Two special return values.

tls_read and tls_write (along with handhake and close) can return special values to indicate that the operation needs to be retried. 

TLS_POLLIN = the descriptor needs to be readable to continue 

TLS_POLLOUT= the descriptor needs to be writable to continue 

When you get one of these, you repeat the operation - immediately in the blocking case, or once you have checked the descriptor for read/writability in the non-blocking case. 

You can get either value, on any operation.