Merge branch busybox (up to "ash: comment out free(p) just before...")

author: Ron Yorston <rmy@pobox.com> 2016-10-19 17:01:55 +0100
committer: Ron Yorston <rmy@pobox.com> 2016-10-19 17:01:55 +0100
commit: 075814c60a316cfd088c88f26f75ab21b5850b98 (patch)
tree: f6e33ac693630827deb309faa5fa4931588db57d
parent: 977d65c1bbc57f5cdd0c8bfd67c8b5bb1cd390dd (diff)
parent: f37e1155aabde6bd95d267a8aec347cedccb8bc3 (diff)
download: busybox-w32-075814c60a316cfd088c88f26f75ab21b5850b98.tar.gz
busybox-w32-075814c60a316cfd088c88f26f75ab21b5850b98.tar.bz2
busybox-w32-075814c60a316cfd088c88f26f75ab21b5850b98.zip
456 files changed, 5694 insertions, 2350 deletions
diff --git a/AUTHORS b/AUTHORS
index 0908fc719..fa58697f7 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -146,6 +146,10 @@ Rob Sullivan <cogito.ergo.cogito@gmail.com>
 Linus Torvalds
    mkswap, fsck.minix, mkfs.minix
+Linus Walleij
+    fbset and fbsplash config RGBA parsing
+    rewrite of mdev helper to create devices from /sys/dev
 Mark Whitley <markw@codepoet.org>
    grep, sed, cut, xargs(previous),
    style-guide, new-applet-HOWTO, bug fixes, etc.
diff --git a/applets/Kbuild.src b/applets/Kbuild.src
index b61239948..3aedbbffe 100644
--- a/applets/Kbuild.src
+++ b/applets/Kbuild.src
@@ -29,7 +29,7 @@ applets/applets.o: include/usage_compressed.h include/applet_tables.h
 applets/applet_tables: .config include/applets.h
 applets/usage:         .config include/applets.h
-applets/usage_pod:     .config include/applet_tables.h include/applets.h
+applets/usage_pod:     .config include/applets.h include/applet_tables.h
 quiet_cmd_gen_usage_compressed = GEN     include/usage_compressed.h
      cmd_gen_usage_compressed = $(srctree_slash)applets/usage_compressed include/usage_compressed.h applets
@@ -37,11 +37,21 @@ quiet_cmd_gen_usage_compressed = GEN     include/usage_compressed.h
 include/usage_compressed.h: applets/usage $(srctree_slash)applets/usage_compressed
        $(call cmd,gen_usage_compressed)
-quiet_cmd_gen_applet_tables = GEN     include/applet_tables.h
+quiet_cmd_gen_applet_tables = GEN     include/applet_tables.h include/NUM_APPLETS.h
      cmd_gen_applet_tables = applets/applet_tables include/applet_tables.h include/NUM_APPLETS.h
-include/applet_tables.h: applets/applet_tables
+include/NUM_APPLETS.h: applets/applet_tables
        $(call cmd,gen_applet_tables)
-include/NUM_APPLETS.h: applets/applet_tables
+# In fact, include/applet_tables.h depends only on applets/applet_tables,
+# and is generated by it. But specifying only it can run
+# applets/applet_tables twice, possibly in parallel.
+# We say that it also needs NUM_APPLETS.h
+#
+# Unfortunately, we need to list the same command,
+# and it can be executed twice (sequentially).
+# The alternative is to not list any command,
+# and then if include/applet_tables.h is deleted, it won't be rebuilt.
+#
+include/applet_tables.h: include/NUM_APPLETS.h applets/applet_tables
        $(call cmd,gen_applet_tables)
diff --git a/applets/applet_tables.c b/applets/applet_tables.c
index 7894b2c33..9a2aa5329 100644
--- a/applets/applet_tables.c
+++ b/applets/applet_tables.c
@@ -143,7 +143,9 @@ int main(int argc, char **argv)
        printf("};\n");
        printf("#endif\n\n");
-#if ENABLE_FEATURE_PREFER_APPLETS
+#if ENABLE_FEATURE_PREFER_APPLETS \
+ || ENABLE_FEATURE_SH_STANDALONE \
+ || ENABLE_FEATURE_SH_NOFORK
        printf("const uint8_t applet_flags[] ALIGN1 = {\n");
        i = 0;
        while (i < NUM_APPLETS) {
@@ -190,27 +192,28 @@ int main(int argc, char **argv)
        printf("};\n");
 #endif
        //printf("#endif /* SKIP_definitions */\n");
 //      printf("\n");
 //      printf("#define MAX_APPLET_NAME_LEN %u\n", MAX_APPLET_NAME_LEN);
        if (argv[2]) {
-                char line_old[80];
-                char line_new[80];
                FILE *fp;
+                char line_new[80];
+//              char line_old[80];
-                line_old[0] = 0;
-                fp = fopen(argv[2], "r");
-                if (fp) {
-                        fgets(line_old, sizeof(line_old), fp);
-                        fclose(fp);
-                }
                sprintf(line_new, "#define NUM_APPLETS %u\n", NUM_APPLETS);
-                if (strcmp(line_old, line_new) != 0) {
+//              line_old[0] = 0;
+//              fp = fopen(argv[2], "r");
+//              if (fp) {
+//                      fgets(line_old, sizeof(line_old), fp);
+//                      fclose(fp);
+//              }
+//              if (strcmp(line_old, line_new) != 0) {
                        fp = fopen(argv[2], "w");
                        if (!fp)
                                return 1;
                        fputs(line_new, fp);
-                }
+//              }
        }
        return 0;
diff --git a/archival/cpio.c b/archival/cpio.c
index 3b1550720..540218cb2 100644
--- a/archival/cpio.c
+++ b/archival/cpio.c
@@ -23,7 +23,7 @@
 //config:         cpio has 110 bytes of overheads for every stored file.
 //config:
 //config:         This implementation of cpio can extract cpio archives created in the
-//config:         "newc" or "crc" format, it cannot create or modify them.
+//config:         "newc" or "crc" format.
 //config:
 //config:         Unless you have a specific application which requires cpio, you
 //config:         should probably say N here.
@@ -51,10 +51,10 @@
 //usage:       " [-ti"IF_FEATURE_CPIO_O("o")"]" IF_FEATURE_CPIO_P(" [-p DIR]")
 //usage:       " [EXTR_FILE]..."
 //usage:#define cpio_full_usage "\n\n"
-//usage:       "Extract or list files from a cpio archive"
+//usage:       "Extract (-i) or list (-t) files from a cpio archive"
 //usage:        IF_FEATURE_CPIO_O(", or"
-//usage:     "\ncreate an archive" IF_FEATURE_CPIO_P(" (-o) or copy files (-p)")
+//usage:     "\ntake file list from stdin and create an archive (-o)"
-//usage:                " using file list on stdin"
+//usage:                IF_FEATURE_CPIO_P(" or copy files (-p)")
 //usage:        )
 //usage:     "\n"
 //usage:     "\nMain operation mode:"
diff --git a/archival/gzip.c b/archival/gzip.c
index 8f1e4ff29..9e0bee815 100644
--- a/archival/gzip.c
+++ b/archival/gzip.c
@@ -2220,10 +2220,7 @@ int gzip_main(int argc UNUSED_PARAM, char **argv)
        opt >>= ENABLE_GUNZIP ? 7 : 5; /* drop cfv[dt]qn bits */
        if (opt == 0)
                opt = 1 << 6; /* default: 6 */
-        /* Map 1..3 to 4 */
+        opt = ffs(opt >> 4); /* Maps -1..-4 to [0], -5 to [1] ... -9 to [5] */
-        if (opt & 0x7)
-                opt |= 1 << 4;
-        opt = ffs(opt >> 3);
        max_chain_length = 1 << gzip_level_config[opt].chain_shift;
        good_match       = gzip_level_config[opt].good;
        max_lazy_match   = gzip_level_config[opt].lazy2 * 2;
diff --git a/configs/TEST_nommu_defconfig b/configs/TEST_nommu_defconfig
index 5f822e598..20c2e1550 100644
--- a/configs/TEST_nommu_defconfig
+++ b/configs/TEST_nommu_defconfig
@@ -760,7 +760,6 @@ CONFIG_TFTP_DEBUG=y
 CONFIG_TRACEROUTE=y
 CONFIG_TRACEROUTE6=y
 CONFIG_FEATURE_TRACEROUTE_VERBOSE=y
-CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE=y
 CONFIG_FEATURE_TRACEROUTE_USE_ICMP=y
 CONFIG_UDHCPD=y
 CONFIG_DHCPRELAY=y
diff --git a/configs/TEST_noprintf_defconfig b/configs/TEST_noprintf_defconfig
index c56781e32..845032ea1 100644
--- a/configs/TEST_noprintf_defconfig
+++ b/configs/TEST_noprintf_defconfig
@@ -762,7 +762,6 @@ CONFIG_IFUPDOWN_IFSTATE_PATH=""
 # CONFIG_TRACEROUTE is not set
 # CONFIG_TRACEROUTE6 is not set
 # CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 # CONFIG_TUNCTL is not set
 # CONFIG_FEATURE_TUNCTL_UG is not set
diff --git a/configs/TEST_rh9_defconfig b/configs/TEST_rh9_defconfig
index 28daa6273..d8c5af4f7 100644
--- a/configs/TEST_rh9_defconfig
+++ b/configs/TEST_rh9_defconfig
@@ -778,7 +778,6 @@ CONFIG_FEATURE_TFTP_PROGRESS_BAR=y
 CONFIG_TRACEROUTE=y
 CONFIG_TRACEROUTE6=y
 CONFIG_FEATURE_TRACEROUTE_VERBOSE=y
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 CONFIG_TUNCTL=y
 CONFIG_FEATURE_TUNCTL_UG=y
diff --git a/configs/android2_defconfig b/configs/android2_defconfig
index fbc0da091..857f9f5df 100644
--- a/configs/android2_defconfig
+++ b/configs/android2_defconfig
@@ -814,7 +814,6 @@ CONFIG_TCPSVD=y
 # CONFIG_TRACEROUTE is not set
 # CONFIG_TRACEROUTE6 is not set
 # CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 CONFIG_TUNCTL=y
 CONFIG_FEATURE_TUNCTL_UG=y
diff --git a/configs/android_502_defconfig b/configs/android_502_defconfig
index 7ef1585fb..cd06affab 100644
--- a/configs/android_502_defconfig
+++ b/configs/android_502_defconfig
@@ -959,7 +959,6 @@ CONFIG_FEATURE_TFTP_PROGRESS_BAR=y
 CONFIG_TRACEROUTE=y
 CONFIG_TRACEROUTE6=y
 CONFIG_FEATURE_TRACEROUTE_VERBOSE=y
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 CONFIG_TUNCTL=y
 CONFIG_FEATURE_TUNCTL_UG=y
diff --git a/configs/android_defconfig b/configs/android_defconfig
index 4e0224207..f1ddc45d4 100644
--- a/configs/android_defconfig
+++ b/configs/android_defconfig
@@ -843,7 +843,6 @@ CONFIG_FEATURE_TFTP_PROGRESS_BAR=y
 CONFIG_TRACEROUTE=y
 # CONFIG_TRACEROUTE6 is not set
 CONFIG_FEATURE_TRACEROUTE_VERBOSE=y
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 CONFIG_TUNCTL=y
 CONFIG_FEATURE_TUNCTL_UG=y
diff --git a/configs/android_ndk_defconfig b/configs/android_ndk_defconfig
index d657d33e9..18651fd7c 100644
--- a/configs/android_ndk_defconfig
+++ b/configs/android_ndk_defconfig
@@ -869,7 +869,6 @@ CONFIG_FEATURE_TFTP_PROGRESS_BAR=y
 CONFIG_TRACEROUTE=y
 # CONFIG_TRACEROUTE6 is not set
 CONFIG_FEATURE_TRACEROUTE_VERBOSE=y
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 CONFIG_TUNCTL=y
 CONFIG_FEATURE_TUNCTL_UG=y
diff --git a/configs/cygwin_defconfig b/configs/cygwin_defconfig
index 38d580ad1..dd7c21edb 100644
--- a/configs/cygwin_defconfig
+++ b/configs/cygwin_defconfig
@@ -814,7 +814,6 @@ CONFIG_FEATURE_TFTP_PROGRESS_BAR=y
 # CONFIG_TRACEROUTE is not set
 # CONFIG_TRACEROUTE6 is not set
 # CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 # CONFIG_TUNCTL is not set
 # CONFIG_FEATURE_TUNCTL_UG is not set
diff --git a/configs/freebsd_defconfig b/configs/freebsd_defconfig
index ae62f1389..265ab1307 100644
--- a/configs/freebsd_defconfig
+++ b/configs/freebsd_defconfig
@@ -795,7 +795,6 @@ CONFIG_FEATURE_TFTP_PROGRESS_BAR=y
 # CONFIG_TRACEROUTE is not set
 # CONFIG_TRACEROUTE6 is not set
 # CONFIG_FEATURE_TRACEROUTE_VERBOSE is not set
-# CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE is not set
 # CONFIG_FEATURE_TRACEROUTE_USE_ICMP is not set
 # CONFIG_TUNCTL is not set
 # CONFIG_FEATURE_TUNCTL_UG is not set
diff --git a/coreutils/Config.src b/coreutils/Config.src
index 619c2efe8..b9dde1209 100644
--- a/coreutils/Config.src
+++ b/coreutils/Config.src
@@ -328,12 +328,6 @@ config FEATURE_LS_COLOR_IS_DEFAULT
          configurable, and the output may not be legible on
          many output screens.
-config MD5SUM
-        bool "md5sum"
-        default y
-        help
-          md5sum is used to print or check MD5 checksums.
 config MKDIR
        bool "mkdir"
        default y
@@ -458,30 +452,6 @@ config SEQ
        help
          print a sequence of numbers
-config SHA1SUM
-        bool "sha1sum"
-        default y
-        help
-          Compute and check SHA1 message digest
-config SHA256SUM
-        bool "sha256sum"
-        default y
-        help
-          Compute and check SHA256 message digest
-config SHA512SUM
-        bool "sha512sum"
-        default y
-        help
-          Compute and check SHA512 message digest
-config SHA3SUM
-        bool "sha3sum"
-        default y
-        help
-          Compute and check SHA3 (512-bit) message digest
 config SLEEP
        bool "sleep"
        default y
@@ -731,17 +701,4 @@ config FEATURE_HUMAN_READABLE
        help
          Allow df, du, and ls to have human readable output.
-comment "Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum"
-        depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
-config FEATURE_MD5_SHA1_SUM_CHECK
-        bool "Enable -c, -s and -w options"
-        default y
-        depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
-        help
-          Enabling the -c options allows files to be checked
-          against pre-calculated hash values.
-          -s and -w are useful options when verifying checksums.
 endmenu
diff --git a/coreutils/Kbuild.src b/coreutils/Kbuild.src
index 4ec075ac6..5a64fee35 100644
--- a/coreutils/Kbuild.src
+++ b/coreutils/Kbuild.src
@@ -41,7 +41,6 @@ lib-$(CONFIG_LN)        += ln.o
 lib-$(CONFIG_LOGNAME)   += logname.o
 lib-$(CONFIG_LS)        += ls.o
 lib-$(CONFIG_FTPD)      += ls.o
-lib-$(CONFIG_MD5SUM)    += md5_sha1_sum.o
 lib-$(CONFIG_MKDIR)     += mkdir.o
 lib-$(CONFIG_MKFIFO)    += mkfifo.o
 lib-$(CONFIG_MKNOD)     += mknod.o
@@ -58,10 +57,6 @@ lib-$(CONFIG_REALPATH)  += realpath.o
 lib-$(CONFIG_RM)        += rm.o
 lib-$(CONFIG_RMDIR)     += rmdir.o
 lib-$(CONFIG_SEQ)       += seq.o
-lib-$(CONFIG_SHA1SUM)   += md5_sha1_sum.o
-lib-$(CONFIG_SHA256SUM) += md5_sha1_sum.o
-lib-$(CONFIG_SHA512SUM) += md5_sha1_sum.o
-lib-$(CONFIG_SHA3SUM)   += md5_sha1_sum.o
 lib-$(CONFIG_SLEEP)     += sleep.o
 lib-$(CONFIG_SPLIT)     += split.o
 lib-$(CONFIG_SORT)      += sort.o
diff --git a/coreutils/expr.c b/coreutils/expr.c
index ce6b2d189..efc435443 100644
--- a/coreutils/expr.c
+++ b/coreutils/expr.c
@@ -114,7 +114,7 @@ static VALUE *int_value(arith_t i)
        VALUE *v;
        v = xzalloc(sizeof(VALUE));
-        if (INTEGER) /* otherwise xzaaloc did it already */
+        if (INTEGER) /* otherwise xzalloc did it already */
                v->type = INTEGER;
        v->u.i = i;
        return v;
@@ -127,7 +127,7 @@ static VALUE *str_value(const char *s)
        VALUE *v;
        v = xzalloc(sizeof(VALUE));
-        if (STRING) /* otherwise xzaaloc did it already */
+        if (STRING) /* otherwise xzalloc did it already */
                v->type = STRING;
        v->u.s = xstrdup(s);
        return v;
diff --git a/coreutils/md5_sha1_sum.c b/coreutils/md5_sha1_sum.c
index 1a5342e87..783f44027 100644
--- a/coreutils/md5_sha1_sum.c
+++ b/coreutils/md5_sha1_sum.c
@@ -5,6 +5,60 @@
 *
 * Licensed under GPLv2 or later, see file LICENSE in this source tree.
 */
+//config:config MD5SUM
+//config:       bool "md5sum"
+//config:       default y
+//config:       help
+//config:         md5sum is used to print or check MD5 checksums.
+//config:
+//config:config SHA1SUM
+//config:       bool "sha1sum"
+//config:       default y
+//config:       help
+//config:         Compute and check SHA1 message digest
+//config:
+//config:config SHA256SUM
+//config:       bool "sha256sum"
+//config:       default y
+//config:       help
+//config:         Compute and check SHA256 message digest
+//config:
+//config:config SHA512SUM
+//config:       bool "sha512sum"
+//config:       default y
+//config:       help
+//config:         Compute and check SHA512 message digest
+//config:
+//config:config SHA3SUM
+//config:       bool "sha3sum"
+//config:       default y
+//config:       help
+//config:         Compute and check SHA3 message digest
+//config:
+//config:comment "Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum"
+//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
+//config:
+//config:config FEATURE_MD5_SHA1_SUM_CHECK
+//config:       bool "Enable -c, -s and -w options"
+//config:       default y
+//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
+//config:       help
+//config:         Enabling the -c options allows files to be checked
+//config:         against pre-calculated hash values.
+//config:
+//config:         -s and -w are useful options when verifying checksums.
+//applet:IF_MD5SUM(APPLET_NOEXEC(md5sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, md5sum))
+//applet:IF_SHA1SUM(APPLET_NOEXEC(sha1sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha1sum))
+//applet:IF_SHA3SUM(APPLET_NOEXEC(sha3sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha3sum))
+//applet:IF_SHA256SUM(APPLET_NOEXEC(sha256sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha256sum))
+//applet:IF_SHA512SUM(APPLET_NOEXEC(sha512sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha512sum))
+//kbuild:lib-$(CONFIG_MD5SUM)    += md5_sha1_sum.o
+//kbuild:lib-$(CONFIG_SHA1SUM)   += md5_sha1_sum.o
+//kbuild:lib-$(CONFIG_SHA256SUM) += md5_sha1_sum.o
+//kbuild:lib-$(CONFIG_SHA512SUM) += md5_sha1_sum.o
+//kbuild:lib-$(CONFIG_SHA3SUM)   += md5_sha1_sum.o
 //usage:#define md5sum_trivial_usage
 //usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[FILE]..."
@@ -57,15 +111,20 @@
 //usage:        )
 //usage:
 //usage:#define sha3sum_trivial_usage
-//usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[FILE]..."
+//usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[-a BITS] [FILE]..."
 //usage:#define sha3sum_full_usage "\n\n"
-//usage:       "Print" IF_FEATURE_MD5_SHA1_SUM_CHECK(" or check") " SHA3-512 checksums"
+//usage:       "Print" IF_FEATURE_MD5_SHA1_SUM_CHECK(" or check") " SHA3 checksums"
 //usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK( "\n"
 //usage:     "\n        -c      Check sums against list in FILEs"
 //usage:     "\n        -s      Don't output anything, status code shows success"
 //usage:     "\n        -w      Warn about improperly formatted checksum lines"
+//usage:     "\n        -a BITS 224 (default), 256, 384, 512"
 //usage:        )
+//FIXME: GNU coreutils 8.25 has no -s option, it has only these two long opts:
+// --quiet   don't print OK for each successfully verified file
+// --status  don't output anything, status code shows success
 #include "libbb.h"
 /* This is a NOEXEC applet. Be very careful! */
@@ -93,7 +152,10 @@ static unsigned char *hash_bin_to_hex(unsigned char *hash_value,
        return (unsigned char *)hex_value;
 }
-static uint8_t *hash_file(const char *filename)
+#if !ENABLE_SHA3SUM
+# define hash_file(f,w) hash_file(f)
+#endif
+static uint8_t *hash_file(const char *filename, unsigned sha3_width)
 {
        int src_fd, hash_len, count;
        union _ctx_ {
@@ -121,27 +183,47 @@ static uint8_t *hash_file(const char *filename)
                update = (void*)md5_hash;
                final = (void*)md5_end;
                hash_len = 16;
-        } else if (ENABLE_SHA1SUM && hash_algo == HASH_SHA1) {
+        }
+        else if (ENABLE_SHA1SUM && hash_algo == HASH_SHA1) {
                sha1_begin(&context.sha1);
                update = (void*)sha1_hash;
                final = (void*)sha1_end;
                hash_len = 20;
-        } else if (ENABLE_SHA256SUM && hash_algo == HASH_SHA256) {
+        }
+        else if (ENABLE_SHA256SUM && hash_algo == HASH_SHA256) {
                sha256_begin(&context.sha256);
                update = (void*)sha256_hash;
                final = (void*)sha256_end;
                hash_len = 32;
-        } else if (ENABLE_SHA512SUM && hash_algo == HASH_SHA512) {
+        }
+        else if (ENABLE_SHA512SUM && hash_algo == HASH_SHA512) {
                sha512_begin(&context.sha512);
                update = (void*)sha512_hash;
                final = (void*)sha512_end;
                hash_len = 64;
-        } else if (ENABLE_SHA3SUM && hash_algo == HASH_SHA3) {
+        }
+#if ENABLE_SHA3SUM
+        else if (ENABLE_SHA3SUM && hash_algo == HASH_SHA3) {
                sha3_begin(&context.sha3);
                update = (void*)sha3_hash;
                final = (void*)sha3_end;
-                hash_len = 64;
+                /*
-        } else {
+                 * Should support 224, 256, 384, 512.
+                 * We allow any value which does not blow the algorithm up.
+                 */
+                if (sha3_width >= 1600/2 /* input block can't be <= 0 */
+                 || sha3_width == 0      /* hash len can't be 0 */
+                 || (sha3_width & 0x1f)  /* should be multiple of 32 */
+                /* (because input uses up to 8 byte wide word XORs. 32/4=8) */
+                ) {
+                        bb_error_msg_and_die("bad -a%u", sha3_width);
+                }
+                sha3_width /= 4;
+                context.sha3.input_block_bytes = 1600/8 - sha3_width;
+                hash_len = sha3_width/2;
+        }
+#endif
+        else {
                xfunc_die(); /* can't reach this */
        }
@@ -172,28 +254,33 @@ int md5_sha1_sum_main(int argc UNUSED_PARAM, char **argv)
 {
        int return_value = EXIT_SUCCESS;
        unsigned flags;
+#if ENABLE_SHA3SUM
+        unsigned sha3_width = 224;
+#endif
        if (ENABLE_FEATURE_MD5_SHA1_SUM_CHECK) {
+                /* -s and -w require -c */
+                opt_complementary = "s?c:w?c";
                /* -b "binary", -t "text" are ignored (shaNNNsum compat) */
-                flags = getopt32(argv, "scwbt");
+#if ENABLE_SHA3SUM
-                argv += optind;
+                if (applet_name[3] == HASH_SHA3)
-                //argc -= optind;
+                        flags = getopt32(argv, "scwbta:+", &sha3_width);
+                else
+#endif
+                        flags = getopt32(argv, "scwbt");
        } else {
-                argv += 1;
+#if ENABLE_SHA3SUM
-                //argc -= 1;
+                if (applet_name[3] == HASH_SHA3)
+                        getopt32(argv, "a:+", &sha3_width);
+                else
+#endif
+                        getopt32(argv, "");
        }
+        argv += optind;
+        //argc -= optind;
        if (!*argv)
                *--argv = (char*)"-";
-        if (ENABLE_FEATURE_MD5_SHA1_SUM_CHECK && !(flags & FLAG_CHECK)) {
-                if (flags & FLAG_SILENT) {
-                        bb_error_msg_and_die("-%c is meaningful only with -c", 's');
-                }
-                if (flags & FLAG_WARN) {
-                        bb_error_msg_and_die("-%c is meaningful only with -c", 'w');
-                }
-        }
        do {
                if (ENABLE_FEATURE_MD5_SHA1_SUM_CHECK && (flags & FLAG_CHECK)) {
                        FILE *pre_computed_stream;
@@ -225,7 +312,7 @@ int md5_sha1_sum_main(int argc UNUSED_PARAM, char **argv)
                                *filename_ptr = '\0';
                                filename_ptr += 2;
-                                hash_value = hash_file(filename_ptr);
+                                hash_value = hash_file(filename_ptr, sha3_width);
                                if (hash_value && (strcmp((char*)hash_value, line) == 0)) {
                                        if (!(flags & FLAG_SILENT))
@@ -244,9 +331,17 @@ int md5_sha1_sum_main(int argc UNUSED_PARAM, char **argv)
                                bb_error_msg("WARNING: %d of %d computed checksums did NOT match",
                                                count_failed, count_total);
                        }
+                        if (count_total == 0) {
+                                return_value = EXIT_FAILURE;
+                                /*
+                                 * md5sum from GNU coreutils 8.25 says:
+                                 * md5sum: <FILE>: no properly formatted MD5 checksum lines found
+                                 */
+                                bb_error_msg("%s: no checksum lines found", *argv);
+                        }
                        fclose_if_not_stdin(pre_computed_stream);
                } else {
-                        uint8_t *hash_value = hash_file(*argv);
+                        uint8_t *hash_value = hash_file(*argv, sha3_width);
                        if (hash_value == NULL) {
                                return_value = EXIT_FAILURE;
                        } else {
diff --git a/coreutils/sync.c b/coreutils/sync.c
index 974e90452..e65d9cd8d 100644
--- a/coreutils/sync.c
+++ b/coreutils/sync.c
@@ -15,7 +15,7 @@
 //config:       help
 //config:         sync is used to flush filesystem buffers.
 //config:config FEATURE_SYNC_FANCY
-//config:       bool "Enable -d and -f flags (requres syncfs(2) in libc)"
+//config:       bool "Enable -d and -f flags (requires syncfs(2) in libc)"
 //config:       default y
 //config:       depends on SYNC
 //config:       help
diff --git a/coreutils/test.c b/coreutils/test.c
index 422d24c54..b8a5d798c 100644
--- a/coreutils/test.c
+++ b/coreutils/test.c
@@ -394,6 +394,7 @@ extern struct test_statics *const test_ptr_to_statics;
        barrier(); \
 } while (0)
 #define DEINIT_S() do { \
+        free(group_array); \
        free(test_ptr_to_statics); \
 } while (0)
diff --git a/docs/keep_data_small.txt b/docs/keep_data_small.txt
index 3ced1a61d..218d4f2ee 100644
--- a/docs/keep_data_small.txt
+++ b/docs/keep_data_small.txt
@@ -59,7 +59,7 @@ wait
                Example 1
 One example how to reduce global data usage is in
-archival/libarchive/decompress_unzip.c:
+archival/libarchive/decompress_gunzip.c:
 /* This is somewhat complex-looking arrangement, but it allows
 * to place decompressor state either in bss or in
@@ -87,7 +87,7 @@ take a look at archival/gzip.c. Here all global data is replaced by
 single global pointer (ptr_to_globals) to allocated storage.
 In order to not duplicate ptr_to_globals in every applet, you can
-reuse single common one. It is defined in libbb/messages.c
+reuse single common one. It is defined in libbb/ptr_to_globals.c
 as struct globals *const ptr_to_globals, but the struct globals is
 NOT defined in libbb.h. You first define your own struct:
diff --git a/editors/sed.c b/editors/sed.c
index 2e99dc792..63ca1dc99 100644
--- a/editors/sed.c
+++ b/editors/sed.c
@@ -1305,16 +1305,17 @@ static void process_files(void)
                case 'n':
                        if (!G.be_quiet)
                                sed_puts(pattern_space, last_gets_char);
-                        if (next_line) {
+                        if (next_line == NULL) {
-                                free(pattern_space);
+                                /* If no next line, jump to end of script and exit. */
-                                pattern_space = next_line;
+                                goto discard_line;
-                                last_gets_char = next_gets_char;
-                                next_line = get_next_line(&next_gets_char, &last_puts_char);
-                                substituted = 0;
-                                linenum++;
-                                break;
                        }
-                        /* fall through */
+                        free(pattern_space);
+                        pattern_space = next_line;
+                        last_gets_char = next_gets_char;
+                        next_line = get_next_line(&next_gets_char, &last_puts_char);
+                        substituted = 0;
+                        linenum++;
+                        break;
                /* Quit.  End of script, end of input. */
                case 'q':
diff --git a/editors/vi.c b/editors/vi.c
index da7464b58..b81f2b92d 100644
--- a/editors/vi.c
+++ b/editors/vi.c
@@ -2722,9 +2722,8 @@ static char *swap_context(char *p) // goto new context for '' command make this
        // only swap context if other context is valid
        if (text <= mark[27] && mark[27] <= end - 1) {
                tmp = mark[27];
-                mark[27] = mark[26];
+                mark[27] = p;
-                mark[26] = tmp;
+                mark[26] = p = tmp;
-                p = mark[26];   // where we are going- previous context
                context_start = prev_line(prev_line(prev_line(p)));
                context_end = next_line(next_line(next_line(p)));
        }
@@ -3665,8 +3664,9 @@ static void do_cmd(int c)
                }
                break;
        case '\'':                      // '- goto a specific mark
-                c1 = (get_one_char() | 0x20) - 'a';
+                c1 = (get_one_char() | 0x20);
-                if ((unsigned)c1 <= 25) { // a-z?
+                if ((unsigned)(c1 - 'a') <= 25) { // a-z?
+                        c1 = (c1 - 'a');
                        // get the b-o-l
                        q = mark[c1];
                        if (text <= q && q < end) {
@@ -3980,7 +3980,9 @@ static void do_cmd(int c)
                c1 = get_one_char();
                if (c1 != 'g') {
                        buf[0] = 'g';
-                        buf[1] = c1; // TODO: if Unicode?
+                        // c1 < 0 if the key was special. Try "g<up-arrow>"
+                        // TODO: if Unicode?
+                        buf[1] = (c1 >= 0 ? c1 : '*');
                        buf[2] = '\0';
                        not_implemented(buf);
                        break;
diff --git a/examples/var_service/dhcpd_if/README b/examples/var_service/dhcpd_if/README
new file mode 100644
index 000000000..4ddccb22d
--- /dev/null
+++ b/examples/var_service/dhcpd_if/README
@@ -0,0 +1,5 @@
+The real README file is one directory up.
+This directory's run script can have useful comments.
+If it doesn't but you feel it should, please send a patch
+to busybox's mailing list.
diff --git a/examples/var_service/dhcpd_if/log/run b/examples/var_service/dhcpd_if/log/run
new file mode 100755
index 000000000..69d74b73f
--- /dev/null
+++ b/examples/var_service/dhcpd_if/log/run
@@ -0,0 +1,21 @@
+#!/bin/sh
+user=logger
+logdir="/var/log/service/`(cd ..;basename $PWD)`"
+mkdir -p "$logdir" 2>/dev/null
+chown -R "$user": "$logdir"
+chmod -R go-rwxst,u+rwX "$logdir"
+rm -rf logdir
+ln -s "$logdir" logdir
+# make this dir accessible to logger
+chmod a+rX .
+exec >/dev/null
+exec 2>&1
+exec \
+env - PATH="$PATH" \
+softlimit \
+setuidgid "$user" \
+svlogd -tt "$logdir"
diff --git a/examples/var_service/dhcpd_if/p_log b/examples/var_service/dhcpd_if/p_log
new file mode 100755
index 000000000..a2521be05
--- /dev/null
+++ b/examples/var_service/dhcpd_if/p_log
@@ -0,0 +1,4 @@
+#!/bin/sh
+cd log/logdir || exit 1
+cat @* current | $PAGER
diff --git a/examples/var_service/dhcpd_if/run b/examples/var_service/dhcpd_if/run
new file mode 100755
index 000000000..de85dece0
--- /dev/null
+++ b/examples/var_service/dhcpd_if/run
@@ -0,0 +1,23 @@
+#!/bin/sh
+exec 2>&1
+exec </dev/null
+pwd="$PWD"
+if="${PWD##*/dhcpd_}"
+echo "* Upping iface $if"
+ip link set dev $if up
+>>udhcpd.leases
+sed 's/^interface.*$/interface '"$if/" -i udhcpc.conf
+echo "* Starting udhcpd"
+exec \
+env - PATH="$PATH" \
+softlimit \
+setuidgid root \
+udhcpd -f -vv udhcpc.conf
+exit $?
diff --git a/examples/var_service/dhcpd_if/udhcpc.conf b/examples/var_service/dhcpd_if/udhcpc.conf
new file mode 100644
index 000000000..a81925970
--- /dev/null
+++ b/examples/var_service/dhcpd_if/udhcpc.conf
@@ -0,0 +1,28 @@
+# Directives with defaults:
+# start         192.168.0.20
+# end           192.168.0.254
+# interface     eth0
+# max_leases    235
+# auto_time     7200
+# decline_time  3600
+# conflict_time 3600
+# offer_time    60
+# min_lease     60
+# lease_file    /var/lib/misc/udhcpd.leases
+# pidfile       /var/run/udhcpd.pid
+# siaddr        0.0.0.0
+#
+# Directives with no defaults (or with empty defaults):
+# option/opt    NAME VALUE
+# notify_file   /path/to/script_to_run_after_leasefile_is_written
+#               (it is run with $1 = lease_file_name)
+# sname         dhcp_packet_sname_field_contents
+# boot_file     dhcp_packet_bootfile_field_contents
+# static_lease  XX:XX:XX:XX:XX:XX IP.ADD.RE.SS
+interface if
+pidfile         /dev/null
+lease_file      udhcpd.leases
+option          subnet 255.255.255.0
+option          lease  3600
+#option         router 192.168.0.1
diff --git a/examples/var_service/dhcpd_if/w_dumpleases b/examples/var_service/dhcpd_if/w_dumpleases
new file mode 100755
index 000000000..ff772055a
--- /dev/null
+++ b/examples/var_service/dhcpd_if/w_dumpleases
@@ -0,0 +1,3 @@
+#!/bin/sh
+watch -n1 'dumpleases -af udhcpd.leases'
diff --git a/examples/var_service/dhcpd_if/w_dumpleases_countdown b/examples/var_service/dhcpd_if/w_dumpleases_countdown
new file mode 100755
index 000000000..7fcd9602a
--- /dev/null
+++ b/examples/var_service/dhcpd_if/w_dumpleases_countdown
@@ -0,0 +1,3 @@
+#!/bin/sh
+watch -n1 'dumpleases -f udhcpd.leases'
diff --git a/examples/var_service/dhcpd_if/w_log b/examples/var_service/dhcpd_if/w_log
new file mode 100755
index 000000000..dba76c69b
--- /dev/null
+++ b/examples/var_service/dhcpd_if/w_log
@@ -0,0 +1,4 @@
+#!/bin/sh
+cd log/logdir
+watch -n1 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b0-$((w-2))'
diff --git a/examples/var_service/fw/run b/examples/var_service/fw/run
index 81c7f2e7c..1fd71cc01 100755
--- a/examples/var_service/fw/run
+++ b/examples/var_service/fw/run
@@ -1,18 +1,20 @@
 #!/bin/bash
 # (using bashism: arrays)
-service="${PWD##*/}"
+user="root"
-rundir="/var/run/service/$service"
+reset_all_netdevs=true
+preferred_default_route_iface="if"
-user=root
+extif="if"
-extif=if
+ext_open_tcp="22 80 88" # space-separated
-ext_open_tcp="21 22 80" # space-separated
 # Make ourself one-shot
 sv o .
 # Debug
 #date '+%Y-%m-%d %H:%M:%S' >>"$0.log"
+service=`basename $PWD`
+rundir="/var/run/service/$service"
 ### filter This is the default table (if no -t option is passed).  It contains
 ###        the  built-in chains INPUT (for packets coming into the box itself),
 ###        FORWARD (for packets being routed through the box), and OUTPUT (for
@@ -70,7 +72,6 @@ ln -s "$rundir" rundir
 # Timestamping
 date '+%Y-%m-%d %H:%M:%S'
 echo; echo "* Reading IP config"
 cfg=-1
 #             static cfg    dhcp,zeroconf etc
@@ -86,11 +87,19 @@ echo; echo "* Configuring hardware"
 #doit ethtool -K if rx off tx off sg off tso off
 echo; echo "* Resetting address and routing info"
-doit ip a f dev lo
+if $reset_all_netdevs; then
-i=0; while test "${if[$i]}"; do
+        devs=`sed -n 's/ //g;s/:.*$//p' </proc/net/dev`
-        doit ip a f dev "${if[$i]}"
+        for iface in $devs; do
-        doit ip r f dev "${if[$i]}" root 0/0
+                doit ip a f dev "$iface"
-let i++; done
+                doit ip r f dev "$iface" root 0/0
+        done
+else
+        doit ip a f dev lo
+        i=0; while test "${if[$i]}"; do
+                doit ip a f dev "${if[$i]}"
+                doit ip r f dev "${if[$i]}" root 0/0
+        let i++; done
+fi
 echo; echo "* Configuring addresses"
 doit ip a a dev lo 127.0.0.1/8 scope host
@@ -103,7 +112,22 @@ i=0; while test "${if[$i]}"; do
 let i++; done
 echo; echo "* Configuring routes"
+# If several ifaces are configured via DHCP, they often both have 0/0 route.
+# They have no way of knowing that this route is offered on more than one iface.
+# Often, it's desirable to prefer one iface: say, wired eth over wireless.
+# if preferred_default_route_iface is not set, 0/0 route will be assigned randomly.
+if test "$preferred_default_route_iface"; then
+        i=0; while test "${if[$i]}"; do
+                if test "${if[$i]}" = "$preferred_default_route_iface" \
+                && test "${net[$i]}" = "0/0" \
+                && test "${gw[$i]}"; then
+                        echo "+ default route through ${if[$i]}, ${gw[$i]}:"
+                        doit ip r a "${net[$i]}" via "${gw[$i]}"
+                fi
+        let i++; done
+fi
 i=0; while test "${if[$i]}"; do
+        #echo $i:"${if[$i]}"
        if test "${net[$i]}" && test "${gw[$i]}"; then
                doit ip r a "${net[$i]}" via "${gw[$i]}"
        fi
diff --git a/examples/var_service/ntpd/p_log_important b/examples/var_service/ntpd/p_log_important
new file mode 100755
index 000000000..09b248fb3
--- /dev/null
+++ b/examples/var_service/ntpd/p_log_important
@@ -0,0 +1,4 @@
+#!/bin/sh
+cd log/logdir || exit 1
+cat @* current | grep -v -eolder -esending -esockets -e'reply from.*offset' -executing | $PAGER
diff --git a/examples/var_service/supplicant_if/README b/examples/var_service/supplicant_if/README
new file mode 100644
index 000000000..4ddccb22d
--- /dev/null
+++ b/examples/var_service/supplicant_if/README
@@ -0,0 +1,5 @@
+The real README file is one directory up.
+This directory's run script can have useful comments.
+If it doesn't but you feel it should, please send a patch
+to busybox's mailing list.
diff --git a/examples/var_service/supplicant_if/log/run b/examples/var_service/supplicant_if/log/run
new file mode 100755
index 000000000..69d74b73f
--- /dev/null
+++ b/examples/var_service/supplicant_if/log/run
@@ -0,0 +1,21 @@
+#!/bin/sh
+user=logger
+logdir="/var/log/service/`(cd ..;basename $PWD)`"
+mkdir -p "$logdir" 2>/dev/null
+chown -R "$user": "$logdir"
+chmod -R go-rwxst,u+rwX "$logdir"
+rm -rf logdir
+ln -s "$logdir" logdir
+# make this dir accessible to logger
+chmod a+rX .
+exec >/dev/null
+exec 2>&1
+exec \
+env - PATH="$PATH" \
+softlimit \
+setuidgid "$user" \
+svlogd -tt "$logdir"
diff --git a/examples/var_service/supplicant_if/p_log b/examples/var_service/supplicant_if/p_log
new file mode 100755
index 000000000..a2521be05
--- /dev/null
+++ b/examples/var_service/supplicant_if/p_log
@@ -0,0 +1,4 @@
+#!/bin/sh
+cd log/logdir || exit 1
+cat @* current | $PAGER
diff --git a/examples/var_service/supplicant_if/run b/examples/var_service/supplicant_if/run
new file mode 100755
index 000000000..45211e001
--- /dev/null
+++ b/examples/var_service/supplicant_if/run
@@ -0,0 +1,21 @@
+#!/bin/sh
+exec 2>&1
+exec </dev/null
+pwd="$PWD"
+if="${PWD##*/dhcp_}"
+echo "* Upping iface $if"
+ip link set dev "$if" up
+##echo "* Powersave disable on $if"
+##iw dev "$if" set power_save off
+echo "* Starting wpa_supplicant"
+exec \
+env - PATH="$PATH" \
+softlimit \
+setuidgid root \
+wpa_supplicant -i "$if" -c "$pwd/wpa_supplicant.conf" -d
diff --git a/examples/var_service/supplicant_if/w_log b/examples/var_service/supplicant_if/w_log
new file mode 100755
index 000000000..aa36ef13b
--- /dev/null
+++ b/examples/var_service/supplicant_if/w_log
@@ -0,0 +1,4 @@
+#!/bin/sh
+cd log/logdir || exit 1
+watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/supplicant_if/wpa_supplicant.conf b/examples/var_service/supplicant_if/wpa_supplicant.conf
new file mode 100644
index 000000000..e317e2ebe
--- /dev/null
+++ b/examples/var_service/supplicant_if/wpa_supplicant.conf
@@ -0,0 +1,28 @@
+# allow frontend (e.g., wpa_cli) to be used by all users in 'wheel' group
+ctrl_interface=DIR=/var/run/wpa_supplicant
+#GROUP=wheel
+# Typical minimal wifi setup:
+network={
+    ssid="--your-ESSID--"
+    key_mgmt=WPA-PSK
+    psk="--your-password--"
+}
+# Other fields:
+#    scan_ssid=1
+#    key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
+#    pairwise=CCMP TKIP
+#    group=CCMP TKIP WEP104 WEP40
+#    eap=TTLS PEAP TLS
+#    identity="user@example.com"
+#    password="foobar"
+#    ca_cert="/etc/cert/ca.pem"
+#    client_cert="/etc/cert/user.pem"
+#    private_key="/etc/cert/user.prv"
+#    private_key_passwd="password"
+#    phase1="peaplabel=0"
+#    ca_cert2="/etc/cert/ca2.pem"
+#    client_cert2="/etc/cer/user.pem"
+#    private_key2="/etc/cer/user.prv"
+#    private_key2_passwd="password"
diff --git a/findutils/grep.c b/findutils/grep.c
index 02ce65159..94bcb6002 100644
--- a/findutils/grep.c
+++ b/findutils/grep.c
@@ -255,7 +255,7 @@ typedef struct grep_list_data_t {
 #endif
 #define ALLOCATED 1
 #define COMPILED 2
-        int flg_mem_alocated_compiled;
+        int flg_mem_allocated_compiled;
 } grep_list_data_t;
 #if !ENABLE_EXTRA_COMPAT
@@ -388,8 +388,8 @@ static int grep_file(FILE *file)
 #endif
                                char *match_at;
-                                if (!(gl->flg_mem_alocated_compiled & COMPILED)) {
+                                if (!(gl->flg_mem_allocated_compiled & COMPILED)) {
-                                        gl->flg_mem_alocated_compiled |= COMPILED;
+                                        gl->flg_mem_allocated_compiled |= COMPILED;
 #if !ENABLE_EXTRA_COMPAT
                                        xregcomp(&gl->compiled_regex, gl->pattern, reflags);
 #else
@@ -627,9 +627,9 @@ static char *add_grep_list_data(char *pattern)
        grep_list_data_t *gl = xzalloc(sizeof(*gl));
        gl->pattern = pattern;
 #if ENABLE_FEATURE_CLEAN_UP
-        gl->flg_mem_alocated_compiled = flg_used_mem;
+        gl->flg_mem_allocated_compiled = flg_used_mem;
 #else
-        /*gl->flg_mem_alocated_compiled = 0;*/
+        /*gl->flg_mem_allocated_compiled = 0;*/
 #endif
        return (char *)gl;
 }
@@ -845,9 +845,9 @@ int grep_main(int argc UNUSED_PARAM, char **argv)
                        grep_list_data_t *gl = (grep_list_data_t *)pattern_head_ptr->data;
                        pattern_head = pattern_head->link;
-                        if (gl->flg_mem_alocated_compiled & ALLOCATED)
+                        if (gl->flg_mem_allocated_compiled & ALLOCATED)
                                free(gl->pattern);
-                        if (gl->flg_mem_alocated_compiled & COMPILED)
+                        if (gl->flg_mem_allocated_compiled & COMPILED)
                                regfree(&gl->compiled_regex);
                        free(gl);
                        free(pattern_head_ptr);
diff --git a/include/applets.src.h b/include/applets.src.h
index 6e1b02fc3..248d539c4 100644
--- a/include/applets.src.h
+++ b/include/applets.src.h
@@ -205,7 +205,6 @@ IF_MAKEDEVS(APPLET(makedevs, BB_DIR_SBIN, BB_SUID_DROP))
 IF_MAKEMIME(APPLET(makemime, BB_DIR_BIN, BB_SUID_DROP))
 IF_MAN(APPLET(man, BB_DIR_USR_BIN, BB_SUID_DROP))
 IF_MATCHPATHCON(APPLET(matchpathcon, BB_DIR_USR_SBIN, BB_SUID_DROP))
-IF_MD5SUM(APPLET_NOEXEC(md5sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, md5sum))
 IF_MICROCOM(APPLET(microcom, BB_DIR_USR_BIN, BB_SUID_DROP))
 IF_MKDIR(APPLET_NOFORK(mkdir, mkdir, BB_DIR_BIN, BB_SUID_DROP, mkdir))
 IF_MKFS_VFAT(APPLET_ODDNAME(mkdosfs, mkfs_vfat, BB_DIR_SBIN, BB_SUID_DROP, mkfs_vfat))
@@ -280,10 +279,6 @@ IF_SETKEYCODES(APPLET(setkeycodes, BB_DIR_USR_BIN, BB_SUID_DROP))
 IF_SETLOGCONS(APPLET(setlogcons, BB_DIR_USR_SBIN, BB_SUID_DROP))
 IF_SETSEBOOL(APPLET(setsebool, BB_DIR_USR_SBIN, BB_SUID_DROP))
 IF_SETSID(APPLET(setsid, BB_DIR_USR_BIN, BB_SUID_DROP))
-IF_SHA1SUM(APPLET_NOEXEC(sha1sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha1sum))
-IF_SHA3SUM(APPLET_NOEXEC(sha3sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha3sum))
-IF_SHA256SUM(APPLET_NOEXEC(sha256sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha256sum))
-IF_SHA512SUM(APPLET_NOEXEC(sha512sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha512sum))
 IF_SHOWKEY(APPLET(showkey, BB_DIR_USR_BIN, BB_SUID_DROP))
 IF_SLATTACH(APPLET(slattach, BB_DIR_SBIN, BB_SUID_DROP))
 /* Do not make this applet NOFORK. It breaks ^C-ing of pauses in shells: */
diff --git a/include/busybox.h b/include/busybox.h
index 737627bd0..6a003d544 100644
--- a/include/busybox.h
+++ b/include/busybox.h
@@ -19,7 +19,9 @@ extern const uint8_t applet_flags[] ALIGN1;
 extern const uint8_t applet_suid[] ALIGN1;
 extern const uint8_t applet_install_loc[] ALIGN1;
-#if ENABLE_FEATURE_PREFER_APPLETS
+#if ENABLE_FEATURE_PREFER_APPLETS \
+ || ENABLE_FEATURE_SH_STANDALONE \
+ || ENABLE_FEATURE_SH_NOFORK
 # define APPLET_IS_NOFORK(i) (applet_flags[(i)/4] & (1 << (2 * ((i)%4))))
 # define APPLET_IS_NOEXEC(i) (applet_flags[(i)/4] & (1 << ((2 * ((i)%4))+1)))
 #else
diff --git a/include/libbb.h b/include/libbb.h
index 6db03d2df..30a0e00ba 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -196,24 +196,33 @@ int klogctl(int type, char *b, int len);
 /* Busybox does not use threads, we can speed up stdio. */
 #ifdef HAVE_UNLOCKED_STDIO
 # undef  getc
-# define getc(stream) getc_unlocked(stream)
+# define getc(stream)   getc_unlocked(stream)
 # undef  getchar
-# define getchar() getchar_unlocked()
+# define getchar()      getchar_unlocked()
 # undef  putc
-# define putc(c, stream) putc_unlocked(c, stream)
+# define putc(c,stream) putc_unlocked(c,stream)
 # undef  putchar
-# define putchar(c) putchar_unlocked(c)
+# define putchar(c)     putchar_unlocked(c)
 # undef  fgetc
-# define fgetc(stream) getc_unlocked(stream)
+# define fgetc(stream)  getc_unlocked(stream)
 # undef  fputc
-# define fputc(c, stream) putc_unlocked(c, stream)
+# define fputc(c,stream) putc_unlocked(c,stream)
 #endif
 /* Above functions are required by POSIX.1-2008, below ones are extensions */
 #ifdef HAVE_UNLOCKED_LINE_OPS
 # undef  fgets
-# define fgets(s, n, stream) fgets_unlocked(s, n, stream)
+# define fgets(s,n,stream) fgets_unlocked(s,n,stream)
 # undef  fputs
-# define fputs(s, stream) fputs_unlocked(s, stream)
+# define fputs(s,stream) fputs_unlocked(s,stream)
+/* musl <= 1.1.15 does not support fflush_unlocked(NULL) */
+//# undef  fflush
+//# define fflush(stream) fflush_unlocked(stream)
+# undef  feof
+# define feof(stream)   feof_unlocked(stream)
+# undef  ferror
+# define ferror(stream) ferror_unlocked(stream)
+# undef  fileno
+# define fileno(stream) fileno_unlocked(stream)
 #endif
@@ -1755,6 +1764,7 @@ typedef struct sha512_ctx_t {
 typedef struct sha3_ctx_t {
        uint64_t state[25];
        unsigned bytes_queued;
+        unsigned input_block_bytes;
 } sha3_ctx_t;
 void md5_begin(md5_ctx_t *ctx) FAST_FUNC;
 void md5_hash(md5_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
diff --git a/init/init.c b/init/init.c
index 6eb76b80e..0813d1b5f 100644
--- a/init/init.c
+++ b/init/init.c
@@ -297,6 +297,11 @@ static void console_init(void)
        s = getenv("CONSOLE");
        if (!s)
                s = getenv("console");
+#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+        /* BSD people say their kernels do not open fd 0,1,2; they need this: */
+        if (!s)
+                s = (char*)"/dev/console";
+#endif
        if (s) {
                int fd = open(s, O_RDWR | O_NONBLOCK | O_NOCTTY);
                if (fd >= 0) {
diff --git a/libbb/appletlib.c b/libbb/appletlib.c
index 28adf2740..4aa40454f 100644
--- a/libbb/appletlib.c
+++ b/libbb/appletlib.c
@@ -930,7 +930,9 @@ void FAST_FUNC run_applet_no_and_exit(int applet_no, char **argv)
        }
        if (ENABLE_FEATURE_SUID)
                check_suid(applet_no);
-        exit(applet_main[applet_no](argc, argv));
+        xfunc_error_retval = applet_main[applet_no](argc, argv);
+        /* Note: applet_main() may also not return (die on a xfunc or such) */
+        xfunc_die();
 }
 # endif /* NUM_APPLETS > 0 */
@@ -993,6 +995,14 @@ int main(int argc UNUSED_PARAM, char **argv)
         */
        mallopt(M_MMAP_THRESHOLD, 32 * 1024 - 256);
 #endif
+#if 0 /*def M_TOP_PAD*/
+        /* When the program break is increased, then M_TOP_PAD bytes are added
+         * to the sbrk(2) request. When the heap is trimmed because of free(3),
+         * this much free space is preserved at the top of the heap.
+         * glibc default seems to be way too big: 128k, but need to verify.
+         */
+        mallopt(M_TOP_PAD, 8 * 1024);
+#endif
 #if !BB_MMU
        /* NOMMU re-exec trick sets high-order bit in first byte of name */
diff --git a/libbb/copy_file.c b/libbb/copy_file.c
index c52297376..cb6d12359 100644
--- a/libbb/copy_file.c
+++ b/libbb/copy_file.c
@@ -299,11 +299,16 @@ int FAST_FUNC copy_file(const char *source, const char *dest, int flags)
                if (!S_ISREG(source_stat.st_mode))
                        new_mode = 0666;
-                // POSIX way is a security problem versus (sym)link attacks
+                if (ENABLE_FEATURE_NON_POSIX_CP || (flags & FILEUTILS_INTERACTIVE)) {
-                if (!ENABLE_FEATURE_NON_POSIX_CP) {
+                        /*
-                        dst_fd = open(dest, O_WRONLY|O_CREAT|O_TRUNC, new_mode);
+                         * O_CREAT|O_EXCL: require that file did not exist before creation
-                } else { /* safe way: */
+                         */
                        dst_fd = open(dest, O_WRONLY|O_CREAT|O_EXCL, new_mode);
+                } else { /* POSIX, and not "cp -i" */
+                        /*
+                         * O_CREAT|O_TRUNC: create, or truncate (security problem versus (sym)link attacks)
+                         */
+                        dst_fd = open(dest, O_WRONLY|O_CREAT|O_TRUNC, new_mode);
                }
                if (dst_fd == -1) {
                        ovr = ask_and_unlink(dest, flags);
@@ -378,7 +383,7 @@ int FAST_FUNC copy_file(const char *source, const char *dest, int flags)
                }
                /* _Not_ jumping to preserve_mode_ugid_time:
                 * symlinks don't have those */
-                return 0;
+                goto verb_and_exit;
        }
        if (S_ISBLK(source_stat.st_mode) || S_ISCHR(source_stat.st_mode)
         || S_ISSOCK(source_stat.st_mode) || S_ISFIFO(source_stat.st_mode)
@@ -413,6 +418,7 @@ int FAST_FUNC copy_file(const char *source, const char *dest, int flags)
                        bb_perror_msg("can't preserve %s of '%s'", "permissions", dest);
        }
+ verb_and_exit:
        if (flags & FILEUTILS_VERBOSE) {
                printf("'%s' -> '%s'\n", source, dest);
        }
diff --git a/libbb/dump.c b/libbb/dump.c
index 566881a78..154be5d80 100644
--- a/libbb/dump.c
+++ b/libbb/dump.c
@@ -157,7 +157,7 @@ static NOINLINE void rewrite(priv_dumper_t *dumper, FS *fs)
                        /*
                         * figure out the byte count for each conversion;
                         * rewrite the format as necessary, set up blank-
-                         * pbb_dump_adding for end of data.
+                         * padding for end of data.
                         */
                        if (*p1 == 'c') {
                                pr->flags = F_CHAR;
@@ -466,14 +466,14 @@ static void bpad(PR *pr)
 }
 static const char conv_str[] ALIGN1 =
-        "\0\\0\0"
+        "\0"  "\\""0""\0"
-        "\007\\a\0"  /* \a */
+        "\007""\\""a""\0"  /* \a */
-        "\b\\b\0"
+        "\b"  "\\""b""\0"
-        "\f\\b\0"
+        "\f"  "\\""f""\0"
-        "\n\\n\0"
+        "\n"  "\\""n""\0"
-        "\r\\r\0"
+        "\r"  "\\""r""\0"
-        "\t\\t\0"
+        "\t"  "\\""t""\0"
-        "\v\\v\0"
+        "\v"  "\\""v""\0"
        ;
@@ -485,7 +485,7 @@ static void conv_c(PR *pr, unsigned char *p)
        do {
                if (*p == *str) {
                        ++str;
-                        goto strpr;
+                        goto strpr; /* map e.g. '\n' to "\\n" */
                }
                str += 4;
        } while (*str);
@@ -702,8 +702,6 @@ int FAST_FUNC bb_dump_dump(dumper_t *pub_dumper, char **argv)
 void FAST_FUNC bb_dump_add(dumper_t* pub_dumper, const char *fmt)
 {
        const char *p;
-        char *p1;
-        char *p2;
        FS *tfs;
        FU *tfu, **nextfupp;
        const char *savep;
@@ -779,29 +777,42 @@ void FAST_FUNC bb_dump_add(dumper_t* pub_dumper, const char *fmt)
                        }
                }
                tfu->fmt = xstrndup(savep, p - savep);
-/*      escape(tfu->fmt); */
-                p1 = tfu->fmt;
                /* alphabetic escape sequences have to be done in place */
+                strcpy_and_process_escape_sequences(tfu->fmt, tfu->fmt);
+                /* unknown mappings are not changed: "\z" -> '\\' 'z' */
+                /* trailing backslash, if any, is preserved */
+#if 0
+                char *p1;
+                char *p2;
+                p1 = tfu->fmt;
                for (p2 = p1;; ++p1, ++p2) {
-                        if (*p1 == '\0') {
+                        *p2 = *p1;
-                                *p2 = *p1;
+                        if (*p1 == '\0')
                                break;
-                        }
                        if (*p1 == '\\') {
-                                const char *cs = conv_str + 4;
+                                const char *cs;
-                                ++p1;
+                                p1++;
                                *p2 = *p1;
+                                if (*p1 == '\0') {
+                                        /* "...\" trailing backslash. Eaten. */
+                                        break;
+                                }
+                                cs = conv_str + 4; /* skip NUL element */
                                do {
+                                        /* map e.g. "\n" -> '\n' */
                                        if (*p1 == cs[2]) {
                                                *p2 = cs[0];
                                                break;
                                        }
                                        cs += 4;
                                } while (*cs);
+                                /* unknown mappings remove bkslash: "\z" -> 'z' */
                        }
                }
+#endif
                p++;
        }
diff --git a/libbb/hash_md5_sha.c b/libbb/hash_md5_sha.c
index d08c6b2f7..7e7d8da2f 100644
--- a/libbb/hash_md5_sha.c
+++ b/libbb/hash_md5_sha.c
@@ -941,10 +941,6 @@ void FAST_FUNC sha512_end(sha512_ctx_t *ctx, void *resbuf)
 # define OPTIMIZE_SHA3_FOR_32 1
 #endif
-enum {
-        SHA3_IBLK_BYTES = 72, /* 576 bits / 8 */
-};
 #if OPTIMIZE_SHA3_FOR_32
 /* This splits every 64-bit word into a pair of 32-bit words,
 * even bits go into first word, odd bits go to second one.
@@ -1352,6 +1348,8 @@ static void sha3_process_block72(uint64_t *state)
 void FAST_FUNC sha3_begin(sha3_ctx_t *ctx)
 {
        memset(ctx, 0, sizeof(*ctx));
+        /* SHA3-512, user can override */
+        ctx->input_block_bytes = (1600 - 512*2) / 8; /* 72 bytes */
 }
 void FAST_FUNC sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len)
@@ -1361,7 +1359,7 @@ void FAST_FUNC sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len)
        unsigned bufpos = ctx->bytes_queued;
        while (1) {
-                unsigned remaining = SHA3_IBLK_BYTES - bufpos;
+                unsigned remaining = ctx->input_block_bytes - bufpos;
                if (remaining > len)
                        remaining = len;
                len -= remaining;
@@ -1373,38 +1371,41 @@ void FAST_FUNC sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len)
                        remaining--;
                }
                /* Clever way to do "if (bufpos != N) break; ... ; bufpos = 0;" */
-                bufpos -= SHA3_IBLK_BYTES;
+                bufpos -= ctx->input_block_bytes;
                if (bufpos != 0)
                        break;
                /* Buffer is filled up, process it */
                sha3_process_block72(ctx->state);
                /*bufpos = 0; - already is */
        }
-        ctx->bytes_queued = bufpos + SHA3_IBLK_BYTES;
+        ctx->bytes_queued = bufpos + ctx->input_block_bytes;
 #else
        /* +50 bytes code size, but a bit faster because of long-sized XORs */
        const uint8_t *data = buffer;
        unsigned bufpos = ctx->bytes_queued;
+        unsigned iblk_bytes = ctx->input_block_bytes;
        /* If already data in queue, continue queuing first */
-        while (len != 0 && bufpos != 0) {
+        if (bufpos != 0) {
-                uint8_t *buf = (uint8_t*)ctx->state;
+                while (len != 0) {
-                buf[bufpos] ^= *data++;
+                        uint8_t *buf = (uint8_t*)ctx->state;
-                len--;
+                        buf[bufpos] ^= *data++;
-                bufpos++;
+                        len--;
-                if (bufpos == SHA3_IBLK_BYTES) {
+                        bufpos++;
-                        bufpos = 0;
+                        if (bufpos == iblk_bytes) {
-                        goto do_block;
+                                bufpos = 0;
+                                goto do_block;
+                        }
                }
        }
        /* Absorb complete blocks */
-        while (len >= SHA3_IBLK_BYTES) {
+        while (len >= iblk_bytes) {
                /* XOR data onto beginning of state[].
                 * We try to be efficient - operate one word at a time, not byte.
                 * Careful wrt unaligned access: can't just use "*(long*)data"!
                 */
-                unsigned count = SHA3_IBLK_BYTES / sizeof(long);
+                unsigned count = iblk_bytes / sizeof(long);
                long *buf = (long*)ctx->state;
                do {
                        long v;
@@ -1412,7 +1413,7 @@ void FAST_FUNC sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len)
                        *buf++ ^= v;
                        data += sizeof(long);
                } while (--count);
-                len -= SHA3_IBLK_BYTES;
+                len -= iblk_bytes;
 do_block:
                sha3_process_block72(ctx->state);
        }
@@ -1433,8 +1434,22 @@ void FAST_FUNC sha3_end(sha3_ctx_t *ctx, void *resbuf)
 {
        /* Padding */
        uint8_t *buf = (uint8_t*)ctx->state;
-        buf[ctx->bytes_queued]   ^= 1;
+        /*
-        buf[SHA3_IBLK_BYTES - 1] ^= 0x80;
+         * Keccak block padding is: add 1 bit after last bit of input,
+         * then add zero bits until the end of block, and add the last 1 bit
+         * (the last bit in the block) - the "10*1" pattern.
+         * SHA3 standard appends additional two bits, 01,  before that padding:
+         *
+         * SHA3-224(M) = KECCAK[448](M||01, 224)
+         * SHA3-256(M) = KECCAK[512](M||01, 256)
+         * SHA3-384(M) = KECCAK[768](M||01, 384)
+         * SHA3-512(M) = KECCAK[1024](M||01, 512)
+         * (M is the input, || is bit concatenation)
+         *
+         * The 6 below contains 01 "SHA3" bits and the first 1 "Keccak" bit:
+         */
+        buf[ctx->bytes_queued]          ^= 6; /* bit pattern 00000110 */
+        buf[ctx->input_block_bytes - 1] ^= 0x80;
        sha3_process_block72(ctx->state);
diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index 2566abd38..34eb16e6b 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -81,7 +81,9 @@
 # define CHAR_T wchar_t
 static bool BB_isspace(CHAR_T c) { return ((unsigned)c < 256 && isspace(c)); }
 # if ENABLE_FEATURE_EDITING_VI
-static bool BB_isalnum(CHAR_T c) { return ((unsigned)c < 256 && isalnum(c)); }
+static bool BB_isalnum_or_underscore(CHAR_T c) {
+        return ((unsigned)c < 256 && isalnum(c)) || c == '_';
+}
 # endif
 static bool BB_ispunct(CHAR_T c) { return ((unsigned)c < 256 && ispunct(c)); }
 # undef isspace
@@ -96,7 +98,11 @@ static bool BB_ispunct(CHAR_T c) { return ((unsigned)c < 256 && ispunct(c)); }
 # define BB_NUL '\0'
 # define CHAR_T char
 # define BB_isspace(c) isspace(c)
-# define BB_isalnum(c) isalnum(c)
+# if ENABLE_FEATURE_EDITING_VI
+static bool BB_isalnum_or_underscore(CHAR_T c) {
+        return ((unsigned)c < 256 && isalnum(c)) || c == '_';
+}
+# endif
 # define BB_ispunct(c) ispunct(c)
 #endif
 #if ENABLE_UNICODE_PRESERVE_BROKEN
@@ -1647,9 +1653,9 @@ vi_word_motion(int eat)
 {
        CHAR_T *command = command_ps;
-        if (BB_isalnum(command[cursor]) || command[cursor] == '_') {
+        if (BB_isalnum_or_underscore(command[cursor])) {
                while (cursor < command_len
-                 && (BB_isalnum(command[cursor+1]) || command[cursor+1] == '_')
+                 && (BB_isalnum_or_underscore(command[cursor+1]))
                ) {
                        input_forward();
                }
@@ -1691,9 +1697,9 @@ vi_end_motion(void)
                input_forward();
        if (cursor >= command_len-1)
                return;
-        if (BB_isalnum(command[cursor]) || command[cursor] == '_') {
+        if (BB_isalnum_or_underscore(command[cursor])) {
                while (cursor < command_len-1
-                 && (BB_isalnum(command[cursor+1]) || command[cursor+1] == '_')
+                 && (BB_isalnum_or_underscore(command[cursor+1]))
                ) {
                        input_forward();
                }
@@ -1726,9 +1732,9 @@ vi_back_motion(void)
                input_backward(1);
        if (cursor <= 0)
                return;
-        if (BB_isalnum(command[cursor]) || command[cursor] == '_') {
+        if (BB_isalnum_or_underscore(command[cursor])) {
                while (cursor > 0
-                 && (BB_isalnum(command[cursor-1]) || command[cursor-1] == '_')
+                 && (BB_isalnum_or_underscore(command[cursor-1]))
                ) {
                        input_backward(1);
                }
diff --git a/libbb/login.c b/libbb/login.c
index 8f080b775..5a7acfcf0 100644
--- a/libbb/login.c
+++ b/libbb/login.c
@@ -45,6 +45,45 @@ void FAST_FUNC print_login_issue(const char *issue_file, const char *tty)
                if (c == '\\' || c == '%') {
                        c = fgetc(fp);
                        switch (c) {
+//From getty manpage (* - supported by us)
+//========================================
+//4 or 4{interface}
+//  Insert the IPv4 address of the network interface (example: \4{eth0}).
+//  If the interface argument is not specified, then select the first
+//  fully configured (UP, non-LOOPBACK, RUNNING) interface.
+//6 or 6{interface} -- The same as \4 but for IPv6.
+//b -- Insert the baudrate of the current line.
+//*d -- Insert the current date.
+//*t -- Insert the current time.
+//e or e{name}
+//  Translate the human-readable name to an escape sequence and insert it
+//  (for example: \e{red}Alert text.\e{reset}).  If the name argument
+//  is not specified, then insert \033. The currently supported names are:
+//  black, blink, blue, bold, brown, cyan, darkgray, gray, green, halfbright,
+//  lightblue, lightcyan, lightgray, lightgreen, lightmagenta, lightred,
+//  magenta, red, reset, reverse, and yellow. Unknown names are ignored.
+//*s
+//  Insert the system name (the name of the operating system - `uname -s`)
+//*S or S{VARIABLE}
+//  Insert the VARIABLE data from /etc/os-release.
+//  If the VARIABLE argument is not specified, use PRETTY_NAME.
+//  If PRETTY_NAME is not in /etc/os-release, \S is the same as \s.
+//*l -- Insert the name of the current tty line.
+//*m -- Insert the architecture identifier of the machine: `uname -m`.
+//*n -- Insert the nodename of the machine: `uname -n`.
+//*o -- Insert the NIS domainname of the machine.  Same as `hostname -d'.
+//*O -- Insert the DNS domainname of the machine.
+//*r -- Insert the release number of the OS: `uname -r`.
+//u -- Insert the number of current users logged in.
+//U -- Insert the string "1 user" or "N users" (current users logged in).
+//*v -- Insert the version of the OS, e.g. the build-date etc: `uname -v`.
+//We also implement:
+//*D -- same as \O "DNS domainname"
+//*h -- same as \n "nodename"
+                        case 'S':
+                                /* minimal implementation, not reading /etc/os-release */
+                                /*FALLTHROUGH*/
                        case 's':
                                outbuf = uts.sysname;
                                break;
@@ -65,6 +104,7 @@ void FAST_FUNC print_login_issue(const char *issue_file, const char *tty)
 #if defined(__linux__)
                        case 'D':
                        case 'o':
+                        case 'O':
                                outbuf = uts.domainname;
                                break;
 #endif
diff --git a/libbb/speed_table.c b/libbb/speed_table.c
index 174d531b2..11ced01d0 100644
--- a/libbb/speed_table.c
+++ b/libbb/speed_table.c
@@ -10,7 +10,16 @@
 #include "libbb.h"
 struct speed_map {
-#if defined __FreeBSD__
+#if defined __FreeBSD__ \
+ || (defined B115200  && B115200  > 0xffff) \
+ || (defined B230400  && B230400  > 0xffff) \
+ || (defined B460800  && B460800  > 0xffff) \
+ || (defined B921600  && B921600  > 0xffff) \
+ || (defined B1152000 && B1152000 > 0xffff) \
+ || (defined B1000000 && B1000000 > 0xffff) \
+ || (defined B2000000 && B2000000 > 0xffff) \
+ || (defined B3000000 && B3000000 > 0xffff) \
+ || (defined B4000000 && B4000000 > 0xffff)
        /* On FreeBSD, B<num> constants don't fit into a short */
        unsigned speed;
 #else
@@ -19,6 +28,7 @@ struct speed_map {
        unsigned short value;
 };
+/* On Linux, Bxx constants are 0..15 (up to B38400) and 0x1001..0x100f */
 static const struct speed_map speeds[] = {
        {B0, 0},
        {B50, 50},
@@ -37,30 +47,79 @@ static const struct speed_map speeds[] = {
 #ifdef B19200
        {B19200, 19200},
 #elif defined(EXTA)
-        {EXTA, 19200},
+        {EXTA,   19200},
 #endif
+/* 19200 = 0x4b00 */
+/* 38400 = 0x9600, this value would use bit#15 if not "/200" encoded: */
 #ifdef B38400
-        {B38400, 38400/256 + 0x8000U},
+        {B38400, 38400/200 + 0x8000u},
 #elif defined(EXTB)
-        {EXTB, 38400/256 + 0x8000U},
+        {EXTB,   38400/200 + 0x8000u},
 #endif
 #ifdef B57600
-        {B57600, 57600/256 + 0x8000U},
+        {B57600, 57600/200 + 0x8000u},
 #endif
 #ifdef B115200
-        {B115200, 115200/256 + 0x8000U},
+        {B115200, 115200/200 + 0x8000u},
 #endif
 #ifdef B230400
-        {B230400, 230400/256 + 0x8000U},
+        {B230400, 230400/200 + 0x8000u},
 #endif
 #ifdef B460800
-        {B460800, 460800/256 + 0x8000U},
+        {B460800, 460800/200 + 0x8000u},
+#endif
+#ifdef B576000
+        {B576000, 576000/200 + 0x8000u},
 #endif
 #ifdef B921600
-        {B921600, 921600/256 + 0x8000U},
+        {B921600, 921600/200 + 0x8000u},
+#endif
+#ifdef B1152000
+        {B1152000, 1152000/200 + 0x8000u},
+#endif
+#ifdef B500000
+        {B500000,   500000/200 + 0x8000u},
+#endif
+#ifdef B1000000
+        {B1000000, 1000000/200 + 0x8000u},
+#endif
+#ifdef B1500000
+        {B1500000, 1500000/200 + 0x8000u},
+#endif
+#ifdef B2000000
+        {B2000000, 2000000/200 + 0x8000u},
+#endif
+#ifdef B2500000
+        {B2500000, 2500000/200 + 0x8000u},
 #endif
+#ifdef B3000000
+        {B3000000, 3000000/200 + 0x8000u},
+#endif
+#ifdef B3500000
+        {B3500000, 3500000/200 + 0x8000u},
+#endif
+#ifdef B4000000
+        {B4000000, 4000000/200 + 0x8000u},
+#endif
+/* 4000000/200 = 0x4e20, bit#15 still does not interfere with the value */
+/* (can use /800 if higher speeds would appear, /1600 won't work for B500000) */
 };
+/*
+ * TODO: maybe we can just bite the bullet, ditch the table and use termios2
+ * Linux API (supports arbitrary baud rates, no Bxxxx mess needed)? Example:
+ *
+ * #include <asm/termios.h>
+ * #include <asm/ioctls.h>
+ * struct termios2 t;
+ * ioctl(fd, TCGETS2, &t);
+ * t.c_ospeed = t.c_ispeed = 543210;
+ * t.c_cflag &= ~CBAUD;
+ * t.c_cflag |= BOTHER;
+ * ioctl(fd, TCSETS2, &t);
+ */
 enum { NUM_SPEEDS = ARRAY_SIZE(speeds) };
 unsigned FAST_FUNC tty_baud_to_value(speed_t speed)
@@ -69,8 +128,8 @@ unsigned FAST_FUNC tty_baud_to_value(speed_t speed)
        do {
                if (speed == speeds[i].speed) {
-                        if (speeds[i].value & 0x8000U) {
+                        if (speeds[i].value & 0x8000u) {
-                                return ((unsigned long) (speeds[i].value) & 0x7fffU) * 256;
+                                return ((unsigned)(speeds[i].value) & 0x7fffU) * 200;
                        }
                        return speeds[i].value;
                }
diff --git a/libbb/udp_io.c b/libbb/udp_io.c
index a32af9bd2..6e3ef484e 100644
--- a/libbb/udp_io.c
+++ b/libbb/udp_io.c
@@ -70,7 +70,13 @@ send_to_from(int fd, void *buf, size_t len, int flags,
        msg.msg_flags = flags;
        cmsgptr = CMSG_FIRSTHDR(&msg);
-        if (to->sa_family == AF_INET && from->sa_family == AF_INET) {
+        /*
+         * Users report that to->sa_family can be AF_INET6 too,
+         * if "to" was acquired by recv_from_to(). IOW: recv_from_to()
+         * was seen showing IPv6 "from" even when the destination
+         * of received packet (our local address) was IPv4.
+         */
+        if (/* to->sa_family == AF_INET && */ from->sa_family == AF_INET) {
                struct in_pktinfo *pktptr;
                cmsgptr->cmsg_level = IPPROTO_IP;
                cmsgptr->cmsg_type = IP_PKTINFO;
@@ -86,7 +92,7 @@ send_to_from(int fd, void *buf, size_t len, int flags,
                pktptr->ipi_spec_dst = ((struct sockaddr_in*)from)->sin_addr;
        }
 # if ENABLE_FEATURE_IPV6 && defined(IPV6_PKTINFO)
-        else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) {
+        else if (/* to->sa_family == AF_INET6 && */ from->sa_family == AF_INET6) {
                struct in6_pktinfo *pktptr;
                cmsgptr->cmsg_level = IPPROTO_IPV6;
                cmsgptr->cmsg_type = IPV6_PKTINFO;
diff --git a/libbb/vfork_daemon_rexec.c b/libbb/vfork_daemon_rexec.c
index f488f8e0c..766a89e5f 100644
--- a/libbb/vfork_daemon_rexec.c
+++ b/libbb/vfork_daemon_rexec.c
@@ -70,7 +70,8 @@ pid_t FAST_FUNC xspawn(char **argv)
        return pid;
 }
-#if ENABLE_FEATURE_PREFER_APPLETS
+#if ENABLE_FEATURE_PREFER_APPLETS \
+ || ENABLE_FEATURE_SH_NOFORK
 static jmp_buf die_jmp;
 static void jump(void)
 {
@@ -176,7 +177,7 @@ int FAST_FUNC run_nofork_applet(int applet_no, char **argv)
        return rc & 0xff; /* don't confuse people with "exitcodes" >255 */
 }
-#endif /* FEATURE_PREFER_APPLETS */
+#endif /* FEATURE_PREFER_APPLETS || FEATURE_SH_NOFORK */
 int FAST_FUNC spawn_and_wait(char **argv)
 {
diff --git a/libbb/xconnect.c b/libbb/xconnect.c
index c318af419..ee54898e3 100644
--- a/libbb/xconnect.c
+++ b/libbb/xconnect.c
@@ -500,12 +500,15 @@ char* FAST_FUNC xmalloc_sockaddr2hostonly_noport(const struct sockaddr *sa)
 {
        return sockaddr2str(sa, NI_NAMEREQD | IGNORE_PORT);
 }
+#ifndef NI_NUMERICSCOPE
+# define NI_NUMERICSCOPE 0
+#endif
 char* FAST_FUNC xmalloc_sockaddr2dotted(const struct sockaddr *sa)
 {
-        return sockaddr2str(sa, NI_NUMERICHOST);
+        return sockaddr2str(sa, NI_NUMERICHOST | NI_NUMERICSCOPE);
 }
 char* FAST_FUNC xmalloc_sockaddr2dotted_noport(const struct sockaddr *sa)
 {
-        return sockaddr2str(sa, NI_NUMERICHOST | IGNORE_PORT);
+        return sockaddr2str(sa, NI_NUMERICHOST | NI_NUMERICSCOPE | IGNORE_PORT);
 }
diff --git a/libbb/xfuncs_printf.c b/libbb/xfuncs_printf.c
index e9222f690..1b11caf6b 100644
--- a/libbb/xfuncs_printf.c
+++ b/libbb/xfuncs_printf.c
@@ -235,8 +235,16 @@ void FAST_FUNC xwrite(int fd, const void *buf, size_t count)
 {
        if (count) {
                ssize_t size = full_write(fd, buf, count);
-                if ((size_t)size != count)
+                if ((size_t)size != count) {
-                        bb_error_msg_and_die("short write");
+                        /*
+                         * Two cases: write error immediately;
+                         * or some writes succeeded, then we hit an error.
+                         * In either case, errno is set.
+                         */
+                        bb_perror_msg_and_die(
+                                size >= 0 ? "short write" : "write error"
+                        );
+                }
        }
 }
 void FAST_FUNC xwrite_str(int fd, const char *str)
diff --git a/mailutils/sendmail.c b/mailutils/sendmail.c
index fb4dbb3da..1242795b8 100644
--- a/mailutils/sendmail.c
+++ b/mailutils/sendmail.c
@@ -10,7 +10,8 @@
 //kbuild:lib-$(CONFIG_SENDMAIL) += sendmail.o mail.o
 //usage:#define sendmail_trivial_usage
-//usage:       "[OPTIONS] [RECIPIENT_EMAIL]..."
+//usage:       "[-tv] [-f SENDER] [-amLOGIN 4<user_pass.txt | -auUSER -apPASS]"
+//usage:     "\n                [-w SECS] [-H 'PROG ARGS' | -S HOST] [RECIPIENT_EMAIL]..."
 //usage:#define sendmail_full_usage "\n\n"
 //usage:       "Read email from stdin and send it\n"
 //usage:     "\nStandard options:"
@@ -18,27 +19,25 @@
 //usage:     "\n        -f SENDER       For use in MAIL FROM:<sender>. Can be empty string"
 //usage:     "\n                        Default: -auUSER, or username of current UID"
 //usage:     "\n        -o OPTIONS      Various options. -oi implied, others are ignored"
-//usage:     "\n        -i              -oi synonym. implied and ignored"
+//usage:     "\n        -i              -oi synonym, implied and ignored"
 //usage:     "\n"
 //usage:     "\nBusybox specific options:"
 //usage:     "\n        -v              Verbose"
 //usage:     "\n        -w SECS         Network timeout"
-//usage:     "\n        -H 'PROG ARGS'  Run connection helper"
+//usage:     "\n        -H 'PROG ARGS'  Run connection helper. Examples:"
-//usage:     "\n                        Examples:"
+//usage:     "\n                openssl s_client -quiet -tls1 -starttls smtp -connect smtp.gmail.com:25"
-//usage:     "\n                        -H 'exec openssl s_client -quiet -tls1 -starttls smtp"
+//usage:     "\n                openssl s_client -quiet -tls1 -connect smtp.gmail.com:465"
-//usage:     "\n                                -connect smtp.gmail.com:25' <email.txt"
+//usage:     "\n                        $SMTP_ANTISPAM_DELAY: seconds to wait after helper connect"
-//usage:     "\n                                [4<username_and_passwd.txt | -auUSER -apPASS]"
+//usage:     "\n        -S HOST[:PORT]  Server (default $SMTPHOST or 127.0.0.1)"
-//usage:     "\n                        -H 'exec openssl s_client -quiet -tls1"
+//usage:     "\n        -amLOGIN        Log in using AUTH LOGIN (-amCRAM-MD5 not supported)"
-//usage:     "\n                                -connect smtp.gmail.com:465' <email.txt"
+//usage:     "\n        -auUSER         Username for AUTH"
-//usage:     "\n                                [4<username_and_passwd.txt | -auUSER -apPASS]"
+//usage:     "\n        -apPASS         Password for AUTH"
-//usage:     "\n        -S HOST[:PORT]  Server"
-//usage:     "\n        -auUSER         Username for AUTH LOGIN"
-//usage:     "\n        -apPASS         Password for AUTH LOGIN"
-////usage:     "\n      -amMETHOD       Authentication method. Ignored. LOGIN is implied"
 //usage:     "\n"
-//usage:     "\nOther options are silently ignored; -oi -t is implied"
+//usage:     "\nIf no -a options are given, authentication is not done."
+//usage:     "\nIf -amLOGIN is given but no -au/-ap, user/password is read from fd #4."
+//usage:     "\nOther options are silently ignored; -oi is implied."
 //usage:        IF_MAKEMIME(
-//usage:     "\nUse makemime to create emails with attachments"
+//usage:     "\nUse makemime to create emails with attachments."
 //usage:        )
 /* Currently we don't sanitize or escape user-supplied SENDER and RECIPIENT_EMAILs.
@@ -209,7 +208,7 @@ static void rcptto_list(const char *list)
 int sendmail_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int sendmail_main(int argc UNUSED_PARAM, char **argv)
 {
-        char *opt_connect = opt_connect;
+        char *opt_connect;
        char *opt_from = NULL;
        char *s;
        llist_t *list = NULL;
@@ -241,6 +240,11 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv)
        // init global variables
        INIT_G();
+        // default HOST[:PORT] is $SMTPHOST, or localhost
+        opt_connect = getenv("SMTPHOST");
+        if (!opt_connect)
+                opt_connect = (char *)"127.0.0.1";
        // save initial stdin since body is piped!
        xdup2(STDIN_FILENO, 3);
        G.fp0 = xfdopen_for_read(3);
@@ -276,6 +280,7 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv)
        // connection helper ordered? ->
        if (opts & OPT_H) {
+                const char *delay;
                const char *args[] = { "sh", "-c", opt_connect, NULL };
                // plug it in
                launch_helper(args);
@@ -294,7 +299,12 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv)
                // before 220 reached it. The code below is unsafe in this regard:
                // in non-STARTTLSed case, we potentially send NOOP before 220
                // is sent by server.
-                // Ideas? (--delay SECS opt? --assume-starttls-helper opt?)
+                //
+                // If $SMTP_ANTISPAM_DELAY is set, we pause before sending NOOP.
+                //
+                delay = getenv("SMTP_ANTISPAM_DELAY");
+                if (delay)
+                        sleep(atoi(delay));
                code = smtp_check("NOOP", -1);
                if (code == 220)
                        // we got 220 - this is not STARTTLSed connection,
@@ -306,14 +316,6 @@ int sendmail_main(int argc UNUSED_PARAM, char **argv)
        } else {
                // vanilla connection
                int fd;
-                // host[:port] not explicitly specified? -> use $SMTPHOST
-                // no $SMTPHOST? -> use localhost
-                if (!(opts & OPT_S)) {
-                        opt_connect = getenv("SMTPHOST");
-                        if (!opt_connect)
-                                opt_connect = (char *)"127.0.0.1";
-                }
-                // do connect
                fd = create_and_connect_stream_or_die(opt_connect, 25);
                // and make ourselves a simple IO filter
                xmove_fd(fd, STDIN_FILENO);
diff --git a/miscutils/less.c b/miscutils/less.c
index f9f6f62d9..8ba687872 100644
--- a/miscutils/less.c
+++ b/miscutils/less.c
@@ -173,6 +173,7 @@ enum { pattern_valid = 0 };
 struct globals {
        int cur_fline; /* signed */
        int kbd_fd;  /* fd to get input from */
+        int kbd_fd_orig_flags;
        int less_gets_pos;
 /* last position in last line, taking into account tabs */
        size_t last_line_pos;
@@ -308,6 +309,8 @@ static void print_statusline(const char *str)
 static void less_exit(int code)
 {
        set_tty_cooked();
+        if (!(G.kbd_fd_orig_flags & O_NONBLOCK))
+                ndelay_off(kbd_fd);
        clear_line();
        if (code < 0)
                kill_myself_with_sig(- code); /* does not return */
@@ -1661,16 +1664,23 @@ static char opp_bracket(char bracket)
 static void match_right_bracket(char bracket)
 {
-        unsigned i;
+        unsigned i = cur_fline;
-        if (strchr(flines[cur_fline], bracket) == NULL) {
+        if (i >= max_fline
+         || strchr(flines[i], bracket) == NULL
+        ) {
                print_statusline("No bracket in top line");
                return;
        }
        bracket = opp_bracket(bracket);
-        for (i = cur_fline + 1; i < max_fline; i++) {
+        for (; i < max_fline; i++) {
                if (strchr(flines[i], bracket) != NULL) {
-                        buffer_line(i);
+                        /*
+                         * Line with matched right bracket becomes
+                         * last visible line
+                         */
+                        buffer_line(i - max_displayed_line);
                        return;
                }
        }
@@ -1679,16 +1689,22 @@ static void match_right_bracket(char bracket)
 static void match_left_bracket(char bracket)
 {
-        int i;
+        int i = cur_fline + max_displayed_line;
-        if (strchr(flines[cur_fline + max_displayed_line], bracket) == NULL) {
+        if (i >= max_fline
+         || strchr(flines[i], bracket) == NULL
+        ) {
                print_statusline("No bracket in bottom line");
                return;
        }
        bracket = opp_bracket(bracket);
-        for (i = cur_fline + max_displayed_line; i >= 0; i--) {
+        for (; i >= 0; i--) {
                if (strchr(flines[i], bracket) != NULL) {
+                        /*
+                         * Line with matched left bracket becomes
+                         * first visible line
+                         */
                        buffer_line(i);
                        return;
                }
@@ -1859,9 +1875,10 @@ int less_main(int argc, char **argv)
        /* Some versions of less can survive w/o controlling tty,
         * try to do the same. This also allows to specify an alternative
         * tty via "less 1<>TTY".
-         * We don't try to use STDOUT_FILENO directly,
+         *
+         * We prefer not to use STDOUT_FILENO directly,
         * since we want to set this fd to non-blocking mode,
-         * and not bother with restoring it on exit.
+         * and not interfere with other processes which share stdout with us.
         */
        tty_name = xmalloc_ttyname(STDOUT_FILENO);
        if (tty_name) {
@@ -1873,10 +1890,12 @@ int less_main(int argc, char **argv)
                /* Try controlling tty */
 try_ctty:
                tty_fd = open(CURRENT_TTY, O_RDONLY);
-                if (tty_fd < 0)
+                if (tty_fd < 0) {
-                        return bb_cat(argv);
+                        /* If all else fails, less 481 uses stdout. Mimic that */
+                        tty_fd = STDOUT_FILENO;
+                }
        }
-        ndelay_on(tty_fd);
+        G.kbd_fd_orig_flags = ndelay_on(tty_fd);
        kbd_fd = tty_fd; /* save in a global */
 #else
        kbd_fd = 0;
diff --git a/miscutils/man.c b/miscutils/man.c
index 4ce40b247..6d32890d1 100644
--- a/miscutils/man.c
+++ b/miscutils/man.c
@@ -232,8 +232,8 @@ int man_main(int argc UNUSED_PARAM, char **argv)
                if (!token[1])
                        continue;
                if (strcmp("DEFINE", token[0]) == 0) {
-                        if (is_prefixed_with("pager", token[1])) {
+                        if (is_prefixed_with(token[1], "pager")) {
-                                pager = xstrdup(skip_whitespace(token[1]) + 5);
+                                pager = xstrdup(skip_whitespace(token[1] + 5));
                        }
                } else
                if (strcmp("MANDATORY_MANPATH"+10, token[0]) == 0 /* "MANPATH"? */
diff --git a/modutils/modprobe-small.c b/modutils/modprobe-small.c
index 5936e48cf..a47e52234 100644
--- a/modutils/modprobe-small.c
+++ b/modutils/modprobe-small.c
@@ -18,9 +18,13 @@
 /* After libbb.h, since it needs sys/types.h on some systems */
 #include <sys/utsname.h> /* uname() */
 #include <fnmatch.h>
+#include <sys/syscall.h>
 extern int init_module(void *module, unsigned long len, const char *options);
 extern int delete_module(const char *module, unsigned flags);
+#ifdef __NR_finit_module
+# define finit_module(fd, uargs, flags) syscall(__NR_finit_module, fd, uargs, flags)
+#endif
 /* linux/include/linux/module.h has limit of 64 chars on module names */
 #undef MODULE_NAME_LEN
 #define MODULE_NAME_LEN 64
@@ -209,11 +213,34 @@ static int load_module(const char *fname, const char *options)
        int r;
        size_t len = MAXINT(ssize_t);
        char *module_image;
+        if (!options)
+                options = "";
        dbg1_error_msg("load_module('%s','%s')", fname, options);
-        module_image = xmalloc_open_zipped_read_close(fname, &len);
+        /*
-        r = (!module_image || init_module(module_image, len, options ? options : "") != 0);
+         * First we try finit_module if available.  Some kernels are configured
-        free(module_image);
+         * to only allow loading of modules off of secure storage (like a read-
+         * only rootfs) which needs the finit_module call.  If it fails, we fall
+         * back to normal module loading to support compressed modules.
+         */
+        r = 1;
+# ifdef __NR_finit_module
+        {
+                int fd = open(fname, O_RDONLY | O_CLOEXEC);
+                if (fd >= 0) {
+                        r = finit_module(fd, options, 0) != 0;
+                        close(fd);
+                }
+        }
+# endif
+        if (r != 0) {
+                module_image = xmalloc_open_zipped_read_close(fname, &len);
+                r = (!module_image || init_module(module_image, len, options) != 0);
+                free(module_image);
+        }
        dbg1_error_msg("load_module:%d", r);
        return r; /* 0 = success */
 #else
diff --git a/modutils/modutils.c b/modutils/modutils.c
index 0a056731d..d36caaf68 100644
--- a/modutils/modutils.c
+++ b/modutils/modutils.c
@@ -13,6 +13,9 @@ extern int delete_module(const char *module, unsigned int flags);
 #else
 # include <sys/syscall.h>
 # define init_module(mod, len, opts) syscall(__NR_init_module, mod, len, opts)
+# if defined(__NR_finit_module)
+#  define finit_module(fd, uargs, flags) syscall(__NR_finit_module, fd, uargs, flags)
+# endif
 # define delete_module(mod, flags) syscall(__NR_delete_module, mod, flags)
 #endif
@@ -212,6 +215,24 @@ int FAST_FUNC bb_init_module(const char *filename, const char *options)
                return bb_init_module_24(filename, options);
 #endif
+        /*
+         * First we try finit_module if available.  Some kernels are configured
+         * to only allow loading of modules off of secure storage (like a read-
+         * only rootfs) which needs the finit_module call.  If it fails, we fall
+         * back to normal module loading to support compressed modules.
+         */
+# ifdef __NR_finit_module
+        {
+                int fd = open(filename, O_RDONLY | O_CLOEXEC);
+                if (fd >= 0) {
+                        rc = finit_module(fd, options, 0) != 0;
+                        close(fd);
+                        if (rc == 0)
+                                return rc;
+                }
+        }
+# endif
        image_size = INT_MAX - 4095;
        mmaped = 0;
        image = try_to_mmap_module(filename, &image_size);
diff --git a/networking/Config.src b/networking/Config.src
index 27c604a31..eb0536a7c 100644
--- a/networking/Config.src
+++ b/networking/Config.src
@@ -912,17 +912,9 @@ config FEATURE_TRACEROUTE_VERBOSE
          Add some verbosity to traceroute. This includes among other things
          hostnames and ICMP response types.
-config FEATURE_TRACEROUTE_SOURCE_ROUTE
-        bool "Enable loose source route"
-        default n
-        depends on TRACEROUTE
-        help
-          Add option to specify a loose source route gateway
-          (8 maximum).
 config FEATURE_TRACEROUTE_USE_ICMP
-        bool "Use ICMP instead of UDP"
+        bool "Enable -I option (use ICMP instead of UDP)"
-        default n
+        default y
        depends on TRACEROUTE
        help
          Add option -I to use ICMP ECHO instead of UDP datagrams.
diff --git a/networking/ifplugd.c b/networking/ifplugd.c
index 28c49e218..029cba147 100644
--- a/networking/ifplugd.c
+++ b/networking/ifplugd.c
@@ -358,8 +358,12 @@ static void up_iface(void)
                ifrequest.ifr_flags |= IFF_UP;
                /* Let user know we mess up with interface */
                bb_error_msg("upping interface");
-                if (network_ioctl(SIOCSIFFLAGS, &ifrequest, "setting interface flags") < 0)
+                if (network_ioctl(SIOCSIFFLAGS, &ifrequest, "setting interface flags") < 0) {
-                        xfunc_die();
+                        if (errno != ENODEV)
+                                xfunc_die();
+                        G.iface_exists = 0;
+                        return;
+                }
        }
 #if 0 /* why do we mess with IP addr? It's not our business */
diff --git a/networking/ifupdown.c b/networking/ifupdown.c
index 25b04c9d7..b0bc0d70f 100644
--- a/networking/ifupdown.c
+++ b/networking/ifupdown.c
@@ -21,7 +21,7 @@
 //usage:       "[-an"IF_FEATURE_IFUPDOWN_MAPPING("m")"vf] [-i FILE] IFACE..."
 //usage:#define ifup_full_usage "\n\n"
 //usage:       "        -a      De/configure all interfaces automatically"
-//usage:     "\n        -i FILE Use FILE for interface definitions"
+//usage:     "\n        -i FILE Use FILE instead of /etc/network/interfaces"
 //usage:     "\n        -n      Print out what would happen, but don't do it"
 //usage:        IF_FEATURE_IFUPDOWN_MAPPING(
 //usage:     "\n                (note: doesn't disable mappings)"
@@ -492,7 +492,7 @@ static int FAST_FUNC static_up(struct interface_defn_t *ifd, execfn *exec)
        result = execute("ifconfig %iface%[[ hw %hwaddress%]][[ media %media%]][[ mtu %mtu%]] up",
                                ifd, exec);
        result += execute("ifconfig %iface% %address% netmask %netmask%"
-                                "[[ broadcast %broadcast%]][[ pointopoint %pointopoint%]] ",
+                                "[[ broadcast %broadcast%]][[ pointopoint %pointopoint%]]",
                                ifd, exec);
        result += execute("[[route add default gw %gateway%[[ metric %metric%]] %iface%]]", ifd, exec);
        return ((result == 3) ? 3 : 0);
@@ -503,7 +503,10 @@ static int FAST_FUNC static_down(struct interface_defn_t *ifd, execfn *exec)
 {
        int result;
 # if ENABLE_FEATURE_IFUPDOWN_IP
-        result = execute("ip addr flush dev %iface%", ifd, exec);
+        /* Optional "label LBL" is necessary if interface is an alias (eth0:0),
+         * otherwise "ip addr flush dev eth0:0" flushes all addresses on eth0.
+         */
+        result = execute("ip addr flush dev %iface%[[ label %label%]]", ifd, exec);
        result += execute("ip link set %iface% down", ifd, exec);
 # else
        /* result = execute("[[route del default gw %gateway% %iface%]]", ifd, exec); */
@@ -1066,6 +1069,11 @@ static int execute_all(struct interface_defn_t *ifd, const char *opt)
                }
        }
+        /* Tested on Debian Squeeze: "standard" ifup runs this without
+         * checking that directory exists. If it doesn't, run-parts
+         * complains, and this message _is_ annoyingly visible.
+         * Don't "fix" this (unless newer Debian does).
+         */
        buf = xasprintf("run-parts /etc/network/if-%s.d", opt);
        /* heh, we don't bother free'ing it */
        return doit(buf);
diff --git a/networking/libiproute/iproute.c b/networking/libiproute/iproute.c
index e674e9a0d..48dc6e3d9 100644
--- a/networking/libiproute/iproute.c
+++ b/networking/libiproute/iproute.c
@@ -362,10 +362,9 @@ IF_FEATURE_IP_RULE(ARG_table,)
                req.r.rtm_scope = RT_SCOPE_NOWHERE;
        if (cmd != RTM_DELROUTE) {
+                req.r.rtm_scope = RT_SCOPE_UNIVERSE;
                if (RTPROT_BOOT != 0)
                        req.r.rtm_protocol = RTPROT_BOOT;
-                if (RT_SCOPE_UNIVERSE != 0)
-                        req.r.rtm_scope = RT_SCOPE_UNIVERSE;
                if (RTN_UNICAST != 0)
                        req.r.rtm_type = RTN_UNICAST;
        }
diff --git a/networking/libiproute/iprule.c b/networking/libiproute/iprule.c
index dba64346f..c486834b0 100644
--- a/networking/libiproute/iprule.c
+++ b/networking/libiproute/iprule.c
@@ -197,9 +197,11 @@ static int iprule_modify(int cmd, char **argv)
        req.n.nlmsg_flags = NLM_F_REQUEST;
        req.r.rtm_family = preferred_family;
        req.r.rtm_protocol = RTPROT_BOOT;
-        req.r.rtm_scope = RT_SCOPE_UNIVERSE;
+        if (RT_SCOPE_UNIVERSE != 0)
-        req.r.rtm_table = 0;
+                req.r.rtm_scope = RT_SCOPE_UNIVERSE;
-        req.r.rtm_type = RTN_UNSPEC;
+        /*req.r.rtm_table = 0; - already is */
+        if (RTN_UNSPEC != 0)
+                req.r.rtm_type = RTN_UNSPEC;
        if (cmd == RTM_NEWRULE) {
                req.n.nlmsg_flags |= NLM_F_CREATE|NLM_F_EXCL;
diff --git a/networking/libiproute/libnetlink.c b/networking/libiproute/libnetlink.c
index cbb5daf95..7e0ff1b6c 100644
--- a/networking/libiproute/libnetlink.c
+++ b/networking/libiproute/libnetlink.c
@@ -68,30 +68,32 @@ int FAST_FUNC rtnl_send(struct rtnl_handle *rth, char *buf, int len)
 int FAST_FUNC rtnl_dump_request(struct rtnl_handle *rth, int type, void *req, int len)
 {
-        struct nlmsghdr nlh;
+        struct {
-        struct sockaddr_nl nladdr;
+                struct nlmsghdr nlh;
-        struct iovec iov[2] = { { &nlh, sizeof(nlh) }, { req, len } };
+                struct msghdr msg;
-        /* Use designated initializers, struct layout is non-portable */
+                struct sockaddr_nl nladdr;
-        struct msghdr msg = {
+        } s;
-                .msg_name = (void*)&nladdr,
+        struct iovec iov[2] = { { &s.nlh, sizeof(s.nlh) }, { req, len } };
-                .msg_namelen = sizeof(nladdr),
-                .msg_iov = iov,
+        memset(&s, 0, sizeof(s));
-                .msg_iovlen = 2,
-                .msg_control = NULL,
+        s.msg.msg_name = (void*)&s.nladdr;
-                .msg_controllen = 0,
+        s.msg.msg_namelen = sizeof(s.nladdr);
-                .msg_flags = 0
+        s.msg.msg_iov = iov;
-        };
+        s.msg.msg_iovlen = 2;
+        /*s.msg.msg_control = NULL; - already is */
-        memset(&nladdr, 0, sizeof(nladdr));
+        /*s.msg.msg_controllen = 0; - already is */
-        nladdr.nl_family = AF_NETLINK;
+        /*s.msg.msg_flags = 0; - already is */
-        nlh.nlmsg_len = NLMSG_LENGTH(len);
+        s.nladdr.nl_family = AF_NETLINK;
-        nlh.nlmsg_type = type;
-        nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
+        s.nlh.nlmsg_len = NLMSG_LENGTH(len);
-        nlh.nlmsg_pid = 0;
+        s.nlh.nlmsg_type = type;
-        nlh.nlmsg_seq = rth->dump = ++rth->seq;
+        s.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
+        /*s.nlh.nlmsg_pid = 0; - already is */
-        return sendmsg(rth->fd, &msg, 0);
+        s.nlh.nlmsg_seq = rth->dump = ++rth->seq;
+        return sendmsg(rth->fd, &s.msg, 0);
 }
 static int rtnl_dump_filter(struct rtnl_handle *rth,
@@ -338,14 +340,14 @@ int FAST_FUNC addattr32(struct nlmsghdr *n, int maxlen, int type, uint32_t data)
        int len = RTA_LENGTH(4);
        struct rtattr *rta;
-        if ((int)(NLMSG_ALIGN(n->nlmsg_len) + len) > maxlen) {
+        if ((int)(NLMSG_ALIGN(n->nlmsg_len + len)) > maxlen) {
                return -1;
        }
        rta = (struct rtattr*)(((char*)n) + NLMSG_ALIGN(n->nlmsg_len));
        rta->rta_type = type;
        rta->rta_len = len;
        move_to_unaligned32(RTA_DATA(rta), data);
-        n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + len;
+        n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len + len);
        return 0;
 }
@@ -354,14 +356,14 @@ int FAST_FUNC addattr_l(struct nlmsghdr *n, int maxlen, int type, void *data, in
        int len = RTA_LENGTH(alen);
        struct rtattr *rta;
-        if ((int)(NLMSG_ALIGN(n->nlmsg_len) + len) > maxlen) {
+        if ((int)(NLMSG_ALIGN(n->nlmsg_len + len)) > maxlen) {
                return -1;
        }
        rta = (struct rtattr*)(((char*)n) + NLMSG_ALIGN(n->nlmsg_len));
        rta->rta_type = type;
        rta->rta_len = len;
        memcpy(RTA_DATA(rta), data, alen);
-        n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + len;
+        n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len + len);
        return 0;
 }
@@ -370,14 +372,14 @@ int FAST_FUNC rta_addattr32(struct rtattr *rta, int maxlen, int type, uint32_t d
        int len = RTA_LENGTH(4);
        struct rtattr *subrta;
-        if (RTA_ALIGN(rta->rta_len) + len > maxlen) {
+        if (RTA_ALIGN(rta->rta_len + len) > maxlen) {
                return -1;
        }
        subrta = (struct rtattr*)(((char*)rta) + RTA_ALIGN(rta->rta_len));
        subrta->rta_type = type;
        subrta->rta_len = len;
        move_to_unaligned32(RTA_DATA(subrta), data);
-        rta->rta_len = NLMSG_ALIGN(rta->rta_len) + len;
+        rta->rta_len = NLMSG_ALIGN(rta->rta_len + len);
        return 0;
 }
@@ -386,14 +388,14 @@ int FAST_FUNC rta_addattr_l(struct rtattr *rta, int maxlen, int type, void *data
        struct rtattr *subrta;
        int len = RTA_LENGTH(alen);
-        if (RTA_ALIGN(rta->rta_len) + len > maxlen) {
+        if (RTA_ALIGN(rta->rta_len + len) > maxlen) {
                return -1;
        }
        subrta = (struct rtattr*)(((char*)rta) + RTA_ALIGN(rta->rta_len));
        subrta->rta_type = type;
        subrta->rta_len = len;
        memcpy(RTA_DATA(subrta), data, alen);
-        rta->rta_len = NLMSG_ALIGN(rta->rta_len) + len;
+        rta->rta_len = NLMSG_ALIGN(rta->rta_len + len);
        return 0;
 }
diff --git a/networking/ntpd.c b/networking/ntpd.c
index 130cef0af..8ca62cf1b 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -2051,6 +2051,13 @@ recv_and_process_client_pkt(void /*int fd*/)
                goto bail;
        }
+        /* Respond only to client and symmetric active packets */
+        if ((msg.m_status & MODE_MASK) != MODE_CLIENT
+         && (msg.m_status & MODE_MASK) != MODE_SYM_ACT
+        ) {
+                goto bail;
+        }
        query_status = msg.m_status;
        query_xmttime = msg.m_xmttime;
diff --git a/networking/route.c b/networking/route.c
index 65c2fb7c8..102a6ec67 100644
--- a/networking/route.c
+++ b/networking/route.c
@@ -295,7 +295,7 @@ static NOINLINE void INET_setroute(int action, char **args)
 #endif
                /* Device is special in that it can be the last arg specified
-                 * and doesn't requre the dev/device keyword in that case. */
+                 * and doesn't require the dev/device keyword in that case. */
                if (!rt->rt_dev && ((k == KW_IPVx_DEVICE) || (!k && !*++args))) {
                        /* Don't use args_m1 here since args may have changed! */
                        rt->rt_dev = args[-1];
@@ -416,7 +416,7 @@ static NOINLINE void INET6_setroute(int action, char **args)
                }
                /* Device is special in that it can be the last arg specified
-                 * and doesn't requre the dev/device keyword in that case. */
+                 * and doesn't require the dev/device keyword in that case. */
                if (!devname && ((k == KW_IPVx_DEVICE) || (!k && !*++args))) {
                        /* Don't use args_m1 here since args may have changed! */
                        devname = args[-1];
diff --git a/networking/ssl_helper-wolfssl/00cfg-wolfssl-3.9.8 b/networking/ssl_helper-wolfssl/00cfg-wolfssl-3.9.8
new file mode 100755
index 000000000..208a7087d
--- /dev/null
+++ b/networking/ssl_helper-wolfssl/00cfg-wolfssl-3.9.8
@@ -0,0 +1,39 @@
+#!/bin/sh
+# How to configure & build a static wolfssl library
+# suitable for static build of ssl_helper.
+export CC="i686-gcc"
+export CFLAGS="\
+-Os \
+-static \
+-fomit-frame-pointer \
+-falign-functions=1 -falign-labels=1 -falign-loops=1 -falign-jumps=1 \
+-ffunction-sections -fdata-sections \
+"
+{
+./configure \
+        --host="i686" \
+        --enable-static \
+        --enable-singlethreaded \
+        --disable-shared \
+\
+        C_EXTRA_FLAGS="-DWOLFSSL_STATIC_RSA" \
+|| exit $?
+# The second group of options was added when "vanilla" config did not work.
+# A good tool to debug problems is to try wolfssl's client tool, e.g.:
+# examples/client/client -h www.google.com -p 443 -d -x
+#
+# configure has many other options, see ./configure --help
+#       --enable-ecc \
+#       --enable-sni \
+#
+# Also consult "wolfSSL - Embedded SSL Library Product Support Forums"
+# for recent report of users having problems connecting.
+make
+} 2>&1 | tee "$0.log"
diff --git a/networking/ssl_helper-wolfssl/README b/networking/ssl_helper-wolfssl/README
index 58a381c20..ff46f4bdf 100644
--- a/networking/ssl_helper-wolfssl/README
+++ b/networking/ssl_helper-wolfssl/README
@@ -11,6 +11,13 @@ Build instructions:
 * Drop this directory into wolfssl-3.6.8/ssl_helper
 * Run ssl_helper.sh to compile and link the helper
+* Unpack wolfssl-3.9.8.tar.gz from https://github.com/wolfSSL/wolfssl/releases
+* Create configure:
+  ./autogen.sh
+* Build it: see 00cfg-wolfssl-3.9.8 shell script
+* Drop this directory into wolfssl-x.y.z/ssl_helper
+* Run ssl_helper.sh to compile and link the helper
 Usage: "ssl_helper -d FILE_DESCRIPTOR" where FILE_DESCRIPTOR is open to the peer.
 In bash, you can do it this way:
diff --git a/networking/ssl_helper-wolfssl/ssl_helper.sh b/networking/ssl_helper-wolfssl/ssl_helper.sh
index 184ffe67e..c6cbf353f 100755
--- a/networking/ssl_helper-wolfssl/ssl_helper.sh
+++ b/networking/ssl_helper-wolfssl/ssl_helper.sh
@@ -9,4 +9,4 @@ STATIC="-static"
 ${PREFIX}gcc -Os -Wall -I.. -c ssl_helper.c -o ssl_helper.o
 ${PREFIX}gcc $STATIC --start-group ssl_helper.o -lm ../src/.libs/libwolfssl.a --end-group -o ssl_helper
-${PREFIX}-strip ssl_helper
+${PREFIX}strip ssl_helper
diff --git a/networking/traceroute.c b/networking/traceroute.c
index e43a36dc7..b9a9ca4bb 100644
--- a/networking/traceroute.c
+++ b/networking/traceroute.c
@@ -212,8 +212,7 @@
 //usage:#define traceroute_trivial_usage
 //usage:       "[-"IF_TRACEROUTE6("46")"FIlnrv] [-f 1ST_TTL] [-m MAXTTL] [-q PROBES] [-p PORT]\n"
-//usage:       "        [-t TOS] [-w WAIT_SEC]"
+//usage:       "        [-t TOS] [-w WAIT_SEC] [-s SRC_IP] [-i IFACE]\n"
-//usage:       IF_FEATURE_TRACEROUTE_SOURCE_ROUTE(" [-g GATEWAY]")" [-s SRC_IP] [-i IFACE]\n"
 //usage:       "        [-z PAUSE_MSEC] HOST [BYTES]"
 //usage:#define traceroute_full_usage "\n\n"
 //usage:       "Trace the route to HOST\n"
@@ -294,7 +293,6 @@
 #define OPT_STRING \
        "FIlnrdvxt:i:m:p:q:s:w:z:f:" \
-        IF_FEATURE_TRACEROUTE_SOURCE_ROUTE("g:*") \
        "4" IF_TRACEROUTE6("6")
 enum {
        OPT_DONT_FRAGMNT = (1 << 0),    /* F */
@@ -314,9 +312,8 @@ enum {
        OPT_WAITTIME     = (1 << 14),   /* w */
        OPT_PAUSE_MS     = (1 << 15),   /* z */
        OPT_FIRST_TTL    = (1 << 16),   /* f */
-        OPT_SOURCE_ROUTE = (1 << 17) * ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE, /* g */
+        OPT_IPV4         = (1 << 17),   /* 4 */
-        OPT_IPV4         = (1 << (17+ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE)),   /* 4 */
+        OPT_IPV6         = (1 << 18) * ENABLE_TRACEROUTE6, /* 6 */
-        OPT_IPV6         = (1 << (18+ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE)) * ENABLE_TRACEROUTE6, /* 6 */
 };
 #define verbose (option_mask32 & OPT_VERBOSE)
@@ -343,26 +340,18 @@ struct outdata6_t {
 #endif
 struct globals {
+        /* Pointer to entire malloced IP packet, "packlen" bytes long: */
        struct ip *outip;
+        /* Pointer to ICMP or UDP payload (not header): */
        struct outdata_t *outdata;
        len_and_sockaddr *dest_lsa;
        int packlen;                    /* total length of packet */
        int pmtu;                       /* Path MTU Discovery (RFC1191) */
        uint32_t ident;
-        uint16_t port; // 32768 + 666;  /* start udp dest port # for probe packets */
+        uint16_t port; // 33434;        /* start udp dest port # for probe packets */
        int waittime; // 5;             /* time to wait for response (in seconds) */
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE
-        int optlen;                     /* length of ip options */
-#else
-#define optlen 0
-#endif
        unsigned char recv_pkt[512];    /* last inbound (icmp) packet */
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE
-        /* Maximum number of gateways (include room for one noop) */
-#define NGATEWAYS ((int)((MAX_IPOPTLEN - IPOPT_MINOFF - 1) / sizeof(uint32_t)))
-        /* loose source route gateway list (including room for final destination) */
-        uint32_t gwlist[NGATEWAYS + 1];
-#endif
 };
 #define G (*ptr_to_globals)
@@ -374,14 +363,11 @@ struct globals {
 #define ident     (G.ident    )
 #define port      (G.port     )
 #define waittime  (G.waittime )
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE
-# define optlen   (G.optlen   )
-#endif
 #define recv_pkt  (G.recv_pkt )
 #define gwlist    (G.gwlist   )
 #define INIT_G() do { \
        SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
-        port = 32768 + 666; \
+        port = 33434; \
        waittime = 5; \
 } while (0)
@@ -421,7 +407,7 @@ send_probe(int seq, int ttl)
        /* Payload */
 #if ENABLE_TRACEROUTE6
        if (dest_lsa->u.sa.sa_family == AF_INET6) {
-                struct outdata6_t *pkt = (struct outdata6_t *) outip;
+                struct outdata6_t *pkt = (struct outdata6_t *) outdata;
                pkt->ident6 = htonl(ident);
                pkt->seq6   = htonl(seq);
                /*gettimeofday(&pkt->tv, &tz);*/
@@ -438,8 +424,10 @@ send_probe(int seq, int ttl)
                        /* Always calculate checksum for icmp packets */
                        outicmp->icmp_cksum = 0;
-                        outicmp->icmp_cksum = inet_cksum((uint16_t *)outicmp,
+                        outicmp->icmp_cksum = inet_cksum(
-                                                packlen - (sizeof(*outip) + optlen));
+                                        (uint16_t *)outicmp,
+                                        ((char*)outip + packlen) - (char*)outicmp
+                        );
                        if (outicmp->icmp_cksum == 0)
                                outicmp->icmp_cksum = 0xffff;
                }
@@ -471,13 +459,12 @@ send_probe(int seq, int ttl)
        }
 #endif
+        out = outdata;
 #if ENABLE_TRACEROUTE6
        if (dest_lsa->u.sa.sa_family == AF_INET6) {
                res = setsockopt_int(sndsock, SOL_IPV6, IPV6_UNICAST_HOPS, ttl);
                if (res != 0)
                        bb_perror_msg_and_die("setsockopt(%s) %d", "UNICAST_HOPS", ttl);
-                out = outip;
-                len = packlen;
        } else
 #endif
        {
@@ -486,15 +473,14 @@ send_probe(int seq, int ttl)
                if (res != 0)
                        bb_perror_msg_and_die("setsockopt(%s) %d", "TTL", ttl);
 #endif
-                out = outicmp;
+                if (option_mask32 & OPT_USE_ICMP)
-                len = packlen - sizeof(*outip);
+                        out = outicmp;
-                if (!(option_mask32 & OPT_USE_ICMP)) {
-                        out = outdata;
-                        len -= sizeof(*outudp);
-                        set_nport(&dest_lsa->u.sa, htons(port + seq));
-                }
        }
+        if (!(option_mask32 & OPT_USE_ICMP)) {
+                set_nport(&dest_lsa->u.sa, htons(port + seq));
+        }
+        len = ((char*)outip + packlen) - (char*)out;
        res = xsendto(sndsock, out, len, &dest_lsa->u.sa, dest_lsa->len);
        if (res != len)
                bb_error_msg("sent %d octets, ret=%d", len, res);
@@ -801,10 +787,6 @@ common_traceroute_main(int op, char **argv)
        char *pausemsecs_str;
        char *first_ttl_str;
        char *dest_str;
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE
-        llist_t *source_route_list = NULL;
-        int lsrr = 0;
-#endif
 #if ENABLE_TRACEROUTE6
        sa_family_t af;
 #else
@@ -823,9 +805,6 @@ common_traceroute_main(int op, char **argv)
        op |= getopt32(argv, OPT_STRING
                , &tos_str, &device, &max_ttl_str, &port_str, &nprobes_str
                , &source, &waittime_str, &pausemsecs_str, &first_ttl_str
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE
-                , &source_route_list
-#endif
        );
        argv += optind;
@@ -858,26 +837,14 @@ common_traceroute_main(int op, char **argv)
        if (op & OPT_FIRST_TTL)
                first_ttl = xatou_range(first_ttl_str, 1, max_ttl);
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE
-        if (source_route_list) {
-                while (source_route_list) {
-                        len_and_sockaddr *lsa;
-                        if (lsrr >= NGATEWAYS)
-                                bb_error_msg_and_die("no more than %d gateways", NGATEWAYS);
-                        lsa = xhost_and_af2sockaddr(llist_pop(&source_route_list), 0, AF_INET);
-                        gwlist[lsrr] = lsa->u.sin.sin_addr.s_addr;
-                        free(lsa);
-                        ++lsrr;
-                }
-                optlen = (lsrr + 1) * sizeof(gwlist[0]);
-        }
-#endif
        /* Process destination and optional packet size */
-        minpacket = sizeof(*outip) + SIZEOF_ICMP_HDR + sizeof(*outdata) + optlen;
+        minpacket = sizeof(struct ip)
+                        + SIZEOF_ICMP_HDR
+                        + sizeof(struct outdata_t);
        if (!(op & OPT_USE_ICMP))
-                minpacket += sizeof(*outudp) - SIZEOF_ICMP_HDR;
+                minpacket = sizeof(struct ip)
+                        + sizeof(struct udphdr)
+                        + sizeof(struct outdata_t);
 #if ENABLE_TRACEROUTE6
        af = AF_UNSPEC;
        if (op & OPT_IPV4)
@@ -887,7 +854,9 @@ common_traceroute_main(int op, char **argv)
        dest_lsa = xhost_and_af2sockaddr(argv[0], port, af);
        af = dest_lsa->u.sa.sa_family;
        if (af == AF_INET6)
-                minpacket = sizeof(struct outdata6_t);
+                minpacket = sizeof(struct ip6_hdr)
+                        + sizeof(struct udphdr)
+                        + sizeof(struct outdata6_t);
 #else
        dest_lsa = xhost2sockaddr(argv[0], port);
 #endif
@@ -932,31 +901,6 @@ common_traceroute_main(int op, char **argv)
                        xmove_fd(xsocket(AF_INET, SOCK_RAW, IPPROTO_ICMP), sndsock);
                else
                        xmove_fd(xsocket(AF_INET, SOCK_DGRAM, 0), sndsock);
-#if ENABLE_FEATURE_TRACEROUTE_SOURCE_ROUTE && defined IP_OPTIONS
-                if (lsrr > 0) {
-                        unsigned char optlist[MAX_IPOPTLEN];
-                        unsigned size;
-                        /* final hop */
-                        gwlist[lsrr] = dest_lsa->u.sin.sin_addr.s_addr;
-                        ++lsrr;
-                        /* force 4 byte alignment */
-                        optlist[0] = IPOPT_NOP;
-                        /* loose source route option */
-                        optlist[1] = IPOPT_LSRR;
-                        size = lsrr * sizeof(gwlist[0]);
-                        optlist[2] = size + 3;
-                        /* pointer to LSRR addresses */
-                        optlist[3] = IPOPT_MINOFF;
-                        memcpy(optlist + 4, gwlist, size);
-                        if (setsockopt(sndsock, IPPROTO_IP, IP_OPTIONS,
-                                        (char *)optlist, size + sizeof(gwlist[0])) < 0) {
-                                bb_perror_msg_and_die("IP_OPTIONS");
-                        }
-                }
-#endif
        }
 #ifdef SO_SNDBUF
@@ -984,7 +928,7 @@ common_traceroute_main(int op, char **argv)
        ident = getpid();
-        if (af == AF_INET) {
+        if (!ENABLE_TRACEROUTE6 || af == AF_INET) {
                if (op & OPT_USE_ICMP) {
                        ident |= 0x8000;
                        outicmp->icmp_type = ICMP_ECHO;
@@ -994,6 +938,14 @@ common_traceroute_main(int op, char **argv)
                        outdata = (struct outdata_t *)(outudp + 1);
                }
        }
+#if ENABLE_TRACEROUTE6
+        if (af == AF_INET6) {
+                outdata = (void*)((char*)outip
+                                + sizeof(struct ip6_hdr)
+                                + sizeof(struct udphdr)
+                                );
+        }
+#endif
        if (op & OPT_DEVICE) /* hmm, do we need error check? */
                setsockopt_bindtodevice(sndsock, device);
diff --git a/networking/udhcp/Kbuild.src b/networking/udhcp/Kbuild.src
index b8767baea..5ea77df06 100644
--- a/networking/udhcp/Kbuild.src
+++ b/networking/udhcp/Kbuild.src
@@ -13,7 +13,7 @@ lib-$(CONFIG_UDHCPC)     += common.o packet.o signalpipe.o socket.o
 lib-$(CONFIG_UDHCPD)     += common.o packet.o signalpipe.o socket.o
 lib-$(CONFIG_UDHCPC)     += dhcpc.o
-lib-$(CONFIG_UDHCPD)     += dhcpd.o arpping.o files.o leases.o static_leases.o
+lib-$(CONFIG_UDHCPD)     += dhcpd.o arpping.o
 lib-$(CONFIG_DUMPLEASES) += dumpleases.o
 lib-$(CONFIG_DHCPRELAY)  += dhcprelay.o
diff --git a/networking/udhcp/arpping.c b/networking/udhcp/arpping.c
index c98027316..215d023ce 100644
--- a/networking/udhcp/arpping.c
+++ b/networking/udhcp/arpping.c
@@ -9,7 +9,6 @@
 #include <net/if_arp.h>
 #include "common.h"
-#include "dhcpd.h"
 struct arpMsg {
        /* Ethernet header */
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
index 6ff040d9e..ddf3412a0 100644
--- a/networking/udhcp/d6_dhcpc.c
+++ b/networking/udhcp/d6_dhcpc.c
@@ -800,10 +800,15 @@ static void perform_d6_release(struct in6_addr *server_ipv6, struct in6_addr *ou
        ) {
                bb_error_msg("unicasting a release");
                send_d6_release(server_ipv6, our_cur_ipv6); /* unicast */
-                d6_run_script(NULL, "deconfig");
        }
        bb_error_msg("entering released state");
+/*
+ * We can be here on: SIGUSR2,
+ * or on exit (SIGTERM) and -R "release on quit" is specified.
+ * Users requested to be notified in all cases, even if not in one
+ * of the states above.
+ */
+        d6_run_script(NULL, "deconfig");
        change_listen_mode(LISTEN_NONE);
        state = RELEASED;
 }
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index 8a16e987d..bef73277a 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -1129,9 +1129,15 @@ static void perform_release(uint32_t server_addr, uint32_t requested_ip)
                bb_error_msg("unicasting a release of %s to %s",
                                inet_ntoa(temp_addr), buffer);
                send_release(server_addr, requested_ip); /* unicast */
-                udhcp_run_script(NULL, "deconfig");
        }
        bb_error_msg("entering released state");
+/*
+ * We can be here on: SIGUSR2,
+ * or on exit (SIGTERM) and -R "release on quit" is specified.
+ * Users requested to be notified in all cases, even if not in one
+ * of the states above.
+ */
+        udhcp_run_script(NULL, "deconfig");
        change_listen_mode(LISTEN_NONE);
        state = RELEASED;
@@ -1813,9 +1819,8 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                                        temp = udhcp_get_option(&packet, DHCP_SERVER_ID);
                                        if (!temp) {
 non_matching_svid:
-                                                log1("%s with wrong server ID, ignoring packet",
+                                                log1("received DHCP NAK with wrong"
-                                                        "Received DHCP NAK"
+                                                        " server ID, ignoring packet");
-                                                );
                                                continue;
                                        }
                                        move_from_unaligned32(svid, temp);
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index e93a9f1da..56116d01f 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -33,11 +33,507 @@
 //usage:     "\n        -P N    Use port N (default 67)"
 //usage:        )
+#include <netinet/ether.h>
 #include <syslog.h>
 #include "common.h"
 #include "dhcpc.h"
 #include "dhcpd.h"
+/* globals */
+struct dyn_lease *g_leases;
+/* struct server_config_t server_config is in bb_common_bufsiz1 */
+/* Takes the address of the pointer to the static_leases linked list,
+ * address to a 6 byte mac address,
+ * 4 byte IP address */
+static void add_static_lease(struct static_lease **st_lease_pp,
+                uint8_t *mac,
+                uint32_t nip)
+{
+        struct static_lease *st_lease;
+        /* Find the tail of the list */
+        while ((st_lease = *st_lease_pp) != NULL) {
+                st_lease_pp = &st_lease->next;
+        }
+        /* Add new node */
+        *st_lease_pp = st_lease = xzalloc(sizeof(*st_lease));
+        memcpy(st_lease->mac, mac, 6);
+        st_lease->nip = nip;
+        /*st_lease->next = NULL;*/
+}
+/* Find static lease IP by mac */
+static uint32_t get_static_nip_by_mac(struct static_lease *st_lease, void *mac)
+{
+        while (st_lease) {
+                if (memcmp(st_lease->mac, mac, 6) == 0)
+                        return st_lease->nip;
+                st_lease = st_lease->next;
+        }
+        return 0;
+}
+static int is_nip_reserved(struct static_lease *st_lease, uint32_t nip)
+{
+        while (st_lease) {
+                if (st_lease->nip == nip)
+                        return 1;
+                st_lease = st_lease->next;
+        }
+        return 0;
+}
+#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 2
+/* Print out static leases just to check what's going on */
+/* Takes the address of the pointer to the static_leases linked list */
+static void log_static_leases(struct static_lease **st_lease_pp)
+{
+        struct static_lease *cur;
+        if (dhcp_verbose < 2)
+                return;
+        cur = *st_lease_pp;
+        while (cur) {
+                bb_error_msg("static lease: mac:%02x:%02x:%02x:%02x:%02x:%02x nip:%x",
+                        cur->mac[0], cur->mac[1], cur->mac[2],
+                        cur->mac[3], cur->mac[4], cur->mac[5],
+                        cur->nip
+                );
+                cur = cur->next;
+        }
+}
+#else
+# define log_static_leases(st_lease_pp) ((void)0)
+#endif
+/* Find the oldest expired lease, NULL if there are no expired leases */
+static struct dyn_lease *oldest_expired_lease(void)
+{
+        struct dyn_lease *oldest_lease = NULL;
+        leasetime_t oldest_time = time(NULL);
+        unsigned i;
+        /* Unexpired leases have g_leases[i].expires >= current time
+         * and therefore can't ever match */
+        for (i = 0; i < server_config.max_leases; i++) {
+                if (g_leases[i].expires == 0 /* empty entry */
+                 || g_leases[i].expires < oldest_time
+                ) {
+                        oldest_time = g_leases[i].expires;
+                        oldest_lease = &g_leases[i];
+                }
+        }
+        return oldest_lease;
+}
+/* Clear out all leases with matching nonzero chaddr OR yiaddr.
+ * If chaddr == NULL, this is a conflict lease.
+ */
+static void clear_leases(const uint8_t *chaddr, uint32_t yiaddr)
+{
+        unsigned i;
+        for (i = 0; i < server_config.max_leases; i++) {
+                if ((chaddr && memcmp(g_leases[i].lease_mac, chaddr, 6) == 0)
+                 || (yiaddr && g_leases[i].lease_nip == yiaddr)
+                ) {
+                        memset(&g_leases[i], 0, sizeof(g_leases[i]));
+                }
+        }
+}
+/* Add a lease into the table, clearing out any old ones.
+ * If chaddr == NULL, this is a conflict lease.
+ */
+static struct dyn_lease *add_lease(
+                const uint8_t *chaddr, uint32_t yiaddr,
+                leasetime_t leasetime,
+                const char *hostname, int hostname_len)
+{
+        struct dyn_lease *oldest;
+        /* clean out any old ones */
+        clear_leases(chaddr, yiaddr);
+        oldest = oldest_expired_lease();
+        if (oldest) {
+                memset(oldest, 0, sizeof(*oldest));
+                if (hostname) {
+                        char *p;
+                        hostname_len++; /* include NUL */
+                        if (hostname_len > sizeof(oldest->hostname))
+                                hostname_len = sizeof(oldest->hostname);
+                        p = safe_strncpy(oldest->hostname, hostname, hostname_len);
+                        /*
+                         * Sanitization (s/bad_char/./g).
+                         * The intent is not to allow only "DNS-valid" hostnames,
+                         * but merely make dumpleases output safe for shells to use.
+                         * We accept "0-9A-Za-z._-", all other chars turn to dots.
+                         */
+                        while (*p) {
+                                if (!isalnum(*p) && *p != '-' && *p != '_')
+                                        *p = '.';
+                                p++;
+                        }
+                }
+                if (chaddr)
+                        memcpy(oldest->lease_mac, chaddr, 6);
+                oldest->lease_nip = yiaddr;
+                oldest->expires = time(NULL) + leasetime;
+        }
+        return oldest;
+}
+/* True if a lease has expired */
+static int is_expired_lease(struct dyn_lease *lease)
+{
+        return (lease->expires < (leasetime_t) time(NULL));
+}
+/* Find the first lease that matches MAC, NULL if no match */
+static struct dyn_lease *find_lease_by_mac(const uint8_t *mac)
+{
+        unsigned i;
+        for (i = 0; i < server_config.max_leases; i++)
+                if (memcmp(g_leases[i].lease_mac, mac, 6) == 0)
+                        return &g_leases[i];
+        return NULL;
+}
+/* Find the first lease that matches IP, NULL is no match */
+static struct dyn_lease *find_lease_by_nip(uint32_t nip)
+{
+        unsigned i;
+        for (i = 0; i < server_config.max_leases; i++)
+                if (g_leases[i].lease_nip == nip)
+                        return &g_leases[i];
+        return NULL;
+}
+/* Check if the IP is taken; if it is, add it to the lease table */
+static int nobody_responds_to_arp(uint32_t nip, const uint8_t *safe_mac, unsigned arpping_ms)
+{
+        struct in_addr temp;
+        int r;
+        r = arpping(nip, safe_mac,
+                        server_config.server_nip,
+                        server_config.server_mac,
+                        server_config.interface,
+                        arpping_ms);
+        if (r)
+                return r;
+        temp.s_addr = nip;
+        bb_error_msg("%s belongs to someone, reserving it for %u seconds",
+                inet_ntoa(temp), (unsigned)server_config.conflict_time);
+        add_lease(NULL, nip, server_config.conflict_time, NULL, 0);
+        return 0;
+}
+/* Find a new usable (we think) address */
+static uint32_t find_free_or_expired_nip(const uint8_t *safe_mac, unsigned arpping_ms)
+{
+        uint32_t addr;
+        struct dyn_lease *oldest_lease = NULL;
+#if ENABLE_FEATURE_UDHCPD_BASE_IP_ON_MAC
+        uint32_t stop;
+        unsigned i, hash;
+        /* hash hwaddr: use the SDBM hashing algorithm.  Seems to give good
+         * dispersal even with similarly-valued "strings".
+         */
+        hash = 0;
+        for (i = 0; i < 6; i++)
+                hash += safe_mac[i] + (hash << 6) + (hash << 16) - hash;
+        /* pick a seed based on hwaddr then iterate until we find a free address. */
+        addr = server_config.start_ip
+                + (hash % (1 + server_config.end_ip - server_config.start_ip));
+        stop = addr;
+#else
+        addr = server_config.start_ip;
+#define stop (server_config.end_ip + 1)
+#endif
+        do {
+                uint32_t nip;
+                struct dyn_lease *lease;
+                /* ie, 192.168.55.0 */
+                if ((addr & 0xff) == 0)
+                        goto next_addr;
+                /* ie, 192.168.55.255 */
+                if ((addr & 0xff) == 0xff)
+                        goto next_addr;
+                nip = htonl(addr);
+                /* skip our own address */
+                if (nip == server_config.server_nip)
+                        goto next_addr;
+                /* is this a static lease addr? */
+                if (is_nip_reserved(server_config.static_leases, nip))
+                        goto next_addr;
+                lease = find_lease_by_nip(nip);
+                if (!lease) {
+//TODO: DHCP servers do not always sit on the same subnet as clients: should *ping*, not arp-ping!
+                        if (nobody_responds_to_arp(nip, safe_mac, arpping_ms))
+                                return nip;
+                } else {
+                        if (!oldest_lease || lease->expires < oldest_lease->expires)
+                                oldest_lease = lease;
+                }
+ next_addr:
+                addr++;
+#if ENABLE_FEATURE_UDHCPD_BASE_IP_ON_MAC
+                if (addr > server_config.end_ip)
+                        addr = server_config.start_ip;
+#endif
+        } while (addr != stop);
+        if (oldest_lease
+         && is_expired_lease(oldest_lease)
+         && nobody_responds_to_arp(oldest_lease->lease_nip, safe_mac, arpping_ms)
+        ) {
+                return oldest_lease->lease_nip;
+        }
+        return 0;
+}
+/* On these functions, make sure your datatype matches */
+static int FAST_FUNC read_str(const char *line, void *arg)
+{
+        char **dest = arg;
+        free(*dest);
+        *dest = xstrdup(line);
+        return 1;
+}
+static int FAST_FUNC read_u32(const char *line, void *arg)
+{
+        *(uint32_t*)arg = bb_strtou32(line, NULL, 10);
+        return errno == 0;
+}
+static int FAST_FUNC read_staticlease(const char *const_line, void *arg)
+{
+        char *line;
+        char *mac_string;
+        char *ip_string;
+        struct ether_addr mac_bytes; /* it's "struct { uint8_t mac[6]; }" */
+        uint32_t nip;
+        /* Read mac */
+        line = (char *) const_line;
+        mac_string = strtok_r(line, " \t", &line);
+        if (!mac_string || !ether_aton_r(mac_string, &mac_bytes))
+                return 0;
+        /* Read ip */
+        ip_string = strtok_r(NULL, " \t", &line);
+        if (!ip_string || !udhcp_str2nip(ip_string, &nip))
+                return 0;
+        add_static_lease(arg, (uint8_t*) &mac_bytes, nip);
+        log_static_leases(arg);
+        return 1;
+}
+struct config_keyword {
+        const char *keyword;
+        int (*handler)(const char *line, void *var) FAST_FUNC;
+        unsigned ofs;
+        const char *def;
+};
+#define OFS(field) offsetof(struct server_config_t, field)
+static const struct config_keyword keywords[] = {
+        /* keyword        handler           variable address               default */
+        {"start"        , udhcp_str2nip   , OFS(start_ip     ), "192.168.0.20"},
+        {"end"          , udhcp_str2nip   , OFS(end_ip       ), "192.168.0.254"},
+        {"interface"    , read_str        , OFS(interface    ), "eth0"},
+        /* Avoid "max_leases value not sane" warning by setting default
+         * to default_end_ip - default_start_ip + 1: */
+        {"max_leases"   , read_u32        , OFS(max_leases   ), "235"},
+        {"auto_time"    , read_u32        , OFS(auto_time    ), "7200"},
+        {"decline_time" , read_u32        , OFS(decline_time ), "3600"},
+        {"conflict_time", read_u32        , OFS(conflict_time), "3600"},
+        {"offer_time"   , read_u32        , OFS(offer_time   ), "60"},
+        {"min_lease"    , read_u32        , OFS(min_lease_sec), "60"},
+        {"lease_file"   , read_str        , OFS(lease_file   ), LEASES_FILE},
+        {"pidfile"      , read_str        , OFS(pidfile      ), "/var/run/udhcpd.pid"},
+        {"siaddr"       , udhcp_str2nip   , OFS(siaddr_nip   ), "0.0.0.0"},
+        /* keywords with no defaults must be last! */
+        {"option"       , udhcp_str2optset, OFS(options      ), ""},
+        {"opt"          , udhcp_str2optset, OFS(options      ), ""},
+        {"notify_file"  , read_str        , OFS(notify_file  ), NULL},
+        {"sname"        , read_str        , OFS(sname        ), NULL},
+        {"boot_file"    , read_str        , OFS(boot_file    ), NULL},
+        {"static_lease" , read_staticlease, OFS(static_leases), ""},
+};
+enum { KWS_WITH_DEFAULTS = ARRAY_SIZE(keywords) - 6 };
+static NOINLINE void read_config(const char *file)
+{
+        parser_t *parser;
+        const struct config_keyword *k;
+        unsigned i;
+        char *token[2];
+        for (i = 0; i < KWS_WITH_DEFAULTS; i++)
+                keywords[i].handler(keywords[i].def, (char*)&server_config + keywords[i].ofs);
+        parser = config_open(file);
+        while (config_read(parser, token, 2, 2, "# \t", PARSE_NORMAL)) {
+                for (k = keywords, i = 0; i < ARRAY_SIZE(keywords); k++, i++) {
+                        if (strcasecmp(token[0], k->keyword) == 0) {
+                                if (!k->handler(token[1], (char*)&server_config + k->ofs)) {
+                                        bb_error_msg("can't parse line %u in %s",
+                                                        parser->lineno, file);
+                                        /* reset back to the default value */
+                                        k->handler(k->def, (char*)&server_config + k->ofs);
+                                }
+                                break;
+                        }
+                }
+        }
+        config_close(parser);
+        server_config.start_ip = ntohl(server_config.start_ip);
+        server_config.end_ip = ntohl(server_config.end_ip);
+}
+static void write_leases(void)
+{
+        int fd;
+        unsigned i;
+        leasetime_t curr;
+        int64_t written_at;
+        fd = open_or_warn(server_config.lease_file, O_WRONLY|O_CREAT|O_TRUNC);
+        if (fd < 0)
+                return;
+        curr = written_at = time(NULL);
+        written_at = SWAP_BE64(written_at);
+        full_write(fd, &written_at, sizeof(written_at));
+        for (i = 0; i < server_config.max_leases; i++) {
+                leasetime_t tmp_time;
+                if (g_leases[i].lease_nip == 0)
+                        continue;
+                /* Screw with the time in the struct, for easier writing */
+                tmp_time = g_leases[i].expires;
+                g_leases[i].expires -= curr;
+                if ((signed_leasetime_t) g_leases[i].expires < 0)
+                        g_leases[i].expires = 0;
+                g_leases[i].expires = htonl(g_leases[i].expires);
+                /* No error check. If the file gets truncated,
+                 * we lose some leases on restart. Oh well. */
+                full_write(fd, &g_leases[i], sizeof(g_leases[i]));
+                /* Then restore it when done */
+                g_leases[i].expires = tmp_time;
+        }
+        close(fd);
+        if (server_config.notify_file) {
+                char *argv[3];
+                argv[0] = server_config.notify_file;
+                argv[1] = server_config.lease_file;
+                argv[2] = NULL;
+                spawn_and_wait(argv);
+        }
+}
+static NOINLINE void read_leases(const char *file)
+{
+        struct dyn_lease lease;
+        int64_t written_at, time_passed;
+        int fd;
+#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 1
+        unsigned i = 0;
+#endif
+        fd = open_or_warn(file, O_RDONLY);
+        if (fd < 0)
+                return;
+        if (full_read(fd, &written_at, sizeof(written_at)) != sizeof(written_at))
+                goto ret;
+        written_at = SWAP_BE64(written_at);
+        time_passed = time(NULL) - written_at;
+        /* Strange written_at, or lease file from old version of udhcpd
+         * which had no "written_at" field? */
+        if ((uint64_t)time_passed > 12 * 60 * 60)
+                goto ret;
+        while (full_read(fd, &lease, sizeof(lease)) == sizeof(lease)) {
+                uint32_t y = ntohl(lease.lease_nip);
+                if (y >= server_config.start_ip && y <= server_config.end_ip) {
+                        signed_leasetime_t expires = ntohl(lease.expires) - (signed_leasetime_t)time_passed;
+                        uint32_t static_nip;
+                        if (expires <= 0)
+                                /* We keep expired leases: add_lease() will add
+                                 * a lease with 0 seconds remaining.
+                                 * Fewer IP address changes this way for mass reboot scenario.
+                                 */
+                                expires = 0;
+                        /* Check if there is a different static lease for this IP or MAC */
+                        static_nip = get_static_nip_by_mac(server_config.static_leases, lease.lease_mac);
+                        if (static_nip) {
+                                /* NB: we do not add lease even if static_nip == lease.lease_nip.
+                                 */
+                                continue;
+                        }
+                        if (is_nip_reserved(server_config.static_leases, lease.lease_nip))
+                                continue;
+                        /* NB: add_lease takes "relative time", IOW,
+                         * lease duration, not lease deadline. */
+                        if (add_lease(lease.lease_mac, lease.lease_nip,
+                                        expires,
+                                        lease.hostname, sizeof(lease.hostname)
+                                ) == 0
+                        ) {
+                                bb_error_msg("too many leases while loading %s", file);
+                                break;
+                        }
+#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 1
+                        i++;
+#endif
+                }
+        }
+        log1("read %d leases", i);
+ ret:
+        close(fd);
+}
 /* Send a packet to a specific mac address and ip address by creating our own ip packet */
 static void send_packet_to_client(struct dhcp_packet *dhcp_pkt, int force_broadcast)
@@ -290,12 +786,6 @@ static NOINLINE void send_inform(struct dhcp_packet *oldpacket)
        send_packet(&packet, /*force_bcast:*/ 0);
 }
-/* globals */
-struct dyn_lease *g_leases;
-/* struct server_config_t server_config is in bb_common_bufsiz1 */
 int udhcpd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int udhcpd_main(int argc UNUSED_PARAM, char **argv)
 {
diff --git a/networking/udhcp/dhcpd.h b/networking/udhcp/dhcpd.h
index 9dd5bef9e..b8f96b029 100644
--- a/networking/udhcp/dhcpd.h
+++ b/networking/udhcp/dhcpd.h
@@ -90,39 +90,6 @@ struct dyn_lease {
        /* total size is a multiply of 4 */
 } PACKED;
-extern struct dyn_lease *g_leases;
-struct dyn_lease *add_lease(
-                const uint8_t *chaddr, uint32_t yiaddr,
-                leasetime_t leasetime,
-                const char *hostname, int hostname_len
-                ) FAST_FUNC;
-int is_expired_lease(struct dyn_lease *lease) FAST_FUNC;
-struct dyn_lease *find_lease_by_mac(const uint8_t *mac) FAST_FUNC;
-struct dyn_lease *find_lease_by_nip(uint32_t nip) FAST_FUNC;
-uint32_t find_free_or_expired_nip(const uint8_t *safe_mac, unsigned arpping_ms) FAST_FUNC;
-/* Config file parser will pass static lease info to this function
- * which will add it to a data structure that can be searched later */
-void add_static_lease(struct static_lease **st_lease_pp, uint8_t *mac, uint32_t nip) FAST_FUNC;
-/* Find static lease IP by mac */
-uint32_t get_static_nip_by_mac(struct static_lease *st_lease, void *arg) FAST_FUNC;
-/* Check to see if an IP is reserved as a static IP */
-int is_nip_reserved(struct static_lease *st_lease, uint32_t nip) FAST_FUNC;
-/* Print out static leases just to check what's going on (debug code) */
-#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 2
-void log_static_leases(struct static_lease **st_lease_pp) FAST_FUNC;
-#else
-# define log_static_leases(st_lease_pp) ((void)0)
-#endif
-void read_config(const char *file) FAST_FUNC;
-void write_leases(void) FAST_FUNC;
-void read_leases(const char *file) FAST_FUNC;
 POP_SAVED_FUNCTION_VISIBILITY
 #endif
diff --git a/networking/udhcp/files.c b/networking/udhcp/files.c
deleted file mode 100644
index b22425352..000000000
--- a/networking/udhcp/files.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/* vi: set sw=4 ts=4: */
-/*
- * DHCP server config and lease file manipulation
- *
- * Rewrite by Russ Dill <Russ.Dill@asu.edu> July 2001
- *
- * Licensed under GPLv2, see file LICENSE in this source tree.
- */
-#include <netinet/ether.h>
-#include "common.h"
-#include "dhcpd.h"
-/* on these functions, make sure your datatype matches */
-static int FAST_FUNC read_str(const char *line, void *arg)
-{
-        char **dest = arg;
-        free(*dest);
-        *dest = xstrdup(line);
-        return 1;
-}
-static int FAST_FUNC read_u32(const char *line, void *arg)
-{
-        *(uint32_t*)arg = bb_strtou32(line, NULL, 10);
-        return errno == 0;
-}
-static int FAST_FUNC read_staticlease(const char *const_line, void *arg)
-{
-        char *line;
-        char *mac_string;
-        char *ip_string;
-        struct ether_addr mac_bytes; /* it's "struct { uint8_t mac[6]; }" */
-        uint32_t nip;
-        /* Read mac */
-        line = (char *) const_line;
-        mac_string = strtok_r(line, " \t", &line);
-        if (!mac_string || !ether_aton_r(mac_string, &mac_bytes))
-                return 0;
-        /* Read ip */
-        ip_string = strtok_r(NULL, " \t", &line);
-        if (!ip_string || !udhcp_str2nip(ip_string, &nip))
-                return 0;
-        add_static_lease(arg, (uint8_t*) &mac_bytes, nip);
-        log_static_leases(arg);
-        return 1;
-}
-struct config_keyword {
-        const char *keyword;
-        int (*handler)(const char *line, void *var) FAST_FUNC;
-        unsigned ofs;
-        const char *def;
-};
-#define OFS(field) offsetof(struct server_config_t, field)
-static const struct config_keyword keywords[] = {
-        /* keyword        handler           variable address               default */
-        {"start"        , udhcp_str2nip   , OFS(start_ip     ), "192.168.0.20"},
-        {"end"          , udhcp_str2nip   , OFS(end_ip       ), "192.168.0.254"},
-        {"interface"    , read_str        , OFS(interface    ), "eth0"},
-        /* Avoid "max_leases value not sane" warning by setting default
-         * to default_end_ip - default_start_ip + 1: */
-        {"max_leases"   , read_u32        , OFS(max_leases   ), "235"},
-        {"auto_time"    , read_u32        , OFS(auto_time    ), "7200"},
-        {"decline_time" , read_u32        , OFS(decline_time ), "3600"},
-        {"conflict_time", read_u32        , OFS(conflict_time), "3600"},
-        {"offer_time"   , read_u32        , OFS(offer_time   ), "60"},
-        {"min_lease"    , read_u32        , OFS(min_lease_sec), "60"},
-        {"lease_file"   , read_str        , OFS(lease_file   ), LEASES_FILE},
-        {"pidfile"      , read_str        , OFS(pidfile      ), "/var/run/udhcpd.pid"},
-        {"siaddr"       , udhcp_str2nip   , OFS(siaddr_nip   ), "0.0.0.0"},
-        /* keywords with no defaults must be last! */
-        {"option"       , udhcp_str2optset, OFS(options      ), ""},
-        {"opt"          , udhcp_str2optset, OFS(options      ), ""},
-        {"notify_file"  , read_str        , OFS(notify_file  ), NULL},
-        {"sname"        , read_str        , OFS(sname        ), NULL},
-        {"boot_file"    , read_str        , OFS(boot_file    ), NULL},
-        {"static_lease" , read_staticlease, OFS(static_leases), ""},
-};
-enum { KWS_WITH_DEFAULTS = ARRAY_SIZE(keywords) - 6 };
-void FAST_FUNC read_config(const char *file)
-{
-        parser_t *parser;
-        const struct config_keyword *k;
-        unsigned i;
-        char *token[2];
-        for (i = 0; i < KWS_WITH_DEFAULTS; i++)
-                keywords[i].handler(keywords[i].def, (char*)&server_config + keywords[i].ofs);
-        parser = config_open(file);
-        while (config_read(parser, token, 2, 2, "# \t", PARSE_NORMAL)) {
-                for (k = keywords, i = 0; i < ARRAY_SIZE(keywords); k++, i++) {
-                        if (strcasecmp(token[0], k->keyword) == 0) {
-                                if (!k->handler(token[1], (char*)&server_config + k->ofs)) {
-                                        bb_error_msg("can't parse line %u in %s",
-                                                        parser->lineno, file);
-                                        /* reset back to the default value */
-                                        k->handler(k->def, (char*)&server_config + k->ofs);
-                                }
-                                break;
-                        }
-                }
-        }
-        config_close(parser);
-        server_config.start_ip = ntohl(server_config.start_ip);
-        server_config.end_ip = ntohl(server_config.end_ip);
-}
-void FAST_FUNC write_leases(void)
-{
-        int fd;
-        unsigned i;
-        leasetime_t curr;
-        int64_t written_at;
-        fd = open_or_warn(server_config.lease_file, O_WRONLY|O_CREAT|O_TRUNC);
-        if (fd < 0)
-                return;
-        curr = written_at = time(NULL);
-        written_at = SWAP_BE64(written_at);
-        full_write(fd, &written_at, sizeof(written_at));
-        for (i = 0; i < server_config.max_leases; i++) {
-                leasetime_t tmp_time;
-                if (g_leases[i].lease_nip == 0)
-                        continue;
-                /* Screw with the time in the struct, for easier writing */
-                tmp_time = g_leases[i].expires;
-                g_leases[i].expires -= curr;
-                if ((signed_leasetime_t) g_leases[i].expires < 0)
-                        g_leases[i].expires = 0;
-                g_leases[i].expires = htonl(g_leases[i].expires);
-                /* No error check. If the file gets truncated,
-                 * we lose some leases on restart. Oh well. */
-                full_write(fd, &g_leases[i], sizeof(g_leases[i]));
-                /* Then restore it when done */
-                g_leases[i].expires = tmp_time;
-        }
-        close(fd);
-        if (server_config.notify_file) {
-                char *argv[3];
-                argv[0] = server_config.notify_file;
-                argv[1] = server_config.lease_file;
-                argv[2] = NULL;
-                spawn_and_wait(argv);
-        }
-}
-void FAST_FUNC read_leases(const char *file)
-{
-        struct dyn_lease lease;
-        int64_t written_at, time_passed;
-        int fd;
-#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 1
-        unsigned i = 0;
-#endif
-        fd = open_or_warn(file, O_RDONLY);
-        if (fd < 0)
-                return;
-        if (full_read(fd, &written_at, sizeof(written_at)) != sizeof(written_at))
-                goto ret;
-        written_at = SWAP_BE64(written_at);
-        time_passed = time(NULL) - written_at;
-        /* Strange written_at, or lease file from old version of udhcpd
-         * which had no "written_at" field? */
-        if ((uint64_t)time_passed > 12 * 60 * 60)
-                goto ret;
-        while (full_read(fd, &lease, sizeof(lease)) == sizeof(lease)) {
-                uint32_t y = ntohl(lease.lease_nip);
-                if (y >= server_config.start_ip && y <= server_config.end_ip) {
-                        signed_leasetime_t expires = ntohl(lease.expires) - (signed_leasetime_t)time_passed;
-                        uint32_t static_nip;
-                        if (expires <= 0)
-                                /* We keep expired leases: add_lease() will add
-                                 * a lease with 0 seconds remaining.
-                                 * Fewer IP address changes this way for mass reboot scenario.
-                                 */
-                                expires = 0;
-                        /* Check if there is a different static lease for this IP or MAC */
-                        static_nip = get_static_nip_by_mac(server_config.static_leases, lease.lease_mac);
-                        if (static_nip) {
-                                /* NB: we do not add lease even if static_nip == lease.lease_nip.
-                                 */
-                                continue;
-                        }
-                        if (is_nip_reserved(server_config.static_leases, lease.lease_nip))
-                                continue;
-                        /* NB: add_lease takes "relative time", IOW,
-                         * lease duration, not lease deadline. */
-                        if (add_lease(lease.lease_mac, lease.lease_nip,
-                                        expires,
-                                        lease.hostname, sizeof(lease.hostname)
-                                ) == 0
-                        ) {
-                                bb_error_msg("too many leases while loading %s", file);
-                                break;
-                        }
-#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 1
-                        i++;
-#endif
-                }
-        }
-        log1("read %d leases", i);
- ret:
-        close(fd);
-}
diff --git a/networking/udhcp/leases.c b/networking/udhcp/leases.c
deleted file mode 100644
index 6642e396d..000000000
--- a/networking/udhcp/leases.c
+++ /dev/null
@@ -1,211 +0,0 @@
-/* vi: set sw=4 ts=4: */
-/*
- * Russ Dill <Russ.Dill@asu.edu> July 2001
- *
- * Licensed under GPLv2, see file LICENSE in this source tree.
- */
-#include "common.h"
-#include "dhcpd.h"
-/* Find the oldest expired lease, NULL if there are no expired leases */
-static struct dyn_lease *oldest_expired_lease(void)
-{
-        struct dyn_lease *oldest_lease = NULL;
-        leasetime_t oldest_time = time(NULL);
-        unsigned i;
-        /* Unexpired leases have g_leases[i].expires >= current time
-         * and therefore can't ever match */
-        for (i = 0; i < server_config.max_leases; i++) {
-                if (g_leases[i].expires == 0 /* empty entry */
-                 || g_leases[i].expires < oldest_time
-                ) {
-                        oldest_time = g_leases[i].expires;
-                        oldest_lease = &g_leases[i];
-                }
-        }
-        return oldest_lease;
-}
-/* Clear out all leases with matching nonzero chaddr OR yiaddr.
- * If chaddr == NULL, this is a conflict lease.
- */
-static void clear_leases(const uint8_t *chaddr, uint32_t yiaddr)
-{
-        unsigned i;
-        for (i = 0; i < server_config.max_leases; i++) {
-                if ((chaddr && memcmp(g_leases[i].lease_mac, chaddr, 6) == 0)
-                 || (yiaddr && g_leases[i].lease_nip == yiaddr)
-                ) {
-                        memset(&g_leases[i], 0, sizeof(g_leases[i]));
-                }
-        }
-}
-/* Add a lease into the table, clearing out any old ones.
- * If chaddr == NULL, this is a conflict lease.
- */
-struct dyn_lease* FAST_FUNC add_lease(
-                const uint8_t *chaddr, uint32_t yiaddr,
-                leasetime_t leasetime,
-                const char *hostname, int hostname_len)
-{
-        struct dyn_lease *oldest;
-        /* clean out any old ones */
-        clear_leases(chaddr, yiaddr);
-        oldest = oldest_expired_lease();
-        if (oldest) {
-                memset(oldest, 0, sizeof(*oldest));
-                if (hostname) {
-                        char *p;
-                        hostname_len++; /* include NUL */
-                        if (hostname_len > sizeof(oldest->hostname))
-                                hostname_len = sizeof(oldest->hostname);
-                        p = safe_strncpy(oldest->hostname, hostname, hostname_len);
-                        /*
-                         * Sanitization (s/bad_char/./g).
-                         * The intent is not to allow only "DNS-valid" hostnames,
-                         * but merely make dumpleases output safe for shells to use.
-                         * We accept "0-9A-Za-z._-", all other chars turn to dots.
-                         */
-                        while (*p) {
-                                if (!isalnum(*p) && *p != '-' && *p != '_')
-                                        *p = '.';
-                                p++;
-                        }
-                }
-                if (chaddr)
-                        memcpy(oldest->lease_mac, chaddr, 6);
-                oldest->lease_nip = yiaddr;
-                oldest->expires = time(NULL) + leasetime;
-        }
-        return oldest;
-}
-/* True if a lease has expired */
-int FAST_FUNC is_expired_lease(struct dyn_lease *lease)
-{
-        return (lease->expires < (leasetime_t) time(NULL));
-}
-/* Find the first lease that matches MAC, NULL if no match */
-struct dyn_lease* FAST_FUNC find_lease_by_mac(const uint8_t *mac)
-{
-        unsigned i;
-        for (i = 0; i < server_config.max_leases; i++)
-                if (memcmp(g_leases[i].lease_mac, mac, 6) == 0)
-                        return &g_leases[i];
-        return NULL;
-}
-/* Find the first lease that matches IP, NULL is no match */
-struct dyn_lease* FAST_FUNC find_lease_by_nip(uint32_t nip)
-{
-        unsigned i;
-        for (i = 0; i < server_config.max_leases; i++)
-                if (g_leases[i].lease_nip == nip)
-                        return &g_leases[i];
-        return NULL;
-}
-/* Check if the IP is taken; if it is, add it to the lease table */
-static int nobody_responds_to_arp(uint32_t nip, const uint8_t *safe_mac, unsigned arpping_ms)
-{
-        struct in_addr temp;
-        int r;
-        r = arpping(nip, safe_mac,
-                        server_config.server_nip,
-                        server_config.server_mac,
-                        server_config.interface,
-                        arpping_ms);
-        if (r)
-                return r;
-        temp.s_addr = nip;
-        bb_error_msg("%s belongs to someone, reserving it for %u seconds",
-                inet_ntoa(temp), (unsigned)server_config.conflict_time);
-        add_lease(NULL, nip, server_config.conflict_time, NULL, 0);
-        return 0;
-}
-/* Find a new usable (we think) address */
-uint32_t FAST_FUNC find_free_or_expired_nip(const uint8_t *safe_mac, unsigned arpping_ms)
-{
-        uint32_t addr;
-        struct dyn_lease *oldest_lease = NULL;
-#if ENABLE_FEATURE_UDHCPD_BASE_IP_ON_MAC
-        uint32_t stop;
-        unsigned i, hash;
-        /* hash hwaddr: use the SDBM hashing algorithm.  Seems to give good
-         * dispersal even with similarly-valued "strings".
-         */
-        hash = 0;
-        for (i = 0; i < 6; i++)
-                hash += safe_mac[i] + (hash << 6) + (hash << 16) - hash;
-        /* pick a seed based on hwaddr then iterate until we find a free address. */
-        addr = server_config.start_ip
-                + (hash % (1 + server_config.end_ip - server_config.start_ip));
-        stop = addr;
-#else
-        addr = server_config.start_ip;
-#define stop (server_config.end_ip + 1)
-#endif
-        do {
-                uint32_t nip;
-                struct dyn_lease *lease;
-                /* ie, 192.168.55.0 */
-                if ((addr & 0xff) == 0)
-                        goto next_addr;
-                /* ie, 192.168.55.255 */
-                if ((addr & 0xff) == 0xff)
-                        goto next_addr;
-                nip = htonl(addr);
-                /* skip our own address */
-                if (nip == server_config.server_nip)
-                        goto next_addr;
-                /* is this a static lease addr? */
-                if (is_nip_reserved(server_config.static_leases, nip))
-                        goto next_addr;
-                lease = find_lease_by_nip(nip);
-                if (!lease) {
-//TODO: DHCP servers do not always sit on the same subnet as clients: should *ping*, not arp-ping!
-                        if (nobody_responds_to_arp(nip, safe_mac, arpping_ms))
-                                return nip;
-                } else {
-                        if (!oldest_lease || lease->expires < oldest_lease->expires)
-                                oldest_lease = lease;
-                }
- next_addr:
-                addr++;
-#if ENABLE_FEATURE_UDHCPD_BASE_IP_ON_MAC
-                if (addr > server_config.end_ip)
-                        addr = server_config.start_ip;
-#endif
-        } while (addr != stop);
-        if (oldest_lease
-         && is_expired_lease(oldest_lease)
-         && nobody_responds_to_arp(oldest_lease->lease_nip, safe_mac, arpping_ms)
-        ) {
-                return oldest_lease->lease_nip;
-        }
-        return 0;
-}
diff --git a/networking/udhcp/static_leases.c b/networking/udhcp/static_leases.c
deleted file mode 100644
index b7f9e5c59..000000000
--- a/networking/udhcp/static_leases.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/* vi: set sw=4 ts=4: */
-/*
- * Storing and retrieving data for static leases
- *
- * Wade Berrier <wberrier@myrealbox.com> September 2004
- *
- * Licensed under GPLv2, see file LICENSE in this source tree.
- */
-#include "common.h"
-#include "dhcpd.h"
-/* Takes the address of the pointer to the static_leases linked list,
- * address to a 6 byte mac address,
- * 4 byte IP address */
-void FAST_FUNC add_static_lease(struct static_lease **st_lease_pp,
-                uint8_t *mac,
-                uint32_t nip)
-{
-        struct static_lease *st_lease;
-        /* Find the tail of the list */
-        while ((st_lease = *st_lease_pp) != NULL) {
-                st_lease_pp = &st_lease->next;
-        }
-        /* Add new node */
-        *st_lease_pp = st_lease = xzalloc(sizeof(*st_lease));
-        memcpy(st_lease->mac, mac, 6);
-        st_lease->nip = nip;
-        /*st_lease->next = NULL;*/
-}
-/* Find static lease IP by mac */
-uint32_t FAST_FUNC get_static_nip_by_mac(struct static_lease *st_lease, void *mac)
-{
-        while (st_lease) {
-                if (memcmp(st_lease->mac, mac, 6) == 0)
-                        return st_lease->nip;
-                st_lease = st_lease->next;
-        }
-        return 0;
-}
-/* Check to see if an IP is reserved as a static IP */
-int FAST_FUNC is_nip_reserved(struct static_lease *st_lease, uint32_t nip)
-{
-        while (st_lease) {
-                if (st_lease->nip == nip)
-                        return 1;
-                st_lease = st_lease->next;
-        }
-        return 0;
-}
-#if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 2
-/* Print out static leases just to check what's going on */
-/* Takes the address of the pointer to the static_leases linked list */
-void FAST_FUNC log_static_leases(struct static_lease **st_lease_pp)
-{
-        struct static_lease *cur;
-        if (dhcp_verbose < 2)
-                return;
-        cur = *st_lease_pp;
-        while (cur) {
-                bb_error_msg("static lease: mac:%02x:%02x:%02x:%02x:%02x:%02x nip:%x",
-                        cur->mac[0], cur->mac[1], cur->mac[2],
-                        cur->mac[3], cur->mac[4], cur->mac[5],
-                        cur->nip
-                );
-                cur = cur->next;
-        }
-}
-#endif
diff --git a/networking/wget.c b/networking/wget.c
index c886dd391..460b4b833 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -62,9 +62,10 @@
 //config:         a helper program to talk over HTTPS.
 //config:
 //config:         OpenSSL has a simple SSL client for debug purposes.
-//config:         If you select "openssl" helper, wget will effectively call
+//config:         If you select "openssl" helper, wget will effectively run:
-//config:         "openssl s_client -quiet -connect IP:443 2>/dev/null"
+//config:         "openssl s_client -quiet -connect hostname:443
-//config:         and pipe its data through it.
+//config:         -servername hostname 2>/dev/null" and pipe its data
+//config:         through it. -servername is not used if hostname is numeric.
 //config:         Note inconvenient API: host resolution is done twice,
 //config:         and there is no guarantee openssl's idea of IPv6 address
 //config:         format is the same as ours.
@@ -99,7 +100,7 @@
 //usage:#define wget_trivial_usage
 //usage:        IF_FEATURE_WGET_LONG_OPTIONS(
-//usage:       "[-c|--continue] [-s|--spider] [-q|--quiet] [-O|--output-document FILE]\n"
+//usage:       "[-c|--continue] [--spider] [-q|--quiet] [-O|--output-document FILE]\n"
 //usage:       "        [--header 'header: value'] [-Y|--proxy on/off] [-P DIR]\n"
 /* Since we ignore these opts, we don't show them in --help */
 /* //usage:    "        [--no-check-certificate] [--no-cache] [--passive-ftp] [-t TRIES]" */
@@ -107,21 +108,23 @@
 //usage:       "        [-U|--user-agent AGENT]" IF_FEATURE_WGET_TIMEOUT(" [-T SEC]") " URL..."
 //usage:        )
 //usage:        IF_NOT_FEATURE_WGET_LONG_OPTIONS(
-//usage:       "[-csq] [-O FILE] [-Y on/off] [-P DIR] [-U AGENT]"
+//usage:       "[-cq] [-O FILE] [-Y on/off] [-P DIR] [-U AGENT]"
 //usage:                        IF_FEATURE_WGET_TIMEOUT(" [-T SEC]") " URL..."
 //usage:        )
 //usage:#define wget_full_usage "\n\n"
 //usage:       "Retrieve files via HTTP or FTP\n"
-//usage:     "\n        -s      Spider mode - only check file existence"
+//usage:        IF_FEATURE_WGET_LONG_OPTIONS(
-//usage:     "\n        -c      Continue retrieval of aborted transfer"
+//usage:     "\n        --spider        Spider mode - only check file existence"
-//usage:     "\n        -q      Quiet"
+//usage:        )
-//usage:     "\n        -P DIR  Save to DIR (default .)"
+//usage:     "\n        -c              Continue retrieval of aborted transfer"
+//usage:     "\n        -q              Quiet"
+//usage:     "\n        -P DIR          Save to DIR (default .)"
 //usage:        IF_FEATURE_WGET_TIMEOUT(
-//usage:     "\n        -T SEC  Network read timeout is SEC seconds"
+//usage:     "\n        -T SEC          Network read timeout is SEC seconds"
 //usage:        )
-//usage:     "\n        -O FILE Save to FILE ('-' for stdout)"
+//usage:     "\n        -O FILE         Save to FILE ('-' for stdout)"
-//usage:     "\n        -U STR  Use STR for User-Agent header"
+//usage:     "\n        -U STR          Use STR for User-Agent header"
-//usage:     "\n        -Y      Use proxy ('on' or 'off')"
+//usage:     "\n        -Y on/off       Use proxy"
 #include "libbb.h"
@@ -228,17 +231,17 @@ struct globals {
 /* Must match option string! */
 enum {
        WGET_OPT_CONTINUE   = (1 << 0),
-        WGET_OPT_SPIDER     = (1 << 1),
+        WGET_OPT_QUIET      = (1 << 1),
-        WGET_OPT_QUIET      = (1 << 2),
+        WGET_OPT_OUTNAME    = (1 << 2),
-        WGET_OPT_OUTNAME    = (1 << 3),
+        WGET_OPT_PREFIX     = (1 << 3),
-        WGET_OPT_PREFIX     = (1 << 4),
+        WGET_OPT_PROXY      = (1 << 4),
-        WGET_OPT_PROXY      = (1 << 5),
+        WGET_OPT_USER_AGENT = (1 << 5),
-        WGET_OPT_USER_AGENT = (1 << 6),
+        WGET_OPT_NETWORK_READ_TIMEOUT = (1 << 6),
-        WGET_OPT_NETWORK_READ_TIMEOUT = (1 << 7),
+        WGET_OPT_RETRIES    = (1 << 7),
-        WGET_OPT_RETRIES    = (1 << 8),
+        WGET_OPT_nsomething = (1 << 8),
-        WGET_OPT_PASSIVE    = (1 << 9),
+        WGET_OPT_HEADER     = (1 << 9) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
-        WGET_OPT_HEADER     = (1 << 10) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
+        WGET_OPT_POST_DATA  = (1 << 10) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
-        WGET_OPT_POST_DATA  = (1 << 11) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
+        WGET_OPT_SPIDER     = (1 << 11) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
 };
 enum {
@@ -349,6 +352,30 @@ static void set_alarm(void)
 # define clear_alarm() ((void)0)
 #endif
+#if ENABLE_FEATURE_WGET_OPENSSL
+/*
+ * is_ip_address() attempts to verify whether or not a string
+ * contains an IPv4 or IPv6 address (vs. an FQDN).  The result
+ * of inet_pton() can be used to determine this.
+ *
+ * TODO add proper error checking when inet_pton() returns -1
+ * (some form of system error has occurred, and errno is set)
+ */
+static int is_ip_address(const char *string)
+{
+        struct sockaddr_in sa;
+        int result = inet_pton(AF_INET, string, &(sa.sin_addr));
+# if ENABLE_FEATURE_IPV6
+        if (result == 0) {
+                struct sockaddr_in6 sa6;
+                result = inet_pton(AF_INET6, string, &(sa6.sin6_addr));
+        }
+# endif
+        return (result == 1);
+}
+#endif
 static FILE *open_socket(len_and_sockaddr *lsa)
 {
        int fd;
@@ -635,6 +662,7 @@ static FILE* prepare_ftp_session(FILE **dfpp, struct host_info *target, len_and_
 static int spawn_https_helper_openssl(const char *host, unsigned port)
 {
        char *allocated = NULL;
+        char *servername;
        int sp[2];
        int pid;
        IF_FEATURE_WGET_SSL_HELPER(volatile int child_failed = 0;)
@@ -645,12 +673,14 @@ static int spawn_https_helper_openssl(const char *host, unsigned port)
        if (!strchr(host, ':'))
                host = allocated = xasprintf("%s:%u", host, port);
+        servername = xstrdup(host);
+        strrchr(servername, ':')[0] = '\0';
        fflush_all();
        pid = xvfork();
        if (pid == 0) {
                /* Child */
-                char *argv[6];
+                char *argv[8];
                close(sp[0]);
                xmove_fd(sp[1], 0);
@@ -662,12 +692,22 @@ static int spawn_https_helper_openssl(const char *host, unsigned port)
                 */
                xmove_fd(2, 3);
                xopen("/dev/null", O_RDWR);
+                memset(&argv, 0, sizeof(argv));
                argv[0] = (char*)"openssl";
                argv[1] = (char*)"s_client";
                argv[2] = (char*)"-quiet";
                argv[3] = (char*)"-connect";
                argv[4] = (char*)host;
-                argv[5] = NULL;
+                /*
+                 * Per RFC 6066 Section 3, the only permitted values in the
+                 * TLS server_name (SNI) field are FQDNs (DNS hostnames).
+                 * IPv4 and IPv6 addresses, port numbers are not allowed.
+                 */
+                if (!is_ip_address(servername)) {
+                        argv[5] = (char*)"-servername";
+                        argv[6] = (char*)servername;
+                }
                BB_EXECVP(argv[0], argv);
                xmove_fd(3, 2);
 # if ENABLE_FEATURE_WGET_SSL_HELPER
@@ -680,6 +720,7 @@ static int spawn_https_helper_openssl(const char *host, unsigned port)
        }
        /* Parent */
+        free(servername);
        free(allocated);
        close(sp[1]);
 # if ENABLE_FEATURE_WGET_SSL_HELPER
@@ -1058,6 +1099,12 @@ static void download_one_url(const char *url)
                }
                fflush(sfp);
+                /* If we use SSL helper, keeping our end of the socket open for writing
+                 * makes our end (i.e. the same fd!) readable (EAGAIN instead of EOF)
+                 * even after child closes its copy of the fd.
+                 * This helps:
+                 */
+                shutdown(fileno(sfp), SHUT_WR);
                /*
                 * Retrieve HTTP response line and check for "200" status code.
@@ -1077,7 +1124,21 @@ static void download_one_url(const char *url)
                        while (gethdr(sfp) != NULL)
                                /* eat all remaining headers */;
                        goto read_response;
+                /* Success responses */
                case 200:
+                        /* fall through */
+                case 201: /* 201 Created */
+/* "The request has been fulfilled and resulted in a new resource being created" */
+                        /* Standard wget is reported to treat this as success */
+                        /* fall through */
+                case 202: /* 202 Accepted */
+/* "The request has been accepted for processing, but the processing has not been completed" */
+                        /* Treat as success: fall through */
+                case 203: /* 203 Non-Authoritative Information */
+/* "Use of this response code is not required and is only appropriate when the response would otherwise be 200 (OK)" */
+                        /* fall through */
+                case 204: /* 204 No Content */
 /*
 Response 204 doesn't say "null file", it says "metadata
 has changed but data didn't":
@@ -1102,7 +1163,6 @@ is always terminated by the first empty line after the header fields."
 However, in real world it was observed that some web servers
 (e.g. Boa/0.94.14rc21) simply use code 204 when file size is zero.
 */
-                case 204:
                        if (G.beg_range != 0) {
                                /* "Range:..." was not honored by the server.
                                 * Restart download from the beginning.
@@ -1110,11 +1170,14 @@ However, in real world it was observed that some web servers
                                reset_beg_range_to_zero();
                        }
                        break;
+                /* 205 Reset Content ?? what to do on this ??   */
                case 300:  /* redirection */
                case 301:
                case 302:
                case 303:
                        break;
                case 206: /* Partial Content */
                        if (G.beg_range != 0)
                                /* "Range:..." worked. Good. */
@@ -1231,8 +1294,6 @@ int wget_main(int argc UNUSED_PARAM, char **argv)
        static const char wget_longopts[] ALIGN1 =
                /* name, has_arg, val */
                "continue\0"         No_argument       "c"
-//FIXME: -s isn't --spider, it's --save-headers!
-                "spider\0"           No_argument       "s"
                "quiet\0"            No_argument       "q"
                "output-document\0"  Required_argument "O"
                "directory-prefix\0" Required_argument "P"
@@ -1244,6 +1305,7 @@ IF_FEATURE_WGET_TIMEOUT(
 IF_DESKTOP(     "tries\0"            Required_argument "t")
                "header\0"           Required_argument "\xff"
                "post-data\0"        Required_argument "\xfe"
+                "spider\0"           No_argument       "\xfd"
                /* Ignored (we always use PASV): */
 IF_DESKTOP(     "passive-ftp\0"      No_argument       "\xf0")
                /* Ignored (we don't do ssl) */
@@ -1275,7 +1337,7 @@ IF_DESKTOP(	"no-parent\0"        No_argument       "\xf0")
 #endif
        opt_complementary = "-1" /* at least one URL */
                IF_FEATURE_WGET_LONG_OPTIONS(":\xff::"); /* --header is a list */
-        getopt32(argv, "csqO:P:Y:U:T:+"
+        getopt32(argv, "cqO:P:Y:U:T:+"
                /*ignored:*/ "t:"
                /*ignored:*/ "n::"
                /* wget has exactly four -n<letter> opts, all of which we can ignore:
@@ -1294,6 +1356,14 @@ IF_DESKTOP(	"no-parent\0"        No_argument       "\xf0")
                IF_FEATURE_WGET_LONG_OPTIONS(, &headers_llist)
                IF_FEATURE_WGET_LONG_OPTIONS(, &G.post_data)
        );
+#if 0 /* option bits debug */
+        if (option_mask32 & WGET_OPT_RETRIES) bb_error_msg("-t NUM");
+        if (option_mask32 & WGET_OPT_nsomething) bb_error_msg("-nsomething");
+        if (option_mask32 & WGET_OPT_HEADER) bb_error_msg("--header");
+        if (option_mask32 & WGET_OPT_POST_DATA) bb_error_msg("--post-data");
+        if (option_mask32 & WGET_OPT_SPIDER) bb_error_msg("--spider");
+        exit(0);
+#endif
        argv += optind;
 #if ENABLE_FEATURE_WGET_LONG_OPTIONS
diff --git a/procps/top.c b/procps/top.c
index 73cd285f0..6f7f7d382 100644
--- a/procps/top.c
+++ b/procps/top.c
@@ -728,12 +728,6 @@ static void reset_term(void)
 {
        if (!OPT_BATCH_MODE)
                tcsetattr_stdin_TCSANOW(&initial_settings);
-        if (ENABLE_FEATURE_CLEAN_UP) {
-                clearmems();
-# if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
-                free(prev_hist);
-# endif
-        }
 }
 static void sig_catcher(int sig)
@@ -1258,5 +1252,11 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 #if ENABLE_FEATURE_USE_TERMIOS
        reset_term();
 #endif
+        if (ENABLE_FEATURE_CLEAN_UP) {
+                clearmems();
+#if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
+                free(prev_hist);
+#endif
+        }
        return EXIT_SUCCESS;
 }
diff --git a/runit/runsvdir.c b/runit/runsvdir.c
index 2b7927542..84916e929 100644
--- a/runit/runsvdir.c
+++ b/runit/runsvdir.c
@@ -181,9 +181,9 @@ static NOINLINE int do_rescan(void)
                        continue;
                /* Do we have this service listed already? */
                for (i = 0; i < svnum; i++) {
-                        if ((sv[i].ino == s.st_ino)
+                        if (sv[i].ino == s.st_ino
 #if CHECK_DEVNO_TOO
-                         && (sv[i].dev == s.st_dev)
+                         && sv[i].dev == s.st_dev
 #endif
                        ) {
                                if (sv[i].pid == 0) /* restart if it has died */
diff --git a/runit/svlogd.c b/runit/svlogd.c
index 7cae81cb2..3ed13b67b 100644
--- a/runit/svlogd.c
+++ b/runit/svlogd.c
@@ -784,7 +784,7 @@ static NOINLINE unsigned logdir_open(struct logdir *ld, const char *fn)
                        case '!':
                                if (s[1]) {
                                        free(ld->processor);
-                                        ld->processor = wstrdup(s);
+                                        ld->processor = wstrdup(&s[1]);
                                }
                                break;
                        }
diff --git a/scripts/trylink b/scripts/trylink
index 145df9959..c2a431626 100755
--- a/scripts/trylink
+++ b/scripts/trylink
@@ -46,7 +46,7 @@ try() {
 }
 check_cc() {
-    local tempname="$(mktemp)"
+    local tempname="$(mktemp tmp.XXXXXXXXXX)"
    local r
    echo "int main(int argc,char**argv){return argv?argc:0;}" >"$tempname".c
    # Can use "-o /dev/null", but older gcc tend to *unlink it* on failure! :(
@@ -61,7 +61,7 @@ check_cc() {
 }
 check_libc_is_glibc() {
-    local tempname="$(mktemp)"
+    local tempname="$(mktemp tmp.XXXXXXXXXX)"
    local r
    echo "\
        #include <stdlib.h>
diff --git a/shell/Config.src b/shell/Config.src
index b31e62dda..e4df35973 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -88,7 +88,7 @@ config FEATURE_SH_EXTRA_QUIET
 config FEATURE_SH_STANDALONE
        bool "Standalone shell"
        default n
-        depends on (HUSH || ASH) && FEATURE_PREFER_APPLETS
+        depends on (HUSH || ASH)
        help
          This option causes busybox shells to use busybox applets
          in preference to executables in the PATH whenever possible. For
@@ -121,7 +121,7 @@ config FEATURE_SH_STANDALONE
 config FEATURE_SH_NOFORK
        bool "Run 'nofork' applets directly"
        default n
-        depends on (HUSH || ASH) && FEATURE_PREFER_APPLETS
+        depends on (HUSH || ASH)
        help
          This option causes busybox shells to not execute typical
          fork/exec/wait sequence, but call <applet>_main directly,
diff --git a/shell/ash.c b/shell/ash.c
index 750ca7b6d..02e76c0ae 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -57,8 +57,18 @@
 #include <sys/utsname.h> /* for setting $HOSTNAME */
 #include "busybox.h" /* for applet_names */
-#include "unicode.h"
+#if defined(__ANDROID_API__) && __ANDROID_API__ <= 24
+/* Bionic at least up to version 24 has no glob() */
+# undef  ENABLE_ASH_INTERNAL_GLOB
+# define ENABLE_ASH_INTERNAL_GLOB 1
+#endif
+#if !ENABLE_ASH_INTERNAL_GLOB
+# include <glob.h>
+#endif
+#include "unicode.h"
 #include "shell_common.h"
 #if ENABLE_SH_MATH_SUPPORT
 # include "math.h"
@@ -104,6 +114,42 @@
 //config:         shell (by Herbert Xu), which was created by porting the 'ash' shell
 //config:         (written by Kenneth Almquist) from NetBSD.
 //config:
+//config:config ASH_OPTIMIZE_FOR_SIZE
+//config:       bool "Optimize for size instead of speed"
+//config:       default y
+//config:       depends on ASH
+//config:       help
+//config:         Compile ash for reduced size at the price of speed.
+//config:
+//config:config ASH_INTERNAL_GLOB
+//config:       bool "Use internal glob() implementation"
+//config:       default n
+//config:       depends on ASH
+//config:       help
+//config:         Do not use glob() function from libc, use internal implementation.
+//config:         Use this if you are getting "glob.h: No such file or directory"
+//config:         or similar build errors.
+//config:
+//config:config ASH_RANDOM_SUPPORT
+//config:       bool "Pseudorandom generator and $RANDOM variable"
+//config:       default y
+//config:       depends on ASH
+//config:       help
+//config:         Enable pseudorandom generator and dynamic variable "$RANDOM".
+//config:         Each read of "$RANDOM" will generate a new pseudorandom value.
+//config:         You can reset the generator by using a specified start value.
+//config:         After "unset RANDOM" the generator will switch off and this
+//config:         variable will no longer have special treatment.
+//config:
+//config:config ASH_EXPAND_PRMT
+//config:       bool "Expand prompt string"
+//config:       default y
+//config:       depends on ASH
+//config:       help
+//config:         "PS#" may contain volatile content, such as backquote commands.
+//config:         This option recreates the prompt string from the environment
+//config:         variable each time it is displayed.
+//config:
 //config:config ASH_BASH_COMPAT
 //config:       bool "bash-compatible extensions"
 //config:       default y
@@ -183,33 +229,6 @@
 //config:       help
 //config:         Enable "check for new mail" function in the ash shell.
 //config:
-//config:config ASH_OPTIMIZE_FOR_SIZE
-//config:       bool "Optimize for size instead of speed"
-//config:       default y
-//config:       depends on ASH
-//config:       help
-//config:         Compile ash for reduced size at the price of speed.
-//config:
-//config:config ASH_RANDOM_SUPPORT
-//config:       bool "Pseudorandom generator and $RANDOM variable"
-//config:       default y
-//config:       depends on ASH
-//config:       help
-//config:         Enable pseudorandom generator and dynamic variable "$RANDOM".
-//config:         Each read of "$RANDOM" will generate a new pseudorandom value.
-//config:         You can reset the generator by using a specified start value.
-//config:         After "unset RANDOM" the generator will switch off and this
-//config:         variable will no longer have special treatment.
-//config:
-//config:config ASH_EXPAND_PRMT
-//config:       bool "Expand prompt string"
-//config:       default y
-//config:       depends on ASH
-//config:       help
-//config:         "PS#" may contain volatile content, such as backquote commands.
-//config:         This option recreates the prompt string from the environment
-//config:         variable each time it is displayed.
-//config:
 //applet:IF_ASH(APPLET(ash, BB_DIR_BIN, BB_SUID_DROP))
 //applet:IF_FEATURE_SH_IS_ASH(APPLET_ODDNAME(sh, ash, BB_DIR_BIN, BB_SUID_DROP, sh))
@@ -324,8 +343,10 @@ struct jmploc {
 };
 struct globals_misc {
-        /* pid of main shell */
+        uint8_t exitstatus;     /* exit status of last command */
-        int rootpid;
+        uint8_t back_exitstatus;/* exit status of backquoted command */
+        smallint job_warning;   /* user was warned about stopped jobs (can be 2, 1 or 0). */
+        int rootpid;            /* pid of main shell */
        /* shell level: 0 for the main shell, 1 for its children, and so on */
        int shlvl;
 #define rootshell (!shlvl)
@@ -393,7 +414,7 @@ struct globals_misc {
 #define S_DFL      1            /* default signal handling (SIG_DFL) */
 #define S_CATCH    2            /* signal is caught */
 #define S_IGN      3            /* signal is ignored (SIG_IGN) */
-#define S_HARD_IGN 4            /* signal is ignored permenantly */
+#define S_HARD_IGN 4            /* signal is ignored permanently */
        /* indicates specified signal received */
        uint8_t gotsig[NSIG - 1]; /* offset by 1: "signal" 0 is meaningless */
@@ -406,10 +427,12 @@ struct globals_misc {
        random_t random_gen;
 #endif
        pid_t backgndpid;        /* pid of last background process */
-        smallint job_warning;    /* user was warned about stopped jobs (can be 2, 1 or 0). */
 };
 extern struct globals_misc *const ash_ptr_to_globals_misc;
 #define G_misc (*ash_ptr_to_globals_misc)
+#define exitstatus        (G_misc.exitstatus )
+#define back_exitstatus   (G_misc.back_exitstatus )
+#define job_warning       (G_misc.job_warning)
 #define rootpid     (G_misc.rootpid    )
 #define shlvl       (G_misc.shlvl      )
 #define minusc      (G_misc.minusc     )
@@ -431,7 +454,6 @@ extern struct globals_misc *const ash_ptr_to_globals_misc;
 #define trap_ptr    (G_misc.trap_ptr   )
 #define random_gen  (G_misc.random_gen )
 #define backgndpid  (G_misc.backgndpid )
-#define job_warning (G_misc.job_warning)
 #define INIT_G_misc() do { \
        (*(struct globals_misc**)&ash_ptr_to_globals_misc) = xzalloc(sizeof(G_misc)); \
        barrier(); \
@@ -460,12 +482,11 @@ static void trace_vprintf(const char *fmt, va_list va);
 /* ============ Utility functions */
-#define xbarrier() do { __asm__ __volatile__ ("": : :"memory"); } while (0)
 #define is_name(c)      ((c) == '_' || isalpha((unsigned char)(c)))
 #define is_in_name(c)   ((c) == '_' || isalnum((unsigned char)(c)))
-static int isdigit_str9(const char *str)
+static int
+isdigit_str9(const char *str)
 {
        int maxlen = 9 + 1; /* max 9 digits: 999999999 */
        while (--maxlen && isdigit(*str))
@@ -473,7 +494,8 @@ static int isdigit_str9(const char *str)
        return (*str == '\0');
 }
-static const char *var_end(const char *var)
+static const char *
+var_end(const char *var)
 {
        while (*var)
                if (*var++ == '=')
@@ -494,7 +516,7 @@ static void exitshell(void) NORETURN;
 */
 #define INT_OFF do { \
        suppress_int++; \
-        xbarrier(); \
+        barrier(); \
 } while (0)
 /*
@@ -522,7 +544,7 @@ raise_exception(int e)
 #endif
 /*
- * Called from trap.c when a SIGINT is received.  (If the user specifies
+ * Called when a SIGINT is received.  (If the user specifies
 * that SIGINT is to be trapped or ignored using the trap builtin, then
 * this routine is not called.)  Suppressint is nonzero when interrupts
 * are held using the INT_OFF macro.  (The test for iflag is just
@@ -549,6 +571,8 @@ raise_interrupt(void)
                }
                ex_type = EXINT;
        }
+        /* bash: ^C even on empty command line sets $? */
+        exitstatus = SIGINT + 128;
        raise_exception(ex_type);
        /* NOTREACHED */
 }
@@ -562,7 +586,7 @@ raise_interrupt(void)
 static IF_ASH_OPTIMIZE_FOR_SIZE(inline) void
 int_on(void)
 {
-        xbarrier();
+        barrier();
        if (--suppress_int == 0 && pending_int) {
                raise_interrupt();
        }
@@ -571,7 +595,7 @@ int_on(void)
 static IF_ASH_OPTIMIZE_FOR_SIZE(inline) void
 force_int_on(void)
 {
-        xbarrier();
+        barrier();
        suppress_int = 0;
        if (pending_int)
                raise_interrupt();
@@ -581,7 +605,7 @@ force_int_on(void)
 #define SAVE_INT(v) ((v) = suppress_int)
 #define RESTORE_INT(v) do { \
-        xbarrier(); \
+        barrier(); \
        suppress_int = (v); \
        if (suppress_int == 0 && pending_int) \
                raise_interrupt(); \
@@ -1237,6 +1261,12 @@ struct strpush {
        struct alias *ap;       /* if push was associated with an alias */
 #endif
        char *string;           /* remember the string since it may change */
+        /* Remember last two characters for pungetc. */
+        int lastc[2];
+        /* Number of outstanding calls to pungetc. */
+        int unget;
 };
 struct parsefile {
@@ -1249,6 +1279,12 @@ struct parsefile {
        char *buf;              /* input buffer */
        struct strpush *strpush; /* for pushing strings at this level */
        struct strpush basestrpush; /* so pushing one is fast */
+        /* Remember last two characters for pungetc. */
+        int lastc[2];
+        /* Number of outstanding calls to pungetc. */
+        int unget;
 };
 static struct parsefile basepf;        /* top level input file */
@@ -1256,7 +1292,6 @@ static struct parsefile *g_parsefile = &basepf;  /* current input file */
 static int startlinno;                 /* line # where last token started */
 static char *commandname;              /* currently executing command */
 static struct strlist *cmdenviron;     /* environment for builtin command */
-static uint8_t exitstatus;             /* exit status of last command */
 /* ============ Message printing */
@@ -1428,13 +1463,11 @@ struct stackmark {
        struct stack_block *stackp;
        char *stacknxt;
        size_t stacknleft;
-        struct stackmark *marknext;
 };
 struct globals_memstack {
        struct stack_block *g_stackp; // = &stackbase;
-        struct stackmark *markp;
        char *g_stacknxt; // = stackbase.space;
        char *sstrend; // = stackbase.space + MINSIZE;
        size_t g_stacknleft; // = MINSIZE;
@@ -1444,7 +1477,6 @@ struct globals_memstack {
 extern struct globals_memstack *const ash_ptr_to_globals_memstack;
 #define G_memstack (*ash_ptr_to_globals_memstack)
 #define g_stackp     (G_memstack.g_stackp    )
-#define markp        (G_memstack.markp       )
 #define g_stacknxt   (G_memstack.g_stacknxt  )
 #define sstrend      (G_memstack.sstrend     )
 #define g_stacknleft (G_memstack.g_stacknleft)
@@ -1528,20 +1560,33 @@ stunalloc(void *p)
 * Like strdup but works with the ash stack.
 */
 static char *
-ststrdup(const char *p)
+sstrdup(const char *p)
 {
        size_t len = strlen(p) + 1;
        return memcpy(stalloc(len), p, len);
 }
 static void
-setstackmark(struct stackmark *mark)
+grabstackblock(size_t len)
+{
+        len = SHELL_ALIGN(len);
+        g_stacknxt += len;
+        g_stacknleft -= len;
+}
+static void
+pushstackmark(struct stackmark *mark, size_t len)
 {
        mark->stackp = g_stackp;
        mark->stacknxt = g_stacknxt;
        mark->stacknleft = g_stacknleft;
-        mark->marknext = markp;
+        grabstackblock(len);
-        markp = mark;
+}
+static void
+setstackmark(struct stackmark *mark)
+{
+        pushstackmark(mark, g_stacknxt == g_stackp->space && g_stackp != &stackbase);
 }
 static void
@@ -1553,7 +1598,6 @@ popstackmark(struct stackmark *mark)
                return;
        INT_OFF;
-        markp = mark->marknext;
        while (g_stackp != mark->stackp) {
                sp = g_stackp;
                g_stackp = sp->prev;
@@ -1586,14 +1630,11 @@ growstackblock(void)
                newlen += 128;
        if (g_stacknxt == g_stackp->space && g_stackp != &stackbase) {
-                struct stack_block *oldstackp;
-                struct stackmark *xmark;
                struct stack_block *sp;
                struct stack_block *prevstackp;
                size_t grosslen;
                INT_OFF;
-                oldstackp = g_stackp;
                sp = g_stackp;
                prevstackp = sp->prev;
                grosslen = newlen + sizeof(struct stack_block) - MINSIZE;
@@ -1603,18 +1644,6 @@ growstackblock(void)
                g_stacknxt = sp->space;
                g_stacknleft = newlen;
                sstrend = sp->space + newlen;
-                /*
-                 * Stack marks pointing to the start of the old block
-                 * must be relocated to point to the new block
-                 */
-                xmark = markp;
-                while (xmark != NULL && xmark->stackp == oldstackp) {
-                        xmark->stackp = g_stackp;
-                        xmark->stacknxt = g_stacknxt;
-                        xmark->stacknleft = g_stacknleft;
-                        xmark = xmark->marknext;
-                }
                INT_ON;
        } else {
                char *oldspace = g_stacknxt;
@@ -1627,14 +1656,6 @@ growstackblock(void)
        }
 }
-static void
-grabstackblock(size_t len)
-{
-        len = SHELL_ALIGN(len);
-        g_stacknxt += len;
-        g_stacknleft -= len;
-}
 /*
 * The following routines are somewhat easier to use than the above.
 * The user declares a variable of type STACKSTR, which may be declared
@@ -1671,7 +1692,7 @@ static char *
 makestrspace(size_t newlen, char *p)
 {
        size_t len = p - g_stacknxt;
-        size_t size = stackblocksize();
+        size_t size;
        for (;;) {
                size_t nleft;
@@ -1990,7 +2011,7 @@ static const struct {
        { VSTRFIXED|VTEXTFIXED       , "PS2=> "    , NULL            },
        { VSTRFIXED|VTEXTFIXED       , "PS4=+ "    , NULL            },
 #if ENABLE_ASH_GETOPTS
-        { VSTRFIXED|VTEXTFIXED       , "OPTIND=1"  , getoptsreset    },
+        { VSTRFIXED|VTEXTFIXED       , defoptindvar, getoptsreset    },
 #endif
 #if ENABLE_ASH_RANDOM_SUPPORT
        { VSTRFIXED|VTEXTFIXED|VUNSET|VDYNAMIC, "RANDOM", change_random },
@@ -2193,7 +2214,8 @@ lookupvar(const char *name)
        return NULL;
 }
-static void reinit_unicode_for_ash(void)
+static void
+reinit_unicode_for_ash(void)
 {
        /* Unicode support should be activated even if LANG is set
         * _during_ shell execution, not only if it was set when
@@ -2560,8 +2582,7 @@ setprompt_if(smallint do_set, int whichprompt)
                prompt = nullstr;
        }
 #if ENABLE_ASH_EXPAND_PRMT
-        setstackmark(&smark);
+        pushstackmark(&smark, stackblocksize());
-        stalloc(stackblocksize());
 #endif
        putprompt(expandstr(prompt));
 #if ENABLE_ASH_EXPAND_PRMT
@@ -2704,7 +2725,7 @@ updatepwd(const char *dir)
        char *cdcomppath;
        const char *lim;
-        cdcomppath = ststrdup(dir);
+        cdcomppath = sstrdup(dir);
        STARTSTACKSTR(new);
        if (*dir != '/') {
                if (curdir == nullstr)
@@ -3000,18 +3021,27 @@ enum {
 static int
 SIT(int c, int syntax)
 {
-        static const char spec_symbls[] ALIGN1 = "\t\n !\"$&'()*-/:;<=>?[\\]`|}~";
+        /* Used to also have '/' in this string: "\t\n !\"$&'()*-/:;<=>?[\\]`|}~" */
+        static const char spec_symbls[] ALIGN1 = "\t\n !\"$&'()*-:;<=>?[\\]`|}~";
+        /*
+         * This causes '/' to be prepended with CTLESC in dquoted string,
+         * making "./file"* treated incorrectly because we feed
+         * ".\/file*" string to glob(), confusing it (see expandmeta func).
+         * The "homegrown" glob implementation is okay with that,
+         * but glibc one isn't. With '/' always treated as CWORD,
+         * both work fine.
+         */
 # if ENABLE_ASH_ALIAS
        static const uint8_t syntax_index_table[] ALIGN1 = {
                1, 2, 1, 3, 4, 5, 1, 6,         /* "\t\n !\"$&'" */
-                7, 8, 3, 3, 3, 3, 1, 1,         /* "()*-/:;<" */
+                7, 8, 3, 3,/*3,*/3, 1, 1,       /* "()*-/:;<" */
                3, 1, 3, 3, 9, 3, 10, 1,        /* "=>?[\\]`|" */
                11, 3                           /* "}~" */
        };
 # else
        static const uint8_t syntax_index_table[] ALIGN1 = {
                0, 1, 0, 2, 3, 4, 0, 5,         /* "\t\n !\"$&'" */
-                6, 7, 2, 2, 2, 2, 0, 0,         /* "()*-/:;<" */
+                6, 7, 2, 2,/*2,*/2, 0, 0,       /* "()*-/:;<" */
                2, 0, 2, 2, 8, 2, 9, 0,         /* "=>?[\\]`|" */
                10, 2                           /* "}~" */
        };
@@ -3093,7 +3123,8 @@ static const uint8_t syntax_index_table[] ALIGN1 = {
        /*  44  "," */ CWORD_CWORD_CWORD_CWORD,
        /*  45  "-" */ CWORD_CCTL_CCTL_CWORD,
        /*  46  "." */ CWORD_CWORD_CWORD_CWORD,
-        /*  47  "/" */ CWORD_CCTL_CCTL_CWORD,
+/* "/" was CWORD_CCTL_CCTL_CWORD, see comment in SIT() function why this is changed: */
+        /*  47  "/" */ CWORD_CWORD_CWORD_CWORD,
        /*  48  "0" */ CWORD_CWORD_CWORD_CWORD,
        /*  49  "1" */ CWORD_CWORD_CWORD_CWORD,
        /*  50  "2" */ CWORD_CWORD_CWORD_CWORD,
@@ -3335,7 +3366,8 @@ static struct alias **atab; // [ATABSIZE];
 static struct alias **
-__lookupalias(const char *name) {
+__lookupalias(const char *name)
+{
        unsigned int hashval;
        struct alias **app;
        const char *p;
@@ -3517,8 +3549,6 @@ unaliascmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 #endif /* ASH_ALIAS */
-/* ============ jobs.c */
 /* Mode argument to forkshell.  Don't change FORK_FG or FORK_BG. */
 #define FORK_FG    0
 #define FORK_BG    1
@@ -3842,7 +3872,7 @@ getjob(const char *name, int getctl)
        if (is_number(p)) {
                num = atoi(p);
-                if (num <= njobs) {
+                if (num > 0 && num <= njobs) {
                        jp = jobtab + num - 1;
                        if (jp->used)
                                goto gotit;
@@ -5419,6 +5449,19 @@ openredirect(union node *redir)
        char *fname;
        int f;
+        switch (redir->nfile.type) {
+/* Can't happen, our single caller does this itself */
+//      case NTOFD:
+//      case NFROMFD:
+//              return -1;
+        case NHERE:
+        case NXHERE:
+                return openhere(redir);
+        }
+        /* For N[X]HERE, reading redir->nfile.expfname would touch beyond
+         * allocated space. Do it only when we know it is safe.
+         */
        fname = redir->nfile.expfname;
 #if ENABLE_PLATFORM_MINGW32
        /* Support for /dev/null */
@@ -5445,7 +5488,12 @@ openredirect(union node *redir)
                        break;
        }
 #endif
        switch (redir->nfile.type) {
+        default:
+#if DEBUG
+                abort();
+#endif
        case NFROM:
                f = open(fname, O_RDONLY);
                if (f < 0)
@@ -5481,20 +5529,6 @@ openredirect(union node *redir)
                lseek(f, 0, SEEK_END);
 #endif
                break;
-        default:
-#if DEBUG
-                abort();
-#endif
-                /* Fall through to eliminate warning. */
-/* Our single caller does this itself */
-//      case NTOFD:
-//      case NFROMFD:
-//              f = -1;
-//              break;
-        case NHERE:
-        case NXHERE:
-                f = openhere(redir);
-                break;
        }
        return f;
@@ -5548,7 +5582,8 @@ struct redirtab {
 };
 #define redirlist (G_var.redirlist)
-static int need_to_remember(struct redirtab *rp, int fd)
+static int
+need_to_remember(struct redirtab *rp, int fd)
 {
        int i;
@@ -5565,7 +5600,8 @@ static int need_to_remember(struct redirtab *rp, int fd)
 }
 /* "hidden" fd is a fd used to read scripts, or a copy of such */
-static int is_hidden_fd(struct redirtab *rp, int fd)
+static int
+is_hidden_fd(struct redirtab *rp, int fd)
 {
        int i;
        struct parsefile *pf;
@@ -5979,7 +6015,6 @@ rmescapes(char *str, int flag)
        while (*p) {
                if ((unsigned char)*p == CTLQUOTEMARK) {
 // Note: both inquotes and protect_against_glob only affect whether
-// CTLESC,<ch> gets converted to <ch> or to \<ch>
                        inquotes = ~inquotes;
                        p++;
                        protect_against_glob = globbing;
@@ -5987,6 +6022,10 @@ rmescapes(char *str, int flag)
                }
                if ((unsigned char)*p == CTLESC) {
                        p++;
+#if DEBUG
+                        if (*p == '\0')
+                                ash_msg_and_raise_error("CTLESC at EOL (shouldn't happen)");
+#endif
                        if (protect_against_glob) {
                                *q++ = '\\';
                        }
@@ -6043,11 +6082,14 @@ memtodest(const char *p, size_t len, int syntax, int quotes)
                unsigned char c = *p++;
                if (c) {
                        int n = SIT(c, syntax);
-                        if ((quotes & QUOTES_ESC) &&
+                        if ((quotes & QUOTES_ESC)
-                                        ((n == CCTL) ||
+                         && ((n == CCTL)
-                                        (((quotes & EXP_FULL) || syntax != BASESYNTAX) &&
+                            ||  (((quotes & EXP_FULL) || syntax != BASESYNTAX)
-                                        n == CBACK)))
+                                && n == CBACK)
+                                )
+                        ) {
                                USTPUTC(CTLESC, q);
+                        }
                } else if (!(quotes & QUOTES_KEEPNUL))
                        continue;
                USTPUTC(c, q);
@@ -6188,9 +6230,8 @@ struct backcmd {                /* result of evalbackcmd */
 };
 /* These forward decls are needed to use "eval" code for backticks handling: */
-static uint8_t back_exitstatus; /* exit status of backquoted command */
 #define EV_EXIT 01              /* exit after evaluating tree */
-static void evaltree(union node *, int);
+static int evaltree(union node *, int);
 static void FAST_FUNC
 evalbackcmd(union node *n, struct backcmd *result)
@@ -6262,10 +6303,8 @@ expbackq(union node *cmd, int flag)
        struct stackmark smark;
        INT_OFF;
-        setstackmark(&smark);
+        startloc = expdest - (char *)stackblock();
-        dest = expdest;
+        pushstackmark(&smark, startloc);
-        startloc = dest - (char *)stackblock();
-        grabstackstr(dest);
        evalbackcmd(cmd, &in);
        popstackmark(&smark);
@@ -6681,6 +6720,8 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
 #if ENABLE_ASH_BASH_COMPAT
        case VSSUBSTR:
+//TODO: support more general format ${v:EXPR:EXPR},
+// where EXPR follows $(()) rules
                loc = str = stackblock() + strloc;
                /* Read POS in ${var:POS:LEN} */
                pos = atoi(loc); /* number(loc) errors out on "1:4" */
@@ -6791,7 +6832,8 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                char *idx, *end;
                if (!repl) {
-                        if ((repl=strchr(str, CTLESC)))
+                        repl = strchr(str, CTLESC);
+                        if (repl)
                                *repl++ = '\0';
                        else
                                repl = nullstr;
@@ -6924,20 +6966,21 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
 * ash -c 'echo ${#1#}'  name:'1=#'
 */
 static NOINLINE ssize_t
-varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
+varvalue(char *name, int varflags, int flags, struct strlist *var_str_list, int *quotedp)
 {
        const char *p;
        int num;
        int i;
        ssize_t len = 0;
        int sep;
-        int quoted = flags & EXP_QUOTED;
+        int quoted = *quotedp;
        int subtype = varflags & VSTYPE;
        int discard = subtype == VSPLUS || subtype == VSLENGTH;
        int quotes = (discard ? 0 : (flags & QUOTES_ESC)) | QUOTES_KEEPNUL;
-        int syntax = quoted ? DQSYNTAX : BASESYNTAX;
+        int syntax;
-        sep = quoted ? ((flags & EXP_FULL) << CHAR_BIT) : 0;
+        sep = (flags & EXP_FULL) << CHAR_BIT;
+        syntax = quoted ? DQSYNTAX : BASESYNTAX;
        switch (*name) {
        case '$':
@@ -6971,21 +7014,21 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
                        raise_error_syntax("bad substitution");
 #endif
                break;
-        case '@': {
+        case '@':
+                if (quoted && sep)
+                        goto param;
+                /* fall through */
+        case '*': {
                char **ap;
                char sepc;
-                if (quoted && (flags & EXP_FULL)) {
+                if (quoted)
-                        /* note: this is not meant as PEOF value */
+                        sep = 0;
-                        sep = 1 << CHAR_BIT;
+                sep |= ifsset() ? ifsval()[0] : ' ';
-                        goto param;
-                }
-                /* fall through */
-        case '*':
-                sep = ifsset() ? (unsigned char)(ifsval()[0]) : ' ';
 param:
-                ap = shellparam.p;
                sepc = sep;
+                *quotedp = !sepc;
+                ap = shellparam.p;
                if (!ap)
                        return -1;
                while ((p = *ap++) != NULL) {
@@ -6997,7 +7040,7 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
                        }
                }
                break;
-        } /* case '@' and '*' */
+        } /* case '*' */
        case '0':
        case '1':
        case '2':
@@ -7069,7 +7112,7 @@ varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
 * input string.
 */
 static char *
-evalvar(char *p, int flags, struct strlist *var_str_list)
+evalvar(char *p, int flag, struct strlist *var_str_list)
 {
        char varflags;
        char subtype;
@@ -7082,14 +7125,14 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
        varflags = (unsigned char) *p++;
        subtype = varflags & VSTYPE;
-        quoted = flags & EXP_QUOTED;
+        quoted = flag & EXP_QUOTED;
        var = p;
        easy = (!quoted || (*var == '@' && shellparam.nparam));
        startloc = expdest - (char *)stackblock();
        p = strchr(p, '=') + 1; //TODO: use var_end(p)?
 again:
-        varlen = varvalue(var, varflags, flags, var_str_list);
+        varlen = varvalue(var, varflags, flag, var_str_list, &quoted);
        if (varflags & VSNUL)
                varlen--;
@@ -7103,36 +7146,27 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                if (varlen < 0) {
                        argstr(
                                p,
-                                flags | EXP_TILDE | EXP_WORD,
+                                flag | EXP_TILDE | EXP_WORD,
                                var_str_list
                        );
                        goto end;
                }
-                if (easy)
+                goto record;
-                        goto record;
-                goto end;
        }
        if (subtype == VSASSIGN || subtype == VSQUESTION) {
-                if (varlen < 0) {
+                if (varlen >= 0)
-                        if (subevalvar(p, var, /* strloc: */ 0,
-                                        subtype, startloc, varflags,
-                                        /* quotes: */ flags & ~QUOTES_ESC,
-                                        var_str_list)
-                        ) {
-                                varflags &= ~VSNUL;
-                                /*
-                                 * Remove any recorded regions beyond
-                                 * start of variable
-                                 */
-                                removerecordregions(startloc);
-                                goto again;
-                        }
-                        goto end;
-                }
-                if (easy)
                        goto record;
-                goto end;
+                subevalvar(p, var, 0, subtype, startloc, varflags,
+                           flag & ~QUOTES_ESC, var_str_list);
+                varflags &= ~VSNUL;
+                /*
+                 * Remove any recorded regions beyond
+                 * start of variable
+                 */
+                removerecordregions(startloc);
+                goto again;
        }
        if (varlen < 0 && uflag)
@@ -7144,8 +7178,10 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
        }
        if (subtype == VSNORMAL) {
-                if (easy)
+ record:
-                        goto record;
+                if (!easy)
+                        goto end;
+                recordregion(startloc, expdest - (char *)stackblock(), quoted);
                goto end;
        }
@@ -7174,7 +7210,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                STPUTC('\0', expdest);
                patloc = expdest - (char *)stackblock();
                if (NULL == subevalvar(p, /* varname: */ NULL, patloc, subtype,
-                                startloc, varflags, flags, var_str_list)) {
+                                startloc, varflags, flag, var_str_list)) {
                        int amount = expdest - (
                                (char *)stackblock() + patloc - 1
                        );
@@ -7182,8 +7218,7 @@ evalvar(char *p, int flags, struct strlist *var_str_list)
                }
                /* Remove any recorded regions beyond start of variable */
                removerecordregions(startloc);
- record:
+                goto record;
-                recordregion(startloc, expdest - (char *)stackblock(), quoted);
        }
 end:
@@ -7327,11 +7362,90 @@ addfname(const char *name)
        struct strlist *sp;
        sp = stzalloc(sizeof(*sp));
-        sp->text = ststrdup(name);
+        sp->text = sstrdup(name);
        *exparg.lastp = sp;
        exparg.lastp = &sp->next;
 }
+/* If we want to use glob() from libc... */
+#if !ENABLE_ASH_INTERNAL_GLOB
+/* Add the result of glob() to the list */
+static void
+addglob(const glob_t *pglob)
+{
+        char **p = pglob->gl_pathv;
+        do {
+                addfname(*p);
+        } while (*++p);
+}
+static void
+expandmeta(struct strlist *str /*, int flag*/)
+{
+        /* TODO - EXP_REDIR */
+        while (str) {
+                char *p;
+                glob_t pglob;
+                int i;
+                if (fflag)
+                        goto nometa;
+                INT_OFF;
+                p = preglob(str->text, RMESCAPE_ALLOC | RMESCAPE_HEAP);
+// GLOB_NOMAGIC (GNU): if no *?[ chars in pattern, return it even if no match
+// GLOB_NOCHECK: if no match, return unchanged pattern (sans \* escapes?)
+//
+// glibc 2.24.90 glob(GLOB_NOMAGIC) does not remove backslashes used for escaping:
+// if you pass it "file\?", it returns "file\?", not "file?", if no match.
+// Which means you need to unescape the string, right? Not so fast:
+// if there _is_ a file named "file\?" (with backslash), it is returned
+// as "file\?" too (whichever pattern you used to find it, say, "file*").
+// You DONT KNOW by looking at the result whether you need to unescape it.
+//
+// Worse, globbing of "file\?" in a directory with two files, "file?" and "file\?",
+// returns "file\?" - which is WRONG: "file\?" pattern matches "file?" file.
+// Without GLOB_NOMAGIC, this works correctly ("file?" is returned as a match).
+// With GLOB_NOMAGIC | GLOB_NOCHECK, this also works correctly.
+//              i = glob(p, GLOB_NOMAGIC | GLOB_NOCHECK, NULL, &pglob);
+//              i = glob(p, GLOB_NOMAGIC, NULL, &pglob);
+                i = glob(p, 0, NULL, &pglob);
+                //bb_error_msg("glob('%s'):%d '%s'...", p, i, pglob.gl_pathv ? pglob.gl_pathv[0] : "-");
+                if (p != str->text)
+                        free(p);
+                switch (i) {
+                case 0:
+#if 0 // glibc 2.24.90 bug? Patterns like "*/file", when match, don't set GLOB_MAGCHAR
+                        /* GLOB_MAGCHAR is set if *?[ chars were seen (GNU) */
+                        if (!(pglob.gl_flags & GLOB_MAGCHAR))
+                                goto nometa2;
+#endif
+                        addglob(&pglob);
+                        globfree(&pglob);
+                        INT_ON;
+                        break;
+                case GLOB_NOMATCH:
+ //nometa2:
+                        globfree(&pglob);
+                        INT_ON;
+ nometa:
+                        *exparg.lastp = str;
+                        rmescapes(str->text, 0);
+                        exparg.lastp = &str->next;
+                        break;
+                default:        /* GLOB_NOSPACE */
+                        globfree(&pglob);
+                        INT_ON;
+                        ash_msg_and_raise_error(bb_msg_memory_exhausted);
+                }
+                str = str->next;
+        }
+}
+#else
+/* ENABLE_ASH_INTERNAL_GLOB: Homegrown globbing code. (dash also has both, uses homegrown one.) */
 /*
 * Do metacharacter (i.e. *, ?, [...]) expansion.
 */
@@ -7535,7 +7649,8 @@ expandmeta(struct strlist *str /*, int flag*/)
                p = preglob(str->text, RMESCAPE_ALLOC | RMESCAPE_HEAP);
                {
                        int i = strlen(str->text);
-                        expdir = ckmalloc(i < 2048 ? 2048 : i); /* XXX */
+//BUGGY estimation of how long expanded name can be
+                        expdir = ckmalloc(i < 2048 ? 2048 : i+1);
                }
                expmeta(expdir, expdir, p);
                free(expdir);
@@ -7560,6 +7675,7 @@ expandmeta(struct strlist *str /*, int flag*/)
                str = str->next;
        }
 }
+#endif /* ENABLE_ASH_INTERNAL_GLOB */
 /*
 * Perform variable substitution and command substitution on an argument,
@@ -8126,49 +8242,86 @@ enum {
 };
 typedef smallint token_id_t;
-/* first char is indicating which tokens mark the end of a list */
+/* Nth bit indicates if token marks the end of a list */
+enum {
+        tokendlist = 0
+        /*  0 */ | (1u << TEOF)
+        /*  1 */ | (0u << TNL)
+        /*  2 */ | (0u << TREDIR)
+        /*  3 */ | (0u << TWORD)
+        /*  4 */ | (0u << TSEMI)
+        /*  5 */ | (0u << TBACKGND)
+        /*  6 */ | (0u << TAND)
+        /*  7 */ | (0u << TOR)
+        /*  8 */ | (0u << TPIPE)
+        /*  9 */ | (0u << TLP)
+        /* 10 */ | (1u << TRP)
+        /* 11 */ | (1u << TENDCASE)
+        /* 12 */ | (1u << TENDBQUOTE)
+        /* 13 */ | (0u << TNOT)
+        /* 14 */ | (0u << TCASE)
+        /* 15 */ | (1u << TDO)
+        /* 16 */ | (1u << TDONE)
+        /* 17 */ | (1u << TELIF)
+        /* 18 */ | (1u << TELSE)
+        /* 19 */ | (1u << TESAC)
+        /* 20 */ | (1u << TFI)
+        /* 21 */ | (0u << TFOR)
+#if ENABLE_ASH_BASH_COMPAT
+        /* 22 */ | (0u << TFUNCTION)
+#endif
+        /* 23 */ | (0u << TIF)
+        /* 24 */ | (0u << TIN)
+        /* 25 */ | (1u << TTHEN)
+        /* 26 */ | (0u << TUNTIL)
+        /* 27 */ | (0u << TWHILE)
+        /* 28 */ | (0u << TBEGIN)
+        /* 29 */ | (1u << TEND)
+        , /* thus far 29 bits used */
+};
 static const char *const tokname_array[] = {
-        "\1end of file",
+        "end of file",
-        "\0newline",
+        "newline",
-        "\0redirection",
+        "redirection",
-        "\0word",
+        "word",
-        "\0;",
+        ";",
-        "\0&",
+        "&",
-        "\0&&",
+        "&&",
-        "\0||",
+        "||",
-        "\0|",
+        "|",
-        "\0(",
+        "(",
-        "\1)",
+        ")",
-        "\1;;",
+        ";;",
-        "\1`",
+        "`",
 #define KWDOFFSET 13
        /* the following are keywords */
-        "\0!",
+        "!",
-        "\0case",
+        "case",
-        "\1do",
+        "do",
-        "\1done",
+        "done",
-        "\1elif",
+        "elif",
-        "\1else",
+        "else",
-        "\1esac",
+        "esac",
-        "\1fi",
+        "fi",
-        "\0for",
+        "for",
 #if ENABLE_ASH_BASH_COMPAT
-        "\0function",
+        "function",
-#endif
+#endif
-        "\0if",
+        "if",
-        "\0in",
+        "in",
-        "\1then",
+        "then",
-        "\0until",
+        "until",
-        "\0while",
+        "while",
-        "\0{",
+        "{",
-        "\1}",
+        "}",
 };
 /* Wrapper around strcmp for qsort/bsearch/... */
 static int
 pstrcmp(const void *a, const void *b)
 {
-        return strcmp((char*) a, (*(char**) b) + 1);
+        return strcmp((char*)a, *(char**)b);
 }
 static const char *const *
@@ -8297,9 +8450,45 @@ typecmd(int argc UNUSED_PARAM, char **argv)
 }
 #if ENABLE_ASH_CMDCMD
+/* Is it "command [-p] PROG ARGS" bltin, no other opts? Return ptr to "PROG" if yes */
+static char **
+parse_command_args(char **argv, const char **path)
+{
+        char *cp, c;
+        for (;;) {
+                cp = *++argv;
+                if (!cp)
+                        return NULL;
+                if (*cp++ != '-')
+                        break;
+                c = *cp++;
+                if (!c)
+                        break;
+                if (c == '-' && !*cp) {
+                        if (!*++argv)
+                                return NULL;
+                        break;
+                }
+                do {
+                        switch (c) {
+                        case 'p':
+                                *path = bb_default_path;
+                                break;
+                        default:
+                                /* run 'typecmd' for other options */
+                                return NULL;
+                        }
+                        c = *cp++;
+                } while (c);
+        }
+        return argv;
+}
 static int FAST_FUNC
 commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
+        char *cmd;
        int c;
        enum {
                VERIFY_BRIEF = 1,
@@ -8307,29 +8496,32 @@ commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
        } verify = 0;
        const char *path = NULL;
+        /* "command [-p] PROG ARGS" (that is, without -V or -v)
+         * never reaches this function.
+         */
        while ((c = nextopt("pvV")) != '\0')
                if (c == 'V')
                        verify |= VERIFY_VERBOSE;
                else if (c == 'v')
-                        verify |= VERIFY_BRIEF;
+                        /*verify |= VERIFY_BRIEF*/;
 #if DEBUG
                else if (c != 'p')
                        abort();
 #endif
                else
                        path = bb_default_path;
        /* Mimic bash: just "command -v" doesn't complain, it's a nop */
-        if (verify && (*argptr != NULL)) {
+        cmd = *argptr;
-                return describe_command(*argptr, path, verify - VERIFY_BRIEF);
+        if (/*verify && */ cmd)
-        }
+                return describe_command(cmd, path, verify /* - VERIFY_BRIEF*/);
        return 0;
 }
 #endif
-/* ============ eval.c */
 static int funcblocksize;       /* size of structures in function */
 static int funcstringsize;      /* size of strings in node */
 static void *funcblock;         /* block to allocate function from */
@@ -8342,7 +8534,6 @@ static char **nodeptr;
 /* flags in argument to evaltree */
 #define EV_EXIT    01           /* exit after evaluating tree */
 #define EV_TESTED  02           /* exit status is checked; ignore -e flag */
-#define EV_BACKCMD 04           /* command executing within back quotes */
 static const uint8_t nodesize[N_NUMBER] ALIGN1 = {
        [NCMD     ] = SHELL_ALIGN(sizeof(struct ncmd)),
@@ -8674,15 +8865,13 @@ defun(char *name, union node *func)
 #define SKIPBREAK      (1 << 0)
 #define SKIPCONT       (1 << 1)
 #define SKIPFUNC       (1 << 2)
-#define SKIPFILE       (1 << 3)
-#define SKIPEVAL       (1 << 4)
 static smallint evalskip;       /* set to SKIPxxx if we are skipping commands */
 static int skipcount;           /* number of levels to skip */
 static int funcnest;            /* depth of function calls */
 static int loopnest;            /* current loop nesting level */
 /* Forward decl way out to parsing code - dotrap needs it */
-static int evalstring(char *s, int mask);
+static int evalstring(char *s, int flags);
 /* Called to execute a trap.
 * Single callsite - at the end of evaltree().
@@ -8691,69 +8880,71 @@ static int evalstring(char *s, int mask);
 * Perhaps we should avoid entering new trap handlers
 * while we are executing a trap handler. [is it a TODO?]
 */
-static int
+static void
 dotrap(void)
 {
        uint8_t *g;
        int sig;
-        uint8_t savestatus;
+        uint8_t last_status;
+        if (!pending_sig)
+                return;
-        savestatus = exitstatus;
+        last_status = exitstatus;
        pending_sig = 0;
-        xbarrier();
+        barrier();
        TRACE(("dotrap entered\n"));
        for (sig = 1, g = gotsig; sig < NSIG; sig++, g++) {
-                int want_exexit;
+                char *p;
-                char *t;
-                if (*g == 0)
+                if (!*g)
                        continue;
-                t = trap[sig];
+                if (evalskip) {
+                        pending_sig = sig;
+                        break;
+                }
+                p = trap[sig];
                /* non-trapped SIGINT is handled separately by raise_interrupt,
                 * don't upset it by resetting gotsig[SIGINT-1] */
-                if (sig == SIGINT && !t)
+                if (sig == SIGINT && !p)
                        continue;
-                TRACE(("sig %d is active, will run handler '%s'\n", sig, t));
+                TRACE(("sig %d is active, will run handler '%s'\n", sig, p));
                *g = 0;
-                if (!t)
+                if (!p)
                        continue;
-                want_exexit = evalstring(t, SKIPEVAL);
+                evalstring(p, 0);
-                exitstatus = savestatus;
-                if (want_exexit) {
-                        TRACE(("dotrap returns %d\n", want_exexit));
-                        return want_exexit;
-                }
        }
+        exitstatus = last_status;
-        TRACE(("dotrap returns 0\n"));
+        TRACE(("dotrap returns\n"));
-        return 0;
 }
 /* forward declarations - evaluation is fairly recursive business... */
-static void evalloop(union node *, int);
+static int evalloop(union node *, int);
-static void evalfor(union node *, int);
+static int evalfor(union node *, int);
-static void evalcase(union node *, int);
+static int evalcase(union node *, int);
-static void evalsubshell(union node *, int);
+static int evalsubshell(union node *, int);
 static void expredir(union node *);
-static void evalpipe(union node *, int);
+static int evalpipe(union node *, int);
-static void evalcommand(union node *, int);
+static int evalcommand(union node *, int);
-static int evalbltin(const struct builtincmd *, int, char **);
+static int evalbltin(const struct builtincmd *, int, char **, int);
 static void prehash(union node *);
 /*
 * Evaluate a parse tree.  The value is left in the global variable
 * exitstatus.
 */
-static void
+static int
 evaltree(union node *n, int flags)
 {
        struct jmploc *volatile savehandler = exception_handler;
        struct jmploc jmploc;
        int checkexit = 0;
-        void (*evalfn)(union node *, int);
+        int (*evalfn)(union node *, int);
-        int status;
+        int status = 0;
        int int_level;
        SAVE_INT(int_level);
@@ -8764,6 +8955,8 @@ evaltree(union node *n, int flags)
        }
        TRACE(("evaltree(%p: %d, %d) called\n", n, n->type, flags));
+        dotrap();
        exception_handler = &jmploc;
        {
                int err = setjmp(jmploc.loc);
@@ -8790,15 +8983,13 @@ evaltree(union node *n, int flags)
                break;
 #endif
        case NNOT:
-                evaltree(n->nnot.com, EV_TESTED);
+                status = !evaltree(n->nnot.com, EV_TESTED);
-                status = !exitstatus;
                goto setstatus;
        case NREDIR:
                expredir(n->nredir.redirect);
                status = redirectsafe(n->nredir.redirect, REDIR_PUSH);
                if (!status) {
-                        evaltree(n->nredir.n, flags & EV_TESTED);
+                        status = evaltree(n->nredir.n, flags & EV_TESTED);
-                        status = exitstatus;
                }
                popredir(/*drop:*/ 0, /*restore:*/ 0 /* not sure */);
                goto setstatus;
@@ -8816,6 +9007,8 @@ evaltree(union node *n, int flags)
                evalfn = evalloop;
                goto calleval;
        case NSUBSHELL:
+                evalfn = evalsubshell;
+                goto checkexit;
        case NBACKGND:
                evalfn = evalsubshell;
                goto calleval;
@@ -8836,27 +9029,24 @@ evaltree(union node *n, int flags)
 #error NOR + 1 != NSEMI
 #endif
                unsigned is_or = n->type - NAND;
-                evaltree(
+                status = evaltree(
                        n->nbinary.ch1,
                        (flags | ((is_or >> 1) - 1)) & EV_TESTED
                );
-                if ((!exitstatus) == is_or)
+                if ((!status) == is_or || evalskip)
                        break;
-                if (!evalskip) {
+                n = n->nbinary.ch2;
-                        n = n->nbinary.ch2;
 evaln:
-                        evalfn = evaltree;
+                evalfn = evaltree;
 calleval:
-                        evalfn(n, flags);
+                status = evalfn(n, flags);
-                        break;
+                goto setstatus;
-                }
-                break;
        }
        case NIF:
-                evaltree(n->nif.test, EV_TESTED);
+                status = evaltree(n->nif.test, EV_TESTED);
                if (evalskip)
                        break;
-                if (exitstatus == 0) {
+                if (!status) {
                        n = n->nif.ifpart;
                        goto evaln;
                }
@@ -8864,11 +9054,14 @@ evaltree(union node *n, int flags)
                        n = n->nif.elsepart;
                        goto evaln;
                }
-                goto success;
+                status = 0;
+                goto setstatus;
        case NDEFUN:
                defun(n->narg.text, n->narg.next);
- success:
+                /* Not necessary. To test it:
-                status = 0;
+                 * "false; f() { qwerty; }; echo $?" should print 0.
+                 */
+                /* status = 0; */
 setstatus:
                exitstatus = status;
                break;
@@ -8881,119 +9074,127 @@ evaltree(union node *n, int flags)
        /* Order of checks below is important:
         * signal handlers trigger before exit caused by "set -e".
         */
-        if (pending_sig && dotrap())
+        dotrap();
-                goto exexit;
-        if (checkexit & exitstatus)
-                evalskip |= SKIPEVAL;
-        if (flags & EV_EXIT) {
+        if (checkexit & status)
- exexit:
+                raise_exception(EXEXIT);
+        if (flags & EV_EXIT)
                raise_exception(EXEXIT);
-        }
        RESTORE_INT(int_level);
        TRACE(("leaving evaltree (no interrupts)\n"));
+        return exitstatus;
 }
 #if !defined(__alpha__) || (defined(__GNUC__) && __GNUC__ >= 3)
 static
 #endif
-void evaltreenr(union node *, int) __attribute__ ((alias("evaltree"),__noreturn__));
+int evaltreenr(union node *, int) __attribute__ ((alias("evaltree"),__noreturn__));
-static void
+static int
+skiploop(void)
+{
+        int skip = evalskip;
+        switch (skip) {
+        case 0:
+                break;
+        case SKIPBREAK:
+        case SKIPCONT:
+                if (--skipcount <= 0) {
+                        evalskip = 0;
+                        break;
+                }
+                skip = SKIPBREAK;
+                break;
+        }
+        return skip;
+}
+static int
 evalloop(union node *n, int flags)
 {
+        int skip;
        int status;
        loopnest++;
        status = 0;
        flags &= EV_TESTED;
-        for (;;) {
+        do {
                int i;
-                evaltree(n->nbinary.ch1, EV_TESTED);
+                i = evaltree(n->nbinary.ch1, EV_TESTED);
-                if (evalskip) {
+                skip = skiploop();
- skipping:
+                if (skip == SKIPFUNC)
-                        if (evalskip == SKIPCONT && --skipcount <= 0) {
+                        status = i;
-                                evalskip = 0;
+                if (skip)
-                                continue;
+                        continue;
-                        }
-                        if (evalskip == SKIPBREAK && --skipcount <= 0)
-                                evalskip = 0;
-                        break;
-                }
-                i = exitstatus;
                if (n->type != NWHILE)
                        i = !i;
                if (i != 0)
                        break;
-                evaltree(n->nbinary.ch2, flags);
+                status = evaltree(n->nbinary.ch2, flags);
-                status = exitstatus;
+                skip = skiploop();
-                if (evalskip)
+        } while (!(skip & ~SKIPCONT));
-                        goto skipping;
-        }
        loopnest--;
-        exitstatus = status;
+        return status;
 }
-static void
+static int
 evalfor(union node *n, int flags)
 {
        struct arglist arglist;
        union node *argp;
        struct strlist *sp;
        struct stackmark smark;
+        int status = 0;
        setstackmark(&smark);
        arglist.list = NULL;
        arglist.lastp = &arglist.list;
        for (argp = n->nfor.args; argp; argp = argp->narg.next) {
                expandarg(argp, &arglist, EXP_FULL | EXP_TILDE);
-                /* XXX */
-                if (evalskip)
-                        goto out;
        }
        *arglist.lastp = NULL;
-        exitstatus = 0;
        loopnest++;
        flags &= EV_TESTED;
        for (sp = arglist.list; sp; sp = sp->next) {
                setvar0(n->nfor.var, sp->text);
-                evaltree(n->nfor.body, flags);
+                status = evaltree(n->nfor.body, flags);
-                if (evalskip) {
+                if (skiploop() & ~SKIPCONT)
-                        if (evalskip == SKIPCONT && --skipcount <= 0) {
-                                evalskip = 0;
-                                continue;
-                        }
-                        if (evalskip == SKIPBREAK && --skipcount <= 0)
-                                evalskip = 0;
                        break;
-                }
        }
        loopnest--;
- out:
        popstackmark(&smark);
+        return status;
 }
-static void
+static int
 evalcase(union node *n, int flags)
 {
        union node *cp;
        union node *patp;
        struct arglist arglist;
        struct stackmark smark;
+        int status = 0;
        setstackmark(&smark);
        arglist.list = NULL;
        arglist.lastp = &arglist.list;
        expandarg(n->ncase.expr, &arglist, EXP_TILDE);
-        exitstatus = 0;
        for (cp = n->ncase.cases; cp && evalskip == 0; cp = cp->nclist.next) {
                for (patp = cp->nclist.pattern; patp; patp = patp->narg.next) {
                        if (casematch(patp, arglist.list->text)) {
-                                if (evalskip == 0) {
+                                /* Ensure body is non-empty as otherwise
-                                        evaltree(cp->nclist.body, flags);
+                                 * EV_EXIT may prevent us from setting the
+                                 * exit status.
+                                 */
+                                if (evalskip == 0 && cp->nclist.body) {
+                                        status = evaltree(cp->nclist.body, flags);
                                }
                                goto out;
                        }
@@ -9001,12 +9202,14 @@ evalcase(union node *n, int flags)
        }
 out:
        popstackmark(&smark);
+        return status;
 }
 /*
 * Kick off a subshell to evaluate a tree.
 */
-static void
+static int
 evalsubshell(union node *n, int flags)
 {
        IF_PLATFORM_MINGW32(struct forkshell fs;)
@@ -9043,8 +9246,8 @@ evalsubshell(union node *n, int flags)
        status = 0;
        if (!backgnd)
                status = waitforjob(jp);
-        exitstatus = status;
        INT_ON;
+        return status;
 }
 /*
@@ -9117,7 +9320,7 @@ expredir(union node *n)
 * of the shell, which make the last process in a pipeline the parent
 * of all the rest.)
 */
-static void
+static int
 evalpipe(union node *n, int flags)
 {
        IF_PLATFORM_MINGW32(struct forkshell fs;)
@@ -9126,6 +9329,7 @@ evalpipe(union node *n, int flags)
        int pipelen;
        int prevfd;
        int pip[2];
+        int status = 0;
        TRACE(("evalpipe(0x%lx) called\n", (long)n));
        pipelen = 0;
@@ -9180,10 +9384,12 @@ evalpipe(union node *n, int flags)
                        close(pip[1]);
        }
        if (n->npipe.pipe_backgnd == 0) {
-                exitstatus = waitforjob(jp);
+                status = waitforjob(jp);
-                TRACE(("evalpipe:  job done exit status %d\n", exitstatus));
+                TRACE(("evalpipe:  job done exit status %d\n", status));
        }
        INT_ON;
+        return status;
 }
 /*
@@ -9282,12 +9488,12 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
        saveparam = shellparam;
        savelocalvars = localvars;
+        savehandler = exception_handler;
        e = setjmp(jmploc.loc);
        if (e) {
                goto funcdone;
        }
        INT_OFF;
-        savehandler = exception_handler;
        exception_handler = &jmploc;
        localvars = NULL;
        shellparam.malloced = 0;
@@ -9315,42 +9521,6 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
        return e;
 }
-#if ENABLE_ASH_CMDCMD
-static char **
-parse_command_args(char **argv, const char **path)
-{
-        char *cp, c;
-        for (;;) {
-                cp = *++argv;
-                if (!cp)
-                        return NULL;
-                if (*cp++ != '-')
-                        break;
-                c = *cp++;
-                if (!c)
-                        break;
-                if (c == '-' && !*cp) {
-                        if (!*++argv)
-                                return NULL;
-                        break;
-                }
-                do {
-                        switch (c) {
-                        case 'p':
-                                *path = bb_default_path;
-                                break;
-                        default:
-                                /* run 'typecmd' for other options */
-                                return NULL;
-                        }
-                        c = *cp++;
-                } while (c);
-        }
-        return argv;
-}
-#endif
 /*
 * Make a variable a local variable.  When a variable is made local, it's
 * value and flags are saved in a localvar structure.  The saved values
@@ -9458,7 +9628,20 @@ execcmd(int argc UNUSED_PARAM, char **argv)
                iflag = 0;              /* exit on error */
                mflag = 0;
                optschanged();
+                /* We should set up signals for "exec CMD"
+                 * the same way as for "CMD" without "exec".
+                 * But optschanged->setinteractive->setsignal
+                 * still thought we are a root shell. Therefore, for example,
+                 * SIGQUIT is still set to IGN. Fix it:
+                 */
+                shlvl++;
+                setsignal(SIGQUIT);
+                /*setsignal(SIGTERM); - unnecessary because of iflag=0 */
+                /*setsignal(SIGTSTP); - unnecessary because of mflag=0 */
+                /*setsignal(SIGTTOU); - unnecessary because of mflag=0 */
                shellexec(argv + 1, pathval(), 0);
+                /* NOTREACHED */
        }
        return 0;
 }
@@ -9473,14 +9656,14 @@ returncmd(int argc UNUSED_PARAM, char **argv)
         * If called outside a function, do what ksh does;
         * skip the rest of the file.
         */
-        evalskip = funcnest ? SKIPFUNC : SKIPFILE;
+        evalskip = SKIPFUNC;
        return argv[1] ? number(argv[1]) : exitstatus;
 }
 /* Forward declarations for builtintab[] */
 static int breakcmd(int, char **) FAST_FUNC;
 static int dotcmd(int, char **) FAST_FUNC;
-static int evalcmd(int, char **) FAST_FUNC;
+static int evalcmd(int, char **, int) FAST_FUNC;
 static int exitcmd(int, char **) FAST_FUNC;
 static int exportcmd(int, char **) FAST_FUNC;
 #if ENABLE_ASH_GETOPTS
@@ -9550,7 +9733,7 @@ static const struct builtincmd builtintab[] = {
 #if ENABLE_ASH_BUILTIN_ECHO
        { BUILTIN_REGULAR       "echo"    , echocmd    },
 #endif
-        { BUILTIN_SPEC_REG      "eval"    , evalcmd    },
+        { BUILTIN_SPEC_REG      "eval"    , NULL       }, /*evalcmd() has a differing prototype*/
        { BUILTIN_SPEC_REG      "exec"    , execcmd    },
        { BUILTIN_SPEC_REG      "exit"    , exitcmd    },
        { BUILTIN_SPEC_REG_ASSG "export"  , exportcmd  },
@@ -9606,27 +9789,28 @@ static const struct builtincmd builtintab[] = {
 /* Should match the above table! */
 #define COMMANDCMD (builtintab + \
-        2 + \
+        /* . : */       2 + \
-        1 * ENABLE_ASH_BUILTIN_TEST + \
+        /* [ */         1 * ENABLE_ASH_BUILTIN_TEST + \
-        1 * ENABLE_ASH_BUILTIN_TEST * ENABLE_ASH_BASH_COMPAT + \
+        /* [[ */        1 * ENABLE_ASH_BUILTIN_TEST * ENABLE_ASH_BASH_COMPAT + \
-        1 * ENABLE_ASH_ALIAS + \
+        /* alias */     1 * ENABLE_ASH_ALIAS + \
-        1 * ENABLE_ASH_JOB_CONTROL + \
+        /* bg */        1 * ENABLE_ASH_JOB_CONTROL + \
-        3)
+        /* break cd cddir  */   3)
-#define EXECCMD (builtintab + \
+#define EVALCMD (COMMANDCMD + \
-        2 + \
+        /* command */   1 * ENABLE_ASH_CMDCMD + \
-        1 * ENABLE_ASH_BUILTIN_TEST + \
+        /* continue */  1 + \
-        1 * ENABLE_ASH_BUILTIN_TEST * ENABLE_ASH_BASH_COMPAT + \
+        /* echo */      1 * ENABLE_ASH_BUILTIN_ECHO + \
-        1 * ENABLE_ASH_ALIAS + \
+        0)
-        1 * ENABLE_ASH_JOB_CONTROL + \
+#define EXECCMD (EVALCMD + \
-        3 + \
+        /* eval */      1)
-        1 * ENABLE_ASH_CMDCMD + \
-        1 + \
-        ENABLE_ASH_BUILTIN_ECHO + \
-        1)
 /*
 * Search the table of builtin commands.
 */
+static int
+pstrcmp1(const void *a, const void *b)
+{
+        return strcmp((char*)a, *(char**)b + 1);
+}
 static struct builtincmd *
 find_builtin(const char *name)
 {
@@ -9634,7 +9818,7 @@ find_builtin(const char *name)
        bp = bsearch(
                name, builtintab, ARRAY_SIZE(builtintab), sizeof(builtintab[0]),
-                pstrcmp
+                pstrcmp1
        );
        return bp;
 }
@@ -9658,7 +9842,7 @@ bltincmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
        return back_exitstatus;
 }
-static void
+static int
 evalcommand(union node *cmd, int flags)
 {
        static const struct builtincmd null_bltin = {
@@ -9794,6 +9978,9 @@ evalcommand(union node *cmd, int flags)
                                nargv = parse_command_args(argv, &path);
                                if (!nargv)
                                        break;
+                                /* It's "command [-p] PROG ARGS" (that is, no -Vv).
+                                 * nargv => "PROG". path is updated if -p.
+                                 */
                                argc -= nargv - argv;
                                argv = nargv;
                                cmd_flag |= DO_NOFUNC;
@@ -9862,9 +10049,9 @@ evalcommand(union node *cmd, int flags)
                        jp = makejob(/*cmd,*/ 1);
                        if (forkshell(jp, cmd, FORK_FG) != 0) {
                                /* parent */
-                                exitstatus = waitforjob(jp);
+                                status = waitforjob(jp);
                                INT_ON;
-                                TRACE(("forked child exited with %d\n", exitstatus));
+                                TRACE(("forked child exited with %d\n", status));
                                break;
                        }
                        /* child */
@@ -9894,7 +10081,7 @@ evalcommand(union node *cmd, int flags)
                 * to reap the zombie and make kill detect that it's gone: */
                dowait(DOWAIT_NONBLOCK, NULL);
-                if (evalbltin(cmdentry.u.cmd, argc, argv)) {
+                if (evalbltin(cmdentry.u.cmd, argc, argv, flags)) {
                        int exit_status;
                        int i = exception_type;
                        if (i == EXEXIT || i == EXEXEC)
@@ -9911,7 +10098,7 @@ evalcommand(union node *cmd, int flags)
                        }
                        FORCE_INT_ON;
                }
-                break;
+                goto readstatus;
        case CMDFUNCTION:
                listsetvar(varlist.list, 0);
@@ -9919,6 +10106,8 @@ evalcommand(union node *cmd, int flags)
                dowait(DOWAIT_NONBLOCK, NULL);
                if (evalfun(cmdentry.u.func, argc, argv, flags))
                        goto raise;
+ readstatus:
+                status = exitstatus;
                break;
        } /* switch */
@@ -9932,29 +10121,36 @@ evalcommand(union node *cmd, int flags)
                setvar0("_", lastarg);
        }
        popstackmark(&smark);
+        return status;
 }
 static int
-evalbltin(const struct builtincmd *cmd, int argc, char **argv)
+evalbltin(const struct builtincmd *cmd, int argc, char **argv, int flags)
 {
        char *volatile savecmdname;
        struct jmploc *volatile savehandler;
        struct jmploc jmploc;
+        int status;
        int i;
        savecmdname = commandname;
+        savehandler = exception_handler;
        i = setjmp(jmploc.loc);
        if (i)
                goto cmddone;
-        savehandler = exception_handler;
        exception_handler = &jmploc;
        commandname = argv[0];
        argptr = argv + 1;
        optptr = NULL;                  /* initialize nextopt */
-        exitstatus = (*cmd->builtin)(argc, argv);
+        if (cmd == EVALCMD)
+                status = evalcmd(argc, argv, flags);
+        else
+                status = (*cmd->builtin)(argc, argv);
        flush_stdout_stderr();
+        status |= ferror(stdout);
+        exitstatus = status;
 cmddone:
-        exitstatus |= ferror(stdout);
        clearerr(stdout);
        commandname = savecmdname;
        exception_handler = savehandler;
@@ -10058,6 +10254,8 @@ pushstring(char *s, struct alias *ap)
        g_parsefile->strpush = sp;
        sp->prev_string = g_parsefile->next_to_pgetc;
        sp->prev_left_in_line = g_parsefile->left_in_line;
+        sp->unget = g_parsefile->unget;
+        memcpy(sp->lastc, g_parsefile->lastc, sizeof(sp->lastc));
 #if ENABLE_ASH_ALIAS
        sp->ap = ap;
        if (ap) {
@@ -10067,6 +10265,7 @@ pushstring(char *s, struct alias *ap)
 #endif
        g_parsefile->next_to_pgetc = s;
        g_parsefile->left_in_line = len;
+        g_parsefile->unget = 0;
        INT_ON;
 }
@@ -10094,17 +10293,14 @@ popstring(void)
 #endif
        g_parsefile->next_to_pgetc = sp->prev_string;
        g_parsefile->left_in_line = sp->prev_left_in_line;
+        g_parsefile->unget = sp->unget;
+        memcpy(g_parsefile->lastc, sp->lastc, sizeof(sp->lastc));
        g_parsefile->strpush = sp->prev;
        if (sp != &(g_parsefile->basestrpush))
                free(sp);
        INT_ON;
 }
-//FIXME: BASH_COMPAT with "...&" does TWO pungetc():
-//it peeks whether it is &>, and then pushes back both chars.
-//This function needs to save last *next_to_pgetc to buf[0]
-//to make two pungetc() reliable. Currently,
-// pgetc (out of buf: does preadfd), pgetc, pungetc, pungetc won't work...
 static int
 preadfd(void)
 {
@@ -10189,13 +10385,14 @@ preadfd(void)
 */
 //#define pgetc_debug(...) bb_error_msg(__VA_ARGS__)
 #define pgetc_debug(...) ((void)0)
+static int pgetc(void);
 static int
 preadbuffer(void)
 {
        char *q;
        int more;
-        while (g_parsefile->strpush) {
+        if (g_parsefile->strpush) {
 #if ENABLE_ASH_ALIAS
                if (g_parsefile->left_in_line == -1
                 && g_parsefile->strpush->ap
@@ -10207,13 +10404,7 @@ preadbuffer(void)
                }
 #endif
                popstring();
-                /* try "pgetc" now: */
+                return pgetc();
-                pgetc_debug("preadbuffer internal pgetc at %d:%p'%s'",
-                                g_parsefile->left_in_line,
-                                g_parsefile->next_to_pgetc,
-                                g_parsefile->next_to_pgetc);
-                if (--g_parsefile->left_in_line >= 0)
-                        return (unsigned char)(*g_parsefile->next_to_pgetc++);
        }
        /* on both branches above g_parsefile->left_in_line < 0.
         * "pgetc" needs refilling.
@@ -10292,27 +10483,41 @@ preadbuffer(void)
        return (unsigned char)*g_parsefile->next_to_pgetc++;
 }
-#define pgetc_as_macro() \
+static void
-        (--g_parsefile->left_in_line >= 0 \
+nlprompt(void)
-        ? (unsigned char)*g_parsefile->next_to_pgetc++ \
+{
-        : preadbuffer() \
+        g_parsefile->linno++;
-        )
+        setprompt_if(doprompt, 2);
+}
+static void
+nlnoprompt(void)
+{
+        g_parsefile->linno++;
+        needprompt = doprompt;
+}
 static int
 pgetc(void)
 {
-        pgetc_debug("pgetc_fast at %d:%p'%s'",
+        int c;
+        pgetc_debug("pgetc at %d:%p'%s'",
                        g_parsefile->left_in_line,
                        g_parsefile->next_to_pgetc,
                        g_parsefile->next_to_pgetc);
-        return pgetc_as_macro();
+        if (g_parsefile->unget)
-}
+                return g_parsefile->lastc[--g_parsefile->unget];
-#if ENABLE_ASH_OPTIMIZE_FOR_SIZE
+        if (--g_parsefile->left_in_line >= 0)
-# define pgetc_fast() pgetc()
+                c = (signed char)*g_parsefile->next_to_pgetc++;
-#else
+        else
-# define pgetc_fast() pgetc_as_macro()
+                c = preadbuffer();
-#endif
+        g_parsefile->lastc[1] = g_parsefile->lastc[0];
+        g_parsefile->lastc[0] = c;
+        return c;
+}
 #if ENABLE_ASH_ALIAS
 static int
@@ -10320,11 +10525,11 @@ pgetc_without_PEOA(void)
 {
        int c;
        do {
-                pgetc_debug("pgetc_fast at %d:%p'%s'",
+                pgetc_debug("pgetc at %d:%p'%s'",
                                g_parsefile->left_in_line,
                                g_parsefile->next_to_pgetc,
                                g_parsefile->next_to_pgetc);
-                c = pgetc_fast();
+                c = pgetc();
        } while (c == PEOA);
        return c;
 }
@@ -10358,18 +10563,31 @@ pfgets(char *line, int len)
 }
 /*
- * Undo the last call to pgetc.  Only one character may be pushed back.
+ * Undo a call to pgetc.  Only two characters may be pushed back.
 * PEOF may be pushed back.
 */
 static void
 pungetc(void)
 {
-        g_parsefile->left_in_line++;
+        g_parsefile->unget++;
-        g_parsefile->next_to_pgetc--;
+}
-        pgetc_debug("pushed back to %d:%p'%s'",
-                        g_parsefile->left_in_line,
+/* This one eats backslash+newline */
-                        g_parsefile->next_to_pgetc,
+static int
-                        g_parsefile->next_to_pgetc);
+pgetc_eatbnl(void)
+{
+        int c;
+        while ((c = pgetc()) == '\\') {
+                if (pgetc() != '\n') {
+                        pungetc();
+                        break;
+                }
+                nlprompt();
+        }
+        return c;
 }
 /*
@@ -10386,6 +10604,7 @@ pushfile(void)
        pf->pf_fd = -1;
        /*pf->strpush = NULL; - ckzalloc did it */
        /*pf->basestrpush.prev = NULL;*/
+        /*pf->unget = 0;*/
        g_parsefile = pf;
 }
@@ -10959,8 +11178,8 @@ static const char *
 tokname(char *buf, int tok)
 {
        if (tok < TSEMI)
-                return tokname_array[tok] + 1;
+                return tokname_array[tok];
-        sprintf(buf, "\"%s\"", tokname_array[tok] + 1);
+        sprintf(buf, "\"%s\"", tokname_array[tok]);
        return buf;
 }
@@ -11017,7 +11236,7 @@ list(int nlflag)
                }
                checkkwd = CHKNL | CHKKWD | CHKALIAS;
-                if (nlflag == 2 && tokname_array[peektoken()][0])
+                if (nlflag == 2 && ((1 << peektoken()) & tokendlist))
                        return n1;
                nlflag |= 2;
@@ -11399,7 +11618,7 @@ parse_command(void)
                n1->nbinary.ch1 = list(0);
                got = readtoken();
                if (got != TDO) {
-                        TRACE(("expecting DO got '%s' %s\n", tokname_array[got] + 1,
+                        TRACE(("expecting DO got '%s' %s\n", tokname_array[got],
                                        got == TWORD ? wordtext : ""));
                        raise_error_unexpected_syntax(TDO);
                }
@@ -11545,7 +11764,8 @@ parse_command(void)
 }
 #if ENABLE_ASH_BASH_COMPAT
-static int decode_dollar_squote(void)
+static int
+decode_dollar_squote(void)
 {
        static const char C_escapes[] ALIGN1 = "nrbtfav""x\\01234567";
        int c, cnt;
@@ -11613,7 +11833,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
        /* NB: syntax parameter fits into smallint */
        /* c parameter is an unsigned char or PEOF or PEOA */
        char *out;
-        int len;
+        size_t len;
        char line[EOFMARKLEN + 1];
        struct nodelist *bqlist;
        smallint quotef;
@@ -11656,25 +11876,31 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                        if (syntax == BASESYNTAX)
                                goto endword;   /* exit outer loop */
                        USTPUTC(c, out);
-                        g_parsefile->linno++;
+                        nlprompt();
-                        setprompt_if(doprompt, 2);
                        c = pgetc();
                        goto loop;              /* continue outer loop */
                case CWORD:
                        USTPUTC(c, out);
                        break;
                case CCTL:
-                        if (eofmark == NULL || dblquote)
-                                USTPUTC(CTLESC, out);
 #if ENABLE_ASH_BASH_COMPAT
                        if (c == '\\' && bash_dollar_squote) {
                                c = decode_dollar_squote();
+                                if (c == '\0') {
+                                        /* skip $'\000', $'\x00' (like bash) */
+                                        break;
+                                }
                                if (c & 0x100) {
-                                        USTPUTC('\\', out);
+                                        /* Unknown escape. Encode as '\z' */
                                        c = (unsigned char)c;
+                                        if (eofmark == NULL || dblquote)
+                                                USTPUTC(CTLESC, out);
+                                        USTPUTC('\\', out);
                                }
                        }
 #endif
+                        if (eofmark == NULL || dblquote)
+                                USTPUTC(CTLESC, out);
                        USTPUTC(c, out);
                        break;
                case CBACK:     /* backslash */
@@ -11684,7 +11910,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                USTPUTC('\\', out);
                                pungetc();
                        } else if (c == '\n') {
-                                setprompt_if(doprompt, 2);
+                                nlprompt();
                        } else {
 #if ENABLE_ASH_EXPAND_PRMT
                                if (c == '$' && pssyntax) {
@@ -11752,7 +11978,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                        if (parenlevel > 0) {
                                parenlevel--;
                        } else {
-                                if (pgetc() == ')') {
+                                if (pgetc_eatbnl() == ')') {
                                        c = CTLENDARI;
                                        if (--arinest == 0) {
                                                syntax = prevsyntax;
@@ -11779,6 +12005,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                        if (varnest == 0) {
 #if ENABLE_ASH_BASH_COMPAT
                                if (c == '&') {
+//Can't call pgetc_eatbnl() here, this requires three-deep pungetc()
                                        if (pgetc() == '>')
                                                c = 0x100 + '>'; /* flag &> */
                                        pungetc();
@@ -11789,7 +12016,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                        IF_ASH_ALIAS(if (c != PEOA))
                                USTPUTC(c, out);
                }
-                c = pgetc_fast();
+                c = pgetc();
        } /* for (;;) */
 endword:
@@ -11854,8 +12081,7 @@ checkend: {
                                        continue;
                                if (*p == '\n' && *q == '\0') {
                                        c = PEOF;
-                                        g_parsefile->linno++;
+                                        nlnoprompt();
-                                        needprompt = doprompt;
                                } else {
                                        pushstring(line, NULL);
                                }
@@ -11954,7 +12180,7 @@ parsesub: {
        int typeloc;
        int flags;
-        c = pgetc();
+        c = pgetc_eatbnl();
        if (c > 255 /* PEOA or PEOF */
         || (c != '(' && c != '{' && !is_name(c) && !is_special(c))
        ) {
@@ -11967,7 +12193,7 @@ parsesub: {
                pungetc();
        } else if (c == '(') {
                /* $(command) or $((arith)) */
-                if (pgetc() == '(') {
+                if (pgetc_eatbnl() == '(') {
 #if ENABLE_SH_MATH_SUPPORT
                        PARSEARITH();
 #else
@@ -11984,9 +12210,9 @@ parsesub: {
                USTPUTC(VSNORMAL, out);
                subtype = VSNORMAL;
                if (c == '{') {
-                        c = pgetc();
+                        c = pgetc_eatbnl();
                        if (c == '#') {
-                                c = pgetc();
+                                c = pgetc_eatbnl();
                                if (c == '}')
                                        c = '#'; /* ${#} - same as $# */
                                else
@@ -11999,18 +12225,18 @@ parsesub: {
                        /* $[{[#]]NAME[}] */
                        do {
                                STPUTC(c, out);
-                                c = pgetc();
+                                c = pgetc_eatbnl();
                        } while (c <= 255 /* not PEOA or PEOF */ && is_in_name(c));
                } else if (isdigit(c)) {
                        /* $[{[#]]NUM[}] */
                        do {
                                STPUTC(c, out);
-                                c = pgetc();
+                                c = pgetc_eatbnl();
                        } while (isdigit(c));
                } else if (is_special(c)) {
                        /* $[{[#]]<specialchar>[}] */
                        USTPUTC(c, out);
-                        c = pgetc();
+                        c = pgetc_eatbnl();
                } else {
 badsub:
                        raise_error_syntax("bad substitution");
@@ -12023,15 +12249,18 @@ parsesub: {
                STPUTC('=', out);
                flags = 0;
                if (subtype == 0) {
+                        static const char types[] ALIGN1 = "}-+?=";
                        /* ${VAR...} but not $VAR or ${#VAR} */
                        /* c == first char after VAR */
                        switch (c) {
                        case ':':
-                                c = pgetc();
+                                c = pgetc_eatbnl();
 #if ENABLE_ASH_BASH_COMPAT
-                                if (c == ':' || c == '$' || isdigit(c)) {
+                                /* This check is only needed to not misinterpret
-//TODO: support more general format ${v:EXPR:EXPR},
+                                 * ${VAR:-WORD}, ${VAR:+WORD}, ${VAR:=WORD}, ${VAR:?WORD}
-// where EXPR follows $(()) rules
+                                 * constructs.
+                                 */
+                                if (!strchr(types, c)) {
                                        subtype = VSSUBSTR;
                                        pungetc();
                                        break; /* "goto do_pungetc" is bigger (!) */
@@ -12040,7 +12269,6 @@ parsesub: {
                                flags = VSNUL;
                                /*FALLTHROUGH*/
                        default: {
-                                static const char types[] ALIGN1 = "}-+?=";
                                const char *p = strchr(types, c);
                                if (p == NULL)
                                        goto badsub;
@@ -12051,7 +12279,7 @@ parsesub: {
                        case '#': {
                                int cc = c;
                                subtype = (c == '#' ? VSTRIMLEFT : VSTRIMRIGHT);
-                                c = pgetc();
+                                c = pgetc_eatbnl();
                                if (c != cc)
                                        goto do_pungetc;
                                subtype++;
@@ -12063,7 +12291,7 @@ parsesub: {
 //TODO: encode pattern and repl separately.
 // Currently ${v/$var_with_slash/repl} is horribly broken
                                subtype = VSREPLACE;
-                                c = pgetc();
+                                c = pgetc_eatbnl();
                                if (c != '/')
                                        goto do_pungetc;
                                subtype++; /* VSREPLACEALL */
@@ -12101,9 +12329,18 @@ parsebackq: {
        str = NULL;
        savelen = out - (char *)stackblock();
        if (savelen > 0) {
+                /*
+                 * FIXME: this can allocate very large block on stack and SEGV.
+                 * Example:
+                 * echo "..<100kbytes>..`true` $(true) `true` ..."
+                 * allocates 100kb for every command subst. With about
+                 * a hundred command substitutions stack overflows.
+                 * With larger prepended string, SEGV happens sooner.
+                 */
                str = alloca(savelen);
                memcpy(str, stackblock(), savelen);
        }
        if (oldstyle) {
                /* We must read until the closing backquote, giving special
                 * treatment to some slashes, and then push the string and
@@ -12126,8 +12363,7 @@ parsebackq: {
                        case '\\':
                                pc = pgetc();
                                if (pc == '\n') {
-                                        g_parsefile->linno++;
+                                        nlprompt();
-                                        setprompt_if(doprompt, 2);
                                        /*
                                         * If eating a newline, avoid putting
                                         * the newline into the new character
@@ -12152,8 +12388,7 @@ parsebackq: {
                                raise_error_syntax("EOF in backquote substitution");
                        case '\n':
-                                g_parsefile->linno++;
+                                nlnoprompt();
-                                needprompt = doprompt;
                                break;
                        default:
@@ -12272,7 +12507,7 @@ xxreadtoken(void)
        setprompt_if(needprompt, 2);
        startlinno = g_parsefile->linno;
        for (;;) {                      /* until token or start of word found */
-                c = pgetc_fast();
+                c = pgetc();
                if (c == ' ' || c == '\t' IF_ASH_ALIAS( || c == PEOA))
                        continue;
@@ -12285,16 +12520,14 @@ xxreadtoken(void)
                                pungetc();
                                break; /* return readtoken1(...) */
                        }
-                        startlinno = ++g_parsefile->linno;
+                        nlprompt();
-                        setprompt_if(doprompt, 2);
                } else {
                        const char *p;
                        p = xxreadtoken_chars + sizeof(xxreadtoken_chars) - 1;
                        if (c != PEOF) {
                                if (c == '\n') {
-                                        g_parsefile->linno++;
+                                        nlnoprompt();
-                                        needprompt = doprompt;
                                }
                                p = strchr(xxreadtoken_chars, c);
@@ -12335,7 +12568,7 @@ xxreadtoken(void)
        setprompt_if(needprompt, 2);
        startlinno = g_parsefile->linno;
        for (;;) {      /* until token or start of word found */
-                c = pgetc_fast();
+                c = pgetc();
                switch (c) {
                case ' ': case '\t':
                IF_ASH_ALIAS(case PEOA:)
@@ -12347,15 +12580,13 @@ xxreadtoken(void)
                        continue;
                case '\\':
                        if (pgetc() == '\n') {
-                                startlinno = ++g_parsefile->linno;
+                                nlprompt();
-                                setprompt_if(doprompt, 2);
                                continue;
                        }
                        pungetc();
                        goto breakloop;
                case '\n':
-                        g_parsefile->linno++;
+                        nlnoprompt();
-                        needprompt = doprompt;
                        RETURN(TNL);
                case PEOF:
                        RETURN(TEOF);
@@ -12426,7 +12657,7 @@ readtoken(void)
                pp = findkwd(wordtext);
                if (pp) {
                        lasttoken = t = pp - tokname_array;
-                        TRACE(("keyword '%s' recognized\n", tokname_array[t] + 1));
+                        TRACE(("keyword '%s' recognized\n", tokname_array[t]));
                        goto out;
                }
        }
@@ -12447,9 +12678,9 @@ readtoken(void)
        checkkwd = 0;
 #if DEBUG
        if (!alreadyseen)
-                TRACE(("token '%s' %s\n", tokname_array[t] + 1, t == TWORD ? wordtext : ""));
+                TRACE(("token '%s' %s\n", tokname_array[t], t == TWORD ? wordtext : ""));
        else
-                TRACE(("reread token '%s' %s\n", tokname_array[t] + 1, t == TWORD ? wordtext : ""));
+                TRACE(("reread token '%s' %s\n", tokname_array[t], t == TWORD ? wordtext : ""));
 #endif
        return t;
 }
@@ -12536,35 +12767,39 @@ expandstr(const char *ps)
 * Execute a command or commands contained in a string.
 */
 static int
-evalstring(char *s, int mask)
+evalstring(char *s, int flags)
 {
        union node *n;
        struct stackmark smark;
-        int skip;
+        int status;
+        s = sstrdup(s);
        setinputstring(s);
        setstackmark(&smark);
-        skip = 0;
+        status = 0;
        while ((n = parsecmd(0)) != NODE_EOF) {
-                evaltree(n, 0);
+                int i;
+                i = evaltree(n, flags);
+                if (n)
+                        status = i;
                popstackmark(&smark);
-                skip = evalskip;
+                if (evalskip)
-                if (skip)
                        break;
        }
+        popstackmark(&smark);
        popfile();
+        stunalloc(s);
-        skip &= mask;
+        return status;
-        evalskip = skip;
-        return skip;
 }
 /*
 * The eval command.
 */
 static int FAST_FUNC
-evalcmd(int argc UNUSED_PARAM, char **argv)
+evalcmd(int argc UNUSED_PARAM, char **argv, int flags)
 {
        char *p;
        char *concat;
@@ -12584,9 +12819,9 @@ evalcmd(int argc UNUSED_PARAM, char **argv)
                        STPUTC('\0', concat);
                        p = grabstackstr(concat);
                }
-                evalstring(p, ~SKIPEVAL);
+                return evalstring(p, flags & EV_TESTED);
        }
-        return exitstatus;
+        return 0;
 }
 /*
@@ -12600,6 +12835,7 @@ cmdloop(int top)
        union node *n;
        struct stackmark smark;
        int inter;
+        int status = 0;
        int numeof = 0;
        TRACE(("cmdloop(%d) called\n", top));
@@ -12631,20 +12867,24 @@ cmdloop(int top)
                        }
                        numeof++;
                } else if (nflag == 0) {
+                        int i;
                        /* job_warning can only be 2,1,0. Here 2->1, 1/0->0 */
                        job_warning >>= 1;
                        numeof = 0;
-                        evaltree(n, 0);
+                        i = evaltree(n, 0);
+                        if (n)
+                                status = i;
                }
                popstackmark(&smark);
                skip = evalskip;
                if (skip) {
-                        evalskip = 0;
+                        evalskip &= ~SKIPFUNC;
-                        return skip & SKIPEVAL;
+                        break;
                }
        }
-        return 0;
+        return status;
 }
 /*
@@ -12689,32 +12929,38 @@ find_dot_file(char *name)
 }
 static int FAST_FUNC
-dotcmd(int argc, char **argv)
+dotcmd(int argc_ UNUSED_PARAM, char **argv_ UNUSED_PARAM)
 {
+        /* "false; . empty_file; echo $?" should print 0, not 1: */
+        int status = 0;
        char *fullname;
+        char **argv;
        struct strlist *sp;
        volatile struct shparam saveparam;
        for (sp = cmdenviron; sp; sp = sp->next)
                setvareq(ckstrdup(sp->text), VSTRFIXED | VTEXTFIXED);
-        if (!argv[1]) {
+        nextopt(nullstr); /* handle possible "--" */
+        argv = argptr;
+        if (!argv[0]) {
                /* bash says: "bash: .: filename argument required" */
                return 2; /* bash compat */
        }
-        /* "false; . empty_file; echo $?" should print 0, not 1: */
-        exitstatus = 0;
        /* This aborts if file isn't found, which is POSIXly correct.
         * bash returns exitcode 1 instead.
         */
-        fullname = find_dot_file(argv[1]);
+        fullname = find_dot_file(argv[0]);
-        argv += 2;
+        argv++;
-        argc -= 2;
+        if (argv[0]) { /* . FILE ARGS, ARGS exist */
-        if (argc) { /* argc > 0, argv[0] != NULL */
+                int argc;
                saveparam = shellparam;
                shellparam.malloced = 0;
+                argc = 1;
+                while (argv[argc])
+                        argc++;
                shellparam.nparam = argc;
                shellparam.p = argv;
        };
@@ -12724,15 +12970,15 @@ dotcmd(int argc, char **argv)
         */
        setinputfile(fullname, INPUT_PUSH_FILE);
        commandname = fullname;
-        cmdloop(0);
+        status = cmdloop(0);
        popfile();
-        if (argc) {
+        if (argv[0]) {
                freeparam(&shellparam);
                shellparam = saveparam;
        };
-        return exitstatus;
+        return status;
 }
 static int FAST_FUNC
@@ -12994,8 +13240,6 @@ find_command(char *name, struct cmdentry *entry, int act, const char *path)
 }
-/* ============ trap.c */
 /*
 * The trap builtin.
 */
@@ -13101,7 +13345,7 @@ helpcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                }
        }
 # endif
-        out1fmt("\n\n");
+        newline_and_flush(stdout);
        return EXIT_SUCCESS;
 }
 #endif
@@ -13421,15 +13665,10 @@ exitshell(void)
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
        save_history(line_input_state);
 #endif
        status = exitstatus;
        TRACE(("pid %d, exitshell(%d)\n", getpid(), status));
        if (setjmp(loc.loc)) {
                if (exception_type == EXEXIT)
-/* dash bug: it just does _exit(exitstatus) here
- * but we have to do setjobctl(0) first!
- * (bug is still not fixed in dash-0.5.3 - if you run dash
- * under Midnight Commander, on exit from dash MC is backgrounded) */
                        status = exitstatus;
                goto out;
        }
@@ -13437,11 +13676,15 @@ exitshell(void)
        p = trap[0];
        if (p) {
                trap[0] = NULL;
+                evalskip = 0;
                evalstring(p, 0);
-                free(p);
+                /*free(p); - we'll exit soon */
        }
        flush_stdout_stderr();
 out:
+        /* dash wraps setjobctl(0) in "if (setjmp(loc.loc) == 0) {...}".
+         * our setjobctl(0) does not panic if tcsetpgrp fails inside it.
+         */
        setjobctl(0);
        _exit(status);
        /* NOTREACHED */
@@ -13454,18 +13697,15 @@ init(int xp)
 init(void)
 #endif
 {
-        /* from input.c: */
        /* we will never free this */
        basepf.next_to_pgetc = basepf.buf = ckmalloc(IBUFSIZ);
-        /* from trap.c: */
        signal(SIGCHLD, SIG_DFL);
        /* bash re-enables SIGHUP which is SIG_IGNed on entry.
         * Try: "trap '' HUP; bash; echo RET" and type "kill -HUP $$"
         */
        signal(SIGHUP, SIG_DFL);
-        /* from var.c: */
        {
                char **envp;
                const char *p;
@@ -13553,11 +13793,14 @@ init(void)
                }
 #endif
                for (envp = environ; envp && *envp; envp++) {
-                        if (strchr(*envp, '=')) {
+                        p = endofname(*envp);
+                        if (p != *envp && *p == '=') {
                                setvareq(*envp, VEXPORT|VTEXTFIXED);
                        }
                }
+                setvareq((char*)defoptindvar, VTEXTFIXED);
                setvar0("PPID", utoa(getppid()));
 #if ENABLE_ASH_BASH_COMPAT
                p = lookupvar("SHLVL");
@@ -13570,10 +13813,10 @@ init(void)
 #endif
                p = lookupvar("PWD");
                if (p) {
-                        if (*p != '/' || stat(p, &st1) || stat(".", &st2)
+                        if (p[0] != '/' || stat(p, &st1) || stat(".", &st2)
                         || st1.st_dev != st2.st_dev || st1.st_ino != st2.st_ino
                        ) {
-                                p = '\0';
+                                p = NULL;
                        }
                }
                setpwd(p, 0);
@@ -13664,14 +13907,10 @@ procargs(char **argv)
 static void
 read_profile(const char *name)
 {
-        int skip;
        if (setinputfile(name, INPUT_PUSH_FILE | INPUT_NOFILE_OK) < 0)
                return;
-        skip = cmdloop(0);
+        cmdloop(0);
        popfile();
-        if (skip)
-                exitshell();
 }
 /*
diff --git a/shell/ash_test/ash-glob/glob_dir.right b/shell/ash_test/ash-glob/glob_dir.right
new file mode 100644
index 000000000..aa90514d5
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_dir.right
@@ -0,0 +1,19 @@
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+*/z.tmp
+*/z.*
+*/?.*
+*/z*p
+d*r*e*t/z*p
+*\/z.tmp
+*/z.*
+*/z*p
+d*r*e*t/z*p
diff --git a/shell/ash_test/ash-glob/glob_dir.tests b/shell/ash_test/ash-glob/glob_dir.tests
new file mode 100755
index 000000000..dc4c4fdb5
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_dir.tests
@@ -0,0 +1,25 @@
+mkdir dirtest
+     >dirtest/z.tmp
+echo */z.tmp
+echo */z.*
+echo */?.*
+echo */z*p
+echo d*r*e*t/z*p
+echo *"/z.t"mp
+echo */z"."*
+echo *"/z"*"p"
+echo "d"*r*e*t"/"z*p
+echo
+echo \*/z.tmp
+echo "*"/z.*
+echo */"?".*
+echo */z"*p"
+echo d*r*e\*t/z*p
+echo *"\\/z.t"mp
+echo */z".*"
+echo *"/z"\*"p"
+echo "d*"r*e*t"/"z*p
+rm dirtest/z.tmp
+rmdir dirtest
diff --git a/shell/hush_test/hush-misc/heredoc2.right b/shell/ash_test/ash-heredoc/heredoc5.right
index 74110e3b5..74110e3b5 100644
--- a/shell/hush_test/hush-misc/heredoc2.right
+++ b/shell/ash_test/ash-heredoc/heredoc5.right
diff --git a/shell/hush_test/hush-misc/heredoc2.tests b/shell/ash_test/ash-heredoc/heredoc5.tests
index e619bded1..e619bded1 100755
--- a/shell/hush_test/hush-misc/heredoc2.tests
+++ b/shell/ash_test/ash-heredoc/heredoc5.tests
diff --git a/shell/hush_test/hush-misc/heredoc_huge.right b/shell/ash_test/ash-heredoc/heredoc_huge.right
index 11740f674..11740f674 100644
--- a/shell/hush_test/hush-misc/heredoc_huge.right
+++ b/shell/ash_test/ash-heredoc/heredoc_huge.right
diff --git a/shell/hush_test/hush-misc/heredoc_huge.tests b/shell/ash_test/ash-heredoc/heredoc_huge.tests
index c2ec2817b..c2ec2817b 100755
--- a/shell/hush_test/hush-misc/heredoc_huge.tests
+++ b/shell/ash_test/ash-heredoc/heredoc_huge.tests
diff --git a/shell/ash_test/ash-misc/and-or.right b/shell/ash_test/ash-misc/and-or.right
new file mode 100644
index 000000000..f9fa5fbf8
--- /dev/null
+++ b/shell/ash_test/ash-misc/and-or.right
@@ -0,0 +1,18 @@
+a1
+a4
+b1
+b3
+b4
+b6
+c4
+c5
+c7
+c8
+ff1
+ff3
+ft2
+ft3
+tf2
+tf3
+tt2
+tt4
diff --git a/shell/ash_test/ash-misc/and-or.tests b/shell/ash_test/ash-misc/and-or.tests
new file mode 100755
index 000000000..485458abe
--- /dev/null
+++ b/shell/ash_test/ash-misc/and-or.tests
@@ -0,0 +1,34 @@
+false || echo a1
+false && echo a2
+true || echo a3
+true && echo a4
+false || echo b1 || echo b2
+false || echo b3 && echo b4
+false && echo b5 || echo b6
+false && echo b7 && echo b8
+true || echo c1 || echo c2
+true || echo c3 && echo c4
+true && echo c5 || echo c6
+true && echo c7 && echo c8
+false || false || echo ff1
+false || false && echo ff2
+false && false || echo ff3
+false && false && echo ff4
+false || true || echo ft1
+false || true && echo ft2
+false && true || echo ft3
+false && true && echo ft4
+true || false || echo tf1
+true || false && echo tf2
+true && false || echo tf3
+true && false && echo tf4
+true || true || echo tt1
+true || true && echo tt2
+true && true || echo tt3
+true && true && echo tt4
diff --git a/shell/ash_test/ash-misc/assignment1.right b/shell/ash_test/ash-misc/assignment1.right
new file mode 100644
index 000000000..d0a13d3d8
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment1.right
@@ -0,0 +1,9 @@
+if1:0
+while1:0
+until1:0
+if2:0
+while2:0
+until2:0
+if3:0
+while3:0
+until3:0
diff --git a/shell/ash_test/ash-misc/assignment1.tests b/shell/ash_test/ash-misc/assignment1.tests
new file mode 100755
index 000000000..033b35250
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment1.tests
@@ -0,0 +1,42 @@
+# Assignments after some keywords should still work
+if a=1 true; then a=1 true; elif a=1 true; then a=1 true; else a=1 true; fi
+echo if1:$?
+while a=1 true; do a=1 true; break; done
+echo while1:$?
+until a=1 false; do a=1 true; break; done
+echo until1:$?
+if a=1 true
+ then a=1 true
+ elif a=1 true
+ then a=1 true
+ else a=1 true
+ fi
+echo if2:$?
+while a=1 true
+ do a=1 true
+ break
+ done
+echo while2:$?
+until a=1 false
+ do a=1 true
+ break
+ done
+echo until2:$?
+if
+ a=1 true; then
+ a=1 true; elif
+ a=1 true; then
+ a=1 true; else
+ a=1 true; fi
+echo if3:$?
+while
+ a=1 true; do
+ a=1 true; break; done
+echo while3:$?
+until
+ a=1 false; do
+ a=1 true; break; done
+echo until3:$?
diff --git a/shell/ash_test/ash-misc/assignment3.right b/shell/ash_test/ash-misc/assignment3.right
new file mode 100644
index 000000000..0f02d7cbc
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment3.right
@@ -0,0 +1,2 @@
+Done:0
+abc=123
diff --git a/shell/ash_test/ash-misc/assignment3.tests b/shell/ash_test/ash-misc/assignment3.tests
new file mode 100755
index 000000000..790129be1
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment3.tests
@@ -0,0 +1,5 @@
+# This must be interpreted as assignments
+a=1 b\
+=2 c=3
+echo Done:$?
+echo abc=$a$b$c
diff --git a/shell/ash_test/ash-misc/assignment4.right b/shell/ash_test/ash-misc/assignment4.right
new file mode 100644
index 000000000..31c896f62
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment4.right
@@ -0,0 +1 @@
+Done:0
diff --git a/shell/ash_test/ash-misc/assignment4.tests b/shell/ash_test/ash-misc/assignment4.tests
new file mode 100755
index 000000000..6f46d0a33
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment4.tests
@@ -0,0 +1,3 @@
+# There was a bug where we misinterpreted assignments after 'do':
+for i in 1; do eval b=; done
+echo Done:$?
diff --git a/shell/ash_test/ash-misc/break1.right b/shell/ash_test/ash-misc/break1.right
new file mode 100644
index 000000000..04a4b1757
--- /dev/null
+++ b/shell/ash_test/ash-misc/break1.right
@@ -0,0 +1,2 @@
+A
+OK:0
diff --git a/shell/ash_test/ash-misc/break1.tests b/shell/ash_test/ash-misc/break1.tests
new file mode 100755
index 000000000..3a6b060d9
--- /dev/null
+++ b/shell/ash_test/ash-misc/break1.tests
@@ -0,0 +1,2 @@
+while true; do echo A; break; echo B; done
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/break2.right b/shell/ash_test/ash-misc/break2.right
new file mode 100644
index 000000000..8a15cb95f
--- /dev/null
+++ b/shell/ash_test/ash-misc/break2.right
@@ -0,0 +1,3 @@
+A
+AA
+OK:0
diff --git a/shell/ash_test/ash-misc/break2.tests b/shell/ash_test/ash-misc/break2.tests
new file mode 100755
index 000000000..7da9faf34
--- /dev/null
+++ b/shell/ash_test/ash-misc/break2.tests
@@ -0,0 +1,6 @@
+while true; do
+    echo A
+    while true; do echo AA; break 2; echo BB; done
+    echo B
+done
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/break3.right b/shell/ash_test/ash-misc/break3.right
new file mode 100644
index 000000000..04a4b1757
--- /dev/null
+++ b/shell/ash_test/ash-misc/break3.right
@@ -0,0 +1,2 @@
+A
+OK:0
diff --git a/shell/ash_test/ash-misc/break3.tests b/shell/ash_test/ash-misc/break3.tests
new file mode 100755
index 000000000..d138dcac5
--- /dev/null
+++ b/shell/ash_test/ash-misc/break3.tests
@@ -0,0 +1,2 @@
+v=break; while true; do echo A; $v; echo B; break; echo C; done
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/break4.right b/shell/ash_test/ash-misc/break4.right
new file mode 100644
index 000000000..6f41c141d
--- /dev/null
+++ b/shell/ash_test/ash-misc/break4.right
@@ -0,0 +1,6 @@
+A
+AA
+TRUE
+A
+AA
+OK:0
diff --git a/shell/ash_test/ash-misc/break4.tests b/shell/ash_test/ash-misc/break4.tests
new file mode 100755
index 000000000..67da2889c
--- /dev/null
+++ b/shell/ash_test/ash-misc/break4.tests
@@ -0,0 +1,12 @@
+cond=true
+while $cond; do
+    echo A
+    if test "$cond" = true; then
+        cond='echo TRUE'
+    else
+        cond=false
+    fi
+    while true; do echo AA; continue 2; echo BB; done
+    echo B
+done
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/break5.right b/shell/ash_test/ash-misc/break5.right
new file mode 100644
index 000000000..0b9df2a4f
--- /dev/null
+++ b/shell/ash_test/ash-misc/break5.right
@@ -0,0 +1,13 @@
+A
+B
+0
+A:a
+B
+D
+A:b
+B
+D
+A:c
+B
+D
+0
diff --git a/shell/ash_test/ash-misc/break5.tests b/shell/ash_test/ash-misc/break5.tests
new file mode 100755
index 000000000..273e040ec
--- /dev/null
+++ b/shell/ash_test/ash-misc/break5.tests
@@ -0,0 +1,4 @@
+while true; do echo A; { echo B; break; echo C; }; echo D; done
+echo $?
+for v in a b c; do echo A:$v; (echo B; break; echo C); echo D; done
+echo $?
diff --git a/shell/ash_test/ash-misc/builtin1.right b/shell/ash_test/ash-misc/builtin1.right
new file mode 100644
index 000000000..2e55ecb09
--- /dev/null
+++ b/shell/ash_test/ash-misc/builtin1.right
@@ -0,0 +1,2 @@
+VARIABLE=export
+OK:0
diff --git a/shell/ash_test/ash-misc/builtin1.tests b/shell/ash_test/ash-misc/builtin1.tests
new file mode 100755
index 000000000..1a2941faa
--- /dev/null
+++ b/shell/ash_test/ash-misc/builtin1.tests
@@ -0,0 +1,6 @@
+# builtins, unlike keywords like "while", can be constructed
+# with substitutions
+VARIABLE=export
+$VARIABLE VARIABLE
+env | grep ^VARIABLE
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/case1.right b/shell/ash_test/ash-misc/case1.right
new file mode 100644
index 000000000..4afb2f51c
--- /dev/null
+++ b/shell/ash_test/ash-misc/case1.right
@@ -0,0 +1,22 @@
+OK_1
+OK_1
+OK_21
+OK_22
+OK_23
+OK_31
+OK_32
+OK_41
+OK_42
+OK_43
+OK_44
+OK_51
+OK_52
+OK_53
+OK_sub1
+OK_sub2
+OK_sub3
+OK_sub4
+OK_sub5
+OK_sub6
+OK_esac1
+Done
diff --git a/shell/ash_test/ash-misc/case1.tests b/shell/ash_test/ash-misc/case1.tests
new file mode 100755
index 000000000..d72b57f53
--- /dev/null
+++ b/shell/ash_test/ash-misc/case1.tests
@@ -0,0 +1,40 @@
+case w in a) echo SKIP;; w) echo OK_1;; w) echo WRONG;; esac
+case w in
+ a) echo SKIP;;
+ w)echo OK_1 ;;
+ w)
+ echo WRONG
+ ;;
+esac
+t=w
+case $t in a) echo SKIP;; w) echo OK_21;; w) echo WRONG;; esac;
+case "$t" in a) echo SKIP;; w) echo OK_22;; w) echo WRONG;; esac;
+case w in a) echo SKIP;; $t) echo OK_23;; "$t") echo WRONG;; esac;
+case '' in a) echo SKIP;; w) echo WRONG;; *) echo OK_31;; esac;
+case '' in a) echo SKIP;; '') echo OK_32;; *) echo WRONG;; esac;
+case `echo w` in a) echo SKIP;; w) echo OK_41;; w) echo WRONG;; esac;
+case "`echo w`" in a) echo SKIP;; w) echo OK_42;; w) echo WRONG;; esac;
+case `echo w w` in a) echo SKIP;; w) echo WRONG;; 'w w') echo OK_43;; esac;
+case `echo w w` in a) echo SKIP;; w) echo WRONG;; w*) echo OK_44;; esac;
+case w in `echo w`) echo OK_51;; `echo WRONG >&2`w) echo WRONG;; esac;
+case w in `echo OK_52 >&2`) echo SKIP;; `echo`w) echo OK_53;; esac;
+# parsing cases in subshells can easily get messy
+ case m in  m) echo OK_sub1;; esac
+ case m in (m) echo OK_sub2;; esac
+(case m in  m) echo OK_sub3;; esac)
+(case m in (m) echo OK_sub4;; esac)
+(
+ case m in  m) echo OK_sub5;; esac
+)
+(
+ case m in (m) echo OK_sub6;; esac
+)
+(case esac in "esac") echo OK_esac1;; esac)
+echo Done
diff --git a/shell/ash_test/ash-misc/colon.right b/shell/ash_test/ash-misc/colon.right
new file mode 100644
index 000000000..2a87d0293
--- /dev/null
+++ b/shell/ash_test/ash-misc/colon.right
@@ -0,0 +1,2 @@
+0
+OK: 0
diff --git a/shell/ash_test/ash-misc/colon.tests b/shell/ash_test/ash-misc/colon.tests
new file mode 100755
index 000000000..cb8ab5306
--- /dev/null
+++ b/shell/ash_test/ash-misc/colon.tests
@@ -0,0 +1,5 @@
+false
+:
+echo $?
+(while :; do exit; done)
+echo OK: $?
diff --git a/shell/ash_test/ash-misc/compound.right b/shell/ash_test/ash-misc/compound.right
new file mode 100644
index 000000000..757d42fe4
--- /dev/null
+++ b/shell/ash_test/ash-misc/compound.right
@@ -0,0 +1,14 @@
+new group
+0
+1
+2
+3
+4
+5
+6
+new group
+new group
+0
+1
+2
+3
diff --git a/shell/ash_test/ash-misc/compound.tests b/shell/ash_test/ash-misc/compound.tests
new file mode 100755
index 000000000..a5e85c3d5
--- /dev/null
+++ b/shell/ash_test/ash-misc/compound.tests
@@ -0,0 +1,21 @@
+echo new group
+echo 0;  { :; }
+echo 1;  { : ;}
+echo 2; ({ :; })
+echo 3; ({ : ;})
+echo 4;  ( :  )
+echo 5;  ( :; )
+echo 6;  ( : ;)
+# not sure if POSIX requires these, but bash accepts them ...
+#echo 7; {( :  )}
+#echo 8; {( :; )}
+#echo 9; {( : ;)}
+echo new group
+#echo 0;  {(:);}
+echo new group
+echo 0;  (:)
+echo 1;  (:;)
+echo 2;  (:);
+echo 3;  (:;);
diff --git a/shell/ash_test/ash-misc/continue1.right b/shell/ash_test/ash-misc/continue1.right
new file mode 100644
index 000000000..c4a5565bc
--- /dev/null
+++ b/shell/ash_test/ash-misc/continue1.right
@@ -0,0 +1,8 @@
+A:a
+A:b
+A:c
+OK1
+A:a
+A:b
+A:c
+OK2
diff --git a/shell/ash_test/ash-misc/continue1.tests b/shell/ash_test/ash-misc/continue1.tests
new file mode 100755
index 000000000..72d356660
--- /dev/null
+++ b/shell/ash_test/ash-misc/continue1.tests
@@ -0,0 +1,4 @@
+for v in a b c; do echo A:$v; continue 666; done
+echo OK1
+for v in a b c; do echo A:$v; continue 666; done
+echo OK2
diff --git a/shell/ash_test/ash-misc/continue2.right b/shell/ash_test/ash-misc/continue2.right
new file mode 100644
index 000000000..49d3ebd3a
--- /dev/null
+++ b/shell/ash_test/ash-misc/continue2.right
@@ -0,0 +1 @@
+Ok:1
diff --git a/shell/ash_test/ash-misc/continue2.tests b/shell/ash_test/ash-misc/continue2.tests
new file mode 100755
index 000000000..c2df07195
--- /dev/null
+++ b/shell/ash_test/ash-misc/continue2.tests
@@ -0,0 +1,3 @@
+e=''
+(while test $e && exit 1; true; do e=1; continue; done)
+echo Ok:$?
diff --git a/shell/ash_test/ash-misc/continue3.right b/shell/ash_test/ash-misc/continue3.right
new file mode 100644
index 000000000..aa47d0d46
--- /dev/null
+++ b/shell/ash_test/ash-misc/continue3.right
@@ -0,0 +1,2 @@
+0
+0
diff --git a/shell/ash_test/ash-misc/continue3.tests b/shell/ash_test/ash-misc/continue3.tests
new file mode 100755
index 000000000..0aff867cd
--- /dev/null
+++ b/shell/ash_test/ash-misc/continue3.tests
@@ -0,0 +1,3 @@
+# Test that "continue" does affect exitcode (sets to 0)
+e=''
+while echo $?; test $e && exit; true; do e=1; false; continue; done
diff --git a/shell/ash_test/ash-misc/empty_for.right b/shell/ash_test/ash-misc/empty_for.right
new file mode 100644
index 000000000..290d39b7e
--- /dev/null
+++ b/shell/ash_test/ash-misc/empty_for.right
@@ -0,0 +1 @@
+OK: 0
diff --git a/shell/ash_test/ash-misc/empty_for.tests b/shell/ash_test/ash-misc/empty_for.tests
new file mode 100755
index 000000000..0cb52e849
--- /dev/null
+++ b/shell/ash_test/ash-misc/empty_for.tests
@@ -0,0 +1,3 @@
+false
+for a in; do echo "HELLO"; done
+echo OK: $?
diff --git a/shell/ash_test/ash-misc/empty_for2.right b/shell/ash_test/ash-misc/empty_for2.right
new file mode 100644
index 000000000..1acee9eb8
--- /dev/null
+++ b/shell/ash_test/ash-misc/empty_for2.right
@@ -0,0 +1,4 @@
+PARAM:abc
+PARAM:d e
+PARAM:123
+OK: 0
diff --git a/shell/ash_test/ash-misc/empty_for2.tests b/shell/ash_test/ash-misc/empty_for2.tests
new file mode 100755
index 000000000..2b12ec2c1
--- /dev/null
+++ b/shell/ash_test/ash-misc/empty_for2.tests
@@ -0,0 +1,6 @@
+if test $# = 0; then
+    exec "$THIS_SH" $0 abc "d e" 123
+fi
+false
+for v; do echo "PARAM:$v"; done
+echo OK: $?
diff --git a/shell/msh_test/msh-execution/many_continues.right b/shell/ash_test/ash-misc/errexit1.right
index d86bac9de..d86bac9de 100644
--- a/shell/msh_test/msh-execution/many_continues.right
+++ b/shell/ash_test/ash-misc/errexit1.right
diff --git a/shell/ash_test/ash-misc/errexit1.tests b/shell/ash_test/ash-misc/errexit1.tests
new file mode 100755
index 000000000..7b4a15634
--- /dev/null
+++ b/shell/ash_test/ash-misc/errexit1.tests
@@ -0,0 +1,5 @@
+set -e
+(true)
+echo OK
+(false)
+echo FAIL
diff --git a/shell/ash_test/ash-misc/eval1.right b/shell/ash_test/ash-misc/eval1.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/ash_test/ash-misc/eval1.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/ash_test/ash-misc/eval1.tests b/shell/ash_test/ash-misc/eval1.tests
new file mode 100755
index 000000000..b78c6cc94
--- /dev/null
+++ b/shell/ash_test/ash-misc/eval1.tests
@@ -0,0 +1,4 @@
+# empty eval nevertheless sets $? = 0
+false
+eval
+echo Ok:$?
diff --git a/shell/ash_test/ash-misc/eval2.right b/shell/ash_test/ash-misc/eval2.right
new file mode 100644
index 000000000..a7ce6ccc7
--- /dev/null
+++ b/shell/ash_test/ash-misc/eval2.right
@@ -0,0 +1,3 @@
+Zero:0
+Zero:0
+Zero:0
diff --git a/shell/ash_test/ash-misc/eval2.tests b/shell/ash_test/ash-misc/eval2.tests
new file mode 100755
index 000000000..6bfb87aa7
--- /dev/null
+++ b/shell/ash_test/ash-misc/eval2.tests
@@ -0,0 +1,4 @@
+false; eval; echo Zero:$?
+false; eval ""; echo Zero:$?
+false; eval "
+"; echo Zero:$?
diff --git a/shell/ash_test/ash-misc/exit1.right b/shell/ash_test/ash-misc/exit1.right
new file mode 100644
index 000000000..dd2cfc279
--- /dev/null
+++ b/shell/ash_test/ash-misc/exit1.right
@@ -0,0 +1 @@
+Once
diff --git a/shell/ash_test/ash-misc/exit1.tests b/shell/ash_test/ash-misc/exit1.tests
new file mode 100755
index 000000000..41e0d092d
--- /dev/null
+++ b/shell/ash_test/ash-misc/exit1.tests
@@ -0,0 +1,4 @@
+trap "echo Not shown" EXIT
+(exit)  # must be silent
+trap "echo Once; exit" EXIT
+{ exit; }
diff --git a/shell/ash_test/ash-misc/exitcode1.right b/shell/ash_test/ash-misc/exitcode1.right
new file mode 100644
index 000000000..e5fefefda
--- /dev/null
+++ b/shell/ash_test/ash-misc/exitcode1.right
@@ -0,0 +1,2 @@
+One:1
+Zero:0
diff --git a/shell/ash_test/ash-misc/exitcode1.tests b/shell/ash_test/ash-misc/exitcode1.tests
new file mode 100755
index 000000000..dc8619d8b
--- /dev/null
+++ b/shell/ash_test/ash-misc/exitcode1.tests
@@ -0,0 +1,2 @@
+false || case a in a) echo One:$?;; esac
+echo Zero:$?
diff --git a/shell/ash_test/ash-misc/exitcode_EACCES.right b/shell/ash_test/ash-misc/exitcode_EACCES.right
new file mode 100644
index 000000000..0a332f56c
--- /dev/null
+++ b/shell/ash_test/ash-misc/exitcode_EACCES.right
@@ -0,0 +1,2 @@
+exitcode_EACCES.tests: line 1: ./: Permission denied
+126
diff --git a/shell/msh_test/msh-execution/exitcode_EACCES.tests b/shell/ash_test/ash-misc/exitcode_EACCES.tests
index 26b5c6116..26b5c6116 100755
--- a/shell/msh_test/msh-execution/exitcode_EACCES.tests
+++ b/shell/ash_test/ash-misc/exitcode_EACCES.tests
diff --git a/shell/ash_test/ash-misc/exitcode_ENOENT.right b/shell/ash_test/ash-misc/exitcode_ENOENT.right
new file mode 100644
index 000000000..45b27b32e
--- /dev/null
+++ b/shell/ash_test/ash-misc/exitcode_ENOENT.right
@@ -0,0 +1,2 @@
+exitcode_ENOENT.tests: line 1: ./does_not_exist_for_sure: not found
+127
diff --git a/shell/msh_test/msh-execution/exitcode_ENOENT.tests b/shell/ash_test/ash-misc/exitcode_ENOENT.tests
index 7f1b88a99..7f1b88a99 100755
--- a/shell/msh_test/msh-execution/exitcode_ENOENT.tests
+++ b/shell/ash_test/ash-misc/exitcode_ENOENT.tests
diff --git a/shell/ash_test/ash-misc/for_with_bslashes.right b/shell/ash_test/ash-misc/for_with_bslashes.right
new file mode 100644
index 000000000..02d96692c
--- /dev/null
+++ b/shell/ash_test/ash-misc/for_with_bslashes.right
@@ -0,0 +1,8 @@
+a
+b\c
+b\\c
+b"c
+b'c
+b$c
+b`true`c
+Zero:0
diff --git a/shell/ash_test/ash-misc/for_with_bslashes.tests b/shell/ash_test/ash-misc/for_with_bslashes.tests
new file mode 100755
index 000000000..363f3d85b
--- /dev/null
+++ b/shell/ash_test/ash-misc/for_with_bslashes.tests
@@ -0,0 +1,10 @@
+# UNFIXED BUG.
+# commented-out words contain ^C character.
+# It's a SPECIAL_VAR_SYMBOL, for now hush does not escape it.
+# When it is fixed, update this test.
+for a in 'a' 'b\c' 'b\\c' 'b"c' "b'c" 'b$c' 'b`true`c' ### 'b#c'
+do
+    echo $a
+done
+echo Zero:$?
diff --git a/shell/ash_test/ash-misc/for_with_keywords.right b/shell/ash_test/ash-misc/for_with_keywords.right
new file mode 100644
index 000000000..eb04e9af9
--- /dev/null
+++ b/shell/ash_test/ash-misc/for_with_keywords.right
@@ -0,0 +1,4 @@
+do
+done
+then
+OK: 0
diff --git a/shell/ash_test/ash-misc/for_with_keywords.tests b/shell/ash_test/ash-misc/for_with_keywords.tests
new file mode 100755
index 000000000..a8b8e4264
--- /dev/null
+++ b/shell/ash_test/ash-misc/for_with_keywords.tests
@@ -0,0 +1,2 @@
+for if in do done then; do echo $if; done
+echo OK: $?
diff --git a/shell/ash_test/ash-misc/func6.right b/shell/ash_test/ash-misc/func6.right
new file mode 100644
index 000000000..0ebd8e5a3
--- /dev/null
+++ b/shell/ash_test/ash-misc/func6.right
@@ -0,0 +1,2 @@
+Two:2
+Two:2
diff --git a/shell/ash_test/ash-misc/func6.tests b/shell/ash_test/ash-misc/func6.tests
new file mode 100755
index 000000000..029c3e85e
--- /dev/null
+++ b/shell/ash_test/ash-misc/func6.tests
@@ -0,0 +1,11 @@
+f1() {
+        while return 2; do :; done
+}
+f1
+echo Two:$?
+f2() {
+        while :; do return 2; done
+}
+f2
+echo Two:$?
diff --git a/shell/ash_test/ash-misc/if_false_exitcode.right b/shell/ash_test/ash-misc/if_false_exitcode.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/ash_test/ash-misc/if_false_exitcode.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/ash_test/ash-misc/if_false_exitcode.tests b/shell/ash_test/ash-misc/if_false_exitcode.tests
new file mode 100755
index 000000000..01b36b100
--- /dev/null
+++ b/shell/ash_test/ash-misc/if_false_exitcode.tests
@@ -0,0 +1,2 @@
+if false; then echo Bad; fi
+echo Ok:$?
diff --git a/shell/ash_test/ash-misc/nommu1.right b/shell/ash_test/ash-misc/nommu1.right
new file mode 100644
index 000000000..d206a854b
--- /dev/null
+++ b/shell/ash_test/ash-misc/nommu1.right
@@ -0,0 +1,7 @@
+Ok
+Ok
+Ok
+Ok
+Ok
+Ok
+Done
diff --git a/shell/ash_test/ash-misc/nommu1.tests b/shell/ash_test/ash-misc/nommu1.tests
new file mode 100755
index 000000000..e14ada5f9
--- /dev/null
+++ b/shell/ash_test/ash-misc/nommu1.tests
@@ -0,0 +1,12 @@
+(echo \
+Ok)
+( (echo \
+Ok) )
+( ( (echo \
+Ok) ) )
+(echo \Ok)
+( (echo \Ok) )
+( ( (echo \Ok) ) )
+echo Done
diff --git a/shell/ash_test/ash-misc/nommu2.right b/shell/ash_test/ash-misc/nommu2.right
new file mode 100644
index 000000000..fb8ba8b5c
--- /dev/null
+++ b/shell/ash_test/ash-misc/nommu2.right
@@ -0,0 +1,5 @@
+Ok
+Ok
+Ok
+Ok
+Done
diff --git a/shell/ash_test/ash-misc/nommu2.tests b/shell/ash_test/ash-misc/nommu2.tests
new file mode 100755
index 000000000..61ed5ce5b
--- /dev/null
+++ b/shell/ash_test/ash-misc/nommu2.tests
@@ -0,0 +1,5 @@
+echo Not shown | if true; then echo $(echo Ok); fi
+echo Not shown | if true; then echo `echo Ok`; fi
+echo Not shown | ( if true; then echo $(echo Ok); fi )
+echo Not shown | ( if true; then echo `echo Ok`; fi )
+echo Done
diff --git a/shell/ash_test/ash-misc/nommu3.right b/shell/ash_test/ash-misc/nommu3.right
new file mode 100644
index 000000000..da1534bef
--- /dev/null
+++ b/shell/ash_test/ash-misc/nommu3.right
@@ -0,0 +1,2 @@
+Ok
+0
diff --git a/shell/ash_test/ash-misc/nommu3.tests b/shell/ash_test/ash-misc/nommu3.tests
new file mode 100755
index 000000000..ac82a6a11
--- /dev/null
+++ b/shell/ash_test/ash-misc/nommu3.tests
@@ -0,0 +1,15 @@
+#!/bin/sh
+func()
+{
+        while read p; do echo "$p"; done
+}
+pipe_to_func()
+{
+        # We had a NOMMU bug which caused "echo Ok |" part to be lost
+        echo Ok | func
+}
+pipe_to_func | cat
+echo $?
diff --git a/shell/ash_test/ash-misc/opts1.right b/shell/ash_test/ash-misc/opts1.right
new file mode 100644
index 000000000..4da75737d
--- /dev/null
+++ b/shell/ash_test/ash-misc/opts1.right
@@ -0,0 +1,2 @@
+Param1: >-10qwertyuiop<
+Done
diff --git a/shell/ash_test/ash-misc/opts1.tests b/shell/ash_test/ash-misc/opts1.tests
new file mode 100755
index 000000000..45a23d66b
--- /dev/null
+++ b/shell/ash_test/ash-misc/opts1.tests
@@ -0,0 +1,5 @@
+if test $# = 0; then
+    exec "$THIS_SH" $0 -10qwertyuiop
+fi
+echo "Param1: >$1<"
+echo Done
diff --git a/shell/ash_test/ash-misc/pid.right b/shell/ash_test/ash-misc/pid.right
new file mode 100644
index 000000000..573541ac9
--- /dev/null
+++ b/shell/ash_test/ash-misc/pid.right
@@ -0,0 +1 @@
+0
diff --git a/shell/ash_test/ash-misc/pid.tests b/shell/ash_test/ash-misc/pid.tests
new file mode 100755
index 000000000..eaeaa717b
--- /dev/null
+++ b/shell/ash_test/ash-misc/pid.tests
@@ -0,0 +1 @@
+test `(echo $$)` = `echo $$`; echo $?
diff --git a/shell/ash_test/ash-misc/pipefail.right b/shell/ash_test/ash-misc/pipefail.right
new file mode 100644
index 000000000..5845d8939
--- /dev/null
+++ b/shell/ash_test/ash-misc/pipefail.right
@@ -0,0 +1,40 @@
+Default:
+true | true:
+0
+1
+true | false:
+1
+0
+false | true:
+0
+1
+exit 2 | exit 3 | exit 4:
+4
+0
+Pipefail on:
+true | true:
+0
+1
+true | false:
+1
+0
+false | true:
+1
+0
+exit 2 | exit 3 | exit 4:
+4
+0
+Pipefail off:
+true | true:
+0
+1
+true | false:
+1
+0
+false | true:
+0
+1
+exit 2 | exit 3 | exit 4:
+4
+0
+Done
diff --git a/shell/ash_test/ash-misc/pipefail.tests b/shell/ash_test/ash-misc/pipefail.tests
new file mode 100755
index 000000000..9df841861
--- /dev/null
+++ b/shell/ash_test/ash-misc/pipefail.tests
@@ -0,0 +1,45 @@
+echo Default:
+echo "true | true:"
+  true | true; echo $?
+! true | true; echo $?
+echo "true | false:"
+  true | false; echo $?
+! true | false; echo $?
+echo "false | true:"
+  false | true; echo $?
+! false | true; echo $?
+echo "exit 2 | exit 3 | exit 4:"
+  exit 2 | exit 3 | exit 4; echo $?
+! exit 2 | exit 3 | exit 4; echo $?
+echo Pipefail on:
+set -o pipefail
+echo "true | true:"
+  true | true; echo $?
+! true | true; echo $?
+echo "true | false:"
+  true | false; echo $?
+! true | false; echo $?
+echo "false | true:"
+  false | true; echo $?
+! false | true; echo $?
+echo "exit 2 | exit 3 | exit 4:"
+  exit 2 | exit 3 | exit 4; echo $?
+! exit 2 | exit 3 | exit 4; echo $?
+echo Pipefail off:
+set +o pipefail
+echo "true | true:"
+  true | true; echo $?
+! true | true; echo $?
+echo "true | false:"
+  true | false; echo $?
+! true | false; echo $?
+echo "false | true:"
+  false | true; echo $?
+! false | true; echo $?
+echo "exit 2 | exit 3 | exit 4:"
+  exit 2 | exit 3 | exit 4; echo $?
+! exit 2 | exit 3 | exit 4; echo $?
+echo Done
diff --git a/shell/msh_test/msh-bugs/read.right b/shell/ash_test/ash-misc/read.right
index 0e50e2a23..0e50e2a23 100644
--- a/shell/msh_test/msh-bugs/read.right
+++ b/shell/ash_test/ash-misc/read.right
diff --git a/shell/msh_test/msh-bugs/read.tests b/shell/ash_test/ash-misc/read.tests
index ff1acbde1..ff1acbde1 100755
--- a/shell/msh_test/msh-bugs/read.tests
+++ b/shell/ash_test/ash-misc/read.tests
diff --git a/shell/ash_test/ash-misc/return1.right b/shell/ash_test/ash-misc/return1.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/ash_test/ash-misc/return1.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/ash_test/ash-misc/return1.tests b/shell/ash_test/ash-misc/return1.tests
new file mode 100755
index 000000000..eeb92ef3f
--- /dev/null
+++ b/shell/ash_test/ash-misc/return1.tests
@@ -0,0 +1,4 @@
+echo "true && return; echo Should not be printed" >return_sourced
+. ./return_sourced
+rm return_sourced
+echo Ok:$?
diff --git a/shell/msh_test/msh-bugs/shift.right b/shell/ash_test/ash-misc/shift.right
index d281e358c..d281e358c 100644
--- a/shell/msh_test/msh-bugs/shift.right
+++ b/shell/ash_test/ash-misc/shift.right
diff --git a/shell/msh_test/msh-bugs/shift.tests b/shell/ash_test/ash-misc/shift.tests
index 53ef249f2..53ef249f2 100755
--- a/shell/msh_test/msh-bugs/shift.tests
+++ b/shell/ash_test/ash-misc/shift.tests
diff --git a/shell/ash_test/ash-misc/sigint1.right b/shell/ash_test/ash-misc/sigint1.right
new file mode 100644
index 000000000..a9094b056
--- /dev/null
+++ b/shell/ash_test/ash-misc/sigint1.right
@@ -0,0 +1 @@
+Sending SIGINT to main shell PID
diff --git a/shell/ash_test/ash-misc/sigint1.tests b/shell/ash_test/ash-misc/sigint1.tests
new file mode 100755
index 000000000..3d483d32a
--- /dev/null
+++ b/shell/ash_test/ash-misc/sigint1.tests
@@ -0,0 +1,41 @@
+# What should happen if non-interactive shell gets SIGINT?
+(sleep 1; echo Sending SIGINT to main shell PID; exec kill -INT $$) &
+# We create a child which exits with 0 even on SIGINT
+# (The complex command is necessary only if SIGINT is generated by ^C,
+# in this testcase even bare "sleep 2" would do because
+# in the testcase we don't send SIGINT *to the child*...)
+$THIS_SH -c 'trap "exit 0" SIGINT; sleep 2'
+# In one second, we (main shell) get SIGINT here.
+# The question is whether we should, or should not, exit.
+# bash will not stop here. It will execute next command(s).
+# The rationale for this is described here:
+# http://www.cons.org/cracauer/sigint.html
+#
+# Basically, bash will not exit on SIGINT immediately if it waits
+# for a child. It will wait for the child to exit.
+# If child exits NOT by dying on SIGINT, then bash will not exit.
+#
+# The idea is that the following script:
+# | emacs file.txt
+# | more cmds
+# User may use ^C to interrupt editor's ops like search. But then
+# emacs exits normally. User expects that script doesn't stop.
+#
+# This is a nice idea, but detecting "did process really exit
+# with SIGINT?" is racy. Consider:
+# | bash -c 'while true; do /bin/true; done'
+# When ^C is pressed while bash waits for /bin/true to exit,
+# it may happen that /bin/true exits with exitcode 0 before
+# ^C is delivered to it as SIGINT. bash will see SIGINT, then
+# it will see that child exited with 0, and bash will NOT EXIT.
+# Therefore we do not implement bash behavior.
+# I'd say that emacs need to put itself into a separate pgrp
+# to isolate shell from getting stray SIGINTs from ^C.
+echo Next command after SIGINT was executed
diff --git a/shell/ash_test/ash-misc/source3.right b/shell/ash_test/ash-misc/source3.right
new file mode 100644
index 000000000..bdf9001a5
--- /dev/null
+++ b/shell/ash_test/ash-misc/source3.right
@@ -0,0 +1,2 @@
+Zero:0
+Zero:0
diff --git a/shell/ash_test/ash-misc/source3.tests b/shell/ash_test/ash-misc/source3.tests
new file mode 100755
index 000000000..1abf156ed
--- /dev/null
+++ b/shell/ash_test/ash-misc/source3.tests
@@ -0,0 +1,6 @@
+# Test both empty file, and one-empty-line file
+echo >sourced1
+true >sourced2
+false; . ./sourced1; echo Zero:$?
+false; . ./sourced2; echo Zero:$?
+rm sourced1 sourced2
diff --git a/shell/ash_test/ash-misc/source5.right b/shell/ash_test/ash-misc/source5.right
new file mode 100644
index 000000000..0587bad67
--- /dev/null
+++ b/shell/ash_test/ash-misc/source5.right
@@ -0,0 +1,4 @@
+0:arg0 1:arg1 2:arg2
+Ok1:0
+0:arg0 1:q 2:w
+Ok2:0
diff --git a/shell/ash_test/ash-misc/source5.tests b/shell/ash_test/ash-misc/source5.tests
new file mode 100755
index 000000000..40b6b83cd
--- /dev/null
+++ b/shell/ash_test/ash-misc/source5.tests
@@ -0,0 +1,8 @@
+echo 'echo "0:$0 1:$1 2:$2"' >sourced1
+set -- 1 2 3
+"$THIS_SH" -c '. ./sourced1' arg0 arg1 arg2
+echo Ok1:$?
+"$THIS_SH" -c '. ./sourced1 q w e' arg0 arg1 arg2
+echo Ok2:$?
+rm sourced1
diff --git a/shell/msh_test/msh-misc/tick.right b/shell/ash_test/ash-misc/unicode1.right
index 6ed281c75..d3bbbf697 100644
--- a/shell/msh_test/msh-misc/tick.right
+++ b/shell/ash_test/ash-misc/unicode1.right
@@ -1,2 +1,3 @@
 1
 1
+Ok
diff --git a/shell/ash_test/ash-misc/unicode1.tests b/shell/ash_test/ash-misc/unicode1.tests
new file mode 100755
index 000000000..8788ba910
--- /dev/null
+++ b/shell/ash_test/ash-misc/unicode1.tests
@@ -0,0 +1,13 @@
+LANG=en_US.UTF-8
+# A combining character U+300
+a=`printf "\xcc\x80"`
+# Should print 1
+echo ${#a}
+# A Japanese katakana charachter U+30a3
+a=`printf "\xe3\x82\xa3"`
+# Should print 1
+echo ${#a}
+echo Ok
diff --git a/shell/ash_test/ash-misc/until1.right b/shell/ash_test/ash-misc/until1.right
new file mode 100644
index 000000000..be2daad95
--- /dev/null
+++ b/shell/ash_test/ash-misc/until1.right
@@ -0,0 +1,3 @@
+1
+1
+Ok:0
diff --git a/shell/ash_test/ash-misc/until1.tests b/shell/ash_test/ash-misc/until1.tests
new file mode 100755
index 000000000..10ab28381
--- /dev/null
+++ b/shell/ash_test/ash-misc/until1.tests
@@ -0,0 +1,11 @@
+x=1
+until test "$x" = 4; do echo $x; x=4; done
+# We had a bug in multi-line form
+x=1
+until test "$x" = 4; do
+        echo $x
+        x=4
+done
+echo Ok:$?
diff --git a/shell/ash_test/ash-misc/while1.right b/shell/ash_test/ash-misc/while1.right
new file mode 100644
index 000000000..7c4d7beb0
--- /dev/null
+++ b/shell/ash_test/ash-misc/while1.right
@@ -0,0 +1 @@
+OK:0
diff --git a/shell/ash_test/ash-misc/while1.tests b/shell/ash_test/ash-misc/while1.tests
new file mode 100755
index 000000000..11e201e6a
--- /dev/null
+++ b/shell/ash_test/ash-misc/while1.tests
@@ -0,0 +1,2 @@
+while false; do echo NOT SHOWN; done
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/while2.right b/shell/ash_test/ash-misc/while2.right
new file mode 100644
index 000000000..07207cc84
--- /dev/null
+++ b/shell/ash_test/ash-misc/while2.right
@@ -0,0 +1,2 @@
+Hello
+OK:0
diff --git a/shell/ash_test/ash-misc/while2.tests b/shell/ash_test/ash-misc/while2.tests
new file mode 100755
index 000000000..2247adc74
--- /dev/null
+++ b/shell/ash_test/ash-misc/while2.tests
@@ -0,0 +1,2 @@
+while echo Hello; false; do echo NOT SHOWN; done
+echo OK:$?
diff --git a/shell/ash_test/ash-misc/while4.right b/shell/ash_test/ash-misc/while4.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/ash_test/ash-misc/while4.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/ash_test/ash-misc/while4.tests b/shell/ash_test/ash-misc/while4.tests
new file mode 100755
index 000000000..ba80e603a
--- /dev/null
+++ b/shell/ash_test/ash-misc/while4.tests
@@ -0,0 +1,6 @@
+false
+while false && echo Not reached; do
+    echo BUG
+    break
+done
+echo Ok:$?
diff --git a/shell/ash_test/ash-misc/while_in_subshell.right b/shell/ash_test/ash-misc/while_in_subshell.right
new file mode 100644
index 000000000..290d39b7e
--- /dev/null
+++ b/shell/ash_test/ash-misc/while_in_subshell.right
@@ -0,0 +1 @@
+OK: 0
diff --git a/shell/ash_test/ash-misc/while_in_subshell.tests b/shell/ash_test/ash-misc/while_in_subshell.tests
new file mode 100755
index 000000000..def8e092b
--- /dev/null
+++ b/shell/ash_test/ash-misc/while_in_subshell.tests
@@ -0,0 +1,2 @@
+(while true; do exit; done)
+echo OK: $?
diff --git a/shell/ash_test/ash-quoting/dollar_repl_slash_bash1.tests b/shell/ash_test/ash-quoting/dollar_repl_slash_bash1.tests
index 3fa2f186d..74dca1cc0 100755
--- a/shell/ash_test/ash-quoting/dollar_repl_slash_bash1.tests
+++ b/shell/ash_test/ash-quoting/dollar_repl_slash_bash1.tests
@@ -1,5 +1,5 @@
 # The bug here was triggered by:
-# * performin pathname expansion because we see [
+# * performing pathname expansion because we see [
 # * replace operator did not escape \ in replace string
 IP=192.168.0.1
diff --git a/shell/ash_test/ash-quoting/dollar_squote_bash2.right b/shell/ash_test/ash-quoting/dollar_squote_bash2.right
new file mode 100644
index 000000000..f7a1731dd
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_squote_bash2.right
@@ -0,0 +1,6 @@
+strstrstrstrstrstrstrstrstrstrstrstrstrstrstrstrstr
+strstrstrstrstrstrstrstrstrstrstrstrstrstrstrstrstr
+80:\�
+81:\�
+82:\�
+Done:0
diff --git a/shell/ash_test/ash-quoting/dollar_squote_bash2.tests b/shell/ash_test/ash-quoting/dollar_squote_bash2.tests
new file mode 100755
index 000000000..449772813
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_squote_bash2.tests
@@ -0,0 +1,10 @@
+# Embedded NULs
+echo $'str\x00'strstrstrstrstrstrstrstrstrstrstrstrstrstrstrstr
+echo $'str\000'strstrstrstrstrstrstrstrstrstrstrstrstrstrstrstr
+# The chars after '\' are hex 0x80,81,82...
+echo 80:$'\�'
+echo 81:$'\�'
+echo 82:$'\�'
+echo Done:$?
diff --git a/shell/ash_test/ash-read/read_r.tests b/shell/ash_test/ash-read/read_r.tests
index 2c4cc6106..1f0a18afc 100755
--- a/shell/ash_test/ash-read/read_r.tests
+++ b/shell/ash_test/ash-read/read_r.tests
@@ -1,2 +1,4 @@
-echo -e 'test\\\nbest' | (read reply; echo "$reply")
+echo 'test\
-echo -e 'test\\\nbest' | (read -r reply; echo "$reply")
+best' | (read reply; echo "$reply")
+echo 'test\
+best' | (read -r reply; echo "$reply")
diff --git a/shell/hush_test/hush-misc/redir1.right b/shell/ash_test/ash-redir/redir1.right
index 15515d1af..15515d1af 100644
--- a/shell/hush_test/hush-misc/redir1.right
+++ b/shell/ash_test/ash-redir/redir1.right
diff --git a/shell/hush_test/hush-misc/redir1.tests b/shell/ash_test/ash-redir/redir1.tests
index ef2fbfb77..ef2fbfb77 100755
--- a/shell/hush_test/hush-misc/redir1.tests
+++ b/shell/ash_test/ash-redir/redir1.tests
diff --git a/shell/ash_test/ash-redir/redir7.tests b/shell/ash_test/ash-redir/redir7.tests
index ca3979a81..e873a4622 100755
--- a/shell/ash_test/ash-redir/redir7.tests
+++ b/shell/ash_test/ash-redir/redir7.tests
@@ -4,9 +4,9 @@
 # was out of sync for redirect filenames.
 >unicode.sh
-echo -e 'echo Ok >uni\x81code' >>unicode.sh
+printf 'echo Ok >uni\x81code\n' >>unicode.sh
-echo -e 'cat uni\x81code' >>unicode.sh
+printf 'cat uni\x81code\n' >>unicode.sh
-echo -e 'cat uni?code' >>unicode.sh
+printf 'cat uni?code\n' >>unicode.sh
 . ./unicode.sh
 rm uni*code*
 echo Done
diff --git a/shell/ash_test/ash-redir/redir8.tests b/shell/ash_test/ash-redir/redir8.tests
index 8cb42c0d3..2bd386749 100755
--- a/shell/ash_test/ash-redir/redir8.tests
+++ b/shell/ash_test/ash-redir/redir8.tests
@@ -6,10 +6,10 @@
 # Subcase when redirect filename is specified in a variable.
 >unicode.sh
-echo -e 'v=uni\x81code' >>unicode.sh
+printf 'v=uni\x81code\n' >>unicode.sh
-echo -e 'echo Ok >"$v"' >>unicode.sh
+printf 'echo Ok >"$v"\n' >>unicode.sh
-echo -e 'cat uni\x81code' >>unicode.sh
+printf 'cat uni\x81code\n' >>unicode.sh
-echo -e 'cat uni?code' >>unicode.sh
+printf 'cat uni?code\n' >>unicode.sh
 . ./unicode.sh
 rm uni*code*
 echo Done
diff --git a/shell/hush_test/hush-misc/redir2.right b/shell/ash_test/ash-redir/redir_escapednum.right
index 7326d9603..7326d9603 100644
--- a/shell/hush_test/hush-misc/redir2.right
+++ b/shell/ash_test/ash-redir/redir_escapednum.right
diff --git a/shell/hush_test/hush-misc/redir2.tests b/shell/ash_test/ash-redir/redir_escapednum.tests
index 81983cae2..81983cae2 100755
--- a/shell/hush_test/hush-misc/redir2.tests
+++ b/shell/ash_test/ash-redir/redir_escapednum.tests
diff --git a/shell/hush_test/hush-misc/redir4.right b/shell/ash_test/ash-redir/redir_expand.right
index ead25f603..ead25f603 100644
--- a/shell/hush_test/hush-misc/redir4.right
+++ b/shell/ash_test/ash-redir/redir_expand.right
diff --git a/shell/hush_test/hush-misc/redir4.tests b/shell/ash_test/ash-redir/redir_expand.tests
index c50b8cedf..c50b8cedf 100755
--- a/shell/hush_test/hush-misc/redir4.tests
+++ b/shell/ash_test/ash-redir/redir_expand.tests
diff --git a/shell/hush_test/hush-misc/redir6.right b/shell/ash_test/ash-redir/redir_multi.right
index a97c4bdf1..a97c4bdf1 100644
--- a/shell/hush_test/hush-misc/redir6.right
+++ b/shell/ash_test/ash-redir/redir_multi.right
diff --git a/shell/hush_test/hush-misc/redir6.tests b/shell/ash_test/ash-redir/redir_multi.tests
index c639ebb2d..c639ebb2d 100755
--- a/shell/hush_test/hush-misc/redir6.tests
+++ b/shell/ash_test/ash-redir/redir_multi.tests
diff --git a/shell/ash_test/ash-redir/redir_script.right b/shell/ash_test/ash-redir/redir_script.right
new file mode 100644
index 000000000..6694ed334
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_script.right
@@ -0,0 +1 @@
+Ok: script fd is not closed
diff --git a/shell/ash_test/ash-redir/redir_script.tests b/shell/ash_test/ash-redir/redir_script.tests
new file mode 100755
index 000000000..ccc497d7b
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_script.tests
@@ -0,0 +1,29 @@
+# Builds a " 3>&- 4>&-" string.
+# Note: one of these fds is a directory opened to /proc/self/fd
+# for globbing. It is unwanted, but I don't know how to filter it out.
+find_fds() {
+        fds=""
+        for f in /proc/self/fd/*; do
+                test "$f" = "/proc/self/fd/0" && continue
+                test "$f" = "/proc/self/fd/1" && continue
+                test "$f" = "/proc/self/fd/2" && continue
+                fds="$fds ${f##*/}>&-"
+        done
+}
+find_fds
+fds1="$fds"
+# One of the fds is open to the script body
+# Close it while executing something.
+eval "find_fds $fds"
+# Shell should not lose that fd. Did it?
+find_fds
+test x"$fds1" = x"$fds" && { echo "Ok: script fd is not closed"; exit 0; }
+echo "Bug: script fd is closed"
+echo "fds1:$fds1"
+echo "fds2:$fds"
+exit 1
diff --git a/shell/hush_test/hush-parsing/redir_space.right b/shell/ash_test/ash-redir/redir_space.right
index 084295204..084295204 100644
--- a/shell/hush_test/hush-parsing/redir_space.right
+++ b/shell/ash_test/ash-redir/redir_space.right
diff --git a/shell/hush_test/hush-parsing/redir_space.tests b/shell/ash_test/ash-redir/redir_space.tests
index c0b543098..c0b543098 100755
--- a/shell/hush_test/hush-parsing/redir_space.tests
+++ b/shell/ash_test/ash-redir/redir_space.tests
diff --git a/shell/ash_test/ash-signals/continue_and_trap1.right b/shell/ash_test/ash-signals/continue_and_trap1.right
new file mode 100644
index 000000000..d2dd0af72
--- /dev/null
+++ b/shell/ash_test/ash-signals/continue_and_trap1.right
@@ -0,0 +1 @@
+Exiting
diff --git a/shell/ash_test/ash-signals/continue_and_trap1.tests b/shell/ash_test/ash-signals/continue_and_trap1.tests
new file mode 100755
index 000000000..2a5c147b1
--- /dev/null
+++ b/shell/ash_test/ash-signals/continue_and_trap1.tests
@@ -0,0 +1,7 @@
+trap "echo Exiting; exit" INT
+(sleep 1; kill -s INT $$) &
+while continue; do
+        continue;
+done
diff --git a/shell/ash_test/ash-signals/return_in_trap1.right b/shell/ash_test/ash-signals/return_in_trap1.right
new file mode 100644
index 000000000..a6e637885
--- /dev/null
+++ b/shell/ash_test/ash-signals/return_in_trap1.right
@@ -0,0 +1,4 @@
+a:2
+b:0
+Trap
+d:3
diff --git a/shell/ash_test/ash-signals/return_in_trap1.tests b/shell/ash_test/ash-signals/return_in_trap1.tests
new file mode 100755
index 000000000..f2498024f
--- /dev/null
+++ b/shell/ash_test/ash-signals/return_in_trap1.tests
@@ -0,0 +1,18 @@
+a() {
+        (exit 2)
+        echo a:$?
+        (kill -s USR1 $$; echo b:$?; exit 3)
+        echo c:$?       # does not execute
+        (exit 4)
+}
+trap "echo Trap; return" USR1
+a
+echo d:$?
+# It's debatable what is the correct value above.
+# Does 'return' in trap sees $? == 2 or $? == 3?
+# IOW: after (kill..), does shell first wait for its completion
+# and sets $?, then checks pending signals and runs a trap handler,
+# or does it first checks pending signals and runs handler?
+# hush does the former, and prints 3.
diff --git a/shell/hush_test/hush-trap/save-ret.right b/shell/ash_test/ash-signals/save-ret.right
index a3e12ce5e..a3e12ce5e 100644
--- a/shell/hush_test/hush-trap/save-ret.right
+++ b/shell/ash_test/ash-signals/save-ret.right
diff --git a/shell/hush_test/hush-trap/save-ret.tests b/shell/ash_test/ash-signals/save-ret.tests
index 0786b6d96..0786b6d96 100755
--- a/shell/hush_test/hush-trap/save-ret.tests
+++ b/shell/ash_test/ash-signals/save-ret.tests
diff --git a/shell/ash_test/ash-signals/signal1.tests b/shell/ash_test/ash-signals/signal1.tests
index 28bfc6a46..61943467a 100755
--- a/shell/ash_test/ash-signals/signal1.tests
+++ b/shell/ash_test/ash-signals/signal1.tests
@@ -19,7 +19,7 @@ while $sleeping; do
    if wait %%; then
        echo "sleep completed"
        sleeping=false
-    elif [ $? == 127 ]; then
+    elif [ $? = 127 ]; then
        echo "BUG: no processes to wait for?!"
        sleeping=false
    else
diff --git a/shell/ash_test/ash-signals/sigquit_exec.right b/shell/ash_test/ash-signals/sigquit_exec.right
new file mode 100644
index 000000000..a8041929a
--- /dev/null
+++ b/shell/ash_test/ash-signals/sigquit_exec.right
@@ -0,0 +1,2 @@
+SigIgn: 0000000000000000
+SigIgn: 0000000000000000
diff --git a/shell/ash_test/ash-signals/sigquit_exec.tests b/shell/ash_test/ash-signals/sigquit_exec.tests
new file mode 100755
index 000000000..24bda6921
--- /dev/null
+++ b/shell/ash_test/ash-signals/sigquit_exec.tests
@@ -0,0 +1,4 @@
+# Should show no masked signals in both cases.
+# We had a bug where SIGQUIT was masked on exec.
+grep SigIgn: /proc/self/status
+exec grep SigIgn: /proc/self/status
diff --git a/shell/ash_test/ash-vars/empty.right b/shell/ash_test/ash-vars/empty.right
new file mode 100644
index 000000000..2cb3c70f2
--- /dev/null
+++ b/shell/ash_test/ash-vars/empty.right
@@ -0,0 +1,3 @@
+a b c d e f 1 2 3 4 5 6 7 8 9 0 A B C D E F
+a b c d e f 1 2 3 4 5 6 7 8 9 0 A B C D E F
+a b c d e f 1 2 3 4 5 6 7 8 9 0 A B C D E F
diff --git a/shell/ash_test/ash-vars/empty.tests b/shell/ash_test/ash-vars/empty.tests
new file mode 100755
index 000000000..a9c247e31
--- /dev/null
+++ b/shell/ash_test/ash-vars/empty.tests
@@ -0,0 +1,5 @@
+e=
+echo a b c d e f 1 2 3 4 5 6 7 8 9 0 A B C D E F
+echo a $e b $e c $e d $e e $e f $e 1 $e 2 $e 3 $e 4 $e 5 $e 6 $e 7 $e 8 $e 9 $e 0 $e A $e B $e C $e D $e E $e F
+echo $e a $e b $e c $e d $e e $e f $e 1 $e 2 $e 3 $e 4 $e 5 $e 6 $e 7 $e 8 $e 9 $e 0 $e A $e B $e C $e D $e E $e F
diff --git a/shell/ash_test/ash-vars/glob_and_vars.right b/shell/ash_test/ash-vars/glob_and_vars.right
new file mode 100644
index 000000000..3ac7ec5ff
--- /dev/null
+++ b/shell/ash_test/ash-vars/glob_and_vars.right
@@ -0,0 +1 @@
+./glob_and_vars.right ./glob_and_vars.tests
diff --git a/shell/ash_test/ash-vars/glob_and_vars.tests b/shell/ash_test/ash-vars/glob_and_vars.tests
new file mode 100755
index 000000000..482cf9d8a
--- /dev/null
+++ b/shell/ash_test/ash-vars/glob_and_vars.tests
@@ -0,0 +1,2 @@
+v=.
+echo $v/glob_and_vars.[tr]*
diff --git a/shell/ash_test/ash-vars/param_expand_len.right b/shell/ash_test/ash-vars/param_expand_len.right
new file mode 100644
index 000000000..96e8cb59b
--- /dev/null
+++ b/shell/ash_test/ash-vars/param_expand_len.right
@@ -0,0 +1,9 @@
+0
+0
+1
+Make sure len parsing doesnt break arg count
+0 0
+4 4
+Testing len op
+4 3 2 1 0 0
+0 3 0
diff --git a/shell/ash_test/ash-vars/param_expand_len.tests b/shell/ash_test/ash-vars/param_expand_len.tests
new file mode 100755
index 000000000..fe20a45e9
--- /dev/null
+++ b/shell/ash_test/ash-vars/param_expand_len.tests
@@ -0,0 +1,17 @@
+"$THIS_SH" -c 'echo $#'
+"$THIS_SH" -c 'echo $#' arg0
+"$THIS_SH" -c 'echo $#' arg0 arg1
+echo Make sure len parsing doesnt break arg count
+set --
+echo $# ${#}
+set -- aaaa bbb cc d
+echo $# ${#}
+echo Testing len op
+echo ${#1} ${#2} ${#3} ${#4} ${#5} ${#6}
+unset e
+f=abc
+g=
+echo ${#e} ${#f} ${#g}
diff --git a/shell/ash_test/ash-vars/param_glob.right b/shell/ash_test/ash-vars/param_glob.right
new file mode 100644
index 000000000..bdee8fe0f
--- /dev/null
+++ b/shell/ash_test/ash-vars/param_glob.right
@@ -0,0 +1,4 @@
+param_glob.tests
+param_glob.tests
+param_glob.t*
+param_glob.t*
diff --git a/shell/ash_test/ash-vars/param_glob.tests b/shell/ash_test/ash-vars/param_glob.tests
new file mode 100755
index 000000000..4d74fee02
--- /dev/null
+++ b/shell/ash_test/ash-vars/param_glob.tests
@@ -0,0 +1,9 @@
+if test $# = 0; then
+    exec "$THIS_SH" "$0" 'param_glob.t*'
+    echo NOT SHOWN
+    exit
+fi
+echo $*
+echo $@
+echo "$*"
+echo "$@"
diff --git a/shell/ash_test/ash-vars/param_subshell.right b/shell/ash_test/ash-vars/param_subshell.right
new file mode 100644
index 000000000..f3c3767de
--- /dev/null
+++ b/shell/ash_test/ash-vars/param_subshell.right
@@ -0,0 +1,7 @@
+1=1
+2=2
+3=3
+4=4
+5=5
+6=6
+7=7
diff --git a/shell/ash_test/ash-vars/param_subshell.tests b/shell/ash_test/ash-vars/param_subshell.tests
new file mode 100755
index 000000000..27fdc5b9b
--- /dev/null
+++ b/shell/ash_test/ash-vars/param_subshell.tests
@@ -0,0 +1,15 @@
+if test $# = 0; then
+    "$THIS_SH" "$0" 1 2 3 4 5 6 7 8 9
+    exit
+fi
+echo 1=$1
+{ echo 2=$2; }
+{ echo 3=$3; } &
+# cant use usleep as it isnt standard in $PATH --
+# we fail when testing busybox compiled solely as "hush"
+wait
+( echo 4=$4 )
+( echo 5=$5 ) &
+wait
+true | echo 6=$6 | cat
+true | { echo 7=$7; } | cat
diff --git a/shell/msh_test/msh-vars/star.right b/shell/ash_test/ash-vars/star.right
index 0ecc55bc2..0ecc55bc2 100644
--- a/shell/msh_test/msh-vars/star.right
+++ b/shell/ash_test/ash-vars/star.right
diff --git a/shell/msh_test/msh-vars/star.tests b/shell/ash_test/ash-vars/star.tests
index 5554c4090..5554c4090 100755
--- a/shell/msh_test/msh-vars/star.tests
+++ b/shell/ash_test/ash-vars/star.tests
diff --git a/shell/ash_test/ash-vars/var1.right b/shell/ash_test/ash-vars/var1.right
index 2a01291bb..194e7dbe2 100644
--- a/shell/ash_test/ash-vars/var1.right
+++ b/shell/ash_test/ash-vars/var1.right
@@ -1,6 +1,4 @@
-a=a A=a
+http://busybox.net
-a=a A=a
+http://busybox.net_abc
-a= A=
+1 1
-a= A=
+1 1
-a=a A=a
-a=a A=a
diff --git a/shell/ash_test/ash-vars/var1.tests b/shell/ash_test/ash-vars/var1.tests
index 802e489bd..48a6782ba 100755
--- a/shell/ash_test/ash-vars/var1.tests
+++ b/shell/ash_test/ash-vars/var1.tests
@@ -1,14 +1,9 @@
-# check that first assignment has proper effect on second one
+URL=http://busybox.net
-(
+echo $URL
-a=a A=$a
+echo ${URL}_abc
-echo a=$a A=$A
-)
-(a=a A=$a; echo a=$a A=$A)
-(a=a A=$a echo a=$a A=$A)
-(a=a A=$a /bin/echo a=$a A=$A)
-f() { echo a=$a A=$A; }
+true
+false; echo $? ${?}
-(a=a A=$a f)
+true
-(a=a A=$a; f)
+{ false; echo $? ${?}; }
diff --git a/shell/ash_test/ash-vars/var2.right b/shell/ash_test/ash-vars/var2.right
index 8fed138eb..40bf4bff4 100644
--- a/shell/ash_test/ash-vars/var2.right
+++ b/shell/ash_test/ash-vars/var2.right
@@ -1 +1,2 @@
-bus/usb/1/2
+http://busybox.net
+http://busybox.net_abc
diff --git a/shell/ash_test/ash-vars/var2.tests b/shell/ash_test/ash-vars/var2.tests
index 07feaeb8b..1292410f3 100755
--- a/shell/ash_test/ash-vars/var2.tests
+++ b/shell/ash_test/ash-vars/var2.tests
@@ -1 +1,4 @@
-X=usbdev1.2 X=${X#usbdev} B=${X%%.*} D=${X#*.}; echo bus/usb/$B/$D
+_1=http://busybox.net
+echo $_1
+echo ${_1}_abc
diff --git a/shell/ash_test/ash-vars/var4.right b/shell/ash_test/ash-vars/var4.right
new file mode 100644
index 000000000..8fed138eb
--- /dev/null
+++ b/shell/ash_test/ash-vars/var4.right
@@ -0,0 +1 @@
+bus/usb/1/2
diff --git a/shell/ash_test/ash-vars/var4.tests b/shell/ash_test/ash-vars/var4.tests
new file mode 100755
index 000000000..07feaeb8b
--- /dev/null
+++ b/shell/ash_test/ash-vars/var4.tests
@@ -0,0 +1 @@
+X=usbdev1.2 X=${X#usbdev} B=${X%%.*} D=${X#*.}; echo bus/usb/$B/$D
diff --git a/shell/ash_test/ash-vars/var5.right b/shell/ash_test/ash-vars/var5.right
new file mode 100644
index 000000000..2a01291bb
--- /dev/null
+++ b/shell/ash_test/ash-vars/var5.right
@@ -0,0 +1,6 @@
+a=a A=a
+a=a A=a
+a= A=
+a= A=
+a=a A=a
+a=a A=a
diff --git a/shell/ash_test/ash-vars/var5.tests b/shell/ash_test/ash-vars/var5.tests
new file mode 100755
index 000000000..802e489bd
--- /dev/null
+++ b/shell/ash_test/ash-vars/var5.tests
@@ -0,0 +1,14 @@
+# check that first assignment has proper effect on second one
+(
+a=a A=$a
+echo a=$a A=$A
+)
+(a=a A=$a; echo a=$a A=$A)
+(a=a A=$a echo a=$a A=$A)
+(a=a A=$a /bin/echo a=$a A=$A)
+f() { echo a=$a A=$A; }
+(a=a A=$a f)
+(a=a A=$a; f)
diff --git a/shell/ash_test/ash-vars/var_bash1a.right b/shell/ash_test/ash-vars/var_bash1a.right
new file mode 100644
index 000000000..1965b5c6c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash1a.right
@@ -0,0 +1,6 @@
+parameter     'abcdef'
+varoffset2    'cdef'
+varoffset-2   'ef'
+literal '2'   'cdef'
+literal '-2'  'abcdef'
+literal ' -2' 'ef'
diff --git a/shell/ash_test/ash-vars/var_bash1a.tests b/shell/ash_test/ash-vars/var_bash1a.tests
new file mode 100755
index 000000000..551dd9acc
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash1a.tests
@@ -0,0 +1,11 @@
+parameter=abcdef
+offset=2
+noffset=-2
+echo "parameter     '${parameter}'"
+echo "varoffset2    '${parameter:${offset}}'"
+echo "varoffset-2   '${parameter:${noffset}}'"
+echo "literal '2'   '${parameter:2}'"
+# This is not inrpreted as ${VAR:POS{:LEN}},
+# but as ${VAR:=WORD} - if VAR is unset or null, substitute WORD
+echo "literal '-2'  '${parameter:-2}'"
+echo "literal ' -2' '${parameter: -2}'"
diff --git a/shell/ash_test/ash-vars/var_bash4.right b/shell/ash_test/ash-vars/var_bash4.right
index 600e8532f..0ef1bf661 100644
--- a/shell/ash_test/ash-vars/var_bash4.right
+++ b/shell/ash_test/ash-vars/var_bash4.right
@@ -1,23 +1,40 @@
 Source:        a*b\*c
 Replace str:   _\\_\z_
 Pattern:       single backslash and star: "replace literal star"
-In assignment: a_\_z_b\*c
 Unquoted:      a_\_z_b\*c
+Unquoted =:    a_\_z_b\*c
 Quoted:        a_\_\z_b\*c
+Quoted =:      a_\_\z_b\*c
 Pattern:       double backslash and star: "replace backslash and everything after it"
-In assignment: a*b_\_z_
 Unquoted:      a*b_\_z_
+Unquoted =:    a*b_\_z_
 Quoted:        a*b_\_\z_
+Quoted =:      a*b_\_\z_
 Source:        a\bc
 Replace str:   _\\_\z_
 Pattern:       single backslash and b: "replace b"
-In assignment: a\_\_z_c
 Unquoted:      a\_\_z_c
+Unquoted =:    a\_\_z_c
 Quoted:        a\_\_\z_c
+Quoted =:      a\_\_\z_c
 Pattern:       double backslash and b: "replace backslash and b"
-In assignment: a_\_z_c
 Unquoted:      a_\_z_c
+Unquoted =:    a_\_z_c
 Quoted:        a_\_\z_c
+Quoted =:      a_\_\z_c
+Source:        a\bc
+Replace str:   _\\_\z_ (as variable $s)
+Pattern:       single backslash and b: "replace b"
+Unquoted:      a\_\\_\z_c
+Unquoted =:    a\_\\_\z_c
+Quoted:        a\_\\_\z_c
+Quoted =:      a\_\\_\z_c
+Pattern:       double backslash and b: "replace backslash and b"
+Unquoted:      a_\\_\z_c
+Unquoted =:    a_\\_\z_c
+Quoted:        a_\\_\z_c
+Quoted =:      a_\\_\z_c
 Done: 0
diff --git a/shell/ash_test/ash-vars/var_bash4.tests b/shell/ash_test/ash-vars/var_bash4.tests
index d5470614b..32aa2b34c 100755
--- a/shell/ash_test/ash-vars/var_bash4.tests
+++ b/shell/ash_test/ash-vars/var_bash4.tests
@@ -6,23 +6,30 @@
 # even in quotes.
 #
 # bash4 (and probably bash3 too): "Quoted:" results are different from
-# unquoted and assignment expansions - they have a backslash before z.
+# unquoted expansions - they have a backslash before z.
+#
+# The difference only exists if repl is a literal. If it is a variable:
+# ${v/.../$s}, then all backslashes are preserved in both cases.
 v='a*b\*c'
 echo 'Source:       ' "$v"
 echo 'Replace str:  ' '_\\_\z_'
 echo 'Pattern:      ' 'single backslash and star: "replace literal star"'
-r=${v/\*/_\\_\z_}
-echo 'In assignment:' "$r"
 echo 'Unquoted:     ' ${v/\*/_\\_\z_}
+r=${v/\*/_\\_\z_}
+echo 'Unquoted =:   ' "$r"
 echo 'Quoted:       ' "${v/\*/_\\_\z_}"
+r="${v/\*/_\\_\z_}"
+echo 'Quoted =:     ' "$r"
 echo 'Pattern:      ' 'double backslash and star: "replace backslash and everything after it"'
-r=${v/\\*/_\\_\z_}
-echo 'In assignment:' "$r"
 echo 'Unquoted:     '  ${v/\\*/_\\_\z_}
+r=${v/\\*/_\\_\z_}
+echo 'Unquoted =:   ' "$r"
 echo 'Quoted:       ' "${v/\\*/_\\_\z_}"
+r="${v/\\*/_\\_\z_}"
+echo 'Quoted =:     ' "$r"
 echo
@@ -31,16 +38,43 @@ echo 'Source:       ' "$v"
 echo 'Replace str:  ' '_\\_\z_'
 echo 'Pattern:      ' 'single backslash and b: "replace b"'
-r=${v/\b/_\\_\z_}
-echo 'In assignment:' "$r"
 echo 'Unquoted:     '  ${v/\b/_\\_\z_}
+r=${v/\b/_\\_\z_}
+echo 'Unquoted =:   ' "$r"
 echo 'Quoted:       ' "${v/\b/_\\_\z_}"
+r="${v/\b/_\\_\z_}"
+echo 'Quoted =:     ' "$r"
 echo 'Pattern:      ' 'double backslash and b: "replace backslash and b"'
-r=${v/\\b/_\\_\z_}
-echo 'In assignment:' "$r"
 echo 'Unquoted:     '  ${v/\\b/_\\_\z_}
+r=${v/\\b/_\\_\z_}
+echo 'Unquoted =:   ' "$r"
 echo 'Quoted:       ' "${v/\\b/_\\_\z_}"
+r="${v/\\b/_\\_\z_}"
+echo 'Quoted =:     ' "$r"
+echo
+v='a\bc'
+s='_\\_\z_'
+echo 'Source:       ' "$v"
+echo 'Replace str:  ' "$s" '(as variable $s)'
+echo 'Pattern:      ' 'single backslash and b: "replace b"'
+echo 'Unquoted:     '  ${v/\b/$s}
+r=${v/\b/$s}
+echo 'Unquoted =:   ' "$r"
+echo 'Quoted:       ' "${v/\b/$s}"
+r="${v/\b/$s}"
+echo 'Quoted =:     ' "$r"
+echo 'Pattern:      ' 'double backslash and b: "replace backslash and b"'
+echo 'Unquoted:     '  ${v/\\b/$s}
+r=${v/\\b/$s}
+echo 'Unquoted =:   ' "$r"
+echo 'Quoted:       ' "${v/\\b/$s}"
+r="${v/\\b/$s}"
+echo 'Quoted =:     ' "$r"
 echo
diff --git a/shell/ash_test/ash-vars/var_bash5.right b/shell/ash_test/ash-vars/var_bash5.right
index 278ed3228..1990902b2 100644
--- a/shell/ash_test/ash-vars/var_bash5.right
+++ b/shell/ash_test/ash-vars/var_bash5.right
@@ -1,4 +1,11 @@
-a/
+1 a/
-a/d
+2 a/d
-a/e/f
+3 a/e/f
+4 a\
+5 a\d
+6 a\e\f
+7 a\\
+8 a\\d
+9 a\\e\\f
+a ab
 Done: 0
diff --git a/shell/ash_test/ash-vars/var_bash5.tests b/shell/ash_test/ash-vars/var_bash5.tests
index 7f482a554..5748b4ac7 100755
--- a/shell/ash_test/ash-vars/var_bash5.tests
+++ b/shell/ash_test/ash-vars/var_bash5.tests
@@ -4,8 +4,26 @@
 v='a/b/c'
 s='b/c'
 r='e/f'
-echo "${v/$s}"
+echo "1 ${v/$s}"
-echo "${v/$s/d}"
+echo "2 ${v/$s/d}"
-echo "${v/$s/$r}"
+echo "3 ${v/$s/$r}"
+v='a\b\c'
+s='b\\c'
+r='e\f'
+echo "4 ${v/$s}"
+echo "5 ${v/$s/d}"
+echo "6 ${v/$s/$r}"
+v='a\\b\\c'
+s='b\\\\c'
+r='e\\f'
+echo "7 ${v/$s}"
+echo "8 ${v/$s/d}"
+echo "9 ${v/$s/$r}"
+v='a-$a-\t-\\-\"-\`-\--\z-\*-\?-b'
+s='-$a-\\t-\\\\-\\"-\\`-\\--\\z-\\\*-\\\?-'
+echo "a ${v/$s}"
 echo Done: $?
diff --git a/shell/msh_test/msh-bugs/var_expand_in_assign.right b/shell/ash_test/ash-vars/var_expand_in_assign.right
index 352210d7e..352210d7e 100644
--- a/shell/msh_test/msh-bugs/var_expand_in_assign.right
+++ b/shell/ash_test/ash-vars/var_expand_in_assign.right
diff --git a/shell/msh_test/msh-bugs/var_expand_in_assign.tests b/shell/ash_test/ash-vars/var_expand_in_assign.tests
index 18cdc74c0..18cdc74c0 100755
--- a/shell/msh_test/msh-bugs/var_expand_in_assign.tests
+++ b/shell/ash_test/ash-vars/var_expand_in_assign.tests
diff --git a/shell/msh_test/msh-bugs/var_expand_in_redir.right b/shell/ash_test/ash-vars/var_expand_in_redir.right
index 423299c97..423299c97 100644
--- a/shell/msh_test/msh-bugs/var_expand_in_redir.right
+++ b/shell/ash_test/ash-vars/var_expand_in_redir.right
diff --git a/shell/msh_test/msh-bugs/var_expand_in_redir.tests b/shell/ash_test/ash-vars/var_expand_in_redir.tests
index bda6bdd7f..bda6bdd7f 100755
--- a/shell/msh_test/msh-bugs/var_expand_in_redir.tests
+++ b/shell/ash_test/ash-vars/var_expand_in_redir.tests
diff --git a/shell/ash_test/ash-vars/var_expand_on_ifs.right b/shell/ash_test/ash-vars/var_expand_on_ifs.right
new file mode 100644
index 000000000..2ed2069f7
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_expand_on_ifs.right
@@ -0,0 +1,9 @@
+1 a b c
+2 a + b c
+3 a b c
+4 a  b c
+5 a  b c
+6 a b + c
+7 a b c
+8 a b  c
+9 a b  c
diff --git a/shell/ash_test/ash-vars/var_expand_on_ifs.tests b/shell/ash_test/ash-vars/var_expand_on_ifs.tests
new file mode 100755
index 000000000..a12ff8ec8
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_expand_on_ifs.tests
@@ -0,0 +1,11 @@
+b=' b '
+e=''
+echo 1 a $b c
+echo 2 a +$b c
+echo 3 a $e$b c
+echo 4 a "$e"$b c
+echo 5 a ""$b c
+echo 6 a $b+ c
+echo 7 a $b$e c
+echo 8 a $b"$e" c
+echo 9 a $b"" c
diff --git a/shell/ash_test/ash-vars/var_in_pipes.right b/shell/ash_test/ash-vars/var_in_pipes.right
new file mode 100644
index 000000000..faf65bed4
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_in_pipes.right
@@ -0,0 +1,6 @@
+b=1
+b=2
+b=3
+b=4
+b=5
+b=6
diff --git a/shell/ash_test/ash-vars/var_in_pipes.tests b/shell/ash_test/ash-vars/var_in_pipes.tests
new file mode 100755
index 000000000..3f8cd2729
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_in_pipes.tests
@@ -0,0 +1,7 @@
+b=1 env | grep ^b=
+true | b=2 env | grep ^b=
+a=1 true | b=3 env | grep ^b=
+(b=4 env) | grep ^b=
+(true | b=5 env) | grep ^b=
+(a=1 true | b=6 env) | grep ^b=
diff --git a/shell/msh_test/msh-parsing/argv0.right b/shell/ash_test/ash-vars/var_leaks.right
index d86bac9de..d86bac9de 100644
--- a/shell/msh_test/msh-parsing/argv0.right
+++ b/shell/ash_test/ash-vars/var_leaks.right
diff --git a/shell/ash_test/ash-vars/var_leaks.tests b/shell/ash_test/ash-vars/var_leaks.tests
new file mode 100755
index 000000000..27c8c6504
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_leaks.tests
@@ -0,0 +1,14 @@
+# external program
+a=b /bin/true
+env | grep ^a=
+# builtin
+a=b true
+env | grep ^a=
+# exec with redirection only
+# in bash, this leaks!
+a=b exec 1>&1
+env | grep ^a=
+echo OK
diff --git a/shell/ash_test/ash-vars/var_posix1.right b/shell/ash_test/ash-vars/var_posix1.right
index 55f35798a..7ff618ad0 100644
--- a/shell/ash_test/ash-vars/var_posix1.right
+++ b/shell/ash_test/ash-vars/var_posix1.right
@@ -1,3 +1,19 @@
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
+Empty:
 abcdcd
 abcdcd
 abcdcd
@@ -5,7 +21,9 @@ cdcd
 babcdcd
 babcdcd
 ababcdcd
+Empty:
+ababcdcd}_tail
+ababcdcd_tail
 ababcd
 ababcd
 ababcd
@@ -13,5 +31,11 @@ abab
 ababcdc
 ababcdc
 ababcdcd
+Empty:
-end
+ababcdcd}_tail
+ababcdcd_tail
+ababcdcd
+ab
+ab
+ab
+End
diff --git a/shell/ash_test/ash-vars/var_posix1.tests b/shell/ash_test/ash-vars/var_posix1.tests
index 4139e2cc3..82abe8198 100755
--- a/shell/ash_test/ash-vars/var_posix1.tests
+++ b/shell/ash_test/ash-vars/var_posix1.tests
@@ -1,3 +1,25 @@
+unset var
+echo Empty:${var#}
+echo Empty:${var##}
+echo Empty:${var#*}
+echo Empty:${var##*}
+echo Empty:${var%}
+echo Empty:${var%%}
+echo Empty:${var%*}
+echo Empty:${var%%*}
+var=
+echo Empty:${var#}
+echo Empty:${var##}
+echo Empty:${var#*}
+echo Empty:${var##*}
+echo Empty:${var%}
+echo Empty:${var%%}
+echo Empty:${var%*}
+echo Empty:${var%%*}
 var=ababcdcd
 echo ${var#ab}
@@ -7,7 +29,9 @@ echo ${var##a*b}
 echo ${var#?}
 echo ${var##?}
 echo ${var#*}
-echo ${var##*}
+echo Empty:${var##*}
+echo ${var#}}_tail
+echo ${var#\}}_tail
 echo ${var%cd}
 echo ${var%%cd}
@@ -16,6 +40,13 @@ echo ${var%%c*d}
 echo ${var%?}
 echo ${var%%?}
 echo ${var%*}
-echo ${var%%*}
+echo Empty:${var%%*}
+echo ${var#}}_tail
+echo ${var#\}}_tail
+echo ${var%\\*}
+a=ab}; echo ${a%\}};
+a=abc; c=c; echo ${a%${c}}
+a=ab{{c; echo ${a%`echo {{c`}
-echo end
+echo End
diff --git a/shell/ash_test/ash-vars/var_serial.right b/shell/ash_test/ash-vars/var_serial.right
new file mode 100644
index 000000000..42aa33057
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_serial.right
@@ -0,0 +1,5 @@
+Assignments only: c=a
+Assignments and a command: c=a
+Assignments and a builtin: c=a
+Assignments and a function: c=a
+Done
diff --git a/shell/ash_test/ash-vars/var_serial.tests b/shell/ash_test/ash-vars/var_serial.tests
new file mode 100755
index 000000000..6b4a4cdf7
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_serial.tests
@@ -0,0 +1,22 @@
+a=a
+b=b
+c=c
+# Second assignment depends on the first:
+b=$a c=$b
+echo Assignments only: c=$c
+b=b
+c=c
+b=$a c=$b "$THIS_SH" -c 'echo Assignments and a command: c=$c'
+b=b
+c=c
+b=$a c=$b eval 'echo Assignments and a builtin: c=$c'
+b=b
+c=c
+f() { echo Assignments and a function: c=$c; }
+b=$a c=$b f
+echo Done
diff --git a/shell/msh_test/msh-vars/var_subst_in_for.right b/shell/ash_test/ash-vars/var_subst_in_for.right
index c8aca1c12..c8aca1c12 100644
--- a/shell/msh_test/msh-vars/var_subst_in_for.right
+++ b/shell/ash_test/ash-vars/var_subst_in_for.right
diff --git a/shell/msh_test/msh-vars/var_subst_in_for.tests b/shell/ash_test/ash-vars/var_subst_in_for.tests
index 4d1c11201..433c60627 100755
--- a/shell/msh_test/msh-vars/var_subst_in_for.tests
+++ b/shell/ash_test/ash-vars/var_subst_in_for.tests
@@ -1,5 +1,5 @@
 if test $# = 0; then
-    exec "$THIS_SH" var_subst_in_for.tests abc "d e"
+    exec "$THIS_SH" "$0" abc "d e"
 fi
 echo 'Testing: in x y z'
diff --git a/shell/ash_test/ash-vars/var_unbackslash.right b/shell/ash_test/ash-vars/var_unbackslash.right
new file mode 100644
index 000000000..8bc834711
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_unbackslash.right
@@ -0,0 +1,11 @@
+b1=-qwerty-t-\-"-`---z-*-?-
+b1=-qwerty-t-\-"-`---z-*-?-
+b2=-qwerty-\t-\-"-`-\--\z-\*-\?-
+b2=-qwerty-\t-\-"-`-\--\z-\*-\?-
+b3=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+b3=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+c=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+c=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+c=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+c=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+Done: 0
diff --git a/shell/ash_test/ash-vars/var_unbackslash.tests b/shell/ash_test/ash-vars/var_unbackslash.tests
new file mode 100755
index 000000000..bb52af3d0
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_unbackslash.tests
@@ -0,0 +1,23 @@
+# Test for correct handling of backslashes
+a=qwerty
+b=-$a-\t-\\-\"-\`-\--\z-\*-\?-
+echo b1=$b
+echo "b1=$b"
+b="-$a-\t-\\-\"-\`-\--\z-\*-\?-"
+echo b2=$b
+echo "b2=$b"
+b='-$a-\t-\\-\"-\`-\--\z-\*-\?-'
+echo b3=$b
+echo "b3=$b"
+c=$b
+echo "c=$c"
+c=${b}
+echo "c=$c"
+c="$b"
+echo "c=$c"
+c="${b}"
+echo "c=$c"
+echo "Done: $?"
diff --git a/shell/ash_test/ash-vars/var_unbackslash1.right b/shell/ash_test/ash-vars/var_unbackslash1.right
new file mode 100644
index 000000000..3e0c0e2af
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_unbackslash1.right
@@ -0,0 +1,7 @@
+Ok
+Ba d
+Ok
+Ok
+Ok
+Forty two:42
+Forty two:42
diff --git a/shell/ash_test/ash-vars/var_unbackslash1.tests b/shell/ash_test/ash-vars/var_unbackslash1.tests
new file mode 100755
index 000000000..a4665e423
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_unbackslash1.tests
@@ -0,0 +1,35 @@
+ad="Ok"
+a="Ba"
+# "Ok"
+echo $a\
+d
+# This variable contains backslash+newline!
+e='echo $a\
+d'
+# "Ba d"
+eval $e
+# "Ok"
+eval "$e"
+echo $\
+(echo Ok\
+)
+echo "$\
+(echo Ok\
+)"
+echo Forty two:$\
+(\
+(\
+42\
+)\
+)
+echo "Forty two:$\
+(\
+(\
+42\
+)\
+)"
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs1.right b/shell/ash_test/ash-vars/var_wordsplit_ifs1.right
new file mode 100644
index 000000000..cf583d0aa
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs1.right
@@ -0,0 +1,41 @@
+Testing: !IFS $*
+.abc.
+.d.
+.e.
+Testing: !IFS $@
+.abc.
+.d.
+.e.
+Testing: !IFS "$*"
+.abc d e.
+Testing: !IFS "$@"
+.abc.
+.d e.
+Testing: IFS="" $*
+.abc.
+.d e.
+Testing: IFS="" $@
+.abc.
+.d e.
+Testing: IFS="" "$*"
+.abcd e.
+Testing: IFS="" "$@"
+.abc.
+.d e.
+Testing: !IFS v=$*
+v='abc d e'
+Testing: !IFS v=$@
+v='abc d e'
+Testing: !IFS v="$*"
+v='abc d e'
+Testing: !IFS v="$@"
+v='abc d e'
+Testing: IFS="" v=$*
+v='abcd e'
+Testing: IFS="" v=$@
+v='abcd e'
+Testing: IFS="" v="$*"
+v='abcd e'
+Testing: IFS="" v="$@"
+v='abcd e'
+Finished
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs1.tests b/shell/ash_test/ash-vars/var_wordsplit_ifs1.tests
new file mode 100755
index 000000000..a62afc6fd
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs1.tests
@@ -0,0 +1,42 @@
+set -- abc "d e"
+echo 'Testing: !IFS $*'
+unset IFS; for a in $*; do echo ".$a."; done
+echo 'Testing: !IFS $@'
+unset IFS; for a in $@; do echo ".$a."; done
+echo 'Testing: !IFS "$*"'
+unset IFS; for a in "$*"; do echo ".$a."; done
+echo 'Testing: !IFS "$@"'
+unset IFS; for a in "$@"; do echo ".$a."; done
+echo 'Testing: IFS="" $*'
+IFS=""; for a in $*; do echo ".$a."; done
+echo 'Testing: IFS="" $@'
+IFS=""; for a in $@; do echo ".$a."; done
+echo 'Testing: IFS="" "$*"'
+IFS=""; for a in "$*"; do echo ".$a."; done
+echo 'Testing: IFS="" "$@"'
+IFS=""; for a in "$@"; do echo ".$a."; done
+echo 'Testing: !IFS v=$*'
+unset IFS; v=$*; echo "v='$v'"
+echo 'Testing: !IFS v=$@'
+unset IFS; v=$@; echo "v='$v'"
+echo 'Testing: !IFS v="$*"'
+unset IFS; v="$*"; echo "v='$v'"
+echo 'Testing: !IFS v="$@"'
+unset IFS; v="$@"; echo "v='$v'"
+echo 'Testing: IFS="" v=$*'
+IFS=""; v=$*; echo "v='$v'"
+echo 'Testing: IFS="" v=$@'
+IFS=""; v=$@; echo "v='$v'"
+echo 'Testing: IFS="" v="$*"'
+IFS=""; v="$*"; echo "v='$v'"
+echo 'Testing: IFS="" v="$@"'
+IFS=""; v="$@"; echo "v='$v'"
+# Note: in IFS="" v=$@ and IFS="" v="$@" cases, bash produces "abc d e"
+# We produce "abcd e"
+echo Finished
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs2.right b/shell/ash_test/ash-vars/var_wordsplit_ifs2.right
new file mode 100644
index 000000000..c234193fe
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs2.right
@@ -0,0 +1,3 @@
+Unquoted:<1>
+Unquoted:<3>
+Quoted:<123>
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs2.tests b/shell/ash_test/ash-vars/var_wordsplit_ifs2.tests
new file mode 100755
index 000000000..47523549c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs2.tests
@@ -0,0 +1,13 @@
+# 123 chars long
+a="\
+01234567890123456789\
+01234567890123456789\
+01234567890123456789\
+01234567890123456789\
+01234567890123456789\
+0123456789\
+0123456789\
+012"
+IFS=2; for v in ${#a}; do echo Unquoted:"<$v>"; done
+IFS=2; for v in "${#a}"; do echo Quoted:"<$v>"; done
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs3.right b/shell/ash_test/ash-vars/var_wordsplit_ifs3.right
new file mode 100644
index 000000000..5ab72e1cd
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs3.right
@@ -0,0 +1,12 @@
+Unquoted%:<q>
+Unquoted%:<w>
+Unquoted%:<e>
+Unquoted%:<r>
+Unquoted%:<t>
+Unquoted#:<w>
+Unquoted#:<e>
+Unquoted#:<r>
+Unquoted#:<t>
+Unquoted#:<y>
+Quoted%:<q w e r t >
+Quoted#:< w e r t y>
diff --git a/shell/ash_test/ash-vars/var_wordsplit_ifs3.tests b/shell/ash_test/ash-vars/var_wordsplit_ifs3.tests
new file mode 100755
index 000000000..4aa65574a
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_wordsplit_ifs3.tests
@@ -0,0 +1,5 @@
+a="q w e r t y"
+for v in ${a%y}; do echo Unquoted%:"<$v>"; done
+for v in ${a#q}; do echo Unquoted#:"<$v>"; done
+for v in "${a%y}"; do echo Quoted%:"<$v>"; done
+for v in "${a#q}"; do echo Quoted#:"<$v>"; done
diff --git a/shell/hush.c b/shell/hush.c
index eabe83ac6..9b51f389e 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -103,6 +103,9 @@
 #else
 # define CLEAR_RANDOM_T(rnd) ((void)0)
 #endif
+#ifndef F_DUPFD_CLOEXEC
+# define F_DUPFD_CLOEXEC F_DUPFD
+#endif
 #ifndef PIPE_BUF
 # define PIPE_BUF 4096  /* amount of buffering in a pipe */
 #endif
@@ -459,19 +462,17 @@ static const char *const assignment_flag[] = {
 typedef struct in_str {
        const char *p;
-        /* eof_flag=1: last char in ->p is really an EOF */
-        char eof_flag; /* meaningless if ->p == NULL */
-        char peek_buf[2];
 #if ENABLE_HUSH_INTERACTIVE
        smallint promptmode; /* 0: PS1, 1: PS2 */
 #endif
+        int peek_buf[2];
        int last_char;
        FILE *file;
        int (*get) (struct in_str *) FAST_FUNC;
        int (*peek) (struct in_str *) FAST_FUNC;
 } in_str;
 #define i_getch(input) ((input)->get(input))
-#define i_peek(input) ((input)->peek(input))
+#define i_peek(input)  ((input)->peek(input))
 /* The descrip member of this structure is only used to make
 * debugging output pretty */
@@ -711,6 +712,13 @@ enum {
 };
+struct FILE_list {
+        struct FILE_list *next;
+        FILE *fp;
+        int fd;
+};
 /* "Globals" within this file */
 /* Sorted roughly by size (smaller offsets == smaller code) */
 struct globals {
@@ -769,6 +777,9 @@ struct globals {
         * 1: return is invoked, skip all till end of func
         */
        smallint flag_return_in_progress;
+# define G_flag_return_in_progress (G.flag_return_in_progress)
+#else
+# define G_flag_return_in_progress 0
 #endif
        smallint exiting; /* used to prevent EXIT trap recursion */
        /* These four support $?, $#, and $1 */
@@ -802,6 +813,7 @@ struct globals {
        unsigned handled_SIGCHLD;
        smallint we_have_children;
 #endif
+        struct FILE_list *FILE_list;
        /* Which signals have non-DFL handler (even with no traps set)?
         * Set at the start to:
         * (SIGQUIT + maybe SPECIAL_INTERACTIVE_SIGS + maybe SPECIAL_JOBSTOP_SIGS)
@@ -823,7 +835,9 @@ struct globals {
        int debug_indent;
 #endif
        struct sigaction sa;
-        char user_input_buf[ENABLE_FEATURE_EDITING ? CONFIG_FEATURE_EDITING_MAX_LEN : 2];
+#if ENABLE_FEATURE_EDITING
+        char user_input_buf[CONFIG_FEATURE_EDITING_MAX_LEN];
+#endif
 };
 #define G (*ptr_to_globals)
 /* Not #defining name to G.name - this quickly gets unwieldy
@@ -1252,6 +1266,91 @@ static void free_strings(char **strings)
 }
+static int xdup_and_close(int fd, int F_DUPFD_maybe_CLOEXEC)
+{
+        /* We avoid taking stdio fds. Mimicking ash: use fds above 9 */
+        int newfd = fcntl(fd, F_DUPFD_maybe_CLOEXEC, 10);
+        if (newfd < 0) {
+                /* fd was not open? */
+                if (errno == EBADF)
+                        return fd;
+                xfunc_die();
+        }
+        close(fd);
+        return newfd;
+}
+/* Manipulating the list of open FILEs */
+static FILE *remember_FILE(FILE *fp)
+{
+        if (fp) {
+                struct FILE_list *n = xmalloc(sizeof(*n));
+                n->next = G.FILE_list;
+                G.FILE_list = n;
+                n->fp = fp;
+                n->fd = fileno(fp);
+                close_on_exec_on(n->fd);
+        }
+        return fp;
+}
+static void fclose_and_forget(FILE *fp)
+{
+        struct FILE_list **pp = &G.FILE_list;
+        while (*pp) {
+                struct FILE_list *cur = *pp;
+                if (cur->fp == fp) {
+                        *pp = cur->next;
+                        free(cur);
+                        break;
+                }
+                pp = &cur->next;
+        }
+        fclose(fp);
+}
+static int save_FILEs_on_redirect(int fd)
+{
+        struct FILE_list *fl = G.FILE_list;
+        while (fl) {
+                if (fd == fl->fd) {
+                        /* We use it only on script files, they are all CLOEXEC */
+                        fl->fd = xdup_and_close(fd, F_DUPFD_CLOEXEC);
+                        return 1;
+                }
+                fl = fl->next;
+        }
+        return 0;
+}
+static void restore_redirected_FILEs(void)
+{
+        struct FILE_list *fl = G.FILE_list;
+        while (fl) {
+                int should_be = fileno(fl->fp);
+                if (fl->fd != should_be) {
+                        xmove_fd(fl->fd, should_be);
+                        fl->fd = should_be;
+                }
+                fl = fl->next;
+        }
+}
+#if ENABLE_FEATURE_SH_STANDALONE
+static void close_all_FILE_list(void)
+{
+        struct FILE_list *fl = G.FILE_list;
+        while (fl) {
+                /* fclose would also free FILE object.
+                 * It is disastrous if we share memory with a vforked parent.
+                 * I'm not sure we never come here after vfork.
+                 * Therefore just close fd, nothing more.
+                 */
+                /*fclose(fl->fp); - unsafe */
+                close(fl->fd);
+                fl = fl->next;
+        }
+}
+#endif
 /* Helpers for setting new $n and restoring them back
 */
 typedef struct save_arg_t {
@@ -1477,19 +1576,50 @@ static sighandler_t install_sighandler(int sig, sighandler_t handler)
        return old_sa.sa_handler;
 }
+static void hush_exit(int exitcode) NORETURN;
+static void fflush_and__exit(void) NORETURN;
+static void restore_ttypgrp_and__exit(void) NORETURN;
+static void restore_ttypgrp_and__exit(void)
+{
+        /* xfunc has failed! die die die */
+        /* no EXIT traps, this is an escape hatch! */
+        G.exiting = 1;
+        hush_exit(xfunc_error_retval);
+}
+/* Needed only on some libc:
+ * It was observed that on exit(), fgetc'ed buffered data
+ * gets "unwound" via lseek(fd, -NUM, SEEK_CUR).
+ * With the net effect that even after fork(), not vfork(),
+ * exit() in NOEXECed applet in "sh SCRIPT":
+ *      noexec_applet_here
+ *      echo END_OF_SCRIPT
+ * lseeks fd in input FILE object from EOF to "e" in "echo END_OF_SCRIPT".
+ * This makes "echo END_OF_SCRIPT" executed twice.
+ * Similar problems can be seen with die_if_script() -> xfunc_die()
+ * and in `cmd` handling.
+ * If set as die_func(), this makes xfunc_die() exit via _exit(), not exit():
+ */
+static void fflush_and__exit(void)
+{
+        fflush_all();
+        _exit(xfunc_error_retval);
+}
 #if ENABLE_HUSH_JOB
-static void xfunc_has_died(void);
 /* After [v]fork, in child: do not restore tty pgrp on xfunc death */
-# define disable_restore_tty_pgrp_on_exit() (die_func = NULL)
+# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
 /* After [v]fork, in parent: restore tty pgrp on xfunc death */
-# define enable_restore_tty_pgrp_on_exit()  (die_func = xfunc_has_died)
+# define enable_restore_tty_pgrp_on_exit()  (die_func = restore_ttypgrp_and__exit)
 /* Restores tty foreground process group, and exits.
 * May be called as signal handler for fatal signal
 * (will resend signal to itself, producing correct exit state)
 * or called directly with -EXITCODE.
- * We also call it if xfunc is exiting. */
+ * We also call it if xfunc is exiting.
+ */
 static void sigexit(int sig) NORETURN;
 static void sigexit(int sig)
 {
@@ -1544,7 +1674,6 @@ static sighandler_t pick_sighandler(unsigned sig)
 }
 /* Restores tty foreground process group, and exits. */
-static void hush_exit(int exitcode) NORETURN;
 static void hush_exit(int exitcode)
 {
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
@@ -1580,23 +1709,14 @@ static void hush_exit(int exitcode)
        }
 #endif
-#if ENABLE_HUSH_JOB
        fflush_all();
+#if ENABLE_HUSH_JOB
        sigexit(- (exitcode & 0xff));
 #else
-        exit(exitcode);
+        _exit(exitcode);
 #endif
 }
-static void xfunc_has_died(void) NORETURN;
-static void xfunc_has_died(void)
-{
-        /* xfunc has failed! die die die */
-        /* no EXIT traps, this is an escape hatch! */
-        G.exiting = 1;
-        hush_exit(xfunc_error_retval);
-}
 //TODO: return a mask of ALL handled sigs?
 static int check_and_run_traps(void)
@@ -1619,6 +1739,7 @@ static int check_and_run_traps(void)
                break;
 got_sig:
                if (G.traps && G.traps[sig]) {
+                        debug_printf_exec("%s: sig:%d handler:'%s'\n", __func__, sig, G.traps[sig]);
                        if (G.traps[sig][0]) {
                                /* We have user-defined handler */
                                smalluint save_rcode;
@@ -1636,6 +1757,7 @@ static int check_and_run_traps(void)
                /* not a trap: special action */
                switch (sig) {
                case SIGINT:
+                        debug_printf_exec("%s: sig:%d default SIGINT handler\n", __func__, sig);
                        /* Builtin was ^C'ed, make it look prettier: */
                        bb_putchar('\n');
                        G.flag_SIGINT = 1;
@@ -1644,6 +1766,7 @@ static int check_and_run_traps(void)
 #if ENABLE_HUSH_JOB
                case SIGHUP: {
                        struct pipe *job;
+                        debug_printf_exec("%s: sig:%d default SIGHUP handler\n", __func__, sig);
                        /* bash is observed to signal whole process groups,
                         * not individual processes */
                        for (job = G.job_list; job; job = job->next) {
@@ -1658,6 +1781,7 @@ static int check_and_run_traps(void)
 #endif
 #if ENABLE_HUSH_FAST
                case SIGCHLD:
+                        debug_printf_exec("%s: sig:%d default SIGCHLD handler\n", __func__, sig);
                        G.count_SIGCHLD++;
 //bb_error_msg("[%d] check_and_run_traps: G.count_SIGCHLD:%d G.handled_SIGCHLD:%d", getpid(), G.count_SIGCHLD, G.handled_SIGCHLD);
                        /* Note:
@@ -1667,6 +1791,7 @@ static int check_and_run_traps(void)
                        break;
 #endif
                default: /* ignored: */
+                        debug_printf_exec("%s: sig:%d default handling is to ignore\n", __func__, sig);
                        /* SIGTERM, SIGQUIT, SIGTTIN, SIGTTOU, SIGTSTP */
                        /* Note:
                         * We dont do 'last_sig = sig' here -> NOT returning this sig.
@@ -1766,6 +1891,7 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
 {
        struct variable **var_pp;
        struct variable *cur;
+        char *free_me = NULL;
        char *eq_sign;
        int name_len;
@@ -1782,6 +1908,7 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
                        var_pp = &cur->next;
                        continue;
                }
                /* We found an existing var with this name */
                if (cur->flg_read_only) {
 #if !BB_MMU
@@ -1830,12 +1957,17 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
                                strcpy(cur->varstr, str);
                                goto free_and_exp;
                        }
-                } else {
+                        /* Can't reuse */
-                        /* max_len == 0 signifies "malloced" var, which we can
+                        cur->max_len = 0;
-                         * (and has to) free */
+                        goto set_str_and_exp;
-                        free(cur->varstr);
+                }
-                }
+                /* max_len == 0 signifies "malloced" var, which we can
-                cur->max_len = 0;
+                 * (and have to) free. But we can't free(cur->varstr) here:
+                 * if cur->flg_export is 1, it is in the environment.
+                 * We should either unsetenv+free, or wait until putenv,
+                 * then putenv(new)+free(old).
+                 */
+                free_me = cur->varstr;
                goto set_str_and_exp;
        }
@@ -1862,10 +1994,15 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
                        cur->flg_export = 0;
                        /* unsetenv was already done */
                } else {
+                        int i;
                        debug_printf_env("%s: putenv '%s'\n", __func__, cur->varstr);
-                        return putenv(cur->varstr);
+                        i = putenv(cur->varstr);
+                        /* only now we can free old exported malloced string */
+                        free(free_me);
+                        return i;
                }
        }
+        free(free_me);
        return 0;
 }
@@ -2005,28 +2142,19 @@ static void reinit_unicode_for_hush(void)
        }
 }
 /*
- * in_str support
+ * in_str support (strings, and "strings" read from files).
 */
-static int FAST_FUNC static_get(struct in_str *i)
-{
-        int ch = *i->p;
-        if (ch != '\0') {
-                i->p++;
-                i->last_char = ch;
-                return ch;
-        }
-        return EOF;
-}
-static int FAST_FUNC static_peek(struct in_str *i)
-{
-        return *i->p;
-}
 #if ENABLE_HUSH_INTERACTIVE
+/* To test correct lineedit/interactive behavior, type from command line:
+ *      echo $P\
+ *      \
+ *      AT\
+ *      H\
+ *      \
+ * It excercises a lot of corner cases.
+ */
 static void cmdedit_update_prompt(void)
 {
        if (ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
@@ -2040,7 +2168,6 @@ static void cmdedit_update_prompt(void)
        if (G.PS2 == NULL)
                G.PS2 = "> ";
 }
 static const char *setup_prompt_string(int promptmode)
 {
        const char *prompt_str;
@@ -2058,33 +2185,36 @@ static const char *setup_prompt_string(int promptmode)
                        prompt_str = G.PS2;
        } else
                prompt_str = (promptmode == 0) ? G.PS1 : G.PS2;
-        debug_printf("result '%s'\n", prompt_str);
+        debug_printf("prompt_str '%s'\n", prompt_str);
        return prompt_str;
 }
+static int get_user_input(struct in_str *i)
-static void get_user_input(struct in_str *i)
 {
        int r;
        const char *prompt_str;
        prompt_str = setup_prompt_string(i->promptmode);
 # if ENABLE_FEATURE_EDITING
-        /* Enable command line editing only while a command line
-         * is actually being read */
        do {
                reinit_unicode_for_hush();
                G.flag_SIGINT = 0;
                /* buglet: SIGINT will not make new prompt to appear _at once_,
                 * only after <Enter>. (^C will work) */
-                r = read_line_input(G.line_input_state, prompt_str, G.user_input_buf, CONFIG_FEATURE_EDITING_MAX_LEN-1, /*timeout*/ -1);
+                r = read_line_input(G.line_input_state, prompt_str,
+                                G.user_input_buf, CONFIG_FEATURE_EDITING_MAX_LEN-1,
+                                /*timeout*/ -1
+                );
                /* catch *SIGINT* etc (^C is handled by read_line_input) */
                check_and_run_traps();
        } while (r == 0 || G.flag_SIGINT); /* repeat if ^C or SIGINT */
-        i->eof_flag = (r < 0);
+        if (r < 0) {
-        if (i->eof_flag) { /* EOF/error detected */
+                /* EOF/error detected */
-                G.user_input_buf[0] = EOF; /* yes, it will be truncated, it's ok */
+                i->p = NULL;
-                G.user_input_buf[1] = '\0';
+                i->peek_buf[0] = r = EOF;
+                return r;
        }
+        i->p = G.user_input_buf;
+        return (unsigned char)*i->p++;
 # else
        do {
                G.flag_SIGINT = 0;
@@ -2098,76 +2228,149 @@ static void get_user_input(struct in_str *i)
                        fputs(prompt_str, stdout);
                }
                fflush_all();
-                G.user_input_buf[0] = r = fgetc(i->file);
+                r = fgetc(i->file);
-                /*G.user_input_buf[1] = '\0'; - already is and never changed */
+        } while (G.flag_SIGINT || r == '\0');
-        } while (G.flag_SIGINT);
+        return r;
-        i->eof_flag = (r == EOF);
 # endif
-        i->p = G.user_input_buf;
 }
-#endif  /* INTERACTIVE */
 /* This is the magic location that prints prompts
 * and gets data back from the user */
+static int fgetc_interactive(struct in_str *i)
+{
+        int ch;
+        /* If it's interactive stdin, get new line. */
+        if (G_interactive_fd && i->file == stdin) {
+                /* Returns first char (or EOF), the rest is in i->p[] */
+                ch = get_user_input(i);
+                i->promptmode = 1; /* PS2 */
+        } else {
+                /* Not stdin: script file, sourced file, etc */
+                do ch = fgetc(i->file); while (ch == '\0');
+        }
+        return ch;
+}
+#else
+static inline int fgetc_interactive(struct in_str *i)
+{
+        int ch;
+        do ch = fgetc(i->file); while (ch == '\0');
+        return ch;
+}
+#endif  /* INTERACTIVE */
 static int FAST_FUNC file_get(struct in_str *i)
 {
        int ch;
-        /* If there is data waiting, eat it up */
+#if ENABLE_FEATURE_EDITING
-        if (i->p && *i->p) {
+        /* This can be stdin, check line editing char[] buffer */
-#if ENABLE_HUSH_INTERACTIVE
+        if (i->p && *i->p != '\0') {
- take_cached:
+                ch = (unsigned char)*i->p++;
-#endif
+                goto out;
-                ch = *i->p++;
+        }
-                if (i->eof_flag && !*i->p)
-                        ch = EOF;
-                /* note: ch is never NUL */
-        } else {
-                /* need to double check i->file because we might be doing something
-                 * more complicated by now, like sourcing or substituting. */
-#if ENABLE_HUSH_INTERACTIVE
-                if (G_interactive_fd && i->file == stdin) {
-                        do {
-                                get_user_input(i);
-                        } while (!*i->p); /* need non-empty line */
-                        i->promptmode = 1; /* PS2 */
-                        goto take_cached;
-                }
 #endif
-                do ch = fgetc(i->file); while (ch == '\0');
+        /* peek_buf[] is an int array, not char. Can contain EOF. */
+        ch = i->peek_buf[0];
+        if (ch != 0) {
+                int ch2 = i->peek_buf[1];
+                i->peek_buf[0] = ch2;
+                if (ch2 == 0) /* very likely, avoid redundant write */
+                        goto out;
+                i->peek_buf[1] = 0;
+                goto out;
        }
+        ch = fgetc_interactive(i);
+ out:
        debug_printf("file_get: got '%c' %d\n", ch, ch);
        i->last_char = ch;
        return ch;
 }
-/* All callers guarantee this routine will never
- * be used right after a newline, so prompting is not needed.
- */
 static int FAST_FUNC file_peek(struct in_str *i)
 {
        int ch;
-        if (i->p && *i->p) {
-                if (i->eof_flag && !i->p[1])
+#if ENABLE_FEATURE_EDITING && ENABLE_HUSH_INTERACTIVE
-                        return EOF;
+        /* This can be stdin, check line editing char[] buffer */
-                return *i->p;
+        if (i->p && *i->p != '\0')
-                /* note: ch is never NUL */
+                return (unsigned char)*i->p;
+#endif
+        /* peek_buf[] is an int array, not char. Can contain EOF. */
+        ch = i->peek_buf[0];
+        if (ch != 0)
+                return ch;
+        /* Need to get a new char */
+        ch = fgetc_interactive(i);
+        debug_printf("file_peek: got '%c' %d\n", ch, ch);
+        /* Save it by either rolling back line editing buffer, or in i->peek_buf[0] */
+#if ENABLE_FEATURE_EDITING && ENABLE_HUSH_INTERACTIVE
+        if (i->p) {
+                i->p -= 1;
+                return ch;
        }
-        do ch = fgetc(i->file); while (ch == '\0');
+#endif
-        i->eof_flag = (ch == EOF);
        i->peek_buf[0] = ch;
-        i->peek_buf[1] = '\0';
+        /*i->peek_buf[1] = 0; - already is */
-        i->p = i->peek_buf;
+        return ch;
-        debug_printf("file_peek: got '%c' %d\n", ch, ch);
+}
+static int FAST_FUNC static_get(struct in_str *i)
+{
+        int ch = (unsigned char)*i->p;
+        if (ch != '\0') {
+                i->p++;
+                i->last_char = ch;
+                return ch;
+        }
+        return EOF;
+}
+static int FAST_FUNC static_peek(struct in_str *i)
+{
+        /* Doesn't report EOF on NUL. None of the callers care. */
+        return (unsigned char)*i->p;
+}
+/* Only ever called if i_peek() was called, and did not return EOF.
+ * IOW: we know the previous peek saw an ordinary char, not EOF, not NUL,
+ * not end-of-line. Therefore we never need to read a new editing line here.
+ */
+static int i_peek2(struct in_str *i)
+{
+        int ch;
+        /* There are two cases when i->p[] buffer exists.
+         * (1) it's a string in_str.
+         * (2) It's a file, and we have a saved line editing buffer.
+         * In both cases, we know that i->p[0] exists and not NUL, and
+         * the peek2 result is in i->p[1].
+         */
+        if (i->p)
+                return (unsigned char)i->p[1];
+        /* Now we know it is a file-based in_str. */
+        /* peek_buf[] is an int array, not char. Can contain EOF. */
+        /* Is there 2nd char? */
+        ch = i->peek_buf[1];
+        if (ch == 0) {
+                /* We did not read it yet, get it now */
+                do ch = fgetc(i->file); while (ch == '\0');
+                i->peek_buf[1] = ch;
+        }
+        debug_printf("file_peek2: got '%c' %d\n", ch, ch);
        return ch;
 }
 static void setup_file_in_str(struct in_str *i, FILE *f)
 {
        memset(i, 0, sizeof(*i));
-        i->peek = file_peek;
        i->get = file_get;
+        i->peek = file_peek;
        /* i->promptmode = 0; - PS1 (memset did it) */
        i->file = f;
        /* i->p = NULL; */
@@ -2176,11 +2379,10 @@ static void setup_file_in_str(struct in_str *i, FILE *f)
 static void setup_string_in_str(struct in_str *i, const char *s)
 {
        memset(i, 0, sizeof(*i));
-        i->peek = static_peek;
        i->get = static_get;
+        i->peek = static_peek;
        /* i->promptmode = 0; - PS1 (memset did it) */
        i->p = s;
-        /* i->eof_flag = 0; */
 }
@@ -2211,7 +2413,7 @@ static ALWAYS_INLINE void o_free_unsafe(o_string *o)
 static void o_grow_by(o_string *o, int len)
 {
        if (o->length + len > o->maxlen) {
-                o->maxlen += (2*len > B_CHUNK ? 2*len : B_CHUNK);
+                o->maxlen += (2 * len) | (B_CHUNK-1);
                o->data = xrealloc(o->data, 1 + o->maxlen);
        }
 }
@@ -2219,11 +2421,26 @@ static void o_grow_by(o_string *o, int len)
 static void o_addchr(o_string *o, int ch)
 {
        debug_printf("o_addchr: '%c' o->length=%d o=%p\n", ch, o->length, o);
+        if (o->length < o->maxlen) {
+                /* likely. avoid o_grow_by() call */
+ add:
+                o->data[o->length] = ch;
+                o->length++;
+                o->data[o->length] = '\0';
+                return;
+        }
        o_grow_by(o, 1);
-        o->data[o->length] = ch;
+        goto add;
-        o->length++;
+}
+#if 0
+/* Valid only if we know o_string is not empty */
+static void o_delchr(o_string *o)
+{
+        o->length--;
        o->data[o->length] = '\0';
 }
+#endif
 static void o_addblock(o_string *o, const char *str, int len)
 {
@@ -2937,6 +3154,14 @@ static int done_command(struct parse_context *ctx)
        struct pipe *pi = ctx->pipe;
        struct command *command = ctx->command;
+#if 0   /* Instead we emit error message at run time */
+        if (ctx->pending_redirect) {
+                /* For example, "cmd >" (no filename to redirect to) */
+                die_if_script("syntax error: %s", "invalid redirect");
+                ctx->pending_redirect = NULL;
+        }
+#endif
        if (command) {
                if (IS_NULL_CMD(command)) {
                        debug_printf_parse("done_command: skipping null cmd, num_cmds=%d\n", pi->num_cmds);
@@ -3459,6 +3684,12 @@ static int parse_redirect(struct parse_context *ctx,
                debug_printf_parse("duplicating redirect '%d>&%d'\n",
                                redir->rd_fd, redir->rd_dup);
        } else {
+#if 0           /* Instead we emit error message at run time */
+                if (ctx->pending_redirect) {
+                        /* For example, "cmd > <file" */
+                        die_if_script("syntax error: %s", "invalid redirect");
+                }
+#endif
                /* Set ctx->pending_redirect, so we know what to do at the
                 * end of the next parsed word. */
                ctx->pending_redirect = redir;
@@ -3724,6 +3955,39 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
        /* command remains "open", available for possible redirects */
 }
+static int i_getch_and_eat_bkslash_nl(struct in_str *input)
+{
+        for (;;) {
+                int ch, ch2;
+                ch = i_getch(input);
+                if (ch != '\\')
+                        return ch;
+                ch2 = i_peek(input);
+                if (ch2 != '\n')
+                        return ch;
+                /* backslash+newline, skip it */
+                i_getch(input);
+        }
+}
+static int i_peek_and_eat_bkslash_nl(struct in_str *input)
+{
+        for (;;) {
+                int ch, ch2;
+                ch = i_peek(input);
+                if (ch != '\\')
+                        return ch;
+                ch2 = i_peek2(input);
+                if (ch2 != '\n')
+                        return ch;
+                /* backslash+newline, skip it */
+                i_getch(input);
+                i_getch(input);
+        }
+}
 #if ENABLE_HUSH_TICK || ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_DOLLAR_OPS
 /* Subroutines for copying $(...) and `...` things */
 static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote);
@@ -3841,7 +4105,7 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
                        if (!dbl)
                                break;
                        /* we look for closing )) of $((EXPR)) */
-                        if (i_peek(input) == end_ch) {
+                        if (i_peek_and_eat_bkslash_nl(input) == end_ch) {
                                i_getch(input); /* eat second ')' */
                                break;
                        }
@@ -3879,6 +4143,13 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
                                syntax_error_unterm_ch(')');
                                return 0;
                        }
+#if 0
+                        if (ch == '\n') {
+                                /* "backslash+newline", ignore both */
+                                o_delchr(dest); /* undo insertion of '\' */
+                                continue;
+                        }
+#endif
                        o_addchr(dest, ch);
                        continue;
                }
@@ -3897,7 +4168,7 @@ static int parse_dollar(o_string *as_string,
                o_string *dest,
                struct in_str *input, unsigned char quote_mask)
 {
-        int ch = i_peek(input);  /* first character after the $ */
+        int ch = i_peek_and_eat_bkslash_nl(input);  /* first character after the $ */
        debug_printf_parse("parse_dollar entered: ch='%c'\n", ch);
        if (isalpha(ch)) {
@@ -3909,9 +4180,11 @@ static int parse_dollar(o_string *as_string,
                        debug_printf_parse(": '%c'\n", ch);
                        o_addchr(dest, ch | quote_mask);
                        quote_mask = 0;
-                        ch = i_peek(input);
+                        ch = i_peek_and_eat_bkslash_nl(input);
-                        if (!isalnum(ch) && ch != '_')
+                        if (!isalnum(ch) && ch != '_') {
+                                /* End of variable name reached */
                                break;
+                        }
                        ch = i_getch(input);
                        nommu_addchr(as_string, ch);
                }
@@ -3938,7 +4211,7 @@ static int parse_dollar(o_string *as_string,
                ch = i_getch(input); /* eat '{' */
                nommu_addchr(as_string, ch);
-                ch = i_getch(input); /* first char after '{' */
+                ch = i_getch_and_eat_bkslash_nl(input); /* first char after '{' */
                /* It should be ${?}, or ${#var},
                 * or even ${?+subst} - operator acting on a special variable,
                 * or the beginning of variable name.
@@ -4044,7 +4317,7 @@ static int parse_dollar(o_string *as_string,
                ch = i_getch(input);
                nommu_addchr(as_string, ch);
 # if ENABLE_SH_MATH_SUPPORT
-                if (i_peek(input) == '(') {
+                if (i_peek_and_eat_bkslash_nl(input) == '(') {
                        ch = i_getch(input);
                        nommu_addchr(as_string, ch);
                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
@@ -4081,7 +4354,7 @@ static int parse_dollar(o_string *as_string,
        case '_':
                ch = i_getch(input);
                nommu_addchr(as_string, ch);
-                ch = i_peek(input);
+                ch = i_peek_and_eat_bkslash_nl(input);
                if (isalnum(ch)) { /* it's $_name or $_123 */
                        ch = '_';
                        goto make_var;
@@ -5548,7 +5821,7 @@ static char* expand_strvec_to_string(char **argv)
                        n++;
                }
        }
-        overlapping_strcpy((char*)list, list[0]);
+        overlapping_strcpy((char*)list, list[0] ? list[0] : "");
        debug_printf_expand("strvec_to_string='%s'\n", (char*)list);
        return (char*)list;
 }
@@ -5825,10 +6098,8 @@ static void parse_and_run_stream(struct in_str *inp, int end_trigger)
                debug_printf_exec("parse_and_run_stream: run_and_free_list\n");
                run_and_free_list(pipe_list);
                empty = 0;
-#if ENABLE_HUSH_FUNCTIONS
+                if (G_flag_return_in_progress == 1)
-                if (G.flag_return_in_progress == 1)
                        break;
-#endif
        }
 }
@@ -5913,7 +6184,8 @@ static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
                ) {
                        static const char *const argv[] = { NULL, NULL };
                        builtin_trap((char**)argv);
-                        exit(0); /* not _exit() - we need to fflush */
+                        fflush_all(); /* important */
+                        _exit(0);
                }
 # if BB_MMU
                reset_traps_to_defaults();
@@ -5946,8 +6218,7 @@ static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
        free(to_free);
 # endif
        close(channel[1]);
-        close_on_exec_on(channel[0]);
+        return remember_FILE(xfdopen_for_read(channel[0]));
-        return xfdopen_for_read(channel[0]);
 }
 /* Return code is exit status of the process that is run. */
@@ -5976,7 +6247,7 @@ static int process_command_subs(o_string *dest, const char *s)
        }
        debug_printf("done reading from `cmd` pipe, closing it\n");
-        fclose(fp);
+        fclose_and_forget(fp);
        /* We need to extract exitcode. Test case
         * "true; echo `sleep 1; false` $?"
         * should print 1 */
@@ -6068,6 +6339,74 @@ static void setup_heredoc(struct redir_struct *redir)
        wait(NULL); /* wait till child has died */
 }
+/* fd: redirect wants this fd to be used (e.g. 3>file).
+ * Move all conflicting internally used fds,
+ * and remember them so that we can restore them later.
+ */
+static int save_fds_on_redirect(int fd, int squirrel[3])
+{
+        if (squirrel) {
+                /* Handle redirects of fds 0,1,2 */
+                /* If we collide with an already moved stdio fd... */
+                if (fd == squirrel[0]) {
+                        squirrel[0] = xdup_and_close(squirrel[0], F_DUPFD);
+                        return 1;
+                }
+                if (fd == squirrel[1]) {
+                        squirrel[1] = xdup_and_close(squirrel[1], F_DUPFD);
+                        return 1;
+                }
+                if (fd == squirrel[2]) {
+                        squirrel[2] = xdup_and_close(squirrel[2], F_DUPFD);
+                        return 1;
+                }
+                /* If we are about to redirect stdio fd, and did not yet move it... */
+                if (fd <= 2 && squirrel[fd] < 0) {
+                        /* We avoid taking stdio fds */
+                        squirrel[fd] = fcntl(fd, F_DUPFD, 10);
+                        if (squirrel[fd] < 0 && errno != EBADF)
+                                xfunc_die();
+                        return 0; /* "we did not close fd" */
+                }
+        }
+#if ENABLE_HUSH_INTERACTIVE
+        if (fd != 0 && fd == G.interactive_fd) {
+                G.interactive_fd = xdup_and_close(G.interactive_fd, F_DUPFD_CLOEXEC);
+                return 1;
+        }
+#endif
+        /* Are we called from setup_redirects(squirrel==NULL)? Two cases:
+         * (1) Redirect in a forked child. No need to save FILEs' fds,
+         * we aren't going to use them anymore, ok to trash.
+         * (2) "exec 3>FILE". Bummer. We can save FILEs' fds,
+         * but how are we doing to use them?
+         * "fileno(fd) = new_fd" can't be done.
+         */
+        if (!squirrel)
+                return 0;
+        return save_FILEs_on_redirect(fd);
+}
+static void restore_redirects(int squirrel[3])
+{
+        int i, fd;
+        for (i = 0; i <= 2; i++) {
+                fd = squirrel[i];
+                if (fd != -1) {
+                        /* We simply die on error */
+                        xmove_fd(fd, i);
+                }
+        }
+        /* Moved G.interactive_fd stays on new fd, not doing anything for it */
+        restore_redirected_FILEs();
+}
 /* squirrel != NULL means we squirrel away copies of stdin, stdout,
 * and stderr if they are redirected. */
 static int setup_redirects(struct command *prog, int squirrel[])
@@ -6077,12 +6416,8 @@ static int setup_redirects(struct command *prog, int squirrel[])
        for (redir = prog->redirects; redir; redir = redir->next) {
                if (redir->rd_type == REDIRECT_HEREDOC2) {
-                        /* rd_fd<<HERE case */
+                        /* "rd_fd<<HERE" case */
-                        if (squirrel && redir->rd_fd < 3
+                        save_fds_on_redirect(redir->rd_fd, squirrel);
-                         && squirrel[redir->rd_fd] < 0
-                        ) {
-                                squirrel[redir->rd_fd] = dup(redir->rd_fd);
-                        }
                        /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
                         * of the heredoc */
                        debug_printf_parse("set heredoc '%s'\n",
@@ -6092,12 +6427,15 @@ static int setup_redirects(struct command *prog, int squirrel[])
                }
                if (redir->rd_dup == REDIRFD_TO_FILE) {
-                        /* rd_fd<*>file case (<*> is <,>,>>,<>) */
+                        /* "rd_fd<*>file" case (<*> is <,>,>>,<>) */
                        char *p;
                        if (redir->rd_filename == NULL) {
-                                /* Something went wrong in the parse.
+                                /*
-                                 * Pretend it didn't happen */
+                                 * Examples:
-                                bb_error_msg("bug in redirect parse");
+                                 * "cmd >" (no filename)
+                                 * "cmd > <file" (2nd redirect starts too early)
+                                 */
+                                die_if_script("syntax error: %s", "invalid redirect");
                                continue;
                        }
                        mode = redir_table[redir->rd_type].mode;
@@ -6105,47 +6443,39 @@ static int setup_redirects(struct command *prog, int squirrel[])
                        openfd = open_or_warn(p, mode);
                        free(p);
                        if (openfd < 0) {
-                        /* this could get lost if stderr has been redirected, but
+                                /* Error message from open_or_warn can be lost
-                         * bash and ash both lose it as well (though zsh doesn't!) */
+                                 * if stderr has been redirected, but bash
-//what the above comment tries to say?
+                                 * and ash both lose it as well
+                                 * (though zsh doesn't!)
+                                 */
                                return 1;
                        }
                } else {
-                        /* rd_fd<*>rd_dup or rd_fd<*>- cases */
+                        /* "rd_fd<*>rd_dup" or "rd_fd<*>-" cases */
                        openfd = redir->rd_dup;
                }
                if (openfd != redir->rd_fd) {
-                        if (squirrel && redir->rd_fd < 3
+                        int closed = save_fds_on_redirect(redir->rd_fd, squirrel);
-                         && squirrel[redir->rd_fd] < 0
-                        ) {
-                                squirrel[redir->rd_fd] = dup(redir->rd_fd);
-                        }
                        if (openfd == REDIRFD_CLOSE) {
-                                /* "n>-" means "close me" */
+                                /* "rd_fd >&-" means "close me" */
-                                close(redir->rd_fd);
+                                if (!closed) {
+                                        /* ^^^ optimization: saving may already
+                                         * have closed it. If not... */
+                                        close(redir->rd_fd);
+                                }
                        } else {
                                xdup2(openfd, redir->rd_fd);
                                if (redir->rd_dup == REDIRFD_TO_FILE)
+                                        /* "rd_fd > FILE" */
                                        close(openfd);
+                                /* else: "rd_fd > rd_dup" */
                        }
                }
        }
        return 0;
 }
-static void restore_redirects(int squirrel[])
-{
-        int i, fd;
-        for (i = 0; i < 3; i++) {
-                fd = squirrel[i];
-                if (fd != -1) {
-                        /* We simply die on error */
-                        xmove_fd(fd, i);
-                }
-        }
-}
 static char *find_in_path(const char *arg)
 {
        char *ret = NULL;
@@ -6329,8 +6659,8 @@ static int run_function(const struct function *funcp, char **argv)
        save_and_replace_G_args(&sv, argv);
        /* "we are in function, ok to use return" */
-        sv_flg = G.flag_return_in_progress;
+        sv_flg = G_flag_return_in_progress;
-        G.flag_return_in_progress = -1;
+        G_flag_return_in_progress = -1;
 # if ENABLE_HUSH_LOCAL
        G.func_nest_level++;
 # endif
@@ -6371,7 +6701,7 @@ static int run_function(const struct function *funcp, char **argv)
                G.func_nest_level--;
        }
 # endif
-        G.flag_return_in_progress = sv_flg;
+        G_flag_return_in_progress = sv_flg;
        restore_G_args(&sv, argv);
@@ -6417,13 +6747,17 @@ static void exec_builtin(char ***to_free,
 static void execvp_or_die(char **argv) NORETURN;
 static void execvp_or_die(char **argv)
 {
+        int e;
        debug_printf_exec("execing '%s'\n", argv[0]);
        /* Don't propagate SIG_IGN to the child */
        if (SPECIAL_JOBSTOP_SIGS != 0)
                switch_off_special_sigs(G.special_sig_mask & SPECIAL_JOBSTOP_SIGS);
        execvp(argv[0], argv);
+        e = 2;
+        if (errno == EACCES) e = 126;
+        if (errno == ENOENT) e = 127;
        bb_perror_msg("can't execute '%s'", argv[0]);
-        _exit(127); /* bash compat */
+        _exit(e);
 }
 #if ENABLE_HUSH_MODE_X
@@ -6466,7 +6800,8 @@ static void dump_cmd_in_x_mode(char **argv)
 * Never returns.
 * Don't exit() here.  If you don't exec, use _exit instead.
 * The at_exit handlers apparently confuse the calling process,
- * in particular stdin handling.  Not sure why? -- because of vfork! (vda) */
+ * in particular stdin handling. Not sure why? -- because of vfork! (vda)
+ */
 static void pseudo_exec_argv(nommu_save_t *nommu_save,
                char **argv, int assignment_cnt,
                char **argv_expanded) NORETURN;
@@ -6546,6 +6881,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                if (a >= 0) {
 # if BB_MMU /* see above why on NOMMU it is not allowed */
                        if (APPLET_IS_NOEXEC(a)) {
+                                /* Do not leak open fds from opened script files etc */
+                                close_all_FILE_list();
                                debug_printf_exec("running applet '%s'\n", argv[0]);
                                run_applet_no_and_exit(a, argv);
                        }
@@ -7121,6 +7458,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                if (x->b_function == builtin_exec && argv_expanded[1] == NULL) {
                                        debug_printf("exec with redirects only\n");
                                        rcode = setup_redirects(command, NULL);
+                                        /* rcode=1 can be if redir file can't be opened */
                                        goto clean_up_and_ret1;
                                }
                        }
@@ -7247,9 +7585,20 @@ static NOINLINE int run_pipe(struct pipe *pi)
                        if (pipefds.rd > 1)
                                close(pipefds.rd);
                        /* Like bash, explicit redirects override pipes,
-                         * and the pipe fd is available for dup'ing. */
+                         * and the pipe fd (fd#1) is available for dup'ing:
-                        if (setup_redirects(command, NULL))
+                         * "cmd1 2>&1 | cmd2": fd#1 is duped to fd#2, thus stderr
+                         * of cmd1 goes into pipe.
+                         */
+                        if (setup_redirects(command, NULL)) {
+                                /* Happens when redir file can't be opened:
+                                 * $ hush -c 'echo FOO >&2 | echo BAR 3>/qwe/rty; echo BAZ'
+                                 * FOO
+                                 * hush: can't open '/qwe/rty': No such file or directory
+                                 * BAZ
+                                 * (echo BAR is not executed, it hits _exit(1) below)
+                                 */
                                _exit(1);
+                        }
                        /* Stores to nommu_save list of env vars putenv'ed
                         * (NOMMU, on MMU we don't need that) */
@@ -7380,6 +7729,8 @@ static int run_list(struct pipe *pi)
        for (; pi; pi = IF_HUSH_LOOPS(rword == RES_DONE ? loop_top : ) pi->next) {
                if (G.flag_SIGINT)
                        break;
+                if (G_flag_return_in_progress == 1)
+                        break;
                IF_HAS_KEYWORDS(rword = pi->res_word;)
                debug_printf_exec(": rword=%d cond_code=%d last_rword=%d\n",
@@ -7550,12 +7901,10 @@ static int run_list(struct pipe *pi)
                                        continue;
                                }
 #endif
-#if ENABLE_HUSH_FUNCTIONS
+                                if (G_flag_return_in_progress == 1) {
-                                if (G.flag_return_in_progress == 1) {
                                        checkjobs(NULL);
                                        break;
                                }
-#endif
                        } else if (pi->followup == PIPE_BG) {
                                /* What does bash do with attempts to background builtins? */
                                /* even bash 3.2 doesn't do that well with nested bg:
@@ -7787,6 +8136,7 @@ int hush_main(int argc, char **argv)
        INIT_G();
        if (EXIT_SUCCESS != 0) /* if EXIT_SUCCESS == 0, it is already done */
                G.last_exitcode = EXIT_SUCCESS;
 #if ENABLE_HUSH_FAST
        G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
 #endif
@@ -7876,7 +8226,7 @@ int hush_main(int argc, char **argv)
        /* Initialize some more globals to non-zero values */
        cmdedit_update_prompt();
-        die_func = xfunc_has_died;
+        die_func = restore_ttypgrp_and__exit;
        /* Shell is non-interactive at first. We need to call
         * install_special_sighandlers() if we are going to execute "sh <script>",
@@ -8035,10 +8385,10 @@ int hush_main(int argc, char **argv)
                debug_printf("sourcing /etc/profile\n");
                input = fopen_for_read("/etc/profile");
                if (input != NULL) {
-                        close_on_exec_on(fileno(input));
+                        remember_FILE(input);
                        install_special_sighandlers();
                        parse_and_run_file(input);
-                        fclose(input);
+                        fclose_and_forget(input);
                }
                /* bash: after sourcing /etc/profile,
                 * tries to source (in the given order):
@@ -8060,11 +8410,11 @@ int hush_main(int argc, char **argv)
                G.global_argv++;
                debug_printf("running script '%s'\n", G.global_argv[0]);
                input = xfopen_for_read(G.global_argv[0]);
-                close_on_exec_on(fileno(input));
+                remember_FILE(input);
                install_special_sighandlers();
                parse_and_run_file(input);
 #if ENABLE_FEATURE_CLEAN_UP
-                fclose(input);
+                fclose_and_forget(input);
 #endif
                goto final_return;
        }
@@ -8205,7 +8555,7 @@ int hush_main(int argc, char **argv)
 int msh_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int msh_main(int argc, char **argv)
 {
-        //bb_error_msg("msh is deprecated, please use hush instead");
+        bb_error_msg("msh is deprecated, please use hush instead");
        return hush_main(argc, argv);
 }
 #endif
@@ -8399,6 +8749,14 @@ static void helper_export_local(char **argv, int exp, int lvl)
                                        continue;
                                }
                        }
+#if ENABLE_HUSH_LOCAL
+                        if (exp == 0 /* local? */
+                         && var && var->func_nest_level == lvl
+                        ) {
+                                /* "local x=abc; ...; local x" - ignore second local decl */
+                                continue;
+                        }
+#endif
                        /* Exporting non-existing variable.
                         * bash does not put it in environment,
                         * but remembers that it is exported,
@@ -8473,6 +8831,212 @@ static int FAST_FUNC builtin_local(char **argv)
 }
 #endif
+/* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#unset */
+static int FAST_FUNC builtin_unset(char **argv)
+{
+        int ret;
+        unsigned opts;
+        /* "!": do not abort on errors */
+        /* "+": stop at 1st non-option */
+        opts = getopt32(argv, "!+vf");
+        if (opts == (unsigned)-1)
+                return EXIT_FAILURE;
+        if (opts == 3) {
+                bb_error_msg("unset: -v and -f are exclusive");
+                return EXIT_FAILURE;
+        }
+        argv += optind;
+        ret = EXIT_SUCCESS;
+        while (*argv) {
+                if (!(opts & 2)) { /* not -f */
+                        if (unset_local_var(*argv)) {
+                                /* unset <nonexistent_var> doesn't fail.
+                                 * Error is when one tries to unset RO var.
+                                 * Message was printed by unset_local_var. */
+                                ret = EXIT_FAILURE;
+                        }
+                }
+#if ENABLE_HUSH_FUNCTIONS
+                else {
+                        unset_func(*argv);
+                }
+#endif
+                argv++;
+        }
+        return ret;
+}
+/* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#set
+ * built-in 'set' handler
+ * SUSv3 says:
+ * set [-abCefhmnuvx] [-o option] [argument...]
+ * set [+abCefhmnuvx] [+o option] [argument...]
+ * set -- [argument...]
+ * set -o
+ * set +o
+ * Implementations shall support the options in both their hyphen and
+ * plus-sign forms. These options can also be specified as options to sh.
+ * Examples:
+ * Write out all variables and their values: set
+ * Set $1, $2, and $3 and set "$#" to 3: set c a b
+ * Turn on the -x and -v options: set -xv
+ * Unset all positional parameters: set --
+ * Set $1 to the value of x, even if it begins with '-' or '+': set -- "$x"
+ * Set the positional parameters to the expansion of x, even if x expands
+ * with a leading '-' or '+': set -- $x
+ *
+ * So far, we only support "set -- [argument...]" and some of the short names.
+ */
+static int FAST_FUNC builtin_set(char **argv)
+{
+        int n;
+        char **pp, **g_argv;
+        char *arg = *++argv;
+        if (arg == NULL) {
+                struct variable *e;
+                for (e = G.top_var; e; e = e->next)
+                        puts(e->varstr);
+                return EXIT_SUCCESS;
+        }
+        do {
+                if (strcmp(arg, "--") == 0) {
+                        ++argv;
+                        goto set_argv;
+                }
+                if (arg[0] != '+' && arg[0] != '-')
+                        break;
+                for (n = 1; arg[n]; ++n) {
+                        if (set_mode((arg[0] == '-'), arg[n], argv[1]))
+                                goto error;
+                        if (arg[n] == 'o' && argv[1])
+                                argv++;
+                }
+        } while ((arg = *++argv) != NULL);
+        /* Now argv[0] is 1st argument */
+        if (arg == NULL)
+                return EXIT_SUCCESS;
+ set_argv:
+        /* NB: G.global_argv[0] ($0) is never freed/changed */
+        g_argv = G.global_argv;
+        if (G.global_args_malloced) {
+                pp = g_argv;
+                while (*++pp)
+                        free(*pp);
+                g_argv[1] = NULL;
+        } else {
+                G.global_args_malloced = 1;
+                pp = xzalloc(sizeof(pp[0]) * 2);
+                pp[0] = g_argv[0]; /* retain $0 */
+                g_argv = pp;
+        }
+        /* This realloc's G.global_argv */
+        G.global_argv = pp = add_strings_to_strings(g_argv, argv, /*dup:*/ 1);
+        n = 1;
+        while (*++pp)
+                n++;
+        G.global_argc = n;
+        return EXIT_SUCCESS;
+        /* Nothing known, so abort */
+ error:
+        bb_error_msg("set: %s: invalid option", arg);
+        return EXIT_FAILURE;
+}
+static int FAST_FUNC builtin_shift(char **argv)
+{
+        int n = 1;
+        argv = skip_dash_dash(argv);
+        if (argv[0]) {
+                n = atoi(argv[0]);
+        }
+        if (n >= 0 && n < G.global_argc) {
+                if (G.global_args_malloced) {
+                        int m = 1;
+                        while (m <= n)
+                                free(G.global_argv[m++]);
+                }
+                G.global_argc -= n;
+                memmove(&G.global_argv[1], &G.global_argv[n+1],
+                                G.global_argc * sizeof(G.global_argv[0]));
+                return EXIT_SUCCESS;
+        }
+        return EXIT_FAILURE;
+}
+/* Interruptibility of read builtin in bash
+ * (tested on bash-4.2.8 by sending signals (not by ^C)):
+ *
+ * Empty trap makes read ignore corresponding signal, for any signal.
+ *
+ * SIGINT:
+ * - terminates non-interactive shell;
+ * - interrupts read in interactive shell;
+ * if it has non-empty trap:
+ * - executes trap and returns to command prompt in interactive shell;
+ * - executes trap and returns to read in non-interactive shell;
+ * SIGTERM:
+ * - is ignored (does not interrupt) read in interactive shell;
+ * - terminates non-interactive shell;
+ * if it has non-empty trap:
+ * - executes trap and returns to read;
+ * SIGHUP:
+ * - terminates shell (regardless of interactivity);
+ * if it has non-empty trap:
+ * - executes trap and returns to read;
+ */
+static int FAST_FUNC builtin_read(char **argv)
+{
+        const char *r;
+        char *opt_n = NULL;
+        char *opt_p = NULL;
+        char *opt_t = NULL;
+        char *opt_u = NULL;
+        const char *ifs;
+        int read_flags;
+        /* "!": do not abort on errors.
+         * Option string must start with "sr" to match BUILTIN_READ_xxx
+         */
+        read_flags = getopt32(argv, "!srn:p:t:u:", &opt_n, &opt_p, &opt_t, &opt_u);
+        if (read_flags == (uint32_t)-1)
+                return EXIT_FAILURE;
+        argv += optind;
+        ifs = get_local_var_value("IFS"); /* can be NULL */
+ again:
+        r = shell_builtin_read(set_local_var_from_halves,
+                argv,
+                ifs,
+                read_flags,
+                opt_n,
+                opt_p,
+                opt_t,
+                opt_u
+        );
+        if ((uintptr_t)r == 1 && errno == EINTR) {
+                unsigned sig = check_and_run_traps();
+                if (sig && sig != SIGINT)
+                        goto again;
+        }
+        if ((uintptr_t)r > 1) {
+                bb_error_msg("%s", r);
+                r = (char*)(uintptr_t)1;
+        }
+        return (uintptr_t)r;
+}
 static int FAST_FUNC builtin_trap(char **argv)
 {
        int sig;
@@ -8671,7 +9235,6 @@ static int FAST_FUNC builtin_help(char **argv UNUSED_PARAM)
                if (x->b_descr)
                        printf("%-10s%s\n", x->b_cmd, x->b_descr);
        }
-        bb_putchar('\n');
        return EXIT_SUCCESS;
 }
 #endif
@@ -8721,6 +9284,15 @@ static int FAST_FUNC builtin_memleak(char **argv UNUSED_PARAM)
        if (l < (unsigned long)p) l = (unsigned long)p;
        free(p);
+# if 0  /* debug */
+        {
+                struct mallinfo mi = mallinfo();
+                printf("top alloc:0x%lx malloced:%d+%d=%d\n", l,
+                        mi.arena, mi.hblkhd, mi.arena + mi.hblkhd);
+        }
+# endif
        if (!G.memleak_value)
                G.memleak_value = l;
@@ -8742,175 +9314,6 @@ static int FAST_FUNC builtin_pwd(char **argv UNUSED_PARAM)
        return EXIT_SUCCESS;
 }
-/* Interruptibility of read builtin in bash
- * (tested on bash-4.2.8 by sending signals (not by ^C)):
- *
- * Empty trap makes read ignore corresponding signal, for any signal.
- *
- * SIGINT:
- * - terminates non-interactive shell;
- * - interrupts read in interactive shell;
- * if it has non-empty trap:
- * - executes trap and returns to command prompt in interactive shell;
- * - executes trap and returns to read in non-interactive shell;
- * SIGTERM:
- * - is ignored (does not interrupt) read in interactive shell;
- * - terminates non-interactive shell;
- * if it has non-empty trap:
- * - executes trap and returns to read;
- * SIGHUP:
- * - terminates shell (regardless of interactivity);
- * if it has non-empty trap:
- * - executes trap and returns to read;
- */
-static int FAST_FUNC builtin_read(char **argv)
-{
-        const char *r;
-        char *opt_n = NULL;
-        char *opt_p = NULL;
-        char *opt_t = NULL;
-        char *opt_u = NULL;
-        const char *ifs;
-        int read_flags;
-        /* "!": do not abort on errors.
-         * Option string must start with "sr" to match BUILTIN_READ_xxx
-         */
-        read_flags = getopt32(argv, "!srn:p:t:u:", &opt_n, &opt_p, &opt_t, &opt_u);
-        if (read_flags == (uint32_t)-1)
-                return EXIT_FAILURE;
-        argv += optind;
-        ifs = get_local_var_value("IFS"); /* can be NULL */
- again:
-        r = shell_builtin_read(set_local_var_from_halves,
-                argv,
-                ifs,
-                read_flags,
-                opt_n,
-                opt_p,
-                opt_t,
-                opt_u
-        );
-        if ((uintptr_t)r == 1 && errno == EINTR) {
-                unsigned sig = check_and_run_traps();
-                if (sig && sig != SIGINT)
-                        goto again;
-        }
-        if ((uintptr_t)r > 1) {
-                bb_error_msg("%s", r);
-                r = (char*)(uintptr_t)1;
-        }
-        return (uintptr_t)r;
-}
-/* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#set
- * built-in 'set' handler
- * SUSv3 says:
- * set [-abCefhmnuvx] [-o option] [argument...]
- * set [+abCefhmnuvx] [+o option] [argument...]
- * set -- [argument...]
- * set -o
- * set +o
- * Implementations shall support the options in both their hyphen and
- * plus-sign forms. These options can also be specified as options to sh.
- * Examples:
- * Write out all variables and their values: set
- * Set $1, $2, and $3 and set "$#" to 3: set c a b
- * Turn on the -x and -v options: set -xv
- * Unset all positional parameters: set --
- * Set $1 to the value of x, even if it begins with '-' or '+': set -- "$x"
- * Set the positional parameters to the expansion of x, even if x expands
- * with a leading '-' or '+': set -- $x
- *
- * So far, we only support "set -- [argument...]" and some of the short names.
- */
-static int FAST_FUNC builtin_set(char **argv)
-{
-        int n;
-        char **pp, **g_argv;
-        char *arg = *++argv;
-        if (arg == NULL) {
-                struct variable *e;
-                for (e = G.top_var; e; e = e->next)
-                        puts(e->varstr);
-                return EXIT_SUCCESS;
-        }
-        do {
-                if (strcmp(arg, "--") == 0) {
-                        ++argv;
-                        goto set_argv;
-                }
-                if (arg[0] != '+' && arg[0] != '-')
-                        break;
-                for (n = 1; arg[n]; ++n) {
-                        if (set_mode((arg[0] == '-'), arg[n], argv[1]))
-                                goto error;
-                        if (arg[n] == 'o' && argv[1])
-                                argv++;
-                }
-        } while ((arg = *++argv) != NULL);
-        /* Now argv[0] is 1st argument */
-        if (arg == NULL)
-                return EXIT_SUCCESS;
- set_argv:
-        /* NB: G.global_argv[0] ($0) is never freed/changed */
-        g_argv = G.global_argv;
-        if (G.global_args_malloced) {
-                pp = g_argv;
-                while (*++pp)
-                        free(*pp);
-                g_argv[1] = NULL;
-        } else {
-                G.global_args_malloced = 1;
-                pp = xzalloc(sizeof(pp[0]) * 2);
-                pp[0] = g_argv[0]; /* retain $0 */
-                g_argv = pp;
-        }
-        /* This realloc's G.global_argv */
-        G.global_argv = pp = add_strings_to_strings(g_argv, argv, /*dup:*/ 1);
-        n = 1;
-        while (*++pp)
-                n++;
-        G.global_argc = n;
-        return EXIT_SUCCESS;
-        /* Nothing known, so abort */
- error:
-        bb_error_msg("set: %s: invalid option", arg);
-        return EXIT_FAILURE;
-}
-static int FAST_FUNC builtin_shift(char **argv)
-{
-        int n = 1;
-        argv = skip_dash_dash(argv);
-        if (argv[0]) {
-                n = atoi(argv[0]);
-        }
-        if (n >= 0 && n < G.global_argc) {
-                if (G.global_args_malloced) {
-                        int m = 1;
-                        while (m <= n)
-                                free(G.global_argv[m++]);
-                }
-                G.global_argc -= n;
-                memmove(&G.global_argv[1], &G.global_argv[n+1],
-                                G.global_argc * sizeof(G.global_argv[0]));
-                return EXIT_SUCCESS;
-        }
-        return EXIT_FAILURE;
-}
 static int FAST_FUNC builtin_source(char **argv)
 {
        char *arg_path, *filename;
@@ -8932,7 +9335,7 @@ static int FAST_FUNC builtin_source(char **argv)
                if (arg_path)
                        filename = arg_path;
        }
-        input = fopen_or_warn(filename, "r");
+        input = remember_FILE(fopen_or_warn(filename, "r"));
        free(arg_path);
        if (!input) {
                /* bb_perror_msg("%s", *argv); - done by fopen_or_warn */
@@ -8941,23 +9344,24 @@ static int FAST_FUNC builtin_source(char **argv)
                 */
                return EXIT_FAILURE;
        }
-        close_on_exec_on(fileno(input));
 #if ENABLE_HUSH_FUNCTIONS
-        sv_flg = G.flag_return_in_progress;
+        sv_flg = G_flag_return_in_progress;
        /* "we are inside sourced file, ok to use return" */
-        G.flag_return_in_progress = -1;
+        G_flag_return_in_progress = -1;
 #endif
        if (argv[1])
                save_and_replace_G_args(&sv, argv);
+        /* "false; . ./empty_line; echo Zero:$?" should print 0 */
+        G.last_exitcode = 0;
        parse_and_run_file(input);
-        fclose(input);
+        fclose_and_forget(input);
        if (argv[1])
                restore_G_args(&sv, argv);
 #if ENABLE_HUSH_FUNCTIONS
-        G.flag_return_in_progress = sv_flg;
+        G_flag_return_in_progress = sv_flg;
 #endif
        return G.last_exitcode;
@@ -9000,43 +9404,6 @@ static int FAST_FUNC builtin_umask(char **argv)
        return !rc; /* rc != 0 - success */
 }
-/* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#unset */
-static int FAST_FUNC builtin_unset(char **argv)
-{
-        int ret;
-        unsigned opts;
-        /* "!": do not abort on errors */
-        /* "+": stop at 1st non-option */
-        opts = getopt32(argv, "!+vf");
-        if (opts == (unsigned)-1)
-                return EXIT_FAILURE;
-        if (opts == 3) {
-                bb_error_msg("unset: -v and -f are exclusive");
-                return EXIT_FAILURE;
-        }
-        argv += optind;
-        ret = EXIT_SUCCESS;
-        while (*argv) {
-                if (!(opts & 2)) { /* not -f */
-                        if (unset_local_var(*argv)) {
-                                /* unset <nonexistent_var> doesn't fail.
-                                 * Error is when one tries to unset RO var.
-                                 * Message was printed by unset_local_var. */
-                                ret = EXIT_FAILURE;
-                        }
-                }
-#if ENABLE_HUSH_FUNCTIONS
-                else {
-                        unset_func(*argv);
-                }
-#endif
-                argv++;
-        }
-        return ret;
-}
 /* http://www.opengroup.org/onlinepubs/9699919799/utilities/wait.html */
 static int FAST_FUNC builtin_wait(char **argv)
 {
@@ -9153,9 +9520,11 @@ static int FAST_FUNC builtin_break(char **argv)
        unsigned depth;
        if (G.depth_of_loop == 0) {
                bb_error_msg("%s: only meaningful in a loop", argv[0]);
+                /* if we came from builtin_continue(), need to undo "= 1" */
+                G.flag_break_continue = 0;
                return EXIT_SUCCESS; /* bash compat */
        }
-        G.flag_break_continue++; /* BC_BREAK = 1 */
+        G.flag_break_continue++; /* BC_BREAK = 1, or BC_CONTINUE = 2 */
        G.depth_break_continue = depth = parse_numeric_argv1(argv, 1, 1);
        if (depth == UINT_MAX)
@@ -9178,12 +9547,12 @@ static int FAST_FUNC builtin_return(char **argv)
 {
        int rc;
-        if (G.flag_return_in_progress != -1) {
+        if (G_flag_return_in_progress != -1) {
                bb_error_msg("%s: not in a function or sourced script", argv[0]);
                return EXIT_FAILURE; /* bash compat */
        }
-        G.flag_return_in_progress = 1;
+        G_flag_return_in_progress = 1;
        /* bash:
         * out of range: wraps around at 256, does not error out
diff --git a/shell/hush_test/hush-bugs/var3.right b/shell/hush_test/hush-bugs/var3.right
deleted file mode 100644
index 8eb0e3337..000000000
--- a/shell/hush_test/hush-bugs/var3.right
+++ /dev/null
@@ -1,5 +0,0 @@
-1
-1
-0
diff --git a/shell/hush_test/hush-bugs/var3.tests b/shell/hush_test/hush-bugs/var3.tests
deleted file mode 100755
index 97b102cbe..000000000
--- a/shell/hush_test/hush-bugs/var3.tests
+++ /dev/null
@@ -1 +0,0 @@
-x=0; f() { local x=1; echo $x; local x; echo $x; unset x; echo $x; local x; echo $x; }; f; echo $x
diff --git a/shell/hush_test/hush-glob/bash_brace1.tests b/shell/hush_test/hush-glob/bash_brace1.tests
index eb2f0e974..eae2e2a84 100755
--- a/shell/hush_test/hush-glob/bash_brace1.tests
+++ b/shell/hush_test/hush-glob/bash_brace1.tests
@@ -4,7 +4,7 @@ v='*brace1.t*'; echo $v
 # ...but not brace expanded:
 v='*{b,b}race1.t*'; echo $v
-# whereas direct brces are expanded:
+# whereas direct braces are expanded:
 echo *{b,b}race1.t*
 echo Done: $?
diff --git a/shell/hush_test/hush-glob/glob_dir.right b/shell/hush_test/hush-glob/glob_dir.right
new file mode 100644
index 000000000..aa90514d5
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_dir.right
@@ -0,0 +1,19 @@
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+dirtest/z.tmp
+*/z.tmp
+*/z.*
+*/?.*
+*/z*p
+d*r*e*t/z*p
+*\/z.tmp
+*/z.*
+*/z*p
+d*r*e*t/z*p
diff --git a/shell/hush_test/hush-glob/glob_dir.tests b/shell/hush_test/hush-glob/glob_dir.tests
new file mode 100755
index 000000000..dc4c4fdb5
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_dir.tests
@@ -0,0 +1,25 @@
+mkdir dirtest
+     >dirtest/z.tmp
+echo */z.tmp
+echo */z.*
+echo */?.*
+echo */z*p
+echo d*r*e*t/z*p
+echo *"/z.t"mp
+echo */z"."*
+echo *"/z"*"p"
+echo "d"*r*e*t"/"z*p
+echo
+echo \*/z.tmp
+echo "*"/z.*
+echo */"?".*
+echo */z"*p"
+echo d*r*e\*t/z*p
+echo *"\\/z.t"mp
+echo */z".*"
+echo *"/z"\*"p"
+echo "d*"r*e*t"/"z*p
+rm dirtest/z.tmp
+rmdir dirtest
diff --git a/shell/hush_test/hush-misc/heredoc1.right b/shell/hush_test/hush-heredoc/heredoc1.right
index 7fc68f3e1..7fc68f3e1 100644
--- a/shell/hush_test/hush-misc/heredoc1.right
+++ b/shell/hush_test/hush-heredoc/heredoc1.right
diff --git a/shell/hush_test/hush-misc/heredoc1.tests b/shell/hush_test/hush-heredoc/heredoc1.tests
index 2eeb4726b..2eeb4726b 100755
--- a/shell/hush_test/hush-misc/heredoc1.tests
+++ b/shell/hush_test/hush-heredoc/heredoc1.tests
diff --git a/shell/hush_test/hush-heredoc/heredoc2.right b/shell/hush_test/hush-heredoc/heredoc2.right
new file mode 100644
index 000000000..a486f1ac4
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc2.right
@@ -0,0 +1,2 @@
+bar
+bar
diff --git a/shell/hush_test/hush-heredoc/heredoc2.tests b/shell/hush_test/hush-heredoc/heredoc2.tests
new file mode 100755
index 000000000..6d9ccb6cc
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc2.tests
@@ -0,0 +1,7 @@
+foo () {
+cat <<EOF && { echo "$1" ; }
+$1
+EOF
+}
+foo "bar"
diff --git a/shell/hush_test/hush-misc/heredoc3.right b/shell/hush_test/hush-heredoc/heredoc3.right
index 6ed517f74..6ed517f74 100644
--- a/shell/hush_test/hush-misc/heredoc3.right
+++ b/shell/hush_test/hush-heredoc/heredoc3.right
diff --git a/shell/hush_test/hush-misc/heredoc3.tests b/shell/hush_test/hush-heredoc/heredoc3.tests
index 938577a89..938577a89 100755
--- a/shell/hush_test/hush-misc/heredoc3.tests
+++ b/shell/hush_test/hush-heredoc/heredoc3.tests
diff --git a/shell/hush_test/hush-heredoc/heredoc4.right b/shell/hush_test/hush-heredoc/heredoc4.right
new file mode 100644
index 000000000..371b092e2
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc4.right
@@ -0,0 +1 @@
+'$'
diff --git a/shell/hush_test/hush-heredoc/heredoc4.tests b/shell/hush_test/hush-heredoc/heredoc4.tests
new file mode 100755
index 000000000..642ddb324
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc4.tests
@@ -0,0 +1,3 @@
+cat <<EOF
+'$'
+EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc5.right b/shell/hush_test/hush-heredoc/heredoc5.right
new file mode 100644
index 000000000..74110e3b5
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc5.right
@@ -0,0 +1,9 @@
+exit EOF-f
+"
+echo 1
+echo Hello World
+moo      
+ EOF-f
+EOF-f   f
+EOF-f 
+Ok
diff --git a/shell/hush_test/hush-heredoc/heredoc5.tests b/shell/hush_test/hush-heredoc/heredoc5.tests
new file mode 100755
index 000000000..e619bded1
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc5.tests
@@ -0,0 +1,12 @@
+f=1
+  cat <<- EOF-f
+                exit EOF-f
+"
+echo $f
+echo `echo Hello World`
+                moo      
+ EOF-f
+EOF-f   f
+EOF-f 
+EOF-f
+echo Ok
diff --git a/shell/hush_test/hush-misc/heredoc_backslash1.right b/shell/hush_test/hush-heredoc/heredoc_backslash1.right
index 6a6114821..6a6114821 100644
--- a/shell/hush_test/hush-misc/heredoc_backslash1.right
+++ b/shell/hush_test/hush-heredoc/heredoc_backslash1.right
diff --git a/shell/hush_test/hush-misc/heredoc_backslash1.tests b/shell/hush_test/hush-heredoc/heredoc_backslash1.tests
index 501af5490..501af5490 100755
--- a/shell/hush_test/hush-misc/heredoc_backslash1.tests
+++ b/shell/hush_test/hush-heredoc/heredoc_backslash1.tests
diff --git a/shell/hush_test/hush-heredoc/heredoc_huge.right b/shell/hush_test/hush-heredoc/heredoc_huge.right
new file mode 100644
index 000000000..11740f674
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_huge.right
@@ -0,0 +1,3 @@
+546ed3f5c81c780d3ab86ada14824237  -
+546ed3f5c81c780d3ab86ada14824237  -
+End
diff --git a/shell/hush_test/hush-heredoc/heredoc_huge.tests b/shell/hush_test/hush-heredoc/heredoc_huge.tests
new file mode 100755
index 000000000..c2ec2817b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_huge.tests
@@ -0,0 +1,9 @@
+# This creates 120k heredoc
+echo 'cat <<HERE | md5sum' >"$0.tmp"
+yes "123456789 123456789 123456789 123456789" | head -3000 >>"$0.tmp"
+echo 'HERE' >>"$0.tmp"
+yes "123456789 123456789 123456789 123456789" | head -3000 | md5sum
+. "$0.tmp"
+rm "$0.tmp"
+echo End
diff --git a/shell/hush_test/hush-invert/invert.right b/shell/hush_test/hush-invert/invert.right
new file mode 100644
index 000000000..5a9239aa6
--- /dev/null
+++ b/shell/hush_test/hush-invert/invert.right
@@ -0,0 +1,10 @@
+1
+1
+1
+0
+0
+1
+0
+1
+0
+1
diff --git a/shell/hush_test/hush-invert/invert.tests b/shell/hush_test/hush-invert/invert.tests
new file mode 100755
index 000000000..8393d95a4
--- /dev/null
+++ b/shell/hush_test/hush-invert/invert.tests
@@ -0,0 +1,19 @@
+# tests of return value inversion
+# placeholder for future expansion
+# user subshells (...) did this wrong in bash versions before 2.04
+! ( echo hello | grep h >/dev/null 2>&1 ); echo $?
+! echo hello | grep h >/dev/null 2>&1 ; echo $?
+! true ; echo $?
+! false; echo $?
+! (false) ; echo $?
+! (true); echo $?
+! true | false ; echo $?
+! false | true ; echo $?
+! (true | false) ; echo $?
+! (false | true) ; echo $?
diff --git a/shell/hush_test/hush-misc/assignment2.right b/shell/hush_test/hush-misc/assignment2.right
new file mode 100644
index 000000000..9d1860be7
--- /dev/null
+++ b/shell/hush_test/hush-misc/assignment2.right
@@ -0,0 +1,2 @@
+hush: can't execute 'a=b': No such file or directory
+127
diff --git a/shell/hush_test/hush-misc/assignment2.rigth b/shell/hush_test/hush-misc/assignment2.rigth
deleted file mode 100644
index 591552cde..000000000
--- a/shell/hush_test/hush-misc/assignment2.rigth
+++ /dev/null
@@ -1,2 +0,0 @@
-hush: can't exec 'a=b': No such file or directory
-1
diff --git a/shell/hush_test/hush-misc/assignment2.tests b/shell/hush_test/hush-misc/assignment2.tests
index 540e01ec2..f6938434c 100755
--- a/shell/hush_test/hush-misc/assignment2.tests
+++ b/shell/hush_test/hush-misc/assignment2.tests
@@ -1,4 +1,3 @@
 # This must not be interpreted as an assignment
 a''=b true
 echo $?
-# (buglet: $? should be 127. it is currently 1)
diff --git a/shell/hush_test/hush-misc/eval1.right b/shell/hush_test/hush-misc/eval1.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/hush_test/hush-misc/eval1.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/hush_test/hush-misc/eval1.tests b/shell/hush_test/hush-misc/eval1.tests
new file mode 100755
index 000000000..b78c6cc94
--- /dev/null
+++ b/shell/hush_test/hush-misc/eval1.tests
@@ -0,0 +1,4 @@
+# empty eval nevertheless sets $? = 0
+false
+eval
+echo Ok:$?
diff --git a/shell/hush_test/hush-misc/eval2.right b/shell/hush_test/hush-misc/eval2.right
new file mode 100644
index 000000000..a7ce6ccc7
--- /dev/null
+++ b/shell/hush_test/hush-misc/eval2.right
@@ -0,0 +1,3 @@
+Zero:0
+Zero:0
+Zero:0
diff --git a/shell/hush_test/hush-misc/eval2.tests b/shell/hush_test/hush-misc/eval2.tests
new file mode 100755
index 000000000..6bfb87aa7
--- /dev/null
+++ b/shell/hush_test/hush-misc/eval2.tests
@@ -0,0 +1,4 @@
+false; eval; echo Zero:$?
+false; eval ""; echo Zero:$?
+false; eval "
+"; echo Zero:$?
diff --git a/shell/hush_test/hush-misc/exitcode1.right b/shell/hush_test/hush-misc/exitcode1.right
new file mode 100644
index 000000000..e5fefefda
--- /dev/null
+++ b/shell/hush_test/hush-misc/exitcode1.right
@@ -0,0 +1,2 @@
+One:1
+Zero:0
diff --git a/shell/hush_test/hush-misc/exitcode1.tests b/shell/hush_test/hush-misc/exitcode1.tests
new file mode 100755
index 000000000..dc8619d8b
--- /dev/null
+++ b/shell/hush_test/hush-misc/exitcode1.tests
@@ -0,0 +1,2 @@
+false || case a in a) echo One:$?;; esac
+echo Zero:$?
diff --git a/shell/hush_test/hush-misc/exitcode_EACCES.right b/shell/hush_test/hush-misc/exitcode_EACCES.right
new file mode 100644
index 000000000..a80d55137
--- /dev/null
+++ b/shell/hush_test/hush-misc/exitcode_EACCES.right
@@ -0,0 +1,2 @@
+hush: can't execute './': Permission denied
+126
diff --git a/shell/hush_test/hush-misc/exitcode_EACCES.tests b/shell/hush_test/hush-misc/exitcode_EACCES.tests
new file mode 100755
index 000000000..26b5c6116
--- /dev/null
+++ b/shell/hush_test/hush-misc/exitcode_EACCES.tests
@@ -0,0 +1,2 @@
+./
+echo $?
diff --git a/shell/hush_test/hush-misc/exitcode_ENOENT.right b/shell/hush_test/hush-misc/exitcode_ENOENT.right
new file mode 100644
index 000000000..d8315503f
--- /dev/null
+++ b/shell/hush_test/hush-misc/exitcode_ENOENT.right
@@ -0,0 +1,2 @@
+hush: can't execute './does_not_exist_for_sure': No such file or directory
+127
diff --git a/shell/hush_test/hush-misc/exitcode_ENOENT.tests b/shell/hush_test/hush-misc/exitcode_ENOENT.tests
new file mode 100755
index 000000000..7f1b88a99
--- /dev/null
+++ b/shell/hush_test/hush-misc/exitcode_ENOENT.tests
@@ -0,0 +1,2 @@
+./does_not_exist_for_sure
+echo $?
diff --git a/shell/hush_test/hush-misc/func6.right b/shell/hush_test/hush-misc/func6.right
new file mode 100644
index 000000000..0ebd8e5a3
--- /dev/null
+++ b/shell/hush_test/hush-misc/func6.right
@@ -0,0 +1,2 @@
+Two:2
+Two:2
diff --git a/shell/hush_test/hush-misc/func6.tests b/shell/hush_test/hush-misc/func6.tests
new file mode 100755
index 000000000..029c3e85e
--- /dev/null
+++ b/shell/hush_test/hush-misc/func6.tests
@@ -0,0 +1,11 @@
+f1() {
+        while return 2; do :; done
+}
+f1
+echo Two:$?
+f2() {
+        while :; do return 2; done
+}
+f2
+echo Two:$?
diff --git a/shell/hush_test/hush-misc/last_amp.right b/shell/hush_test/hush-misc/last_amp.right
new file mode 100644
index 000000000..3da21aec2
--- /dev/null
+++ b/shell/hush_test/hush-misc/last_amp.right
@@ -0,0 +1,2 @@
+3
+End
diff --git a/shell/hush_test/hush-misc/last_amp.tests b/shell/hush_test/hush-misc/last_amp.tests
new file mode 100755
index 000000000..160937644
--- /dev/null
+++ b/shell/hush_test/hush-misc/last_amp.tests
@@ -0,0 +1,8 @@
+$THIS_SH -c 'echo 3&'
+d=`date`
+while test "`date`" = "$d"; do true; done
+d1=`date`
+$THIS_SH -c 'sleep 1&'
+d2=`date`
+test "$d1" = "$d2" || echo BAD
+echo End
diff --git a/shell/hush_test/hush-misc/local1.right b/shell/hush_test/hush-misc/local1.right
new file mode 100644
index 000000000..a2d121df6
--- /dev/null
+++ b/shell/hush_test/hush-misc/local1.right
@@ -0,0 +1,4 @@
+A1:'A'
+A2:''
+A3:''
+A4:'A'
diff --git a/shell/hush_test/hush-misc/local1.tests b/shell/hush_test/hush-misc/local1.tests
new file mode 100755
index 000000000..b1e675059
--- /dev/null
+++ b/shell/hush_test/hush-misc/local1.tests
@@ -0,0 +1,11 @@
+a=A
+f() {
+        local a
+        # the above line unsets $a
+        echo "A2:'$a'"
+        unset a
+        echo "A3:'$a'"
+}
+echo "A1:'$a'"
+f
+echo "A4:'$a'"
diff --git a/shell/hush_test/hush-misc/nulltick1.right b/shell/hush_test/hush-misc/nulltick1.right
new file mode 100644
index 000000000..f90b8209e
--- /dev/null
+++ b/shell/hush_test/hush-misc/nulltick1.right
@@ -0,0 +1,3 @@
+Test 1
+Test 2
+Done
diff --git a/shell/hush_test/hush-misc/nulltick1.tests b/shell/hush_test/hush-misc/nulltick1.tests
new file mode 100755
index 000000000..f81923de3
--- /dev/null
+++ b/shell/hush_test/hush-misc/nulltick1.tests
@@ -0,0 +1,3 @@
+echo Test ` ` 1
+echo Test `</dev/null` 2
+echo Done
diff --git a/shell/hush_test/hush-misc/source1.right b/shell/hush_test/hush-misc/source1.right
index d4256034b..0ab7c548c 100644
--- a/shell/hush_test/hush-misc/source1.right
+++ b/shell/hush_test/hush-misc/source1.right
@@ -1,5 +1,2 @@
-hush: syntax error: unterminated ${name}
+Sourced ok
-line2
+Done
-Ok1:0
-hush: syntax error: unterminated '
-Ok2:1
diff --git a/shell/hush_test/hush-misc/source1.tests b/shell/hush_test/hush-misc/source1.tests
index c13888359..e2e75b227 100755
--- a/shell/hush_test/hush-misc/source1.tests
+++ b/shell/hush_test/hush-misc/source1.tests
@@ -1,10 +1,5 @@
-echo 'echo ${^}
+echo "echo Sourced ok" >../sourced.sh
-echo line2' >sourced1
+PATH="..:$PATH"
-. ./sourced1
+. sourced.sh
-echo Ok1:$?
+rm ../sourced.sh
+echo Done
-echo "echo '" >sourced1
-. ./sourced1
-echo Ok2:$?
-rm sourced1
diff --git a/shell/hush_test/hush-misc/source2.right b/shell/hush_test/hush-misc/source2.right
index 0587bad67..ce7171c87 100644
--- a/shell/hush_test/hush-misc/source2.right
+++ b/shell/hush_test/hush-misc/source2.right
@@ -1,4 +1 @@
-0:arg0 1:arg1 2:arg2
+Done: 0
-Ok1:0
-0:arg0 1:q 2:w
-Ok2:0
diff --git a/shell/hush_test/hush-misc/source2.tests b/shell/hush_test/hush-misc/source2.tests
index 40b6b83cd..1870cdf7e 100755
--- a/shell/hush_test/hush-misc/source2.tests
+++ b/shell/hush_test/hush-misc/source2.tests
@@ -1,8 +1,3 @@
-echo 'echo "0:$0 1:$1 2:$2"' >sourced1
+false
-set -- 1 2 3
+. /dev/null
-"$THIS_SH" -c '. ./sourced1' arg0 arg1 arg2
+echo Done: $?
-echo Ok1:$?
-"$THIS_SH" -c '. ./sourced1 q w e' arg0 arg1 arg2
-echo Ok2:$?
-rm sourced1
diff --git a/shell/hush_test/hush-misc/source3.right b/shell/hush_test/hush-misc/source3.right
new file mode 100644
index 000000000..bdf9001a5
--- /dev/null
+++ b/shell/hush_test/hush-misc/source3.right
@@ -0,0 +1,2 @@
+Zero:0
+Zero:0
diff --git a/shell/hush_test/hush-misc/source3.tests b/shell/hush_test/hush-misc/source3.tests
new file mode 100755
index 000000000..1abf156ed
--- /dev/null
+++ b/shell/hush_test/hush-misc/source3.tests
@@ -0,0 +1,6 @@
+# Test both empty file, and one-empty-line file
+echo >sourced1
+true >sourced2
+false; . ./sourced1; echo Zero:$?
+false; . ./sourced2; echo Zero:$?
+rm sourced1 sourced2
diff --git a/shell/hush_test/hush-misc/source4.right b/shell/hush_test/hush-misc/source4.right
new file mode 100644
index 000000000..d4256034b
--- /dev/null
+++ b/shell/hush_test/hush-misc/source4.right
@@ -0,0 +1,5 @@
+hush: syntax error: unterminated ${name}
+line2
+Ok1:0
+hush: syntax error: unterminated '
+Ok2:1
diff --git a/shell/hush_test/hush-misc/source4.tests b/shell/hush_test/hush-misc/source4.tests
new file mode 100755
index 000000000..c13888359
--- /dev/null
+++ b/shell/hush_test/hush-misc/source4.tests
@@ -0,0 +1,10 @@
+echo 'echo ${^}
+echo line2' >sourced1
+. ./sourced1
+echo Ok1:$?
+echo "echo '" >sourced1
+. ./sourced1
+echo Ok2:$?
+rm sourced1
diff --git a/shell/hush_test/hush-misc/source5.right b/shell/hush_test/hush-misc/source5.right
new file mode 100644
index 000000000..0587bad67
--- /dev/null
+++ b/shell/hush_test/hush-misc/source5.right
@@ -0,0 +1,4 @@
+0:arg0 1:arg1 2:arg2
+Ok1:0
+0:arg0 1:q 2:w
+Ok2:0
diff --git a/shell/hush_test/hush-misc/source5.tests b/shell/hush_test/hush-misc/source5.tests
new file mode 100755
index 000000000..40b6b83cd
--- /dev/null
+++ b/shell/hush_test/hush-misc/source5.tests
@@ -0,0 +1,8 @@
+echo 'echo "0:$0 1:$1 2:$2"' >sourced1
+set -- 1 2 3
+"$THIS_SH" -c '. ./sourced1' arg0 arg1 arg2
+echo Ok1:$?
+"$THIS_SH" -c '. ./sourced1 q w e' arg0 arg1 arg2
+echo Ok2:$?
+rm sourced1
diff --git a/shell/hush_test/hush-quoting/dollar_repl_slash_bash1.right b/shell/hush_test/hush-quoting/dollar_repl_slash_bash1.right
new file mode 100644
index 000000000..b212c246c
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_repl_slash_bash1.right
@@ -0,0 +1,10 @@
+192\.168\.0\.1
+192\.168\.0\.1[
+192\.168\.0\.1[
+192\\.168\\.0\\.1[
+192\.168\.0\.1[
+192\.168\.0\.1
+192\.168\.0\.1[
+192\.168\.0\.1[
+192\\.168\\.0\\.1[
+192\.168\.0\.1[
diff --git a/shell/hush_test/hush-quoting/dollar_repl_slash_bash1.tests b/shell/hush_test/hush-quoting/dollar_repl_slash_bash1.tests
new file mode 100755
index 000000000..74dca1cc0
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_repl_slash_bash1.tests
@@ -0,0 +1,21 @@
+# The bug here was triggered by:
+# * performing pathname expansion because we see [
+# * replace operator did not escape \ in replace string
+IP=192.168.0.1
+rm -f '192.168.0.1['
+echo "${IP//./\\.}"
+echo "${IP//./\\.}"'[' # bug was here
+echo "${IP//./\\.}["   # bug was here
+echo "${IP//./\\\\.}[" # bug was here
+echo "192\.168\.0\.1["
+echo >'192.168.0.1['
+echo "${IP//./\\.}"
+echo "${IP//./\\.}"'[' # bug was here
+echo "${IP//./\\.}["   # bug was here
+echo "${IP//./\\\\.}[" # bug was here
+echo "192\.168\.0\.1["
+rm -f '192.168.0.1['
diff --git a/shell/hush_test/hush-read/read_r.tests b/shell/hush_test/hush-read/read_r.tests
index 2c4cc6106..1f0a18afc 100755
--- a/shell/hush_test/hush-read/read_r.tests
+++ b/shell/hush_test/hush-read/read_r.tests
@@ -1,2 +1,4 @@
-echo -e 'test\\\nbest' | (read reply; echo "$reply")
+echo 'test\
-echo -e 'test\\\nbest' | (read -r reply; echo "$reply")
+best' | (read reply; echo "$reply")
+echo 'test\
+best' | (read -r reply; echo "$reply")
diff --git a/shell/hush_test/hush-redir/redir1.right b/shell/hush_test/hush-redir/redir1.right
new file mode 100644
index 000000000..15515d1af
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir1.right
@@ -0,0 +1,12 @@
+Test 0:  var:ok
+File created:ok
+Test 1:  var:ok
+File created:ok
+Test 2:  var:ok
+File created:ok
+Test 3:  var:ok
+File created:ok
+Test 4:  var:ok
+File created:ok
+Test 5:  var:ok
+File created:ok
diff --git a/shell/hush_test/hush-redir/redir1.tests b/shell/hush_test/hush-redir/redir1.tests
new file mode 100755
index 000000000..ef2fbfb77
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir1.tests
@@ -0,0 +1,40 @@
+rm shell_test_$$ 2>/dev/null
+var=bad
+>shell_test_$$ var=ok
+echo "Test 0:  var:$var"
+test -f shell_test_$$ && echo "File created:ok"
+rm shell_test_$$ 2>/dev/null
+var=bad
+var=ok >shell_test_$$
+echo "Test 1:  var:$var"
+test -f shell_test_$$ && echo "File created:ok"
+rm shell_test_$$ 2>/dev/null
+var=ok
+true | var=bad >shell_test_$$
+echo "Test 2:  var:$var"
+test -f shell_test_$$ && echo "File created:ok"
+rm shell_test_$$ 2>/dev/null
+var=bad
+{ var=ok >shell_test_$$; }
+echo "Test 3:  var:$var"
+test -f shell_test_$$ && echo "File created:ok"
+rm shell_test_$$ 2>/dev/null
+var=ok
+{ var=bad >shell_test_$$; } &
+# cant use usleep as it isnt standard in $PATH --
+# we fail when testing busybox compiled solely as "hush"
+wait
+echo "Test 4:  var:$var"
+test -f shell_test_$$ && echo "File created:ok"
+rm shell_test_$$ 2>/dev/null
+var=ok
+( var=bad >shell_test_$$ )
+echo "Test 5:  var:$var"
+test -f shell_test_$$ && echo "File created:ok"
+rm shell_test_$$ 2>/dev/null
diff --git a/shell/hush_test/hush-redir/redir2.right b/shell/hush_test/hush-redir/redir2.right
new file mode 100644
index 000000000..d86bac9de
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir2.right
@@ -0,0 +1 @@
+OK
diff --git a/shell/hush_test/hush-redir/redir2.tests b/shell/hush_test/hush-redir/redir2.tests
new file mode 100755
index 000000000..61ccea30c
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir2.tests
@@ -0,0 +1,5 @@
+# ash once couldn't redirect above fd#9
+exec 1>/dev/null
+(echo LOST1 >&22) 22>&1
+(echo LOST2 >&22) 22>&1
+(echo OK >&22) 22>&2
diff --git a/shell/hush_test/hush-misc/redir3.right b/shell/hush_test/hush-redir/redir3.right
index 3d20bbf68..3d20bbf68 100644
--- a/shell/hush_test/hush-misc/redir3.right
+++ b/shell/hush_test/hush-redir/redir3.right
diff --git a/shell/hush_test/hush-misc/redir3.tests b/shell/hush_test/hush-redir/redir3.tests
index 7c28e4324..7c28e4324 100755
--- a/shell/hush_test/hush-misc/redir3.tests
+++ b/shell/hush_test/hush-redir/redir3.tests
diff --git a/shell/hush_test/hush-redir/redir4.right b/shell/hush_test/hush-redir/redir4.right
new file mode 100644
index 000000000..d86bac9de
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir4.right
@@ -0,0 +1 @@
+OK
diff --git a/shell/hush_test/hush-redir/redir4.tests b/shell/hush_test/hush-redir/redir4.tests
new file mode 100755
index 000000000..4bdf5ae27
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir4.tests
@@ -0,0 +1,72 @@
+# ash uses fd 10 (usually) for reading the script
+exec 13>&-
+exec 12>&-
+exec 11>&-
+exec 10>&-
+# some amount of input is prefetched.
+# make sure final echo is far enough to not be prefetched.
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+###############################################################
+echo "OK"
diff --git a/shell/hush_test/hush-misc/redir5.right b/shell/hush_test/hush-redir/redir5.right
index 52cce4feb..52cce4feb 100644
--- a/shell/hush_test/hush-misc/redir5.right
+++ b/shell/hush_test/hush-redir/redir5.right
diff --git a/shell/hush_test/hush-misc/redir5.tests b/shell/hush_test/hush-redir/redir5.tests
index 957f9c81f..957f9c81f 100755
--- a/shell/hush_test/hush-misc/redir5.tests
+++ b/shell/hush_test/hush-redir/redir5.tests
diff --git a/shell/hush_test/hush-redir/redir6.right b/shell/hush_test/hush-redir/redir6.right
new file mode 100644
index 000000000..ed754df78
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir6.right
@@ -0,0 +1,2 @@
+Hello
+OK
diff --git a/shell/hush_test/hush-redir/redir6.tests b/shell/hush_test/hush-redir/redir6.tests
new file mode 100755
index 000000000..33b6d4cd4
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir6.tests
@@ -0,0 +1,3 @@
+# we had a bug where this would hang
+(head -n 1 <redir6.right)
+echo OK
diff --git a/shell/hush_test/hush-redir/redir7.right b/shell/hush_test/hush-redir/redir7.right
new file mode 100644
index 000000000..6430b0211
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir7.right
@@ -0,0 +1,3 @@
+Ok
+Ok
+Done
diff --git a/shell/hush_test/hush-redir/redir7.tests b/shell/hush_test/hush-redir/redir7.tests
new file mode 100755
index 000000000..e873a4622
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir7.tests
@@ -0,0 +1,12 @@
+# Chars above 0x7f are used as special codes.
+# 0x81 is CTLESC (see ash.c).
+# The bug was that quoting and unquoting of them
+# was out of sync for redirect filenames.
+>unicode.sh
+printf 'echo Ok >uni\x81code\n' >>unicode.sh
+printf 'cat uni\x81code\n' >>unicode.sh
+printf 'cat uni?code\n' >>unicode.sh
+. ./unicode.sh
+rm uni*code*
+echo Done
diff --git a/shell/hush_test/hush-redir/redir8.right b/shell/hush_test/hush-redir/redir8.right
new file mode 100644
index 000000000..6430b0211
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir8.right
@@ -0,0 +1,3 @@
+Ok
+Ok
+Done
diff --git a/shell/hush_test/hush-redir/redir8.tests b/shell/hush_test/hush-redir/redir8.tests
new file mode 100755
index 000000000..2bd386749
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir8.tests
@@ -0,0 +1,15 @@
+# Chars above 0x7f are used as special codes.
+# 0x81 is CTLESC (see ash.c).
+# The bug was that quoting and unquoting of them
+# was out of sync for redirect filenames.
+# Subcase when redirect filename is specified in a variable.
+>unicode.sh
+printf 'v=uni\x81code\n' >>unicode.sh
+printf 'echo Ok >"$v"\n' >>unicode.sh
+printf 'cat uni\x81code\n' >>unicode.sh
+printf 'cat uni?code\n' >>unicode.sh
+. ./unicode.sh
+rm uni*code*
+echo Done
diff --git a/shell/hush_test/hush-redir/redir9.right b/shell/hush_test/hush-redir/redir9.right
new file mode 100644
index 000000000..34c2512e4
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir9.right
@@ -0,0 +1,2 @@
+Ok
+Done:0
diff --git a/shell/hush_test/hush-redir/redir9.tests b/shell/hush_test/hush-redir/redir9.tests
new file mode 100755
index 000000000..8befa611c
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir9.tests
@@ -0,0 +1,4 @@
+echo Ok >file.tmp
+cat 0<>file.tmp
+echo Done:$?
+rm file.tmp
diff --git a/shell/hush_test/hush-redir/redirA.right b/shell/hush_test/hush-redir/redirA.right
new file mode 100644
index 000000000..31406e336
--- /dev/null
+++ b/shell/hush_test/hush-redir/redirA.right
@@ -0,0 +1,2 @@
+tmp11
+tmp11
diff --git a/shell/hush_test/hush-redir/redirA.tests b/shell/hush_test/hush-redir/redirA.tests
new file mode 100755
index 000000000..56833f938
--- /dev/null
+++ b/shell/hush_test/hush-redir/redirA.tests
@@ -0,0 +1,11 @@
+x="tmp11:tmp22"
+# Bug was incorrectly expanding variables in >redir
+echo "${x%:*}" >"${x%:*}"
+echo tmp1*
+rm tmp1*
+# Also try unquoted
+echo "${x%:*}" >${x%:*}
+echo tmp1*
+rm tmp1*
diff --git a/shell/hush_test/hush-redir/redir_escapednum.right b/shell/hush_test/hush-redir/redir_escapednum.right
new file mode 100644
index 000000000..7326d9603
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_escapednum.right
@@ -0,0 +1 @@
+Ok
diff --git a/shell/hush_test/hush-redir/redir_escapednum.tests b/shell/hush_test/hush-redir/redir_escapednum.tests
new file mode 100755
index 000000000..81983cae2
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_escapednum.tests
@@ -0,0 +1,2 @@
+echo NOT SHOWN \2>/dev/null
+echo Ok
diff --git a/shell/hush_test/hush-redir/redir_expand.right b/shell/hush_test/hush-redir/redir_expand.right
new file mode 100644
index 000000000..ead25f603
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_expand.right
@@ -0,0 +1,18 @@
+shell_test
+\shell_test
+\shell_test
+\shell_test
+Here1
+Ok1
+Here2
+Ok2
+Here3
+Ok3
+Here4
+Ok4
+Now with variable refs
+shell_test_1
+\shell_test_1
+\shell_test_1
+\shell_test_1
+Done
diff --git a/shell/hush_test/hush-redir/redir_expand.tests b/shell/hush_test/hush-redir/redir_expand.tests
new file mode 100755
index 000000000..c50b8cedf
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_expand.tests
@@ -0,0 +1,85 @@
+rm *shell_test* 2>/dev/null
+>\shell_test
+echo *shell_test*
+rm *shell_test*
+>\\shell_test
+echo *shell_test*
+rm *shell_test*
+>"\shell_test"
+echo *shell_test*
+rm *shell_test*
+>"\\shell_test"
+echo *shell_test*
+rm *shell_test*
+cat <<\shell_test
+Here1
+shell_test
+echo Ok1
+cat <<\\shell_test
+Here2
+\shell_test
+echo Ok2
+cat <<"\shell_test"
+Here3
+\shell_test
+echo Ok3
+cat <<"\\shell_test"
+Here4
+\shell_test
+echo Ok4
+echo Now with variable refs
+i=1
+>\shell_test_$i
+echo *shell_test*
+rm *shell_test*
+>\\shell_test_$i
+echo *shell_test*
+rm *shell_test*
+>"\shell_test_$i"
+echo *shell_test*
+rm *shell_test*
+>"\\shell_test_$i"
+echo *shell_test*
+rm *shell_test*
+echo Done;exit
+# UNFIXED BUG. bash apparently will expand $i even in terminating delimiter.
+# http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
+# does not mandate this behavior.
+# This is not likely to be used much in real-world.
+cat <<\shell_test_$i
+Here1
+shell_test_$i
+echo Ok1
+cat <<\\shell_test_$i
+Here2
+\shell_test_$i
+echo Ok2
+cat <<"\shell_test_$i"
+Here3
+\shell_test_$i
+echo Ok3
+cat <<"\\shell_test_$i"
+Here4
+\shell_test_$i
+echo Ok4
diff --git a/shell/hush_test/hush-redir/redir_multi.right b/shell/hush_test/hush-redir/redir_multi.right
new file mode 100644
index 000000000..a97c4bdf1
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_multi.right
@@ -0,0 +1,4 @@
+Testing multiple redirections to same fd
+Hello
+Done1
+Done2
diff --git a/shell/hush_test/hush-redir/redir_multi.tests b/shell/hush_test/hush-redir/redir_multi.tests
new file mode 100755
index 000000000..c639ebb2d
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_multi.tests
@@ -0,0 +1,5 @@
+echo "Testing multiple redirections to same fd"
+# bug was making us lose fd #1 after this:
+echo Hello >/dev/null 1>&2
+echo Done1
+echo Done2 >&2
diff --git a/shell/hush_test/hush-redir/redir_script.right b/shell/hush_test/hush-redir/redir_script.right
new file mode 100644
index 000000000..6694ed334
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_script.right
@@ -0,0 +1 @@
+Ok: script fd is not closed
diff --git a/shell/hush_test/hush-redir/redir_script.tests b/shell/hush_test/hush-redir/redir_script.tests
new file mode 100755
index 000000000..ccc497d7b
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_script.tests
@@ -0,0 +1,29 @@
+# Builds a " 3>&- 4>&-" string.
+# Note: one of these fds is a directory opened to /proc/self/fd
+# for globbing. It is unwanted, but I don't know how to filter it out.
+find_fds() {
+        fds=""
+        for f in /proc/self/fd/*; do
+                test "$f" = "/proc/self/fd/0" && continue
+                test "$f" = "/proc/self/fd/1" && continue
+                test "$f" = "/proc/self/fd/2" && continue
+                fds="$fds ${f##*/}>&-"
+        done
+}
+find_fds
+fds1="$fds"
+# One of the fds is open to the script body
+# Close it while executing something.
+eval "find_fds $fds"
+# Shell should not lose that fd. Did it?
+find_fds
+test x"$fds1" = x"$fds" && { echo "Ok: script fd is not closed"; exit 0; }
+echo "Bug: script fd is closed"
+echo "fds1:$fds1"
+echo "fds2:$fds"
+exit 1
diff --git a/shell/hush_test/hush-redir/redir_space.right b/shell/hush_test/hush-redir/redir_space.right
new file mode 100644
index 000000000..084295204
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_space.right
@@ -0,0 +1,3 @@
+z1.tmp: 1
+z2.tmp: 1
+"z1.tmp z2.tmp": TEST 0
diff --git a/shell/hush_test/hush-redir/redir_space.tests b/shell/hush_test/hush-redir/redir_space.tests
new file mode 100755
index 000000000..c0b543098
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_space.tests
@@ -0,0 +1,6 @@
+v='z1.tmp z2.tmp'
+echo TEST >$v
+echo 'z1.tmp:' `cat 'z1.tmp' 2>/dev/null; echo $?`
+echo 'z2.tmp:' `cat 'z2.tmp' 2>/dev/null; echo $?`
+echo '"z1.tmp z2.tmp":' `cat 'z1.tmp z2.tmp' 2>/dev/null; echo $?`
+rm z*.tmp
diff --git a/shell/hush_test/hush-trap/catch.right b/shell/hush_test/hush-signals/catch.right
index 80a062c4b..80a062c4b 100644
--- a/shell/hush_test/hush-trap/catch.right
+++ b/shell/hush_test/hush-signals/catch.right
diff --git a/shell/hush_test/hush-trap/catch.tests b/shell/hush_test/hush-signals/catch.tests
index d2a21d17e..d2a21d17e 100755
--- a/shell/hush_test/hush-trap/catch.tests
+++ b/shell/hush_test/hush-signals/catch.tests
diff --git a/shell/hush_test/hush-signals/continue_and_trap1.right b/shell/hush_test/hush-signals/continue_and_trap1.right
new file mode 100644
index 000000000..d2dd0af72
--- /dev/null
+++ b/shell/hush_test/hush-signals/continue_and_trap1.right
@@ -0,0 +1 @@
+Exiting
diff --git a/shell/hush_test/hush-signals/continue_and_trap1.tests b/shell/hush_test/hush-signals/continue_and_trap1.tests
new file mode 100755
index 000000000..2a5c147b1
--- /dev/null
+++ b/shell/hush_test/hush-signals/continue_and_trap1.tests
@@ -0,0 +1,7 @@
+trap "echo Exiting; exit" INT
+(sleep 1; kill -s INT $$) &
+while continue; do
+        continue;
+done
diff --git a/shell/hush_test/hush-trap/exit.right b/shell/hush_test/hush-signals/exit.right
index 3d0072564..3d0072564 100644
--- a/shell/hush_test/hush-trap/exit.right
+++ b/shell/hush_test/hush-signals/exit.right
diff --git a/shell/hush_test/hush-trap/exit.tests b/shell/hush_test/hush-signals/exit.tests
index 2061105dd..2061105dd 100755
--- a/shell/hush_test/hush-trap/exit.tests
+++ b/shell/hush_test/hush-signals/exit.tests
diff --git a/shell/hush_test/hush-signals/reap1.right b/shell/hush_test/hush-signals/reap1.right
new file mode 100644
index 000000000..7326d9603
--- /dev/null
+++ b/shell/hush_test/hush-signals/reap1.right
@@ -0,0 +1 @@
+Ok
diff --git a/shell/hush_test/hush-signals/reap1.tests b/shell/hush_test/hush-signals/reap1.tests
new file mode 100755
index 000000000..bf1a1f908
--- /dev/null
+++ b/shell/hush_test/hush-signals/reap1.tests
@@ -0,0 +1,14 @@
+#!/bin/sh
+# Must not find us alive
+{ sleep 2; kill -9 $$; } 2>/dev/null &
+sleep 1 &
+PID=$!
+# We must exit the loop in one second.
+# We had bug 5304: builtins never waited for exited children
+while kill -0 $PID >/dev/null 2>&1; do
+    true
+done
+echo Ok
diff --git a/shell/hush_test/hush-signals/return_in_trap1.right b/shell/hush_test/hush-signals/return_in_trap1.right
new file mode 100644
index 000000000..a6e637885
--- /dev/null
+++ b/shell/hush_test/hush-signals/return_in_trap1.right
@@ -0,0 +1,4 @@
+a:2
+b:0
+Trap
+d:3
diff --git a/shell/hush_test/hush-signals/return_in_trap1.tests b/shell/hush_test/hush-signals/return_in_trap1.tests
new file mode 100755
index 000000000..f2498024f
--- /dev/null
+++ b/shell/hush_test/hush-signals/return_in_trap1.tests
@@ -0,0 +1,18 @@
+a() {
+        (exit 2)
+        echo a:$?
+        (kill -s USR1 $$; echo b:$?; exit 3)
+        echo c:$?       # does not execute
+        (exit 4)
+}
+trap "echo Trap; return" USR1
+a
+echo d:$?
+# It's debatable what is the correct value above.
+# Does 'return' in trap sees $? == 2 or $? == 3?
+# IOW: after (kill..), does shell first wait for its completion
+# and sets $?, then checks pending signals and runs a trap handler,
+# or does it first checks pending signals and runs handler?
+# hush does the former, and prints 3.
diff --git a/shell/hush_test/hush-signals/save-ret.right b/shell/hush_test/hush-signals/save-ret.right
new file mode 100644
index 000000000..a3e12ce5e
--- /dev/null
+++ b/shell/hush_test/hush-signals/save-ret.right
@@ -0,0 +1,2 @@
+YEAH
+0
diff --git a/shell/hush_test/hush-signals/save-ret.tests b/shell/hush_test/hush-signals/save-ret.tests
new file mode 100755
index 000000000..0786b6d96
--- /dev/null
+++ b/shell/hush_test/hush-signals/save-ret.tests
@@ -0,0 +1,4 @@
+# make sure we do not corrupt $? across traps
+trap "echo YEAH; false" USR1
+kill -USR1 $$
+echo $?
diff --git a/shell/hush_test/hush-trap/savetrap.right b/shell/hush_test/hush-signals/savetrap.right
index a59225be3..a59225be3 100644
--- a/shell/hush_test/hush-trap/savetrap.right
+++ b/shell/hush_test/hush-signals/savetrap.right
diff --git a/shell/hush_test/hush-trap/savetrap.tests b/shell/hush_test/hush-signals/savetrap.tests
index c2b312fb8..c2b312fb8 100755
--- a/shell/hush_test/hush-trap/savetrap.tests
+++ b/shell/hush_test/hush-signals/savetrap.tests
diff --git a/shell/hush_test/hush-signals/sigint1.right b/shell/hush_test/hush-signals/sigint1.right
new file mode 100644
index 000000000..a9094b056
--- /dev/null
+++ b/shell/hush_test/hush-signals/sigint1.right
@@ -0,0 +1 @@
+Sending SIGINT to main shell PID
diff --git a/shell/hush_test/hush-signals/sigint1.tests b/shell/hush_test/hush-signals/sigint1.tests
new file mode 100755
index 000000000..3d483d32a
--- /dev/null
+++ b/shell/hush_test/hush-signals/sigint1.tests
@@ -0,0 +1,41 @@
+# What should happen if non-interactive shell gets SIGINT?
+(sleep 1; echo Sending SIGINT to main shell PID; exec kill -INT $$) &
+# We create a child which exits with 0 even on SIGINT
+# (The complex command is necessary only if SIGINT is generated by ^C,
+# in this testcase even bare "sleep 2" would do because
+# in the testcase we don't send SIGINT *to the child*...)
+$THIS_SH -c 'trap "exit 0" SIGINT; sleep 2'
+# In one second, we (main shell) get SIGINT here.
+# The question is whether we should, or should not, exit.
+# bash will not stop here. It will execute next command(s).
+# The rationale for this is described here:
+# http://www.cons.org/cracauer/sigint.html
+#
+# Basically, bash will not exit on SIGINT immediately if it waits
+# for a child. It will wait for the child to exit.
+# If child exits NOT by dying on SIGINT, then bash will not exit.
+#
+# The idea is that the following script:
+# | emacs file.txt
+# | more cmds
+# User may use ^C to interrupt editor's ops like search. But then
+# emacs exits normally. User expects that script doesn't stop.
+#
+# This is a nice idea, but detecting "did process really exit
+# with SIGINT?" is racy. Consider:
+# | bash -c 'while true; do /bin/true; done'
+# When ^C is pressed while bash waits for /bin/true to exit,
+# it may happen that /bin/true exits with exitcode 0 before
+# ^C is delivered to it as SIGINT. bash will see SIGINT, then
+# it will see that child exited with 0, and bash will NOT EXIT.
+# Therefore we do not implement bash behavior.
+# I'd say that emacs need to put itself into a separate pgrp
+# to isolate shell from getting stray SIGINTs from ^C.
+echo Next command after SIGINT was executed
diff --git a/shell/hush_test/hush-signals/signal2.right b/shell/hush_test/hush-signals/signal2.right
new file mode 100644
index 000000000..a2af919c0
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal2.right
@@ -0,0 +1,3 @@
+child sleeps
+child exits as expected
+parent exits
diff --git a/shell/hush_test/hush-signals/signal2.tests b/shell/hush_test/hush-signals/signal2.tests
new file mode 100755
index 000000000..df639ca2c
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal2.tests
@@ -0,0 +1,18 @@
+#!/bin/sh
+$THIS_SH -c '
+cleanup() {
+    echo "child exits as expected"
+    exit
+}
+trap cleanup HUP
+echo "child sleeps"
+sleep 1
+echo "BAD exit from child!"
+' &
+child=$!
+sleep 0.1 # let child install handler first
+kill -HUP $child
+wait
+echo "parent exits"
diff --git a/shell/hush_test/hush-signals/signal3.right b/shell/hush_test/hush-signals/signal3.right
new file mode 100644
index 000000000..3113ba5cf
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal3.right
@@ -0,0 +1,4 @@
+child sleeps
+child got HUP
+child exits
+parent exits
diff --git a/shell/hush_test/hush-signals/signal3.tests b/shell/hush_test/hush-signals/signal3.tests
new file mode 100755
index 000000000..b56c2d97e
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal3.tests
@@ -0,0 +1,17 @@
+#!/bin/sh
+$THIS_SH -c '
+hup() {
+    echo "child got HUP"
+}
+trap hup HUP
+echo "child sleeps"
+sleep 1
+echo "child exits"
+' &
+child=$!
+sleep 0.1 # let child install handler first
+kill -HUP $child
+wait
+echo "parent exits"
diff --git a/shell/hush_test/hush-signals/signal5.right b/shell/hush_test/hush-signals/signal5.right
new file mode 100644
index 000000000..7cfd4110e
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal5.right
@@ -0,0 +1,12 @@
+Sleeping
+Sleeping
+Waiting
+2 sec passed, sending USR1 to parent
+USR1 received
+Wait exit code: 138
+Waiting
+3 sec passed, sending USR1 to parent
+USR1 received
+Wait exit code: 138
+Waiting
+Wait returned 0
diff --git a/shell/hush_test/hush-signals/signal5.tests b/shell/hush_test/hush-signals/signal5.tests
new file mode 100755
index 000000000..179bcdd80
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal5.tests
@@ -0,0 +1,14 @@
+trap "echo USR1 received" USR1
+stub() {
+    echo "Sleeping"
+    sleep $1
+    echo "$1 sec passed, sending USR1 to parent"
+    kill -USR1 $$
+}
+stub 3 &
+stub 2 &
+sleep 1
+until { echo "Waiting"; wait; } do
+    echo "Wait exit code: $?"
+done
+echo "Wait returned 0"
diff --git a/shell/hush_test/hush-signals/signal6.right b/shell/hush_test/hush-signals/signal6.right
new file mode 100644
index 000000000..df4d9306a
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal6.right
@@ -0,0 +1,2 @@
+got TERM
+Done: 0
diff --git a/shell/hush_test/hush-signals/signal6.tests b/shell/hush_test/hush-signals/signal6.tests
new file mode 100755
index 000000000..3ce151060
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal6.tests
@@ -0,0 +1,2 @@
+{ trap "echo got TERM" TERM; sleep 3; }& sleep 1; kill $!; wait
+echo Done: $?
diff --git a/shell/hush_test/hush-trap/signal7.right b/shell/hush_test/hush-signals/signal7.right
index ba7453e42..ba7453e42 100644
--- a/shell/hush_test/hush-trap/signal7.right
+++ b/shell/hush_test/hush-signals/signal7.right
diff --git a/shell/hush_test/hush-trap/signal7.tests b/shell/hush_test/hush-signals/signal7.tests
index c2b1381f9..c2b1381f9 100755
--- a/shell/hush_test/hush-trap/signal7.tests
+++ b/shell/hush_test/hush-signals/signal7.tests
diff --git a/shell/hush_test/hush-trap/signal_read1.right b/shell/hush_test/hush-signals/signal_read1.right
index 2870a8e70..2870a8e70 100644
--- a/shell/hush_test/hush-trap/signal_read1.right
+++ b/shell/hush_test/hush-signals/signal_read1.right
diff --git a/shell/hush_test/hush-trap/signal_read1.tests b/shell/hush_test/hush-signals/signal_read1.tests
index 1105479a3..1105479a3 100755
--- a/shell/hush_test/hush-trap/signal_read1.tests
+++ b/shell/hush_test/hush-signals/signal_read1.tests
diff --git a/shell/hush_test/hush-trap/signal_read2.right b/shell/hush_test/hush-signals/signal_read2.right
index 71a6bc16d..71a6bc16d 100644
--- a/shell/hush_test/hush-trap/signal_read2.right
+++ b/shell/hush_test/hush-signals/signal_read2.right
diff --git a/shell/hush_test/hush-trap/signal_read2.tests b/shell/hush_test/hush-signals/signal_read2.tests
index eab5b9b5b..eab5b9b5b 100755
--- a/shell/hush_test/hush-trap/signal_read2.tests
+++ b/shell/hush_test/hush-signals/signal_read2.tests
diff --git a/shell/hush_test/hush-signals/sigquit_exec.right b/shell/hush_test/hush-signals/sigquit_exec.right
new file mode 100644
index 000000000..a8041929a
--- /dev/null
+++ b/shell/hush_test/hush-signals/sigquit_exec.right
@@ -0,0 +1,2 @@
+SigIgn: 0000000000000000
+SigIgn: 0000000000000000
diff --git a/shell/hush_test/hush-signals/sigquit_exec.tests b/shell/hush_test/hush-signals/sigquit_exec.tests
new file mode 100755
index 000000000..24bda6921
--- /dev/null
+++ b/shell/hush_test/hush-signals/sigquit_exec.tests
@@ -0,0 +1,4 @@
+# Should show no masked signals in both cases.
+# We had a bug where SIGQUIT was masked on exec.
+grep SigIgn: /proc/self/status
+exec grep SigIgn: /proc/self/status
diff --git a/shell/hush_test/hush-trap/subshell.right b/shell/hush_test/hush-signals/subshell.right
index f865b932b..f865b932b 100644
--- a/shell/hush_test/hush-trap/subshell.right
+++ b/shell/hush_test/hush-signals/subshell.right
diff --git a/shell/hush_test/hush-trap/subshell.tests b/shell/hush_test/hush-signals/subshell.tests
index d877f2b82..d877f2b82 100755
--- a/shell/hush_test/hush-trap/subshell.tests
+++ b/shell/hush_test/hush-signals/subshell.tests
diff --git a/shell/hush_test/hush-trap/usage.right b/shell/hush_test/hush-signals/usage.right
index c0dbd6c3c..c0dbd6c3c 100644
--- a/shell/hush_test/hush-trap/usage.right
+++ b/shell/hush_test/hush-signals/usage.right
diff --git a/shell/hush_test/hush-trap/usage.tests b/shell/hush_test/hush-signals/usage.tests
index d29c6e74a..d29c6e74a 100755
--- a/shell/hush_test/hush-trap/usage.tests
+++ b/shell/hush_test/hush-signals/usage.tests
diff --git a/shell/hush_test/hush-standalone/noexec_gets_no_env.right b/shell/hush_test/hush-standalone/noexec_gets_no_env.right
new file mode 100644
index 000000000..8522dff31
--- /dev/null
+++ b/shell/hush_test/hush-standalone/noexec_gets_no_env.right
@@ -0,0 +1,4 @@
+VAR7=VAL
+0
+VAR8=VAL
+0
diff --git a/shell/hush_test/hush-standalone/noexec_gets_no_env.tests b/shell/hush_test/hush-standalone/noexec_gets_no_env.tests
new file mode 100755
index 000000000..0d347bdcd
--- /dev/null
+++ b/shell/hush_test/hush-standalone/noexec_gets_no_env.tests
@@ -0,0 +1,5 @@
+export VAR7=VAL
+env | grep ^VAR7=
+echo $?
+VAR8=VAL env | grep ^VAR8=
+echo $?
diff --git a/shell/hush_test/hush-standalone/nofork_trashes_getopt.right b/shell/hush_test/hush-standalone/nofork_trashes_getopt.right
new file mode 100644
index 000000000..573541ac9
--- /dev/null
+++ b/shell/hush_test/hush-standalone/nofork_trashes_getopt.right
@@ -0,0 +1 @@
+0
diff --git a/shell/hush_test/hush-standalone/nofork_trashes_getopt.tests b/shell/hush_test/hush-standalone/nofork_trashes_getopt.tests
new file mode 100755
index 000000000..f42c50730
--- /dev/null
+++ b/shell/hush_test/hush-standalone/nofork_trashes_getopt.tests
@@ -0,0 +1,6 @@
+# In this test, rm is NOFORK and it modifies getopt internal state
+rm -f non_existent_file
+# Subsequent hexdump is run as NOEXEC, and thus still uses this state
+hexdump </dev/null
+# Did hexdump segfault etc?
+echo $?
diff --git a/shell/hush_test/hush-standalone/var_standalone1.right b/shell/hush_test/hush-standalone/var_standalone1.right
new file mode 100644
index 000000000..37457fd74
--- /dev/null
+++ b/shell/hush_test/hush-standalone/var_standalone1.right
@@ -0,0 +1 @@
+Done: 1
diff --git a/shell/hush_test/hush-standalone/var_standalone1.tests b/shell/hush_test/hush-standalone/var_standalone1.tests
new file mode 100755
index 000000000..1e905ba75
--- /dev/null
+++ b/shell/hush_test/hush-standalone/var_standalone1.tests
@@ -0,0 +1,2 @@
+VAR=42 $THIS_SH -c 'unset VAR; env | grep ^VAR'
+echo Done: $?
diff --git a/shell/hush_test/hush-vars/var3.right b/shell/hush_test/hush-vars/var3.right
index 40e67fdf5..8eb0e3337 100644
--- a/shell/hush_test/hush-vars/var3.right
+++ b/shell/hush_test/hush-vars/var3.right
@@ -1,2 +1,5 @@
-hush: invalid number '1q'
+1
-hush: syntax error: unterminated ${name}
+1
+0
diff --git a/shell/hush_test/hush-vars/var3.tests b/shell/hush_test/hush-vars/var3.tests
index aea36d62d..97b102cbe 100755
--- a/shell/hush_test/hush-vars/var3.tests
+++ b/shell/hush_test/hush-vars/var3.tests
@@ -1,4 +1 @@
-# reject invalid vars
+x=0; f() { local x=1; echo $x; local x; echo $x; unset x; echo $x; local x; echo $x; }; f; echo $x
-"$THIS_SH" -c 'echo ${1q}'
-"$THIS_SH" -c 'echo ${&}'
-#"$THIS_SH" -c 'echo ${$}' -- this is valid as it's the same as $$
diff --git a/shell/hush_test/hush-vars/var4.right b/shell/hush_test/hush-vars/var4.right
new file mode 100644
index 000000000..8fed138eb
--- /dev/null
+++ b/shell/hush_test/hush-vars/var4.right
@@ -0,0 +1 @@
+bus/usb/1/2
diff --git a/shell/hush_test/hush-vars/var4.tests b/shell/hush_test/hush-vars/var4.tests
new file mode 100755
index 000000000..07feaeb8b
--- /dev/null
+++ b/shell/hush_test/hush-vars/var4.tests
@@ -0,0 +1 @@
+X=usbdev1.2 X=${X#usbdev} B=${X%%.*} D=${X#*.}; echo bus/usb/$B/$D
diff --git a/shell/hush_test/hush-vars/var5.right b/shell/hush_test/hush-vars/var5.right
new file mode 100644
index 000000000..2a01291bb
--- /dev/null
+++ b/shell/hush_test/hush-vars/var5.right
@@ -0,0 +1,6 @@
+a=a A=a
+a=a A=a
+a= A=
+a= A=
+a=a A=a
+a=a A=a
diff --git a/shell/hush_test/hush-vars/var5.tests b/shell/hush_test/hush-vars/var5.tests
new file mode 100755
index 000000000..802e489bd
--- /dev/null
+++ b/shell/hush_test/hush-vars/var5.tests
@@ -0,0 +1,14 @@
+# check that first assignment has proper effect on second one
+(
+a=a A=$a
+echo a=$a A=$A
+)
+(a=a A=$a; echo a=$a A=$A)
+(a=a A=$a echo a=$a A=$A)
+(a=a A=$a /bin/echo a=$a A=$A)
+f() { echo a=$a A=$A; }
+(a=a A=$a f)
+(a=a A=$a; f)
diff --git a/shell/hush_test/hush-vars/var6.right b/shell/hush_test/hush-vars/var6.right
new file mode 100644
index 000000000..40e67fdf5
--- /dev/null
+++ b/shell/hush_test/hush-vars/var6.right
@@ -0,0 +1,2 @@
+hush: invalid number '1q'
+hush: syntax error: unterminated ${name}
diff --git a/shell/hush_test/hush-vars/var6.tests b/shell/hush_test/hush-vars/var6.tests
new file mode 100755
index 000000000..aea36d62d
--- /dev/null
+++ b/shell/hush_test/hush-vars/var6.tests
@@ -0,0 +1,4 @@
+# reject invalid vars
+"$THIS_SH" -c 'echo ${1q}'
+"$THIS_SH" -c 'echo ${&}'
+#"$THIS_SH" -c 'echo ${$}' -- this is valid as it's the same as $$
diff --git a/shell/hush_test/hush-vars/var_unbackslash1.right b/shell/hush_test/hush-vars/var_unbackslash1.right
new file mode 100644
index 000000000..3e0c0e2af
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_unbackslash1.right
@@ -0,0 +1,7 @@
+Ok
+Ba d
+Ok
+Ok
+Ok
+Forty two:42
+Forty two:42
diff --git a/shell/hush_test/hush-vars/var_unbackslash1.tests b/shell/hush_test/hush-vars/var_unbackslash1.tests
new file mode 100755
index 000000000..a4665e423
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_unbackslash1.tests
@@ -0,0 +1,35 @@
+ad="Ok"
+a="Ba"
+# "Ok"
+echo $a\
+d
+# This variable contains backslash+newline!
+e='echo $a\
+d'
+# "Ba d"
+eval $e
+# "Ok"
+eval "$e"
+echo $\
+(echo Ok\
+)
+echo "$\
+(echo Ok\
+)"
+echo Forty two:$\
+(\
+(\
+42\
+)\
+)
+echo "Forty two:$\
+(\
+(\
+42\
+)\
+)"
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs1.right b/shell/hush_test/hush-vars/var_wordsplit_ifs1.right
new file mode 100644
index 000000000..cf583d0aa
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs1.right
@@ -0,0 +1,41 @@
+Testing: !IFS $*
+.abc.
+.d.
+.e.
+Testing: !IFS $@
+.abc.
+.d.
+.e.
+Testing: !IFS "$*"
+.abc d e.
+Testing: !IFS "$@"
+.abc.
+.d e.
+Testing: IFS="" $*
+.abc.
+.d e.
+Testing: IFS="" $@
+.abc.
+.d e.
+Testing: IFS="" "$*"
+.abcd e.
+Testing: IFS="" "$@"
+.abc.
+.d e.
+Testing: !IFS v=$*
+v='abc d e'
+Testing: !IFS v=$@
+v='abc d e'
+Testing: !IFS v="$*"
+v='abc d e'
+Testing: !IFS v="$@"
+v='abc d e'
+Testing: IFS="" v=$*
+v='abcd e'
+Testing: IFS="" v=$@
+v='abcd e'
+Testing: IFS="" v="$*"
+v='abcd e'
+Testing: IFS="" v="$@"
+v='abcd e'
+Finished
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs1.tests b/shell/hush_test/hush-vars/var_wordsplit_ifs1.tests
new file mode 100755
index 000000000..a62afc6fd
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs1.tests
@@ -0,0 +1,42 @@
+set -- abc "d e"
+echo 'Testing: !IFS $*'
+unset IFS; for a in $*; do echo ".$a."; done
+echo 'Testing: !IFS $@'
+unset IFS; for a in $@; do echo ".$a."; done
+echo 'Testing: !IFS "$*"'
+unset IFS; for a in "$*"; do echo ".$a."; done
+echo 'Testing: !IFS "$@"'
+unset IFS; for a in "$@"; do echo ".$a."; done
+echo 'Testing: IFS="" $*'
+IFS=""; for a in $*; do echo ".$a."; done
+echo 'Testing: IFS="" $@'
+IFS=""; for a in $@; do echo ".$a."; done
+echo 'Testing: IFS="" "$*"'
+IFS=""; for a in "$*"; do echo ".$a."; done
+echo 'Testing: IFS="" "$@"'
+IFS=""; for a in "$@"; do echo ".$a."; done
+echo 'Testing: !IFS v=$*'
+unset IFS; v=$*; echo "v='$v'"
+echo 'Testing: !IFS v=$@'
+unset IFS; v=$@; echo "v='$v'"
+echo 'Testing: !IFS v="$*"'
+unset IFS; v="$*"; echo "v='$v'"
+echo 'Testing: !IFS v="$@"'
+unset IFS; v="$@"; echo "v='$v'"
+echo 'Testing: IFS="" v=$*'
+IFS=""; v=$*; echo "v='$v'"
+echo 'Testing: IFS="" v=$@'
+IFS=""; v=$@; echo "v='$v'"
+echo 'Testing: IFS="" v="$*"'
+IFS=""; v="$*"; echo "v='$v'"
+echo 'Testing: IFS="" v="$@"'
+IFS=""; v="$@"; echo "v='$v'"
+# Note: in IFS="" v=$@ and IFS="" v="$@" cases, bash produces "abc d e"
+# We produce "abcd e"
+echo Finished
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs2.right b/shell/hush_test/hush-vars/var_wordsplit_ifs2.right
new file mode 100644
index 000000000..c234193fe
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs2.right
@@ -0,0 +1,3 @@
+Unquoted:<1>
+Unquoted:<3>
+Quoted:<123>
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs2.tests b/shell/hush_test/hush-vars/var_wordsplit_ifs2.tests
new file mode 100755
index 000000000..47523549c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs2.tests
@@ -0,0 +1,13 @@
+# 123 chars long
+a="\
+01234567890123456789\
+01234567890123456789\
+01234567890123456789\
+01234567890123456789\
+01234567890123456789\
+0123456789\
+0123456789\
+012"
+IFS=2; for v in ${#a}; do echo Unquoted:"<$v>"; done
+IFS=2; for v in "${#a}"; do echo Quoted:"<$v>"; done
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs3.right b/shell/hush_test/hush-vars/var_wordsplit_ifs3.right
new file mode 100644
index 000000000..5ab72e1cd
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs3.right
@@ -0,0 +1,12 @@
+Unquoted%:<q>
+Unquoted%:<w>
+Unquoted%:<e>
+Unquoted%:<r>
+Unquoted%:<t>
+Unquoted#:<w>
+Unquoted#:<e>
+Unquoted#:<r>
+Unquoted#:<t>
+Unquoted#:<y>
+Quoted%:<q w e r t >
+Quoted#:< w e r t y>
diff --git a/shell/hush_test/hush-vars/var_wordsplit_ifs3.tests b/shell/hush_test/hush-vars/var_wordsplit_ifs3.tests
new file mode 100755
index 000000000..4aa65574a
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_wordsplit_ifs3.tests
@@ -0,0 +1,5 @@
+a="q w e r t y"
+for v in ${a%y}; do echo Unquoted%:"<$v>"; done
+for v in ${a#q}; do echo Unquoted#:"<$v>"; done
+for v in "${a%y}"; do echo Quoted%:"<$v>"; done
+for v in "${a#q}"; do echo Quoted#:"<$v>"; done
diff --git a/shell/hush_test/run-all b/shell/hush_test/run-all
index 64a7abc47..837b3f7da 100755
--- a/shell/hush_test/run-all
+++ b/shell/hush_test/run-all
@@ -64,11 +64,12 @@ do_test()
        echo -n "$1/$x:"
        (
                "$THIS_SH" "./$x" >"$name.xx" 2>&1
+                r=$?
                # filter C library differences
                sed -i \
                        -e "/: invalid option /s:'::g" \
                        "$name.xx"
-                test $? -eq 77 && rm -f "../$1-$x.fail" && exit 77
+                test $r -eq 77 && rm -f "../$1-$x.fail" && exit 77
                diff -u "$name.xx" "$name.right" >"../$1-$x.fail" && rm -f "$name.xx" "../$1-$x.fail"
        )
        case $? in
diff --git a/shell/msh_test/msh-bugs/noeol3.right b/shell/msh_test/msh-bugs/noeol3.right
deleted file mode 100644
index 56f8515b7..000000000
--- a/shell/msh_test/msh-bugs/noeol3.right
+++ /dev/null
@@ -1 +0,0 @@
-hush: syntax error: unterminated "
diff --git a/shell/msh_test/msh-bugs/noeol3.tests b/shell/msh_test/msh-bugs/noeol3.tests
deleted file mode 100755
index ec958ed7a..000000000
--- a/shell/msh_test/msh-bugs/noeol3.tests
+++ /dev/null
@@ -1,2 +0,0 @@
-# last line has no EOL!
-echo "unterminated
-\ No newline at end of file
diff --git a/shell/msh_test/msh-bugs/process_subst.right b/shell/msh_test/msh-bugs/process_subst.right
deleted file mode 100644
index 397bc8067..000000000
--- a/shell/msh_test/msh-bugs/process_subst.right
+++ /dev/null
@@ -1,3 +0,0 @@
-TESTzzBEST
-TEST$(echo zz)BEST
-TEST'BEST
diff --git a/shell/msh_test/msh-bugs/process_subst.tests b/shell/msh_test/msh-bugs/process_subst.tests
deleted file mode 100755
index 21996bc0e..000000000
--- a/shell/msh_test/msh-bugs/process_subst.tests
+++ /dev/null
@@ -1,3 +0,0 @@
-echo "TEST`echo zz;echo;echo`BEST"
-echo "TEST`echo '$(echo zz)'`BEST"
-echo "TEST`echo "'"`BEST"
diff --git a/shell/msh_test/msh-bugs/starquoted.right b/shell/msh_test/msh-bugs/starquoted.right
deleted file mode 100644
index b56323fe1..000000000
--- a/shell/msh_test/msh-bugs/starquoted.right
+++ /dev/null
@@ -1,8 +0,0 @@
-.1 abc d e f.
-.1.
-.abc.
-.d e f.
-.-1 abc d e f-.
-.-1.
-.abc.
-.d e f-.
diff --git a/shell/msh_test/msh-bugs/starquoted.tests b/shell/msh_test/msh-bugs/starquoted.tests
deleted file mode 100755
index 2fe49b1cd..000000000
--- a/shell/msh_test/msh-bugs/starquoted.tests
+++ /dev/null
@@ -1,8 +0,0 @@
-if test $# = 0; then
-    exec "$THIS_SH" "$0" 1 abc 'd e f'
-fi
-for a in "$*"; do echo ".$a."; done
-for a in "$@"; do echo ".$a."; done
-for a in "-$*-"; do echo ".$a."; done
-for a in "-$@-"; do echo ".$a."; done
diff --git a/shell/msh_test/msh-bugs/syntax_err.right b/shell/msh_test/msh-bugs/syntax_err.right
deleted file mode 100644
index 08a270c31..000000000
--- a/shell/msh_test/msh-bugs/syntax_err.right
+++ /dev/null
@@ -1,2 +0,0 @@
-shown
-hush: syntax error: unterminated '
diff --git a/shell/msh_test/msh-bugs/syntax_err.tests b/shell/msh_test/msh-bugs/syntax_err.tests
deleted file mode 100755
index d10ed42e9..000000000
--- a/shell/msh_test/msh-bugs/syntax_err.tests
+++ /dev/null
@@ -1,3 +0,0 @@
-echo shown
-echo test `echo 'aa`
-echo not shown
diff --git a/shell/msh_test/msh-execution/exitcode_EACCES.right b/shell/msh_test/msh-execution/exitcode_EACCES.right
deleted file mode 100644
index 6e5480b9d..000000000
--- a/shell/msh_test/msh-execution/exitcode_EACCES.right
+++ /dev/null
@@ -1,2 +0,0 @@
-./: can't execute
-126
diff --git a/shell/msh_test/msh-execution/exitcode_ENOENT.right b/shell/msh_test/msh-execution/exitcode_ENOENT.right
deleted file mode 100644
index dd49d2c0c..000000000
--- a/shell/msh_test/msh-execution/exitcode_ENOENT.right
+++ /dev/null
@@ -1,2 +0,0 @@
-./does_not_exist_for_sure: not found
-127
diff --git a/shell/msh_test/msh-execution/many_continues.tests b/shell/msh_test/msh-execution/many_continues.tests
deleted file mode 100755
index 86c729abc..000000000
--- a/shell/msh_test/msh-execution/many_continues.tests
+++ /dev/null
@@ -1,15 +0,0 @@
-if test $# = 0; then
-    # Child will kill us in 1 second
-    "$THIS_SH" "$0" $$ &
-    # Loop many, many times
-    trap 'echo OK; exit 0' 15
-    while true; do
-        continue
-    done
-    echo BAD
-    exit 1
-fi
-sleep 1
-kill $1
diff --git a/shell/msh_test/msh-execution/nested_break.right b/shell/msh_test/msh-execution/nested_break.right
deleted file mode 100644
index 4e8b6b0f2..000000000
--- a/shell/msh_test/msh-execution/nested_break.right
+++ /dev/null
@@ -1,8 +0,0 @@
-A
-B
-iteration
-C
-A
-B
-iteration
-D
diff --git a/shell/msh_test/msh-execution/nested_break.tests b/shell/msh_test/msh-execution/nested_break.tests
deleted file mode 100755
index 1a954d227..000000000
--- a/shell/msh_test/msh-execution/nested_break.tests
+++ /dev/null
@@ -1,17 +0,0 @@
-# Testcase for http://bugs.busybox.net/view.php?id=846
-n=0
-while :
-do
-        echo A
-        while :
-        do
-                echo B
-                break
-        done
-        echo iteration
-        [ $n = 1 ] && break
-        echo C
-        n=`expr $n + 1`
-done
-echo D
diff --git a/shell/msh_test/msh-misc/tick.tests b/shell/msh_test/msh-misc/tick.tests
deleted file mode 100755
index 1f749a9cd..000000000
--- a/shell/msh_test/msh-misc/tick.tests
+++ /dev/null
@@ -1,4 +0,0 @@
-true
-false; echo `echo $?`
-true
-{ false; echo `echo $?`; }
diff --git a/shell/msh_test/msh-parsing/argv0.tests b/shell/msh_test/msh-parsing/argv0.tests
deleted file mode 100755
index f5c40f6fe..000000000
--- a/shell/msh_test/msh-parsing/argv0.tests
+++ /dev/null
@@ -1,4 +0,0 @@
-if test $# = 0; then
-    exec "$THIS_SH" "$0" arg
-fi
-echo OK
diff --git a/shell/msh_test/msh-parsing/noeol.right b/shell/msh_test/msh-parsing/noeol.right
deleted file mode 100644
index e427984d4..000000000
--- a/shell/msh_test/msh-parsing/noeol.right
+++ /dev/null
@@ -1 +0,0 @@
-HELLO
diff --git a/shell/msh_test/msh-parsing/noeol.tests b/shell/msh_test/msh-parsing/noeol.tests
deleted file mode 100755
index a93113a03..000000000
--- a/shell/msh_test/msh-parsing/noeol.tests
+++ /dev/null
@@ -1,2 +0,0 @@
-# next line has no EOL!
-echo HELLO
-\ No newline at end of file
diff --git a/shell/msh_test/msh-parsing/noeol2.right b/shell/msh_test/msh-parsing/noeol2.right
deleted file mode 100644
index d00491fd7..000000000
--- a/shell/msh_test/msh-parsing/noeol2.right
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/shell/msh_test/msh-parsing/noeol2.tests b/shell/msh_test/msh-parsing/noeol2.tests
deleted file mode 100755
index 1220f056f..000000000
--- a/shell/msh_test/msh-parsing/noeol2.tests
+++ /dev/null
@@ -1,7 +0,0 @@
-# last line has no EOL!
-if true
-then
-  echo 1
-else
-  echo 2
-fi
-\ No newline at end of file
diff --git a/shell/msh_test/msh-parsing/quote1.right b/shell/msh_test/msh-parsing/quote1.right
deleted file mode 100644
index cb382054c..000000000
--- a/shell/msh_test/msh-parsing/quote1.right
+++ /dev/null
@@ -1 +0,0 @@
-'1'
diff --git a/shell/msh_test/msh-parsing/quote1.tests b/shell/msh_test/msh-parsing/quote1.tests
deleted file mode 100755
index f55895466..000000000
--- a/shell/msh_test/msh-parsing/quote1.tests
+++ /dev/null
@@ -1,2 +0,0 @@
-a=1
-echo "'$a'"
diff --git a/shell/msh_test/msh-parsing/quote2.right b/shell/msh_test/msh-parsing/quote2.right
deleted file mode 100644
index 3bc9edcd6..000000000
--- a/shell/msh_test/msh-parsing/quote2.right
+++ /dev/null
@@ -1 +0,0 @@
->1
diff --git a/shell/msh_test/msh-parsing/quote2.tests b/shell/msh_test/msh-parsing/quote2.tests
deleted file mode 100755
index bd966f30b..000000000
--- a/shell/msh_test/msh-parsing/quote2.tests
+++ /dev/null
@@ -1,2 +0,0 @@
-a=1
-echo ">$a"
diff --git a/shell/msh_test/msh-parsing/quote3.right b/shell/msh_test/msh-parsing/quote3.right
deleted file mode 100644
index 069a46e8f..000000000
--- a/shell/msh_test/msh-parsing/quote3.right
+++ /dev/null
@@ -1,3 +0,0 @@
-Testing: in $empty""
-..
-Finished
diff --git a/shell/msh_test/msh-parsing/quote3.tests b/shell/msh_test/msh-parsing/quote3.tests
deleted file mode 100755
index 075e78570..000000000
--- a/shell/msh_test/msh-parsing/quote3.tests
+++ /dev/null
@@ -1,8 +0,0 @@
-if test $# = 0; then
-    exec "$THIS_SH" quote3.tests abc "d e"
-fi
-echo 'Testing: in $empty""'
-empty=''
-for a in $empty""; do echo ".$a."; done
-echo Finished
diff --git a/shell/msh_test/msh-parsing/quote4.right b/shell/msh_test/msh-parsing/quote4.right
deleted file mode 100644
index b2901ea97..000000000
--- a/shell/msh_test/msh-parsing/quote4.right
+++ /dev/null
@@ -1 +0,0 @@
-a b
diff --git a/shell/msh_test/msh-parsing/quote4.tests b/shell/msh_test/msh-parsing/quote4.tests
deleted file mode 100755
index f1dabfa54..000000000
--- a/shell/msh_test/msh-parsing/quote4.tests
+++ /dev/null
@@ -1,2 +0,0 @@
-a_b='a b'
-echo "$a_b"
diff --git a/shell/msh_test/msh-vars/var.right b/shell/msh_test/msh-vars/var.right
deleted file mode 100644
index 14b2314d9..000000000
--- a/shell/msh_test/msh-vars/var.right
+++ /dev/null
@@ -1,4 +0,0 @@
-http://busybox.net
-http://busybox.net_abc
-1
-1
diff --git a/shell/msh_test/msh-vars/var.tests b/shell/msh_test/msh-vars/var.tests
deleted file mode 100755
index 0a63696c9..000000000
--- a/shell/msh_test/msh-vars/var.tests
+++ /dev/null
@@ -1,9 +0,0 @@
-URL=http://busybox.net
-echo $URL
-echo ${URL}_abc
-true
-false; echo $?
-true
-{ false; echo $?; }
diff --git a/shell/msh_test/run-all b/shell/msh_test/run-all
deleted file mode 100755
index 29f62a5e2..000000000
--- a/shell/msh_test/run-all
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/sh
-test -x msh || {
-    echo "No ./msh - creating a link to ../../busybox"
-    ln -s ../../busybox msh
-}
-PATH="$PWD:$PATH" # for msh
-export PATH
-THIS_SH="$PWD/msh"
-export THIS_SH
-do_test()
-{
-    test -d "$1" || return 0
-#   echo Running tests in directory "$1"
-    (
-    cd "$1" || { echo "cannot cd $1!"; exit 1; }
-    for x in run-*; do
-        test -f "$x" || continue
-        case "$x" in
-            "$0"|run-minimal|run-gprof) ;;
-            *.orig|*~) ;;
-            #*) echo $x ; sh $x ;;
-            *)
-            sh "$x" >"../$1-$x.fail" 2>&1 && \
-            { echo "$1/$x: ok"; rm "../$1-$x.fail"; } || echo "$1/$x: fail";
-            ;;
-        esac
-    done
-    # Many bash run-XXX scripts just do this,
-    # no point in duplication it all over the place
-    for x in *.tests; do
-        test -x "$x" || continue
-        name="${x%%.tests}"
-        test -f "$name.right" || continue
-#       echo Running test: "$name.right"
-        {
-            "$THIS_SH" "./$x" >"$name.xx" 2>&1
-            diff -u "$name.xx" "$name.right" >"../$1-$x.fail" && rm -f "$name.xx" "../$1-$x.fail"
-        } && echo "$1/$x: ok" || echo "$1/$x: fail"
-    done
-    )
-}
-# Main part of this script
-# Usage: run-all [directories]
-if [ $# -lt 1 ]; then
-    # All sub directories
-    modules=`ls -d msh-*`
-    for module in $modules; do
-        do_test $module
-    done
-else
-    while [ $# -ge 1 ]; do
-        if [ -d $1 ]; then
-            do_test $1
-        fi
-        shift
-    done
-fi
diff --git a/shell/shell_common.c b/shell/shell_common.c
index c3bff477d..5a5b1780d 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -25,6 +25,7 @@ const char defifsvar[] ALIGN1 = "IFS= \t\n";
 #else
 const char defifsvar[] ALIGN1 = "IFS= \t\n\r";
 #endif
+const char defoptindvar[] ALIGN1 = "OPTIND=1";
 int FAST_FUNC is_well_formed_var_name(const char *s, char terminator)
diff --git a/shell/shell_common.h b/shell/shell_common.h
index 993ed5951..a82535c86 100644
--- a/shell/shell_common.h
+++ b/shell/shell_common.h
@@ -24,6 +24,8 @@ PUSH_AND_SET_FUNCTION_VISIBILITY_TO_HIDDEN
 extern const char defifsvar[] ALIGN1; /* "IFS= \t\n" */
 #define defifs (defifsvar + 4)
+extern const char defoptindvar[] ALIGN1; /* "OPTIND=1" */
 int FAST_FUNC is_well_formed_var_name(const char *s, char terminator);
 /* Builtins */
diff --git a/testsuite/gzip/gzip-compression-levels b/testsuite/gzip/gzip-compression-levels
new file mode 100644
index 000000000..6d9a13d08
--- /dev/null
+++ b/testsuite/gzip/gzip-compression-levels
@@ -0,0 +1,5 @@
+# FEATURE: CONFIG_FEATURE_GZIP_LEVELS
+level1=$(busybox gzip -c -1 $(which busybox) | wc -c)
+level9=$(busybox gzip -c -9 $(which busybox) | wc -c)
+test $level1 -gt $level9
diff --git a/testsuite/md5sum.tests b/testsuite/md5sum.tests
index 6c75b6d1c..cca26dc64 100755
--- a/testsuite/md5sum.tests
+++ b/testsuite/md5sum.tests
@@ -23,6 +23,8 @@ test -f "$bindir/.config" && . "$bindir/.config"
 test x"$CONFIG_FEATURE_FANCY_HEAD" != x"y" \
 && { echo "SKIPPED: $sum"; exit 0; }
+FAILCOUNT=0
 text="The quick brown fox jumps over the lazy dog"
 text=`yes "$text" | head -c 9999`
@@ -33,11 +35,21 @@ while test $n -le 999; do
        n=$(($n+1))
 done | "$sum"
 )`
+if test x"$result" != x"$expected  -"; then
-if test x"$result" = x"$expected  -"; then
+        echo "FAIL: $sum (r:$result exp:$expected)"
+        : $((FAILCOUNT++))
+else
        echo "PASS: $sum"
-        exit 0
 fi
-echo "FAIL: $sum (r:$result exp:$expected)"
+# GNU compat: -c EMPTY must fail (exitcode 1)!
-exit 1
+>EMPTY
+if "$sum" -c EMPTY 2>/dev/null; then
+        echo "FAIL: $sum -c EMPTY"
+        : $((FAILCOUNT++))
+else
+        echo "PASS: $sum -c EMPTY"
+fi
+rm EMPTY
+exit $FAILCOUNT
diff --git a/testsuite/sed.tests b/testsuite/sed.tests
index a71f8b1f0..05c00a99b 100755
--- a/testsuite/sed.tests
+++ b/testsuite/sed.tests
@@ -73,13 +73,9 @@ testing "sed t (test/branch clears test bit)" "sed -e 's/a/b/;:loop;t loop'" \
 testing "sed T (!test/branch)" "sed -e 's/a/1/;T notone;p;: notone;p'" \
        "1\n1\n1\nb\nb\nc\nc\n" "" "a\nb\nc\n"
-test x"$SKIP_KNOWN_BUGS" = x"" && {
-# Normal sed end-of-script doesn't print "c" because n flushed the pattern
-# space.  If n hits EOF, pattern space is empty when script ends.
-# Query: how does this interact with no newline at EOF?
 testing "sed n (flushes pattern space, terminates early)" "sed -e 'n;p'" \
        "a\nb\nb\nc\n" "" "a\nb\nc\n"
-}
 # non-GNU sed: N does _not_ flush pattern space, therefore c is eaten @ script end
 # GNU sed: N flushes pattern space, therefore c is printed too @ script end
 testing "sed N (flushes pattern space (GNU behavior))" "sed -e 'N;p'" \
diff --git a/testsuite/sha3sum.tests b/testsuite/sha3sum.tests
index 82fada633..2cd8e3bf2 100755
--- a/testsuite/sha3sum.tests
+++ b/testsuite/sha3sum.tests
@@ -1,3 +1,3 @@
 #!/bin/sh
-. ./md5sum.tests sha3sum c29d77bc548fa2b20a04c861400a5360879c52156e2a54a3415b99a9a3123e1d5f36714a24eca8c1f05a8e2d8ba859c930d41141f64a255c6794436fc99c486a
+. ./md5sum.tests sha3sum 11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9
diff --git a/util-linux/fdisk.c b/util-linux/fdisk.c
index 6391f9bd9..32a66d03d 100644
--- a/util-linux/fdisk.c
+++ b/util-linux/fdisk.c
@@ -363,7 +363,6 @@ struct globals {
        jmp_buf listingbuf;
        char line_buffer[80];
-        char partname_buffer[80];
        /* Raw disk label. For DOS-type partition tables the MBR,
         * with descriptions of the primary partitions. */
        char MBRbuffer[MAX_SECTOR_SIZE];
@@ -399,7 +398,6 @@ struct globals {
 #define total_number_of_sectors (G.total_number_of_sectors)
 #define listingbuf      (G.listingbuf     )
 #define line_buffer     (G.line_buffer    )
-#define partname_buffer (G.partname_buffer)
 #define MBRbuffer       (G.MBRbuffer      )
 #define ptes            (G.ptes           )
 #define INIT_G() do { \
@@ -468,9 +466,6 @@ static sector_t bb_BLKGETSIZE_sectors(int fd)
 #define cylinder(s, c)  ((c) | (((s) & 0xc0) << 2))
-#define hsc2sector(h,s,c) \
-        (sector(s) - 1 + sectors * ((h) + heads * cylinder(s,c)))
 static void
 close_dev_fd(void)
 {
@@ -478,9 +473,7 @@ close_dev_fd(void)
        xmove_fd(xopen(bb_dev_null, O_RDONLY), dev_fd);
 }
-/*
+/* Return partition name */
- * Return partition name - uses static storage
- */
 static const char *
 partname(const char *dev, int pno, int lth)
 {
@@ -489,8 +482,8 @@ partname(const char *dev, int pno, int lth)
        int bufsiz;
        char *bufp;
-        bufp = partname_buffer;
+        bufp = auto_string(xzalloc(80));
-        bufsiz = sizeof(partname_buffer);
+        bufsiz = 80;
        w = strlen(dev);
        p = "";
@@ -1898,14 +1891,14 @@ check_consistency(const struct partition *p, int partition)
                return;         /* do not check extended partitions */
 /* physical beginning c, h, s */
-        pbc = (p->cyl & 0xff) | ((p->sector << 2) & 0x300);
+        pbc = cylinder(p->sector, p->cyl);
        pbh = p->head;
-        pbs = p->sector & 0x3f;
+        pbs = sector(p->sector);
 /* physical ending c, h, s */
-        pec = (p->end_cyl & 0xff) | ((p->end_sector << 2) & 0x300);
+        pec = cylinder(p->end_sector, p->end_cyl);
        peh = p->end_head;
-        pes = p->end_sector & 0x3f;
+        pes = sector(p->end_sector);
 /* compute logical beginning (c, h, s) */
        linear2chs(get_start_sect(p), &lbc, &lbh, &lbs);
@@ -1916,17 +1909,17 @@ check_consistency(const struct partition *p, int partition)
 /* Same physical / logical beginning? */
        if (g_cylinders <= 1024 && (pbc != lbc || pbh != lbh || pbs != lbs)) {
                printf("Partition %u has different physical/logical "
-                        "beginnings (non-Linux?):\n", partition + 1);
+                        "start (non-Linux?):\n", partition + 1);
-                printf("     phys=(%u, %u, %u) ", pbc, pbh, pbs);
+                printf("     phys=(%u,%u,%u) ", pbc, pbh, pbs);
-                printf("logical=(%u, %u, %u)\n", lbc, lbh, lbs);
+                printf("logical=(%u,%u,%u)\n", lbc, lbh, lbs);
        }
 /* Same physical / logical ending? */
        if (g_cylinders <= 1024 && (pec != lec || peh != leh || pes != les)) {
                printf("Partition %u has different physical/logical "
-                        "endings:\n", partition + 1);
+                        "end:\n", partition + 1);
-                printf("     phys=(%u, %u, %u) ", pec, peh, pes);
+                printf("     phys=(%u,%u,%u) ", pec, peh, pes);
-                printf("logical=(%u, %u, %u)\n", lec, leh, les);
+                printf("logical=(%u,%u,%u)\n", lec, leh, les);
        }
 /* Ending on cylinder boundary? */
@@ -1940,22 +1933,23 @@ static void
 list_disk_geometry(void)
 {
        ullong bytes = ((ullong)total_number_of_sectors << 9);
-        long megabytes = bytes / 1000000;
+        ullong xbytes = bytes / (1024*1024);
+        char x = 'M';
-        if (megabytes < 10000)
-                printf("\nDisk %s: %lu MB, %llu bytes\n",
+        if (xbytes >= 10000) {
-                        disk_device, megabytes, bytes);
+                xbytes += 512; /* fdisk util-linux 2.28 does this */
-        else
+                xbytes /= 1024;
-                printf("\nDisk %s: %lu.%lu GB, %llu bytes\n",
+                x = 'G';
-                        disk_device, megabytes/1000, (megabytes/100)%10, bytes);
+        }
-        printf("%u heads, %u sectors/track, %u cylinders",
+        printf("Disk %s: %llu %cB, %llu bytes, %"SECT_FMT"u sectors\n"
-                   g_heads, g_sectors, g_cylinders);
+                "%u cylinders, %u heads, %u sectors/track\n"
-        if (units_per_sector == 1)
+                "Units: %s of %u * %u = %u bytes\n\n",
-                printf(", total %"SECT_FMT"u sectors",
+                disk_device, xbytes, x,
-                        total_number_of_sectors / (sector_size/512));
+                bytes, total_number_of_sectors,
-        printf("\nUnits = %s of %u * %u = %u bytes\n\n",
+                g_cylinders, g_heads, g_sectors,
                str_units(PLURAL),
-                units_per_sector, sector_size, units_per_sector * sector_size);
+                units_per_sector, sector_size, units_per_sector * sector_size
+        );
 }
 /*
@@ -2099,10 +2093,17 @@ fix_partition_table_order(void)
 }
 #endif
+static const char *
+chs_string11(unsigned cyl, unsigned head, unsigned sect)
+{
+        char *buf = auto_string(xzalloc(sizeof(int)*3 * 3));
+        sprintf(buf, "%u,%u,%u", cylinder(sect,cyl), head, sector(sect));
+        return buf;
+}
 static void
 list_table(int xtra)
 {
-        const struct partition *p;
        int i, w;
        if (LABEL_IS_SUN) {
@@ -2126,50 +2127,62 @@ list_table(int xtra)
        }
        /* Heuristic: we list partition 3 of /dev/foo as /dev/foo3,
-           but if the device name ends in a digit, say /dev/foo1,
+         * but if the device name ends in a digit, say /dev/foo1,
-           then the partition is called /dev/foo1p3. */
+         * then the partition is called /dev/foo1p3.
+         */
        w = strlen(disk_device);
        if (w && isdigit(disk_device[w-1]))
                w++;
-        if (w < 5)
+        if (w < 7)
-                w = 5;
+                w = 7;
-        //            1 12345678901 12345678901 12345678901  12
+        printf("%-*s Boot StartCHS    EndCHS        StartLBA     EndLBA    Sectors  Size Id Type\n",
-        printf("%*s Boot      Start         End      Blocks  Id System\n",
+                   w-1, "Device");
-                   w+1, "Device");
        for (i = 0; i < g_partitions; i++) {
+                const struct partition *p;
                const struct pte *pe = &ptes[i];
-                sector_t psects;
+                char boot4[4];
-                sector_t pblocks;
+                char numstr6[6];
-                unsigned podd;
+                sector_t start_sect;
+                sector_t end_sect;
+                sector_t nr_sects;
                p = pe->part_table;
                if (!p || is_cleared_partition(p))
                        continue;
-                psects = get_nr_sects(p);
+                sprintf(boot4, "%02x", p->boot_ind);
-                pblocks = psects;
+                if ((p->boot_ind & 0x7f) == 0) {
-                podd = 0;
+                        /* 0x80 shown as '*', 0x00 is ' ' */
+                        boot4[0] = p->boot_ind ? '*' : ' ';
-                if (sector_size < 1024) {
+                        boot4[1] = ' ';
-                        pblocks /= (1024 / sector_size);
-                        podd = psects % (1024 / sector_size);
                }
-                if (sector_size > 1024)
-                        pblocks *= (sector_size / 1024);
-                printf("%s  %c %11"SECT_FMT"u %11"SECT_FMT"u %11"SECT_FMT"u%c %2x %s\n",
+                start_sect = get_partition_start_from_dev_start(pe);
-                        partname(disk_device, i+1, w+2),
+                end_sect = start_sect;
-                        !p->boot_ind ? ' ' : p->boot_ind == ACTIVE_FLAG /* boot flag */
+                nr_sects = get_nr_sects(p);
-                                ? '*' : '?',
+                if (nr_sects != 0)
-                        cround(get_partition_start_from_dev_start(pe)),           /* start */
+                        end_sect += nr_sects - 1;
-                        cround(get_partition_start_from_dev_start(pe) + psects    /* end */
-                                - (psects ? 1 : 0)),
+                smart_ulltoa5((ullong)nr_sects * sector_size,
-                        pblocks, podd ? '+' : ' ', /* odd flag on end */
+                        numstr6, " KMGTPEZY")[0] = '\0';
-                        p->sys_ind,                                     /* type id */
-                        partition_type(p->sys_ind));                    /* type name */
+#define SFMT SECT_FMT
+                //      Boot StartCHS    EndCHS        StartLBA     EndLBA    Sectors  Size Id Type
+                printf("%s%s %-11s"/**/" %-11s"/**/" %10"SFMT"u %10"SFMT"u %10"SFMT"u %s %2x %s\n",
+                        partname(disk_device, i+1, w+2),
+                        boot4,
+                        chs_string11(p->cyl, p->head, p->sector),
+                        chs_string11(p->end_cyl, p->end_head, p->end_sector),
+                        start_sect,
+                        end_sect,
+                        nr_sects,
+                        numstr6,
+                        p->sys_ind,
+                        partition_type(p->sys_ind)
+                );
+#undef SFMT
                check_consistency(p, i);
        }
@@ -2198,13 +2211,17 @@ x_list_table(int extend)
                p = (extend ? pe->ext_pointer : pe->part_table);
                if (p != NULL) {
                        printf("%2u %02x%4u%4u%5u%4u%4u%5u%11"SECT_FMT"u%11"SECT_FMT"u %02x\n",
-                                i + 1, p->boot_ind, p->head,
+                                i + 1, p->boot_ind,
+                                p->head,
                                sector(p->sector),
-                                cylinder(p->sector, p->cyl), p->end_head,
+                                cylinder(p->sector, p->cyl),
+                                p->end_head,
                                sector(p->end_sector),
                                cylinder(p->end_sector, p->end_cyl),
-                                get_start_sect(p), get_nr_sects(p),
+                                get_start_sect(p),
-                                p->sys_ind);
+                                get_nr_sects(p),
+                                p->sys_ind
+                        );
                        if (p->sys_ind)
                                check_consistency(p, i);
                }
@@ -2261,6 +2278,7 @@ verify(void)
 {
        int i, j;
        sector_t total = 1;
+        sector_t chs_size;
        sector_t first[g_partitions], last[g_partitions];
        struct partition *p;
@@ -2322,11 +2340,14 @@ verify(void)
                }
        }
-        if (total > g_heads * g_sectors * g_cylinders)
+        chs_size = (sector_t)g_heads * g_sectors * g_cylinders;
-                printf("Total allocated sectors %u greater than the maximum "
+        if (total > chs_size)
-                        "%u\n", total, g_heads * g_sectors * g_cylinders);
+                printf("Total allocated sectors %u"
+                        " greater than CHS size %"SECT_FMT"u\n",
+                        total, chs_size
+                );
        else {
-                total = g_heads * g_sectors * g_cylinders - total;
+                total = chs_size - total;
                if (total != 0)
                        printf("%"SECT_FMT"u unallocated sectors\n", total);
        }
diff --git a/util-linux/mdev.c b/util-linux/mdev.c
index 37514eb54..a59115dd4 100644
--- a/util-linux/mdev.c
+++ b/util-linux/mdev.c
@@ -543,8 +543,7 @@ static char *build_alias(char *alias, const char *device_name)
 /* mknod in /dev based on a path like "/sys/block/hda/hda1"
 * NB1: path parameter needs to have SCRATCH_SIZE scratch bytes
- * after NUL, but we promise to not mangle (IOW: to restore NUL if needed)
+ * after NUL, but we promise to not mangle it (IOW: to restore NUL if needed).
- * path string.
 * NB2: "mdev -s" may call us many times, do not leak memory/fds!
 *
 * device_name = $DEVNAME (may be NULL)
@@ -810,41 +809,39 @@ static void make_device(char *device_name, char *path, int operation)
        } /* for (;;) */
 }
-/* File callback for /sys/ traversal */
+/* File callback for /sys/ traversal.
+ * We act only on "/sys/.../dev" (pseudo)file
+ */
 static int FAST_FUNC fileAction(const char *fileName,
                struct stat *statbuf UNUSED_PARAM,
                void *userData,
                int depth UNUSED_PARAM)
 {
        size_t len = strlen(fileName) - 4; /* can't underflow */
-        char *scratch = userData;
+        char *path = userData;  /* char array[PATH_MAX + SCRATCH_SIZE] */
+        char subsys[PATH_MAX];
-        /* len check is for paranoid reasons */
+        int res;
-        if (strcmp(fileName + len, "/dev") != 0 || len >= PATH_MAX)
-                return FALSE;
+        /* Is it a ".../dev" file? (len check is for paranoid reasons) */
+        if (strcmp(fileName + len, "/dev") != 0 || len >= PATH_MAX - 32)
-        strcpy(scratch, fileName);
+                return FALSE; /* not .../dev */
-        scratch[len] = '\0';
-        make_device(/*DEVNAME:*/ NULL, scratch, OP_add);
+        strcpy(path, fileName);
+        path[len] = '\0';
-        return TRUE;
-}
+        /* Read ".../subsystem" symlink in the same directory where ".../dev" is */
+        strcpy(subsys, path);
-/* Directory callback for /sys/ traversal */
+        strcpy(subsys + len, "/subsystem");
-static int FAST_FUNC dirAction(const char *fileName UNUSED_PARAM,
+        res = readlink(subsys, subsys, sizeof(subsys)-1);
-                struct stat *statbuf UNUSED_PARAM,
+        if (res > 0) {
-                void *userData UNUSED_PARAM,
+                subsys[res] = '\0';
-                int depth)
-{
-        /* Extract device subsystem -- the name of the directory
-         * under /sys/class/ */
-        if (1 == depth) {
                free(G.subsystem);
                if (G.subsys_env) {
                        bb_unsetenv_and_free(G.subsys_env);
                        G.subsys_env = NULL;
                }
-                G.subsystem = strrchr(fileName, '/');
+                /* Set G.subsystem and $SUBSYSTEM from symlink's last component */
+                G.subsystem = strrchr(subsys, '/');
                if (G.subsystem) {
                        G.subsystem = xstrdup(G.subsystem + 1);
                        G.subsys_env = xasprintf("%s=%s", "SUBSYSTEM", G.subsystem);
@@ -852,6 +849,17 @@ static int FAST_FUNC dirAction(const char *fileName UNUSED_PARAM,
                }
        }
+        make_device(/*DEVNAME:*/ NULL, path, OP_add);
+        return TRUE;
+}
+/* Directory callback for /sys/ traversal */
+static int FAST_FUNC dirAction(const char *fileName UNUSED_PARAM,
+                struct stat *statbuf UNUSED_PARAM,
+                void *userData UNUSED_PARAM,
+                int depth)
+{
        return (depth >= MAX_SYSFS_DEPTH ? SKIP : TRUE);
 }
@@ -872,8 +880,9 @@ static void load_firmware(const char *firmware, const char *sysfs_path)
        int firmware_fd, loading_fd;
        /* check for /lib/firmware/$FIRMWARE */
-        xchdir("/lib/firmware");
+        firmware_fd = -1;
-        firmware_fd = open(firmware, O_RDONLY); /* can fail */
+        if (chdir("/lib/firmware") == 0)
+                firmware_fd = open(firmware, O_RDONLY); /* can fail */
        /* check for /sys/$DEVPATH/loading ... give 30 seconds to appear */
        xchdir(sysfs_path);
@@ -1065,25 +1074,10 @@ int mdev_main(int argc UNUSED_PARAM, char **argv)
                putenv((char*)"ACTION=add");
-                /* ACTION_FOLLOWLINKS is needed since in newer kernels
+                /* Create all devices from /sys/dev hierarchy */
-                 * /sys/block/loop* (for example) are symlinks to dirs,
+                recursive_action("/sys/dev",
-                 * not real directories.
+                                 ACTION_RECURSE | ACTION_FOLLOWLINKS,
-                 * (kernel's CONFIG_SYSFS_DEPRECATED makes them real dirs,
+                                 fileAction, dirAction, temp, 0);
-                 * but we can't enforce that on users)
-                 */
-                if (access("/sys/class/block", F_OK) != 0) {
-                        /* Scan obsolete /sys/block only if /sys/class/block
-                         * doesn't exist. Otherwise we'll have dupes.
-                         * Also, do not complain if it doesn't exist.
-                         * Some people configure kernel to have no blockdevs.
-                         */
-                        recursive_action("/sys/block",
-                                ACTION_RECURSE | ACTION_FOLLOWLINKS | ACTION_QUIET,
-                                fileAction, dirAction, temp, 0);
-                }
-                recursive_action("/sys/class",
-                        ACTION_RECURSE | ACTION_FOLLOWLINKS,
-                        fileAction, dirAction, temp, 0);
        } else {
                char *fw;
                char *seq;
diff --git a/util-linux/mount.c b/util-linux/mount.c
index 13590ceb4..eb8b7ba7b 100644
--- a/util-linux/mount.c
+++ b/util-linux/mount.c
@@ -1931,7 +1931,6 @@ static int singlemount(struct mntent *mp, int ignore_busy)
                int len;
                char c;
                char *hostname, *share;
-                char *dotted, *ip;
                len_and_sockaddr *lsa;
                // Parse mp->mnt_fsname of the form "//hostname/share[/dir1/dir2]"
@@ -1971,13 +1970,26 @@ static int singlemount(struct mntent *mp, int ignore_busy)
                if (!lsa)
                        goto report_error;
-                // Insert "ip=..." option into options
+                // If there is no "ip=..." option yet
-                dotted = xmalloc_sockaddr2dotted_noport(&lsa->u.sa);
+                if (!is_prefixed_with(filteropts, ",ip="+1)
-                if (ENABLE_FEATURE_CLEAN_UP) free(lsa);
+                 && !strstr(filteropts, ",ip=")
-                ip = xasprintf("ip=%s", dotted);
+                ) {
-                if (ENABLE_FEATURE_CLEAN_UP) free(dotted);
+                        char *dotted, *ip;
-                parse_mount_options(ip, &filteropts);
+                        // Insert "ip=..." option into options
-                if (ENABLE_FEATURE_CLEAN_UP) free(ip);
+                        dotted = xmalloc_sockaddr2dotted_noport(&lsa->u.sa);
+                        if (ENABLE_FEATURE_CLEAN_UP) free(lsa);
+                        ip = xasprintf("ip=%s", dotted);
+                        if (ENABLE_FEATURE_CLEAN_UP) free(dotted);
+// Note: IPv6 scoped addresses ("host%iface", see RFC 4007) should be
+// handled by libc in getnameinfo() (inside xmalloc_sockaddr2dotted_noport()).
+// Currently, glibc does not support that (has no NI_NUMERICSCOPE),
+// musl apparently does. This results in "ip=numericIPv6%iface_name"
+// (instead of _numeric_ iface_id) with glibc.
+// This probably should be fixed in glibc, not here.
+// The workaround is to manually specify correct "ip=ADDR%n" option.
+                        parse_mount_options(ip, &filteropts);
+                        if (ENABLE_FEATURE_CLEAN_UP) free(ip);
+                }
                mp->mnt_type = (char*)"cifs";
                rc = mount_it_now(mp, vfsflags, filteropts);
diff --git a/util-linux/unshare.c b/util-linux/unshare.c
index fa7086add..dcc59559a 100644
--- a/util-linux/unshare.c
+++ b/util-linux/unshare.c
@@ -103,7 +103,7 @@ enum {
        OPT_mount       = 1 << 0,
        OPT_uts         = 1 << 1,
        OPT_ipc         = 1 << 2,
-        OPT_network     = 1 << 3,
+        OPT_net         = 1 << 3,
        OPT_pid         = 1 << 4,
        OPT_user        = 1 << 5, /* OPT_user, NS_USR_POS, and ns_list[] index must match! */
        OPT_fork        = 1 << 6,
@@ -142,7 +142,7 @@ static const char unshare_longopts[] ALIGN1 =
        "mount\0"               Optional_argument       "\xf0"
        "uts\0"                 Optional_argument       "\xf1"
        "ipc\0"                 Optional_argument       "\xf2"
-        "network\0"             Optional_argument       "\xf3"
+        "net\0"                 Optional_argument       "\xf3"
        "pid\0"                 Optional_argument       "\xf4"
        "user\0"                Optional_argument       "\xf5"
        "fork\0"                No_argument             "f"
diff --git a/util-linux/volume_id/get_devname.c b/util-linux/volume_id/get_devname.c
index 6b97df113..b64d28ceb 100644
--- a/util-linux/volume_id/get_devname.c
+++ b/util-linux/volume_id/get_devname.c
@@ -107,7 +107,11 @@ uuidcache_check_device(const char *device,
                int depth UNUSED_PARAM)
 {
        /* note: this check rejects links to devices, among other nodes */
-        if (!S_ISBLK(statbuf->st_mode))
+        if (!S_ISBLK(statbuf->st_mode)
+#if ENABLE_FEATURE_VOLUMEID_UBIFS
+         && !(S_ISCHR(statbuf->st_mode) && strncmp(bb_basename(device), "ubi", 3) == 0)
+#endif
+        )
                return TRUE;
        /* Users report that mucking with floppies (especially non-present
diff --git a/util-linux/volume_id/ubifs.c b/util-linux/volume_id/ubifs.c
new file mode 100644
index 000000000..13604ec35
--- /dev/null
+++ b/util-linux/volume_id/ubifs.c
@@ -0,0 +1,125 @@
+/*
+ * volume_id - reads filesystem label and uuid
+ *
+ * Copyright (C) 2012 S-G Bergh <sgb@systemasis.org>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_FEATURE_VOLUMEID_UBIFS) += ubifs.o
+//config:
+//config:config FEATURE_VOLUMEID_UBIFS
+//config:       bool "UBIFS filesystem"
+//config:       default y
+//config:       depends on VOLUMEID
+//config:       help
+//config:         UBIFS (Unsorted Block Image File System) is a file
+//config:         system for use with raw flash memory media.
+//config:
+#include "volume_id_internal.h"
+#define UBIFS_NODE_MAGIC  0x06101831
+/*
+ * struct ubifs_ch - common header node.
+ * @magic: UBIFS node magic number (%UBIFS_NODE_MAGIC)
+ * @crc: CRC-32 checksum of the node header
+ * @sqnum: sequence number
+ * @len: full node length
+ * @node_type: node type
+ * @group_type: node group type
+ * @padding: reserved for future, zeroes
+ *
+ * Every UBIFS node starts with this common part. If the node has a key, the
+ * key always goes next.
+ */
+struct ubifs_ch {
+        uint32_t magic;
+        uint32_t crc;
+        uint64_t sqnum;
+        uint32_t len;
+        uint8_t node_type;
+        uint8_t group_type;
+        uint8_t padding[2];
+} PACKED;
+/*
+ * struct ubifs_sb_node - superblock node.
+ * @ch: common header
+ * @padding: reserved for future, zeroes
+ * @key_hash: type of hash function used in keys
+ * @key_fmt: format of the key
+ * @flags: file-system flags (%UBIFS_FLG_BIGLPT, etc)
+ * @min_io_size: minimal input/output unit size
+ * @leb_size: logical eraseblock size in bytes
+ * @leb_cnt: count of LEBs used by file-system
+ * @max_leb_cnt: maximum count of LEBs used by file-system
+ * @max_bud_bytes: maximum amount of data stored in buds
+ * @log_lebs: log size in logical eraseblocks
+ * @lpt_lebs: number of LEBs used for lprops table
+ * @orph_lebs: number of LEBs used for recording orphans
+ * @jhead_cnt: count of journal heads
+ * @fanout: tree fanout (max. number of links per indexing node)
+ * @lsave_cnt: number of LEB numbers in LPT's save table
+ * @fmt_version: UBIFS on-flash format version
+ * @default_compr: default compression algorithm (%UBIFS_COMPR_LZO, etc)
+ * @padding1: reserved for future, zeroes
+ * @rp_uid: reserve pool UID
+ * @rp_gid: reserve pool GID
+ * @rp_size: size of the reserved pool in bytes
+ * @padding2: reserved for future, zeroes
+ * @time_gran: time granularity in nanoseconds
+ * @uuid: UUID generated when the file system image was created
+ * @ro_compat_version: UBIFS R/O compatibility version
+ */
+struct ubifs_sb_node {
+        struct ubifs_ch ch;
+        uint8_t padding[2];
+        uint8_t key_hash;
+        uint8_t key_fmt;
+        uint32_t flags;
+        uint32_t min_io_size;
+        uint32_t leb_size;
+        uint32_t leb_cnt;
+        uint32_t max_leb_cnt;
+        uint64_t max_bud_bytes;
+        uint32_t log_lebs;
+        uint32_t lpt_lebs;
+        uint32_t orph_lebs;
+        uint32_t jhead_cnt;
+        uint32_t fanout;
+        uint32_t lsave_cnt;
+        uint32_t fmt_version;
+        uint16_t default_compr;
+        uint8_t padding1[2];
+        uint32_t rp_uid;
+        uint32_t rp_gid;
+        uint64_t rp_size;
+        uint32_t time_gran;
+        uint8_t uuid[16];
+        uint32_t ro_compat_version;
+/*
+        uint8_t padding2[3968];
+*/
+} PACKED;
+int FAST_FUNC volume_id_probe_ubifs(struct volume_id *id /*,uint64_t off*/)
+{
+#define off ((uint64_t)0)
+        struct ubifs_sb_node *sb;
+        dbg("UBIFS: probing at offset 0x%llx", (unsigned long long) off);
+        sb = volume_id_get_buffer(id, off, sizeof(struct ubifs_sb_node));
+        if (!sb)
+                return -1;
+        if (le32_to_cpu(sb->ch.magic) != UBIFS_NODE_MAGIC)
+                return -1;
+        IF_FEATURE_BLKID_TYPE(id->type = "ubifs";)
+        volume_id_set_uuid(id, sb->uuid, UUID_DCE);
+        return 0;
+}
diff --git a/util-linux/volume_id/volume_id.c b/util-linux/volume_id/volume_id.c
index 3f71e0084..5bb95994b 100644
--- a/util-linux/volume_id/volume_id.c
+++ b/util-linux/volume_id/volume_id.c
@@ -168,6 +168,9 @@ static const probe_fptr fs2[] = {
 #if ENABLE_FEATURE_VOLUMEID_OCFS2
        volume_id_probe_ocfs2,
 #endif
+#if ENABLE_FEATURE_VOLUMEID_UBIFS
+        volume_id_probe_ubifs,
+#endif
 };
 int FAST_FUNC volume_id_probe_all(struct volume_id *id, /*uint64_t off,*/ uint64_t size)
diff --git a/util-linux/volume_id/volume_id_internal.h b/util-linux/volume_id/volume_id_internal.h
index 3061ac4d5..759a832e6 100644
--- a/util-linux/volume_id/volume_id_internal.h
+++ b/util-linux/volume_id/volume_id_internal.h
@@ -221,4 +221,6 @@ int FAST_FUNC volume_id_probe_udf(struct volume_id *id /*,uint64_t off*/);
 int FAST_FUNC volume_id_probe_xfs(struct volume_id *id /*,uint64_t off*/);
+int FAST_FUNC volume_id_probe_ubifs(struct volume_id *id /*,uint64_t off*/);
 POP_SAVED_FUNCTION_VISIBILITY
author	Ron Yorston <rmy@pobox.com>	2016-10-19 17:01:55 +0100
committer	Ron Yorston <rmy@pobox.com>	2016-10-19 17:01:55 +0100
commit	075814c60a316cfd088c88f26f75ab21b5850b98 (patch)
tree	f6e33ac693630827deb309faa5fa4931588db57d
parent	977d65c1bbc57f5cdd0c8bfd67c8b5bb1cd390dd (diff)
parent	f37e1155aabde6bd95d267a8aec347cedccb8bc3 (diff)
download	busybox-w32-075814c60a316cfd088c88f26f75ab21b5850b98.tar.gz busybox-w32-075814c60a316cfd088c88f26f75ab21b5850b98.tar.bz2 busybox-w32-075814c60a316cfd088c88f26f75ab21b5850b98.zip