RHEL9 ppc64le Power9 pseries guest userspace segfaults

• QEMU master
• Any host (reproduced on x86, arm64 M1, ppc64le power9)
• RHEL9.3 qcow2 guest image
• Power9 pseries guest

qemu-system-ppc64 -M pseries -accel tcg -cpu POWER9 -drive file=rhel.qcow2,format=qcow2 -nographic

On boot, the RHEL9 image will attempt to run cloud-init, a Python3 program which segfaults:

[   65.200049] cloud-init[740]: segfault (11) at 8 nip 7fff9f6daa60 lr 7fff9f6dae00 code 1 in libpython3.9.so.1.0[7fff9f600000+380000]
[   65.201251] cloud-init[740]: code: 2c090000 7ddc502a 7ebc5214 41e20008 4800845c 60000000 3900ffff e94280f0 
[   65.201282] cloud-init[740]: code: 7905f80e e9ea0000 2c2f0000 41c26d9c <e90e0008> e8e800a8 70e70800 41c24ae4 ```

This reliably reproduces each boot. I bisected it down to 72b70d5c introduced in v6.2:

commit 72b70d5c3cdca7eaa7be448a1dc91af52167b9ab
Author: Lucas Mateus Castro (alqotel) <lucas.castro@eldorado.org.br>
Date:   Thu Nov 4 09:37:06 2021 -0300

    target/ppc: moved stxv and lxv from legacy to decodtree
    
    Moved stxv and lxv implementation from the legacy system to
    decodetree.
    
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Signed-off-by: Luis Pires <luis.pires@eldorado.org.br>
    Signed-off-by: Lucas Mateus Castro (alqotel) <lucas.castro@eldorado.org.br>
    Signed-off-by: Matheus Ferst <matheus.ferst@eldorado.org.br>
    Message-Id: <20211104123719.323713-13-matheus.ferst@eldorado.org.br>
    Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

 target/ppc/insn32.decode            |  8 ++++++
 target/ppc/translate.c              | 17 ++-----------
 target/ppc/translate/vsx-impl.c.inc | 51 +++++++++++++++++++++++++++++++++++--
 3 files changed, 59 insertions(+), 17 deletions(-)