add membarrier syscall wrapper, refactor dynamic tls install to use it