diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 6850d67b6875..8056c917efb1 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -232,8 +232,6 @@ typedef enum powerpc_mmu_t {
      * keywords: tlbld tlbli TLBMISS PTEHI PTELO)
      */
     POWERPC_MMU_SOFT_74xx  = 0x00000003,
-    /* PowerPC 4xx MMU with software TLB                       */
-    POWERPC_MMU_SOFT_4xx   = 0x00000004,
     /* PowerPC MMU in real mode only                           */
     POWERPC_MMU_REAL       = 0x00000006,
     /* Freescale MPC8xx MMU model                              */
@@ -2146,7 +2144,6 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_7XX_UPMC3         (0x3AD)
 #define SPR_7XX_UPMC4         (0x3AE)
 #define SPR_USDA              (0x3AF)
-#define SPR_40x_ZPR           (0x3B0)
 #define SPR_BOOKE_MAS7        (0x3B0)
 #define SPR_74XX_MMCR2        (0x3B0)
 #define SPR_7XX_PMC5          (0x3B1)
@@ -2181,13 +2178,10 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_BOOKE_ICDBDR      (0x3D3)
 #define SPR_TLBMISS           (0x3D4)
 #define SPR_IMISS             (0x3D4)
-#define SPR_40x_ESR           (0x3D4)
 #define SPR_PTEHI             (0x3D5)
 #define SPR_ICMP              (0x3D5)
-#define SPR_40x_DEAR          (0x3D5)
 #define SPR_PTELO             (0x3D6)
 #define SPR_RPA               (0x3D6)
-#define SPR_40x_EVPR          (0x3D6)
 #define SPR_L3PM              (0x3D7)
 #define SPR_403_CDBCR         (0x3D7)
 #define SPR_L3ITCR0           (0x3D8)
diff --git a/target/ppc/mmu-booke.h b/target/ppc/mmu-booke.h
index f972843bbb7b..dcbfac2caefe 100644
--- a/target/ppc/mmu-booke.h
+++ b/target/ppc/mmu-booke.h
@@ -4,9 +4,6 @@
 #include "cpu.h"
 
 int ppcemb_tlb_search(CPUPPCState *env, target_ulong address, uint32_t pid);
-int mmu40x_get_physical_address(CPUPPCState *env, hwaddr *raddr, int *prot,
-                                target_ulong address,
-                                MMUAccessType access_type);
 hwaddr booke206_tlb_to_page_size(CPUPPCState *env, ppcmas_tlb_t *tlb);
 int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb, hwaddr *raddrp,
                      target_ulong address, uint32_t pid);
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 1a4c0ae5c0f0..b795d1969d01 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -3040,9 +3040,6 @@ void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     insn = ppc_ldl_code(env, env->nip);
 
     switch (env->mmu_model) {
-    case POWERPC_MMU_SOFT_4xx:
-        env->spr[SPR_40x_DEAR] = vaddr;
-        break;
     case POWERPC_MMU_BOOKE:
     case POWERPC_MMU_BOOKE206:
         env->spr[SPR_BOOKE_DEAR] = vaddr;
diff --git a/target/ppc/mmu-booke.c b/target/ppc/mmu-booke.c
index 55e5dd7c6b0c..3bb721c3d2c6 100644
--- a/target/ppc/mmu-booke.c
+++ b/target/ppc/mmu-booke.c
@@ -68,69 +68,6 @@ int ppcemb_tlb_search(CPUPPCState *env, target_ulong address, uint32_t pid)
     return -1;
 }
 
-int mmu40x_get_physical_address(CPUPPCState *env, hwaddr *raddr, int *prot,
-                                target_ulong address,
-                                MMUAccessType access_type)
-{
-    ppcemb_tlb_t *tlb;
-    int i, ret, zsel, zpr, pr;
-
-    ret = -1;
-    pr = FIELD_EX64(env->msr, MSR, PR);
-    for (i = 0; i < env->nb_tlb; i++) {
-        tlb = &env->tlb.tlbe[i];
-        if (!ppcemb_tlb_check(env, tlb, raddr, address,
-                              env->spr[SPR_40x_PID], i)) {
-            continue;
-        }
-        zsel = (tlb->attr >> 4) & 0xF;
-        zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
-        qemu_log_mask(CPU_LOG_MMU,
-                      "%s: TLB %d zsel %d zpr %d ty %d attr %08x\n",
-                      __func__, i, zsel, zpr, access_type, tlb->attr);
-        /* Check execute enable bit */
-        switch (zpr) {
-        case 0x2:
-            if (pr != 0) {
-                goto check_perms;
-            }
-            /* fall through */
-        case 0x3:
-            /* All accesses granted */
-            *prot = PAGE_RWX;
-            ret = 0;
-            break;
-
-        case 0x0:
-            if (pr != 0) {
-                /* Raise Zone protection fault.  */
-                env->spr[SPR_40x_ESR] = 1 << 22;
-                *prot = 0;
-                ret = -2;
-                break;
-            }
-            /* fall through */
-        case 0x1:
-check_perms:
-            /* Check from TLB entry */
-            *prot = tlb->prot;
-            if (check_prot_access_type(*prot, access_type)) {
-                ret = 0;
-            } else {
-                env->spr[SPR_40x_ESR] = 0;
-                ret = -2;
-            }
-            break;
-        }
-    }
-    qemu_log_mask(CPU_LOG_MMU, "%s: access %s " TARGET_FMT_lx " => "
-                  HWADDR_FMT_plx " %d %d\n",  __func__,
-                  ret < 0 ? "refused" : "granted", address,
-                  ret < 0 ? 0 : *raddr, *prot, ret);
-
-    return ret;
-}
-
 static bool mmubooke_check_pid(CPUPPCState *env, ppcemb_tlb_t *tlb,
                                hwaddr *raddr, target_ulong addr, int i)
 {
diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
index fb62b947f1d9..1748d088ac15 100644
--- a/target/ppc/mmu_common.c
+++ b/target/ppc/mmu_common.c
@@ -599,74 +599,6 @@ static bool ppc_real_mode_xlate(PowerPCCPU *cpu, vaddr eaddr,
     return false;
 }
 
-static bool ppc_40x_xlate(PowerPCCPU *cpu, vaddr eaddr,
-                          MMUAccessType access_type,
-                          hwaddr *raddrp, int *psizep, int *protp,
-                          int mmu_idx, bool guest_visible)
-{
-    CPUState *cs = CPU(cpu);
-    CPUPPCState *env = &cpu->env;
-    int ret;
-
-    if (ppc_real_mode_xlate(cpu, eaddr, access_type, raddrp, psizep, protp)) {
-        return true;
-    }
-
-    ret = mmu40x_get_physical_address(env, raddrp, protp, eaddr, access_type);
-    if (ret == 0) {
-        *psizep = TARGET_PAGE_BITS;
-        return true;
-    } else if (!guest_visible) {
-        return false;
-    }
-
-    log_cpu_state_mask(CPU_LOG_MMU, cs, 0);
-    if (access_type == MMU_INST_FETCH) {
-        switch (ret) {
-        case -1:
-            /* No matches in page tables or TLB */
-            cs->exception_index = POWERPC_EXCP_ITLB;
-            env->error_code = 0;
-            env->spr[SPR_40x_DEAR] = eaddr;
-            env->spr[SPR_40x_ESR] = 0x00000000;
-            break;
-        case -2:
-            /* Access rights violation */
-            cs->exception_index = POWERPC_EXCP_ISI;
-            env->error_code = 0x08000000;
-            break;
-        default:
-            g_assert_not_reached();
-        }
-    } else {
-        switch (ret) {
-        case -1:
-            /* No matches in page tables or TLB */
-            cs->exception_index = POWERPC_EXCP_DTLB;
-            env->error_code = 0;
-            env->spr[SPR_40x_DEAR] = eaddr;
-            if (access_type == MMU_DATA_STORE) {
-                env->spr[SPR_40x_ESR] = 0x00800000;
-            } else {
-                env->spr[SPR_40x_ESR] = 0x00000000;
-            }
-            break;
-        case -2:
-            /* Access rights violation */
-            cs->exception_index = POWERPC_EXCP_DSI;
-            env->error_code = 0;
-            env->spr[SPR_40x_DEAR] = eaddr;
-            if (access_type == MMU_DATA_STORE) {
-                env->spr[SPR_40x_ESR] |= 0x00800000;
-            }
-            break;
-        default:
-            g_assert_not_reached();
-        }
-    }
-    return false;
-}
-
 static bool ppc_6xx_xlate(PowerPCCPU *cpu, vaddr eaddr,
                           MMUAccessType access_type,
                           hwaddr *raddrp, int *psizep, int *protp,
@@ -832,9 +764,6 @@ bool ppc_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
     case POWERPC_MMU_BOOKE206:
         return ppc_booke_xlate(cpu, eaddr, access_type, raddrp,
                                psizep, protp, mmu_idx, guest_visible);
-    case POWERPC_MMU_SOFT_4xx:
-        return ppc_40x_xlate(cpu, eaddr, access_type, raddrp,
-                             psizep, protp, mmu_idx, guest_visible);
     case POWERPC_MMU_SOFT_6xx:
         return ppc_6xx_xlate(cpu, eaddr, access_type, raddrp,
                              psizep, protp, mmu_idx, guest_visible);
diff --git a/target/ppc/mmu_helper.c b/target/ppc/mmu_helper.c
index faa4522ec8b0..36e06de0e36c 100644
--- a/target/ppc/mmu_helper.c
+++ b/target/ppc/mmu_helper.c
@@ -107,19 +107,6 @@ static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
     env->last_way = way;
 }
 
-/* Helpers specific to PowerPC 40x implementations */
-static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
-{
-    ppcemb_tlb_t *tlb;
-    int i;
-
-    for (i = 0; i < env->nb_tlb; i++) {
-        tlb = &env->tlb.tlbe[i];
-        tlb->prot &= ~PAGE_VALID;
-    }
-    tlb_flush(env_cpu(env));
-}
-
 static void booke206_flush_tlb(CPUPPCState *env, int flags,
                                const int check_iprot)
 {
@@ -258,9 +245,6 @@ void ppc_tlb_invalidate_all(CPUPPCState *env)
     case POWERPC_MMU_SOFT_6xx:
         ppc6xx_tlb_invalidate_all(env);
         break;
-    case POWERPC_MMU_SOFT_4xx:
-        ppc4xx_tlb_invalidate_all(env);
-        break;
     case POWERPC_MMU_REAL:
         cpu_abort(env_cpu(env), "No TLB for PowerPC 4xx in real mode\n");
         break;
