[atharvjairath]

What

Implement SSL_CIPHER_get_bits, SSL_CIPHER_get_name and SSL_CIPHER_get_version in libSceLibreSsl. Callers can now read a cipher's effective key strength, algorithm key size, existing name pointer and protocol label instead of hitting unsupported-export exceptions.

The contract and 88-byte LP64 layout follow LibreSSL 2.5.4 ssl.h and ssl_ciph.c. Published firmware 13.40 measurements identify libSceLibreSsl as 2.5.4; I have not independently verified these three calls or the cipher layout on a console. That limitation is recorded in the library's debt file.

Explicit 64-bit guest fields avoid Windows' 32-bit long layout. The functions preserve the upstream edge cases: null cipher leaves the bits output untouched, a null name field remains null, algorithm bits are written before strength is read when the output aliases the cipher, and protocol lookup tests the full shifted 64-bit ID. TLS 1.2 cipher suites still use the older release's TLSv1/SSLv3 label. No handshake, encryption or certificate-verification behavior is added.

The unchanged progress scanner reports three additional completed exports (libSceLibreSsl: 43 to 46 of 399). This measures implemented functions, not game compatibility. The patch is independent of #10047, #10056 and #10065.

Landing order: #10071 → #10078. The prior #9529 prerequisite has merged and is included in the tested main base. This branch is now a single follow-up directly on main; it has no remaining open prerequisite. Main's ASN.1, ERR, AES, RAND/CRYPTO, digest, DES and X509 work are preserved. The source has 345 pending exports. #10078 carries this exact cipher commit and declares Depends on: #10071.

The public-header review is addressed by replacing the three unknown-signature placeholders in include/Api.hpp with the documented getter signatures. The implementation and fixture include the public umbrella header; duplicate local declarations are removed. Getter bodies and regression assertions are unchanged.

Refreshed after #10005 merged: the five ASN.1 implementations, canonical declarations, both regression modes and functional debt entries are preserved. Getter implementations, signatures and fixtures are byte-identical to the previously tested head; Export.cpp differs only by removal of the five ASN.1 stubs now implemented on main. The pending block is recomputed from source. The unchanged progress scanner still counts 46/399 because it marks functions with unsupported paths as incomplete; its eight entries outside the pending block are the five ASN.1 exports, ERR_remove_thread_state, SHA256 and SHA512_Final.

Tested

Exact tested head: 0390178ba06a360f4c4799725bf0699e3a3c4916; parent: 63a863d3b07f2457ee1210f1abba1c11409cdff5; main base: 63a863d3b07f2457ee1210f1abba1c11409cdff5. Recovery ref: backup/pr-10071-before-asn1-refresh-20261025-1539. Author and committer: atharvjairath <54663702+atharvjairath@users.noreply.github.com>.

• Linux x86-64, Ubuntu 24.04/GCC 13.3 Release under native ARM QEMU 11.0.3: 11/11 pass, 1.52 s total.
• Windows x86-64, WinLibs GCC 15.2.0 UCRT r7 Release through Wine 9/QEMU 11.0.3: 11/11 pass, 36.65 s total.
• The eleven tests cover cipher metadata, ASN.1 conversion/accessors and guest allocator integration, ERR queues, X509 error strings, RAND/CRYPTO runtime, LibreSSL digests, DES, AES, LibreSSL3 digests and constant-time comparison. Cipher null/optional outputs, alias ordering, canaries and 1,280 protocol-ID combinations remain intact.
• Conventions, whitespace checks and the public-header audit pass. Each affected umbrella header also compiles in a standalone Linux translation unit. The implementation and fixtures compile against the canonical declarations on both tested platforms.
• The required overlap scans and manual inspection of 34 current LibreSSL peer payloads found no independent duplicate of these getters. New feat(libSceLibreSsl): implement the RSA public-key calls on the RSA object #10915 adds distinct RSA APIs; feat(libSceLibreSsl): implement EC groups and keys for named curves #10395 refreshed its shared context after ASN.1 landed. feat(libressl): implement cipher metadata queries #10071/feat(libressl): implement X509 extension getters #10078 remain intentionally stacked, and comparisons with their old remote heads are not competing work. All main source, test and debt entries are preserved.
• Windows environment limitation: a previous guest_libressl_runtime run timed out after a Wine/Rosetta fault while using page write watching. Its source, fixture and complete libc match main exactly. The recorded passing Windows matrix sets APS5_NO_WRITE_WATCH=1 for guest_libressl_runtime and guest_libressl_asn1, using the repository's existing diagnostic switch. All assertions and guest allocation/RAND behavior still execute; Windows page write watching itself is not validated by this run. Other tests run without the switch.

The initial Windows cipher-branch run passed 10/11 cases and timed out in guest_libressl_asn1 after fault 0xc000001d at GuestHeap::allocate in libc. An isolated control built from exact main ASN.1 sources/fixture and linked to the identical rebuilt libc, excluding our getter code, reproduced that same fault with default settings and passed with APS5_NO_WRITE_WATCH=1. The final matrix applies this switch only to runtime and ASN.1 conversion; the separate ASN.1 allocator case and all other cases keep default settings. Assertions and production code were not weakened. Native/default Windows page write watching remains unvalidated.

Focused builds use the complete real libraries and libc with repository-pinned dependencies. Native hardware, native Windows desktop, whole-project, title and PS5 console validation were not performed. Full upstream product CI requires maintainer dispatch.

Focused runtime build recipe

Use this CMake project outside the source tree, with the repository-pinned ZArchive, zstd and mbedTLS checkouts under its 3rdparty/ directory (mbedTLS 068ff080b369adfac81509f9b57b2afabaf82dc5, including its pinned framework submodule):

cmake_minimum_required(VERSION 3.20)
project(CipherValidation LANGUAGES CXX)
enable_testing()
set(CMAKE_CXX_STANDARD 20)
set(BUILD_TESTING ON)
set(ANYPS5_SOURCE_ROOT /src CACHE PATH "AnyPS5 source checkout")
set(LIBS_INCLUDE_DIR ${ANYPS5_SOURCE_ROOT}/core/libs)
set(ANYPS5_TEST_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests)
set(ANYPS5_WINDOWS_TEST_EXIT ${ANYPS5_SOURCE_ROOT}/cmake/WindowsTestExit.cpp)
add_compile_options(-ffunction-sections -fdata-sections)
add_link_options(-Wl,--gc-sections)
function(add_test_executable target)
    add_executable(${target} ${ARGN})
    set_target_properties(${target} PROPERTIES RUNTIME_OUTPUT_DIRECTORY "$<1:${ANYPS5_TEST_OUTPUT_DIRECTORY}>")
    if(MINGW)
        target_sources(${target} PRIVATE "${ANYPS5_WINDOWS_TEST_EXIT}")
        target_link_options(${target} PRIVATE LINKER:--wrap=main)
    endif()
endfunction()
function(add_asan_test_options test options)
    if(ANYPS5_ENABLE_ASAN)
        set_property(TEST ${test} APPEND PROPERTY ENVIRONMENT_MODIFICATION "ASAN_OPTIONS=string_append::${options}")
    endif()
endfunction()
function(configure_windows_unwind target)
    if(MINGW)
        if(NOT EXISTS "${CMAKE_OBJCOPY}")
            message(FATAL_ERROR "Windows DWARF unwinding requires objcopy")
        endif()
        add_custom_command(TARGET ${target} POST_BUILD
                COMMAND "${CMAKE_OBJCOPY}" --rename-section .eh_frame=.ehfram --rename-section .eh_fram=.ehfram "$<TARGET_FILE:${target}>"
                VERBATIM
        )
    endif()
endfunction()
if(MINGW)
    add_compile_options(-fno-asynchronous-unwind-tables)
endif()
include(${ANYPS5_SOURCE_ROOT}/cmake/ZArchive.cmake)
set(BUILD_TESTING OFF)
add_library(libc SHARED)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libc libc)
configure_windows_unwind(libc)
if(WIN32)
    target_compile_options(libc PRIVATE "SHELL:-include ${LIBS_INCLUDE_DIR}/prx/libc/include/HostStandardStreams.hpp")
endif()
if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
    target_link_options(libc PRIVATE LINKER:-z,now)
    target_link_options(libc INTERFACE LINKER:--no-as-needed)
endif()
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceSsl ssl)
set(BUILD_TESTING ON)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl libressl)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl3 libressl3)
foreach(target IN ITEMS libSceLibreSsl libSceLibreSsl3)
    target_link_libraries(${target} PUBLIC libc)
    if(WIN32)
        target_compile_options(${target} PRIVATE "SHELL:-include ${LIBS_INCLUDE_DIR}/prx/libc/include/HostStandardStreams.hpp")
    endif()
endforeach()

Configure with -DANYPS5_SOURCE_ROOT=<checkout> -DCMAKE_BUILD_TYPE=Release, build, then run ctest --test-dir <build> --output-on-failure. In this environment the Linux CMAKE_CROSSCOMPILING_EMULATOR is QEMU 11.0.3 x86-64. Windows uses WinLibs GCC 15.2.0 UCRT r7; the actual Windows test executables run through Wine 9 under QEMU with WINELOADERNOEXEC=1, and WINEPATH includes the build directory, both LibreSSL DLL directories and WinLibs bin. Test timeouts remain 30 s (20 s for constant-time comparison).

For the reported Wine run, the external Windows CTest manifest additionally sets ENVIRONMENT "APS5_NO_WRITE_WATCH=1" only on guest_libressl_runtime and guest_libressl_asn1, because Wine page write watching faults in this environment. Native Windows results are still needed for that path.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Progress report (63a863d → 0390178)

📈 System libraries: 49.37% (+0.02%, +3 implemented functions)

✅ 3 implemented

Library	Name
libSceLibreSsl	SSL_CIPHER_get_bits_nid_postfix
libSceLibreSsl	SSL_CIPHER_get_name_nid_postfix
libSceLibreSsl	SSL_CIPHER_get_version_nid_postfix

Changed libraries (implemented exports)

Library	Before	After	Change
libSceLibreSsl	43/399 (10.78%)	46/399 (11.53%)	+0.75 pp

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 10395	docs/dev/debt/libSceLibreSsl.md L5, L11-12

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 9446	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9448	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9535	core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 9536	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9571	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 9745	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 9870	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10248	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10475	core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10484	docs/dev/debt/libSceLibreSsl.md
PR 10508	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10570	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10571	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10878	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md

[MarcZX10]

Reviewed exact head d56f90f4d27a9c95ac9c78de07b0cdbb21a561fa. The cipher field reads and regression coverage are clear, and the description gives focused Linux/Windows 6/6 runs, including boundary, aliasing, and validation details. Hosted eligibility, conventions, labels and report checks pass; hosted product jobs are path-skipped. I have not independently run the local test suite.\n\nOne contribution-rule item needs resolving before merge: a direct merge preview of this head with your open #10078 reports a content conflict in docs/dev/debt/libSceLibreSsl.md (both edit the same pending-export count and add a debt entry). Please coordinate which lands first, declare that order with Depends on, and make sure the second branch keeps both entries and the corrected count. This is a keep-both sequencing request; neither PR needs to be closed.

[MarcZX10]

Formatting correction to my review above: its paragraph separator rendered as literal \n text. The review finding is unchanged.

The direct merge preview confirms a content conflict in docs/dev/debt/libSceLibreSsl.md between #10071 and #10078. Please agree the landing order, declare it with Depends on, and preserve both entries and the corrected pending-export count. Neither PR needs to be closed.

The landing order is now declared on #10078: #10071 lands first, and #10078 merges main afterwards and depends on it.

[MarcZX10]

The current overlap report/body lists #9529 among the shared-file work, but this PR still says Depends on: none. I tested the actual branches with git merge-tree --write-tree upstream/pr/9529 upstream/pr/10071; the merge has a content conflict in docs/dev/debt/libSceLibreSsl.md (CMakeLists and Export.cpp auto-merge). CONTRIBUTING requires authors to agree the landing order for overlapping lines and declare the prerequisite. Please coordinate the #9529 order, update the checklist if this PR needs it first, and confirm the merged debt retains both entries and the correct pending-export count. This is a merge-order request; I found no conflict in the three cipher getters themselves.

[atharvjairath]

Thanks, Marc. I checked the current branches and confirmed the conflict is in the debt entry and pending count; the getter code merges cleanly.

@2Swagger, I propose landing #9529 first, then #10071, then #10078. I've marked #9529 as a prerequisite here. Once it lands, I'll rebase the cipher follow-up, keep both debt entries, recompute the count from the resulting source, and rerun the tests. Does that order work for you?

[oneandonlydean]

@atharvjairath The local declarations differ from main’s public headers: int SSL_CIPHER_get_bits_nid_postfix(const void*, std::int32_t*) at core/libs/tests/GuestLibreSslCipher.cpp:11 versus int SSL_CIPHER_get_bits_nid_postfix(void) at core/libs/prx/libSceLibreSsl/include/Api.hpp:249; const char* SSL_CIPHER_get_name_nid_postfix(const void*) at core/libs/tests/GuestLibreSslCipher.cpp:12 versus int SSL_CIPHER_get_name_nid_postfix(void) at core/libs/prx/libSceLibreSsl/include/Api.hpp:250; char* SSL_CIPHER_get_version_nid_postfix(const void*) at core/libs/tests/GuestLibreSslCipher.cpp:13 versus int SSL_CIPHER_get_version_nid_postfix(void) at core/libs/prx/libSceLibreSsl/include/Api.hpp:251. Main now requires each exported function to be declared once, in the library's public header (checked by the public_headers tests). Could you use main’s public signatures and types throughout the implementation and tests, or explain why the public declarations need to change?

#9529 has merged and the branch was rebased onto main after it, so the requested "Depends on: #9529" no longer applies.