HW/SW Co-verification - Embedded assembly code coverage

Here is a verification challenge I'm facing and gathering ideas on the possible solutions.

I have a custom processor IP in the design which executes some pre-compiled code. The assembly code is compiled into Verilog ROM. This ROM is then simulated within the design. So the Processor starts executing this ROM code after power up.

Are there any tools or methodologies for collecting embedded firmware code coverage during RTL simulation?

The simplest way would be to create cover bins for every ROM address and measure if all instructions were fetched. But this might not be enough, would be good to see if assembly code branches are covered.

Please share your experience, thoughts or ideas you might have seen in similar cases.

Thanks