docs: record the OpenC906 SRAM macro swap and its evidence

Move the chapter 3 memory swap from deferred to simulation-validated in
docs/ip/hp-platform.md (mechanism, define gating, and the stacking table)
and docs/hp-rv64-validation.md (macro-mode boot TB and SoC macro-sim
evidence, with the remaining synthesis/netlist/STA/LEC gates called out).
Extend the override inventories in rtl/README.md and scripts/README.md to
cover the eight aq_spsram_* wrappers. The chapter 3 ICG replacement and
physical qualification stay explicitly deferred.

docs/hp-rv64-validation.md

@@ -115,15 +115,28 @@ qualification. Current evidence requires, at minimum:
   the C906 store buffer; `rtl/mini/ip_overrides/sysmap.h` marks the MMIO and
   core-internal CLINT/PLIC windows strong-order non-cacheable per the user
   manual.
+- The integration manual chapter 3 SRAM swap is validated in simulation: the
+  eight `rtl/mini/ip_overrides/aq_spsram_*.v` overrides select IHP130
+  `RM_IHPSG13_1P_*` macro combinations under `PDK_IHP130`+`HAVE_SRAM_MACRO`
+  without `PDK_BEHAV`, and the focused boot testbench variant
+  `test_c906_boots_smoke_payload_with_ihp130_sram_macros` boots the real
+  smoke payload (cache maintenance plus GA2D data movement, which exercises
+  the BHT/ICache/DCache/JTLB RAMs for real) on the macro path with the same
+  `HP_C906_BOOT_TEST_PASS` verdict as the behavioral run.
 
 `hp-linux-sim` was run with a bounded wall-clock budget this round and its
 current frontier is recorded above; the synthesis-dependent gates remain
-unrun (synthesis waits for the SRAM macro swap). Both stay required evidence
-for qualification.
+unrun (synthesis, netlist simulation, STA, and the physical/LEC qualification
+of the macro path). The SoC-level macro-mode simulation now has passing
+evidence: `make CONFIG=configs/ci/ihp130-hp.mk PDK_BEHAV=NO SIMU=VERILATOR
+hp-smoke-sim` builds the whole SoC (C906 `aq_spsram_*` wrappers and
+`tc_sram`) on the IHP130 macro models and passes with
+`SIM_TEST_PASS code=0` plus the `HP_LINUX_READY`/`HP_GA2D_PASS`/
+`HP_GA2D_CACHE_CLEAN` markers. All stay required evidence for qualification.
 
 Deferred this phase: low-power support (`core0_pad_lpmd_b` unconnected), DFT
-(scan/mbist tied off), the debug SBA AXI master (unconnected), ASIC
-memory-macro replacement for the behavioral FPGA SRAM models, and HP Linux
+(scan/mbist tied off), the debug SBA AXI master (unconnected), the chapter 3
+ICG (`gated_clk_cell`) replacement, and HP Linux
 re-qualification timing/performance evidence. The repo-owned OpenSBI platform
 registers `fdt_irqchip_init` (v1.9 supports the `thead,c900-plic` match with
 T-Head delegation fixups), so the C906-internal PLIC is initialized by

docs/ip/hp-platform.md

@@ -44,11 +44,36 @@ and would mark the Mini peripheral window cacheable/bufferable) with the Mini
 address map: the MMIO window `0x02000000`-`0x2FFFFFFF` — including the
 core-internal CLINT/PLIC window — is strong-order/non-cacheable device memory
 as the OpenC906 user manual requires; SRAM/SDRAM/PSRAM/OPI and the flash/XIP
-windows stay cacheable. The vendored checkout is never modified. Deferred
-this phase: low-power support
+windows stay cacheable. The vendored checkout is never modified.
+
+The OpenC906 integration manual chapter 3 memory swap is implemented for
+simulation: the eight C906 single-port SRAM wrappers have reviewed overrides
+in `rtl/mini/ip_overrides/aq_spsram_*.v`. With `PDK_IHP130` +
+`HAVE_SRAM_MACRO` and without `PDK_BEHAV` each wrapper instantiates IHP130
+`RM_IHPSG13_1P_*` macros (BIST pins tied off, `A_DLY=1`), stacked per manual
+section 3.1.5:
+
+| Wrapper | Macro combination | Stacking |
+| --- | --- | --- |
+| `aq_spsram_1024x16` (BHT) | 1x `RM_IHPSG13_1P_1024x32_c2_bm_bist` | low 16 bits used |
+| `aq_spsram_2048x32` (ICache data) | 2x `RM_IHPSG13_1P_1024x32_c2_bm_bist` | depth, `A[10]` chip-select |
+| `aq_spsram_256x59` (ICache tag) | 4x `RM_IHPSG13_1P_64x64_c2_bm_bist` | depth, `A[7:6]` chip-select |
+| `aq_spsram_1024x64` (DCache data) | 2x `RM_IHPSG13_1P_1024x32_c2_bm_bist` | width, low/high 32 bits |
+| `aq_spsram_128x8` (DCache dirty) | 2x `RM_IHPSG13_1P_64x64_c2_bm_bist` | depth, `A[6]` chip-select |
+| `aq_spsram_64x58` (DCache tag) | 1x `RM_IHPSG13_1P_64x64_c2_bm_bist` | low 58 bits used |
+| `aq_spsram_64x88` (JTLB data) | 2x `RM_IHPSG13_1P_64x64_c2_bm_bist` | width, low 64 + high 24 bits |
+| `aq_spsram_64x98` (JTLB tag) | 2x `RM_IHPSG13_1P_64x64_c2_bm_bist` | width, low 64 + high 34 bits |
+
+Depth stacks register the bank select on read transactions and mux the bank
+outputs one cycle later (manual section 3.1.4 timing); unused upper
+write-mask bits are tied off so unimplemented bits are never written. Every
+other configuration — including the committed `PDK_BEHAV=YES` CI profiles —
+compiles the upstream behavioral `aq_f_spsram_*` instance byte-identically.
+Deferred this phase: low-power support
 (`core0_pad_lpmd_b` unconnected), DFT (scan/mbist tied off), the debug SBA AXI
-master (unconnected), ASIC memory-macro replacement for the behavioral FPGA
-SRAM models, and HP Linux re-qualification timing/performance evidence.
+master (unconnected), the chapter 3 ICG (`gated_clk_cell`) replacement,
+physical/LEC qualification of the macro path (synthesis mapping, STA), and
+HP Linux re-qualification timing/performance evidence.
 
 ### Boot bundle V2
 
@@ -136,8 +161,12 @@ separate run logs and
 structured results; an interrupted or ongoing run cannot reuse an old pass.
 Run affected host/Python/C/RTL checks and IHP130 behavioral regressions.
 Synthesis, netlist simulation, STA, and synthesis-dependent metrics are
-explicitly deferred by user instruction, as are SRAM macro replacement,
-CDC/RDC/physical signoff and commercial qualification. No PPA claim is made.
+explicitly deferred by user instruction, as are CDC/RDC/physical signoff and
+commercial qualification. No PPA claim is made. The SRAM macro swap is no
+longer deferred at simulation level: the `aq_spsram_*` overrides described
+above run the IHP130 macro path in the focused boot testbench (see
+[HP RV64 Validation](../hp-rv64-validation.md)); physical macro integration
+remains deferred.
 
 Reference boundaries: [RT-Thread v5.3.0](https://github.com/RT-Thread/rt-thread/releases/tag/v5.3.0)
 supplies the OS/CPU port; the repository owns board integration. The C906

rtl/README.md

@@ -18,8 +18,11 @@ downsizer with an MMIO demux, the C906 internal CLINT/PLIC, mailbox, UART1, and
 SYSCTRL lifecycle signals. `make setup-openc906` (part of `make setup`)
 restores the locked checkout and `make openc906-prepare` emits the generated
 filelist and manifest below `build/<variant>/generated/openc906/`; the OpenC906
-sources are an external lint boundary. The reviewed hart-ID and sysmap
-address-attribute overrides live in `rtl/mini/ip_overrides/` and are applied
+sources are an external lint boundary. The reviewed hart-ID, sysmap
+address-attribute, and SRAM wrapper overrides live in `rtl/mini/ip_overrides/`
+(the `aq_spsram_*.v` overrides implement the integration manual chapter 3
+memory swap and select IHP130 `RM_IHPSG13_1P_*` macros only under
+`PDK_IHP130`+`HAVE_SRAM_MACRO` without `PDK_BEHAV`) and are applied
 by filelist generation, never by editing the vendored checkout. The former
 VexiiRiscv HP generator is preserved
 only as the frozen Std-series asset (`make std-vexii-generate`). See

scripts/README.md

@@ -130,7 +130,9 @@ source used by Mini product profiles and verifies the checked-out revision;
 the vendored checkout is never modified. `generate_openc906.py` resolves the
 upstream `C906_RTL_FACTORY/gen_rtl` filelists from that checkout, substitutes
 the reviewed overrides from `rtl/mini/ip_overrides/` (the hart-1
-`aq_sysio_kid.v` and the strong-order MMIO-window `sysmap.h`, each pinned to
+`aq_sysio_kid.v`, the strong-order MMIO-window `sysmap.h`, and the eight
+`aq_spsram_*.v` SRAM wrappers whose IHP130 macro path is gated on
+`PDK_IHP130`+`HAVE_SRAM_MACRO` without `PDK_BEHAV`, each pinned to
 the upstream file's SHA-256 so a locked-revision move forces review), and
 emits the single compilation unit `openc906_combined.v` below `build/`;
 generated RTL is never tracked.