Loading...
src/dyld.cpp dyld-239.4 dyld-421.1
--- dyld/dyld-239.4/src/dyld.cpp
+++ dyld/dyld-421.1/src/dyld.cpp
@@ -1,6 +1,6 @@
 /* -*- mode: C++; c-basic-offset: 4; tab-width: 4 -*-
  *
- * Copyright (c) 2004-2010 Apple Inc. All rights reserved.
+ * Copyright (c) 2004-2013 Apple Inc. All rights reserved.
  *
  * @APPLE_LICENSE_HEADER_START@
  * 
@@ -28,6 +28,8 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <dirent.h>
+#include <pthread.h>
+#include <libproc.h>
 #include <sys/param.h>
 #include <mach/mach_time.h> // mach_absolute_time()
 #include <mach/mach_init.h> 
@@ -50,8 +52,16 @@
 #include <libkern/OSAtomic.h>
 #include <Availability.h>
 #include <System/sys/codesign.h>
+#include <System/sys/csr.h>
 #include <_simple.h>
-
+#include <os/lock_private.h>
+#include <System/machine/cpu_capabilities.h>
+#include <System/sys/reason.h>
+#include <kern/kcdata.h>
+#include <sandbox.h>
+#include <sandbox/private.h>
+
+#include <array>
 
 #ifndef CPU_SUBTYPE_ARM_V5TEJ
 	#define CPU_SUBTYPE_ARM_V5TEJ		((cpu_subtype_t) 7)
@@ -74,6 +84,10 @@
 #ifndef LC_DYLD_ENVIRONMENT
 	#define LC_DYLD_ENVIRONMENT			0x27
 #endif
+
+#ifndef CPU_SUBTYPE_X86_64_H
+	#define CPU_SUBTYPE_X86_64_H		((cpu_subtype_t) 8) 
+#endif	
 
 #ifndef VM_PROT_SLIDE   
     #define VM_PROT_SLIDE 0x20
@@ -88,20 +102,49 @@
 #include "ImageLoader.h"
 #include "ImageLoaderMachO.h"
 #include "dyldLibSystemInterface.h"
-#include "dyldSyscallInterface.h"
 #if DYLD_SHARED_CACHE_SUPPORT
 #include "dyld_cache_format.h"
 #endif
-#if CORESYMBOLICATION_SUPPORT
-#include "coreSymbolicationDyldSupport.hpp"
-#endif
+#include "dyld_process_info_internal.h"
+#include <coreSymbolicationDyldSupport.h>
+#if TARGET_IPHONE_SIMULATOR
+	extern "C" void xcoresymbolication_load_notifier(void *connection, uint64_t load_timestamp, const char *image_path, const struct mach_header *mach_header);
+	extern "C" void xcoresymbolication_unload_notifier(void *connection, uint64_t unload_timestamp, const char *image_path, const struct mach_header *mach_header);
+	#define coresymbolication_load_notifier(c, t, p, h) xcoresymbolication_load_notifier(c, t, p, h)
+	#define coresymbolication_unload_notifier(c, t, p, h) xcoresymbolication_unload_notifier(c, t, p, h)
+#endif
+
+#if SUPPORT_ACCELERATE_TABLES
+	#include "ImageLoaderMegaDylib.h"
+#endif
+
+#if TARGET_IPHONE_SIMULATOR
+	extern "C" void* gSyscallHelpers;
+#else
+	#include "dyldSyscallInterface.h"
+#endif
+
 
 // not libc header for send() syscall interface
 extern "C" ssize_t __sendto(int, const void *, size_t, int, const struct sockaddr *, socklen_t);
 
 
-// ARM is the only architecture that use cpu-sub-types
-#define CPU_SUBTYPES_SUPPORTED  __arm__
+// ARM and x86_64 are the only architecture that use cpu-sub-types
+#define CPU_SUBTYPES_SUPPORTED  ((__arm__ || __x86_64__) && !TARGET_IPHONE_SIMULATOR)
+
+#if __LP64__
+	#define LC_SEGMENT_COMMAND		LC_SEGMENT_64
+	#define LC_SEGMENT_COMMAND_WRONG LC_SEGMENT
+	#define LC_ENCRYPT_COMMAND		LC_ENCRYPTION_INFO
+	#define macho_segment_command	segment_command_64
+	#define macho_section			section_64
+#else
+	#define LC_SEGMENT_COMMAND		LC_SEGMENT
+	#define LC_SEGMENT_COMMAND_WRONG LC_SEGMENT_64
+	#define LC_ENCRYPT_COMMAND		LC_ENCRYPTION_INFO_64
+	#define macho_segment_command	segment_command
+	#define macho_section			section
+#endif
 
 
 
@@ -109,21 +152,20 @@
 
 
 /* implemented in dyld_gdb.cpp */
+extern void resetAllImages();
 extern void addImagesToAllImages(uint32_t infoCount, const dyld_image_info info[]);
 extern void removeImageFromAllImages(const mach_header* mh);
-extern void setAlImageInfosHalt(const char* message, uintptr_t flags);
 extern void addNonSharedCacheImageUUID(const dyld_uuid_info& info);
 extern const char* notifyGDB(enum dyld_image_states state, uint32_t infoCount, const dyld_image_info info[]);
+extern size_t allImagesCount();
 
 // magic so CrashReporter logs message
 extern "C" {
 	char error_string[1024];
 }
-// implemented in dyldStartup.s for CrashReporter
-extern "C" void dyld_fatal_error(const char* errString) __attribute__((noreturn));
 
 // magic linker symbol for start of dyld binary
-extern "C" void* __dso_handle;
+extern "C" const macho_header __dso_handle;
 
 
 //
@@ -163,10 +205,10 @@
 	const char* const *			LD_LIBRARY_PATH;			// for unix conformance
 	const char* const *			DYLD_VERSIONED_LIBRARY_PATH;
 	const char* const *			DYLD_VERSIONED_FRAMEWORK_PATH;
-	bool						DYLD_PRINT_LIBRARIES;
 	bool						DYLD_PRINT_LIBRARIES_POST_LAUNCH;
 	bool						DYLD_BIND_AT_LAUNCH;
 	bool						DYLD_PRINT_STATISTICS;
+	bool						DYLD_PRINT_STATISTICS_DETAILS;
 	bool						DYLD_PRINT_OPTS;
 	bool						DYLD_PRINT_ENV;
 	bool						DYLD_DISABLE_DOFS;
@@ -192,6 +234,7 @@
 							//	DYLD_PRINT_WARNINGS				==> gLinkContext.verboseWarnings
 							//	DYLD_PRINT_RPATHS				==> gLinkContext.verboseRPaths
 							//	DYLD_PRINT_INTERPOSING			==> gLinkContext.verboseInterposing
+							//  DYLD_PRINT_LIBRARIES			==> gLinkContext.verboseLoading
 };
 
 
@@ -199,7 +242,7 @@
 typedef std::vector<dyld_image_state_change_handler> StateHandlers;
 
 
-enum RestrictedReason { restrictedNot, restrictedBySetGUid, restrictedBySegment, restrictedByEntitlements };
+enum EnvVarMode { envNone, envPrintOnly, envAll };
 	
 // all global state
 static const char*					sExecPath = NULL;
@@ -209,38 +252,48 @@
 static cpu_type_t					sHostCPU;
 static cpu_subtype_t				sHostCPUsubtype;
 #endif
-static ImageLoader*					sMainExecutable = NULL;
-static bool							sProcessIsRestricted = false;
-static RestrictedReason				sRestrictedReason = restrictedNot;
-static unsigned int					sInsertedDylibCount = 0;
+static ImageLoaderMachO*			sMainExecutable = NULL;
+static EnvVarMode					sEnvMode = envNone;
+static size_t						sInsertedDylibCount = 0;
 static std::vector<ImageLoader*>	sAllImages;
 static std::vector<ImageLoader*>	sImageRoots;
 static std::vector<ImageLoader*>	sImageFilesNeedingTermination;
 static std::vector<RegisteredDOF>	sImageFilesNeedingDOFUnregistration;
 static std::vector<ImageCallback>   sAddImageCallbacks;
 static std::vector<ImageCallback>   sRemoveImageCallbacks;
+static bool							sRemoveImageCallbacksInUse = false;
 static void*						sSingleHandlers[7][3];
 static void*						sBatchHandlers[7][3];
 static ImageLoader*					sLastImageByAddressCache;
 static EnvironmentVariables			sEnv;
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 static const char*					sFrameworkFallbackPaths[] = { "$HOME/Library/Frameworks", "/Library/Frameworks", "/Network/Library/Frameworks", "/System/Library/Frameworks", NULL };
 static const char*					sLibraryFallbackPaths[] = { "$HOME/lib", "/usr/local/lib", "/usr/lib", NULL };
+#else
+static const char*					sFrameworkFallbackPaths[] = { "/System/Library/Frameworks", NULL };
+static const char*					sLibraryFallbackPaths[] = { "/usr/local/lib", "/usr/lib", NULL };
+#endif
+static const char*					sRestrictedFrameworkFallbackPaths[] = { "/System/Library/Frameworks", NULL };
+static const char*					sRestrictedLibraryFallbackPaths[] = { "/usr/lib", NULL };
 static UndefinedHandler				sUndefinedHandler = NULL;
 static ImageLoader*					sBundleBeingLoaded = NULL;	// hack until OFI is reworked
 #if DYLD_SHARED_CACHE_SUPPORT
 static const dyld_cache_header*		sSharedCache = NULL;
 static long							sSharedCacheSlide = 0;
 static bool							sSharedCacheIgnoreInodeAndTimeStamp = false;
-#if __IPHONE_OS_VERSION_MIN_REQUIRED && DYLD_SHARED_CACHE_SUPPORT
-	bool							gSharedCacheOverridden = false;
+	   bool							gSharedCacheOverridden = false;
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
 	static const char*				sSharedCacheDir = IPHONE_DYLD_SHARED_CACHE_DIR;
-	static bool						sDylibsOverrideCache = false;
+	#define ENABLE_DYLIBS_TO_OVERRIDE_CACHE_SIZE 1024
 #else
 	static const char*				sSharedCacheDir = MACOSX_DYLD_SHARED_CACHE_DIR;
 #endif
 #endif
 ImageLoader::LinkContext			gLinkContext;
 bool								gLogAPIs = false;
+#if SUPPORT_ACCELERATE_TABLES
+bool								gLogAppAPIs = false;
+#endif
 const struct LibSystemHelpers*		gLibSystemHelpers = NULL;
 #if SUPPORT_OLD_CRT_INITIALIZATION
 bool								gRunInitializersOldWay = false;
@@ -250,9 +303,30 @@
 static int							sLogSocket = -1;
 #endif
 static bool							sFrameworksFoundAsDylibs = false;
- 
+#if __x86_64__ && DYLD_SHARED_CACHE_SUPPORT
+static bool							sHaswell = false;
+#endif
 static std::vector<ImageLoader::DynamicReference> sDynamicReferences;
-	
+static OSSpinLock					sDynamicReferencesLock = 0;
+#if !TARGET_IPHONE_SIMULATOR
+static bool							sLogToFile = false;
+#endif
+static char							sLoadingCrashMessage[1024] = "dyld: launch, loading dependent libraries";
+
+static _dyld_objc_notify_mapped		sNotifyObjCMapped;
+static _dyld_objc_notify_init		sNotifyObjCInit;
+static _dyld_objc_notify_unmapped	sNotifyObjCUnmapped;
+
+#if __IPHONE_OS_VERSION_MIN_REQUIRED && !TARGET_IPHONE_SIMULATOR
+static bool							sForceStderr = false;
+#endif
+
+
+
+#if SUPPORT_ACCELERATE_TABLES
+static ImageLoaderMegaDylib*		sAllCacheImagesProxy = NULL;
+static bool							sDisableAcceleratorTables = false;
+#endif
 
 //
 // The MappedRanges structure is used for fast address->image lookups.
@@ -265,22 +339,22 @@
 //
 struct MappedRanges
 {
-	enum { count=400 };
+	MappedRanges*		next;
+	unsigned long		count;
 	struct {
 		ImageLoader*	image;
 		uintptr_t		start;
 		uintptr_t		end;
-	} array[count];
-	MappedRanges*		next;
+	} array[1];
 };
 
-static MappedRanges			sMappedRangesStart;
+static MappedRanges*	sMappedRangesStart;
 
 void addMappedRange(ImageLoader* image, uintptr_t start, uintptr_t end)
 {
 	//dyld::log("addMappedRange(0x%lX->0x%lX) for %s\n", start, end, image->getShortName());
-	for (MappedRanges* p = &sMappedRangesStart; p != NULL; p = p->next) {
-		for (int i=0; i < MappedRanges::count; ++i) {
+	for (MappedRanges* p = sMappedRangesStart; p != NULL; p = p->next) {
+		for (unsigned long i=0; i < p->count; ++i) {
 			if ( p->array[i].image == NULL ) {
 				p->array[i].start = start;
 				p->array[i].end = end;
@@ -292,24 +366,37 @@
 		}
 	}
 	// table must be full, chain another
-	MappedRanges* newRanges = (MappedRanges*)malloc(sizeof(MappedRanges));
-	bzero(newRanges, sizeof(MappedRanges));
+#if SUPPORT_ACCELERATE_TABLES
+	unsigned count = (sAllCacheImagesProxy != NULL) ? 16 : 400;
+#else
+	unsigned count = 400;
+#endif
+	size_t allocationSize = sizeof(MappedRanges) + (count-1)*3*sizeof(void*);
+	MappedRanges* newRanges = (MappedRanges*)malloc(allocationSize);
+	bzero(newRanges, allocationSize);
+	newRanges->count = count;
 	newRanges->array[0].start = start;
 	newRanges->array[0].end = end;
 	newRanges->array[0].image = image;
-	for (MappedRanges* p = &sMappedRangesStart; p != NULL; p = p->next) {
-		if ( p->next == NULL ) {
-			OSMemoryBarrier();
-			p->next = newRanges;
-			break;
+	OSMemoryBarrier();
+	if ( sMappedRangesStart == NULL ) {
+		sMappedRangesStart = newRanges;
+	}
+	else {
+		for (MappedRanges* p = sMappedRangesStart; p != NULL; p = p->next) {
+			if ( p->next == NULL ) {
+				OSMemoryBarrier();
+				p->next = newRanges;
+				break;
+			}
 		}
 	}
 }
 
 void removedMappedRanges(ImageLoader* image)
 {
-	for (MappedRanges* p = &sMappedRangesStart; p != NULL; p = p->next) {
-		for (int i=0; i < MappedRanges::count; ++i) {
+	for (MappedRanges* p = sMappedRangesStart; p != NULL; p = p->next) {
+		for (unsigned long i=0; i < p->count; ++i) {
 			if ( p->array[i].image == image ) {
 				// clear with a barrier so that any reader will see consistent records
 				OSMemoryBarrier();
@@ -321,8 +408,8 @@
 
 ImageLoader* findMappedRange(uintptr_t target)
 {
-	for (MappedRanges* p = &sMappedRangesStart; p != NULL; p = p->next) {
-		for (int i=0; i < MappedRanges::count; ++i) {
+	for (MappedRanges* p = sMappedRangesStart; p != NULL; p = p->next) {
+		for (unsigned long i=0; i < p->count; ++i) {
 			if ( p->array[i].image != NULL ) {
 				if ( (p->array[i].start <= target) && (target < p->array[i].end) )
 					return p->array[i].image;
@@ -368,37 +455,8 @@
 }
 
 
-//#define ALTERNATIVE_LOGFILE "/dev/console"
 #if !TARGET_IPHONE_SIMULATOR
 static int sLogfile = STDERR_FILENO;
-#endif
-
-#if LOG_BINDINGS
-static int sBindingsLogfile = -1;
-static void mysprintf(char* dst, const char* format, ...)
-{
-	_SIMPLE_STRING buf = _simple_salloc();
-	if ( buf != NULL ) {
-		va_list	list;
-		va_start(list, format);
-		_simple_vsprintf(buf, format, list);
-		va_end(list);
-		strcpy(dst, _simple_string(buf));
-		_simple_sfree(buf);
-	}
-	else {
-		strcpy(dst, "out of memory");
-	}
-}
-void logBindings(const char* format, ...) 
-{
-	if ( sBindingsLogfile != -1 ) {
-		va_list	list;
-		va_start(list, format);
-		_simple_vdprintf(sBindingsLogfile, format, list);
-		va_end(list);
-	}
-}
 #endif
 
 #if !TARGET_IPHONE_SIMULATOR	
@@ -406,11 +464,17 @@
 static bool useSyslog()
 {
 	// Use syslog() for processes managed by launchd
-	if ( (gLibSystemHelpers != NULL) && (gLibSystemHelpers->version >= 11) ) {
-		if ( (*gLibSystemHelpers->isLaunchdOwned)() ) {
-			return true;
-		}
-	}
+	static bool launchdChecked = false;
+	static bool launchdOwned = false;
+	if ( !launchdChecked && gProcessInfo->libSystemInitialized ) {
+		if ( (gLibSystemHelpers != NULL) && (gLibSystemHelpers->version >= 11) ) {
+			// <rdar://problem/23520449> only call isLaunchdOwned() after libSystem is initialized
+			launchdOwned = (*gLibSystemHelpers->isLaunchdOwned)();
+			launchdChecked = true;
+		}
+	}
+	if ( launchdChecked && launchdOwned )
+		return true;
 
 	// If stderr is not available, use syslog()
 	struct stat sb;
@@ -454,12 +518,20 @@
 	_simple_sfree(buf);
 }
 
+
+
 void vlog(const char* format, va_list list)
 {
-	if ( useSyslog() ) 
+#if __IPHONE_OS_VERSION_MIN_REQUIRED && !TARGET_IPHONE_SIMULATOR
+	// <rdar://problem/25965832> log to console when running iOS app from Xcode
+	if ( !sLogToFile && !sForceStderr && useSyslog() )
+#else
+	if ( !sLogToFile && useSyslog() )
+#endif
 		socket_syslogv(LOG_ERR, format, list);
-	else
+	else {
 		_simple_vdprintf(sLogfile, format, list);
+	}
 }
 
 void log(const char* format, ...)
@@ -491,25 +563,18 @@
 
 // <rdar://problem/8867781> control access to sAllImages through a lock 
 // because global dyld lock is not held during initialization phase of dlopen()
-static long sAllImagesLock = 0;
+// <rdar://problem/16145518> Use OSSpinLockLock to allow yielding
+static OSSpinLock sAllImagesLock = 0;
 
 static void allImagesLock()
 {
-    //dyld::log("allImagesLock()\n");
-	while ( ! OSAtomicCompareAndSwapPtrBarrier((void*)0, (void*)1, (void**)&sAllImagesLock) ) {
-        // spin
-    }
+	OSSpinLockLock(&sAllImagesLock);
 }
 
 static void allImagesUnlock()
 {
-    //dyld::log("allImagesUnlock()\n");
-	while ( ! OSAtomicCompareAndSwapPtrBarrier((void*)1, (void*)0, (void**)&sAllImagesLock) ) {
-        // spin
-   }
-}
-
-
+	OSSpinLockUnlock(&sAllImagesLock);
+}
 
 
 // utility class to assure files are closed when an exception is thrown
@@ -537,7 +602,7 @@
 
 static void	registerDOFs(const std::vector<ImageLoader::DOFInfo>& dofs)
 {
-	const unsigned int dofSectionCount = dofs.size();
+	const size_t dofSectionCount = dofs.size();
 	if ( !sEnv.DYLD_DISABLE_DOFS && (dofSectionCount != 0) ) {
 		int fd = open("/dev/" DTRACEMNR_HELPER, O_RDWR);
 		if ( fd < 0 ) {
@@ -573,7 +638,7 @@
 				}
 			}
 			else {
-				dyld::log( "dyld: ioctl to register dtrace DOF section failed\n");
+				//dyld::log( "dyld: ioctl to register dtrace DOF section failed\n");
 			}
 			close(fd);
 		}
@@ -647,7 +712,165 @@
 	return NULL;
 }
 
-static void notifySingle(dyld_image_states state, const ImageLoader* image)
+#if SUPPORT_ACCELERATE_TABLES
+static dyld_image_state_change_handler getPreInitNotifyHandler(unsigned index)
+{
+	std::vector<dyld_image_state_change_handler>* handlers = stateToHandlers(dyld_image_state_dependents_initialized, sSingleHandlers);
+	if ( index >= handlers->size() )
+		return NULL;
+	return (*handlers)[index];
+}
+
+static dyld_image_state_change_handler getBoundBatchHandler(unsigned index)
+{
+	std::vector<dyld_image_state_change_handler>* handlers = stateToHandlers(dyld_image_state_bound, sBatchHandlers);
+	if ( index >= handlers->size() )
+		return NULL;
+	return (*handlers)[index];
+}
+
+static void notifySingleFromCache(dyld_image_states state, const mach_header* mh, const char* path)
+{
+	//dyld::log("notifySingle(state=%d, image=%s)\n", state, image->getPath());
+	std::vector<dyld_image_state_change_handler>* handlers = stateToHandlers(state, sSingleHandlers);
+	if ( handlers != NULL ) {
+		dyld_image_info info;
+		info.imageLoadAddress	= mh;
+		info.imageFilePath		= path;
+		info.imageFileModDate	= 0;
+		for (dyld_image_state_change_handler handler : *handlers) {
+			const char* result = (*handler)(state, 1, &info);
+			if ( (result != NULL) && (state == dyld_image_state_mapped) ) {
+				//fprintf(stderr, "  image rejected by handler=%p\n", *it);
+				// make copy of thrown string so that later catch clauses can free it
+				const char* str = strdup(result);
+				throw str;
+			}
+		}
+	}
+	if ( (state == dyld_image_state_dependents_initialized) && (sNotifyObjCInit != NULL) && (mh->flags & MH_HAS_OBJC) ) {
+		(*sNotifyObjCInit)(path, mh);
+	}
+}
+#endif
+
+static mach_port_t sNotifyReplyPorts[DYLD_MAX_PROCESS_INFO_NOTIFY_COUNT];
+
+
+static void notifyMonitoringDyld(bool unloading, unsigned portSlot, unsigned imageCount, const dyld_image_info infos[])
+{
+	unsigned entriesSize = imageCount*sizeof(dyld_process_info_image_entry);
+	unsigned pathsSize = 0;
+	for (unsigned j=0; j < imageCount; ++j) {
+		pathsSize += (strlen(infos[j].imageFilePath) + 1);
+	}
+	unsigned totalSize = (sizeof(dyld_process_info_notify_header) + entriesSize + pathsSize + 127) & -128;   // align
+	if ( totalSize > DYLD_PROCESS_INFO_NOTIFY_MAX_BUFFER_SIZE ) {
+		// Putting all image paths into one message would make buffer too big.
+		// Instead split into two messages.  Recurse as needed until paths fit in buffer.
+		unsigned imageHalfCount = imageCount/2;
+		notifyMonitoringDyld(unloading, portSlot, imageHalfCount, infos);
+		notifyMonitoringDyld(unloading, portSlot, imageCount - imageHalfCount, &infos[imageHalfCount]);
+		return;
+	}
+	uint8_t	buffer[totalSize];
+	dyld_process_info_notify_header* header = (dyld_process_info_notify_header*)buffer;
+	header->version			= 1;
+	header->imageCount		= imageCount;
+	header->imagesOffset	= sizeof(dyld_process_info_notify_header);
+	header->stringsOffset	= sizeof(dyld_process_info_notify_header) + entriesSize;
+	header->timestamp		= mach_absolute_time();
+	dyld_process_info_image_entry* entries = (dyld_process_info_image_entry*)&buffer[header->imagesOffset];
+	char* const pathPoolStart = (char*)&buffer[header->stringsOffset];
+	char* pathPool = pathPoolStart;
+	for (unsigned j=0; j < imageCount; ++j) {
+		strcpy(pathPool, infos[j].imageFilePath);
+		uint32_t len = (uint32_t)strlen(pathPool);
+		bzero(entries->uuid, 16);
+		const ImageLoader* image = findImageByMachHeader(infos[j].imageLoadAddress);
+		if ( image != NULL ) {
+			image->getUUID(entries->uuid);
+		}
+#if SUPPORT_ACCELERATE_TABLES
+		else if ( sAllCacheImagesProxy != NULL ) {
+			const mach_header* mh;
+			const char* path;
+			unsigned index;
+			if ( sAllCacheImagesProxy->addressInCache(infos[j].imageLoadAddress, &mh, &path, &index) ) {
+				sAllCacheImagesProxy->getDylibUUID(index, entries->uuid);
+			}
+		}
+#endif
+		entries->loadAddress = (uint64_t)infos[j].imageLoadAddress;
+		entries->pathStringOffset = (uint32_t)(pathPool - pathPoolStart);
+		entries->pathLength  = len;
+		pathPool += (len +1);
+		++entries;
+	}
+
+	if ( sNotifyReplyPorts[portSlot] == 0 ) {
+		if ( !mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &sNotifyReplyPorts[portSlot]) )
+			mach_port_insert_right(mach_task_self(), sNotifyReplyPorts[portSlot], sNotifyReplyPorts[portSlot], MACH_MSG_TYPE_MAKE_SEND);
+		//dyld::log("allocated reply port %d\n", sNotifyReplyPorts[portSlot]);
+	}
+	//dyld::log("found port to send to\n");
+	mach_msg_header_t* h = (mach_msg_header_t*)buffer;
+	h->msgh_bits		= MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND,MACH_MSG_TYPE_MAKE_SEND); // MACH_MSG_TYPE_MAKE_SEND_ONCE
+	h->msgh_id			= unloading ? DYLD_PROCESS_INFO_NOTIFY_UNLOAD_ID : DYLD_PROCESS_INFO_NOTIFY_LOAD_ID;
+	h->msgh_local_port	= sNotifyReplyPorts[portSlot];
+	h->msgh_remote_port = dyld::gProcessInfo->notifyPorts[portSlot];
+	h->msgh_reserved	= 0;
+	h->msgh_size		= (mach_msg_size_t)sizeof(buffer);
+	//dyld::log("sending to port[%d]=%d, size=%d, reply port=%d, id=0x%X\n", portSlot, dyld::gProcessInfo->notifyPorts[portSlot], h->msgh_size, sNotifyReplyPorts[portSlot], h->msgh_id);
+	kern_return_t sendResult = mach_msg(h, MACH_SEND_MSG | MACH_RCV_MSG | MACH_SEND_TIMEOUT, h->msgh_size, h->msgh_size, sNotifyReplyPorts[portSlot], 100, MACH_PORT_NULL);
+	//dyld::log("send result = 0x%X, msg_id=%d, msg_size=%d\n", sendResult, h->msgh_id, h->msgh_size);
+	if ( sendResult == MACH_SEND_INVALID_DEST ) {
+		// sender is not responding, detatch
+		//dyld::log("process requesting notification gone. deallocation send port %d and receive port %d\n", dyld::gProcessInfo->notifyPorts[portSlot], sNotifyReplyPorts[portSlot]);
+		mach_port_deallocate(mach_task_self(), dyld::gProcessInfo->notifyPorts[portSlot]);
+		mach_port_deallocate(mach_task_self(), sNotifyReplyPorts[portSlot]);
+		dyld::gProcessInfo->notifyPorts[portSlot] = 0;
+		sNotifyReplyPorts[portSlot] = 0;
+	}
+}
+
+#define MAX_KERNEL_IMAGES_PER_CALL (100)
+
+static void flushKernelNotifications(bool loading, bool force, std::array<dyld_kernel_image_info_t,MAX_KERNEL_IMAGES_PER_CALL>& kernelInfos, uint32_t &kernelInfoCount) {
+	if ((force && kernelInfoCount != 0) || kernelInfoCount == MAX_KERNEL_IMAGES_PER_CALL) {
+		if (loading) {
+			task_register_dyld_image_infos(mach_task_self(), kernelInfos.data(), kernelInfoCount);
+		} else {
+			task_unregister_dyld_image_infos(mach_task_self(), kernelInfos.data(), kernelInfoCount);
+		}
+		kernelInfoCount = 0;
+	}
+}
+
+static
+void queueKernelNotification(const ImageLoader& image, bool loading, std::array<dyld_kernel_image_info_t,MAX_KERNEL_IMAGES_PER_CALL>& kernelInfos, uint32_t &kernelInfoCount) {
+	if ( !image.inSharedCache() ) {
+		ino_t inode = image.getInode();
+		image.getUUID(kernelInfos[kernelInfoCount].uuid);
+		memcpy(&kernelInfos[kernelInfoCount].fsobjid, &inode, 8);
+		kernelInfos[kernelInfoCount].load_addr = (uint64_t)image.machHeader();
+		// FIXME we should also be grabbing the device ID, but that is not necessary yet,
+		// and requires threading it through the ImageLoader
+		kernelInfos[kernelInfoCount].fsid.val[0] = 0;
+		kernelInfos[kernelInfoCount].fsid.val[1] = 0;
+		kernelInfoCount++;
+	}
+	flushKernelNotifications(loading, false, kernelInfos, kernelInfoCount);
+}
+
+void notifyKernel(const ImageLoader& image, bool loading) {
+	std::array<dyld_kernel_image_info_t,MAX_KERNEL_IMAGES_PER_CALL> kernelInfos;
+	uint32_t kernelInfoCount = 0;
+	queueKernelNotification(image, loading, kernelInfos, kernelInfoCount);
+	flushKernelNotifications(loading, true, kernelInfos, kernelInfoCount);
+}
+
+static void notifySingle(dyld_image_states state, const ImageLoader* image, ImageLoader::InitializerTimingList* timingInfo)
 {
 	//dyld::log("notifySingle(state=%d, image=%s)\n", state, image->getPath());
 	std::vector<dyld_image_state_change_handler>* handlers = stateToHandlers(state, sSingleHandlers);
@@ -676,23 +899,47 @@
 			}
 		}
 	}
-#if CORESYMBOLICATION_SUPPORT
-    // mach message csdlc about dynamically loaded images 
+	if ( (state == dyld_image_state_dependents_initialized) && (sNotifyObjCInit != NULL) && image->notifyObjC() ) {
+		uint64_t t0 = mach_absolute_time();
+		(*sNotifyObjCInit)(image->getRealPath(), image->machHeader());
+		uint64_t t1 = mach_absolute_time();
+		uint64_t t2 = mach_absolute_time();
+		uint64_t timeInObjC = t1-t0;
+		uint64_t emptyTime = (t2-t1)*100;
+		if ( (timeInObjC > emptyTime) && (timingInfo != NULL) ) {
+			timingInfo->addTime(image->getShortName(), timeInObjC);
+		}
+	}
+    // mach message csdlc about dynamically unloaded images
 	if ( image->addFuncNotified() && (state == dyld_image_state_terminated) ) {
+		notifyKernel(*image, false);
+
+		uint64_t loadTimestamp = mach_absolute_time();
 		if ( sEnv.DYLD_PRINT_CS_NOTIFICATIONS ) {
-			dyld::log("dyld core symbolication unload notification: %p %s\n", image->machHeader(), image->getPath());
+			dyld::log("dyld: coresymbolication_unload_notifier(%p, 0x%016llX, %p, %s)\n",
+					  dyld::gProcessInfo->coreSymbolicationShmPage, loadTimestamp, image->machHeader(), image->getPath());
 		}
 		if ( dyld::gProcessInfo->coreSymbolicationShmPage != NULL) {
-			CSCppDyldSharedMemoryPage* connection = (CSCppDyldSharedMemoryPage*)dyld::gProcessInfo->coreSymbolicationShmPage;
-			if ( connection->is_valid_version() ) {
-				coresymbolication_unload_image(connection, image);
-			}
-		}
-	}
-#endif
-}
-
-
+			coresymbolication_unload_notifier(dyld::gProcessInfo->coreSymbolicationShmPage, loadTimestamp, image->getPath(), image->machHeader());
+		}
+		for (int slot=0; slot < DYLD_MAX_PROCESS_INFO_NOTIFY_COUNT; ++slot) {
+			if ( dyld::gProcessInfo->notifyPorts[slot] != 0 ) {
+				dyld_image_info info;
+				info.imageLoadAddress	= image->machHeader();
+				info.imageFilePath		= image->getPath();
+				info.imageFileModDate	= 0;
+				notifyMonitoringDyld(true, slot, 1, &info);
+			}
+			else if ( sNotifyReplyPorts[slot] != 0 ) {
+				// monitoring process detached from this process, so release reply port
+				//dyld::log("deallocated reply port %d\n", sNotifyReplyPorts[slot]);
+				mach_port_deallocate(mach_task_self(), sNotifyReplyPorts[slot]);
+				sNotifyReplyPorts[slot] = 0;
+			}
+		}
+	}
+
+}
 
 
 //
@@ -740,13 +987,17 @@
 	return left->compare(right);
 }
 
-static void notifyBatchPartial(dyld_image_states state, bool orLater, dyld_image_state_change_handler onlyHandler)
+static void notifyBatchPartial(dyld_image_states state, bool orLater, dyld_image_state_change_handler onlyHandler, bool preflightOnly, bool onlyObjCMappedNotification)
 {
 	std::vector<dyld_image_state_change_handler>* handlers = stateToHandlers(state, sBatchHandlers);
-	if ( handlers != NULL ) {
+	std::array<dyld_kernel_image_info_t,MAX_KERNEL_IMAGES_PER_CALL> kernelInfos;
+	uint32_t kernelInfoCount = 0;
+
+	if ( (handlers != NULL) || ((state == dyld_image_state_bound) && (sNotifyObjCMapped != NULL)) ) {
 		// don't use a vector because it will use malloc/free and we want notifcation to be low cost
         allImagesLock();
-        ImageLoader* images[sAllImages.size()+1];
+		dyld_image_info	infos[allImagesCount()+1];
+        ImageLoader* images[allImagesCount()+1];
         ImageLoader** end = images;
         for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
             dyld_image_states imageState = (*it)->getState();
@@ -759,79 +1010,131 @@
 				*end++ = sBundleBeingLoaded;
 		}
         const char* dontLoadReason = NULL;
-		unsigned int count = end-images;
-		if ( end != images ) {
+		uint32_t imageCount = (uint32_t)(end-images);
+		if ( imageCount != 0 ) {
 			// sort bottom up
-			qsort(images, count, sizeof(ImageLoader*), &imageSorter);
+			qsort(images, imageCount, sizeof(ImageLoader*), &imageSorter);
 			// build info array
-			dyld_image_info	infos[count];
-			for (unsigned int i=0; i < count; ++i) {
+			for (unsigned int i=0; i < imageCount; ++i) {
 				dyld_image_info* p = &infos[i];
 				ImageLoader* image = images[i];
 				//dyld::log("  state=%d, name=%s\n", state, image->getPath());
 				p->imageLoadAddress = image->machHeader();
-				p->imageFilePath = image->getRealPath();
+				p->imageFilePath    = image->getRealPath();
 				p->imageFileModDate = image->lastModified();
+				// get these registered with the kernel as early as possible
+				if ( state == dyld_image_state_dependents_mapped)
+					queueKernelNotification(*image, true, kernelInfos, kernelInfoCount);
 				// special case for add_image hook
 				if ( state == dyld_image_state_bound )
 					notifyAddImageCallbacks(image);
 			}
-			
-			if ( onlyHandler != NULL ) {
-				const char* result = (*onlyHandler)(state, count, infos);
-				if ( (result != NULL) && (state == dyld_image_state_dependents_mapped) ) {
-					//fprintf(stderr, "  images rejected by handler=%p\n", onlyHandler);
-					// make copy of thrown string so that later catch clauses can free it
-					dontLoadReason = strdup(result);
+			flushKernelNotifications(true, true, kernelInfos, kernelInfoCount);
+		}
+#if SUPPORT_ACCELERATE_TABLES
+		if ( sAllCacheImagesProxy != NULL ) {
+			unsigned cacheCount = sAllCacheImagesProxy->appendImagesToNotify(state, orLater, &infos[imageCount]);
+			// support _dyld_register_func_for_add_image()
+			if ( state == dyld_image_state_bound ) {
+				for (ImageCallback callback : sAddImageCallbacks) {
+					for (unsigned i=0; i < cacheCount; ++i)
+						(*callback)(infos[imageCount+i].imageLoadAddress, sSharedCacheSlide);
 				}
 			}
-			else {
-				// call each handler with whole array 
-				for (std::vector<dyld_image_state_change_handler>::iterator it = handlers->begin(); it != handlers->end(); ++it) {
-					const char* result = (*it)(state, count, infos);
+			imageCount += cacheCount;
+		}
+#endif
+		if ( imageCount != 0 ) {
+			if ( !onlyObjCMappedNotification ) {
+				if ( onlyHandler != NULL ) {
+					const char* result = NULL;
+					if ( result == NULL ) {
+						result = (*onlyHandler)(state, imageCount, infos);
+					}
 					if ( (result != NULL) && (state == dyld_image_state_dependents_mapped) ) {
-						//fprintf(stderr, "  images rejected by handler=%p\n", *it);
+						//fprintf(stderr, "  images rejected by handler=%p\n", onlyHandler);
 						// make copy of thrown string so that later catch clauses can free it
 						dontLoadReason = strdup(result);
-						break;
 					}
+				}
+				else {
+					// call each handler with whole array
+					if ( handlers != NULL ) {
+						for (std::vector<dyld_image_state_change_handler>::iterator it = handlers->begin(); it != handlers->end(); ++it) {
+							const char* result = (*it)(state, imageCount, infos);
+							if ( (result != NULL) && (state == dyld_image_state_dependents_mapped) ) {
+								//fprintf(stderr, "  images rejected by handler=%p\n", *it);
+								// make copy of thrown string so that later catch clauses can free it
+								dontLoadReason = strdup(result);
+								break;
+							}
+						}
+					}
+				}
+			}
+			// tell objc about new images
+			if ( (onlyHandler == NULL) && ((state == dyld_image_state_bound) || (orLater && (dyld_image_state_bound > state))) && (sNotifyObjCMapped != NULL) ) {
+				const char* paths[imageCount];
+				const mach_header* mhs[imageCount];
+				unsigned objcImageCount = 0;
+				for (int i=0; i < imageCount; ++i) {
+					const ImageLoader* image = findImageByMachHeader(infos[i].imageLoadAddress);
+					bool hasObjC = false;
+					if ( image != NULL ) {
+						hasObjC = image->notifyObjC();
+					}
+#if SUPPORT_ACCELERATE_TABLES
+					else if ( sAllCacheImagesProxy != NULL ) {
+						const mach_header* mh;
+						const char* path;
+						unsigned index;
+						if ( sAllCacheImagesProxy->addressInCache(infos[i].imageLoadAddress, &mh, &path, &index) ) {
+							hasObjC = (mh->flags & MH_HAS_OBJC);
+						}
+					}
+#endif
+					if ( hasObjC ) {
+						paths[objcImageCount] = infos[i].imageFilePath;
+						mhs[objcImageCount]   = infos[i].imageLoadAddress;
+						++objcImageCount;
+					}
+				}
+				if ( objcImageCount != 0 ) {
+					uint64_t t0 = mach_absolute_time();
+					(*sNotifyObjCMapped)(objcImageCount, paths, mhs);
+					uint64_t t1 = mach_absolute_time();
+					ImageLoader::fgTotalObjCSetupTime += (t1-t0);
 				}
 			}
 		}
         allImagesUnlock();
         if ( dontLoadReason != NULL )
             throw dontLoadReason;
-	}
-#if CORESYMBOLICATION_SUPPORT
-	if ( state == dyld_image_state_rebased ) {
-		if ( sEnv.DYLD_PRINT_CS_NOTIFICATIONS ) {
-			for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
-				dyld_image_states imageState = (*it)->getState();
-				if ( (imageState == dyld_image_state_rebased) || (orLater && (imageState > dyld_image_state_rebased)) )
-					dyld::log("dyld core symbolication load notification: %p %s\n", (*it)->machHeader(), (*it)->getPath());
-			}
-		}
-		if ( dyld::gProcessInfo->coreSymbolicationShmPage != NULL) {
-			CSCppDyldSharedMemoryPage* connection = (CSCppDyldSharedMemoryPage*)dyld::gProcessInfo->coreSymbolicationShmPage;
-			if ( connection->is_valid_version() ) {
-				// This needs to be captured now
-				uint64_t load_timestamp = mach_absolute_time();
-				for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
-					dyld_image_states imageState = (*it)->getState();
-					if ( (imageState == state) || (orLater && (imageState > state)) )
-						coresymbolication_load_image(connection, *it, load_timestamp);
+		if ( !preflightOnly && (state == dyld_image_state_dependents_mapped) ) {
+			if ( (dyld::gProcessInfo->coreSymbolicationShmPage != NULL) || sEnv.DYLD_PRINT_CS_NOTIFICATIONS ) {
+				// mach message csdlc about loaded images
+				uint64_t loadTimestamp = mach_absolute_time();
+				for (unsigned j=0; j < imageCount; ++j) {
+					if ( sEnv.DYLD_PRINT_CS_NOTIFICATIONS ) {
+						dyld::log("dyld: coresymbolication_load_notifier(%p, 0x%016llX, %p, %s)\n",
+								  dyld::gProcessInfo->coreSymbolicationShmPage, loadTimestamp, infos[j].imageLoadAddress, infos[j].imageFilePath);
+					}
+					coresymbolication_load_notifier(dyld::gProcessInfo->coreSymbolicationShmPage, loadTimestamp, infos[j].imageFilePath, infos[j].imageLoadAddress);
 				}
 			}
-		}
-	}
-#endif
-}
-
-
-
-static void notifyBatch(dyld_image_states state)
-{
-	notifyBatchPartial(state, false, NULL);
+			for (int slot=0; slot < DYLD_MAX_PROCESS_INFO_NOTIFY_COUNT; ++slot) {
+				if ( dyld::gProcessInfo->notifyPorts[slot] )
+					notifyMonitoringDyld(false, slot, imageCount, infos);
+			}
+		}
+	}
+}
+
+
+
+static void notifyBatch(dyld_image_states state, bool preflightOnly)
+{
+	notifyBatchPartial(state, false, NULL, preflightOnly, false);
 }
 
 // In order for register_func_for_add_image() callbacks to to be called bottom up,
@@ -861,7 +1164,10 @@
 
 static unsigned int imageCount()
 {
-	return sAllImages.size();
+    allImagesLock();
+		unsigned int result = (unsigned int)sAllImages.size();
+    allImagesUnlock();
+	return (result);
 }
 
 
@@ -884,11 +1190,36 @@
 }
 #endif
 
+static bool sandboxBlocked(const char* path, const char* kind)
+{
+#if TARGET_IPHONE_SIMULATOR
+	// sandbox calls not yet supported in simulator runtime
+	return false;
+#else
+	sandbox_filter_type filter = (sandbox_filter_type)(SANDBOX_FILTER_PATH | SANDBOX_CHECK_NO_REPORT);
+	return ( sandbox_check(getpid(), kind, filter, path) > 0 );
+#endif
+}
+
+bool sandboxBlockedMmap(const char* path)
+{
+	return sandboxBlocked(path, "file-map-executable");
+}
+
+bool sandboxBlockedOpen(const char* path)
+{
+	return sandboxBlocked(path, "file-read-data");
+}
+
+bool sandboxBlockedStat(const char* path)
+{
+	return sandboxBlocked(path, "file-read-metadata");
+}
+
+
 static void addDynamicReference(ImageLoader* from, ImageLoader* to) {
-	// don't add dynamic reference if either are in the shared cache
-	if( from->inSharedCache() )
-		return;
-	if( to->inSharedCache() )
+	// don't add dynamic reference if target is in the shared cache (since it can't be unloaded)
+	if ( to->inSharedCache() )
 		return;
 
 	// don't add dynamic reference if there already is a static one
@@ -896,17 +1227,22 @@
 		return;
 	
 	// don't add if this combination already exists
+	OSSpinLockLock(&sDynamicReferencesLock);
 	for (std::vector<ImageLoader::DynamicReference>::iterator it=sDynamicReferences.begin(); it != sDynamicReferences.end(); ++it) {
-		if ( (it->from == from) && (it->to == to) )
+		if ( (it->from == from) && (it->to == to) ) {
+			OSSpinLockUnlock(&sDynamicReferencesLock);
 			return;
-	}
+		}
+	}
+
 	//dyld::log("addDynamicReference(%s, %s\n", from->getShortName(), to->getShortName());
 	ImageLoader::DynamicReference t;
 	t.from = from;
 	t.to = to;
 	sDynamicReferences.push_back(t);
-}
-	
+	OSSpinLockUnlock(&sDynamicReferencesLock);
+}
+
 static void addImage(ImageLoader* image)
 {
 	// add to master list
@@ -938,7 +1274,7 @@
 		addMappedRange(image, lastSegStart, lastSegEnd);
 
 	
-	if ( sEnv.DYLD_PRINT_LIBRARIES || (sEnv.DYLD_PRINT_LIBRARIES_POST_LAUNCH && (sMainExecutable!=NULL) && sMainExecutable->isLinked()) ) {
+	if ( gLinkContext.verboseLoading || (sEnv.DYLD_PRINT_LIBRARIES_POST_LAUNCH && (sMainExecutable!=NULL) && sMainExecutable->isLinked()) ) {
 		dyld::log("dyld: loaded: %s\n", image->getPath());
 	}
 	
@@ -976,13 +1312,18 @@
 	// tell all registered remove image handlers about this
 	// do this before removing image from internal data structures so that the callback can query dyld about the image
 	if ( image->getState() >= dyld_image_state_bound ) {
+		sRemoveImageCallbacksInUse = true; // This only runs inside dyld's global lock, so ok to use a global for the in-use flag.
 		for (std::vector<ImageCallback>::iterator it=sRemoveImageCallbacks.begin(); it != sRemoveImageCallbacks.end(); it++) {
 			(*it)(image->machHeader(), image->getSlide());
 		}
+		sRemoveImageCallbacksInUse = false;
+
+		if ( sNotifyObjCUnmapped !=  NULL && image->notifyObjC() )
+			(*sNotifyObjCUnmapped)(image->getRealPath(), image->machHeader());
 	}
 	
 	// notify 
-	notifySingle(dyld_image_state_terminated, image);
+	notifySingle(dyld_image_state_terminated, image, NULL);
 	
 	// remove from mapped images table
 	removedMappedRanges(image);
@@ -998,7 +1339,9 @@
     allImagesUnlock();
 	
 	// remove from sDynamicReferences
-	sDynamicReferences.erase(std::remove_if(sDynamicReferences.begin(), sDynamicReferences.end(), RefUsesImage(image)), sDynamicReferences.end());
+	OSSpinLockLock(&sDynamicReferencesLock);
+		sDynamicReferences.erase(std::remove_if(sDynamicReferences.begin(), sDynamicReferences.end(), RefUsesImage(image)), sDynamicReferences.end());
+	OSSpinLockUnlock(&sDynamicReferencesLock);
 
 	// flush find-by-address cache (do this after removed from master list, so there is no chance it can come back)
 	if ( sLastImageByAddressCache == image )
@@ -1013,7 +1356,7 @@
 	}
 
 	// log if requested
-	if ( sEnv.DYLD_PRINT_LIBRARIES || (sEnv.DYLD_PRINT_LIBRARIES_POST_LAUNCH && (sMainExecutable!=NULL) && sMainExecutable->isLinked()) ) {
+	if ( gLinkContext.verboseLoading || (sEnv.DYLD_PRINT_LIBRARIES_POST_LAUNCH && (sMainExecutable!=NULL) && sMainExecutable->isLinked()) ) {
 		dyld::log("dyld: unloaded: %s\n", image->getPath());
 	}
 
@@ -1022,7 +1365,7 @@
 }
 
 
-void runImageTerminators(ImageLoader* image)
+void runImageStaticTerminators(ImageLoader* image)
 {
 	// if in termination list, pull it out and run terminator
 	bool mightBeMore;
@@ -1031,17 +1374,13 @@
 		for (std::vector<ImageLoader*>::iterator it=sImageFilesNeedingTermination.begin(); it != sImageFilesNeedingTermination.end(); it++) {
 			if ( *it == image ) {
 				sImageFilesNeedingTermination.erase(it);
+				if (gLogAPIs) dyld::log("dlclose(), running static terminators for %p %s\n", image, image->getShortName());
 				image->doTermination(gLinkContext);
 				mightBeMore = true;
 				break;
 			}
 		}
 	} while ( mightBeMore );
-
-	// <rdar://problem/7740779> dyld should directly call __cxa_finalize()
-	if ( (gLibSystemHelpers != NULL) && (gLibSystemHelpers->version >= 8) )
-		(*gLibSystemHelpers->cxa_finalize)(image->machHeader());
-	
 }
 
 static void terminationRecorder(ImageLoader* image)
@@ -1054,6 +1393,21 @@
 	return sExecPath;
 }
 
+static void runAllStaticTerminators(void* extra)
+{
+	try {
+		const size_t imageCount = sImageFilesNeedingTermination.size();
+		for(size_t i=imageCount; i > 0; --i){
+			ImageLoader* image = sImageFilesNeedingTermination[i-1];
+			image->doTermination(gLinkContext);
+		}
+		sImageFilesNeedingTermination.clear();
+		notifyBatch(dyld_image_state_terminated, false);
+	}
+	catch (const char* msg) {
+		halt(msg);
+	}
+}
 
 void initializeMainExecutable()
 {
@@ -1061,26 +1415,27 @@
 	gLinkContext.startedInitializingMainExecutable = true;
 
 	// run initialzers for any inserted dylibs
-	ImageLoader::InitializerTimingList initializerTimes[sAllImages.size()];
-	const int rootCount = sImageRoots.size();
+	ImageLoader::InitializerTimingList initializerTimes[allImagesCount()];
+	initializerTimes[0].count = 0;
+	const size_t rootCount = sImageRoots.size();
 	if ( rootCount > 1 ) {
-		for(int i=1; i < rootCount; ++i) {
-			initializerTimes[0].count = 0;
+		for(size_t i=1; i < rootCount; ++i) {
 			sImageRoots[i]->runInitializers(gLinkContext, initializerTimes[0]);
 		}
 	}
 	
 	// run initializers for main executable and everything it brings up 
-	initializerTimes[0].count = 0;
 	sMainExecutable->runInitializers(gLinkContext, initializerTimes[0]);
 	
-	// register atexit() handler to run terminators in all loaded images when this process exits
+	// register cxa_atexit() handler to run static terminators in all loaded images when this process exits
 	if ( gLibSystemHelpers != NULL ) 
-		(*gLibSystemHelpers->cxa_atexit)(&runTerminators, NULL, NULL);
+		(*gLibSystemHelpers->cxa_atexit)(&runAllStaticTerminators, NULL, NULL);
 
 	// dump info if requested
 	if ( sEnv.DYLD_PRINT_STATISTICS )
-		ImageLoaderMachO::printStatistics(sAllImages.size(), initializerTimes[0]);
+		ImageLoader::printStatistics((unsigned int)allImagesCount(), initializerTimes[0]);
+	if ( sEnv.DYLD_PRINT_STATISTICS_DETAILS )
+		ImageLoaderMachO::printStatisticsDetails((unsigned int)allImagesCount(), initializerTimes[0]);
 }
 
 bool mainExecutablePrebound()
@@ -1094,21 +1449,6 @@
 }
 
 
-void runTerminators(void* extra)
-{
-	try {
-		const unsigned int imageCount = sImageFilesNeedingTermination.size();
-		for(unsigned int i=imageCount; i > 0; --i){
-			ImageLoader* image = sImageFilesNeedingTermination[i-1];
-			image->doTermination(gLinkContext);
-		}
-		sImageFilesNeedingTermination.clear();
-		notifyBatch(dyld_image_state_terminated);
-	}
-	catch (const char* msg) {
-		halt(msg);
-	}
-}
 
 
 #if SUPPORT_VERSIONED_PATHS
@@ -1126,7 +1466,7 @@
 	//dyld::log("checkDylibOverride('%s')\n", dylibFile);
 	uint32_t altVersion;
  	char sysInstallName[PATH_MAX];
-	if ( getDylibVersionAndInstallname(dylibFile, &altVersion, sysInstallName) ) {
+	if ( getDylibVersionAndInstallname(dylibFile, &altVersion, sysInstallName) && (sysInstallName[0] =='/') ) {
 		//dyld::log("%s has version 0x%08X and install name %s\n", dylibFile, altVersion, sysInstallName);
 		uint32_t sysVersion;
 		if ( getDylibVersionAndInstallname(sysInstallName, &sysVersion, NULL) ) {
@@ -1174,8 +1514,9 @@
 {
 	//dyld::log("checkDylibOverridesInDir('%s')\n", dirPath);
 	char dylibPath[PATH_MAX];
-	int dirPathLen = strlen(dirPath);
-	strlcpy(dylibPath, dirPath, PATH_MAX); 
+	long dirPathLen = strlcpy(dylibPath, dirPath, PATH_MAX-1);
+	if ( dirPathLen >= PATH_MAX )
+		return;
 	DIR* dirp = opendir(dirPath);
 	if ( dirp != NULL) {
 		dirent entry;
@@ -1185,9 +1526,9 @@
 				break;
 			if ( entp->d_type != DT_REG ) 
 				continue;
-			dylibPath[dirPathLen] = '/';     
-			dylibPath[dirPathLen+1] = '\0';     
-			if ( strlcat(dylibPath, entp->d_name, PATH_MAX) > PATH_MAX ) 
+			dylibPath[dirPathLen] = '/';
+			dylibPath[dirPathLen+1] = '\0';
+			if ( strlcat(dylibPath, entp->d_name, PATH_MAX) >= PATH_MAX )
 				continue;
 			checkDylibOverride(dylibPath);
 		}
@@ -1200,8 +1541,9 @@
 {
 	//dyld::log("checkFrameworkOverridesInDir('%s')\n", dirPath);
 	char frameworkPath[PATH_MAX];
-	int dirPathLen = strlen(dirPath);
-	strlcpy(frameworkPath, dirPath, PATH_MAX); 
+	long dirPathLen = strlcpy(frameworkPath, dirPath, PATH_MAX-1);
+	if ( dirPathLen >= PATH_MAX )
+		return;
 	DIR* dirp = opendir(dirPath);
 	if ( dirp != NULL) {
 		dirent entry;
@@ -1211,18 +1553,18 @@
 				break;
 			if ( entp->d_type != DT_DIR ) 
 				continue;
-			frameworkPath[dirPathLen] = '/';     
+			frameworkPath[dirPathLen] = '/';
 			frameworkPath[dirPathLen+1] = '\0';
-			int dirNameLen = strlen(entp->d_name);
+			int dirNameLen = (int)strlen(entp->d_name);
 			if ( dirNameLen < 11 )
 				continue;
 			if ( strcmp(&entp->d_name[dirNameLen-10], ".framework") != 0 )
 				continue;
-			if ( strlcat(frameworkPath, entp->d_name, PATH_MAX) > PATH_MAX ) 
+			if ( strlcat(frameworkPath, entp->d_name, PATH_MAX) >= PATH_MAX )
 				continue;
-			if ( strlcat(frameworkPath, "/", PATH_MAX) > PATH_MAX ) 
+			if ( strlcat(frameworkPath, "/", PATH_MAX) >= PATH_MAX )
 				continue;
-			if ( strlcat(frameworkPath, entp->d_name, PATH_MAX) > PATH_MAX ) 
+			if ( strlcat(frameworkPath, entp->d_name, PATH_MAX) >= PATH_MAX )
 				continue;
 			frameworkPath[strlen(frameworkPath)-10] = '\0';
 			checkDylibOverride(frameworkPath);
@@ -1256,9 +1598,15 @@
 	char** result = new char*[colonCount+2];
 	for(const char* s=list; *s != '\0'; ++s) {
 		if (*s == ':') {
-			int len = s-start;
+			size_t len = s-start;
 			if ( (mainExecutableDir != NULL) && (strncmp(start, "@loader_path/", 13) == 0) ) {
-				int mainExecDirLen = strlen(mainExecutableDir);
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+				if ( gLinkContext.processIsRestricted ) {
+					dyld::log("dyld: warning: @loader_path/ ignored in restricted process\n");
+					continue;
+				}
+#endif
+				size_t mainExecDirLen = strlen(mainExecutableDir);
 				char* str = new char[mainExecDirLen+len+1];
 				strcpy(str, mainExecutableDir);
 				strlcat(str, &start[13], mainExecDirLen+len+1);
@@ -1267,7 +1615,13 @@
 				result[index++] = str;
 			}
 			else if ( (mainExecutableDir != NULL) && (strncmp(start, "@executable_path/", 17) == 0) ) {
-				int mainExecDirLen = strlen(mainExecutableDir);
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+				if ( gLinkContext.processIsRestricted ) {
+					dyld::log("dyld: warning: @executable_path/ ignored in restricted process\n");
+					continue;
+				}
+#endif
+				size_t mainExecDirLen = strlen(mainExecutableDir);
 				char* str = new char[mainExecDirLen+len+1];
 				strcpy(str, mainExecutableDir);
 				strlcat(str, &start[17], mainExecDirLen+len+1);
@@ -1284,22 +1638,38 @@
 			}
 		}
 	}
-	int len = strlen(start);
+	size_t len = strlen(start);
 	if ( (mainExecutableDir != NULL) && (strncmp(start, "@loader_path/", 13) == 0) ) {
-		int mainExecDirLen = strlen(mainExecutableDir);
-		char* str = new char[mainExecDirLen+len+1];
-		strcpy(str, mainExecutableDir);
-		strlcat(str, &start[13], mainExecDirLen+len+1);
-		str[mainExecDirLen+len-13] = '\0';
-		result[index++] = str;
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+		if ( gLinkContext.processIsRestricted ) {
+			dyld::log("dyld: warning: @loader_path/ ignored in restricted process\n");
+		}
+		else
+#endif
+		{
+			size_t mainExecDirLen = strlen(mainExecutableDir);
+			char* str = new char[mainExecDirLen+len+1];
+			strcpy(str, mainExecutableDir);
+			strlcat(str, &start[13], mainExecDirLen+len+1);
+			str[mainExecDirLen+len-13] = '\0';
+			result[index++] = str;
+		}
 	}
 	else if ( (mainExecutableDir != NULL) && (strncmp(start, "@executable_path/", 17) == 0) ) {
-		int mainExecDirLen = strlen(mainExecutableDir);
-		char* str = new char[mainExecDirLen+len+1];
-		strcpy(str, mainExecutableDir);
-		strlcat(str, &start[17], mainExecDirLen+len+1);
-		str[mainExecDirLen+len-17] = '\0';
-		result[index++] = str;
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+		if ( gLinkContext.processIsRestricted ) {
+			dyld::log("dyld: warning: @executable_path/ ignored in restricted process\n");
+		}
+		else
+#endif
+		{
+			size_t mainExecDirLen = strlen(mainExecutableDir);
+			char* str = new char[mainExecDirLen+len+1];
+			strcpy(str, mainExecutableDir);
+			strlcat(str, &start[17], mainExecDirLen+len+1);
+			str[mainExecDirLen+len-17] = '\0';
+			result[index++] = str;
+		}
 	}
 	else {
 		char* str = new char[len+1];
@@ -1341,7 +1711,7 @@
 	}
 }
 
- 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 static void paths_expand_roots(const char **paths, const char *key, const char *val)
 {
 // 	assert(val != NULL);
@@ -1373,6 +1743,7 @@
     }
     paths[i-skip] = NULL;
 }
+#endif
 
 
 #if 0
@@ -1420,6 +1791,7 @@
 	else if ( strcmp(key, "DYLD_FALLBACK_LIBRARY_PATH") == 0 ) {
 		appendParsedColonList(value, mainExecutableDir, &sEnv.DYLD_FALLBACK_LIBRARY_PATH);
 	}
+#if SUPPORT_ROOT_PATH
 	else if ( (strcmp(key, "DYLD_ROOT_PATH") == 0) || (strcmp(key, "DYLD_PATHS_ROOT") == 0) ) {
 		if ( strcmp(value, "/") != 0 ) {
 			gLinkContext.rootPaths = parseColonList(value, mainExecutableDir);
@@ -1431,12 +1803,16 @@
 				}
 			}
 		}
-	} 
+	}
+#endif
 	else if ( strcmp(key, "DYLD_IMAGE_SUFFIX") == 0 ) {
 		gLinkContext.imageSuffix = value;
 	}
 	else if ( strcmp(key, "DYLD_INSERT_LIBRARIES") == 0 ) {
 		sEnv.DYLD_INSERT_LIBRARIES = parseColonList(value, NULL);
+#if SUPPORT_ACCELERATE_TABLES
+		sDisableAcceleratorTables = true;
+#endif
 	}
 	else if ( strcmp(key, "DYLD_PRINT_OPTS") == 0 ) {
 		sEnv.DYLD_PRINT_OPTS = true;
@@ -1451,7 +1827,7 @@
 		gLinkContext.preFetchDisabled = true;
 	}
 	else if ( strcmp(key, "DYLD_PRINT_LIBRARIES") == 0 ) {
-		sEnv.DYLD_PRINT_LIBRARIES = true;
+		gLinkContext.verboseLoading = true;
 	}
 	else if ( strcmp(key, "DYLD_PRINT_LIBRARIES_POST_LAUNCH") == 0 ) {
 		sEnv.DYLD_PRINT_LIBRARIES_POST_LAUNCH = true;
@@ -1478,6 +1854,19 @@
 	}
 	else if ( strcmp(key, "DYLD_PRINT_STATISTICS") == 0 ) {
 		sEnv.DYLD_PRINT_STATISTICS = true;
+#if __IPHONE_OS_VERSION_MIN_REQUIRED && !TARGET_IPHONE_SIMULATOR
+		// <rdar://problem/26614838> DYLD_PRINT_STATISTICS no longer logs to xcode console for device apps
+		sForceStderr = true;
+#endif
+	}
+	else if ( strcmp(key, "DYLD_PRINT_TO_STDERR") == 0 ) {
+#if __IPHONE_OS_VERSION_MIN_REQUIRED && !TARGET_IPHONE_SIMULATOR
+		// <rdar://problem/26633440> DYLD_PRINT_STATISTICS no longer logs to xcode console for device apps
+		sForceStderr = true;
+#endif
+	}
+	else if ( strcmp(key, "DYLD_PRINT_STATISTICS_DETAILS") == 0 ) {
+		sEnv.DYLD_PRINT_STATISTICS_DETAILS = true;
 	}
 	else if ( strcmp(key, "DYLD_PRINT_SEGMENTS") == 0 ) {
 		gLinkContext.verboseMapping = true;
@@ -1494,6 +1883,11 @@
 	else if ( strcmp(key, "DYLD_PRINT_APIS") == 0 ) {
 		gLogAPIs = true;
 	}
+#if SUPPORT_ACCELERATE_TABLES
+	else if ( strcmp(key, "DYLD_PRINT_APIS_APP") == 0 ) {
+		gLogAppAPIs = true;
+	}
+#endif
 	else if ( strcmp(key, "DYLD_PRINT_WARNINGS") == 0 ) {
 		gLinkContext.verboseWarnings = true;
 	}
@@ -1554,9 +1948,27 @@
 #if SUPPORT_VERSIONED_PATHS
 	else if ( strcmp(key, "DYLD_VERSIONED_LIBRARY_PATH") == 0 ) {
 		appendParsedColonList(value, mainExecutableDir, &sEnv.DYLD_VERSIONED_LIBRARY_PATH);
+	#if SUPPORT_ACCELERATE_TABLES
+		sDisableAcceleratorTables = true;
+	#endif
 	}
 	else if ( strcmp(key, "DYLD_VERSIONED_FRAMEWORK_PATH") == 0 ) {
 		appendParsedColonList(value, mainExecutableDir, &sEnv.DYLD_VERSIONED_FRAMEWORK_PATH);
+	#if SUPPORT_ACCELERATE_TABLES
+		sDisableAcceleratorTables = true;
+	#endif
+	}
+#endif
+#if !TARGET_IPHONE_SIMULATOR
+	else if ( (strcmp(key, "DYLD_PRINT_TO_FILE") == 0) && (mainExecutableDir == NULL) ) {
+		int fd = open(value, O_WRONLY | O_CREAT | O_APPEND, 0644);
+		if ( fd != -1 ) {
+			sLogfile = fd;
+			sLogToFile = true;
+		}
+		else {
+			dyld::log("dyld: could not open DYLD_PRINT_TO_FILE='%s', errno=%d\n", value, errno);
+		}
 	}
 #endif
 	else {
@@ -1578,7 +1990,7 @@
 			{
 				const struct dylinker_command* envcmd = (struct dylinker_command*)cmd;
 				const char* keyEqualsValue = (char*)envcmd + envcmd->name.offset;
-				char mainExecutableDir[strlen(sExecPath)];
+				char mainExecutableDir[strlen(sExecPath)+2];
 				strcpy(mainExecutableDir, sExecPath);
 				char* lastSlash = strrchr(mainExecutableDir, '/');
 				if ( lastSlash != NULL)
@@ -1589,13 +2001,16 @@
 					if ( equals != NULL ) {
 						if ( strncmp(&equals[-5], "_PATH", 5) == 0 ) {
 							const char* value = &equals[1];
-							const int keyLen = equals-keyEqualsValue;
-							char key[keyLen+1];
-							strncpy(key, keyEqualsValue, keyLen);
-							key[keyLen] = '\0';
-							//dyld::log("processing: %s\n", keyEqualsValue);
-							//dyld::log("mainExecutableDir: %s\n", mainExecutableDir);
-							processDyldEnvironmentVariable(key, value, mainExecutableDir);
+							const size_t keyLen = equals-keyEqualsValue;
+							// <rdar://problem/22799635> don't let malformed load command overflow stack
+							if ( keyLen < 40 ) {
+								char key[keyLen+1];
+								strncpy(key, keyEqualsValue, keyLen);
+								key[keyLen] = '\0';
+								//dyld::log("processing: %s\n", keyEqualsValue);
+								//dyld::log("mainExecutableDir: %s\n", mainExecutableDir);
+								processDyldEnvironmentVariable(key, value, mainExecutableDir);
+							}
 						}
 					}
 				}
@@ -1642,6 +2057,7 @@
 #endif	
 
 
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 //
 // For security, setuid programs ignore DYLD_* environment variables.
 // Additionally, the DYLD_* enviroment variables are removed
@@ -1649,6 +2065,10 @@
 //
 static void pruneEnvironmentVariables(const char* envp[], const char*** applep)
 {
+#if SUPPORT_LC_DYLD_ENVIRONMENT
+	checkLoadCommandEnvironmentVariables();
+#endif
+
 	// delete all DYLD_* and LD_LIBRARY_PATH environment variables
 	int removedCount = 0;
 	const char** d = envp;
@@ -1661,25 +2081,6 @@
 		}
 	}
 	*d++ = NULL;
-// <rdar://11894054> Disable warnings about DYLD_ env vars being ignored.  The warnings are causing too much confusion.
-#if 0
-	if ( removedCount != 0 ) {
-		dyld::log("dyld: DYLD_ environment variables being ignored because ");
-		switch (sRestrictedReason) {
-			case restrictedNot:
-				break;
-			case restrictedBySetGUid:
-				dyld::log("main executable (%s) is setuid or setgid\n", sExecPath);
-				break;
-			case restrictedBySegment:
-				dyld::log("main executable (%s) has __RESTRICT/__restrict section\n", sExecPath);
-				break;
-			case restrictedByEntitlements:
-				dyld::log("main executable (%s) is code signed with entitlements\n", sExecPath);
-				break;
-		}
-	}
-#endif
 	// slide apple parameters
 	if ( removedCount > 0 ) {
 		*applep = d;
@@ -1693,28 +2094,72 @@
 	// disable framework and library fallback paths for setuid binaries rdar://problem/4589305
 	sEnv.DYLD_FALLBACK_FRAMEWORK_PATH = NULL;
 	sEnv.DYLD_FALLBACK_LIBRARY_PATH = NULL;
-}
-
-
-static void checkEnvironmentVariables(const char* envp[], bool ignoreEnviron)
-{
-	const char* home = NULL;
+
+	if ( removedCount > 0 )
+		strlcat(sLoadingCrashMessage, ", ignoring DYLD_* env vars", sizeof(sLoadingCrashMessage));
+}
+#endif
+
+static void defaultUninitializedFallbackPaths(const char* envp[])
+{
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+	if ( gLinkContext.processIsRestricted ) {
+		sEnv.DYLD_FALLBACK_FRAMEWORK_PATH = sRestrictedFrameworkFallbackPaths;
+		sEnv.DYLD_FALLBACK_LIBRARY_PATH   = sRestrictedLibraryFallbackPaths;
+		return;
+	}
+
+	// default value for DYLD_FALLBACK_FRAMEWORK_PATH, if not set in environment
+	const char* home = _simple_getenv(envp, "HOME");;
+	if ( sEnv.DYLD_FALLBACK_FRAMEWORK_PATH == NULL ) {
+		const char** fpaths = sFrameworkFallbackPaths;
+		if ( home == NULL )
+			removePathWithPrefix(fpaths, "$HOME");
+		else
+			paths_expand_roots(fpaths, "$HOME", home);
+		sEnv.DYLD_FALLBACK_FRAMEWORK_PATH = fpaths;
+	}
+
+    // default value for DYLD_FALLBACK_LIBRARY_PATH, if not set in environment
+	if ( sEnv.DYLD_FALLBACK_LIBRARY_PATH == NULL ) {
+		const char** lpaths = sLibraryFallbackPaths;
+		if ( home == NULL )
+			removePathWithPrefix(lpaths, "$HOME");
+		else
+			paths_expand_roots(lpaths, "$HOME", home);
+		sEnv.DYLD_FALLBACK_LIBRARY_PATH = lpaths;
+	}
+#else
+	if ( sEnv.DYLD_FALLBACK_FRAMEWORK_PATH == NULL )
+		sEnv.DYLD_FALLBACK_FRAMEWORK_PATH = sFrameworkFallbackPaths;
+
+	if ( sEnv.DYLD_FALLBACK_LIBRARY_PATH == NULL )
+		sEnv.DYLD_FALLBACK_LIBRARY_PATH = sLibraryFallbackPaths;
+#endif
+}
+
+
+static void checkEnvironmentVariables(const char* envp[])
+{
+	if ( sEnvMode == envNone )
+		return;
 	const char** p;
 	for(p = envp; *p != NULL; p++) {
 		const char* keyEqualsValue = *p;
 	    if ( strncmp(keyEqualsValue, "DYLD_", 5) == 0 ) {
 			const char* equals = strchr(keyEqualsValue, '=');
-			if ( (equals != NULL) && !ignoreEnviron ) {
+			if ( equals != NULL ) {
+				strlcat(sLoadingCrashMessage, "\n", sizeof(sLoadingCrashMessage));
+				strlcat(sLoadingCrashMessage, keyEqualsValue, sizeof(sLoadingCrashMessage));
 				const char* value = &equals[1];
-				const int keyLen = equals-keyEqualsValue;
+				const size_t keyLen = equals-keyEqualsValue;
 				char key[keyLen+1];
 				strncpy(key, keyEqualsValue, keyLen);
 				key[keyLen] = '\0';
+				if ( (sEnvMode == envPrintOnly) && (strncmp(key, "DYLD_PRINT_", 11) != 0) )
+					continue;
 				processDyldEnvironmentVariable(key, value, NULL);
 			}
-		}
-	    else if ( strncmp(keyEqualsValue, "HOME=", 5) == 0 ) {
-			home = &keyEqualsValue[5];
 		}
 		else if ( strncmp(keyEqualsValue, "LD_LIBRARY_PATH=", 16) == 0 ) {
 			const char* path = &keyEqualsValue[16];
@@ -1726,42 +2171,52 @@
 	checkLoadCommandEnvironmentVariables();
 #endif // SUPPORT_LC_DYLD_ENVIRONMENT	
 	
-	// default value for DYLD_FALLBACK_FRAMEWORK_PATH, if not set in environment
-	if ( sEnv.DYLD_FALLBACK_FRAMEWORK_PATH == NULL ) {
-		const char** paths = sFrameworkFallbackPaths;
-		if ( home == NULL )
-			removePathWithPrefix(paths, "$HOME");
-		else
-			paths_expand_roots(paths, "$HOME", home);
-		sEnv.DYLD_FALLBACK_FRAMEWORK_PATH = paths;
-	}
-
-	// default value for DYLD_FALLBACK_LIBRARY_PATH, if not set in environment
-	if ( sEnv.DYLD_FALLBACK_LIBRARY_PATH == NULL ) {
-		const char** paths = sLibraryFallbackPaths;
-		if ( home == NULL ) 
-			removePathWithPrefix(paths, "$HOME");
-		else
-			paths_expand_roots(paths, "$HOME", home);
-		sEnv.DYLD_FALLBACK_LIBRARY_PATH = paths;
-	}
-	
+#if SUPPORT_ROOT_PATH
 	// <rdar://problem/11281064> DYLD_IMAGE_SUFFIX and DYLD_ROOT_PATH cannot be used together
 	if ( (gLinkContext.imageSuffix != NULL) && (gLinkContext.rootPaths != NULL) ) {
 		dyld::warn("Ignoring DYLD_IMAGE_SUFFIX because DYLD_ROOT_PATH is used.\n");
 		gLinkContext.imageSuffix = NULL;
 	}
-	
-#if SUPPORT_VERSIONED_PATHS
-	checkVersionedPaths();
-#endif	
-}
-
-
-static void getHostInfo()
+#endif
+}
+
+#if __x86_64__ && DYLD_SHARED_CACHE_SUPPORT
+static bool isGCProgram(const macho_header* mh, uintptr_t slide)
+{
+	const uint32_t cmd_count = mh->ncmds;
+	const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		switch (cmd->cmd) {
+			case LC_SEGMENT_COMMAND:
+			{
+				const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
+				if (strcmp(seg->segname, "__DATA") == 0) {
+					const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
+					const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
+					for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
+						if (strncmp(sect->sectname, "__objc_imageinfo", 16) == 0) {
+							const uint32_t*  objcInfo = (uint32_t*)(sect->addr + slide);
+							return (objcInfo[1] & 6); // 6 = (OBJC_IMAGE_SUPPORTS_GC | OBJC_IMAGE_REQUIRES_GC)
+						}
+					}
+				}
+			}
+			break;
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+	return false;
+}
+#endif
+
+static void getHostInfo(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide)
 {
 #if CPU_SUBTYPES_SUPPORTED
-#if __ARM_ARCH_7A__
+#if __ARM_ARCH_7K__
+	sHostCPU		= CPU_TYPE_ARM;
+	sHostCPUsubtype = CPU_SUBTYPE_ARM_V7K;
+#elif __ARM_ARCH_7A__
 	sHostCPU		= CPU_TYPE_ARM;
 	sHostCPUsubtype = CPU_SUBTYPE_ARM_V7;
 #elif __ARM_ARCH_6K__
@@ -1773,9 +2228,6 @@
 #elif __ARM_ARCH_7S__
 	sHostCPU		= CPU_TYPE_ARM;
 	sHostCPUsubtype = CPU_SUBTYPE_ARM_V7S;
-#elif __ARM_ARCH_7K__
-	sHostCPU		= CPU_TYPE_ARM;
-	sHostCPUsubtype = CPU_SUBTYPE_ARM_V7K;
 #else
 	struct host_basic_info info;
 	mach_msg_type_number_t count = HOST_BASIC_INFO_COUNT;
@@ -1785,6 +2237,21 @@
 		throw "host_info() failed";
 	sHostCPU		= info.cpu_type;
 	sHostCPUsubtype = info.cpu_subtype;
+	mach_port_deallocate(mach_task_self(), hostPort);
+  #if __x86_64__
+	#if DYLD_SHARED_CACHE_SUPPORT
+	  sHaswell = (sHostCPUsubtype == CPU_SUBTYPE_X86_64_H);
+	  // <rdar://problem/18528074> x86_64h: Fall back to the x86_64 slice if an app requires GC.
+	  if ( sHaswell ) {
+		if ( isGCProgram(mainExecutableMH, mainExecutableSlide) ) {
+			// When running a GC program on a haswell machine, don't use and 'h slices
+			sHostCPUsubtype = CPU_SUBTYPE_X86_64_ALL;
+			sHaswell = false;
+			gLinkContext.sharedRegionMode = ImageLoader::kDontUseSharedRegion;
+		}
+	  }
+	#endif
+  #endif
 #endif
 #endif
 }
@@ -1799,14 +2266,20 @@
 		if ( gLinkContext.verboseMapping )
 			dyld::warn("disabling shared region because main executable overlaps\n");
 	}
+#if __i386__
+	if ( gLinkContext.processIsRestricted ) {
+		// <rdar://problem/15280847> use private or no shared region for suid processes
+		gLinkContext.sharedRegionMode = ImageLoader::kUsePrivateSharedRegion;
+	}
+#endif
 #endif
 	// iPhoneOS cannot run without shared region
 }
 
 bool validImage(const ImageLoader* possibleImage)
 {
-    const unsigned int imageCount = sAllImages.size();
-    for(unsigned int i=0; i < imageCount; ++i) {
+    const size_t imageCount = sAllImages.size();
+    for(size_t i=0; i < imageCount; ++i) {
         if ( possibleImage == sAllImages[i] ) {
             return true;
         }
@@ -1816,7 +2289,7 @@
 
 uint32_t getImageCount()
 {
-	return sAllImages.size();
+	return (uint32_t)sAllImages.size();
 }
 
 ImageLoader* getIndexedImage(unsigned int index)
@@ -1834,6 +2307,15 @@
 
 ImageLoader* findImageContainingAddress(const void* addr)
 {
+  #if SUPPORT_ACCELERATE_TABLES
+	if ( sAllCacheImagesProxy != NULL ) {
+		const mach_header* mh;
+		const char* path;
+		unsigned index;
+		if ( sAllCacheImagesProxy->addressInCache(addr, &mh, &path, &index) )
+			return sAllCacheImagesProxy;
+	}
+  #endif
 	return findMappedRange((uintptr_t)addr);
 }
 
@@ -1852,8 +2334,8 @@
 
 void forEachImageDo( void (*callback)(ImageLoader*, void* userData), void* userData)
 {
-	const unsigned int imageCount = sAllImages.size();
-	for(unsigned int i=0; i < imageCount; ++i) {
+	const size_t imageCount = sAllImages.size();
+	for(size_t i=0; i < imageCount; ++i) {
 		ImageLoader* anImage = sAllImages[i];
 		(*callback)(anImage, userData);
 	}
@@ -1861,8 +2343,8 @@
 
 ImageLoader* findLoadedImage(const struct stat& stat_buf)
 {
-	const unsigned int imageCount = sAllImages.size();
-	for(unsigned int i=0; i < imageCount; ++i){
+	const size_t imageCount = sAllImages.size();
+	for(size_t i=0; i < imageCount; ++i){
 		ImageLoader* anImage = sAllImages[i];
 		if ( anImage->statMatch(stat_buf) )
 			return anImage;
@@ -1873,7 +2355,7 @@
 // based on ANSI-C strstr()
 static const char* strrstr(const char* str, const char* sub) 
 {
-	const int sublen = strlen(sub);
+	const size_t sublen = strlen(sub);
 	for(const char* p = &str[strlen(str)]; p != str; --p) {
 		if ( strncmp(p, sub, sublen) == 0 )
 			return p;
@@ -1903,7 +2385,7 @@
 				const char* frameworkStart = &dirStart[1];
 				if ( dirStart == path )
 					--frameworkStart;
-				int len = dirDot - frameworkStart;
+				size_t len = dirDot - frameworkStart;
 				char framework[len+1];
 				strncpy(framework, frameworkStart, len);
 				framework[len] = '\0';
@@ -1966,11 +2448,11 @@
 	// armv7f can run: v7f, v7, v6, v5, and v4
 	{  CPU_SUBTYPE_ARM_V7F, CPU_SUBTYPE_ARM_V7, CPU_SUBTYPE_ARM_V6, CPU_SUBTYPE_ARM_V5TEJ, CPU_SUBTYPE_ARM_V4T, CPU_SUBTYPE_ARM_ALL, CPU_SUBTYPE_END_OF_LIST },
 
-	// armv7k can run: v7k, v6, v5, and v4
-	{  CPU_SUBTYPE_ARM_V7K, CPU_SUBTYPE_ARM_V6, CPU_SUBTYPE_ARM_V5TEJ, CPU_SUBTYPE_ARM_V4T, CPU_SUBTYPE_ARM_ALL, CPU_SUBTYPE_END_OF_LIST },
+	// armv7k can run: v7k
+	{  CPU_SUBTYPE_ARM_V7K, CPU_SUBTYPE_END_OF_LIST },
 
 	// armv7s can run: v7s, v7, v7f, v7k, v6, v5, and v4
-	{  CPU_SUBTYPE_ARM_V7S, CPU_SUBTYPE_ARM_V7, CPU_SUBTYPE_ARM_V7F, CPU_SUBTYPE_ARM_V7K, CPU_SUBTYPE_ARM_V6, CPU_SUBTYPE_ARM_V5TEJ, CPU_SUBTYPE_ARM_V4T, CPU_SUBTYPE_ARM_ALL, CPU_SUBTYPE_END_OF_LIST },
+	{  CPU_SUBTYPE_ARM_V7S, CPU_SUBTYPE_ARM_V7, CPU_SUBTYPE_ARM_V7F, CPU_SUBTYPE_ARM_V6, CPU_SUBTYPE_ARM_V5TEJ, CPU_SUBTYPE_ARM_V4T, CPU_SUBTYPE_ARM_ALL, CPU_SUBTYPE_END_OF_LIST },
 
 	// armv7 can run: v7, v6, v5, and v4
 	{  CPU_SUBTYPE_ARM_V7, CPU_SUBTYPE_ARM_V6, CPU_SUBTYPE_ARM_V5TEJ, CPU_SUBTYPE_ARM_V4T, CPU_SUBTYPE_ARM_ALL, CPU_SUBTYPE_END_OF_LIST },
@@ -1986,6 +2468,22 @@
 
 	// armv4 can run: v4
 	{  CPU_SUBTYPE_ARM_V4T, CPU_SUBTYPE_ARM_ALL, CPU_SUBTYPE_END_OF_LIST, CPU_SUBTYPE_END_OF_LIST, CPU_SUBTYPE_END_OF_LIST, CPU_SUBTYPE_END_OF_LIST },
+};
+#endif
+
+#if __x86_64__
+//      
+//     x86_64 sub-type lists
+//
+const int kX86_64_RowCount = 2;
+static const cpu_subtype_t kX86_64[kX86_64_RowCount][5] = {
+
+	// x86_64h can run: x86_64h, x86_64h(lib), x86_64(lib), and x86_64
+	{ CPU_SUBTYPE_X86_64_H, CPU_SUBTYPE_LIB64|CPU_SUBTYPE_X86_64_H, CPU_SUBTYPE_LIB64|CPU_SUBTYPE_X86_64_ALL, CPU_SUBTYPE_X86_64_ALL,  CPU_SUBTYPE_END_OF_LIST },
+
+	// x86_64 can run: x86_64(lib) and x86_64
+	{ CPU_SUBTYPE_X86_64_ALL, CPU_SUBTYPE_LIB64|CPU_SUBTYPE_X86_64_ALL, CPU_SUBTYPE_END_OF_LIST },
+
 };
 #endif
 
@@ -1999,6 +2497,14 @@
 			for (int i=0; i < kARM_RowCount ; ++i) {
 				if ( kARM[i][0] == subtype )
 					return kARM[i];
+			}
+			break;
+#endif
+#if __x86_64__
+		case CPU_TYPE_X86_64:
+			for (int i=0; i < kX86_64_RowCount ; ++i) {
+				if ( kX86_64[i][0] == subtype )
+					return kX86_64[i];
 			}
 			break;
 #endif
@@ -2057,6 +2563,15 @@
 					}
 					break;
 #endif
+#if __x86_64__
+				case CPU_TYPE_X86_64:
+					if ( (cpu_subtype_t)OSSwapBigToHostInt32(archs[i].cpusubtype) == CPU_SUBTYPE_X86_64_ALL ) {
+						*offset = OSSwapBigToHostInt32(archs[i].offset);
+						*len = OSSwapBigToHostInt32(archs[i].size);
+						return true;
+					}
+					break;
+#endif
 			}
 		}
 	}
@@ -2064,6 +2579,66 @@
 }
 
 #endif // CPU_SUBTYPES_SUPPORTED
+
+
+//
+// Validate the fat_header and fat_arch array:
+//
+// 1) arch count would not cause array to extend past 4096 byte read buffer
+// 2) no slice overlaps the fat_header and arch array
+// 3) arch list does not contain duplicate cputype/cpusubtype tuples
+// 4) arch list does not have two overlapping slices.
+//
+static bool fatValidate(const fat_header* fh)
+{
+	if ( fh->magic != OSSwapBigToHostInt32(FAT_MAGIC) )
+		return false;
+
+	// since only first 4096 bytes of file read, we can only handle up to 204 slices.
+	const uint32_t sliceCount = OSSwapBigToHostInt32(fh->nfat_arch);
+	if ( sliceCount > 204 )
+		return false;
+
+	// compare all slices looking for conflicts
+	const fat_arch* archs = (fat_arch*)(((char*)fh)+sizeof(fat_header));
+	for (uint32_t i=0; i < sliceCount; ++i) {
+		uint32_t i_offset     = OSSwapBigToHostInt32(archs[i].offset);
+		uint32_t i_size       = OSSwapBigToHostInt32(archs[i].size);
+		uint32_t i_cputype    = OSSwapBigToHostInt32(archs[i].cputype);
+		uint32_t i_cpusubtype = OSSwapBigToHostInt32(archs[i].cpusubtype);
+		uint32_t i_end        = i_offset + i_size;
+		// slice cannot overlap with header
+		if ( i_offset < 4096 )
+			return false;
+		// slice size cannot overflow
+		if ( i_end < i_offset )
+			return false;
+		for (uint32_t j=i+1; j < sliceCount; ++j) {
+			uint32_t j_offset     = OSSwapBigToHostInt32(archs[j].offset);
+			uint32_t j_size       = OSSwapBigToHostInt32(archs[j].size);
+			uint32_t j_cputype    = OSSwapBigToHostInt32(archs[j].cputype);
+			uint32_t j_cpusubtype = OSSwapBigToHostInt32(archs[j].cpusubtype);
+			uint32_t j_end        = j_offset + j_size;
+			// duplicate slices types not allowed
+			if ( (i_cputype == j_cputype) && (i_cpusubtype == j_cpusubtype) )
+				return false;
+			// slice size cannot overflow
+			if ( j_end < j_offset )
+				return false;
+			// check for overlap of slices
+			if ( i_offset <= j_offset ) {
+				if ( j_offset < i_end )
+					return false; //  j overlaps end of i
+			}
+			else {
+				//  j overlaps end of i
+				if ( i_offset < j_end )
+					return false;  //  i overlaps end of j
+			}
+		}
+	}
+	return true;
+}
 
 //
 // A fat file may contain multiple sub-images for the same cpu-type,
@@ -2072,6 +2647,9 @@
 //
 static bool fatFindBest(const fat_header* fh, uint64_t* offset, uint64_t* len)
 {
+	if ( !fatValidate(fh) )
+		return false;
+
 #if CPU_SUBTYPES_SUPPORTED
 	// assume all dylibs loaded must have same cpu type as main executable
 	const cpu_type_t cpu = sMainExecutableMachHeader->cputype;
@@ -2082,9 +2660,11 @@
 		const cpu_subtype_t* subTypePreferenceList = findCPUSubtypeList(cpu, sHostCPUsubtype);
 	
 		// use ordered list to find best sub-image in fat file
-		if ( subTypePreferenceList != NULL ) 
-			return fatFindBestFromOrderedList(cpu, subTypePreferenceList, fh, offset, len);
-		
+		if ( subTypePreferenceList != NULL ) {
+			if ( fatFindBestFromOrderedList(cpu, subTypePreferenceList, fh, offset, len) )
+				return true;
+		}
+
 		// if running cpu is not in list, try for an exact match
 		if ( fatFindExactMatch(cpu, sHostCPUsubtype, fh, offset, len) )
 			return true;
@@ -2165,21 +2745,31 @@
 
 // The kernel maps in main executable before dyld gets control.  We need to 
 // make an ImageLoader* for the already mapped in main executable.
-static ImageLoader* instantiateFromLoadedImage(const macho_header* mh, uintptr_t slide, const char* path)
+static ImageLoaderMachO* instantiateFromLoadedImage(const macho_header* mh, uintptr_t slide, const char* path)
 {
 	// try mach-o loader
 	if ( isCompatibleMachO((const uint8_t*)mh, path) ) {
 		ImageLoader* image = ImageLoaderMachO::instantiateMainExecutable(mh, slide, path, gLinkContext);
 		addImage(image);
-		return image;
+		return (ImageLoaderMachO*)image;
 	}
 	
 	throw "main executable not a known format";
 }
 
-
 #if DYLD_SHARED_CACHE_SUPPORT
-static bool findInSharedCacheImage(const char* path, const struct stat* stat_buf, const macho_header** mh, const char** pathInCache, long* slide)
+
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+static bool dylibsCanOverrideCache()
+{
+	uint32_t devFlags = *((uint32_t*)_COMM_PAGE_DEV_FIRM);
+	if ( (devFlags & 1) == 0 )
+		return false;
+	return ( (sSharedCache != NULL) && (sSharedCache->cacheType == kDyldSharedCacheTypeDevelopment) );
+}
+#endif
+
+static bool findInSharedCacheImage(const char* path, bool searchByPath, const struct stat* stat_buf, const macho_header** mh, const char** pathInCache, long* slide)
 {
 	if ( sSharedCache != NULL ) {
 #if __MAC_OS_X_VERSION_MIN_REQUIRED	
@@ -2192,28 +2782,48 @@
 			stat_buf = &statb;
 		}
 #endif
+#if __IPHONE_OS_VERSION_MIN_REQUIRED	
+		uint64_t hash = 0;
+		for (const char* s=path; *s != '\0'; ++s)
+			hash += hash*4 + *s;
+#endif
+
 		// walk shared cache to see if there is a cached image that matches the inode/mtime/path desired
 		const dyld_cache_image_info* const start = (dyld_cache_image_info*)((uint8_t*)sSharedCache + sSharedCache->imagesOffset);
 		const dyld_cache_image_info* const end = &start[sSharedCache->imagesCount];
+#if __IPHONE_OS_VERSION_MIN_REQUIRED	
+		const bool cacheHasHashInfo = (start->modTime == 0);
+#endif
 		for( const dyld_cache_image_info* p = start; p != end; ++p) {
 #if __IPHONE_OS_VERSION_MIN_REQUIRED	
 			// just check path
 			const char* aPath = (char*)sSharedCache + p->pathFileOffset;
+			if ( cacheHasHashInfo && (p->inode != hash) )
+				continue;
 			if ( strcmp(path, aPath) == 0 ) {
 				// found image in cache
 				*mh = (macho_header*)(p->address+sSharedCacheSlide);
 				*pathInCache = aPath;
 				*slide = sSharedCacheSlide;
+				if ( aPath < (char*)(*mh) )  {
+					// <rdar://problem/22056997> found alias, rescan list to get canonical name
+					for (const dyld_cache_image_info* p2 = start; p2 != end; ++p2) {
+						if ( p2->address == p->address ) {
+							*pathInCache = (char*)sSharedCache + p2->pathFileOffset;
+							break;
+						}
+					}
+				}
 				return true;
 			}
 #elif __MAC_OS_X_VERSION_MIN_REQUIRED
 			// check mtime and inode first because it is fast
-			if ( sSharedCacheIgnoreInodeAndTimeStamp 
-				|| ( ((time_t)p->modTime == stat_buf->st_mtime) && ((ino_t)p->inode == stat_buf->st_ino) ) ) {
+			bool inodeMatch = ( ((time_t)p->modTime == stat_buf->st_mtime) && ((ino_t)p->inode == stat_buf->st_ino) );
+			if ( searchByPath || sSharedCacheIgnoreInodeAndTimeStamp || inodeMatch ) {
 				// mod-time and inode match an image in the shared cache, now check path
 				const char* aPath = (char*)sSharedCache + p->pathFileOffset;
 				bool cacheHit = (strcmp(path, aPath) == 0);
-				if ( ! cacheHit ) {
+				if ( inodeMatch && !cacheHit ) {
 					// path does not match install name of dylib in cache, but inode and mtime does match
 					// perhaps path is a symlink to the cached dylib
 					struct stat pathInCacheStatBuf;
@@ -2223,7 +2833,7 @@
 				if ( cacheHit ) {
 					// found image in cache, return info
 					*mh = (macho_header*)(p->address+sSharedCacheSlide);
-					//dyld::log("findInSharedCacheImage(), mh=%p, p->address=0x%0llX, slid=0x%0lX, path=%p\n", 
+					//dyld::log("findInSharedCacheImage(), mh=%p, p->address=0x%0llX, slid=0x%0lX, path=%s\n",
 					//	*mh, p->address, sSharedCacheSlide, aPath);
 					*pathInCache = aPath;
 					*slide = sSharedCacheSlide;
@@ -2241,7 +2851,7 @@
 	const macho_header* mhInCache;
 	const char*			pathInCache;
 	long				slide;
-	return findInSharedCacheImage(path, NULL, &mhInCache, &pathInCache, &slide);
+	return findInSharedCacheImage(path, true, NULL, &mhInCache, &pathInCache, &slide);
 }
 
 #endif
@@ -2284,6 +2894,42 @@
 	return image;
 }
 
+#if TARGET_IPHONE_SIMULATOR	
+static bool isSimulatorBinary(const uint8_t* firstPages, const char* path)
+{
+	const macho_header* mh = (macho_header*)firstPages;
+	const uint32_t cmd_count = mh->ncmds;
+	const load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
+	const load_command* const cmdsEnd = (load_command*)((char*)cmds + mh->sizeofcmds);
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		switch (cmd->cmd) {
+	#if TARGET_OS_WATCH
+			case LC_VERSION_MIN_WATCHOS:
+				return true;
+	#elif TARGET_OS_TV
+			case LC_VERSION_MIN_TVOS:
+				return true;
+	#elif TARGET_OS_IOS
+			case LC_VERSION_MIN_IPHONEOS:
+				return true;
+	#endif
+			case LC_VERSION_MIN_MACOSX:
+				// grandfather in a few libSystem dylibs
+				if ((strcmp(path, "/usr/lib/system/libsystem_kernel.dylib") == 0) ||
+				    (strcmp(path, "/usr/lib/system/libsystem_platform.dylib") == 0) ||
+				    (strcmp(path, "/usr/lib/system/libsystem_pthread.dylib") == 0))
+					return true;
+				return false;
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+		if ( cmd > cmdsEnd )
+			return false;
+	}
+	return false;
+}
+#endif
+
 // map in file and instantiate an ImageLoader
 static ImageLoader* loadPhase6(int fd, const struct stat& stat_buf, const char* path, const LoadContext& context)
 {
@@ -2295,27 +2941,30 @@
 	if ( (stat_buf.st_mode & S_IFMT) != S_IFREG ) 
 		throw "not a file";
 
-	uint8_t firstPage[4096];
+	uint8_t firstPages[MAX_MACH_O_HEADER_AND_LOAD_COMMANDS_SIZE];
 	bool shortPage = false;
 	
 	// min mach-o file is 4K
 	if ( fileLength < 4096 ) {
-		if ( pread(fd, firstPage, fileLength, 0) != (ssize_t)fileLength )
+		if ( pread(fd, firstPages, fileLength, 0) != (ssize_t)fileLength )
 			throwf("pread of short file failed: %d", errno);
 		shortPage = true;
 	} 
 	else {
-		if ( pread(fd, firstPage, 4096,0) != 4096 )
+		// optimistically read only first 4KB
+		if ( pread(fd, firstPages, 4096, 0) != 4096 )
 			throwf("pread of first 4K failed: %d", errno);
 	}
 	
 	// if fat wrapper, find usable sub-file
-	const fat_header* fileStartAsFat = (fat_header*)firstPage;
+	const fat_header* fileStartAsFat = (fat_header*)firstPages;
 	if ( fileStartAsFat->magic == OSSwapBigToHostInt32(FAT_MAGIC) ) {
+		if ( OSSwapBigToHostInt32(fileStartAsFat->nfat_arch) > ((4096 - sizeof(fat_header)) / sizeof(fat_arch)) )
+			throwf("fat header too large: %u entries", OSSwapBigToHostInt32(fileStartAsFat->nfat_arch));
 		if ( fatFindBest(fileStartAsFat, &fileOffset, &fileLength) ) {
 			if ( (fileOffset+fileLength) > (uint64_t)(stat_buf.st_size) )
 				throwf("truncated fat file.  file length=%llu, but needed slice goes to %llu", stat_buf.st_size, fileOffset+fileLength);
-			if (pread(fd, firstPage, 4096, fileOffset) != 4096)
+			if (pread(fd, firstPages, 4096, fileOffset) != 4096)
 				throwf("pread of fat file failed: %d", errno);
 		}
 		else {
@@ -2326,10 +2975,11 @@
 	// try mach-o loader
 	if ( shortPage ) 
 		throw "file too short";
-	if ( isCompatibleMachO(firstPage, path) ) {
+	if ( isCompatibleMachO(firstPages, path) ) {
 
 		// only MH_BUNDLE, MH_DYLIB, and some MH_EXECUTE can be dynamically loaded
-		switch ( ((mach_header*)firstPage)->filetype ) {
+		const mach_header* mh = (mach_header*)firstPages;
+		switch ( mh->filetype ) {
 			case MH_EXECUTE:
 			case MH_DYLIB:
 			case MH_BUNDLE:
@@ -2337,9 +2987,36 @@
 			default:
 				throw "mach-o, but wrong filetype";
 		}
-		
+
+		uint32_t headerAndLoadCommandsSize = sizeof(macho_header) + mh->sizeofcmds;
+		if ( headerAndLoadCommandsSize > MAX_MACH_O_HEADER_AND_LOAD_COMMANDS_SIZE )
+			throwf("malformed mach-o: load commands size (%u) > %u", headerAndLoadCommandsSize, MAX_MACH_O_HEADER_AND_LOAD_COMMANDS_SIZE);
+
+		if ( headerAndLoadCommandsSize > fileLength )
+			dyld::throwf("malformed mach-o: load commands size (%u) > mach-o file size (%llu)", headerAndLoadCommandsSize, fileLength);
+
+		if ( headerAndLoadCommandsSize > 4096 ) {
+			// read more pages
+			unsigned readAmount = headerAndLoadCommandsSize - 4096;
+			if ( pread(fd, &firstPages[4096], readAmount, fileOffset+4096) != readAmount )
+				throwf("pread of extra load commands past 4KB failed: %d", errno);
+		}
+
+#if TARGET_IPHONE_SIMULATOR	
+		// <rdar://problem/14168872> dyld_sim should restrict loading osx binaries
+		if ( !isSimulatorBinary(firstPages, path) ) {
+	#if TARGET_OS_WATCH
+			throw "mach-o, but not built for watchOS simulator";
+	#elif TARGET_OS_TV
+			throw "mach-o, but not built for tvOS simulator";
+	#else
+			throw "mach-o, but not built for iOS simulator";
+	#endif
+		}
+#endif
+
 		// instantiate an image
-		ImageLoader* image = ImageLoaderMachO::instantiateFromFile(path, fd, firstPage, fileOffset, fileLength, stat_buf, gLinkContext);
+		ImageLoader* image = ImageLoaderMachO::instantiateFromFile(path, fd, firstPages, headerAndLoadCommandsSize, fileOffset, fileLength, stat_buf, gLinkContext);
 		
 		// validate
 		return checkandAddImage(image, context);
@@ -2349,7 +3026,7 @@
 	
 	
 	// throw error about what was found
-	switch (*(uint32_t*)firstPage) {
+	switch (*(uint32_t*)firstPages) {
 		case MH_MAGIC:
 		case MH_CIGAM:
 		case MH_MAGIC_64:
@@ -2357,7 +3034,7 @@
 			throw "mach-o, but wrong architecture";
 		default:
 		throwf("unknown file type, first eight bytes: 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X", 
-			firstPage[0], firstPage[1], firstPage[2], firstPage[3], firstPage[4], firstPage[5], firstPage[6],firstPage[7]);
+			firstPages[0], firstPages[1], firstPages[2], firstPages[3], firstPages[4], firstPages[5], firstPages[6],firstPages[7]);
 	}
 }
 
@@ -2373,7 +3050,11 @@
 	if ( file.getFileDescriptor() == -1 ) {
 		int err = errno;
 		if ( err != ENOENT ) {
-			const char* newMsg = dyld::mkstringf("%s: open() failed with errno=%d", path, err);
+			const char* newMsg;
+			if ( (err == EPERM) && sandboxBlockedOpen(path) )
+				newMsg = dyld::mkstringf("file system sandbox blocked open() of '%s'", path);
+			else
+				newMsg = dyld::mkstringf("%s: open() failed with errno=%d", path, err);
 			exceptions->push_back(newMsg);
 		}
 		return NULL;
@@ -2392,21 +3073,32 @@
 
 
 #if __MAC_OS_X_VERSION_MIN_REQUIRED	
-static ImageLoader* loadPhase5load(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase5load(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	ImageLoader* image = NULL;
+
+  #if SUPPORT_ACCELERATE_TABLES
+	if ( sAllCacheImagesProxy != NULL ) {
+		unsigned index;
+		if ( sAllCacheImagesProxy->hasDylib(path, &index) )
+			return sAllCacheImagesProxy;
+	}
+  #endif
 
 	// just return NULL if file not found, but record any other errors
 	struct stat stat_buf;
 	if ( my_stat(path, &stat_buf) == -1 ) {
 		int err = errno;
 		if ( err != ENOENT ) {
-			exceptions->push_back(dyld::mkstringf("%s: stat() failed with errno=%d", path, err));
+			if ( (err == EPERM) && sandboxBlockedStat(path) )
+				exceptions->push_back(dyld::mkstringf("%s: file system sandbox blocked stat()", path));
+			else
+				exceptions->push_back(dyld::mkstringf("%s: stat() failed with errno=%d", path, err));
 		}
 		return NULL;
 	}
-	
+
 	// in case image was renamed or found via symlinks, check for inode match
 	image = findLoadedImage(stat_buf);
 	if ( image != NULL )
@@ -2421,7 +3113,7 @@
 	const macho_header* mhInCache;
 	const char*			pathInCache;
 	long				slideInCache;
-	if ( findInSharedCacheImage(path, &stat_buf, &mhInCache, &pathInCache, &slideInCache) ) {
+	if ( findInSharedCacheImage(path, false, &stat_buf, &mhInCache, &pathInCache, &slideInCache) ) {
 		image = ImageLoaderMachO::instantiateFromCache(mhInCache, pathInCache, slideInCache, stat_buf, gLinkContext);
 		return checkandAddImage(image, context);
 	}
@@ -2465,7 +3157,7 @@
 }
 
 // try to open file
-static ImageLoader* loadPhase5load(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase5load(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	struct stat stat_buf;
@@ -2473,7 +3165,13 @@
 	int statErrNo;
 	ImageLoader* image;
 #if DYLD_SHARED_CACHE_SUPPORT
-	if ( sDylibsOverrideCache ) {
+  #if SUPPORT_ACCELERATE_TABLES
+	if ( sAllCacheImagesProxy != NULL ) {
+		if ( sAllCacheImagesProxy->hasDylib(path, &cacheIndex) )
+			return sAllCacheImagesProxy;
+	}
+  #endif
+	if ( dylibsCanOverrideCache() ) {
 		// flag is set that allows installed framework roots to override dyld shared cache
 		image = loadPhase5stat(path, context, &stat_buf, &statErrNo, &imageFound, exceptions);
 		if ( imageFound )
@@ -2483,7 +3181,7 @@
 	const macho_header* mhInCache;
 	const char*			pathInCache;
 	long				slideInCache;
-	if ( findInSharedCacheImage(path, NULL, &mhInCache, &pathInCache, &slideInCache) ) {
+	if ( findInSharedCacheImage(path, true, NULL, &mhInCache, &pathInCache, &slideInCache) ) {
 		// see if this image in the cache was already loaded via a different path
 		for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); ++it) {
 			ImageLoader* anImage = *it;
@@ -2500,7 +3198,7 @@
 		return checkandAddImage(image, context);
 	}
 	
-	if ( !sDylibsOverrideCache ) {
+	if ( !dylibsCanOverrideCache() ) {
 		// flag is not set, and not in cache to try opening it
 		image = loadPhase5stat(path, context, &stat_buf, &statErrNo, &imageFound, exceptions);
 		if ( imageFound )
@@ -2513,7 +3211,10 @@
 #endif
 	// just return NULL if file not found, but record any other errors
 	if ( (statErrNo != ENOENT) && (statErrNo != 0) ) {
-		exceptions->push_back(dyld::mkstringf("%s: stat() failed with errno=%d", path, statErrNo));
+		if ( (statErrNo == EPERM) && sandboxBlockedStat(path) )
+			exceptions->push_back(dyld::mkstringf("%s: file system sandbox blocked stat()", path));
+		else
+			exceptions->push_back(dyld::mkstringf("%s: stat() failed with errno=%d", path, statErrNo));
 	}
 	return NULL;
 }
@@ -2566,7 +3267,7 @@
 
 
 // open or check existing
-static ImageLoader* loadPhase5(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase5(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	
@@ -2579,40 +3280,42 @@
 	}
 	
 	if ( exceptions != NULL ) 
-		return loadPhase5load(path, orgPath, context, exceptions);
+		return loadPhase5load(path, orgPath, context, cacheIndex, exceptions);
 	else
 		return loadPhase5check(path, orgPath, context);
 }
 
 // try with and without image suffix
-static ImageLoader* loadPhase4(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase4(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	ImageLoader* image = NULL;
 	if (  gLinkContext.imageSuffix != NULL ) {
 		char pathWithSuffix[strlen(path)+strlen( gLinkContext.imageSuffix)+2];
 		ImageLoader::addSuffix(path,  gLinkContext.imageSuffix, pathWithSuffix);
-		image = loadPhase5(pathWithSuffix, orgPath, context, exceptions);
+		image = loadPhase5(pathWithSuffix, orgPath, context, cacheIndex, exceptions);
 	}
 	if ( image == NULL )
-		image = loadPhase5(path, orgPath, context, exceptions);
+		image = loadPhase5(path, orgPath, context, cacheIndex, exceptions);
 	return image;
 }
 
-static ImageLoader* loadPhase2(const char* path, const char* orgPath, const LoadContext& context, 
-							   const char* const frameworkPaths[], const char* const libraryPaths[], 
-							   std::vector<const char*>* exceptions); // forward reference
+static ImageLoader* loadPhase2(const char* path, const char* orgPath, const LoadContext& context,
+							   const char* const frameworkPaths[], const char* const libraryPaths[],
+							   unsigned& cacheIndex, std::vector<const char*>* exceptions); // forward reference
 
 
 // expand @ variables
-static ImageLoader* loadPhase3(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase3(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	ImageLoader* image = NULL;
 	if ( strncmp(path, "@executable_path/", 17) == 0 ) {
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 		// executable_path cannot be in used in any binary in a setuid process rdar://problem/4589305
-		if ( sProcessIsRestricted ) 
+		if ( gLinkContext.processIsRestricted )
 			throwf("unsafe use of @executable_path in %s with restricted binary", context.origin);
+#endif
 		// handle @executable_path path prefix
 		const char* executablePath = sExecPath;
 		char newPath[strlen(executablePath) + strlen(path)];
@@ -2622,7 +3325,7 @@
 			strcpy(&addPoint[1], &path[17]);
 		else
 			strcpy(newPath, &path[17]);
-		image = loadPhase4(newPath, orgPath, context, exceptions);
+		image = loadPhase4(newPath, orgPath, context, cacheIndex, exceptions);
 		if ( image != NULL ) 
 			return image;
 
@@ -2631,20 +3334,22 @@
 		if ( realpath(sExecPath, resolvedPath) != NULL ) {
 			char newRealPath[strlen(resolvedPath) + strlen(path)];
 			strcpy(newRealPath, resolvedPath);
-			char* addPoint = strrchr(newRealPath,'/');
+			addPoint = strrchr(newRealPath,'/');
 			if ( addPoint != NULL )
 				strcpy(&addPoint[1], &path[17]);
 			else
 				strcpy(newRealPath, &path[17]);
-			image = loadPhase4(newRealPath, orgPath, context, exceptions);
+			image = loadPhase4(newRealPath, orgPath, context, cacheIndex, exceptions);
 			if ( image != NULL ) 
 				return image;
 		}
 	}
 	else if ( (strncmp(path, "@loader_path/", 13) == 0) && (context.origin != NULL) ) {
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 		// @loader_path cannot be used from the main executable of a setuid process rdar://problem/4589305
-		if ( sProcessIsRestricted && (strcmp(context.origin, sExecPath) == 0) )
+		if ( gLinkContext.processIsRestricted && (strcmp(context.origin, sExecPath) == 0) )
 			throwf("unsafe use of @loader_path in %s with restricted binary", context.origin);
+#endif
 		// handle @loader_path path prefix
 		char newPath[strlen(context.origin) + strlen(path)];
 		strcpy(newPath, context.origin);
@@ -2653,7 +3358,7 @@
 			strcpy(&addPoint[1], &path[13]);
 		else
 			strcpy(newPath, &path[13]);
-		image = loadPhase4(newPath, orgPath, context, exceptions);
+		image = loadPhase4(newPath, orgPath, context, cacheIndex, exceptions);
 		if ( image != NULL ) 
 			return image;
 		
@@ -2662,12 +3367,12 @@
 		if ( realpath(context.origin, resolvedPath) != NULL ) {
 			char newRealPath[strlen(resolvedPath) + strlen(path)];
 			strcpy(newRealPath, resolvedPath);
-			char* addPoint = strrchr(newRealPath,'/');
+			addPoint = strrchr(newRealPath,'/');
 			if ( addPoint != NULL )
 				strcpy(&addPoint[1], &path[13]);
 			else
 				strcpy(newRealPath, &path[13]);
-			image = loadPhase4(newRealPath, orgPath, context, exceptions);
+			image = loadPhase4(newRealPath, orgPath, context, cacheIndex, exceptions);
 			if ( image != NULL ) 
 				return image;
 		}
@@ -2681,9 +3386,10 @@
 					const char* anRPath = *it;
 					char newPath[strlen(anRPath) + strlen(trailingPath)+2];
 					strcpy(newPath, anRPath);
-					strcat(newPath, "/"); 
+					if ( newPath[strlen(newPath)-1] != '/' )
+						strcat(newPath, "/");
 					strcat(newPath, trailingPath); 
-					image = loadPhase4(newPath, orgPath, context, exceptions);
+					image = loadPhase4(newPath, orgPath, context, cacheIndex, exceptions);
 					if ( gLinkContext.verboseRPaths && (exceptions != NULL) ) {
 						if ( image != NULL ) 
 							dyld::log("RPATH successful expansion of %s to: %s\n", orgPath, newPath);
@@ -2698,7 +3404,7 @@
 		
 		// substitute @rpath with LD_LIBRARY_PATH
 		if ( sEnv.LD_LIBRARY_PATH != NULL ) {
-			image = loadPhase2(trailingPath, orgPath, context, NULL, sEnv.LD_LIBRARY_PATH, exceptions);
+			image = loadPhase2(trailingPath, orgPath, context, NULL, sEnv.LD_LIBRARY_PATH, cacheIndex, exceptions);
 			if ( image != NULL )
 				return image;
 		}
@@ -2707,32 +3413,34 @@
 		if ( (exceptions != NULL) && (trailingPath != path) )
 			return NULL;
 	}
-	else if (sProcessIsRestricted && (path[0] != '/' )) {
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+	else if ( gLinkContext.processIsRestricted && (path[0] != '/' ) ) {
 		throwf("unsafe use of relative rpath %s in %s with restricted binary", path, context.origin);
 	}
-	
-	return loadPhase4(path, orgPath, context, exceptions);
+#endif
+	
+	return loadPhase4(path, orgPath, context, cacheIndex, exceptions);
 }
 
 
 // try search paths
-static ImageLoader* loadPhase2(const char* path, const char* orgPath, const LoadContext& context, 
+static ImageLoader* loadPhase2(const char* path, const char* orgPath, const LoadContext& context,
 							   const char* const frameworkPaths[], const char* const libraryPaths[], 
-							   std::vector<const char*>* exceptions)
+							   unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	ImageLoader* image = NULL;
 	const char* frameworkPartialPath = getFrameworkPartialPath(path);
 	if ( frameworkPaths != NULL ) {
 		if ( frameworkPartialPath != NULL ) {
-			const int frameworkPartialPathLen = strlen(frameworkPartialPath);
+			const size_t frameworkPartialPathLen = strlen(frameworkPartialPath);
 			for(const char* const* fp = frameworkPaths; *fp != NULL; ++fp) {
 				char npath[strlen(*fp)+frameworkPartialPathLen+8];
 				strcpy(npath, *fp);
 				strcat(npath, "/");
 				strcat(npath, frameworkPartialPath);
 				//dyld::log("dyld: fallback framework path used: %s() -> loadPhase4(\"%s\", ...)\n", __func__, npath);
-				image = loadPhase4(npath, orgPath, context, exceptions);
+				image = loadPhase4(npath, orgPath, context, cacheIndex, exceptions);
 				if ( image != NULL )
 					return image;
 			}
@@ -2742,14 +3450,14 @@
 	// <rdar://problem/14160846> Some apps depend on frameworks being found via library paths
 	if ( (libraryPaths != NULL) && ((frameworkPartialPath == NULL) || sFrameworksFoundAsDylibs) ) {
 		const char* libraryLeafName = getLibraryLeafName(path);
-		const int libraryLeafNameLen = strlen(libraryLeafName);
+		const size_t libraryLeafNameLen = strlen(libraryLeafName);
 		for(const char* const* lp = libraryPaths; *lp != NULL; ++lp) {
 			char libpath[strlen(*lp)+libraryLeafNameLen+8];
 			strcpy(libpath, *lp);
 			strcat(libpath, "/");
 			strcat(libpath, libraryLeafName);
 			//dyld::log("dyld: fallback library path used: %s() -> loadPhase4(\"%s\", ...)\n", __func__, libpath);
-			image = loadPhase4(libpath, orgPath, context, exceptions);
+			image = loadPhase4(libpath, orgPath, context, cacheIndex, exceptions);
 			if ( image != NULL )
 				return image;
 		}
@@ -2758,27 +3466,27 @@
 }
 
 // try search overrides and fallbacks
-static ImageLoader* loadPhase1(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase1(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 	ImageLoader* image = NULL;
 
 	// handle LD_LIBRARY_PATH environment variables that force searching
 	if ( context.useLdLibraryPath && (sEnv.LD_LIBRARY_PATH != NULL) ) {
-		image = loadPhase2(path, orgPath, context, NULL, sEnv.LD_LIBRARY_PATH, exceptions);
+		image = loadPhase2(path, orgPath, context,  NULL, sEnv.LD_LIBRARY_PATH, cacheIndex,exceptions);
 		if ( image != NULL )
 			return image;
 	}
 
 	// handle DYLD_ environment variables that force searching
 	if ( context.useSearchPaths && ((sEnv.DYLD_FRAMEWORK_PATH != NULL) || (sEnv.DYLD_LIBRARY_PATH != NULL)) ) {
-		image = loadPhase2(path, orgPath, context, sEnv.DYLD_FRAMEWORK_PATH, sEnv.DYLD_LIBRARY_PATH, exceptions);
+		image = loadPhase2(path, orgPath, context, sEnv.DYLD_FRAMEWORK_PATH, sEnv.DYLD_LIBRARY_PATH, cacheIndex, exceptions);
 		if ( image != NULL )
 			return image;
 	}
 	
 	// try raw path
-	image = loadPhase3(path, orgPath, context, exceptions);
+	image = loadPhase3(path, orgPath, context, cacheIndex, exceptions);
 	if ( image != NULL )
 		return image;
 	
@@ -2787,7 +3495,7 @@
 	if ( (fallbackLibraryPaths != NULL) && !context.useFallbackPaths )
 		fallbackLibraryPaths = NULL;
 	if ( !context.dontLoad  && (exceptions != NULL) && ((sEnv.DYLD_FALLBACK_FRAMEWORK_PATH != NULL) || (fallbackLibraryPaths != NULL)) ) {
-		image = loadPhase2(path, orgPath, context, sEnv.DYLD_FALLBACK_FRAMEWORK_PATH, fallbackLibraryPaths, exceptions);
+		image = loadPhase2(path, orgPath, context, sEnv.DYLD_FALLBACK_FRAMEWORK_PATH, fallbackLibraryPaths, cacheIndex, exceptions);
 		if ( image != NULL )
 			return image;
 	}
@@ -2796,25 +3504,37 @@
 }
 
 // try root substitutions
-static ImageLoader* loadPhase0(const char* path, const char* orgPath, const LoadContext& context, std::vector<const char*>* exceptions)
+static ImageLoader* loadPhase0(const char* path, const char* orgPath, const LoadContext& context, unsigned& cacheIndex, std::vector<const char*>* exceptions)
 {
 	//dyld::log("%s(%s, %p)\n", __func__ , path, exceptions);
 
+#if SUPPORT_ROOT_PATH
 	// handle DYLD_ROOT_PATH which forces absolute paths to use a new root
 	if ( (gLinkContext.rootPaths != NULL) && (path[0] == '/') ) {
 		for(const char* const* rootPath = gLinkContext.rootPaths ; *rootPath != NULL; ++rootPath) {
 			char newPath[strlen(*rootPath) + strlen(path)+2];
 			strcpy(newPath, *rootPath);
 			strcat(newPath, path);
-			ImageLoader* image = loadPhase1(newPath, orgPath, context, exceptions);
+			ImageLoader* image = loadPhase1(newPath, orgPath, context, cacheIndex, exceptions);
 			if ( image != NULL )
 				return image;
 		}
 	}
+#endif
 
 	// try raw path
-	return loadPhase1(path, orgPath, context, exceptions);
-}
+	return loadPhase1(path, orgPath, context, cacheIndex, exceptions);
+}
+
+#if DYLD_SHARED_CACHE_SUPPORT
+	static bool cacheablePath(const char* path) {
+		if (strncmp(path, "/usr/lib/", 9) == 0)
+			return true;
+		if (strncmp(path, "/System/Library/", 16) == 0)
+			return true;
+		return false;
+	}
+#endif
 
 //
 // Given all the DYLD_ environment variables, the general case for loading libraries
@@ -2830,10 +3550,11 @@
 // the path.  Either time, if an image is found, the phases all unwind without checking
 // for other paths.
 //
-ImageLoader* load(const char* path, const LoadContext& context)
+ImageLoader* load(const char* path, const LoadContext& context, unsigned& cacheIndex)
 {
 	CRSetCrashLogMessage2(path);
 	const char* orgPath = path;
+	cacheIndex = UINT32_MAX;
 	
 	//dyld::log("%s(%s)\n", __func__ , path);
 	char realPath[PATH_MAX];
@@ -2844,7 +3565,8 @@
 	}
 	
 	// try all path permutations and check against existing loaded images
-	ImageLoader* image = loadPhase0(path, orgPath, context, NULL);
+
+	ImageLoader* image = loadPhase0(path, orgPath, context, cacheIndex, NULL);
 	if ( image != NULL ) {
 		CRSetCrashLogMessage2(NULL);
 		return image;
@@ -2852,20 +3574,45 @@
 
 	// try all path permutations and try open() until first success
 	std::vector<const char*> exceptions;
-	image = loadPhase0(path, orgPath, context, &exceptions);
+	image = loadPhase0(path, orgPath, context, cacheIndex, &exceptions);
+#if __IPHONE_OS_VERSION_MIN_REQUIRED && DYLD_SHARED_CACHE_SUPPORT && !TARGET_IPHONE_SIMULATOR
+	// <rdar://problem/16704628> support symlinks on disk to a path in dyld shared cache
+	if ( (image == NULL) && cacheablePath(path) && !context.dontLoad ) {
+		char resolvedPath[PATH_MAX];
+		realpath(path, resolvedPath);
+		int myerr = errno;
+		// If realpath() resolves to a path which does not exist on disk, errno is set to ENOENT
+		if ( (myerr == ENOENT) || (myerr == 0) )
+		{
+			// see if this image is in shared cache
+			const macho_header* mhInCache;
+			const char*			pathInCache;
+			long				slideInCache;
+			if ( findInSharedCacheImage(resolvedPath, false, NULL, &mhInCache, &pathInCache, &slideInCache) ) {
+				struct stat stat_buf;
+				bzero(&stat_buf, sizeof(stat_buf));
+				try {
+					image = ImageLoaderMachO::instantiateFromCache(mhInCache, pathInCache, slideInCache, stat_buf, gLinkContext);
+					image = checkandAddImage(image, context);
+				}
+				catch (...) {
+					image = NULL;
+				}
+			}
+		}
+	}
+#endif
     CRSetCrashLogMessage2(NULL);
 	if ( image != NULL ) {
 		// <rdar://problem/6916014> leak in dyld during dlopen when using DYLD_ variables
 		for (std::vector<const char*>::iterator it = exceptions.begin(); it != exceptions.end(); ++it) {
 			free((void*)(*it));
 		}
-#if __IPHONE_OS_VERSION_MIN_REQUIRED && DYLD_SHARED_CACHE_SUPPORT
+#if DYLD_SHARED_CACHE_SUPPORT
 		// if loaded image is not from cache, but original path is in cache
 		// set gSharedCacheOverridden flag to disable some ObjC optimizations
-		if ( !gSharedCacheOverridden ) {
-			if ( !image->inSharedCache() && inSharedCache(path) ) {
-				gSharedCacheOverridden = true;
-			}
+		if ( !gSharedCacheOverridden && !image->inSharedCache() && image->isDylib() && cacheablePath(path) && inSharedCache(path) ) {
+			gSharedCacheOverridden = true;
 		}
 #endif
 		return image;
@@ -2881,11 +3628,11 @@
 		const char* msgStart = "no suitable image found.  Did find:";
 		const char* delim = "\n\t";
 		size_t allsizes = strlen(msgStart)+8;
-		for (unsigned int i=0; i < exceptions.size(); ++i) 
+		for (size_t i=0; i < exceptions.size(); ++i) 
 			allsizes += (strlen(exceptions[i]) + strlen(delim));
 		char* fullMsg = new char[allsizes];
 		strcpy(fullMsg, msgStart);
-		for (unsigned int i=0; i < exceptions.size(); ++i) {
+		for (size_t i=0; i < exceptions.size(); ++i) {
 			strcat(fullMsg, delim);
 			strcat(fullMsg, exceptions[i]);
 			free((void*)exceptions[i]);
@@ -2906,6 +3653,8 @@
 #elif __x86_64__
 	#define ARCH_NAME			"x86_64"
 	#define ARCH_CACHE_MAGIC	"dyld_v1  x86_64"
+	#define ARCH_NAME_H			"x86_64h"
+	#define ARCH_CACHE_MAGIC_H	"dyld_v1 x86_64h"
 #elif __ARM_ARCH_5TEJ__
 	#define ARCH_NAME			"armv5"
 	#define ARCH_CACHE_MAGIC	"dyld_v1   armv5"
@@ -2915,15 +3664,18 @@
 #elif __ARM_ARCH_7F__
 	#define ARCH_NAME			"armv7f"
 	#define ARCH_CACHE_MAGIC	"dyld_v1  armv7f"
+#elif __ARM_ARCH_7K__
+	#define ARCH_NAME			"armv7k"
+	#define ARCH_CACHE_MAGIC	"dyld_v1  armv7k"
 #elif __ARM_ARCH_7A__
 	#define ARCH_NAME			"armv7"
 	#define ARCH_CACHE_MAGIC	"dyld_v1   armv7"
 #elif __ARM_ARCH_7S__
 	#define ARCH_NAME			"armv7s"
 	#define ARCH_CACHE_MAGIC	"dyld_v1  armv7s"
-#elif __ARM_ARCH_7K__
-	#define ARCH_NAME			"armv7k"
-	#define ARCH_CACHE_MAGIC	"dyld_v1  armv7k"
+#elif __arm64__
+	#define ARCH_NAME			"arm64"
+	#define ARCH_CACHE_MAGIC	"dyld_v1   arm64"
 #endif
 
 
@@ -2935,21 +3687,68 @@
 }
 
 
+static void rebaseChain(uint8_t* pageContent, uint16_t startOffset, uintptr_t slideAmount, const dyld_cache_slide_info2* slideInfo)
+{
+    const uintptr_t   deltaMask    = (uintptr_t)(slideInfo->delta_mask);
+    const uintptr_t   valueMask    = ~deltaMask;
+    const uintptr_t   valueAdd     = (uintptr_t)(slideInfo->value_add);
+    const unsigned	  deltaShift   = __builtin_ctzll(deltaMask) - 2;
+
+	uint32_t pageOffset = startOffset;
+	uint32_t delta = 1;
+	while ( delta != 0 ) {
+		uint8_t* loc = pageContent + pageOffset;
+		uintptr_t rawValue = *((uintptr_t*)loc);
+		delta = (uint32_t)((rawValue & deltaMask) >> deltaShift);
+		uintptr_t value = (rawValue & valueMask);
+		if ( value != 0 ) {
+			value += valueAdd;
+			value += slideAmount;
+		}
+		*((uintptr_t*)loc) = value;
+		//dyld::log("         pageOffset=0x%03X, loc=%p, org value=0x%08llX, new value=0x%08llX, delta=0x%X\n", pageOffset, loc, (uint64_t)rawValue, (uint64_t)value, delta);
+		pageOffset += delta;
+	}
+}
+
+
+static void loadAndCheckCodeSignature(int fd, uint32_t count, const shared_file_mapping_np mappings[],
+									off_t codeSignatureOffset, size_t codeSignatureSize,
+									const void *firstPages, size_t firstPagesSize)
+{
+	// register code signature blob for whole dyld cache
+	fsignatures_t siginfo;
+	siginfo.fs_file_start = 0;  // cache always starts at beginning of file
+	siginfo.fs_blob_start = (void*)codeSignatureOffset;
+	siginfo.fs_blob_size  = codeSignatureSize;
+
+	int result = fcntl(fd, F_ADDFILESIGS_RETURN, &siginfo);
+		// <rdar://problem/12891874> don't warn in chrooted case because mapping syscall is about to fail too
+	if ( result == -1 ) {
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+		throwf("code signature registration for shared cache failed with errno=%d\n", errno);
+#else
+		if ( gLinkContext.verboseMapping )
+			dyld::log("dyld: code signature registration for shared cache failed with errno=%d\n", errno);
+#endif
+	}
+	uint64_t codeSignedLength = siginfo.fs_file_start;
+	for (uint32_t i = 0; i < count; ++i) {
+		if ( (mappings[i].sfm_size > codeSignedLength) || (mappings[i].sfm_file_offset > (codeSignedLength - mappings[i].sfm_size)) )
+			throw "dyld shared cache mapping not covered by code signature";
+	}
+
+	void *fdata = xmmap(NULL, firstPagesSize, PROT_READ|PROT_EXEC, MAP_PRIVATE, fd, 0);
+	if ( fdata == MAP_FAILED )
+		throwf("mmap() errno=%d validating first page of shared cache", errno);
+	if ( memcmp(fdata, firstPages, firstPagesSize) != 0 )
+		throwf("mmap() page compare failed for shared cache");
+	munmap(fdata, firstPagesSize);
+}
+
 static int __attribute__((noinline)) _shared_region_map_and_slide_np(int fd, uint32_t count, const shared_file_mapping_np mappings[],
-												int codeSignatureMappingIndex, int slide, void* slideInfo, uint32_t slideInfoSize)
-{
-	// register code signature blob for whole dyld cache
-	if ( codeSignatureMappingIndex != -1 ) {
-		fsignatures_t siginfo;
-		siginfo.fs_file_start = 0;  // cache always starts at beginning of file
-		siginfo.fs_blob_start = (void*)mappings[codeSignatureMappingIndex].sfm_file_offset;
-		siginfo.fs_blob_size  = mappings[codeSignatureMappingIndex].sfm_size;
-		int result = fcntl(fd, F_ADDFILESIGS, &siginfo);
-		// <rdar://problem/12891874> don't warn in chrooted case because mapping syscall is about to fail too
-		if ( (result == -1) && gLinkContext.verboseMapping )
-			dyld::log("dyld: code signature registration for shared cache failed with errno=%d\n", errno);
-	}
-
+												long slide, void* slideInfo, unsigned long slideInfoSize)
+{
 	if ( gLinkContext.sharedRegionMode == ImageLoader::kUseSharedRegion ) {
 		return syscall(438, fd, count, mappings, slide, slideInfo, slideInfoSize);
 	}
@@ -2991,9 +3790,40 @@
 	}
 
 	// update all __DATA pages with slide info
-	if ( slide != 0 ) {
+	const dyld_cache_slide_info* slideInfoHeader = (dyld_cache_slide_info*)slideInfo;
+	if ( slideInfoHeader->version == 2 ) {
+		const dyld_cache_slide_info2* slideHeader = (dyld_cache_slide_info2*)slideInfo;
+		const uint32_t  page_size = slideHeader->page_size;
+		const uint16_t* page_starts = (uint16_t*)((long)(slideInfo) + slideHeader->page_starts_offset);
+		const uint16_t* page_extras = (uint16_t*)((long)(slideInfo) + slideHeader->page_extras_offset);
 		const uintptr_t dataPagesStart = mappings[1].sfm_address;
-		const dyld_cache_slide_info* slideInfoHeader = (dyld_cache_slide_info*)slideInfo;
+		for (int i=0; i < slideHeader->page_starts_count; ++i) {
+			uint8_t* page = (uint8_t*)(long)(dataPagesStart + (page_size*i));
+			uint16_t pageEntry = page_starts[i];
+			//dyld::log("page[%d]: page_starts[i]=0x%04X\n", i, pageEntry);
+			if ( pageEntry == DYLD_CACHE_SLIDE_PAGE_ATTR_NO_REBASE )
+				continue;
+			if ( pageEntry & DYLD_CACHE_SLIDE_PAGE_ATTR_EXTRA ) {
+				uint16_t chainIndex = (pageEntry & 0x3FFF);
+				bool done = false;
+				while ( !done ) {
+					uint16_t info = page_extras[chainIndex];
+					uint16_t pageStartOffset = (info & 0x3FFF)*4;
+					//dyld::log("     chain[%d] pageOffset=0x%03X\n", chainIndex, pageStartOffset);
+					rebaseChain(page, pageStartOffset, slide, slideHeader);
+					done = (info & DYLD_CACHE_SLIDE_PAGE_ATTR_END);
+					++chainIndex;
+				}
+			}
+			else {
+				uint32_t pageOffset = pageEntry * 4;
+				//dyld::log("     start pageOffset=0x%03X\n", pageOffset);
+				rebaseChain(page, pageOffset, slide, slideHeader);
+			}
+		}
+	}
+	else if ( slide != 0 ) {
+		const uintptr_t dataPagesStart = mappings[1].sfm_address;
 		const uint16_t* toc = (uint16_t*)((long)(slideInfoHeader) + slideInfoHeader->toc_offset);
 		const uint8_t* entries = (uint8_t*)((long)(slideInfoHeader) + slideInfoHeader->entries_offset);
 		for(uint32_t i=0; i < slideInfoHeader->toc_count; ++i) {
@@ -3029,13 +3859,73 @@
 	return sSharedCache;
 }
 
+const char* getStandardSharedCacheFilePath()
+{
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+	return IPHONE_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME;
+#else
+  #if __x86_64__
+	if ( sHaswell ) {
+		const char* path2 = MACOSX_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME_H;
+		struct stat statBuf;
+		if ( my_stat(path2, &statBuf) == 0 )
+			return path2;
+	}
+  #endif
+	return MACOSX_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME;
+#endif
+}
+
 int openSharedCacheFile()
 {
 	char path[MAXPATHLEN];
 	strlcpy(path, sSharedCacheDir, MAXPATHLEN);
 	strlcat(path, "/", MAXPATHLEN);
+#if __x86_64__
+	if ( sHaswell ) {
+		strlcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME_H, MAXPATHLEN);
+		int fd = my_open(path, O_RDONLY, 0);
+		if ( fd != -1 ) {
+			if ( gLinkContext.verboseMapping ) 
+				dyld::log("dyld: Mapping%s shared cache from %s\n", (gLinkContext.sharedRegionMode == ImageLoader::kUsePrivateSharedRegion) ? " private": "", path);
+			return fd;
+		}
+		strlcpy(path, sSharedCacheDir, MAXPATHLEN);
+	}
+#endif
 	strlcat(path, DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME, MAXPATHLEN);
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+	struct stat enableStatBuf;
+	struct stat devCacheStatBuf;
+	struct stat prodCacheStatBuf;
+	if ( ((my_stat(IPHONE_DYLD_SHARED_CACHE_DIR "enable-dylibs-to-override-cache", &enableStatBuf) == 0)
+			&& (enableStatBuf.st_size < ENABLE_DYLIBS_TO_OVERRIDE_CACHE_SIZE)
+			&& (my_stat(IPHONE_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME DYLD_SHARED_CACHE_DEVELOPMENT_EXT, &devCacheStatBuf) == 0))
+		|| (my_stat(IPHONE_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME, &prodCacheStatBuf) != 0))
+		strlcat(path, DYLD_SHARED_CACHE_DEVELOPMENT_EXT, MAXPATHLEN);
+#endif
+	if ( gLinkContext.verboseMapping )
+		dyld::log("dyld: Mapping%s shared cache from %s\n", (gLinkContext.sharedRegionMode == ImageLoader::kUsePrivateSharedRegion) ? " private": "", path);
 	return my_open(path, O_RDONLY, 0);
+}
+
+
+static void getCacheBounds(uint32_t mappingsCount, const shared_file_mapping_np mappings[], uint64_t& lowAddress, uint64_t& highAddress)
+{
+	lowAddress = 0;
+	highAddress = 0;
+	for(uint32_t i=0; i < mappingsCount; ++i) {
+		if ( lowAddress == 0 ) {
+			lowAddress = mappings[i].sfm_address;
+			highAddress = mappings[i].sfm_address + mappings[i].sfm_size;
+		}
+		else {
+			if ( mappings[i].sfm_address < lowAddress )
+				lowAddress = mappings[i].sfm_address;
+			if ( (mappings[i].sfm_address + mappings[i].sfm_size) > highAddress )
+				highAddress = mappings[i].sfm_address + mappings[i].sfm_size;
+		}
+	}
 }
 
 static long pickCacheSlide(uint32_t mappingsCount, shared_file_mapping_np mappings[])
@@ -3068,29 +3958,23 @@
 	// else fall through to handle old style cache
 #endif
 	// get bounds of cache
-	uint64_t lowAddress = 0;
-	uint64_t highAddress = 0;
-	for(uint32_t i=0; i < mappingsCount; ++i) {
-		if ( lowAddress == 0 ) {
-			lowAddress = mappings[i].sfm_address;
-			highAddress = mappings[i].sfm_address + mappings[i].sfm_size;
-		}
-		else {
-			if ( mappings[i].sfm_address < lowAddress )
-				lowAddress = mappings[i].sfm_address;
-			if ( (mappings[i].sfm_address + mappings[i].sfm_size) > highAddress )
-				highAddress = mappings[i].sfm_address + mappings[i].sfm_size;
-		}
-	}
+	uint64_t lowAddress;
+	uint64_t highAddress;
+	getCacheBounds(mappingsCount, mappings, lowAddress, highAddress);
 	
 	// find slop space
 	const uint64_t space = (SHARED_REGION_BASE + SHARED_REGION_SIZE) - highAddress;
 	
 	// choose new random slide
-	long slide = (arc4random() % space) & (-4096);
+#if __arm__
+	// <rdar://problem/20848977> change shared cache slide for 32-bit arm to always be 16k aligned
+	long slide = ((arc4random() % space) & (-16384));
+#else
+	long slide = dyld_page_trunc(arc4random() % space);
+#endif
 	//dyld::log("slideSpace=0x%0llX\n", space);
 	//dyld::log("slide=0x%0lX\n", slide);
-	
+
 	// update mappings
 	for(uint32_t i=0; i < mappingsCount; ++i) {
 		mappings[i].sfm_address += slide;
@@ -3102,11 +3986,16 @@
 static void mapSharedCache()
 {
 	uint64_t cacheBaseAddress = 0;
-	// quick check if a cache is alreay mapped into shared region
+	// quick check if a cache is already mapped into shared region
 	if ( _shared_region_check_np(&cacheBaseAddress) == 0 ) {
 		sSharedCache = (dyld_cache_header*)cacheBaseAddress;
 		// if we don't understand the currently mapped shared cache, then ignore
-		if ( strcmp(sSharedCache->magic, ARCH_CACHE_MAGIC) != 0 ) {
+#if __x86_64__
+		const char* magic = (sHaswell ? ARCH_CACHE_MAGIC_H : ARCH_CACHE_MAGIC);
+#else
+		const char* magic = ARCH_CACHE_MAGIC;
+#endif
+		if ( strcmp(sSharedCache->magic, magic) != 0 ) {
 			sSharedCache = NULL;
 			if ( gLinkContext.verboseMapping ) {
 				dyld::log("dyld: existing shared cached in memory is not compatible\n");
@@ -3122,11 +4011,26 @@
 			const uint8_t* preferedLoadAddress = (uint8_t*)(long)(mappings[0].address);
 			sSharedCacheSlide = loadedAddress - preferedLoadAddress;
 			dyld::gProcessInfo->sharedCacheSlide = sSharedCacheSlide;
+			dyld::gProcessInfo->sharedCacheBaseAddress = cacheBaseAddress;
 			//dyld::log("sSharedCacheSlide=0x%08lX, loadedAddress=%p, preferedLoadAddress=%p\n", sSharedCacheSlide, loadedAddress, preferedLoadAddress);
 		}
 		// if cache has a uuid, copy it 
 		if ( header->mappingOffset >= 0x68 ) {
 			memcpy(dyld::gProcessInfo->sharedCacheUUID, header->uuid, 16);
+		}
+		// verbose logging
+		if ( gLinkContext.verboseMapping ) {
+			dyld::log("dyld: re-using existing %s shared cache mapping\n", (header->cacheType == kDyldSharedCacheTypeDevelopment ? "development" : "production"));
+		}
+		if (header->mappingOffset >= 0x68) {
+			dyld_kernel_image_info_t kernelCacheInfo;
+			memcpy(&kernelCacheInfo.uuid[0], &sSharedCache->uuid[0], sizeof(uuid_t));
+			kernelCacheInfo.load_addr = (uint64_t)sSharedCache;
+			kernelCacheInfo.fsobjid.fid_objno = 0;
+			kernelCacheInfo.fsobjid.fid_generation = 0;
+			kernelCacheInfo.fsid.val[0] = 0;
+			kernelCacheInfo.fsid.val[0] = 0;
+			task_register_dyld_shared_cache_image_info(mach_task_self(), kernelCacheInfo, false, false);
 		}
 	}
 	else {
@@ -3160,12 +4064,27 @@
 			uint8_t firstPages[8192];
 			if ( ::read(fd, firstPages, 8192) == 8192 ) {
 				dyld_cache_header* header = (dyld_cache_header*)firstPages;
-				if ( strcmp(header->magic, ARCH_CACHE_MAGIC) == 0 ) {
+		#if __x86_64__
+				const char* magic = (sHaswell ? ARCH_CACHE_MAGIC_H : ARCH_CACHE_MAGIC);
+		#else
+				const char* magic = ARCH_CACHE_MAGIC;
+		#endif
+				if ( strcmp(header->magic, magic) == 0 ) {
 					const dyld_cache_mapping_info* const fileMappingsStart = (dyld_cache_mapping_info*)&firstPages[header->mappingOffset];
 					const dyld_cache_mapping_info* const fileMappingsEnd = &fileMappingsStart[header->mappingCount];
-					shared_file_mapping_np	mappings[header->mappingCount+1]; // add room for code-sig 
+	#if __IPHONE_OS_VERSION_MIN_REQUIRED
+					if ( (header->mappingCount != 3)
+					  || (header->mappingOffset > 256)
+					  || (fileMappingsStart[0].fileOffset != 0)
+					  || (fileMappingsStart[0].address != SHARED_REGION_BASE)
+					  || ((fileMappingsStart[0].address + fileMappingsStart[0].size) > fileMappingsStart[1].address)
+					  || ((fileMappingsStart[1].address + fileMappingsStart[1].size) > fileMappingsStart[2].address)
+					  || ((fileMappingsStart[0].fileOffset + fileMappingsStart[0].size) != fileMappingsStart[1].fileOffset)
+					  || ((fileMappingsStart[1].fileOffset + fileMappingsStart[1].size) != fileMappingsStart[2].fileOffset) )
+						throw "dyld shared cache file is invalid";
+	#endif
+					shared_file_mapping_np	mappings[header->mappingCount];
 					unsigned int mappingCount = header->mappingCount;
-					int codeSignatureMappingIndex = -1;
 					int readWriteMappingIndex = -1;
 					int readOnlyMappingIndex = -1;
 					// validate that the cache file has not been truncated
@@ -3194,19 +4113,24 @@
 							}
 						}
 						// if shared cache is code signed, add a mapping for the code signature
-						uint32_t signatureSize = header->codeSignatureSize;
+						uint64_t signatureSize = header->codeSignatureSize;
 						// zero size in header means signature runs to end-of-file
 						if ( signatureSize == 0 )
 							signatureSize = stat_buf.st_size - header->codeSignatureOffset;
 						if ( signatureSize != 0 ) {
-                            int linkeditMapping = mappingCount-1;
-							codeSignatureMappingIndex = mappingCount++;
-							mappings[codeSignatureMappingIndex].sfm_address		= mappings[linkeditMapping].sfm_address + mappings[linkeditMapping].sfm_size;
-							mappings[codeSignatureMappingIndex].sfm_size		= (signatureSize+4095) & (-4096);
-							mappings[codeSignatureMappingIndex].sfm_file_offset	= header->codeSignatureOffset;
-							mappings[codeSignatureMappingIndex].sfm_max_prot	= VM_PROT_READ;
-							mappings[codeSignatureMappingIndex].sfm_init_prot	= VM_PROT_READ;
+#if __arm__ || __arm64__
+							size_t alignedSignatureSize		= (signatureSize+16383) & (-16384);
+#else
+							size_t alignedSignatureSize		= (signatureSize+4095) & (-4096);
+#endif
+							// <rdar://problem/23188073> validate code signature covers entire shared cache
+							loadAndCheckCodeSignature(fd, mappingCount, mappings, header->codeSignatureOffset, alignedSignatureSize, firstPages, sizeof(firstPages));
 						}
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+						else {
+							throw "dyld shared cache file not code signed";
+						}
+#endif
 					}
 #if __MAC_OS_X_VERSION_MIN_REQUIRED	
 					// sanity check that /usr/lib/libSystem.B.dylib stat() info matches cache
@@ -3228,7 +4152,17 @@
 							goodCache = false;
 						}
 					}
-#endif				
+#endif
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+					{
+						uint64_t lowAddress;
+						uint64_t highAddress;
+						getCacheBounds(mappingCount, mappings, lowAddress, highAddress);
+						if ( (highAddress-lowAddress) > SHARED_REGION_SIZE ) 
+							throw "dyld shared cache is too big to fit in shared region";
+					}
+#endif
+
 					if ( goodCache && (readWriteMappingIndex == -1) ) {
 						dyld::log("dyld: shared cached file is missing read/write mapping: %s" DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME "\n", sSharedCacheDir);
 						goodCache = false;
@@ -3239,35 +4173,68 @@
 					}
 					if ( goodCache ) {
 						long cacheSlide = 0;
-						void* slideInfo = NULL;
-						uint32_t slideInfoSize = 0;
+						void* slideInfo = (void*)(long)(mappings[readOnlyMappingIndex].sfm_address + (header->slideInfoOffset - mappings[readOnlyMappingIndex].sfm_file_offset));;
+						uint64_t slideInfoSize = header->slideInfoSize;
 						// check if shared cache contains slid info
-						if ( header->slideInfoSize != 0 ) {
+						if ( slideInfoSize != 0 ) {
 							// <rdar://problem/8611968> don't slide shared cache if ASLR disabled (main executable didn't slide)
-							if ( sMainExecutable->isPositionIndependentExecutable() && (sMainExecutable->getSlide() == 0) )
+							if ( sMainExecutable->isPositionIndependentExecutable() && (sMainExecutable->getSlide() == 0) ) {
 								cacheSlide = 0;
+							}
 							else {
 								// generate random slide amount
 								cacheSlide = pickCacheSlide(mappingCount, mappings);
-								slideInfo = (void*)(long)(mappings[readOnlyMappingIndex].sfm_address + (header->slideInfoOffset - mappings[readOnlyMappingIndex].sfm_file_offset));
-								slideInfoSize = header->slideInfoSize;
-								// add VM_PROT_SLIDE bit to __DATA area of cache
-								mappings[readWriteMappingIndex].sfm_max_prot  |= VM_PROT_SLIDE;
-								mappings[readWriteMappingIndex].sfm_init_prot |= VM_PROT_SLIDE;
+							}
+
+							slideInfo = (void*)((uint8_t*)slideInfo + cacheSlide);
+							// add VM_PROT_SLIDE bit to __DATA area of cache
+							mappings[readWriteMappingIndex].sfm_max_prot  |= VM_PROT_SLIDE;
+							mappings[readWriteMappingIndex].sfm_init_prot |= VM_PROT_SLIDE;
+						}
+						if ( gLinkContext.verboseMapping ) {
+							dyld::log("dyld: calling _shared_region_map_and_slide_np() with regions:\n");
+							for (int i=0; i < mappingCount; ++i) {
+								dyld::log("   address=0x%08llX, size=0x%08llX, fileOffset=0x%08llX\n", mappings[i].sfm_address, mappings[i].sfm_size, mappings[i].sfm_file_offset);
 							}
 						}
-						if (_shared_region_map_and_slide_np(fd, mappingCount, mappings, codeSignatureMappingIndex, cacheSlide, slideInfo, slideInfoSize) == 0) {
+
+						if (_shared_region_map_and_slide_np(fd, mappingCount, mappings, cacheSlide, slideInfo, slideInfoSize) == 0) {
 							// successfully mapped cache into shared region
 							sSharedCache = (dyld_cache_header*)mappings[0].sfm_address;
 							sSharedCacheSlide = cacheSlide;
 							dyld::gProcessInfo->sharedCacheSlide = cacheSlide;
+							dyld::gProcessInfo->sharedCacheBaseAddress = mappings[0].sfm_address;
 							//dyld::log("sSharedCache=%p sSharedCacheSlide=0x%08lX\n", sSharedCache, sSharedCacheSlide);
 							// if cache has a uuid, copy it
 							if ( header->mappingOffset >= 0x68 ) {
+								const bool privateSharedCache =  gLinkContext.sharedRegionMode == ImageLoader::kUsePrivateSharedRegion;
 								memcpy(dyld::gProcessInfo->sharedCacheUUID, header->uuid, 16);
+								dyld_kernel_image_info_t kernelCacheInfo;
+								memcpy(&kernelCacheInfo.uuid[0], &sSharedCache->uuid[0], sizeof(uuid_t));
+								kernelCacheInfo.load_addr = (uint64_t)sSharedCache;
+								kernelCacheInfo.fsobjid.fid_objno = 0;
+								kernelCacheInfo.fsobjid.fid_generation = 0;
+								kernelCacheInfo.fsid.val[0] = 0;
+								kernelCacheInfo.fsid.val[0] = 0;
+								if (privateSharedCache) {
+									kernelCacheInfo.fsobjid = *(fsobj_id_t*)(&stat_buf.st_ino);
+									struct statfs statfs_buf;
+									if ( fstatfs(fd, &statfs_buf) == 0 ) {
+										kernelCacheInfo.fsid = statfs_buf.f_fsid;
+									}
+								}
+								task_register_dyld_shared_cache_image_info(mach_task_self(), kernelCacheInfo, false, privateSharedCache);
 							}
 						}
 						else {
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+							throwf("dyld shared cache could not be mapped.  errno=%d, slide=0x%08lX, slideInfo=%p, slideInfoSize=0x%08llX, mappingCount=%u, "
+								   "address/size/off/init/max [0]=0x%0llX/0x%0llX/0x%0llX/0x%02X/0x%02X, [1]=0x%0llX/0x%0llX/0x%0llX/0x%02X/0x%02X, [2]=0x%0llX/0x%0llX/0x%0llX/0x%02X/0x%02X",
+								   errno, cacheSlide, slideInfo, slideInfoSize, mappingCount,
+								   mappings[0].sfm_address, mappings[0].sfm_size, mappings[0].sfm_file_offset, mappings[0].sfm_init_prot, mappings[0].sfm_max_prot,
+								   mappings[1].sfm_address, mappings[1].sfm_size, mappings[1].sfm_file_offset, mappings[1].sfm_init_prot, mappings[1].sfm_max_prot,
+								   mappings[2].sfm_address, mappings[2].sfm_size, mappings[2].sfm_file_offset, mappings[2].sfm_init_prot, mappings[2].sfm_max_prot);
+#endif
 							if ( gLinkContext.verboseMapping ) 
 								dyld::log("dyld: shared cached file could not be mapped\n");
 						}
@@ -3302,12 +4269,6 @@
 		// only room to tell gdb about first four regions
 		if ( dyld_shared_cache_ranges.sharedRegionsCount > 4 )
 			dyld_shared_cache_ranges.sharedRegionsCount = 4;
-		if ( gLinkContext.verboseMapping ) {
-			if ( gLinkContext.sharedRegionMode == ImageLoader::kUseSharedRegion )
-				dyld::log("dyld: Mapping shared cache from %s/" DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME "\n", sSharedCacheDir);
-			else if ( gLinkContext.sharedRegionMode == ImageLoader::kUsePrivateSharedRegion )
-				dyld::log("dyld: Mapping private shared cache from %s/" DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME "\n", sSharedCacheDir);
-		}
 		const dyld_cache_mapping_info* const end = &start[dyld_shared_cache_ranges.sharedRegionsCount];
 		int index = 0;
 		for (const dyld_cache_mapping_info* p = start; p < end; ++p, ++index ) {
@@ -3339,11 +4300,12 @@
 		if ( gLinkContext.verboseMapping ) {
 			// list the code blob
 			dyld_cache_header* header = (dyld_cache_header*)sSharedCache;
-			uint32_t signatureSize = header->codeSignatureSize;
+			uint64_t signatureSize = header->codeSignatureSize;
 			// zero size in header means signature runs to end-of-file
 			if ( signatureSize == 0 ) {
 				struct stat stat_buf;
-				if ( my_stat(IPHONE_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME, &stat_buf) == 0 ) 
+				// FIXME: need size of cache file actually used
+				if ( my_stat(IPHONE_DYLD_SHARED_CACHE_DIR DYLD_SHARED_CACHE_BASE_NAME ARCH_NAME, &stat_buf) == 0 )
 					signatureSize = stat_buf.st_size - header->codeSignatureOffset;
 			}
 			if ( signatureSize != 0 ) {
@@ -3352,11 +4314,11 @@
 				dyld::log("        0x%08llX->0x%08llX (code signature)\n", codeBlobStart, codeBlobStart+signatureSize);
 			}
 		}
-#if __IPHONE_OS_VERSION_MIN_REQUIRED
-		// check for file that enables dyld shared cache dylibs to be overridden
-		struct stat enableStatBuf;
-		sDylibsOverrideCache = ( my_stat(IPHONE_DYLD_SHARED_CACHE_DIR "enable-dylibs-to-override-cache", &enableStatBuf) == 0 );
-#endif	
+	#if SUPPORT_ACCELERATE_TABLES
+		if ( !dylibsCanOverrideCache() && !sDisableAcceleratorTables && (sSharedCache->mappingOffset > 0x80) && (sSharedCache->accelerateInfoAddr != 0) ) {
+			sAllCacheImagesProxy = ImageLoaderMegaDylib::makeImageLoaderMegaDylib(sSharedCache, sSharedCacheSlide, gLinkContext);
+		}
+	#endif
 	}
 }
 #endif // #if DYLD_SHARED_CACHE_SUPPORT
@@ -3441,10 +4403,22 @@
 		if ( image->getState() >= dyld_image_state_bound && image->getState() < dyld_image_state_terminated )
 			(*func)(image->machHeader(), image->getSlide());
 	}
+#if SUPPORT_ACCELERATE_TABLES
+	if ( sAllCacheImagesProxy != NULL ) {
+		dyld_image_info	infos[allImagesCount()+1];
+		unsigned cacheCount = sAllCacheImagesProxy->appendImagesToNotify(dyld_image_state_bound, true, infos);
+		for (unsigned i=0; i < cacheCount; ++i) {
+			(*func)(infos[i].imageLoadAddress, sSharedCacheSlide);
+		}
+	}
+#endif
 }
 
 void registerRemoveCallback(ImageCallback func)
 {
+	// <rdar://problem/15025198> ignore calls to register a notification during a notification
+	if ( sRemoveImageCallbacksInUse )
+		return;
 	sRemoveImageCallbacks.push_back(func);
 }
 
@@ -3464,16 +4438,40 @@
 	return error_string;
 }
 
-
 void halt(const char* message)
 {
 	dyld::log("dyld: %s\n", message);
 	setErrorMessage(message);
-	uintptr_t terminationFlags = 0;
-	if ( !gLinkContext.startedInitializingMainExecutable ) 
-		terminationFlags = 1;
-	setAlImageInfosHalt(error_string, terminationFlags);
-	dyld_fatal_error(error_string);
+	dyld::gProcessInfo->errorMessage = error_string;
+	if ( !gLinkContext.startedInitializingMainExecutable )
+		dyld::gProcessInfo->terminationFlags = 1;
+	else
+		dyld::gProcessInfo->terminationFlags = 0;
+
+	char payloadBuffer[EXIT_REASON_PAYLOAD_MAX_LEN];
+	dyld_abort_payload* payload = (dyld_abort_payload*)payloadBuffer;
+	payload->version               = 1;
+	payload->flags                 = gLinkContext.startedInitializingMainExecutable ? 0 : 1;
+	payload->targetDylibPathOffset = 0;
+	payload->clientPathOffset      = 0;
+	payload->symbolOffset          = 0;
+	int payloadSize = sizeof(dyld_abort_payload);
+
+	if ( dyld::gProcessInfo->errorTargetDylibPath != NULL ) {
+		payload->targetDylibPathOffset = payloadSize;
+		payloadSize += strlcpy(&payloadBuffer[payloadSize], dyld::gProcessInfo->errorTargetDylibPath, sizeof(payloadBuffer)-payloadSize) + 1;
+	}
+	if ( dyld::gProcessInfo->errorClientOfDylibPath != NULL ) {
+		payload->clientPathOffset = payloadSize;
+		payloadSize += strlcpy(&payloadBuffer[payloadSize], dyld::gProcessInfo->errorClientOfDylibPath, sizeof(payloadBuffer)-payloadSize) + 1;
+	}
+	if ( dyld::gProcessInfo->errorSymbol != NULL ) {
+		payload->symbolOffset = payloadSize;
+		payloadSize += strlcpy(&payloadBuffer[payloadSize], dyld::gProcessInfo->errorSymbol, sizeof(payloadBuffer)-payloadSize) + 1;
+	}
+	char truncMessage[EXIT_REASON_USER_DESC_MAX_LEN];
+	strlcpy(truncMessage, message, EXIT_REASON_USER_DESC_MAX_LEN);
+	abort_with_payload(OS_REASON_DYLD, dyld::gProcessInfo->errorKind ? dyld::gProcessInfo->errorKind : DYLD_EXIT_REASON_OTHER, payloadBuffer, payloadSize, truncMessage, 0);
 }
 
 static void setErrorStrings(unsigned errorCode, const char* errorClientOfDylibPath,
@@ -3533,6 +4531,20 @@
 		// save in cache
 		*imageLoaderCache = dyld::findMappedRange((uintptr_t)imageLoaderCache);
 		if ( *imageLoaderCache == NULL ) {
+#if SUPPORT_ACCELERATE_TABLES
+		if ( sAllCacheImagesProxy != NULL ) {
+			const mach_header* mh;
+			const char* path;
+			unsigned index;
+			if ( sAllCacheImagesProxy->addressInCache(imageLoaderCache, &mh, &path, &index) ) {
+				result = sAllCacheImagesProxy->bindLazy(lazyBindingInfoOffset, gLinkContext, mh, index);
+				if ( result == 0 ) {
+					halt("dyld: lazy symbol binding failed for image in dyld shared\n");
+				}
+				return result;
+			}
+		}
+#endif
 			const char* message = "fast lazy binding from unknown image";
 			dyld::log("dyld: %s\n", message);
 			halt(message);
@@ -3541,7 +4553,7 @@
 	
 	// bind lazy pointer and return it
 	try {
-		result = (*imageLoaderCache)->doBindFastLazySymbol(lazyBindingInfoOffset, gLinkContext, 
+		result = (*imageLoaderCache)->doBindFastLazySymbol((uint32_t)lazyBindingInfoOffset, gLinkContext, 
 								(dyld::gLibSystemHelpers != NULL) ? dyld::gLibSystemHelpers->acquireGlobalDyldLock : NULL,
 								(dyld::gLibSystemHelpers != NULL) ? dyld::gLibSystemHelpers->releaseGlobalDyldLock : NULL);
 	}
@@ -3573,8 +4585,8 @@
 	// search all images in order
 	const ImageLoader* firstWeakImage = NULL;
 	const ImageLoader::Symbol* firstWeakSym = NULL;
-	const unsigned int imageCount = sAllImages.size();
-	for(unsigned int i=0; i < imageCount; ++i) {
+	const size_t imageCount = sAllImages.size();
+	for(size_t i=0; i < imageCount; ++i) {
 		ImageLoader* anImage = sAllImages[i];
 		// the use of inserted libraries alters search order
 		// so that inserted libraries are found before the main executable
@@ -3607,7 +4619,13 @@
 		*image = firstWeakImage;
 		return true;
 	}
-	
+#if SUPPORT_ACCELERATE_TABLES
+	if ( sAllCacheImagesProxy != NULL ) {
+		if ( sAllCacheImagesProxy->flatFindSymbol(name, onlyInCoalesced, sym, image) )
+			return true;
+	}
+#endif
+
 	return false;
 }
 
@@ -3625,8 +4643,8 @@
 bool flatFindExportedSymbolWithHint(const char* name, const char* librarySubstring, const ImageLoader::Symbol** sym, const ImageLoader** image)
 {
 	// search all images in order
-	const unsigned int imageCount = sAllImages.size();
-	for(unsigned int i=0; i < imageCount; ++i){
+	const size_t imageCount = sAllImages.size();
+	for(size_t i=0; i < imageCount; ++i){
 		ImageLoader* anImage = sAllImages[i];
 		// only look at images whose paths contain the hint string (NULL hint string is wildcard)
 		if ( ! anImage->isBundle() && ((librarySubstring==NULL) || (strstr(anImage->getPath(), librarySubstring) != NULL)) ) {
@@ -3639,16 +4657,23 @@
 	return false;
 }
 
-unsigned int getCoalescedImages(ImageLoader* images[])
+
+unsigned int getCoalescedImages(ImageLoader* images[], unsigned imageIndex[])
 {
 	unsigned int count = 0;
 	for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
 		ImageLoader* image = *it;
 		if ( image->participatesInCoalescing() ) {
-			*images++ = *it;
+			images[count] = *it;
+			imageIndex[count] = 0;
 			++count;
 		}
 	}
+#if SUPPORT_ACCELERATE_TABLES
+	if ( sAllCacheImagesProxy != NULL ) {
+		sAllCacheImagesProxy->appendImagesNeedingCoalescing(images, imageIndex, count);
+	}
+#endif
 	return count;
 }
 
@@ -3709,7 +4734,7 @@
 		
 		// call callback with all existing images
 		try {
-			notifyBatchPartial(state, true, handler);
+			notifyBatchPartial(state, true, handler, false, false);
 		}
 		catch (const char* msg) {
 			// ignore request to abort during registration
@@ -3717,7 +4742,113 @@
 	}
 }
 
-static ImageLoader* libraryLocator(const char* libraryName, bool search, const char* origin, const ImageLoader::RPathChain* rpaths)
+
+void registerObjCNotifiers(_dyld_objc_notify_mapped mapped, _dyld_objc_notify_init init, _dyld_objc_notify_unmapped unmapped)
+{
+	// record functions to call
+	sNotifyObjCMapped	= mapped;
+	sNotifyObjCInit		= init;
+	sNotifyObjCUnmapped = unmapped;
+
+	// call 'mapped' function with all images mapped so far
+	try {
+		notifyBatchPartial(dyld_image_state_bound, true, NULL, false, true);
+	}
+	catch (const char* msg) {
+		// ignore request to abort during registration
+	}
+}
+
+bool sharedCacheUUID(uuid_t uuid)
+{
+#if DYLD_SHARED_CACHE_SUPPORT
+	if ( sSharedCache == NULL )
+		return false;
+
+	memcpy(uuid, sSharedCache->uuid, 16);
+	return true;
+#else
+	return false;
+#endif
+}
+
+#if SUPPORT_ACCELERATE_TABLES
+
+bool dlopenFromCache(const char* path, int mode, void** handle)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	bool result = sAllCacheImagesProxy->dlopenFromCache(gLinkContext, path, mode, handle);
+	if ( !result && (strchr(path, '/') == NULL) ) {
+		// POSIX says you can call dlopen() with a leaf name (e.g. dlopen("libz.dylb"))
+		char fallbackPath[PATH_MAX];
+		strcpy(fallbackPath, "/usr/lib/");
+		strlcat(fallbackPath, path, PATH_MAX);
+		result = sAllCacheImagesProxy->dlopenFromCache(gLinkContext, fallbackPath, mode, handle);
+	}
+	return result;
+}
+
+bool makeCacheHandle(ImageLoader* image, unsigned cacheIndex, int mode, void** result)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	return sAllCacheImagesProxy->makeCacheHandle(gLinkContext, cacheIndex, mode, result);
+}
+
+bool isCacheHandle(void* handle)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	return sAllCacheImagesProxy->isCacheHandle(handle, NULL, NULL);
+}
+
+bool isPathInCache(const char* path)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	unsigned index;
+	return sAllCacheImagesProxy->hasDylib(path, &index);
+}
+
+const char* getPathFromIndex(unsigned cacheIndex)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return NULL;
+	return sAllCacheImagesProxy->getIndexedPath(cacheIndex);
+}
+
+void* dlsymFromCache(void* handle, const char* symName, unsigned index)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return NULL;
+	return sAllCacheImagesProxy->dlsymFromCache(gLinkContext, handle, symName, index);
+}
+
+bool addressInCache(const void* address, const mach_header** mh, const char** path, unsigned* index)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	unsigned ignore;
+	return sAllCacheImagesProxy->addressInCache(address, mh, path, index ? index : &ignore);
+}
+
+bool findUnwindSections(const void* addr, dyld_unwind_sections* info)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	return sAllCacheImagesProxy->findUnwindSections(addr, info);
+}
+
+bool dladdrFromCache(const void* address, Dl_info* info)
+{
+	if ( sAllCacheImagesProxy == NULL )
+		return false;
+	return sAllCacheImagesProxy->dladdrFromCache(address, info);
+}
+#endif
+
+static ImageLoader* libraryLocator(const char* libraryName, bool search, const char* origin, const ImageLoader::RPathChain* rpaths, unsigned& cacheIndex)
 {
 	dyld::LoadContext context;
 	context.useSearchPaths		= search;
@@ -3731,7 +4862,7 @@
 	context.canBePIE			= false;
 	context.origin				= origin;
 	context.rpath				= rpaths;
-	return load(libraryName, context);
+	return load(libraryName, context, cacheIndex);
 }
 
 static const char* basename(const char* path)
@@ -3771,6 +4902,11 @@
 #endif
 	gLinkContext.findImageContainingAddress	= &findImageContainingAddress;
 	gLinkContext.addDynamicReference	= &addDynamicReference;
+#if SUPPORT_ACCELERATE_TABLES
+	gLinkContext.notifySingleFromCache	= &notifySingleFromCache;
+	gLinkContext.getPreInitNotifyHandler= &getPreInitNotifyHandler;
+	gLinkContext.getBoundBatchHandler   = &getBoundBatchHandler;
+#endif
 	gLinkContext.bindingOptions			= ImageLoader::kBindingNone;
 	gLinkContext.argc					= argc;
 	gLinkContext.argv					= argv;
@@ -3784,20 +4920,16 @@
 	gLinkContext.programVars.__prognamePtr=&gLinkContext.progname;
 	gLinkContext.mainExecutable			= NULL;
 	gLinkContext.imageSuffix			= NULL;
+	gLinkContext.dynamicInterposeArray	= NULL;
+	gLinkContext.dynamicInterposeCount	= 0;
 	gLinkContext.prebindUsage			= ImageLoader::kUseAllPrebinding;
+#if TARGET_IPHONE_SIMULATOR
+	gLinkContext.sharedRegionMode		= ImageLoader::kDontUseSharedRegion;
+#else
 	gLinkContext.sharedRegionMode		= ImageLoader::kUseSharedRegion;
-}
-
-
-#if __LP64__
-	#define LC_SEGMENT_COMMAND		LC_SEGMENT_64
-	#define macho_segment_command	segment_command_64
-	#define macho_section			section_64
-#else
-	#define LC_SEGMENT_COMMAND		LC_SEGMENT
-	#define macho_segment_command	segment_command
-	#define macho_section			section
-#endif
+#endif
+}
+
 
 
 //
@@ -3834,20 +4966,35 @@
 	return false;
 }
 
+#if __IPHONE_OS_VERSION_MIN_REQUIRED
+static bool isFairPlayEncrypted(const macho_header* mh)
+{
+	const uint32_t cmd_count = mh->ncmds;
+	const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		if ( cmd->cmd == LC_ENCRYPT_COMMAND ) {
+			const encryption_info_command* enc = (encryption_info_command*)cmd;
+			return (enc->cryptid != 0);
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+
+	return false;
+}
+#endif
+
 #if SUPPORT_VERSIONED_PATHS
-//
-// Peeks at a dylib file and returns its current_version and install_name.
-// Returns false on error.
-//			
-static bool getDylibVersionAndInstallname(const char* dylibPath, uint32_t* version, char* installName)
-{
+
+static bool readFirstPage(const char* dylibPath, uint8_t firstPage[4096]) 
+{
+	firstPage[0] = 0;
 	// open file (automagically closed when this function exits)
 	FileOpener file(dylibPath);
-	
+
 	if ( file.getFileDescriptor() == -1 ) 
 		return false;
 	
-	uint8_t firstPage[4096];
 	if ( pread(file.getFileDescriptor(), firstPage, 4096, 0) != 4096 )
 		return false;
 
@@ -3864,9 +5011,33 @@
 			return false;
 		}
 	}
+	
+	return true;
+}
+
+//
+// Peeks at a dylib file and returns its current_version and install_name.
+// Returns false on error.
+//
+static bool getDylibVersionAndInstallname(const char* dylibPath, uint32_t* version, char* installName)
+{
+	uint8_t firstPage[4096];
+	const macho_header* mh = (macho_header*)firstPage;
+	if ( !readFirstPage(dylibPath, firstPage) ) {
+	#if DYLD_SHARED_CACHE_SUPPORT
+		// If file cannot be read, check to see if path is in shared cache
+		const macho_header* mhInCache;
+		const char*			pathInCache;
+		long				slideInCache;
+		if ( !findInSharedCacheImage(dylibPath, true, NULL, &mhInCache, &pathInCache, &slideInCache) )
+			return false;
+		mh = mhInCache;
+	#else
+		return false;
+	#endif
+	}
 
 	// check mach-o header
-	const mach_header* mh = (mach_header*)firstPage;
 	if ( mh->magic != sMainExecutableMachHeader->magic ) 
 		return false;
 	if ( mh->cputype != sMainExecutableMachHeader->cputype )
@@ -3898,6 +5069,7 @@
 }
 #endif // SUPPORT_VERSIONED_PATHS
 						
+
 #if 0
 static void printAllImages()
 {
@@ -3911,7 +5083,7 @@
 }
 #endif
 
-void link(ImageLoader* image, bool forceLazysBound, bool neverUnload, const ImageLoader::RPathChain& loaderRPaths)
+void link(ImageLoader* image, bool forceLazysBound, bool neverUnload, const ImageLoader::RPathChain& loaderRPaths, unsigned cacheIndex)
 {
 	// add to list of known images.  This did not happen at creation time for bundles
 	if ( image->isBundle() && !image->isLinked() )
@@ -3923,7 +5095,12 @@
 	
 	// process images
 	try {
-		image->link(gLinkContext, forceLazysBound, false, neverUnload, loaderRPaths);
+		const char* path = image->getPath();
+#if SUPPORT_ACCELERATE_TABLES
+		if ( image == sAllCacheImagesProxy )
+			path = sAllCacheImagesProxy->getIndexedPath(cacheIndex);
+#endif
+		image->link(gLinkContext, forceLazysBound, false, neverUnload, loaderRPaths, path);
 	}
 	catch (const char* msg) {
 		garbageCollectImages();
@@ -3935,7 +5112,7 @@
 void runInitializers(ImageLoader* image)
 {
 	// do bottom up initialization
-	ImageLoader::InitializerTimingList initializerTimes[sAllImages.size()];
+	ImageLoader::InitializerTimingList initializerTimes[allImagesCount()];
 	initializerTimes[0].count = 0;
 	image->runInitializers(gLinkContext, initializerTimes[0]);
 }
@@ -3978,36 +5155,51 @@
 		// sweep phase: mark as in-use, images reachable from never-unload or in-use image
 		for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
 			ImageLoader* image = *it;
-			if ( (image->dlopenCount() != 0) || image->neverUnload() ) {
-				image->markedUsedRecursive(sDynamicReferences);
+			if ( (image->dlopenCount() != 0) || image->neverUnload() || (image == sMainExecutable) ) {
+				OSSpinLockLock(&sDynamicReferencesLock);
+					image->markedUsedRecursive(sDynamicReferences);
+				OSSpinLockUnlock(&sDynamicReferencesLock);
 			}
 		}
 
 		// collect phase: build array of images not marked in-use
 		ImageLoader* deadImages[sAllImages.size()];
 		unsigned deadCount = 0;
-		unsigned i = 0;
+		int maxRangeCount = 0;
 		for (std::vector<ImageLoader*>::iterator it=sAllImages.begin(); it != sAllImages.end(); it++) {
 			ImageLoader* image = *it;
 			if ( ! image->isMarkedInUse() ) {
-				deadImages[i++] = image;
+				deadImages[deadCount++] = image;
 				if (gLogAPIs) dyld::log("dlclose(), found unused image %p %s\n", image, image->getShortName());
-				++deadCount;
+				maxRangeCount += image->segmentCount();
 			}
 		}
 
 		// collect phase: run termination routines for images not marked in-use
-		// TO DO:  When libc has cxa_finalize() that takes array of images, pass deadImages[] instead of the for loop here
+		__cxa_range_t ranges[maxRangeCount];
+		int rangeCount = 0;
 		for (unsigned i=0; i < deadCount; ++i) {
 			ImageLoader* image = deadImages[i];
+			for (unsigned int j=0; j < image->segmentCount(); ++j) {
+				if ( !image->segExecutable(j) )
+					continue;
+				if ( rangeCount < maxRangeCount ) {
+					ranges[rangeCount].addr = (const void*)image->segActualLoadAddress(j);
+					ranges[rangeCount].length = image->segSize(j);
+					++rangeCount;
+				}
+			}
 			try {
-				if (gLogAPIs) dyld::log("dlclose(), running terminators for %p %s\n", image, image->getShortName());
-				runImageTerminators(image);
+				runImageStaticTerminators(image);
 			}
 			catch (const char* msg) {
 				dyld::warn("problem running terminators for image: %s\n", msg);
 			}
 		}
+		
+		// <rdar://problem/14718598> dyld should call __cxa_finalize_ranges()
+		if ( (rangeCount > 0) && (gLibSystemHelpers != NULL) && (gLibSystemHelpers->version >= 13) )
+			(*gLibSystemHelpers->cxa_finalize_ranges)(ranges, rangeCount);
 
 		// collect phase: delete all images which are not marked in-use
 		bool mightBeMore;
@@ -4048,12 +5240,17 @@
 }
 
 
-void preflight(ImageLoader* image, const ImageLoader::RPathChain& loaderRPaths)
+void preflight(ImageLoader* image, const ImageLoader::RPathChain& loaderRPaths, unsigned cacheIndex)
 {
 	try {
 		if ( image->isBundle() ) 
 			sBundleBeingLoaded = image;	// hack
-		image->link(gLinkContext, false, true, false, loaderRPaths);
+		const char* path = image->getPath();
+#if SUPPORT_ACCELERATE_TABLES
+		if ( image == sAllCacheImagesProxy )
+			path = sAllCacheImagesProxy->getIndexedPath(cacheIndex);
+#endif
+		image->link(gLinkContext, false, true, false, loaderRPaths, path);
 	}
 	catch (const char* msg) {	
 		preflight_finally(image);
@@ -4065,6 +5262,7 @@
 static void loadInsertedDylib(const char* path)
 {
 	ImageLoader* image = NULL;
+	unsigned cacheIndex;
 	try {
 		LoadContext context;
 		context.useSearchPaths		= false;
@@ -4078,53 +5276,98 @@
 		context.canBePIE			= false;
 		context.origin				= NULL;	// can't use @loader_path with DYLD_INSERT_LIBRARIES
 		context.rpath				= NULL;
-		image = load(path, context);
+		image = load(path, context, cacheIndex);
 	}
 	catch (const char* msg) {
-		halt(dyld::mkstringf("could not load inserted library '%s' because %s\n", path, msg));
+#if TARGET_IPHONE_SIMULATOR
+		dyld::log("dyld: warning: could not load inserted library '%s' because %s\n", path, msg);
+#else
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+		if ( gLinkContext.processUsingLibraryValidation )
+			dyld::log("dyld: warning: could not load inserted library '%s' into library validated process because %s\n", path, msg);
+		else
+#endif
+			halt(dyld::mkstringf("could not load inserted library '%s' because %s\n", path, msg));
+#endif
 	}
 	catch (...) {
 		halt(dyld::mkstringf("could not load inserted library '%s'\n", path));
 	}
 }
 
-static bool processRestricted(const macho_header* mainExecutableMH)
-{	
-#if __MAC_OS_X_VERSION_MIN_REQUIRED
-    // ask kernel if code signature of program makes it restricted
+
+//
+// Sets:
+//	sEnvMode
+//	gLinkContext.requireCodeSignature
+//	gLinkContext.processIsRestricted				// Mac OS X only
+//	gLinkContext.processUsingLibraryValidation		// Mac OS X only
+//
+static void configureProcessRestrictions(const macho_header* mainExecutableMH)
+{
     uint32_t flags;
+#if TARGET_IPHONE_SIMULATOR
+	sEnvMode = envAll;
+	gLinkContext.requireCodeSignature = true;
+#elif __IPHONE_OS_VERSION_MIN_REQUIRED
+	sEnvMode = envNone;
+	gLinkContext.requireCodeSignature = true;
 	if ( csops(0, CS_OPS_STATUS, &flags, sizeof(flags)) != -1 ) {
 		if ( flags & CS_ENFORCEMENT ) {
-			gLinkContext.codeSigningEnforced = true;
-		}
-	}
-	if (flags & CS_RESTRICT) {
-		sRestrictedReason = restrictedByEntitlements;
-		return true;
-	}
+			if ( flags & CS_GET_TASK_ALLOW ) {
+				// Xcode built app for Debug allowed to use DYLD_* variables
+				sEnvMode = envAll;
+			}
+			else {
+				// Development kernel can use DYLD_PRINT_* variables on any FairPlay encrypted app
+				uint32_t secureValue = 0;
+				size_t   secureValueSize = sizeof(secureValue);
+				if ( (sysctlbyname("kern.secure_kernel", &secureValue, &secureValueSize, NULL, 0) == 0) && (secureValue == 0) && isFairPlayEncrypted(mainExecutableMH) ) {
+					sEnvMode = envPrintOnly;
+				}
+			}
+		}
+		else {
+			// Development kernel can run unsigned code
+			sEnvMode = envAll;
+			gLinkContext.requireCodeSignature = false;
+		}
+	}
+	if ( issetugid() ) {
+		sEnvMode = envNone;
+	}
+#elif __MAC_OS_X_VERSION_MIN_REQUIRED
+	sEnvMode = envAll;
+	gLinkContext.requireCodeSignature = false;
+	gLinkContext.processIsRestricted = false;
+	gLinkContext.processUsingLibraryValidation = false;
+	// any processes with setuid or setgid bit set or with __RESTRICT segment is restricted
+    if ( issetugid() || hasRestrictedSegment(mainExecutableMH) ) {
+		gLinkContext.processIsRestricted = true;
+	}
+	if ( csops(0, CS_OPS_STATUS, &flags, sizeof(flags)) != -1 ) {
+		// On OS X CS_RESTRICT means the program was signed with entitlements
+		if ( ((flags & CS_RESTRICT) == CS_RESTRICT) && (csr_check(CSR_ALLOW_TASK_FOR_PID) != 0) ) {
+			gLinkContext.processIsRestricted = true;
+		}
+		// Library Validation loosens searching but requires everything to be code signed
+		if ( flags & CS_REQUIRE_LV ) {
+			gLinkContext.processIsRestricted = false;
+			//gLinkContext.requireCodeSignature = true;
+			gLinkContext.processUsingLibraryValidation = true;
+		}
+	}
+#endif
+}
+
+
+bool processIsRestricted()
+{
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+	return gLinkContext.processIsRestricted;
 #else
-	gLinkContext.codeSigningEnforced = true;
-#endif
-	
-	// all processes with setuid or setgid bit set are restricted
-    if ( issetugid() ) {
-		sRestrictedReason = restrictedBySetGUid;
-		return true;
-	}
-		
-	// <rdar://problem/13158444&13245742> Respect __RESTRICT,__restrict section for root processes
-	if ( hasRestrictedSegment(mainExecutableMH) ) {
-		// existence of __RESTRICT/__restrict section make process restricted
-		sRestrictedReason = restrictedBySegment;
-		return true;
-	}
-    return false;
-}
-
-
-bool processIsRestricted()
-{
-	return sProcessIsRestricted;
+	return false;
+#endif
 }
 
 
@@ -4150,13 +5393,40 @@
 	}
 }
 
+void notifyKernelAboutDyld()
+{
+	const struct macho_header* mh = (macho_header*)&__dso_handle;
+	const uint32_t cmd_count = mh->ncmds;
+	const struct load_command* const cmds = (struct load_command*)((char*)mh + sizeof(macho_header));
+	const struct load_command* cmd = cmds;
+	for (uint32_t i = 0; i < cmd_count; ++i) {
+		switch (cmd->cmd) {
+			case LC_UUID: {
+				// Add dyld to the kernel image info
+				uuid_command* uc = (uuid_command*)cmd;
+				dyld_kernel_image_info_t kernelInfo;
+				memcpy(kernelInfo.uuid, uc->uuid, 16);
+				kernelInfo.load_addr = (uint64_t)mh;
+				kernelInfo.fsobjid.fid_objno = 0;
+				kernelInfo.fsobjid.fid_generation = 0;
+				kernelInfo.fsid.val[0] = 0;
+				kernelInfo.fsid.val[1] = 0;
+				task_register_dyld_image_infos(mach_task_self(), &kernelInfo, 1);
+				return;
+			}
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
+}
+
 #if __MAC_OS_X_VERSION_MIN_REQUIRED
 typedef int (*open_proc_t)(const char*, int, int);
 typedef int (*fcntl_proc_t)(int, int, void*);
 typedef int (*ioctl_proc_t)(int, unsigned long, void*);
 static void* getProcessInfo() { return dyld::gProcessInfo; }
 static SyscallHelpers sSysCalls = {
-		1, 
+		7,
+		// added in version 1
 		(open_proc_t)&open, 
 		&close, 
 		&pread, 
@@ -4185,70 +5455,150 @@
 		&OSMemoryBarrier,
 		&getProcessInfo,
 		&__error,
-		&mach_absolute_time
+		&mach_absolute_time,
+		// added in version 2
+		&thread_switch,
+		// added in version 3
+		&opendir,
+		&readdir_r,
+		&closedir,
+		// added in version 4
+		&coresymbolication_load_notifier,
+		&coresymbolication_unload_notifier,
+		// Added in version 5
+		&proc_regionfilename,
+		&getpid,
+		&mach_port_insert_right,
+		&mach_port_allocate,
+		&mach_msg,
+		// Added in version 6
+		&abort_with_payload,
+		// Added in version 7
+		&task_register_dyld_image_infos,
+		&task_unregister_dyld_image_infos,
+		&task_get_dyld_image_infos,
+		&task_register_dyld_shared_cache_image_info,
+		&task_register_dyld_set_dyld_state,
+		&task_register_dyld_get_process_state
 };
 
 __attribute__((noinline))
-static uintptr_t useSimulatorDyld(int fd, const macho_header* mainExecutableMH, const char* dyldPath, 
-								int argc, const char* argv[], const char* envp[], const char* apple[], uintptr_t* startGlue)
+static const char* useSimulatorDyld(int fd, const macho_header* mainExecutableMH, const char* dyldPath,
+								int argc, const char* argv[], const char* envp[], const char* apple[],
+								uintptr_t* startGlue, uintptr_t* mainAddr)
 {
 	*startGlue = 0;
-	
-	// verify simulator dyld file is owned by root
+	*mainAddr = 0;
+
+	// <rdar://problem/25311921> simulator does not support restricted processes
+	uint32_t flags;
+	if ( csops(0, CS_OPS_STATUS, &flags, sizeof(flags)) == -1 )
+		return "csops() failed";
+	if ( (flags & CS_RESTRICT) == CS_RESTRICT )
+		return "dyld_sim cannot be loaded in a restricted process";
+	if ( issetugid() )
+		return "dyld_sim cannot be loaded in a setuid process";
+	if ( hasRestrictedSegment(mainExecutableMH) )
+		return "dyld_sim cannot be loaded in a restricted process";
+
+	// get file size of dyld_sim
 	struct stat sb;
 	if ( fstat(fd, &sb) == -1 )
-		return 0;
-	if ( sb.st_uid != 0 )
-		return 0;
-
-	// read first page of dyld file
+		return "stat(dyld_sim) failed";
+
+	// read first page of dyld_sim file
 	uint8_t firstPage[4096];
 	if ( pread(fd, firstPage, 4096, 0) != 4096 )
-		return 0;
-	
+		return "pread(dyld_sim) failed";
+
 	// if fat file, pick matching slice
 	uint64_t fileOffset = 0;
 	uint64_t fileLength = sb.st_size;
 	const fat_header* fileStartAsFat = (fat_header*)firstPage;
 	if ( fileStartAsFat->magic == OSSwapBigToHostInt32(FAT_MAGIC) ) {
 		if ( !fatFindBest(fileStartAsFat, &fileOffset, &fileLength) ) 
-			return 0;
+			return "no matching arch in dyld_sim";
 		// re-read buffer from start of mach-o slice in fat file
 		if ( pread(fd, firstPage, 4096, fileOffset) != 4096 )
-			return 0;
+			return "pread(dyld_sim) failed";
 	}
 	else if ( !isCompatibleMachO(firstPage, dyldPath) ) {
-		return 0;
+		return "dyld_sim not compatible mach-o";
 	}
 	
 	// calculate total size of dyld segments
 	const macho_header* mh = (const macho_header*)firstPage;
+	struct macho_segment_command* lastSeg = NULL;
+	struct macho_segment_command* firstSeg = NULL;
 	uintptr_t mappingSize = 0;
 	uintptr_t preferredLoadAddress = 0;
 	const uint32_t cmd_count = mh->ncmds;
+	if ( mh->sizeofcmds > 4096 )
+		return "dyld_sim load commands to large";
+	if ( (sizeof(macho_header) + mh->sizeofcmds) > 4096 )
+		return "dyld_sim load commands to large";
 	const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
+	const struct load_command* const endCmds = (struct load_command*)(((char*)mh) + sizeof(macho_header) + mh->sizeofcmds);
 	const struct load_command* cmd = cmds;
 	for (uint32_t i = 0; i < cmd_count; ++i) {
+		uint32_t cmdLength = cmd->cmdsize;
+		if ( cmdLength < 8 )
+			return "dyld_sim load command too small";
+		const struct load_command* const nextCmd = (const struct load_command*)(((char*)cmd)+cmdLength);
+		if ( (nextCmd > endCmds) || (nextCmd < cmd) )
+			return "dyld_sim load command too large";
 		switch (cmd->cmd) {
 			case LC_SEGMENT_COMMAND:
 				{
 					struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
+					if ( seg->vmaddr + seg->vmsize < seg->vmaddr )
+						return "dyld_sim seg wraps address space";
+					if ( seg->vmsize < seg->filesize )
+						return "dyld_sim seg vmsize too small";
+					if ( (seg->fileoff + seg->filesize) < seg->fileoff )
+						return "dyld_sim seg size wraps address space";
+					if ( lastSeg == NULL ) {
+						// first segment must be __TEXT and start at beginning of file/slice
+						firstSeg = seg;
+						if ( strcmp(seg->segname, "__TEXT") != 0 )
+							return "dyld_sim first segment not __TEXT";
+						if ( seg->fileoff != 0 )
+							return "dyld_sim first segment not at file offset zero";
+						if ( seg->filesize < (sizeof(macho_header) + mh->sizeofcmds) )
+							return "dyld_sim first segment smaller than load commands";
+						preferredLoadAddress = seg->vmaddr;
+					}
+					else {
+						// other sements must be continguous with previous segment and not executable
+						if ( lastSeg->fileoff + lastSeg->filesize != seg->fileoff )
+							return "dyld_sim segments not contiguous";
+						if ( lastSeg->vmaddr + lastSeg->vmsize != seg->vmaddr )
+							return "dyld_sim segments not address contiguous";
+						if ( (seg->initprot & VM_PROT_EXECUTE) != 0 )
+							return "dyld_sim non-first segment is executable";
+					}
 					mappingSize += seg->vmsize;
-					if ( seg->fileoff == 0 )
-						preferredLoadAddress = seg->vmaddr;
+					lastSeg = seg;
 				}
 				break;
-		}
-		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
-	}
+			case LC_SEGMENT_COMMAND_WRONG:
+				return "dyld_sim wrong load segment load command";
+		}
+		cmd = nextCmd;
+	}
+	// last segment must be named __LINKEDIT and not writable
+	if ( strcmp(lastSeg->segname, "__LINKEDIT") != 0 )
+		return "dyld_sim last segment not __LINKEDIT";
+	if ( lastSeg->initprot & VM_PROT_WRITE )
+		return "dyld_sim __LINKEDIT segment writable";
 
 	// reserve space, then mmap each segment
 	vm_address_t loadAddress = 0;
-	uintptr_t entry = 0;
 	if ( ::vm_allocate(mach_task_self(), &loadAddress, mappingSize, VM_FLAGS_ANYWHERE) != 0 )
-		return 0;
+		return "dyld_sim cannot allocate space";
 	cmd = cmds;
 	struct linkedit_data_command* codeSigCmd = NULL;
+	struct source_version_command* dyldVersionCmd = NULL;
 	for (uint32_t i = 0; i < cmd_count; ++i) {
 		switch (cmd->cmd) {
 			case LC_SEGMENT_COMMAND:
@@ -4258,39 +5608,71 @@
 					void* segAddress = ::mmap((void*)requestedLoadAddress, seg->filesize, seg->initprot, MAP_FIXED | MAP_PRIVATE, fd, fileOffset + seg->fileoff);
 					//dyld::log("dyld_sim %s mapped at %p\n", seg->segname, segAddress);
 					if ( segAddress == (void*)(-1) )
-						return 0;
-				}
-				break;
-			case LC_UNIXTHREAD:
-				{
-				#if __i386__
-					const i386_thread_state_t* registers = (i386_thread_state_t*)(((char*)cmd) + 16);
-					entry = (registers->__eip + loadAddress - preferredLoadAddress);
-				#elif __x86_64__
-					const x86_thread_state64_t* registers = (x86_thread_state64_t*)(((char*)cmd) + 16);
-					entry = (registers->__rip + loadAddress - preferredLoadAddress);
-				#endif
+						return "dyld_sim mmap() of segment failed";
+					if ( ((uintptr_t)segAddress < loadAddress) || ((uintptr_t)segAddress+seg->filesize > loadAddress+mappingSize) )
+						return "dyld_sim mmap() to wrong location";
 				}
 				break;
 			case LC_CODE_SIGNATURE:
 				codeSigCmd = (struct linkedit_data_command*)cmd;
 				break;
+			case LC_SOURCE_VERSION:
+				dyldVersionCmd = (struct source_version_command*)cmd;
+				break;
 		}
 		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
 	}
-	
-	if ( codeSigCmd != NULL ) {
-		fsignatures_t siginfo;
-		siginfo.fs_file_start=fileOffset;							// start of mach-o slice in fat file 
-		siginfo.fs_blob_start=(void*)(long)(codeSigCmd->dataoff);	// start of code-signature in mach-o file
-		siginfo.fs_blob_size=codeSigCmd->datasize;					// size of code-signature
-		int result = fcntl(fd, F_ADDFILESIGS, &siginfo);
-		if ( result == -1 ) {
-			if ( (errno == EPERM) || (errno == EBADEXEC) )
-				return 0;
-		}
+
+	// must have code signature which is contained within LINKEDIT segment
+	if ( codeSigCmd == NULL )
+		return "dyld_sim not code signed";
+	if ( codeSigCmd->dataoff < lastSeg->fileoff )
+		return "dyld_sim code signature not in __LINKEDIT";
+	if ( (codeSigCmd->dataoff + codeSigCmd->datasize) <  codeSigCmd->dataoff )
+		return "dyld_sim code signature size wraps";
+	if ( (codeSigCmd->dataoff + codeSigCmd->datasize) > (lastSeg->fileoff + lastSeg->filesize) )
+		return "dyld_sim code signature extends beyond __LINKEDIT";
+
+	fsignatures_t siginfo;
+	siginfo.fs_file_start=fileOffset;							// start of mach-o slice in fat file 
+	siginfo.fs_blob_start=(void*)(long)(codeSigCmd->dataoff);	// start of code-signature in mach-o file
+	siginfo.fs_blob_size=codeSigCmd->datasize;					// size of code-signature
+	int result = fcntl(fd, F_ADDFILESIGS_FOR_DYLD_SIM, &siginfo);
+	if ( result == -1 ) {
+		return mkstringf("dyld_sim fcntl(F_ADDFILESIGS_FOR_DYLD_SIM) failed with errno=%d", errno);
 	}
 	close(fd);
+	// file range covered by code signature must extend up to code signature itself
+	if ( siginfo.fs_file_start < codeSigCmd->dataoff )
+		return mkstringf("dyld_sim code signature does not cover all of dyld_sim. Signature covers up to 0x%08lX. Signature starts at 0x%08X", (unsigned long)siginfo.fs_file_start, codeSigCmd->dataoff);
+
+
+	// walk newly mapped dyld_sim __TEXT load commands to find entry point
+	uintptr_t entry = 0;
+	cmd = (struct load_command*)(((char*)loadAddress)+sizeof(macho_header));
+	const uint32_t count = ((macho_header*)(loadAddress))->ncmds;
+	for (uint32_t i = 0; i < count; ++i) {
+		if (cmd->cmd == LC_UNIXTHREAD) {
+		#if __i386__
+			const i386_thread_state_t* registers = (i386_thread_state_t*)(((char*)cmd) + 16);
+			// entry point must be in first segment
+			if ( registers->__eip < firstSeg->vmaddr )
+				return "dyld_sim entry point not in __TEXT segment";
+			if ( registers->__eip > (firstSeg->vmaddr + firstSeg->vmsize) )
+				return "dyld_sim entry point not in __TEXT segment";
+			entry = (registers->__eip + loadAddress - preferredLoadAddress);
+		#elif __x86_64__
+			const x86_thread_state64_t* registers = (x86_thread_state64_t*)(((char*)cmd) + 16);
+			// entry point must be in first segment
+			if ( registers->__rip < firstSeg->vmaddr )
+				return "dyld_sim entry point not in __TEXT segment";
+			if ( registers->__rip > (firstSeg->vmaddr + firstSeg->vmsize) )
+				return "dyld_sim entry point not in __TEXT segment";
+			entry = (registers->__rip + loadAddress - preferredLoadAddress);
+		#endif
+		}
+		cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
+	}
 
 	// notify debugger that dyld_sim is loaded
 	dyld_image_info info;
@@ -4299,15 +5681,17 @@
 	info.imageFileModDate = sb.st_mtime;
 	addImagesToAllImages(1, &info);
 	dyld::gProcessInfo->notification(dyld_image_adding, 1, &info);
-	
+
+	const char** appleParams = apple;
 	// jump into new simulator dyld
 	typedef uintptr_t (*sim_entry_proc_t)(int argc, const char* argv[], const char* envp[], const char* apple[],
 								const macho_header* mainExecutableMH, const macho_header* dyldMH, uintptr_t dyldSlide,
 								const dyld::SyscallHelpers* vtable, uintptr_t* startGlue);
 	sim_entry_proc_t newDyld = (sim_entry_proc_t)entry;
-	return (*newDyld)(argc, argv, envp, apple, mainExecutableMH, (macho_header*)loadAddress, 
+	*mainAddr = (*newDyld)(argc, argv, envp, appleParams, mainExecutableMH, (macho_header*)loadAddress,
 					 loadAddress - preferredLoadAddress, 
 					 &sSysCalls, startGlue);
+	return NULL;
 }
 #endif
 
@@ -4329,48 +5713,25 @@
 	// if this is host dyld, check to see if iOS simulator is being run
 	const char* rootPath = _simple_getenv(envp, "DYLD_ROOT_PATH");
 	if ( rootPath != NULL ) {
+		// Add dyld to the kernel image info before we jump to the sim
+		notifyKernelAboutDyld();
+
 		// look to see if simulator has its own dyld
 		char simDyldPath[PATH_MAX]; 
 		strlcpy(simDyldPath, rootPath, PATH_MAX);
 		strlcat(simDyldPath, "/usr/lib/dyld_sim", PATH_MAX);
 		int fd = my_open(simDyldPath, O_RDONLY, 0);
 		if ( fd != -1 ) {
-			result = useSimulatorDyld(fd, mainExecutableMH, simDyldPath, argc, argv, envp, apple, startGlue);
-			if ( !result && (*startGlue == 0) )
-				halt("problem loading iOS simulator dyld");
+			const char* errMessage = useSimulatorDyld(fd, mainExecutableMH, simDyldPath, argc, argv, envp, apple, startGlue, &result);
+			if ( errMessage != NULL )
+				halt(errMessage);
 			return result;
 		}
 	}
 #endif
 
 	CRSetCrashLogMessage("dyld: launch started");
-#ifdef ALTERNATIVE_LOGFILE
-	sLogfile = open(ALTERNATIVE_LOGFILE, O_WRONLY | O_CREAT | O_APPEND);
-	if ( sLogfile == -1 ) {
-		sLogfile = STDERR_FILENO;
-		dyld::log("error opening alternate log file %s, errno = %d\n", ALTERNATIVE_LOGFILE, errno);
-	}
-#endif
-
-#if LOG_BINDINGS
-	char bindingsLogPath[256];
-	
-	const char* shortProgName = "unknown";
-	if ( argc > 0 ) {
-		shortProgName = strrchr(argv[0], '/');
-		if ( shortProgName == NULL )
-			shortProgName = argv[0];
-		else 
-			++shortProgName;
-	}
-	mysprintf(bindingsLogPath, "/tmp/bindings/%d-%s", getpid(), shortProgName);
-	sBindingsLogfile = open(bindingsLogPath, O_WRONLY | O_CREAT, 0666);
-	if ( sBindingsLogfile == -1 ) {
-		::mkdir("/tmp/bindings", 0777);
-		sBindingsLogfile = open(bindingsLogPath, O_WRONLY | O_CREAT, 0666);
-	}
-	//dyld::log("open(%s) => %d, errno = %d\n", bindingsLogPath, sBindingsLogfile, errno);
-#endif	
+
 	setContext(mainExecutableMH, argc, argv, envp, apple);
 
 	// Pickup the pointer to the exec path.
@@ -4379,8 +5740,6 @@
 	// <rdar://problem/13868260> Remove interim apple[0] transition code from dyld
 	if (!sExecPath) sExecPath = apple[0];
 	
-	sExecPath = apple[0];
-	bool ignoreEnvironmentVariables = false;
 	if ( sExecPath[0] != '/' ) {
 		// have relative path, use cwd to make absolute
 		char cwdbuff[MAXPATHLEN];
@@ -4399,60 +5758,145 @@
 		++sExecShortName;
 	else
 		sExecShortName = sExecPath;
-    sProcessIsRestricted = processRestricted(mainExecutableMH);
-    if ( sProcessIsRestricted ) {
-#if SUPPORT_LC_DYLD_ENVIRONMENT
-		checkLoadCommandEnvironmentVariables();
-#if SUPPORT_VERSIONED_PATHS
-		checkVersionedPaths();
-#endif	
-#endif 	
+
+    configureProcessRestrictions(mainExecutableMH);
+
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
+    if ( gLinkContext.processIsRestricted ) {
 		pruneEnvironmentVariables(envp, &apple);
 		// set again because envp and apple may have changed or moved
 		setContext(mainExecutableMH, argc, argv, envp, apple);
 	}
 	else
-		checkEnvironmentVariables(envp, ignoreEnvironmentVariables);
-	if ( sEnv.DYLD_PRINT_OPTS ) 
+#endif
+	{
+		checkEnvironmentVariables(envp);
+		defaultUninitializedFallbackPaths(envp);
+	}
+	if ( sEnv.DYLD_PRINT_OPTS )
 		printOptions(argv);
 	if ( sEnv.DYLD_PRINT_ENV ) 
 		printEnvironmentVariables(envp);
-	getHostInfo();
+	getHostInfo(mainExecutableMH, mainExecutableSlide);
 	// install gdb notifier
 	stateToHandlers(dyld_image_state_dependents_mapped, sBatchHandlers)->push_back(notifyGDB);
 	stateToHandlers(dyld_image_state_mapped, sSingleHandlers)->push_back(updateAllImages);
 	// make initial allocations large enough that it is unlikely to need to be re-alloced
-	sAllImages.reserve(INITIAL_IMAGE_COUNT);
 	sImageRoots.reserve(16);
 	sAddImageCallbacks.reserve(4);
 	sRemoveImageCallbacks.reserve(4);
 	sImageFilesNeedingTermination.reserve(16);
 	sImageFilesNeedingDOFUnregistration.reserve(8);
-	
+
+#if !TARGET_IPHONE_SIMULATOR
 #ifdef WAIT_FOR_SYSTEM_ORDER_HANDSHAKE
 	// <rdar://problem/6849505> Add gating mechanism to dyld support system order file generation process
 	WAIT_FOR_SYSTEM_ORDER_HANDSHAKE(dyld::gProcessInfo->systemOrderFlag);
 #endif
-	
+#endif
+
 
 	try {
 		// add dyld itself to UUID list
 		addDyldImageToUUIDList();
-		if ( sProcessIsRestricted )
-			CRSetCrashLogMessage("dyld: launch, loading dependent libraries, ignoring DYLD_* env vars");
-		else
-			CRSetCrashLogMessage("dyld: launch, loading dependent libraries");
+		notifyKernelAboutDyld();
+
+#if SUPPORT_ACCELERATE_TABLES
+		bool mainExcutableAlreadyRebased = false;
+
+reloadAllImages:
+#endif
+
+		CRSetCrashLogMessage(sLoadingCrashMessage);
 		// instantiate ImageLoader for main executable
 		sMainExecutable = instantiateFromLoadedImage(mainExecutableMH, mainExecutableSlide, sExecPath);
 		gLinkContext.mainExecutable = sMainExecutable;
-		gLinkContext.processIsRestricted = sProcessIsRestricted;
 		gLinkContext.mainExecutableCodeSigned = hasCodeSignatureLoadCommand(mainExecutableMH);
+
+#if TARGET_IPHONE_SIMULATOR
+		// check main executable is not too new for this OS
+		{
+			if ( ! isSimulatorBinary((uint8_t*)mainExecutableMH, sExecPath) ) {
+				throwf("program was built for a platform that is not supported by this runtime");
+			}
+			uint32_t mainMinOS = sMainExecutable->minOSVersion();
+
+			// dyld is always built for the current OS, so we can get the current OS version
+			// from the load command in dyld itself.
+			uint32_t dyldMinOS = ImageLoaderMachO::minOSVersion((const mach_header*)&__dso_handle);
+			if ( mainMinOS > dyldMinOS ) {
+	#if TARGET_OS_WATCH
+				throwf("app was built for watchOS %d.%d which is newer than this simulator %d.%d",
+						mainMinOS >> 16, ((mainMinOS >> 8) & 0xFF),
+						dyldMinOS >> 16, ((dyldMinOS >> 8) & 0xFF));
+	#elif TARGET_OS_TV
+				throwf("app was built for tvOS %d.%d which is newer than this simulator %d.%d",
+						mainMinOS >> 16, ((mainMinOS >> 8) & 0xFF),
+						dyldMinOS >> 16, ((dyldMinOS >> 8) & 0xFF));
+	#else
+				throwf("app was built for iOS %d.%d which is newer than this simulator %d.%d",
+						mainMinOS >> 16, ((mainMinOS >> 8) & 0xFF),
+						dyldMinOS >> 16, ((dyldMinOS >> 8) & 0xFF));
+	#endif
+			}
+		}
+#endif
+
+
+	#if __MAC_OS_X_VERSION_MIN_REQUIRED
+		// <rdar://problem/22805519> be less strict about old mach-o binaries
+		uint32_t mainSDK = sMainExecutable->sdkVersion();
+		gLinkContext.strictMachORequired = (mainSDK >= DYLD_MACOSX_VERSION_10_12) || gLinkContext.processUsingLibraryValidation;
+	#else
+		// simulators, iOS, tvOS, and watchOS are always strict
+		gLinkContext.strictMachORequired = true;
+	#endif
+
 		// load shared cache
 		checkSharedRegionDisable();
 	#if DYLD_SHARED_CACHE_SUPPORT
-		if ( gLinkContext.sharedRegionMode != ImageLoader::kDontUseSharedRegion )
+		if ( gLinkContext.sharedRegionMode != ImageLoader::kDontUseSharedRegion ) {
 			mapSharedCache();
+		} else {
+			dyld_kernel_image_info_t kernelCacheInfo;
+			bzero(&kernelCacheInfo.uuid[0], sizeof(uuid_t));
+			kernelCacheInfo.load_addr = 0;
+			kernelCacheInfo.fsobjid.fid_objno = 0;
+			kernelCacheInfo.fsobjid.fid_generation = 0;
+			kernelCacheInfo.fsid.val[0] = 0;
+			kernelCacheInfo.fsid.val[0] = 0;
+			task_register_dyld_shared_cache_image_info(mach_task_self(), kernelCacheInfo, true, false);
+		}
 	#endif
+
+	#if SUPPORT_ACCELERATE_TABLES
+		sAllImages.reserve((sAllCacheImagesProxy != NULL) ? 16 : INITIAL_IMAGE_COUNT);
+	#else
+		sAllImages.reserve(INITIAL_IMAGE_COUNT);
+	#endif
+
+		// Now that shared cache is loaded, setup an versioned dylib overrides
+	#if SUPPORT_VERSIONED_PATHS
+		checkVersionedPaths();
+	#endif
+
+
+		// dyld_all_image_infos image list does not contain dyld
+		// add it as dyldPath field in dyld_all_image_infos
+		// for simulator, dyld_sim is in image list, need host dyld added
+#if TARGET_IPHONE_SIMULATOR
+		// get path of host dyld from table of syscall vectors in host dyld
+		void* addressInDyld = gSyscallHelpers;
+#else
+		// get path of dyld itself
+		void*  addressInDyld = (void*)&__dso_handle;
+#endif
+		char dyldPathBuffer[MAXPATHLEN+1];
+		int len = proc_regionfilename(getpid(), (uint64_t)(long)addressInDyld, dyldPathBuffer, MAXPATHLEN);
+		if ( (len != 0) && (strcmp(dyldPathBuffer, gProcessInfo->dyldPath) != 0) ) {
+			gProcessInfo->dyldPath = strdup(dyldPathBuffer);
+		}
+
 		// load any inserted libraries
 		if	( sEnv.DYLD_INSERT_LIBRARIES != NULL ) {
 			for (const char* const* lib = sEnv.DYLD_INSERT_LIBRARIES; *lib != NULL; ++lib) 
@@ -4464,7 +5908,14 @@
 
 		// link main executable
 		gLinkContext.linkingMainExecutable = true;
-		link(sMainExecutable, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL));
+#if SUPPORT_ACCELERATE_TABLES
+		if ( mainExcutableAlreadyRebased ) {
+			// previous link() on main executable has already adjusted its internal pointers for ASLR
+			// work around that by rebasing by inverse amount
+			sMainExecutable->rebase(gLinkContext, -mainExecutableSlide);
+		}
+#endif
+		link(sMainExecutable, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL), -1);
 		sMainExecutable->setNeverUnloadRecursive();
 		if ( sMainExecutable->forceFlat() ) {
 			gLinkContext.bindFlat = true;
@@ -4477,12 +5928,55 @@
 		if ( sInsertedDylibCount > 0 ) {
 			for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
 				ImageLoader* image = sAllImages[i+1];
-				link(image, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL));
+				link(image, sEnv.DYLD_BIND_AT_LAUNCH, true, ImageLoader::RPathChain(NULL, NULL), -1);
 				image->setNeverUnloadRecursive();
-				// only INSERTED libraries can interpose
+			}
+			// only INSERTED libraries can interpose
+			// register interposing info after all inserted libraries are bound so chaining works
+			for(unsigned int i=0; i < sInsertedDylibCount; ++i) {
+				ImageLoader* image = sAllImages[i+1];
 				image->registerInterposing();
 			}
 		}
+
+		// <rdar://problem/19315404> dyld should support interposition even without DYLD_INSERT_LIBRARIES
+		for (long i=sInsertedDylibCount+1; i < sAllImages.size(); ++i) {
+			ImageLoader* image = sAllImages[i];
+			if ( image->inSharedCache() )
+				continue;
+			image->registerInterposing();
+		}
+	#if SUPPORT_ACCELERATE_TABLES
+		if ( (sAllCacheImagesProxy != NULL) && ImageLoader::haveInterposingTuples() ) {
+			// Accelerator tables cannot be used with implicit interposing, so relaunch with accelerator tables disabled
+			ImageLoader::clearInterposingTuples();
+			// unmap all loaded dylibs (but not main executable)
+			for (long i=1; i < sAllImages.size(); ++i) {
+				ImageLoader* image = sAllImages[i];
+				if ( image == sMainExecutable )
+					continue;
+				if ( image == sAllCacheImagesProxy )
+					continue;
+				image->setCanUnload();
+				ImageLoader::deleteImage(image);
+			}
+			// note: we don't need to worry about inserted images because if DYLD_INSERT_LIBRARIES was set we would not be using the accelerator table
+			sAllImages.clear();
+			sImageRoots.clear();
+			sImageFilesNeedingTermination.clear();
+			sImageFilesNeedingDOFUnregistration.clear();
+			sAddImageCallbacks.clear();
+			sRemoveImageCallbacks.clear();
+			sDisableAcceleratorTables = true;
+			sAllCacheImagesProxy = NULL;
+			sMappedRangesStart = NULL;
+			mainExcutableAlreadyRebased = true;
+			gLinkContext.linkingMainExecutable = false;
+			resetAllImages();
+			goto reloadAllImages;
+		}
+	#endif
+
 		// apply interposing to initial set of images
 		for(int i=0; i < sImageRoots.size(); ++i) {
 			sImageRoots[i]->applyInterposing(gLinkContext);
@@ -4491,7 +5985,29 @@
 		
 		// <rdar://problem/12186933> do weak binding only after all inserted images linked
 		sMainExecutable->weakBind(gLinkContext);
-		
+
+	#if DYLD_SHARED_CACHE_SUPPORT
+		// If cache has branch island dylibs, tell debugger about them
+		if ( (sSharedCache != NULL) && (sSharedCache->mappingOffset >= 0x78) && (sSharedCache->branchPoolsOffset != 0) ) {
+			uint32_t count = sSharedCache->branchPoolsCount;
+			dyld_image_info info[count];
+			const uint64_t* poolAddress = (uint64_t*)((char*)sSharedCache + sSharedCache->branchPoolsOffset);
+			// <rdar://problem/20799203> empty branch pools can be in development cache
+			if ( ((mach_header*)poolAddress)->magic == sMainExecutableMachHeader->magic ) {
+				for (int poolIndex=0; poolIndex < count; ++poolIndex) {
+					uint64_t poolAddr = poolAddress[poolIndex] + sSharedCacheSlide;
+					info[poolIndex].imageLoadAddress = (mach_header*)(long)poolAddr;
+					info[poolIndex].imageFilePath = "dyld_shared_cache_branch_islands";
+					info[poolIndex].imageFileModDate = 0;
+				}
+				// add to all_images list
+				addImagesToAllImages(count, info);
+				// tell gdb about new branch island images
+				gProcessInfo->notification(dyld_image_adding, count, info);
+			}
+		}
+	#endif
+
 		CRSetCrashLogMessage("dyld: launch, running initializers");
 	#if SUPPORT_OLD_CRT_INITIALIZATION
 		// Old way is to run initializers via a callback from crt1.o
@@ -4524,13 +6040,6 @@
 		dyld::log("dyld: launch failed\n");
 	}
 
-#ifdef ALTERNATIVE_LOGFILE
-	// only use alternate log during launch, otherwise file is open forever
-	if ( sLogfile != STDERR_FILENO ) {
-		close(sLogfile);
-		sLogfile = STDERR_FILENO;
-	}
-#endif
 	CRSetCrashLogMessage(NULL);
 	
 	return result;