diff -r c37825de3414 -r f5cb3abbb62b src/arch/x86/tlb.hh
--- a/src/arch/x86/tlb.hh	Sun Oct 25 23:13:03 2015 -0500
+++ b/src/arch/x86/tlb.hh	Mon Oct 26 12:25:33 2015 -0500
@@ -93,6 +93,8 @@
 
         void flushNonGlobal();
 
+        void flushOne(TlbEntry *entry);
+
         void demapPage(Addr va, uint64_t asn) override;
 
       protected:
diff -r c37825de3414 -r f5cb3abbb62b src/arch/x86/tlb.cc
--- a/src/arch/x86/tlb.cc	Sun Oct 25 23:13:03 2015 -0500
+++ b/src/arch/x86/tlb.cc	Mon Oct 26 12:25:33 2015 -0500
@@ -162,6 +162,14 @@
 }
 
 void
+TLB::flushOne(TlbEntry *entry)
+{
+    trie.remove(entry->trieHandle);
+    entry->trieHandle = NULL;
+    freeList.push_back(entry);
+}
+
+void
 TLB::demapPage(Addr va, uint64_t asn)
 {
     TlbEntry *entry = trie.lookup(va);
@@ -386,12 +394,14 @@
                 // The page must have been present to get into the TLB in
                 // the first place. We'll assume the reserved bits are
                 // fine even though we're not checking them.
+                flushOne(entry);
                 return std::make_shared<PageFault>(vaddr, true, mode, inUser,
                                                    false);
             }
             if (storeCheck && badWrite) {
                 // This would fault if this were a write, so return a page
                 // fault that reflects that happening.
+                flushOne(entry);
                 return std::make_shared<PageFault>(vaddr, true, Write, inUser,
                                                    false);
             }