[PATCH v2 00/25] hw/arm: Facebook SanMiguel BMC and TMP75-family sensors

This series adds the Facebook SanMiguel BMC, promotes the
TMP75/TMP175/LM75B sensors from generic TMP105 stand-ins to improved,
dedicated models, and introduces the test-side plumbing needed to
exercise real I2C devices from functional tests without hardcoding QOM
paths.

The work falls into four parts.

1. TMP* sensor models

The TMP105 model was the only stand-in for a whole family of pin- and
register-compatible parts, and several boards worked around the gap with
private TYPE_TMP75 / TYPE_LM75 aliases that resolved back to a plain
TMP105.

The model is first cleaned up for correctness and QEMU convention. One
of those changes touches migrated state, which gains an optional
subsection so existing streams stay compatible.

On that base, TMP75/TMP175/LM75B become variants selected by a small
per-type class descriptor. The variant is class data, so the wire format
is unchanged and all variants share the existing vmstate. qtest coverage
is added for the per-variant behaviour. The existing BMC boards then
drop their local aliases and instantiate the real models.

2. SanMiguel BMC

A new AST2600-based machine for the Facebook SanMiguel BMC, derived from
its device tree. It wires up three TMP75 sensors, IO expanders, FRU
EEPROMs, an I2C mux and an RTC across its I2C buses, and provides its
RAM, flash and networking; the FRU EEPROMs are populated with data read
from physical hardware. A functional test boots the OpenBMC image and
drives each sensor over QOM, checking the guest hwmon interface reports
the injected value back.

3. Python device locator

A QOM path names a device by its position under the object that owns it,
in enumeration order — it says nothing about where the device sits in
the bus topology. From a QOM path alone it is impossible to tell where a
device is actually connected or what purpose it serves.

DeviceLocator is a pure-Python helper that resolves a device from a
string descriptor of its position — bus, address, type, on-bus index —
by walking the bus/device hierarchy. It uses only standard QOM queries
over QMP: no new QEMU commands, no model changes. A self-check exercises
the grammar and its error paths against a paused SanMiguel BMC; it needs
no disk image and runs in about a second.

Note: the helper adopts the 3.10 type-hint syntax rather than the 3.9
equivalents; 3.9 reached end of life on 2025-10-31. The import is
guarded so the module still loads on 3.9 and dependent tests skip there.

Two small test-framework fixes ride along: the set_machine probe VM now
gets the per-test workdir instead of the hardcoded /var/tmp default, and
the Aspeed OpenBMC helper can optionally assert the booted device-tree
model.

4. Catalina follow-ups

The final three commits are the tail of the earlier "hw/arm: improve
Aspeed Catalina BMC emulation" series: functional tests for the PCA9555
and PCA9554 IO expanders, plus the PCA9554 change that drives its input
pins externally. They were held back because reaching such devices from
a test needs a stable way to reference them by bus position — the QOM
re-parenting patch tried then was rejected, and the device locator now
unblocks them.

Based on:

  repo:   https://github.com/legoater/qemu.git
  branch: aspeed-11.1
  commit: 04d27371e3 ("hw/arm: catalina: add NIC and FIO temperature sensors")

Signed-off-by: Emmanuel Blot <[email protected]>
---
Changes in v2:
- Simplify TMP105 multiple variant initialization
- Improve reliability against malformed device locator strings
- Remove an obsolete reference to INA23x devices from a commit log message
- Rebase patch series on aspeed-next branch
- Fix invalid JSON syntax in SanMiguel FRU descriptions
- Link to v1: https://lore.kernel.org/qemu-devel/[email protected]

To: [email protected]
Cc: Philippe Mathieu-Daudé <[email protected]>
Cc: Cédric Le Goater <[email protected]>
Cc: Peter Maydell <[email protected]>
Cc: Steven Lee <[email protected]>
Cc: Jamin Lin <[email protected]>
Cc: Kane Chen <[email protected]>
Cc: Andrew Jeffery <[email protected]>
Cc: Joel Stanley <[email protected]>
Cc: [email protected]
Cc: Fabiano Rosas <[email protected]>
Cc: Laurent Vivier <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Cc: Thomas Huth <[email protected]>
Cc: "Daniel P. Berrangé" <[email protected]>

---
Emmanuel Blot (25):
      hw/sensor: tmp105: make device state private to the implementation
      hw/sensor: tmp105: name the parent object field parent_obj
      hw/sensor: tmp105: implement Resettable reset
      hw/sensor: tmp105: enforce the configurable fault queue
      hw/sensor: tmp105: describe the temperature property
      hw/arm: aspeed: guard board-local temperature-sensor aliases
      hw/sensor: tmp105: add TMP75, TMP175 and LM75B variants
      tests/qtest: tmp105: cover the ALERT fault queue
      tests/qtest: tmp105: cover the TMP75, TMP175 and LM75B variants
      tests/qtest: tmp105: cover one-shot and fault-queue write immunity
      tests/qtest: tmp105: cover shutdown clearing the ALERT across variants
      hw/arm: sanmiguel: add Facebook SanMiguel BMC machine
      hw/arm: sanmiguel: populate EEPROM data
      hw/arm: catalina: use the real TMP75 model
      hw/arm: fuji: use the real TMP75 and LM75B temperature sensors
      tests/functional: aspeed: optionally check the device tree model on boot
      tests/functional: give the set_machine probe VM the test workdir
      tests/functional: add a pure-Python device-locator resolver
      tests/functional: add a device-locator self-check
      tests/functional: aspeed: add hwmon sensor read helpers
      tests/functional/arm: sanmiguel: add BMC boot test
      tests/functional/arm: catalina: test TMP75
      tests/functional/arm: catalina: test PCA9555 IO expander via QOM
      hw/arm: catalina: drive pca9554 io expander input pins externally
      tests/functional/arm: catalina: test PCA9554 IO expander via QOM

 hw/arm/aspeed_ast2600_catalina.c              |  14 +-
 hw/arm/aspeed_ast2600_fuji.c                  |  16 +-
 hw/arm/aspeed_ast2600_sanmiguel.c             | 405 ++++++++++++++++++
 hw/arm/meson.build                            |   1 +
 hw/sensor/tmp105.c                            | 304 ++++++++++---
 include/hw/sensor/tmp105.h                    |  46 +-
 tests/functional/arm/meson.build              |   3 +
 tests/functional/arm/test_aspeed_catalina.py  | 107 ++++-
 tests/functional/arm/test_aspeed_sanmiguel.py |  72 ++++
 tests/functional/arm/test_device_locator.py   | 120 ++++++
 tests/functional/aspeed.py                    |  21 +-
 tests/functional/qemu_test/locator.py         | 586 ++++++++++++++++++++++++++
 tests/functional/qemu_test/testcase.py        |   2 +-
 tests/qtest/tmp105-test.c                     | 359 ++++++++++++++++
 14 files changed, 1934 insertions(+), 122 deletions(-)
---
base-commit: e5d3f5ac8633de310066f14862b17e4cac8ef8a5
change-id: 20260729-sanmiguel-bmc-locator-db13cceae66c

Best regards,
--  
Emmanuel Blot <[email protected]>