I am trying to figure out the encoding for unconditional JMPs on SPARC, i.e the JMP. After disassembling a few binaries.

In my IDA disassembly the encoding for JMP %g1 is:

81 c0 40 00 

Digging through the spark manuals, I can't seem to find a record of how this is encoded. I am also confused as to why IDA refers to a "JMP" as opposed to the "JMPL" in the docs.

The JMPL encoding recommendations given in the SPARC9 manual are a little arcane to me and I struggle with what they are getting at:




"If either of the low-order two bits of the jump address is nonzero, a mem_address_not_aligned exception occurs"

Well, I'm not sure how that squares with the instruction that IDA found. Can someone break down how this maps to JMP %g1? How would this change for JMP %g2?

  • I suspect it sees the 'L' as an implementation detail - often you'd just write JMP and leave it up to the assembler whether it generates a short or long jump (but my SPARC is rusty). %g2 - you should probably get hold of a SPARC assembler and experiment, e.g. GNU binutils is easy to build targeting any chip - if you can build it in a Linux VM or a Mac at least, or maybe Cygwin just works too nowadays. Or you could hex-edit your SPARC binary and run it through IDA again at a pinch to see if you can change it to g2 yourself.
    – Rup
    Commented May 31, 2017 at 6:59

1 Answer 1


81 c0 40 00 can be broken down as follows

10 00000 111000 00001 0 0000000000000


To change the target from %g1 to %g2, just change the rs1 field from 00001 to 00010.

The 'L' is simply an artifact of at&t syntax vs intel syntax. In at&t syntax, the instruction name encodes information about the argument size. In intel syntax, that's done via the decorating of arguments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.