JR opcode (Jump Register) only takes 1 argument, $rs.
JALR (Jump And Link Register) takes 3: $rs, $rd and $hint.

Commit 6af0bf9c7c3 added their processing into decode_opc() as:

    case 0x08 ... 0x09: /* Jumps */
        gen_compute_branch(ctx, op1 | EXT_SPECIAL, rs, rd, sa);

having both opcodes handled in the same function: gen_compute_branch.

Per JR encoding, both $rd and $hint ('sa') are decoded as zero.

Later this code got extracted to decode_opc_special(),
commit 7a387fffce5 used definitions instead of magic values:

    case OPC_JR ... OPC_JALR:
        gen_compute_branch(ctx, op1, rs, rd, sa);

Finally commit 0aefa33318b moved OPC_JR out of decode_opc_special,
to a new 'decode_opc_special_legacy' function:

  @@ -15851,6 +15851,9 @@ static void decode_opc_special_legacy(CPUMIPSState *env, DisasContext *ctx)
  +    case OPC_JR:
  +        gen_compute_branch(ctx, op1, 4, rs, rd, sa);
  +        break;

  @@ -15933,7 +15936,7 @@ static void decode_opc_special(CPUMIPSState *env, DisasContext *ctx)
  -    case OPC_JR ... OPC_JALR:
  +    case OPC_JALR:
           gen_compute_branch(ctx, op1, 4, rs, rd, sa);
           break;

Since JR is now handled individually, it is pointless to decode
and pass it unused arguments. Replace them by simple zero value
to avoid confusion with this opcode.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 target/mips/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 5b03545f099..bf71724f3f0 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -14203,7 +14203,7 @@ static void decode_opc_special_legacy(CPUMIPSState *env, DisasContext *ctx)
         break;
 #endif
     case OPC_JR:
-        gen_compute_branch(ctx, op1, 4, rs, rd, sa, 4);
+        gen_compute_branch(ctx, op1, 4, rs, 0, 0, 4);
         break;
     case OPC_SPIM:
 #ifdef MIPS_STRICT_STANDARD
-- 
2.31.1

On 7/30/21 12:55 PM, Philippe Mathieu-Daudé wrote:
>       case OPC_JR:
> -        gen_compute_branch(ctx, op1, 4, rs, rd, sa, 4);
> +        gen_compute_branch(ctx, op1, 4, rs, 0, 0, 4);

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~

On 7/31/21 12:55 AM, Philippe Mathieu-Daudé wrote:
> JR opcode (Jump Register) only takes 1 argument, $rs.
> JALR (Jump And Link Register) takes 3: $rs, $rd and $hint.
> 
> Commit 6af0bf9c7c3 added their processing into decode_opc() as:
> 
>     case 0x08 ... 0x09: /* Jumps */
>         gen_compute_branch(ctx, op1 | EXT_SPECIAL, rs, rd, sa);
> 
> having both opcodes handled in the same function: gen_compute_branch.
> 
> Per JR encoding, both $rd and $hint ('sa') are decoded as zero.
> 
> Later this code got extracted to decode_opc_special(),
> commit 7a387fffce5 used definitions instead of magic values:
> 
>     case OPC_JR ... OPC_JALR:
>         gen_compute_branch(ctx, op1, rs, rd, sa);
> 
> Finally commit 0aefa33318b moved OPC_JR out of decode_opc_special,
> to a new 'decode_opc_special_legacy' function:
> 
>   @@ -15851,6 +15851,9 @@ static void decode_opc_special_legacy(CPUMIPSState *env, DisasContext *ctx)
>   +    case OPC_JR:
>   +        gen_compute_branch(ctx, op1, 4, rs, rd, sa);
>   +        break;
> 
>   @@ -15933,7 +15936,7 @@ static void decode_opc_special(CPUMIPSState *env, DisasContext *ctx)
>   -    case OPC_JR ... OPC_JALR:
>   +    case OPC_JALR:
>            gen_compute_branch(ctx, op1, 4, rs, rd, sa);
>            break;
> 
> Since JR is now handled individually, it is pointless to decode
> and pass it unused arguments. Replace them by simple zero value
> to avoid confusion with this opcode.
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  target/mips/tcg/translate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thanks, applied to mips-next.