[dv] PMP Coverage Holes

The significant coverage holes in PMP are all related to instruction side accesses.

At the top-level pmp_iside_nomatch_cross`pmp_iside2_nomatch_cross` which cover scenarios where a fetch doesn't match any PMP entry (and hence may be denied or allowed depending upon MMWP and U or M mode execution) has one missing bin involving M mode and several involving U mode.

The M mode bin requires a setup without any executable regions and MMWP set. This is a possible scenario but hard to hit without a directed test. It's also not a sane configuration that would be used by software so concern over missing coverage is low for V2 here. We also have confidence that this would work as we do hit various scenarios where M mode execution is denied and M mode dside (store/load) accesses are denied due to lack of matching regions so the general logic here is sound.

Most of the holes are around U mode, indicating we don't have many scenarios where we execute U mode code without any U mode executable regions setup. For similar reasons to above this is not a major concern for V2.

Within the regional coverage pmp_iside_priv_bits_cross and pmp_iside2_priv_bits_cross have the most holes. These cover all scenarios of attempted execution against all PMP configurations, all privilege levels and deny/allow. The missing scenarios are mostly around U mode execution against various different PMP configurations. We do see some deny and allow scenarios for U mode execution showing the general logic is sound so these holes aren't a major concern for V2.

There are also a small number of holes around M mode execution allow/deny and dside load/store accesses. These occur as the random PMP config generation simply doesn't generate all possible configs. There are few of them and with no particular pattern so they aren't a major concern for V2.

estimate 4

Start by locating the pmp_iside_nomatch_cross, pmp_iside2_nomatch_cross, pmp_iside_priv_bits_cross, and pmp_iside2_priv_bits_cross coverage points. Review the missing M-mode and U-mode bins alongside the random PMP configuration generation, then add coverage scenarios for the identified holes and verify that the crosses are covered.