use 2mb pages

Signed-off-by: Caio Oliveira <caiooliveirafarias0@gmail.com>

src/common/fs/file.cpp

@@ -7,18 +7,25 @@
 #include <vector>
 
 #include "common/assert.h"
+#include "common/bit_util.h"
 #include "common/fs/file.h"
 #include "common/fs/fs.h"
+#include "common/fs/fs_types.h"
 #ifdef __ANDROID__
 #include "common/fs/fs_android.h"
 #endif
 #include "common/logging.h"
+#include "common/literals.h"
 
 #ifdef _WIN32
 #include <io.h>
 #include <share.h>
+#include <windows.h>
 #else
 #include <unistd.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 #endif
 
 #ifdef _MSC_VER
@@ -36,13 +43,13 @@ namespace {
 #ifdef _WIN32
 
 /**
- * Converts the file access mode and file type enums to a file access mode wide string.
- *
- * @param mode File access mode
- * @param type File type
- *
- * @returns A pointer to a wide string representing the file access mode.
- */
+* Converts the file access mode and file type enums to a file access mode wide string.
+*
+* @param mode File access mode
+* @param type File type
+*
+* @returns A pointer to a wide string representing the file access mode.
+*/
 [[nodiscard]] constexpr const wchar_t* AccessModeToWStr(FileAccessMode mode, FileType type) {
     switch (type) {
     case FileType::BinaryFile:
@@ -79,12 +86,12 @@ namespace {
 }
 
 /**
- * Converts the file-share access flag enum to a Windows defined file-share access flag.
- *
- * @param flag File-share access flag
- *
- * @returns Windows defined file-share access flag.
- */
+* Converts the file-share access flag enum to a Windows defined file-share access flag.
+*
+* @param flag File-share access flag
+*
+* @returns Windows defined file-share access flag.
+*/
 [[nodiscard]] constexpr int ToWindowsFileShareFlag(FileShareFlag flag) {
     switch (flag) {
     case FileShareFlag::ShareNone:
@@ -102,13 +109,13 @@ namespace {
 #else
 
 /**
- * Converts the file access mode and file type enums to a file access mode string.
- *
- * @param mode File access mode
- * @param type File type
- *
- * @returns A pointer to a string representing the file access mode.
- */
+* Converts the file access mode and file type enums to a file access mode string.
+*
+* @param mode File access mode
+* @param type File type
+*
+* @returns A pointer to a string representing the file access mode.
+*/
 [[nodiscard]] constexpr const char* AccessModeToStr(FileAccessMode mode, FileType type) {
     switch (type) {
     case FileType::BinaryFile:
@@ -147,12 +154,12 @@ namespace {
 #endif
 
 /**
- * Converts the seek origin enum to a seek origin integer.
- *
- * @param origin Seek origin
- *
- * @returns Seek origin integer.
- */
+* Converts the seek origin enum to a seek origin integer.
+*
+* @param origin Seek origin
+*
+* @returns Seek origin integer.
+*/
 [[nodiscard]] constexpr int ToSeekOrigin(SeekOrigin origin) {
     switch (origin) {
     case SeekOrigin::SetOrigin:
@@ -178,7 +185,7 @@ std::string ReadStringFromFile(const std::filesystem::path& path, FileType type)
 }
 
 size_t WriteStringToFile(const std::filesystem::path& path, FileType type,
-                         std::string_view string) {
+                        std::string_view string) {
     if (Exists(path) && !IsFile(path)) {
         return 0;
     }
@@ -189,7 +196,7 @@ size_t WriteStringToFile(const std::filesystem::path& path, FileType type,
 }
 
 size_t AppendStringToFile(const std::filesystem::path& path, FileType type,
-                          std::string_view string) {
+                        std::string_view string) {
     if (Exists(path) && !IsFile(path)) {
         return 0;
     }
@@ -244,69 +251,189 @@ FileType IOFile::GetType() const {
     return file_type;
 }
 
+#if defined(__unix__)
+static int PlatformMapReadOnly(IOFile& io, const char* path) {
+    io.mmap_fd = open(path, O_RDONLY);
+    if (io.mmap_fd > 0) {
+        struct stat st;
+        fstat(io.mmap_fd, &st);
+        io.mmap_size = st.st_size;
+
+        int map_flags = MAP_PRIVATE;
+#ifdef MAP_PREFAULT_READ
+        // Prefaults reads so the final resulting pagetable from this big stupid mmap()
+        // isn't comically lazily loaded, we just coalesce everything in-place for our
+        // lovely mmap flags; if we didn't prefault the reads the page table will be
+        // constructed in-place (i.e on a read-by-read basis) causing lovely soft-faults
+        // which would nuke any performance gains.
+        //
+        // This of course incurs a cost in the initial mmap(2) call, but that is fine.
+        map_flags |= MAP_PREFAULT_READ;
+#endif
+#ifdef MAP_NOSYNC
+        // This causes physical media to not be synched to our file/memory
+        // This means that if the read-only file is written to, we won't see changes
+        // or we may see changes which are just funnily scattered, in any case
+        // this presumes the files won't be changed during execution
+        //
+        // Do not ever use this on write files (if we ever support that); this will create
+        // a fun amount of fragmentation on the disk.
+        map_flags |= MAP_NOSYNC;
+#endif
+#if defined(NDEBUG) && defined(MAP_NOCORE)
+        map_flags |= MAP_NOCORE;
+#endif
+#ifdef MAP_HUGE_2MB
+        map_flags |= MAP_HUGE_2MB; //2mb pages
+#elif defined(MAP_ALIGNED)
+        // File must be big enough that it's worth to super align. We can't just super-align every
+        // file otherwise we will run out of alignments for actually important files :)
+        // System doesn't guarantee a super alignment, but if it's available it will delete
+        // about 3 layers(?) of the TLB tree for each read/write.
+        // Again the cost of faults may make this negligible gains, but hey, we gotta work
+        // what we gotta work with.
+        map_flags |= MAP_ALIGNED(21); //2^21 = 2mb use 2MB pages
+#endif
+        io.mmap_base = (u8*)mmap(nullptr, io.mmap_size, PROT_READ, map_flags, io.mmap_fd, 0);
+        if (io.mmap_base == MAP_FAILED) {
+            close(io.mmap_fd);
+            io.mmap_fd = -1;
+        } else {
+            using namespace Common::Literals;
+            // For small files it is acceptable to use a full readahead
+            // See https://github.com/torvalds/linux/blob/e80d033851b3bc94c3d254ac66660ddd0a49d72c/include/linux/pagemap.h#L1392
+            if (u64(st.st_size) >= 256_MiB) {
+                posix_madvise(io.mmap_base, io.mmap_size, POSIX_MADV_RANDOM);
+            } else {
+                posix_madvise(io.mmap_base, io.mmap_size, POSIX_MADV_SEQUENTIAL);
+            }
+        }
+    }
+    return io.mmap_fd;
+}
+static void PlatformUnmap(IOFile& io) {
+    if (io.mmap_fd != -1) {
+        munmap(io.mmap_base, io.mmap_size);
+        close(io.mmap_fd);
+        io.mmap_fd = -1;
+    }
+}
+#elif defined(__APPLE__)
+// NO IMPLEMENTATION YET
+#else
+static int PlatformMapReadOnly(IOFile& io, const wchar_t* path) {
+    io.file_handle = CreateFileW(path, GENERIC_READ, FILE_SHARE_READ, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_SEQUENTIAL_SCAN, nullptr);
+    if (HANDLE(io.file_handle) != INVALID_HANDLE_VALUE) {
+        io.mapping_handle = CreateFileMappingW(HANDLE(io.file_handle), nullptr, PAGE_READONLY, 0, 0, nullptr);
+        if (io.mapping_handle) {
+            io.mmap_base = (u8*)MapViewOfFile(HANDLE(io.mapping_handle), FILE_MAP_READ, 0, 0, 0);
+            if (io.mmap_base) {
+                _LARGE_INTEGER pvalue;
+                GetFileSizeEx(io.file_handle, &pvalue);
+                io.mmap_size = uint32_t(pvalue.QuadPart);
+            } else {
+                CloseHandle(io.mapping_handle);
+                CloseHandle(io.file_handle);
+                return -1;
+            }
+        } else {
+            CloseHandle(io.file_handle);
+            return -1;
+        }
+    }
+    return 0;
+}
+static void PlatformUnmap(IOFile& io) {
+    if(io.mapping_handle) {
+        if(io.mmap_base)
+            UnmapViewOfFile(HANDLE(io.mmap_base));
+        CloseHandle(HANDLE(io.mapping_handle));
+    }
+    if(io.file_handle != INVALID_HANDLE_VALUE)
+        CloseHandle(HANDLE(io.file_handle));
+}
+#endif
+
 void IOFile::Open(const fs::path& path, FileAccessMode mode, FileType type, FileShareFlag flag) {
     Close();
-
     file_path = path;
     file_access_mode = mode;
     file_type = type;
-
     errno = 0;
-
 #ifdef _WIN32
-    if (flag != FileShareFlag::ShareNone) {
-        file = _wfsopen(path.c_str(), AccessModeToWStr(mode, type), ToWindowsFileShareFlag(flag));
-    } else {
-        _wfopen_s(&file, path.c_str(), AccessModeToWStr(mode, type));
+    // TODO: this probably can use better logic but oh well I'm not a windowser
+    file_handle = nullptr;
+    if (type == FileType::BinaryFile && mode == FileAccessMode::Read) {
+        if (PlatformMapReadOnly(*this, path.c_str()) == -1) {
+            LOG_ERROR(Common_Filesystem, "Error mmap'ing file"); //: {}", path.c_str());
+        }
+    }
+    if (file_handle == nullptr) {
+        if (flag != FileShareFlag::ShareNone) {
+            file = _wfsopen(path.c_str(), AccessModeToWStr(mode, type), ToWindowsFileShareFlag(flag));
+        } else {
+            _wfopen_s(&file, path.c_str(), AccessModeToWStr(mode, type));
+        }
     }
 #elif __ANDROID__
     if (Android::IsContentUri(path)) {
         ASSERT_MSG(mode == FileAccessMode::Read, "Content URI file access is for read-only!");
-        const auto fd = Android::OpenContentUri(path, Android::OpenMode::Read);
-        if (fd != -1) {
-            file = fdopen(fd, "r");
-            const auto error_num = errno;
-            if (error_num != 0 && file == nullptr) {
-                LOG_ERROR(Common_Filesystem, "Error opening file: {}, error: {}", path.c_str(),
-                          strerror(error_num));
+        if (PlatformMapReadOnly(*this, path.c_str()) == -1) {
+            LOG_ERROR(Common_Filesystem, "Error mmap'ing file: {}", path.c_str());
+            int const fd = Android::OpenContentUri(path, Android::OpenMode::Read);
+            if (fd != -1) {
+                file = fdopen(fd, "r");
+                if (errno != 0 && file == nullptr)
+                    LOG_ERROR(Common_Filesystem, "Error opening file: {}, error: {}", path.c_str(), strerror(errno));
+            } else {
+                LOG_ERROR(Common_Filesystem, "Error opening file: {}", path.c_str());
             }
-        } else {
-            LOG_ERROR(Common_Filesystem, "Error opening file: {}", path.c_str());
         }
     } else {
         file = std::fopen(path.c_str(), AccessModeToStr(mode, type));
     }
+#elif defined(__HAIKU__) || defined(__managarm__) || defined(__OPENORBIS__) || defined(__APPLE__)
+    file = std::fopen(path.c_str(), AccessModeToStr(mode, type));
+#elif defined(__unix__)
+    if (type == FileType::BinaryFile && mode == FileAccessMode::Read) {
+        if (PlatformMapReadOnly(*this, path.c_str()) == -1) {
+            LOG_ERROR(Common_Filesystem, "Error mmap'ing file: {}", path.c_str());
+        }
+    }
+    if (mmap_fd == -1) {
+        file = std::fopen(path.c_str(), AccessModeToStr(mode, type)); // mmap(2) failed or simply we can't use it
+    }
 #else
+    // Some other fancy OS (ahem fucking Darwin/Mac OSX)
     file = std::fopen(path.c_str(), AccessModeToStr(mode, type));
 #endif
-
     if (!IsOpen()) {
         const auto ec = std::error_code{errno, std::generic_category()};
         LOG_ERROR(Common_Filesystem, "Failed to open the file at path={}, ec_message={}",
-                  PathToUTF8String(file_path), ec.message());
+            PathToUTF8String(file_path), ec.message());
     }
 }
 
 void IOFile::Close() {
-    if (!IsOpen()) {
-        return;
+#if defined(__APPLE__)
+    // NO IMPLEMENTATION YET
+#else
+    PlatformUnmap(*this);
+#endif
+    if (file) {
+        errno = 0;
+        const auto close_result = std::fclose(file) == 0;
+        if (!close_result) {
+            const auto ec = std::error_code{errno, std::generic_category()};
+            LOG_ERROR(Common_Filesystem, "Failed to close the file at path={}, ec_message={}",
+                PathToUTF8String(file_path), ec.message());
+        }
+        file = nullptr;
     }
-
-    errno = 0;
-
-    const auto close_result = std::fclose(file) == 0;
-
-    if (!close_result) {
-        const auto ec = std::error_code{errno, std::generic_category()};
-        LOG_ERROR(Common_Filesystem, "Failed to close the file at path={}, ec_message={}",
-                  PathToUTF8String(file_path), ec.message());
-    }
-
-    file = nullptr;
 }
 
 bool IOFile::IsOpen() const {
-    return file != nullptr;
+    return file != nullptr || IsMappedFile();
 }
 
 std::string IOFile::ReadString(size_t length) const {
@@ -323,137 +450,132 @@ size_t IOFile::WriteString(std::span<const char> string) const {
 }
 
 bool IOFile::Flush() const {
-    if (!IsOpen()) {
-        return false;
+    ASSERT(!IsMappedFile());
+    if (file) {
+        errno = 0;
+        auto const flush_result = std::fflush(file) == 0;
+        if (!flush_result) {
+            const auto ec = std::error_code{errno, std::generic_category()};
+            LOG_ERROR(Common_Filesystem, "Failed to flush the file at path={}, ec_message={}",
+                PathToUTF8String(file_path), ec.message());
+        }
+        return flush_result;
     }
-
-    errno = 0;
-
-#ifdef _WIN32
-    const auto flush_result = std::fflush(file) == 0;
-#else
-    const auto flush_result = std::fflush(file) == 0;
-#endif
-
-    if (!flush_result) {
-        const auto ec = std::error_code{errno, std::generic_category()};
-        LOG_ERROR(Common_Filesystem, "Failed to flush the file at path={}, ec_message={}",
-                  PathToUTF8String(file_path), ec.message());
-    }
-
-    return flush_result;
+    return false;
 }
 
 bool IOFile::Commit() const {
-    if (!IsOpen()) {
-        return false;
-    }
-
-    errno = 0;
-
+    ASSERT(!IsMappedFile());
+    if (file) {
+        errno = 0;
 #ifdef _WIN32
-    const auto commit_result = std::fflush(file) == 0 && _commit(fileno(file)) == 0;
+        const auto commit_result = std::fflush(file) == 0 && _commit(fileno(file)) == 0;
 #else
-    const auto commit_result = std::fflush(file) == 0 && fsync(fileno(file)) == 0;
+        const auto commit_result = std::fflush(file) == 0 && fsync(fileno(file)) == 0;
 #endif
-
-    if (!commit_result) {
-        const auto ec = std::error_code{errno, std::generic_category()};
-        LOG_ERROR(Common_Filesystem, "Failed to commit the file at path={}, ec_message={}",
-                  PathToUTF8String(file_path), ec.message());
+        if (!commit_result) {
+            const auto ec = std::error_code{errno, std::generic_category()};
+            LOG_ERROR(Common_Filesystem, "Failed to commit the file at path={}, ec_message={}",
+                PathToUTF8String(file_path), ec.message());
+        }
+        return commit_result;
     }
-
-    return commit_result;
+    return false;
 }
 
 bool IOFile::SetSize(u64 size) const {
-    if (!IsOpen()) {
-        return false;
-    }
-
-    errno = 0;
-
+    ASSERT(!IsMappedFile());
+    if (file) {
+        errno = 0;
 #ifdef _WIN32
-    const auto set_size_result = _chsize_s(fileno(file), static_cast<s64>(size)) == 0;
+        const auto set_size_result = _chsize_s(fileno(file), s64(size)) == 0;
 #else
-    const auto set_size_result = ftruncate(fileno(file), static_cast<s64>(size)) == 0;
+        const auto set_size_result = ftruncate(fileno(file), s64(size)) == 0;
 #endif
-
-    if (!set_size_result) {
-        const auto ec = std::error_code{errno, std::generic_category()};
-        LOG_ERROR(Common_Filesystem, "Failed to resize the file at path={}, size={}, ec_message={}",
-                  PathToUTF8String(file_path), size, ec.message());
+        if (!set_size_result) {
+            const auto ec = std::error_code{errno, std::generic_category()};
+            LOG_ERROR(Common_Filesystem, "Failed to resize the file at path={}, size={}, ec_message={}",
+                PathToUTF8String(file_path), size, ec.message());
+        }
+        return set_size_result;
     }
-
-    return set_size_result;
+    return false;
 }
 
 u64 IOFile::GetSize() const {
-    if (!IsOpen()) {
-        return 0;
-    }
+    if (IsMappedFile())
+        return mmap_size;
+    if (file) {
+        // Flush any unwritten buffered data into the file prior to retrieving the file mmap_size.
+        std::fflush(file);
+#if __ANDROID__
+        u64 file_size = 0;
+        if (Android::IsContentUri(file_path)) {
+            file_size = Android::GetSize(file_path);
+        } else {
+            std::error_code ec;
 
-    // Flush any unwritten buffered data into the file prior to retrieving the file size.
-    std::fflush(file);
+            file_size = fs::file_size(file_path, ec);
 
-#ifdef __ANDROID__
-    u64 file_size = 0;
-    if (Android::IsContentUri(file_path)) {
-        file_size = Android::GetSize(file_path);
-    } else {
+            if (ec) {
+                LOG_ERROR(Common_Filesystem, "Failed to retrieve the file mmap_size of path={}, ec_message={}",
+                    PathToUTF8String(file_path), ec.message());
+                return 0;
+            }
+        }
+#else
         std::error_code ec;
-
-        file_size = fs::file_size(file_path, ec);
-
+        auto const file_size = fs::file_size(file_path, ec);
         if (ec) {
-            LOG_ERROR(Common_Filesystem,
-                      "Failed to retrieve the file size of path={}, ec_message={}",
-                      PathToUTF8String(file_path), ec.message());
+            LOG_ERROR(Common_Filesystem, "Failed to retrieve the file mmap_size of path={}, ec_message={}",
+                PathToUTF8String(file_path), ec.message());
             return 0;
         }
-    }
-#else
-    std::error_code ec;
-
-    const auto file_size = fs::file_size(file_path, ec);
-
-    if (ec) {
-        LOG_ERROR(Common_Filesystem, "Failed to retrieve the file size of path={}, ec_message={}",
-                  PathToUTF8String(file_path), ec.message());
-        return 0;
-    }
 #endif
-
-    return file_size;
+        return file_size;
+    }
+    return 0;
 }
 
 bool IOFile::Seek(s64 offset, SeekOrigin origin) const {
-    if (!IsOpen()) {
-        return false;
+    if (IsMappedFile()) {
+        // fuck you to whoever made this method const
+        switch (origin) {
+        case SeekOrigin::SetOrigin:
+            mmap_offset = s64(offset);
+            break;
+        case SeekOrigin::CurrentPosition:
+            mmap_offset += s64(offset);
+            break;
+        case SeekOrigin::End:
+            mmap_offset = s64(mmap_size) + s64(offset);
+            break;
+        }
+        return true;
     }
-
-    errno = 0;
-
-    const auto seek_result = fseeko(file, offset, ToSeekOrigin(origin)) == 0;
-
-    if (!seek_result) {
-        const auto ec = std::error_code{errno, std::generic_category()};
-        LOG_ERROR(Common_Filesystem,
-                  "Failed to seek the file at path={}, offset={}, origin={}, ec_message={}",
-                  PathToUTF8String(file_path), offset, origin, ec.message());
+    if (file) {
+        errno = 0;
+        const auto seek_result = fseeko(file, offset, ToSeekOrigin(origin)) == 0;
+        if (!seek_result) {
+            const auto ec = std::error_code{errno, std::generic_category()};
+            LOG_ERROR(Common_Filesystem, "Failed to seek the file at path={}, offset={}, origin={}, ec_message={}",
+                PathToUTF8String(file_path), offset, origin, ec.message());
+        }
+        return seek_result;
     }
-
-    return seek_result;
+    return false;
 }
 
 s64 IOFile::Tell() const {
-    if (!IsOpen()) {
-        return 0;
+    if (IsMappedFile()) {
+        errno = 0;
+        return s64(mmap_offset);
     }
-
-    errno = 0;
-
-    return ftello(file);
+    if (file) {
+        errno = 0;
+        return ftello(file);
+    }
+    return 0;
 }
 
 } // namespace Common::FS

src/common/fs/file.h

@@ -7,6 +7,7 @@
 #pragma once
 
 #include <cstdio>
+#include <cstring>
 #include <filesystem>
 #include <span>
 #include <type_traits>
@@ -24,12 +25,12 @@ enum class SeekOrigin {
 };
 
 /**
- * Opens a file stream at path with the specified open mode.
- *
- * @param file_stream Reference to file stream
- * @param path Filesystem path
- * @param open_mode File stream open mode
- */
+* Opens a file stream at path with the specified open mode.
+*
+* @param file_stream Reference to file stream
+* @param path Filesystem path
+* @param open_mode File stream open mode
+*/
 template <typename FileStream>
 void OpenFileStream(FileStream& file_stream, const std::filesystem::path& path,
                     std::ios_base::openmode open_mode) {
@@ -48,14 +49,14 @@ void OpenFileStream(FileStream& file_stream, const Path& path, std::ios_base::op
 #endif
 
 /**
- * Reads an entire file at path and returns a string of the contents read from the file.
- * If the filesystem object at path is not a regular file, this function returns an empty string.
- *
- * @param path Filesystem path
- * @param type File type
- *
- * @returns A string of the contents read from the file.
- */
+* Reads an entire file at path and returns a string of the contents read from the file.
+* If the filesystem object at path is not a regular file, this function returns an empty string.
+*
+* @param path Filesystem path
+* @param type File type
+*
+* @returns A string of the contents read from the file.
+*/
 [[nodiscard]] std::string ReadStringFromFile(const std::filesystem::path& path, FileType type);
 
 #ifdef _WIN32
@@ -70,18 +71,18 @@ template <typename Path>
 #endif
 
 /**
- * Writes a string to a file at path and returns the number of characters successfully written.
- * If a file already exists at path, its contents will be erased.
- * If a file does not exist at path, it creates and opens a new empty file for writing.
- * If the filesystem object at path exists and is not a regular file, this function returns 0.
- *
- * @param path Filesystem path
- * @param type File type
- *
- * @returns Number of characters successfully written.
- */
+* Writes a string to a file at path and returns the number of characters successfully written.
+* If a file already exists at path, its contents will be erased.
+* If a file does not exist at path, it creates and opens a new empty file for writing.
+* If the filesystem object at path exists and is not a regular file, this function returns 0.
+*
+* @param path Filesystem path
+* @param type File type
+*
+* @returns Number of characters successfully written.
+*/
 [[nodiscard]] size_t WriteStringToFile(const std::filesystem::path& path, FileType type,
-                                       std::string_view string);
+                                    std::string_view string);
 
 #ifdef _WIN32
 template <typename Path>
@@ -95,15 +96,15 @@ template <typename Path>
 #endif
 
 /**
- * Appends a string to a file at path and returns the number of characters successfully written.
- * If a file does not exist at path, it creates and opens a new empty file for appending.
- * If the filesystem object at path exists and is not a regular file, this function returns 0.
- *
- * @param path Filesystem path
- * @param type File type
- *
- * @returns Number of characters successfully written.
- */
+* Appends a string to a file at path and returns the number of characters successfully written.
+* If a file does not exist at path, it creates and opens a new empty file for appending.
+* If the filesystem object at path exists and is not a regular file, this function returns 0.
+*
+* @param path Filesystem path
+* @param type File type
+*
+* @returns Number of characters successfully written.
+*/
 [[nodiscard]] size_t AppendStringToFile(const std::filesystem::path& path, FileType type,
                                         std::string_view string);
 
@@ -131,14 +132,14 @@ public:
                     FileShareFlag flag = FileShareFlag::ShareReadOnly);
 
     /**
-     * An IOFile is a lightweight wrapper on C Library file operations.
-     * Automatically closes an open file on the destruction of an IOFile object.
-     *
-     * @param path Filesystem path
-     * @param mode File access mode
-     * @param type File type, default is BinaryFile. Use TextFile to open the file as a text file
-     * @param flag (Windows only) File-share access flag, default is ShareReadOnly
-     */
+    * An IOFile is a lightweight wrapper on C Library file operations.
+    * Automatically closes an open file on the destruction of an IOFile object.
+    *
+    * @param path Filesystem path
+    * @param mode File access mode
+    * @param type File type, default is BinaryFile. Use TextFile to open the file as a text file
+    * @param flag (Windows only) File-share access flag, default is ShareReadOnly
+    */
     explicit IOFile(const std::filesystem::path& path, FileAccessMode mode,
                     FileType type = FileType::BinaryFile,
                     FileShareFlag flag = FileShareFlag::ShareReadOnly);
@@ -152,84 +153,70 @@ public:
     IOFile& operator=(IOFile&& other) noexcept;
 
     /**
-     * Gets the path of the file.
-     *
-     * @returns The path of the file.
-     */
+    * Gets the path of the file.
+    *
+    * @returns The path of the file.
+    */
     [[nodiscard]] std::filesystem::path GetPath() const;
 
     /**
-     * Gets the access mode of the file.
-     *
-     * @returns The access mode of the file.
-     */
+    * Gets the access mode of the file.
+    *
+    * @returns The access mode of the file.
+    */
     [[nodiscard]] FileAccessMode GetAccessMode() const;
 
     /**
-     * Gets the type of the file.
-     *
-     * @returns The type of the file.
-     */
+    * Gets the type of the file.
+    *
+    * @returns The type of the file.
+    */
     [[nodiscard]] FileType GetType() const;
 
     /**
-     * Opens a file at path with the specified file access mode.
-     * This function behaves differently depending on the FileAccessMode.
-     * These behaviors are documented in each enum value of FileAccessMode.
-     *
-     * @param path Filesystem path
-     * @param mode File access mode
-     * @param type File type, default is BinaryFile. Use TextFile to open the file as a text file
-     * @param flag (Windows only) File-share access flag, default is ShareReadOnly
-     */
+    * Opens a file at path with the specified file access mode.
+    * This function behaves differently depending on the FileAccessMode.
+    * These behaviors are documented in each enum value of FileAccessMode.
+    *
+    * @param path Filesystem path
+    * @param mode File access mode
+    * @param type File type, default is BinaryFile. Use TextFile to open the file as a text file
+    * @param flag (Windows only) File-share access flag, default is ShareReadOnly
+    */
     void Open(const std::filesystem::path& path, FileAccessMode mode,
-              FileType type = FileType::BinaryFile,
-              FileShareFlag flag = FileShareFlag::ShareReadOnly);
-
-// #ifdef _WIN32
-//     template <typename Path>
-//     void Open(const Path& path, FileAccessMode mode, FileType type = FileType::BinaryFile,
-//               FileShareFlag flag = FileShareFlag::ShareReadOnly) {
-//         using ValueType = typename Path::value_type;
-//         if constexpr (IsChar<ValueType>) {
-//             Open(ToU8String(path), mode, type, flag);
-//         } else {
-//             Open(std::filesystem::path{path}, mode, type, flag);
-//         }
-//     }
-// #endif
+            FileType type = FileType::BinaryFile,
+            FileShareFlag flag = FileShareFlag::ShareReadOnly);
 
     /// Closes the file if it is opened.
     void Close();
 
     /**
-     * Checks whether the file is open.
-     * Use this to check whether the calls to Open() or Close() succeeded.
-     *
-     * @returns True if the file is open, false otherwise.
-     */
+    * Checks whether the file is open.
+    * Use this to check whether the calls to Open() or Close() succeeded.
+    *
+    * @returns True if the file is open, false otherwise.
+    */
     [[nodiscard]] bool IsOpen() const;
 
     /**
-     * Helper function which deduces the value type of a contiguous STL container used in ReadSpan.
-     * If T is not a contiguous container as defined by the concept IsContiguousContainer, this
-     * calls ReadObject and T must be a trivially copyable object.
-     *
-     * See ReadSpan for more details if T is a contiguous container.
-     * See ReadObject for more details if T is a trivially copyable object.
-     *
-     * @tparam T Contiguous container or trivially copyable object
-     *
-     * @param data Container of T::value_type data or reference to object
-     *
-     * @returns Count of T::value_type data or objects successfully read.
-     */
+    * Helper function which deduces the value type of a contiguous STL container used in ReadSpan.
+    * If T is not a contiguous container as defined by the concept IsContiguousContainer, this
+    * calls ReadObject and T must be a trivially copyable object.
+    *
+    * See ReadSpan for more details if T is a contiguous container.
+    * See ReadObject for more details if T is a trivially copyable object.
+    *
+    * @tparam T Contiguous container or trivially copyable object
+    *
+    * @param data Container of T::value_type data or reference to object
+    *
+    * @returns Count of T::value_type data or objects successfully read.
+    */
     template <typename T>
     [[nodiscard]] size_t Read(T& data) const {
         if constexpr (IsContiguousContainer<T>) {
             using ContiguousType = typename T::value_type;
-            static_assert(std::is_trivially_copyable_v<ContiguousType>,
-                          "Data type must be trivially copyable.");
+            static_assert(std::is_trivially_copyable_v<ContiguousType>, "Data type must be trivially copyable.");
             return ReadSpan<ContiguousType>(data);
         } else {
             return ReadObject(data) ? 1 : 0;
@@ -237,25 +224,24 @@ public:
     }
 
     /**
-     * Helper function which deduces the value type of a contiguous STL container used in WriteSpan.
-     * If T is not a contiguous STL container as defined by the concept IsContiguousContainer, this
-     * calls WriteObject and T must be a trivially copyable object.
-     *
-     * See WriteSpan for more details if T is a contiguous container.
-     * See WriteObject for more details if T is a trivially copyable object.
-     *
-     * @tparam T Contiguous container or trivially copyable object
-     *
-     * @param data Container of T::value_type data or const reference to object
-     *
-     * @returns Count of T::value_type data or objects successfully written.
-     */
+    * Helper function which deduces the value type of a contiguous STL container used in WriteSpan.
+    * If T is not a contiguous STL container as defined by the concept IsContiguousContainer, this
+    * calls WriteObject and T must be a trivially copyable object.
+    *
+    * See WriteSpan for more details if T is a contiguous container.
+    * See WriteObject for more details if T is a trivially copyable object.
+    *
+    * @tparam T Contiguous container or trivially copyable object
+    *
+    * @param data Container of T::value_type data or const reference to object
+    *
+    * @returns Count of T::value_type data or objects successfully written.
+    */
     template <typename T>
     [[nodiscard]] size_t Write(const T& data) const {
         if constexpr (IsContiguousContainer<T>) {
             using ContiguousType = typename T::value_type;
-            static_assert(std::is_trivially_copyable_v<ContiguousType>,
-                          "Data type must be trivially copyable.");
+            static_assert(std::is_trivially_copyable_v<ContiguousType>, "Data type must be trivially copyable.");
             return WriteSpan<ContiguousType>(data);
         } else {
             static_assert(std::is_trivially_copyable_v<T>, "Data type must be trivially copyable.");
@@ -264,197 +250,219 @@ public:
     }
 
     /**
-     * Reads a span of T data from a file sequentially.
-     * This function reads from the current position of the file pointer and
-     * advances it by the (count of T * sizeof(T)) bytes successfully read.
-     *
-     * Failures occur when:
-     * - The file is not open
-     * - The opened file lacks read permissions
-     * - Attempting to read beyond the end-of-file
-     *
-     * @tparam T Data type
-     *
-     * @param data Span of T data
-     *
-     * @returns Count of T data successfully read.
-     */
+    * Reads a span of T data from a file sequentially.
+    * This function reads from the current position of the file pointer and
+    * advances it by the (count of T * sizeof(T)) bytes successfully read.
+    *
+    * Failures occur when:
+    * - The file is not open
+    * - The opened file lacks read permissions
+    * - Attempting to read beyond the end-of-file
+    *
+    * @tparam T Data type
+    *
+    * @param data Span of T data
+    *
+    * @returns Count of T data successfully read.
+    */
     template <typename T>
         requires std::is_trivially_copyable_v<T>
     [[nodiscard]] size_t ReadSpan(std::span<T> data) const {
-        if (!IsOpen()) {
-            return 0;
+        if (IsMappedFile()) {
+            std::memcpy(data.data(), mmap_base + mmap_offset, sizeof(T) * data.size());
+            return data.size();
         }
-        return std::fread(data.data(), sizeof(T), data.size(), file);
+        return IsOpen() ? std::fread(data.data(), sizeof(T), data.size(), file) : 0;
     }
 
     /**
-     * Writes a span of T data to a file sequentially.
-     * This function writes from the current position of the file pointer and
-     * advances it by the (count of T * sizeof(T)) bytes successfully written.
-     *
-     * Failures occur when:
-     * - The file is not open
-     * - The opened file lacks write permissions
-     *
-     * @tparam T Data type
-     *
-     * @param data Span of T data
-     *
-     * @returns Count of T data successfully written.
-     */
+    * Writes a span of T data to a file sequentially.
+    * This function writes from the current position of the file pointer and
+    * advances it by the (count of T * sizeof(T)) bytes successfully written.
+    *
+    * Failures occur when:
+    * - The file is not open
+    * - The opened file lacks write permissions
+    *
+    * @tparam T Data type
+    *
+    * @param data Span of T data
+    *
+    * @returns Count of T data successfully written.
+    */
     template <typename T>
     [[nodiscard]] size_t WriteSpan(std::span<const T> data) const {
         static_assert(std::is_trivially_copyable_v<T>, "Data type must be trivially copyable.");
-
-        if (!IsOpen()) {
-            return 0;
+        if (IsMappedFile()) {
+            std::memcpy(mmap_base + mmap_offset, data.data(), sizeof(T) * data.size());
+            return data.size();
         }
-
-        return std::fwrite(data.data(), sizeof(T), data.size(), file);
+        return IsOpen() ? std::fwrite(data.data(), sizeof(T), data.size(), file) : 0;
     }
 
     /**
-     * Reads a T object from a file sequentially.
-     * This function reads from the current position of the file pointer and
-     * advances it by the sizeof(T) bytes successfully read.
-     *
-     * Failures occur when:
-     * - The file is not open
-     * - The opened file lacks read permissions
-     * - Attempting to read beyond the end-of-file
-     *
-     * @tparam T Data type
-     *
-     * @param object Reference to object
-     *
-     * @returns True if the object is successfully read from the file, false otherwise.
-     */
+    * Reads a T object from a file sequentially.
+    * This function reads from the current position of the file pointer and
+    * advances it by the sizeof(T) bytes successfully read.
+    *
+    * Failures occur when:
+    * - The file is not open
+    * - The opened file lacks read permissions
+    * - Attempting to read beyond the end-of-file
+    *
+    * @tparam T Data type
+    *
+    * @param object Reference to object
+    *
+    * @returns True if the object is successfully read from the file, false otherwise.
+    */
     template <typename T>
     [[nodiscard]] bool ReadObject(T& object) const {
         static_assert(std::is_trivially_copyable_v<T>, "Data type must be trivially copyable.");
         static_assert(!std::is_pointer_v<T>, "T must not be a pointer to an object.");
-
-        if (!IsOpen()) {
-            return false;
+        if (IsMappedFile()) {
+            std::memcpy(&object, mmap_base + mmap_offset, sizeof(T));
+#ifdef _WIN32
+            return bool(sizeof(T));
+#else
+            return sizeof(T);
+#endif
         }
-
-        return std::fread(&object, sizeof(T), 1, file) == 1;
+        return IsOpen() ? std::fread(&object, sizeof(T), 1, file) == 1 : false;
     }
 
     /**
-     * Writes a T object to a file sequentially.
-     * This function writes from the current position of the file pointer and
-     * advances it by the sizeof(T) bytes successfully written.
-     *
-     * Failures occur when:
-     * - The file is not open
-     * - The opened file lacks write permissions
-     *
-     * @tparam T Data type
-     *
-     * @param object Const reference to object
-     *
-     * @returns True if the object is successfully written to the file, false otherwise.
-     */
+    * Writes a T object to a file sequentially.
+    * This function writes from the current position of the file pointer and
+    * advances it by the sizeof(T) bytes successfully written.
+    *
+    * Failures occur when:
+    * - The file is not open
+    * - The opened file lacks write permissions
+    *
+    * @tparam T Data type
+    *
+    * @param object Const reference to object
+    *
+    * @returns True if the object is successfully written to the file, false otherwise.
+    */
     template <typename T>
     [[nodiscard]] bool WriteObject(const T& object) const {
         static_assert(std::is_trivially_copyable_v<T>, "Data type must be trivially copyable.");
         static_assert(!std::is_pointer_v<T>, "T must not be a pointer to an object.");
-
-        if (!IsOpen()) {
-            return false;
+        if (IsMappedFile()) {
+            std::memcpy(mmap_base + mmap_offset, &object, sizeof(T));
+#ifdef _WIN32
+            return sizeof(T) != 0;
+#else
+            return sizeof(T);
+#endif
         }
-
-        return std::fwrite(&object, sizeof(T), 1, file) == 1;
+        return IsOpen() ? std::fwrite(&object, sizeof(T), 1, file) == 1 : false;
     }
 
     /**
-     * Specialized function to read a string of a given length from a file sequentially.
-     * This function writes from the current position of the file pointer and
-     * advances it by the number of characters successfully read.
-     * The size of the returned string may not match length if not all bytes are successfully read.
-     *
-     * @param length Length of the string
-     *
-     * @returns A string read from the file.
-     */
+    * Specialized function to read a string of a given length from a file sequentially.
+    * This function writes from the current position of the file pointer and
+    * advances it by the number of characters successfully read.
+    * The size of the returned string may not match length if not all bytes are successfully read.
+    *
+    * @param length Length of the string
+    *
+    * @returns A string read from the file.
+    */
     [[nodiscard]] std::string ReadString(size_t length) const;
 
     /**
-     * Specialized function to write a string to a file sequentially.
-     * This function writes from the current position of the file pointer and
-     * advances it by the number of characters successfully written.
-     *
-     * @param string Span of const char backed std::string or std::string_view
-     *
-     * @returns Number of characters successfully written.
-     */
+    * Specialized function to write a string to a file sequentially.
+    * This function writes from the current position of the file pointer and
+    * advances it by the number of characters successfully written.
+    *
+    * @param string Span of const char backed std::string or std::string_view
+    *
+    * @returns Number of characters successfully written.
+    */
     [[nodiscard]] size_t WriteString(std::span<const char> string) const;
 
     /**
-     * Attempts to flush any unwritten buffered data into the file.
-     *
-     * @returns True if the flush was successful, false otherwise.
-     */
+    * Attempts to flush any unwritten buffered data into the file.
+    *
+    * @returns True if the flush was successful, false otherwise.
+    */
     bool Flush() const;
 
     /**
-     * Attempts to commit the file into the disk.
-     * Note that this is an expensive operation as this forces the operating system to write
-     * the contents of the file associated with the file descriptor into the disk.
-     *
-     * @returns True if the commit was successful, false otherwise.
-     */
+    * Attempts to commit the file into the disk.
+    * Note that this is an expensive operation as this forces the operating system to write
+    * the contents of the file associated with the file descriptor into the disk.
+    *
+    * @returns True if the commit was successful, false otherwise.
+    */
     bool Commit() const;
 
     /**
-     * Resizes the file to a given size.
-     * If the file is resized to a smaller size, the remainder of the file is discarded.
-     * If the file is resized to a larger size, the new area appears as if zero-filled.
-     *
-     * Failures occur when:
-     * - The file is not open
-     *
-     * @param size File size in bytes
-     *
-     * @returns True if the file resize succeeded, false otherwise.
-     */
+    * Resizes the file to a given size.
+    * If the file is resized to a smaller size, the remainder of the file is discarded.
+    * If the file is resized to a larger size, the new area appears as if zero-filled.
+    *
+    * Failures occur when:
+    * - The file is not open
+    *
+    * @param size File size in bytes
+    *
+    * @returns True if the file resize succeeded, false otherwise.
+    */
     [[nodiscard]] bool SetSize(u64 size) const;
 
     /**
-     * Gets the size of the file.
-     *
-     * Failures occur when:
-     * - The file is not open
-     *
-     * @returns The file size in bytes of the file. Returns 0 on failure.
-     */
+    * Gets the size of the file.
+    *
+    * Failures occur when:
+    * - The file is not open
+    *
+    * @returns The file size in bytes of the file. Returns 0 on failure.
+    */
     [[nodiscard]] u64 GetSize() const;
 
     /**
-     * Moves the current position of the file pointer with the specified offset and seek origin.
-     *
-     * @param offset Offset from seek origin
-     * @param origin Seek origin
-     *
-     * @returns True if the file pointer has moved to the specified offset, false otherwise.
-     */
+    * Moves the current position of the file pointer with the specified offset and seek origin.
+    *
+    * @param offset Offset from seek origin
+    * @param origin Seek origin
+    *
+    * @returns True if the file pointer has moved to the specified offset, false otherwise.
+    */
     [[nodiscard]] bool Seek(s64 offset, SeekOrigin origin = SeekOrigin::SetOrigin) const;
 
     /**
-     * Gets the current position of the file pointer.
-     *
-     * @returns The current position of the file pointer.
-     */
+    * Gets the current position of the file pointer.
+    *
+    * @returns The current position of the file pointer.
+    */
     [[nodiscard]] s64 Tell() const;
 
-private:
+#ifdef _WIN32
+    inline bool IsMappedFile() const noexcept { return mapping_handle != nullptr; }
+#else // POSIX
+    inline bool IsMappedFile() const noexcept { return mmap_fd != -1; }
+#endif
+
     std::filesystem::path file_path;
     FileAccessMode file_access_mode{};
     FileType file_type{};
-
     std::FILE* file = nullptr;
+    // Any decent system should have mmap() for files
+    // Systems with artifical mmap() limitations should simply change the logic within file.cpp
+    // and reduce the threshold for which the mmap() is set to
+#ifdef _WIN32
+    void *mapping_handle = nullptr;
+    void *file_handle = nullptr;
+#else // POSIX
+    int mmap_fd = -1;
+#endif
+    u8* mmap_base = nullptr;
+    size_t mmap_size = 0;
+    mutable s64 mmap_offset = 0; // fuck you
 };
 
 } // namespace Common::FS

src/core/CMakeLists.txt

@@ -1267,6 +1267,23 @@ if (ARCHITECTURE_x86_64 OR ARCHITECTURE_arm64 OR ARCHITECTURE_riscv64 OR ARCHITE
     target_link_libraries(core PRIVATE dynarmic::dynarmic)
 endif()
 
+target_sources(core PRIVATE hle/service/ssl/ssl_backend_openssl.cpp)
+
 target_link_libraries(core PRIVATE OpenSSL::SSL OpenSSL::Crypto)
 
+# TODO
+
+# elseif (APPLE)
+#     target_sources(core PRIVATE
+#         hle/service/ssl/ssl_backend_securetransport.cpp)
+#     target_link_libraries(core PRIVATE "-framework Security")
+# elseif (WIN32)
+#     target_sources(core PRIVATE
+#         hle/service/ssl/ssl_backend_schannel.cpp)
+#     target_link_libraries(core PRIVATE crypt32 secur32)
+# else()
+#     target_sources(core PRIVATE
+#         hle/service/ssl/ssl_backend_none.cpp)
+# endif()
+
 create_target_directory_groups(core)

src/core/hle/service/nim/nim.cpp

@@ -5,33 +5,136 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include <chrono>
-#include <ctime>
+#include <mutex>
+#include <string>
+#include <vector>
+
 #include "core/core.h"
 #include "core/hle/kernel/k_event.h"
+#include "core/hle/service/cmif_serialization.h"
+#include "core/hle/service/cmif_types.h"
 #include "core/hle/service/ipc_helpers.h"
 #include "core/hle/service/kernel_helpers.h"
 #include "core/hle/service/nim/nim.h"
+#include "core/hle/service/os/event.h"
 #include "core/hle/service/server_manager.h"
 #include "core/hle/service/service.h"
 
 namespace Service::NIM {
-
 class IShopServiceAsync final : public ServiceFramework<IShopServiceAsync> {
 public:
     explicit IShopServiceAsync(Core::System& system_)
-        : ServiceFramework{system_, "IShopServiceAsync"} {
+        : ServiceFramework{system_, "IShopServiceAsync"},
+          service_context{system_, "IShopServiceAsync"} {
         // clang-format off
         static const FunctionInfo functions[] = {
-            {0, nullptr, "Cancel"},
-            {1, nullptr, "GetSize"},
-            {2, nullptr, "Read"},
-            {3, nullptr, "GetErrorCode"},
-            {4, nullptr, "Request"},
-            {5, nullptr, "Prepare"},
+            {0, D<&IShopServiceAsync::Cancel>, "Cancel"},
+            {1, D<&IShopServiceAsync::GetSize>, "GetSize"},
+            {2, D<&IShopServiceAsync::Read>, "Read"},
+            {3, D<&IShopServiceAsync::GetErrorCode>, "GetErrorCode"},
+            {4, D<&IShopServiceAsync::Request>, "Request"},
+            {5, D<&IShopServiceAsync::Prepare>, "Prepare"},
         };
         // clang-format on
 
         RegisterHandlers(functions);
+
+        completion_event = service_context.CreateEvent("IShopServiceAsync:Completion");
+    }
+
+    ~IShopServiceAsync() override {
+        CancelImpl();
+        service_context.CloseEvent(completion_event);
+    }
+
+    Kernel::KReadableEvent* GetEvent() const {
+        return &completion_event->GetReadableEvent();
+    }
+
+private:
+    KernelHelpers::ServiceContext service_context;
+    Kernel::KEvent* completion_event;
+
+    std::jthread worker;
+    std::atomic<u32> error_code{0};
+
+    std::mutex data_mutex;
+    std::vector<u8> download_data;
+
+    void CancelImpl() {
+        worker.request_stop();
+        if (worker.joinable()) {
+            worker.join();
+        }
+    }
+
+    Result Cancel() {
+        LOG_DEBUG(Service_NIM, "called");
+        CancelImpl();
+        R_SUCCEED();
+    }
+
+    Result GetSize(Out<u64> out_size) {
+        LOG_DEBUG(Service_NIM, "called");
+        std::scoped_lock lock{data_mutex};
+        *out_size = download_data.size();
+        R_SUCCEED();
+    }
+
+    Result Read(Out<u64> out_size, u64 offset, OutBuffer<BufferAttr_HipcAutoSelect> out_buffer) {
+        std::scoped_lock lock{data_mutex};
+
+        u64 actual_read = 0;
+        if (offset < download_data.size()) {
+            actual_read = std::min<u64>(out_buffer.size(), download_data.size() - offset);
+            std::memcpy(out_buffer.data(), download_data.data() + offset, actual_read);
+        }
+
+        *out_size = actual_read;
+        R_SUCCEED();
+    }
+
+    Result GetErrorCode(Out<u32> out_error_code) {
+        LOG_DEBUG(Service_NIM, "called");
+        *out_error_code = error_code.load();
+        R_SUCCEED();
+    }
+
+    Result Request() {
+        LOG_DEBUG(Service_NIM, "(STUBBED) called");
+        CancelImpl();
+
+        error_code.store(0);
+        completion_event->Clear(system.Kernel());
+
+        {
+            std::scoped_lock lock{data_mutex};
+            download_data.clear();
+        }
+
+        worker = std::jthread([this](const std::stop_token& stop_token) {
+            if (stop_token.stop_requested()) {
+                error_code.store(1);
+            } else {
+                std::scoped_lock lock{data_mutex};
+                // Dummy JSON response, else it fails...
+                const std::string dummy_response = "{}";
+                download_data.assign(dummy_response.begin(), dummy_response.end());
+                error_code.store(0);
+            }
+            completion_event->Signal(system.Kernel());
+        });
+
+        R_SUCCEED();
+    }
+
+    Result Prepare(InArray<char, BufferAttr_HipcMapAlias> in_path, InArray<char, BufferAttr_HipcMapAlias> in_post) {
+        LOG_DEBUG(Service_NIM, "called");
+        if (!in_path.empty()) {
+            std::string url(in_path.data(), in_path.size());
+            LOG_INFO(Service_NIM, "Preparing request for URL: {}", url);
+        }
+        R_SUCCEED();
     }
 };
 
@@ -49,11 +152,13 @@ public:
     }
 
 private:
-    void CreateAsyncInterface(HLERequestContext& ctx) {
-        LOG_WARNING(Service_NIM, "(STUBBED) called");
-        IPC::ResponseBuilder rb{ctx, 2, 0, 1};
+    void CreateAsyncInterface(HLERequestContext& ctx) {LOG_DEBUG(Service_NIM, "called");
+        auto async_interface = std::make_shared<IShopServiceAsync>(system);
+
+        IPC::ResponseBuilder rb{ctx, 2, 1, 1};
         rb.Push(ResultSuccess);
-        rb.PushIpcInterface<IShopServiceAsync>(ctx, system);
+        rb.PushCopyObjects(ctx, async_interface->GetEvent());
+        rb.PushIpcInterface<IShopServiceAsync>(ctx, std::move(async_interface));
     }
 };
 

src/core/hle/service/ssl/ssl.cpp

@@ -4,18 +4,6 @@
 // SPDX-FileCopyrightText: Copyright 2018 yuzu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-#include <mutex>
-
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/ssl.h>
-#include <openssl/x509.h>
-#ifdef YUZU_BUNDLED_OPENSSL
-#include <openssl/cert.h>
-#endif
-
-#include "common/fs/file.h"
-#include "common/hex_util.h"
 #include "common/string_util.h"
 
 #include "core/core.h"
@@ -34,377 +22,6 @@
 
 namespace Service::SSL {
 
-namespace {
-
-std::once_flag one_time_init_flag;
-bool one_time_init_success = false;
-SSL_CTX* ssl_ctx = nullptr;
-BIO_METHOD* bio_meth = nullptr;
-Common::FS::IOFile key_log_file; // only open if SSLKEYLOGFILE set in environment
-
-Result CheckOpenSSLErrors();
-void OneTimeInit();
-void OneTimeInitLogFile();
-bool OneTimeInitBIO();
-
-#ifdef YUZU_BUNDLED_OPENSSL
-// This is ported from httplib
-struct scope_exit {
-  explicit scope_exit(std::function<void(void)> &&f)
-      : exit_function(std::move(f)), execute_on_destruction{true} {}
-
-  scope_exit(scope_exit &&rhs) noexcept
-      : exit_function(std::move(rhs.exit_function)),
-        execute_on_destruction{rhs.execute_on_destruction} {
-    rhs.release();
-  }
-
-  ~scope_exit() {
-    if (execute_on_destruction) { this->exit_function(); }
-  }
-
-  void release() { this->execute_on_destruction = false; }
-
-private:
-  scope_exit(const scope_exit &) = delete;
-  void operator=(const scope_exit &) = delete;
-  scope_exit &operator=(scope_exit &&) = delete;
-
-  std::function<void(void)> exit_function;
-  bool execute_on_destruction;
-};
-
-inline X509_STORE *CreateCaCertStore(const char *ca_cert,
-                                                    std::size_t size) {
-    auto mem = BIO_new_mem_buf(ca_cert, static_cast<int>(size));
-    auto se = scope_exit([&] { BIO_free_all(mem); });
-    if (!mem) { return nullptr; }
-
-    auto inf = PEM_X509_INFO_read_bio(mem, nullptr, nullptr, nullptr);
-    if (!inf) { return nullptr; }
-
-    auto cts = X509_STORE_new();
-    if (cts) {
-        for (auto i = 0; i < static_cast<int>(sk_X509_INFO_num(inf)); i++) {
-            auto itmp = sk_X509_INFO_value(inf, i);
-            if (!itmp) { continue; }
-
-            if (itmp->x509) { X509_STORE_add_cert(cts, itmp->x509); }
-            if (itmp->crl) { X509_STORE_add_crl(cts, itmp->crl); }
-        }
-    }
-
-    sk_X509_INFO_pop_free(inf, X509_INFO_free);
-    return cts;
-}
-
-inline void SetCaCertStore(SSL_CTX *ctx, X509_STORE *ca_cert_store) {
-    if (ca_cert_store) {
-        if (ctx) {
-            if (SSL_CTX_get_cert_store(ctx) != ca_cert_store) {
-                // Free memory allocated for old cert and use new store `ca_cert_store`
-                SSL_CTX_set_cert_store(ctx, ca_cert_store);
-            }
-        } else {
-            X509_STORE_free(ca_cert_store);
-        }
-    }
-}
-
-inline void LoadCaCertStore(SSL_CTX* ctx, const char* ca_cert, std::size_t size)
-{
-    SetCaCertStore(ctx, CreateCaCertStore(ca_cert, size));
-}
-#endif
-
-} // namespace
-
-class SSLConnectionBackend final {
-public:
-    Result Init() {
-        // on bundled OpenSSL, load ca cert store
-#ifdef YUZU_BUNDLED_OPENSSL
-        LoadCaCertStore(ssl_ctx, kCert, sizeof(kCert));
-#endif
-        std::call_once(one_time_init_flag, OneTimeInit);
-
-        if (!one_time_init_success) {
-            LOG_ERROR(Service_SSL, "Can't create SSL connection because OpenSSL one-time initialization failed");
-            return ResultInternalError;
-        }
-
-        ssl = SSL_new(ssl_ctx);
-        if (!ssl) {
-            LOG_ERROR(Service_SSL, "SSL_new failed");
-            return CheckOpenSSLErrors();
-        }
-        SSL_set_connect_state(ssl);
-        bio = BIO_new(bio_meth);
-        if (!bio) {
-            LOG_ERROR(Service_SSL, "BIO_new failed");
-            return CheckOpenSSLErrors();
-        }
-        BIO_set_data(bio, this);
-        BIO_set_init(bio, 1);
-        SSL_set_bio(ssl, bio, bio);
-        return ResultSuccess;
-    }
-
-    Result SetHostName(const std::string& hostname) {
-        if (!skip_cert_verification) {
-            if (!SSL_set1_host(ssl, hostname.c_str())) {
-                LOG_ERROR(Service_SSL, "SSL_set1_host({}) failed", hostname);
-                return CheckOpenSSLErrors();
-            }
-        }
-        if (!SSL_set_tlsext_host_name(ssl, hostname.c_str())) { // hostname for SNI
-            LOG_ERROR(Service_SSL, "SSL_set_tlsext_host_name({}) failed", hostname);
-            return CheckOpenSSLErrors();
-        }
-        return ResultSuccess;
-    }
-
-    void SetVerifyOption(u32 option) {
-        skip_cert_verification = (option == 0);
-        LOG_WARNING(Service_SSL, "option={} skip_verification={}", option,
-                    skip_cert_verification);
-        if (skip_cert_verification) {
-            SSL_set_verify(ssl, SSL_VERIFY_NONE, nullptr);
-            SSL_set1_host(ssl, nullptr);
-            SSL_set_hostflags(ssl, 0);
-        } else {
-            SSL_set_verify(ssl, SSL_VERIFY_PEER, nullptr);
-        }
-    }
-
-    Result DoHandshake() {
-        SSL_set_verify_result(ssl, X509_V_OK);
-        const int ret = SSL_do_handshake(ssl);
-
-        if (!skip_cert_verification) {
-            const long verify_result = SSL_get_verify_result(ssl);
-            if (verify_result != X509_V_OK) {
-                LOG_ERROR(Service_SSL, "SSL cert verification failed because: {}",
-                          X509_verify_cert_error_string(verify_result));
-                return CheckOpenSSLErrors();
-            }
-        }
-
-        if (ret <= 0) {
-            const int ssl_err = SSL_get_error(ssl, ret);
-            if (ssl_err == SSL_ERROR_ZERO_RETURN ||
-                (ssl_err == SSL_ERROR_SYSCALL && got_read_eof)) {
-                LOG_ERROR(Service_SSL, "SSL handshake failed because server hung up");
-                return ResultInternalError;
-            }
-        }
-        return HandleReturn("SSL_do_handshake", 0, ret);
-    }
-
-    Result HandleReturn(const char* what, size_t* actual, int ret) {
-        const int ssl_err = SSL_get_error(ssl, ret);
-        CheckOpenSSLErrors();
-        switch (ssl_err) {
-        case SSL_ERROR_NONE:
-            return ResultSuccess;
-        case SSL_ERROR_ZERO_RETURN:
-            LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_ZERO_RETURN", what);
-            // DoHandshake special-cases this, but for Read and Write:
-            *actual = 0;
-            return ResultSuccess;
-        case SSL_ERROR_WANT_READ:
-            LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_WANT_READ", what);
-            return ResultWouldBlock;
-        case SSL_ERROR_WANT_WRITE:
-            LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_WANT_WRITE", what);
-            return ResultWouldBlock;
-        default:
-            if (ssl_err == SSL_ERROR_SYSCALL && got_read_eof) {
-                LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_SYSCALL because server hung up", what);
-                *actual = 0;
-                return ResultSuccess;
-            }
-            LOG_ERROR(Service_SSL, "{} => other SSL_get_error return value {}", what, ssl_err);
-            return ResultInternalError;
-        }
-    }
-
-    ~SSLConnectionBackend() {
-        // this is null-tolerant:
-        SSL_free(ssl);
-    }
-
-    static void KeyLogCallback(const ::SSL* ssl, const char* line) {
-        std::string str(line);
-        str.push_back('\n');
-        // Do this in a single WriteString for atomicity if multiple instances
-        // are running on different threads (though that can't currently
-        // happen).
-        if (key_log_file.WriteString(str) != str.size() || !key_log_file.Flush()) {
-            LOG_CRITICAL(Service_SSL, "Failed to write to SSLKEYLOGFILE");
-        }
-        LOG_DEBUG(Service_SSL, "Wrote to SSLKEYLOGFILE: {}", line);
-    }
-
-    static int WriteCallback(BIO* bio, const char* buf, size_t len, size_t* actual_p) {
-        auto self = static_cast<SSLConnectionBackend*>(BIO_get_data(bio));
-        ASSERT_OR_EXECUTE_MSG(
-            self->socket, { return 0; }, "OpenSSL asked to send but we have no socket");
-        BIO_clear_retry_flags(bio);
-        auto [actual, err] = self->socket->Send({reinterpret_cast<const u8*>(buf), len}, 0);
-        switch (err) {
-        case Network::Errno::SUCCESS:
-            *actual_p = actual;
-            return 1;
-        case Network::Errno::AGAIN:
-            BIO_set_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
-            return 0;
-        default:
-            LOG_ERROR(Service_SSL, "Socket send returned Network::Errno {}", err);
-            return -1;
-        }
-    }
-
-    static int ReadCallback(BIO* bio, char* buf, size_t len, size_t* actual_p) {
-        auto self = static_cast<SSLConnectionBackend*>(BIO_get_data(bio));
-        ASSERT_OR_EXECUTE_MSG(
-            self->socket, { return 0; }, "OpenSSL asked to recv but we have no socket");
-        BIO_clear_retry_flags(bio);
-        auto [actual, err] = self->socket->Recv(0, {reinterpret_cast<u8*>(buf), len});
-        switch (err) {
-        case Network::Errno::SUCCESS:
-            *actual_p = actual;
-            if (actual == 0) {
-                self->got_read_eof = true;
-            }
-            return actual ? 1 : 0;
-        case Network::Errno::AGAIN:
-            BIO_set_flags(bio, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
-            return 0;
-        default:
-            LOG_ERROR(Service_SSL, "Socket recv returned Network::Errno {}", err);
-            return -1;
-        }
-    }
-
-    static long CtrlCallback(BIO* bio, int cmd, long l_arg, void* p_arg) {
-        switch (cmd) {
-        case BIO_CTRL_FLUSH:
-            // Nothing to flush.
-            return 1;
-        case BIO_CTRL_PUSH:
-        case BIO_CTRL_POP:
-#ifdef BIO_CTRL_GET_KTLS_SEND
-        case BIO_CTRL_GET_KTLS_SEND:
-        case BIO_CTRL_GET_KTLS_RECV:
-#endif
-            // We don't support these operations, but don't bother logging them
-            // as they're nothing unusual.
-            return 0;
-        default:
-            LOG_DEBUG(Service_SSL, "OpenSSL BIO got ctrl({}, {}, {})", cmd, l_arg, p_arg);
-            return 0;
-        }
-    }
-
-    ::SSL* ssl = nullptr;
-    BIO* bio = nullptr;
-    bool got_read_eof = false;
-    bool skip_cert_verification = false;
-    std::shared_ptr<Network::SocketBase> socket;
-};
-
-namespace {
-
-Result CreateSSLConnectionBackend(std::unique_ptr<SSLConnectionBackend>* out_backend) {
-    auto conn = std::make_unique<SSLConnectionBackend>();
-    R_TRY(conn->Init());
-    *out_backend = std::move(conn);
-    return ResultSuccess;
-}
-
-Result CheckOpenSSLErrors() {
-    unsigned long rc;
-    const char* file;
-    int line;
-    const char* func;
-    const char* data;
-    int flags;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-    while ((rc = ERR_get_error_all(&file, &line, &func, &data, &flags)))
-#else
-    // Can't get function names from OpenSSL on this version, so use mine:
-    func = __func__;
-    while ((rc = ERR_get_error_line_data(&file, &line, &data, &flags)))
-#endif
-    {
-        std::string msg;
-        msg.resize(1024, '\0');
-        ERR_error_string_n(rc, msg.data(), msg.size());
-        msg.resize(strlen(msg.data()), '\0');
-        if (flags & ERR_TXT_STRING) {
-            msg.append(" | ");
-            msg.append(data);
-        }
-        Common::Log::FmtLogMessage(Common::Log::Class::Service_SSL, Common::Log::Level::Error,
-                                   file, line, func, "OpenSSL: {}",
-                                   msg);
-    }
-    return ResultInternalError;
-}
-
-void OneTimeInit() {
-    ssl_ctx = SSL_CTX_new(TLS_client_method());
-    if (!ssl_ctx) {
-        LOG_ERROR(Service_SSL, "SSL_CTX_new failed");
-        CheckOpenSSLErrors();
-        return;
-    }
-
-    SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, nullptr);
-
-    if (!SSL_CTX_set_default_verify_paths(ssl_ctx)) {
-        LOG_ERROR(Service_SSL, "SSL_CTX_set_default_verify_paths failed");
-        CheckOpenSSLErrors();
-        return;
-    }
-
-    OneTimeInitLogFile();
-
-    if (!OneTimeInitBIO()) {
-        return;
-    }
-
-    one_time_init_success = true;
-}
-
-void OneTimeInitLogFile() {
-    const char* logfile = getenv("SSLKEYLOGFILE");
-    if (logfile) {
-        key_log_file.Open(logfile, Common::FS::FileAccessMode::Append, Common::FS::FileType::TextFile, Common::FS::FileShareFlag::ShareWriteOnly);
-        if (key_log_file.IsOpen()) {
-            SSL_CTX_set_keylog_callback(ssl_ctx, &SSLConnectionBackend::KeyLogCallback);
-        } else {
-            LOG_CRITICAL(Service_SSL, "SSLKEYLOGFILE was set but file could not be opened; not logging keys!");
-        }
-    }
-}
-
-bool OneTimeInitBIO() {
-    bio_meth =
-        BIO_meth_new(BIO_get_new_index() | BIO_TYPE_SOURCE_SINK, "SSLConnectionBackend");
-    if (!bio_meth ||
-        !BIO_meth_set_write_ex(bio_meth, &SSLConnectionBackend::WriteCallback) ||
-        !BIO_meth_set_read_ex(bio_meth, &SSLConnectionBackend::ReadCallback) ||
-        !BIO_meth_set_ctrl(bio_meth, &SSLConnectionBackend::CtrlCallback)) {
-        LOG_ERROR(Service_SSL, "Failed to create BIO_METHOD");
-        return false;
-    }
-    return true;
-}
-
-} // namespace
-
 // This is nn::ssl::sf::CertificateFormat
 enum class CertificateFormat : u32 {
     Pem = 1,
@@ -545,17 +162,20 @@ private:
 
         auto const res_v = bsd->DuplicateSocketImpl(fd);
         if (auto *res = std::get_if<s32>(&res_v)) {
-            const s32 dup_fd = *res;
-            *out_fd = do_not_close_socket ? dup_fd : -1;
-            if (!do_not_close_socket)
-                fd_to_close = dup_fd;
-            auto const sock = bsd->GetSocket(dup_fd);
+            const s32 duplicated_fd = *res;
+            if (do_not_close_socket) {
+                *out_fd = duplicated_fd;
+            } else {
+                *out_fd = -1;
+                fd_to_close = duplicated_fd;
+            }
+            std::optional<std::shared_ptr<Network::SocketBase>> sock = bsd->GetSocket(duplicated_fd);
             if (!sock.has_value()) {
-                LOG_ERROR(Service_SSL, "invalid socket fd {} after duplication", dup_fd);
+                LOG_ERROR(Service_SSL, "invalid socket fd {} after duplication", duplicated_fd);
                 return ResultInvalidSocket;
             }
             socket = std::move(*sock);
-            backend->socket = std::move(socket);
+            backend->SetSocket(socket);
             return ResultSuccess;
         }
         LOG_ERROR(Service_SSL, "Failed to duplicate socket with fd {}", fd);
@@ -569,11 +189,11 @@ private:
     }
 
     Result SetVerifyOptionImpl(u32 option) {
-        LOG_DEBUG(Service_SSL, "called. option={} (forcing 0)", option);
         ASSERT(!did_handshake);
+        LOG_DEBUG(Service_SSL, "called. option={} (forcing 0)", option);
         verify_option = 0;
         backend->SetVerifyOption(0);
-        R_SUCCEED();
+        return ResultSuccess;
     }
 
     Result SetIoModeImpl(u32 input_mode) {
@@ -586,13 +206,13 @@ private:
         if (error != Network::Errno::SUCCESS) {
             LOG_ERROR(Service_SSL, "Failed to set native socket non-block flag to {}", non_block);
         }
-        R_SUCCEED();
+        return ResultSuccess;
     }
 
     Result SetSessionCacheModeImpl(u32 mode) {
         ASSERT(!did_handshake);
         LOG_WARNING(Service_SSL, "(STUBBED) called. value={}", mode);
-        R_SUCCEED();
+        return ResultSuccess;
     }
 
     Result DoHandshakeImpl() {
@@ -614,17 +234,19 @@ private:
         };
         if (!get_server_cert_chain) {
             // Just return the first one, unencoded.
-            ASSERT_OR_EXECUTE_MSG(!certs.empty(), { return {}; }, "Should be at least one server cert");
+            ASSERT_OR_EXECUTE_MSG(
+                !certs.empty(), { return {}; }, "Should be at least one server cert");
             return certs[0];
         }
         std::vector<u8> ret;
-        Header header{0x4E4D684374726543, u32(certs.size()), 0};
+        Header header{0x4E4D684374726543, static_cast<u32>(certs.size()), 0};
         ret.insert(ret.end(), reinterpret_cast<u8*>(&header), reinterpret_cast<u8*>(&header + 1));
         size_t data_offset = sizeof(Header) + certs.size() * sizeof(EntryHeader);
         for (auto& cert : certs) {
-            EntryHeader entry_header{u32(cert.size()), u32(data_offset)};
+            EntryHeader entry_header{static_cast<u32>(cert.size()), static_cast<u32>(data_offset)};
             data_offset += cert.size();
-            ret.insert(ret.end(), reinterpret_cast<u8*>(&entry_header), reinterpret_cast<u8*>(&entry_header + 1));
+            ret.insert(ret.end(), reinterpret_cast<u8*>(&entry_header),
+                       reinterpret_cast<u8*>(&entry_header + 1));
         }
         for (auto& cert : certs) {
             ret.insert(ret.end(), cert.begin(), cert.end());
@@ -635,8 +257,7 @@ private:
     Result ReadImpl(std::vector<u8>* out_data) {
         ASSERT_OR_EXECUTE(did_handshake, { return ResultInternalError; });
         size_t actual_size{};
-        const int ret = SSL_read_ex(backend->ssl, out_data->data(), out_data->size(), &actual_size);
-        Result res = backend->HandleReturn("SSL_read_ex", &actual_size, ret);
+        Result res = backend->Read(&actual_size, *out_data);
         if (res != ResultSuccess) {
             return res;
         }
@@ -646,13 +267,12 @@ private:
 
     Result WriteImpl(size_t* out_size, std::span<const u8> data) {
         ASSERT_OR_EXECUTE(did_handshake, { return ResultInternalError; });
-        const int ret = SSL_write_ex(backend->ssl, data.data(), data.size(), out_size);
-        return backend->HandleReturn("SSL_write_ex", out_size, ret);
+        return backend->Write(out_size, data);
     }
 
     Result PendingImpl(s32* out_pending) {
         LOG_WARNING(Service_SSL, "(STUBBED) called.");
-        *out_pending = SSL_pending(backend->ssl);
+        *out_pending = 0;
         return ResultSuccess;
     }
 
@@ -706,39 +326,24 @@ private:
         OutputParameters out{};
         if (res == ResultSuccess) {
             std::vector<std::vector<u8>> certs;
-            STACK_OF(X509)* chain = SSL_get_peer_cert_chain(backend->ssl);
-            if (chain) {
-                int count = sk_X509_num(chain);
-                ASSERT(count >= 0);
-                for (int i = 0; i < count; i++) {
-                    X509* x509 = sk_X509_value(chain, i);
-                    ASSERT_OR_EXECUTE(x509 != nullptr, { continue; });
-                    unsigned char* buf = nullptr;
-                    int len = i2d_X509(x509, &buf);
-                    ASSERT_OR_EXECUTE(len >= 0 && buf, { continue; });
-                    certs.emplace_back(buf, buf + len);
-                    OPENSSL_free(buf);
-                }
-
-                // succeed!
+            res = backend->GetServerCerts(&certs);
+            if (res == ResultSuccess) {
                 const std::vector<u8> certs_buf = SerializeServerCerts(certs);
                 if (ctx.CanWriteBuffer()) {
                     const size_t buffer_size = ctx.GetWriteBufferSize();
                     if (certs_buf.size() <= buffer_size) {
                         ctx.WriteBuffer(certs_buf);
                     } else {
-                        LOG_WARNING(Service_SSL, "Certificate buffer too small: {} bytes needed, {} bytes available", certs_buf.size(), buffer_size);
+                        LOG_WARNING(Service_SSL, "Certificate buffer too small: {} bytes needed, {} bytes available",
+                                    certs_buf.size(), buffer_size);
                         ctx.WriteBuffer(std::span<const u8>(certs_buf.data(), buffer_size));
                     }
                 } else {
                     LOG_DEBUG(Service_SSL, "No output buffer provided for certificates ({} bytes)", certs_buf.size());
                 }
 
-                out.certs_count = u32(certs.size());
-                out.certs_size = u32(certs_buf.size());
-            } else {
-                LOG_ERROR(Service_SSL, "SSL_get_peer_cert_chain returned nullptr");
-                res = ResultInternalError;
+                out.certs_count = static_cast<u32>(certs.size());
+                out.certs_size = static_cast<u32>(certs_buf.size());
             }
         }
         IPC::ResponseBuilder rb{ctx, 4};

src/core/hle/service/ssl/ssl_backend.h

@@ -32,4 +32,18 @@ constexpr Result ResultInternalError{ErrorModule::SSLSrv, 999}; // made up
 // polling for read (with a timeout).
 constexpr Result ResultWouldBlock{ErrorModule::SSLSrv, 204};
 
+class SSLConnectionBackend {
+public:
+    virtual ~SSLConnectionBackend() {}
+    virtual void SetSocket(std::shared_ptr<Network::SocketBase> socket) = 0;
+    virtual Result SetHostName(const std::string& hostname) = 0;
+    virtual void SetVerifyOption(u32 option) = 0;
+    virtual Result DoHandshake() = 0;
+    virtual Result Read(size_t* out_size, std::span<u8> data) = 0;
+    virtual Result Write(size_t* out_size, std::span<const u8> data) = 0;
+    virtual Result GetServerCerts(std::vector<std::vector<u8>>* out_certs) = 0;
+};
+
+Result CreateSSLConnectionBackend(std::unique_ptr<SSLConnectionBackend>* out_backend);
+
 } // namespace Service::SSL

src/core/hle/service/ssl/ssl_backend_none.cpp

@@ -0,0 +1,19 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// SPDX-FileCopyrightText: Copyright 2023 yuzu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "common/logging.h"
+
+#include "core/hle/service/ssl/ssl_backend.h"
+
+namespace Service::SSL {
+
+Result CreateSSLConnectionBackend(std::unique_ptr<SSLConnectionBackend>* out_backend) {
+    LOG_ERROR(Service_SSL,
+              "Can't create SSL connection because no SSL backend is available on this platform");
+    return ResultInternalError;
+}
+
+} // namespace Service::SSL

src/core/hle/service/ssl/ssl_backend_openssl.cpp

@@ -0,0 +1,450 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// SPDX-FileCopyrightText: Copyright 2023 yuzu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <mutex>
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <openssl/x509.h>
+
+#include "common/fs/file.h"
+#include "common/hex_util.h"
+#include "common/string_util.h"
+
+#include "core/hle/service/ssl/ssl_backend.h"
+#include "core/internal_network/network.h"
+#include "core/internal_network/sockets.h"
+
+#ifdef YUZU_BUNDLED_OPENSSL
+#include <openssl/cert.h>
+#endif
+
+using namespace Common::FS;
+
+namespace Service::SSL {
+
+// Import OpenSSL's `SSL` type into the namespace.  This is needed because the
+// namespace is also named `SSL`.
+using ::SSL;
+
+namespace {
+
+std::once_flag one_time_init_flag;
+bool one_time_init_success = false;
+
+SSL_CTX* ssl_ctx;
+IOFile key_log_file; // only open if SSLKEYLOGFILE set in environment
+BIO_METHOD* bio_meth;
+
+Result CheckOpenSSLErrors();
+void OneTimeInit();
+void OneTimeInitLogFile();
+bool OneTimeInitBIO();
+
+#ifdef YUZU_BUNDLED_OPENSSL
+// This is ported from httplib
+struct scope_exit {
+  explicit scope_exit(std::function<void(void)> &&f)
+      : exit_function(std::move(f)), execute_on_destruction{true} {}
+
+  scope_exit(scope_exit &&rhs) noexcept
+      : exit_function(std::move(rhs.exit_function)),
+        execute_on_destruction{rhs.execute_on_destruction} {
+    rhs.release();
+  }
+
+  ~scope_exit() {
+    if (execute_on_destruction) { this->exit_function(); }
+  }
+
+  void release() { this->execute_on_destruction = false; }
+
+private:
+  scope_exit(const scope_exit &) = delete;
+  void operator=(const scope_exit &) = delete;
+  scope_exit &operator=(scope_exit &&) = delete;
+
+  std::function<void(void)> exit_function;
+  bool execute_on_destruction;
+};
+
+inline X509_STORE *CreateCaCertStore(const char *ca_cert,
+                                                    std::size_t size) {
+    auto mem = BIO_new_mem_buf(ca_cert, static_cast<int>(size));
+    auto se = scope_exit([&] { BIO_free_all(mem); });
+    if (!mem) { return nullptr; }
+
+    auto inf = PEM_X509_INFO_read_bio(mem, nullptr, nullptr, nullptr);
+    if (!inf) { return nullptr; }
+
+    auto cts = X509_STORE_new();
+    if (cts) {
+        for (auto i = 0; i < static_cast<int>(sk_X509_INFO_num(inf)); i++) {
+            auto itmp = sk_X509_INFO_value(inf, i);
+            if (!itmp) { continue; }
+
+            if (itmp->x509) { X509_STORE_add_cert(cts, itmp->x509); }
+            if (itmp->crl) { X509_STORE_add_crl(cts, itmp->crl); }
+        }
+    }
+
+    sk_X509_INFO_pop_free(inf, X509_INFO_free);
+    return cts;
+}
+
+inline void SetCaCertStore(SSL_CTX *ctx, X509_STORE *ca_cert_store) {
+    if (ca_cert_store) {
+        if (ctx) {
+            if (SSL_CTX_get_cert_store(ctx) != ca_cert_store) {
+                // Free memory allocated for old cert and use new store `ca_cert_store`
+                SSL_CTX_set_cert_store(ctx, ca_cert_store);
+            }
+        } else {
+            X509_STORE_free(ca_cert_store);
+        }
+    }
+}
+
+inline void LoadCaCertStore(SSL_CTX* ctx, const char* ca_cert, std::size_t size)
+{
+    SetCaCertStore(ctx, CreateCaCertStore(ca_cert, size));
+}
+#endif
+
+} // namespace
+
+class SSLConnectionBackendOpenSSL final : public SSLConnectionBackend {
+public:
+    Result Init() {
+        // on bundled OpenSSL, load ca cert store
+#ifdef YUZU_BUNDLED_OPENSSL
+        LoadCaCertStore(ssl_ctx, kCert, sizeof(kCert));
+#endif
+        std::call_once(one_time_init_flag, OneTimeInit);
+
+        if (!one_time_init_success) {
+            LOG_ERROR(Service_SSL,
+                      "Can't create SSL connection because OpenSSL one-time initialization failed");
+            return ResultInternalError;
+        }
+
+        ssl = SSL_new(ssl_ctx);
+        if (!ssl) {
+            LOG_ERROR(Service_SSL, "SSL_new failed");
+            return CheckOpenSSLErrors();
+        }
+
+        SSL_set_connect_state(ssl);
+
+        bio = BIO_new(bio_meth);
+        if (!bio) {
+            LOG_ERROR(Service_SSL, "BIO_new failed");
+            return CheckOpenSSLErrors();
+        }
+
+        BIO_set_data(bio, this);
+        BIO_set_init(bio, 1);
+        SSL_set_bio(ssl, bio, bio);
+
+        return ResultSuccess;
+    }
+
+    void SetSocket(std::shared_ptr<Network::SocketBase> socket_in) override {
+        socket = std::move(socket_in);
+    }
+
+    Result SetHostName(const std::string& hostname) override {
+        if (!skip_cert_verification) {
+            if (!SSL_set1_host(ssl, hostname.c_str())) {
+                LOG_ERROR(Service_SSL, "SSL_set1_host({}) failed", hostname);
+                return CheckOpenSSLErrors();
+            }
+        }
+        if (!SSL_set_tlsext_host_name(ssl, hostname.c_str())) { // hostname for SNI
+            LOG_ERROR(Service_SSL, "SSL_set_tlsext_host_name({}) failed", hostname);
+            return CheckOpenSSLErrors();
+        }
+        return ResultSuccess;
+    }
+
+    void SetVerifyOption(u32 option) override {
+        skip_cert_verification = (option == 0);
+        LOG_WARNING(Service_SSL, "option={} skip_verification={}", option,
+                    skip_cert_verification);
+        if (skip_cert_verification) {
+            SSL_set_verify(ssl, SSL_VERIFY_NONE, nullptr);
+            SSL_set1_host(ssl, nullptr);
+            SSL_set_hostflags(ssl, 0);
+        } else {
+            SSL_set_verify(ssl, SSL_VERIFY_PEER, nullptr);
+        }
+    }
+
+    Result DoHandshake() override {
+        SSL_set_verify_result(ssl, X509_V_OK);
+        const int ret = SSL_do_handshake(ssl);
+
+        if (!skip_cert_verification) {
+            const long verify_result = SSL_get_verify_result(ssl);
+            if (verify_result != X509_V_OK) {
+                LOG_ERROR(Service_SSL, "SSL cert verification failed because: {}",
+                          X509_verify_cert_error_string(verify_result));
+                return CheckOpenSSLErrors();
+            }
+        }
+
+        if (ret <= 0) {
+            const int ssl_err = SSL_get_error(ssl, ret);
+            if (ssl_err == SSL_ERROR_ZERO_RETURN ||
+                (ssl_err == SSL_ERROR_SYSCALL && got_read_eof)) {
+                LOG_ERROR(Service_SSL, "SSL handshake failed because server hung up");
+                return ResultInternalError;
+            }
+        }
+        return HandleReturn("SSL_do_handshake", 0, ret);
+    }
+
+    Result Read(size_t* out_size, std::span<u8> data) override {
+        const int ret = SSL_read_ex(ssl, data.data(), data.size(), out_size);
+        return HandleReturn("SSL_read_ex", out_size, ret);
+    }
+
+    Result Write(size_t* out_size, std::span<const u8> data) override {
+        const int ret = SSL_write_ex(ssl, data.data(), data.size(), out_size);
+        return HandleReturn("SSL_write_ex", out_size, ret);
+    }
+
+    Result HandleReturn(const char* what, size_t* actual, int ret) {
+        const int ssl_err = SSL_get_error(ssl, ret);
+        CheckOpenSSLErrors();
+        switch (ssl_err) {
+        case SSL_ERROR_NONE:
+            return ResultSuccess;
+        case SSL_ERROR_ZERO_RETURN:
+            LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_ZERO_RETURN", what);
+            // DoHandshake special-cases this, but for Read and Write:
+            *actual = 0;
+            return ResultSuccess;
+        case SSL_ERROR_WANT_READ:
+            LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_WANT_READ", what);
+            return ResultWouldBlock;
+        case SSL_ERROR_WANT_WRITE:
+            LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_WANT_WRITE", what);
+            return ResultWouldBlock;
+        default:
+            if (ssl_err == SSL_ERROR_SYSCALL && got_read_eof) {
+                LOG_DEBUG(Service_SSL, "{} => SSL_ERROR_SYSCALL because server hung up", what);
+                *actual = 0;
+                return ResultSuccess;
+            }
+            LOG_ERROR(Service_SSL, "{} => other SSL_get_error return value {}", what, ssl_err);
+            return ResultInternalError;
+        }
+    }
+
+    Result GetServerCerts(std::vector<std::vector<u8>>* out_certs) override {
+        STACK_OF(X509)* chain = SSL_get_peer_cert_chain(ssl);
+        if (!chain) {
+            LOG_ERROR(Service_SSL, "SSL_get_peer_cert_chain returned nullptr");
+            return ResultInternalError;
+        }
+        int count = sk_X509_num(chain);
+        ASSERT(count >= 0);
+        for (int i = 0; i < count; i++) {
+            X509* x509 = sk_X509_value(chain, i);
+            ASSERT_OR_EXECUTE(x509 != nullptr, { continue; });
+            unsigned char* buf = nullptr;
+            int len = i2d_X509(x509, &buf);
+            ASSERT_OR_EXECUTE(len >= 0 && buf, { continue; });
+            out_certs->emplace_back(buf, buf + len);
+            OPENSSL_free(buf);
+        }
+        return ResultSuccess;
+    }
+
+    ~SSLConnectionBackendOpenSSL() {
+        // this is null-tolerant:
+        SSL_free(ssl);
+    }
+
+    static void KeyLogCallback(const SSL* ssl, const char* line) {
+        std::string str(line);
+        str.push_back('\n');
+        // Do this in a single WriteString for atomicity if multiple instances
+        // are running on different threads (though that can't currently
+        // happen).
+        if (key_log_file.WriteString(str) != str.size() || !key_log_file.Flush()) {
+            LOG_CRITICAL(Service_SSL, "Failed to write to SSLKEYLOGFILE");
+        }
+        LOG_DEBUG(Service_SSL, "Wrote to SSLKEYLOGFILE: {}", line);
+    }
+
+    static int WriteCallback(BIO* bio, const char* buf, size_t len, size_t* actual_p) {
+        auto self = static_cast<SSLConnectionBackendOpenSSL*>(BIO_get_data(bio));
+        ASSERT_OR_EXECUTE_MSG(
+            self->socket, { return 0; }, "OpenSSL asked to send but we have no socket");
+        BIO_clear_retry_flags(bio);
+        auto [actual, err] = self->socket->Send({reinterpret_cast<const u8*>(buf), len}, 0);
+        switch (err) {
+        case Network::Errno::SUCCESS:
+            *actual_p = actual;
+            return 1;
+        case Network::Errno::AGAIN:
+            BIO_set_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
+            return 0;
+        default:
+            LOG_ERROR(Service_SSL, "Socket send returned Network::Errno {}", err);
+            return -1;
+        }
+    }
+
+    static int ReadCallback(BIO* bio, char* buf, size_t len, size_t* actual_p) {
+        auto self = static_cast<SSLConnectionBackendOpenSSL*>(BIO_get_data(bio));
+        ASSERT_OR_EXECUTE_MSG(
+            self->socket, { return 0; }, "OpenSSL asked to recv but we have no socket");
+        BIO_clear_retry_flags(bio);
+        auto [actual, err] = self->socket->Recv(0, {reinterpret_cast<u8*>(buf), len});
+        switch (err) {
+        case Network::Errno::SUCCESS:
+            *actual_p = actual;
+            if (actual == 0) {
+                self->got_read_eof = true;
+            }
+            return actual ? 1 : 0;
+        case Network::Errno::AGAIN:
+            BIO_set_flags(bio, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
+            return 0;
+        default:
+            LOG_ERROR(Service_SSL, "Socket recv returned Network::Errno {}", err);
+            return -1;
+        }
+    }
+
+    static long CtrlCallback(BIO* bio, int cmd, long l_arg, void* p_arg) {
+        switch (cmd) {
+        case BIO_CTRL_FLUSH:
+            // Nothing to flush.
+            return 1;
+        case BIO_CTRL_PUSH:
+        case BIO_CTRL_POP:
+#ifdef BIO_CTRL_GET_KTLS_SEND
+        case BIO_CTRL_GET_KTLS_SEND:
+        case BIO_CTRL_GET_KTLS_RECV:
+#endif
+            // We don't support these operations, but don't bother logging them
+            // as they're nothing unusual.
+            return 0;
+        default:
+            LOG_DEBUG(Service_SSL, "OpenSSL BIO got ctrl({}, {}, {})", cmd, l_arg, p_arg);
+            return 0;
+        }
+    }
+
+    SSL* ssl = nullptr;
+    BIO* bio = nullptr;
+    bool got_read_eof = false;
+    bool skip_cert_verification = false;
+
+    std::shared_ptr<Network::SocketBase> socket;
+};
+
+Result CreateSSLConnectionBackend(std::unique_ptr<SSLConnectionBackend>* out_backend) {
+    auto conn = std::make_unique<SSLConnectionBackendOpenSSL>();
+
+    R_TRY(conn->Init());
+
+    *out_backend = std::move(conn);
+    return ResultSuccess;
+}
+
+namespace {
+
+Result CheckOpenSSLErrors() {
+    unsigned long rc;
+    const char* file;
+    int line;
+    const char* func;
+    const char* data;
+    int flags;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    while ((rc = ERR_get_error_all(&file, &line, &func, &data, &flags)))
+#else
+    // Can't get function names from OpenSSL on this version, so use mine:
+    func = __func__;
+    while ((rc = ERR_get_error_line_data(&file, &line, &data, &flags)))
+#endif
+    {
+        std::string msg;
+        msg.resize(1024, '\0');
+        ERR_error_string_n(rc, msg.data(), msg.size());
+        msg.resize(strlen(msg.data()), '\0');
+        if (flags & ERR_TXT_STRING) {
+            msg.append(" | ");
+            msg.append(data);
+        }
+        Common::Log::FmtLogMessage(Common::Log::Class::Service_SSL, Common::Log::Level::Error,
+                                   file, line, func, "OpenSSL: {}",
+                                   msg);
+    }
+    return ResultInternalError;
+}
+
+void OneTimeInit() {
+    ssl_ctx = SSL_CTX_new(TLS_client_method());
+    if (!ssl_ctx) {
+        LOG_ERROR(Service_SSL, "SSL_CTX_new failed");
+        CheckOpenSSLErrors();
+        return;
+    }
+
+    SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, nullptr);
+
+    if (!SSL_CTX_set_default_verify_paths(ssl_ctx)) {
+        LOG_ERROR(Service_SSL, "SSL_CTX_set_default_verify_paths failed");
+        CheckOpenSSLErrors();
+        return;
+    }
+
+    OneTimeInitLogFile();
+
+    if (!OneTimeInitBIO()) {
+        return;
+    }
+
+    one_time_init_success = true;
+}
+
+void OneTimeInitLogFile() {
+    const char* logfile = getenv("SSLKEYLOGFILE");
+    if (logfile) {
+        key_log_file.Open(logfile, FileAccessMode::Append, FileType::TextFile,
+                          FileShareFlag::ShareWriteOnly);
+        if (key_log_file.IsOpen()) {
+            SSL_CTX_set_keylog_callback(ssl_ctx, &SSLConnectionBackendOpenSSL::KeyLogCallback);
+        } else {
+            LOG_CRITICAL(Service_SSL,
+                         "SSLKEYLOGFILE was set but file could not be opened; not logging keys!");
+        }
+    }
+}
+
+bool OneTimeInitBIO() {
+    bio_meth =
+        BIO_meth_new(BIO_get_new_index() | BIO_TYPE_SOURCE_SINK, "SSLConnectionBackendOpenSSL");
+    if (!bio_meth ||
+        !BIO_meth_set_write_ex(bio_meth, &SSLConnectionBackendOpenSSL::WriteCallback) ||
+        !BIO_meth_set_read_ex(bio_meth, &SSLConnectionBackendOpenSSL::ReadCallback) ||
+        !BIO_meth_set_ctrl(bio_meth, &SSLConnectionBackendOpenSSL::CtrlCallback)) {
+        LOG_ERROR(Service_SSL, "Failed to create BIO_METHOD");
+        return false;
+    }
+    return true;
+}
+
+} // namespace
+
+} // namespace Service::SSL

src/core/hle/service/ssl/ssl_backend_schannel.cpp

@@ -0,0 +1,563 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// SPDX-FileCopyrightText: Copyright 2023 yuzu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <mutex>
+
+#include "common/error.h"
+#include "common/fs/file.h"
+#include "common/hex_util.h"
+#include "common/string_util.h"
+
+#include "core/hle/service/ssl/ssl_backend.h"
+#include "core/internal_network/network.h"
+#include "core/internal_network/sockets.h"
+
+namespace {
+
+// These includes are inside the namespace to avoid a conflict on MinGW where
+// the headers define an enum containing Network and Service as enumerators
+// (which clash with the correspondingly named namespaces).
+#define SECURITY_WIN32
+#include <schnlsp.h>
+#include <security.h>
+#include <wincrypt.h>
+
+std::once_flag one_time_init_flag;
+bool one_time_init_success = false;
+
+SCHANNEL_CRED schannel_cred{};
+CredHandle cred_handle;
+
+static void OneTimeInit() {
+    schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
+    schannel_cred.dwFlags =
+        SCH_USE_STRONG_CRYPTO |        // don't allow insecure protocols
+        SCH_CRED_NO_SERVERNAME_CHECK | // don't validate server names
+        SCH_CRED_NO_DEFAULT_CREDS;     // don't automatically present a client certificate
+    // ^ I'm assuming that nobody would want to connect Yuzu to a
+    // service that requires some OS-provided corporate client
+    // certificate, and presenting one to some arbitrary server
+    // might be a privacy concern?  Who knows, though.
+
+    const SECURITY_STATUS ret =
+        AcquireCredentialsHandle(nullptr, const_cast<LPTSTR>(UNISP_NAME), SECPKG_CRED_OUTBOUND,
+                                 nullptr, &schannel_cred, nullptr, nullptr, &cred_handle, nullptr);
+    if (ret != SEC_E_OK) {
+        // SECURITY_STATUS codes are a type of HRESULT and can be used with NativeErrorToString.
+        LOG_ERROR(Service_SSL, "AcquireCredentialsHandle failed: {}",
+                  Common::NativeErrorToString(ret));
+        return;
+    }
+
+    if (getenv("SSLKEYLOGFILE")) {
+        LOG_CRITICAL(Service_SSL, "SSLKEYLOGFILE was set but Schannel does not support exporting "
+                                  "keys; not logging keys!");
+        // Not fatal.
+    }
+
+    one_time_init_success = true;
+}
+
+} // namespace
+
+namespace Service::SSL {
+
+class SSLConnectionBackendSchannel final : public SSLConnectionBackend {
+public:
+    Result Init() {
+        std::call_once(one_time_init_flag, OneTimeInit);
+
+        if (!one_time_init_success) {
+            LOG_ERROR(
+                Service_SSL,
+                "Can't create SSL connection because Schannel one-time initialization failed");
+            return ResultInternalError;
+        }
+
+        return ResultSuccess;
+    }
+
+    void SetSocket(std::shared_ptr<Network::SocketBase> socket_in) override {
+        socket = std::move(socket_in);
+    }
+
+    Result SetHostName(const std::string& hostname_in) override {
+        hostname = hostname_in;
+        return ResultSuccess;
+    }
+
+    void SetVerifyOption(u32 option) override {
+        skip_cert_verification = (option == 0);
+        LOG_WARNING(Service_SSL, "option={} skip_verification={}", option,
+                    skip_cert_verification);
+    }
+
+    Result DoHandshake() override {
+        while (1) {
+            Result r;
+            switch (handshake_state) {
+            case HandshakeState::Initial:
+                if ((r = FlushCiphertextWriteBuf()) != ResultSuccess ||
+                    (r = CallInitializeSecurityContext()) != ResultSuccess) {
+                    return r;
+                }
+                // CallInitializeSecurityContext updated `handshake_state`.
+                continue;
+            case HandshakeState::ContinueNeeded:
+            case HandshakeState::IncompleteMessage:
+                if ((r = FlushCiphertextWriteBuf()) != ResultSuccess ||
+                    (r = FillCiphertextReadBuf()) != ResultSuccess) {
+                    return r;
+                }
+                if (ciphertext_read_buf.empty()) {
+                    LOG_ERROR(Service_SSL, "SSL handshake failed because server hung up");
+                    return ResultInternalError;
+                }
+                if ((r = CallInitializeSecurityContext()) != ResultSuccess) {
+                    return r;
+                }
+                // CallInitializeSecurityContext updated `handshake_state`.
+                continue;
+            case HandshakeState::DoneAfterFlush:
+                if ((r = FlushCiphertextWriteBuf()) != ResultSuccess) {
+                    return r;
+                }
+                handshake_state = HandshakeState::Connected;
+                return ResultSuccess;
+            case HandshakeState::Connected:
+                LOG_ERROR(Service_SSL, "Called DoHandshake but we already handshook");
+                return ResultInternalError;
+            case HandshakeState::Error:
+                return ResultInternalError;
+            }
+        }
+    }
+
+    Result FillCiphertextReadBuf() {
+        const size_t fill_size = read_buf_fill_size ? read_buf_fill_size : 4096;
+        read_buf_fill_size = 0;
+        // This unnecessarily zeroes the buffer; oh well.
+        const size_t offset = ciphertext_read_buf.size();
+        ASSERT_OR_EXECUTE(offset + fill_size >= offset, { return ResultInternalError; });
+        ciphertext_read_buf.resize(offset + fill_size, 0);
+        const auto read_span = std::span(ciphertext_read_buf).subspan(offset, fill_size);
+        const auto [actual, err] = socket->Recv(0, read_span);
+        switch (err) {
+        case Network::Errno::SUCCESS:
+            ASSERT(static_cast<size_t>(actual) <= fill_size);
+            ciphertext_read_buf.resize(offset + actual);
+            return ResultSuccess;
+        case Network::Errno::AGAIN:
+            ciphertext_read_buf.resize(offset);
+            return ResultWouldBlock;
+        default:
+            ciphertext_read_buf.resize(offset);
+            LOG_ERROR(Service_SSL, "Socket recv returned Network::Errno {}", err);
+            return ResultInternalError;
+        }
+    }
+
+    // Returns success if the write buffer has been completely emptied.
+    Result FlushCiphertextWriteBuf() {
+        while (!ciphertext_write_buf.empty()) {
+            const auto [actual, err] = socket->Send(ciphertext_write_buf, 0);
+            switch (err) {
+            case Network::Errno::SUCCESS:
+                ASSERT(static_cast<size_t>(actual) <= ciphertext_write_buf.size());
+                ciphertext_write_buf.erase(ciphertext_write_buf.begin(),
+                                           ciphertext_write_buf.begin() + actual);
+                break;
+            case Network::Errno::AGAIN:
+                return ResultWouldBlock;
+            default:
+                LOG_ERROR(Service_SSL, "Socket send returned Network::Errno {}", err);
+                return ResultInternalError;
+            }
+        }
+        return ResultSuccess;
+    }
+
+    Result CallInitializeSecurityContext() {
+        unsigned long req = ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_CONFIDENTIALITY |
+                            ISC_REQ_INTEGRITY | ISC_REQ_REPLAY_DETECT |
+                            ISC_REQ_SEQUENCE_DETECT | ISC_REQ_STREAM |
+                            ISC_REQ_USE_SUPPLIED_CREDS;
+
+        if (skip_cert_verification) {
+            req |= ISC_REQ_MANUAL_CRED_VALIDATION;
+        }
+
+        unsigned long attr;
+        // https://learn.microsoft.com/en-us/windows/win32/secauthn/initializesecuritycontext--schannel
+        std::array<SecBuffer, 2> input_buffers{{
+            // only used if `initial_call_done`
+            {
+                // [0]
+                .cbBuffer = static_cast<unsigned long>(ciphertext_read_buf.size()),
+                .BufferType = SECBUFFER_TOKEN,
+                .pvBuffer = ciphertext_read_buf.data(),
+            },
+            {
+                // [1] (will be replaced by SECBUFFER_MISSING when SEC_E_INCOMPLETE_MESSAGE is
+                //     returned, or SECBUFFER_EXTRA when SEC_E_CONTINUE_NEEDED is returned if the
+                //     whole buffer wasn't used)
+                .cbBuffer = 0,
+                .BufferType = SECBUFFER_EMPTY,
+                .pvBuffer = nullptr,
+            },
+        }};
+        std::array<SecBuffer, 2> output_buffers{{
+            {
+                .cbBuffer = 0,
+                .BufferType = SECBUFFER_TOKEN,
+                .pvBuffer = nullptr,
+            }, // [0]
+            {
+                .cbBuffer = 0,
+                .BufferType = SECBUFFER_ALERT,
+                .pvBuffer = nullptr,
+            }, // [1]
+        }};
+        SecBufferDesc input_desc{
+            .ulVersion = SECBUFFER_VERSION,
+            .cBuffers = static_cast<unsigned long>(input_buffers.size()),
+            .pBuffers = input_buffers.data(),
+        };
+        SecBufferDesc output_desc{
+            .ulVersion = SECBUFFER_VERSION,
+            .cBuffers = static_cast<unsigned long>(output_buffers.size()),
+            .pBuffers = output_buffers.data(),
+        };
+        ASSERT_OR_EXECUTE_MSG(
+            input_buffers[0].cbBuffer == ciphertext_read_buf.size(),
+            { return ResultInternalError; }, "read buffer too large");
+
+        bool initial_call_done = handshake_state != HandshakeState::Initial;
+        if (initial_call_done) {
+            LOG_DEBUG(Service_SSL, "Passing {} bytes into InitializeSecurityContext",
+                      ciphertext_read_buf.size());
+        }
+
+        char* hostname_ptr = hostname ? const_cast<char*>(hostname->c_str()) : nullptr;
+        const SECURITY_STATUS ret = InitializeSecurityContextA(
+            &cred_handle, initial_call_done ? &ctxt : nullptr, hostname_ptr, req,
+            0, // Reserved1
+            0, // TargetDataRep not used with Schannel
+            initial_call_done ? &input_desc : nullptr,
+            0, // Reserved2
+            initial_call_done ? nullptr : &ctxt, &output_desc, &attr,
+            nullptr); // ptsExpiry
+
+        if (output_buffers[0].pvBuffer) {
+            const std::span span(static_cast<u8*>(output_buffers[0].pvBuffer),
+                                 output_buffers[0].cbBuffer);
+            ciphertext_write_buf.insert(ciphertext_write_buf.end(), span.begin(), span.end());
+            FreeContextBuffer(output_buffers[0].pvBuffer);
+        }
+
+        if (output_buffers[1].pvBuffer) {
+            const std::span span(static_cast<u8*>(output_buffers[1].pvBuffer),
+                                 output_buffers[1].cbBuffer);
+            // The documentation doesn't explain what format this data is in.
+            LOG_DEBUG(Service_SSL, "Got a {}-byte alert buffer: {}", span.size(),
+                      Common::HexToString(span));
+        }
+
+        switch (ret) {
+        case SEC_I_CONTINUE_NEEDED:
+            LOG_DEBUG(Service_SSL, "InitializeSecurityContext => SEC_I_CONTINUE_NEEDED");
+            if (input_buffers[1].BufferType == SECBUFFER_EXTRA) {
+                LOG_DEBUG(Service_SSL, "EXTRA of size {}", input_buffers[1].cbBuffer);
+                ASSERT(input_buffers[1].cbBuffer <= ciphertext_read_buf.size());
+                ciphertext_read_buf.erase(ciphertext_read_buf.begin(),
+                                          ciphertext_read_buf.end() - input_buffers[1].cbBuffer);
+            } else {
+                ASSERT(input_buffers[1].BufferType == SECBUFFER_EMPTY);
+                ciphertext_read_buf.clear();
+            }
+            handshake_state = HandshakeState::ContinueNeeded;
+            return ResultSuccess;
+        case SEC_E_INCOMPLETE_MESSAGE:
+            LOG_DEBUG(Service_SSL, "InitializeSecurityContext => SEC_E_INCOMPLETE_MESSAGE");
+            ASSERT(input_buffers[1].BufferType == SECBUFFER_MISSING);
+            read_buf_fill_size = input_buffers[1].cbBuffer;
+            handshake_state = HandshakeState::IncompleteMessage;
+            return ResultSuccess;
+        case SEC_E_OK:
+            LOG_DEBUG(Service_SSL, "InitializeSecurityContext => SEC_E_OK");
+            ciphertext_read_buf.clear();
+            handshake_state = HandshakeState::DoneAfterFlush;
+            return GrabStreamSizes();
+        default:
+            LOG_ERROR(Service_SSL,
+                      "InitializeSecurityContext failed (probably certificate/protocol issue): {}",
+                      Common::NativeErrorToString(ret));
+            handshake_state = HandshakeState::Error;
+            return ResultInternalError;
+        }
+    }
+
+    Result GrabStreamSizes() {
+        const SECURITY_STATUS ret =
+            QueryContextAttributes(&ctxt, SECPKG_ATTR_STREAM_SIZES, &stream_sizes);
+        if (ret != SEC_E_OK) {
+            LOG_ERROR(Service_SSL, "QueryContextAttributes(SECPKG_ATTR_STREAM_SIZES) failed: {}",
+                      Common::NativeErrorToString(ret));
+            handshake_state = HandshakeState::Error;
+            return ResultInternalError;
+        }
+        return ResultSuccess;
+    }
+
+    Result Read(size_t* out_size, std::span<u8> data) override {
+        *out_size = 0;
+        if (handshake_state != HandshakeState::Connected) {
+            LOG_ERROR(Service_SSL, "Called Read but we did not successfully handshake");
+            return ResultInternalError;
+        }
+        if (data.size() == 0 || got_read_eof) {
+            return ResultSuccess;
+        }
+        while (1) {
+            if (!cleartext_read_buf.empty()) {
+                *out_size = (std::min)(cleartext_read_buf.size(), data.size());
+                std::memcpy(data.data(), cleartext_read_buf.data(), *out_size);
+                cleartext_read_buf.erase(cleartext_read_buf.begin(),
+                                         cleartext_read_buf.begin() + *out_size);
+                return ResultSuccess;
+            }
+            if (!ciphertext_read_buf.empty()) {
+                SecBuffer empty{
+                    .cbBuffer = 0,
+                    .BufferType = SECBUFFER_EMPTY,
+                    .pvBuffer = nullptr,
+                };
+                std::array<SecBuffer, 5> buffers{{
+                    {
+                        .cbBuffer = static_cast<unsigned long>(ciphertext_read_buf.size()),
+                        .BufferType = SECBUFFER_DATA,
+                        .pvBuffer = ciphertext_read_buf.data(),
+                    },
+                    empty,
+                    empty,
+                    empty,
+                }};
+                ASSERT_OR_EXECUTE_MSG(
+                    buffers[0].cbBuffer == ciphertext_read_buf.size(),
+                    { return ResultInternalError; }, "read buffer too large");
+                SecBufferDesc desc{
+                    .ulVersion = SECBUFFER_VERSION,
+                    .cBuffers = static_cast<unsigned long>(buffers.size()),
+                    .pBuffers = buffers.data(),
+                };
+                SECURITY_STATUS ret =
+                    DecryptMessage(&ctxt, &desc, /*MessageSeqNo*/ 0, /*pfQOP*/ nullptr);
+                switch (ret) {
+                case SEC_E_OK:
+                    ASSERT_OR_EXECUTE(buffers[0].BufferType == SECBUFFER_STREAM_HEADER,
+                                      { return ResultInternalError; });
+                    ASSERT_OR_EXECUTE(buffers[1].BufferType == SECBUFFER_DATA,
+                                      { return ResultInternalError; });
+                    ASSERT_OR_EXECUTE(buffers[2].BufferType == SECBUFFER_STREAM_TRAILER,
+                                      { return ResultInternalError; });
+                    cleartext_read_buf.assign(static_cast<u8*>(buffers[1].pvBuffer),
+                                              static_cast<u8*>(buffers[1].pvBuffer) +
+                                                  buffers[1].cbBuffer);
+                    if (buffers[3].BufferType == SECBUFFER_EXTRA) {
+                        ASSERT(buffers[3].cbBuffer <= ciphertext_read_buf.size());
+                        ciphertext_read_buf.erase(ciphertext_read_buf.begin(),
+                                                  ciphertext_read_buf.end() - buffers[3].cbBuffer);
+                    } else {
+                        ASSERT(buffers[3].BufferType == SECBUFFER_EMPTY);
+                        ciphertext_read_buf.clear();
+                    }
+                    continue;
+                case SEC_E_INCOMPLETE_MESSAGE:
+                    break;
+                case SEC_I_CONTEXT_EXPIRED:
+                    // Server hung up by sending close_notify.
+                    got_read_eof = true;
+                    *out_size = 0;
+                    return ResultSuccess;
+                default:
+                    LOG_ERROR(Service_SSL, "DecryptMessage failed: {}",
+                              Common::NativeErrorToString(ret));
+                    return ResultInternalError;
+                }
+            }
+            const Result r = FillCiphertextReadBuf();
+            if (r != ResultSuccess) {
+                return r;
+            }
+            if (ciphertext_read_buf.empty()) {
+                got_read_eof = true;
+                *out_size = 0;
+                return ResultSuccess;
+            }
+        }
+    }
+
+    Result Write(size_t* out_size, std::span<const u8> data) override {
+        *out_size = 0;
+
+        if (handshake_state != HandshakeState::Connected) {
+            LOG_ERROR(Service_SSL, "Called Write but we did not successfully handshake");
+            return ResultInternalError;
+        }
+        if (data.size() == 0) {
+            return ResultSuccess;
+        }
+        data = data.subspan(0, std::min<size_t>(data.size(), stream_sizes.cbMaximumMessage));
+        if (!cleartext_write_buf.empty()) {
+            // Already in the middle of a write.  It wouldn't make sense to not
+            // finish sending the entire buffer since TLS has
+            // header/MAC/padding/etc.
+            if (data.size() != cleartext_write_buf.size() ||
+                std::memcmp(data.data(), cleartext_write_buf.data(), data.size())) {
+                LOG_ERROR(Service_SSL, "Called Write but buffer does not match previous buffer");
+                return ResultInternalError;
+            }
+            return WriteAlreadyEncryptedData(out_size);
+        } else {
+            cleartext_write_buf.assign(data.begin(), data.end());
+        }
+
+        std::vector<u8> header_buf(stream_sizes.cbHeader, 0);
+        std::vector<u8> tmp_data_buf = cleartext_write_buf;
+        std::vector<u8> trailer_buf(stream_sizes.cbTrailer, 0);
+
+        std::array<SecBuffer, 3> buffers{{
+            {
+                .cbBuffer = stream_sizes.cbHeader,
+                .BufferType = SECBUFFER_STREAM_HEADER,
+                .pvBuffer = header_buf.data(),
+            },
+            {
+                .cbBuffer = static_cast<unsigned long>(tmp_data_buf.size()),
+                .BufferType = SECBUFFER_DATA,
+                .pvBuffer = tmp_data_buf.data(),
+            },
+            {
+                .cbBuffer = stream_sizes.cbTrailer,
+                .BufferType = SECBUFFER_STREAM_TRAILER,
+                .pvBuffer = trailer_buf.data(),
+            },
+        }};
+        ASSERT_OR_EXECUTE_MSG(
+            buffers[1].cbBuffer == tmp_data_buf.size(), { return ResultInternalError; },
+            "temp buffer too large");
+        SecBufferDesc desc{
+            .ulVersion = SECBUFFER_VERSION,
+            .cBuffers = static_cast<unsigned long>(buffers.size()),
+            .pBuffers = buffers.data(),
+        };
+
+        const SECURITY_STATUS ret = EncryptMessage(&ctxt, /*fQOP*/ 0, &desc, /*MessageSeqNo*/ 0);
+        if (ret != SEC_E_OK) {
+            LOG_ERROR(Service_SSL, "EncryptMessage failed: {}", Common::NativeErrorToString(ret));
+            return ResultInternalError;
+        }
+        ciphertext_write_buf.insert(ciphertext_write_buf.end(), header_buf.begin(),
+                                    header_buf.end());
+        ciphertext_write_buf.insert(ciphertext_write_buf.end(), tmp_data_buf.begin(),
+                                    tmp_data_buf.end());
+        ciphertext_write_buf.insert(ciphertext_write_buf.end(), trailer_buf.begin(),
+                                    trailer_buf.end());
+        return WriteAlreadyEncryptedData(out_size);
+    }
+
+    Result WriteAlreadyEncryptedData(size_t* out_size) {
+        const Result r = FlushCiphertextWriteBuf();
+        if (r != ResultSuccess) {
+            return r;
+        }
+        // write buf is empty
+        *out_size = cleartext_write_buf.size();
+        cleartext_write_buf.clear();
+        return ResultSuccess;
+    }
+
+    Result GetServerCerts(std::vector<std::vector<u8>>* out_certs) override {
+        PCCERT_CONTEXT returned_cert = nullptr;
+        const SECURITY_STATUS ret =
+            QueryContextAttributes(&ctxt, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &returned_cert);
+        if (ret != SEC_E_OK) {
+            LOG_ERROR(Service_SSL,
+                      "QueryContextAttributes(SECPKG_ATTR_REMOTE_CERT_CONTEXT) failed: {}",
+                      Common::NativeErrorToString(ret));
+            return ResultInternalError;
+        }
+        PCCERT_CONTEXT some_cert = nullptr;
+        while ((some_cert = CertEnumCertificatesInStore(returned_cert->hCertStore, some_cert)) !=
+               nullptr) {
+            out_certs->emplace_back(static_cast<u8*>(some_cert->pbCertEncoded),
+                                    static_cast<u8*>(some_cert->pbCertEncoded) +
+                                        some_cert->cbCertEncoded);
+        }
+        std::reverse(out_certs->begin(),
+                     out_certs->end()); // Windows returns certs in reverse order from what we want
+        CertFreeCertificateContext(returned_cert);
+        return ResultSuccess;
+    }
+
+    ~SSLConnectionBackendSchannel() {
+        if (handshake_state != HandshakeState::Initial) {
+            DeleteSecurityContext(&ctxt);
+        }
+    }
+
+    enum class HandshakeState {
+        // Haven't called anything yet.
+        Initial,
+        // `SEC_I_CONTINUE_NEEDED` was returned by
+        // `InitializeSecurityContext`; must finish sending data (if any) in
+        // the write buffer, then read at least one byte before calling
+        // `InitializeSecurityContext` again.
+        ContinueNeeded,
+        // `SEC_E_INCOMPLETE_MESSAGE` was returned by
+        // `InitializeSecurityContext`; hopefully the write buffer is empty;
+        // must read at least one byte before calling
+        // `InitializeSecurityContext` again.
+        IncompleteMessage,
+        // `SEC_E_OK` was returned by `InitializeSecurityContext`; must
+        // finish sending data in the write buffer before having `DoHandshake`
+        // report success.
+        DoneAfterFlush,
+        // We finished the above and are now connected.  At this point, writing
+        // and reading are separate 'state machines' represented by the
+        // nonemptiness of the ciphertext and cleartext read and write buffers.
+        Connected,
+        // Another error was returned and we shouldn't allow initialization
+        // to continue.
+        Error,
+    } handshake_state = HandshakeState::Initial;
+
+    CtxtHandle ctxt;
+    SecPkgContext_StreamSizes stream_sizes;
+
+    std::shared_ptr<Network::SocketBase> socket;
+    std::optional<std::string> hostname;
+
+    std::vector<u8> ciphertext_read_buf;
+    std::vector<u8> ciphertext_write_buf;
+    std::vector<u8> cleartext_read_buf;
+    std::vector<u8> cleartext_write_buf;
+
+    bool got_read_eof = false;
+    bool skip_cert_verification = false;
+    size_t read_buf_fill_size = 0;
+};
+
+Result CreateSSLConnectionBackend(std::unique_ptr<SSLConnectionBackend>* out_backend) {
+    auto conn = std::make_unique<SSLConnectionBackendSchannel>();
+
+    R_TRY(conn->Init());
+
+    *out_backend = std::move(conn);
+    return ResultSuccess;
+}
+
+} // namespace Service::SSL

src/core/hle/service/ssl/ssl_backend_securetransport.cpp

@@ -0,0 +1,236 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// SPDX-FileCopyrightText: Copyright 2023 yuzu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <mutex>
+
+// SecureTransport has been deprecated in its entirety in favor of
+// Network.framework, but that does not allow layering TLS on top of an
+// arbitrary socket.
+#if defined(__GNUC__) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#include <Security/SecureTransport.h>
+#pragma GCC diagnostic pop
+#endif
+
+#include "core/hle/service/ssl/ssl_backend.h"
+#include "core/internal_network/network.h"
+#include "core/internal_network/sockets.h"
+
+namespace {
+
+template <typename T>
+struct CFReleaser {
+    T ptr;
+
+    YUZU_NON_COPYABLE(CFReleaser);
+    constexpr CFReleaser() : ptr(nullptr) {}
+    constexpr CFReleaser(T ptr) : ptr(ptr) {}
+    constexpr operator T() {
+        return ptr;
+    }
+    ~CFReleaser() {
+        if (ptr) {
+            CFRelease(ptr);
+        }
+    }
+};
+
+std::string CFStringToString(CFStringRef cfstr) {
+    CFReleaser<CFDataRef> cfdata(
+        CFStringCreateExternalRepresentation(nullptr, cfstr, kCFStringEncodingUTF8, 0));
+    ASSERT_OR_EXECUTE(cfdata, { return "???"; });
+    return std::string(reinterpret_cast<const char*>(CFDataGetBytePtr(cfdata)),
+                       CFDataGetLength(cfdata));
+}
+
+std::string OSStatusToString(OSStatus status) {
+    CFReleaser<CFStringRef> cfstr(SecCopyErrorMessageString(status, nullptr));
+    if (!cfstr) {
+        return "[unknown error]";
+    }
+    return CFStringToString(cfstr);
+}
+
+} // namespace
+
+namespace Service::SSL {
+
+class SSLConnectionBackendSecureTransport final : public SSLConnectionBackend {
+public:
+    Result Init() {
+        static std::once_flag once_flag;
+        std::call_once(once_flag, []() {
+            if (getenv("SSLKEYLOGFILE")) {
+                LOG_CRITICAL(Service_SSL, "SSLKEYLOGFILE was set but SecureTransport does not "
+                                          "support exporting keys; not logging keys!");
+                // Not fatal.
+            }
+        });
+
+        context.ptr = SSLCreateContext(nullptr, kSSLClientSide, kSSLStreamType);
+        if (!context) {
+            LOG_ERROR(Service_SSL, "SSLCreateContext failed");
+            return ResultInternalError;
+        }
+
+        OSStatus status;
+        if ((status = SSLSetIOFuncs(context, ReadCallback, WriteCallback)) ||
+            (status = SSLSetConnection(context, this))) {
+            LOG_ERROR(Service_SSL, "SSLContext initialization failed: {}",
+                      OSStatusToString(status));
+            return ResultInternalError;
+        }
+
+        return ResultSuccess;
+    }
+
+    void SetSocket(std::shared_ptr<Network::SocketBase> in_socket) override {
+        socket = std::move(in_socket);
+    }
+
+    Result SetHostName(const std::string& hostname) override {
+        OSStatus status = SSLSetPeerDomainName(context, hostname.c_str(), hostname.size());
+        if (status) {
+            LOG_ERROR(Service_SSL, "SSLSetPeerDomainName failed: {}", OSStatusToString(status));
+            return ResultInternalError;
+        }
+        return ResultSuccess;
+    }
+
+    void SetVerifyOption(u32 option) override {
+        skip_cert_verification = (option == 0);
+        LOG_WARNING(Service_SSL, "option={} skip_verification={}", option,
+                    skip_cert_verification);
+        if (skip_cert_verification) {
+            SSLSetSessionOption(context, kSSLSessionOptionBreakOnServerAuth, true);
+        }
+    }
+
+    Result DoHandshake() override {
+        OSStatus status = SSLHandshake(context);
+
+        if (skip_cert_verification && status == errSSLServerAuthCompleted) {
+            LOG_DEBUG(Service_SSL, "Skipping certificate verification as requested");
+            status = SSLHandshake(context);
+        }
+
+        return HandleReturn("SSLHandshake", 0, status);
+    }
+
+    Result Read(size_t* out_size, std::span<u8> data) override {
+        OSStatus status = SSLRead(context, data.data(), data.size(), out_size);
+        return HandleReturn("SSLRead", out_size, status);
+    }
+
+    Result Write(size_t* out_size, std::span<const u8> data) override {
+        OSStatus status = SSLWrite(context, data.data(), data.size(), out_size);
+        return HandleReturn("SSLWrite", out_size, status);
+    }
+
+    Result HandleReturn(const char* what, size_t* actual, OSStatus status) {
+        switch (status) {
+        case 0:
+            return ResultSuccess;
+        case errSSLWouldBlock:
+            return ResultWouldBlock;
+        default: {
+            std::string reason;
+            if (got_read_eof) {
+                reason = "server hung up";
+            } else {
+                reason = OSStatusToString(status);
+            }
+            LOG_ERROR(Service_SSL, "{} failed: {}", what, reason);
+            return ResultInternalError;
+        }
+        }
+    }
+
+    Result GetServerCerts(std::vector<std::vector<u8>>* out_certs) override {
+        CFReleaser<SecTrustRef> trust;
+        OSStatus status = SSLCopyPeerTrust(context, &trust.ptr);
+        if (status) {
+            LOG_ERROR(Service_SSL, "SSLCopyPeerTrust failed: {}", OSStatusToString(status));
+            return ResultInternalError;
+        }
+        for (CFIndex i = 0, count = SecTrustGetCertificateCount(trust); i < count; i++) {
+            SecCertificateRef cert = SecTrustGetCertificateAtIndex(trust, i);
+            CFReleaser<CFDataRef> data(SecCertificateCopyData(cert));
+            ASSERT_OR_EXECUTE(data, { return ResultInternalError; });
+            const u8* ptr = CFDataGetBytePtr(data);
+            out_certs->emplace_back(ptr, ptr + CFDataGetLength(data));
+        }
+        return ResultSuccess;
+    }
+
+    static OSStatus ReadCallback(SSLConnectionRef connection, void* data, size_t* dataLength) {
+        return ReadOrWriteCallback(connection, data, dataLength, true);
+    }
+
+    static OSStatus WriteCallback(SSLConnectionRef connection, const void* data,
+                                  size_t* dataLength) {
+        return ReadOrWriteCallback(connection, const_cast<void*>(data), dataLength, false);
+    }
+
+    static OSStatus ReadOrWriteCallback(SSLConnectionRef connection, void* data, size_t* dataLength,
+                                        bool is_read) {
+        auto self =
+            static_cast<SSLConnectionBackendSecureTransport*>(const_cast<void*>(connection));
+        ASSERT_OR_EXECUTE_MSG(
+            self->socket, { return 0; }, "SecureTransport asked to {} but we have no socket",
+            is_read ? "read" : "write");
+
+        // SecureTransport callbacks (unlike OpenSSL BIO callbacks) are
+        // expected to read/write the full requested dataLength or return an
+        // error, so we have to add a loop ourselves.
+        size_t requested_len = *dataLength;
+        size_t offset = 0;
+        while (offset < requested_len) {
+            std::span cur(reinterpret_cast<u8*>(data) + offset, requested_len - offset);
+            auto [actual, err] = is_read ? self->socket->Recv(0, cur) : self->socket->Send(cur, 0);
+            LOG_CRITICAL(Service_SSL, "op={}, offset={} actual={}/{} err={}", is_read, offset,
+                         actual, cur.size(), static_cast<s32>(err));
+            switch (err) {
+            case Network::Errno::SUCCESS:
+                offset += actual;
+                if (actual == 0) {
+                    ASSERT(is_read);
+                    self->got_read_eof = true;
+                    return errSecEndOfData;
+                }
+                break;
+            case Network::Errno::AGAIN:
+                *dataLength = offset;
+                return errSSLWouldBlock;
+            default:
+                LOG_ERROR(Service_SSL, "Socket {} returned Network::Errno {}",
+                          is_read ? "recv" : "send", err);
+                return errSecIO;
+            }
+        }
+        ASSERT(offset == requested_len);
+        return 0;
+    }
+
+private:
+    CFReleaser<SSLContextRef> context = nullptr;
+    bool got_read_eof = false;
+    bool skip_cert_verification = false;
+
+    std::shared_ptr<Network::SocketBase> socket;
+};
+
+Result CreateSSLConnectionBackend(std::unique_ptr<SSLConnectionBackend>* out_backend) {
+    auto conn = std::make_unique<SSLConnectionBackendSecureTransport>();
+
+    R_TRY(conn->Init());
+
+    *out_backend = std::move(conn);
+    return ResultSuccess;
+}
+
+} // namespace Service::SSL