Objects.qll has support for identifying objects with different storage durations (static, thread local, allocated, and automatic). However, its thread local object support is limited to _Thread_local variables.

Ideally, a tss_t variable would be recognizable as two objects:

• One object representing the variable holding the tss_t key. Usually this is an object with static lifetime.
• Another object identity for the thread local behind the tss_t.

Unfortunately, tss_t currently extends Element, which means that it can't have two implementations of the ObjectIdentity class. Alternatively, calls to tss_get() could be considered ObjectIdentitys, however, that doesn't match the intention of the ObjectIdentity class/library, as the threadlocal is really identified by the tss_t.

The threadlocal object could be identified by the tss_create call (similarly to how we identify dynamic memory via malloc calls). But it probably makes more sense to have ObjectIdentity extend Locatable and then have a tss_t variable produce two ObjectIdentys.

Otherwise the tss_t object class will closely match the malloc object class, since malloc returns a pointer to the dynamic memory just like tss_get() returns a pointer to the thread local. Additional refactoring to share code here will be required.