How do I flush the TLB?
tlbie, and perhaps tlbsync.
The QEMU TLB only caches existing translations, never misses.
I'm not sure what you mean here? No PowerPC hardware that I know of stores a "this address doesn't go anywhere" tag in the TLB, either (I don't think the architecture allows that even).
I also don't see what it has to do with the problem. The scenario what we think is happening: the CPU has translations for the OF code space in its TLB, because it has run it before. The kernel removes the translations but doesn't do TLBIE on those. On real hardware, the TLB entries are still used. What does QEMU do?
Segher