diff --git a/bl1/aarch64/bl1_exceptions.S b/bl1/aarch64/bl1_exceptions.S
index eb98ffa0df5221671ae3f6934143db7f31ea7761..92313fa31dd5a3a8cfc4eaf109668b04cc09e3aa 100644
--- a/bl1/aarch64/bl1_exceptions.S
+++ b/bl1/aarch64/bl1_exceptions.S
@@ -187,6 +187,7 @@ func smc_handler64
 
 	bl	disable_mmu_icache_el3
 	tlbi	alle3
+	dsb	ish /* ERET implies ISB, so it is not needed here */
 
 #if SPIN_ON_BL1_EXIT
 	bl	print_debug_loop_message
diff --git a/plat/rockchip/rk3328/drivers/pmu/pmu.c b/plat/rockchip/rk3328/drivers/pmu/pmu.c
index f576fe41263f44728b83d53a7fce9a0c708bd0e3..835c3a6b688e5e877ccf65492b23f6efd23216db 100644
--- a/plat/rockchip/rk3328/drivers/pmu/pmu.c
+++ b/plat/rockchip/rk3328/drivers/pmu/pmu.c
@@ -591,8 +591,10 @@ err_loop:
 __sramfunc void sram_suspend(void)
 {
 	/* disable mmu and icache */
-	tlbialle3();
 	disable_mmu_icache_el3();
+	tlbialle3();
+	dsbsy();
+	isb();
 
 	mmio_write_32(SGRF_BASE + SGRF_SOC_CON(1),
 		      ((uintptr_t)&pmu_cpuson_entrypoint >> CPU_BOOT_ADDR_ALIGN) |
diff --git a/services/std_svc/spm/secure_partition_setup.c b/services/std_svc/spm/secure_partition_setup.c
index c1f0edf69ae1f96bc24bdf8d3dad5b0c1c7bca04..6998dae5700b99938cdacf3a799449c2677df7db 100644
--- a/services/std_svc/spm/secure_partition_setup.c
+++ b/services/std_svc/spm/secure_partition_setup.c
@@ -54,6 +54,7 @@ void secure_partition_setup(void)
 
 	/* Invalidate TLBs at EL1. */
 	tlbivmalle1();
+	dsbish();
 
 	/*
 	 * General-Purpose registers