debug: 0.881
boot: 0.828
device: 0.822
other: 0.817
network: 0.725
socket: 0.614
graphic: 0.603
semantic: 0.548
performance: 0.528
PID: 0.516
vnc: 0.504
files: 0.246
KVM: 0.196
permissions: 0.160

qemu-system-arm highmem support broken with TCG
Additional information:
I initially bisected this to commit 39a1fd25287f ("target/arm: Fix handling of LPAE block descriptors"), which introduced an identical bug by masking the wrong address bits due to a type mismatch, but this was in turn fixed by commit c2360eaa0262 ("target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem"). The bug resurfaced between qemu-7.1.0 and qemu-7.2.0 after commit f3639a64f602 ("target/arm: Use softmmu tlbs for page table walking"), but may be caused by the preceding 4a35855682ce ("target/arm: Plumb debug into S1Translate") which fails to boot for an unrelated reason.

I reproduced this on qemu-7.2 as shipped by Debian as well as on qemu-9.1 (built locally).

Part of this problem appeared to be hidden by the 'highmem=on' argument not having the intended effect during parts of the bisection, which I worked around by overriding the 'pa_bits' variable in machvirt_init().