title: How can a shared object contain static thread local storage?
body: <p><strong>Background</strong></p>
  <p>I've encountered a problem that violates my conceptual model of position independent code and thread local storage. The problem that prompted this can be found <a href="https://stackoverflow.com/questions/14892101/cannot-load-any-more-object-with-static-tls">in this StackOverflow post</a>; I have a binary, which in turn <code>dlopen</code>'s a shared object. Opening the shared object triggers an error stating <code>dlopen: cannot load any more object with static TLS</code>.</p>
  <p>My understanding of this is that the <code>initial-exec</code> model is what is referred to as &quot;static TLS&quot; and that this is the often default when not creating position independent code. When one creates position independent code, the default is usually something else such as the <code>global-dynamic</code> model that GCC uses. I believed that the reason for this was because <code>initial-exec</code> cannot work in a shared object. An answer to <a href="https://stackoverflow.com/questions/14892101/cannot-load-any-more-object-with-static-tls">Another StackOverflow post</a> supported this belief, stating:</p>
  <blockquote>
  <p>Linking non-fPIC code into a shared library is impossible on x86_64, but is allowed on ix86 (and leads to many subtle problems, like this one).</p>
  </blockquote>
  <p>Given I am on an x86_64 machine, this has lead to some confusion. I then came across <a href="https://stackoverflow.com/questions/22983986/is-there-a-way-to-determine-thread-local-storage-model-used-by-a-library-on-linu">another StackOverflow question</a>, where the answer appears to create a shared object using the static TLS model.</p>
  <p>Upon seeing this, I decided to return to my problematic binary and recursively scan dependencies for the use of the static TLS model by looking at the output of <code>readelf -d</code> as per the answer to <a href="https://stackoverflow.com/questions/22983986/is-there-a-way-to-determine-thread-local-storage-model-used-by-a-library-on-linu">this question</a>. To my surprise, I find a few libraries. To my dismay, they are not libraries built by the application.</p>
  <p>Here is the output of <code>readelf -d</code> for one of them:</p>
  <pre><code>/lib64/libpthread.so.0
  
  Dynamic section at offset 0x17d90 contains 29 entries:
    Tag        Type                         Name/Value
   0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
   0x0000000000000001 (NEEDED)             Shared library: [ld-linux-x86-64.so.2]
   0x000000000000000e (SONAME)             Library soname: [libpthread.so.0]
   0x000000000000000c (INIT)               0x38c46052d0
   0x000000000000000d (FINI)               0x38c4611120
   0x0000000000000004 (HASH)               0x38c4615e90
   0x000000006ffffef5 (GNU_HASH)           0x38c4600280
   0x0000000000000005 (STRTAB)             0x38c4602dd8
   0x0000000000000006 (SYMTAB)             0x38c4600f00
   0x000000000000000a (STRSZ)              4918 (bytes)
   0x000000000000000b (SYMENT)             24 (bytes)
   0x0000000000000003 (PLTGOT)             0x38c4817fe8
   0x0000000000000002 (PLTRELSZ)           1680 (bytes)
   0x0000000000000014 (PLTREL)             RELA
   0x0000000000000017 (JMPREL)             0x38c4604c38
   0x0000000000000007 (RELA)               0x38c4604578
   0x0000000000000008 (RELASZ)             1728 (bytes)
   0x0000000000000009 (RELAENT)            24 (bytes)
   0x000000006ffffffc (VERDEF)             0x38c46043a0
   0x000000006ffffffd (VERDEFNUM)          10
   0x000000000000001e (FLAGS)              STATIC_TLS
   0x000000006ffffffb (FLAGS_1)            Flags: NODELETE INITFIRST
   0x000000006ffffffe (VERNEED)            0x38c46044f8
   0x000000006fffffff (VERNEEDNUM)         2
   0x000000006ffffff0 (VERSYM)             0x38c460410e
   0x000000006ffffff9 (RELACOUNT)          60
   0x000000006ffffdf8 (CHECKSUM)           0x86f709c8
   0x000000006ffffdf5 (GNU_PRELINKED)      2018-05-23T11:25:00
   0x0000000000000000 (NULL)               0x0
  </code></pre>
  <p>Here we can see <code>STATIC_TLS</code>, which leads me to believe the <code>initial-exec</code> model has been used.</p>
  <p>The output of <code>readelf -l</code>:</p>
  <pre><code>Elf file type is DYN (Shared object file)
  Entry point 0x38c4605de0
  There are 9 program headers, starting at offset 64
  
  Program Headers:
    Type           Offset             VirtAddr           PhysAddr
                   FileSiz            MemSiz              Flags  Align
    PHDR           0x0000000000000040 0x00000038c4600040 0x00000038c4600040
                   0x00000000000001f8 0x00000000000001f8  R E    8
    INTERP         0x0000000000011830 0x00000038c4611830 0x00000038c4611830
                   0x000000000000001c 0x000000000000001c  R      10
        [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
    LOAD           0x0000000000000000 0x00000038c4600000 0x00000038c4600000
                   0x0000000000016df0 0x0000000000016df0  R E    200000
    LOAD           0x0000000000017b90 0x00000038c4817b90 0x00000038c4817b90
                   0x00000000000006e0 0x0000000000004860  RW     200000
    DYNAMIC        0x0000000000017d90 0x00000038c4817d90 0x00000038c4817d90
                   0x00000000000001f0 0x00000000000001f0  RW     8
    NOTE           0x0000000000000238 0x00000038c4600238 0x00000038c4600238
                   0x0000000000000044 0x0000000000000044  R      4
    GNU_EH_FRAME   0x000000000001184c 0x00000038c461184c 0x00000038c461184c
                   0x0000000000000a5c 0x0000000000000a5c  R      4
    GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                   0x0000000000000000 0x0000000000000000  RW     8
    GNU_RELRO      0x0000000000017b90 0x00000038c4817b90 0x00000038c4817b90
                   0x0000000000000470 0x0000000000000470  R      1
  
   Section to Segment mapping:
    Segment Sections...
     00     
     01     .interp 
     02     .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_d .gnu.version_r .rela.dyn .rela.plt .init .plt .text __libc_freeres_fn .fini .rodata .interp .eh_frame_hdr .eh_frame .gcc_except_table .hash 
     03     .ctors .dtors .jcr .data.rel.ro .dynamic .got .got.plt .data .bss 
     04     .dynamic 
     05     .note.gnu.build-id .note.ABI-tag 
     06     .eh_frame_hdr 
     07     
     08     .ctors .dtors .jcr .data.rel.ro .dynamic .got 
  </code></pre>
  <p>I was surprised by the lack of a TLS section here, but even so we have clear indications that a shared object is using the static <code>initial-exec</code> TLS model.</p>
  <p>Finally, I've seen people with similar problems reordering dependencies to get rid of the earlier <code>dlopen</code> error. I'm not why that makes a difference.</p>
  <p><strong>Question(s)</strong></p>
  <ul>
  <li>How does a <code>initial-exec</code> function inside relocatable code, especially shared objects on x86_64?</li>
  <li>Why does reordering dependencies sometimes resolve the <code>dlopen</code> issue; surely the number of slots used remains the same?</li>
  </ul>
  <p>Any other suggestions for the original <code>dlopen</code> issue are also welcomed.</p>
  <p><strong>Update 1</strong></p>
  <p>Whilst digging around the problem some more, <a href="http://www.sco.com/developers/gabi/2003-12-17/ch5.dynamic.html" rel="nofollow noreferrer">I came across another source</a> stating static TLS models cannot be use in shared libraries:</p>
  <pre><code>DF_STATIC_TLS
      If set in a shared object or executable, this flag instructs the dynamic linker to reject attempts to load this file dynamically. It indicates that the shared object or executable contains code using a static thread-local storage scheme. Implementations need not support any form of thread-local storage.
  </code></pre>