diff --git a/bin/merge.sh b/bin/merge.sh
index fb132049eb..e7e2e8bbdf 100755
--- a/bin/merge.sh
+++ b/bin/merge.sh
@@ -40,6 +40,16 @@ usage() {
 }
 
 
+die() {
+
+  scriptname=$0
+  message=$1
+  echo "$scriptname: error: $message"
+  exit 1
+
+}
+
+
 merge_cv32e40s_into_cv32e40x-dv () {
 
   echo $'\n======= Merge of cv32e40s into cv32e40x-dv: =======\n'
@@ -158,8 +168,8 @@ rejection_diff() {
   branch_name_merge_normal=$(git branch | grep 'merge')
   branch_name_merge_theirs=$(echo $branch_name_merge_normal | sed 's/merge/theirs/')
 
-  git checkout main
-  git checkout -B $branch_name_merge_theirs
+  git checkout main  ||  die "can't checkout main"
+  git checkout -B $branch_name_merge_theirs  ||  die "can't create branch"
   git merge -X theirs $branch_name_40s_subtree
 
   move_files_40s_into_40x
diff --git a/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.csv b/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.csv
index 63683ff06a..ff2ed0e205 100644
--- a/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.csv
+++ b/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.csv
@@ -14,7 +14,7 @@ UM v0.3.0 Common,Constraints,Privilege Modes,CLIC interrupts only support machin
 Assume on input for formal",Assertion Check,"ENV capability, not specific test",Functional Coverage,a_clic_mode_only
 UM v0.3.0 Common,Constraints,NMI,"NMI address is located at the 15th entry in the machine trap vector table, located at mtvec. In other words, nmi_addr = { mtvec[31:7], 5'b0_1111, 2'b00 }","Assert that nmi addr = { mtvec[31:7], 5'b0_1111, 2'b00 }",Assertion Check,"ENV capability, not specific test",Functional Coverage,a_nmi_to_mtvec_offset
 UM v0.3.0 Common,Constraints,Interrupts,Support up to a maximum of 1024 CLIC interrupts,Assert that SMCLIC_ID_WIDTH is inside { 1 .. 10 },Assertion Check,"ENV capability, not specific test",Functional Coverage,a_clic_valid_setting
-UM v0.3.0 Common,Constraints,Interrupts,Interrupt levels inside { 0 .. 255 },Correct functionality of interrupts of all valid levels,Check against RM,Constrained-Random,Functional Coverage,"Missing covergroup, vc should use all interrupt levels"
+UM v0.3.0 Common,Constraints,Interrupts,Interrupt levels inside { 0 .. 255 },Correct functionality of interrupts of all valid levels,Check against RM,Constrained-Random,Functional Coverage,clic_cg.cp_lvl
 UM v0.3.0 Common,Constraints,Input ports,irq_i[31:0] tied to zero,Assert that non-clic irq[31:0] signals are tied to 0,Assertion Check,"ENV capability, not specific test",Functional Coverage,a_tieoff_zero_irq_i
 Silabs Internal,Eventually taken,Interrupt taken,"An interrupt that is both pending and enabled shall be taken, unless if the core is in debug mode or is blocked by external interfaces (rvalid, fence_flush_ack, etc), and the taking happens within a fixed number of cycles","Check that when conditions are right, then the interrupt gets taken within expected time",Assertion Check,"ENV capability, not specific test",Functional Coverage,"Waived on top level verification due to lack of visibility and precise specification of what prevents interrupts from being taken, and there exist no definite bound. 
 
diff --git a/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.json b/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.json
index 31fe7aaf06..8eda35f479 100644
--- a/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.json
+++ b/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.json
@@ -85,7 +85,7 @@
         "Pass/Fail Criteria": "Check against RM",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "Link to Coverage": "Missing covergroup, vc should use all interrupt levels"
+        "Link to Coverage": "clic_cg.cp_lvl"
     },
     {
         "Requirement Location": "UM v0.3.0 Common",
diff --git a/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.xlsx b/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.xlsx
index 73ee087bab..49e6523ea6 100644
Binary files a/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.xlsx and b/cv32e40s/docs/VerifPlans/Simulation/interrupts/CV32E40SX_CLIC.xlsx differ
diff --git a/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.csv b/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.csv
index a5ddbacddd..70665cc859 100644
--- a/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.csv
+++ b/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.csv
@@ -1,223 +1,305 @@
 Requirement Location,Feature,Sub Feature,Feature Description,Verification Goal,Pass/Fail Criteria,Test Type,Coverage Method,High Priority?,Link to Coverage,Comment
-,Comments,SmepmpOverrule,"The ""smepmp"" spec features can overrule the ""privspec"" (e.g. for locking). Both specs are included here, so be mindful that checking of certain vplan items could be conditional.",N/A,N/A,N/A,N/A,,N/A,
-,,FunctionalCoverage,"Functional coverage is encouraged to be creative in capturing a broad set of possible state, and evaluate it towards the checkers, to catch aspects of pmp functionality that this vplan might have overlooked.",N/A,N/A,N/A,N/A,,N/A,
-,,ImplementationChanges,"If test implementation reveals new knowledge that contradicts or augments this vplan, then the vplan should be updated.",N/A,N/A,N/A,N/A,,N/A,
-,,TimeAllowance,"Some verification goals in this plan has a ""base level"" of checking plus some optional tweaks that might be tried. It is up to the testing implementation how to prioritize and potentially skip the extras, according to what time allows.",N/A,N/A,N/A,N/A,,N/A,
-privspec,General,Configs,"The pmp must be tested in a wide range of configurations. That includes testing on both instruction-side and data-side, and it includes testing overlapping regions, non-overlaping, no regions, differing settings for overlapping regions, M-mode only, U-mode only, both M-mode and U-mode, etc, etc. Use functional coverage with plenty of crosses.","Run with different configs to test parameters in low/mid/high ranges and in combination with the other parameters, instantiate checking on both instruction-side and data-side, write coverage to see all relevant region overlap combinations and to see an exhaustive combination of block-level input combinations and functional-level states.",Other,"ENV capability, not specific test",Functional Coverage,,COV: ???,TODO missing cover
-,,Smepmp,"Given 1) backwards-compatible reset values, and 2) no change in ""mseccfg"", then C) the PMP should be fully compatible with the privspec.","For all privspec-derived PMP assertions, check that they must hold as long as the two preconditions hold (i.e. must not be excusable/overridable by smepmp features).",Other,Other,N/A,,N/A,
+N/A,Comments,SmepmpOverrule,"""smepmp"" features can overrule the ""privspec"" (e.g. locking). Both specs are included here, so be aware that certain vplan items are conditional.",N/A,N/A,N/A,N/A,No,N/A,
+,,FunctionalCoverage,"Functional coverage should capture a broad set of possible state (could be compared with the checkers), to find crosses that this vplan might have overlooked.",N/A,N/A,N/A,N/A,No,N/A,
+,,ImplementationChanges,"If test implementation gains new knowledge, then update this vplan when appropriate.",N/A,N/A,N/A,N/A,No,N/A,
+,,TimeAllowance,"Some of the verification goals have a ""base level"" of checking plus optional tweaks. It is up to implementation to prioritize and potentially skip the extras.",N/A,N/A,N/A,N/A,No,N/A,
+privspec,General,Configs,"The pmp must be tested in a wide range of configurations. That includes testing on both instruction-side and data-side, and it includes testing overlapping regions, non-overlaping, no regions, differing settings for overlapping regions, M-mode only, U-mode only, both M-mode and U-mode, etc, etc. Use functional coverage with plenty of crosses.","Run with different configs to test parameters in low/mid/high ranges and in combination with the other parameters, instantiate checking on both instruction-side and data-side.
+
+Cover: see all relevant region overlap combinations and to see an exhaustive combination of block-level input combinations and functional-level states.",Other,"ENV capability, not specific test",Functional Coverage,No,COV: (SKIPPED),Skipped in favor of using realease-specific configs.
+,,Smepmp,"Given 1) backwards-compatible reset values, and 2) no change in ""mseccfg"", then C) the PMP should be fully compatible with the privspec.","For all privspec-derived PMP assertions, check that they must hold as long as the two preconditions hold (i.e. must not be excusable/overridable by smepmp features).",Other,Other,N/A,No,(SKIPPED),Skipped in favor of considering the normal assertions good enough and using release-specific configs.
 ,,UmodeAlways,"""PMP checks are applied to all accesses whose effective privilege mode is S or U, including instruction fetches in S and U mode, data accesses in S and U mode when the MPRV bit in the mstatus register is clear, and data accesses in any mode when the MPRV bit in mstatus is set and the MPP field in mstatus contains S or U.""
 
 Note: None of those scenarios should let an access bypass the pmp.","Set up the system to match each point in the listing, ensure that the pmp's decision matches all modelled expectations.
 
-Note: Also cover when none of the listed preconditions are active and the pmp's decision can disagree with the modelled expectations.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*
+Cover: when none of the listed preconditions are active and the pmp's decision can disagree with the modelled expectations.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,DefaultNone,"""PMP can grant permissions to S and U modes, which by default have none""","Check that, out of reset, given no extraordinary reset values, and given no change to the pmp csrs, then U-mode has no access permissions.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,,"A: ???
+COV: (SKIPPED)","(Same as for ""MmodeDeny"")
 
-DTC: cv32e40s/tests/programs/custom/pmp/",TODO missing assert
+Cover is skipped because it is not essential, and we have equivalence checking of RTL vs model."
+,,DefaultNone,"""PMP can grant permissions to S and U modes, which by default have none""","Given:
+1) out of reset,
+2) no extraordinary reset values,
+3) no change to the pmp csrs.
+
+Then:
+U-mode has no access permissions. (I.e. always excepts.)",Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: (SKIPPED).
+
+DTC: cv32e40s/tests/programs/custom/pmp/","Skipped in favor of using realease-specific configs (which have ""extraordinary reset values"")."
 ,,DefaultFull,"""can revoke permissions from M-mode, which
-by default has full permissions""","Check that, out of reset, given no extraordinary reset values, and given no change to the pmp csrs, then M-mode has full access permissions.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,,"A: ???
+by default has full permissions""","Check that, out of reset, given no extraordinary reset values, and given no change to the pmp csrs, then M-mode has full access permissions.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,No,"A: (SKIPPED)
 
-DTC: cv32e40s/tests/programs/custom/pmp/",TODO missing assert
+DTC: cv32e40s/tests/programs/custom/pmp/",Skipped in favor of the directed test and the entire test suite in general.
 ,Csrs,ResetRegisters,"""Writable PMP registers’ A and L fields are set to 0, unless the platform mandates a different reset value for some PMP registers’ A and L fields.""","Read the A and L values right after reset, ensure that the default reset values are 0.
 
-Note: Should also be visible on rvfi without specifically using csr instructions.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,,"A: ???
+Note: Should also be visible on rvfi without specifically using csr instructions.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,No,"A: (SKIPPED)
 
-DTC: cv32e40s/tests/programs/custom/pmp/",TODO missing assert
+DTC: cv32e40s/tests/programs/custom/pmp/","Skipped in favor of integration-level testing w/ release-specific configs, and the directed test."
 ,,Warl,"""All PMP CSR fields are WARL and may be hardwired to zero"".
 
-Note: A field shall also not change its value when an attempt is made to write an illegal value to it. (XWR is one field.)","Try writing any values to the registers and read values out of them, ensure that neither reads nor writes causes exceptions, and ensure that all read values are legal or otherwise as expected and that illegally written fields don't change.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfg_expected[*].a_cfg_expected
+Note: A field shall also not change its value when an attempt is made to write an illegal value to it. (XWR is one field.)","Try writing any values to the registers and read values out of them.
+Ensure that neither reads nor writes causes exceptions.
+And ensure that all read values are legal or otherwise as expected and that illegally written fields don't change.
+
+Cover: access to all CSRs and all fields.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfg_expected[*].a_cfg_expected
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected
 
-COV: ???",TODO missing cover
+COV: (SKIPPED)",Cover skipped because the asserts are deemed sufficient.
 ,,MmodeOnly,"""PMP CSRs are only accessible to M-mode.""","Try to access any of the pmp CSRs from U-mode, ensure that it always gives ""illegal instruction exception"" and that the CSRs are not updated.
 
+Cover: For all CSRs.
+
 Note: M-mode accesses are covered by AlwaysAccessible below.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_csrs_mmode_only
 
-COV: ???
+COV: (SKIPPED)
+
+DTC: cv32e40s/tests/programs/custom/pmp/",Cover skipped because the asserts and directed test are deemed sufficient.
+,,Addr34bit,"""Each PMP address register encodes bits 33–2 of a 34-bit physical address for RV32""","Ensure that when the two pmpaddr MSBs are set, then no NAPOT accesses matches.
+Ensure that there are no attempted accesses to MSBs that the core should not be able to use.
 
-DTC: cv32e40s/tests/programs/custom/pmp/","TODO missing cover (combine with ""Warl"" above)"
-,,Addr34bit,"""Each PMP address register encodes bits 33–2 of a 34-bit physical address for RV32""","Ensure that when the pmpaddr MSBs are set, then no NAPOT accesses matches. Cover that all bits have been matched against (""toggle cross""). Ensure that there are no attempted accesses to MSBs that the core should not be able to use.",Assertion Check,Constrained-Random,Functional Coverage,,"A: ???
+Cover: all bits have been matched against (""toggle cross"").",Assertion Check,Constrained-Random,Functional Coverage,No,"A: (SKIPPED).
 
-COV: ???","TODO missing assert
+COV: (SKIPPED)",Assert and cover skipped in favor of model equivalence checking.
+,,AddrImplemented,"""Not all physical address bits may be implemented, and so the pmpaddr registers are WARL.""","Cover: (toggle) that all bits can be both written and set.
 
-TODO missing cover"
-,,AddrImplemented,"""Not all physical address bits may be implemented, and so the pmpaddr registers are WARL.""",Cover (toggle) that all bits can be both written and set. (UnusedZero below covers the WARL(0x0) case.),Other,Constrained-Random,Functional Coverage,High Priority,COV: ???,TODO missing cover
+(""UnusedZero"" below covers the WARL(0x0) case.)",Other,Constrained-Random,Functional Coverage,High Priority,COV: (SKIPPED),Skipped in favor of integration-level testing w/ release-specific configs.
 ,AddressMatching,MatchDisabled,"""When A=0, this PMP entry is disabled and matches no addresses""
-When a cfg is set to off but its address(es) (interpreted as napot/tor) is the only rule that matches an attempted access, then it still does not count as a match.","Have a region's address(es) set up as tor and napot (separate runs), have all other regions not include the target address, have the target region's rule be OFF, make an access within that range, ensure that the outcome is the same as for when an access is outside of all address ranges.
+When a cfg is set to off but its address(es) (interpreted as napot/tor) is the only rule that matches an attempted access, then it still does not count as a match.","Have a region's address(es) set up as tor and napot (separate runs),
+have all other regions not include the target address,
+have the target region's rule be OFF,
+make an access within that range,
+ensure that the outcome is the same as for when an access is outside of all address ranges.
 
 Note: For this and several other items, functional coverage is necessary because the checking doesn't necessarily have the above scenario in its antecedent.
 
-Coverage: Capture the above scenario, minus the checking.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+Coverage: Capture the above scenario, minus the checking.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A:
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???",TODO missing cover
+COV: (SKIPPED)","Cover is skipped in favor of integration-level testing w/ release-specific configs, because we have equivalence checking of RTL vs model."
 ,,NapotMatching,"""NAPOT ranges make use of the low-order bits of the associated address register to encode the size of the range [""yyyy...yy01"" etc]""
 
-Note: The napot address matching modes match on addresses that are equal to the requested access when masked to the granularity size.","Configure napot rules of different sizes, try accesses within and outside the regions, ensure that the outcomes corresponds to the designated sizes.
+Note: The napot address matching modes match on addresses that are equal to the requested access when masked to the granularity size.","Configure napot rules of different sizes.
+Try accesses within and outside the regions.
+Ensure that the outcomes corresponds to the designated sizes.
 
 Note: Includes NAPOT and NA4.
 
-Note: Try also max and min.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_na4is4byte.a_na4_is_4byte
+Cover: Matching inside / outside.
+
+Cover: Min / Max of the ""yyy..."" patterns.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_na4is4byte.a_na4_is_4byte
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
 COV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_bin_auto[*]
-dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_disallowed_bin_auto[*]
 
-COV: ???",TODO missing coverage
-,,TorMatching,"""If TOR is selected, the associated address register forms the top of the address range, and the preceding PMP address register forms the bottom of the address range. If PMP entry i’s A field is set to TOR, the entry matches any address y such that pmpaddri−1 ≤ y < pmpaddri (irrespective  of the value of pmpcfgi−1)""","Configure tor regions of different sizes, try accesses within and outside the regions, ensure that the outcomes corresponds to the designated ranges.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+COV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_disallowed_bin_auto[*]
 
-COV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_ismatch_tor_bin_auto[*]
+COV: (SKIPPED).",Cover skipped (min/max) in favor of model equivalence checking and trusting formal's capability of exercising the asserts.
+,,TorMatching,"""If TOR is selected, the associated address register forms the top of the address range, and the preceding PMP address register forms the bottom of the address range. If PMP entry i’s A field is set to TOR, the entry matches any address y such that pmpaddri−1 ≤ y < pmpaddri (irrespective  of the value of pmpcfgi−1)""","Configure tor regions of different sizes.
+Try accesses within and outside the regions.
+Ensure that the outcomes correspond to the designated ranges.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 
-COV: ???",TODO missing coverage
-,,TorZero,"""If PMP entry 0’s A field is set to TOR, zero is used for the lower bound, and so it matches any address y < pmpaddr0.""","Configure entry 0 as tor regions of different sizes, try accesses within and outside the regions, ensure that the outcomes corresponds to the designated ranges.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???
+COV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_ismatch_tor_bin_auto[*]",
+,,TorZero,"""If PMP entry 0’s A field is set to TOR, zero is used for the lower bound, and so it matches any address y < pmpaddr0.""","Configure entry 0 as tor regions of different sizes, try accesses within and outside the regions, ensure that the outcomes corresponds to the designated ranges.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 
-DTC: cv32e40s/tests/programs/custom/pmp/",TODO missing cover
-,,TorNomatch,"""If pmpaddri−1 ≥ pmpaddri and pmpcfgi.A=TOR, then PMP entry i matches no addresses.""","Set up tor regions where the addresses are not in increasing order, try accesses on or within the designated ""reverse"" regions, ensure that they are treated as if there is no match.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+COV: (SKIPPED)
+
+DTC: cv32e40s/tests/programs/custom/pmp/",Cover skipped in favor of directed test and equivalence checking vs model.
+,,TorNomatch,"""If pmpaddri−1 ≥ pmpaddri and pmpcfgi.A=TOR, then PMP entry i matches no addresses.""","Set up tor regions where the addresses are not in increasing order, try accesses on or within the designated ""reverse"" regions, ensure that they are treated as if there is no match.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???
+COV: (SKIPPED)
 
-DTC: cv32e40s/tests/programs/custom/pmp/",TODO missing cover
-,,SameGrain,"""In general, the PMP grain [...] must be the same across all PMP regions.""","Do the same as for the basic case of GranularityDetermination below, ensure that all read values are the same across all the pmp csrs.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,,A: ???,TODO missing assert
+DTC: cv32e40s/tests/programs/custom/pmp/",Cover skipped in favor of directed test and equivalence checking vs model.
+,,SameGrain,"""In general, the PMP grain [...] must be the same across all PMP regions.""","Do the same as for the basic case of GranularityDetermination below, ensure that all read values are the same across all the pmp csrs.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,No,A: (SKIPPED),Assert skipped in favor of the asserts checking the grain in general and model equivalence checking.
 ,,Na4Unselectable,"""When G ≥ 1, the NA4 mode is not selectable.""","Have the G parameter set to at least 1, ensure that NA4 never gets selected (even when writing to non-locked cfg).
 
 Note: Formal should easily check this.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_na4onlyg0[*].a_na4_only_g0
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_na4onlyg0[*].a_na4_only_g0
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_na4onlyg0[*].a_na4_not_when_g uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_na4onlyg0[*].a_na4_not_when_g",
-,,NapotImplied,"""When G ≥ 2 and pmpcfgi.A[1] is set, i.e. the mode is NAPOT"".",(Covered by Na4Unselectable above),Other,Other,N/A,,N/A,
+,,NapotImplied,"""When G ≥ 2 and pmpcfgi.A[1] is set, i.e. the mode is NAPOT"".",(Covered by Na4Unselectable above),Other,Other,N/A,High Priority,N/A,
 ,,NapotOnes,"""When G ≥ 2 and pmpcfgi.A[1] is set, [...] then bits pmpaddri[G-2:0] read as all ones.""","Have the G parameter set to at least 2, have A set, read pmpaddri, ensure the LSBs are all ones as specified.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_napot_ones_g2.gen_napot_ones_i[*].a_napot_ones,
 ,,AllZeros,"""When G ≥ 1 and pmpcfgi.A[1] is clear, i.e. the mode is OFF or TOR, then bits pmpaddri[G-1:0] read as all zeros.""","Create the listed preconditions, ensure that the read value contains zeroes as specified.
 
 Note: Check both OFF/TOR, and for all configs fields (checking of all configs don't need 100% coverage in simulation).",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_all_zeros_g1.gen_all_zeros_i[*].a_all_zeros
 
-COV: ???",TODO missing cover
-,,TorUnaffected,"""Bits pmpaddri[G-1:0] do not affect the TOR address-matching logic.""","Write different values to ""pmpaddri[G-1:0]"", ensure TOR mode matches the same either way.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
+COV: uvmt_cv32e40s_pmp_assert.sv,  ""cp_ismatch_tor"".
+
+COV: uvmt_cv32e40s_pmp_assert.sv, ""cov_rlb_locked_rules_can_remove"".",(The covers are written for a different purpose but should sufficiently hit this.)
+,,TorUnaffected,"""Bits pmpaddri[G-1:0] do not affect the TOR address-matching logic.""","Write different values to ""pmpaddri[G-1:0]"", ensure TOR mode matches the same either way.",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED),Assert skipped in favor of  model equivalence checking.
 ,,StorageUnaffected,"""Although changing pmpcfgi.A[1] affects the value read from pmpaddri, it does not affect the underlying value stored in that register""
-""in particular, pmpaddri[G-1] retains its original value when pmpcfgi.A is changed from NAPOT to TOR/OFF then back to NAPOT.""","Change in and out of (OFF || TOR) and !(OFF || TOR), ensure that different values can be read without having written anything new to the register.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_storage_unaffected[*].a_storage_unaffected
+""in particular, pmpaddri[G-1] retains its original value when pmpcfgi.A is changed from NAPOT to TOR/OFF then back to NAPOT.""","Change in and out of (OFF || TOR) and !(OFF || TOR), ensure that different values can be read without having written anything new to the register.
+
+Cover: All transitions, na4/napot -> off/tor.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_storage_unaffected[*].a_storage_unaffected
 
-COV: ???",TODO missing cover
+COV: (SKIPPED)",Cover skipped because assert is deemed sufficient.
 ,,GranularityDetermination,"""Software may determine the PMP granularity by writing zero to pmp0cfg, then writing all ones to pmpaddr0, then reading back pmpaddr0. If G is the index of the least-significant bit set, the PMP granularity is 2 G+2 bytes.""","Write zero to pmpicfg, write ones to pmpaddri, read pmpaddri, ensure that the LSB index matches to granularity parameter.
 
 Note: Formal can maybe check this for all i.
 
 Note: If time allows, can write something else than zero and ensure that the rest follows as expected.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_granularity_determination,
-,,XlenMatching,"""If the current XLEN is greater than MXLEN, the PMP address registers are zero-extended from MXLEN to XLEN bits for the purposes of address matching.""",N/A,N/A,N/A,N/A,,N/A,
+,,XlenMatching,"""If the current XLEN is greater than MXLEN, the PMP address registers are zero-extended from MXLEN to XLEN bits for the purposes of address matching.""",N/A,N/A,N/A,N/A,No,N/A,
 ,LockingAndPrivmode,UntilReset,"""Locked PMP entries remain locked until the hart is reset.""","Lock entry i (for all i, if feasible), ensure that the lock bit is never lifted before reset. (Unless if RLB interferes.)
 
 Note: Sim might do a second reset, formal most likely won't and shouldn't need to.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_until_reset[*].a_until_reset,
-,,IgnoreWrites,"""If PMP entry i is locked, writes to pmpicfg and pmpaddri are ignored.""","Lock entry i (for all i, if feasible), ensure that their value can't change, both when written to and otherwise. (Unless if RLB interferes.)",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify
+,,IgnoreWrites,"""If PMP entry i is locked, writes to pmpicfg and pmpaddri are ignored.""","Lock entry i (for all i, if feasible), ensure that their value can't change. (Unless if RLB interferes.)
+
+Cover: both when written to and otherwise.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_writes_notrap[*].a_ignore_writes_notrap
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_writes_nochange[*].a_ignore_writes_nochange
 
-COV: ???",TODO missing cover
-,,IgnoreTor,"""Additionally, if PMP entry i is locked and pmpicfg.A is set to TOR, writes to pmpaddri-1 are ignored.""","Lock entry i (…), have A set and the mode be TOR, ensure that pmpaddri-1 can't change, both for explicit writes and otherwise. (Unless RLB.)",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_stable
+COV: (SKIPPED)",Cover skipped because the asserts are deemed sufficient.
+,,IgnoreTor,"""Additionally, if PMP entry i is locked and pmpicfg.A is set to TOR, writes to pmpaddri-1 are ignored.""","Lock entry i (…), have A set and the mode be TOR, ensure that pmpaddri-1 can't change. (Unless RLB.)
+
+Cover: both for explicit writes and otherwise",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_stable
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_wdata
 
-COV: ???",TODO missing cover
-,,NotIgnore,"When neither cfg i is locked, nor is cfg i+1 a locked TOR region, then writes to cfg and addr i are not ignored.","Have cfg i unlocked, write to cfg and addr csr i, check that it changes.",Assertion Check,Constrained-Random,Assertion Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_addr_writes[*].a_addr_nonlocked
+COV: (SKIPPED)",Cover skipped because the asserts are deemed sufficient.
+,,NotIgnore,"When neither cfg i is locked, nor is cfg i+1 a locked TOR region, then writes to cfg and addr i are not ignored.","Have cfg i unlocked,
+write to cfg and addr csr i,
+check that it changes.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_addr_writes[*].a_addr_nonlocked
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_addr_tor[*].a_addr_nonlocked_tor",
 ,,LockOff,"""Setting the L bit locks the PMP entry even when the A field is set to OFF.""","Lock entry i while the mode is OFF, ensure that it gets locked in this case too.
 
 Note: Ensure that checking and coverage handles locking for all possible modes.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: (Same checking as for ""IgnoreWrites"" and ""IgnoreTor"" above.)
 
-COV: ???",TODO missing cover
-,,RwxPrivmode,"""In addition to locking the PMP entry, the L bit  indicates whether the R/W/X permissions are enforced on M-mode accesses. When the L bit is set, these permissions are enforced for all privilege modes.""","Be in M-mode and U-mode (separate runs), access a region where L is set and where RWX {grant, deny R, deny W, deny X}, ensure that the access is correspondingly granted/denied.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+COV: (SKIPPED).","Cover skipped, trusting formal to exercise the assert."
+,,RwxPrivmode,"""In addition to locking the PMP entry, the L bit  indicates whether the R/W/X permissions are enforced on M-mode accesses. When the L bit is set, these permissions are enforced for all privilege modes.""","Be in M-mode and U-mode (separate runs),
+access a region where L is set and where RWX {grant, deny R, deny W, deny X},
+ensure that the access is correspondingly granted/denied.
 
-COV: ???",TODO missing cover
+Cover: grant, deny R, deny W, deny X.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+COV: (SKIPPED)",Cover skipped because the asserts are deemed sufficient.
 ,,MmodeSucceed,"""When the L bit is clear, any M-mode access matching the PMP entry will succeed""","Be in M-mode, access a region where L is clear, ensure that access is granted in all cases.
 
-(Note, see ""Smepmp"" above.)",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-,,RwxUmode,"""When the L bit is clear […] the R/W/X permissions apply only to S and U modes.""","Be in U-mode, access a region where L is clear, ensure that access is granted/denied based on RWX.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_uorl_onlyif_rwx
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_uorl_onlyif_rwx
+(Note, see ""Smepmp"" above.)",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED),Assert skipped in favor of Smepmp-based assertions.
+,,RwxUmode,"""When the L bit is clear […] the R/W/X permissions apply only to S and U modes.""","Be in U-mode, access a region where L is clear, ensure that access is granted/denied based on RWX.
+
+Cover: granted / denied.
+
+Note: The M-mode part of this is handled by ""MmodeSucceed"" above.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_uorl_onlyif_rwx
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_uorl_onlyif_rwx
 
-COV: ???",TODO missing cover
+COV: (SKIPPED)",Cover skipped because the asserts are deemed sufficient.
 ,PriorityAndMatching,LowestDetermines,"""PMP entries are statically prioritized. The lowest-numbered PMP entry that matches any byte of an access determines whether that access succeeds or fails.""
 
 Note: ""any"" byte.","Access a region that is covered by multiple rules, ensure that the lowest indexed match determines the outcome.
 
-Note: Requires that the rules would disagree on the outcome.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+Note: Requires that the rules would disagree on the outcome. (One rule allows, other disallows.)
+
+Cover: ""winning"" rule allows / disallows.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???",TODO missing cover
-,,MatchAll,"""The matching PMP entry must match all bytes of an access, or the access fails, irrespective of the L, R, W, and X bits.""",(Only relevant for 64-bit architectures.),N/A,N/A,N/A,,N/A,
-,,LrwxDetermines,"""If a PMP entry matches all bytes of an access, then the L, R, W,and X bits determine whether the access succeeds or fails. [...] if the L bit is set or the privilege mode of the access is S or U, then the access succeeds only if the R, W,or X bit corresponding to the access type is set.""","Access a pmp region where L and the privmode etc is such that nothing else would deny the access, ensure that each of (or a combination of) RWX can either grant or deny the access.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_lrwx_aftermatch
+COV: (SKIPPED).","Cover skipped, trusting formal to exercise the assert."
+,,MatchAll,"""The matching PMP entry must match all bytes of an access, or the access fails, irrespective of the L, R, W, and X bits.""",(Only relevant for 64-bit architectures.),N/A,N/A,N/A,No,N/A,
+,,LrwxDetermines,"""If a PMP entry matches all bytes of an access, then the L, R, W,and X bits determine whether the access succeeds or fails. [...] if the L bit is set or the privilege mode of the access is S or U, then the access succeeds only if the R, W,or X bit corresponding to the access type is set.""","Access a pmp region where L and the privmode etc is such that nothing else would deny the access, ensure that each of (or a combination of) RWX can either grant or deny the access.
+
+Cover: U, M, L, grant, deny R, deny W, deny X, etc.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_lrwx_aftermatch
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_lrwx_aftermatch
 
-COV: ???",TODO missing cover
-,,MmodeSucceed2,"""If the L bit is clear and the privilege mode of the access is M, the access succeeds.""","(Same as ""MmodeSucceed"" above)",Other,Other,N/A,,N/A,
-,,MmodeNomatch,"""If no PMP entry matches an M-mode access, the access succeeds.""","Be in M-mode, access a region where no rule matches, ensure that the access is granted (where MMWP is off).
+COV: (SKIPPED)","Cover skipped because the asserts are deemed sufficient. It is partially covered already by the ""general"" covergroup and its crosses."
+,,MmodeSucceed2,"""If the L bit is clear and the privilege mode of the access is M, the access succeeds.""","(Same as ""MmodeSucceed"" above)",Other,Other,N/A,No,N/A,
+,,MmodeNomatch,"""If no PMP entry matches an M-mode access, the access succeeds.""","Be in M-mode,
+access a region where no rule matches,
+ensure that the access is granted (where MMWP is off).
+
+Cover: the checker is generic, so cover this specific scenario.
 
-(Note, see ""Smepmp"" above.)",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+(Note, see ""Smepmp"" above.)",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 
-COV: ???",TODO missing cover
+COV: uvmt_cv32e40s_pmp_assert.sv, ""cp_x_mmode_nomatch_nommwp_x"".
+
+COV: uvmt_cv32e40s_pmp_assert.sv, ""cp_r_mmode_nomatch_nommwp_r"".
+
+COV: uvmt_cv32e40s_pmp_assert.sv, ""cp_w_mmode_nomatch_nommwp_w"".",
 ,,UmodeNomatch,"""If no PMP entry matches an S-mode or U-mode access, but at least one PMP entry is implemented, the access fails.""
 
-Note: ""All PMP CSRs are always implemented"".","Be in U-mode, do an access that doesn't match any region, ensure that the access fails.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_umode_fails
+Note: ""All PMP CSRs are always implemented"".","Be in U-mode, do an access that doesn't match any region, ensure that the access fails.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_umode_fails
 
-A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_umode_fails
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_umode_fails",
+,,UmodeOff,"""If at least one PMP entry is implemented, but all PMP entries’ A fields are set to OFF, then all S-mode and U-mode memory accesses will fail.""","Be in U-mode,
+have all entries OFF,
+make an access,
+ensure that the access fails.
 
-COV: ???",TODO missing cover
-,,UmodeOff,"""If at least one PMP entry is implemented, but all PMP entries’ A fields are set to OFF, then all S-mode and U-mode memory accesses will fail.""","Be in U-mode, have all entries OFF, make an access, ensure that the access fails (for all variations of accesses).",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+Cover: this specific scenario.
+
+Cover: for all variations of accesses",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_umode_off"".
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 
-COV: ???",TODO missing cover
-,,FailException,"""Failed accesses generate an instruction, load, or store access-fault exception.""","Cause failed accesses on instructions/loads/stores, ensure that an exception occurs and that it is the right one.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-A: <embedded>::uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*
+COV: (SKIPPED)","Second cover skipped because it should be the responsibility of the ""general"" covergroup and its crosses."
+,,FailException,"""Failed accesses generate an instruction, load, or store access-fault exception.""","Cause failed accesses on instructions/loads/stores, ensure that an exception occurs and that it is the right one.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
 
-COV: ???",TODO missing cover
+A: <embedded>::uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*",
 ,,MultiAccess,"""Note that a single instruction may generate multiple accesses, which may not be mutually atomic. An access-fault exception is generated if at least one access generated by an instruction fails, though other accesses generated by that instruction may succeed with visible side effects.""
 
 ""On some implementations, misaligned loads, stores, and instruction fetches may also be decomposed into multiple accesses, some of which may succeed before an access-fault exception occurs. In particular, a portion of a misaligned store that passes the PMP check may become visible, even if another portion fails the PMP check.""","Induce misaligned word instruction-fetch, load, and store, where the lower and upper (separate runs) parts are either accessible or blocked by pmp, ensure that exceptions occur while parts of the access might reach the bus.
 
-Also check Zc's push/pop and table jump.
+Cover: upper/lower blocked/allowed.
 
-Note: It is up to other vplans to check what happens upon the exception. It is up to this PMP vplan to check that the PMP will cause the exceptions.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_splittrap
+Cover: parts reaching the bus.
 
-A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_splittrap
+Cover: push/pop and table jump.
+
+Note: It is up to other vplans to check what happens upon the exception. It is up to this PMP vplan to check that the PMP will cause the exceptions.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec*
 
-A: ???
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore*
 
-COV: ???","TODO missing assert (on split that errs on first)
+A: (SKIPPED)
 
-TODO missing cover"
-smepmp,MsecCfg,MmodeOnly,"""Machine Security Configuration (mseccfg) is [...] only accessible to Machine mode.""
+COV: (SKIPPED)","Assert skipped (explicitly, split that errs on first) because it is theoretically covered by the generic assert.
+
+Specific covers skipped, in favor of trusting formal's ability to exercise the asserts."
+smepmp,MsecCfg,MmodeOnly,"""Machine SECurity ConFiGuration (mseccfg) is [...] only accessible to Machine mode.""
 
 Note: Includes ""mseccfgh"".","Access (read/write) mseccfg (and mseccfgh) from M-mode, access mseccfg from U-mode, ensure that the first always works (WARL) and the second never works (exception).
 
-Note: Cover with MPRV too.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: ???,TODO missing assert
+Note: Cover with MPRV too.
+
+Cover: read/write, mmode/umode, mprv/no, mseccfg/mseccfgh.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_csrs_mmode_only"".
+
+COV: (SKIPPED)","Cover skipped, trusting formal to exercise the assert."
 ,,FieldsWarl,"""All mseccfg fields defined on this proposal are WARL""","Try writing any values to the fields (the defined ones, but also other bits) and read values out of the fields, ensure that neither reads nor writes causes exceptions, and ensure that all read values are legal or otherwise as expected.
 
 Note: This relates to the ""stickiness"" of those fields. Regardless of their values and current stickiness, the fields are WARL.
 
-Note: It might be difficult, when trying to write a checker for traps, to filter out all other causes for traps that can occur simultaneously. (Either reduce the scope of checking, or write re-usable helper signals for ""trap causality"" info.)
+Note: ""WPRI"" on some bits.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_csrs_mmode_only"".
 
-Note: ""WPRI"" on some bits.",Assertion Check,Constrained-Random,Functional Coverage,,"A: ???
+A: (SKIPPED)
 
-COV: ???","TODO missing assert
+COV: (SKIPPED)","Second assert skipped because the features themselves are covered by other asserts and integration testing.
 
-TODO missing cover"
+Cover skipped for the same reasons as the assert and also because the covergroups in uvmt_cv32e40s_pmp_assert.sv covers parts of it."
 ,,ReservedZero,"""the remaining bits are reserved for future standard use and should always read zero.""
-(This spec can't dictate that about other specs, but the user manual agrees on the hardwiring.)","Read mseccfg, ensure the non-smepmp-field bits are always zero.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: ???,TODO missing assert
+
+(Note: This spec can't dictate that about other specs, but the user manual agrees on the hardwiring.)","Read mseccfg, ensure the non-smepmp-field bits are always zero.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_pmp_assert.sv, ""a_reserved_zero_mseccfg_fields"".",
 ,,ResetValue,"""The reset value of mseccfg is implementation-specific, otherwise if backwards compatibility is a requirement it should reset to zero on hard reset.""","Read the value of mseccfg right after reset, ensure that the default reset value is zero.
 
 Note: Should also be visible on rvfi without specifically using csr instructions.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_mseccfg_reset_val
@@ -225,21 +307,21 @@ Note: Should also be visible on rvfi without specifically using csr instructions
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_mseccfg_reset_val",
 ,LockingBypass,ModifiableEntries,"""When mseccfg.RLB is 1 locked PMP rules may be removed/modified and locked PMP entries may be edited.""
 
-Note: Both ""cfg"" and ""addr"" registers, limited to fields within ""cfg"" reg, also TOR affects lower ""addr"" reg.","Have a locked pmp entry i, set RLB to 1, try modifying any(!) field within {pmpicfg, pmpaddri, pmpaddri-1(tor)}, ensure that values are updated succesfully (while respecting other rules like legal values and reserved bits).",Assertion Check,Constrained-Random,Functional Coverage,,"A: ???
+Note: Both ""cfg"" and ""addr"" registers, limited to fields within ""cfg"" reg, also TOR affects lower ""addr"" reg.","Have a locked pmp entry i, set RLB to 1, try modifying any(!) field within {pmpicfg, pmpaddri, pmpaddri-1(tor)}, ensure that values are updated succesfully (while respecting other rules like legal values and reserved bits).",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: N/A
 
-COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_addr
+COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_addr
 
-COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_exec
+COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_exec
 
-COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_lock
+COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_lock
 
-COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_mode
+COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_mode
 
-COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_read
+COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_read
 
-COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_write
+COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_write
 
-COV: ???",TODO missing assert
+COV: uvmt_cv32e40s_pmp_assert.sv, ""cov_rlb_locked_rules_can_modify_tor"".",The assert is N/A because the covers are the checkers.
 ,,RemainZero,"""When mseccfg.RLB is 0 and pmpcfg.L is 1 in any rule or entry (including disabled entries), then mseccfg.RLB remains 0 and any further modifications to mseccfg.RLB are ignored until a PMP reset""
 
 Note: ""any"" entry.","Have RLB=0 and at least one L=1, ensure that RLB is 0 forever (until reset).
@@ -247,105 +329,159 @@ Note: ""any"" entry.","Have RLB=0 and at least one L=1, ensure that RLB is 0 for
 Note: No exception occurs on attempted access, but one should try overwriting the value to stimulate the checking.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_rlb_never_fall_while_locked
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_rlb_never_fall_while_locked",
-,,UntilReset,"The sticky zero and update-ignores last until reset, and do not hold after reset.",Ensure that RLB is modifiable after reset. (Unless if reset values are set to activate the RemainZero condition.),Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_until_reset_notbefore
+,,UntilReset,"The sticky zero and update-ignores last until reset, and do not hold after reset.","Ensure that RLB is modifiable after reset. (Unless if reset values are set to activate the RemainZero condition.)
 
-COV: ???",TODO missing cover
-,,HardwireZero,"""Vendors who don’t need this functionality may hardwire this field to 0.""","(40s has not hardwired this to 0, it is RW.)",N/A,N/A,N/A,,N/A,
+Note: Both enable / disable.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_until_reset_notbefore,
+,,HardwireZero,"""Vendors who don’t need this functionality may hardwire this field to 0.""","(40s has not hardwired this to 0, it is RW.)",N/A,N/A,N/A,No,N/A,
 ,WhiteList,StickyUntilReset,"""[mseccfg.MMWP] is a sticky bit, meaning that once set it cannot be unset until a PMP reset.""","Have MMWP set, ensure that it remains high forever (til reset).",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_mmwp_never_fall_until_reset
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_mmwp_never_fall_until_reset",
-,,Denied,"""When set it changes the default PMP policy for M-mode when accessing memory regions that don’t have a matching PMP rule, to denied instead of ignored.""","Have MMWP set, be in (effective mode) M-mode, access regions that don't match any rule (including OFF, ""reversed"" TOR, >32bit NAPOT, etc), ensure that the access is denied.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_mmode_mmwp_fails
+,,Denied,"""When set it changes the default PMP policy for M-mode when accessing memory regions that don’t have a matching PMP rule, to denied instead of ignored.""","Have MMWP set,
+be in (effective mode) M-mode,
+access regions that don't match any rule (including OFF, ""reversed"" TOR, >32bit NAPOT, etc),
+ensure that the access is denied.
+
+Cover: MPRV/no, off/reversed/napot.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_mmode_mmwp_fails
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_mmode_mmwp_fails
 
-COV: ???",TODO missing cover
-,LockdownGeneral,StickyUntilReset,"""[mseccfg.MML] is a sticky bit, meaning that once set it cannot be unset until a PMP reset.""","Cover: Trying to clear the bit.
+COV: (SKIPPED)",Cover skipped because assert is deemed sufficient.
+,LockdownGeneral,StickyUntilReset,"""[mseccfg.MML] is a sticky bit, meaning that once set it cannot be unset until a PMP reset.""","Check: Have MML set, ensure that it remains high forever (til reset).
 
-Check: Have MML set, ensure that it remains high forever (til reset).",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_mml_never_fall_until_reset
+Cover: Trying to clear the bit.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_mml_never_fall_until_reset
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_mml_never_fall_until_reset
 
-COV: ???",TODO missing cover
+COV: (Skipped)",Cover skipped because assert is deemed sufficient.
 ,,ExecIgnored,"""[When mseccfg.MML is set.] Adding an M-mode-only or a locked Shared-Region rule with executable privileges is not possible and such pmpcfg writes are ignored, leaving pmpcfg unchanged.""
 
-Note: ""pmpcfg"" refers to a field, so the write to the CSR itself should still update other fields.","Have MML set, try adding an ""M-mode-only"" rule and a ""locked Shared-Region"" rule with X privileges, ensure that the relevant pmpcfg field is not updated but is left unchanged, ensure also that other fields can still get updated.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal
+Note: ""pmpcfg"" refers to a field, so the write to the CSR itself should still update other fields.","Have MML set,
+try adding an ""M-mode-only"" rule and a ""locked Shared-Region"" rule with X privileges,
+ensure that the relevant pmpcfg field is not updated but is left unchanged,
+ensure also that other fields can still get updated.
+
+Cover: M-mode-only / Shared-Region.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked_cov[0].a_mmode_only_or_shared_executable_ignore
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked_cov[0].a_mmode_only_or_shared_executable_ignore
 
-COV: ???",TODO missing cover
+COV: (SKIPPED)",Cover skipped because assert is deemed sufficient.
 ,,ExecRlb,"""[The above] restriction can be temporarily lifted e.g. during the boot process, by setting mseccfg.RLB.""","Have RLB and MML set, try adding an ""M-mode-only"" rule and a ""locked Shared-Region"" rule with X privileges, ensure that the relevant pmpcfg field is in fact updated.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_rlblifts_lockedexec[*].a_rlblifts_lockedexec,
-,,MmodeExec,"""Executing code with Machine mode privileges is only possible from memory regions with a matching M-mode-only rule or a locked Shared-Region rule with executable privileges. Executing code from a region without a matching rule or with a matching S/U-mode-only rule is denied.""","Execute from ""M-mode-only"" and ""locked Shared-Region"" regions, attempt execution without matching and from ""U-mode-only"" regions, ensure corresponding grant or deny.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+,,MmodeExec,"""Executing code with Machine mode privileges is only possible from memory regions with a matching M-mode-only rule or a locked Shared-Region rule with executable privileges. Executing code from a region without a matching rule or with a matching S/U-mode-only rule is denied.""","Execute from ""M-mode-only"" and ""locked Shared-Region"" regions,
+attempt execution without matching and from ""U-mode-only"" regions,
+ensure corresponding grant or deny.
 
-COV: ???",TODO missing cover
+Cover: The different scenarios.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+COV: (SKIPPED)",Cover skipped because assert is deemed sufficient.
 ,,RwReserved,"""If mseccfg.MML is not set, the combination of pmpcfg.RW=01 remains reserved for future standard use.""","Whitelist the conditions that allow RW=01 (including MML conditions), ensure that it is adhered to.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_rwx_mml[*].a_rwx_mml
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rwfuture[*].a_rw_futureuse
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rwfuture[*].a_rw_futureuse",
-,LockdownA,MmodeEnforce,"""[When mseccfg.MML is set.] An M-mode-only rule is enforced on Machine mode""","Be in M-mode, have MML set, access an ""M-mode-only"" region, ensure that the grant/deny is always in accordance to the rule. (E.g. it is not denied execute despite the execute bit being set.)
+,LockdownA,MmodeEnforce,"""[When mseccfg.MML is set.] An M-mode-only rule is enforced on Machine mode""","Be in M-mode,
+have MML set,
+access an ""M-mode-only"" region,
+ensure that the grant/deny is always in accordance to the rule.
+(E.g. it is not denied execute despite the execute bit being set.)
 
-Note: Exclude cases of interference from e.g. PMA.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+Cover: grant / deny for this specific scenario.
+
+Note: Exclude cases of interference from e.g. PMA.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,UmodeDeny,"""[When mseccfg.MML is set.] An M-mode-only rule is [...] denied in Supervisor or User mode.""","Be in U-mode, have MML set, access an ""M-mode-only"" region, ensure that the access is always denied.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-,,RemainLocked,"""It also remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset""
+COV: (SKIPPED)","(Same as for ""MmodeDeny"")
 
-Certain rules under MML are sticky. They cannot be modified again.","Configure rules for {""M-mode-only"", ""U-mode-only, ""Shared-Region rule where pmpcfg.L is set""(both kinds)}, have MML=1 (and RLB=0), ensure that the configs never change again (until reset).",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: ???
+Cover skipped because assert is deemed sufficient."
+,,UmodeDeny,"""[When mseccfg.MML is set.] An M-mode-only rule is [...] denied in Supervisor or User mode.""","Be in U-mode,
+have MML set,
+access an ""M-mode-only"" region,
+ensure that the access is always denied.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: (SKIPPED),Explicit assert skipped in favor of model equivalence checking.
+,,RemainLocked,"""[An M-mode-only rule] also remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset""
 
-COV: ???",TODO missing assert
+Certain rules under MML are sticky. They cannot be modified again.","1) Configure for ""M-mode-only,
+2) have MML=1 (and RLB=0),
+3) ensure that the configs never change again (until reset).
+
+Cover: with mml=1. (Since the assert re-uses a different vplan item's assert.)",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: (See IgnoreWrites)
+
+COV: (SKIPPED)",Cover skipped because assert is deemed sufficient.
 ,,RlbUnlocks,"""It also remains locked [...] unless mseccfg.RLB is set.""","Have the same setup as in RemainLocked, but let RLB=1, try changing the configs, ensure that they are indeed changed.
 
-Note: ""Assertion check"" includes cover properties.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: ???
+Note: ""Assertion check"" includes cover properties.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: (see ""ModifiableEntries"")
 
-COV: ???",TODO missing assert
-,,UmodeEnforce,"""[When mseccfg.MML is set.] An S/U-mode-only rule is enforced on Supervisor and User modes ""","Be in U-mode, have MML=1, access a ""U-mode-only"" region, ensure that the grant/deny is in accordance with the rule (apart from PMA etc).",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+COV: (See ""ModifiableEntries"")",
+,,UmodeEnforce,"""[When mseccfg.MML is set.] An S/U-mode-only rule is enforced on Supervisor and User modes ""","1) Be in U-mode,
+2) have MML=1,
+3) access a ""U-mode-only"" region,
+4) ensure that the grant/deny is in accordance with the rule (apart from PMA etc).
+
+Cover: Grant / deny.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
 COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cg_data
 
 COV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_cp_instr_side.cg_instr
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,MmodeDeny,"""An S/U-mode-only rule is [...] denied on Machine mode.""","Be in M-mode, have MML=1, access a ""U-mode-only"" region, ensure that the access is always denied.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+COV: (SKIPPED)","(Same as for ""MmodeDeny"")
 
-COV: ???",TODO missing coverage. (Just do a cg with crosses of all of these variables.)
-,,SharedEnforced,"""A Shared-Region rule is enforced on all modes""","Be in M-mode and U-mode (separate runs), access a ""Shared-Region"", ensure that the grant/deny is in accordance with the rule.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+Skipped cover for explicit deny, in favor of model equivalence checking."
+,,MmodeDeny,"""An S/U-mode-only rule is [...] denied on Machine mode.""","1) Be in M-mode,
+2) have MML=1,
+3) access a ""U-mode-only"" region,
+4) ensure that the access is always denied.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,SharedNoexec,"""A Shared-Region rule where pmpcfg.L is not set can be used for sharing data between M-mode and S/U-mode, so is not executable.""","Be in M-mode and U-mode, try to execute from ""A Shared-Region rule where pmpcfg.L is not set"", ensure that it does not work (exception).",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+COV: (SKIPPED)",Cover skipped in favor of model equivalence checking.
+,,SharedEnforced,"""A Shared-Region rule is enforced on all modes""","1) Be in M-mode and U-mode (separate runs),
+2) access a ""Shared-Region"",
+3) ensure that the grant/deny is in accordance with the rule.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,MmodeReadwrite,"""[Shared-Region rule where pmpcfg.L is not set.] M-mode has read/write access to that region""","Be in M-mode, perform reads and writes to such a region, ensure that the intended effects happen and that the accesses do not cause exceptions.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+COV: (See ""UmodeEnforce"").","(Same as for ""MmodeDeny"")"
+,,SharedNoexec,"""A Shared-Region rule where pmpcfg.L is not set can be used for sharing data between M-mode and S/U-mode, so is not executable.""","1) Be in M-mode and U-mode,
+2) try to execute from ""A Shared-Region rule where pmpcfg.L is not set"",
+3) ensure that it does not work (exception).",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+COV: (See ""MmodeDeny"").","(Same as for ""MmodeDeny"")"
+,,MmodeReadwrite,"""[Shared-Region rule where pmpcfg.L is not set.] M-mode has read/write access to that region""","1) Be in M-mode,
+2) perform reads and writes to such a region,
+3) ensure that the intended effects happen and that the accesses do not cause exceptions.
+
+Cover: read / write.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,UmodeRead,"""[For a Shared-Region rule where pmpcfg.L is not set] S/U-mode has read access if pmpcfg.X is not set, or read/write access if pmpcfg.X is set.""","Be in U-mode, perform reads and writes to such a region, ensure that the reads always work and that the writes depend on X.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+COV: (See ""MmodeDeny"").","(Same as for ""MmodeDeny"")"
+,,UmodeRead,"""[For a Shared-Region rule where pmpcfg.L is not set] S/U-mode has read access if pmpcfg.X is not set, or read/write access if pmpcfg.X is set.""","Be in U-mode, perform reads and writes to such a region, ensure that the reads always work and that the writes depend on X.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
+COV: (See ""MmodeDeny"").","(Same as for ""MmodeDeny"")"
 ,,SharedNowrite,"""A Shared-Region rule where pmpcfg.L is set can be used for sharing code between M-mode and S/U-mode, so is not writeable.""
 
-Note: The spec is unclear here, but ""A Shared-Region rule where pmpcfg.L is set"" must refer to ""LRWX=101X"", because ""The encoding pmpcfg.LRWX=1111"" is a separate point. (This holds for the subsequent items below too.)","Be in M-mode and U-mode, write to such a region, ensure that the writes do not reach the bus and that an exception occurs.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+Note: The spec is unclear here, but ""A Shared-Region rule where pmpcfg.L is set"" must refer to ""LRWX=101X"", because ""The encoding pmpcfg.LRWX=1111"" is a separate point. (This holds for the subsequent items below too.)","Be in M-mode and U-mode, write to such a region, ensure that the writes do not reach the bus and that an exception occurs.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,BothExecute,"""Both M-mode and S/U-mode have execute access on the [Shared-Region rule where pmpcfg.L is set]""","Be in M-mode and U-mode, attempt to execute from such a region, ensure that the code is executed and that the attempt does not cause an exception.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+COV: (See ""MmodeDeny"").","(Same as for ""MmodeDeny"")"
+,,BothExecute,"""Both M-mode and S/U-mode have execute access on the [Shared-Region rule where pmpcfg.L is set]""","Be in M-mode and U-mode, attempt to execute from such a region, ensure that the code is executed and that the attempt does not cause an exception.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,MmodeRead,"""M-mode also has read access [to Shared-Region rule where pmpcfg.L is set] if pmpcfg.X is set.""","Be in M-mode, attempt to read from such a region, ensure that the success depends accordingly on X.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+COV: (See ""MmodeDeny"").","(Same as for ""MmodeDeny"")"
+,,MmodeRead,"""M-mode also has read access [to Shared-Region rule where pmpcfg.L is set] if pmpcfg.X is set.""","Be in M-mode, attempt to read from such a region, ensure that the success depends accordingly on X.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
-COV: ???","(Same as for ""MmodeDeny"")"
-,,IgnoreUntilReset,"""The [Shared-Region rule where pmpcfg.L is set] remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset, unless mseccfg.RLB is set.""",(Covered by RemainLocked above.),Other,Other,N/A,,N/A,
-,,BothReadonly,"""The encoding pmpcfg.LRWX=1111 can be used for sharing data between M-mode and S/U mode, where both modes only have read-only access to the region.""","Be in M-mode and U-mode, access such a region, ensure that only the reads work and that the rest (write/execute) excepts.",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
-uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+COV: (See ""MmodeDeny"").","(Same as for ""MmodeDeny"")"
+,,IgnoreUntilReset,"""The [Shared-Region rule where pmpcfg.L is set] remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset, unless mseccfg.RLB is set.""",(Covered by RemainLocked above.),Other,Other,N/A,High Priority,N/A,
+,,BothReadonly,"""The encoding pmpcfg.LRWX=1111 can be used for sharing data between M-mode and S/U mode, where both modes only have read-only access to the region.""","Be in M-mode and U-mode, access such a region, ensure that only the reads work and that the rest (write/execute) excepts.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
+
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
 
 COV: dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_cp_instr_side.cover_item_covergroup_cg_internals_instr_side_inst_cg_instr_coverpoint_cp_r_mmode_mml_lrwx
 
@@ -353,8 +489,8 @@ COV: dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_
 
 COV: dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cover_item_covergroup_cg_internals_data_side_inst_cg_instr_coverpoint_cp_r_umode_mml_lrwx
 
-COV: ???","TODO technically missing the ""the rest … excepts"" cover"
-,,ReadonlyLocked,"""The [pmpcfg.LRWX=1111] rule remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset, unless mseccfg.RLB is set.""",(Covered by RemainLocked above.),Other,Other,N/A,,N/A,
+COV: (SKIPPED)","Non-exhaustive covers, in favor of model equivalence checking (technically missing the ""the rest … excepts"" cover)."
+,,ReadonlyLocked,"""The [pmpcfg.LRWX=1111] rule remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset, unless mseccfg.RLB is set.""",(Covered by RemainLocked above.),Other,Other,N/A,High Priority,N/A,
 ,LegalRwx,,"Depending on the mseccfg control bits and L, some RWX combinations are reserved.
 
 Note: Use the table from the spec.",Ensure that illegal/reserved mseccfg/L/RWX combinations are unreachable.,Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfg_expected[*].a_cfg_expected
@@ -362,42 +498,48 @@ Note: Use the table from the spec.",Ensure that illegal/reserved mseccfg/L/RWX c
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected",
-,Reachable,,"All legal states in the table are reachable. It could theoretically be that platform-specific constraints made certain states unreachable (particularily related to locking), but we should be able to reach all legal and supported combinations of settings.",Ensure that all legal states are reachable.,Other,Constrained-Random,Functional Coverage,,COV: ???,TODO missing cover
-manual,Parameters,MinimumGranularity,"""The PMP_GRANULARITY parameter is used to configure the minimum granularity of PMP address matching. The minimum granularity is [2^(PMP_GRANULARITY+2)] bytes, so at least 4 bytes.""","Have runs with max granularity, minimum granularity, and something in between. Make sure all checkers/covers are active for each relevant run configuration, so tor/napot/na4 is tested with different granularities. Cover cases where a match would otherwise occur but the granularity made the access not match.
+,Reachable,,"All legal states in the table are reachable. It could theoretically be that platform-specific constraints made certain states unreachable (particularily related to locking), but we should be able to reach all legal and supported combinations of settings.",Ensure that all legal states are reachable.,Other,Constrained-Random,Functional Coverage,No,"COV: uvmt_cv32e40s_pmp_assert.sv, ""cg_internals_*"".
 
-Note: Ensure TorMatching etc above heed this parameter.",Other,Constrained-Random,Functional Coverage,,COV: ???,TODO missing cover
+COV: (SKIPPED)","Cover skipped for all explicit variations of ""denied"", in favor of model equivalence checking."
+manual,Parameters,MinimumGranularity,"""The PMP_GRANULARITY parameter is used to configure the minimum granularity of PMP address matching. The minimum granularity is [2^(PMP_GRANULARITY+2)] bytes, so at least 4 bytes.""","Have runs with max granularity, minimum granularity, and something in between. Make sure all checkers/covers are active for each relevant run configuration, so tor/napot/na4 is tested with different granularities.
+
+Cover: cases where a match would otherwise occur but the granularity made the access not match.
+
+Note: Ensure TorMatching etc above heed this parameter.",Other,Constrained-Random,Functional Coverage,No,COV: (SKIPPED),Cover skipped in favor of release-specific configs and the rest of the tests/asserts.
 ,,NumRegions,"""The PMP_NUM_REGIONS parameter is used to configure the number of PMP regions, starting from the lowest numbered region.""
 
-Note: Including 0 regions.","Have runs with max number, minimum number, and something in between.",Other,Constrained-Random,Functional Coverage,,COV: ???,TODO missing cover
+Note: Including 0 regions.","Have runs with max number, minimum number, and something in between.",Other,Constrained-Random,Functional Coverage,No,COV: (SKIPPED),Cover skipped in favor of release-specific configs.
 ,,ResetValues,"""The reset value of the PMP CSR registers can be set through the top level parameters PMP_PMPNCFG_RV[], PMP_PMPADDR_RV[] and PMP_MSECCFG_RV.""","Have runs with different reset values. Ensure that after reset then the reset values are effectuated.
 
-Note: Try also, reset values with locked configs.",Assertion Check,"ENV capability, not specific test",Functional Coverage,High Priority,"A: ???
-
-COV: ???","TODO missing assert
+Note: Try also, reset values with locked configs.",Assertion Check,"ENV capability, not specific test",Functional Coverage,No,"A: (SKIPPED)
 
-TODO missing cover"
-,,DefaultValues,The reset value defaults should amount to a safe config. (Including no violation of reserved bits.),(Covered by all the checks that handles the various legalities.),Other,Other,N/A,,N/A,
+COV: (SKIPPED)",Assert and cover skipped in favor of release-specific configs and integration-level testing.
+,,DefaultValues,The reset value defaults should amount to a safe config. (Including no violation of reserved bits.),(Covered by all the checks that handles the various legalities.),Other,Other,N/A,No,N/A,
 ,CSRs,AlwaysAccessible,"""All PMP CSRs are always implemented"". ""MRW"". The CSRs are M-mode accessible, and their existence does not depend on PMP_NUM_REGIONS.
 
-Note: ""All"" pmp registers, and all fields within them.","Be in M-mode, access (reads/writes) all the pmp csrs, ensure that it always works without excepting (because the csrs exist and the mode is appropriate).
+Note: ""All"" pmp registers, and all fields within them.","1) Be in M-mode,
+2) access (reads/writes) all the pmp csrs,
+3) ensure that it always works without excepting (because the csrs exist and the mode is appropriate).
 
-Note: Potential overlap with CSR vplan.",Assertion Check,Directed Non-Self-Checking,Assertion Coverage,High Priority,A: ???,TODO missing assert
-,,ReservedLegal,"Reserved bits/fields have legal values, matching the platform-specified defaults.","(Overlaps with LegalRwx and RwReservedabove.) Read all fields of all pmp-related csrs, ensure there are no unsupported values anywhere (at all times).",Assertion Check,Constrained-Random,Assertion Coverage,,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected,
-,,MseccfghZero,"""Hardwired to 0""","Read mseccfgh, ensure it is always 0.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: ???,TODO missing assert
+Note: Potential overlap with CSR vplan.",Assertion Check,Directed Non-Self-Checking,Assertion Coverage,No,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_always_accessible_mmode_csrs"".",
+,,ReservedLegal,"Reserved bits/fields have legal values, matching the platform-specified defaults.","(Overlaps with LegalRwx and RwReservedabove.)
+Read all fields of all pmp-related csrs, ensure there are no unsupported values anywhere (at all times).",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected,
+,,MseccfghZero,"""Hardwired to 0""","Read mseccfgh, ensure it is always 0.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_mseccfgh_zero"".",
 ,,UnusedZero,"""CSRs (or bitfields of CSRs) related to PMP entries with number PMP_NUM_REGIONS and above are hardwired to zero.""
 
-Note: Including upper parts of pmpcfgn and also pmpaddr.","Read pmpcfg and pmpaddr csrs, ensure the values are zero as specified. Cover that the other values can be non-zero.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: ???
+Note: Including upper parts of pmpcfgn and also pmpaddr.","1) Read pmpcfg and pmpaddr csrs,
+2) ensure the values are zero as specified.
 
-COV: ???","TODO missing assert
+Cover: that the other values can be non-zero.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: uvmt_cv32e40s_pmp_assert.sv, ""a_unused_zero_pmp_csrs"".
 
-TODO missing cover"
-,,Hardening,"Certain CSRs related to the PMP shall be ""hardened"" as per Xsecure.","(CSR hardening is the responsibility of the security features vplan, even the pmp-specific part of it.)",N/A,N/A,N/A,,N/A,
+COV: (SKIPPED).",Cover skipped as not important.
+,,Hardening,"Certain CSRs related to the PMP shall be ""hardened"" as per Xsecure.","(CSR hardening is the responsibility of the security features vplan, even the pmp-specific part of it.)",N/A,N/A,N/A,High Priority,N/A,
 ,MicroArchitecture,WaitUpdate,"Updates to pmp configs should NOT have an effect on earlier instructions (nor on the instruction itself).
 
 Note: Potential security hole.","The pmp grant/deny checking must be compared vs ""rvfi_csr_<csrname>_rdata"".
 (This will detect whether the actual pmp decision differs from what the rvfi csr data would incidate.)
 
-Note: Compare ""pc_rdata"" for execute, and ""mem_"" signals for read/write. (Might need additional decoding of ""rvfi_insn"".)",Assertion Check,"ENV capability, not specific test",Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_musttrap
+Note: Compare ""pc_rdata"" for execute, and ""mem_"" signals for read/write. (Might need additional decoding of ""rvfi_insn"".)",Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_musttrap
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load
 
@@ -409,10 +551,8 @@ A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_cause
 
-A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_splittrap
-
-COV: ???",TODO missing cover
-,,,,"Inject pmp csr write instructions in random testing, intermingled with all other kinds of instructions. This should include random interrupts, bus faults, random bus stalls, etc.",Check against RM,Constrained-Random,Functional Coverage,,COV: ???,TODO missing cover
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_splittrap",
+,,,,"Inject pmp csr write instructions in random testing, intermingled with all other kinds of instructions. This should include random interrupts, bus faults, random bus stalls, etc.",Check against RM,Constrained-Random,Functional Coverage,No,COV: (SKIPPED),Cover skipped because random testing of pmp proved to be low ROI.
 ,,AffectSuccessors,"Updates to pmp configs MUST have an effect on later instructions.
 
 Note: Potential security hole.
@@ -423,100 +563,131 @@ Note: There was a known rtl bug here before (cv32e40s/issues/168).","The ""rvfi_
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_rvfi_csr_writes[0].a_rvfi_cfg_writes
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_rvfi_csr_writes[0].a_rvfi_addr_writes",
-,,,,(Same random testing as WaitUpdate above.),Other,Other,N/A,,N/A,
-,,ImplementationDetails,"Details about pipeline/prefetcher/bus flushing etc are not part of this vplan. Only black-box observable functional behavior is checked. (Such requirements exists in specs, but are deliberately not addressed here.)",N/A,N/A,N/A,N/A,,N/A,
-,,Performance,Requirements about performance and stalls etc are not covered here (unless review calls for the opposite).,N/A,N/A,N/A,N/A,,N/A,
-,,WriteBuffer,Changes to the pmp config should not impact the write buffer such that a transaction can get its grant/deny status altered.,"Cover cases of the write buffer being full while the pmp cfg changes. Checking of accidental grants is handled by SuppressReq below. Checking of guaranteed writes is not part of this vplan.
+,,,,(Same random testing as WaitUpdate above.),Other,Other,N/A,No,N/A,
+,,ImplementationDetails,"Details about pipeline/prefetcher/bus flushing etc are not part of this vplan. Only black-box observable functional behavior is checked. (Such requirements exists in specs, but are deliberately not addressed here.)",N/A,N/A,N/A,N/A,No,N/A,
+,,Performance,Requirements about performance and stalls etc are not covered here (unless review calls for the opposite).,N/A,N/A,N/A,N/A,No,N/A,
+,,WriteBuffer,Changes to the pmp config should not impact the write buffer such that a transaction can get its grant/deny status altered.,"Cover cases of the write buffer being full while the pmp cfg changes. Checking of accidental grants is handled by SuppressReq below.
+Checking of guaranteed writes is not part of this vplan.
 
-Note: The Write buffer is situated between the pmp and the bus.",Other,Other,Functional Coverage,High Priority,COV: ???,TODO missing cover
+Note: The Write buffer is situated between the pmp and the bus.",Other,Other,Functional Coverage,High Priority,"COV: (See ""WaitUpdate"").",
 ,Violations,SuppressReq,"When an access is denied by the pmp, the effect is that the attempted obi transaction is suppressed and does not reach the bus.
 
 Note: Both ""instr_req_o"" and ""data_req_o"".","Observe a transaction request coming in to the pmp module, observe the pmp denying the access, ensure that the obi bus is shielded from the transaction request.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_supress_req_data.a_suppress_req_data
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_supress_req_instr.a_suppress_req_instr",
-,,InternalBuses,(The transaction request feeding into the mpu and its response signaling is not covered by this vplan.),N/A,N/A,N/A,N/A,,N/A,
+,,InternalBuses,(The transaction request feeding into the mpu and its response signaling is not covered by this vplan.),N/A,N/A,N/A,N/A,No,N/A,
 ,,ExceptionExecute,"""mcause [...] Instruction access fault [...] Execution attempt with address failing PMP check.""","Attempt execution of a region that pmp denies execution of, ensure that an ""instruction access fault"" exception occurs (read mcause and rvfi signals).
 
-Note: Since ISS can check most of this, one could deprioritize this checking if it is not feasible to check within reasonable efforts. (Same for the next 2 items.)",Assertion Check,Constrained-Random,Assertion Coverage,,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_cause,
+Note: Since ISS can check most of this, one could deprioritize this checking if it is not feasible to check within reasonable efforts. (Same for the next 2 items.)",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_cause,
 ,,ExceptionLoad,"""mcause [...] Load access fault [...] Load attempt with address failing PMP check.""
 
-Note: Holds for load-reserved too.","Attempt loads (and load-reserveds) of a region that pmp denies reading from, ensure that a ""load access fault"" exception occurs (read mcause and rvfi signals).",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load
+Note: Holds for load-reserved too.","1) Attempt loads (and load-reserveds) of a region that pmp denies reading from,
+2) ensure that a ""load access fault"" exception occurs (read mcause and rvfi signals).
+
+Cover: normal / load-reserved / pop.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load
 
-COV: ???",TODO missing cover
+COV: (SKIPPED).","Cover skipped as ""rvfi_if.is_load_instr"" should handle all load types."
 ,,ExceptionStore,"""mcause [...] Store/AMO access fault [...] Store attempt with address failing PMP check.""
 
-Note: Holds for store-conditional and amo too.","Attempt stores (and store-conditionals and amo) to a region that pmp denies writing to, ensure that a ""store/amo access fault"" exception occurs (read mcause and rvfi signals).",Assertion Check,Constrained-Random,Functional Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_store
+Note: Holds for store-conditional and amo too.","1) Attempt stores (and store-conditionals and amo) to a region that pmp denies writing to,
+2) ensure that a ""store/amo access fault"" exception occurs (read mcause and rvfi signals).",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_store
 
-COV: ???",TODO missing cover
+COV: (SKIPPED).","Cover skipped as ""rvfi_if.is_store_instr"" should handle all store types."
 ,,TrapPrecisely,"""All exceptions are precise"".
 Meaning mepc will point to the offending instruction, and exactly previous instructions have their side effects fully visible.
 
 Note: Applies to loads, stores, and executes.","Observe that the pmp causes an exception, ensure that mepc points to the offending instruction.
 
-Note: Let the Exceptions vplan deal with visibility of side effects for earlier instructions. (Zc push/pop does not follow this, but that is mostly the responsibility of the Zc vplan.)
+Note: Let the Exceptions vplan deal with visibility of side effects for earlier instructions.
+(Zc push/pop does not follow this, but that is mostly the responsibility of the Zc vplan.)
 
-Note: If satisfactory mepc checking already exist then it is acceptable to just add covers for the pmp scenarios.",Assertion Check,Constrained-Random,Functional Coverage,,"A: ???
+Note: If satisfactory mepc checking already exist then it is acceptable to just add covers for the pmp scenarios.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: (SKIPPED).
 
-COV: ???","TODO missing assert
+COV: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noexec_cause"".
 
-TODO missing cover"
-,,AlertMinor,"""The following issues result in a minor security alert: [...] Instruction access fault [...] Load access fault [...] Store/AMO access fault""",(Responsibility of the xsecure vplan. But link to coverage here too.),N/A,N/A,N/A,,"A: ???
+COV: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_cause_load"".
 
-COV: ???",Waiting for xsecure vplan
+COV: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_cause_store"".","Assertion skipped because 1) we don't have readily-available helper signals for non-clic pointers, and 2) this is not a high priority assert. (It could be easy to write and assert that mepc is pc_rdata, with some exceptions to that rule.)"
+,,AlertMinor,"""The following issues result in a minor security alert: [...] Instruction access fault [...] Load access fault [...] Store/AMO access fault""",(Responsibility of the xsecure vplan. But link to coverage here too.),N/A,N/A,N/A,High Priority,"A: uvmt_cv32e40s_xsecure_security_alerts_assert.sv, ""a_xsecure_security_alert_non_nmi_exceptions"".
+
+COV: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noexec_cause"".
+
+COV: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_cause_load"".
+
+COV: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_cause_store"".",Waiting for xsecure vplan
 ,,AlertNothing,"The manual lists which pmp-related events can cause an alert minor, but the pmp should in no other cases be the cause for an alert (major/minor).
 
 Note: Example, ""attempt to reprogram a locked PMP""","Observe an alert signal going high while there is no pmp error that should have caused it, ensure that another viable reason for the alert was present.
 
-Note: This is slightly out of scope for this vplan, so if it is not very easy to hook on to existing xsecure (helper-)signals then this can be skipped.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-,,SplitLoadRegfile,"Even if parts of a split load can reach the bus, the instruction itself has failed and so the regfile should not get updated.","(Handled by ""SplitLoadException"" below, because: One only needs to show that an exception is caused, and the exceptions vplan is responsible for checking what that means for the regfile. (But link to coverage here too.))",N/A,N/A,N/A,,A: ???,Waiting for exceptions vplan
-,,SplitLoadException,"For split loads, regardless of which of the access that fails, the instruction should still cause an exception.","Perform a misaligned load that translates to multiple accesses, let any of the accesses be denied by pmp, ensure an exception occurs.
+Note: This is slightly out of scope for this vplan, so if it is not very easy to hook on to existing xsecure (helper-)signals then this can be skipped.",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED).,Assert skipped in favor of deeming the xsecure verification and integration-level testing sufficient.
+,,SplitLoadRegfile,"Even if parts of a split load can reach the bus, the instruction itself has failed and so the regfile should not get updated.","(Handled by ""SplitLoadException"" below, because: One only needs to show that an exception is caused, and the exceptions vplan is responsible for checking what that means for the regfile. (But link to coverage here too.))",N/A,N/A,N/A,No,"A: uvmt_cv32e40s_rvfi_assert.sv, ""a_exceptions_dont_update_gprs"".",
+,,SplitLoadException,"For split loads, regardless of which of the access that fails, the instruction should still cause an exception.","1) Perform a misaligned load that translates to multiple accesses,
+2) let any of the accesses be denied by pmp,
+3) ensure an exception occurs.
 
-Coverage: See rvfi retire with exception cause from pmp, while the ""low addr"" model checking gave access granted.",Assertion Check,Constrained-Random,Functional Coverage,,"A: ???
+Coverage: See rvfi retire with exception cause from pmp, while the ""low addr"" model checking gave access granted.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_splittrap"".","Note: The assert only checks that the 2nd access is denied, not the general case of _any_."
+,,FirstFail,"If a split load/store fails on its first transaction it should get an exception immediately, so it should not allow the second transaction reach the bus and mcause shall reflect the failing transactions.","1 Attempt such an instruction,
+2) ensure that the denied access does not reach the bus,
+3) ensure that following accesses also do not reach the bus.
 
-COV: ???","TODO missing assert
+Cover: load / store.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_rvfi_mem_allowed_data"".
 
-TODO missing cover"
-,,FirstFail,"If a split load/store fails on its first transaction it should get an exception immediately, so it should not allow the second transaction reach the bus and mcause shall reflect the failing transactions.","Attempt such an instruction, ensure that the denied access does not reach the bus, ensure that following accesses also do not reach the bus.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
+A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_rvfi_mem_allowed_upperdata"".",Note: Trusting RVFI to report OBI actuals truthfully.
 ,,PushPop,"If a push/pop fails on a transaction it should get an exception immediately, so the remaining transactions should not reach the bus and mcause shall reflect the failing transaction.","(Responsibility of the zc vplan. But link to coverage here too.)
 
-Note: Could write a pmp-specific cover, but coordinate with Zc vplan to ensure the checker is written too.",N/A,N/A,N/A,,"A: ???
+Cover: could write a pmp-specific cover, but coordinate with Zc vplan to ensure the checker is written too.",N/A,N/A,N/A,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.u_zc_assert.a_multiop_exception_stop_dbus_push
 
-COV: ???",Waiting for zc vplan
+A: A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.u_zc_assert.a_multiop_exception_stop_dbus_pop
+
+COV: (SKIPPED).",Cover skipped in favor of trusting that formal will exercise the assert for pmp-specific cases.
 ,,TableJump,PMP applies to table jumps and Zc instructions in general.,"(Responsibility of the zc vplan. But link to coverage here too.)
 
-Note: Could write a pmp-specific cover, but coordinate with Zc vplan to ensure the checker is written too.",N/A,N/A,N/A,,"A: ???
+Note: Could write a pmp-specific cover, but coordinate with Zc vplan to ensure the checker is written too.",N/A,N/A,N/A,High Priority,"A: (SKIPPED).
 
-COV: ???",Waiting for zc vplan
-,,ClicVector,"Similarly to TableJump above, CLIC vector fetch needs execute permission.",(Analogous to TableJump above.),N/A,N/A,N/A,,"A: ???
+COV: (SKIPPED).",Assert and cover skipped in favor of trusting that formal will exercise the assert for pmp-specific cases.
+,,ClicVector,"Similarly to TableJump above, CLIC vector fetch needs execute permission.",(Analogous to TableJump above.),N/A,N/A,N/A,High Priority,"A: ???
 
-COV: ???",Waiting for clic vplan
+COV: ???",TODO Waiting for clic vplan
 ,,Priority,"Exceptions priority apply to the PMP as well. Particularily, PMP exception (instruction access fault) gets priority over bus errors (instruction bus fault) if an instruction is the result of two fetches were both of these occurred.
 
-Note: Both could be present in an attempted executed instruction at the same time, because no exception occurs before the point of execution so there is enough time for both to be captured and travel through the pipeline.","Keep track of words fetched with bus error and with pmp execute denied, check retired instructions for a pc that overlaps two such fetches (cover both orders), ensure that ""instruction access fault"" is the taken exception.",Assertion Check,Constrained-Random,Functional Coverage,,"A: ???
+Note: Both could be present in an attempted executed instruction at the same time, because no exception occurs before the point of execution so there is enough time for both to be captured and travel through the pipeline.","1) Keep track of words fetched with bus error and with pmp execute denied,
+2) check retired instructions for a pc that overlaps two such fetches (cover both orders),
+3) ensure that ""instruction access fault"" is the taken exception.",Assertion Check,Constrained-Random,Functional Coverage,No,"A: (SKIPPED).
+
+COV: (SKIPPED).","Assert and cover skipped because it would require support logic with an unreasonably low ROI, and we have other exceptions checking."
+,Pma,RevokeExecutable,"Even if the pma should allow for execution, the pmp can overrule it and deny access.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma allow for execution, let the pmp deny it, attempt execution, ensure that execution is indeed denied.",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED).,Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient.
+,,RemainNonexecutable,"If the pma disallows execution, the pmp cannot change this fact and execution remains disallowed.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma disallow execution, let the pmp allow and deny execution (separate runs), attempt execution, ensure that execution is denied.",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED).,Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient.
+,,RevokePermissible,"Even if the pma allows for data access, the pmp can overrule it and deny access.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma allow for read and write (separate or same runs), let pmp deny read/write, attempt read/write, ensure that the pmp can overrule the pma.",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED).,Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient.
+,,RemainNonpermissible,"If the pma disallows data access, the pmp cannot change this fact and data access remains disallowed.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma deny read and write, let pmp allow or deny it, attempt read/write, ensure that the access is always denied.",Assertion Check,Constrained-Random,Assertion Coverage,No,A: (SKIPPED).,Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient.
+,,DisallowDebug,"""As execution based debug is used, the Debug Module region, as defined by the DM_REGION_START and DM_REGION_END parameters, needs to support code execution, loads and stores when CV32E40S is in debug mode. In order to achieve this CV32E40S overrules the PMA and PMP settings for the Debug Module region when it is in debug mode (see Physical Memory Attribution (PMA) and Physical Memory Protection (PMP)).""","Check that accesses to the DM region are never blocked.
 
-COV: ???","TODO missing assert
+Cover: access within range, would deny / allow.",Assertion Check,Directed Non-Self-Checking,Assertion Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal
 
-TODO missing cover"
-,Pma,RevokeExecutable,"Even if the pma should allow for execution, the pmp can overrule it and deny access.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma allow for execution, let the pmp deny it, attempt execution, ensure that execution is indeed denied.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-,,RemainNonexecutable,"If the pma disallows execution, the pmp cannot change this fact and execution remains disallowed.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma disallow execution, let the pmp allow and deny execution (separate runs), attempt execution, ensure that execution is denied.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-,,RevokePermissible,"Even if the pma allows for data access, the pmp can overrule it and deny access.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma allow for read and write (separate or same runs), let pmp deny read/write, attempt read/write, ensure that the pmp can overrule the pma.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-,,RemainNonpermissible,"If the pma disallows data access, the pmp cannot change this fact and data access remains disallowed.","Set up pma and pmp regions such that both have rules covering the same addresses, let the pma deny read and write, let pmp allow or deny it, attempt read/write, ensure that the access is always denied.",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
-misc,Misc,DisallowDebug,The PMP can deny usage of debug mode by setting up regions for dm_halt_addr and dm_exception_addr.,"Set up pmp rules so all D-mode entries are blocked from execution, attempt to enter debug mode, ensure that nohing is executed in debug mode.",Assertion Check,Directed Non-Self-Checking,Assertion Coverage,,A: ???,Waiting for ongoing spec changes to be resolved
-,,40x,The 40x does not have PMP.,N/A,N/A,N/A,N/A,,N/A,
-,,Xif,"The X-interface can do memory operations, but the 40x does not have PMP and the 40s does not have XIF.",N/A,N/A,N/A,N/A,,N/A,
+A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal
+
+COV: (SKIPPED).",Cover skipped in favor of trusting that formal will exercise the assert for dm region specific cases.
+misc,Misc,40x,The 40x does not have PMP.,N/A,N/A,N/A,N/A,No,N/A,
+,,Xif,"The X-interface can do memory operations, but the 40x does not have PMP and the 40s does not have XIF.",N/A,N/A,N/A,N/A,No,N/A,
 ,,RvfiReliable,"Rvfi is used for checking some pmp functionality, so the link between rvfi and pmp must be checked.","If feasible to model within reasonable effort, check that 1) the PMPs' privmode inputs and 2) CSRs and 3) wdata/wmask is for csr write instrs, are properly correlated between access attempts and rvfi reportings.
-Otherwise, leave this to general ISS checking.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
+Otherwise, leave this to general ISS checking.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,No,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*
 
 (Indirectly checked by those asserts)",
-,,RvfiTrap,"The ""rvfi_trap"" table has PMP-specific fields.","Augment the exception checkers above with checking of ""rvfi_trap.cause_type"" to ensure that specifically PMP is reported as the cause.",Assertion Check,"ENV capability, not specific test",Assertion Coverage,,A: ???,TODO missing assert
+,,RvfiTrap,"The ""rvfi_trap"" table has PMP-specific fields.","Augment the exception checkers above with checking of ""rvfi_trap.cause_type"" to ensure that specifically PMP is reported as the cause.
+E.g. ""|-> rvfi_trap"" changed to ""|-> rvfi_trap && <cause equal to …>"".",Assertion Check,"ENV capability, not specific test",Assertion Coverage,No,"A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noexec_cause"".
+
+A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_cause_load"".
+
+A: uvmt_cv32e40s_pmprvfi_assert.sv, ""a_noloadstore_cause_store"".",
 ,,UntilReset,"Everything that can get locked ""until reset"" must be possible to change after a reset. It should not be possible that these settings lock up so even resets cannot unlock them.
 
-Note: Formal's reset analysis should in principle be able to find every state that is possible to be in after a reset.","(Covered by ResetValues above. As long as those always take effect out of reset, then a permanent lock up should be either impossible or intentional.)",N/A,N/A,N/A,,N/A,
-,,Xsecure,(Will be covered by its own vplan.),N/A,N/A,N/A,N/A,,N/A,
-,,Reset,The PMP module is never reset without the whole core being reset. (As this could lift all the locks and stickies and grant privilege escalation.),Check that the core's reset is always equal to the pmp module's reset.,Assertion Check,"ENV capability, not specific test",Assertion Coverage,,A: ???,TODO missing assert
-,,UmodeZeroRegions,"If the parameters are set to have 0 pmp regions, then all rules are OFF and U-mode matches nothing and defaults to not have any access.","Be in U-mode, have PMP_NUM_REGIONS=0, ensure all accesses fail (read/write/execute).",Assertion Check,Constrained-Random,Assertion Coverage,,A: ???,TODO missing assert
+Note: Formal's reset analysis should in principle be able to find every state that is possible to be in after a reset.","(Covered by ResetValues above. As long as those always take effect out of reset, then a permanent lock up should be either impossible or intentional.)",N/A,N/A,N/A,No,N/A,
+,,Xsecure,(Will be covered by its own vplan.),N/A,N/A,N/A,N/A,High Priority,N/A,
+,,Reset,The PMP module is never reset without the whole core being reset. (As this could lift all the locks and stickies and grant privilege escalation.),Check that the core's reset is always equal to the pmp module's reset.,Assertion Check,"ENV capability, not specific test",Assertion Coverage,No,A: (SKIPPED).,"Skipped in favor of trusting ""WaitUpdate"" and ""AffectSuccessors"" and all other functional asserts.."
+,,UmodeZeroRegions,"If the parameters are set to have 0 pmp regions, then all rules are OFF and U-mode matches nothing and defaults to not have any access.","Be in U-mode, have PMP_NUM_REGIONS=0, ensure all accesses fail (read/write/execute).
+
+Note: also assert that read/write attempts can not occur.",Assertion Check,Constrained-Random,Assertion Coverage,High Priority,A: (SKIPPED).,Skipped in favor of using realease-specific configs.
 debug,Mmode,,"""All operations are executed with machine mode privilege"".
 It is mostly the responsibility of other vplans to check D-mode relationship to M-mode and U-mode, but the pmp inputs should be checked against debug mode.
 
@@ -524,19 +695,10 @@ Note: Refer to user-mode vplan and debug vplan if necessary.
 
 Note: It is assumed that once 1) dmode is shown to be interpreted as mmode by pmp, and 2) all mmode features are verified, then C) the mmode features will work in dmode. But one alternative is to duplicate all the mmode-related checking with dmode variants.","Ensure that the PMP inputs receive the correct mode while in D-mode.
 
-Note: Test w/wo MPRV too.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
+Cover: w/wo MPRV.",Assertion Check,Constrained-Random,Functional Coverage,High Priority,"A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*
 
 A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*
 
 (Indirectly checked by those asserts, together with effective priv mode and umode asserts for dmode/mmode.)
 
-COV: ???",TODO missing cover
-,,,,,,,,,,
-,,,,,,,,,,
-,,,,,,,,,,
-,,,,,,,,,,
-,,,,,,,,,,
-,,,,,,,,,,
-,,,,,,,,,,
-,,,,,,,,,,
- -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- END -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------,,,,,,,,,,
+COV: (SKIPPED).","Cover skipped because the asserts are deemed sufficient, and because debug has its own new override mechanism."
diff --git a/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.json b/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.json
index 43080652d0..d7dc326a6f 100644
--- a/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.json
+++ b/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.json
@@ -1,14 +1,14 @@
 [
     {
-        "Requirement Location": "",
+        "Requirement Location": "N/A",
         "Feature": "Comments",
         "Sub Feature": "SmepmpOverrule",
-        "Feature Description": "The \"smepmp\" spec features can overrule the \"privspec\" (e.g. for locking). Both specs are included here, so be mindful that checking of certain vplan items could be conditional.",
+        "Feature Description": "\"smepmp\" features can overrule the \"privspec\" (e.g. locking). Both specs are included here, so be aware that certain vplan items are conditional.",
         "Verification Goal": "N/A",
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -16,12 +16,12 @@
         "Requirement Location": "",
         "Feature": "Comments",
         "Sub Feature": "FunctionalCoverage",
-        "Feature Description": "Functional coverage is encouraged to be creative in capturing a broad set of possible state, and evaluate it towards the checkers, to catch aspects of pmp functionality that this vplan might have overlooked.",
+        "Feature Description": "Functional coverage should capture a broad set of possible state (could be compared with the checkers), to find crosses that this vplan might have overlooked.",
         "Verification Goal": "N/A",
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -29,12 +29,12 @@
         "Requirement Location": "",
         "Feature": "Comments",
         "Sub Feature": "ImplementationChanges",
-        "Feature Description": "If test implementation reveals new knowledge that contradicts or augments this vplan, then the vplan should be updated.",
+        "Feature Description": "If test implementation gains new knowledge, then update this vplan when appropriate.",
         "Verification Goal": "N/A",
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -42,12 +42,12 @@
         "Requirement Location": "",
         "Feature": "Comments",
         "Sub Feature": "TimeAllowance",
-        "Feature Description": "Some verification goals in this plan has a \"base level\" of checking plus some optional tweaks that might be tried. It is up to the testing implementation how to prioritize and potentially skip the extras, according to what time allows.",
+        "Feature Description": "Some of the verification goals have a \"base level\" of checking plus optional tweaks. It is up to implementation to prioritize and potentially skip the extras.",
         "Verification Goal": "N/A",
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -56,13 +56,13 @@
         "Feature": "General",
         "Sub Feature": "Configs",
         "Feature Description": "The pmp must be tested in a wide range of configurations. That includes testing on both instruction-side and data-side, and it includes testing overlapping regions, non-overlaping, no regions, differing settings for overlapping regions, M-mode only, U-mode only, both M-mode and U-mode, etc, etc. Use functional coverage with plenty of crosses.",
-        "Verification Goal": "Run with different configs to test parameters in low/mid/high ranges and in combination with the other parameters, instantiate checking on both instruction-side and data-side, write coverage to see all relevant region overlap combinations and to see an exhaustive combination of block-level input combinations and functional-level states.",
+        "Verification Goal": "Run with different configs to test parameters in low/mid/high ranges and in combination with the other parameters, instantiate checking on both instruction-side and data-side.\n\nCover: see all relevant region overlap combinations and to see an exhaustive combination of block-level input combinations and functional-level states.",
         "Pass/Fail Criteria": "Other",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "COV: (SKIPPED)",
+        "Comment": "Skipped in favor of using realease-specific configs."
     },
     {
         "Requirement Location": "",
@@ -73,35 +73,35 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
-        "Link to Coverage": "N/A",
-        "Comment": ""
+        "High Priority?": "No",
+        "Link to Coverage": "(SKIPPED)",
+        "Comment": "Skipped in favor of considering the normal assertions good enough and using release-specific configs."
     },
     {
         "Requirement Location": "",
         "Feature": "General",
         "Sub Feature": "UmodeAlways",
         "Feature Description": "\"PMP checks are applied to all accesses whose effective privilege mode is S or U, including instruction fetches in S and U mode, data accesses in S and U mode when the MPRV bit in the mstatus register is clear, and data accesses in any mode when the MPRV bit in mstatus is set and the MPP field in mstatus contains S or U.\"\n\nNote: None of those scenarios should let an access bypass the pmp.",
-        "Verification Goal": "Set up the system to match each point in the listing, ensure that the pmp's decision matches all modelled expectations.\n\nNote: Also cover when none of the listed preconditions are active and the pmp's decision can disagree with the modelled expectations.",
+        "Verification Goal": "Set up the system to match each point in the listing, ensure that the pmp's decision matches all modelled expectations.\n\nCover: when none of the listed preconditions are active and the pmp's decision can disagree with the modelled expectations.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nCOV: ???",
-        "Comment": "(Same as for \"MmodeDeny\")"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nCOV: (SKIPPED)",
+        "Comment": "(Same as for \"MmodeDeny\")\n\nCover is skipped because it is not essential, and we have equivalence checking of RTL vs model."
     },
     {
         "Requirement Location": "",
         "Feature": "General",
         "Sub Feature": "DefaultNone",
         "Feature Description": "\"PMP can grant permissions to S and U modes, which by default have none\"",
-        "Verification Goal": "Check that, out of reset, given no extraordinary reset values, and given no change to the pmp csrs, then U-mode has no access permissions.",
+        "Verification Goal": "Given:\n1) out of reset,\n2) no extraordinary reset values,\n3) no change to the pmp csrs.\n\nThen:\nU-mode has no access permissions. (I.e. always excepts.)",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
-        "Comment": "TODO missing assert"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: (SKIPPED).\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
+        "Comment": "Skipped in favor of using realease-specific configs (which have \"extraordinary reset values\")."
     },
     {
         "Requirement Location": "",
@@ -112,9 +112,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED)\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
+        "Comment": "Skipped in favor of the directed test and the entire test suite in general."
     },
     {
         "Requirement Location": "",
@@ -125,100 +125,100 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED)\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
+        "Comment": "Skipped in favor of integration-level testing w/ release-specific configs, and the directed test."
     },
     {
         "Requirement Location": "",
         "Feature": "Csrs",
         "Sub Feature": "Warl",
         "Feature Description": "\"All PMP CSR fields are WARL and may be hardwired to zero\".\n\nNote: A field shall also not change its value when an attempt is made to write an illegal value to it. (XWR is one field.)",
-        "Verification Goal": "Try writing any values to the registers and read values out of them, ensure that neither reads nor writes causes exceptions, and ensure that all read values are legal or otherwise as expected and that illegally written fields don't change.",
+        "Verification Goal": "Try writing any values to the registers and read values out of them.\nEnsure that neither reads nor writes causes exceptions.\nAnd ensure that all read values are legal or otherwise as expected and that illegally written fields don't change.\n\nCover: access to all CSRs and all fields.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfg_expected[*].a_cfg_expected\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfg_expected[*].a_cfg_expected\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because the asserts are deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "Csrs",
         "Sub Feature": "MmodeOnly",
         "Feature Description": "\"PMP CSRs are only accessible to M-mode.\"",
-        "Verification Goal": "Try to access any of the pmp CSRs from U-mode, ensure that it always gives \"illegal instruction exception\" and that the CSRs are not updated.\n\nNote: M-mode accesses are covered by AlwaysAccessible below.",
+        "Verification Goal": "Try to access any of the pmp CSRs from U-mode, ensure that it always gives \"illegal instruction exception\" and that the CSRs are not updated.\n\nCover: For all CSRs.\n\nNote: M-mode accesses are covered by AlwaysAccessible below.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_csrs_mmode_only\n\nCOV: ???\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
-        "Comment": "TODO missing cover (combine with \"Warl\" above)"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_csrs_mmode_only\n\nCOV: (SKIPPED)\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
+        "Comment": "Cover skipped because the asserts and directed test are deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "Csrs",
         "Sub Feature": "Addr34bit",
         "Feature Description": "\"Each PMP address register encodes bits 33\u20132 of a 34-bit physical address for RV32\"",
-        "Verification Goal": "Ensure that when the pmpaddr MSBs are set, then no NAPOT accesses matches. Cover that all bits have been matched against (\"toggle cross\"). Ensure that there are no attempted accesses to MSBs that the core should not be able to use.",
+        "Verification Goal": "Ensure that when the two pmpaddr MSBs are set, then no NAPOT accesses matches.\nEnsure that there are no attempted accesses to MSBs that the core should not be able to use.\n\nCover: all bits have been matched against (\"toggle cross\").",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).\n\nCOV: (SKIPPED)",
+        "Comment": "Assert and cover skipped in favor of model equivalence checking."
     },
     {
         "Requirement Location": "",
         "Feature": "Csrs",
         "Sub Feature": "AddrImplemented",
         "Feature Description": "\"Not all physical address bits may be implemented, and so the pmpaddr registers are WARL.\"",
-        "Verification Goal": "Cover (toggle) that all bits can be both written and set. (UnusedZero below covers the WARL(0x0) case.)",
+        "Verification Goal": "Cover: (toggle) that all bits can be both written and set.\n\n(\"UnusedZero\" below covers the WARL(0x0) case.)",
         "Pass/Fail Criteria": "Other",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "COV: (SKIPPED)",
+        "Comment": "Skipped in favor of integration-level testing w/ release-specific configs."
     },
     {
         "Requirement Location": "",
         "Feature": "AddressMatching",
         "Sub Feature": "MatchDisabled",
         "Feature Description": "\"When A=0, this PMP entry is disabled and matches no addresses\"\nWhen a cfg is set to off but its address(es) (interpreted as napot/tor) is the only rule that matches an attempted access, then it still does not count as a match.",
-        "Verification Goal": "Have a region's address(es) set up as tor and napot (separate runs), have all other regions not include the target address, have the target region's rule be OFF, make an access within that range, ensure that the outcome is the same as for when an access is outside of all address ranges.\n\nNote: For this and several other items, functional coverage is necessary because the checking doesn't necessarily have the above scenario in its antecedent.\n\nCoverage: Capture the above scenario, minus the checking.",
+        "Verification Goal": "Have a region's address(es) set up as tor and napot (separate runs),\nhave all other regions not include the target address,\nhave the target region's rule be OFF,\nmake an access within that range,\nensure that the outcome is the same as for when an access is outside of all address ranges.\n\nNote: For this and several other items, functional coverage is necessary because the checking doesn't necessarily have the above scenario in its antecedent.\n\nCoverage: Capture the above scenario, minus the checking.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA:\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)",
+        "Comment": "Cover is skipped in favor of integration-level testing w/ release-specific configs, because we have equivalence checking of RTL vs model."
     },
     {
         "Requirement Location": "",
         "Feature": "AddressMatching",
         "Sub Feature": "NapotMatching",
         "Feature Description": "\"NAPOT ranges make use of the low-order bits of the associated address register to encode the size of the range [\"yyyy...yy01\" etc]\"\n\nNote: The napot address matching modes match on addresses that are equal to the requested access when masked to the granularity size.",
-        "Verification Goal": "Configure napot rules of different sizes, try accesses within and outside the regions, ensure that the outcomes corresponds to the designated sizes.\n\nNote: Includes NAPOT and NA4.\n\nNote: Try also max and min.",
+        "Verification Goal": "Configure napot rules of different sizes.\nTry accesses within and outside the regions.\nEnsure that the outcomes corresponds to the designated sizes.\n\nNote: Includes NAPOT and NA4.\n\nCover: Matching inside / outside.\n\nCover: Min / Max of the \"yyy...\" patterns.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_na4is4byte.a_na4_is_4byte\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_bin_auto[*]\ndut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_disallowed_bin_auto[*]\n\nCOV: ???",
-        "Comment": "TODO missing coverage"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_na4is4byte.a_na4_is_4byte\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_bin_auto[*]\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_napot_encoding_disallowed_bin_auto[*]\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped (min/max) in favor of model equivalence checking and trusting formal's capability of exercising the asserts."
     },
     {
         "Requirement Location": "",
         "Feature": "AddressMatching",
         "Sub Feature": "TorMatching",
         "Feature Description": "\"If TOR is selected, the associated address register forms the top of the address range, and the preceding PMP address register forms the bottom of the address range. If PMP entry i\u2019s A field is set to TOR, the entry matches any address y such that pmpaddri\u22121 \u2264 y < pmpaddri (irrespective  of the value of pmpcfgi\u22121)\"",
-        "Verification Goal": "Configure tor regions of different sizes, try accesses within and outside the regions, ensure that the outcomes corresponds to the designated ranges.",
+        "Verification Goal": "Configure tor regions of different sizes.\nTry accesses within and outside the regions.\nEnsure that the outcomes correspond to the designated ranges.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_ismatch_tor_bin_auto[*]\n\nCOV: ???",
-        "Comment": "TODO missing coverage"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_cg_common.cover_item_covergroup_cg_internals_common_inst_cg_int_coverpoint_cp_ismatch_tor_bin_auto[*]",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -229,9 +229,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
+        "Comment": "Cover skipped in favor of directed test and equivalence checking vs model."
     },
     {
         "Requirement Location": "",
@@ -242,9 +242,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)\n\nDTC: cv32e40s/tests/programs/custom/pmp/",
+        "Comment": "Cover skipped in favor of directed test and equivalence checking vs model."
     },
     {
         "Requirement Location": "",
@@ -255,9 +255,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED)",
+        "Comment": "Assert skipped in favor of the asserts checking the grain in general and model equivalence checking."
     },
     {
         "Requirement Location": "",
@@ -281,7 +281,7 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -308,8 +308,8 @@
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_all_zeros_g1.gen_all_zeros_i[*].a_all_zeros\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_all_zeros_g1.gen_all_zeros_i[*].a_all_zeros\n\nCOV: uvmt_cv32e40s_pmp_assert.sv,  \"cp_ismatch_tor\".\n\nCOV: uvmt_cv32e40s_pmp_assert.sv, \"cov_rlb_locked_rules_can_remove\".",
+        "Comment": "(The covers are written for a different purpose but should sufficiently hit this.)"
     },
     {
         "Requirement Location": "",
@@ -320,22 +320,22 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED)",
+        "Comment": "Assert skipped in favor of  model equivalence checking."
     },
     {
         "Requirement Location": "",
         "Feature": "AddressMatching",
         "Sub Feature": "StorageUnaffected",
         "Feature Description": "\"Although changing pmpcfgi.A[1] affects the value read from pmpaddri, it does not affect the underlying value stored in that register\"\n\"in particular, pmpaddri[G-1] retains its original value when pmpcfgi.A is changed from NAPOT to TOR/OFF then back to NAPOT.\"",
-        "Verification Goal": "Change in and out of (OFF || TOR) and !(OFF || TOR), ensure that different values can be read without having written anything new to the register.",
+        "Verification Goal": "Change in and out of (OFF || TOR) and !(OFF || TOR), ensure that different values can be read without having written anything new to the register.\n\nCover: All transitions, na4/napot -> off/tor.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_storage_unaffected[*].a_storage_unaffected\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_storage_unaffected[*].a_storage_unaffected\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
@@ -359,7 +359,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -381,37 +381,37 @@
         "Feature": "LockingAndPrivmode",
         "Sub Feature": "IgnoreWrites",
         "Feature Description": "\"If PMP entry i is locked, writes to pmpicfg and pmpaddri are ignored.\"",
-        "Verification Goal": "Lock entry i (for all i, if feasible), ensure that their value can't change, both when written to and otherwise. (Unless if RLB interferes.)",
+        "Verification Goal": "Lock entry i (for all i, if feasible), ensure that their value can't change. (Unless if RLB interferes.)\n\nCover: both when written to and otherwise.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_writes_notrap[*].a_ignore_writes_notrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_writes_nochange[*].a_ignore_writes_nochange\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked[*].a_norlb_locked_rules_cannot_modify\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_writes_notrap[*].a_ignore_writes_notrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_writes_nochange[*].a_ignore_writes_nochange\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because the asserts are deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "LockingAndPrivmode",
         "Sub Feature": "IgnoreTor",
         "Feature Description": "\"Additionally, if PMP entry i is locked and pmpicfg.A is set to TOR, writes to pmpaddri-1 are ignored.\"",
-        "Verification Goal": "Lock entry i (\u2026), have A set and the mode be TOR, ensure that pmpaddri-1 can't change, both for explicit writes and otherwise. (Unless RLB.)",
+        "Verification Goal": "Lock entry i (\u2026), have A set and the mode be TOR, ensure that pmpaddri-1 can't change. (Unless RLB.)\n\nCover: both for explicit writes and otherwise",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_stable\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_wdata\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_stable\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_ignore_tor[*].a_ignore_tor_wdata\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because the asserts are deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "LockingAndPrivmode",
         "Sub Feature": "NotIgnore",
         "Feature Description": "When neither cfg i is locked, nor is cfg i+1 a locked TOR region, then writes to cfg and addr i are not ignored.",
-        "Verification Goal": "Have cfg i unlocked, write to cfg and addr csr i, check that it changes.",
+        "Verification Goal": "Have cfg i unlocked,\nwrite to cfg and addr csr i,\ncheck that it changes.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_addr_writes[*].a_addr_nonlocked\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_addr_tor[*].a_addr_nonlocked_tor",
         "Comment": ""
     },
@@ -425,21 +425,21 @@
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: (Same checking as for \"IgnoreWrites\" and \"IgnoreTor\" above.)\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: (Same checking as for \"IgnoreWrites\" and \"IgnoreTor\" above.)\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped, trusting formal to exercise the assert."
     },
     {
         "Requirement Location": "",
         "Feature": "LockingAndPrivmode",
         "Sub Feature": "RwxPrivmode",
         "Feature Description": "\"In addition to locking the PMP entry, the L bit  indicates whether the R/W/X permissions are enforced on M-mode accesses. When the L bit is set, these permissions are enforced for all privilege modes.\"",
-        "Verification Goal": "Be in M-mode and U-mode (separate runs), access a region where L is set and where RWX {grant, deny R, deny W, deny X}, ensure that the access is correspondingly granted/denied.",
+        "Verification Goal": "Be in M-mode and U-mode (separate runs),\naccess a region where L is set and where RWX {grant, deny R, deny W, deny X},\nensure that the access is correspondingly granted/denied.\n\nCover: grant, deny R, deny W, deny X.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because the asserts are deemed sufficient."
     },
     {
         "Requirement Location": "",
@@ -450,35 +450,35 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED)",
+        "Comment": "Assert skipped in favor of Smepmp-based assertions."
     },
     {
         "Requirement Location": "",
         "Feature": "LockingAndPrivmode",
         "Sub Feature": "RwxUmode",
         "Feature Description": "\"When the L bit is clear [\u2026] the R/W/X permissions apply only to S and U modes.\"",
-        "Verification Goal": "Be in U-mode, access a region where L is clear, ensure that access is granted/denied based on RWX.",
+        "Verification Goal": "Be in U-mode, access a region where L is clear, ensure that access is granted/denied based on RWX.\n\nCover: granted / denied.\n\nNote: The M-mode part of this is handled by \"MmodeSucceed\" above.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_uorl_onlyif_rwx\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_uorl_onlyif_rwx\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_uorl_onlyif_rwx\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_uorl_onlyif_rwx\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because the asserts are deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "PriorityAndMatching",
         "Sub Feature": "LowestDetermines",
         "Feature Description": "\"PMP entries are statically prioritized. The lowest-numbered PMP entry that matches any byte of an access determines whether that access succeeds or fails.\"\n\nNote: \"any\" byte.",
-        "Verification Goal": "Access a region that is covered by multiple rules, ensure that the lowest indexed match determines the outcome.\n\nNote: Requires that the rules would disagree on the outcome.",
+        "Verification Goal": "Access a region that is covered by multiple rules, ensure that the lowest indexed match determines the outcome.\n\nNote: Requires that the rules would disagree on the outcome. (One rule allows, other disallows.)\n\nCover: \"winning\" rule allows / disallows.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped, trusting formal to exercise the assert."
     },
     {
         "Requirement Location": "",
@@ -489,7 +489,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -498,13 +498,13 @@
         "Feature": "PriorityAndMatching",
         "Sub Feature": "LrwxDetermines",
         "Feature Description": "\"If a PMP entry matches all bytes of an access, then the L, R, W,and X bits determine whether the access succeeds or fails. [...] if the L bit is set or the privilege mode of the access is S or U, then the access succeeds only if the R, W,or X bit corresponding to the access type is set.\"",
-        "Verification Goal": "Access a pmp region where L and the privmode etc is such that nothing else would deny the access, ensure that each of (or a combination of) RWX can either grant or deny the access.",
+        "Verification Goal": "Access a pmp region where L and the privmode etc is such that nothing else would deny the access, ensure that each of (or a combination of) RWX can either grant or deny the access.\n\nCover: U, M, L, grant, deny R, deny W, deny X, etc.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_lrwx_aftermatch\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_lrwx_aftermatch\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_lrwx_aftermatch\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_lrwx_aftermatch\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because the asserts are deemed sufficient. It is partially covered already by the \"general\" covergroup and its crosses."
     },
     {
         "Requirement Location": "",
@@ -515,7 +515,7 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -524,13 +524,13 @@
         "Feature": "PriorityAndMatching",
         "Sub Feature": "MmodeNomatch",
         "Feature Description": "\"If no PMP entry matches an M-mode access, the access succeeds.\"",
-        "Verification Goal": "Be in M-mode, access a region where no rule matches, ensure that the access is granted (where MMWP is off).\n\n(Note, see \"Smepmp\" above.)",
+        "Verification Goal": "Be in M-mode,\naccess a region where no rule matches,\nensure that the access is granted (where MMWP is off).\n\nCover: the checker is generic, so cover this specific scenario.\n\n(Note, see \"Smepmp\" above.)",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nCOV: uvmt_cv32e40s_pmp_assert.sv, \"cp_x_mmode_nomatch_nommwp_x\".\n\nCOV: uvmt_cv32e40s_pmp_assert.sv, \"cp_r_mmode_nomatch_nommwp_r\".\n\nCOV: uvmt_cv32e40s_pmp_assert.sv, \"cp_w_mmode_nomatch_nommwp_w\".",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -540,23 +540,23 @@
         "Verification Goal": "Be in U-mode, do an access that doesn't match any region, ensure that the access fails.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
-        "Coverage Method": "Functional Coverage",
+        "Coverage Method": "Assertion Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_umode_fails\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_umode_fails\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_umode_fails\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_umode_fails",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
         "Feature": "PriorityAndMatching",
         "Sub Feature": "UmodeOff",
         "Feature Description": "\"If at least one PMP entry is implemented, but all PMP entries\u2019 A fields are set to OFF, then all S-mode and U-mode memory accesses will fail.\"",
-        "Verification Goal": "Be in U-mode, have all entries OFF, make an access, ensure that the access fails (for all variations of accesses).",
+        "Verification Goal": "Be in U-mode,\nhave all entries OFF,\nmake an access,\nensure that the access fails.\n\nCover: this specific scenario.\n\nCover: for all variations of accesses",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
-        "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Coverage Method": "Assertion Coverage",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_umode_off\".\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)",
+        "Comment": "Second cover skipped because it should be the responsibility of the \"general\" covergroup and its crosses."
     },
     {
         "Requirement Location": "",
@@ -566,62 +566,62 @@
         "Verification Goal": "Cause failed accesses on instructions/loads/stores, ensure that an exception occurs and that it is the right one.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
-        "Coverage Method": "Functional Coverage",
+        "Coverage Method": "Assertion Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nA: <embedded>::uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nA: <embedded>::uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
         "Feature": "PriorityAndMatching",
         "Sub Feature": "MultiAccess",
         "Feature Description": "\"Note that a single instruction may generate multiple accesses, which may not be mutually atomic. An access-fault exception is generated if at least one access generated by an instruction fails, though other accesses generated by that instruction may succeed with visible side effects.\"\n\n\"On some implementations, misaligned loads, stores, and instruction fetches may also be decomposed into multiple accesses, some of which may succeed before an access-fault exception occurs. In particular, a portion of a misaligned store that passes the PMP check may become visible, even if another portion fails the PMP check.\"",
-        "Verification Goal": "Induce misaligned word instruction-fetch, load, and store, where the lower and upper (separate runs) parts are either accessible or blocked by pmp, ensure that exceptions occur while parts of the access might reach the bus.\n\nAlso check Zc's push/pop and table jump.\n\nNote: It is up to other vplans to check what happens upon the exception. It is up to this PMP vplan to check that the PMP will cause the exceptions.",
+        "Verification Goal": "Induce misaligned word instruction-fetch, load, and store, where the lower and upper (separate runs) parts are either accessible or blocked by pmp, ensure that exceptions occur while parts of the access might reach the bus.\n\nCover: upper/lower blocked/allowed.\n\nCover: parts reaching the bus.\n\nCover: push/pop and table jump.\n\nNote: It is up to other vplans to check what happens upon the exception. It is up to this PMP vplan to check that the PMP will cause the exceptions.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_splittrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_splittrap\n\nA: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert (on split that errs on first)\n\nTODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec*\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore*\n\nA: (SKIPPED)\n\nCOV: (SKIPPED)",
+        "Comment": "Assert skipped (explicitly, split that errs on first) because it is theoretically covered by the generic assert.\n\nSpecific covers skipped, in favor of trusting formal's ability to exercise the asserts."
     },
     {
         "Requirement Location": "smepmp",
         "Feature": "MsecCfg",
         "Sub Feature": "MmodeOnly",
-        "Feature Description": "\"Machine Security Configuration (mseccfg) is [...] only accessible to Machine mode.\"\n\nNote: Includes \"mseccfgh\".",
-        "Verification Goal": "Access (read/write) mseccfg (and mseccfgh) from M-mode, access mseccfg from U-mode, ensure that the first always works (WARL) and the second never works (exception).\n\nNote: Cover with MPRV too.",
+        "Feature Description": "\"Machine SECurity ConFiGuration (mseccfg) is [...] only accessible to Machine mode.\"\n\nNote: Includes \"mseccfgh\".",
+        "Verification Goal": "Access (read/write) mseccfg (and mseccfgh) from M-mode, access mseccfg from U-mode, ensure that the first always works (WARL) and the second never works (exception).\n\nNote: Cover with MPRV too.\n\nCover: read/write, mmode/umode, mprv/no, mseccfg/mseccfgh.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
-        "Coverage Method": "Assertion Coverage",
+        "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_csrs_mmode_only\".\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped, trusting formal to exercise the assert."
     },
     {
         "Requirement Location": "",
         "Feature": "MsecCfg",
         "Sub Feature": "FieldsWarl",
         "Feature Description": "\"All mseccfg fields defined on this proposal are WARL\"",
-        "Verification Goal": "Try writing any values to the fields (the defined ones, but also other bits) and read values out of the fields, ensure that neither reads nor writes causes exceptions, and ensure that all read values are legal or otherwise as expected.\n\nNote: This relates to the \"stickiness\" of those fields. Regardless of their values and current stickiness, the fields are WARL.\n\nNote: It might be difficult, when trying to write a checker for traps, to filter out all other causes for traps that can occur simultaneously. (Either reduce the scope of checking, or write re-usable helper signals for \"trap causality\" info.)\n\nNote: \"WPRI\" on some bits.",
+        "Verification Goal": "Try writing any values to the fields (the defined ones, but also other bits) and read values out of the fields, ensure that neither reads nor writes causes exceptions, and ensure that all read values are legal or otherwise as expected.\n\nNote: This relates to the \"stickiness\" of those fields. Regardless of their values and current stickiness, the fields are WARL.\n\nNote: \"WPRI\" on some bits.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_csrs_mmode_only\".\n\nA: (SKIPPED)\n\nCOV: (SKIPPED)",
+        "Comment": "Second assert skipped because the features themselves are covered by other asserts and integration testing.\n\nCover skipped for the same reasons as the assert and also because the covergroups in uvmt_cv32e40s_pmp_assert.sv covers parts of it."
     },
     {
         "Requirement Location": "",
         "Feature": "MsecCfg",
         "Sub Feature": "ReservedZero",
-        "Feature Description": "\"the remaining bits are reserved for future standard use and should always read zero.\"\n(This spec can't dictate that about other specs, but the user manual agrees on the hardwiring.)",
+        "Feature Description": "\"the remaining bits are reserved for future standard use and should always read zero.\"\n\n(Note: This spec can't dictate that about other specs, but the user manual agrees on the hardwiring.)",
         "Verification Goal": "Read mseccfg, ensure the non-smepmp-field bits are always zero.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "Link to Coverage": "A: uvmt_cv32e40s_pmp_assert.sv, \"a_reserved_zero_mseccfg_fields\".",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -645,9 +645,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_addr\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_exec\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_lock\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_mode\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_read\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].c_rlb_locked_rules_can_modify_write\n\nCOV: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: N/A\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_addr\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_exec\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_lock\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_mode\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_read\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.*.gen_rlb_locked_cov[*].cov_rlb_locked_rules_can_modify_write\n\nCOV: uvmt_cv32e40s_pmp_assert.sv, \"cov_rlb_locked_rules_can_modify_tor\".",
+        "Comment": "The assert is N/A because the covers are the checkers."
     },
     {
         "Requirement Location": "",
@@ -667,13 +667,13 @@
         "Feature": "LockingBypass",
         "Sub Feature": "UntilReset",
         "Feature Description": "The sticky zero and update-ignores last until reset, and do not hold after reset.",
-        "Verification Goal": "Ensure that RLB is modifiable after reset. (Unless if reset values are set to activate the RemainZero condition.)",
+        "Verification Goal": "Ensure that RLB is modifiable after reset. (Unless if reset values are set to activate the RemainZero condition.)\n\nNote: Both enable / disable.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
-        "Coverage Method": "Functional Coverage",
+        "Coverage Method": "Assertion Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_until_reset_notbefore\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_until_reset_notbefore",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -684,7 +684,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -706,39 +706,39 @@
         "Feature": "WhiteList",
         "Sub Feature": "Denied",
         "Feature Description": "\"When set it changes the default PMP policy for M-mode when accessing memory regions that don\u2019t have a matching PMP rule, to denied instead of ignored.\"",
-        "Verification Goal": "Have MMWP set, be in (effective mode) M-mode, access regions that don't match any rule (including OFF, \"reversed\" TOR, >32bit NAPOT, etc), ensure that the access is denied.",
+        "Verification Goal": "Have MMWP set,\nbe in (effective mode) M-mode,\naccess regions that don't match any rule (including OFF, \"reversed\" TOR, >32bit NAPOT, etc),\nensure that the access is denied.\n\nCover: MPRV/no, off/reversed/napot.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_mmode_mmwp_fails\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_mmode_mmwp_fails\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_nomatch_mmode_mmwp_fails\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_nomatch_mmode_mmwp_fails\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownGeneral",
         "Sub Feature": "StickyUntilReset",
         "Feature Description": "\"[mseccfg.MML] is a sticky bit, meaning that once set it cannot be unset until a PMP reset.\"",
-        "Verification Goal": "Cover: Trying to clear the bit.\n\nCheck: Have MML set, ensure that it remains high forever (til reset).",
+        "Verification Goal": "Check: Have MML set, ensure that it remains high forever (til reset).\n\nCover: Trying to clear the bit.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_mml_never_fall_until_reset\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_mml_never_fall_until_reset\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_pmp_assert.a_mml_never_fall_until_reset\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_mml_never_fall_until_reset\n\nCOV: (Skipped)",
+        "Comment": "Cover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownGeneral",
         "Sub Feature": "ExecIgnored",
         "Feature Description": "\"[When mseccfg.MML is set.] Adding an M-mode-only or a locked Shared-Region rule with executable privileges is not possible and such pmpcfg writes are ignored, leaving pmpcfg unchanged.\"\n\nNote: \"pmpcfg\" refers to a field, so the write to the CSR itself should still update other fields.",
-        "Verification Goal": "Have MML set, try adding an \"M-mode-only\" rule and a \"locked Shared-Region\" rule with X privileges, ensure that the relevant pmpcfg field is not updated but is left unchanged, ensure also that other fields can still get updated.",
+        "Verification Goal": "Have MML set,\ntry adding an \"M-mode-only\" rule and a \"locked Shared-Region\" rule with X privileges,\nensure that the relevant pmpcfg field is not updated but is left unchanged,\nensure also that other fields can still get updated.\n\nCover: M-mode-only / Shared-Region.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked_cov[0].a_mmode_only_or_shared_executable_ignore\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked_cov[0].a_mmode_only_or_shared_executable_ignore\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgwdata_legal[*].a_cfgwdata_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_rlb_locked_cov[0].a_mmode_only_or_shared_executable_ignore\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_rlb_locked_cov[0].a_mmode_only_or_shared_executable_ignore\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
@@ -758,13 +758,13 @@
         "Feature": "LockdownGeneral",
         "Sub Feature": "MmodeExec",
         "Feature Description": "\"Executing code with Machine mode privileges is only possible from memory regions with a matching M-mode-only rule or a locked Shared-Region rule with executable privileges. Executing code from a region without a matching rule or with a matching S/U-mode-only rule is denied.\"",
-        "Verification Goal": "Execute from \"M-mode-only\" and \"locked Shared-Region\" regions, attempt execution without matching and from \"U-mode-only\" regions, ensure corresponding grant or deny.",
+        "Verification Goal": "Execute from \"M-mode-only\" and \"locked Shared-Region\" regions,\nattempt execution without matching and from \"U-mode-only\" regions,\nensure corresponding grant or deny.\n\nCover: The different scenarios.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
@@ -784,39 +784,39 @@
         "Feature": "LockdownA",
         "Sub Feature": "MmodeEnforce",
         "Feature Description": "\"[When mseccfg.MML is set.] An M-mode-only rule is enforced on Machine mode\"",
-        "Verification Goal": "Be in M-mode, have MML set, access an \"M-mode-only\" region, ensure that the grant/deny is always in accordance to the rule. (E.g. it is not denied execute despite the execute bit being set.)\n\nNote: Exclude cases of interference from e.g. PMA.",
+        "Verification Goal": "Be in M-mode,\nhave MML set,\naccess an \"M-mode-only\" region,\nensure that the grant/deny is always in accordance to the rule.\n(E.g. it is not denied execute despite the execute bit being set.)\n\nCover: grant / deny for this specific scenario.\n\nNote: Exclude cases of interference from e.g. PMA.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "(Same as for \"MmodeDeny\")"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)",
+        "Comment": "(Same as for \"MmodeDeny\")\n\nCover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownA",
         "Sub Feature": "UmodeDeny",
         "Feature Description": "\"[When mseccfg.MML is set.] An M-mode-only rule is [...] denied in Supervisor or User mode.\"",
-        "Verification Goal": "Be in U-mode, have MML set, access an \"M-mode-only\" region, ensure that the access is always denied.",
+        "Verification Goal": "Be in U-mode,\nhave MML set,\naccess an \"M-mode-only\" region,\nensure that the access is always denied.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: (SKIPPED)",
+        "Comment": "Explicit assert skipped in favor of model equivalence checking."
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownA",
         "Sub Feature": "RemainLocked",
-        "Feature Description": "\"It also remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset\"\n\nCertain rules under MML are sticky. They cannot be modified again.",
-        "Verification Goal": "Configure rules for {\"M-mode-only\", \"U-mode-only, \"Shared-Region rule where pmpcfg.L is set\"(both kinds)}, have MML=1 (and RLB=0), ensure that the configs never change again (until reset).",
+        "Feature Description": "\"[An M-mode-only rule] also remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP reset\"\n\nCertain rules under MML are sticky. They cannot be modified again.",
+        "Verification Goal": "1) Configure for \"M-mode-only,\n2) have MML=1 (and RLB=0),\n3) ensure that the configs never change again (until reset).\n\nCover: with mml=1. (Since the assert re-uses a different vplan item's assert.)",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert"
+        "Link to Coverage": "A: (See IgnoreWrites)\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped because assert is deemed sufficient."
     },
     {
         "Requirement Location": "",
@@ -828,46 +828,46 @@
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert"
+        "Link to Coverage": "A: (see \"ModifiableEntries\")\n\nCOV: (See \"ModifiableEntries\")",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownA",
         "Sub Feature": "UmodeEnforce",
         "Feature Description": "\"[When mseccfg.MML is set.] An S/U-mode-only rule is enforced on Supervisor and User modes \"",
-        "Verification Goal": "Be in U-mode, have MML=1, access a \"U-mode-only\" region, ensure that the grant/deny is in accordance with the rule (apart from PMA etc).",
+        "Verification Goal": "1) Be in U-mode,\n2) have MML=1,\n3) access a \"U-mode-only\" region,\n4) ensure that the grant/deny is in accordance with the rule (apart from PMA etc).\n\nCover: Grant / deny.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cg_data\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_cp_instr_side.cg_instr\n\nCOV: ???",
-        "Comment": "(Same as for \"MmodeDeny\")"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cg_data\n\nCOV: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_cp_instr_side.cg_instr\n\nCOV: (SKIPPED)",
+        "Comment": "(Same as for \"MmodeDeny\")\n\nSkipped cover for explicit deny, in favor of model equivalence checking."
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownA",
         "Sub Feature": "MmodeDeny",
         "Feature Description": "\"An S/U-mode-only rule is [...] denied on Machine mode.\"",
-        "Verification Goal": "Be in M-mode, have MML=1, access a \"U-mode-only\" region, ensure that the access is always denied.",
+        "Verification Goal": "1) Be in M-mode,\n2) have MML=1,\n3) access a \"U-mode-only\" region,\n4) ensure that the access is always denied.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
-        "Comment": "TODO missing coverage. (Just do a cg with crosses of all of these variables.)"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped in favor of model equivalence checking."
     },
     {
         "Requirement Location": "",
         "Feature": "LockdownA",
         "Sub Feature": "SharedEnforced",
         "Feature Description": "\"A Shared-Region rule is enforced on all modes\"",
-        "Verification Goal": "Be in M-mode and U-mode (separate runs), access a \"Shared-Region\", ensure that the grant/deny is in accordance with the rule.",
+        "Verification Goal": "1) Be in M-mode and U-mode (separate runs),\n2) access a \"Shared-Region\",\n3) ensure that the grant/deny is in accordance with the rule.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"UmodeEnforce\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -875,12 +875,12 @@
         "Feature": "LockdownA",
         "Sub Feature": "SharedNoexec",
         "Feature Description": "\"A Shared-Region rule where pmpcfg.L is not set can be used for sharing data between M-mode and S/U-mode, so is not executable.\"",
-        "Verification Goal": "Be in M-mode and U-mode, try to execute from \"A Shared-Region rule where pmpcfg.L is not set\", ensure that it does not work (exception).",
+        "Verification Goal": "1) Be in M-mode and U-mode,\n2) try to execute from \"A Shared-Region rule where pmpcfg.L is not set\",\n3) ensure that it does not work (exception).",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"MmodeDeny\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -888,12 +888,12 @@
         "Feature": "LockdownA",
         "Sub Feature": "MmodeReadwrite",
         "Feature Description": "\"[Shared-Region rule where pmpcfg.L is not set.] M-mode has read/write access to that region\"",
-        "Verification Goal": "Be in M-mode, perform reads and writes to such a region, ensure that the intended effects happen and that the accesses do not cause exceptions.",
+        "Verification Goal": "1) Be in M-mode,\n2) perform reads and writes to such a region,\n3) ensure that the intended effects happen and that the accesses do not cause exceptions.\n\nCover: read / write.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"MmodeDeny\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -905,8 +905,8 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"MmodeDeny\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -918,8 +918,8 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"MmodeDeny\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -931,8 +931,8 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"MmodeDeny\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -944,8 +944,8 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (See \"MmodeDeny\").",
         "Comment": "(Same as for \"MmodeDeny\")"
     },
     {
@@ -957,7 +957,7 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -970,9 +970,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\nuvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_cp_instr_side.cover_item_covergroup_cg_internals_instr_side_inst_cg_instr_coverpoint_cp_r_mmode_mml_lrwx\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cover_item_covergroup_cg_internals_data_side_inst_cg_instr_coverpoint_cp_r_mmode_mml_lrwx\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cover_item_covergroup_cg_internals_data_side_inst_cg_instr_coverpoint_cp_r_umode_mml_lrwx\n\nCOV: ???",
-        "Comment": "TODO technically missing the \"the rest \u2026 excepts\" cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.if_stage_i.mpu_i.pmp.pmp_i.u_pmp_assert_if_stage.gen_cp_instr_side.cover_item_covergroup_cg_internals_instr_side_inst_cg_instr_coverpoint_cp_r_mmode_mml_lrwx\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cover_item_covergroup_cg_internals_data_side_inst_cg_instr_coverpoint_cp_r_mmode_mml_lrwx\n\nCOV: dut_wrap.cv32e40s_wrapper_i.core_i.load_store_unit_i.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_cp_data_side.cover_item_covergroup_cg_internals_data_side_inst_cg_instr_coverpoint_cp_r_umode_mml_lrwx\n\nCOV: (SKIPPED)",
+        "Comment": "Non-exhaustive covers, in favor of model equivalence checking (technically missing the \"the rest \u2026 excepts\" cover)."
     },
     {
         "Requirement Location": "",
@@ -983,7 +983,7 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1009,22 +1009,22 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "COV: uvmt_cv32e40s_pmp_assert.sv, \"cg_internals_*\".\n\nCOV: (SKIPPED)",
+        "Comment": "Cover skipped for all explicit variations of \"denied\", in favor of model equivalence checking."
     },
     {
         "Requirement Location": "manual",
         "Feature": "Parameters",
         "Sub Feature": "MinimumGranularity",
         "Feature Description": "\"The PMP_GRANULARITY parameter is used to configure the minimum granularity of PMP address matching. The minimum granularity is [2^(PMP_GRANULARITY+2)] bytes, so at least 4 bytes.\"",
-        "Verification Goal": "Have runs with max granularity, minimum granularity, and something in between. Make sure all checkers/covers are active for each relevant run configuration, so tor/napot/na4 is tested with different granularities. Cover cases where a match would otherwise occur but the granularity made the access not match.\n\nNote: Ensure TorMatching etc above heed this parameter.",
+        "Verification Goal": "Have runs with max granularity, minimum granularity, and something in between. Make sure all checkers/covers are active for each relevant run configuration, so tor/napot/na4 is tested with different granularities.\n\nCover: cases where a match would otherwise occur but the granularity made the access not match.\n\nNote: Ensure TorMatching etc above heed this parameter.",
         "Pass/Fail Criteria": "Other",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "COV: (SKIPPED)",
+        "Comment": "Cover skipped in favor of release-specific configs and the rest of the tests/asserts."
     },
     {
         "Requirement Location": "",
@@ -1035,9 +1035,9 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "COV: (SKIPPED)",
+        "Comment": "Cover skipped in favor of release-specific configs."
     },
     {
         "Requirement Location": "",
@@ -1048,9 +1048,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED)\n\nCOV: (SKIPPED)",
+        "Comment": "Assert and cover skipped in favor of release-specific configs and integration-level testing."
     },
     {
         "Requirement Location": "",
@@ -1061,7 +1061,7 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1070,24 +1070,24 @@
         "Feature": "CSRs",
         "Sub Feature": "AlwaysAccessible",
         "Feature Description": "\"All PMP CSRs are always implemented\". \"MRW\". The CSRs are M-mode accessible, and their existence does not depend on PMP_NUM_REGIONS.\n\nNote: \"All\" pmp registers, and all fields within them.",
-        "Verification Goal": "Be in M-mode, access (reads/writes) all the pmp csrs, ensure that it always works without excepting (because the csrs exist and the mode is appropriate).\n\nNote: Potential overlap with CSR vplan.",
+        "Verification Goal": "1) Be in M-mode,\n2) access (reads/writes) all the pmp csrs,\n3) ensure that it always works without excepting (because the csrs exist and the mode is appropriate).\n\nNote: Potential overlap with CSR vplan.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Directed Non-Self-Checking",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_always_accessible_mmode_csrs\".",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
         "Feature": "CSRs",
         "Sub Feature": "ReservedLegal",
         "Feature Description": "Reserved bits/fields have legal values, matching the platform-specified defaults.",
-        "Verification Goal": "(Overlaps with LegalRwx and RwReservedabove.) Read all fields of all pmp-related csrs, ensure there are no unsupported values anywhere (at all times).",
+        "Verification Goal": "(Overlaps with LegalRwx and RwReservedabove.)\nRead all fields of all pmp-related csrs, ensure there are no unsupported values anywhere (at all times).",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.gen_cfgrdata_expected[*].a_cfgrdata_expected",
         "Comment": ""
     },
@@ -1101,21 +1101,21 @@
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_mseccfgh_zero\".",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
         "Feature": "CSRs",
         "Sub Feature": "UnusedZero",
         "Feature Description": "\"CSRs (or bitfields of CSRs) related to PMP entries with number PMP_NUM_REGIONS and above are hardwired to zero.\"\n\nNote: Including upper parts of pmpcfgn and also pmpaddr.",
-        "Verification Goal": "Read pmpcfg and pmpaddr csrs, ensure the values are zero as specified. Cover that the other values can be non-zero.",
+        "Verification Goal": "1) Read pmpcfg and pmpaddr csrs,\n2) ensure the values are zero as specified.\n\nCover: that the other values can be non-zero.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "High Priority",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmp_assert.sv, \"a_unused_zero_pmp_csrs\".\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped as not important."
     },
     {
         "Requirement Location": "",
@@ -1126,7 +1126,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1138,10 +1138,10 @@
         "Verification Goal": "The pmp grant/deny checking must be compared vs \"rvfi_csr_<csrname>_rdata\".\n(This will detect whether the actual pmp decision differs from what the rvfi csr data would incidate.)\n\nNote: Compare \"pc_rdata\" for execute, and \"mem_\" signals for read/write. (Might need additional decoding of \"rvfi_insn\".)",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
-        "Coverage Method": "Functional Coverage",
+        "Coverage Method": "Assertion Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_musttrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_store\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_splittrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_musttrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_cause\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_splittrap\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_musttrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_store\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_splittrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_musttrap\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_cause\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_splittrap",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -1152,9 +1152,9 @@
         "Pass/Fail Criteria": "Check against RM",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "COV: (SKIPPED)",
+        "Comment": "Cover skipped because random testing of pmp proved to be low ROI."
     },
     {
         "Requirement Location": "",
@@ -1178,7 +1178,7 @@
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1191,7 +1191,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1204,7 +1204,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1213,13 +1213,13 @@
         "Feature": "MicroArchitecture",
         "Sub Feature": "WriteBuffer",
         "Feature Description": "Changes to the pmp config should not impact the write buffer such that a transaction can get its grant/deny status altered.",
-        "Verification Goal": "Cover cases of the write buffer being full while the pmp cfg changes. Checking of accidental grants is handled by SuppressReq below. Checking of guaranteed writes is not part of this vplan.\n\nNote: The Write buffer is situated between the pmp and the bus.",
+        "Verification Goal": "Cover cases of the write buffer being full while the pmp cfg changes. Checking of accidental grants is handled by SuppressReq below.\nChecking of guaranteed writes is not part of this vplan.\n\nNote: The Write buffer is situated between the pmp and the bus.",
         "Pass/Fail Criteria": "Other",
         "Test Type": "Other",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "COV: ???",
-        "Comment": "TODO missing cover"
+        "Link to Coverage": "COV: (See \"WaitUpdate\").",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -1243,7 +1243,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1256,7 +1256,7 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_cause",
         "Comment": ""
     },
@@ -1265,39 +1265,39 @@
         "Feature": "Violations",
         "Sub Feature": "ExceptionLoad",
         "Feature Description": "\"mcause [...] Load access fault [...] Load attempt with address failing PMP check.\"\n\nNote: Holds for load-reserved too.",
-        "Verification Goal": "Attempt loads (and load-reserveds) of a region that pmp denies reading from, ensure that a \"load access fault\" exception occurs (read mcause and rvfi signals).",
+        "Verification Goal": "1) Attempt loads (and load-reserveds) of a region that pmp denies reading from,\n2) ensure that a \"load access fault\" exception occurs (read mcause and rvfi signals).\n\nCover: normal / load-reserved / pop.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_load\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped as \"rvfi_if.is_load_instr\" should handle all load types."
     },
     {
         "Requirement Location": "",
         "Feature": "Violations",
         "Sub Feature": "ExceptionStore",
         "Feature Description": "\"mcause [...] Store/AMO access fault [...] Store attempt with address failing PMP check.\"\n\nNote: Holds for store-conditional and amo too.",
-        "Verification Goal": "Attempt stores (and store-conditionals and amo) to a region that pmp denies writing to, ensure that a \"store/amo access fault\" exception occurs (read mcause and rvfi signals).",
+        "Verification Goal": "1) Attempt stores (and store-conditionals and amo) to a region that pmp denies writing to,\n2) ensure that a \"store/amo access fault\" exception occurs (read mcause and rvfi signals).",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_store\n\nCOV: ???",
-        "Comment": "TODO missing cover"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_cause_store\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped as \"rvfi_if.is_store_instr\" should handle all store types."
     },
     {
         "Requirement Location": "",
         "Feature": "Violations",
         "Sub Feature": "TrapPrecisely",
         "Feature Description": "\"All exceptions are precise\".\nMeaning mepc will point to the offending instruction, and exactly previous instructions have their side effects fully visible.\n\nNote: Applies to loads, stores, and executes.",
-        "Verification Goal": "Observe that the pmp causes an exception, ensure that mepc points to the offending instruction.\n\nNote: Let the Exceptions vplan deal with visibility of side effects for earlier instructions. (Zc push/pop does not follow this, but that is mostly the responsibility of the Zc vplan.)\n\nNote: If satisfactory mepc checking already exist then it is acceptable to just add covers for the pmp scenarios.",
+        "Verification Goal": "Observe that the pmp causes an exception, ensure that mepc points to the offending instruction.\n\nNote: Let the Exceptions vplan deal with visibility of side effects for earlier instructions.\n(Zc push/pop does not follow this, but that is mostly the responsibility of the Zc vplan.)\n\nNote: If satisfactory mepc checking already exist then it is acceptable to just add covers for the pmp scenarios.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).\n\nCOV: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noexec_cause\".\n\nCOV: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_cause_load\".\n\nCOV: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_cause_store\".",
+        "Comment": "Assertion skipped because 1) we don't have readily-available helper signals for non-clic pointers, and 2) this is not a high priority assert. (It could be easy to write and assert that mepc is pc_rdata, with some exceptions to that rule.)"
     },
     {
         "Requirement Location": "",
@@ -1308,8 +1308,8 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_xsecure_security_alerts_assert.sv, \"a_xsecure_security_alert_non_nmi_exceptions\".\n\nCOV: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noexec_cause\".\n\nCOV: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_cause_load\".\n\nCOV: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_cause_store\".",
         "Comment": "Waiting for xsecure vplan"
     },
     {
@@ -1321,9 +1321,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Assert skipped in favor of deeming the xsecure verification and integration-level testing sufficient."
     },
     {
         "Requirement Location": "",
@@ -1334,48 +1334,48 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "Waiting for exceptions vplan"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_rvfi_assert.sv, \"a_exceptions_dont_update_gprs\".",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
         "Feature": "Violations",
         "Sub Feature": "SplitLoadException",
         "Feature Description": "For split loads, regardless of which of the access that fails, the instruction should still cause an exception.",
-        "Verification Goal": "Perform a misaligned load that translates to multiple accesses, let any of the accesses be denied by pmp, ensure an exception occurs.\n\nCoverage: See rvfi retire with exception cause from pmp, while the \"low addr\" model checking gave access granted.",
+        "Verification Goal": "1) Perform a misaligned load that translates to multiple accesses,\n2) let any of the accesses be denied by pmp,\n3) ensure an exception occurs.\n\nCoverage: See rvfi retire with exception cause from pmp, while the \"low addr\" model checking gave access granted.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
-        "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "Coverage Method": "Assertion Coverage",
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_splittrap\".",
+        "Comment": "Note: The assert only checks that the 2nd access is denied, not the general case of _any_."
     },
     {
         "Requirement Location": "",
         "Feature": "Violations",
         "Sub Feature": "FirstFail",
         "Feature Description": "If a split load/store fails on its first transaction it should get an exception immediately, so it should not allow the second transaction reach the bus and mcause shall reflect the failing transactions.",
-        "Verification Goal": "Attempt such an instruction, ensure that the denied access does not reach the bus, ensure that following accesses also do not reach the bus.",
+        "Verification Goal": "1 Attempt such an instruction,\n2) ensure that the denied access does not reach the bus,\n3) ensure that following accesses also do not reach the bus.\n\nCover: load / store.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_rvfi_mem_allowed_data\".\n\nA: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_rvfi_mem_allowed_upperdata\".",
+        "Comment": "Note: Trusting RVFI to report OBI actuals truthfully."
     },
     {
         "Requirement Location": "",
         "Feature": "Violations",
         "Sub Feature": "PushPop",
         "Feature Description": "If a push/pop fails on a transaction it should get an exception immediately, so the remaining transactions should not reach the bus and mcause shall reflect the failing transaction.",
-        "Verification Goal": "(Responsibility of the zc vplan. But link to coverage here too.)\n\nNote: Could write a pmp-specific cover, but coordinate with Zc vplan to ensure the checker is written too.",
+        "Verification Goal": "(Responsibility of the zc vplan. But link to coverage here too.)\n\nCover: could write a pmp-specific cover, but coordinate with Zc vplan to ensure the checker is written too.",
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "Waiting for zc vplan"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.u_zc_assert.a_multiop_exception_stop_dbus_push\n\nA: A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.u_zc_assert.a_multiop_exception_stop_dbus_pop\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped in favor of trusting that formal will exercise the assert for pmp-specific cases."
     },
     {
         "Requirement Location": "",
@@ -1386,9 +1386,9 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "Waiting for zc vplan"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: (SKIPPED).\n\nCOV: (SKIPPED).",
+        "Comment": "Assert and cover skipped in favor of trusting that formal will exercise the assert for pmp-specific cases."
     },
     {
         "Requirement Location": "",
@@ -1399,22 +1399,22 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "Waiting for clic vplan"
+        "Comment": "TODO Waiting for clic vplan"
     },
     {
         "Requirement Location": "",
         "Feature": "Violations",
         "Sub Feature": "Priority",
         "Feature Description": "Exceptions priority apply to the PMP as well. Particularily, PMP exception (instruction access fault) gets priority over bus errors (instruction bus fault) if an instruction is the result of two fetches were both of these occurred.\n\nNote: Both could be present in an attempted executed instruction at the same time, because no exception occurs before the point of execution so there is enough time for both to be captured and travel through the pipeline.",
-        "Verification Goal": "Keep track of words fetched with bus error and with pmp execute denied, check retired instructions for a pc that overlaps two such fetches (cover both orders), ensure that \"instruction access fault\" is the taken exception.",
+        "Verification Goal": "1) Keep track of words fetched with bus error and with pmp execute denied,\n2) check retired instructions for a pc that overlaps two such fetches (cover both orders),\n3) ensure that \"instruction access fault\" is the taken exception.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???\n\nCOV: ???",
-        "Comment": "TODO missing assert\n\nTODO missing cover"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).\n\nCOV: (SKIPPED).",
+        "Comment": "Assert and cover skipped because it would require support logic with an unreasonably low ROI, and we have other exceptions checking."
     },
     {
         "Requirement Location": "",
@@ -1425,9 +1425,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient."
     },
     {
         "Requirement Location": "",
@@ -1438,9 +1438,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient."
     },
     {
         "Requirement Location": "",
@@ -1451,9 +1451,9 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient."
     },
     {
         "Requirement Location": "",
@@ -1464,25 +1464,25 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Assert skipped in favor of regarding the pmp and pma efforts themselves as sufficient."
     },
     {
-        "Requirement Location": "misc",
-        "Feature": "Misc",
+        "Requirement Location": "",
+        "Feature": "Pma",
         "Sub Feature": "DisallowDebug",
-        "Feature Description": "The PMP can deny usage of debug mode by setting up regions for dm_halt_addr and dm_exception_addr.",
-        "Verification Goal": "Set up pmp rules so all D-mode entries are blocked from execution, attempt to enter debug mode, ensure that nohing is executed in debug mode.",
+        "Feature Description": "\"As execution based debug is used, the Debug Module region, as defined by the DM_REGION_START and DM_REGION_END parameters, needs to support code execution, loads and stores when CV32E40S is in debug mode. In order to achieve this CV32E40S overrules the PMA and PMP settings for the Debug Module region when it is in debug mode (see Physical Memory Attribution (PMA) and Physical Memory Protection (PMP)).\"",
+        "Verification Goal": "Check that accesses to the DM region are never blocked.\n\nCover: access within range, would deny / allow.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Directed Non-Self-Checking",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "Waiting for ongoing spec changes to be resolved"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_accept_only_legal\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.core_i.*.mpu_i.pmp.pmp_i.u_pmp_assert_lsu.gen_pmp_assert.a_deny_only_illegal\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped in favor of trusting that formal will exercise the assert for dm region specific cases."
     },
     {
-        "Requirement Location": "",
+        "Requirement Location": "misc",
         "Feature": "Misc",
         "Sub Feature": "40x",
         "Feature Description": "The 40x does not have PMP.",
@@ -1490,7 +1490,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1503,7 +1503,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1516,7 +1516,7 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*\n\n(Indirectly checked by those asserts)",
         "Comment": ""
     },
@@ -1525,13 +1525,13 @@
         "Feature": "Misc",
         "Sub Feature": "RvfiTrap",
         "Feature Description": "The \"rvfi_trap\" table has PMP-specific fields.",
-        "Verification Goal": "Augment the exception checkers above with checking of \"rvfi_trap.cause_type\" to ensure that specifically PMP is reported as the cause.",
+        "Verification Goal": "Augment the exception checkers above with checking of \"rvfi_trap.cause_type\" to ensure that specifically PMP is reported as the cause.\nE.g. \"|-> rvfi_trap\" changed to \"|-> rvfi_trap && <cause equal to \u2026>\".",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noexec_cause\".\n\nA: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_cause_load\".\n\nA: uvmt_cv32e40s_pmprvfi_assert.sv, \"a_noloadstore_cause_store\".",
+        "Comment": ""
     },
     {
         "Requirement Location": "",
@@ -1542,7 +1542,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "No",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1555,7 +1555,7 @@
         "Pass/Fail Criteria": "N/A",
         "Test Type": "N/A",
         "Coverage Method": "N/A",
-        "High Priority?": "",
+        "High Priority?": "High Priority",
         "Link to Coverage": "N/A",
         "Comment": ""
     },
@@ -1568,151 +1568,34 @@
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "ENV capability, not specific test",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "No",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Skipped in favor of trusting \"WaitUpdate\" and \"AffectSuccessors\" and all other functional asserts.."
     },
     {
         "Requirement Location": "",
         "Feature": "Misc",
         "Sub Feature": "UmodeZeroRegions",
         "Feature Description": "If the parameters are set to have 0 pmp regions, then all rules are OFF and U-mode matches nothing and defaults to not have any access.",
-        "Verification Goal": "Be in U-mode, have PMP_NUM_REGIONS=0, ensure all accesses fail (read/write/execute).",
+        "Verification Goal": "Be in U-mode, have PMP_NUM_REGIONS=0, ensure all accesses fail (read/write/execute).\n\nNote: also assert that read/write attempts can not occur.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Assertion Coverage",
-        "High Priority?": "",
-        "Link to Coverage": "A: ???",
-        "Comment": "TODO missing assert"
+        "High Priority?": "High Priority",
+        "Link to Coverage": "A: (SKIPPED).",
+        "Comment": "Skipped in favor of using realease-specific configs."
     },
     {
         "Requirement Location": "debug",
         "Feature": "Mmode",
         "Sub Feature": "",
         "Feature Description": "\"All operations are executed with machine mode privilege\".\nIt is mostly the responsibility of other vplans to check D-mode relationship to M-mode and U-mode, but the pmp inputs should be checked against debug mode.\n\nNote: Refer to user-mode vplan and debug vplan if necessary.\n\nNote: It is assumed that once 1) dmode is shown to be interpreted as mmode by pmp, and 2) all mmode features are verified, then C) the mmode features will work in dmode. But one alternative is to duplicate all the mmode-related checking with dmode variants.",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
+        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nCover: w/wo MPRV.",
         "Pass/Fail Criteria": "Assertion Check",
         "Test Type": "Constrained-Random",
         "Coverage Method": "Functional Coverage",
         "High Priority?": "High Priority",
-        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*\n\n(Indirectly checked by those asserts, together with effective priv mode and umode asserts for dmode/mmode.)\n\nCOV: ???",
-        "Comment": "TODO missing cover"
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": "",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
-    },
-    {
-        "Requirement Location": " -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- END -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------",
-        "Feature": "Mmode",
-        "Sub Feature": "",
-        "Feature Description": "",
-        "Verification Goal": "Ensure that the PMP inputs receive the correct mode while in D-mode.\n\nNote: Test w/wo MPRV too.",
-        "Pass/Fail Criteria": "",
-        "Test Type": "",
-        "Coverage Method": "",
-        "High Priority?": "",
-        "Link to Coverage": "",
-        "Comment": ""
+        "Link to Coverage": "A: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noexec_*\n\nA: uvmt_cv32e40s_tb.dut_wrap.cv32e40s_wrapper_i.rvfi_i.pmprvfi_assert_i.a_noloadstore_*\n\n(Indirectly checked by those asserts, together with effective priv mode and umode asserts for dmode/mmode.)\n\nCOV: (SKIPPED).",
+        "Comment": "Cover skipped because the asserts are deemed sufficient, and because debug has its own new override mechanism."
     }
 ]
\ No newline at end of file
diff --git a/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.xlsx b/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.xlsx
index a24e24418a..c52977586c 100755
Binary files a/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.xlsx and b/cv32e40s/docs/VerifPlans/Simulation/privileged_spec/CV32E40S_PMP.xlsx differ
diff --git a/cv32e40s/tb/assertions/uvmt_cv32e40s_pmp_assert.sv b/cv32e40s/tb/assertions/uvmt_cv32e40s_pmp_assert.sv
index 52b14563fc..ef9abfa5e9 100644
--- a/cv32e40s/tb/assertions/uvmt_cv32e40s_pmp_assert.sv
+++ b/cv32e40s/tb/assertions/uvmt_cv32e40s_pmp_assert.sv
@@ -205,25 +205,25 @@ module uvmt_cv32e40s_pmp_assert
           iff (csr_pmp_i.cfg[match_status.val_index].mode == PMP_MODE_NAPOT &&
                match_status.is_matched         == 1'b1 &&
                match_status.is_access_allowed  == 1'b1
-        );
+          );
 
         cp_napot_min_8byte_disallowed: coverpoint { pmp_req_addr_i[2+PMP_GRANULARITY], csr_pmp_i.addr[match_status.val_index][2+PMP_GRANULARITY] }
           iff (csr_pmp_i.cfg[match_status.val_index].mode == PMP_MODE_NAPOT &&
                match_status.is_matched         == 1'b1 &&
                match_status.is_access_allowed  == 1'b0
-        );
+          );
 
         cp_napot_encoding: coverpoint ( pmp_req_addr_i[33:2+PMP_GRANULARITY] == csr_pmp_i.addr[match_status.val_index][33:2+PMP_GRANULARITY] )
           iff (csr_pmp_i.cfg[match_status.val_index].mode == PMP_MODE_NAPOT &&
                match_status.is_matched        == 1'b1 &&
                match_status.is_access_allowed == 1'b1
-        );
+          );
 
         cp_napot_encoding_disallowed: coverpoint ( pmp_req_addr_i[33:2+PMP_GRANULARITY] == csr_pmp_i.addr[match_status.val_index][33:2+PMP_GRANULARITY] )
           iff (csr_pmp_i.cfg[match_status.val_index].mode == PMP_MODE_NAPOT &&
                match_status.is_matched        == 1'b1 &&
                match_status.is_access_allowed == 1'b0
-        );
+          );
 
       endgroup
       cg_internals_common cg_int = new();
@@ -306,6 +306,14 @@ module uvmt_cv32e40s_pmp_assert
         $changed(csr_pmp_i.cfg[region].read)
     );
 
+    if (region > 0) begin: gen_tor
+      cov_rlb_locked_rules_can_modify_tor : cover property (
+        csr_pmp_i.mseccfg.rlb === 1'b1 && csr_pmp_i.cfg[region].lock === 1'b1 &&
+        csr_pmp_i.cfg[region].mode === PMP_MODE_TOR ##1
+          $changed(csr_pmp_i.cfg[region-1])
+      );
+    end
+
     cov_rlb_locked_rules_can_remove : cover property (
       csr_pmp_i.mseccfg.rlb === 1'b1 &&
       csr_pmp_i.cfg[region].lock == 1'b1 &&
@@ -538,6 +546,23 @@ module uvmt_cv32e40s_pmp_assert
   end
 
 
+  // "mseccfg" has fields hardwired to 0  (vplan:ReservedZero)
+
+  a_reserved_zero_mseccfg_fields: assert property (
+    csr_pmp_i.mseccfg[31:3] == '0
+  ) else `uvm_error(info_tag, "mseccfg fields not zero");
+
+
+  // "Unused" PMP CSRs read as zero  (vplan:UnusedZero)
+
+  for (genvar i = PMP_NUM_REGIONS; i < 64; i++) begin: gen_unused_zero
+    a_unused_zero_pmp_csrs: assert property (
+      csr_pmp_i.cfg[i] == '0  &&
+      csr_pmp_i.addr[i] == '0
+    );
+  end
+
+
 endmodule : uvmt_cv32e40s_pmp_assert
 
 
diff --git a/cv32e40s/tb/assertions/uvmt_cv32e40s_pmprvfi_assert.sv b/cv32e40s/tb/assertions/uvmt_cv32e40s_pmprvfi_assert.sv
index 7384639c0b..40984dc58e 100644
--- a/cv32e40s/tb/assertions/uvmt_cv32e40s_pmprvfi_assert.sv
+++ b/cv32e40s/tb/assertions/uvmt_cv32e40s_pmprvfi_assert.sv
@@ -29,8 +29,8 @@ module uvmt_cv32e40s_pmprvfi_assert
   import uvma_rvfi_pkg::EXC_CAUSE_INSTR_INTEGRITY_FAULT;
   import uvmt_cv32e40s_base_test_pkg::*;
 #(
-  parameter int  PMP_GRANULARITY = 0,
-  parameter int  PMP_NUM_REGIONS = 0
+  parameter int  PMP_GRANULARITY,
+  parameter int  PMP_NUM_REGIONS
 )(
   // Clock and Reset
   input wire  clk_i,
@@ -84,14 +84,14 @@ module uvmt_cv32e40s_pmprvfi_assert
 
   string info_tag = "CV32E40S_PMPRVFI_ASSERT";
 
-  localparam logic [1:0] MODE_U                = 2'b 00;
-  localparam logic [1:0] MODE_M                = 2'b 11;
-  localparam logic [2:0] DBG_TRIGGER           = 3'd 2;
-  localparam int         NUM_CFG_REGS          = 16;
-  localparam int         NUM_ADDR_REGS         = 64;
-  localparam int         CSRADDR_FIRST_PMPCFG  = 12'h 3A0;
-  localparam int         CSRADDR_FIRST_PMPADDR = 12'h 3B0;
-  localparam int         CSRADDR_MSECCFG       = 12'h 747;
+  localparam int           NUM_ADDR_REGS         = 64;
+  localparam int           NUM_CFG_REGS          = 16;
+  localparam logic [11:0]  CSRADDR_FIRST_PMPADDR = 12'h 3B0;
+  localparam logic [11:0]  CSRADDR_FIRST_PMPCFG  = 12'h 3A0;
+  localparam logic [11:0]  CSRADDR_MSECCFG       = 12'h 747;
+  localparam logic [1:0]   MODE_M                = 2'b 11;
+  localparam logic [1:0]   MODE_U                = 2'b 00;
+  localparam logic [2:0]   DBG_TRIGGER           = 3'd 2;
 
   typedef struct packed {
     logic  pc_lower;
@@ -222,6 +222,16 @@ module uvmt_cv32e40s_pmprvfi_assert
   assign  pmp_csr_rvfi_wdata.mseccfg = rvfi_csr_mseccfg_wdata;
   assign  pmp_csr_rvfi_wmask.mseccfg = rvfi_csr_mseccfg_wmask;
 
+  logic  is_all_regions_off;
+  always_comb begin
+    is_all_regions_off = 1;
+    for (int i = 0; i < PMP_NUM_REGIONS; i++) begin
+      if (pmp_csr_rvfi_rdata.cfg[i].mode != '0) begin
+        is_all_regions_off = 0;
+      end
+    end
+  end
+
 
   // Helper models
 
@@ -336,30 +346,22 @@ module uvmt_cv32e40s_pmprvfi_assert
     .*
   );
 
-  var [31:0]  clk_cnt;
-  always @(posedge clk_i, negedge rst_ni) begin
-    if (rst_ni == 0) begin
-      clk_cnt <= 32'd 1;
-    end else if (clk_cnt != '1) begin
-      clk_cnt <= clk_cnt + 32'd 1;
-    end
-  end
 
 
   // Assertions:
 
 
-  // PMP CSRs only accessible from M-mode  (vplan:Csrs:MmodeOnly)
+  // PMP CSRs only accessible from M-mode  (vplan:Csrs:MmodeOnly, vplan:MsecCfg:MmodeOnly)
 
-  sequence seq_csrs_mmode_only_ante;
+  sequence  seq_pmp_csr_access(mode);
     is_rvfi_csr_instr      &&
-    (rvfi_mode == MODE_U)  &&
+    (rvfi_mode == mode)  &&
     (rvfi_insn[31:20] inside {['h3A0 : 'h3EF], 'h747, 'h757})  //PMP regs
     ;
-  endsequence : seq_csrs_mmode_only_ante
+  endsequence
 
   a_csrs_mmode_only: assert property (
-    seq_csrs_mmode_only_ante
+    seq_pmp_csr_access(MODE_U)
     |->
     is_rvfi_exc_ill_instr          ||
     is_rvfi_exc_instr_bus_fault    ||
@@ -370,9 +372,16 @@ module uvmt_cv32e40s_pmprvfi_assert
 
   cov_csrs_mmode_only: cover property (
     // Want to see "the real cause" (ill exc) finishing this property
-    seq_csrs_mmode_only_ante  ##0  is_rvfi_exc_ill_instr
+    seq_pmp_csr_access(MODE_U) ##0  is_rvfi_exc_ill_instr
   );
 
+  // M-mode can always access the csrs  (vplan:AlwaysAccessible)
+  a_always_accessible_mmode_csrs: assert property (
+    seq_pmp_csr_access(MODE_M)
+    |->
+    ! is_rvfi_exc_ill_instr
+  ) else `uvm_error(info_tag, "mmode couldn't access csr");
+
 
   // NAPOT, some bits read as ones, depending on G  (vplan:NapotOnes)
 
@@ -897,7 +906,7 @@ module uvmt_cv32e40s_pmprvfi_assert
       csr_intended_wdata <=
         rvfi_if.csr_intended_wdata(
           ({24'd 0, pmp_csr_rvfi_rdata.cfg[i]} << 8*(i%4)),
-          (CSRADDR_FIRST_PMPCFG + (i / 3'd4))
+          (CSRADDR_FIRST_PMPCFG + (i[11:0] / 3'd4))
         );
     end
     wire pmpncfg_t  cfg_attempt = csr_intended_wdata[32'd 8 * (i%4) +: 8];
@@ -906,7 +915,7 @@ module uvmt_cv32e40s_pmprvfi_assert
       pmp_csr_rvfi_rdata.mseccfg.rlb  &&
       pmp_csr_rvfi_rdata.mseccfg.mml
       ##0
-      rvfi_if.is_csr_write(CSRADDR_FIRST_PMPCFG + (i / 3'd4))  &&
+      rvfi_if.is_csr_write(CSRADDR_FIRST_PMPCFG + (i[11:0] / 3'd4))  &&
       !rvfi_trap  &&
       !(PMP_GRANULARITY > 0 && cfg_attempt.mode == PMP_MODE_NA4)
       ;
@@ -928,6 +937,23 @@ module uvmt_cv32e40s_pmprvfi_assert
   );
 
 
+  // If all regions "OFF", U-mode fails  (vplan:UmodeOff)
+
+  a_umode_off: assert property (
+    rvfi_if.is_umode  &&
+    is_all_regions_off
+    |->
+    rvfi_if.rvfi_trap
+  );
+
+
+  // "mseccfgh" is just zero  (vplan:MseccfghZero)
+
+  a_mseccfgh_zero: assert property (
+    rvfi_csr_mseccfgh_rdata == '0
+  ) else `uvm_error(info_tag, "mseccfgh not zero");
+
+
   // Translate write-attempts to legal values
 
   function automatic pmpncfg_t  rectify_cfg_write (pmpncfg_t cfg_pre, pmpncfg_t cfg_attempt);
diff --git a/cv32e40s/tb/uvmt/uvmt_cv32e40s_rvfi_assert.sv b/cv32e40s/tb/assertions/uvmt_cv32e40s_rvfi_assert.sv
similarity index 97%
rename from cv32e40s/tb/uvmt/uvmt_cv32e40s_rvfi_assert.sv
rename to cv32e40s/tb/assertions/uvmt_cv32e40s_rvfi_assert.sv
index 4cc7f84419..36414897a8 100644
--- a/cv32e40s/tb/uvmt/uvmt_cv32e40s_rvfi_assert.sv
+++ b/cv32e40s/tb/assertions/uvmt_cv32e40s_rvfi_assert.sv
@@ -348,8 +348,8 @@ module uvmt_cv32e40s_rvfi_assert
   ) else `uvm_error(info_tag, "!store->!exce, exce->store");
 
 
+  // Disassembler
 
-// Disassembler
   a_unknowninstr_trap: assert property (
     (rvfi_if.instr_asm.instr == UNKNOWN_INSTR) && rvfi_if.rvfi_valid
     |->
@@ -357,6 +357,14 @@ module uvmt_cv32e40s_rvfi_assert
   ) else `uvm_error(info_tag, "Unknown instruction is not trapped");
 
 
+  // Exception's don't update GPRs
+
+  a_exceptions_dont_update_gprs: assert property (
+    rvfi_valid && rvfi_trap.exception
+    |->
+    (rvfi_if.rvfi_rd1_addr == 0)
+  ) else `uvm_error(info_tag, "exceptions shouldn't update gprs");
+
 
 endmodule : uvmt_cv32e40s_rvfi_assert
 
diff --git a/cv32e40s/tb/uvmt/uvmt_cv32e40s_rvfi_cov.sv b/cv32e40s/tb/assertions/uvmt_cv32e40s_rvfi_cov.sv
similarity index 100%
rename from cv32e40s/tb/uvmt/uvmt_cv32e40s_rvfi_cov.sv
rename to cv32e40s/tb/assertions/uvmt_cv32e40s_rvfi_cov.sv
diff --git a/cv32e40s/tb/uvmt/uvmt_cv32e40s_clic_interrupt_assert.sv b/cv32e40s/tb/uvmt/uvmt_cv32e40s_clic_interrupt_assert.sv
index e07db9b452..348fe5807a 100644
--- a/cv32e40s/tb/uvmt/uvmt_cv32e40s_clic_interrupt_assert.sv
+++ b/cv32e40s/tb/uvmt/uvmt_cv32e40s_clic_interrupt_assert.sv
@@ -780,6 +780,13 @@ module uvmt_cv32e40s_clic_interrupt_assert
     end
   end
 
+  covergroup cg_clic @(posedge clk_i);
+    option.per_instance = 1;
+    cp_lvl: coverpoint irq_level{ bins values[] = {[0:255]};}
+  endgroup
+
+  cg_clic clic_cg = new;
+
 
   assign core_not_in_debug            = debug_running;
   assign core_in_debug                = !core_not_in_debug;
diff --git a/cv32e40s/tb/uvmt/uvmt_cv32e40s_tb_files.flist b/cv32e40s/tb/uvmt/uvmt_cv32e40s_tb_files.flist
index 7aeba8124f..a092c6618f 100644
--- a/cv32e40s/tb/uvmt/uvmt_cv32e40s_tb_files.flist
+++ b/cv32e40s/tb/uvmt/uvmt_cv32e40s_tb_files.flist
@@ -21,13 +21,13 @@ ${DV_UVMT_PATH}/uvmt_cv32e40s_tb.sv
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_fencei_assert.sv
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_pmp_assert.sv
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_pmprvfi_assert.sv
+${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_rvfi_assert.sv
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_umode_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_clic_interrupt_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_debug_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_integration_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_interrupt_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_pma_assert.sv
-${DV_UVMT_PATH}/uvmt_cv32e40s_rvfi_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_triggers_assert_cov.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_xsecure_assert/uvmt_cv32e40s_xsecure_bus_protocol_hardening_assert.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_xsecure_assert/uvmt_cv32e40s_xsecure_data_independent_timing_assert.sv
@@ -45,6 +45,7 @@ ${DV_UVMT_PATH}/uvmt_cv32e40s_zc_assert.sv
 
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_pma_model.sv
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_pmp_model.sv
+${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_rvfi_cov.sv
 ${DV_UVMT_PATH}/../assertions/uvmt_cv32e40s_umode_cov.sv
 ${DV_UVMT_PATH}/support_logic/uvmt_cv32e40s_rchk_shim.sv
 ${DV_UVMT_PATH}/support_logic/uvmt_cv32e40s_sl_fifo.sv
@@ -53,4 +54,3 @@ ${DV_UVMT_PATH}/support_logic/uvmt_cv32e40s_sl_trigger_match.sv
 ${DV_UVMT_PATH}/support_logic/uvmt_cv32e40s_sl_trigger_match_mem.sv
 ${DV_UVMT_PATH}/support_logic/uvmt_cv32e40s_support_logic.sv
 ${DV_UVMT_PATH}/uvmt_cv32e40s_pma_cov.sv
-${DV_UVMT_PATH}/uvmt_cv32e40s_rvfi_cov.sv
diff --git a/lib/isa_decoder/isa_decoder.sv b/lib/isa_decoder/isa_decoder.sv
index 1a0b0d593b..eb173dae71 100644
--- a/lib/isa_decoder/isa_decoder.sv
+++ b/lib/isa_decoder/isa_decoder.sv
@@ -136,6 +136,7 @@
 
   function automatic gpr_t get_gpr_from_gpr_rvc(gpr_rvc_t gpr);
     gpr_t uncompressed_gpr;
+
     casex (gpr.gpr)
       C_X8:    uncompressed_gpr.gpr = X8;
       C_X9:    uncompressed_gpr.gpr = X9;
@@ -151,6 +152,24 @@
     return uncompressed_gpr;
   endfunction : get_gpr_from_gpr_rvc
 
+  function automatic gpr_t get_gpr_from_gpr_rvc_sreg(gpr_rvc_sreg_t gpr);
+    gpr_t uncompressed_gpr;
+
+    casex (gpr.gpr)
+      CS_X8:    uncompressed_gpr.gpr = X8;
+      CS_X9:    uncompressed_gpr.gpr = X9;
+      CS_X18:   uncompressed_gpr.gpr = X18;
+      CS_X19:   uncompressed_gpr.gpr = X19;
+      CS_X20:   uncompressed_gpr.gpr = X20;
+      CS_X21:   uncompressed_gpr.gpr = X21;
+      CS_X22:   uncompressed_gpr.gpr = X22;
+      CS_X23:   uncompressed_gpr.gpr = X23;
+      default: uncompressed_gpr.gpr = X0; // Function used wrong if we ever end up here
+    endcase
+
+    return uncompressed_gpr;
+  endfunction : get_gpr_from_gpr_rvc_sreg
+
   // ---------------------------------------------------------------------------
   // Find the value of immediate
   // ---------------------------------------------------------------------------
@@ -311,463 +330,463 @@
     casex (format)
       I_TYPE: begin
         if (asm.instr inside { FENCE_I, ECALL, EBREAK, MRET, DRET, WFI, WFE }) begin
-          asm.rd.valid            = 0;
-          asm.rs1.valid           = 0;
-          asm.rs2.valid           = 0;
-          asm.imm.valid           = 0;
+          asm.rd.valid              = 0;
+          asm.rs1.valid             = 0;
+          asm.rs2.valid             = 0;
+          asm.imm.valid             = 0;
         end else if (asm.instr inside { FENCE }) begin
-          asm.imm.imm_raw         = instr.uncompressed.format.i.imm;
-          asm.imm.imm_raw_sorted  = instr.uncompressed.format.i.imm;
-          asm.imm.imm_type        = IMM;
-          asm.imm.width           = 12;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_i(instr.uncompressed.format.i.imm);
-          asm.imm.valid           = 1;
+          asm.imm.imm_raw           = instr.uncompressed.format.i.imm;
+          asm.imm.imm_raw_sorted    = instr.uncompressed.format.i.imm;
+          asm.imm.imm_type          = IMM;
+          asm.imm.width             = 12;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_i(instr.uncompressed.format.i.imm);
+          asm.imm.valid             = 1;
         end else if (asm.instr inside { CSRRW, CSRRS, CSRRC }) begin
-          asm.rd.gpr              = instr.uncompressed.format.i.rd.gpr;
-          asm.rs1.gpr             = instr.uncompressed.format.i.rs1.gpr;
-          asm.csr.address         = instr.uncompressed.format.i.imm;
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.csr.valid           = 1;
+          asm.rd.gpr                = instr.uncompressed.format.i.rd.gpr;
+          asm.rs1.gpr               = instr.uncompressed.format.i.rs1.gpr;
+          asm.csr.address           = instr.uncompressed.format.i.imm;
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.csr.valid             = 1;
         end else if (asm.instr inside { CSRRWI, CSRRSI, CSRRCI }) begin
-          asm.rd.gpr              = instr.uncompressed.format.i.rd.gpr;
-          asm.imm.imm_raw         = instr.uncompressed.format.i.rs1;
-          asm.imm.imm_raw_sorted  = instr.uncompressed.format.i.rs1;
-          asm.imm.imm_type        = UIMM;
-          asm.imm.width           = 5;
-          asm.imm.imm_value       = instr.uncompressed.format.i.rs1;
-          asm.csr.address         = instr.uncompressed.format.i.imm;
-          asm.rd.valid            = 1;
-          asm.imm.valid           = 1;
-          asm.csr.valid           = 1;
+          asm.rd.gpr                = instr.uncompressed.format.i.rd.gpr;
+          asm.imm.imm_raw           = instr.uncompressed.format.i.rs1;
+          asm.imm.imm_raw_sorted    = instr.uncompressed.format.i.rs1;
+          asm.imm.imm_type          = UIMM;
+          asm.imm.width             = 5;
+          asm.imm.imm_value         = instr.uncompressed.format.i.rs1;
+          asm.csr.address           = instr.uncompressed.format.i.imm;
+          asm.rd.valid              = 1;
+          asm.imm.valid             = 1;
+          asm.csr.valid             = 1;
         end else if (asm.instr inside { RORI, BEXTI, BCLRI, BINVI, BSETI, SLLI, SRLI, SRAI }) begin
-          asm.rd.gpr              = instr.uncompressed.format.i.rd.gpr;
-          asm.rs1.gpr             = instr.uncompressed.format.i.rs1.gpr;
-          asm.imm.imm_raw         = instr.uncompressed.format.i.imm.shamt;
-          asm.imm.imm_raw_sorted  = instr.uncompressed.format.i.imm.shamt;
-          asm.imm.imm_type        = SHAMT;
-          asm.imm.width           = 5;
-          asm.imm.imm_value       = instr.uncompressed.format.i.imm.shamt;
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.imm.valid           = 1;
+          asm.rd.gpr                = instr.uncompressed.format.i.rd.gpr;
+          asm.rs1.gpr               = instr.uncompressed.format.i.rs1.gpr;
+          asm.imm.imm_raw           = instr.uncompressed.format.i.imm.shamt;
+          asm.imm.imm_raw_sorted    = instr.uncompressed.format.i.imm.shamt;
+          asm.imm.imm_type          = SHAMT;
+          asm.imm.width             = 5;
+          asm.imm.imm_value         = instr.uncompressed.format.i.imm.shamt;
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.imm.valid             = 1;
         end else begin
-          asm.rd.gpr              = instr.uncompressed.format.i.rd.gpr;
-          asm.rs1.gpr             = instr.uncompressed.format.i.rs1.gpr;
-          asm.imm.imm_raw         = instr.uncompressed.format.i.imm;
-          asm.imm.imm_raw_sorted  = instr.uncompressed.format.i.imm;
-          asm.imm.imm_type        = IMM;
-          asm.imm.width           = 12;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_i(instr.uncompressed.format.i.imm);
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.imm.valid           = 1;
+          asm.rd.gpr                = instr.uncompressed.format.i.rd.gpr;
+          asm.rs1.gpr               = instr.uncompressed.format.i.rs1.gpr;
+          asm.imm.imm_raw           = instr.uncompressed.format.i.imm;
+          asm.imm.imm_raw_sorted    = instr.uncompressed.format.i.imm;
+          asm.imm.imm_type          = IMM;
+          asm.imm.width             = 12;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_i(instr.uncompressed.format.i.imm);
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.imm.valid             = 1;
         end
       end
       J_TYPE: begin
-        asm.rd.gpr                = instr.uncompressed.format.j.rd.gpr;
-        asm.imm.imm_raw           = instr.uncompressed.format.j.imm;
-        asm.imm.imm_raw_sorted    = get_sort_j_imm(instr);
-        asm.imm.imm_type          = OFFSET;
-        asm.imm.width             = 20;
-        asm.imm.sign_ext          = 1;
-        asm.imm.imm_value         = get_imm_value_j(get_sort_j_imm(instr));
-        asm.rd.valid              = 1;
-        asm.imm.valid             = 1;
+        asm.rd.gpr                  = instr.uncompressed.format.j.rd.gpr;
+        asm.imm.imm_raw             = instr.uncompressed.format.j.imm;
+        asm.imm.imm_raw_sorted      = get_sort_j_imm(instr);
+        asm.imm.imm_type            = OFFSET;
+        asm.imm.width               = 20;
+        asm.imm.sign_ext            = 1;
+        asm.imm.imm_value           = get_imm_value_j(get_sort_j_imm(instr));
+        asm.rd.valid                = 1;
+        asm.imm.valid               = 1;
       end
       S_TYPE: begin
-        asm.rs1.gpr               = instr.uncompressed.format.s.rs1.gpr;
-        asm.rs2.gpr               = instr.uncompressed.format.s.rs2.gpr;
-        asm.imm.imm_raw           = get_sort_s_imm(instr);
-        asm.imm.imm_raw_sorted    = get_sort_s_imm(instr);
-        asm.imm.imm_type          = IMM;
-        asm.imm.width             = 12;
-        asm.imm.sign_ext          = 1;
-        asm.imm.imm_value         = get_imm_value_i(get_sort_s_imm(instr));
-        asm.rs1.valid             = 1;
-        asm.rs2.valid             = 1;
-        asm.imm.valid             = 1;
+        asm.rs1.gpr                 = instr.uncompressed.format.s.rs1.gpr;
+        asm.rs2.gpr                 = instr.uncompressed.format.s.rs2.gpr;
+        asm.imm.imm_raw             = get_sort_s_imm(instr);
+        asm.imm.imm_raw_sorted      = get_sort_s_imm(instr);
+        asm.imm.imm_type            = IMM;
+        asm.imm.width               = 12;
+        asm.imm.sign_ext            = 1;
+        asm.imm.imm_value           = get_imm_value_i(get_sort_s_imm(instr));
+        asm.rs1.valid               = 1;
+        asm.rs2.valid               = 1;
+        asm.imm.valid               = 1;
       end
       R_TYPE: begin
         if ( asm.instr inside { LR_W, SC_W, AMOSWAP_W, AMOADD_W, AMOXOR_W, AMOAND_W, AMOOR_W, AMOMIN_W, AMOMAX_W, AMOMINU_W, AMOMAXU_W } ) begin
-          asm.rd.gpr              = instr.uncompressed.format.r.rd.gpr;
-          asm.rs1.gpr             = instr.uncompressed.format.r.rs1.gpr;
-          asm.rs2.gpr             = instr.uncompressed.format.r.rs2.gpr;
-          asm.atomic.aq           = instr.uncompressed.format.r.funct7[26];
-          asm.atomic.rl           = instr.uncompressed.format.r.funct7[25];
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.rs2.valid           = 1;
-          asm.atomic.valid        = 1;
+          asm.rd.gpr                = instr.uncompressed.format.r.rd.gpr;
+          asm.rs1.gpr               = instr.uncompressed.format.r.rs1.gpr;
+          asm.rs2.gpr               = instr.uncompressed.format.r.rs2.gpr;
+          asm.atomic.aq             = instr.uncompressed.format.r.funct7[26];
+          asm.atomic.rl             = instr.uncompressed.format.r.funct7[25];
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.rs2.valid             = 1;
+          asm.atomic.valid          = 1;
         end else begin
-          asm.rd.gpr              = instr.uncompressed.format.r.rd.gpr;
-          asm.rs1.gpr             = instr.uncompressed.format.r.rs1.gpr;
-          asm.rs2.gpr             = instr.uncompressed.format.r.rs2.gpr;
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.rs2.valid           = 1;
+          asm.rd.gpr                = instr.uncompressed.format.r.rd.gpr;
+          asm.rs1.gpr               = instr.uncompressed.format.r.rs1.gpr;
+          asm.rs2.gpr               = instr.uncompressed.format.r.rs2.gpr;
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.rs2.valid             = 1;
         end
       end
       R4_TYPE: begin
-        asm.rd.gpr                = instr.uncompressed.format.r4.rd.gpr;
-        asm.rs1.gpr               = instr.uncompressed.format.r4.rs1.gpr;
-        asm.rs2.gpr               = instr.uncompressed.format.r4.rs2.gpr;
-        asm.rs3.gpr               = instr.uncompressed.format.r4.rs3.gpr;
-        asm.rd.valid              = 1;
-        asm.rs1.valid             = 1;
-        asm.rs2.valid             = 1;
-        asm.rs3.valid             = 1;
+        asm.rd.gpr                  = instr.uncompressed.format.r4.rd.gpr;
+        asm.rs1.gpr                 = instr.uncompressed.format.r4.rs1.gpr;
+        asm.rs2.gpr                 = instr.uncompressed.format.r4.rs2.gpr;
+        asm.rs3.gpr                 = instr.uncompressed.format.r4.rs3.gpr;
+        asm.rd.valid                = 1;
+        asm.rs1.valid               = 1;
+        asm.rs2.valid               = 1;
+        asm.rs3.valid               = 1;
       end
       B_TYPE: begin
-        asm.rs1.gpr               = instr.uncompressed.format.b.rs1.gpr;
-        asm.rs2.gpr               = instr.uncompressed.format.b.rs2.gpr;
-        asm.imm.imm_raw           = {instr.uncompressed.format.b.imm_h, instr.uncompressed.format.b.imm_l};
-        asm.imm.imm_raw_sorted    = get_sort_b_imm(instr);
-        asm.imm.imm_type          = IMM;
-        asm.imm.width             = 12;
-        asm.imm.sign_ext          = 1;
-        asm.imm.imm_value         = get_imm_value_b(get_sort_b_imm(instr));
-        asm.rs1.valid             = 1;
-        asm.rs2.valid             = 1;
-        asm.imm.valid             = 1;
+        asm.rs1.gpr                 = instr.uncompressed.format.b.rs1.gpr;
+        asm.rs2.gpr                 = instr.uncompressed.format.b.rs2.gpr;
+        asm.imm.imm_raw             = {instr.uncompressed.format.b.imm_h, instr.uncompressed.format.b.imm_l};
+        asm.imm.imm_raw_sorted      = get_sort_b_imm(instr);
+        asm.imm.imm_type            = IMM;
+        asm.imm.width               = 12;
+        asm.imm.sign_ext            = 1;
+        asm.imm.imm_value           = get_imm_value_b(get_sort_b_imm(instr));
+        asm.rs1.valid               = 1;
+        asm.rs2.valid               = 1;
+        asm.imm.valid               = 1;
       end
       U_TYPE: begin
-        asm.rd.gpr                = instr.uncompressed.format.u.rd.gpr;
-        asm.imm.imm_raw           = instr.uncompressed.format.u.imm;
-        asm.imm.imm_raw_sorted    = instr.uncompressed.format.u.imm;
-        asm.imm.imm_type          = IMM;
-        asm.imm.width             = 20;
-        asm.imm.imm_value         = { instr.uncompressed.format.u.imm, 12'b0000_0000_0000 };
-        asm.rd.valid              = 1;
-        asm.imm.valid             = 1;
+        asm.rd.gpr                  = instr.uncompressed.format.u.rd.gpr;
+        asm.imm.imm_raw             = instr.uncompressed.format.u.imm;
+        asm.imm.imm_raw_sorted      = instr.uncompressed.format.u.imm;
+        asm.imm.imm_type            = IMM;
+        asm.imm.width               = 20;
+        asm.imm.imm_value           = { instr.uncompressed.format.u.imm, 12'b0000_0000_0000 };
+        asm.rd.valid                = 1;
+        asm.imm.valid               = 1;
       end
       // Compressed
       CR_TYPE: begin
         if (name inside { C_EBREAK }) begin
-          asm.rd.valid            = 0;
-          asm.rs1.valid           = 0;
-          asm.rs2.valid           = 0;
-          asm.rs3.valid           = 0;
-          asm.imm.valid           = 0;
+          asm.rd.valid              = 0;
+          asm.rs1.valid             = 0;
+          asm.rs2.valid             = 0;
+          asm.rs3.valid             = 0;
+          asm.imm.valid             = 0;
         end else if (name inside { C_MV }) begin
-          asm.rd.gpr              = instr.compressed.format.cr.rd_rs1.gpr;
-          asm.rs1.gpr             = instr.compressed.format.cr.rd_rs1.gpr;
-          asm.rs2.gpr             = instr.compressed.format.cr.rs2.gpr;
-          asm.rd.valid            = 1;
-          asm.rs2.valid           = 1;
-          asm.rs1.valid           = 1;
+          asm.rd.gpr                = instr.compressed.format.cr.rd_rs1.gpr;
+          asm.rs1.gpr               = instr.compressed.format.cr.rd_rs1.gpr;
+          asm.rs2.gpr               = instr.compressed.format.cr.rs2.gpr;
+          asm.rd.valid              = 1;
+          asm.rs2.valid             = 1;
+          asm.rs1.valid             = 1;
         end else if (name inside { C_ADD }) begin
-          asm.rd.gpr              = instr.compressed.format.cr.rd_rs1.gpr;
-          asm.rs1.gpr             = instr.compressed.format.cr.rd_rs1.gpr;
-          asm.rs2.gpr             = instr.compressed.format.cr.rs2.gpr;
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.rs2.valid           = 1;
+          asm.rd.gpr                = instr.compressed.format.cr.rd_rs1.gpr;
+          asm.rs1.gpr               = instr.compressed.format.cr.rd_rs1.gpr;
+          asm.rs2.gpr               = instr.compressed.format.cr.rs2.gpr;
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.rs2.valid             = 1;
         end else if (name inside { C_JR, C_JALR }) begin
-          asm.rs1.gpr             = instr.compressed.format.cr.rd_rs1.gpr;
-          asm.rs2.gpr             = instr.compressed.format.cr.rs2.gpr;
-          asm.rs1.valid           = 1;
-          asm.rs2.valid           = 1;
+          asm.rs1.gpr               = instr.compressed.format.cr.rd_rs1.gpr;
+          asm.rs2.gpr               = instr.compressed.format.cr.rs2.gpr;
+          asm.rs1.valid             = 1;
+          asm.rs2.valid             = 1;
         end
       end
       CI_TYPE: begin
         if (name inside { C_NOP, C_ADDI }) begin
-          asm.rd.gpr              = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.rs1.gpr             = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_raw_sorted  = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_type        = IMM;
-          asm.imm.width           = 6;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_ci({ instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 });
-          asm.rd.valid            = 1;
-          asm.rs1.valid           = 1;
-          asm.imm.valid           = 1;
-        end else if (name        == C_LI) begin
-          asm.rd.gpr              = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_raw_sorted  = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_type        = IMM;
-          asm.imm.width           = 6;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_ci({ instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 });
-          asm.rd.valid            = 1;
-          asm.imm.valid           = 1;
-        end else if (name        == C_LUI) begin
-          asm.rd.gpr              = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_raw_sorted  = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_type        = NZIMM;
-          asm.imm.width           = 6;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_ci_lui({ instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 });
-          asm.rd.valid            = 1;
-          asm.imm.valid           = 1;
+          asm.rd.gpr                = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.rs1.gpr               = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_raw_sorted    = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_type          = IMM;
+          asm.imm.width             = 6;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_ci({ instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 });
+          asm.rd.valid              = 1;
+          asm.rs1.valid             = 1;
+          asm.imm.valid             = 1;
+        end else if (name          == C_LI) begin
+          asm.rd.gpr                = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_raw_sorted    = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_type          = IMM;
+          asm.imm.width             = 6;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_ci({ instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 });
+          asm.rd.valid              = 1;
+          asm.imm.valid             = 1;
+        end else if (name          == C_LUI) begin
+          asm.rd.gpr                = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_raw_sorted    = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_type          = NZIMM;
+          asm.imm.width             = 6;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_ci_lui({ instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 });
+          asm.rd.valid              = 1;
+          asm.imm.valid             = 1;
         end else if (name inside { C_LWSP }) begin
-          asm.rd.gpr              = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_raw_sorted  = get_sort_ci_imm_lwsp(instr);
-          asm.imm.imm_type        = OFFSET;
-          asm.imm.width           = 6;
-          asm.imm.imm_value       = {24'b0, get_sort_ci_imm_lwsp(instr), 2'b0};
-          asm.rd.valid            = 1;
-          asm.imm.valid           = 1;
+          asm.rd.gpr                = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_raw_sorted    = get_sort_ci_imm_lwsp(instr);
+          asm.imm.imm_type          = OFFSET;
+          asm.imm.width             = 6;
+          asm.imm.imm_value         = {24'b0, get_sort_ci_imm_lwsp(instr), 2'b0};
+          asm.rd.valid              = 1;
+          asm.imm.valid             = 1;
         end else if (name inside { C_ADDI16SP }) begin
-          asm.rs1.gpr             = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.rd.gpr              = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_raw_sorted  = get_sort_ci_imm_addi16sp(instr);
-          asm.imm.imm_type        = NZIMM;
-          asm.imm.width           = 6;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_ci_addi16sp(get_sort_ci_imm_addi16sp(instr));
-          asm.rs1.valid           = 1;
-          asm.rd.valid            = 1;
-          asm.imm.valid           = 1;
+          asm.rs1.gpr               = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.rd.gpr                = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_raw_sorted    = get_sort_ci_imm_addi16sp(instr);
+          asm.imm.imm_type          = NZIMM;
+          asm.imm.width             = 6;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_ci_addi16sp(get_sort_ci_imm_addi16sp(instr));
+          asm.rs1.valid             = 1;
+          asm.rd.valid              = 1;
+          asm.imm.valid             = 1;
         end else if (name inside { C_SLLI }) begin
-          asm.rs1.gpr             = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.rd.gpr              = instr.compressed.format.ci.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_raw_sorted  = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.imm.imm_type        = SHAMT;
-          asm.imm.width           = 6;
-          asm.imm.imm_value       = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
-          asm.rs1.valid           = 1;
-          asm.rd.valid            = 1;
-          asm.imm.valid           = 1;
+          asm.rs1.gpr               = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.rd.gpr                = instr.compressed.format.ci.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_raw_sorted    = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.imm.imm_type          = SHAMT;
+          asm.imm.width             = 6;
+          asm.imm.imm_value         = { instr.compressed.format.ci.imm_12, instr.compressed.format.ci.imm_6_2 };
+          asm.rs1.valid             = 1;
+          asm.rd.valid              = 1;
+          asm.imm.valid             = 1;
         end
       end
       CSS_TYPE: begin
-        asm.rs2.gpr               = instr.compressed.format.css.rs2.gpr;
-        asm.imm.imm_raw           = instr.compressed.format.css.imm;
-        asm.imm.imm_raw_sorted    = { instr.compressed.format.css.imm[9:7], instr.compressed.format.css.imm[12:10] };
-        asm.imm.imm_type          = OFFSET;
-        asm.imm.width             = 6;
-        asm.imm.imm_value         = { 24'b0, instr.compressed.format.css.imm[9:7], instr.compressed.format.css.imm[12:10], 2'b0 };
-        asm.rs2.valid             = 1;
-        asm.imm.valid             = 1;
+        asm.rs2.gpr                 = instr.compressed.format.css.rs2.gpr;
+        asm.imm.imm_raw             = instr.compressed.format.css.imm;
+        asm.imm.imm_raw_sorted      = { instr.compressed.format.css.imm[9:7], instr.compressed.format.css.imm[12:10] };
+        asm.imm.imm_type            = OFFSET;
+        asm.imm.width               = 6;
+        asm.imm.imm_value           = { 24'b0, instr.compressed.format.css.imm[9:7], instr.compressed.format.css.imm[12:10], 2'b0 };
+        asm.rs2.valid               = 1;
+        asm.imm.valid               = 1;
       end
       CIW_TYPE: begin
-        asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.ciw.rd.gpr);
-        asm.rd.gpr_rvc            = instr.compressed.format.ciw.rd.gpr;
-        asm.imm.imm_raw           = instr.compressed.format.ciw.imm;
-        asm.imm.imm_raw_sorted    = get_sort_ciw_imm(instr);
-        asm.imm.imm_type          = NZUIMM;
-        asm.imm.width             = 8;
-        asm.imm.imm_value         = { 22'b0, get_sort_ciw_imm(instr), 2'b0 };
-        asm.imm.valid             = 1;
-        asm.rd.valid              = 1;
-        asm.rd.valid_gpr_rvc      = 1;
+        asm.rd.gpr                  = get_gpr_from_gpr_rvc(instr.compressed.format.ciw.rd.gpr);
+        asm.rd.gpr_rvc              = instr.compressed.format.ciw.rd.gpr;
+        asm.imm.imm_raw             = instr.compressed.format.ciw.imm;
+        asm.imm.imm_raw_sorted      = get_sort_ciw_imm(instr);
+        asm.imm.imm_type            = NZUIMM;
+        asm.imm.width               = 8;
+        asm.imm.imm_value           = { 22'b0, get_sort_ciw_imm(instr), 2'b0 };
+        asm.imm.valid               = 1;
+        asm.rd.valid                = 1;
+        asm.rd.valid_gpr_rvc        = 1;
       end
       CL_TYPE: begin
-        asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.cl.rd.gpr);
-        asm.rd.gpr_rvc            = instr.compressed.format.cl.rd.gpr;
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cl.rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.cl.rs1.gpr;
-        asm.imm.imm_raw           = { instr.compressed.format.cl.imm_12_10, instr.compressed.format.cl.imm_6_5 };
-        asm.imm.imm_raw_sorted    = get_sort_cl_imm(instr);
-        asm.imm.imm_type          = OFFSET;
-        asm.imm.width             = 5;
-        asm.imm.imm_value         = { 25'b0, get_sort_cl_imm(instr), 2'b0 };
-        asm.rd.valid              = 1;
-        asm.rd.valid_gpr_rvc      = 1;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.imm.valid             = 1;
+        asm.rd.gpr                  = get_gpr_from_gpr_rvc(instr.compressed.format.cl.rd.gpr);
+        asm.rd.gpr_rvc              = instr.compressed.format.cl.rd.gpr;
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.cl.rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.cl.rs1.gpr;
+        asm.imm.imm_raw             = { instr.compressed.format.cl.imm_12_10, instr.compressed.format.cl.imm_6_5 };
+        asm.imm.imm_raw_sorted      = get_sort_cl_imm(instr);
+        asm.imm.imm_type            = OFFSET;
+        asm.imm.width               = 5;
+        asm.imm.imm_value           = { 25'b0, get_sort_cl_imm(instr), 2'b0 };
+        asm.rd.valid                = 1;
+        asm.rd.valid_gpr_rvc        = 1;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.imm.valid               = 1;
       end
       CS_TYPE: begin
-        asm.rs2.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cs.rs2.gpr);
-        asm.rs2.gpr_rvc           = instr.compressed.format.cs.rs2.gpr;
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cs.rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.cs.rs1.gpr;
-        asm.imm.imm_raw           = { instr.compressed.format.cs.imm_12_10, instr.compressed.format.cs.imm_6_5 };
-        asm.imm.imm_raw_sorted    = get_sort_cs_imm(instr);
-        asm.imm.imm_type          = OFFSET;
-        asm.imm.width             = 5;
-        asm.imm.imm_value         = { 25'b0, get_sort_cs_imm(instr), 2'b0 };
-        asm.rs2.valid             = 1;
-        asm.rs2.valid_gpr_rvc     = 1;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.imm.valid             = 1;
+        asm.rs2.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.cs.rs2.gpr);
+        asm.rs2.gpr_rvc             = instr.compressed.format.cs.rs2.gpr;
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.cs.rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.cs.rs1.gpr;
+        asm.imm.imm_raw             = { instr.compressed.format.cs.imm_12_10, instr.compressed.format.cs.imm_6_5 };
+        asm.imm.imm_raw_sorted      = get_sort_cs_imm(instr);
+        asm.imm.imm_type            = OFFSET;
+        asm.imm.width               = 5;
+        asm.imm.imm_value           = { 25'b0, get_sort_cs_imm(instr), 2'b0 };
+        asm.rs2.valid               = 1;
+        asm.rs2.valid_gpr_rvc       = 1;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.imm.valid               = 1;
       end
       CA_TYPE: begin
-        asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.ca.rd_rs1.gpr);
-        asm.rd.gpr_rvc            = instr.compressed.format.ca.rd_rs1.gpr;
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.ca.rd_rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.ca.rd_rs1.gpr;
-        asm.rs2.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.ca.rs2.gpr);
-        asm.rs2.gpr_rvc           = instr.compressed.format.ca.rs2.gpr;
-        asm.rd.valid              = 1;
-        asm.rd.valid_gpr_rvc      = 1;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rs2.valid             = 1;
-        asm.rs2.valid_gpr_rvc     = 1;
+        asm.rd.gpr                  = get_gpr_from_gpr_rvc(instr.compressed.format.ca.rd_rs1.gpr);
+        asm.rd.gpr_rvc              = instr.compressed.format.ca.rd_rs1.gpr;
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.ca.rd_rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.ca.rd_rs1.gpr;
+        asm.rs2.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.ca.rs2.gpr);
+        asm.rs2.gpr_rvc             = instr.compressed.format.ca.rs2.gpr;
+        asm.rd.valid                = 1;
+        asm.rd.valid_gpr_rvc        = 1;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.rs2.valid               = 1;
+        asm.rs2.valid_gpr_rvc       = 1;
       end
       CB_TYPE: begin
         if (name inside { C_SRLI, C_SRAI }) begin
-          asm.rd.gpr              = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
-          asm.rd.gpr_rvc          = instr.compressed.format.cb.rd_rs1.gpr;
-          asm.rs1.gpr             = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
-          asm.rs1.gpr_rvc         = instr.compressed.format.cb.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
-          asm.imm.imm_raw_sorted  = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
-          asm.imm.imm_type        = SHAMT;
-          asm.imm.width           = 6;
-          asm.imm.imm_value       = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
-          asm.rd.valid            = 1;
-          asm.rd.valid_gpr_rvc    = 1;
-          asm.rs1.valid           = 1;
-          asm.rs1.valid_gpr_rvc   = 1;
-          asm.imm.valid           = 1;
+          asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
+          asm.rd.gpr_rvc            = instr.compressed.format.cb.rd_rs1.gpr;
+          asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
+          asm.rs1.gpr_rvc           = instr.compressed.format.cb.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
+          asm.imm.imm_raw_sorted    = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
+          asm.imm.imm_type          = SHAMT;
+          asm.imm.width             = 6;
+          asm.imm.imm_value         = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
+          asm.rd.valid              = 1;
+          asm.rd.valid_gpr_rvc      = 1;
+          asm.rs1.valid             = 1;
+          asm.rs1.valid_gpr_rvc     = 1;
+          asm.imm.valid             = 1;
         end else if (name inside { C_BEQZ, C_BNEZ }) begin
-          asm.rs1.gpr             = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
-          asm.rs1.gpr_rvc         = instr.compressed.format.cb.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.cb.offset_12_10, instr.compressed.format.cb.offset_6_2 };
-          asm.imm.imm_raw_sorted  = get_sort_cb_imm_not_sequential(instr);
-          asm.imm.imm_type        = OFFSET;
-          asm.imm.width           = 8;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_cb(get_sort_cb_imm_not_sequential(instr));
-          asm.rs1.valid           = 1;
-          asm.rs1.valid_gpr_rvc   = 1;
-          asm.imm.valid           = 1;
+          asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
+          asm.rs1.gpr_rvc           = instr.compressed.format.cb.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.cb.offset_12_10, instr.compressed.format.cb.offset_6_2 };
+          asm.imm.imm_raw_sorted    = get_sort_cb_imm_not_sequential(instr);
+          asm.imm.imm_type          = OFFSET;
+          asm.imm.width             = 8;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_cb(get_sort_cb_imm_not_sequential(instr));
+          asm.rs1.valid             = 1;
+          asm.rs1.valid_gpr_rvc     = 1;
+          asm.imm.valid             = 1;
         end else if (name inside { C_ANDI }) begin
-          asm.rd.gpr              = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
-          asm.rd.gpr_rvc          = instr.compressed.format.cb.rd_rs1.gpr;
-          asm.rs1.gpr             = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
-          asm.rs1.gpr_rvc         = instr.compressed.format.cb.rd_rs1.gpr;
-          asm.imm.imm_raw         = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
-          asm.imm.imm_raw_sorted  = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
-          asm.imm.imm_type        = IMM;
-          asm.imm.width           = 6;
-          asm.imm.sign_ext        = 1;
-          asm.imm.imm_value       = get_imm_value_cb({ instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 });
-          asm.rd.valid            = 1;
-          asm.rd.valid_gpr_rvc    = 1;
-          asm.rs1.valid           = 1;
-          asm.rs1.valid_gpr_rvc   = 1;
-          asm.imm.valid           = 1;
+          asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
+          asm.rd.gpr_rvc            = instr.compressed.format.cb.rd_rs1.gpr;
+          asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cb.rd_rs1.gpr);
+          asm.rs1.gpr_rvc           = instr.compressed.format.cb.rd_rs1.gpr;
+          asm.imm.imm_raw           = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
+          asm.imm.imm_raw_sorted    = { instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 };
+          asm.imm.imm_type          = IMM;
+          asm.imm.width             = 6;
+          asm.imm.sign_ext          = 1;
+          asm.imm.imm_value         = get_imm_value_cb({ instr.compressed.format.cb.offset_12_10[12], instr.compressed.format.cb.offset_6_2 });
+          asm.rd.valid              = 1;
+          asm.rd.valid_gpr_rvc      = 1;
+          asm.rs1.valid             = 1;
+          asm.rs1.valid_gpr_rvc     = 1;
+          asm.imm.valid             = 1;
         end
       end
       CJ_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.cj.imm;
-        asm.imm.imm_raw_sorted    = get_sort_cj_imm(instr);
-        asm.imm.imm_type          = OFFSET;
-        asm.imm.width             = 11;
-        asm.imm.sign_ext          = 1;
-        asm.imm.imm_value         = get_imm_value_cj(get_sort_cj_imm(instr));
-        asm.imm.valid             = 1;
+        asm.imm.imm_raw             = instr.compressed.format.cj.imm;
+        asm.imm.imm_raw_sorted      = get_sort_cj_imm(instr);
+        asm.imm.imm_type            = OFFSET;
+        asm.imm.width               = 11;
+        asm.imm.sign_ext            = 1;
+        asm.imm.imm_value           = get_imm_value_cj(get_sort_cj_imm(instr));
+        asm.imm.valid               = 1;
       end
       CLB_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.clb.uimm;
-        asm.imm.imm_raw_sorted    = { instr.compressed.format.clb.uimm[5], instr.compressed.format.clb.uimm[6] };
-        asm.imm.imm_type          = UIMM;
-        asm.imm.width             = 2;
-        asm.imm.imm_value         = { instr.compressed.format.clb.uimm[5], instr.compressed.format.clb.uimm[6] };
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.clb.rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.clb.rs1.gpr;
-        asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.clb.rd.gpr);
-        asm.rd.gpr_rvc            = instr.compressed.format.clb.rd.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rd.valid              = 1;
-        asm.rd.valid_gpr_rvc      = 1;
-        asm.imm.valid             = 1;
+        asm.imm.imm_raw             = instr.compressed.format.clb.uimm;
+        asm.imm.imm_raw_sorted      = { instr.compressed.format.clb.uimm[5], instr.compressed.format.clb.uimm[6] };
+        asm.imm.imm_type            = UIMM;
+        asm.imm.width               = 2;
+        asm.imm.imm_value           = { instr.compressed.format.clb.uimm[5], instr.compressed.format.clb.uimm[6] };
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.clb.rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.clb.rs1.gpr;
+        asm.rd.gpr                  = get_gpr_from_gpr_rvc(instr.compressed.format.clb.rd.gpr);
+        asm.rd.gpr_rvc              = instr.compressed.format.clb.rd.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.rd.valid                = 1;
+        asm.rd.valid_gpr_rvc        = 1;
+        asm.imm.valid               = 1;
       end
       CSB_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.csb.uimm;
-        asm.imm.imm_raw_sorted    = { instr.compressed.format.csb.uimm[5], instr.compressed.format.csb.uimm[6] };
-        asm.imm.imm_type          = UIMM;
-        asm.imm.width             = 2;
-        asm.imm.imm_value         = { instr.compressed.format.csb.uimm[5], instr.compressed.format.csb.uimm[6] };
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.csb.rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.csb.rs1.gpr;
-        asm.rs2.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.csb.rs2.gpr);
-        asm.rs2.gpr_rvc           = instr.compressed.format.csb.rs2.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rs2.valid             = 1;
-        asm.rs2.valid_gpr_rvc     = 1;
-        asm.imm.valid             = 1;
+        asm.imm.imm_raw             = instr.compressed.format.csb.uimm;
+        asm.imm.imm_raw_sorted      = { instr.compressed.format.csb.uimm[5], instr.compressed.format.csb.uimm[6] };
+        asm.imm.imm_type            = UIMM;
+        asm.imm.width               = 2;
+        asm.imm.imm_value           = { instr.compressed.format.csb.uimm[5], instr.compressed.format.csb.uimm[6] };
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.csb.rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.csb.rs1.gpr;
+        asm.rs2.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.csb.rs2.gpr);
+        asm.rs2.gpr_rvc             = instr.compressed.format.csb.rs2.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.rs2.valid               = 1;
+        asm.rs2.valid_gpr_rvc       = 1;
+        asm.imm.valid               = 1;
       end
       CLH_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.clh.uimm;
-        asm.imm.imm_raw_sorted    = instr.compressed.format.clh.uimm;
-        asm.imm.imm_type          = UIMM;
-        asm.imm.width             = 1;
-        asm.imm.imm_value         = { 30'b0, instr.compressed.format.clh.uimm };
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.clh.rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.clh.rs1.gpr;
-        asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.clh.rd.gpr);
-        asm.rd.gpr_rvc            = instr.compressed.format.clh.rd.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rd.valid              = 1;
-        asm.rd.valid_gpr_rvc      = 1;
-        asm.imm.valid             = 1;
+        asm.imm.imm_raw             = instr.compressed.format.clh.uimm;
+        asm.imm.imm_raw_sorted      = instr.compressed.format.clh.uimm;
+        asm.imm.imm_type            = UIMM;
+        asm.imm.width               = 1;
+        asm.imm.imm_value           = { 30'b0, instr.compressed.format.clh.uimm };
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.clh.rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.clh.rs1.gpr;
+        asm.rd.gpr                  = get_gpr_from_gpr_rvc(instr.compressed.format.clh.rd.gpr);
+        asm.rd.gpr_rvc              = instr.compressed.format.clh.rd.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.rd.valid                = 1;
+        asm.rd.valid_gpr_rvc        = 1;
+        asm.imm.valid               = 1;
       end
       CSH_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.csh.uimm;
-        asm.imm.imm_raw_sorted    = instr.compressed.format.csh.uimm;
-        asm.imm.imm_type          = UIMM;
-        asm.imm.width             = 1;
-        asm.imm.imm_value         = {30'b0, instr.compressed.format.csh.uimm, 1'b0};
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.csh.rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.csh.rs1.gpr;
-        asm.rs2.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.csh.rs2.gpr);
-        asm.rs2.gpr_rvc           = instr.compressed.format.csh.rs2.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rs2.valid             = 1;
-        asm.rs2.valid_gpr_rvc     = 1;
-        asm.imm.valid             = 1;
+        asm.imm.imm_raw             = instr.compressed.format.csh.uimm;
+        asm.imm.imm_raw_sorted      = instr.compressed.format.csh.uimm;
+        asm.imm.imm_type            = UIMM;
+        asm.imm.width               = 1;
+        asm.imm.imm_value           = {30'b0, instr.compressed.format.csh.uimm, 1'b0};
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.csh.rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.csh.rs1.gpr;
+        asm.rs2.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.csh.rs2.gpr);
+        asm.rs2.gpr_rvc             = instr.compressed.format.csh.rs2.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.rs2.valid               = 1;
+        asm.rs2.valid_gpr_rvc       = 1;
+        asm.imm.valid               = 1;
       end
       CU_TYPE: begin
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cu.rd_rs1.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.cu.rd_rs1.gpr;
-        asm.rd.gpr                = get_gpr_from_gpr_rvc(instr.compressed.format.cu.rd_rs1.gpr);
-        asm.rd.gpr_rvc            = instr.compressed.format.cu.rd_rs1.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rd.valid              = 1;
-        asm.rd.valid_gpr_rvc      = 1;
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc(instr.compressed.format.cu.rd_rs1.gpr);
+        asm.rs1.gpr_rvc             = instr.compressed.format.cu.rd_rs1.gpr;
+        asm.rd.gpr                  = get_gpr_from_gpr_rvc(instr.compressed.format.cu.rd_rs1.gpr);
+        asm.rd.gpr_rvc              = instr.compressed.format.cu.rd_rs1.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc       = 1;
+        asm.rd.valid                = 1;
+        asm.rd.valid_gpr_rvc        = 1;
       end
       CMMV_TYPE: begin
-        asm.rs1.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cmmv.r1s.gpr);
-        asm.rs1.gpr_rvc           = instr.compressed.format.cmmv.r1s.gpr;
-        asm.rs2.gpr               = get_gpr_from_gpr_rvc(instr.compressed.format.cmmv.r2s.gpr);
-        asm.rs2.gpr_rvc           = instr.compressed.format.cmmv.r2s.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs1.valid_gpr_rvc     = 1;
-        asm.rs2.valid             = 1;
-        asm.rs2.valid_gpr_rvc     = 1;
+        asm.rs1.gpr                 = get_gpr_from_gpr_rvc_sreg(instr.compressed.format.cmmv.r1s.gpr);
+        asm.rs1.gpr_rvc_sreg        = instr.compressed.format.cmmv.r1s.gpr;
+        asm.rs2.gpr                 = get_gpr_from_gpr_rvc_sreg(instr.compressed.format.cmmv.r2s.gpr);
+        asm.rs2.gpr_rvc_sreg        = instr.compressed.format.cmmv.r2s.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs1.valid_gpr_rvc_sreg  = 1;
+        asm.rs2.valid               = 1;
+        asm.rs2.valid_gpr_rvc_sreg  = 1;
       end
       CMJT_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.cmjt.index;
-        asm.imm.imm_raw_sorted    = instr.compressed.format.cmjt.index;
-        asm.imm.imm_type          = INDEX;
-        asm.imm.width             = 1;
-        asm.imm.imm_value         = instr.compressed.format.cmjt.index;
-        asm.imm.valid             = 1;
+        asm.imm.imm_raw             = instr.compressed.format.cmjt.index;
+        asm.imm.imm_raw_sorted      = instr.compressed.format.cmjt.index;
+        asm.imm.imm_type            = INDEX;
+        asm.imm.width               = 1;
+        asm.imm.imm_value           = instr.compressed.format.cmjt.index;
+        asm.imm.valid               = 1;
       end
       CMPP_TYPE: begin
-        asm.imm.imm_raw           = instr.compressed.format.cmpp.spimm;
-        asm.imm.imm_raw_sorted    = instr.compressed.format.cmpp.spimm;
-        asm.imm.imm_type          = SPIMM;
-        asm.imm.width             = 1;
-        asm.rlist.rlist           = instr.compressed.format.cmpp.urlist;
-        asm.stack_adj.stack_adj   = get_stack_adj(instr.compressed.format.cmpp.urlist, instr.compressed.format.cmpp.spimm);
-        asm.imm.valid             = 1;
-        asm.rs1.gpr               = instr.compressed.format.csh.rs1.gpr;
-        asm.rs2.gpr               = instr.compressed.format.csh.rs2.gpr;
-        asm.rs1.valid             = 1;
-        asm.rs2.valid             = 1;
-        asm.rlist.valid           = 1;
-        asm.stack_adj.valid       = 1;
+        asm.imm.imm_raw             = instr.compressed.format.cmpp.spimm;
+        asm.imm.imm_raw_sorted      = instr.compressed.format.cmpp.spimm;
+        asm.imm.imm_type            = SPIMM;
+        asm.imm.width               = 1;
+        asm.rlist.rlist             = instr.compressed.format.cmpp.urlist;
+        asm.stack_adj.stack_adj     = get_stack_adj(instr.compressed.format.cmpp.urlist, instr.compressed.format.cmpp.spimm);
+        asm.imm.valid               = 1;
+        asm.rs1.gpr                 = instr.compressed.format.csh.rs1.gpr;
+        asm.rs2.gpr                 = instr.compressed.format.csh.rs2.gpr;
+        asm.rs1.valid               = 1;
+        asm.rs2.valid               = 1;
+        asm.rlist.valid             = 1;
+        asm.stack_adj.valid         = 1;
       end
 
       default : ;
diff --git a/lib/isa_decoder/isa_typedefs.sv b/lib/isa_decoder/isa_typedefs.sv
index 374985c103..416e705db9 100644
--- a/lib/isa_decoder/isa_typedefs.sv
+++ b/lib/isa_decoder/isa_typedefs.sv
@@ -295,12 +295,40 @@
     C_A5 = 3'b111
   } gpr_rvc_abi_name_e;
 
+  typedef enum logic [2:0] {
+    CS_X8  = 3'b000,
+    CS_X9  = 3'b001,
+    CS_X18 = 3'b010,
+    CS_X19 = 3'b011,
+    CS_X20 = 3'b100,
+    CS_X21 = 3'b101,
+    CS_X22 = 3'b110,
+    CS_X23 = 3'b111
+  } gpr_rvc_sreg_name_e;
+
+  typedef enum logic [2:0] {
+    CS_S0 = 3'b000,
+    CS_S1 = 3'b001,
+    CS_S2 = 3'b010,
+    CS_S3 = 3'b011,
+    CS_S4 = 3'b100,
+    CS_S5 = 3'b101,
+    CS_S6 = 3'b110,
+    CS_S7 = 3'b111
+  } gpr_rvc_sreg_abi_name_e;
+
   typedef union packed {
     bit [2:0]          raw;
     gpr_rvc_name_e     gpr;
     gpr_rvc_abi_name_e gpr_abi;
   } gpr_rvc_t;
 
+  typedef union packed {
+    bit [2:0]               raw;
+    gpr_rvc_sreg_name_e     gpr;
+    gpr_rvc_sreg_abi_name_e gpr_abi;
+  } gpr_rvc_sreg_t;
+
   typedef union packed {
     bit [4:0]      raw;
     gpr_name_e     gpr;
@@ -748,13 +776,6 @@
     logic[6:2]   funct5;
   } cu_type_t;
 
-  typedef struct packed {
-    logic[15:10] funct6;
-    gpr_rvc_t    r1s;
-    logic[6:5]   funct2;
-    gpr_rvc_t    r2s;
-  } cmmv_type_t;
-
   typedef struct packed {
     logic[15:10] funct6;
     logic[9:2]   index;
@@ -767,6 +788,13 @@
     logic[5:4]   spimm;
   } cmpp_type_t;
 
+  typedef struct packed {
+    logic[15:10]   funct6;
+    gpr_rvc_sreg_t r1s;
+    logic[6:5]     funct2;
+    gpr_rvc_sreg_t r2s;
+  } cmmv_type_t;
+
   // Compressed instruction types
   typedef struct packed {
     logic [31:16]  reserved_31_16;
@@ -810,10 +838,12 @@
   // and enumerated abi register names
   // ---------------------------------------------------------------------------
   typedef struct packed {
-    gpr_t     gpr;
-    gpr_rvc_t gpr_rvc;
-    bit       valid;
-    bit       valid_gpr_rvc;
+    gpr_t          gpr;
+    gpr_rvc_t      gpr_rvc;
+    gpr_rvc_sreg_t gpr_rvc_sreg;
+    bit            valid;
+    bit            valid_gpr_rvc;
+    bit            valid_gpr_rvc_sreg;
   } reg_operand_t;
 
   // ---------------------------------------------------------------------------
diff --git a/lib/uvm_agents/uvma_isacov/uvma_isacov_mon.sv b/lib/uvm_agents/uvma_isacov/uvma_isacov_mon.sv
index adf1842114..8a4a7a45d0 100644
--- a/lib/uvm_agents/uvma_isacov/uvma_isacov_mon.sv
+++ b/lib/uvm_agents/uvma_isacov/uvma_isacov_mon.sv
@@ -216,14 +216,64 @@ function void uvma_isacov_mon_c::write_rvfi_instr(uvma_rvfi_instr_seq_item_c#(IL
     // might also interfere with the spike implementation.
     // the "get_rx"-functions should no longer be needed if we supply the translated values to
     // the coverage model.
-    mon_trn.instr.c_rdrs1 = instr_asm.rd.valid ? ( instr_asm.rd.valid_gpr_rvc  ? instr_asm.rd.gpr_rvc  : instr_asm.rd.gpr )
-                                               : ( instr_asm.rs1.valid_gpr_rvc ? instr_asm.rs1.gpr_rvc : instr_asm.rs1.gpr );
-    mon_trn.instr.c_rdp   = instr_asm.rd.valid_gpr_rvc  ? instr_asm.rd.gpr_rvc  : instr_asm.rd.gpr;
-    mon_trn.instr.c_rs1s  = instr_asm.rs1.valid_gpr_rvc ? instr_asm.rs1.gpr_rvc : instr_asm.rs1.gpr;
-    mon_trn.instr.c_rs2s  = instr_asm.rs2.valid_gpr_rvc ? instr_asm.rs2.gpr_rvc : instr_asm.rs2.gpr;
-    mon_trn.instr.rs1     = instr_asm.rs1.valid_gpr_rvc ? instr_asm.rs1.gpr_rvc : instr_asm.rs1.gpr;
-    mon_trn.instr.rs2     = instr_asm.rs2.valid_gpr_rvc ? instr_asm.rs2.gpr_rvc : instr_asm.rs1.gpr;
-    mon_trn.instr.rd      = instr_asm.rd.valid_gpr_rvc  ? instr_asm.rd.gpr_rvc  : instr_asm.rd.gpr;
+
+    if ( instr_asm.rd.valid ) begin
+      case (1)
+        instr_asm.rd.valid_gpr_rvc_sreg : begin
+          mon_trn.instr.c_rdrs1 = instr_asm.rd.gpr_rvc_sreg;
+          mon_trn.instr.c_rdp   = instr_asm.rd.gpr_rvc_sreg;
+          mon_trn.instr.rd      = instr_asm.rd.gpr_rvc_sreg;
+        end
+        instr_asm.rd.valid_gpr_rvc : begin
+          mon_trn.instr.c_rdrs1 = instr_asm.rd.gpr_rvc;
+          mon_trn.instr.c_rdp   = instr_asm.rd.gpr_rvc;
+          mon_trn.instr.rd      = instr_asm.rd.gpr_rvc;
+        end
+        default : begin
+          mon_trn.instr.c_rdrs1 = instr_asm.rd.gpr;
+          mon_trn.instr.c_rdp   = instr_asm.rd.gpr;
+          mon_trn.instr.rd      = instr_asm.rd.gpr;
+        end
+      endcase
+    end
+
+    if ( instr_asm.rs1.valid ) begin
+      case (1)
+        instr_asm.rs1.valid_gpr_rvc_sreg : begin
+            mon_trn.instr.c_rdrs1 = instr_asm.rd.valid ? mon_trn.instr.c_rdrs1 : instr_asm.rs1.gpr_rvc_sreg;
+            mon_trn.instr.c_rs1s  = instr_asm.rs1.gpr_rvc_sreg;
+            mon_trn.instr.rs1     = instr_asm.rs1.gpr_rvc_sreg;
+          end
+        instr_asm.rs1.valid_gpr_rvc : begin
+            mon_trn.instr.c_rdrs1 = instr_asm.rd.valid ? mon_trn.instr.c_rdrs1 : instr_asm.rs1.gpr_rvc;
+            mon_trn.instr.c_rs1s  = instr_asm.rs1.gpr_rvc;
+            mon_trn.instr.rs1     = instr_asm.rs1.gpr_rvc;
+          end
+        default : begin
+            mon_trn.instr.c_rdrs1 = instr_asm.rd.valid ? mon_trn.instr.c_rdrs1 : instr_asm.rs1.gpr;
+            mon_trn.instr.c_rs1s  = instr_asm.rs1.gpr;
+            mon_trn.instr.rs1     = instr_asm.rs1.gpr;
+          end
+      endcase
+    end
+
+    if ( instr_asm.rs2.valid ) begin
+      case (1)
+        instr_asm.rs2.valid_gpr_rvc_sreg : begin
+            mon_trn.instr.c_rs2s = instr_asm.rs2.gpr_rvc_sreg;
+            mon_trn.instr.rs2    = instr_asm.rs2.gpr_rvc_sreg;
+          end
+        instr_asm.rs2.valid_gpr_rvc : begin
+            mon_trn.instr.c_rs2s = instr_asm.rs2.gpr_rvc;
+            mon_trn.instr.rs2    = instr_asm.rs2.gpr_rvc;
+          end
+        default : begin
+            mon_trn.instr.c_rs2s = instr_asm.rs2.gpr;
+            mon_trn.instr.rs2    = instr_asm.rs2.gpr;
+        end
+      endcase
+    end
+
     mon_trn.instr.immi    = instr_asm.imm.imm_raw_sorted;
     mon_trn.instr.imms    = instr_asm.imm.imm_raw_sorted;
     mon_trn.instr.immb    = instr_asm.imm.imm_raw_sorted;