Loading...
src/ImageLoaderMachO.cpp dyld-852 dyld-625.13
--- dyld/dyld-852/src/ImageLoaderMachO.cpp
+++ dyld/dyld-625.13/src/ImageLoaderMachO.cpp
@@ -39,7 +39,6 @@
 #include <mach/thread_status.h>
 #include <mach-o/loader.h> 
 #include <mach-o/nlist.h> 
-#include <mach-o/dyld_images.h>
 #include <sys/sysctl.h>
 #include <sys/syscall.h>
 #include <libkern/OSAtomic.h>
@@ -56,18 +55,62 @@
 #if SUPPORT_CLASSIC_MACHO
 #include "ImageLoaderMachOClassic.h"
 #endif
+#include "mach-o/dyld_images.h"
 #include "Tracing.h"
-#include "dyld2.h"
+#include "dyld.h"
 
 // <rdar://problem/8718137> use stack guard random value to add padding between dylibs
 extern "C" long __stack_chk_guard;
 
-#define LIBSYSTEM_DYLIB_PATH 		  	  "/usr/lib/libSystem.B.dylib"
-#define LIBDYLD_DYLIB_PATH 		  	  "/usr/lib/system/libdyld.dylib"
-#if TARGET_OS_OSX
-  #define DRIVERKIT_LIBSYSTEM_DYLIB_PATH  "/System/DriverKit/usr/lib/libSystem.dylib"
-  #define DRIVERKIT_LIBDYLD_DYLIB_PATH 	  "/System/DriverKit/usr/lib/system/libdyld.dylib"
-#endif
+#ifndef LC_LOAD_UPWARD_DYLIB
+	#define	LC_LOAD_UPWARD_DYLIB (0x23|LC_REQ_DYLD)	/* load of dylib whose initializers run later */
+#endif
+
+#ifndef LC_VERSION_MIN_TVOS
+	#define LC_VERSION_MIN_TVOS 0x2F
+#endif
+
+#ifndef LC_VERSION_MIN_WATCHOS
+	#define LC_VERSION_MIN_WATCHOS 0x30
+#endif
+
+#ifndef LC_BUILD_VERSION
+	#define LC_BUILD_VERSION 0x32 /* build for platform min OS version */
+
+	/*
+	 * The build_version_command contains the min OS version on which this 
+	 * binary was built to run for its platform.  The list of known platforms and
+	 * tool values following it.
+	 */
+	struct build_version_command {
+		uint32_t	cmd;		/* LC_BUILD_VERSION */
+		uint32_t	cmdsize;	/* sizeof(struct build_version_command) plus */
+								/* ntools * sizeof(struct build_tool_version) */
+		uint32_t	platform;	/* platform */
+		uint32_t	minos;		/* X.Y.Z is encoded in nibbles xxxx.yy.zz */
+		uint32_t	sdk;		/* X.Y.Z is encoded in nibbles xxxx.yy.zz */
+		uint32_t	ntools;		/* number of tool entries following this */
+	};
+
+	struct build_tool_version {
+		uint32_t	tool;		/* enum for the tool */
+		uint32_t	version;	/* version number of the tool */
+	};
+
+	/* Known values for the platform field above. */
+	#define PLATFORM_MACOS		1
+	#define PLATFORM_IOS		2
+	#define PLATFORM_TVOS		3
+	#define PLATFORM_WATCHOS	4
+	#define PLATFORM_BRIDGEOS	5
+
+	/* Known values for the tool field above. */
+	#define TOOL_CLANG	1
+	#define TOOL_SWIFT	2
+	#define TOOL_LD		3
+#endif
+
+#define LIBSYSTEM_DYLIB_PATH "/usr/lib/libSystem.B.dylib"
 
 // relocation_info.r_length field has value 3 for 64-bit executables and value 2 for 32-bit executables
 #if __LP64__
@@ -97,8 +140,6 @@
 #if TEXT_RELOC_SUPPORT
 	fTextSegmentRebases(false),
 	fTextSegmentBinds(false),
-#else
-    fReadOnlyDataSegment(false),
 #endif
 #if __i386__
 	fReadOnlyImportSegment(false),
@@ -127,7 +168,7 @@
 
 }
 
-#if TARGET_OS_OSX
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 static uintptr_t pageAlign(uintptr_t value)
 {
 	return (value + 4095) & (-4096);
@@ -148,6 +189,8 @@
 
 	const uint32_t cmd_count = mh->ncmds;
 	const uint32_t sizeofcmds = mh->sizeofcmds;
+	if ( sizeofcmds > (MAX_MACH_O_HEADER_AND_LOAD_COMMANDS_SIZE-sizeof(macho_header)) )
+		dyld::throwf("malformed mach-o: load commands size (%u) > %u", sizeofcmds, MAX_MACH_O_HEADER_AND_LOAD_COMMANDS_SIZE);
 	if ( cmd_count > (sizeofcmds/sizeof(load_command)) )
 		dyld::throwf("malformed mach-o: ncmds (%u) too large to fit in sizeofcmds (%u)", cmd_count, sizeofcmds);
 	const struct load_command* const startCmds = (struct load_command*)(((uint8_t*)mh) + sizeof(macho_header));
@@ -157,8 +200,6 @@
 	const macho_segment_command* linkeditSegCmd = NULL;
 	const macho_segment_command* startOfFileSegCmd = NULL;
 	const dyld_info_command* dyldInfoCmd = NULL;
-	const linkedit_data_command* chainedFixupsCmd = NULL;
-	const linkedit_data_command* exportsTrieCmd = NULL;
 	const symtab_command* symTabCmd = NULL;
 	const dysymtab_command*	dynSymbTabCmd = NULL;
 	for (uint32_t i = 0; i < cmd_count; ++i) {
@@ -182,20 +223,9 @@
 				dyldInfoCmd = (struct dyld_info_command*)cmd;
 				*compressed = true;
 				break;
-			case LC_DYLD_CHAINED_FIXUPS:
-				if ( cmd->cmdsize != sizeof(linkedit_data_command) )
-					throw "malformed mach-o image: LC_DYLD_CHAINED_FIXUPS size wrong";
-				chainedFixupsCmd = (struct linkedit_data_command*)cmd;
-				*compressed = true;
-				break;
-			case LC_DYLD_EXPORTS_TRIE:
-				if ( cmd->cmdsize != sizeof(linkedit_data_command) )
-					throw "malformed mach-o image: LC_DYLD_EXPORTS_TRIE size wrong";
-				exportsTrieCmd = (struct linkedit_data_command*)cmd;
-				break;
 			case LC_SEGMENT_COMMAND:
 				segCmd = (struct macho_segment_command*)cmd;
-#if TARGET_OS_OSX
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 				// rdar://problem/19617624 allow unmapped segments on OSX (but not iOS)
 				if ( ((segCmd->filesize) > pageAlign(segCmd->vmsize)) && (segCmd->vmsize != 0) )
 #else
@@ -211,7 +241,7 @@
 				if ( segCmd->vmsize != 0 )
 					*segCount += 1;
 				if ( strcmp(segCmd->segname, "__LINKEDIT") == 0 ) {
-		#if TARGET_OS_SIMULATOR
+		#if TARGET_IPHONE_SIMULATOR
 					// Note: should check on all platforms that __LINKEDIT is read-only, but <rdar://problem/22637626&22525618>
 					if ( segCmd->initprot != VM_PROT_READ )
 						throw "malformed mach-o image: __LINKEDIT segment does not have read-only permissions";
@@ -305,7 +335,6 @@
 			case LC_LOAD_UPWARD_DYLIB:
 				*libCount += 1;
 				// fall thru
-				[[clang::fallthrough]];
 			case LC_ID_DYLIB:
 				dylibCmd = (dylib_command*)cmd;
 				if ( dylibCmd->dylib.name.offset > cmdLength )
@@ -347,12 +376,12 @@
 					throw "malformed mach-o image: LC_DYSYMTAB size wrong";
 				dynSymbTabCmd = (dysymtab_command*)cmd;
 				break;
-#if TARGET_OS_OSX
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 			// <rdar://problem/26797345> error when loading iOS Simulator mach-o binary into macOS process
 			case LC_VERSION_MIN_WATCHOS:
 			case LC_VERSION_MIN_TVOS:
 			case LC_VERSION_MIN_IPHONEOS:
-				if ( !context.iOSonMac )
+				if ( !context.marzipan )
 					throw "mach-o, but built for simulator (not macOS)";
 				break;
 #endif
@@ -367,7 +396,7 @@
 	if ( !inCache && (startOfFileSegCmd == NULL) )
 		throw "malformed mach-o image: missing __TEXT segment that maps start of file";
 	// <rdar://problem/13145644> verify every segment does not overlap another segment
-	if ( context.strictMachORequired && !inCache ) {
+	if ( context.strictMachORequired ) {
 		uintptr_t lastFileStart = 0;
 		uintptr_t linkeditFileStart = 0;
 		const struct load_command* cmd1 = startCmds;
@@ -414,8 +443,8 @@
 	}
 
 	// validate linkedit content
-	if  ( (dyldInfoCmd == NULL) && (chainedFixupsCmd == NULL) && (symTabCmd == NULL) )
-		throw "malformed mach-o image: missing LC_SYMTAB, LC_DYLD_INFO, or LC_DYLD_CHAINED_FIXUPS";
+	if  ( (dyldInfoCmd == NULL) && (symTabCmd == NULL) )
+		throw "malformed mach-o image: missing LC_SYMTAB or LC_DYLD_INFO";
 	if  ( dynSymbTabCmd == NULL )
 		throw "malformed mach-o image: missing LC_DYSYMTAB";
 
@@ -470,22 +499,6 @@
 			if ( offset > linkeditFileOffsetEnd )
 				throw "malformed mach-o image: dyld export info overruns __LINKEDIT";
 		}
-	}
-
-	if ( !inCache && (chainedFixupsCmd != NULL) && context.strictMachORequired ) {
-		// validate all LC_DYLD_CHAINED_FIXUPS chunks fit in LINKEDIT and don't overlap
-		if ( chainedFixupsCmd->dataoff < linkeditFileOffsetStart )
-			throw "malformed mach-o image: dyld chained fixups info underruns __LINKEDIT";
-		if ( (chainedFixupsCmd->dataoff + chainedFixupsCmd->datasize) > linkeditFileOffsetEnd )
-			throw "malformed mach-o image: dyld chained fixups info overruns __LINKEDIT";
-	}
-
-	if ( !inCache && (exportsTrieCmd != NULL) && context.strictMachORequired ) {
-		// validate all LC_DYLD_EXPORTS_TRIE chunks fit in LINKEDIT and don't overlap
-		if ( exportsTrieCmd->dataoff < linkeditFileOffsetStart )
-			throw "malformed mach-o image: dyld chained fixups info underruns __LINKEDIT";
-		if ( (exportsTrieCmd->dataoff + exportsTrieCmd->datasize) > linkeditFileOffsetEnd )
-			throw "malformed mach-o image: dyld chained fixups info overruns __LINKEDIT";
 	}
 
 	if ( symTabCmd != NULL ) {
@@ -508,13 +521,6 @@
 			if ( context.strictMachORequired || (symTabCmd->stroff + symTabCmd->strsize > ((linkeditFileOffsetEnd + 4095) & (-4096))) )
 				throw "malformed mach-o image: symbol strings overrun __LINKEDIT";
 		}
-#if TARGET_OS_OSX
-		if ( (symTabCmd->symoff % sizeof(void*)) != 0 ) {
-			// <rdar://53723577> allow old malformed plugins in new app
-			if ( sdkVersion((mach_header*)mh) >= DYLD_PACKED_VERSION(10,15,0) )
-				throw "malformed mach-o image: mis-aligned symbol table __LINKEDIT";
-		}
-#endif
 		// validate indirect symbol table
 		if ( dynSymbTabCmd->nindirectsyms != 0 ) {
 			if ( dynSymbTabCmd->indirectsymoff < linkeditFileOffsetStart )
@@ -554,10 +560,6 @@
 
 	if ( needsAddedLibSystemDepency(*libCount, mh) )
 		*libCount = 1;
-
-	// dylibs that use LC_DYLD_CHAINED_FIXUPS have that load command removed when put in the dyld cache
-	if ( !*compressed && (mh->flags & MH_DYLIB_IN_CACHE) )
-		*compressed = true;
 }
 
 
@@ -670,7 +672,7 @@
 	for(unsigned int i=0; i < fSegmentsCount; ++i) {
 		// set up pointer to __LINKEDIT segment
 		if ( strcmp(segName(i),"__LINKEDIT") == 0 ) {
-	#if !TARGET_OS_OSX
+	#if !__MAC_OS_X_VERSION_MIN_REQUIRED
 			// <rdar://problem/42419336> historically, macOS never did this check
 			if ( segFileOffset(i) > fCoveredCodeLength )
 				dyld::throwf("cannot load '%s' (segment outside of code signature)", this->getShortName());
@@ -685,9 +687,6 @@
 			if ( segHasBindFixUps(i) )
 				fTextSegmentBinds = true;
 		}
-#else
-		if ( segIsReadOnlyData(i) )
-			fReadOnlyDataSegment = true;
 #endif
 #if __i386__
 		if ( segIsReadOnlyImport(i) )
@@ -713,8 +712,6 @@
 
 	// walk load commands (mapped in at start of __TEXT segment)
 	const dyld_info_command* dyldInfo = NULL;
-	const linkedit_data_command* chainedFixupsCmd = NULL;
-	const linkedit_data_command* exportsTrieCmd = NULL;
 	const macho_nlist* symbolTable = NULL;
 	const char* symbolTableStrings = NULL;
 	const struct load_command* firstUnknownCmd = NULL;
@@ -751,17 +748,11 @@
 			case LC_DYLD_INFO_ONLY:
 				dyldInfo = (struct dyld_info_command*)cmd;
 				break;
-			case LC_DYLD_CHAINED_FIXUPS:
-				chainedFixupsCmd = (struct linkedit_data_command*)cmd;
-				break;
-			case LC_DYLD_EXPORTS_TRIE:
-				exportsTrieCmd = (struct linkedit_data_command*)cmd;
-				break;
 			case LC_SEGMENT_COMMAND:
 				{
 					const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
 					const bool isTextSeg = (strcmp(seg->segname, "__TEXT") == 0);
-		#if __i386__ && TARGET_OS_OSX
+		#if __i386__ && __MAC_OS_X_VERSION_MIN_REQUIRED
 					const bool isObjCSeg = (strcmp(seg->segname, "__OBJC") == 0);
 					if ( isObjCSeg )
 						fNotifyObjC = true;
@@ -774,8 +765,6 @@
 						const uint8_t type = sect->flags & SECTION_TYPE;
 						if ( type == S_MOD_INIT_FUNC_POINTERS )
 							fHasInitializers = true;
-						else if ( type == S_INIT_FUNC_OFFSETS )
-							fHasInitializers = true;
 						else if ( type == S_MOD_TERM_FUNC_POINTERS )
 							fHasTerminators = true;
 						else if ( type == S_DTRACE_DOF )
@@ -785,7 +774,7 @@
 						else if ( isTextSeg && (strcmp(sect->sectname, "__unwind_info") == 0) )
 							fUnwindInfoSectionOffset = (uint32_t)((uint8_t*)sect - fMachOData);
 
-		#if __i386__ && TARGET_OS_OSX
+		#if __i386__ && __MAC_OS_X_VERSION_MIN_REQUIRED
 						else if ( isObjCSeg ) {
 							if ( strcmp(sect->sectname, "__image_info") == 0 ) {
 								const uint32_t* imageInfo = (uint32_t*)(sect->addr + fSlide);
@@ -799,7 +788,7 @@
 						}
 		#else
 						else if ( isDataSeg && (strncmp(sect->sectname, "__objc_imageinfo", 16) == 0) ) {
-			#if TARGET_OS_OSX
+			#if __MAC_OS_X_VERSION_MIN_REQUIRED
 							const uint32_t* imageInfo = (uint32_t*)(sect->addr + fSlide);
 							uint32_t flags = imageInfo[1];
 							if ( (flags & 4) && (((macho_header*)fMachOData)->filetype != MH_EXECUTE) )
@@ -826,6 +815,7 @@
 		    case LC_REEXPORT_DYLIB:
 			case LC_LOAD_UPWARD_DYLIB:
 			case LC_MAIN:
+				// do nothing, just prevent LC_REQ_DYLD exception from occuring
 				break;
 			case LC_VERSION_MIN_MACOSX:
 			case LC_VERSION_MIN_IPHONEOS:
@@ -857,13 +847,9 @@
 	
 	if ( dyldInfo != NULL )
 		this->setDyldInfo(dyldInfo);
-	if ( chainedFixupsCmd != NULL )
-		this->setChainedFixups(chainedFixupsCmd);
-	if ( exportsTrieCmd != NULL )
-		this->setExportsTrie(exportsTrieCmd);
-
 	if ( symbolTable != NULL)
 		this->setSymbolTableInfo(symbolTable, symbolTableStrings, dynSymbolTable);
+	
 }
 
 // don't do this work in destructor because we need object to be full subclass
@@ -1013,13 +999,6 @@
 }
 #endif
 
-bool ImageLoaderMachO::segIsReadOnlyData(unsigned int segIndex) const
-{
-	const macho_segment_command* segCmd = segLoadCommand(segIndex);
-	return (    (segCmd->initprot & VM_PROT_WRITE)
-			&& ((segCmd->initprot & VM_PROT_EXECUTE) == 0)
-			&& (segCmd->flags & SG_READ_ONLY) );
-}
 
 void ImageLoaderMachO::UnmapSegments()
 {
@@ -1047,6 +1026,32 @@
 }
 
 
+// prefetch __DATA/__OBJC pages during launch, but not for dynamically loaded code
+void ImageLoaderMachO::preFetchDATA(int fd, uint64_t offsetInFat, const LinkContext& context)
+{
+	if ( context.linkingMainExecutable ) {
+		for(unsigned int i=0, e=segmentCount(); i < e; ++i) {
+			if ( segWriteable(i) && (segFileSize(i) > 0) ) {
+				// prefetch writable segment that have mmap'ed regions
+				radvisory advice;
+				advice.ra_offset = offsetInFat + segFileOffset(i);
+				advice.ra_count = (int)segFileSize(i);
+				// limit prefetch to 1MB (256 pages)
+				if ( advice.ra_count > 1024*1024 )
+					advice.ra_count = 1024*1024;
+				// don't prefetch single pages, let them fault in
+				fgTotalBytesPreFetched += advice.ra_count;
+				fcntl(fd, F_RDADVISE, &advice);
+				if ( context.verboseMapping ) {
+					dyld::log("%18s prefetching 0x%0lX -> 0x%0lX\n", 
+						segName(i), segActualLoadAddress(i), segActualLoadAddress(i)+advice.ra_count-1);
+				}
+			}
+		}
+	}
+}
+
+
 bool ImageLoaderMachO::segmentsMustSlideTogether() const 
 {
 	return true;
@@ -1137,9 +1142,9 @@
 		disableCoverageCheck();
 	}
 	else {
-#if TARGET_OS_OSX
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 		// <rdar://problem/13622786> ignore code signatures in binaries built with pre-10.9 tools
-		if ( this->sdkVersion() < DYLD_PACKED_VERSION(10,9,0) ) {
+		if ( this->sdkVersion() < DYLD_MACOSX_VERSION_10_9 ) {
 			disableCoverageCheck();
 			return;
 		}
@@ -1151,7 +1156,7 @@
 		siginfo.fs_blob_size=codeSigCmd->datasize;			// size of CD
 		int result = fcntl(fd, F_ADDFILESIGS_RETURN, &siginfo);
 
-#if TARGET_OS_SIMULATOR
+#if TARGET_IPHONE_SIMULATOR
 		// rdar://problem/18759224> check range covered by the code directory after loading
 		// Attempt to fallback only if we are in the simulator
 
@@ -1189,10 +1194,10 @@
 
 void ImageLoaderMachO::validateFirstPages(const struct linkedit_data_command* codeSigCmd, int fd, const uint8_t *fileData, size_t lenFileData, off_t offsetInFat, const LinkContext& context)
 {
-#if TARGET_OS_OSX
+#if __MAC_OS_X_VERSION_MIN_REQUIRED
 	// rdar://problem/21839703> 15A226d: dyld crashes in mageLoaderMachO::validateFirstPages during dlopen() after encountering an mmap failure
 	// We need to ignore older code signatures because they will be bad.
-	if ( this->sdkVersion() < DYLD_PACKED_VERSION(10,9,0) ) {
+	if ( this->sdkVersion() < DYLD_MACOSX_VERSION_10_9 ) {
 		return;
 	}
 #endif
@@ -1344,13 +1349,8 @@
 			entry_point_command* mainCmd = (entry_point_command*)cmd;
 			void* entry = (void*)(mainCmd->entryoff + (char*)fMachOData);
 			// <rdar://problem/8543820&9228031> verify entry point is in image
-			if ( this->containsAddress(entry) ) {
-#if __has_feature(ptrauth_calls)
-				// start() calls the result pointer as a function pointer so we need to sign it.
-				return __builtin_ptrauth_sign_unauthenticated(entry, 0, 0);
-#endif
+			if ( this->containsAddress(entry) )
 				return entry;
-			}
 			else
 				throw "LC_MAIN entryoff is out of range";
 		}
@@ -1376,6 +1376,13 @@
 	#elif __x86_64__
 			const x86_thread_state64_t* registers = (x86_thread_state64_t*)(((char*)cmd) + 16);
 			void* entry = (void*)(registers->rip + fSlide);
+			// <rdar://problem/8543820&9228031> verify entry point is in image
+			if ( this->containsAddress(entry) )
+				return entry;
+	#elif __arm64__ && !__arm64e__
+			// temp support until <rdar://39514191> is fixed
+			const uint64_t* regs64 = (uint64_t*)(((char*)cmd) + 16);
+			void* entry = (void*)(regs64[32] + fSlide); // arm_thread_state64_t.__pc
 			// <rdar://problem/8543820&9228031> verify entry point is in image
 			if ( this->containsAddress(entry) )
 				return entry;
@@ -1411,10 +1418,10 @@
 				{
 				const dylib_command* dylibID = (dylib_command*)cmd;
 				const char* installPath = (char*)cmd + dylibID->dylib.name.offset;
-				// It is OK for OS dylibs (libSystem or libmath) to have no dependents
+				// It is OK for OS dylibs (libSystem or libmath or Rosetta shims) to have no dependents
 				// but all other dylibs must depend on libSystem for initialization to initialize libSystem first
-				isNonOSdylib = ( (strncmp(installPath, "/usr/lib/", 9) != 0) && (strncmp(installPath, "/System/DriverKit/usr/lib/", 26) != 0) );
-				// if (isNonOSdylib) dyld::log("ImageLoaderMachO::needsAddedLibSystemDepency(%s)\n", installPath);
+				// <rdar://problem/6497528> rosetta circular dependency spew
+				isNonOSdylib = ( (strncmp(installPath, "/usr/lib/", 9) != 0) && (strncmp(installPath, "/usr/libexec/oah/Shims", 9) != 0) );
 				}
 				break;
 		}
@@ -1495,7 +1502,7 @@
 				const char* path = (char*)cmd + ((struct rpath_command*)cmd)->path.offset;
 				if ( (strncmp(path, "@loader_path", 12) == 0) && ((path[12] == '/') || (path[12] == '\0')) ) {
 					if ( !context.allowAtPaths && (context.mainExecutable == this) ) {
-						dyld::warn("LC_RPATH %s in %s being ignored in restricted program because of @loader_path (Codesign main executable with Library Validation to allow @ paths)\n", path, this->getPath());
+						dyld::warn("LC_RPATH %s in %s being ignored in restricted program because of @loader_path\n", path, this->getPath());
 						break;
 					}
 					char resolvedPath[PATH_MAX];
@@ -1511,7 +1518,7 @@
 				}
 				else if ( (strncmp(path, "@executable_path", 16) == 0) && ((path[16] == '/') || (path[16] == '\0')) ) {
 					if ( !context.allowAtPaths) {
-						dyld::warn("LC_RPATH %s in %s being ignored in restricted program because of @executable_path (Codesign main executable with Library Validation to allow @ paths)\n", path, this->getPath());
+						dyld::warn("LC_RPATH %s in %s being ignored in restricted program because of @executable_path\n", path, this->getPath());
 						break;
 					}
 					char resolvedPath[PATH_MAX];
@@ -1532,31 +1539,27 @@
 #if SUPPORT_ROOT_PATH
 				else if ( (path[0] == '/') && (context.rootPaths != NULL) ) {
 					// <rdar://problem/5869973> DYLD_ROOT_PATH should apply to LC_RPATH rpaths
-					// <rdar://problem/49576123> Even if DYLD_ROOT_PATH exists, LC_RPATH should add raw path to rpaths
 					// DYLD_ROOT_PATH can be a list of paths, but at this point we can only support one, so use first combination that exists
-					for (const char** rp = context.rootPaths; *rp != NULL; ++rp) {
+					bool found = false;
+					for(const char** rp = context.rootPaths; *rp != NULL; ++rp) {
 						char newPath[PATH_MAX];
 						strlcpy(newPath, *rp, PATH_MAX);
 						strlcat(newPath, path, PATH_MAX);
 						struct stat stat_buf;
-						if ( dyld3::stat(newPath, &stat_buf) != -1 ) {
-							// dyld::log("combined DYLD_ROOT_PATH and LC_RPATH: %s\n", newPath);
-							paths.push_back(strdup(newPath));
+						if ( stat(newPath, &stat_buf) != -1 ) {
+							//dyld::log("combined DYLD_ROOT_PATH and LC_RPATH: %s\n", newPath);
+							pathToAdd = strdup(newPath);
+							found = true;
+							break;
 						}
 					}
-					// add in raw absolute path without root prefix
-					pathToAdd = strdup(path);
+					if ( ! found ) {
+						// make copy so that all elements of 'paths' can be freed
+						pathToAdd = strdup(path);
+					}
 				}
 #endif
 				else {
-					// realpath() is slow, and /usr/lib/swift is a real path, so don't realpath it
-					if ( strcmp(path, "/usr/lib/swift") != 0 ) {
-						char resolvedPath[PATH_MAX];
-						if ( (realpath(path, resolvedPath) != NULL) && (strcmp(path, resolvedPath) != 0) ) {
-							// <rdar://problem/45470293> support LC_RPATH symlinks to directories of things in the dyld cache
-							path = resolvedPath;
-						}
-					}
 					// make copy so that all elements of 'paths' can be freed
 					pathToAdd = strdup(path);
 				}
@@ -1633,7 +1636,7 @@
 #endif
 
 	// if loaded at preferred address, no rebasing necessary
-	if ( this->fSlide == 0 )
+	if ( this->fSlide == 0 ) 
 		return;
 
 #if TEXT_RELOC_SUPPORT
@@ -2072,16 +2075,6 @@
 extern "C" void stub_binding_helper();
 extern "C" int _dyld_func_lookup(const char* name, void** address);
 
-static const char* libDyldPath(const ImageLoader::LinkContext& context)
-{
-#if TARGET_OS_OSX
-	if ( context.driverKit )
-		return DRIVERKIT_LIBDYLD_DYLIB_PATH;
-	else
-#endif
-	return LIBDYLD_DYLIB_PATH;
-}
-
 void ImageLoaderMachO::setupLazyPointerHandler(const LinkContext& context)
 {
 	const macho_header* mh = (macho_header*)fMachOData;
@@ -2110,7 +2103,7 @@
 				#endif // !__arm64__
 							// <rdar://problem/40352925> Add work around for existing apps that have deprecated __dyld section
 							const char* installNm = this->getInstallPath();
-							if ( (mh->filetype != MH_DYLIB) || (installNm == NULL) || (strcmp(installNm, libDyldPath(context)) != 0) ) {
+							if ( (mh->filetype != MH_DYLIB) || (installNm == NULL) || (strcmp(installNm, "/usr/lib/system/libdyld.dylib") != 0) ) {
 						#if TARGET_OS_OSX
 								// don't allow macOS apps build with 10.14 or later SDK and targeting 10.8 or later to have a __dyld section
 								if ( (minOSVersion() >= 0x000a0800) && (sdkVersion() >= 0x000a0e00) )
@@ -2155,7 +2148,7 @@
 							}
 							else if ( mh->filetype == MH_DYLIB ) {
 								const char* installPath = this->getInstallPath();
-								if ( (installPath != NULL) && ((strncmp(installPath, "/usr/lib/", 9) == 0) || (strncmp(installPath, "/System/DriverKit/usr/lib/", 26) == 0)) ) {
+								if ( (installPath != NULL) && (strncmp(installPath, "/usr/lib/", 9) == 0) ) {
 									if ( sect->size > offsetof(DATAdyld, vars) ) {
 										// use ProgramVars from libdyld.dylib but tweak mh field to correct value
 										dd->vars.mh = context.mainExecutable->machHeader();
@@ -2212,9 +2205,13 @@
 
 bool ImageLoaderMachO::usablePrebinding(const LinkContext& context) const
 {
-	// dylibs in dyld cache do not need to be rebased or bound
-	// for chained fixups always pretend dylib is up to date, patch tables will be used later
-	if ( fInSharedCache && (this->allDependentLibrariesAsWhenPreBound() || context.dyldCache->header.builtFromChainedFixups) ) {
+	// if prebound and loaded at prebound address, and all libraries are same as when this was prebound, then no need to bind
+	if ( ((this->isPrebindable() && (this->getSlide() == 0)) || fInSharedCache)
+		&& this->usesTwoLevelNameSpace()
+#if !USES_CHAINED_BINDS
+		&& this->allDependentLibrariesAsWhenPreBound()
+#endif
+		 ) {
 		// allow environment variables to disable prebinding
 		if ( context.bindFlat )
 			return false;
@@ -2274,18 +2271,6 @@
 		}
 	}
 }
-
-static const char* libSystemPath(const ImageLoader::LinkContext& context)
-{
-#if TARGET_OS_OSX
-	if ( context.driverKit )
-		return DRIVERKIT_LIBSYSTEM_DYLIB_PATH;
-	else
-#endif
-	return LIBSYSTEM_DYLIB_PATH;
-}
-
-
 
 void ImageLoaderMachO::doModInitFunctions(const LinkContext& context)
 {
@@ -2315,7 +2300,7 @@
 							if ( ! dyld::gProcessInfo->libSystemInitialized ) {
 								// <rdar://problem/17973316> libSystem initializer must run first
 								const char* installPath = getInstallPath();
-								if ( (installPath == NULL) || (strcmp(installPath, libSystemPath(context)) != 0) )
+								if ( (installPath == NULL) || (strcmp(installPath, LIBSYSTEM_DYLIB_PATH) != 0) )
 									dyld::throwf("initializer in image (%s) that does not link with libSystem.dylib\n", this->getPath());
 							}
 							if ( context.verboseInit )
@@ -2325,44 +2310,6 @@
 								dyld3::ScopedTimer(DBG_DYLD_TIMING_STATIC_INITIALIZER, (uint64_t)fMachOData, (uint64_t)func, 0);
 								func(context.argc, context.argv, context.envp, context.apple, &context.programVars);
 							}
-							bool haveLibSystemHelpersAfter = (dyld::gLibSystemHelpers != NULL);
-							if ( !haveLibSystemHelpersBefore && haveLibSystemHelpersAfter ) {
-								// now safe to use malloc() and other calls in libSystem.dylib
-								dyld::gProcessInfo->libSystemInitialized = true;
-							}
-						}
-					}
-					else if ( type == S_INIT_FUNC_OFFSETS ) {
-						const uint32_t* inits = (uint32_t*)(sect->addr + fSlide);
-						const size_t count = sect->size / sizeof(uint32_t);
-						// Ensure section is within segment
-						if ( (sect->addr < seg->vmaddr) || (sect->addr+sect->size > seg->vmaddr+seg->vmsize) || (sect->addr+sect->size < sect->addr) )
-							dyld::throwf("__init_offsets section has malformed address range for %s\n", this->getPath());
-						if ( seg->initprot & VM_PROT_WRITE )
-							dyld::throwf("__init_offsets section is not in read-only segment %s\n", this->getPath());
-						for (size_t j=0; j < count; ++j) {
-							uint32_t funcOffset = inits[j];
-							// verify initializers are in image
-							if ( ! this->containsAddress((uint8_t*)this->machHeader() + funcOffset) ) {
-								dyld::throwf("initializer function offset 0x%08X not in mapped image for %s\n", funcOffset, this->getPath());
-							}
-							if ( ! dyld::gProcessInfo->libSystemInitialized ) {
-								// <rdar://problem/17973316> libSystem initializer must run first
-								const char* installPath = getInstallPath();
-								if ( (installPath == NULL) || (strcmp(installPath, libSystemPath(context)) != 0) )
-									dyld::throwf("initializer in image (%s) that does not link with libSystem.dylib\n", this->getPath());
-							}
-                            Initializer func = (Initializer)((uint8_t*)this->machHeader() + funcOffset);
-							if ( context.verboseInit )
-								dyld::log("dyld: calling initializer function %p in %s\n", func, this->getPath());
-#if __has_feature(ptrauth_calls)
-							func = (Initializer)__builtin_ptrauth_sign_unauthenticated((void*)func, ptrauth_key_asia, 0);
-#endif
-							bool haveLibSystemHelpersBefore = (dyld::gLibSystemHelpers != NULL);
-							{
-								dyld3::ScopedTimer(DBG_DYLD_TIMING_STATIC_INITIALIZER, (uint64_t)fMachOData, (uint64_t)func, 0);
-                                func(context.argc, context.argv, context.envp, context.apple, &context.programVars);
-                            }
 							bool haveLibSystemHelpersAfter = (dyld::gLibSystemHelpers != NULL);
 							if ( !haveLibSystemHelpersBefore && haveLibSystemHelpersAfter ) {
 								// now safe to use malloc() and other calls in libSystem.dylib
@@ -2489,13 +2436,13 @@
 	dyld::log("total images using weak symbols:  %u\n", fgImagesRequiringCoalescing);
 }
 
-intptr_t ImageLoaderMachO::assignSegmentAddresses(const LinkContext& context, size_t extraAllocationSize)
+
+intptr_t ImageLoaderMachO::assignSegmentAddresses(const LinkContext& context)
 {
 	// preflight and calculate slide if needed
 	const bool inPIE = (fgNextPIEDylibAddress != 0);
 	intptr_t slide = 0;
 	if ( this->segmentsCanSlide() && this->segmentsMustSlideTogether() ) {
-		intptr_t segmentReAlignSlide = 0;
 		bool needsToSlide = false;
 		bool imageHasPreferredLoadAddress = segHasPreferredLoadAddress(0);
 		uintptr_t lowAddr = (unsigned long)(-1);
@@ -2513,53 +2460,22 @@
 				lowAddr = segLow;
 			if ( segHigh > highAddr )
 				highAddr = segHigh;
-
-#if defined(__x86_64__) && !TARGET_OS_SIMULATOR
-			// For Cambria on Aruba systems (16k page size), realign the image so the first segment ends on a 16k boundry.
-			// FIXME: this can be removed when Aruba dev systems are no longer supported.
-			if ( dyld::isTranslated() && vm_page_size == 0x4000 && i == 0 && segLow == 0 ) {
-				const uintptr_t segHighPageOffset = segHigh & vm_page_mask;
-				if ( segHighPageOffset > 0 ) {
-					// Adjust the slide to make the first segment end on a page boundry.
-					needsToSlide = true;
-					segmentReAlignSlide = vm_page_size - segHighPageOffset;
-
-					if (context.verboseMapping) {
-						dyld::log("dyld: Image %s first segment(%s) does not end on a page boundry [0x%lx, 0x%lx) adding 0x%lx to slide to realign\n", getPath(), segName(i), segLow, segHigh, segmentReAlignSlide);
-					}
-				}
-			}
-#endif
+				
 			if ( needsToSlide || !imageHasPreferredLoadAddress || inPIE || !reserveAddressRange(segPreferredLoadAddress(i), segSize(i)) )
 				needsToSlide = true;
 		}
 		if ( needsToSlide ) {
 			// find a chunk of address space to hold all segments
-			size_t size = highAddr-lowAddr+segmentReAlignSlide;
-			uintptr_t addr = reserveAnAddressRange(size+extraAllocationSize, context);
-			slide = addr - lowAddr + segmentReAlignSlide;
-		} else if ( extraAllocationSize ) {
-			if (!reserveAddressRange(highAddr, extraAllocationSize)) {
-				throw "failed to reserve space for aot";
-			}
+			uintptr_t addr = reserveAnAddressRange(highAddr-lowAddr, context);
+			slide = addr - lowAddr;
 		}
 	} 
 	else if ( ! this->segmentsCanSlide() ) {
-		uintptr_t highAddr = 0;
 		for(unsigned int i=0, e=segmentCount(); i < e; ++i) {
-			const uintptr_t segLow = segPreferredLoadAddress(i);
-			const uintptr_t segHigh = dyld_page_round(segLow + segSize(i));
-
-			if ( segHigh > highAddr )
-				highAddr = segHigh;
-
 			if ( (strcmp(segName(i), "__PAGEZERO") == 0) && (segFileSize(i) == 0) && (segPreferredLoadAddress(i) == 0) )
 				continue;
 			if ( !reserveAddressRange(segPreferredLoadAddress(i), segSize(i)) )
 				dyld::throwf("can't map unslidable segment %s to 0x%lX with size 0x%lX", segName(i), segPreferredLoadAddress(i), segSize(i));
-		}
-		if (extraAllocationSize) {
-			dyld::throwf("binaries with non-slidable segments don't support aot: %s", this->getPath());
 		}
 	}
 	else {
@@ -2602,58 +2518,23 @@
 	return true;
 }
 
+
+
 void ImageLoaderMachO::mapSegments(int fd, uint64_t offsetInFat, uint64_t lenInFat, uint64_t fileLen, const LinkContext& context)
 {
-	uint64_t extra_allocation_size = 0;
-
-#if defined(__x86_64__) && !TARGET_OS_SIMULATOR
-	if (dyld::isTranslated()) {
-		fAotPath = new char[PATH_MAX];
-		int ret = syscall(0x7000001, fd, this->getPath(), &extra_allocation_size, fAotPath, PATH_MAX);
-		if (ret != 0) {
-			delete fAotPath;
-			fAotPath = nullptr;
-		}
-	}
-#endif
-
 	// find address range for image
-	intptr_t slide = this->assignSegmentAddresses(context, extra_allocation_size);
+	intptr_t slide = this->assignSegmentAddresses(context);
 	if ( context.verboseMapping ) {
 		if ( offsetInFat != 0 )
 			dyld::log("dyld: Mapping %s (slice offset=%llu)\n", this->getPath(), (unsigned long long)offsetInFat);
 		else
 			dyld::log("dyld: Mapping %s\n", this->getPath());
 	}
-
-	// <rdar://problem/47163421> speculatively read whole slice
-	fspecread_t specread = {} ;
-	specread.fsr_offset = offsetInFat;
-	specread.fsr_length = lenInFat;
-	specread.fsr_flags  = 0;
-	fcntl(fd, F_SPECULATIVE_READ, &specread);
-	if ( context.verboseMapping )
-		dyld::log("dyld: Speculatively read offset=0x%08llX, len=0x%08llX, path=%s\n", offsetInFat, lenInFat, this->getPath());
-
 	// map in all segments
-	uintptr_t baseAddress = (unsigned long)(-1);
-	uintptr_t endAddress = 0;
-	uintptr_t mappedMachHeaderAddress = 0;
 	for(unsigned int i=0, e=segmentCount(); i < e; ++i) {
 		vm_offset_t fileOffset = (vm_offset_t)(segFileOffset(i) + offsetInFat);
 		vm_size_t size = segFileSize(i);
 		uintptr_t requestedLoadAddress = segPreferredLoadAddress(i) + slide;
-		const uintptr_t segmentEnd = dyld_page_round(requestedLoadAddress + segSize(i));
-
-		if ( requestedLoadAddress < baseAddress )
-			baseAddress = requestedLoadAddress;
-		if ( segmentEnd > endAddress )
-			endAddress = segmentEnd;
-
-		if (segFileOffset(i) == 0 && segFileSize(i) != 0) {
-			mappedMachHeaderAddress = requestedLoadAddress;
-		}
-
 		int protection = 0;
 		if ( !segUnaccessible(i) ) {
 			if ( segExecutable(i) )
@@ -2700,24 +2581,6 @@
 				(protection & PROT_READ) ? 'r' : '.',  (protection & PROT_WRITE) ? 'w' : '.',  (protection & PROT_EXEC) ? 'x' : '.' );
 	}
 
-#if defined(__x86_64__) && !TARGET_OS_SIMULATOR
-	if (dyld::isTranslated() && extra_allocation_size != 0) {
-		const struct mach_header* aot_load_address;
-		dyld_aot_image_info aot_image_info = {};
-		int ret = syscall(0x7000002, this->getPath(), mappedMachHeaderAddress, endAddress, &aot_load_address, &aot_image_info.aotImageSize, aot_image_info.aotImageKey);
-		if (ret == 0) {
-			extern void addAotImagesToAllAotImages(uint32_t aotInfoCount, const dyld_aot_image_info aotInfo[]);
-
-			// fill in the aot load address, at this point the cambria trap has filled in
-			// the image size and image key fields
-			aot_image_info.aotLoadAddress = aot_load_address;
-			aot_image_info.x86LoadAddress = (struct mach_header*)baseAddress;
-
-			addAotImagesToAllAotImages(1, &aot_image_info);
-		}
-	}
-#endif
-
 	// update slide to reflect load location			
 	this->setSlide(slide);
 }
@@ -2725,7 +2588,7 @@
 void ImageLoaderMachO::mapSegments(const void* memoryImage, uint64_t imageLen, const LinkContext& context)
 {
 	// find address range for image
-	intptr_t slide = this->assignSegmentAddresses(context, 0);
+	intptr_t slide = this->assignSegmentAddresses(context);
 	if ( context.verboseMapping )
 		dyld::log("dyld: Mapping memory %p\n", memoryImage);
 	// map in all segments
@@ -2743,52 +2606,24 @@
 	this->setSlide(slide);
 	// set R/W permissions on all segments at slide location
 	for(unsigned int i=0, e=segmentCount(); i < e; ++i) {
-		segProtect(i, context);
-	}
-}
-
-static vm_prot_t protectionForSegIndex(const ImageLoaderMachO* image, unsigned int segIndex)
-{
-	if ( image->segUnaccessible(segIndex) )
-		return 0;
+		segProtect(i, context);		
+	}
+}
+
+
+void ImageLoaderMachO::segProtect(unsigned int segIndex, const ImageLoader::LinkContext& context)
+{
 	vm_prot_t protection = 0;
-	if ( image->segExecutable(segIndex) )
-		protection |= PROT_EXEC;
-	if ( image->segReadable(segIndex) )
-		protection |= PROT_READ;
-	if ( image->segWriteable(segIndex) )
-		protection |= PROT_WRITE;
-	return protection;
-}
-
-
-void ImageLoaderMachO::segProtect(unsigned int segIndex, const ImageLoader::LinkContext& context)
-{
-	vm_prot_t protection = protectionForSegIndex(this, segIndex);
+	if ( !segUnaccessible(segIndex) ) {
+		if ( segExecutable(segIndex) )
+			protection   |= PROT_EXEC;
+		if ( segReadable(segIndex) )
+			protection   |= PROT_READ;
+		if ( segWriteable(segIndex) )
+			protection   |= PROT_WRITE;
+	}
 	vm_address_t addr = segActualLoadAddress(segIndex);
 	vm_size_t size = segSize(segIndex);
-
-#if defined(__x86_64__) && !TARGET_OS_SIMULATOR
-	if ( dyld::isTranslated() ) {
-		// <rdar://problem/60543794> can't vm_protect non-16KB segments
-		if ( (segIndex > 0) && ((addr & 0x3FFF) != 0) ) {
-			// overlaps previous segment
-			vm_prot_t prevProt = protectionForSegIndex(this, segIndex-1);
-			if ( (protection & prevProt) != prevProt ) {
-				// previous had more bits, so we need to not apply new permissions to the overlap
-				vm_size_t overlap = 0x4000 - (addr & 0x3FFF);
-				addr += overlap;
-				if ( size >= overlap )
-					size -= overlap;
-				else if ( size < overlap )
-					size = 0;
-			}
-			if ( size == 0 )
-				return;
-		}
-	}
-#endif
-
 	const bool setCurrentPermissions = false;
 	kern_return_t r = vm_protect(mach_task_self(), addr, size, setCurrentPermissions, protection);
 	if ( r != KERN_SUCCESS ) {
@@ -2913,6 +2748,8 @@
 {
 	if ( lazyBindingInfoOffset > (lazyInfoEnd-lazyInfoStart) )
 		return false;
+	uint8_t type = BIND_TYPE_POINTER;
+	uint8_t symboFlags = 0;
 	bool done = false;
 	const uint8_t* p = &lazyInfoStart[lazyBindingInfoOffset];
 	while ( !done && (p < lazyInfoEnd) ) {
@@ -2941,11 +2778,13 @@
 				break;
 			case BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM:
 				*symbolName = (char*)p;
+				symboFlags = immediate;
 				while (*p != '\0')
 					++p;
 				++p;
 				break;
 			case BIND_OPCODE_SET_TYPE_IMM:
+				type = immediate;
 				break;
 			case BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB:
 				*segIndex  = immediate;