diff --git a/payloads/libpayload/arch/arm64/mmu.c b/payloads/libpayload/arch/arm64/mmu.c
index e2a0cb18b6..f07e4c435c 100644
--- a/payloads/libpayload/arch/arm64/mmu.c
+++ b/payloads/libpayload/arch/arm64/mmu.c
@@ -91,6 +91,7 @@ static uint64_t get_block_attr(unsigned long tag)
 		break;
 	case TYPE_DEV_MEM:
 		attr |= BLOCK_INDEX_MEM_DEV_NGNRNE << BLOCK_INDEX_SHIFT;
+		attr |= BLOCK_XN;
 		break;
 	case TYPE_DMA_MEM:
 		attr |= BLOCK_INDEX_MEM_NORMAL_NC << BLOCK_INDEX_SHIFT;
diff --git a/payloads/libpayload/include/arm64/arch/mmu.h b/payloads/libpayload/include/arm64/arch/mmu.h
index 30a1973cf7..2f87d09681 100644
--- a/payloads/libpayload/include/arm64/arch/mmu.h
+++ b/payloads/libpayload/include/arm64/arch/mmu.h
@@ -72,6 +72,8 @@ extern char _start[], _end[];
 
 #define BLOCK_ACCESS               (1 << 10)
 
+#define BLOCK_XN                   (1UL << 54)
+
 #define BLOCK_SH_SHIFT                 (8)
 #define BLOCK_SH_NON_SHAREABLE         (0 << BLOCK_SH_SHIFT)
 #define BLOCK_SH_UNPREDICTABLE         (1 << BLOCK_SH_SHIFT)
diff --git a/src/arch/arm64/armv8/mmu.c b/src/arch/arm64/armv8/mmu.c
index a3e8d7758a..5c95e96581 100644
--- a/src/arch/arm64/armv8/mmu.c
+++ b/src/arch/arm64/armv8/mmu.c
@@ -76,6 +76,7 @@ static uint64_t get_block_attr(unsigned long tag)
 			attr |= BLOCK_INDEX_MEM_NORMAL << BLOCK_INDEX_SHIFT;
 	} else {
 		attr |= BLOCK_INDEX_MEM_DEV_NGNRNE << BLOCK_INDEX_SHIFT;
+		attr |= BLOCK_XN;
 	}
 
 	return attr;
diff --git a/src/arch/arm64/include/armv8/arch/mmu.h b/src/arch/arm64/include/armv8/arch/mmu.h
index f5111aef88..f697ddb8ae 100644
--- a/src/arch/arm64/include/armv8/arch/mmu.h
+++ b/src/arch/arm64/include/armv8/arch/mmu.h
@@ -56,6 +56,8 @@
 
 #define BLOCK_ACCESS               (1 << 10)
 
+#define BLOCK_XN                   (1UL << 54)
+
 #define BLOCK_SH_SHIFT                 (8)
 #define BLOCK_SH_NON_SHAREABLE         (0 << BLOCK_SH_SHIFT)
 #define BLOCK_SH_UNPREDICTABLE         (1 << BLOCK_SH_SHIFT)