How to disassemble SPC572L assembler code?

Question

I have a binary file with code for the SPC572L64 processor from ST.

The Datasheet can be downloaded here and the Programmers Manual here. All documents for this processor are listed here.

The documents say:

• One main 32-bit Power Architecture® VLE Compliant CPU core, single issue
• There is one e200z215An3 processor core on the SPC572Lx device.
• The e200z215An3 is a single-issue 32-bit PowerISA 2.06 VLE compliant design with 32-bit general-purpose registers (GPRs). The e200z215An3 core implements the VLE (variable- length encoding) ISA, providing improved code density.
• Instruction set enhancement allowing variable length encoding (VLE), encoding a mix of 16-bit and 32-bit instructions, for code size footprint reduction.

Wikipedia says:

• Power ISA is an evolution of the PowerPC ISA, created by the mergers of the core PowerPC ISA and the optional Book E for embedded applications.

All this confuses me more than it helps.

I tried to disassemble the code with Ghidra trying all PowerPC options. But what comes out is garbage. Every few lines a "??" appears instead of valid code:

    0108003c 73 e0 e0 00     andi.      r0,r31,0xe000
    01080040 70 68 e0 00     andi.      r8,r3,0xe000
    01080044 18              ??         18h
    01080045 63              ??         63h    c
    01080046 d1 a0 70 80     stfs       f13,0x7080(0)
    0108004a 00              ??         00h
    0108004b bf              ??         BFh
    0108004c 7c 89 03 a6     mtspr      CTR,r4
    01080050 1a              ??         1Ah
    01080051 03              ??         03h
    01080052 09 00 1c 63     tdgti      r0,0x1c63
    01080056 00              ??         00h
    01080057 40              ??         40h    @
    01080058 7a              ??         7Ah    z
    01080059 20              ??         20h     
    0108005a ff              ??         FFh
    0108005b f8              ??         F8h
    0108005c 70 68 e0 00     andi.      r8,r3,0xe000
    01080060 70 79 c7 c0     andi.      r25,r3,0xc7c0
    01080064 48 c4 7c 89     bl         SUB_01cc7cec

And the decompiler outputs:

void UndefinedFunction_01080000(void)
{
  /* WARNING: Bad instruction - Truncating control flow here */
  halt_baddata();
}

Can anybody give me a step by step instruction what settings I need to disassemble this processor?

Answer 1

Based on the link provided by rce, Ghidra needs extra help to disassemble this code correctly.

I select Language = "PowerISA-VLE-64-32addr" in the Ghidra project editor: Then to start the disassembly it will ONLY work by pressing the F12 key:

Also with IDA pro 7.5 I can disassemble my binary file. IDA pro has only two options for PowerPC: Big endian and Little endian. I selected Big Endian. When loading I chose that all the code is VLE and I get a successful disassembly:

After loading the file you must press "C" to start the disassembly which is done very fast.

To see also the hex bytes (blue) in the disassembly you must edit the file ida.cfg and set

OPCODE_BYTES = 4

because these bytes are disabled by default.