A damaged save should leave the current game alone rather than half-replacing it with invalid state.
Use it in a project
C0..C7 are exactly eight already-read bytes: tag198, version1, payload length4, room0..15, horizontal position0..31, lives0..9, flags0..15, then XOR of the first seven bytes. MODE=0 validates without committing; MODE=1 validates then copies all four payload bytes to L0..L3. VALID means the mode is recognised; ACCEPTED means the entire record passes. A rejected record leaves all live fields unchanged. Physical file length must be verified as exactly eight before supplying this buffer.
Include component.inc once (MOS callers include the shared 6502 implementation through it). Reserve the public fields in this exact order: ACCEPTED, VALID, MODE, L0, L1, L2, L3, C0, C1, C2, C3, C4, C5, C6, C7. They occupy 15 contiguous bytes. Also reserve the private workspace: T0, T1, T2 (3 bytes). Array names in the explanation refer to the numbered consecutive bindings, such as C0, C1 and so on.
Call save_record_validation_init once at the intended reset boundary. It clears inputs as well as outputs and workspace. Set your starting state and configuration afterwards, then call save_record_validation_step whenever the described event occurs. The helper reads no device, waits for no frame and installs no interrupt handler.
| Ownership | Fields |
|---|---|
| Retain between calls | L0..L3 live state |
| Supply before service | MODE and immutable C0..C7 |
| Read after service | ACCEPTED, VALID and optionally L0..L3 |
Check the complete envelope, semantic ranges and integrity before the first live-state write. A separate validation mode allows a load screen to inspect compatibility without changing the running game.
Reusable initialisation and service
; SPDX-License-Identifier: MIT
; Validate a Save Before Replacing Live State. See README.md for the byte interface and ownership.
; init clears the public fields and private workspace; set inputs afterwards.
save_record_validation_init:
move.b #0,d0
move.b d0,ACCEPTED
move.b d0,VALID
move.b d0,MODE
move.b d0,L0
move.b d0,L1
move.b d0,L2
move.b d0,L3
move.b d0,C0
move.b d0,C1
move.b d0,C2
move.b d0,C3
move.b d0,C4
move.b d0,C5
move.b d0,C6
move.b d0,C7
move.b d0,T0
move.b d0,T1
move.b d0,T2
rts
save_record_validation_step:
; ACCEPTED = 0
move.b #0,d0
move.b d0,ACCEPTED
; VALID = 0
move.b #0,d0
move.b d0,VALID
; if MODE > 1:
move.b MODE,d0
cmp.b #1,d0
bhi save_record_validation_L1
jmp save_record_validation_L2
save_record_validation_L1:
; return
rts
jmp save_record_validation_L3
save_record_validation_L2:
save_record_validation_L3:
; VALID = 1
move.b #1,d0
move.b d0,VALID
; if C0 != 198:
move.b C0,d0
cmp.b #198,d0
bne save_record_validation_L4
jmp save_record_validation_L5
save_record_validation_L4:
; return
rts
jmp save_record_validation_L6
save_record_validation_L5:
save_record_validation_L6:
; if C1 != 1:
move.b C1,d0
cmp.b #1,d0
bne save_record_validation_L7
jmp save_record_validation_L8
save_record_validation_L7:
; return
rts
jmp save_record_validation_L9
save_record_validation_L8:
save_record_validation_L9:
; if C2 != 4:
move.b C2,d0
cmp.b #4,d0
bne save_record_validation_L10
jmp save_record_validation_L11
save_record_validation_L10:
; return
rts
jmp save_record_validation_L12
save_record_validation_L11:
save_record_validation_L12:
; if C3 > 15:
move.b C3,d0
cmp.b #15,d0
bhi save_record_validation_L13
jmp save_record_validation_L14
save_record_validation_L13:
; return
rts
jmp save_record_validation_L15
save_record_validation_L14:
save_record_validation_L15:
; if C4 > 31:
move.b C4,d0
cmp.b #31,d0
bhi save_record_validation_L16
jmp save_record_validation_L17
save_record_validation_L16:
; return
rts
jmp save_record_validation_L18
save_record_validation_L17:
save_record_validation_L18:
; if C5 > 9:
move.b C5,d0
cmp.b #9,d0
bhi save_record_validation_L19
jmp save_record_validation_L20
save_record_validation_L19:
; return
rts
jmp save_record_validation_L21
save_record_validation_L20:
save_record_validation_L21:
; if C6 > 15:
move.b C6,d0
cmp.b #15,d0
bhi save_record_validation_L22
jmp save_record_validation_L23
save_record_validation_L22:
; return
rts
jmp save_record_validation_L24
save_record_validation_L23:
save_record_validation_L24:
; T0 = 0
move.b #0,d0
move.b d0,T0
; T1 = 0
move.b #0,d0
move.b d0,T1
; while T0 < 7:
save_record_validation_L25:
move.b T0,d0
cmp.b #7,d0
bcs save_record_validation_L26
jmp save_record_validation_L27
save_record_validation_L26:
; T2 = C[T0]
moveq #0,d1
move.b T0,d1
lea C0,a0
move.b 0(a0,d1.w),d0
move.b d0,T2
; T1 = T1 ^ T2
move.b T1,d0
move.b T2,d1
eor.b d1,d0
move.b d0,T1
; T0 = T0 + 1
move.b T0,d0
add.b #1,d0
move.b d0,T0
jmp save_record_validation_L25
save_record_validation_L27:
; if T1 != C7:
move.b T1,d0
move.b C7,d1
cmp.b d1,d0
bne save_record_validation_L28
jmp save_record_validation_L29
save_record_validation_L28:
; return
rts
jmp save_record_validation_L30
save_record_validation_L29:
save_record_validation_L30:
; ACCEPTED = 1
move.b #1,d0
move.b d0,ACCEPTED
; if MODE == 1:
move.b MODE,d0
cmp.b #1,d0
beq save_record_validation_L31
jmp save_record_validation_L32
save_record_validation_L31:
; L0 = C3
move.b C3,d0
move.b d0,L0
; L1 = C4
move.b C4,d0
move.b d0,L1
; L2 = C5
move.b C5,d0
move.b d0,L2
; L3 = C6
move.b C6,d0
move.b d0,L3
jmp save_record_validation_L33
save_record_validation_L32:
save_record_validation_L33:
rts
component_end:Machine contract
D0–D3/A0–A1/CCR may change; D4–D7/A2–A6 are preserved. A direct BSR/JSR needs four return-address stack bytes. The helper makes no nested calls and adds no other stack use. Its named scratch is private workspace, not a pointer, a ROM variable or shared zero-page space that the game may borrow concurrently. The samples use fixed symbol bindings. Scope or rename every label and binding, including the component_end measurement marker, and allocate a separate block for each independent instance. Different helpers can also use common field names, so combining them needs separate namespaces or explicitly renamed bindings. Give each block one mutation owner.
The A500 OCS diagnostic cold-boots an OFS disk, owns the Copper and bitplane and disables interrupt/DMA sources. The helper does not take over hardware or allocate Chip RAM.
Adapt the caller
demo.asm supplies the bindings and include order. exercise.inc first runs table cases, then a separate client retaining state between calls. A game can call the public step entry directly and remove the diagnostic packet and display. Do not copy the diagnostic’s hardware takeover into an existing game loop.
Build with make ASM198X=/path/to/asm198x and BUILD198X=/path/to/build198x. The Makefile produces normal, custom, deliberately wrong and repaired programs. Tools must already be installed; the sample downloads nothing.
Bindings and include order
section code,code_c
CUSTOM = 0
BROKEN = 0
COYOTE_STEPS = 4
BUFFER_STEPS = 4
TEXT_CAP = 8
PROPERTY_COUNT = 16
STREAM_BYTES = 13
CRC_POLY = 7
include "caller.inc"
include "exercise.inc"
component_start:
include "component.inc"
even
include "data.inc"
include "cases.inc"
even
include "display.inc"
include "../../framework/turn-deadline/font.inc"
code_end:
STATE:
ACCEPTED: dc.b 0
VALID: dc.b 0
MODE: dc.b 0
L0: dc.b 0
L1: dc.b 0
L2: dc.b 0
L3: dc.b 0
C0: dc.b 0
C1: dc.b 0
C2: dc.b 0
C3: dc.b 0
C4: dc.b 0
C5: dc.b 0
C6: dc.b 0
C7: dc.b 0
T0: dc.b 0
T1: dc.b 0
T2: dc.b 0
even
ready: dc.w 0
preview: dcb.b 8,0
OUTPUT: dcb.b 1300,0
even
signature: dc.b "198XNIGHTTWO000",0
even
copperlist:
dc.w $08e,$2c81,$090,$2cc1,$092,$0038,$094,$00d0
dc.w $100,$1200,$102,0,$104,0,$108,0,$10a,0
dc.w $180,$012,$182,$fff
copbpl:
dc.w $0e0,0,$0e2,0
dc.w $ffff,$fffe
plane: dcb.b 10240,0A client retaining state between calls
preview_rules:
ifne CUSTOM
; MODE = 0
move.b #0,d0
move.b d0,MODE
; L0 = 9
move.b #9,d0
move.b d0,L0
; C0 = 198
move.b #198,d0
move.b d0,C0
; C1 = 1
move.b #1,d0
move.b d0,C1
; C2 = 4
move.b #4,d0
move.b d0,C2
; C3 = 15
move.b #15,d0
move.b d0,C3
; C4 = 31
move.b #31,d0
move.b d0,C4
; C5 = 9
move.b #9,d0
move.b d0,C5
; C6 = 15
move.b #15,d0
move.b d0,C6
; C7 = 213
move.b #213,d0
move.b d0,C7
ifne BROKEN
; C7 = 0
move.b #0,d0
move.b d0,C7
endif
bsr checked_step
bsr emit_state
; MODE = 1
move.b #1,d0
move.b d0,MODE
ifne BROKEN
; C7 = 0
move.b #0,d0
move.b d0,C7
endif
bsr checked_step
bsr emit_state
rts
else
; MODE = 1
move.b #1,d0
move.b d0,MODE
; L0 = 2
move.b #2,d0
move.b d0,L0
; L1 = 3
move.b #3,d0
move.b d0,L1
; L2 = 4
move.b #4,d0
move.b d0,L2
; L3 = 5
move.b #5,d0
move.b d0,L3
; C0 = 198
move.b #198,d0
move.b d0,C0
; C1 = 1
move.b #1,d0
move.b d0,C1
; C2 = 4
move.b #4,d0
move.b d0,C2
; C3 = 7
move.b #7,d0
move.b d0,C3
; C4 = 20
move.b #20,d0
move.b d0,C4
; C5 = 3
move.b #3,d0
move.b d0,C5
; C6 = 2
move.b #2,d0
move.b d0,C6
; C7 = 209
move.b #209,d0
move.b d0,C7
ifne BROKEN
; C7 = 0
move.b #0,d0
move.b d0,C7
endif
bsr checked_step
bsr emit_state
; C5 = 255
move.b #255,d0
move.b d0,C5
ifne BROKEN
; C7 = 0
move.b #0,d0
move.b d0,C7
endif
bsr checked_step
bsr emit_state
endif
rtsCustomise it
Validate a different legal record without commitment, then commit the same record on a second call. The maintained custom caller changes its inputs or client sequence rather than hiding a different implementation behind the same label. Compare every state of the two clients, not only their final display.
Custom client selection
section code,code_c
CUSTOM = 1
BROKEN = 0
COYOTE_STEPS = 2
BUFFER_STEPS = 2
TEXT_CAP = 4
PROPERTY_COUNT = 16
STREAM_BYTES = 13
CRC_POLY = 49
include "caller.inc"
include "exercise.inc"
component_start:
include "component.inc"
even
include "data.inc"
include "cases.inc"
even
include "display.inc"
include "../../framework/turn-deadline/font.inc"
code_end:
STATE:
ACCEPTED: dc.b 0
VALID: dc.b 0
MODE: dc.b 0
L0: dc.b 0
L1: dc.b 0
L2: dc.b 0
L3: dc.b 0
C0: dc.b 0
C1: dc.b 0
C2: dc.b 0
C3: dc.b 0
C4: dc.b 0
C5: dc.b 0
C6: dc.b 0
C7: dc.b 0
T0: dc.b 0
T1: dc.b 0
T2: dc.b 0
even
ready: dc.w 0
preview: dcb.b 8,0
OUTPUT: dcb.b 1300,0
even
signature: dc.b "198XNIGHTTWO000",0
even
copperlist:
dc.w $08e,$2c81,$090,$2cc1,$092,$0038,$094,$00d0
dc.w $100,$1200,$102,0,$104,0,$108,0,$10a,0
dc.w $180,$012,$182,$fff
copbpl:
dc.w $0e0,0,$0e2,0
dc.w $ffff,$fffe
plane: dcb.b 10240,0The custom diagnostic row is 01 01 01 0F 1F 09 0F C6. The full client trace in the source explains how it gets there.
Mistake and repair
The wrong client drops the stored checksum before validation. The otherwise valid record is rejected and live state stays intact. Supply all eight bytes, including the stored integrity byte.
The BROKEN branch lives in the sequential client, not the reusable helper. wrong.asm selects it; repaired.asm restores the normal call sequence. The repaired executable matches the normal program (for Spectrum, compare loaded CODE rather than the tape filename).
Select the deliberately wrong client
section code,code_c
CUSTOM = 0
BROKEN = 1
COYOTE_STEPS = 4
BUFFER_STEPS = 4
TEXT_CAP = 8
PROPERTY_COUNT = 16
STREAM_BYTES = 13
CRC_POLY = 7
include "caller.inc"
include "exercise.inc"
component_start:
include "component.inc"
even
include "data.inc"
include "cases.inc"
even
include "display.inc"
include "../../framework/turn-deadline/font.inc"
code_end:
STATE:
ACCEPTED: dc.b 0
VALID: dc.b 0
MODE: dc.b 0
L0: dc.b 0
L1: dc.b 0
L2: dc.b 0
L3: dc.b 0
C0: dc.b 0
C1: dc.b 0
C2: dc.b 0
C3: dc.b 0
C4: dc.b 0
C5: dc.b 0
C6: dc.b 0
C7: dc.b 0
T0: dc.b 0
T1: dc.b 0
T2: dc.b 0
even
ready: dc.w 0
preview: dcb.b 8,0
OUTPUT: dcb.b 1300,0
even
signature: dc.b "198XNIGHTTWO000",0
even
copperlist:
dc.w $08e,$2c81,$090,$2cc1,$092,$0038,$094,$00d0
dc.w $100,$1200,$102,0,$104,0,$108,0,$10a,0
dc.w $180,$012,$182,$fff
copbpl:
dc.w $0e0,0,$0e2,0
dc.w $ffff,$fffe
plane: dcb.b 10240,0
Cost and alternatives
The measured helper extent is 482 code bytes; public state is 15 bytes and private scratch is 3 bytes. There are no immutable helper tables. Caller data, the test cases, return-address stack, alignment and display buffers cost additional space. These are assembled sizes, not cycle measurements.
Seven XOR stages and four writes only after acceptance. A bigger record needs a bounded length and wider index; use the existing CRC helper when stronger error detection justifies its additional work.
XOR is intentionally small and weak: two cancelling changes can pass. The existing streaming CRC-8 gives stronger accidental-corruption detection, but neither authenticates a hostile file. Atomic disk replacement, I/O failure, migration and concurrent game-state writers are outside this in-memory transaction. Add semantic checks whenever the payload gains new rules.
Execution evidence
Four variants run on A500 OCS PAL, Kickstart1.3 OFS cold boot, using Asm198x 0.0.72, Emu198x 0.44.2 and Build198x 0.2.9. Each executes 64 boundary/varied/error table cases, dirty initialisation and the separate retained-state client. An independent mathematical/container model checks every public byte after every call. This is bounded example coverage, not exhaustive correctness for every possible state.
The records retain loaded immutable code, completion, register sentinels, full packets, source/tool/firmware hashes and captures. The public gate validates these retained observations and rejects altered evidence; it does not run restricted firmware. No firmware is distributed. The eight displayed bytes are the first eight public fields, zero-padded when shorter; the packet includes every field.
Where it fits
Streaming CRC-8: Replace the weak XOR with a precisely specified CRC when its extra detection is worth the code and runtime cost.