By suitably programming lockdown Register, see Lockdown Select Register, and asserting secure_boot_lock signal makes the following registers read only:
By programming the lockdown_select, and lockdown_range registers, and asserting the secure_boot_lock signal, you can lockdown the behavior of the TZASC so that it prevents unintentional or erroneous write to the regions specified in the lockdown_range Register. However, read access to those regions is permitted:
The TZASC expects the secure_boot_lock signal to be asserted for at least one clock cycle. One clock after the secure_boot_lock is sampled HIGH by TZASC, then the registers mentioned in Locking down the region using lockdown_range and lockdown_select registers cannot be written, unless the TZASC is reset by asserting aresetn.