On a sabre lite (i.MX6Q), we managed to access the SNVS HPCOMR register from a secure application and change the bit 31 (NPSWA_EN) from 0 to 1. That is, from PL0, which I consider unprivileged.
The RM states:
The SNVS_HP Command Register contains the command, configuration, and control bits for the SNVS block. This is a privileged write register.
Since the HPCOMR bit was 0, I didn't expect a userland application to be able to write to it, since it's protected.
Is my understanding of 'privileged' for the SNVS_HP register wrong ? Can someone explain this behavior ?