From c7bf80fb72d98ba8454d9d2868acc7a9b7cbf278 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Mon, 5 May 2025 17:32:27 -0500
Subject: [PATCH 01/12] S3 Implementation

---
 configuration.c                               |    7 +
 configuration.h                               |    9 +
 griffin/griffin.c                             |    3 +
 intl/msg_hash_lbl.h                           |   12 +
 intl/msg_hash_us.h                            |   24 +
 menu/cbs/menu_cbs_sublabel.c                  |   12 +
 menu/menu_displaylist.c                       |   58 +-
 menu/menu_setting.c                           |   53 +
 msg_hash.h                                    |    5 +-
 network/cloud_sync/s3.c                       | 1328 +++++++++++++++++
 network/cloud_sync_driver.c                   |    3 +
 network/cloud_sync_driver.h                   |    3 +
 .../RetroArch_Metal.xcodeproj/project.pbxproj |    2 +
 13 files changed, 1503 insertions(+), 16 deletions(-)
 create mode 100644 network/cloud_sync/s3.c

diff --git a/configuration.c b/configuration.c
index 1a9917de6ebe..5d76f2481137 100644
--- a/configuration.c
+++ b/configuration.c
@@ -1619,10 +1619,17 @@ static struct config_array_setting *populate_settings_array(
 
 #ifdef HAVE_NETWORKING
    SETTING_ARRAY("netplay_mitm_server",          settings->arrays.netplay_mitm_server, false, NULL, true);
+#ifdef HAVE_CLOUDSYNC
    SETTING_ARRAY("webdav_url",                   settings->arrays.webdav_url, false, NULL, true);
    SETTING_ARRAY("webdav_username",              settings->arrays.webdav_username, false, NULL, true);
    SETTING_ARRAY("webdav_password",              settings->arrays.webdav_password, false, NULL, true);
    SETTING_ARRAY("google_drive_refresh_token",   settings->arrays.google_drive_refresh_token, false, NULL, true);
+#ifdef HAVE_S3
+   SETTING_ARRAY("s3_url",                       settings->arrays.s3_url, false, NULL, true);
+   SETTING_ARRAY("access_key_id",                settings->arrays.access_key_id, false, NULL, true);
+   SETTING_ARRAY("secret_access_key",            settings->arrays.secret_access_key, false, NULL, true);
+#endif
+#endif
    SETTING_ARRAY("youtube_stream_key",           settings->arrays.youtube_stream_key, true, NULL, true);
    SETTING_ARRAY("twitch_stream_key",            settings->arrays.twitch_stream_key, true, NULL, true);
    SETTING_ARRAY("facebook_stream_key",          settings->arrays.facebook_stream_key, true, NULL, true);
diff --git a/configuration.h b/configuration.h
index 3225a2aae2ef..82fbc33d826c 100644
--- a/configuration.h
+++ b/configuration.h
@@ -541,10 +541,19 @@ typedef struct settings
       char audio_device[NAME_MAX_LENGTH];
       char camera_device[NAME_MAX_LENGTH];
       char netplay_mitm_server[NAME_MAX_LENGTH];
+#ifdef HAVE_NETWORKING
+#ifdef HAVE_CLOUDSYNC
       char webdav_url[NAME_MAX_LENGTH];
       char webdav_username[NAME_MAX_LENGTH];
       char webdav_password[NAME_MAX_LENGTH];
       char google_drive_refresh_token[2048];
+#ifdef HAVE_S3
+      char s3_url[NAME_MAX_LENGTH];
+      char access_key_id[128];
+      char secret_access_key[186]; /* TODO/RESEARCH - check size, ex https://github.com/winscp/winscp/pull/15/files */
+#endif
+#endif
+#endif
 
       char crt_switch_timings[NAME_MAX_LENGTH];
       char input_reserved_devices[MAX_USERS][NAME_MAX_LENGTH];
diff --git a/griffin/griffin.c b/griffin/griffin.c
index 8b84bc0ad3d6..2a3479835e2b 100644
--- a/griffin/griffin.c
+++ b/griffin/griffin.c
@@ -1721,6 +1721,9 @@ CLOUD SYNC
 #ifdef HAVE_SMBCLIENT
 #include "../network/cloud_sync/smb.c"
 #endif
+#ifdef HAVE_S3
+#include "../network/cloud_sync/s3.c"
+#endif
 #endif
 
 /*============================================================
diff --git a/intl/msg_hash_lbl.h b/intl/msg_hash_lbl.h
index 383fcb3370f3..b3b0b32db9c2 100644
--- a/intl/msg_hash_lbl.h
+++ b/intl/msg_hash_lbl.h
@@ -3550,6 +3550,18 @@ MSG_HASH(
    MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,
    "cloud_sync_password"
    )
+MSG_HASH(
+   MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,
+   "cloud_sync_access_key_id"
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,
+   "cloud_sync_secret_access_key"
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,
+   "cloud_sync_s3_url"
+   )
 MSG_HASH(
    MENU_ENUM_LABEL_SCAN_DIRECTORY,
    "scan_directory"
diff --git a/intl/msg_hash_us.h b/intl/msg_hash_us.h
index 81cde5d6cec4..ad20e4843531 100644
--- a/intl/msg_hash_us.h
+++ b/intl/msg_hash_us.h
@@ -1158,6 +1158,30 @@ MSG_HASH(
    MENU_ENUM_SUBLABEL_CLOUD_SYNC_PASSWORD,
    "Your password for your cloud storage account."
    )
+MSG_HASH(
+   MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_ACCESS_KEY_ID,
+   "Access Key ID"
+   )
+MSG_HASH(
+   MENU_ENUM_SUBLABEL_CLOUD_SYNC_ACCESS_KEY_ID,
+   "Your access key ID for your cloud storage account."
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_SECRET_ACCESS_KEY,
+   "Secret Access Key"
+   )
+MSG_HASH(
+   MENU_ENUM_SUBLABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,
+   "Your secret access key for your cloud storage account."
+   )
+MSG_HASH(
+   MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_S3_URL,
+   "S3 URL"
+   )
+MSG_HASH(
+   MENU_ENUM_SUBLABEL_CLOUD_SYNC_S3_URL,
+   "Your S3 endpoint URL for cloud storage."
+   )
 MSG_HASH(
    MENU_ENUM_LABEL_VALUE_LOGGING_SETTINGS,
    "Logging"
diff --git a/menu/cbs/menu_cbs_sublabel.c b/menu/cbs/menu_cbs_sublabel.c
index 4904e423d9a1..de2d9d2cdd08 100644
--- a/menu/cbs/menu_cbs_sublabel.c
+++ b/menu/cbs/menu_cbs_sublabel.c
@@ -270,8 +270,11 @@ DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_sync_thumbs,        MENU_
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_sync_system,        MENU_ENUM_SUBLABEL_CLOUD_SYNC_SYNC_SYSTEM)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_driver,             MENU_ENUM_SUBLABEL_CLOUD_SYNC_DRIVER)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_url,                MENU_ENUM_SUBLABEL_CLOUD_SYNC_URL)
+DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_s3_url,             MENU_ENUM_SUBLABEL_CLOUD_SYNC_S3_URL)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_username,           MENU_ENUM_SUBLABEL_CLOUD_SYNC_USERNAME)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_password,           MENU_ENUM_SUBLABEL_CLOUD_SYNC_PASSWORD)
+DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_access_key_id,      MENU_ENUM_SUBLABEL_CLOUD_SYNC_ACCESS_KEY_ID)
+DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_cloud_sync_secret_access_key,  MENU_ENUM_SUBLABEL_CLOUD_SYNC_SECRET_ACCESS_KEY)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_logging_settings_list,         MENU_ENUM_SUBLABEL_LOGGING_SETTINGS)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_user_interface_settings_list,  MENU_ENUM_SUBLABEL_USER_INTERFACE_SETTINGS)
 DEFAULT_SUBLABEL_MACRO(action_bind_sublabel_ai_service_settings_list,  MENU_ENUM_SUBLABEL_AI_SERVICE_SETTINGS)
@@ -5254,12 +5257,21 @@ int menu_cbs_init_bind_sublabel(menu_file_list_cbs_t *cbs,
          case MENU_ENUM_LABEL_CLOUD_SYNC_URL:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_url);
             break;
+         case MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL:
+            BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_s3_url);
+            break;
          case MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_username);
             break;
          case MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_password);
             break;
+         case MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID:
+           BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_access_key_id);
+           break;
+         case MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY:
+           BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_cloud_sync_secret_access_key);
+           break;
          case MENU_ENUM_LABEL_LOGGING_SETTINGS:
             BIND_ACTION_SUBLABEL(cbs, action_bind_sublabel_logging_settings_list);
             break;
diff --git a/menu/menu_displaylist.c b/menu/menu_displaylist.c
index 09730a024165..351c1c6c93f1 100644
--- a/menu/menu_displaylist.c
+++ b/menu/menu_displaylist.c
@@ -10364,7 +10364,7 @@ unsigned menu_displaylist_build_list(
                            MENU_ENUM_LABEL_VIDEO_HDR_SCANLINES,
                            PARSE_ONLY_BOOL, false) == 0)
                      count++;
-                     
+
                   if(settings->bools.video_hdr_scanlines)
                   {
                      if (MENU_DISPLAYLIST_PARSE_SETTINGS_ENUM(list,
@@ -11345,22 +11345,50 @@ unsigned menu_displaylist_build_list(
       case DISPLAYLIST_CLOUD_SYNC_SETTINGS_LIST:
          {
             menu_displaylist_build_info_selective_t build_list[] = {
-               {MENU_ENUM_LABEL_CLOUD_SYNC_ENABLE,       PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_MODE,    PARSE_ONLY_UINT,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_DESTRUCTIVE,  PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SAVES,   PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_CONFIGS, PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_THUMBS,  PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SYSTEM,  PARSE_ONLY_BOOL,           true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_DRIVER,       PARSE_ONLY_STRING_OPTIONS, true},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_URL,          PARSE_ONLY_STRING,         false},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME,     PARSE_ONLY_STRING,         false},
-               {MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,     PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_ENABLE,             PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_MODE,          PARSE_ONLY_UINT,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_DESTRUCTIVE,        PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SAVES,         PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_CONFIGS,       PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_THUMBS,        PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SYSTEM,        PARSE_ONLY_BOOL,           true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_DRIVER,             PARSE_ONLY_STRING_OPTIONS, true},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_URL,                PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME,           PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,           PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,             PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,      PARSE_ONLY_STRING,         false},
+               {MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,  PARSE_ONLY_STRING,         false},
             };
 
-            if (string_is_equal(settings->arrays.cloud_sync_driver, "webdav"))
-               for (i = 0; i < ARRAY_SIZE(build_list); i++)
-                  build_list[i].checked = true;
+            for (i = 0; i < ARRAY_SIZE(build_list); i++)
+               switch(build_list[i].enum_idx)
+                  {
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_ENABLE:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_MODE:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_DESTRUCTIVE:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SAVES:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_CONFIGS:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_THUMBS:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SYNC_SYSTEM:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_DRIVER:
+                     if (string_is_equal(settings->arrays.cloud_sync_driver, "webdav")
+                        || string_is_equal(settings->arrays.cloud_sync_driver, "s3"))
+                       build_list[i].checked = true;
+                     break;
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_URL:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD:
+                     if (string_is_equal(settings->arrays.cloud_sync_driver, "webdav"))
+                        build_list[i].checked = true;
+                     break;
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID:
+                  case MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY:
+                     if (string_is_equal(settings->arrays.cloud_sync_driver, "s3"))
+                        build_list[i].checked = true;
+                     break;
+                  }
 
             for (i = 0; i < ARRAY_SIZE(build_list); i++)
             {
diff --git a/menu/menu_setting.c b/menu/menu_setting.c
index 22efacec5d84..2681090c8af6 100644
--- a/menu/menu_setting.c
+++ b/menu/menu_setting.c
@@ -12282,6 +12282,59 @@ static bool setting_append_list(
          (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_PASSWORD_LINE_EDIT;
          (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
 
+#ifdef HAVE_S3
+         /* AWS */
+         CONFIG_STRING(
+               list, list_info,
+               settings->arrays.s3_url,
+               sizeof(settings->arrays.s3_url),
+               MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,
+               MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_S3_URL,
+               "",
+               &group_info,
+               &subgroup_info,
+               parent_group,
+               general_write_handler,
+               general_read_handler);
+         SETTINGS_DATA_LIST_CURRENT_ADD_FLAGS(list, list_info, SD_FLAG_ALLOW_INPUT);
+         (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_STRING_LINE_EDIT;
+         (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
+
+         CONFIG_STRING(
+               list, list_info,
+               settings->arrays.access_key_id,
+               sizeof(settings->arrays.access_key_id),
+               MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,
+               MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_ACCESS_KEY_ID,
+               "",
+               &group_info,
+               &subgroup_info,
+               parent_group,
+               general_write_handler,
+               general_read_handler);
+         SETTINGS_DATA_LIST_CURRENT_ADD_FLAGS(list, list_info, SD_FLAG_ALLOW_INPUT);
+         (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_STRING_LINE_EDIT;
+         (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
+
+         CONFIG_STRING(
+               list, list_info,
+               settings->arrays.secret_access_key,
+               sizeof(settings->arrays.secret_access_key),
+               MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,
+               MENU_ENUM_LABEL_VALUE_CLOUD_SYNC_SECRET_ACCESS_KEY,
+               "",
+               &group_info,
+               &subgroup_info,
+               parent_group,
+               general_write_handler,
+               general_read_handler);
+         (*list)[list_info->index - 1].get_string_representation =
+            &setting_get_string_representation_password;
+         SETTINGS_DATA_LIST_CURRENT_ADD_FLAGS(list, list_info, SD_FLAG_ALLOW_INPUT);
+         (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_PASSWORD_LINE_EDIT;
+         (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
+#endif
+
          END_SUB_GROUP(list, list_info, parent_group);
          END_GROUP(list, list_info, parent_group);
 #endif
diff --git a/msg_hash.h b/msg_hash.h
index e9db968da693..05206a60cb70 100644
--- a/msg_hash.h
+++ b/msg_hash.h
@@ -1536,7 +1536,7 @@ enum msg_hash_enums
    MENU_ENUM_LABEL_VALUE_VIDEO_HDR_SUBPIXEL_LAYOUT_RGB,
    MENU_ENUM_LABEL_VALUE_VIDEO_HDR_SUBPIXEL_LAYOUT_RBG,
    MENU_ENUM_LABEL_VALUE_VIDEO_HDR_SUBPIXEL_LAYOUT_BGR,
-   
+
    MENU_LBL_H(PARENT_DIRECTORY),
    MENU_LBL_H(FILE_BROWSER_OPEN_UWP_PERMISSIONS),
    MENU_LABEL(FILE_BROWSER_OPEN_PICKER),
@@ -3212,6 +3212,9 @@ enum msg_hash_enums
    MENU_LABEL(CLOUD_SYNC_SYNC_NOW),
    MENU_LABEL(CLOUD_SYNC_RESOLVE_KEEP_LOCAL),
    MENU_LABEL(CLOUD_SYNC_RESOLVE_KEEP_SERVER),
+   MENU_LABEL(CLOUD_SYNC_S3_URL),
+   MENU_LABEL(CLOUD_SYNC_ACCESS_KEY_ID),
+   MENU_LABEL(CLOUD_SYNC_SECRET_ACCESS_KEY),
    MENU_LABEL(RECORDING_SETTINGS),
    MENU_LABEL(OVERLAY_SETTINGS),
    MENU_LABEL(REWIND_SETTINGS),
diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
new file mode 100644
index 000000000000..6f2d1dd0e646
--- /dev/null
+++ b/network/cloud_sync/s3.c
@@ -0,0 +1,1328 @@
+/*  RetroArch - A frontend for libretro.
+ *
+ *  RetroArch is free software: you can redistribute it and/or modify it under the terms
+ *  of the GNU General Public License as published by the Free Software Found-
+ *  ation, either version 3 of the License, or (at your option) any later version.
+ *
+ *  RetroArch is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+ *  without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ *  PURPOSE.  See the GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along with RetroArch.
+ *  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <encodings/base64.h>
+#include <lrc_hash.h>
+#include <net/net_http.h>
+#include <string/stdstring.h>
+#include <time/rtime.h>
+#include <formats/rjson.h>
+#include <retro_miscellaneous.h>
+#include <unistd.h>
+#include <retro_timers.h>
+
+#include "../cloud_sync_driver.h"
+#include "../../retroarch.h"
+#include "../../tasks/tasks_internal.h"
+#include "../../verbosity.h"
+
+#define S3_PFX "[S3] "
+
+/* S3-specific constants */
+#define S3_MAX_PART_SIZE (5 * 1024 * 1024) /* 5MB per part for multipart upload */
+#define S3_MAX_PARTS 10000
+#define S3_SIGNATURE_VERSION "AWS4-HMAC-SHA256"
+#define S3_SERVICE "s3"
+
+typedef struct
+{
+   char path[PATH_MAX_LENGTH];
+   char file[PATH_MAX_LENGTH];
+   cloud_sync_complete_handler_t cb;
+   void *user_data;
+   RFILE *rfile;
+} s3_cb_state_t;
+
+typedef struct
+{
+   char url[PATH_MAX_LENGTH];
+   char bucket[NAME_MAX_LENGTH];
+   char region[NAME_MAX_LENGTH];
+   char host[NAME_MAX_LENGTH];
+   char access_key_id[128];
+   char secret_access_key[186];
+   bool connected;
+} s3_state_t;
+
+static s3_state_t s3_driver_st = {0};
+
+s3_state_t *s3_state_get_ptr(void)
+{
+   return &s3_driver_st;
+}
+
+/* Parse S3 URL to extract bucket, region, and host */
+static bool s3_parse_url(const char *url, char *bucket, char *region, char *host)
+{
+   char *bucket_start = NULL;
+   char *region_start = NULL;
+   char *dot_pos = NULL;
+   char *slash_pos = NULL;
+   bool bucket_found = false;
+
+   if (!url || !bucket || !region || !host)
+      return false;
+
+   RARCH_LOG(S3_PFX "Parsing S3 URL: %s\n", url);
+
+   /* Initialize output buffers */
+   bucket[0] = '\0';
+   region[0] = '\0';
+   host[0] = '\0';
+
+   /* Handle virtual-hosted style S3 URL formats:
+    * - https://bucket.s3.region.amazonaws.com/ (AWS S3)
+    * - https://bucket.s3-region.amazonaws.com/ (AWS S3)
+    * - https://bucket.s3.region.backblazeb2.com/ (Backblaze B2)
+    * - https://bucket.region.digitaloceanspaces.com/ (DigitalOcean Spaces)
+    * - https://bucket.region.linodeobjects.com/ (Linode Object Storage)
+    * - https://bucket.region.cloudflarestorage.com/ (Cloudflare R2)
+    * - https://bucket.endpoint/ (MinIO, custom endpoints)
+    */
+
+   /* Extract bucket from virtual-hosted style URLs */
+   bucket_start = strstr(url, "://");
+   if (bucket_start)
+   {
+      bucket_start += 3; /* Skip "://" */
+      RARCH_LOG(S3_PFX "Found protocol separator, bucket_start: %s\n", bucket_start);
+
+      dot_pos = strchr(bucket_start, '.');
+      if (dot_pos)
+      {
+         size_t bucket_len = dot_pos - bucket_start;
+         RARCH_LOG(S3_PFX "Found first dot at position %zu, bucket length: %zu\n",
+                   (size_t)(dot_pos - bucket_start), bucket_len);
+
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+         {
+            strlcpy(bucket, bucket_start, bucket_len + 1);
+            bucket_found = true;
+            RARCH_LOG(S3_PFX "Extracted bucket: %s\n", bucket);
+
+            /* Extract host from URL */
+            char *host_start = bucket_start;
+            char *host_end = strchr(host_start, '/');
+            if (host_end)
+            {
+               size_t host_len = host_end - host_start;
+               if (host_len > 0 && host_len < NAME_MAX_LENGTH)
+               {
+                  strlcpy(host, host_start, host_len + 1);
+                  RARCH_LOG(S3_PFX "Extracted host: %s\n", host);
+               }
+            }
+            else
+            {
+               /* No path, use entire authority as host */
+               strlcpy(host, host_start, NAME_MAX_LENGTH);
+               RARCH_LOG(S3_PFX "Extracted host: %s\n", host);
+            }
+
+            /* Extract region based on service type */
+            if (strstr(url, ".s3.") && strstr(url, ".amazonaws.com"))
+            {
+               RARCH_LOG(S3_PFX "Detected AWS S3 format (bucket.s3.region.amazonaws.com)\n");
+               /* AWS S3: bucket.s3.region.amazonaws.com */
+               if (strncmp(dot_pos, ".s3.", 4) == 0)
+               {
+                  region_start = dot_pos + 4;
+                  dot_pos = strchr(region_start, '.');
+                  if (dot_pos)
+                  {
+                     size_t region_len = dot_pos - region_start;
+                     if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                     {
+                        strlcpy(region, region_start, region_len + 1);
+                        RARCH_LOG(S3_PFX "Extracted AWS S3 region: %s\n", region);
+                        return true;
+                     }
+                  }
+               }
+            }
+            else if (strstr(url, ".s3-") && strstr(url, ".amazonaws.com"))
+            {
+               RARCH_LOG(S3_PFX "Detected AWS S3 format (bucket.s3-region.amazonaws.com)\n");
+               /* AWS S3: bucket.s3-region.amazonaws.com */
+               if (strncmp(dot_pos, ".s3-", 4) == 0)
+               {
+                  region_start = dot_pos + 4;
+                  dot_pos = strchr(region_start, '.');
+                  if (dot_pos)
+                  {
+                     size_t region_len = dot_pos - region_start;
+                     if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                     {
+                        strlcpy(region, region_start, region_len + 1);
+                        RARCH_LOG(S3_PFX "Extracted AWS S3 region: %s\n", region);
+                        return true;
+                     }
+                  }
+               }
+            }
+            else if (strstr(url, ".backblazeb2.com"))
+            {
+               RARCH_LOG(S3_PFX "Detected Backblaze B2 format\n");
+               /* Backblaze B2: bucket.s3.region.backblazeb2.com */
+               if (strncmp(dot_pos, ".s3.", 4) == 0)
+               {
+                  region_start = dot_pos + 4;
+                  dot_pos = strchr(region_start, '.');
+                  if (dot_pos)
+                  {
+                     size_t region_len = dot_pos - region_start;
+                     if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                     {
+                        strlcpy(region, region_start, region_len + 1);
+                        RARCH_LOG(S3_PFX "Extracted Backblaze B2 region: %s\n", region);
+                        return true;
+                     }
+                  }
+               }
+            }
+            else if (strstr(url, ".digitaloceanspaces.com"))
+            {
+               RARCH_LOG(S3_PFX "Detected DigitalOcean Spaces format\n");
+               /* DigitalOcean Spaces: bucket.region.digitaloceanspaces.com */
+               region_start = dot_pos + 1;
+               dot_pos = strchr(region_start, '.');
+               if (dot_pos)
+               {
+                  size_t region_len = dot_pos - region_start;
+                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                  {
+                     strlcpy(region, region_start, region_len + 1);
+                     RARCH_LOG(S3_PFX "Extracted DigitalOcean region: %s\n", region);
+                     return true;
+                  }
+               }
+            }
+            else if (strstr(url, ".linodeobjects.com"))
+            {
+               RARCH_LOG(S3_PFX "Detected Linode Object Storage format\n");
+               /* Linode Object Storage: bucket.region.linodeobjects.com */
+               region_start = dot_pos + 1;
+               dot_pos = strchr(region_start, '.');
+               if (dot_pos)
+               {
+                  size_t region_len = dot_pos - region_start;
+                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                  {
+                     strlcpy(region, region_start, region_len + 1);
+                     RARCH_LOG(S3_PFX "Extracted Linode region: %s\n", region);
+                     return true;
+                  }
+               }
+            }
+            else if (strstr(url, ".cloudflarestorage.com"))
+            {
+               RARCH_LOG(S3_PFX "Detected Cloudflare R2 format\n");
+               /* Cloudflare R2: bucket.region.cloudflarestorage.com */
+               region_start = dot_pos + 1;
+               dot_pos = strchr(region_start, '.');
+               if (dot_pos)
+               {
+                  size_t region_len = dot_pos - region_start;
+                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                  {
+                     strlcpy(region, region_start, region_len + 1);
+                     RARCH_LOG(S3_PFX "Extracted Cloudflare region: %s\n", region);
+                     return true;
+                  }
+               }
+            }
+            else
+            {
+               RARCH_LOG(S3_PFX "Detected custom endpoint format\n");
+               /* Custom endpoints (MinIO, etc.): bucket.endpoint */
+               /* Try to extract region from the endpoint */
+               region_start = dot_pos + 1;
+               slash_pos = strchr(region_start, '/');
+               if (slash_pos)
+               {
+                  size_t region_len = slash_pos - region_start;
+                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+                  {
+                     strlcpy(region, region_start, region_len + 1);
+                     RARCH_LOG(S3_PFX "Extracted custom endpoint region: %s\n", region);
+                     return true;
+                  }
+               }
+               else
+               {
+                  /* No slash found, use the entire endpoint as region */
+                  strlcpy(region, region_start, NAME_MAX_LENGTH);
+                  RARCH_LOG(S3_PFX "Using entire endpoint as region: %s\n", region);
+                  return true;
+               }
+            }
+         }
+      }
+   }
+
+   /* If we found a bucket but no region, use default */
+   if (bucket_found)
+   {
+      strlcpy(region, "us-east-1", NAME_MAX_LENGTH);
+      RARCH_LOG(S3_PFX "Using default region us-east-1 for bucket: %s\n", bucket);
+      return true;
+   }
+
+   return false;
+}
+
+/* Calculate SHA256 hash */
+static char* s3_sha256_hash(const char *data, size_t len)
+{
+   char *hash = malloc(65);
+   if (!hash)
+      return NULL;
+
+   sha256_hash(hash, (const uint8_t*)data, len);
+   hash[64] = '\0';
+   return hash;
+}
+
+/* URL encode a string according to RFC 3986 */
+static char* s3_url_encode(const char *input)
+{
+   if (!input)
+      return NULL;
+
+   size_t input_len = strlen(input);
+   char *output = malloc(input_len * 3 + 1); /* Worst case: every char needs encoding */
+   if (!output)
+      return NULL;
+
+   size_t output_pos = 0;
+   for (size_t i = 0; i < input_len; i++)
+   {
+      unsigned char c = (unsigned char)input[i];
+
+      /* RFC 3986 unreserved characters: A-Z, a-z, 0-9, -, ., _, ~ */
+      /* Path delimiters that should not be encoded: / */
+      /* Query parameter delimiters that should not be encoded: &, =, ? */
+      if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+          (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~' ||
+          c == '/' || c == '&' || c == '=' || c == '?')
+      {
+         output[output_pos++] = c;
+      }
+      else
+      {
+         /* Percent encode */
+         output[output_pos++] = '%';
+         output[output_pos++] = "0123456789ABCDEF"[c >> 4];
+         output[output_pos++] = "0123456789ABCDEF"[c & 0x0F];
+      }
+   }
+   output[output_pos] = '\0';
+   return output;
+}
+
+/* Trim whitespace from string */
+static char* s3_trim_string(const char *input)
+{
+   if (!input)
+      return NULL;
+
+   size_t len = strlen(input);
+   size_t start = 0;
+   size_t end = len;
+
+   /* Find start of non-whitespace */
+   while (start < len && (input[start] == ' ' || input[start] == '\t'))
+      start++;
+
+   /* Find end of non-whitespace */
+   while (end > start && (input[end-1] == ' ' || input[end-1] == '\t'))
+      end--;
+
+   /* Create trimmed string */
+   size_t trimmed_len = end - start;
+   char *trimmed = malloc(trimmed_len + 1);
+   if (!trimmed)
+      return NULL;
+
+   memcpy(trimmed, input + start, trimmed_len);
+   trimmed[trimmed_len] = '\0';
+
+   return trimmed;
+}
+
+/* Canonicalize query string parameters */
+static char* s3_canonicalize_query_string(const char *query_string)
+{
+   if (!query_string || !*query_string)
+      return strdup("");
+
+   /* For now, return the query string as-is since most S3 operations don't use query parameters */
+   /* A full implementation would:
+    * 1. Split parameters by '&'
+    * 2. URL encode each parameter name and value
+    * 3. Sort parameters alphabetically by name
+    * 4. Join with '&'
+    */
+   return strdup(query_string);
+}
+
+/* Calculate HMAC-SHA256 and return binary result */
+static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const char *data, uint8_t *output)
+{
+   char inner_pad[64];
+   char outer_pad[64];
+   uint8_t key_hash[32];
+   char *inner_data = NULL;
+   size_t data_len = strlen(data);
+
+   /* Debug: Show input parameters */
+   RARCH_LOG(S3_PFX "HMAC input: key_len=%zu, data='%s'\n", key_len, data);
+
+   /* Hash the key if it's longer than 64 bytes */
+   if (key_len > 64)
+   {
+      RARCH_LOG(S3_PFX "HMAC: Key too long (%zu), hashing first\n", key_len);
+      /* Use a temporary buffer for the hash */
+      char temp_hash[65];
+      sha256_hash(temp_hash, (const uint8_t*)key, key_len);
+
+      /* Convert hex to binary */
+      for (int i = 0; i < 32; i++)
+      {
+         char hex_byte[3] = {temp_hash[i*2], temp_hash[i*2+1], 0};
+         key_hash[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+      }
+      key = key_hash;
+      key_len = 32;
+   }
+   else
+   {
+      RARCH_LOG(S3_PFX "HMAC: Key length OK (%zu), using directly\n", key_len);
+   }
+
+   /* Pad the key to 64 bytes */
+   memset(outer_pad, 0, 64);
+   memset(inner_pad, 0, 64);
+   if (key_len <= 64)
+   {
+      memcpy(outer_pad, key, key_len);
+      memcpy(inner_pad, key, key_len);
+   }
+   else
+   {
+      /* Key is longer than 64 bytes, this shouldn't happen after hashing */
+      memcpy(outer_pad, key, 64);
+      memcpy(inner_pad, key, 64);
+   }
+
+   /* XOR with constants */
+   for (int i = 0; i < 64; i++)
+   {
+      outer_pad[i] ^= 0x5c;
+      inner_pad[i] ^= 0x36;
+   }
+
+   /* Inner hash: H(K XOR 0x36, text) */
+   inner_data = malloc(64 + data_len);
+   if (!inner_data)
+      return NULL;
+
+   memcpy(inner_data, inner_pad, 64);
+   memcpy(inner_data + 64, data, data_len);
+
+   /* Hash and convert to binary */
+   char inner_hash_hex[65];
+   sha256_hash(inner_hash_hex, (const uint8_t*)inner_data, 64 + data_len);
+
+   uint8_t inner_hash_bin[32];
+   for (int i = 0; i < 32; i++)
+   {
+      char hex_byte[3] = {inner_hash_hex[i*2], inner_hash_hex[i*2+1], 0};
+      inner_hash_bin[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+   }
+
+   /* Outer hash: H(K XOR 0x5c, inner_hash_bin) */
+   /* We need to ensure we have enough space for outer hash (64 + 32 = 96 bytes) */
+   if (64 + data_len < 96)
+   {
+      /* Reallocate if needed */
+      char *outer_data = realloc(inner_data, 96);
+      if (!outer_data)
+      {
+         free(inner_data);
+         return NULL;
+      }
+      inner_data = outer_data;
+   }
+
+   memcpy(inner_data, outer_pad, 64);
+   memcpy(inner_data + 64, inner_hash_bin, 32);
+
+   char final_hash_hex[65];
+   sha256_hash(final_hash_hex, (const uint8_t*)inner_data, 64 + 32);
+
+   /* Convert final result to binary */
+   for (int i = 0; i < 32; i++)
+   {
+      char hex_byte[3] = {final_hash_hex[i*2], final_hash_hex[i*2+1], 0};
+      output[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+   }
+
+   /* Cleanup */
+   free(inner_data);
+
+   return output;
+}
+
+/* Calculate HMAC-SHA256 (legacy function for compatibility) */
+static char* s3_hmac_sha256(const char *key, const char *data, char *output)
+{
+   char *hmac_hex = malloc(65);
+   if (!hmac_hex)
+      return NULL;
+
+   uint8_t binary_key[64];
+   size_t key_len = strlen(key);
+
+   /* Convert key to binary */
+   if (key_len <= 64)
+   {
+      memset(binary_key, 0, 64);
+      memcpy(binary_key, key, key_len);
+   }
+   else
+   {
+      /* Hash the key if it's longer than 64 bytes */
+      char temp_hash[65];
+      sha256_hash(temp_hash, (const uint8_t*)key, key_len);
+      for (int i = 0; i < 32; i++)
+      {
+         char hex_byte[3] = {temp_hash[i*2], temp_hash[i*2+1], 0};
+         binary_key[i] = (uint8_t)strtol(hex_byte, NULL, 16);
+      }
+      key_len = 32;
+   }
+
+   uint8_t result[32];
+   if (!s3_hmac_sha256_bin(binary_key, key_len, data, result))
+   {
+      free(hmac_hex);
+      return NULL;
+   }
+
+   /* Convert binary result to hex */
+   for (int i = 0; i < 32; i++)
+      snprintf(hmac_hex + 2 * i, 3, "%02x", (unsigned)result[i]);
+
+   hmac_hex[64] = '\0';
+   return hmac_hex;
+}
+
+/* Calculate AWS Signature Version 4 signature with proper key derivation */
+static char* s3_calculate_aws4_signature(const char *secret_key, const char *date,
+                                        const char *region, const char *service,
+                                        const char *string_to_sign)
+{
+   char *signature = malloc(65);
+   if (!signature)
+      return NULL;
+
+   char aws4_key[128];
+   uint8_t k_date[32];
+   uint8_t k_region[32];
+   uint8_t k_service[32];
+   uint8_t k_signing[32];
+   uint8_t final_signature[32];
+
+   /* Build AWS4 key string */
+   snprintf(aws4_key, sizeof(aws4_key), "AWS4%s", secret_key);
+
+   RARCH_LOG(S3_PFX "AWS4 key: %s\n", aws4_key);
+   RARCH_LOG(S3_PFX "Date: %s, Region: %s, Service: %s\n", date, region, service);
+
+   /* Derive keys step by step using binary HMAC throughout */
+   /* Step 1: DateKey = HMAC-SHA256("AWS4" + SecretAccessKey, Date) */
+   /* Note: aws4_key is a string, but HMAC treats it as byte data */
+   RARCH_LOG(S3_PFX "Step 1: HMAC-SHA256(key_len=%zu, data='%s')\n", strlen(aws4_key), date);
+   if (!s3_hmac_sha256_bin((uint8_t*)aws4_key, strlen(aws4_key), date, k_date))
+      goto error;
+
+   /* Debug: Show k_date */
+   char k_date_hex[65];
+   for (int i = 0; i < 32; i++)
+      snprintf(k_date_hex + 2 * i, 3, "%02x", (unsigned)k_date[i]);
+   k_date_hex[64] = '\0';
+   RARCH_LOG(S3_PFX "k_date: %s\n", k_date_hex);
+
+   /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
+   RARCH_LOG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
+   if (!s3_hmac_sha256_bin(k_date, 32, region, k_region))
+      goto error;
+
+   /* Debug: Show k_region */
+   char k_region_hex[65];
+   for (int i = 0; i < 32; i++)
+      snprintf(k_region_hex + 2 * i, 3, "%02x", (unsigned)k_region[i]);
+   k_region_hex[64] = '\0';
+   RARCH_LOG(S3_PFX "k_region: %s\n", k_region_hex);
+
+
+
+   /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
+   RARCH_LOG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
+   char *k_region_hex_result = s3_hmac_sha256(k_date_hex, region, NULL);
+   RARCH_LOG(S3_PFX "k_region: %s\n", k_region_hex_result);
+   free(k_region_hex_result);
+
+
+
+
+   /* Step 3: DateRegionServiceKey = HMAC-SHA256(DateRegionKey, Service) */
+   RARCH_LOG(S3_PFX "Step 3: HMAC-SHA256(binary_key, data='%s')\n", service);
+   if (!s3_hmac_sha256_bin(k_region, 32, service, k_service))
+      goto error;
+
+   /* Debug: Show k_service */
+   char k_service_hex[65];
+   for (int i = 0; i < 32; i++)
+      snprintf(k_service_hex + 2 * i, 3, "%02x", (unsigned)k_service[i]);
+   k_service_hex[64] = '\0';
+   RARCH_LOG(S3_PFX "k_service: %s\n", k_service_hex);
+
+   /* Step 4: SigningKey = HMAC-SHA256(DateRegionServiceKey, "aws4_request") */
+   RARCH_LOG(S3_PFX "Step 4: HMAC-SHA256(binary_key, data='aws4_request')\n");
+   if (!s3_hmac_sha256_bin(k_service, 32, "aws4_request", k_signing))
+      goto error;
+
+   RARCH_LOG(S3_PFX "Key derivation completed successfully\n");
+
+   /* Debug: Show first few bytes of signing key */
+   char k_signing_sample[9];
+   snprintf(k_signing_sample, sizeof(k_signing_sample), "%02x%02x%02x%02x", k_signing[0], k_signing[1], k_signing[2], k_signing[3]);
+
+   RARCH_LOG(S3_PFX "Signing key sample: %s...\n", k_signing_sample);
+
+   /* Debug: Show complete signing key */
+   char k_signing_full[65];
+   for (int i = 0; i < 32; i++)
+      snprintf(k_signing_full + 2 * i, 3, "%02x", (unsigned)k_signing[i]);
+   k_signing_full[64] = '\0';
+   RARCH_LOG(S3_PFX "Complete signing key: %s\n", k_signing_full);
+
+   /* Calculate final signature using the derived signing key in binary format */
+   if (!s3_hmac_sha256_bin(k_signing, 32, string_to_sign, final_signature))
+      goto error;
+
+   /* Convert final signature to hex string */
+   for (int i = 0; i < 32; i++)
+      snprintf(signature + 2 * i, 3, "%02x", (unsigned)final_signature[i]);
+
+   signature[64] = '\0';
+   return signature;
+
+error:
+   free(signature);
+   return NULL;
+}
+
+/* AWS Signature Version 4 calculation with provided timestamp */
+static char* s3_calculate_signature_v4_with_time(const char *method, const char *canonical_uri,
+                                      const char *query_string, const char *headers,
+                                      const char *payload_hash, const char *region,
+                                      const char *service, const char *access_key,
+                                      const char *secret_key, const char *host, time_t now)
+{
+   char *signature = NULL;
+   char date[16];
+   char datetime[32];
+   char credential_scope[128];
+   char canonical_request[4096];
+   char string_to_sign[4096];
+   char signed_headers[256];
+   char *canonical_headers = NULL;
+   char *canonical_query_string = NULL;
+   char *canonical_request_hash = NULL;
+
+   /* Use provided timestamp */
+   struct tm *tm_info = gmtime(&now);
+   strftime(date, sizeof(date), "%Y%m%d", tm_info);
+   strftime(datetime, sizeof(datetime), "%Y%m%dT%H%M%SZ", tm_info);
+
+   RARCH_LOG(S3_PFX "Date: %s, DateTime: %s\n", date, datetime);
+
+   /* Build credential scope */
+   snprintf(credential_scope, sizeof(credential_scope), "%s/%s/%s/aws4_request",
+            date, region, service);
+
+   RARCH_LOG(S3_PFX "Credential scope: %s\n", credential_scope);
+
+   /* Build canonical headers */
+   if (headers)
+   {
+      /* Format headers for canonical request - must be sorted alphabetically and lowercase */
+      /* Each header must be trimmed and end with a newline */
+      canonical_headers = malloc(512);
+      if (canonical_headers)
+      {
+         /* Headers must be in alphabetical order: host, x-amz-content-sha256, x-amz-date */
+         snprintf(canonical_headers, 512, "host:%s\nx-amz-content-sha256:%s\nx-amz-date:%s\n",
+                  host, payload_hash, datetime);
+      }
+
+      RARCH_LOG(S3_PFX "Canonical headers:\n%s", canonical_headers ? canonical_headers : "NULL");
+   }
+
+   /* Build signed headers list */
+   snprintf(signed_headers, sizeof(signed_headers), "host;x-amz-content-sha256;x-amz-date");
+
+   /* Build canonical query string */
+   if (query_string)
+   {
+      canonical_query_string = s3_canonicalize_query_string(query_string);
+   }
+
+   /* Build canonical request */
+   snprintf(canonical_request, sizeof(canonical_request),
+            "%s\n%s\n%s\n%s\n%s\n%s",
+            method,
+            canonical_uri,
+            canonical_query_string ? canonical_query_string : "",
+            canonical_headers ? canonical_headers : "",
+            signed_headers,
+            payload_hash);
+
+   RARCH_LOG(S3_PFX "Canonical request:\n%s\n", canonical_request);
+   RARCH_LOG(S3_PFX "Host: %s\n", host);
+   RARCH_LOG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+   RARCH_LOG(S3_PFX "Method: %s\n", method);
+
+   /* Calculate SHA256 hash of canonical request */
+   canonical_request_hash = s3_sha256_hash(canonical_request, strlen(canonical_request));
+   if (!canonical_request_hash)
+   {
+      if (canonical_headers) free(canonical_headers);
+      if (canonical_query_string) free(canonical_query_string);
+      return NULL;
+   }
+
+   /* Build string to sign */
+   snprintf(string_to_sign, sizeof(string_to_sign),
+            "%s\n%s\n%s\n%s",
+            S3_SIGNATURE_VERSION,
+            datetime,
+            credential_scope,
+            canonical_request_hash);
+
+   RARCH_LOG(S3_PFX "String to sign:\n%s\n", string_to_sign);
+
+   /* Calculate signature using AWS Signature Version 4 key derivation */
+   signature = s3_calculate_aws4_signature(secret_key, date, region, service, string_to_sign);
+
+   if (signature)
+   {
+      RARCH_LOG(S3_PFX "Calculated signature: %s\n", signature);
+   }
+   else
+   {
+      RARCH_ERR(S3_PFX "Failed to calculate signature\n");
+   }
+
+   /* Cleanup */
+   if (canonical_headers) free(canonical_headers);
+   if (canonical_query_string) free(canonical_query_string);
+   if (canonical_request_hash) free(canonical_request_hash);
+
+   return signature;
+}
+
+
+
+/* Build S3 authorization header */
+static char* s3_build_auth_header(const char *method, const char *canonical_uri,
+                                 const char *query_string, const char *headers,
+                                 const char *payload_hash, s3_state_t *s3_st)
+{
+   char *auth_header = NULL;
+   char *signature = NULL;
+   char date[16];
+   char datetime[32];
+   char credential[256];
+   time_t now;
+   struct tm *tm_info;
+
+   /* Get current time - use the same timestamp for signature and headers */
+   now = time(NULL);
+   tm_info = gmtime(&now);
+   strftime(date, sizeof(date), "%Y%m%d", tm_info);
+   strftime(datetime, sizeof(datetime), "%Y%m%dT%H%M%SZ", tm_info);
+
+   /* Calculate signature with the same timestamp */
+   signature = s3_calculate_signature_v4_with_time(method, canonical_uri, query_string, headers,
+                                        payload_hash, s3_st->region, S3_SERVICE,
+                                        s3_st->access_key_id, s3_st->secret_access_key,
+                                        s3_st->host, now);
+
+   if (!signature)
+      return NULL;
+
+   /* Build credential string */
+   snprintf(credential, sizeof(credential), "%s/%s/%s/%s/aws4_request",
+            s3_st->access_key_id, date, s3_st->region, S3_SERVICE);
+
+   /* Build authorization header */
+   auth_header = malloc(1024);
+   snprintf(auth_header, 1024,
+            "Authorization: %s Credential=%s, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=%s\r\n"
+            "x-amz-date: %s\r\n"
+            "x-amz-content-sha256: %s\r\n",
+            S3_SIGNATURE_VERSION, credential, signature, datetime, payload_hash);
+
+   free(signature);
+   return auth_header;
+}
+
+/* Perform S3 HTTP operation asynchronously (for read operations) */
+static bool s3_http_operation_async(const char *method, const char *url, const char *headers,
+                                   const char *data, size_t data_len, s3_cb_state_t *cb_state)
+{
+   struct http_connection_t *conn = NULL;
+   struct http_t *http = NULL;
+   size_t progress = 0, total = 0;
+
+   /* Debug: Show complete HTTP request details */
+   RARCH_LOG(S3_PFX "=== HTTP REQUEST DEBUG ===\n");
+   RARCH_LOG(S3_PFX "Method: %s\n", method);
+   RARCH_LOG(S3_PFX "URL: %s\n", url);
+   RARCH_LOG(S3_PFX "Headers: %s\n", headers ? headers : "(none)");
+   RARCH_LOG(S3_PFX "Data length: %zu\n", data_len);
+   if (data && data_len > 0)
+   {
+      RARCH_LOG(S3_PFX "Data preview: ");
+      size_t preview_len = data_len > 64 ? 64 : data_len;
+      for (size_t i = 0; i < preview_len; i++)
+         RARCH_LOG(S3_PFX "%02x", (unsigned char)data[i]);
+      RARCH_LOG(S3_PFX "%s\n", data_len > 64 ? "..." : "");
+   }
+   RARCH_LOG(S3_PFX "========================\n");
+
+   /* Create HTTP connection */
+   conn = net_http_connection_new(url, method, data);
+   if (!conn)
+   {
+      RARCH_ERR(S3_PFX "Failed to create HTTP connection\n");
+      return false;
+   }
+
+   /* Set headers */
+   if (headers)
+   {
+      RARCH_LOG(S3_PFX "Setting headers:\n%s\n", headers);
+      net_http_connection_set_headers(conn, headers);
+   }
+
+   /* Parse the URL to set domain, port, and path */
+   if (!net_http_connection_iterate(conn))
+   {
+      RARCH_ERR(S3_PFX "Failed to iterate URL: %s\n", url);
+      net_http_connection_free(conn);
+      return false;
+   }
+
+   if (!net_http_connection_done(conn))
+   {
+      RARCH_ERR(S3_PFX "Failed to parse URL: %s\n", url);
+      net_http_connection_free(conn);
+      return false;
+   }
+
+   /* Set content if provided */
+   if (data && data_len > 0)
+      net_http_connection_set_content(conn, "application/octet-stream", data_len, data);
+   /* Create HTTP state */
+   http = net_http_new(conn);
+   if (!http)
+   {
+      RARCH_ERR(S3_PFX "Failed to create HTTP state\n");
+      net_http_connection_free(conn);
+      return false;
+   }
+
+   /* Perform HTTP operation */
+   while (!net_http_update(http, &progress, &total))
+   {
+      /* Wait for completion */
+      retro_sleep(10); /* 10ms delay */
+   }
+
+   /* Check result and call callback */
+   int status = net_http_status(http);
+
+   /* Debug: Show HTTP response details */
+   RARCH_LOG(S3_PFX "=== HTTP RESPONSE DEBUG ===\n");
+   RARCH_LOG(S3_PFX "Status: %d\n", status);
+
+   /* Get response data if available */
+   size_t response_size = 0;
+
+   const uint8_t *response_data = net_http_data(http, &response_size, true);
+   if (response_data)
+   {
+      RARCH_LOG(S3_PFX "Response data: %s\n", (const char*)response_data);
+   }
+   RARCH_LOG(S3_PFX "===========================\n");
+
+   bool success = ((status >= 200 && status < 300) || status == 404);
+   if (!success)
+   {
+      RARCH_ERR(S3_PFX "HTTP error: %d\n", net_http_status(http));
+      /* Call callback with failure */
+      if (cb_state && cb_state->cb)
+         cb_state->cb(cb_state->user_data, cb_state->path, false, NULL);
+   }
+   else
+   {
+
+      if (status >= 200 && status < 300)
+      {
+         /* Success - file exists, read it */
+         RARCH_LOG(S3_PFX "HTTP %s successful: %d\n", method, status);
+
+         /* Read the response data */
+         size_t response_size = 0;
+         const uint8_t *response_data = net_http_data(http, &response_size, false);
+
+         if (response_data && response_size > 0)
+         {
+            /* For now, just call callback with success but no file */
+            /* TODO: Implement proper file creation from response data */
+            cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
+         }
+         else
+         {
+            /* Call callback with success but no file */
+            cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
+         }
+      }
+      else if (status == 404 || status == 400)
+      {
+         /* File not found - this is success for cloud sync */
+         RARCH_LOG(S3_PFX "HTTP %s: File not found (status %d) - treating as success\n", method, status);
+         /* Call callback with success but no file */
+         cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
+      }
+      else
+      {
+         /* Other error - treat as failure */
+         RARCH_ERR(S3_PFX "HTTP %s failed with status: %d\n", method, status);
+         /* Call callback with failure */
+         cb_state->cb(cb_state->user_data, cb_state->path, false, NULL);
+      }
+   }
+
+   /* Cleanup */
+   net_http_delete(http);
+   net_http_connection_free(conn);
+
+   /* Free the callback state */
+   if (cb_state)
+      free(cb_state);
+
+   return true;
+}
+
+/* Perform S3 HTTP operation synchronously (for PUT/DELETE operations) */
+static bool s3_http_operation(const char *method, const char *url, const char *headers,
+                             const char *data, size_t data_len, s3_cb_state_t *cb_state)
+{
+   struct http_connection_t *conn = NULL;
+   struct http_t *http = NULL;
+   bool success = false;
+   size_t progress = 0, total = 0;
+
+   /* Create HTTP connection */
+   conn = net_http_connection_new(url, method, data);
+   if (!conn)
+   {
+      RARCH_ERR(S3_PFX "Failed to create HTTP connection\n");
+      return false;
+   }
+
+   /* Set headers */
+   if (headers)
+      net_http_connection_set_headers(conn, headers);
+
+   /* Parse the URL to set domain, port, and path */
+   if (!net_http_connection_iterate(conn))
+   {
+      RARCH_ERR(S3_PFX "Failed to iterate URL: %s\n", url);
+      net_http_connection_free(conn);
+      return false;
+   }
+
+   if (!net_http_connection_done(conn))
+   {
+      RARCH_ERR(S3_PFX "Failed to parse URL: %s\n", url);
+      net_http_connection_free(conn);
+      return false;
+   }
+
+   /* Set content if provided */
+   if (data && data_len > 0)
+      net_http_connection_set_content(conn, "application/octet-stream", data_len, data);
+
+   /* Create HTTP state */
+   http = net_http_new(conn);
+   if (!http)
+   {
+      RARCH_ERR(S3_PFX "Failed to create HTTP state\n");
+      net_http_connection_free(conn);
+      return false;
+   }
+
+   /* Perform HTTP operation */
+   while (!net_http_update(http, &progress, &total))
+   {
+      /* Wait for completion */
+      retro_sleep(10); /* 10ms delay */
+   }
+
+   /* Check result */
+   if (net_http_error(http))
+   {
+      RARCH_ERR(S3_PFX "HTTP error: %d\n", net_http_status(http));
+   }
+   else
+   {
+      int status = net_http_status(http);
+      if (status >= 200 && status < 300)
+      {
+         success = true;
+         RARCH_LOG(S3_PFX "HTTP %s successful: %d\n", method, status);
+      }
+      else
+      {
+         RARCH_ERR(S3_PFX "HTTP %s failed: %d\n", method, status);
+      }
+   }
+
+   /* Cleanup */
+   net_http_delete(http);
+   net_http_connection_free(conn);
+
+   return success;
+}
+
+/* Initialize S3 connection */
+static bool s3_sync_begin(cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   settings_t *settings = config_get_ptr();
+
+   if (!settings)
+      return false;
+
+   /* Copy configuration - TODO: Use actual settings when available */
+   strlcpy(s3_st->url, settings->arrays.s3_url, sizeof(settings->arrays.s3_url));
+   strlcpy(s3_st->access_key_id, settings->arrays.access_key_id, sizeof(settings->arrays.access_key_id));
+   strlcpy(s3_st->secret_access_key, settings->arrays.secret_access_key, sizeof(settings->arrays.secret_access_key));
+
+   RARCH_LOG(S3_PFX "S3 configuration - URL: '%s', Access Key ID: '%s', Secret Access Key(size): '%d'\n",
+             s3_st->url, s3_st->access_key_id, sizeof(s3_st->secret_access_key));
+
+   /* Parse URL to extract bucket, region, and host */
+   if (!s3_parse_url(s3_st->url, s3_st->bucket, s3_st->region, s3_st->host))
+   {
+      RARCH_WARN(S3_PFX "Could not parse bucket/region from URL, using defaults\n");
+   }
+
+   /* Validate configuration */
+   if (string_is_empty(s3_st->url) || string_is_empty(s3_st->access_key_id) ||
+       string_is_empty(s3_st->secret_access_key))
+   {
+      RARCH_ERR(S3_PFX "Missing S3 configuration\n");
+      return false;
+   }
+
+   RARCH_LOG(S3_PFX "S3 sync initialized for bucket: %s in region: %s\n",
+             s3_st->bucket, s3_st->region);
+
+   s3_st->connected = true;
+
+   /* Call completion handler */
+   if (cb)
+      cb(user_data, NULL, true, NULL);
+
+   return true;
+}
+
+/* Clean up S3 connection */
+static bool s3_sync_end(cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+
+   s3_st->connected = false;
+   RARCH_LOG(S3_PFX "S3 sync ended\n");
+
+   /* Call completion handler */
+   if (cb)
+      cb(user_data, NULL, true, NULL);
+
+   return true;
+}
+
+/* Read file from S3 */
+static bool s3_read(const char *path, const char *file, cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *auth_header = NULL;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+
+   if (!s3_cb_st)
+      return false;
+
+   s3_cb_st->cb = cb;
+   s3_cb_st->user_data = user_data;
+   strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
+   strlcpy(s3_cb_st->file, file, sizeof(s3_cb_st->file));
+
+   /* Build S3 URL - all supported formats are virtual-hosted style */
+   snprintf(url, sizeof(url), "%s/%s", s3_st->url, path);
+
+   /* Build canonical URI - must be URL encoded */
+   if (path && *path)
+   {
+      char *encoded_path = s3_url_encode(path);
+      if (encoded_path)
+      {
+         snprintf(canonical_uri, sizeof(canonical_uri), "/%s", encoded_path);
+         free(encoded_path);
+      }
+      else
+      {
+         strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+      }
+   }
+   else
+   {
+      strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+   }
+
+   /* Build authorization header */
+   auth_header = s3_build_auth_header("GET", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
+                                     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", s3_st);
+
+   if (!auth_header)
+   {
+      RARCH_ERR(S3_PFX "Failed to build authorization header\n");
+      free(s3_cb_st);
+      return false;
+   }
+
+   RARCH_LOG(S3_PFX "Request URL: %s\n", url);
+   RARCH_LOG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+   RARCH_LOG(S3_PFX "Authorization header:\n%s\n", auth_header);
+   RARCH_LOG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
+
+   /* Perform HTTP GET request asynchronously */
+   if (!s3_http_operation_async("GET", url, auth_header, NULL, 0, s3_cb_st))
+   {
+      RARCH_ERR(S3_PFX "Failed to start HTTP GET request\n");
+      free(auth_header);
+      free(s3_cb_st);
+      return false;
+   }
+
+   /* Don't free s3_cb_st here - it will be freed in the callback */
+   free(auth_header);
+   return true;
+}
+
+/* Update file to S3 */
+static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *auth_header = NULL;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   char *file_data = NULL;
+   size_t file_size = 0;
+   char *payload_hash = NULL;
+   bool success = false;
+
+   if (!s3_cb_st)
+      return false;
+
+   s3_cb_st->cb = cb;
+   s3_cb_st->user_data = user_data;
+   s3_cb_st->rfile = file;
+   strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
+
+   /* Get file size and data */
+   if (file)
+   {
+      filestream_seek(file, 0, SEEK_END);
+      file_size = filestream_tell(file);
+      filestream_seek(file, 0, SEEK_SET);
+
+      if (file_size > 0)
+      {
+         file_data = malloc(file_size);
+         if (file_data)
+            filestream_read(file, file_data, file_size);
+      }
+   }
+
+   /* Build S3 URL - all supported formats are virtual-hosted style */
+   snprintf(url, sizeof(url), "%s/%s", s3_st->url, path);
+
+   /* Build canonical URI - must be URL encoded */
+   if (path && *path)
+   {
+      char *encoded_path = s3_url_encode(path);
+      if (encoded_path)
+      {
+         snprintf(canonical_uri, sizeof(canonical_uri), "/%s", encoded_path);
+         free(encoded_path);
+      }
+      else
+      {
+         strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+      }
+   }
+   else
+   {
+      strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+   }
+
+   /* Calculate payload hash */
+   if (file_data && file_size > 0)
+      payload_hash = s3_sha256_hash(file_data, file_size);
+   else
+      payload_hash = strdup("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"); /* Empty file hash */
+
+   /* For large files, use multipart upload */
+   if (file_size > S3_MAX_PART_SIZE)
+   {
+      RARCH_LOG(S3_PFX "Large file detected (%zu bytes), using multipart upload\n", file_size);
+      // TODO: Implement multipart upload
+      success = false;
+   }
+   else
+   {
+      /* Single PUT request */
+      auth_header = s3_build_auth_header("PUT", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
+                                        payload_hash, s3_st);
+
+      if (!auth_header)
+      {
+         RARCH_ERR(S3_PFX "Failed to build authorization header\n");
+         if (file_data) free(file_data);
+         if (payload_hash) free(payload_hash);
+         free(s3_cb_st);
+         return false;
+      }
+
+      /* Perform HTTP PUT request */
+      success = s3_http_operation("PUT", url, auth_header, file_data, file_size, s3_cb_st);
+
+      free(auth_header);
+   }
+
+   /* Cleanup */
+   if (file_data) free(file_data);
+   if (payload_hash) free(payload_hash);
+   free(s3_cb_st);
+
+   /* Call completion handler */
+   if (cb)
+      cb(user_data, path, success, NULL);
+
+   return success;
+}
+
+/* Delete file from S3 */
+static bool s3_free(const char *path, cloud_sync_complete_handler_t cb, void *user_data)
+{
+   s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *auth_header = NULL;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   bool success = false;
+
+   if (!s3_cb_st)
+      return false;
+
+   s3_cb_st->cb = cb;
+   s3_cb_st->user_data = user_data;
+   strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
+
+   /* Build S3 URL - all supported formats are virtual-hosted style */
+   snprintf(url, sizeof(url), "%s/%s", s3_st->url, path);
+
+   /* Build canonical URI - must be URL encoded */
+   if (path && *path)
+   {
+      char *encoded_path = s3_url_encode(path);
+      if (encoded_path)
+      {
+         snprintf(canonical_uri, sizeof(canonical_uri), "/%s", encoded_path);
+         free(encoded_path);
+      }
+      else
+      {
+         strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+      }
+   }
+   else
+   {
+      strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+   }
+
+   /* Build authorization header */
+   auth_header = s3_build_auth_header("DELETE", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
+                                     "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", s3_st);
+
+   if (!auth_header)
+   {
+      RARCH_ERR(S3_PFX "Failed to build authorization header\n");
+      free(s3_cb_st);
+      return false;
+   }
+
+   /* Perform HTTP DELETE request */
+   success = s3_http_operation("DELETE", url, auth_header, NULL, 0, s3_cb_st);
+
+   free(auth_header);
+   free(s3_cb_st);
+
+   /* Call completion handler */
+   if (cb)
+      cb(user_data, path, success, NULL);
+
+   return success;
+}
+
+/* S3 cloud sync driver */
+cloud_sync_driver_t cloud_sync_s3 = {
+   s3_sync_begin,
+   s3_sync_end,
+   s3_read,
+   s3_update,
+   s3_free,
+   "s3"
+};
diff --git a/network/cloud_sync_driver.c b/network/cloud_sync_driver.c
index acd774ea9468..e7bfd78477d0 100644
--- a/network/cloud_sync_driver.c
+++ b/network/cloud_sync_driver.c
@@ -31,6 +31,9 @@ const cloud_sync_driver_t *cloud_sync_drivers[] = {
 #ifdef HAVE_SSL
    &cloud_sync_google_drive,
 #endif
+#ifdef HAVE_S3
+   &cloud_sync_s3,
+#endif
 #ifdef HAVE_ICLOUD
    &cloud_sync_icloud,
 #endif
diff --git a/network/cloud_sync_driver.h b/network/cloud_sync_driver.h
index e852f9fbbb9f..96c818b0bc1e 100644
--- a/network/cloud_sync_driver.h
+++ b/network/cloud_sync_driver.h
@@ -52,6 +52,9 @@ extern cloud_sync_driver_t cloud_sync_webdav;
 #ifdef HAVE_SSL
 extern cloud_sync_driver_t cloud_sync_google_drive;
 #endif
+#ifdef HAVE_S3
+extern cloud_sync_driver_t cloud_sync_s3;
+#endif
 #ifdef HAVE_ICLOUD
 extern cloud_sync_driver_t cloud_sync_icloud;
 #endif
diff --git a/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj b/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj
index 09ca583db37f..c7981073f09e 100644
--- a/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj
+++ b/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj
@@ -1911,6 +1911,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
 				CLANG_ANALYZER_DEADCODE_DEADSTORES = NO;
+				COMMON_SDL_CFLAGS = "-DHAVE_S3";
 				CURRENT_PROJECT_VERSION = 1;
 				ENABLE_HARDENED_RUNTIME = YES;
 			};
@@ -1923,6 +1924,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
 				CLANG_ANALYZER_DEADCODE_DEADSTORES = NO;
+				COMMON_SDL_CFLAGS = "-DHAVE_S3";
 				CURRENT_PROJECT_VERSION = 1;
 				ENABLE_HARDENED_RUNTIME = YES;
 			};

From 64dc2652dd32ebf5ff50deb4b0e3951780e8faf0 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Sun, 1 Mar 2026 14:17:33 -0600
Subject: [PATCH 02/12] Standards cleanup

* Ensure we're using C89 standards and other libretro standards
* Use more appropriate logging levels so we don't spam the log
* Fix incorrect S3 part size
---
 network/cloud_sync/s3.c | 316 ++++++++++++++++++++++++----------------
 1 file changed, 187 insertions(+), 129 deletions(-)

diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index 6f2d1dd0e646..d6d37aafa913 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -29,12 +29,22 @@
 
 #define S3_PFX "[S3] "
 
-/* S3-specific constants */
-#define S3_MAX_PART_SIZE (5 * 1024 * 1024) /* 5MB per part for multipart upload */
+/* S3 multipart constants (AWS): 5 MiB min part size, 5 GiB max part size.
+ * The nominal multipart threshold below is a local policy trigger, not an S3 limit. */
+#define S3_MULTIPART_MIN_PART_SIZE_BYTES (5ULL * 1024ULL * 1024ULL)
+#define S3_MULTIPART_MAX_PART_SIZE_BYTES (5ULL * 1024ULL * 1024ULL * 1024ULL)
 #define S3_MAX_PARTS 10000
 #define S3_SIGNATURE_VERSION "AWS4-HMAC-SHA256"
 #define S3_SERVICE "s3"
 
+#if defined(_3DS) || defined(VITA) || defined(PSP) || defined(PS2) || defined(WIIU) || defined(GEKKO)
+#define S3_MULTIPART_NOMINAL_THRESHOLD_BYTES (16ULL * 1024ULL * 1024ULL)
+#elif defined(HAVE_LIBNX)
+#define S3_MULTIPART_NOMINAL_THRESHOLD_BYTES (32ULL * 1024ULL * 1024ULL)
+#else
+#define S3_MULTIPART_NOMINAL_THRESHOLD_BYTES (64ULL * 1024ULL * 1024ULL)
+#endif
+
 typedef struct
 {
    char path[PATH_MAX_LENGTH];
@@ -62,8 +72,18 @@ s3_state_t *s3_state_get_ptr(void)
    return &s3_driver_st;
 }
 
+static size_t s3_get_multipart_nominal_threshold_bytes(void)
+{
+   if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES < S3_MULTIPART_MIN_PART_SIZE_BYTES)
+      return (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+   if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES > S3_MULTIPART_MAX_PART_SIZE_BYTES)
+      return (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
+   return (size_t)S3_MULTIPART_NOMINAL_THRESHOLD_BYTES;
+}
+
 /* Parse S3 URL to extract bucket, region, and host */
-static bool s3_parse_url(const char *url, char *bucket, char *region, char *host)
+static bool s3_parse_url(const char *url, char *bucket,  char *region,
+                         char *host, char *service)
 {
    char *bucket_start = NULL;
    char *region_start = NULL;
@@ -74,7 +94,7 @@ static bool s3_parse_url(const char *url, char *bucket, char *region, char *host
    if (!url || !bucket || !region || !host)
       return false;
 
-   RARCH_LOG(S3_PFX "Parsing S3 URL: %s\n", url);
+   RARCH_DBG(S3_PFX "Parsing S3 URL: %s\n", url);
 
    /* Initialize output buffers */
    bucket[0] = '\0';
@@ -96,24 +116,26 @@ static bool s3_parse_url(const char *url, char *bucket, char *region, char *host
    if (bucket_start)
    {
       bucket_start += 3; /* Skip "://" */
-      RARCH_LOG(S3_PFX "Found protocol separator, bucket_start: %s\n", bucket_start);
+      RARCH_DBG(S3_PFX "Found protocol separator, bucket_start: %s\n", bucket_start);
 
       dot_pos = strchr(bucket_start, '.');
       if (dot_pos)
       {
          size_t bucket_len = dot_pos - bucket_start;
-         RARCH_LOG(S3_PFX "Found first dot at position %zu, bucket length: %zu\n",
+         RARCH_DBG(S3_PFX "Found first dot at position %zu, bucket length: %zu\n",
                    (size_t)(dot_pos - bucket_start), bucket_len);
 
          if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
          {
+            char *host_start = NULL;
+            char *host_end = NULL;
             strlcpy(bucket, bucket_start, bucket_len + 1);
             bucket_found = true;
             RARCH_LOG(S3_PFX "Extracted bucket: %s\n", bucket);
 
             /* Extract host from URL */
-            char *host_start = bucket_start;
-            char *host_end = strchr(host_start, '/');
+            host_start = bucket_start;
+            host_end = strchr(host_start, '/');
             if (host_end)
             {
                size_t host_len = host_end - host_start;
@@ -297,16 +319,22 @@ static char* s3_sha256_hash(const char *data, size_t len)
 /* URL encode a string according to RFC 3986 */
 static char* s3_url_encode(const char *input)
 {
-   if (!input)
-      return NULL;
-
    size_t input_len = strlen(input);
-   char *output = malloc(input_len * 3 + 1); /* Worst case: every char needs encoding */
+   size_t output_pos = 0;
+
+   /* Worst case: every char needs encoding */
+   char *output = malloc(input_len * 3 + 1); 
+   
+   size_t i;
+   
    if (!output)
       return NULL;
+   
+   if (!input)
+      return NULL;
 
-   size_t output_pos = 0;
-   for (size_t i = 0; i < input_len; i++)
+
+   for (i = 0; i < input_len; i++)
    {
       unsigned char c = (unsigned char)input[i];
 
@@ -314,8 +342,8 @@ static char* s3_url_encode(const char *input)
       /* Path delimiters that should not be encoded: / */
       /* Query parameter delimiters that should not be encoded: &, =, ? */
       if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
-          (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~' ||
-          c == '/' || c == '&' || c == '=' || c == '?')
+          (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || 
+          c == '~' || c == '/' || c == '&' || c == '=' || c == '?')
       {
          output[output_pos++] = c;
       }
@@ -334,12 +362,14 @@ static char* s3_url_encode(const char *input)
 /* Trim whitespace from string */
 static char* s3_trim_string(const char *input)
 {
-   if (!input)
-      return NULL;
-
    size_t len = strlen(input);
    size_t start = 0;
    size_t end = len;
+   size_t trimmed_len = 0;
+   char *trimmed = NULL;
+
+   if (!input)
+      return NULL;
 
    /* Find start of non-whitespace */
    while (start < len && (input[start] == ' ' || input[start] == '\t'))
@@ -350,8 +380,8 @@ static char* s3_trim_string(const char *input)
       end--;
 
    /* Create trimmed string */
-   size_t trimmed_len = end - start;
-   char *trimmed = malloc(trimmed_len + 1);
+   trimmed_len = end - start;
+   trimmed = malloc(trimmed_len + 1);
    if (!trimmed)
       return NULL;
 
@@ -367,8 +397,9 @@ static char* s3_canonicalize_query_string(const char *query_string)
    if (!query_string || !*query_string)
       return strdup("");
 
-   /* For now, return the query string as-is since most S3 operations don't use query parameters */
-   /* A full implementation would:
+   /* For now, return the query string as-is since most S3 operations don't use
+    * query parameters
+    * A full implementation would:
     * 1. Split parameters by '&'
     * 2. URL encode each parameter name and value
     * 3. Sort parameters alphabetically by name
@@ -380,25 +411,30 @@ static char* s3_canonicalize_query_string(const char *query_string)
 /* Calculate HMAC-SHA256 and return binary result */
 static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const char *data, uint8_t *output)
 {
+   unsigned i       = 0;
+   char *inner_data = NULL;
+   size_t data_len  = strlen(data);
+
    char inner_pad[64];
    char outer_pad[64];
    uint8_t key_hash[32];
-   char *inner_data = NULL;
-   size_t data_len = strlen(data);
+
+   char inner_hash_hex[65];
+   uint8_t inner_hash_bin[32];
+   char final_hash_hex[65];
 
    /* Debug: Show input parameters */
-   RARCH_LOG(S3_PFX "HMAC input: key_len=%zu, data='%s'\n", key_len, data);
+   RARCH_DBG(S3_PFX "HMAC input: key_len=%zu, data='%s'\n", key_len, data);
 
    /* Hash the key if it's longer than 64 bytes */
    if (key_len > 64)
    {
-      RARCH_LOG(S3_PFX "HMAC: Key too long (%zu), hashing first\n", key_len);
-      /* Use a temporary buffer for the hash */
-      char temp_hash[65];
+      char temp_hash[65];/* Use a temporary buffer for the hash */
+      RARCH_DBG(S3_PFX "HMAC: Key too long (%zu), hashing first\n", key_len);
       sha256_hash(temp_hash, (const uint8_t*)key, key_len);
 
       /* Convert hex to binary */
-      for (int i = 0; i < 32; i++)
+      for (i = 0; i < 32; i++)
       {
          char hex_byte[3] = {temp_hash[i*2], temp_hash[i*2+1], 0};
          key_hash[i] = (uint8_t)strtol(hex_byte, NULL, 16);
@@ -407,9 +443,7 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
       key_len = 32;
    }
    else
-   {
-      RARCH_LOG(S3_PFX "HMAC: Key length OK (%zu), using directly\n", key_len);
-   }
+      RARCH_DBG(S3_PFX "HMAC: Key length OK (%zu), using directly\n", key_len);
 
    /* Pad the key to 64 bytes */
    memset(outer_pad, 0, 64);
@@ -427,7 +461,7 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
    }
 
    /* XOR with constants */
-   for (int i = 0; i < 64; i++)
+   for (i = 0; i < 64; i++)
    {
       outer_pad[i] ^= 0x5c;
       inner_pad[i] ^= 0x36;
@@ -442,18 +476,16 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
    memcpy(inner_data + 64, data, data_len);
 
    /* Hash and convert to binary */
-   char inner_hash_hex[65];
    sha256_hash(inner_hash_hex, (const uint8_t*)inner_data, 64 + data_len);
 
-   uint8_t inner_hash_bin[32];
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
    {
       char hex_byte[3] = {inner_hash_hex[i*2], inner_hash_hex[i*2+1], 0};
       inner_hash_bin[i] = (uint8_t)strtol(hex_byte, NULL, 16);
    }
 
    /* Outer hash: H(K XOR 0x5c, inner_hash_bin) */
-   /* We need to ensure we have enough space for outer hash (64 + 32 = 96 bytes) */
+   /* Ensure we have enough space for outer hash (64 + 32 = 96 bytes) */
    if (64 + data_len < 96)
    {
       /* Reallocate if needed */
@@ -469,11 +501,10 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
    memcpy(inner_data, outer_pad, 64);
    memcpy(inner_data + 64, inner_hash_bin, 32);
 
-   char final_hash_hex[65];
    sha256_hash(final_hash_hex, (const uint8_t*)inner_data, 64 + 32);
 
    /* Convert final result to binary */
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
    {
       char hex_byte[3] = {final_hash_hex[i*2], final_hash_hex[i*2+1], 0};
       output[i] = (uint8_t)strtol(hex_byte, NULL, 16);
@@ -488,6 +519,7 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
 /* Calculate HMAC-SHA256 (legacy function for compatibility) */
 static char* s3_hmac_sha256(const char *key, const char *data, char *output)
 {
+   unsigned i;
    char *hmac_hex = malloc(65);
    if (!hmac_hex)
       return NULL;
@@ -506,7 +538,7 @@ static char* s3_hmac_sha256(const char *key, const char *data, char *output)
       /* Hash the key if it's longer than 64 bytes */
       char temp_hash[65];
       sha256_hash(temp_hash, (const uint8_t*)key, key_len);
-      for (int i = 0; i < 32; i++)
+      for (i = 0; i < 32; i++)
       {
          char hex_byte[3] = {temp_hash[i*2], temp_hash[i*2+1], 0};
          binary_key[i] = (uint8_t)strtol(hex_byte, NULL, 16);
@@ -522,7 +554,7 @@ static char* s3_hmac_sha256(const char *key, const char *data, char *output)
    }
 
    /* Convert binary result to hex */
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
       snprintf(hmac_hex + 2 * i, 3, "%02x", (unsigned)result[i]);
 
    hmac_hex[64] = '\0';
@@ -534,6 +566,7 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
                                         const char *region, const char *service,
                                         const char *string_to_sign)
 {
+   unsigned i;
    char *signature = malloc(65);
    if (!signature)
       return NULL;
@@ -545,87 +578,94 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    uint8_t k_signing[32];
    uint8_t final_signature[32];
 
+   char k_date_hex[65];
+   char k_region_hex[65];
+   char *k_region_hex_result = NULL;
+   char k_service_hex[65];
+   char k_signing_sample[9];
+   char k_signing_full[65];
+
    /* Build AWS4 key string */
    snprintf(aws4_key, sizeof(aws4_key), "AWS4%s", secret_key);
 
-   RARCH_LOG(S3_PFX "AWS4 key: %s\n", aws4_key);
-   RARCH_LOG(S3_PFX "Date: %s, Region: %s, Service: %s\n", date, region, service);
+   RARCH_DBG(S3_PFX "AWS4 key: %s\n", aws4_key);
+   RARCH_DBG(S3_PFX "Date: %s, Region: %s, Service: %s\n", date, region, service);
 
    /* Derive keys step by step using binary HMAC throughout */
    /* Step 1: DateKey = HMAC-SHA256("AWS4" + SecretAccessKey, Date) */
    /* Note: aws4_key is a string, but HMAC treats it as byte data */
-   RARCH_LOG(S3_PFX "Step 1: HMAC-SHA256(key_len=%zu, data='%s')\n", strlen(aws4_key), date);
+   RARCH_DBG(S3_PFX "Step 1: HMAC-SHA256(key_len=%zu, data='%s')\n", strlen(aws4_key), date);
    if (!s3_hmac_sha256_bin((uint8_t*)aws4_key, strlen(aws4_key), date, k_date))
       goto error;
 
    /* Debug: Show k_date */
-   char k_date_hex[65];
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
       snprintf(k_date_hex + 2 * i, 3, "%02x", (unsigned)k_date[i]);
    k_date_hex[64] = '\0';
-   RARCH_LOG(S3_PFX "k_date: %s\n", k_date_hex);
+   RARCH_DBG(S3_PFX "k_date: %s\n", k_date_hex);
 
    /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
-   RARCH_LOG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
+   RARCH_DBG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
    if (!s3_hmac_sha256_bin(k_date, 32, region, k_region))
       goto error;
 
    /* Debug: Show k_region */
-   char k_region_hex[65];
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
       snprintf(k_region_hex + 2 * i, 3, "%02x", (unsigned)k_region[i]);
    k_region_hex[64] = '\0';
-   RARCH_LOG(S3_PFX "k_region: %s\n", k_region_hex);
+   RARCH_DBG(S3_PFX "k_region: %s\n", k_region_hex);
 
 
 
    /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
-   RARCH_LOG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
-   char *k_region_hex_result = s3_hmac_sha256(k_date_hex, region, NULL);
-   RARCH_LOG(S3_PFX "k_region: %s\n", k_region_hex_result);
+   RARCH_DBG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
+   k_region_hex_result = s3_hmac_sha256(k_date_hex, region, NULL);
+   RARCH_DBG(S3_PFX "k_region: %s\n", k_region_hex_result);
    free(k_region_hex_result);
 
 
 
 
    /* Step 3: DateRegionServiceKey = HMAC-SHA256(DateRegionKey, Service) */
-   RARCH_LOG(S3_PFX "Step 3: HMAC-SHA256(binary_key, data='%s')\n", service);
+   RARCH_DBG(S3_PFX "Step 3: HMAC-SHA256(binary_key, data='%s')\n", service);
    if (!s3_hmac_sha256_bin(k_region, 32, service, k_service))
       goto error;
 
    /* Debug: Show k_service */
-   char k_service_hex[65];
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
       snprintf(k_service_hex + 2 * i, 3, "%02x", (unsigned)k_service[i]);
    k_service_hex[64] = '\0';
-   RARCH_LOG(S3_PFX "k_service: %s\n", k_service_hex);
+   RARCH_DBG(S3_PFX "k_service: %s\n", k_service_hex);
 
    /* Step 4: SigningKey = HMAC-SHA256(DateRegionServiceKey, "aws4_request") */
-   RARCH_LOG(S3_PFX "Step 4: HMAC-SHA256(binary_key, data='aws4_request')\n");
+   RARCH_DBG(S3_PFX "Step 4: HMAC-SHA256(binary_key, data='aws4_request')\n");
    if (!s3_hmac_sha256_bin(k_service, 32, "aws4_request", k_signing))
       goto error;
 
-   RARCH_LOG(S3_PFX "Key derivation completed successfully\n");
+   RARCH_DBG(S3_PFX "Key derivation completed successfully\n");
 
    /* Debug: Show first few bytes of signing key */
-   char k_signing_sample[9];
    snprintf(k_signing_sample, sizeof(k_signing_sample), "%02x%02x%02x%02x", k_signing[0], k_signing[1], k_signing[2], k_signing[3]);
 
-   RARCH_LOG(S3_PFX "Signing key sample: %s...\n", k_signing_sample);
+   RARCH_DBG(S3_PFX "Signing key sample: %s...\n", k_signing_sample);
 
    /* Debug: Show complete signing key */
-   char k_signing_full[65];
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
       snprintf(k_signing_full + 2 * i, 3, "%02x", (unsigned)k_signing[i]);
    k_signing_full[64] = '\0';
-   RARCH_LOG(S3_PFX "Complete signing key: %s\n", k_signing_full);
+   RARCH_DBG(S3_PFX "Complete signing key: %s\n", k_signing_full);
 
-   /* Calculate final signature using the derived signing key in binary format */
+   /* Calculate final signature using the derived signing key in binary
+   * format
+   */
    if (!s3_hmac_sha256_bin(k_signing, 32, string_to_sign, final_signature))
+   {
+      RARCH_ERR(S3_PFX "Failed to calculate final signature\n");
       goto error;
+   }
 
    /* Convert final signature to hex string */
-   for (int i = 0; i < 32; i++)
+   for (i = 0; i < 32; i++)
       snprintf(signature + 2 * i, 3, "%02x", (unsigned)final_signature[i]);
 
    signature[64] = '\0';
@@ -659,28 +699,32 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
    strftime(date, sizeof(date), "%Y%m%d", tm_info);
    strftime(datetime, sizeof(datetime), "%Y%m%dT%H%M%SZ", tm_info);
 
-   RARCH_LOG(S3_PFX "Date: %s, DateTime: %s\n", date, datetime);
+   RARCH_DBG(S3_PFX "Date: %s, DateTime: %s\n", date, datetime);
 
    /* Build credential scope */
    snprintf(credential_scope, sizeof(credential_scope), "%s/%s/%s/aws4_request",
             date, region, service);
 
-   RARCH_LOG(S3_PFX "Credential scope: %s\n", credential_scope);
+   RARCH_DBG(S3_PFX "Credential scope: %s\n", credential_scope);
 
    /* Build canonical headers */
    if (headers)
    {
-      /* Format headers for canonical request - must be sorted alphabetically and lowercase */
-      /* Each header must be trimmed and end with a newline */
+      /* Format headers for canonical request - must be sorted alphabetically
+       * and lowercase. Each header must be trimmed and end with a newline.
+       * Each header must be in the following order:
+       * host
+       * x-amz-content-sha256
+       * x-amz-date
+       */
       canonical_headers = malloc(512);
       if (canonical_headers)
       {
-         /* Headers must be in alphabetical order: host, x-amz-content-sha256, x-amz-date */
          snprintf(canonical_headers, 512, "host:%s\nx-amz-content-sha256:%s\nx-amz-date:%s\n",
                   host, payload_hash, datetime);
       }
 
-      RARCH_LOG(S3_PFX "Canonical headers:\n%s", canonical_headers ? canonical_headers : "NULL");
+      RARCH_DBG(S3_PFX "Canonical headers:\n%s", canonical_headers ? canonical_headers : "NULL");
    }
 
    /* Build signed headers list */
@@ -702,19 +746,15 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
             signed_headers,
             payload_hash);
 
-   RARCH_LOG(S3_PFX "Canonical request:\n%s\n", canonical_request);
-   RARCH_LOG(S3_PFX "Host: %s\n", host);
-   RARCH_LOG(S3_PFX "Canonical URI: %s\n", canonical_uri);
-   RARCH_LOG(S3_PFX "Method: %s\n", method);
+   RARCH_DBG(S3_PFX "Canonical request:\n%s\n", canonical_request);
+   RARCH_DBG(S3_PFX "Host: %s\n", host);
+   RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+   RARCH_DBG(S3_PFX "Method: %s\n", method);
 
    /* Calculate SHA256 hash of canonical request */
    canonical_request_hash = s3_sha256_hash(canonical_request, strlen(canonical_request));
    if (!canonical_request_hash)
-   {
-      if (canonical_headers) free(canonical_headers);
-      if (canonical_query_string) free(canonical_query_string);
-      return NULL;
-   }
+      goto cleanup;
 
    /* Build string to sign */
    snprintf(string_to_sign, sizeof(string_to_sign),
@@ -724,14 +764,14 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
             credential_scope,
             canonical_request_hash);
 
-   RARCH_LOG(S3_PFX "String to sign:\n%s\n", string_to_sign);
+   RARCH_DBG(S3_PFX "String to sign:\n%s\n", string_to_sign);
 
    /* Calculate signature using AWS Signature Version 4 key derivation */
    signature = s3_calculate_aws4_signature(secret_key, date, region, service, string_to_sign);
 
    if (signature)
    {
-      RARCH_LOG(S3_PFX "Calculated signature: %s\n", signature);
+      RARCH_DBG(S3_PFX "Calculated signature: %s\n", signature);
    }
    else
    {
@@ -739,9 +779,13 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
    }
 
    /* Cleanup */
-   if (canonical_headers) free(canonical_headers);
-   if (canonical_query_string) free(canonical_query_string);
-   if (canonical_request_hash) free(canonical_request_hash);
+   cleanup:
+   if (canonical_headers)
+      free(canonical_headers);
+   if (canonical_query_string)
+      free(canonical_query_string);
+   if (canonical_request_hash)
+      free(canonical_request_hash);
 
    return signature;
 }
@@ -798,23 +842,28 @@ static bool s3_http_operation_async(const char *method, const char *url, const c
 {
    struct http_connection_t *conn = NULL;
    struct http_t *http = NULL;
-   size_t progress = 0, total = 0;
+   int status = 0;
+   size_t progress = 0, total = 0, response_size = 0;
+   const uint8_t *response_data = NULL;
+   bool success = false;
 
    /* Debug: Show complete HTTP request details */
-   RARCH_LOG(S3_PFX "=== HTTP REQUEST DEBUG ===\n");
-   RARCH_LOG(S3_PFX "Method: %s\n", method);
-   RARCH_LOG(S3_PFX "URL: %s\n", url);
-   RARCH_LOG(S3_PFX "Headers: %s\n", headers ? headers : "(none)");
-   RARCH_LOG(S3_PFX "Data length: %zu\n", data_len);
+   RARCH_DBG(S3_PFX "=== HTTP REQUEST DEBUG ===\n");
+   RARCH_DBG(S3_PFX "Method: %s\n", method);
+   RARCH_DBG(S3_PFX "URL: %s\n", url);
+   RARCH_DBG(S3_PFX "Headers: %s\n", headers ? headers : "(none)");
+   RARCH_DBG(S3_PFX "Data length: %zu\n", data_len);
    if (data && data_len > 0)
    {
-      RARCH_LOG(S3_PFX "Data preview: ");
-      size_t preview_len = data_len > 64 ? 64 : data_len;
-      for (size_t i = 0; i < preview_len; i++)
-         RARCH_LOG(S3_PFX "%02x", (unsigned char)data[i]);
-      RARCH_LOG(S3_PFX "%s\n", data_len > 64 ? "..." : "");
+      size_t i;
+      size_t preview_len;
+      RARCH_DBG(S3_PFX "Data preview: ");
+      preview_len = data_len > 64 ? 64 : data_len;
+      for (i = 0; i < preview_len; i++)
+         RARCH_DBG(S3_PFX "%02x", (unsigned char)data[i]);
+      RARCH_DBG(S3_PFX "%s\n", data_len > 64 ? "..." : "");
    }
-   RARCH_LOG(S3_PFX "========================\n");
+   RARCH_DBG(S3_PFX "========================\n");
 
    /* Create HTTP connection */
    conn = net_http_connection_new(url, method, data);
@@ -827,7 +876,7 @@ static bool s3_http_operation_async(const char *method, const char *url, const c
    /* Set headers */
    if (headers)
    {
-      RARCH_LOG(S3_PFX "Setting headers:\n%s\n", headers);
+      RARCH_DBG(S3_PFX "Setting headers:\n%s\n", headers);
       net_http_connection_set_headers(conn, headers);
    }
 
@@ -866,23 +915,21 @@ static bool s3_http_operation_async(const char *method, const char *url, const c
    }
 
    /* Check result and call callback */
-   int status = net_http_status(http);
+   status = net_http_status(http);
 
    /* Debug: Show HTTP response details */
-   RARCH_LOG(S3_PFX "=== HTTP RESPONSE DEBUG ===\n");
-   RARCH_LOG(S3_PFX "Status: %d\n", status);
+   RARCH_DBG(S3_PFX "=== HTTP RESPONSE DEBUG ===\n");
+   RARCH_DBG(S3_PFX "Status: %d\n", status);
 
    /* Get response data if available */
-   size_t response_size = 0;
-
-   const uint8_t *response_data = net_http_data(http, &response_size, true);
+   response_data = net_http_data(http, &response_size, true);
    if (response_data)
    {
-      RARCH_LOG(S3_PFX "Response data: %s\n", (const char*)response_data);
+      RARCH_DBG(S3_PFX "Response data: %s\n", (const char*)response_data);
    }
-   RARCH_LOG(S3_PFX "===========================\n");
+   RARCH_DBG(S3_PFX "===========================\n");
 
-   bool success = ((status >= 200 && status < 300) || status == 404);
+   success = ((status >= 200 && status < 300) || status == 404);
    if (!success)
    {
       RARCH_ERR(S3_PFX "HTTP error: %d\n", net_http_status(http));
@@ -895,12 +942,13 @@ static bool s3_http_operation_async(const char *method, const char *url, const c
 
       if (status >= 200 && status < 300)
       {
+         size_t response_size = 0;
+         const uint8_t *response_data = NULL;
          /* Success - file exists, read it */
-         RARCH_LOG(S3_PFX "HTTP %s successful: %d\n", method, status);
+         RARCH_DBG(S3_PFX "HTTP %s %s successful: %d\n", method, cb_state->path, status);
 
          /* Read the response data */
-         size_t response_size = 0;
-         const uint8_t *response_data = net_http_data(http, &response_size, false);
+         response_data = net_http_data(http, &response_size, false);
 
          if (response_data && response_size > 0)
          {
@@ -917,7 +965,7 @@ static bool s3_http_operation_async(const char *method, const char *url, const c
       else if (status == 404 || status == 400)
       {
          /* File not found - this is success for cloud sync */
-         RARCH_LOG(S3_PFX "HTTP %s: File not found (status %d) - treating as success\n", method, status);
+         RARCH_WARN(S3_PFX "HTTP %s: File not found (status %d) - treating as success\n", method, status);
          /* Call callback with success but no file */
          cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
       }
@@ -999,9 +1047,7 @@ static bool s3_http_operation(const char *method, const char *url, const char *h
 
    /* Check result */
    if (net_http_error(http))
-   {
       RARCH_ERR(S3_PFX "HTTP error: %d\n", net_http_status(http));
-   }
    else
    {
       int status = net_http_status(http);
@@ -1037,11 +1083,11 @@ static bool s3_sync_begin(cloud_sync_complete_handler_t cb, void *user_data)
    strlcpy(s3_st->access_key_id, settings->arrays.access_key_id, sizeof(settings->arrays.access_key_id));
    strlcpy(s3_st->secret_access_key, settings->arrays.secret_access_key, sizeof(settings->arrays.secret_access_key));
 
-   RARCH_LOG(S3_PFX "S3 configuration - URL: '%s', Access Key ID: '%s', Secret Access Key(size): '%d'\n",
+   RARCH_DBG(S3_PFX "S3 configuration - URL: '%s', Access Key ID: '%s', Secret Access Key(size): '%d'\n",
              s3_st->url, s3_st->access_key_id, sizeof(s3_st->secret_access_key));
 
    /* Parse URL to extract bucket, region, and host */
-   if (!s3_parse_url(s3_st->url, s3_st->bucket, s3_st->region, s3_st->host))
+   if (!s3_parse_url(s3_st->url, s3_st->bucket, s3_st->region, s3_st->host, S3_SERVICE))
    {
       RARCH_WARN(S3_PFX "Could not parse bucket/region from URL, using defaults\n");
    }
@@ -1131,10 +1177,10 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
       return false;
    }
 
-   RARCH_LOG(S3_PFX "Request URL: %s\n", url);
-   RARCH_LOG(S3_PFX "Canonical URI: %s\n", canonical_uri);
-   RARCH_LOG(S3_PFX "Authorization header:\n%s\n", auth_header);
-   RARCH_LOG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
+   RARCH_DBG(S3_PFX "Request URL: %s\n", url);
+   RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+   RARCH_DBG(S3_PFX "Authorization header:\n%s\n", auth_header);
+   RARCH_DBG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
 
    /* Perform HTTP GET request asynchronously */
    if (!s3_http_operation_async("GET", url, auth_header, NULL, 0, s3_cb_st))
@@ -1161,6 +1207,7 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
    char *file_data = NULL;
    size_t file_size = 0;
    char *payload_hash = NULL;
+   size_t multipart_threshold = s3_get_multipart_nominal_threshold_bytes();
    bool success = false;
 
    if (!s3_cb_st)
@@ -1208,6 +1255,9 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
       strlcpy(canonical_uri, "/", sizeof(canonical_uri));
    }
 
+   RARCH_DBG(S3_PFX "Request URL: %s\n", url);
+   RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
+
    /* Calculate payload hash */
    if (file_data && file_size > 0)
       payload_hash = s3_sha256_hash(file_data, file_size);
@@ -1215,10 +1265,11 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
       payload_hash = strdup("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"); /* Empty file hash */
 
    /* For large files, use multipart upload */
-   if (file_size > S3_MAX_PART_SIZE)
+   if (file_size > multipart_threshold)
    {
-      RARCH_LOG(S3_PFX "Large file detected (%zu bytes), using multipart upload\n", file_size);
-      // TODO: Implement multipart upload
+      RARCH_LOG(S3_PFX "Large file detected (%zu bytes, nominal multipart threshold: %zu bytes), using multipart upload\n",
+            file_size, multipart_threshold);
+      /* TODO: Implement multipart upload */
       success = false;
    }
    else
@@ -1227,11 +1278,16 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
       auth_header = s3_build_auth_header("PUT", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
                                         payload_hash, s3_st);
 
+      RARCH_DBG(S3_PFX "Authorization header:\n%s\n", auth_header);
+      RARCH_DBG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
+
       if (!auth_header)
       {
          RARCH_ERR(S3_PFX "Failed to build authorization header\n");
-         if (file_data) free(file_data);
-         if (payload_hash) free(payload_hash);
+         if (file_data)
+            free(file_data);
+         if (payload_hash)
+            free(payload_hash);
          free(s3_cb_st);
          return false;
       }
@@ -1243,8 +1299,10 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
    }
 
    /* Cleanup */
-   if (file_data) free(file_data);
-   if (payload_hash) free(payload_hash);
+   if (file_data)
+      free(file_data);
+   if (payload_hash)
+      free(payload_hash);
    free(s3_cb_st);
 
    /* Call completion handler */

From 39af5ecf1e54d630abf04011175830ca0bb90713 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Sun, 1 Mar 2026 17:16:04 -0600
Subject: [PATCH 03/12] Move to task-based non-blocking pattern

Similar to how the WebDAV driver uses async tasks to do network
operations I'm moving the MVP of S3 to do this also.
---
 network/cloud_sync/s3.c | 411 ++++++++++++++--------------------------
 1 file changed, 139 insertions(+), 272 deletions(-)

diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index d6d37aafa913..e27582e0ad4c 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -14,13 +14,10 @@
 
 #include <encodings/base64.h>
 #include <lrc_hash.h>
-#include <net/net_http.h>
 #include <string/stdstring.h>
 #include <time/rtime.h>
 #include <formats/rjson.h>
 #include <retro_miscellaneous.h>
-#include <unistd.h>
-#include <retro_timers.h>
 
 #include "../cloud_sync_driver.h"
 #include "../../retroarch.h"
@@ -74,11 +71,12 @@ s3_state_t *s3_state_get_ptr(void)
 
 static size_t s3_get_multipart_nominal_threshold_bytes(void)
 {
-   if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES < S3_MULTIPART_MIN_PART_SIZE_BYTES)
-      return (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
-   if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES > S3_MULTIPART_MAX_PART_SIZE_BYTES)
-      return (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
-   return (size_t)S3_MULTIPART_NOMINAL_THRESHOLD_BYTES;
+   // if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES < S3_MULTIPART_MIN_PART_SIZE_BYTES)
+   //    return (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+   // if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES > S3_MULTIPART_MAX_PART_SIZE_BYTES)
+   //    return (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
+   // return (size_t)S3_MULTIPART_NOMINAL_THRESHOLD_BYTES;
+   return (64ULL * 1024ULL);
 }
 
 /* Parse S3 URL to extract bucket, region, and host */
@@ -521,11 +519,14 @@ static char* s3_hmac_sha256(const char *key, const char *data, char *output)
 {
    unsigned i;
    char *hmac_hex = malloc(65);
+   uint8_t binary_key[64];
+   size_t key_len;
+   uint8_t result[32];
+
    if (!hmac_hex)
       return NULL;
 
-   uint8_t binary_key[64];
-   size_t key_len = strlen(key);
+   key_len = strlen(key);
 
    /* Convert key to binary */
    if (key_len <= 64)
@@ -546,7 +547,6 @@ static char* s3_hmac_sha256(const char *key, const char *data, char *output)
       key_len = 32;
    }
 
-   uint8_t result[32];
    if (!s3_hmac_sha256_bin(binary_key, key_len, data, result))
    {
       free(hmac_hex);
@@ -567,17 +567,13 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
                                         const char *string_to_sign)
 {
    unsigned i;
-   char *signature = malloc(65);
-   if (!signature)
-      return NULL;
-
+   char *signature;
    char aws4_key[128];
    uint8_t k_date[32];
    uint8_t k_region[32];
    uint8_t k_service[32];
    uint8_t k_signing[32];
    uint8_t final_signature[32];
-
    char k_date_hex[65];
    char k_region_hex[65];
    char *k_region_hex_result = NULL;
@@ -585,6 +581,10 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    char k_signing_sample[9];
    char k_signing_full[65];
 
+   signature = malloc(65);
+   if (!signature)
+      return NULL;
+
    /* Build AWS4 key string */
    snprintf(aws4_key, sizeof(aws4_key), "AWS4%s", secret_key);
 
@@ -732,9 +732,7 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
 
    /* Build canonical query string */
    if (query_string)
-   {
       canonical_query_string = s3_canonicalize_query_string(query_string);
-   }
 
    /* Build canonical request */
    snprintf(canonical_request, sizeof(canonical_request),
@@ -770,13 +768,9 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
    signature = s3_calculate_aws4_signature(secret_key, date, region, service, string_to_sign);
 
    if (signature)
-   {
       RARCH_DBG(S3_PFX "Calculated signature: %s\n", signature);
-   }
    else
-   {
       RARCH_ERR(S3_PFX "Failed to calculate signature\n");
-   }
 
    /* Cleanup */
    cleanup:
@@ -836,237 +830,122 @@ static char* s3_build_auth_header(const char *method, const char *canonical_uri,
    return auth_header;
 }
 
-/* Perform S3 HTTP operation asynchronously (for read operations) */
-static bool s3_http_operation_async(const char *method, const char *url, const char *headers,
-                                   const char *data, size_t data_len, s3_cb_state_t *cb_state)
+static void s3_log_http_failure(const char *path, http_transfer_data_t *data)
 {
-   struct http_connection_t *conn = NULL;
-   struct http_t *http = NULL;
-   int status = 0;
-   size_t progress = 0, total = 0, response_size = 0;
-   const uint8_t *response_data = NULL;
-   bool success = false;
-
-   /* Debug: Show complete HTTP request details */
-   RARCH_DBG(S3_PFX "=== HTTP REQUEST DEBUG ===\n");
-   RARCH_DBG(S3_PFX "Method: %s\n", method);
-   RARCH_DBG(S3_PFX "URL: %s\n", url);
-   RARCH_DBG(S3_PFX "Headers: %s\n", headers ? headers : "(none)");
-   RARCH_DBG(S3_PFX "Data length: %zu\n", data_len);
-   if (data && data_len > 0)
-   {
-      size_t i;
-      size_t preview_len;
-      RARCH_DBG(S3_PFX "Data preview: ");
-      preview_len = data_len > 64 ? 64 : data_len;
-      for (i = 0; i < preview_len; i++)
-         RARCH_DBG(S3_PFX "%02x", (unsigned char)data[i]);
-      RARCH_DBG(S3_PFX "%s\n", data_len > 64 ? "..." : "");
-   }
-   RARCH_DBG(S3_PFX "========================\n");
-
-   /* Create HTTP connection */
-   conn = net_http_connection_new(url, method, data);
-   if (!conn)
-   {
-      RARCH_ERR(S3_PFX "Failed to create HTTP connection\n");
-      return false;
-   }
-
-   /* Set headers */
-   if (headers)
-   {
-      RARCH_DBG(S3_PFX "Setting headers:\n%s\n", headers);
-      net_http_connection_set_headers(conn, headers);
-   }
-
-   /* Parse the URL to set domain, port, and path */
-   if (!net_http_connection_iterate(conn))
-   {
-      RARCH_ERR(S3_PFX "Failed to iterate URL: %s\n", url);
-      net_http_connection_free(conn);
-      return false;
-   }
-
-   if (!net_http_connection_done(conn))
-   {
-      RARCH_ERR(S3_PFX "Failed to parse URL: %s\n", url);
-      net_http_connection_free(conn);
-      return false;
-   }
-
-   /* Set content if provided */
-   if (data && data_len > 0)
-      net_http_connection_set_content(conn, "application/octet-stream", data_len, data);
-   /* Create HTTP state */
-   http = net_http_new(conn);
-   if (!http)
+   size_t i;
+   RARCH_WARN(S3_PFX "Failed: %s: HTTP %d\n", path ? path : "<unknown>", data->status);
+   for (i = 0; data->headers && i < data->headers->size; i++)
+      RARCH_WARN(S3_PFX "%s\n", data->headers->elems[i].data);
+   if (data->data)
    {
-      RARCH_ERR(S3_PFX "Failed to create HTTP state\n");
-      net_http_connection_free(conn);
-      return false;
+      data->data[data->len] = '\0';
+      RARCH_WARN(S3_PFX "%s\n", data->data);
    }
+}
 
-   /* Perform HTTP operation */
-   while (!net_http_update(http, &progress, &total))
-   {
-      /* Wait for completion */
-      retro_sleep(10); /* 10ms delay */
-   }
+static void s3_read_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_cb_state_t *s3_cb_st       = (s3_cb_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && ((data->status >= 200 && data->status < 300) || data->status == 404 || data->status == 400));
+   RFILE *file                   = NULL;
 
-   /* Check result and call callback */
-   status = net_http_status(http);
+   (void)task;
+   (void)err;
 
-   /* Debug: Show HTTP response details */
-   RARCH_DBG(S3_PFX "=== HTTP RESPONSE DEBUG ===\n");
-   RARCH_DBG(S3_PFX "Status: %d\n", status);
+   if (!s3_cb_st)
+      return;
 
-   /* Get response data if available */
-   response_data = net_http_data(http, &response_size, true);
-   if (response_data)
-   {
-      RARCH_DBG(S3_PFX "Response data: %s\n", (const char*)response_data);
-   }
-   RARCH_DBG(S3_PFX "===========================\n");
+   if (!data)
+      RARCH_WARN(S3_PFX "Did not get HTTP data for read '%s'\n", s3_cb_st->path);
+   else if (!success)
+      s3_log_http_failure(s3_cb_st->path, data);
 
-   success = ((status >= 200 && status < 300) || status == 404);
-   if (!success)
-   {
-      RARCH_ERR(S3_PFX "HTTP error: %d\n", net_http_status(http));
-      /* Call callback with failure */
-      if (cb_state && cb_state->cb)
-         cb_state->cb(cb_state->user_data, cb_state->path, false, NULL);
-   }
-   else
+   if (success && data && data->status >= 200 && data->status < 300)
    {
-
-      if (status >= 200 && status < 300)
+      file = filestream_open(s3_cb_st->file,
+            RETRO_VFS_FILE_ACCESS_READ_WRITE,
+            RETRO_VFS_FILE_ACCESS_HINT_NONE);
+      if (!file)
       {
-         size_t response_size = 0;
-         const uint8_t *response_data = NULL;
-         /* Success - file exists, read it */
-         RARCH_DBG(S3_PFX "HTTP %s %s successful: %d\n", method, cb_state->path, status);
-
-         /* Read the response data */
-         response_data = net_http_data(http, &response_size, false);
-
-         if (response_data && response_size > 0)
-         {
-            /* For now, just call callback with success but no file */
-            /* TODO: Implement proper file creation from response data */
-            cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
-         }
-         else
-         {
-            /* Call callback with success but no file */
-            cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
-         }
-      }
-      else if (status == 404 || status == 400)
-      {
-         /* File not found - this is success for cloud sync */
-         RARCH_WARN(S3_PFX "HTTP %s: File not found (status %d) - treating as success\n", method, status);
-         /* Call callback with success but no file */
-         cb_state->cb(cb_state->user_data, cb_state->path, true, NULL);
+         RARCH_WARN(S3_PFX "Failed to open local file for read '%s'\n", s3_cb_st->file);
+         success = false;
       }
       else
       {
-         /* Other error - treat as failure */
-         RARCH_ERR(S3_PFX "HTTP %s failed with status: %d\n", method, status);
-         /* Call callback with failure */
-         cb_state->cb(cb_state->user_data, cb_state->path, false, NULL);
+         if (data->data && data->len > 0)
+            filestream_write(file, data->data, data->len);
+         filestream_seek(file, 0, SEEK_SET);
       }
    }
 
-   /* Cleanup */
-   net_http_delete(http);
-   net_http_connection_free(conn);
-
-   /* Free the callback state */
-   if (cb_state)
-      free(cb_state);
-
-   return true;
+   if (s3_cb_st->cb)
+      s3_cb_st->cb(s3_cb_st->user_data, s3_cb_st->path, success, file);
+   free(s3_cb_st);
 }
 
-/* Perform S3 HTTP operation synchronously (for PUT/DELETE operations) */
-static bool s3_http_operation(const char *method, const char *url, const char *headers,
-                             const char *data, size_t data_len, s3_cb_state_t *cb_state)
+static void s3_update_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
 {
-   struct http_connection_t *conn = NULL;
-   struct http_t *http = NULL;
-   bool success = false;
-   size_t progress = 0, total = 0;
+   s3_cb_state_t *s3_cb_st       = (s3_cb_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
 
-   /* Create HTTP connection */
-   conn = net_http_connection_new(url, method, data);
-   if (!conn)
-   {
-      RARCH_ERR(S3_PFX "Failed to create HTTP connection\n");
-      return false;
-   }
+   (void)task;
+   (void)err;
 
-   /* Set headers */
-   if (headers)
-      net_http_connection_set_headers(conn, headers);
+   if (!s3_cb_st)
+      return;
 
-   /* Parse the URL to set domain, port, and path */
-   if (!net_http_connection_iterate(conn))
-   {
-      RARCH_ERR(S3_PFX "Failed to iterate URL: %s\n", url);
-      net_http_connection_free(conn);
-      return false;
-   }
+   if (!data)
+      RARCH_WARN(S3_PFX "Did not get HTTP data for update '%s'\n", s3_cb_st->path);
+   else if (!success)
+      s3_log_http_failure(s3_cb_st->path, data);
 
-   if (!net_http_connection_done(conn))
-   {
-      RARCH_ERR(S3_PFX "Failed to parse URL: %s\n", url);
-      net_http_connection_free(conn);
-      return false;
-   }
+   if (s3_cb_st->cb)
+      s3_cb_st->cb(s3_cb_st->user_data, s3_cb_st->path, success, s3_cb_st->rfile);
+   free(s3_cb_st);
+}
 
-   /* Set content if provided */
-   if (data && data_len > 0)
-      net_http_connection_set_content(conn, "application/octet-stream", data_len, data);
+static void s3_delete_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_cb_state_t *s3_cb_st       = (s3_cb_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
 
-   /* Create HTTP state */
-   http = net_http_new(conn);
-   if (!http)
-   {
-      RARCH_ERR(S3_PFX "Failed to create HTTP state\n");
-      net_http_connection_free(conn);
-      return false;
-   }
+   (void)task;
+   (void)err;
 
-   /* Perform HTTP operation */
-   while (!net_http_update(http, &progress, &total))
-   {
-      /* Wait for completion */
-      retro_sleep(10); /* 10ms delay */
-   }
+   if (!s3_cb_st)
+      return;
 
-   /* Check result */
-   if (net_http_error(http))
-      RARCH_ERR(S3_PFX "HTTP error: %d\n", net_http_status(http));
-   else
-   {
-      int status = net_http_status(http);
-      if (status >= 200 && status < 300)
-      {
-         success = true;
-         RARCH_LOG(S3_PFX "HTTP %s successful: %d\n", method, status);
-      }
-      else
-      {
-         RARCH_ERR(S3_PFX "HTTP %s failed: %d\n", method, status);
-      }
-   }
+   if (!data)
+      RARCH_WARN(S3_PFX "Did not get HTTP data for delete '%s'\n", s3_cb_st->path);
+   else if (!success)
+      s3_log_http_failure(s3_cb_st->path, data);
 
-   /* Cleanup */
-   net_http_delete(http);
-   net_http_connection_free(conn);
+   if (s3_cb_st->cb)
+      s3_cb_st->cb(s3_cb_st->user_data, s3_cb_st->path, success, NULL);
+   free(s3_cb_st);
+}
 
-   return success;
+static bool s3_http_get_async(const char *url, const char *headers, s3_cb_state_t *cb_state)
+{
+   return task_push_http_transfer_with_headers(url, true, NULL,
+         headers, s3_read_cb, cb_state) != NULL;
+}
+
+static bool s3_http_put_async(const char *url, const char *headers,
+      const void *data, size_t data_len, s3_cb_state_t *cb_state)
+{
+   return task_push_http_transfer_with_content(url, "PUT",
+         data, data_len, "application/octet-stream", true,
+         headers, s3_update_cb, cb_state) != NULL;
+}
+
+static bool s3_http_delete_async(const char *url, const char *headers, s3_cb_state_t *cb_state)
+{
+   return task_push_http_transfer_with_headers(url, true, "DELETE",
+         headers, s3_delete_cb, cb_state) != NULL;
 }
 
 /* Initialize S3 connection */
@@ -1088,9 +967,7 @@ static bool s3_sync_begin(cloud_sync_complete_handler_t cb, void *user_data)
 
    /* Parse URL to extract bucket, region, and host */
    if (!s3_parse_url(s3_st->url, s3_st->bucket, s3_st->region, s3_st->host, S3_SERVICE))
-   {
       RARCH_WARN(S3_PFX "Could not parse bucket/region from URL, using defaults\n");
-   }
 
    /* Validate configuration */
    if (string_is_empty(s3_st->url) || string_is_empty(s3_st->access_key_id) ||
@@ -1135,6 +1012,7 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
    char *auth_header = NULL;
    char url[PATH_MAX_LENGTH];
    char canonical_uri[PATH_MAX_LENGTH];
+   bool success = false;
 
    if (!s3_cb_st)
       return false;
@@ -1157,14 +1035,10 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
          free(encoded_path);
       }
       else
-      {
          strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-      }
    }
    else
-   {
       strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-   }
 
    /* Build authorization header */
    auth_header = s3_build_auth_header("GET", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
@@ -1173,8 +1047,7 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
    if (!auth_header)
    {
       RARCH_ERR(S3_PFX "Failed to build authorization header\n");
-      free(s3_cb_st);
-      return false;
+      goto cleanup;
    }
 
    RARCH_DBG(S3_PFX "Request URL: %s\n", url);
@@ -1183,17 +1056,21 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
    RARCH_DBG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
 
    /* Perform HTTP GET request asynchronously */
-   if (!s3_http_operation_async("GET", url, auth_header, NULL, 0, s3_cb_st))
+   if (!s3_http_get_async(url, auth_header, s3_cb_st))
    {
       RARCH_ERR(S3_PFX "Failed to start HTTP GET request\n");
-      free(auth_header);
-      free(s3_cb_st);
-      return false;
+      goto cleanup;
    }
 
-   /* Don't free s3_cb_st here - it will be freed in the callback */
+   /* Ownership transferred to async callback */
+   s3_cb_st = NULL;
+   success = true;
+
+cleanup:
    free(auth_header);
-   return true;
+   free(s3_cb_st);
+
+   return success;
 }
 
 /* Update file to S3 */
@@ -1246,14 +1123,10 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
          free(encoded_path);
       }
       else
-      {
          strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-      }
    }
    else
-   {
       strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-   }
 
    RARCH_DBG(S3_PFX "Request URL: %s\n", url);
    RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
@@ -1270,7 +1143,7 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
       RARCH_LOG(S3_PFX "Large file detected (%zu bytes, nominal multipart threshold: %zu bytes), using multipart upload\n",
             file_size, multipart_threshold);
       /* TODO: Implement multipart upload */
-      success = false;
+      goto cleanup;
    }
    else
    {
@@ -1284,31 +1157,26 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
       if (!auth_header)
       {
          RARCH_ERR(S3_PFX "Failed to build authorization header\n");
-         if (file_data)
-            free(file_data);
-         if (payload_hash)
-            free(payload_hash);
-         free(s3_cb_st);
-         return false;
+         goto cleanup;
       }
 
       /* Perform HTTP PUT request */
-      success = s3_http_operation("PUT", url, auth_header, file_data, file_size, s3_cb_st);
-
-      free(auth_header);
+      if (!s3_http_put_async(url, auth_header, file_data, file_size, s3_cb_st))
+      {
+         RARCH_ERR(S3_PFX "Failed to start HTTP PUT request\n");
+         goto cleanup;
+      }
+      /* Ownership transferred to async callback */
+      s3_cb_st = NULL;
+      success = true;
    }
 
-   /* Cleanup */
-   if (file_data)
-      free(file_data);
-   if (payload_hash)
-      free(payload_hash);
+cleanup:
+   free(auth_header);
+   free(file_data);
+   free(payload_hash);
    free(s3_cb_st);
 
-   /* Call completion handler */
-   if (cb)
-      cb(user_data, path, success, NULL);
-
    return success;
 }
 
@@ -1342,14 +1210,10 @@ static bool s3_free(const char *path, cloud_sync_complete_handler_t cb, void *us
          free(encoded_path);
       }
       else
-      {
          strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-      }
    }
    else
-   {
       strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-   }
 
    /* Build authorization header */
    auth_header = s3_build_auth_header("DELETE", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
@@ -1358,20 +1222,23 @@ static bool s3_free(const char *path, cloud_sync_complete_handler_t cb, void *us
    if (!auth_header)
    {
       RARCH_ERR(S3_PFX "Failed to build authorization header\n");
-      free(s3_cb_st);
-      return false;
+      goto cleanup;
    }
 
    /* Perform HTTP DELETE request */
-   success = s3_http_operation("DELETE", url, auth_header, NULL, 0, s3_cb_st);
+   success = s3_http_delete_async(url, auth_header, s3_cb_st);
+   if (!success)
+   {
+      RARCH_ERR(S3_PFX "Failed to start HTTP DELETE request\n");
+      goto cleanup;
+   }
+   /* Ownership transferred to async callback */
+   s3_cb_st = NULL;
 
+cleanup:
    free(auth_header);
    free(s3_cb_st);
 
-   /* Call completion handler */
-   if (cb)
-      cb(user_data, path, success, NULL);
-
    return success;
 }
 

From 737ba8f77d302f61c43853a201b72dfb6b2402ff Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Sun, 1 Mar 2026 17:41:52 -0600
Subject: [PATCH 04/12] Build fixes

---
 Makefile.libnx          | 1 +
 configuration.c         | 2 +-
 menu/menu_displaylist.c | 4 ++++
 menu/menu_setting.c     | 1 -
 4 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Makefile.libnx b/Makefile.libnx
index 42c004a67056..ae9769f4e327 100644
--- a/Makefile.libnx
+++ b/Makefile.libnx
@@ -59,6 +59,7 @@ HAVE_IBXM = 1
 HAVE_CORE_INFO_CACHE = 1
 HAVE_CLOUDSYNC = 1
 HAVE_SSL = 1
+HAVE_S3 = 1
 
 # RetroArch libnx useful flags
 HAVE_THREADS = 1
diff --git a/configuration.c b/configuration.c
index 5d76f2481137..8913a54b9f05 100644
--- a/configuration.c
+++ b/configuration.c
@@ -1617,8 +1617,8 @@ static struct config_array_setting *populate_settings_array(
    SETTING_ARRAY("cheevos_leaderboards_enable",  settings->arrays.cheevos_leaderboards_enable, true, "", true); /* deprecated */
 #endif
 
-#ifdef HAVE_NETWORKING
    SETTING_ARRAY("netplay_mitm_server",          settings->arrays.netplay_mitm_server, false, NULL, true);
+#ifdef HAVE_NETWORKING
 #ifdef HAVE_CLOUDSYNC
    SETTING_ARRAY("webdav_url",                   settings->arrays.webdav_url, false, NULL, true);
    SETTING_ARRAY("webdav_username",              settings->arrays.webdav_username, false, NULL, true);
diff --git a/menu/menu_displaylist.c b/menu/menu_displaylist.c
index 351c1c6c93f1..afdba82c304a 100644
--- a/menu/menu_displaylist.c
+++ b/menu/menu_displaylist.c
@@ -11356,9 +11356,11 @@ unsigned menu_displaylist_build_list(
                {MENU_ENUM_LABEL_CLOUD_SYNC_URL,                PARSE_ONLY_STRING,         false},
                {MENU_ENUM_LABEL_CLOUD_SYNC_USERNAME,           PARSE_ONLY_STRING,         false},
                {MENU_ENUM_LABEL_CLOUD_SYNC_PASSWORD,           PARSE_ONLY_STRING,         false},
+#ifdef HAVE_S3
                {MENU_ENUM_LABEL_CLOUD_SYNC_S3_URL,             PARSE_ONLY_STRING,         false},
                {MENU_ENUM_LABEL_CLOUD_SYNC_ACCESS_KEY_ID,      PARSE_ONLY_STRING,         false},
                {MENU_ENUM_LABEL_CLOUD_SYNC_SECRET_ACCESS_KEY,  PARSE_ONLY_STRING,         false},
+#endif
             };
 
             for (i = 0; i < ARRAY_SIZE(build_list); i++)
@@ -11388,6 +11390,8 @@ unsigned menu_displaylist_build_list(
                      if (string_is_equal(settings->arrays.cloud_sync_driver, "s3"))
                         build_list[i].checked = true;
                      break;
+                  default:
+                     break;
                   }
 
             for (i = 0; i < ARRAY_SIZE(build_list); i++)
diff --git a/menu/menu_setting.c b/menu/menu_setting.c
index 2681090c8af6..4336fb2a3812 100644
--- a/menu/menu_setting.c
+++ b/menu/menu_setting.c
@@ -12334,7 +12334,6 @@ static bool setting_append_list(
          (*list)[list_info->index - 1].ui_type       = ST_UI_TYPE_PASSWORD_LINE_EDIT;
          (*list)[list_info->index - 1].action_start  = setting_generic_action_start_default;
 #endif
-
          END_SUB_GROUP(list, list_info, parent_group);
          END_GROUP(list, list_info, parent_group);
 #endif

From a1457a1985a7ac0021c03fcb1ac8488318a44b9e Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Mon, 9 Mar 2026 14:43:16 -0500
Subject: [PATCH 05/12] Add multipart uploads for S3

---
 libretro-common/include/net/net_http.h |   1 +
 libretro-common/net/net_http.c         |  87 ++-
 network/cloud_sync/s3.c                | 896 ++++++++++++++++++++++---
 tasks/task_http.c                      |  48 +-
 tasks/tasks_internal.h                 |   5 +
 5 files changed, 929 insertions(+), 108 deletions(-)

diff --git a/libretro-common/include/net/net_http.h b/libretro-common/include/net/net_http.h
index 7b68ddd6304d..14fa8f9ec0f2 100644
--- a/libretro-common/include/net/net_http.h
+++ b/libretro-common/include/net/net_http.h
@@ -106,6 +106,7 @@ bool net_http_error(struct http_t *state);
  * If the status is not 20x and accept_error is false, it returns NULL.
  **/
 struct string_list *net_http_headers(struct http_t *state);
+struct string_list *net_http_headers_ex(struct http_t *state, bool accept_error);
 
 /**
  * net_http_data:
diff --git a/libretro-common/net/net_http.c b/libretro-common/net/net_http.c
index c43c238afedf..8fc8087e50d3 100644
--- a/libretro-common/net/net_http.c
+++ b/libretro-common/net/net_http.c
@@ -23,6 +23,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <ctype.h>
+#include <errno.h>
 
 #include <net/net_http.h>
 #include <net/net_compat.h>
@@ -133,6 +134,54 @@ struct http_connection_t
    bool ssl;
 };
 
+static void net_http_log_transport_state(
+      const struct http_t *state, const char *stage, ssize_t io_len)
+{
+#if defined(DEBUG)
+   const char *method = "GET";
+   const char *domain = "<null>";
+   const char *path   = "<null>";
+   int port           = 0;
+   int fd             = -1;
+   int connected      = 0;
+
+   if (state)
+   {
+      method = state->request.method ? state->request.method : "GET";
+      domain = state->request.domain ? state->request.domain : "<null>";
+      path   = state->request.path ? state->request.path : "<null>";
+      port   = state->request.port;
+
+      if (state->conn)
+      {
+         fd        = state->conn->fd;
+         connected = state->conn->connected ? 1 : 0;
+      }
+   }
+
+   fprintf(stderr,
+         "[net_http] %s: method=%s host=%s port=%d path=/%s ssl=%d fd=%d connected=%d request_sent=%d err=%d io_len=%ld errno=%d (%s)\n",
+         stage ? stage : "unknown",
+         method,
+         domain,
+         port,
+         path,
+         state ? (state->ssl ? 1 : 0) : 0,
+         fd,
+         connected,
+         state ? (state->request_sent ? 1 : 0) : 0,
+         state ? (state->err ? 1 : 0) : 0,
+         (long)io_len,
+         errno,
+         strerror(errno));
+   fflush(stderr);
+#else
+   (void)state;
+   (void)stage;
+   (void)io_len;
+#endif
+}
+
 struct dns_cache_entry
 {
    char *domain;
@@ -920,6 +969,7 @@ static bool net_http_new_socket(struct http_t *state)
          int fd;
          if (!entry->addr)
          {
+            net_http_log_transport_state(state, "dns_lookup_failed", -1);
             UNLOCK_DNS_CACHE();
             return false;
          }
@@ -927,6 +977,8 @@ static bool net_http_new_socket(struct http_t *state)
          fd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
          if (fd >= 0)
             state->conn = net_http_conn_pool_add(state->request.domain, state->request.port, fd, state->ssl);
+         else
+            net_http_log_transport_state(state, "socket_create_failed", -1);
          /* still waiting on thread */
          UNLOCK_DNS_CACHE();
          return (fd >= 0);
@@ -960,6 +1012,11 @@ static bool net_http_connect(struct http_t *state)
    struct conn_pool_entry *conn = state->conn;
    struct dns_cache_entry *dns_entry = net_http_dns_cache_find(state->request.domain, state->request.port);
    /* we just used/added this in _new_socket above, if it's not there it's a big bug */
+   if (!dns_entry || !dns_entry->addr || !conn)
+   {
+      net_http_log_transport_state(state, "connect_missing_dns_or_conn", -1);
+      return false;
+   }
    addr = dns_entry->addr;
 
 #ifndef HAVE_SSL
@@ -968,13 +1025,11 @@ static bool net_http_connect(struct http_t *state)
 #else
    if (state->ssl)
    {
-      if (!conn)
-         return false;
-
       for (next_addr = addr; conn->fd >= 0; conn->fd = socket_next((void**)&next_addr))
       {
          if (!(conn->ssl_ctx = ssl_socket_init(conn->fd, state->request.domain)))
          {
+            net_http_log_transport_state(state, "ssl_init_failed", -1);
             socket_close(conn->fd);
             break;
          }
@@ -992,6 +1047,7 @@ static bool net_http_connect(struct http_t *state)
 
          if (ssl_socket_connect(conn->ssl_ctx, next_addr, timeout, true) < 0)
          {
+            net_http_log_transport_state(state, "ssl_connect_failed", -1);
             ssl_socket_close(conn->ssl_ctx);
             ssl_socket_free(conn->ssl_ctx);
             conn->ssl_ctx = NULL;
@@ -1019,6 +1075,7 @@ static bool net_http_connect(struct http_t *state)
             return true;
          }
 
+         net_http_log_transport_state(state, "socket_connect_failed", -1);
          socket_close(conn->fd);
       }
       conn->fd    = -1; /* already closed */
@@ -1039,14 +1096,20 @@ static void net_http_send_str(
    {
       if (!ssl_socket_send_all_blocking(
                   state->conn->ssl_ctx, text, text_size, true))
+      {
          state->err = true;
+         net_http_log_transport_state(state, "ssl_send_failed", -1);
+      }
    }
    else
 #endif
    {
       if (!socket_send_all_blocking(
                   state->conn->fd, text, text_size, true))
+      {
          state->err = true;
+         net_http_log_transport_state(state, "socket_send_failed", -1);
+      }
    }
 }
 
@@ -1097,9 +1160,12 @@ static bool net_http_send_request(struct http_t *state)
       size_t _len, len;
       char *len_str = NULL;
 
-      if (!request->postdata && !string_is_equal(request->method, "PUT"))
+      if (!request->postdata &&
+            !string_is_equal(request->method, "PUT") &&
+            request->contentlength > 0)
       {
          state->err = true;
+         net_http_log_transport_state(state, "post_without_payload", -1);
          return true;
       }
 
@@ -1460,6 +1526,7 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
    {
       if (_len < 0 || state->err)
       {
+         net_http_log_transport_state(state, "receive_header_failed", _len);
          net_http_conn_pool_remove(state->conn);
          state->conn      = NULL;
          state->err       = true;
@@ -1474,6 +1541,7 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
    {
       if (!net_http_receive_body(state, _len))
       {
+         net_http_log_transport_state(state, "receive_body_failed", _len);
          net_http_conn_pool_remove(state->conn);
          state->conn      = NULL;
          state->err       = true;
@@ -1548,13 +1616,20 @@ int net_http_status(struct http_t *state)
  * caller of net_http_new; it is not freed by net_http_delete().
  * If the status is not 20x and accept_err is false, it returns NULL.
  **/
-struct string_list *net_http_headers(struct http_t *state)
+struct string_list *net_http_headers_ex(struct http_t *state, bool accept_err)
 {
-   if (!state || !state->err)
+   if (!state)
+      return NULL;
+   if (!accept_err && !state->err)
       return NULL;
    return state->response.headers;
 }
 
+struct string_list *net_http_headers(struct http_t *state)
+{
+   return net_http_headers_ex(state, false);
+}
+
 /**
  * net_http_data:
  *
diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index e27582e0ad4c..95db1323b401 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -14,6 +14,7 @@
 
 #include <encodings/base64.h>
 #include <lrc_hash.h>
+// #include <net/net_http.h>
 #include <string/stdstring.h>
 #include <time/rtime.h>
 #include <formats/rjson.h>
@@ -31,6 +32,7 @@
 #define S3_MULTIPART_MIN_PART_SIZE_BYTES (5ULL * 1024ULL * 1024ULL)
 #define S3_MULTIPART_MAX_PART_SIZE_BYTES (5ULL * 1024ULL * 1024ULL * 1024ULL)
 #define S3_MAX_PARTS 10000
+#define S3_EMPTY_PAYLOAD_SHA256 "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 #define S3_SIGNATURE_VERSION "AWS4-HMAC-SHA256"
 #define S3_SERVICE "s3"
 
@@ -62,6 +64,21 @@ typedef struct
    bool connected;
 } s3_state_t;
 
+typedef struct
+{
+   s3_cb_state_t *cb_state;
+   char url[PATH_MAX_LENGTH];
+   char canonical_uri[PATH_MAX_LENGTH];
+   char *file_data;
+   size_t file_size;
+   size_t part_size;
+   size_t part_count;
+   size_t current_part;
+   char *upload_id;
+   char **part_etags;
+   bool aborting;
+} s3_multipart_state_t;
+
 static s3_state_t s3_driver_st = {0};
 
 s3_state_t *s3_state_get_ptr(void)
@@ -71,12 +88,45 @@ s3_state_t *s3_state_get_ptr(void)
 
 static size_t s3_get_multipart_nominal_threshold_bytes(void)
 {
-   // if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES < S3_MULTIPART_MIN_PART_SIZE_BYTES)
-   //    return (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
-   // if (S3_MULTIPART_NOMINAL_THRESHOLD_BYTES > S3_MULTIPART_MAX_PART_SIZE_BYTES)
-   //    return (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
-   // return (size_t)S3_MULTIPART_NOMINAL_THRESHOLD_BYTES;
-   return (64ULL * 1024ULL);
+   size_t threshold = (size_t)S3_MULTIPART_NOMINAL_THRESHOLD_BYTES;
+   if (threshold < (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES)
+      threshold = (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+   if (threshold > (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES)
+      threshold = (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
+   return threshold;
+}
+
+static bool s3_calculate_multipart_plan(size_t file_size, size_t *out_part_size, size_t *out_part_count)
+{
+   size_t part_size  = s3_get_multipart_nominal_threshold_bytes();
+   size_t part_count = 0;
+
+   if (!out_part_size || !out_part_count || file_size == 0)
+      return false;
+
+   if (part_size < (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES)
+      part_size = (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+   if (part_size > (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES)
+      part_size = (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES;
+
+   part_count = (file_size + part_size - 1) / part_size;
+
+   if (part_count > S3_MAX_PARTS)
+   {
+      part_size = (file_size + S3_MAX_PARTS - 1) / S3_MAX_PARTS;
+      if (part_size < (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES)
+         part_size = (size_t)S3_MULTIPART_MIN_PART_SIZE_BYTES;
+      if (part_size > (size_t)S3_MULTIPART_MAX_PART_SIZE_BYTES)
+         return false;
+
+      part_count = (file_size + part_size - 1) / part_size;
+      if (part_count > S3_MAX_PARTS)
+         return false;
+   }
+
+   *out_part_size  = part_size;
+   *out_part_count = part_count;
+   return true;
 }
 
 /* Parse S3 URL to extract bucket, region, and host */
@@ -421,14 +471,10 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
    uint8_t inner_hash_bin[32];
    char final_hash_hex[65];
 
-   /* Debug: Show input parameters */
-   RARCH_DBG(S3_PFX "HMAC input: key_len=%zu, data='%s'\n", key_len, data);
-
    /* Hash the key if it's longer than 64 bytes */
    if (key_len > 64)
    {
       char temp_hash[65];/* Use a temporary buffer for the hash */
-      RARCH_DBG(S3_PFX "HMAC: Key too long (%zu), hashing first\n", key_len);
       sha256_hash(temp_hash, (const uint8_t*)key, key_len);
 
       /* Convert hex to binary */
@@ -441,7 +487,8 @@ static uint8_t* s3_hmac_sha256_bin(const uint8_t *key, size_t key_len, const cha
       key_len = 32;
    }
    else
-      RARCH_DBG(S3_PFX "HMAC: Key length OK (%zu), using directly\n", key_len);
+   {
+   }
 
    /* Pad the key to 64 bytes */
    memset(outer_pad, 0, 64);
@@ -576,10 +623,7 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    uint8_t final_signature[32];
    char k_date_hex[65];
    char k_region_hex[65];
-   char *k_region_hex_result = NULL;
    char k_service_hex[65];
-   char k_signing_sample[9];
-   char k_signing_full[65];
 
    signature = malloc(65);
    if (!signature)
@@ -588,13 +632,9 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    /* Build AWS4 key string */
    snprintf(aws4_key, sizeof(aws4_key), "AWS4%s", secret_key);
 
-   RARCH_DBG(S3_PFX "AWS4 key: %s\n", aws4_key);
-   RARCH_DBG(S3_PFX "Date: %s, Region: %s, Service: %s\n", date, region, service);
-
    /* Derive keys step by step using binary HMAC throughout */
    /* Step 1: DateKey = HMAC-SHA256("AWS4" + SecretAccessKey, Date) */
    /* Note: aws4_key is a string, but HMAC treats it as byte data */
-   RARCH_DBG(S3_PFX "Step 1: HMAC-SHA256(key_len=%zu, data='%s')\n", strlen(aws4_key), date);
    if (!s3_hmac_sha256_bin((uint8_t*)aws4_key, strlen(aws4_key), date, k_date))
       goto error;
 
@@ -602,10 +642,7 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    for (i = 0; i < 32; i++)
       snprintf(k_date_hex + 2 * i, 3, "%02x", (unsigned)k_date[i]);
    k_date_hex[64] = '\0';
-   RARCH_DBG(S3_PFX "k_date: %s\n", k_date_hex);
-
    /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
-   RARCH_DBG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
    if (!s3_hmac_sha256_bin(k_date, 32, region, k_region))
       goto error;
 
@@ -613,21 +650,7 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    for (i = 0; i < 32; i++)
       snprintf(k_region_hex + 2 * i, 3, "%02x", (unsigned)k_region[i]);
    k_region_hex[64] = '\0';
-   RARCH_DBG(S3_PFX "k_region: %s\n", k_region_hex);
-
-
-
-   /* Step 2: DateRegionKey = HMAC-SHA256(DateKey, Region) */
-   RARCH_DBG(S3_PFX "Step 2: HMAC-SHA256(binary_key, data='%s')\n", region);
-   k_region_hex_result = s3_hmac_sha256(k_date_hex, region, NULL);
-   RARCH_DBG(S3_PFX "k_region: %s\n", k_region_hex_result);
-   free(k_region_hex_result);
-
-
-
-
    /* Step 3: DateRegionServiceKey = HMAC-SHA256(DateRegionKey, Service) */
-   RARCH_DBG(S3_PFX "Step 3: HMAC-SHA256(binary_key, data='%s')\n", service);
    if (!s3_hmac_sha256_bin(k_region, 32, service, k_service))
       goto error;
 
@@ -635,26 +658,10 @@ static char* s3_calculate_aws4_signature(const char *secret_key, const char *dat
    for (i = 0; i < 32; i++)
       snprintf(k_service_hex + 2 * i, 3, "%02x", (unsigned)k_service[i]);
    k_service_hex[64] = '\0';
-   RARCH_DBG(S3_PFX "k_service: %s\n", k_service_hex);
-
    /* Step 4: SigningKey = HMAC-SHA256(DateRegionServiceKey, "aws4_request") */
-   RARCH_DBG(S3_PFX "Step 4: HMAC-SHA256(binary_key, data='aws4_request')\n");
    if (!s3_hmac_sha256_bin(k_service, 32, "aws4_request", k_signing))
       goto error;
 
-   RARCH_DBG(S3_PFX "Key derivation completed successfully\n");
-
-   /* Debug: Show first few bytes of signing key */
-   snprintf(k_signing_sample, sizeof(k_signing_sample), "%02x%02x%02x%02x", k_signing[0], k_signing[1], k_signing[2], k_signing[3]);
-
-   RARCH_DBG(S3_PFX "Signing key sample: %s...\n", k_signing_sample);
-
-   /* Debug: Show complete signing key */
-   for (i = 0; i < 32; i++)
-      snprintf(k_signing_full + 2 * i, 3, "%02x", (unsigned)k_signing[i]);
-   k_signing_full[64] = '\0';
-   RARCH_DBG(S3_PFX "Complete signing key: %s\n", k_signing_full);
-
    /* Calculate final signature using the derived signing key in binary
    * format
    */
@@ -699,14 +706,10 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
    strftime(date, sizeof(date), "%Y%m%d", tm_info);
    strftime(datetime, sizeof(datetime), "%Y%m%dT%H%M%SZ", tm_info);
 
-   RARCH_DBG(S3_PFX "Date: %s, DateTime: %s\n", date, datetime);
-
    /* Build credential scope */
    snprintf(credential_scope, sizeof(credential_scope), "%s/%s/%s/aws4_request",
             date, region, service);
 
-   RARCH_DBG(S3_PFX "Credential scope: %s\n", credential_scope);
-
    /* Build canonical headers */
    if (headers)
    {
@@ -724,7 +727,6 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
                   host, payload_hash, datetime);
       }
 
-      RARCH_DBG(S3_PFX "Canonical headers:\n%s", canonical_headers ? canonical_headers : "NULL");
    }
 
    /* Build signed headers list */
@@ -744,11 +746,6 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
             signed_headers,
             payload_hash);
 
-   RARCH_DBG(S3_PFX "Canonical request:\n%s\n", canonical_request);
-   RARCH_DBG(S3_PFX "Host: %s\n", host);
-   RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
-   RARCH_DBG(S3_PFX "Method: %s\n", method);
-
    /* Calculate SHA256 hash of canonical request */
    canonical_request_hash = s3_sha256_hash(canonical_request, strlen(canonical_request));
    if (!canonical_request_hash)
@@ -762,14 +759,9 @@ static char* s3_calculate_signature_v4_with_time(const char *method, const char
             credential_scope,
             canonical_request_hash);
 
-   RARCH_DBG(S3_PFX "String to sign:\n%s\n", string_to_sign);
-
    /* Calculate signature using AWS Signature Version 4 key derivation */
    signature = s3_calculate_aws4_signature(secret_key, date, region, service, string_to_sign);
-
-   if (signature)
-      RARCH_DBG(S3_PFX "Calculated signature: %s\n", signature);
-   else
+   if (!signature)
       RARCH_ERR(S3_PFX "Failed to calculate signature\n");
 
    /* Cleanup */
@@ -948,6 +940,692 @@ static bool s3_http_delete_async(const char *url, const char *headers, s3_cb_sta
          headers, s3_delete_cb, cb_state) != NULL;
 }
 
+static bool s3_build_request_url(char *url, size_t url_size, s3_state_t *s3_st, const char *path)
+{
+   char *encoded_path = NULL;
+
+   if (!url || !s3_st || string_is_empty(s3_st->url))
+      return false;
+
+   if (string_is_empty(path))
+   {
+      strlcpy(url, s3_st->url, url_size);
+      return true;
+   }
+
+   encoded_path = s3_url_encode(path);
+   if (!encoded_path)
+      return false;
+
+   snprintf(url, url_size, "%s/%s", s3_st->url, encoded_path);
+   free(encoded_path);
+   return true;
+}
+
+static char* s3_url_encode_query_value(const char *input)
+{
+   size_t input_len = 0;
+   size_t output_pos = 0;
+   size_t i = 0;
+   char *output = NULL;
+
+   if (!input)
+      return NULL;
+
+   input_len = strlen(input);
+   output = (char*)malloc(input_len * 3 + 1);
+   if (!output)
+      return NULL;
+
+   for (i = 0; i < input_len; i++)
+   {
+      unsigned char c = (unsigned char)input[i];
+      if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+          (c >= '0' && c <= '9') || c == '-' || c == '.' || c == '_' || c == '~')
+      {
+         output[output_pos++] = (char)c;
+      }
+      else
+      {
+         output[output_pos++] = '%';
+         output[output_pos++] = "0123456789ABCDEF"[c >> 4];
+         output[output_pos++] = "0123456789ABCDEF"[c & 0x0F];
+      }
+   }
+
+   output[output_pos] = '\0';
+   return output;
+}
+
+static char* s3_build_url_with_query(const char *url, const char *query)
+{
+   size_t total = 0;
+   char *result = NULL;
+
+   if (string_is_empty(url))
+      return NULL;
+
+   total = strlen(url) + (query ? strlen(query) : 0) + 2;
+   result = (char*)malloc(total);
+   if (!result)
+      return NULL;
+
+   if (query && *query)
+      snprintf(result, total, "%s?%s", url, query);
+   else
+      strlcpy(result, url, total);
+
+   return result;
+}
+
+static char* s3_extract_xml_tag_value(const char *xml, const char *tag_name)
+{
+   char open_tag[64];
+   char close_tag[64];
+   const char *start = NULL;
+   const char *end = NULL;
+   size_t len = 0;
+   char *value = NULL;
+
+   if (string_is_empty(xml) || string_is_empty(tag_name))
+      return NULL;
+
+   snprintf(open_tag, sizeof(open_tag), "<%s>", tag_name);
+   snprintf(close_tag, sizeof(close_tag), "</%s>", tag_name);
+
+   start = strstr(xml, open_tag);
+   if (!start)
+      return NULL;
+   start += strlen(open_tag);
+
+   end = strstr(start, close_tag);
+   if (!end || end <= start)
+      return NULL;
+
+   len = (size_t)(end - start);
+   value = (char*)malloc(len + 1);
+   if (!value)
+      return NULL;
+
+   memcpy(value, start, len);
+   value[len] = '\0';
+   return value;
+}
+
+static char* s3_extract_header_value(http_transfer_data_t *data, const char *header_name)
+{
+   size_t i;
+   char prefix[64];
+
+   if (!data || !data->headers || string_is_empty(header_name))
+      return NULL;
+
+   snprintf(prefix, sizeof(prefix), "%s:", header_name);
+
+   for (i = 0; i < data->headers->size; i++)
+   {
+      const char *line = data->headers->elems[i].data;
+      const char *start = NULL;
+      const char *end = NULL;
+      size_t len = 0;
+      char *out = NULL;
+
+      if (string_is_empty(line))
+         continue;
+      if (!string_starts_with_case_insensitive(line, prefix))
+         continue;
+
+      start = line + strlen(prefix);
+      while (*start == ' ' || *start == '\t')
+         start++;
+
+      end = start + strlen(start);
+      while (end > start && (end[-1] == '\r' || end[-1] == '\n' || end[-1] == ' ' || end[-1] == '\t'))
+         end--;
+
+      len = (size_t)(end - start);
+      out = (char*)malloc(len + 1);
+      if (!out)
+         return NULL;
+      memcpy(out, start, len);
+      out[len] = '\0';
+      return out;
+   }
+
+   return NULL;
+}
+
+static void s3_multipart_free(s3_multipart_state_t *mp_st)
+{
+   size_t i;
+   if (!mp_st)
+      return;
+
+   if (mp_st->part_etags)
+   {
+      for (i = 0; i < mp_st->part_count; i++)
+         free(mp_st->part_etags[i]);
+      free(mp_st->part_etags);
+   }
+
+   free(mp_st->upload_id);
+   free(mp_st->file_data);
+   free(mp_st->cb_state);
+   free(mp_st);
+}
+
+static void s3_multipart_finish(s3_multipart_state_t *mp_st, bool success)
+{
+   if (mp_st && mp_st->cb_state && mp_st->cb_state->cb)
+      mp_st->cb_state->cb(mp_st->cb_state->user_data, mp_st->cb_state->path, success, mp_st->cb_state->rfile);
+   s3_multipart_free(mp_st);
+}
+
+static void s3_multipart_upload_next_part(s3_multipart_state_t *mp_st);
+static void s3_multipart_abort(s3_multipart_state_t *mp_st);
+static bool s3_multipart_start(s3_multipart_state_t *mp_st);
+
+static bool s3_multipart_part_bounds(const s3_multipart_state_t *mp_st,
+      size_t part_index, size_t *out_offset, size_t *out_content_len)
+{
+   size_t offset;
+   size_t remaining;
+   size_t content_len;
+
+   if (!mp_st || !out_offset || !out_content_len)
+      return false;
+   if (part_index >= mp_st->part_count)
+      return false;
+   if (!mp_st->part_size)
+      return false;
+   if (part_index > (mp_st->file_size / mp_st->part_size))
+      return false;
+
+   offset = part_index * mp_st->part_size;
+   if (offset >= mp_st->file_size)
+      return false;
+
+   remaining   = mp_st->file_size - offset;
+   content_len = remaining < mp_st->part_size ? remaining : mp_st->part_size;
+   if (!content_len)
+      return false;
+   if (content_len > (mp_st->file_size - offset))
+      return false;
+
+   *out_offset      = offset;
+   *out_content_len = content_len;
+   return true;
+}
+
+static void s3_log_multipart_initiate_failure(
+      s3_multipart_state_t *mp_st, http_transfer_data_t *data, const char *err)
+{
+   size_t i;
+
+   if (!mp_st)
+      return;
+
+   RARCH_WARN(S3_PFX "Multipart initiate diagnostic: path='%s' url_query='uploads=' canonical_query='uploads=' data=%s status=%d len=%zu headers=%zu err='%s'\n",
+         mp_st->cb_state ? mp_st->cb_state->path : "<unknown>",
+         data ? "present" : "missing",
+         data ? data->status : -1,
+         data ? data->len : 0,
+         (data && data->headers) ? data->headers->size : 0,
+         (err && *err) ? err : "<none>");
+
+   if (data && data->headers)
+      for (i = 0; i < data->headers->size; i++)
+         RARCH_WARN(S3_PFX "Multipart initiate header[%zu]: %s\n", i, data->headers->elems[i].data);
+
+   if (data && data->data && data->len > 0)
+   {
+      data->data[data->len] = '\0';
+      RARCH_WARN(S3_PFX "Multipart initiate body: %s\n", data->data);
+   }
+}
+
+static bool s3_multipart_fallback_single_put(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *payload_hash = NULL;
+   char *auth_header = NULL;
+
+   if (!mp_st || !mp_st->cb_state)
+      return false;
+
+   if (mp_st->file_data && mp_st->file_size > 0)
+      payload_hash = s3_sha256_hash(mp_st->file_data, mp_st->file_size);
+   else
+      payload_hash = strdup(S3_EMPTY_PAYLOAD_SHA256);
+
+   if (!payload_hash)
+      return false;
+
+   auth_header = s3_build_auth_header("PUT", mp_st->canonical_uri, "",
+         "host;x-amz-content-sha256;x-amz-date", payload_hash, s3_st);
+   if (!auth_header)
+   {
+      free(payload_hash);
+      return false;
+   }
+
+   if (!s3_http_put_async(mp_st->url, auth_header,
+            mp_st->file_data, mp_st->file_size, mp_st->cb_state))
+   {
+      free(payload_hash);
+      free(auth_header);
+      return false;
+   }
+
+   /* Callback ownership transferred to the HTTP task. */
+   mp_st->cb_state = NULL;
+
+   free(payload_hash);
+   free(auth_header);
+   return true;
+}
+
+static void s3_multipart_fail(s3_multipart_state_t *mp_st, http_transfer_data_t *data, const char *phase)
+{
+   if (!mp_st)
+      return;
+
+   if (data)
+      s3_log_http_failure(mp_st->cb_state ? mp_st->cb_state->path : phase, data);
+   else
+      RARCH_WARN(S3_PFX "Multipart upload failed during %s\n", phase ? phase : "unknown phase");
+
+   if (!string_is_empty(mp_st->upload_id) && !mp_st->aborting)
+      s3_multipart_abort(mp_st);
+   else
+      s3_multipart_finish(mp_st, false);
+}
+
+static void s3_multipart_abort_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+      RARCH_WARN(S3_PFX "Multipart abort request was not successful\n");
+
+   s3_multipart_finish(mp_st, false);
+}
+
+static void s3_multipart_abort(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *encoded_upload_id = NULL;
+   char *query = NULL;
+   char *url_with_query = NULL;
+   char *auth_header = NULL;
+
+   if (!mp_st || string_is_empty(mp_st->upload_id))
+   {
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+
+   mp_st->aborting = true;
+   encoded_upload_id = s3_url_encode_query_value(mp_st->upload_id);
+   if (!encoded_upload_id)
+   {
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+
+   query = (char*)malloc(strlen(encoded_upload_id) + 16);
+   if (!query)
+   {
+      free(encoded_upload_id);
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+   snprintf(query, strlen(encoded_upload_id) + 16, "uploadId=%s", encoded_upload_id);
+
+   url_with_query = s3_build_url_with_query(mp_st->url, query);
+   auth_header = s3_build_auth_header("DELETE", mp_st->canonical_uri, query,
+         "host;x-amz-content-sha256;x-amz-date", S3_EMPTY_PAYLOAD_SHA256, s3_st);
+
+   if (!url_with_query || !auth_header)
+      goto fail;
+
+   if (!task_push_http_transfer_with_headers(url_with_query, true, "DELETE",
+            auth_header, s3_multipart_abort_cb, mp_st))
+      goto fail;
+
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   return;
+
+fail:
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   s3_multipart_finish(mp_st, false);
+}
+
+static void s3_multipart_complete_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+   {
+      s3_multipart_fail(mp_st, data, "complete");
+      return;
+   }
+
+   RARCH_LOG(S3_PFX "Multipart upload complete: %s (%zu parts)\n",
+         mp_st->cb_state ? mp_st->cb_state->path : "<unknown>",
+         mp_st->part_count);
+   s3_multipart_finish(mp_st, true);
+}
+
+static void s3_multipart_complete(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *encoded_upload_id = NULL;
+   char *query = NULL;
+   char *url_with_query = NULL;
+   char *payload_hash = NULL;
+   char *auth_header = NULL;
+   char *xml_body = NULL;
+   size_t i;
+   size_t xml_len = 0;
+   size_t xml_cap = 128;
+
+   if (!mp_st || string_is_empty(mp_st->upload_id))
+   {
+      s3_multipart_finish(mp_st, false);
+      return;
+   }
+
+   for (i = 0; i < mp_st->part_count; i++)
+   {
+      if (string_is_empty(mp_st->part_etags[i]))
+      {
+         s3_multipart_fail(mp_st, NULL, "complete missing ETag");
+         return;
+      }
+      xml_cap += strlen(mp_st->part_etags[i]) + 96;
+   }
+
+   xml_body = (char*)malloc(xml_cap);
+   if (!xml_body)
+   {
+      s3_multipart_fail(mp_st, NULL, "complete allocation");
+      return;
+   }
+
+   xml_len += (size_t)snprintf(xml_body + xml_len, xml_cap - xml_len,
+         "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<CompleteMultipartUpload>\n");
+   for (i = 0; i < mp_st->part_count; i++)
+      xml_len += (size_t)snprintf(xml_body + xml_len, xml_cap - xml_len,
+            "  <Part><PartNumber>%u</PartNumber><ETag>%s</ETag></Part>\n",
+            (unsigned)(i + 1), mp_st->part_etags[i]);
+   xml_len += (size_t)snprintf(xml_body + xml_len, xml_cap - xml_len, "</CompleteMultipartUpload>");
+
+   encoded_upload_id = s3_url_encode_query_value(mp_st->upload_id);
+   if (!encoded_upload_id)
+      goto fail;
+
+   query = (char*)malloc(strlen(encoded_upload_id) + 16);
+   if (!query)
+      goto fail;
+   snprintf(query, strlen(encoded_upload_id) + 16, "uploadId=%s", encoded_upload_id);
+
+   payload_hash = s3_sha256_hash(xml_body, xml_len);
+   url_with_query = s3_build_url_with_query(mp_st->url, query);
+   auth_header = s3_build_auth_header("POST", mp_st->canonical_uri, query,
+         "host;x-amz-content-sha256;x-amz-date", payload_hash, s3_st);
+   if (!payload_hash || !url_with_query || !auth_header)
+      goto fail;
+
+   if (!task_push_http_transfer_with_content(url_with_query, "POST",
+            xml_body, xml_len, "application/xml", true,
+            auth_header, s3_multipart_complete_cb, mp_st))
+      goto fail;
+
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(payload_hash);
+   free(auth_header);
+   free(xml_body);
+   return;
+
+fail:
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(payload_hash);
+   free(auth_header);
+   free(xml_body);
+   s3_multipart_fail(mp_st, NULL, "complete start");
+}
+
+static void s3_multipart_upload_part_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+   char *etag = NULL;
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+   {
+      s3_multipart_fail(mp_st, data, "upload part");
+      return;
+   }
+
+   etag = s3_extract_header_value(data, "ETag");
+   if (!etag)
+   {
+      RARCH_WARN(S3_PFX "Missing ETag for multipart part %u\n", (unsigned)(mp_st->current_part + 1));
+      s3_multipart_fail(mp_st, data, "upload part missing etag");
+      return;
+   }
+
+   mp_st->part_etags[mp_st->current_part] = etag;
+   mp_st->current_part++;
+
+   if (mp_st->current_part >= mp_st->part_count)
+      s3_multipart_complete(mp_st);
+   else
+      s3_multipart_upload_next_part(mp_st);
+}
+
+static void s3_multipart_upload_next_part(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   size_t offset = 0;
+   size_t content_len = 0;
+   unsigned part_number;
+   char *payload_hash = NULL;
+   char *encoded_upload_id = NULL;
+   char *query = NULL;
+   char *url_with_query = NULL;
+   char *auth_header = NULL;
+
+   if (!mp_st || mp_st->current_part >= mp_st->part_count)
+      return;
+
+   if (!s3_multipart_part_bounds(mp_st, mp_st->current_part, &offset, &content_len))
+   {
+      RARCH_WARN(S3_PFX "Multipart upload part bounds check failed for part %u (parts=%zu file_size=%zu part_size=%zu)\n",
+            (unsigned)(mp_st->current_part + 1),
+            mp_st->part_count,
+            mp_st->file_size,
+            mp_st->part_size);
+      goto fail;
+   }
+   part_number = (unsigned)(mp_st->current_part + 1);
+
+   payload_hash = s3_sha256_hash(mp_st->file_data + offset, content_len);
+   encoded_upload_id = s3_url_encode_query_value(mp_st->upload_id);
+   if (!payload_hash || !encoded_upload_id)
+      goto fail;
+
+   query = (char*)malloc(strlen(encoded_upload_id) + 48);
+   if (!query)
+      goto fail;
+   snprintf(query, strlen(encoded_upload_id) + 48,
+         "partNumber=%u&uploadId=%s", part_number, encoded_upload_id);
+
+   url_with_query = s3_build_url_with_query(mp_st->url, query);
+   auth_header = s3_build_auth_header("PUT", mp_st->canonical_uri, query,
+         "host;x-amz-content-sha256;x-amz-date", payload_hash, s3_st);
+   if (!url_with_query || !auth_header)
+      goto fail;
+
+   if (!task_push_http_transfer_with_content_ex(url_with_query, "PUT",
+            mp_st->file_data + offset, content_len, "application/octet-stream", true, true,
+            auth_header, s3_multipart_upload_part_cb, mp_st))
+      goto fail;
+
+   free(payload_hash);
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   return;
+
+fail:
+   free(payload_hash);
+   free(encoded_upload_id);
+   free(query);
+   free(url_with_query);
+   free(auth_header);
+   s3_multipart_fail(mp_st, NULL, "upload part start");
+}
+
+static void s3_multipart_initiate_cb(retro_task_t *task, void *task_data, void *user_data, const char *err)
+{
+   s3_multipart_state_t *mp_st   = (s3_multipart_state_t*)user_data;
+   http_transfer_data_t *data    = (http_transfer_data_t*)task_data;
+   bool success                  = (data && data->status >= 200 && data->status < 300);
+   char *response_xml            = NULL;
+
+   (void)task;
+   (void)err;
+
+   if (!mp_st)
+      return;
+
+   if (!success)
+   {
+      s3_log_multipart_initiate_failure(mp_st, data, err);
+
+      if (!data || data->status < 0)
+      {
+         RARCH_WARN(S3_PFX "Multipart initiation transport failed (data=%s, status=%d); falling back to single PUT for '%s'\n",
+               data ? "present" : "missing",
+               data ? data->status : -1,
+               mp_st->cb_state ? mp_st->cb_state->path : "<unknown>");
+         if (s3_multipart_fallback_single_put(mp_st))
+         {
+            s3_multipart_free(mp_st);
+            return;
+         }
+      }
+
+      if (err && *err)
+         RARCH_WARN(S3_PFX "Multipart initiate transport error: %s\n", err);
+      s3_multipart_fail(mp_st, data, "initiate");
+      return;
+   }
+
+   if (!data || string_is_empty(data->data))
+   {
+      s3_multipart_fail(mp_st, data, "initiate empty response");
+      return;
+   }
+
+   response_xml = (char*)malloc(data->len + 1);
+   if (!response_xml)
+   {
+      s3_multipart_fail(mp_st, data, "initiate allocation");
+      return;
+   }
+   memcpy(response_xml, data->data, data->len);
+   response_xml[data->len] = '\0';
+
+   mp_st->upload_id = s3_extract_xml_tag_value(response_xml, "UploadId");
+   free(response_xml);
+   if (string_is_empty(mp_st->upload_id))
+   {
+      RARCH_WARN(S3_PFX "Multipart initiation response missing UploadId\n");
+      s3_multipart_fail(mp_st, data, "initiate missing upload id");
+      return;
+   }
+
+   RARCH_LOG(S3_PFX "Started multipart upload for %s (uploadId=%s, parts=%zu)\n",
+         mp_st->cb_state ? mp_st->cb_state->path : "<unknown>", mp_st->upload_id, mp_st->part_count);
+   s3_multipart_upload_next_part(mp_st);
+}
+
+static bool s3_multipart_start(s3_multipart_state_t *mp_st)
+{
+   s3_state_t *s3_st = s3_state_get_ptr();
+   char *url_with_query = NULL;
+   char *auth_header = NULL;
+   const char *url_query = "uploads=";
+   const char *canonical_query = "uploads=";
+
+   if (!mp_st)
+      return false;
+
+   url_with_query = s3_build_url_with_query(mp_st->url, url_query);
+   auth_header = s3_build_auth_header("POST", mp_st->canonical_uri, canonical_query,
+         "host;x-amz-content-sha256;x-amz-date", S3_EMPTY_PAYLOAD_SHA256, s3_st);
+         // "host;x-amz-content-sha256;x-amz-date", "UNSIGNED-PAYLOAD", s3_st);
+   if (!url_with_query || !auth_header)
+   {
+      free(url_with_query);
+      free(auth_header);
+      return false;
+   }
+
+   RARCH_DBG(S3_PFX "Multipart initiate URL: %s\n", url_with_query);
+   RARCH_DBG(S3_PFX "Multipart initiate headers:\n%s\n", auth_header);
+
+   if (!task_push_http_post_transfer_with_headers(url_with_query, "",
+            true, "POST", auth_header,
+            s3_multipart_initiate_cb, mp_st))
+   {
+      free(url_with_query);
+      free(auth_header);
+      return false;
+   }
+
+   free(url_with_query);
+   free(auth_header);
+   return true;
+}
+
 /* Initialize S3 connection */
 static bool s3_sync_begin(cloud_sync_complete_handler_t cb, void *user_data)
 {
@@ -962,8 +1640,7 @@ static bool s3_sync_begin(cloud_sync_complete_handler_t cb, void *user_data)
    strlcpy(s3_st->access_key_id, settings->arrays.access_key_id, sizeof(settings->arrays.access_key_id));
    strlcpy(s3_st->secret_access_key, settings->arrays.secret_access_key, sizeof(settings->arrays.secret_access_key));
 
-   RARCH_DBG(S3_PFX "S3 configuration - URL: '%s', Access Key ID: '%s', Secret Access Key(size): '%d'\n",
-             s3_st->url, s3_st->access_key_id, sizeof(s3_st->secret_access_key));
+   RARCH_DBG(S3_PFX "S3 configuration - URL: '%s'\n", s3_st->url);
 
    /* Parse URL to extract bucket, region, and host */
    if (!s3_parse_url(s3_st->url, s3_st->bucket, s3_st->region, s3_st->host, S3_SERVICE))
@@ -1023,7 +1700,8 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
    strlcpy(s3_cb_st->file, file, sizeof(s3_cb_st->file));
 
    /* Build S3 URL - all supported formats are virtual-hosted style */
-   snprintf(url, sizeof(url), "%s/%s", s3_st->url, path);
+   if (!s3_build_request_url(url, sizeof(url), s3_st, path))
+      goto cleanup;
 
    /* Build canonical URI - must be URL encoded */
    if (path && *path)
@@ -1052,8 +1730,6 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
 
    RARCH_DBG(S3_PFX "Request URL: %s\n", url);
    RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
-   RARCH_DBG(S3_PFX "Authorization header:\n%s\n", auth_header);
-   RARCH_DBG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
 
    /* Perform HTTP GET request asynchronously */
    if (!s3_http_get_async(url, auth_header, s3_cb_st))
@@ -1077,6 +1753,7 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
 static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler_t cb, void *user_data)
 {
    s3_cb_state_t *s3_cb_st = (s3_cb_state_t*)calloc(1, sizeof(s3_cb_state_t));
+   s3_multipart_state_t *mp_st = NULL;
    s3_state_t *s3_st = s3_state_get_ptr();
    char *auth_header = NULL;
    char url[PATH_MAX_LENGTH];
@@ -1107,11 +1784,17 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
          file_data = malloc(file_size);
          if (file_data)
             filestream_read(file, file_data, file_size);
+         else
+         {
+            RARCH_ERR(S3_PFX "Failed to allocate memory for upload (%zu bytes)\n", file_size);
+            goto cleanup;
+         }
       }
    }
 
    /* Build S3 URL - all supported formats are virtual-hosted style */
-   snprintf(url, sizeof(url), "%s/%s", s3_st->url, path);
+   if (!s3_build_request_url(url, sizeof(url), s3_st, path))
+      goto cleanup;
 
    /* Build canonical URI - must be URL encoded */
    if (path && *path)
@@ -1131,29 +1814,70 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
    RARCH_DBG(S3_PFX "Request URL: %s\n", url);
    RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
 
-   /* Calculate payload hash */
-   if (file_data && file_size > 0)
-      payload_hash = s3_sha256_hash(file_data, file_size);
-   else
-      payload_hash = strdup("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"); /* Empty file hash */
-
    /* For large files, use multipart upload */
    if (file_size > multipart_threshold)
    {
+      size_t part_size = 0;
+      size_t part_count = 0;
+
       RARCH_LOG(S3_PFX "Large file detected (%zu bytes, nominal multipart threshold: %zu bytes), using multipart upload\n",
             file_size, multipart_threshold);
-      /* TODO: Implement multipart upload */
-      goto cleanup;
+
+      if (!s3_calculate_multipart_plan(file_size, &part_size, &part_count))
+      {
+         RARCH_ERR(S3_PFX "Could not build multipart plan for %zu-byte upload\n", file_size);
+         goto cleanup;
+      }
+
+      mp_st = (s3_multipart_state_t*)calloc(1, sizeof(*mp_st));
+      if (!mp_st)
+         goto cleanup;
+
+      mp_st->cb_state = s3_cb_st;
+      s3_cb_st = NULL;
+      mp_st->file_data = file_data;
+      file_data = NULL;
+      mp_st->file_size = file_size;
+      mp_st->part_size = part_size;
+      mp_st->part_count = part_count;
+      strlcpy(mp_st->url, url, sizeof(mp_st->url));
+      strlcpy(mp_st->canonical_uri, canonical_uri, sizeof(mp_st->canonical_uri));
+      mp_st->part_etags = (char**)calloc(part_count, sizeof(char*));
+      if (!mp_st->part_etags)
+         goto cleanup;
+
+      RARCH_LOG(S3_PFX "Multipart plan: %zu bytes in %zu parts (%zu bytes/part)\n",
+            file_size, part_count, part_size);
+
+      if (!s3_multipart_start(mp_st))
+      {
+         RARCH_ERR(S3_PFX "Failed to start multipart upload\n");
+         goto cleanup;
+      }
+
+      /* Ownership transferred to multipart callbacks */
+      s3_cb_st = NULL;
+      file_data = NULL;
+      mp_st = NULL;
+      success = true;
    }
    else
    {
       /* Single PUT request */
+      if (file_data && file_size > 0)
+         payload_hash = s3_sha256_hash(file_data, file_size);
+      else
+         payload_hash = strdup(S3_EMPTY_PAYLOAD_SHA256);
+
+      if (!payload_hash)
+      {
+         RARCH_ERR(S3_PFX "Failed to compute payload hash\n");
+         goto cleanup;
+      }
+
       auth_header = s3_build_auth_header("PUT", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
                                         payload_hash, s3_st);
 
-      RARCH_DBG(S3_PFX "Authorization header:\n%s\n", auth_header);
-      RARCH_DBG(S3_PFX "Complete headers being sent:\n%s\n", auth_header);
-
       if (!auth_header)
       {
          RARCH_ERR(S3_PFX "Failed to build authorization header\n");
@@ -1172,6 +1896,7 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
    }
 
 cleanup:
+   s3_multipart_free(mp_st);
    free(auth_header);
    free(file_data);
    free(payload_hash);
@@ -1198,7 +1923,8 @@ static bool s3_free(const char *path, cloud_sync_complete_handler_t cb, void *us
    strlcpy(s3_cb_st->path, path, sizeof(s3_cb_st->path));
 
    /* Build S3 URL - all supported formats are virtual-hosted style */
-   snprintf(url, sizeof(url), "%s/%s", s3_st->url, path);
+   if (!s3_build_request_url(url, sizeof(url), s3_st, path))
+      goto cleanup;
 
    /* Build canonical URI - must be URL encoded */
    if (path && *path)
diff --git a/tasks/task_http.c b/tasks/task_http.c
index 1406f9efde9d..9b3c74b4d296 100644
--- a/tasks/task_http.c
+++ b/tasks/task_http.c
@@ -48,6 +48,7 @@ struct http_handle
    } connection;
    enum http_status_enum status;
    bool error;
+   bool headers_accept_err;
    char connection_url[NAME_MAX_LENGTH];
 };
 
@@ -186,7 +187,7 @@ static void task_http_transfer_handler(retro_task_t *task)
          data          = (http_transfer_data_t*)malloc(sizeof(*data));
          data->data    = tmp;
          data->len     = _len;
-         data->headers = net_http_headers(http->handle);
+         data->headers = net_http_headers_ex(http->handle, http->headers_accept_err);
          data->status  = net_http_status(http->handle);
 
          task_set_data(task, data);
@@ -238,7 +239,7 @@ static void http_transfer_progress_cb(retro_task_t *task)
 
 static void *task_push_http_transfer_generic(
       struct http_connection_t *conn,
-      const char *url, bool mute,
+      const char *url, bool mute, bool headers_accept_err,
       retro_task_callback_t cb, void *user_data)
 {
    retro_task_t  *t        = NULL;
@@ -277,6 +278,7 @@ static void *task_push_http_transfer_generic(
    http->connection.cb       = &cb_http_conn_default;
    http->status              = HTTP_STATUS_CONNECTION_TRANSFER;
    http->error               = false;
+   http->headers_accept_err = headers_accept_err;
    http->connection_url[0]   = '\0';
 
    strlcpy(http->connection_url, url, sizeof(http->connection_url));
@@ -317,7 +319,7 @@ void* task_push_http_transfer(const char *url, bool mute,
    if (!string_is_empty(url))
       return task_push_http_transfer_generic(
             net_http_connection_new(url, type ? type : "GET", NULL),
-            url, mute, cb, user_data);
+            url, mute, false, cb, user_data);
    return NULL;
 }
 
@@ -335,7 +337,7 @@ void *task_push_webdav_stat(const char *url, bool mute, const char *headers,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_webdav_mkdir(const char *url, bool mute,
@@ -353,7 +355,7 @@ void* task_push_webdav_mkdir(const char *url, bool mute,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_webdav_put(const char *url,
@@ -380,7 +382,7 @@ void* task_push_webdav_put(const char *url,
    if (put_data)
       net_http_connection_set_content(conn, NULL, len, put_data);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_webdav_delete(const char *url, bool mute,
@@ -398,7 +400,7 @@ void* task_push_webdav_delete(const char *url, bool mute,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void *task_push_webdav_move(const char *url,
@@ -424,7 +426,7 @@ void *task_push_webdav_move(const char *url,
 
    net_http_connection_set_headers(conn, dest_header);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, userdata);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, userdata);
 }
 
 void* task_push_http_transfer_file(const char* url, bool mute,
@@ -442,7 +444,7 @@ void* task_push_http_transfer_file(const char* url, bool mute,
    if (!(t = (retro_task_t*)task_push_http_transfer_generic(
          /* should be using type but some callers now rely on type being ignored */
          net_http_connection_new(url, "GET", NULL),
-         url, mute, cb, transfer_data)))
+         url, mute, false, cb, transfer_data)))
       return NULL;
 
    if (transfer_data)
@@ -480,7 +482,7 @@ void* task_push_http_transfer_with_user_agent(const char *url, bool mute,
    if (user_agent)
       net_http_connection_set_user_agent(conn, user_agent);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_http_transfer_with_headers(const char *url, bool mute,
@@ -498,7 +500,7 @@ void* task_push_http_transfer_with_headers(const char *url, bool mute,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_http_post_transfer(const char *url,
@@ -508,7 +510,7 @@ void* task_push_http_post_transfer(const char *url,
    if (!string_is_empty(url))
       return task_push_http_transfer_generic(
             net_http_connection_new(url, type ? type : "POST", post_data),
-            url, mute, cb, user_data);
+            url, mute, false, cb, user_data);
    return NULL;
 }
 
@@ -528,7 +530,7 @@ void* task_push_http_post_transfer_with_user_agent(const char *url,
    if (user_agent)
       net_http_connection_set_user_agent(conn, user_agent);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
 void* task_push_http_post_transfer_with_headers(const char *url,
@@ -547,12 +549,13 @@ void* task_push_http_post_transfer_with_headers(const char *url,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
-void *task_push_http_transfer_with_content(const char *url,
+void *task_push_http_transfer_with_content_ex(const char *url,
       const char *method, const void *content, size_t content_len,
-      const char *content_type, bool mute, const char *headers,
+      const char *content_type, bool mute, bool headers_accept_err,
+      const char *headers,
       retro_task_callback_t cb, void *user_data)
 {
    struct http_connection_t *conn;
@@ -570,5 +573,16 @@ void *task_push_http_transfer_with_content(const char *url,
    if (headers)
       net_http_connection_set_headers(conn, headers);
 
-   return task_push_http_transfer_generic(conn, url, mute, cb, user_data);
+   return task_push_http_transfer_generic(conn, url, mute,
+         headers_accept_err, cb, user_data);
+}
+
+void *task_push_http_transfer_with_content(const char *url,
+      const char *method, const void *content, size_t content_len,
+      const char *content_type, bool mute, const char *headers,
+      retro_task_callback_t cb, void *user_data)
+{
+   return task_push_http_transfer_with_content_ex(url, method, content,
+         content_len, content_type, mute, false,
+         headers, cb, user_data);
 }
diff --git a/tasks/tasks_internal.h b/tasks/tasks_internal.h
index e5dc47cf195a..5b26e3f0e7ad 100644
--- a/tasks/tasks_internal.h
+++ b/tasks/tasks_internal.h
@@ -83,6 +83,11 @@ void *task_push_http_transfer_with_content(const char *url, const char *method,
    const void *content, size_t content_len, const char *content_type, bool mute,
    const char *headers, retro_task_callback_t cb, void *user_data);
 
+void *task_push_http_transfer_with_content_ex(const char *url, const char *method,
+   const void *content, size_t content_len, const char *content_type, bool mute,
+   bool headers_accept_err, const char *headers,
+   retro_task_callback_t cb, void *user_data);
+
 void *task_push_webdav_stat(const char *url, bool mute, const char *headers,
       retro_task_callback_t cb, void *userdata);
 void *task_push_webdav_mkdir(const char *url, bool mute, const char *headers,

From 28f0d1c1ad19ff67c8690f9406ee01e77011a20b Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Mon, 9 Mar 2026 23:16:51 -0500
Subject: [PATCH 06/12] Remove comments [skip ci]

---
 network/cloud_sync/s3.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index 95db1323b401..663015020aff 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -14,7 +14,6 @@
 
 #include <encodings/base64.h>
 #include <lrc_hash.h>
-// #include <net/net_http.h>
 #include <string/stdstring.h>
 #include <time/rtime.h>
 #include <formats/rjson.h>
@@ -1601,7 +1600,6 @@ static bool s3_multipart_start(s3_multipart_state_t *mp_st)
    url_with_query = s3_build_url_with_query(mp_st->url, url_query);
    auth_header = s3_build_auth_header("POST", mp_st->canonical_uri, canonical_query,
          "host;x-amz-content-sha256;x-amz-date", S3_EMPTY_PAYLOAD_SHA256, s3_st);
-         // "host;x-amz-content-sha256;x-amz-date", "UNSIGNED-PAYLOAD", s3_st);
    if (!url_with_query || !auth_header)
    {
       free(url_with_query);

From 39153fc6e770a9f38302984edee8de707e95b93d Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Mon, 9 Mar 2026 23:38:48 -0500
Subject: [PATCH 07/12] Enable windows builds

---
 Makefile.msvc | 1 +
 Makefile.win  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Makefile.msvc b/Makefile.msvc
index 306440d1aded..530de6013573 100644
--- a/Makefile.msvc
+++ b/Makefile.msvc
@@ -59,6 +59,7 @@ HAVE_RTGA                := 1
 HAVE_7ZIP                := 1
 HAVE_NETWORKING          := 1
 HAVE_IFINFO              := 1
+HAVE_S3                  := 1
 HAVE_NETWORK_CMD         := 1
 HAVE_OVERLAY             := 1
 HAVE_LANGEXTRA           := 1
diff --git a/Makefile.win b/Makefile.win
index ec1b9dfb692d..049daaa4b901 100644
--- a/Makefile.win
+++ b/Makefile.win
@@ -12,6 +12,7 @@ HAVE_DYLIB = 1
 HAVE_D3D9 = 1
 HAVE_NETWORKING = 1
 HAVE_IFINFO = 1
+HAVE_S3 = 1
 HAVE_NETPLAYDISCOVERY = 1
 HAVE_STDIN_CMD = 1
 HAVE_COMMAND = 1

From 05dea59fd565aef62a9db8b8dae67ce688075886 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Tue, 10 Mar 2026 15:03:54 -0500
Subject: [PATCH 08/12] Removing untested branches

---
 Makefile.libnx | 1 -
 Makefile.msvc  | 1 -
 Makefile.win   | 1 -
 3 files changed, 3 deletions(-)

diff --git a/Makefile.libnx b/Makefile.libnx
index ae9769f4e327..42c004a67056 100644
--- a/Makefile.libnx
+++ b/Makefile.libnx
@@ -59,7 +59,6 @@ HAVE_IBXM = 1
 HAVE_CORE_INFO_CACHE = 1
 HAVE_CLOUDSYNC = 1
 HAVE_SSL = 1
-HAVE_S3 = 1
 
 # RetroArch libnx useful flags
 HAVE_THREADS = 1
diff --git a/Makefile.msvc b/Makefile.msvc
index 530de6013573..306440d1aded 100644
--- a/Makefile.msvc
+++ b/Makefile.msvc
@@ -59,7 +59,6 @@ HAVE_RTGA                := 1
 HAVE_7ZIP                := 1
 HAVE_NETWORKING          := 1
 HAVE_IFINFO              := 1
-HAVE_S3                  := 1
 HAVE_NETWORK_CMD         := 1
 HAVE_OVERLAY             := 1
 HAVE_LANGEXTRA           := 1
diff --git a/Makefile.win b/Makefile.win
index 049daaa4b901..ec1b9dfb692d 100644
--- a/Makefile.win
+++ b/Makefile.win
@@ -12,7 +12,6 @@ HAVE_DYLIB = 1
 HAVE_D3D9 = 1
 HAVE_NETWORKING = 1
 HAVE_IFINFO = 1
-HAVE_S3 = 1
 HAVE_NETPLAYDISCOVERY = 1
 HAVE_STDIN_CMD = 1
 HAVE_COMMAND = 1

From 666fd497dad89e7f1bc0aa655256c06b92cdab86 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Tue, 10 Mar 2026 23:18:44 -0500
Subject: [PATCH 09/12] Fix code review comments

---
 configuration.c                                   |  2 +-
 libretro-common/net/net_http.c                    | 10 +++++-----
 network/cloud_sync/google_drive.c                 |  2 +-
 network/cloud_sync/s3.c                           |  6 +++---
 pkg/apple/BaseConfig.xcconfig                     |  1 +
 .../RetroArch_Metal.xcodeproj/project.pbxproj     |  2 --
 tasks/task_http.c                                 | 15 ++-------------
 tasks/tasks_internal.h                            |  4 ----
 8 files changed, 13 insertions(+), 29 deletions(-)

diff --git a/configuration.c b/configuration.c
index 8913a54b9f05..5d76f2481137 100644
--- a/configuration.c
+++ b/configuration.c
@@ -1617,8 +1617,8 @@ static struct config_array_setting *populate_settings_array(
    SETTING_ARRAY("cheevos_leaderboards_enable",  settings->arrays.cheevos_leaderboards_enable, true, "", true); /* deprecated */
 #endif
 
-   SETTING_ARRAY("netplay_mitm_server",          settings->arrays.netplay_mitm_server, false, NULL, true);
 #ifdef HAVE_NETWORKING
+   SETTING_ARRAY("netplay_mitm_server",          settings->arrays.netplay_mitm_server, false, NULL, true);
 #ifdef HAVE_CLOUDSYNC
    SETTING_ARRAY("webdav_url",                   settings->arrays.webdav_url, false, NULL, true);
    SETTING_ARRAY("webdav_username",              settings->arrays.webdav_username, false, NULL, true);
diff --git a/libretro-common/net/net_http.c b/libretro-common/net/net_http.c
index 8fc8087e50d3..85c405d3db4e 100644
--- a/libretro-common/net/net_http.c
+++ b/libretro-common/net/net_http.c
@@ -1012,11 +1012,6 @@ static bool net_http_connect(struct http_t *state)
    struct conn_pool_entry *conn = state->conn;
    struct dns_cache_entry *dns_entry = net_http_dns_cache_find(state->request.domain, state->request.port);
    /* we just used/added this in _new_socket above, if it's not there it's a big bug */
-   if (!dns_entry || !dns_entry->addr || !conn)
-   {
-      net_http_log_transport_state(state, "connect_missing_dns_or_conn", -1);
-      return false;
-   }
    addr = dns_entry->addr;
 
 #ifndef HAVE_SSL
@@ -1025,6 +1020,11 @@ static bool net_http_connect(struct http_t *state)
 #else
    if (state->ssl)
    {
+      if (!conn)
+      {
+         net_http_log_transport_state(state, "connect_missing_dns_or_conn", -1);
+         return false;
+      }
       for (next_addr = addr; conn->fd >= 0; conn->fd = socket_next((void**)&next_addr))
       {
          if (!(conn->ssl_ctx = ssl_socket_init(conn->fd, state->request.domain)))
diff --git a/network/cloud_sync/google_drive.c b/network/cloud_sync/google_drive.c
index 54c10e2f86bc..bc4843e44a4d 100644
--- a/network/cloud_sync/google_drive.c
+++ b/network/cloud_sync/google_drive.c
@@ -1356,7 +1356,7 @@ static void gdrive_do_patch(gdrive_cb_state_t *cb_st)
          cb_st->path, (long long)len);
    task_push_http_transfer_with_content(url, "PATCH",
          buf, (size_t)len, "application/octet-stream",
-         true, headers, gdrive_upload_cb, cb_st);
+         true, false, headers, gdrive_upload_cb, cb_st);
    free(buf);
    free(headers);
 }
diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index 663015020aff..66d0019a41be 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -929,7 +929,7 @@ static bool s3_http_put_async(const char *url, const char *headers,
       const void *data, size_t data_len, s3_cb_state_t *cb_state)
 {
    return task_push_http_transfer_with_content(url, "PUT",
-         data, data_len, "application/octet-stream", true,
+         data, data_len, "application/octet-stream", true, false,
          headers, s3_update_cb, cb_state) != NULL;
 }
 
@@ -1399,7 +1399,7 @@ static void s3_multipart_complete(s3_multipart_state_t *mp_st)
       goto fail;
 
    if (!task_push_http_transfer_with_content(url_with_query, "POST",
-            xml_body, xml_len, "application/xml", true,
+            xml_body, xml_len, "application/xml", true, false,
             auth_header, s3_multipart_complete_cb, mp_st))
       goto fail;
 
@@ -1500,7 +1500,7 @@ static void s3_multipart_upload_next_part(s3_multipart_state_t *mp_st)
    if (!url_with_query || !auth_header)
       goto fail;
 
-   if (!task_push_http_transfer_with_content_ex(url_with_query, "PUT",
+   if (!task_push_http_transfer_with_content(url_with_query, "PUT",
             mp_st->file_data + offset, content_len, "application/octet-stream", true, true,
             auth_header, s3_multipart_upload_part_cb, mp_st))
       goto fail;
diff --git a/pkg/apple/BaseConfig.xcconfig b/pkg/apple/BaseConfig.xcconfig
index 930a0974a21f..f9d5837bc581 100644
--- a/pkg/apple/BaseConfig.xcconfig
+++ b/pkg/apple/BaseConfig.xcconfig
@@ -74,6 +74,7 @@ OTHER_CFLAGS = $(inherited) -DHAVE_RPNG
 OTHER_CFLAGS = $(inherited) -DHAVE_RTGA
 OTHER_CFLAGS = $(inherited) -DHAVE_RUNAHEAD
 OTHER_CFLAGS = $(inherited) -DHAVE_RWAV
+OTHER_CFLAGS = $(inherited) -DHAVE_S3
 OTHER_CFLAGS = $(inherited) -DHAVE_SCREENSHOTS
 OTHER_CFLAGS = $(inherited) -DHAVE_SHADERPIPELINE
 OTHER_CFLAGS = $(inherited) -DHAVE_SLANG
diff --git a/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj b/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj
index c7981073f09e..09ca583db37f 100644
--- a/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj
+++ b/pkg/apple/RetroArch_Metal.xcodeproj/project.pbxproj
@@ -1911,7 +1911,6 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
 				CLANG_ANALYZER_DEADCODE_DEADSTORES = NO;
-				COMMON_SDL_CFLAGS = "-DHAVE_S3";
 				CURRENT_PROJECT_VERSION = 1;
 				ENABLE_HARDENED_RUNTIME = YES;
 			};
@@ -1924,7 +1923,6 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
 				CLANG_ANALYZER_DEADCODE_DEADSTORES = NO;
-				COMMON_SDL_CFLAGS = "-DHAVE_S3";
 				CURRENT_PROJECT_VERSION = 1;
 				ENABLE_HARDENED_RUNTIME = YES;
 			};
diff --git a/tasks/task_http.c b/tasks/task_http.c
index 9b3c74b4d296..59bd80f51ed4 100644
--- a/tasks/task_http.c
+++ b/tasks/task_http.c
@@ -552,11 +552,10 @@ void* task_push_http_post_transfer_with_headers(const char *url,
    return task_push_http_transfer_generic(conn, url, mute, false, cb, user_data);
 }
 
-void *task_push_http_transfer_with_content_ex(const char *url,
+void *task_push_http_transfer_with_content(const char *url,
       const char *method, const void *content, size_t content_len,
       const char *content_type, bool mute, bool headers_accept_err,
-      const char *headers,
-      retro_task_callback_t cb, void *user_data)
+      const char *headers, retro_task_callback_t cb, void *user_data)
 {
    struct http_connection_t *conn;
 
@@ -576,13 +575,3 @@ void *task_push_http_transfer_with_content_ex(const char *url,
    return task_push_http_transfer_generic(conn, url, mute,
          headers_accept_err, cb, user_data);
 }
-
-void *task_push_http_transfer_with_content(const char *url,
-      const char *method, const void *content, size_t content_len,
-      const char *content_type, bool mute, const char *headers,
-      retro_task_callback_t cb, void *user_data)
-{
-   return task_push_http_transfer_with_content_ex(url, method, content,
-         content_len, content_type, mute, false,
-         headers, cb, user_data);
-}
diff --git a/tasks/tasks_internal.h b/tasks/tasks_internal.h
index 5b26e3f0e7ad..97e71339dce9 100644
--- a/tasks/tasks_internal.h
+++ b/tasks/tasks_internal.h
@@ -80,10 +80,6 @@ void *task_push_http_post_transfer_with_headers(const char *url, const char *pos
    const char *type, const char *headers, retro_task_callback_t cb, void *user_data);
 
 void *task_push_http_transfer_with_content(const char *url, const char *method,
-   const void *content, size_t content_len, const char *content_type, bool mute,
-   const char *headers, retro_task_callback_t cb, void *user_data);
-
-void *task_push_http_transfer_with_content_ex(const char *url, const char *method,
    const void *content, size_t content_len, const char *content_type, bool mute,
    bool headers_accept_err, const char *headers,
    retro_task_callback_t cb, void *user_data);

From 0b2493f2c74b2262b539fa41754226bf1210b514 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Wed, 11 Mar 2026 19:37:48 -0500
Subject: [PATCH 10/12] Changed url parsing logic

* Support extra prefix in URL
* Cloudflare should support both virtual-host style and path-based URLs
---
 network/cloud_sync/s3.c | 555 +++++++++++++++++++++++-----------------
 1 file changed, 319 insertions(+), 236 deletions(-)

diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index 66d0019a41be..5587ceac9bc9 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -128,227 +128,241 @@ static bool s3_calculate_multipart_plan(size_t file_size, size_t *out_part_size,
    return true;
 }
 
-/* Parse S3 URL to extract bucket, region, and host */
+/* Parse S3 URL to extract bucket, region, and host. Supports both virtual-hosted
+ * and path-style layouts so providers can be normalized from one URL string. */
 static bool s3_parse_url(const char *url, char *bucket,  char *region,
                          char *host, char *service)
 {
-   char *bucket_start = NULL;
-   char *region_start = NULL;
-   char *dot_pos = NULL;
-   char *slash_pos = NULL;
-   bool bucket_found = false;
+   const char *scheme_sep    = NULL;
+   const char *authority     = NULL;
+   const char *authority_end = NULL;
+   const char *path_start    = NULL;
+   const char *first_dot     = NULL;
+   const char *second_dot    = NULL;
+   char first_label[NAME_MAX_LENGTH];
+   char first_path_seg[NAME_MAX_LENGTH];
+
+   (void)service;
 
    if (!url || !bucket || !region || !host)
       return false;
 
    RARCH_DBG(S3_PFX "Parsing S3 URL: %s\n", url);
 
-   /* Initialize output buffers */
    bucket[0] = '\0';
    region[0] = '\0';
-   host[0] = '\0';
-
-   /* Handle virtual-hosted style S3 URL formats:
-    * - https://bucket.s3.region.amazonaws.com/ (AWS S3)
-    * - https://bucket.s3-region.amazonaws.com/ (AWS S3)
-    * - https://bucket.s3.region.backblazeb2.com/ (Backblaze B2)
-    * - https://bucket.region.digitaloceanspaces.com/ (DigitalOcean Spaces)
-    * - https://bucket.region.linodeobjects.com/ (Linode Object Storage)
-    * - https://bucket.region.cloudflarestorage.com/ (Cloudflare R2)
-    * - https://bucket.endpoint/ (MinIO, custom endpoints)
-    */
+   host[0]   = '\0';
+   first_label[0]    = '\0';
+   first_path_seg[0] = '\0';
+
+   scheme_sep = strstr(url, "://");
+   authority  = scheme_sep ? scheme_sep + 3 : url;
+   if (string_is_empty(authority))
+      return false;
+
+   authority_end = strchr(authority, '/');
+   if (!authority_end)
+      authority_end = authority + strlen(authority);
 
-   /* Extract bucket from virtual-hosted style URLs */
-   bucket_start = strstr(url, "://");
-   if (bucket_start)
+   if (authority_end > authority)
    {
-      bucket_start += 3; /* Skip "://" */
-      RARCH_DBG(S3_PFX "Found protocol separator, bucket_start: %s\n", bucket_start);
+      size_t host_len = authority_end - authority;
+      if (host_len >= NAME_MAX_LENGTH)
+         host_len = NAME_MAX_LENGTH - 1;
+      strlcpy(host, authority, host_len + 1);
+   }
 
-      dot_pos = strchr(bucket_start, '.');
-      if (dot_pos)
+   if (string_is_empty(host))
+      return false;
+
+   if (*authority_end == '/')
+      path_start = authority_end + 1;
+
+   /* Capture first host label and first path segment for provider-specific rules. */
+   first_dot = strchr(host, '.');
+   if (first_dot)
+   {
+      size_t first_label_len = first_dot - host;
+      if (first_label_len > 0 && first_label_len < NAME_MAX_LENGTH)
+         strlcpy(first_label, host, first_label_len + 1);
+   }
+
+   if (path_start && *path_start)
+   {
+      const char *path_seg_end = strchr(path_start, '/');
+      size_t path_seg_len      = path_seg_end ? (size_t)(path_seg_end - path_start) : strlen(path_start);
+      if (path_seg_len > 0 && path_seg_len < NAME_MAX_LENGTH)
+         strlcpy(first_path_seg, path_start, path_seg_len + 1);
+   }
+
+   if (strstr(host, ".cloudflarestorage.com"))
+   {
+      const char *r2_suffix = ".r2.cloudflarestorage.com";
+      const char *r2_pos    = strstr(host, r2_suffix);
+
+      RARCH_LOG(S3_PFX "Detected Cloudflare R2 format\n");
+
+      if (r2_pos)
       {
-         size_t bucket_len = dot_pos - bucket_start;
-         RARCH_DBG(S3_PFX "Found first dot at position %zu, bucket length: %zu\n",
-                   (size_t)(dot_pos - bucket_start), bucket_len);
+         /* Cloudflare R2 supports both:
+          * - <bucket>.<accountid>.r2.cloudflarestorage.com
+          * - <accountid>.r2.cloudflarestorage.com/<bucket>/... */
+         const char *prefix_start = host;
+         size_t prefix_len         = (size_t)(r2_pos - prefix_start);
 
-         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+         if (prefix_len > 0)
          {
-            char *host_start = NULL;
-            char *host_end = NULL;
-            strlcpy(bucket, bucket_start, bucket_len + 1);
-            bucket_found = true;
-            RARCH_LOG(S3_PFX "Extracted bucket: %s\n", bucket);
-
-            /* Extract host from URL */
-            host_start = bucket_start;
-            host_end = strchr(host_start, '/');
-            if (host_end)
-            {
-               size_t host_len = host_end - host_start;
-               if (host_len > 0 && host_len < NAME_MAX_LENGTH)
-               {
-                  strlcpy(host, host_start, host_len + 1);
-                  RARCH_LOG(S3_PFX "Extracted host: %s\n", host);
-               }
-            }
-            else
-            {
-               /* No path, use entire authority as host */
-               strlcpy(host, host_start, NAME_MAX_LENGTH);
-               RARCH_LOG(S3_PFX "Extracted host: %s\n", host);
-            }
+            const char *prefix_dot = strchr(prefix_start, '.');
 
-            /* Extract region based on service type */
-            if (strstr(url, ".s3.") && strstr(url, ".amazonaws.com"))
-            {
-               RARCH_LOG(S3_PFX "Detected AWS S3 format (bucket.s3.region.amazonaws.com)\n");
-               /* AWS S3: bucket.s3.region.amazonaws.com */
-               if (strncmp(dot_pos, ".s3.", 4) == 0)
-               {
-                  region_start = dot_pos + 4;
-                  dot_pos = strchr(region_start, '.');
-                  if (dot_pos)
-                  {
-                     size_t region_len = dot_pos - region_start;
-                     if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                     {
-                        strlcpy(region, region_start, region_len + 1);
-                        RARCH_LOG(S3_PFX "Extracted AWS S3 region: %s\n", region);
-                        return true;
-                     }
-                  }
-               }
-            }
-            else if (strstr(url, ".s3-") && strstr(url, ".amazonaws.com"))
-            {
-               RARCH_LOG(S3_PFX "Detected AWS S3 format (bucket.s3-region.amazonaws.com)\n");
-               /* AWS S3: bucket.s3-region.amazonaws.com */
-               if (strncmp(dot_pos, ".s3-", 4) == 0)
-               {
-                  region_start = dot_pos + 4;
-                  dot_pos = strchr(region_start, '.');
-                  if (dot_pos)
-                  {
-                     size_t region_len = dot_pos - region_start;
-                     if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                     {
-                        strlcpy(region, region_start, region_len + 1);
-                        RARCH_LOG(S3_PFX "Extracted AWS S3 region: %s\n", region);
-                        return true;
-                     }
-                  }
-               }
-            }
-            else if (strstr(url, ".backblazeb2.com"))
-            {
-               RARCH_LOG(S3_PFX "Detected Backblaze B2 format\n");
-               /* Backblaze B2: bucket.s3.region.backblazeb2.com */
-               if (strncmp(dot_pos, ".s3.", 4) == 0)
-               {
-                  region_start = dot_pos + 4;
-                  dot_pos = strchr(region_start, '.');
-                  if (dot_pos)
-                  {
-                     size_t region_len = dot_pos - region_start;
-                     if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                     {
-                        strlcpy(region, region_start, region_len + 1);
-                        RARCH_LOG(S3_PFX "Extracted Backblaze B2 region: %s\n", region);
-                        return true;
-                     }
-                  }
-               }
-            }
-            else if (strstr(url, ".digitaloceanspaces.com"))
-            {
-               RARCH_LOG(S3_PFX "Detected DigitalOcean Spaces format\n");
-               /* DigitalOcean Spaces: bucket.region.digitaloceanspaces.com */
-               region_start = dot_pos + 1;
-               dot_pos = strchr(region_start, '.');
-               if (dot_pos)
-               {
-                  size_t region_len = dot_pos - region_start;
-                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                  {
-                     strlcpy(region, region_start, region_len + 1);
-                     RARCH_LOG(S3_PFX "Extracted DigitalOcean region: %s\n", region);
-                     return true;
-                  }
-               }
-            }
-            else if (strstr(url, ".linodeobjects.com"))
-            {
-               RARCH_LOG(S3_PFX "Detected Linode Object Storage format\n");
-               /* Linode Object Storage: bucket.region.linodeobjects.com */
-               region_start = dot_pos + 1;
-               dot_pos = strchr(region_start, '.');
-               if (dot_pos)
-               {
-                  size_t region_len = dot_pos - region_start;
-                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                  {
-                     strlcpy(region, region_start, region_len + 1);
-                     RARCH_LOG(S3_PFX "Extracted Linode region: %s\n", region);
-                     return true;
-                  }
-               }
-            }
-            else if (strstr(url, ".cloudflarestorage.com"))
+            /* If there are two labels before ".r2..." then first label is bucket. */
+            if (prefix_dot && prefix_dot < r2_pos)
             {
-               RARCH_LOG(S3_PFX "Detected Cloudflare R2 format\n");
-               /* Cloudflare R2: bucket.region.cloudflarestorage.com */
-               region_start = dot_pos + 1;
-               dot_pos = strchr(region_start, '.');
-               if (dot_pos)
+               size_t bucket_len = (size_t)(prefix_dot - prefix_start);
+               if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
                {
-                  size_t region_len = dot_pos - region_start;
-                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                  {
-                     strlcpy(region, region_start, region_len + 1);
-                     RARCH_LOG(S3_PFX "Extracted Cloudflare region: %s\n", region);
-                     return true;
-                  }
-               }
-            }
-            else
-            {
-               RARCH_LOG(S3_PFX "Detected custom endpoint format\n");
-               /* Custom endpoints (MinIO, etc.): bucket.endpoint */
-               /* Try to extract region from the endpoint */
-               region_start = dot_pos + 1;
-               slash_pos = strchr(region_start, '/');
-               if (slash_pos)
-               {
-                  size_t region_len = slash_pos - region_start;
-                  if (region_len > 0 && region_len < NAME_MAX_LENGTH)
-                  {
-                     strlcpy(region, region_start, region_len + 1);
-                     RARCH_LOG(S3_PFX "Extracted custom endpoint region: %s\n", region);
-                     return true;
-                  }
-               }
-               else
-               {
-                  /* No slash found, use the entire endpoint as region */
-                  strlcpy(region, region_start, NAME_MAX_LENGTH);
-                  RARCH_LOG(S3_PFX "Using entire endpoint as region: %s\n", region);
-                  return true;
+                  RARCH_LOG(S3_PFX "Cloudflare R2 style: virtual-hosted\n");
+                  strlcpy(bucket, prefix_start, bucket_len + 1);
                }
             }
          }
+
+         /* Path-style endpoint (accountid.r2...) carries bucket in first path segment. */
+         if (string_is_empty(bucket) && !string_is_empty(first_path_seg))
+         {
+            RARCH_LOG(S3_PFX "Cloudflare R2 style: path-style\n");
+            strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+         }
+      }
+      else if (!string_is_empty(first_label))
+      {
+         /* Compatibility fallback for other cloudflarestorage host variants. */
+         RARCH_LOG(S3_PFX "Cloudflare R2 style: fallback-host-label\n");
+         strlcpy(bucket, first_label, NAME_MAX_LENGTH);
       }
+
+      /* Cloudflare R2 uses region "auto" for AWS SigV4. */
+      strlcpy(region, "auto", NAME_MAX_LENGTH);
    }
+   else if (strstr(host, ".amazonaws.com"))
+   {
+      const char *s3pos = strstr(host, ".s3.");
+      const char *s3dash = strstr(host, ".s3-");
+      const char *s3accelerate = strstr(host, ".s3-accelerate.");
+      const char *s3acceleration = strstr(host, ".s3-acceleration.");
+      const char *host_start = host;
 
-   /* If we found a bucket but no region, use default */
-   if (bucket_found)
+      RARCH_LOG(S3_PFX "Detected AWS S3 format\n");
+
+      if (s3accelerate || s3acceleration)
+      {
+         const char *accel_pos = s3accelerate ? s3accelerate : s3acceleration;
+         size_t bucket_len = accel_pos - host_start;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host_start, bucket_len + 1);
+
+         /* Transfer acceleration endpoints do not encode bucket region in hostname.
+          * Keep fallback-compatible behavior by using us-east-1 here. */
+         strlcpy(region, "us-east-1", NAME_MAX_LENGTH);
+      }
+      else if (s3pos)
+      {
+         size_t bucket_len = s3pos - host_start;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host_start, bucket_len + 1);
+         s3pos += 4; /* skip ".s3." */
+         second_dot = strchr(s3pos, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - s3pos;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, s3pos, region_len + 1);
+         }
+      }
+      else if (s3dash)
+      {
+         size_t bucket_len = s3dash - host_start;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host_start, bucket_len + 1);
+         s3dash += 4; /* skip ".s3-" */
+         second_dot = strchr(s3dash, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - s3dash;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, s3dash, region_len + 1);
+         }
+      }
+      else
+      {
+         /* Path-style fallback: s3.<region>.amazonaws.com/<bucket>/... */
+         if (!string_is_empty(first_path_seg))
+            strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+      }
+   }
+   else if (strstr(host, ".backblazeb2.com"))
    {
-      strlcpy(region, "us-east-1", NAME_MAX_LENGTH);
-      RARCH_LOG(S3_PFX "Using default region us-east-1 for bucket: %s\n", bucket);
-      return true;
+      const char *s3pos = strstr(host, ".s3.");
+
+      RARCH_LOG(S3_PFX "Detected Backblaze B2 format\n");
+
+      if (s3pos)
+      {
+         RARCH_LOG(S3_PFX "Backblaze B2 style: virtual-hosted\n");
+         size_t bucket_len = s3pos - host;
+         if (bucket_len > 0 && bucket_len < NAME_MAX_LENGTH)
+            strlcpy(bucket, host, bucket_len + 1);
+         s3pos += 4; /* skip ".s3." */
+         second_dot = strchr(s3pos, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - s3pos;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, s3pos, region_len + 1);
+         }
+      }
+      else if (!string_is_empty(first_path_seg))
+      {
+         RARCH_LOG(S3_PFX "Backblaze B2 style: path-style\n");
+         strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+      }
    }
+   else if (strstr(host, ".digitaloceanspaces.com") || strstr(host, ".linodeobjects.com"))
+   {
+      if (!string_is_empty(first_label))
+         strlcpy(bucket, first_label, NAME_MAX_LENGTH);
+      if (first_dot)
+      {
+         const char *region_start = first_dot + 1;
+         second_dot = strchr(region_start, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - region_start;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+               strlcpy(region, region_start, region_len + 1);
+         }
+      }
+   }
+   else
+   {
+      /* Generic fallback:
+       * - virtual-host: bucket.endpoint
+       * - path-style: endpoint/bucket */
+      if (!string_is_empty(first_path_seg))
+         strlcpy(bucket, first_path_seg, NAME_MAX_LENGTH);
+      else if (!string_is_empty(first_label))
+         strlcpy(bucket, first_label, NAME_MAX_LENGTH);
+   }
+
+   if (string_is_empty(region))
+      strlcpy(region, "us-east-1", NAME_MAX_LENGTH);
+
+   if (string_is_empty(bucket))
+      RARCH_WARN(S3_PFX "Could not extract bucket from URL: %s\n", url);
 
-   return false;
+   RARCH_LOG(S3_PFX "Extracted bucket: %s, region: %s, host: %s\n",
+             string_is_empty(bucket) ? "(none)" : bucket, region, host);
+
+   return !string_is_empty(host) && !string_is_empty(bucket);
 }
 
 /* Calculate SHA256 hash */
@@ -939,9 +953,55 @@ static bool s3_http_delete_async(const char *url, const char *headers, s3_cb_sta
          headers, s3_delete_cb, cb_state) != NULL;
 }
 
+/* Normalize object key path to avoid malformed request URLs:
+ * - strip leading '/'
+ * - collapse repeated '/' inside key */
+static char* s3_normalize_object_key(const char *path)
+{
+   const char *src = path;
+   size_t src_len = 0;
+   char *normalized = NULL;
+   size_t out = 0;
+   bool prev_slash = false;
+
+   if (string_is_empty(path))
+      return strdup("");
+
+   while (*src == '/')
+      src++;
+
+   src_len = strlen(src);
+   normalized = (char*)malloc(src_len + 1);
+   if (!normalized)
+      return NULL;
+
+   while (*src)
+   {
+      if (*src == '/')
+      {
+         if (prev_slash)
+         {
+            src++;
+            continue;
+         }
+         prev_slash = true;
+      }
+      else
+         prev_slash = false;
+
+      normalized[out++] = *src++;
+   }
+
+   normalized[out] = '\0';
+   return normalized;
+}
+
 static bool s3_build_request_url(char *url, size_t url_size, s3_state_t *s3_st, const char *path)
 {
+   char base_url[PATH_MAX_LENGTH];
+   char *normalized_path = NULL;
    char *encoded_path = NULL;
+   size_t base_len = 0;
 
    if (!url || !s3_st || string_is_empty(s3_st->url))
       return false;
@@ -952,15 +1012,74 @@ static bool s3_build_request_url(char *url, size_t url_size, s3_state_t *s3_st,
       return true;
    }
 
-   encoded_path = s3_url_encode(path);
+   normalized_path = s3_normalize_object_key(path);
+   if (!normalized_path)
+      return false;
+
+   encoded_path = s3_url_encode(normalized_path);
    if (!encoded_path)
+   {
+      free(normalized_path);
       return false;
+   }
+
+   strlcpy(base_url, s3_st->url, sizeof(base_url));
+   base_len = strlen(base_url);
+   while (base_len > 0 && base_url[base_len - 1] == '/')
+      base_url[--base_len] = '\0';
+
+   if (string_is_empty(encoded_path))
+      strlcpy(url, base_url, url_size);
+   else
+      snprintf(url, url_size, "%s/%s", base_url, encoded_path);
 
-   snprintf(url, url_size, "%s/%s", s3_st->url, encoded_path);
+   free(normalized_path);
    free(encoded_path);
    return true;
 }
 
+/* Build canonical URI from an already constructed request URL path component.
+ * This keeps signing aligned with the exact URL being requested, including any
+ * base path prefix (e.g. path-style bucket endpoints). */
+static bool s3_build_canonical_uri_from_url(const char *url, char *canonical_uri, size_t canonical_uri_size)
+{
+   const char *scheme_sep = NULL;
+   const char *authority = NULL;
+   const char *path_start = NULL;
+   const char *path_end = NULL;
+   size_t path_len = 0;
+
+   if (string_is_empty(url) || !canonical_uri || canonical_uri_size == 0)
+      return false;
+
+   scheme_sep = strstr(url, "://");
+   authority  = scheme_sep ? scheme_sep + 3 : url;
+   if (string_is_empty(authority))
+      return false;
+
+   path_start = strchr(authority, '/');
+   if (!path_start)
+   {
+      strlcpy(canonical_uri, "/", canonical_uri_size);
+      return true;
+   }
+
+   path_end = strpbrk(path_start, "?#");
+   path_len = path_end ? (size_t)(path_end - path_start) : strlen(path_start);
+
+   if (path_len == 0)
+   {
+      strlcpy(canonical_uri, "/", canonical_uri_size);
+      return true;
+   }
+
+   if (path_len >= canonical_uri_size)
+      return false;
+
+   strlcpy(canonical_uri, path_start, path_len + 1);
+   return true;
+}
+
 static char* s3_url_encode_query_value(const char *input)
 {
    size_t input_len = 0;
@@ -1701,20 +1820,8 @@ static bool s3_read(const char *path, const char *file, cloud_sync_complete_hand
    if (!s3_build_request_url(url, sizeof(url), s3_st, path))
       goto cleanup;
 
-   /* Build canonical URI - must be URL encoded */
-   if (path && *path)
-   {
-      char *encoded_path = s3_url_encode(path);
-      if (encoded_path)
-      {
-         snprintf(canonical_uri, sizeof(canonical_uri), "/%s", encoded_path);
-         free(encoded_path);
-      }
-      else
-         strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-   }
-   else
-      strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+   if (!s3_build_canonical_uri_from_url(url, canonical_uri, sizeof(canonical_uri)))
+      goto cleanup;
 
    /* Build authorization header */
    auth_header = s3_build_auth_header("GET", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",
@@ -1794,20 +1901,8 @@ static bool s3_update(const char *path, RFILE *file, cloud_sync_complete_handler
    if (!s3_build_request_url(url, sizeof(url), s3_st, path))
       goto cleanup;
 
-   /* Build canonical URI - must be URL encoded */
-   if (path && *path)
-   {
-      char *encoded_path = s3_url_encode(path);
-      if (encoded_path)
-      {
-         snprintf(canonical_uri, sizeof(canonical_uri), "/%s", encoded_path);
-         free(encoded_path);
-      }
-      else
-         strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-   }
-   else
-      strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+   if (!s3_build_canonical_uri_from_url(url, canonical_uri, sizeof(canonical_uri)))
+      goto cleanup;
 
    RARCH_DBG(S3_PFX "Request URL: %s\n", url);
    RARCH_DBG(S3_PFX "Canonical URI: %s\n", canonical_uri);
@@ -1924,20 +2019,8 @@ static bool s3_free(const char *path, cloud_sync_complete_handler_t cb, void *us
    if (!s3_build_request_url(url, sizeof(url), s3_st, path))
       goto cleanup;
 
-   /* Build canonical URI - must be URL encoded */
-   if (path && *path)
-   {
-      char *encoded_path = s3_url_encode(path);
-      if (encoded_path)
-      {
-         snprintf(canonical_uri, sizeof(canonical_uri), "/%s", encoded_path);
-         free(encoded_path);
-      }
-      else
-         strlcpy(canonical_uri, "/", sizeof(canonical_uri));
-   }
-   else
-      strlcpy(canonical_uri, "/", sizeof(canonical_uri));
+   if (!s3_build_canonical_uri_from_url(url, canonical_uri, sizeof(canonical_uri)))
+      goto cleanup;
 
    /* Build authorization header */
    auth_header = s3_build_auth_header("DELETE", canonical_uri, "", "host;x-amz-content-sha256;x-amz-date",

From 94954303051fe9a384a975dc0b653e924fa55913 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Thu, 12 Mar 2026 23:31:11 -0500
Subject: [PATCH 11/12] Fix b2 for path and virtual host styles

---
 network/cloud_sync/s3.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index 5587ceac9bc9..d1e159df18a6 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -302,10 +302,27 @@ static bool s3_parse_url(const char *url, char *bucket,  char *region,
    else if (strstr(host, ".backblazeb2.com"))
    {
       const char *s3pos = strstr(host, ".s3.");
+      bool b2_path_style_host = false;
 
       RARCH_LOG(S3_PFX "Detected Backblaze B2 format\n");
 
-      if (s3pos)
+      /* Backblaze B2 path-style host: s3.<region>.backblazeb2.com/<bucket>/... */
+      if (string_starts_with_case_insensitive(host, "s3."))
+      {
+         const char *region_start = host + 3; /* skip "s3." */
+         second_dot = strchr(region_start, '.');
+         if (second_dot)
+         {
+            size_t region_len = second_dot - region_start;
+            if (region_len > 0 && region_len < NAME_MAX_LENGTH)
+            {
+               strlcpy(region, region_start, region_len + 1);
+               b2_path_style_host = true;
+            }
+         }
+      }
+
+      if (s3pos && !b2_path_style_host)
       {
          RARCH_LOG(S3_PFX "Backblaze B2 style: virtual-hosted\n");
          size_t bucket_len = s3pos - host;

From c289bd10ebd7b0c54828eb7715f41a4c6f3da870 Mon Sep 17 00:00:00 2001
From: Russell Parks <russell.parks@rezzell.com>
Date: Fri, 13 Mar 2026 23:21:38 -0500
Subject: [PATCH 12/12] Move net_http logging to http_t

---
 libretro-common/include/net/net_http.h |  43 ++++++
 libretro-common/net/net_http.c         | 201 ++++++++++++++++++-------
 network/cloud_sync/s3.c                |  26 ++++
 tasks/task_http.c                      |   2 +
 tasks/tasks_internal.h                 |   3 +
 5 files changed, 222 insertions(+), 53 deletions(-)

diff --git a/libretro-common/include/net/net_http.h b/libretro-common/include/net/net_http.h
index 14fa8f9ec0f2..a1e5c18792fe 100644
--- a/libretro-common/include/net/net_http.h
+++ b/libretro-common/include/net/net_http.h
@@ -34,6 +34,43 @@ RETRO_BEGIN_DECLS
 struct http_t;
 struct http_connection_t;
 
+typedef enum net_http_phase
+{
+   NET_HTTP_PHASE_CONNECT = 0,
+   NET_HTTP_PHASE_SEND,
+   NET_HTTP_PHASE_RECV_HEADER,
+   NET_HTTP_PHASE_RECV_BODY,
+   NET_HTTP_PHASE_REDIRECT,
+   NET_HTTP_PHASE_DONE,
+   NET_HTTP_PHASE_ERROR
+} net_http_phase_t;
+
+const char *net_http_phase_to_string(net_http_phase_t phase);
+
+/* Caller-facing, point-in-time HTTP transport snapshot.
+ *
+ * Notes:
+ * - Some fields intentionally mirror live http_t state (e.g. status/fd/err)
+ *   so callers can log a single self-contained payload without issuing
+ *   additional net_http_* calls.
+ * - Snapshot data is safe to copy and retain after transfer completion,
+ *   unlike the opaque internal state which may be freed. */
+typedef struct net_http_debug_state
+{
+   int fd;
+   int status;
+   int last_errno;
+   int64_t last_io_len;
+   size_t progress;
+   size_t total;
+   unsigned redirects;
+   bool ssl;
+   bool connected;
+   bool request_sent;
+   bool err;
+   net_http_phase_t phase;
+} net_http_debug_state_t;
+
 struct http_connection_t *net_http_connection_new(const char *url, const char *method, const char *data);
 
 /**
@@ -96,6 +133,12 @@ int net_http_status(struct http_t *state);
  **/
 bool net_http_error(struct http_t *state);
 
+/* Copies the current transport snapshot into @out.
+ *
+ * Returns false if inputs are invalid; true on success.
+ * The returned snapshot is independent from internal http_t lifetime. */
+bool net_http_get_debug_state(struct http_t *state, net_http_debug_state_t *out);
+
 /**
  * net_http_headers:
  *
diff --git a/libretro-common/net/net_http.c b/libretro-common/net/net_http.c
index 85c405d3db4e..3e8e956b3147 100644
--- a/libretro-common/net/net_http.c
+++ b/libretro-common/net/net_http.c
@@ -116,6 +116,7 @@ struct http_t
 
    request_t request;
    response_t response;
+   net_http_debug_state_t debug_state;
 };
 
 struct http_connection_t
@@ -134,52 +135,56 @@ struct http_connection_t
    bool ssl;
 };
 
-static void net_http_log_transport_state(
-      const struct http_t *state, const char *stage, ssize_t io_len)
+const char *net_http_phase_to_string(net_http_phase_t phase)
 {
-#if defined(DEBUG)
-   const char *method = "GET";
-   const char *domain = "<null>";
-   const char *path   = "<null>";
-   int port           = 0;
-   int fd             = -1;
-   int connected      = 0;
-
-   if (state)
+   switch (phase)
    {
-      method = state->request.method ? state->request.method : "GET";
-      domain = state->request.domain ? state->request.domain : "<null>";
-      path   = state->request.path ? state->request.path : "<null>";
-      port   = state->request.port;
-
-      if (state->conn)
-      {
-         fd        = state->conn->fd;
-         connected = state->conn->connected ? 1 : 0;
-      }
+      case NET_HTTP_PHASE_CONNECT:
+         return "connect";
+      case NET_HTTP_PHASE_SEND:
+         return "send";
+      case NET_HTTP_PHASE_RECV_HEADER:
+         return "recv_header";
+      case NET_HTTP_PHASE_RECV_BODY:
+         return "recv_body";
+      case NET_HTTP_PHASE_REDIRECT:
+         return "redirect";
+      case NET_HTTP_PHASE_DONE:
+         return "done";
+      case NET_HTTP_PHASE_ERROR:
+         return "error";
+      default:
+         return "unknown";
    }
+}
 
-   fprintf(stderr,
-         "[net_http] %s: method=%s host=%s port=%d path=/%s ssl=%d fd=%d connected=%d request_sent=%d err=%d io_len=%ld errno=%d (%s)\n",
-         stage ? stage : "unknown",
-         method,
-         domain,
-         port,
-         path,
-         state ? (state->ssl ? 1 : 0) : 0,
-         fd,
-         connected,
-         state ? (state->request_sent ? 1 : 0) : 0,
-         state ? (state->err ? 1 : 0) : 0,
-         (long)io_len,
-         errno,
-         strerror(errno));
-   fflush(stderr);
-#else
-   (void)state;
-   (void)stage;
-   (void)io_len;
-#endif
+static void net_http_debug_sync(struct http_t *state)
+{
+   if (!state)
+      return;
+
+   state->debug_state.ssl          = state->ssl;
+   state->debug_state.request_sent = state->request_sent;
+   state->debug_state.err          = state->err;
+   state->debug_state.status       = state->response.status;
+   state->debug_state.connected    = state->conn ? state->conn->connected : false;
+   state->debug_state.fd           = state->conn ? state->conn->fd : -1;
+}
+
+static void net_http_debug_set_phase(struct http_t *state, net_http_phase_t phase)
+{
+   if (!state)
+      return;
+   state->debug_state.phase = phase;
+}
+
+static void net_http_debug_set_io(struct http_t *state, ssize_t io_len)
+{
+   if (!state)
+      return;
+
+   state->debug_state.last_io_len = (int64_t)io_len;
+   state->debug_state.last_errno  = errno;
 }
 
 struct dns_cache_entry
@@ -898,6 +903,15 @@ struct http_t *net_http_new(struct http_connection_t *conn)
    state->response.buflen  = 64 * 1024;  /* Start with larger buffer to reduce reallocations */
    state->response.data    = (char*)malloc(state->response.buflen);
    state->response.headers = string_list_new();
+   state->debug_state.fd         = -1;
+   state->debug_state.status     = -1;
+   state->debug_state.last_errno = 0;
+   state->debug_state.last_io_len = -1;
+   state->debug_state.progress   = 0;
+   state->debug_state.total      = 0;
+   state->debug_state.redirects  = 0;
+   state->debug_state.phase      = NET_HTTP_PHASE_CONNECT;
+   net_http_debug_sync(state);
 
    return state;
 }
@@ -969,16 +983,25 @@ static bool net_http_new_socket(struct http_t *state)
          int fd;
          if (!entry->addr)
          {
-            net_http_log_transport_state(state, "dns_lookup_failed", -1);
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
             UNLOCK_DNS_CACHE();
             return false;
          }
          addr = entry->addr;
          fd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
          if (fd >= 0)
+         {
             state->conn = net_http_conn_pool_add(state->request.domain, state->request.port, fd, state->ssl);
+            net_http_debug_sync(state);
+         }
          else
-            net_http_log_transport_state(state, "socket_create_failed", -1);
+         {
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
+         }
          /* still waiting on thread */
          UNLOCK_DNS_CACHE();
          return (fd >= 0);
@@ -1022,14 +1045,18 @@ static bool net_http_connect(struct http_t *state)
    {
       if (!conn)
       {
-         net_http_log_transport_state(state, "connect_missing_dns_or_conn", -1);
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
          return false;
       }
       for (next_addr = addr; conn->fd >= 0; conn->fd = socket_next((void**)&next_addr))
       {
          if (!(conn->ssl_ctx = ssl_socket_init(conn->fd, state->request.domain)))
          {
-            net_http_log_transport_state(state, "ssl_init_failed", -1);
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
             socket_close(conn->fd);
             break;
          }
@@ -1047,7 +1074,9 @@ static bool net_http_connect(struct http_t *state)
 
          if (ssl_socket_connect(conn->ssl_ctx, next_addr, timeout, true) < 0)
          {
-            net_http_log_transport_state(state, "ssl_connect_failed", -1);
+            net_http_debug_set_io(state, -1);
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
             ssl_socket_close(conn->ssl_ctx);
             ssl_socket_free(conn->ssl_ctx);
             conn->ssl_ctx = NULL;
@@ -1055,6 +1084,8 @@ static bool net_http_connect(struct http_t *state)
          else
          {
             conn->connected = true;
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_SEND);
+            net_http_debug_sync(state);
             return true;
          }
       }
@@ -1072,10 +1103,14 @@ static bool net_http_connect(struct http_t *state)
          if (socket_connect_with_timeout(conn->fd, next_addr, 5000))
          {
             conn->connected = true;
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_SEND);
+            net_http_debug_sync(state);
             return true;
          }
 
-         net_http_log_transport_state(state, "socket_connect_failed", -1);
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
          socket_close(conn->fd);
       }
       conn->fd    = -1; /* already closed */
@@ -1098,7 +1133,9 @@ static void net_http_send_str(
                   state->conn->ssl_ctx, text, text_size, true))
       {
          state->err = true;
-         net_http_log_transport_state(state, "ssl_send_failed", -1);
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
       }
    }
    else
@@ -1108,7 +1145,9 @@ static void net_http_send_str(
                   state->conn->fd, text, text_size, true))
       {
          state->err = true;
-         net_http_log_transport_state(state, "socket_send_failed", -1);
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
       }
    }
 }
@@ -1165,7 +1204,9 @@ static bool net_http_send_request(struct http_t *state)
             request->contentlength > 0)
       {
          state->err = true;
-         net_http_log_transport_state(state, "post_without_payload", -1);
+         net_http_debug_set_io(state, -1);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
          return true;
       }
 
@@ -1209,6 +1250,8 @@ static bool net_http_send_request(struct http_t *state)
             request->contentlength);
 
    state->request_sent = true;
+   net_http_debug_set_phase(state, NET_HTTP_PHASE_RECV_HEADER);
+   net_http_debug_sync(state);
    return state->err;
 }
 
@@ -1252,10 +1295,13 @@ static ssize_t net_http_receive_header(struct http_t *state, ssize_t len)
          {
             response->part = P_DONE;
             state->err     = true;
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
             return -1;
          }
          response->status = (int)strtoul(response->data
                + STRLEN_CONST("HTTP/1.1 "), NULL, 10);
+      net_http_debug_sync(state);
          response->part   = P_HEADER;
       }
       else
@@ -1470,6 +1516,9 @@ static bool net_http_redirect(struct http_t *state, const char *location)
    /* after this, assume location is invalid */
    string_list_deinitialize(state->response.headers);
    string_list_initialize(state->response.headers);
+   state->debug_state.redirects++;
+   net_http_debug_set_phase(state, NET_HTTP_PHASE_REDIRECT);
+   net_http_debug_sync(state);
    /* keep going */
    return false;
 }
@@ -1488,26 +1537,43 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
    if (!state || state->err)
       return true;
 
+   net_http_debug_sync(state);
+
    if (!state->conn)
    {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_CONNECT);
       state->conn = net_http_conn_pool_find(state->request.domain, state->request.port);
       if (!state->conn)
       {
          if (!net_http_new_socket(state))
             state->err = true;
+         if (state->err)
+         {
+            net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+            net_http_debug_sync(state);
+         }
          return state->err;
       }
+      net_http_debug_sync(state);
    }
 
    if (!state->conn->connected)
    {
       if (!net_http_connect(state))
          state->err = true;
+      if (state->err)
+      {
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
+         net_http_debug_sync(state);
+      }
       return state->err;
    }
 
    if (!state->request_sent)
+   {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_SEND);
       return net_http_send_request(state);
+   }
 
    response = (struct response*)&state->response;
 
@@ -1521,38 +1587,49 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
       _len = socket_receive_all_nonblocking(state->conn->fd, &state->err,
             (uint8_t*)response->data + response->pos,
             response->buflen - response->pos);
+   net_http_debug_set_io(state, _len);
 
    if (response->part < P_BODY)
    {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_RECV_HEADER);
       if (_len < 0 || state->err)
       {
-         net_http_log_transport_state(state, "receive_header_failed", _len);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
          net_http_conn_pool_remove(state->conn);
          state->conn      = NULL;
          state->err       = true;
          response->part   = P_DONE;
          response->status = -1;
+         net_http_debug_sync(state);
          return true;
       }
       _len = net_http_receive_header(state, _len);
+      net_http_debug_set_io(state, _len);
    }
 
    if (response->part >= P_BODY && response->part < P_DONE)
    {
+      net_http_debug_set_phase(state, NET_HTTP_PHASE_RECV_BODY);
       if (!net_http_receive_body(state, _len))
       {
-         net_http_log_transport_state(state, "receive_body_failed", _len);
+         net_http_debug_set_phase(state, NET_HTTP_PHASE_ERROR);
          net_http_conn_pool_remove(state->conn);
          state->conn      = NULL;
          state->err       = true;
          response->part   = P_DONE;
          response->status = -1;
+         net_http_debug_sync(state);
          return true;
       }
    }
 
    if (progress)
+   {
       *progress = response->pos;
+      state->debug_state.progress = *progress;
+   }
+   else
+      state->debug_state.progress = response->pos;
 
    if (total)
    {
@@ -1560,10 +1637,16 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
          *total = response->len;
       else
          *total = 0;
+      state->debug_state.total = *total;
    }
+   else
+      state->debug_state.total = (response->bodytype == T_LEN) ? response->len : 0;
 
    if (response->part != P_DONE)
+   {
+      net_http_debug_sync(state);
       return false;
+   }
 
    for (_len = 0; (size_t)_len < response->headers->size; _len++)
    {
@@ -1588,6 +1671,8 @@ bool net_http_update(struct http_t *state, size_t* progress, size_t* total)
       }
    }
 
+   net_http_debug_set_phase(state, NET_HTTP_PHASE_DONE);
+   net_http_debug_sync(state);
    return true;
 }
 
@@ -1657,6 +1742,16 @@ uint8_t* net_http_data(struct http_t *state, size_t* len, bool accept_err)
    return (uint8_t*)state->response.data;
 }
 
+bool net_http_get_debug_state(struct http_t *state, net_http_debug_state_t *out)
+{
+   if (!state || !out)
+      return false;
+
+   net_http_debug_sync(state);
+   *out = state->debug_state;
+   return true;
+}
+
 /**
  * net_http_delete:
  *
diff --git a/network/cloud_sync/s3.c b/network/cloud_sync/s3.c
index d1e159df18a6..6e0a8034b502 100644
--- a/network/cloud_sync/s3.c
+++ b/network/cloud_sync/s3.c
@@ -852,10 +852,35 @@ static char* s3_build_auth_header(const char *method, const char *canonical_uri,
    return auth_header;
 }
 
+static void s3_log_http_snapshot(const http_transfer_data_t *data)
+{
+   const net_http_debug_state_t *dbg = NULL;
+
+   if (!data || !data->has_http_debug_state)
+      return;
+
+   dbg = &data->http_debug_state;
+   RARCH_LOG(S3_PFX
+         "HTTP snapshot: phase=%s status=%d err=%d last_errno=%d last_io_len=%lld fd=%d connected=%d request_sent=%d redirects=%u progress=%zu total=%zu ssl=%d\n",
+         net_http_phase_to_string(dbg->phase),
+         dbg->status,
+         dbg->err ? 1 : 0,
+         dbg->last_errno,
+         (long long)dbg->last_io_len,
+         dbg->fd,
+         dbg->connected ? 1 : 0,
+         dbg->request_sent ? 1 : 0,
+         dbg->redirects,
+         dbg->progress,
+         dbg->total,
+         dbg->ssl ? 1 : 0);
+}
+
 static void s3_log_http_failure(const char *path, http_transfer_data_t *data)
 {
    size_t i;
    RARCH_WARN(S3_PFX "Failed: %s: HTTP %d\n", path ? path : "<unknown>", data->status);
+   s3_log_http_snapshot(data);
    for (i = 0; data->headers && i < data->headers->size; i++)
       RARCH_WARN(S3_PFX "%s\n", data->headers->elems[i].data);
    if (data->data)
@@ -1307,6 +1332,7 @@ static void s3_log_multipart_initiate_failure(
          data ? data->len : 0,
          (data && data->headers) ? data->headers->size : 0,
          (err && *err) ? err : "<none>");
+   s3_log_http_snapshot(data);
 
    if (data && data->headers)
       for (i = 0; i < data->headers->size; i++)
diff --git a/tasks/task_http.c b/tasks/task_http.c
index 59bd80f51ed4..8c4039164963 100644
--- a/tasks/task_http.c
+++ b/tasks/task_http.c
@@ -189,6 +189,8 @@ static void task_http_transfer_handler(retro_task_t *task)
          data->len     = _len;
          data->headers = net_http_headers_ex(http->handle, http->headers_accept_err);
          data->status  = net_http_status(http->handle);
+         data->has_http_debug_state =
+               net_http_get_debug_state(http->handle, &data->http_debug_state);
 
          task_set_data(task, data);
 
diff --git a/tasks/tasks_internal.h b/tasks/tasks_internal.h
index 97e71339dce9..f636a42e9b70 100644
--- a/tasks/tasks_internal.h
+++ b/tasks/tasks_internal.h
@@ -32,6 +32,7 @@
 
 #if defined(HAVE_NETWORKING)
 #include "../core_updater_list.h"
+#include <net/net_http.h>
 #endif
 
 #include "../playlist.h"
@@ -59,6 +60,8 @@ typedef struct
    struct string_list *headers;
    size_t len;
    int status;
+   bool has_http_debug_state;
+   net_http_debug_state_t http_debug_state;
 } http_transfer_data_t;
 
 void *task_push_http_transfer(const char *url, bool mute, const char *type,