MC68HC11 reversing and EEPROM calls

[PunkFiction]

Hi everyone,
Thanks for welcoming me in.
I'm doing a little project to get the hang of Ghidra, I've been curious about SRE for some time, and microcontrollers overall.
I've dumped an old spare I had lying around, an MC68HC11E1. I've been trying to see if I can figure out some of the stuff within the EEPROM because it's mostly empty except the first line and two end lines which I find odd.
I've not been able to find any direct calls to it in the ROM assembly, and i'm struggling to understand how the datasheet says we're supposed to use it. 
Can someone explain to me how does the chip access its own onchip EEPROM?

For reference just in case:
EEPROM: $b600-b7ff
ROM: $d000-$fffe.
 Link to NXP MC68HC11E reference book

Let me know if I forgot to post an important piece of the puzzle.

Thanks in advance.

[srb1954]

As far as reading the EEPROM is accessed in a normal read cycle just like RAM or the program memory. The 68HC11 family has a contiguous 64k memory map containing all memory and I/O devices, which can be accessed by any memory reference instruction.

Writing the EEPROM is more difficult due the relatively long programming time for the EEPROM cells and also the need to erase old data first. The procedure is fully described in the 68HC11 reference manual, along  with programming examples.

The lack of direct calls to the EEPROM memory space in the program code is probably because the EEPROM has been accessed using one of the indexed addressing modes. The X or Y index registers are set up with an address pointing to the EEPROM space and then other memory reference  instructions can access these addresses by stepping the index register through the EEPROM address range.

[Benta]

Something's off with your memory map. You can't fill the whole address space with ROM, that'll give conflicts with internal RAM, EEPROM and peripherals.
Also, if the EEPROM is protected, attempts to read it out with the internal bootloader will lead to it being erased before access is allowed.

[PunkFiction]

As far as reading the EEPROM is accessed in a normal read cycle just like RAM or the program memory. The 68HC11 family has a contiguous 64k memory map containing all memory and I/O devices, which can be accessed by any memory reference instruction.

Writing the EEPROM is more difficult due the relatively long programming time for the EEPROM cells and also the need to erase old data first. The procedure is fully described in the 68HC11 reference manual, along  with programming examples.
*
The lack of direct calls to the EEPROM memory space in the program code is probably because the EEPROM has been accessed using one of the indexed addressing modes. The X or Y index registers are set up with an address pointing to the EEPROM space and then other memory reference  instructions can access these addresses by stepping the index register through the EEPROM address range.

Yeah, I happily expected to see memory calls in the EEPROM region, that's why it confused me. Or, like you said, with indexed addressing. But I really have no mention of the $b6xx or $b7xx memory spaces, which I would have expected to see as a base address ? Or perhaps Ghidra just hasn't found it?
I'm probably lacking good understanding of the EEPROM use. But you gave me the idea of looking into the how the programming also works (which I skipped since I was just trying to pinpoint what was reading it) and I've found $103b to be set multiple time at the very top of the code. I'll see what I can find!

Something's off with your memory map. You can't fill the whole address space with ROM, that'll give conflicts with internal RAM, EEPROM and peripherals.
Also, if the EEPROM is protected, attempts to read it out with the internal bootloader will lead to it being erased before access is allowed.

I'm not sure what you mean? The ROM is not feeling the whole address space?
EEPROM was not protected and was dumped just fine

[Benta]

"I'm not sure what you mean? The ROM is not feeling the whole address space?"

My apologies.
I read $D000 as $0000. Need to get my eyes checked...

[PunkFiction]

"I'm not sure what you mean? The ROM is not feeling the whole address space?"

My apologies.
I read $D000 as $0000. Need to get my eyes checked...

Happens to everyone, don't worry.

[amyk]

"I'm not sure what you mean? The ROM is not feeling the whole address space?"

My apologies.
I read $D000 as $0000. Need to get my eyes checked...

Happens to everyone, don't worry.

I have always used lowercase hex digits (a, b, c, d, e, f) to avoid such confusion, although it's more common to confuse 8 and B: b800 vs B800, which one is easier to read?

[PunkFiction]

I have always used lowercase hex digits (a, b, c, d, e, f) to avoid such confusion, although it's more common to confuse 8 and B: b800 vs B800, which one is easier to read?

Good point, i've edited it Thanks.