Index: kernel/arch/mips32/src/mm/tlb.c
===================================================================
--- kernel/arch/mips32/src/mm/tlb.c	(revision d704d7f038e55dfafc09dc2e9511d26c2bb9cdcb)
+++ kernel/arch/mips32/src/mm/tlb.c	(revision cf538e7f8a69e2cbf42fd5283c5ad34ba51d135f)
@@ -142,4 +142,16 @@
 	index.value = cp0_index_read();
 
+#if defined(PROCESSOR_4Kc)
+	/*
+	 * This can happen on a 4Kc when Status.EXL is 1 and there is a TLB miss.
+	 * EXL is 1 when interrupts are disabled. The combination of a TLB miss
+	 * and disabled interrupts is possible in copy_to/from_uspace().
+	 */
+	if (index.p) {
+		tlb_refill(istate);
+		return;
+	}
+#endif
+
 	ASSERT(!index.p);