As described in Configuration Lock, from the Overview section, the XMPU_PL configuration registers can be write protected from unauthorized masters, but are still readable. The following figure demonstrates one way to completely isolate the configuration I/F.
Figure 1. Configuration I/F Isolation
Map the S_AXI_XMPU configuration slave port to the M_AXI of the
zupl_xmpu instead of using the Configuration Lock. Either the
static or run-time configuration can define a region to protect the XMPU_PL
configuration from both read and write accesses.
Tip: If using a run-time application to
define the XMPU_PL configuration protection region, ensure that the DefRdAllowed and
DefWrAllowed settings in the CTRL register are set. Otherwise, the run-time application
may not have access to load the region parameters. DefRdAllowed and DefWrAllowed are set
by default.