Replace blocking Task.Run + poll() approach with proper async I/O:

- Handshake: non-blocking SSL_do_handshake loop with zero-byte reads
  on InnerStream (via TIOAdapter) for WANT_READ
- Read: non-blocking SSL_read with zero-byte reads for WANT_READ
- Write: non-blocking SSL_write with Task.Yield() for WANT_WRITE

This avoids blocking threadpool threads and integrates with .NET's
epoll-based async socket infrastructure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

With socket BIOs on non-blocking sockets, OpenSSL may return
SSL_ERROR_SYSCALL with errno=EAGAIN instead of SSL_ERROR_WANT_READ
or SSL_ERROR_WANT_WRITE. This happens because ERR_clear_error() is
called before SSL operations, leaving the error queue empty, so
SSL_get_error() falls through to SSL_ERROR_SYSCALL.

Handle this in the managed kTLS code via IsKtlsWantRead() helper
that checks Marshal.GetLastPInvokeError() for EAGAIN, avoiding
changes to the shared native PAL functions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Debug Console.WriteLine statements between SSL_read/SSL_write P/Invoke
calls and the subsequent errno check were corrupting the saved errno.
Console.WriteLine internally calls Interop.Sys.Write (SetLastError=true),
which overwrites Marshal.GetLastPInvokeError() before IsKtlsWantRead
could read it. This caused genuine EOF (ret=0 + SSL_ERROR_SYSCALL +
errno=0) to be misinterpreted as EAGAIN/WANT_READ, leading to an
infinite wait on a zero-byte read that would never complete.

Fix:
- Remove all debug Console.WriteLine statements from kTLS paths
- Capture errno immediately after SSL P/Invoke calls via out parameters
  in TryKtlsRead/TryKtlsWrite, before any other P/Invoke can run
- Pass captured errno to IsKtlsWantRead instead of reading it later
- Handle ret=0 + SSL_ERROR_SYSCALL + errno=SUCCESS as EOF explicitly

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove unused blocking wrappers (DoSslHandshakeKtls, KtlsRead,
KtlsWrite) from Interop.OpenSsl.cs and their P/Invoke declarations
(SslDoHandshakeBlocking, SslReadBlocking, SslWriteBlocking) from
Interop.Ssl.cs. These were from the initial blocking I/O approach and
are no longer called since switching to the async pattern.

Also remove: empty static constructor, unused 'ns' local variable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Three performance improvements for the kTLS PoC:

1. Fix busy-spin on WANT_READ: Zero-byte reads on Socket complete
   immediately (SocketAsyncContext fast-paths them without a syscall).
   Replace with 1-byte MSG_PEEK recv which properly waits via epoll
   for data availability without consuming it from the kernel buffer.
   Applies to both handshake and read paths.

2. Fix busy-spin on WANT_WRITE: Replace Task.Yield() (immediate
   reschedule = CPU burn) with Task.Delay(1) to give the socket send
   buffer time to drain. WANT_WRITE is rare in practice.

3. Enable SSL_CTX caching and TLS session resume: The kTLS path now
   reuses cached SSL_CTX handles and sets TLS sessions for repeat
   connections, matching the behavior of the normal SslStream path.
   This avoids full TLS handshakes on subsequent connections to the
   same host.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The two functions were nearly identical — the only difference was
SafeSslHandle.Create vs CreateForKtls (memory BIOs vs socket BIO).
Add an optional socketFd parameter (default -1) to AllocateSslHandle
and branch at the Create call. This eliminates ~120 lines of
duplicated SSL configuration code.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

With blocking sockets (the default for new Socket instances),
SSL_do_handshake blocks the thread pool thread during recv/send calls.
In loopback test scenarios where both client and server handshakes
run as tasks on the thread pool, this causes thread pool starvation
and hangs.

Set socket.Blocking = false before the handshake. This is necessary
because SSL_do_handshake bypasses SocketAsyncContext (calling recv/send
directly on the fd), so we can't rely on SocketAsyncContext's lazy
non-blocking initialization. With non-blocking sockets, the handshake
loop properly returns WANT_READ/WANT_WRITE and uses peek-based async
readiness waiting.

All 4957 tests pass with DOTNET_SYSTEM_NET_SECURITY_KTLS=1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Only set socket.Blocking = false when using the async handshake path
(AsyncReadWriteAdapter). For the sync path, blocking is expected by
the caller. The JIT constant-folds the typeof comparison.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Two improvements to the kTLS read path based on benchmark trace analysis:

1. Buffer filling: After a successful SSL_read, continue reading to fill the
   caller's buffer instead of returning immediately. This avoids extra
   peek+SSL_read syscall round trips when multiple TLS records are already
   buffered in the kernel. For a 64KB response (~4 TLS records), this reduces
   from 8 syscalls to ~6 and eliminates 3 async iterations.

2. Connection close handling: Catch SocketException from the MSG_PEEK recv
   used for readiness notification. When the peer closes a kTLS connection,
   recv() may return ECONNRESET instead of clean EOF. The exception is caught
   and the loop continues to SSL_read which determines the actual TLS-level
   status (SSL_ERROR_ZERO_RETURN for clean closure, or a real error).
   This eliminates ~276K exceptions/15s seen in h11-get-close benchmarks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove PollForSsl, SslDoHandshakeBlocking, SslReadBlocking, and
SslWriteBlocking from pal_ssl.c. These were part of the initial kTLS
implementation but are no longer used since async I/O was implemented
in managed code using MSG_PEEK readiness notification.

Also remove the unused errno.h and poll.h includes, and fix
entrypoints.c ordering to keep kTLS-related entries sorted
alphabetically.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ring

- When kTLS TX is active, bypass SSL_write and use Socket.SendAsync
  directly — the kernel encrypts transparently on send()
- Add 32KB read-ahead buffer to amortize SSL_read (recvmsg) calls,
  reducing epoll_wait syscalls per request
- Track kTLS TX state via _ktlsTx field set after handshake
- Remove unused _ktlsRx field (socket-direct reads don't work due
  to NewSessionTicket records requiring OpenSSL's record layer)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace the custom _ktlsReadBuffer with the existing _buffer (SslBuffer)
infrastructure. SSL_read returns already-decrypted plaintext, so we
Commit + OnDecrypted(0, ret, ret) to treat it as decrypted data in
_buffer, reusing the same CopyDecryptedData consume path.

When the caller's buffer is >= ReadBufferSize, read directly into it
to avoid a copy (zero-copy fast path for large reads).

This eliminates 4 fields (_ktlsReadBuffer, offset, count, buffer size
constant) and significantly improves large-response scenarios:
- H1.1 64KB: -9.2% -> +1.6% (neutral)
- H2 64KB: -34.2% -> -26.0%

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The direct socket read bypass for kTLS RX doesn't work with TLS 1.3
because OpenSSL must process post-handshake messages (NewSessionTicket)
that arrive as non-application-data records on the socket. Bypassing
SSL_read causes these records to be mixed into the data stream.

Instead, keep SSL_read for all kTLS paths (TX and RX). The kernel
decryption benefit of kTLS RX still applies transparently when OpenSSL
calls recv/recvmsg on the kTLS socket.

Added a buffer-fill loop after successful SSL_read: since each SSL_read
returns at most one TLS record (~16KB), we immediately retry to fill
more of the read-ahead buffer or user buffer without re-waiting. This
amortizes the MSG_PEEK wait cost for large responses.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

For kTLS and DirectOpenSSL modes, SSL_shutdown attempted I/O directly
on the non-blocking socket via socket BIO, causing EAGAIN to surface
as SSL_ERROR_SYSCALL and be treated as a fatal error.

Fix: keep quiet shutdown enabled for socket BIO handles so SSL_shutdown
sets internal flags without attempting I/O. Skip GenerateToken in
CreateShutdownToken since there is no output memory BIO to read from.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>