diff --git a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
index eecba15678..2e8eea05b5 100644
--- a/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
+++ b/ArmPkg/Library/ArmMmuLib/AArch64/ArmMmuLibCore.c
@@ -20,6 +20,8 @@
 #include <Library/BaseLib.h>
 #include <Library/DebugLib.h>
 #include <Library/HobLib.h>
+#include <Library/PcdLib.h>
+
 #include "ArmMmuLibInternal.h"
 
 STATIC  ARM_REPLACE_LIVE_TRANSLATION_ENTRY  mReplaceLiveEntryFunc = ArmReplaceLiveTranslationEntry;
@@ -456,7 +458,9 @@ GcdAttributeToPageAttribute (
       PageAttributes |= TT_AP_RW_RW;
     }
   } else {
-    PageAttributes |= TT_UXN_MASK;
+    if (PcdGetBool (PcdEnableUserSpace) || (ArmReadCurrentEL () == AARCH64_EL1)) {
+      PageAttributes |= TT_UXN_MASK;
+    }
 
     if ((GcdAttributes & EFI_MEMORY_RO) != 0) {
       PageAttributes |= TT_AP_NO_RO;
@@ -586,7 +590,12 @@ ArmConfigureMmu (
   T0SZ                = 64 - MaxAddressBits;
   RootTableEntryCount = GetRootTableEntryCount (T0SZ);
 
-  if (ArmReadCurrentEL () == AARCH64_EL2) {
+  //
+  // Set TCR that allows us to retrieve T0SZ in the subsequent functions
+  //
+  // Ideally we will be running at EL2, but should support EL1 as well.
+  // UEFI should not run at EL3.
+  if (PcdGetBool (PcdEnableUserSpace) && (ArmReadCurrentEL () == AARCH64_EL2)) {
     //
     // Switch to EL2&0 translation regime.
     //
@@ -597,14 +606,59 @@ ArmConfigureMmu (
     // Allow access to the Advanced SIMD and floating-point registers.
     //
     ArmWriteCptr (AARCH64_CPTR_FPEN);
-  }
 
-  //
-  // Set TCR that allows us to retrieve T0SZ in the subsequent functions
-  //
-  // Ideally we will be running at EL2, but should support EL1 as well.
-  // UEFI should not run at EL3.
-  if ((ArmReadCurrentEL () == AARCH64_EL1) || (ArmReadCurrentEL () == AARCH64_EL2)) {
+    // Due to Cortex-A57 erratum #822227 we must set TG1[1] == 1, regardless of EPD1.
+    TCR = T0SZ | TCR_TG0_4KB | TCR_TG1_4KB | TCR_EPD1;
+
+    // Set the Physical Address Size using MaxAddress
+    if (MaxAddress < SIZE_4GB) {
+      TCR |= TCR_IPS_4GB;
+    } else if (MaxAddress < SIZE_64GB) {
+      TCR |= TCR_IPS_64GB;
+    } else if (MaxAddress < SIZE_1TB) {
+      TCR |= TCR_IPS_1TB;
+    } else if (MaxAddress < SIZE_4TB) {
+      TCR |= TCR_IPS_4TB;
+    } else if (MaxAddress < SIZE_16TB) {
+      TCR |= TCR_IPS_16TB;
+    } else if (MaxAddress < SIZE_256TB) {
+      TCR |= TCR_IPS_256TB;
+    } else {
+      DEBUG ((
+        DEBUG_ERROR,
+        "ArmConfigureMmu: The MaxAddress 0x%lX is not supported by this MMU configuration.\n",
+        MaxAddress
+        ));
+      ASSERT (0); // Bigger than 48-bit memory space are not supported
+      return EFI_UNSUPPORTED;
+    }
+  } else if (ArmReadCurrentEL () == AARCH64_EL2) {
+    // Note: Bits 23 and 31 are reserved(RES1) bits in TCR_EL2
+    TCR = T0SZ | (1UL << 31) | (1UL << 23) | TCR_TG0_4KB;
+
+    // Set the Physical Address Size using MaxAddress
+    if (MaxAddress < SIZE_4GB) {
+      TCR |= TCR_PS_4GB;
+    } else if (MaxAddress < SIZE_64GB) {
+      TCR |= TCR_PS_64GB;
+    } else if (MaxAddress < SIZE_1TB) {
+      TCR |= TCR_PS_1TB;
+    } else if (MaxAddress < SIZE_4TB) {
+      TCR |= TCR_PS_4TB;
+    } else if (MaxAddress < SIZE_16TB) {
+      TCR |= TCR_PS_16TB;
+    } else if (MaxAddress < SIZE_256TB) {
+      TCR |= TCR_PS_256TB;
+    } else {
+      DEBUG ((
+        DEBUG_ERROR,
+        "ArmConfigureMmu: The MaxAddress 0x%lX is not supported by this MMU configuration.\n",
+        MaxAddress
+        ));
+      ASSERT (0); // Bigger than 48-bit memory space are not supported
+      return EFI_UNSUPPORTED;
+    }
+  } else if (ArmReadCurrentEL () == AARCH64_EL1) {
     // Due to Cortex-A57 erratum #822227 we must set TG1[1] == 1, regardless of EPD1.
     TCR = T0SZ | TCR_TG0_4KB | TCR_TG1_4KB | TCR_EPD1;
 
diff --git a/ArmPkg/Library/ArmMmuLib/ArmMmuBaseLib.inf b/ArmPkg/Library/ArmMmuLib/ArmMmuBaseLib.inf
index 510511bd41..babab4dca6 100644
--- a/ArmPkg/Library/ArmMmuLib/ArmMmuBaseLib.inf
+++ b/ArmPkg/Library/ArmMmuLib/ArmMmuBaseLib.inf
@@ -34,15 +34,20 @@
   ArmPkg/ArmPkg.dec
   EmbeddedPkg/EmbeddedPkg.dec
   MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
 
 [LibraryClasses]
   ArmLib
   CacheMaintenanceLib
   HobLib
   MemoryAllocationLib
+  PcdLib
 
 [Guids]
   gArmMmuReplaceLiveTranslationEntryFuncGuid
 
 [Pcd.ARM]
   gArmTokenSpaceGuid.PcdNormalMemoryNonshareableOverride
+
+[Pcd]
+  gEfiMdeModulePkgTokenSpaceGuid.PcdEnableUserSpace          ## CONSUMES
diff --git a/ArmPkg/Library/ArmMmuLib/ArmMmuPeiLib.inf b/ArmPkg/Library/ArmMmuLib/ArmMmuPeiLib.inf
index 37424628aa..be33f6b37a 100644
--- a/ArmPkg/Library/ArmMmuLib/ArmMmuPeiLib.inf
+++ b/ArmPkg/Library/ArmMmuLib/ArmMmuPeiLib.inf
@@ -26,12 +26,17 @@
   ArmPkg/ArmPkg.dec
   EmbeddedPkg/EmbeddedPkg.dec
   MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
 
 [LibraryClasses]
   ArmLib
   CacheMaintenanceLib
   HobLib
   MemoryAllocationLib
+  PcdLib
 
 [Guids]
   gArmMmuReplaceLiveTranslationEntryFuncGuid
+
+[Pcd]
+  gEfiMdeModulePkgTokenSpaceGuid.PcdEnableUserSpace          ## CONSUMES
diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
index 8e8e0435df..906fd05275 100644
--- a/ArmVirtPkg/ArmVirt.dsc.inc
+++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -373,7 +373,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD5
 
   gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard|TRUE
-  gEfiMdeModulePkgTokenSpaceGuid.PcdEnableUserSpace|TRUE
+  gEfiMdeModulePkgTokenSpaceGuid.PcdEnableUserSpace|FALSE
   gEfiMdeModulePkgTokenSpaceGuid.PcdSerialUseMmio|TRUE
 
 [Components.common]