According to PowerISA, the PIR register should be readable in privileged mode also, not only in hypervisor privileged mode.
The following patch fixes this: --- qemu-2.12.0-original/target/ppc/translate_init.c 2018-04-24 13:30:47.000000000 -0300 +++ qemu-2.12.0/target/ppc/translate_init.c 2018-04-25 16:40:04.248844415 -0300 @@ -7811,7 +7811,7 @@ /* Processor identification */ spr_register_hv(env, SPR_PIR, "PIR", SPR_NOACCESS, SPR_NOACCESS, - SPR_NOACCESS, SPR_NOACCESS, + &spr_read_generic, SPR_NOACCESS, &spr_read_generic, NULL, 0x00000000); spr_register_hv(env, SPR_HID0, "HID0",