Index: Makefile
--- Makefile.orig
+++ Makefile
@@ -409,6 +409,8 @@ endif
 
 GCC_V_OUTPUT		:=	$(shell $(CC) -v 2>&1)
 
+TF_LDFLAGS		+=	-z noexecstack
+
 # LD = armlink
 ifneq ($(findstring armlink,$(notdir $(LD))),)
 TF_LDFLAGS		+=	--diag_error=warning --lto_level=O1
@@ -435,6 +437,9 @@ TF_LDFLAGS		+=	$(subst --,-Xlinker --,$(TF_LDFLAGS_$(A
 
 # LD = gcc-ld (ld) or llvm-ld (ld.lld) or other
 else
+# With ld.bfd version 2.39 and newer new warnings are added. Skip those since we
+# are not loaded by a elf loader.
+TF_LDFLAGS		+=	$(call ld_option, --no-warn-rwx-segments)
 TF_LDFLAGS		+=	--fatal-warnings -O1
 TF_LDFLAGS		+=	--gc-sections
 # ld.lld doesn't recognize the errata flags,
@@ -1086,6 +1091,12 @@ $(eval $(call assert_numerics,\
         TWED_DELAY \
         ENABLE_FEAT_TWED \
 )))
+
+# Convenience function to check for a given linker option. An call to
+# $(call ld_option, --no-XYZ) will return --no-XYZ if supported by the linker
+define ld_option
+        $(shell if $(LD) $(1) -v >/dev/null 2>&1; then echo $(1); fi )
+endef
 
 ifdef KEY_SIZE
         $(eval $(call assert_numeric,KEY_SIZE))