diff --git a/target-mips/helper.c b/target-mips/helper.c
index 87a6a33..c1a7792 100644
--- a/target-mips/helper.c
+++ b/target-mips/helper.c
@@ -130,11 +130,11 @@
 
     if (address <= (int32_t)0x7FFFFFFFUL) {
         /* useg */
-        if (!(env->CP0_Status & (1 << CP0St_ERL) && user_mode)) {
-            ret = env->map_address(env, physical, prot, address, rw, access_type);
-        } else {
+        if (env->CP0_Status & (1 << CP0St_ERL)) {
             *physical = address & 0xFFFFFFFF;
             *prot = PAGE_READ | PAGE_WRITE;
+        } else {
+            ret = env->map_address(env, physical, prot, address, rw, access_type);
         }
 #ifdef TARGET_MIPS64
 /*
diff --git a/target-mips/op.c b/target-mips/op.c
index 715c355..4aa63e3 100644
--- a/target-mips/op.c
+++ b/target-mips/op.c
@@ -297,7 +297,7 @@
    with Status_UX = 0 should be casted to 32-bit and sign extended.
    See the MIPS64 PRA manual, section 4.10. */
 #ifdef TARGET_MIPS64
-    if ((env->CP0_Status & (1 << CP0St_UM)) &&
+    if ((env->hflags & MIPS_HFLAG_UM) &&
         !(env->CP0_Status & (1 << CP0St_UX)))
         T0 = (int64_t)(int32_t)(T0 + T1);
     else
@@ -1608,7 +1608,7 @@
 void op_cp0_enabled(void)
 {
     if (!(env->CP0_Status & (1 << CP0St_CU0)) &&
-	(env->hflags & MIPS_HFLAG_UM)) {
+        (env->hflags & MIPS_HFLAG_UM)) {
         CALL_FROM_TB2(do_raise_exception_err, EXCP_CpU, 0);
     }
     RETURN();