diff --git a/ArmPkg/Include/Chipset/ArmV7Mmu.h b/ArmPkg/Include/Chipset/ArmV7Mmu.h
index aaa0977205..e38c5f7b05 100644
--- a/ArmPkg/Include/Chipset/ArmV7Mmu.h
+++ b/ArmPkg/Include/Chipset/ArmV7Mmu.h
@@ -192,6 +192,7 @@
                                                             TT_DESCRIPTOR_SECTION_S_NOT_SHARED                      | \
                                                             TT_DESCRIPTOR_SECTION_DOMAIN(0)                         | \
                                                             TT_DESCRIPTOR_SECTION_AP_RW_RW                          | \
+                                                            TT_DESCRIPTOR_SECTION_XN_MASK                           | \
                                                             TT_DESCRIPTOR_SECTION_CACHE_POLICY_SHAREABLE_DEVICE)
 #define TT_DESCRIPTOR_SECTION_UNCACHED(NonSecure)          (TT_DESCRIPTOR_SECTION_TYPE_SECTION                                                           | \
                                                            ((NonSecure) ?  TT_DESCRIPTOR_SECTION_NS : 0)    | \
@@ -215,6 +216,7 @@
                                                         TT_DESCRIPTOR_PAGE_NG_GLOBAL                                                      | \
                                                         TT_DESCRIPTOR_PAGE_S_NOT_SHARED                                                   | \
                                                         TT_DESCRIPTOR_PAGE_AP_RW_RW                                                       | \
+                                                        TT_DESCRIPTOR_PAGE_XN_MASK                                                        | \
                                                         TT_DESCRIPTOR_PAGE_CACHE_POLICY_SHAREABLE_DEVICE)
 #define TT_DESCRIPTOR_PAGE_UNCACHED                (TT_DESCRIPTOR_PAGE_TYPE_PAGE                                                           | \
                                                         TT_DESCRIPTOR_PAGE_NG_GLOBAL                                                      | \
diff --git a/ArmPkg/Library/ArmLib/AArch64/AArch64Mmu.c b/ArmPkg/Library/ArmLib/AArch64/AArch64Mmu.c
index c8b3d4a121..377a7858d4 100644
--- a/ArmPkg/Library/ArmLib/AArch64/AArch64Mmu.c
+++ b/ArmPkg/Library/ArmLib/AArch64/AArch64Mmu.c
@@ -50,7 +50,10 @@ ArmMemoryAttributeToPageAttribute (
     ASSERT(0);
   case ARM_MEMORY_REGION_ATTRIBUTE_DEVICE:
   case ARM_MEMORY_REGION_ATTRIBUTE_NONSECURE_DEVICE:
-    return TT_ATTR_INDX_DEVICE_MEMORY;
+    if (ArmReadCurrentEL () == AARCH64_EL2)
+      return TT_ATTR_INDX_DEVICE_MEMORY | TT_TABLE_XN;
+    else
+      return TT_ATTR_INDX_DEVICE_MEMORY | TT_TABLE_UXN | TT_TABLE_PXN;
   }
 }
 
diff --git a/ArmPkg/Library/ArmLib/ArmV7/ArmV7Mmu.c b/ArmPkg/Library/ArmLib/ArmV7/ArmV7Mmu.c
index 1287dfb1a9..e05a51e0d9 100644
--- a/ArmPkg/Library/ArmLib/ArmV7/ArmV7Mmu.c
+++ b/ArmPkg/Library/ArmLib/ArmV7/ArmV7Mmu.c
@@ -294,7 +294,7 @@ ArmConfigureMmu (
                              DOMAIN_ACCESS_CONTROL_NONE( 3) |
                              DOMAIN_ACCESS_CONTROL_NONE( 2) |
                              DOMAIN_ACCESS_CONTROL_NONE( 1) |
-                             DOMAIN_ACCESS_CONTROL_MANAGER(0));
+                             DOMAIN_ACCESS_CONTROL_CLIENT(0));
 
   ArmEnableInstructionCache();
   ArmEnableDataCache();