GPIO manipulation on A55 core of IMX93 with JTAG

I'm working on a custom board using an NXP IMX93 (which contains an A55 core).

Using JLink and this script I can connect

Log "C:\temp\yocto\JLink\jlink.log" 
device MIMX9352_A55_0 
si JTAG 
speed 4000 
jtagconf -1,-1 
connect 
halt 
RsetType 0 
reset 
ShowHWStatus 
 	
mem32 AP1:47000050,1 

I am able to connect to it with JTAG and can get some output:

SEGGER J-Link Commander V7.98c (Compiled Aug 7 2024 15:41:14)
DLL version V7.98c, compiled Aug 7 2024 15:40:25


J-Link Command File read successfully.
Processing script file...
J-Link>Log "C:\temp\yocto\JLink\jlink.log"
J-Link connection not established yet but required for command.
Connecting to J-Link via USB...O.K.
Firmware: J-Link V11 compiled May 28 2024 15:36:02
Hardware version: V11.00
J-Link uptime (since boot): 0d 00h 41m 23s
S/N:xxxxxxx
License(s): GDB
USB speed mode: High speed (480 MBit/s)
VTref=1.800V (fixed)
J-Link>device MIMX9352_A55_0
J-Link>si JTAG
Selecting JTAG as current target interface.
J-Link>speed 4000
Selecting 4000 kHz as target interface speed
J-Link>jtagconf -1,-1
J-Link>connect
Device "MIMX9352_A55_0" selected.


Connecting to target via JTAG
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 28us
TotalIRLen = 4, IRPrint = 0x01
JTAG chain detection found 1 devices:
#0 Id: 0x0892801D, IRLen: 04, JTAG-DP
DPv0 detected
AP map detection skipped. Manually configured AP map found.
AP[0]: AHB-AP (IDR: Not set)
AP[1]: APB-AP (IDR: Not set)
Using preconfigured AP[1] as APB-AP
AP[1]: APB-AP found
DebugRegs + CTI manually specified. ROM table scan skipped.
Cortex-A55 @ 0x80810000 (configured)
CoreCTI @ 0x80820000 (configured)
Debug architecture: ARMv8.2
6 code breakpoints, 4 data breakpoints
Processor features:
EL0 support: AArch64 + AArch32
EL1 support: AArch64 + AArch32
EL2 support: AArch64 + AArch32
EL3 support: AArch64 + AArch32
FPU support: Single + Double + Conversion + single arithmetic
ARMv8-A/R: The connected J-Link (S/N 821013450) uses an old firmware module V10 with known problems / limitations.
Add. info (CPU temp. halted)
Current exception level: EL3
Exception level AArch usage:
EL0: AArch32
EL1: AArch32
EL2: AArch32
EL3: AArch64
Non-secure status: Secure
Cache info:
Inner cache boundary: L3
LoU Uniprocessor: 0
LoC: 3
LoU Inner Shareable: 0
I-Cache L1: 32 KB, 128 Sets, 64 Bytes/Line, 4-Way
D-Cache L1: 32 KB, 128 Sets, 64 Bytes/Line, 4-Way
Unified-Cache L2: 64 KB, 256 Sets, 64 Bytes/Line, 4-Way
Unified-Cache L3: 256 KB, 256 Sets, 64 Bytes/Line, 16-Way
VMSAv8-64: Supports 48-bit VAs
Memory zones:
Zone: "Default" Description: Default access mode
Zone: "AP0" Description: MEM-AP (AHB-AP)
Zone: "AP1" Description: MEM-AP (APB-AP)
Cortex-A55 identified.
J-Link>halt
PC = 000000000000BB78
CPSR = 400002CD (AArch64, EL3h (SP_EL3) mode, IRQ masked, FIQ masked)
SP = 000000002048FDA0
ELR_EL1 = 0000000000000000 ELR_EL2 = 0000000000000000
ELR_EL3 = 0000000000000000
SP_EL0 = 0000000000000000 SP_EL1 = 0000000000000000
SP_EL2 = 0000000000000000 SP_EL3 = 000000002048FDA0
R0 = 0000000000000000, R1 = 000000002048FDC0
R2 = 0000000000000000, R3 = 0000000000000000
R4 = 0000000000000000, R5 = 0000000000000000
R6 = 0000000000000000, R7 = 0000000000000000
R8 = 00000000425E0014, R9 = 000000002048FE00
R10 = 0000000000000004, R11 = 0000000000000040
R12 = 0000000000000001, R13 = 0000000000000001
R14 = 0000000007000000, R15 = 0000000000000109
R16 = 0000000000000000, R17 = 0000000000000000
R18 = 0000000000000000, R19 = 0000000000000000
R20 = 0000000000000000, R21 = 0000000000000000
R22 = 000000002048FE00, R23 = 000000002048FDFC
R24 = 000000002048FDF8, R25 = 0000000000000001
R26 = 0000000000000001, R27 = 0000000000000000
R28 = 0000000000000000, R29 = 0000000000000000
R30 = 000000000000C11C, R31 = 0000000000000000
JMISC = 0000000000000008
J-Link>RsetType 0
Reset type NORMAL: Reset CPU + peripherals via reset pin. CPU halted immediately after reset.
J-Link>reset
Reset delay: 0 ms
Reset type NORMAL: Reset CPU + peripherals via reset pin. CPU halted immediately after reset.
ResetTarget() start
No Reset strategy is implemented. Reset will be skipped.
ResetTarget() end - Took 65us
J-Link>ShowHWStatus
VTref=1.800V (fixed)
ITarget=0mA
TCK=1 TDI=0 TDO=0 TMS=0 TRES=0 TRST=1
Supported target interface speeds:
- 180 MHz/n, (n>=12). => 15000kHz, 13846kHz, 12857kHz, ...
- Adaptive clocking
J-Link>mem32 AP1:47000050,1
47000050 = 00000000

Script processing completed.



Type "connect" to establish a target connection, '?' for help
J-Link>

However, I'm trying to read certain input GPIO lines, and write to certain output GPIO lines but only seem to get a value of zero. And when I attempt to write to a port set, port clear such as at 47400000h it seems to have no effect. Could this be due to the exception level? I'm currently at EL3 and secure state is Secure. 

Current exception level: EL3
Exception level AArch usage:
EL0: AArch32
EL1: AArch32
EL2: AArch32
EL3: AArch64
Non-secure status: Secure

I realise the A55 is intended to boot from a secure image and not really meant for bare-metal development, but such a simple task would surely be possible somehow? And if GPIO can be addressed, some IC2 comms would also be useful.

I am able to build and deploy a linux images for an EVK board built with Yocto ok, but I'm not yet certain the external SRAM, Flash or even the USB port is quite functioning correctly on our board, otherwise using UUU and Uboot would be the obvious option.