Index: kernel/arch/mips32/src/mm/tlb.c
===================================================================
--- kernel/arch/mips32/src/mm/tlb.c	(revision bcad855c010b3c34d90af0e20b0fb4bbff0f638c)
+++ kernel/arch/mips32/src/mm/tlb.c	(revision cf538e7f8a69e2cbf42fd5283c5ad34ba51d135f)
@@ -142,4 +142,16 @@
 	index.value = cp0_index_read();
 
+#if defined(PROCESSOR_4Kc)
+	/*
+	 * This can happen on a 4Kc when Status.EXL is 1 and there is a TLB miss.
+	 * EXL is 1 when interrupts are disabled. The combination of a TLB miss
+	 * and disabled interrupts is possible in copy_to/from_uspace().
+	 */
+	if (index.p) {
+		tlb_refill(istate);
+		return;
+	}
+#endif
+
 	ASSERT(!index.p);