Loading...
--- libmalloc/libmalloc-409.60.6/src/malloc.c
+++ libmalloc/libmalloc-317.40.8/src/malloc.c
@@ -23,12 +23,12 @@
 
 #include "internal.h"
 
-#if MALLOC_TARGET_IOS
+#if TARGET_OS_IPHONE
 // malloc_report(ASL_LEVEL_INFO...) on iOS doesn't show up in the Xcode Console log of the device,
 // but ASL_LEVEL_NOTICE does.  So raising the log level is helpful.
 #undef ASL_LEVEL_INFO
 #define ASL_LEVEL_INFO ASL_LEVEL_NOTICE
-#endif // MALLOC_TARGET_IOS
+#endif // TARGET_OS_IPHONE
 
 #define USE_SLEEP_RATHER_THAN_ABORT 0
 
@@ -50,17 +50,14 @@
 malloc_zone_t **malloc_zones = (malloc_zone_t **)0xdeaddeaddeaddead;
 malloc_logger_t *malloc_logger = NULL;
 
-static uint32_t initial_num_zones;
 static malloc_zone_t *initial_scalable_zone;
 static malloc_zone_t *initial_nano_zone;
-static bool has_injected_zone0;
+static malloc_zone_t *initial_default_zone = NULL;
 
 unsigned malloc_debug_flags = 0;
 bool malloc_tracing_enabled = false;
 bool malloc_space_efficient_enabled = false;
-bool malloc_medium_space_efficient_enabled = true;
-
-bool malloc_quarantine_enabled = false;
+bool malloc_medium_space_efficient_enabled = false;
 
 unsigned malloc_check_start = 0; // 0 means don't check
 unsigned malloc_check_counter = 0;
@@ -68,20 +65,19 @@
 
 static int malloc_check_sleep = 100; // default 100 second sleep
 static int malloc_check_abort = 0;   // default is to sleep, not abort
-static bool malloc_instrumented = false;
-static bool malloc_simple_stack_logging = false;
-#define MALLOC_SIMPLE_STACK_LOGGING_FLAGS \
-		(ASL_LEVEL_NOTICE | MALLOC_REPORT_NOPREFIX | MALLOC_REPORT_BACKTRACE | MALLOC_REPORT_NOWRITE)
-
-static struct _malloc_msl_symbols msl = {};
-
-// TODO delete this, its only used some deprecated functions like turn_on_stack_logging,
-// which have been replaced by functions in MallocStackLogging.framework
-// (like msl_turn_on_stack_logging)
-static struct msl_dylib {
-	
+
+static
+struct msl {
 	void *dylib;
 
+	void (*handle_memory_event) (unsigned long event);
+	boolean_t (*stack_logging_locked) (void);
+	void (*fork_prepare) (void);
+	void (*fork_parent) (void);
+	void (*fork_child) (void);
+	
+	
+	// TODO delete these ones
 	kern_return_t (*get_frames_for_address)(task_t task,
 											mach_vm_address_t address,
 											mach_vm_address_t *stack_frames_buffer,
@@ -103,7 +99,7 @@
 												mach_vm_address_t *out_frames_buffer,
 												uint32_t *out_frames_count,
 												uint32_t max_frames);
-} msld = {};
+} msl = {};
 
 /*
  * Counters that coordinate zone destruction (in malloc_zone_unregister) with
@@ -125,6 +121,7 @@
 #define DEFAULT_MALLOC_ZONE_STRING "DefaultMallocZone"
 #define DEFAULT_PUREGEABLE_ZONE_STRING "DefaultPurgeableMallocZone"
 #define MALLOC_HELPER_ZONE_STRING "MallocHelperZone"
+#define MALLOC_PGUARD_ZONE_STRING "PGuardMallocZone"
 
 MALLOC_NOEXPORT
 unsigned int phys_ncpus;
@@ -135,31 +132,16 @@
 MALLOC_NOEXPORT
 unsigned int hyper_shift;
 
-MALLOC_NOEXPORT
-size_t malloc_absolute_max_size;
-
 // Boot argument for max magazine control
 static const char max_magazines_boot_arg[] = "malloc_max_magazines";
 
 static const char large_expanded_cache_threshold_boot_arg[] = "malloc_large_expanded_cache_threshold";
-
-
-MALLOC_NOEXPORT
-unsigned malloc_zero_on_free_sample_period = 0; // 0 means don't sample
-
-static const char zero_on_free_sample_period_boot_arg[] = "malloc_zero_on_free_sample_period";
-
-MALLOC_NOEXPORT
-malloc_zero_policy_t malloc_zero_policy = MALLOC_ZERO_POLICY_DEFAULT;
-
-static const char zero_on_free_enabled_boot_arg[] = "malloc_zero_on_free_enabled";
 
 #if CONFIG_MEDIUM_ALLOCATOR
 static const char medium_enabled_boot_arg[] = "malloc_medium_zone";
 static const char max_medium_magazines_boot_arg[] = "malloc_max_medium_magazines";
 static const char medium_activation_threshold_boot_arg[] = "malloc_medium_activation_threshold";
 static const char medium_space_efficient_boot_arg[] = "malloc_medium_space_efficient";
-static const char medium_madvise_dram_scale_divisor_boot_arg[] = "malloc_medium_madvise_dram_scale_divisor";
 #endif // CONFIG_MEDIUM_ALLOCATOR
 
 /*********	Utilities	************/
@@ -218,24 +200,6 @@
 	return (*(uint64_t*)_COMM_PAGE_CPU_CAPABILITIES64) & kIsTranslated;
 }
 #endif /* TARGET_OS_OSX */
-
-#define LIBMALLOC_EXPERIMENT_FACTORS_KEY "MallocExperiment="
-#define LIBMALLOC_EXPERIMENT_DISABLE_MEDIUM (1ULL)
-#define LIBMALLOC_DEFERRED_RECLAIM_ENABLE "MallocDeferredReclaim=1"
-static void
-__malloc_init_experiments(const char *str)
-{
-	uint64_t experiment_factors = 0;
-	str = strchr(str, '=');
-	if (str) {
-		experiment_factors = strtoull_l(str + 1, NULL, 16, NULL);
-	}
-	switch (experiment_factors) {
-	case LIBMALLOC_EXPERIMENT_DISABLE_MEDIUM:
-		magazine_medium_enabled = false;
-		break;
-	}
-}
 
 static void
 __malloc_init_from_bootargs(const char *bootargs)
@@ -272,32 +236,6 @@
 		}
 	}
 
-	flag = malloc_common_value_for_key_copy(bootargs,
-			zero_on_free_enabled_boot_arg, value_buf, sizeof(value_buf));
-	if (flag) {
-		const char *endp;
-		long value = malloc_common_convert_to_long(flag, &endp);
-		if (!*endp && (value == 0 || value == 1)) {
-			malloc_zero_policy = value ? MALLOC_ZERO_ON_FREE : MALLOC_ZERO_NONE;
-		} else {
-			malloc_report(ASL_LEVEL_ERR,
-					"malloc_zero_on_free_enabled must be 0 or 1 - ignored.\n");
-		}
-	}
-
-	flag = malloc_common_value_for_key_copy(bootargs,
-			zero_on_free_sample_period_boot_arg, value_buf, sizeof(value_buf));
-	if (flag) {
-		const char *endp;
-		long value = malloc_common_convert_to_long(flag, &endp);
-		if (!*endp && value >= 0) {
-			malloc_zero_on_free_sample_period = (unsigned int)value;
-		} else {
-			malloc_report(ASL_LEVEL_ERR,
-					"malloc_zero_on_free_sample_period must be positive - ignored.\n");
-		}
-	}
-
 #if CONFIG_MEDIUM_ALLOCATOR
 #if TARGET_OS_OSX
 #if defined(__x86_64__)
@@ -352,18 +290,6 @@
 		long value = malloc_common_convert_to_long(flag, &endp);
 		if (!*endp) {
 			malloc_medium_space_efficient_enabled = (value != 0);
-		}
-	}
-
-	flag = malloc_common_value_for_key_copy(bootargs, medium_madvise_dram_scale_divisor_boot_arg, value_buf, sizeof(value_buf));
-	if (flag) {
-		const char *endp;
-		long value = malloc_common_convert_to_long(flag, &endp);
-		if (!*endp && value >= 0) {
-			magazine_medium_madvise_dram_scale_divisor = (uint64_t)value;
-		} else {
-			malloc_report(ASL_LEVEL_ERR,
-					"malloc_medium_madvise_dram_scale_divisor must be positive - ignored.\n");
 		}
 	}
 #endif // CONFIG_MEDIUM_ALLOCATOR
@@ -395,22 +321,7 @@
 		bootargs[len + 1] = '\0';
 	}
 
-#if CONFIG_FEATUREFLAGS_SIMPLE
-	bool zero_on_free_feature_enabled = os_feature_enabled_simple(libmalloc,
-			ZeroOnFree, MALLOC_ZERO_POLICY_DEFAULT == MALLOC_ZERO_ON_FREE);
-	bool policy_is_zero_on_free = (malloc_zero_policy == MALLOC_ZERO_ON_FREE);
-	if (zero_on_free_feature_enabled != policy_is_zero_on_free) {
-		malloc_zero_policy = zero_on_free_feature_enabled ?
-				MALLOC_ZERO_ON_FREE : MALLOC_ZERO_NONE;
-	}
-#endif
-
-	// Cache the calculation of this "constant", which unfortunately depends on
-	// runtime values of vm_kernel_page_size and vm_page_size
-	malloc_absolute_max_size = _MALLOC_ABSOLUTE_MAX_SIZE;
-
 	const char **p;
-	const char *malloc_experiments = NULL;
 	for (p = apple; p && *p; p++) {
 		if (strstr(*p, "malloc_entropy") == *p) {
 			int count = __entropy_from_kernel(*p);
@@ -419,26 +330,14 @@
 			if (sizeof(malloc_entropy) / sizeof(malloc_entropy[0]) == count) {
 				_malloc_entropy_initialized = true;
 			}
-		}
-		if (strstr(*p, LIBMALLOC_EXPERIMENT_FACTORS_KEY) == *p) {
-			malloc_experiments = *p;
-		}
-#if CONFIG_DEFERRED_RECLAIM
-		if (strstr(*p, LIBMALLOC_DEFERRED_RECLAIM_ENABLE) == *p) {
-			// Turn on the large cache which will place
-			// its free entries in the deferred reclaim buffer
-			large_cache_enabled = 1;
-		}
-#endif /* CONFIG_DEFERRED_RECLAIM */
+			break;
+		}
 	}
 	if (!_malloc_entropy_initialized) {
 		getentropy((void*)malloc_entropy, sizeof(malloc_entropy));
 		_malloc_entropy_initialized = true;
 	}
 
-	if (malloc_experiments) {
-		__malloc_init_experiments(malloc_experiments);
-	}
 	__malloc_init_from_bootargs(bootargs);
 	mvm_aslr_init();
 
@@ -453,28 +352,6 @@
 	force_asan_init_if_present();
 
 	_malloc_initialize(apple, bootargs);
-}
-
-static void register_pgm_zone(bool internal_diagnostics);
-static void stack_logging_early_finished(const struct _malloc_late_init *funcs);
-
-// WARNING: The passed _malloc_late_init is a stack variable in
-// libSystem_initializer().  We must not hold on to it.
-//
-// WARNING 2: By the time this is called, malloc() is already used
-// a bunch of times (from libobjc, libxpc, ...).
-void
-__malloc_late_init(const struct _malloc_late_init *mli)
-{
-	register_pgm_zone(mli->internal_diagnostics);
-	stack_logging_early_finished(mli);
-	initial_num_zones = malloc_num_zones;
-	
-#if CONFIG_QUARANTINE
-	if (malloc_quarantine_enabled) {
-		quarantine_reset_environment();
-	}
-#endif
 }
 
 MALLOC_NOEXPORT malloc_zone_t* lite_zone = NULL;
@@ -725,12 +602,16 @@
 /*static*/ boolean_t
 has_default_zone0(void)
 {
-	return !has_injected_zone0;
-}
-
-static inline malloc_zone_t *find_registered_zone(const void *, size_t *, bool) __attribute__((always_inline));
+	if (!malloc_zones) {
+		return false;
+	}
+	
+	return initial_default_zone == malloc_zones[0];
+}
+
+static inline malloc_zone_t *find_registered_zone(const void *, size_t *) __attribute__((always_inline));
 static inline malloc_zone_t *
-find_registered_zone(const void *ptr, size_t *returned_size, bool known_non_default)
+find_registered_zone(const void *ptr, size_t *returned_size)
 {
 	// Returns a zone which contains ptr, else NULL
 
@@ -753,37 +634,32 @@
 			return default_zone;
 		}
 	}
-
-	malloc_zone_t *zone;
-	size_t size;
-
-	// We assume that the initial zones will never be unregistered concurrently while this code is running so we can have
-	// a fast path without synchronization.  Callers who really do unregister these (to install their own default zone) need
-	// to ensure they establish their zone setup during initialization and before entering a multi-threaded environment.
-	for (uint32_t i = known_non_default ? 1 : 0; i < initial_num_zones; i++) {
-		zone = malloc_zones[i];
-		size = zone->size(zone, ptr);
-
-		if (size) { // Claimed by this zone?
-			if (returned_size) {
-				*returned_size = size;
-			}
-
-			// Asan and others replace the zone at position 0 with their own zone.
-			// In that case just return that zone as they need this information.
-			// Otherwise return the virtual default zone, not the actual zone in position 0.
-			if (i == 0 && has_default_zone0()) {
-				return default_zone;
-			}
-
+	
+	// The default zone is registered in malloc_zones[0]. There's no danger that it will ever be unregistered.
+	// So don't advance the FRZ counter yet.
+	malloc_zone_t *zone = malloc_zones[0];
+	size_t size = zone->size(zone, ptr);
+	if (size) { // Claimed by this zone?
+		if (returned_size) {
+			*returned_size = size;
+		}
+
+		// Asan and others replace the zone at position 0 with their own zone.
+		// In that case just return that zone as they need this information.
+		// Otherwise return the virtual default zone, not the actual zone in position 0.
+		if (!has_default_zone0()) {
 			return zone;
+		} else {
+			return default_zone;
 		}
 	}
 
 	int32_t volatile *pFRZCounter = pFRZCounterLive;   // Capture pointer to the counter of the moment
 	OSAtomicIncrement32Barrier(pFRZCounter); // Advance this counter -- our thread is in FRZ
 
+	unsigned index;
 	int32_t limit = *(int32_t volatile *)&malloc_num_zones;
+	malloc_zone_t **zones = &malloc_zones[1];
 
 	// From this point on, FRZ is accessing the malloc_zones[] array without locking
 	// in order to avoid contention on common operations (such as non-default-zone free()).
@@ -800,8 +676,8 @@
 	//      are still valid). It also ensures that all the pointers in the zones array are
 	//      valid until it returns, so that a stale value in limit is not dangerous.
 
-	for (uint32_t i = initial_num_zones; i < limit; i++) {
-		zone = malloc_zones[i];
+	for (index = 1; index < limit; ++index, ++zones) {
+		zone = *zones;
 		size = zone->size(zone, ptr);
 		if (size) { // Claimed by this zone?
 			goto out;
@@ -867,7 +743,7 @@
 static void set_flags_from_environment(void);
 
 MALLOC_NOEXPORT void
-malloc_zone_register_while_locked(malloc_zone_t *zone, bool make_default)
+malloc_zone_register_while_locked(malloc_zone_t *zone)
 {
 	size_t protect_size;
 	unsigned i;
@@ -916,13 +792,6 @@
 		mprotect(malloc_zones, protect_size, PROT_READ | PROT_WRITE);
 	}
 
-	if (make_default) {
-		memmove(&malloc_zones[1], &malloc_zones[0], malloc_num_zones * sizeof(malloc_zone_t *));
-		malloc_zones[0] = zone;
-	} else {
-		malloc_zones[malloc_num_zones] = zone;
-	}
-
 	/* <rdar://problem/12871662> This store-increment needs to be visible in the correct
 	 * order to any threads in find_registered_zone, such that if the incremented value
 	 * in malloc_num_zones is visible then the pointer write before it must also be visible.
@@ -931,17 +800,12 @@
 	 * ensure the proper store-release operation is performed is to use OSAtomic*Barrier
 	 * to update malloc_num_zones.
 	 */
+	malloc_zones[malloc_num_zones] = zone;
 	OSAtomicIncrement32Barrier(&malloc_num_zones);
 
 	/* Finally, now that the zone is registered, disallow write access to the
 	 * malloc_zones array */
 	mprotect(malloc_zones, protect_size, PROT_READ);
-
-	// ASan and others interpose on mprotect() to ensure their zone is always at position 0.
-	if (make_default && malloc_zones[0] != zone) {
-		has_injected_zone0 = true;
-	}
-
 	//malloc_report(ASL_LEVEL_INFO, "Registered malloc_zone %p in malloc_zones %p [%u zones, %u bytes]\n", zone, malloc_zones,
 	// malloc_num_zones, protect_size);
 }
@@ -994,114 +858,61 @@
 
 	set_flags_from_environment(); // will only set flags up to two times
 
-	if (malloc_tracing_enabled || malloc_simple_stack_logging) {
-		// Note: although malloc_tracing_enabled is exported "for performance
-		// tools", it does not appear in any API or SPI headers and is not
-		// referenced by any indexed performance tools, so we're going to go
-		// ahead and stop respecting dynamic programmatic enablement via direct
-		// setting of the global by other code
-		//
-		// TODO: it may be possible to fold malloc_check_start into this as well
-		malloc_instrumented = true;
-	}
-
-#if CONFIG_QUARANTINE
-	malloc_quarantine_enabled = quarantine_should_enable();
-#endif
-	
 #if CONFIG_NANOZONE
 	// TODO: envp should be passed down from Libsystem
 	const char **envp = (const char **)*_NSGetEnviron();
-	
-	// Force magazine_malloc when:
-	// - quarantine is enabled, to avoid speculative out-of-bounds
-	//   use-after-free reads that nano/nanov2 performs, OR
-	// - MallocScribble is enabled, which nanov2 does not implement
-	// - MallocCheckZeroOnFreeCorruption sampling is enabled, which nanov2 does
-	//   not implement
-	if (!malloc_quarantine_enabled &&
-			!(malloc_debug_flags & MALLOC_DO_SCRIBBLE) &&
-			!malloc_zero_on_free_sample_period) {
-		nano_common_init(envp, apple, bootargs);
-	}
-#endif // CONFIG_NANOZONE
+	nano_common_init(envp, apple, bootargs);
+#endif
+
+	const uint32_t k_max_zones = 3;
+	malloc_zone_t *zone_stack[k_max_zones];
+	const char *name_stack[k_max_zones];
+	uint32_t num_zones = 0;
 
 	initial_scalable_zone = create_scalable_zone(0, malloc_debug_flags);
-	malloc_set_zone_name(initial_scalable_zone, DEFAULT_MALLOC_ZONE_STRING);
-	malloc_zone_register_while_locked(initial_scalable_zone, /*make_default=*/true);
+	zone_stack[num_zones] = initial_scalable_zone;
+	name_stack[num_zones] = DEFAULT_MALLOC_ZONE_STRING;
+	num_zones++;
 
 #if CONFIG_NANOZONE
 	nano_common_configure();
 
-	malloc_zone_t *helper_zone = initial_scalable_zone;
+	malloc_zone_t *helper_zone = zone_stack[num_zones - 1];
+	malloc_zone_t *nano_zone = NULL;
 
 	if (_malloc_engaged_nano == NANO_V2) {
-		initial_nano_zone = nanov2_create_zone(helper_zone, malloc_debug_flags);
-	}
-
-	if (initial_nano_zone) {
-		malloc_set_zone_name(initial_nano_zone, DEFAULT_MALLOC_ZONE_STRING);
-		malloc_set_zone_name(helper_zone, MALLOC_HELPER_ZONE_STRING);
-		malloc_zone_register_while_locked(initial_nano_zone, /*make_default=*/true);
+		nano_zone = nanov2_create_zone(helper_zone, malloc_debug_flags);
+	} else if (_malloc_engaged_nano == NANO_V1) {
+		nano_zone = nano_create_zone(helper_zone, malloc_debug_flags);
+	}
+
+	if (nano_zone) {
+		initial_nano_zone = nano_zone;
+		zone_stack[num_zones] = nano_zone;
+		name_stack[num_zones] = DEFAULT_MALLOC_ZONE_STRING;
+		name_stack[num_zones - 1] = MALLOC_HELPER_ZONE_STRING;
+		num_zones++;
 	}
 #endif
 
-#if CONFIG_QUARANTINE
-	if (malloc_quarantine_enabled) {
-		malloc_zone_t *wrapped_zone = malloc_zones[0];
-		malloc_zone_t *quarantine_zone = quarantine_create_zone(wrapped_zone);
-		malloc_zone_register_while_locked(quarantine_zone, /*make_default=*/true);
-	}
-#endif
-
-	initial_num_zones = malloc_num_zones;
-
-#if CONFIG_DEFERRED_RECLAIM
-	if (large_cache_enabled) {
-		kern_return_t kr = mvm_deferred_reclaim_init();
-		if (kr != KERN_SUCCESS) {
-			MALLOC_REPORT_FATAL_ERROR(kr, "Unable to set up reclaim buffer.\n");
-		}
-	}
-#endif /* CONFIG_DEFERRED_RECLAIM */
-
-#if CONFIG_MEDIUM_ALLOCATOR
-	uint64_t memsize = platform_hw_memsize();
-	if (memsize >= 8 * magazine_medium_madvise_dram_scale_divisor) {
-		magazine_medium_madvise_window_scale_factor = 8;
-	} else if (memsize >= 4 * magazine_medium_madvise_dram_scale_divisor) {
-		magazine_medium_madvise_window_scale_factor = 4;
-	} else if (memsize >= 2 * magazine_medium_madvise_dram_scale_divisor) {
-		magazine_medium_madvise_window_scale_factor = 2;
-	} else {
-		magazine_medium_madvise_window_scale_factor = 1;
-	}
-#endif /* CONFIG_MEDIUM_ALLOCATOR */
+	if (pguard_enabled()) {
+		malloc_zone_t *wrapped_zone = zone_stack[num_zones - 1];
+		zone_stack[num_zones] = pguard_create_zone(wrapped_zone, malloc_debug_flags);
+		name_stack[num_zones] = MALLOC_PGUARD_ZONE_STRING;
+		// TODO(yln): what is the external contract for zone names?
+		num_zones++;
+	}
+
+	MALLOC_ASSERT(num_zones <= k_max_zones);
+	initial_default_zone = zone_stack[num_zones - 1];
+
+	// 2 separate loops: malloc_set_zone_name already requires a working allocator.
+	for (int i = num_zones - 1; i >= 0; i--) malloc_zone_register_while_locked(zone_stack[i]);
+	for (int i = num_zones - 1; i >= 0; i--) malloc_set_zone_name(zone_stack[i], name_stack[i]);
 
 	// malloc_report(ASL_LEVEL_INFO, "%d registered zones\n", malloc_num_zones);
 	// malloc_report(ASL_LEVEL_INFO, "malloc_zones is at %p; malloc_num_zones is at %p\n", (unsigned)&malloc_zones,
 	// (unsigned)&malloc_num_zones);
-}
-
-static bool internal_build;
-static bool
-enable_pgm(void)
-{
-	bool other_debug_tool = has_injected_zone0 || malloc_quarantine_enabled;
-	return !other_debug_tool && pgm_should_enable(internal_build);
-}
-
-static void
-register_pgm_zone(bool internal_diagnostics)
-{
-	if (internal_diagnostics) {
-		internal_build = true;
-	}
-	if (enable_pgm()) {
-		malloc_zone_t *wrapped_zone = malloc_zones[0];
-		malloc_zone_t *pgm_zone = pgm_create_zone(wrapped_zone);
-		malloc_zone_register_while_locked(pgm_zone, /*make_default=*/true);
-	}
 }
 
 static inline malloc_zone_t *
@@ -1205,16 +1016,6 @@
 		malloc_debug_flags = MALLOC_ABORT_ON_CORRUPTION;
 	}
 #endif
-
-#if TARGET_OS_OSX
-	// rdar://99288027
-	if (!dyld_program_sdk_at_least(dyld_platform_version_macOS_13_0)) {
-		if (malloc_zero_policy == MALLOC_ZERO_ON_FREE) {
-			malloc_zero_policy = MALLOC_ZERO_ON_ALLOC;
-		}
-	}
-#else // TARGET_OS_OSX
-#endif // TARGET_OS_OSX
 
 	/*
 	 * Given that all environment variables start with "Malloc" we optimize by scanning quickly
@@ -1284,9 +1085,6 @@
 	if (getenv("MallocTracing")) {
 		malloc_tracing_enabled = true;
 	}
-	if (getenv("MallocSimpleStackLogging")) {
-		malloc_simple_stack_logging = true;
-	}
 
 #if __LP64__
 /* initialization above forces MALLOC_ABORT_ON_CORRUPTION of 64-bit processes */
@@ -1397,10 +1195,7 @@
 			aggressive_madvise_enabled = (value == 1);
 #endif // CONFIG_AGGRESSIVE_MADVISE
 #if CONFIG_LARGE_CACHE
-			// Disable the large cache in space efficient mode
-			if (value != 0){
-				large_cache_enabled = 0;
-			}
+			large_cache_enabled = (value == 0);
 #endif // CONFIG_LARGE_CACHE
 			malloc_space_efficient_enabled = (value == 1);
 			// consider disabling medium magazine if aggressive madvise is not sufficient
@@ -1510,40 +1305,6 @@
 		}
 	}
 #endif // CONFIG_RECIRC_DEPOT
-
-	flag = getenv("MallocZeroOnFree");
-	if (flag) {
-		const char *endp;
-		long value = malloc_common_convert_to_long(flag, &endp);
-		if (!*endp && endp != flag && (value == 0 || value == 1)) {
-			malloc_zero_policy = value ? MALLOC_ZERO_ON_FREE : MALLOC_ZERO_NONE;
-		} else {
-			malloc_report(ASL_LEVEL_ERR, "MallocZeroOnFree must be 0 or 1.\n");
-		}
-	}
-
-	flag = getenv("MallocZeroOnAlloc");
-	if (flag) {
-		const char *endp;
-		long value = malloc_common_convert_to_long(flag, &endp);
-		if (!*endp && endp != flag && (value == 0 || value == 1)) {
-			malloc_zero_policy = value ? MALLOC_ZERO_ON_ALLOC : MALLOC_ZERO_NONE;
-		} else {
-			malloc_report(ASL_LEVEL_ERR, "MallocZeroOnAlloc must be 0 or 1.\n");
-		}
-	}
-
-	flag = getenv("MallocCheckZeroOnFreeCorruption");
-	if (flag) {
-		int value = (int)strtol(flag, NULL, 0);
-		if (value > 0) {
-			malloc_zero_on_free_sample_period = value;
-		} else {
-			malloc_report(ASL_LEVEL_ERR,
-					"malloc_zero_on_free_sample_period must be positive - ignored.\n");
-		}
-	}
-
 	if (getenv("MallocHelp")) {
 		malloc_report(ASL_LEVEL_INFO,
 				"environment variables that can be set for debug:\n"
@@ -1564,8 +1325,6 @@
 				"  MallocCorruptionAbort is always set on 64-bit processes\n"
 				"- MallocErrorAbort to abort on any malloc error, including out of memory\n"\
 				"- MallocTracing to emit kdebug trace points on malloc entry points\n"\
-				"- MallocZeroOnFree to enable or disable zero-on-free behavior (for debugging only)\n"\
-				"- MallocCheckZeroOnFreeCorruption to enable zero-on-free corruption detection\n"\
 				"- MallocHelp - this help!\n");
 	}
 }
@@ -1576,19 +1335,12 @@
 	malloc_zone_t *zone;
 
 	/* start_size doesn't actually appear to be used, but we test anyway. */
-	if (start_size > malloc_absolute_max_size) {
+	if (start_size > MALLOC_ABSOLUTE_MAX_SIZE) {
 		return NULL;
 	}
 
 	zone = create_scalable_zone(start_size, flags | malloc_debug_flags);
 	malloc_zone_register(zone);
-
-#if CONFIG_PGM_WRAP_CUSTOM_ZONES
-	if (enable_pgm()) {
-		zone = pgm_create_zone(zone);
-		malloc_zone_register(zone);
-	}
-#endif
 	return zone;
 }
 
@@ -1600,10 +1352,12 @@
 malloc_create_legacy_default_zone(void)
 {
 	malloc_zone_t *zone;
+	int i;
 
 	zone = create_legacy_scalable_zone(0, malloc_debug_flags);
 
 	MALLOC_LOCK();
+	malloc_zone_register_while_locked(zone);
 
 	//
 	// Establish the legacy scalable zone just created as the default zone.
@@ -1614,7 +1368,16 @@
 	}
 	malloc_set_zone_name(zone, DEFAULT_MALLOC_ZONE_STRING);
 
-	malloc_zone_register_while_locked(zone, /*make_default=*/true);
+	unsigned protect_size = malloc_num_zones_allocated * sizeof(malloc_zone_t *);
+	mprotect(malloc_zones, protect_size, PROT_READ | PROT_WRITE);
+
+	// assert(zone == malloc_zones[malloc_num_zones - 1];
+	for (i = malloc_num_zones - 1; i > 0; --i) {
+		malloc_zones[i] = malloc_zones[i - 1];
+	}
+	malloc_zones[0] = zone;
+
+	mprotect(malloc_zones, protect_size, PROT_READ);
 	MALLOC_UNLOCK();
 }
 
@@ -1715,10 +1478,27 @@
 	malloc_check_start += malloc_check_each;
 }
 
+__options_decl(malloc_zone_options_t, unsigned, {
+	MZ_NONE  = 0x0,
+	MZ_POSIX = 0x1,
+	MZ_C11   = 0x2,
+});
+
+static inline void
+malloc_set_errno_fast(malloc_zone_options_t mzo, int err)
+{
+	if (mzo & MZ_POSIX) {
+#if TARGET_OS_SIMULATOR
+		errno = err;
+#else
+		(*_pthread_errno_address_direct()) = err;
+#endif
+	}
+}
+
 MALLOC_NOINLINE
 static void *
-_malloc_zone_malloc_instrumented_or_legacy(malloc_zone_t *zone, size_t size,
-		malloc_zone_options_t mzo)
+_malloc_zone_malloc(malloc_zone_t *zone, size_t size, malloc_zone_options_t mzo)
 {
 	MALLOC_TRACE(TRACE_malloc | DBG_FUNC_START, (uintptr_t)zone, size, 0, 0);
 
@@ -1727,19 +1507,14 @@
 	if (malloc_check_start) {
 		internal_check();
 	}
-	if (size > malloc_absolute_max_size) {
+	if (size > MALLOC_ABSOLUTE_MAX_SIZE) {
 		goto out;
 	}
 
-	ptr = zone->malloc(zone, size);
+	ptr = zone->malloc(zone, size);		// if lite zone is passed in then we still call the lite methods
 
 	if (os_unlikely(malloc_logger)) {
 		malloc_logger(MALLOC_LOG_TYPE_ALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE, (uintptr_t)zone, (uintptr_t)size, 0, (uintptr_t)ptr, 0);
-	}
-
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "malloc (%p/%llu): ",
-				ptr, (unsigned long long)size);
 	}
 
 	MALLOC_TRACE(TRACE_malloc | DBG_FUNC_END, (uintptr_t)zone, size, (uintptr_t)ptr, 0);
@@ -1750,64 +1525,10 @@
 	return ptr;
 }
 
-static void *
-_malloc_zone_malloc(malloc_zone_t *zone, size_t size, malloc_zone_options_t mzo)
-{
-	if (zone == default_zone && !lite_zone) {
-		// Eagerly resolve the virtual default zone to make the zone version
-		// check accurate
-		zone = malloc_zones[0];
-	}
-
-	if (os_unlikely(malloc_instrumented || malloc_check_start ||
-				malloc_logger || zone->version < 13)) {
-		return _malloc_zone_malloc_instrumented_or_legacy(zone, size, mzo);
-	}
-
-	if (os_unlikely(size > malloc_absolute_max_size)) {
-		malloc_set_errno_fast(mzo, ENOMEM);
-		return NULL;
-	}
-
-	// zone versions >= 13 set errno on failure so we can tail-call
-	return zone->malloc(zone, size);
-}
-
 void *
 malloc_zone_malloc(malloc_zone_t *zone, size_t size)
 {
 	return _malloc_zone_malloc(zone, size, MZ_NONE);
-}
-
-MALLOC_NOINLINE
-static void *
-_malloc_zone_calloc_instrumented_or_legacy(malloc_zone_t *zone,
-		size_t num_items, size_t size, malloc_zone_options_t mzo)
-{
-	MALLOC_TRACE(TRACE_calloc | DBG_FUNC_START, (uintptr_t)zone, num_items, size, 0);
-
-	void *ptr;
-	if (malloc_check_start) {
-		internal_check();
-	}
-
-	ptr = zone->calloc(zone, num_items, size);
-
-	if (os_unlikely(malloc_logger)) {
-		malloc_logger(MALLOC_LOG_TYPE_ALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE | MALLOC_LOG_TYPE_CLEARED, (uintptr_t)zone,
-				(uintptr_t)(num_items * size), 0, (uintptr_t)ptr, 0);
-	}
-
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "calloc (%p/%llu*%llu): ",
-				ptr, (unsigned long long)num_items, (unsigned long long)size);
-	}
-
-	MALLOC_TRACE(TRACE_calloc | DBG_FUNC_END, (uintptr_t)zone, num_items, size, (uintptr_t)ptr);
-	if (os_unlikely(ptr == NULL)) {
-		malloc_set_errno_fast(mzo, ENOMEM);
-	}
-	return ptr;
 }
 
 MALLOC_NOINLINE
@@ -1815,19 +1536,25 @@
 _malloc_zone_calloc(malloc_zone_t *zone, size_t num_items, size_t size,
 		malloc_zone_options_t mzo)
 {
-	if (zone == default_zone && !lite_zone) {
-		// Eagerly resolve the virtual default zone to make the zone version
-		// check accurate
-		zone = malloc_zones[0];
-	}
-
-	if (os_unlikely(malloc_instrumented || malloc_check_start ||
-				malloc_logger || zone->version < 13)) {
-		return _malloc_zone_calloc_instrumented_or_legacy(zone, num_items, size, mzo);
-	}
-
-	// zone versions >= 13 set errno on failure so we can tail-call
-	return zone->calloc(zone, num_items, size);
+	MALLOC_TRACE(TRACE_calloc | DBG_FUNC_START, (uintptr_t)zone, num_items, size, 0);
+
+	void *ptr;
+	if (malloc_check_start) {
+		internal_check();
+	}
+
+	ptr = zone->calloc(zone, num_items, size);
+
+	if (os_unlikely(malloc_logger)) {
+		malloc_logger(MALLOC_LOG_TYPE_ALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE | MALLOC_LOG_TYPE_CLEARED, (uintptr_t)zone,
+				(uintptr_t)(num_items * size), 0, (uintptr_t)ptr, 0);
+	}
+
+	MALLOC_TRACE(TRACE_calloc | DBG_FUNC_END, (uintptr_t)zone, num_items, size, (uintptr_t)ptr);
+	if (os_unlikely(ptr == NULL)) {
+		malloc_set_errno_fast(mzo, ENOMEM);
+	}
+	return ptr;
 }
 
 void *
@@ -1846,7 +1573,7 @@
 	if (malloc_check_start) {
 		internal_check();
 	}
-	if (size > malloc_absolute_max_size) {
+	if (size > MALLOC_ABSOLUTE_MAX_SIZE) {
 		goto out;
 	}
 
@@ -1854,11 +1581,6 @@
 
 	if (os_unlikely(malloc_logger)) {
 		malloc_logger(MALLOC_LOG_TYPE_ALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE, (uintptr_t)zone, (uintptr_t)size, 0, (uintptr_t)ptr, 0);
-	}
-
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "valloc (%p/%llu): ",
-				ptr, (unsigned long long)size);
 	}
 
 	MALLOC_TRACE(TRACE_valloc | DBG_FUNC_END, (uintptr_t)zone, size, (uintptr_t)ptr, 0);
@@ -1884,7 +1606,7 @@
 	if (malloc_check_start) {
 		internal_check();
 	}
-	if (size > malloc_absolute_max_size) {
+	if (size > MALLOC_ABSOLUTE_MAX_SIZE) {
 		return NULL;
 	}
 
@@ -1894,12 +1616,6 @@
 		malloc_logger(MALLOC_LOG_TYPE_ALLOCATE | MALLOC_LOG_TYPE_DEALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE, (uintptr_t)zone,
 				(uintptr_t)ptr, (uintptr_t)size, (uintptr_t)new_ptr, 0);
 	}
-
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "realloc (%p->%p/%llu): ",
-				ptr, new_ptr, (unsigned long long)size);
-	}
-
 	MALLOC_TRACE(TRACE_realloc | DBG_FUNC_END, (uintptr_t)zone, (uintptr_t)ptr, size, (uintptr_t)new_ptr);
 	return new_ptr;
 }
@@ -1912,9 +1628,6 @@
 	if (os_unlikely(malloc_logger)) {
 		malloc_logger(MALLOC_LOG_TYPE_DEALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE, (uintptr_t)zone, (uintptr_t)ptr, 0, 0, 0);
 	}
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "malloc_zone_free (%p): ", ptr);
-	}
 	if (malloc_check_start) {
 		internal_check();
 	}
@@ -1929,10 +1642,6 @@
 
 	if (os_unlikely(malloc_logger)) {
 		malloc_logger(MALLOC_LOG_TYPE_DEALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE, (uintptr_t)zone, (uintptr_t)ptr, 0, 0, 0);
-	}
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "free (%p/%llu): ",
-				ptr, (unsigned long long)size);
 	}
 	if (malloc_check_start) {
 		internal_check();
@@ -1947,7 +1656,7 @@
 	if (!ptr) {
 		return NULL;
 	} else {
-		return find_registered_zone(ptr, NULL, false);
+		return find_registered_zone(ptr, NULL);
 	}
 }
 
@@ -1966,7 +1675,7 @@
 	if (malloc_check_start) {
 		internal_check();
 	}
-	if (size > malloc_absolute_max_size) {
+	if (size > MALLOC_ABSOLUTE_MAX_SIZE) {
 		goto out;
 	}
 	if (alignment < sizeof(void *) ||			  // excludes 0 == alignment
@@ -1987,10 +1696,6 @@
 	if (os_unlikely(malloc_logger)) {
 		malloc_logger(MALLOC_LOG_TYPE_ALLOCATE | MALLOC_LOG_TYPE_HAS_ZONE, (uintptr_t)zone, (uintptr_t)size, 0, (uintptr_t)ptr, 0);
 	}
-	if (os_unlikely(malloc_simple_stack_logging)) {
-		malloc_report(MALLOC_SIMPLE_STACK_LOGGING_FLAGS, "memalign (%p/%llu,%llu): ",
-				ptr, (unsigned long long)alignment, (unsigned long long)size);
-	}
 
 	MALLOC_TRACE(TRACE_memalign | DBG_FUNC_END, (uintptr_t)zone, alignment, size, (uintptr_t)ptr);
 
@@ -2036,7 +1741,7 @@
 malloc_zone_register(malloc_zone_t *zone)
 {
 	MALLOC_LOCK();
-	malloc_zone_register_while_locked(zone, false);
+	malloc_zone_register_while_locked(zone);
 	MALLOC_UNLOCK();
 }
 
@@ -2067,10 +1772,6 @@
 		--malloc_num_zones;
 
 		mprotect(malloc_zones, protect_size, PROT_READ);
-
-		// MAX(num_zones, 1) retains the fast path in find_registered_zone() for zone 0 even
-		// if it is a custom zone, e.g., ASan and user zones.
-		initial_num_zones = MAX(MIN(malloc_num_zones, initial_num_zones), 1);
 
 		// Exchange the roles of the FRZ counters. The counter that has captured the number of threads presently
 		// executing *inside* find_registered_zone is swapped with the counter drained to zero last time through.
@@ -2095,24 +1796,21 @@
 void
 malloc_set_zone_name(malloc_zone_t *z, const char *name)
 {
+	char *newName;
+
 	mprotect(z, sizeof(malloc_zone_t), PROT_READ | PROT_WRITE);
 	if (z->zone_name) {
-		malloc_zone_t *old_zone = find_registered_zone(z->zone_name, NULL, false);
-		if (old_zone) {
-			malloc_zone_free(old_zone, (char *)z->zone_name);
-		}
+		free((char *)z->zone_name);
 		z->zone_name = NULL;
 	}
 	if (name) {
 		size_t buflen = strlen(name) + 1;
-		if (_dyld_is_memory_immutable(name, buflen)) {
-			z->zone_name = name;
+		newName = _malloc_zone_malloc(z, buflen, MZ_NONE);
+		if (newName) {
+			strlcpy(newName, name, buflen);
+			z->zone_name = (const char *)newName;
 		} else {
-			char *name_copy = _malloc_zone_malloc(z, buflen, MZ_NONE);
-			if (name_copy) {
-				strlcpy(name_copy, name, buflen);
-				z->zone_name = name_copy;
-			}
+			z->zone_name = NULL;
 		}
 	}
 	mprotect(z, sizeof(malloc_zone_t), PROT_READ);
@@ -2124,8 +1822,30 @@
 	return zone->zone_name;
 }
 
-void
-find_zone_and_free(void *ptr, bool known_non_default)
+
+/*********	Generic ANSI callouts	************/
+
+void *
+malloc(size_t size)
+{
+	return _malloc_zone_malloc(default_zone, size, MZ_POSIX);
+}
+
+void *
+aligned_alloc(size_t alignment, size_t size)
+{
+	return _malloc_zone_memalign(default_zone, alignment, size,
+	    MZ_POSIX | MZ_C11);
+}
+
+void *
+calloc(size_t num_items, size_t size)
+{
+	return _malloc_zone_calloc(default_zone, num_items, size, MZ_POSIX);
+}
+
+void
+free(void *ptr)
 {
 	malloc_zone_t *zone;
 	size_t size;
@@ -2133,7 +1853,7 @@
 		return;
 	}
 
-	zone = find_registered_zone(ptr, &size, known_non_default);
+	zone = find_registered_zone(ptr, &size);
 	if (!zone) {
 		int flags = MALLOC_REPORT_DEBUG | MALLOC_REPORT_NOLOG;
 		if ((malloc_debug_flags & (MALLOC_ABORT_ON_CORRUPTION | MALLOC_ABORT_ON_ERROR))) {
@@ -2146,50 +1866,6 @@
 	} else {
 		malloc_zone_free(zone, ptr);
 	}
-}
-
-
-/*********	Generic ANSI callouts	************/
-
-void *
-malloc(size_t size)
-{
-	return _malloc_zone_malloc(default_zone, size, MZ_POSIX);
-}
-
-void *
-aligned_alloc(size_t alignment, size_t size)
-{
-	return _malloc_zone_memalign(default_zone, alignment, size,
-	    MZ_POSIX | MZ_C11);
-}
-
-void *
-calloc(size_t num_items, size_t size)
-{
-	return _malloc_zone_calloc(default_zone, num_items, size, MZ_POSIX);
-}
-
-void
-free(void *ptr)
-{
-	if (!ptr) {
-		return;
-	}
-
-	if (os_unlikely(malloc_instrumented ||
-				malloc_check_start ||
-				malloc_logger ||
-				lite_zone ||
-				malloc_num_zones == 0 ||
-				malloc_zones[0]->version < 13 ||
-				!malloc_zones[0]->try_free_default)) {
-		find_zone_and_free(ptr, false);
-		return;
-	}
-
-	malloc_zone_t *zone0 = malloc_zones[0];
-	zone0->try_free_default(zone0, ptr);
 }
 
 void *
@@ -2211,7 +1887,7 @@
 	if (!old_ptr) {
 		retval = malloc_zone_malloc(default_zone, new_size);
 	} else {
-		zone = find_registered_zone(old_ptr, NULL, false);
+		zone = find_registered_zone(old_ptr, NULL);
 		if (!zone) {
 			int flags = MALLOC_REPORT_DEBUG | MALLOC_REPORT_NOLOG;
 			if (malloc_debug_flags & (MALLOC_ABORT_ON_CORRUPTION | MALLOC_ABORT_ON_ERROR)) {
@@ -2252,7 +1928,7 @@
 		return size;
 	}
 
-	(void)find_registered_zone(ptr, &size, false);
+	(void)find_registered_zone(ptr, &size);
 	return size;
 }
 
@@ -2317,11 +1993,9 @@
 		return true;
 	}
 
-	// Next, try the initial zones.
-	for (uint32_t i = 0; i < initial_num_zones; i++) {
-		if (malloc_zone_claimed_address(malloc_zones[i], ptr)) {
-			return true;
-		}
+	// Next, try the default zone, which is always present.
+	if (malloc_zone_claimed_address(malloc_zones[0], ptr)) {
+		return true;
 	}
 
 	// Try all the other zones. Increment the FRZ barrier so that we can
@@ -2331,9 +2005,10 @@
 	OSAtomicIncrement32Barrier(pFRZCounter);
 
 	int32_t limit = *(int32_t volatile *)&malloc_num_zones;
+	malloc_zone_t **zones = &malloc_zones[1];
 	boolean_t result = false;
-	for (uint32_t i = initial_num_zones; i < limit; i++) {
-		malloc_zone_t *zone = malloc_zones[i];
+	for (unsigned index = 1; index < limit; ++index, ++zones) {
+		malloc_zone_t *zone = *zones;
 		if (malloc_zone_claimed_address(zone, ptr)) {
 			result = true;
 			break;
@@ -2378,7 +2053,7 @@
 	 * and only search those.
 	 */
 	size_t size = 0;
-	malloc_zone_t *zone = find_registered_zone(ptr, &size, false);
+	malloc_zone_t *zone = find_registered_zone(ptr, &size);
 
 	/* FIXME: would really like a zone->introspect->flags->purgeable check, but haven't determined
 	 * binary compatibility impact of changing the introspect struct yet. */
@@ -2783,6 +2458,8 @@
 	if (_malloc_entropy_initialized) {
 		if (_malloc_engaged_nano == NANO_V2) {
 			nanov2_forked_zone((nanozonev2_t *)initial_nano_zone);
+		} else if (_malloc_engaged_nano == NANO_V1) {
+			nano_forked_zone((nanozone_t *)initial_nano_zone);
 		}
 	}
 #endif
@@ -2880,12 +2557,6 @@
 	}
 }
 
-void
-malloc_zero_on_free_disable(void)
-{
-	malloc_zero_policy = MALLOC_ZERO_NONE;
-}
-
 /*****************	OBSOLETE ENTRY POINTS	********************/
 
 #if PHASE_OUT_OLD_MALLOC
@@ -2922,65 +2593,34 @@
 }
 
 #pragma mark -
-#pragma mark Malloc Thread Options
-
-typedef union {
-	malloc_thread_options_t options;
-	void *storage;
-} th_opts_t;
-
-MALLOC_STATIC_ASSERT(sizeof(th_opts_t) == sizeof(void *), "Options fit into pointer bits");
-
-malloc_thread_options_t
-malloc_get_thread_options(void)
-{
-	th_opts_t x = {.storage = _pthread_getspecific_direct(__TSD_MALLOC_THREAD_OPTIONS)};
-	return x.options;
-}
-
-void
-malloc_set_thread_options(malloc_thread_options_t opts)
-{
-	// Canonicalize options
-	if (opts.DisableExpensiveDebuggingOptions) {
-		opts.DisableProbabilisticGuardMalloc = true;
-		opts.DisableMallocStackLogging = true;
-	}
-
-	pgm_thread_set_disabled(opts.DisableProbabilisticGuardMalloc);
-
-	th_opts_t x = {.options = opts};
-	_pthread_setspecific_direct(__TSD_MALLOC_THREAD_OPTIONS, x.storage);
-}
-
-#pragma mark -
 #pragma mark Malloc Stack Logging
 
-static bool _malloc_register_stack_logger(bool at_startup);
 
 /* this is called from libsystem during initialization. */
-static void
-stack_logging_early_finished(const struct _malloc_late_init *funcs)
+void
+__stack_logging_early_finished(const struct _malloc_functions *funcs)
 {
 #if !TARGET_OS_DRIVERKIT
 	_dlopen = funcs->dlopen;
 	_dlsym = funcs->dlsym;
 #endif
-	if (funcs->version >= 2 && funcs->msl) {
-		msl = *funcs->msl;
-	}
 	const char **env = (const char**) *_NSGetEnviron();
 	for (const char **e = env; *e; e++) {
 		if (0==strncmp(*e, "MallocStackLogging", 18)) {
-			_malloc_register_stack_logger(true);
-			if (msl.set_flags_from_environment) {
-				msl.set_flags_from_environment(env);
+			malloc_register_stack_logger();
+			void (*msl_set_flags_from_environment) (const char **env);
+			msl_set_flags_from_environment = _dlsym(msl.dylib, "msl_set_flags_from_environment");
+			if (msl_set_flags_from_environment) {
+				msl_set_flags_from_environment(env);
 			}
 			break;
 		}
 	}
-	if (msl.initialize) {
-		msl.initialize();
+	if (msl.dylib) {
+		void (*initialize) () = _dlsym(msl.dylib, "msl_initialize");
+		if (initialize) {
+			initialize();
+		}
 	}
 }
 
@@ -2990,70 +2630,45 @@
 static void
 register_msl_dylib(void *dylib)
 {
-#if TARGET_OS_DRIVERKIT
-	set_msl_lite_hooks(msl.copy_msl_lite_hooks);
-#else
 	if (!dylib) {
 		return;
 	}
-	msld.dylib = dylib;
+	msl.dylib = dylib;
 	msl.handle_memory_event = _dlsym(dylib, "msl_handle_memory_event");
 	msl.stack_logging_locked = _dlsym(dylib, "msl_stack_logging_locked");
 	msl.fork_prepare = _dlsym(dylib, "msl_fork_prepare");
 	msl.fork_child = _dlsym(dylib, "msl_fork_child");
 	msl.fork_parent = _dlsym(dylib, "msl_fork_parent");
-	msl.turn_on_stack_logging = _dlsym(dylib, "msl_turn_on_stack_logging");
-	msl.turn_off_stack_logging = _dlsym(dylib, "msl_turn_off_stack_logging");
-	msl.set_flags_from_environment = _dlsym(dylib, "msl_set_flags_from_environment");
-	msl.initialize = _dlsym(dylib, "msl_initialize");
-
 	
 	// TODO delete these ones
-	msld.get_frames_for_address = _dlsym(dylib, "msl_get_frames_for_address");
-	msld.stackid_for_vm_region = _dlsym(dylib, "msl_stackid_for_vm_region");
-	msld.get_frames_for_stackid = _dlsym(dylib, "msl_get_frames_for_stackid");
-	msld.uniquing_table_read_stack = _dlsym(dylib, "msl_uniquing_table_read_stack");
+	msl.get_frames_for_address = _dlsym(dylib, "msl_get_frames_for_address");
+	msl.stackid_for_vm_region = _dlsym(dylib, "msl_stackid_for_vm_region");
+	msl.get_frames_for_stackid = _dlsym(dylib, "msl_get_frames_for_stackid");
+	msl.uniquing_table_read_stack = _dlsym(dylib, "msl_uniquing_table_read_stack");
 
 	void (*msl_copy_msl_lite_hooks) (struct _malloc_msl_lite_hooks_s *hooksp, size_t size);
 	msl_copy_msl_lite_hooks = _dlsym(dylib, "msl_copy_msl_lite_hooks");
 	if (msl_copy_msl_lite_hooks) {
 		set_msl_lite_hooks(msl_copy_msl_lite_hooks);
 	}
-#endif
 }
 
 MALLOC_EXPORT
 boolean_t
 malloc_register_stack_logger(void)
 {
-    return _malloc_register_stack_logger(false);
-}
-
-static bool
-_malloc_register_stack_logger(bool at_startup)
-{
-	void *dylib = NULL;
-	if (malloc_quarantine_enabled && !at_startup) {
-		return false;
-	}
-#if !TARGET_OS_DRIVERKIT
-	if (msl.handle_memory_event != NULL) {
+	if (msl.dylib != NULL) {
 		return true;
 	}
-	if (_dlopen == NULL) {
-		return false;
-	}
-	dylib = _dlopen("/System/Library/PrivateFrameworks/MallocStackLogging.framework/MallocStackLogging", RTLD_GLOBAL);
+	void *dylib = _dlopen("/System/Library/PrivateFrameworks/MallocStackLogging.framework/MallocStackLogging", RTLD_GLOBAL);
 	if (dylib == NULL) {
 		return false;	
 	}
-#endif
 	os_once(&_register_msl_dylib_pred, dylib, register_msl_dylib);
-	if (!msl.handle_memory_event) {
+	if (!msl.dylib) {
 		malloc_report(ASL_LEVEL_WARNING, "failed to load MallocStackLogging.framework\n");
-		return false;
-	}
-	return true;
+	}
+	return msl.dylib == dylib;
 }
 
 /* Symbolication.framework looks up this symbol by name inside libsystem_malloc.dylib. */
@@ -3075,48 +2690,55 @@
 turn_on_stack_logging(stack_logging_mode_type mode)
 {
 	malloc_register_stack_logger();
-	if (!msl.turn_on_stack_logging) {
+	if (!msl.dylib) {
 		return false;
 	}
-	return msl.turn_on_stack_logging(mode);
+	boolean_t (*msl_turn_on_stack_logging) (stack_logging_mode_type mode);
+	msl_turn_on_stack_logging = _dlsym(msl.dylib, "msl_turn_on_stack_logging");
+	if (!msl_turn_on_stack_logging) {
+		return false;
+	}
+	return msl_turn_on_stack_logging(mode);
 }
 
 MALLOC_EXPORT
 void turn_off_stack_logging(void)
 {
 	malloc_register_stack_logger();
-	if (msl.turn_off_stack_logging) {
-		msl.turn_off_stack_logging();
-	}
-}
-
-//deprecated
+	if (!msl.dylib) {
+		return;
+	}
+	void (*msl_turn_off_stack_logging) ();
+	msl_turn_off_stack_logging = _dlsym(msl.dylib, "msl_turn_off_stack_logging");
+	if (msl_turn_off_stack_logging) {
+		msl_turn_off_stack_logging();
+	}
+}
+
 kern_return_t
 __mach_stack_logging_start_reading(task_t task, vm_address_t shared_memory_address, boolean_t *uses_lite_mode)
 {
 	malloc_register_stack_logger();
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return KERN_FAILURE;
 	}
 	kern_return_t (*f) (task_t task, vm_address_t shared_memory_address, boolean_t *uses_lite_mode);
-	f = _dlsym(msld.dylib, "msl_start_reading");
+	f = _dlsym(msl.dylib, "msl_start_reading");
 	if (!f) {
 		return KERN_FAILURE;
 	}
 	return f(task, shared_memory_address, uses_lite_mode);
 }
 
-
-//deprecated
 kern_return_t
 __mach_stack_logging_stop_reading(task_t task)
 {
 	malloc_register_stack_logger();
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return KERN_FAILURE;
 	}
 	kern_return_t (*f) (task_t task);
-	f = _dlsym(msld.dylib, "msl_stop_reading");
+	f = _dlsym(msl.dylib, "msl_stop_reading");
 	if (!f) {
 		return KERN_FAILURE;
 	}
@@ -3131,23 +2753,23 @@
 								uint32_t *count)
 {
 	malloc_register_stack_logger();
-	if (!msld.get_frames_for_address) {
+	if (!msl.get_frames_for_address) {
 		return KERN_FAILURE;
 	}
-	return msld.get_frames_for_address(task, address, stack_frames_buffer, max_stack_frames, count);
+	return msl.get_frames_for_address(task, address, stack_frames_buffer, max_stack_frames, count);
 }
 
 uint64_t
 __mach_stack_logging_stackid_for_vm_region(task_t task, mach_vm_address_t address)
 {
 	malloc_register_stack_logger();
-	if (!msld.stackid_for_vm_region) {
+	if (!msl.stackid_for_vm_region) {
 		return -1ull;
 	}
-	return msld.stackid_for_vm_region(task, address);
-}
-
-//deprecated
+	return msl.stackid_for_vm_region(task, address);
+}
+
+
 kern_return_t
 __mach_stack_logging_frames_for_uniqued_stack(task_t task,
 											  uint64_t stack_identifier,
@@ -3156,13 +2778,12 @@
 											  uint32_t *count)
 {
 	malloc_register_stack_logger();
-	if (!msld.get_frames_for_stackid) {
+	if (!msl.get_frames_for_stackid) {
 		return KERN_FAILURE;
 	}
-	return msld.get_frames_for_stackid(task, stack_identifier, stack_frames_buffer, max_stack_frames, count, NULL);
-}
-
-//deprecated
+	return msl.get_frames_for_stackid(task, stack_identifier, stack_frames_buffer, max_stack_frames, count, NULL);
+}
+
 kern_return_t
 __mach_stack_logging_get_frames_for_stackid(task_t task,
 											uint64_t stack_identifier,
@@ -3172,13 +2793,12 @@
 											bool *last_frame_is_threadid)
 {
 	malloc_register_stack_logger();
-	if (!msld.get_frames_for_stackid) {
+	if (!msl.get_frames_for_stackid) {
 		return KERN_FAILURE;
 	}
-	return msld.get_frames_for_stackid(task, stack_identifier, stack_frames_buffer, max_stack_frames, count, last_frame_is_threadid);
-}
-
-//deprecated
+	return msl.get_frames_for_stackid(task, stack_identifier, stack_frames_buffer, max_stack_frames, count, last_frame_is_threadid);
+}
+
 kern_return_t
 __mach_stack_logging_uniquing_table_read_stack(struct backtrace_uniquing_table *uniquing_table,
 											   uint64_t stackid,
@@ -3187,13 +2807,12 @@
 											   uint32_t max_frames)
 {
 	malloc_register_stack_logger();
-	if (!msld.uniquing_table_read_stack) {
+	if (!msl.uniquing_table_read_stack) {
 		return KERN_FAILURE;
 	}
-	return msld.uniquing_table_read_stack(uniquing_table, stackid, out_frames_buffer, out_frames_count, max_frames);
-}
-
-//deprecated
+	return msl.uniquing_table_read_stack(uniquing_table, stackid, out_frames_buffer, out_frames_count, max_frames);
+}
+
 kern_return_t
 __mach_stack_logging_enumerate_records(task_t task,
 									   mach_vm_address_t address,
@@ -3205,100 +2824,93 @@
 						mach_vm_address_t address,
 						void enumerator(mach_stack_logging_record_t, void *),
 						void *context);
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return KERN_FAILURE;
 	}
-	f = _dlsym(msld.dylib, "msl_disk_stack_logs_enumerate_from_task");
+	f = _dlsym(msl.dylib, "msl_disk_stack_logs_enumerate_from_task");
 	if (!f) {
 		return KERN_FAILURE;
 	}
 	return f(task, address, enumerator, context);
 }
 
-
-//deprecated
 struct backtrace_uniquing_table *
 __mach_stack_logging_copy_uniquing_table(task_t task)
 {
 	malloc_register_stack_logger();
 	struct backtrace_uniquing_table * (*f) (task_t task);
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return NULL;
 	}
-	f = _dlsym(msld.dylib, "msl_uniquing_table_copy_from_task");
+	f = _dlsym(msl.dylib, "msl_uniquing_table_copy_from_task");
 	if (!f) {
 		return NULL;
 	}
 	return f(task);
 }
 
-//deprecated
 struct backtrace_uniquing_table *
 __mach_stack_logging_uniquing_table_copy_from_serialized(void *buffer, size_t size)
 {
 	malloc_register_stack_logger();
 	struct backtrace_uniquing_table * (*f) (void *buffer, size_t size);
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return NULL;
 	}
-	f = _dlsym(msld.dylib, "msl_uniquing_table_copy_from_serialized");
+	f = _dlsym(msl.dylib, "msl_uniquing_table_copy_from_serialized");
 	if (!f) {
 		return NULL;
 	}
 	return f(buffer, size);
 }
 
-//deprecated
 void
 __mach_stack_logging_uniquing_table_release(struct backtrace_uniquing_table *table)
 {
 	malloc_register_stack_logger();
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return;
 	}
 	void (*f) (struct backtrace_uniquing_table *table);
-	f = _dlsym(msld.dylib, "msl_uniquing_table_release");
+	f = _dlsym(msl.dylib, "msl_uniquing_table_release");
 	if (f) {
 		f(table);
 	}
 }
 
-//deprecated
 void
 __mach_stack_logging_uniquing_table_retain(struct backtrace_uniquing_table *table)
 {
 	malloc_register_stack_logger();
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return;
 	}
 	void (*f) (struct backtrace_uniquing_table *table);
-	f = _dlsym(msld.dylib, "msl_uniquing_table_retain");
+	f = _dlsym(msl.dylib, "msl_uniquing_table_retain");
 	if (f) {
 		f(table);
 	}
 }
 
-//deprecated
 extern
 size_t
 __mach_stack_logging_uniquing_table_sizeof(struct backtrace_uniquing_table *table)
 {
 	malloc_register_stack_logger();
 	size_t (*f) (struct backtrace_uniquing_table *table);
-	f = _dlsym(msld.dylib, "msl_uniquing_table_retain");
+	f = _dlsym(msl.dylib, "msl_uniquing_table_retain");
 	return f(table);
 }
 
-//deprecated
 void *
 __mach_stack_logging_uniquing_table_serialize(struct backtrace_uniquing_table *table, mach_vm_size_t *size)
 {
 	malloc_register_stack_logger();
-	if (!msld.dylib) {
+	if (!msl.dylib) {
 		return NULL;
 	}
 	void * (*f) (struct backtrace_uniquing_table *table, mach_vm_size_t *size);
-	f = _dlsym(msld.dylib, "msl_uniquing_table_serialize");
+	f = _dlsym(msl.dylib, "msl_uniquing_table_serialize");
 	if (!f) {
 		return NULL;
 	}