diff --git a/bl31/context_mgmt.c b/bl31/context_mgmt.c
index 6d405343093c6a4c55c53c1cb09b7d8a5a3692af..2b619aaa568312b3bd3e15b44b0d82f6b9bd8d66 100644
--- a/bl31/context_mgmt.c
+++ b/bl31/context_mgmt.c
@@ -330,6 +330,14 @@ void cm_prepare_el3_exit(uint32_t security_state)
 			/* Set VPIDR, VMPIDR to match MIDR, MPIDR */
 			write_vpidr_el2(read_midr_el1());
 			write_vmpidr_el2(read_mpidr_el1());
+
+			/*
+			 * Reset VTTBR_EL2.
+			 * Needed because cache maintenance operations depend on
+			 * the VMID even when non-secure EL1&0 stage 2 address
+			 * translation are disabled.
+			 */
+			write_vttbr_el2(0);
 		}
 	}
 
diff --git a/include/lib/aarch64/arch_helpers.h b/include/lib/aarch64/arch_helpers.h
index 43c6917e45c6109465b572857426330f4fe9f918..067b8302046445ecbb0a24058cc087a3fd1619c0 100644
--- a/include/lib/aarch64/arch_helpers.h
+++ b/include/lib/aarch64/arch_helpers.h
@@ -270,6 +270,8 @@ DEFINE_SYSREG_RW_FUNCS(ttbr0_el3)
 
 DEFINE_SYSREG_RW_FUNCS(ttbr1_el1)
 
+DEFINE_SYSREG_RW_FUNCS(vttbr_el2)
+
 DEFINE_SYSREG_RW_FUNCS(cptr_el2)
 DEFINE_SYSREG_RW_FUNCS(cptr_el3)