The protection unit is configurable either one time or through multiple accesses. After a boot, the unit can be configured and then its configuration can be locked so that the protection unit can only be reconfigured after an internal or external POR reset. If the registers are not locked, the XPPU can be reconfigured any number of times by secure accesses to support dynamic reconfiguration.
Once the XPPU LOCK [RegWrDis] register bit is set, access to the XPPU registers is disabled and can no longer be written to until after a POR reset. The only exception, secure transaction can write to the interrupt status register, ISR.
The registers are always readable by secure or non-secure transactions.