[test_rom] Unlock ePMP before accessing outside the initial ePMP RX region

Signed-off-by: Alphan Ulusoy <alphan@google.com>
diff --git a/sw/device/lib/testing/test_rom/test_rom_start.S b/sw/device/lib/testing/test_rom/test_rom_start.S
index 11e56c1..26e1da1 100644
--- a/sw/device/lib/testing/test_rom/test_rom_start.S
+++ b/sw/device/lib/testing/test_rom/test_rom_start.S
@@ -196,6 +196,19 @@
          (MULTIBIT_ASM_BOOL4_FALSE << EDN_CTRL_CMD_FIFO_RST_OFFSET)
   sw t0, EDN_CTRL_REG_OFFSET(a0)
 #endif
+  // Remove address space protections by configuring entry 15 as
+  // read-write-execute for the entire address space and then clearing
+  // all other entries.
+  // NOTE: This should happen before attemting to access any address outside
+  // the initial ePMP RX region at reset, e.g. `kDeviceType` which is in
+  // .rodata.
+  li   t0, (0x9f << 24) // Locked NAPOT read-write-execute.
+  csrw pmpcfg3, t0
+  li   t0, 0x7fffffff   // NAPOT encoded region covering entire 34-bit address space.
+  csrw pmpaddr15, t0
+  csrw pmpcfg0, zero
+  csrw pmpcfg1, zero
+  csrw pmpcfg2, zero
 
   // Scramble and initialize main memory (main SRAM).
   // Memory accesses will stall until initialization is complete.
@@ -208,17 +221,6 @@
   sw    t0, SRAM_CTRL_CTRL_REG_OFFSET(a0)
 
 .L_sram_init_skip:
-  // Remove address space protections by configuring entry 15 as
-  // read-write-execute for the entire address space and then clearing
-  // all other entries.
-  li   t0, (0x9f << 24) // Locked NAPOT read-write-execute.
-  csrw pmpcfg3, t0
-  li   t0, -1           // NAPOT encoded region covering entire 32-bit address space.
-  csrw pmpaddr15, t0
-  csrw pmpcfg0, zero
-  csrw pmpcfg1, zero
-  csrw pmpcfg2, zero
-
   // Zero out the `.bss` segment.
   la   a0, _bss_start
   la   a1, _bss_end