Merge branch 'busybox'

213 files changed, 2877 insertions, 1398 deletions

diff --git a/Config.in b/Config.in
index b9df4ca16..43061e9ac 100644
--- a/Config.in
+++ b/Config.in
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 mainmenu "Configuration"
diff --git a/Makefile b/Makefile
index ee30c1f08..ea40cd14b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 VERSION = 1
-PATCHLEVEL = 29
+PATCHLEVEL = 30
 SUBLEVEL = 0
 EXTRAVERSION = .git
 NAME = Unnamed
diff --git a/archival/Config.src b/archival/Config.src
index 449914565..6f4f30c43 100644
--- a/archival/Config.src
+++ b/archival/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Archival Utilities"
diff --git a/archival/cpio.c b/archival/cpio.c
index 308ec1b25..9cacf9de6 100644
--- a/archival/cpio.c
+++ b/archival/cpio.c
@@ -64,15 +64,17 @@
 //usage:     "\n        -p DIR  Copy files to DIR"
 //usage:        )
 //usage:     "\nOptions:"
+//usage:        IF_FEATURE_CPIO_O(
+//usage:     "\n        -H newc Archive format"
+//usage:        )
 //usage:     "\n        -d      Make leading directories"
 //usage:     "\n        -m      Preserve mtime"
 //usage:     "\n        -v      Verbose"
 //usage:     "\n        -u      Overwrite"
 //usage:     "\n        -F FILE Input (-t,-i,-p) or output (-o) file"
 //usage:     "\n        -R USER[:GRP]   Set owner of created files"
-//usage:        IF_FEATURE_CPIO_O(
-//usage:     "\n        -H newc Archive format"
-//usage:        )
+//usage:     "\n        -L      Dereference symlinks"
+//usage:     "\n        -0      Input is separated by NULs"
 
 /* GNU cpio 2.9 --help (abridged):
 
@@ -374,6 +376,7 @@ int cpio_main(int argc UNUSED_PARAM, char **argv)
 #endif
                 "owner\0"        Required_argument "R"
                 "verbose\0"      No_argument       "v"
+                "null\0"         No_argument       "0"
                 "quiet\0"        No_argument       "\xff"
                 "to-stdout\0"    No_argument       "\xfe"
                 ;
@@ -508,7 +511,7 @@ int cpio_main(int argc UNUSED_PARAM, char **argv)
         while (get_header_cpio(archive_handle) == EXIT_SUCCESS)
                 continue;
 
-        create_symlinks_from_list(archive_handle->symlink_placeholders);
+        create_links_from_list(archive_handle->link_placeholders);
 
         if (archive_handle->cpio__blocks != (off_t)-1
          && !(opt & OPT_QUIET)
diff --git a/archival/gzip.c b/archival/gzip.c
index c5a1fe9b4..74d5d685f 100644
--- a/archival/gzip.c
+++ b/archival/gzip.c
@@ -333,12 +333,6 @@ struct globals {
         /* DECLARE(Pos, head, 1<<HASH_BITS); */
 #define head (G1.prev + WSIZE) /* hash head (see deflate.c) */
 
-/* =========================================================================== */
-/* all members below are zeroed out in pack_gzip() for each next file */
-
-        uint32_t crc;   /* shift register contents */
-        /*uint32_t *crc_32_tab;*/
-
 #if ENABLE_FEATURE_GZIP_LEVELS
         unsigned max_chain_length;
         unsigned max_lazy_match;
@@ -350,6 +344,12 @@ struct globals {
 #define nice_match       (G1.nice_match)
 #endif
 
+/* =========================================================================== */
+/* all members below are zeroed out in pack_gzip() for each next file */
+
+        uint32_t crc;   /* shift register contents */
+        /*uint32_t *crc_32_tab;*/
+
 /* window position at the beginning of the current output block. Gets
  * negative when the window is moved backwards.
  */
diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
index 8fa69ffaf..4c95db4a6 100644
--- a/archival/libarchive/data_extract_all.c
+++ b/archival/libarchive/data_extract_all.c
@@ -122,13 +122,10 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
 
         /* Handle hard links separately */
         if (hard_link) {
-                res = link(hard_link, dst_name);
-                if (res != 0) {
-                        /* shared message */
-                        bb_perror_msg("can't create %slink '%s' to '%s'",
-                                "hard", dst_name, hard_link
-                        );
-                }
+                create_or_remember_link(&archive_handle->link_placeholders,
+                                hard_link,
+                                dst_name,
+                                1);
                 /* Hardlinks have no separate mode/ownership, skip chown/chmod */
                 goto ret;
         }
@@ -195,9 +192,10 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
                  *
                  * Untarring bug.tar would otherwise place evil.py in '/tmp'.
                  */
-                create_or_remember_symlink(&archive_handle->symlink_placeholders,
+                create_or_remember_link(&archive_handle->link_placeholders,
                                 file_header->link_target,
-                                dst_name);
+                                dst_name,
+                                0);
                 break;
         case S_IFSOCK:
         case S_IFBLK:
diff --git a/archival/libarchive/decompress_unlzma.c b/archival/libarchive/decompress_unlzma.c
index 446319e7b..6886239d0 100644
--- a/archival/libarchive/decompress_unlzma.c
+++ b/archival/libarchive/decompress_unlzma.c
@@ -350,8 +350,12 @@ unpack_lzma_stream(transformer_state_t *xstate)
                                                 state = state < LZMA_NUM_LIT_STATES ? 9 : 11;
 
                                                 pos = buffer_pos - rep0;
-                                                if ((int32_t)pos < 0)
+                                                if ((int32_t)pos < 0) {
                                                         pos += header.dict_size;
+                                                        /* see unzip_bad_lzma_2.zip: */
+                                                        if (pos >= buffer_size)
+                                                                goto bad;
+                                                }
                                                 previous_byte = buffer[pos];
                                                 goto one_byte1;
 #else
diff --git a/archival/libarchive/get_header_ar.c b/archival/libarchive/get_header_ar.c
index adcde46d5..7ce9c615c 100644
--- a/archival/libarchive/get_header_ar.c
+++ b/archival/libarchive/get_header_ar.c
@@ -126,7 +126,7 @@ char FAST_FUNC get_header_ar(archive_handle_t *archive_handle)
                         struct archive_handle_t *sa = archive_handle->dpkg__sub_archive;
                         while (archive_handle->dpkg__action_data_subarchive(sa) == EXIT_SUCCESS)
                                 continue;
-                        create_symlinks_from_list(sa->symlink_placeholders);
+                        create_links_from_list(sa->link_placeholders);
                 } else
 #endif
                         archive_handle->action_data(archive_handle);
diff --git a/archival/libarchive/unsafe_symlink_target.c b/archival/libarchive/unsafe_symlink_target.c
index 0ad4c9392..f53881f2f 100644
--- a/archival/libarchive/unsafe_symlink_target.c
+++ b/archival/libarchive/unsafe_symlink_target.c
@@ -5,15 +5,16 @@
 #include "libbb.h"
 #include "bb_archive.h"
 
-void FAST_FUNC create_or_remember_symlink(llist_t **symlink_placeholders
+void FAST_FUNC create_or_remember_link(llist_t **link_placeholders
                 IF_PLATFORM_MINGW32(UNUSED_PARAM),
                 const char *target,
-                const char *linkname)
+                const char *linkname,
+                int hard_link IF_PLATFORM_MINGW32(UNUSED_PARAM))
 {
 #if !ENABLE_PLATFORM_MINGW32
-        if (target[0] == '/' || strstr(target, "..")) {
-                llist_add_to(symlink_placeholders,
-                        xasprintf("%s%c%s", linkname, '\0', target)
+        if (hard_link || target[0] == '/' || strstr(target, "..")) {
+                llist_add_to_end(link_placeholders,
+                        xasprintf("%c%s%c%s", hard_link, linkname, '\0', target)
                 );
                 return;
         }
@@ -30,17 +31,17 @@ void FAST_FUNC create_or_remember_symlink(llist_t **symlink_placeholders
 }
 
 #if !ENABLE_PLATFORM_MINGW32
-void FAST_FUNC create_symlinks_from_list(llist_t *list)
+void FAST_FUNC create_links_from_list(llist_t *list)
 {
         while (list) {
                 char *target;
 
-                target = list->data + strlen(list->data) + 1;
-                if (symlink(target, list->data)) {
+                target = list->data + 1 + strlen(list->data + 1) + 1;
+                if ((*list->data ? link : symlink) (target, list->data + 1)) {
                         /* shared message */
                         bb_error_msg_and_die("can't create %slink '%s' to '%s'",
-                                "sym",
-                                list->data, target
+                                *list->data ? "hard" : "sym",
+                                list->data + 1, target
                         );
                 }
                 list = list->link;
diff --git a/archival/tar.c b/archival/tar.c
index afd8cfec5..e1af27401 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -1279,7 +1279,7 @@ int tar_main(int argc UNUSED_PARAM, char **argv)
         while (get_header_tar(tar_handle) == EXIT_SUCCESS)
                 bb_got_signal = EXIT_SUCCESS; /* saw at least one header, good */
 
-        create_symlinks_from_list(tar_handle->symlink_placeholders);
+        create_links_from_list(tar_handle->link_placeholders);
 
         /* Check that every file that should have been extracted was */
         while (tar_handle->accept) {
diff --git a/archival/unzip.c b/archival/unzip.c
index 369c6c028..a9b7dc10f 100644
--- a/archival/unzip.c
+++ b/archival/unzip.c
@@ -375,9 +375,10 @@ static void unzip_extract_symlink(llist_t **symlink_placeholders,
                 target[xstate.mem_output_size] = '\0';
 #endif
         }
-        create_or_remember_symlink(symlink_placeholders,
+        create_or_remember_link(symlink_placeholders,
                         target,
-                        dst_fn);
+                        dst_fn,
+                        0);
         free(target);
 }
 #endif
@@ -993,7 +994,7 @@ int unzip_main(int argc, char **argv)
         }
 
 #if ENABLE_FEATURE_UNZIP_CDF
-        create_symlinks_from_list(symlink_placeholders);
+        create_links_from_list(symlink_placeholders);
 #endif
 
         if ((opts & OPT_l) && quiet <= 1) {
diff --git a/console-tools/Config.src b/console-tools/Config.src
index e6587ade4..c30caf0e1 100644
--- a/console-tools/Config.src
+++ b/console-tools/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Console Utilities"
diff --git a/coreutils/Config.src b/coreutils/Config.src
index 7a8a3a634..1bded03a6 100644
--- a/coreutils/Config.src
+++ b/coreutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Coreutils"
diff --git a/coreutils/cp.c b/coreutils/cp.c
index 455bffbba..ae60623d3 100644
--- a/coreutils/cp.c
+++ b/coreutils/cp.c
@@ -24,6 +24,11 @@
 //config:       help
 //config:       Enable long options.
 //config:       Also add support for --parents option.
+//config:
+//config:config FEATURE_CP_REFLINK
+//config:       bool "Enable --reflink[=auto]"
+//config:       default y
+//config:       depends on FEATURE_CP_LONG_OPTIONS
 
 //applet:IF_CP(APPLET_NOEXEC(cp, cp, BB_DIR_BIN, BB_SUID_DROP, cp))
 /* NOEXEC despite cases when it can be a "runner" (cp -r LARGE_DIR NEW_DIR) */
@@ -72,10 +77,14 @@ int cp_main(int argc, char **argv)
 #if ENABLE_FEATURE_CP_LONG_OPTIONS
                 /*OPT_rmdest  = FILEUTILS_RMDEST = 1 << FILEUTILS_CP_OPTNUM */
                 OPT_parents = 1 << (FILEUTILS_CP_OPTNUM+1),
+                OPT_reflink = 1 << (FILEUTILS_CP_OPTNUM+2),
 #endif
         };
 
 #if ENABLE_FEATURE_CP_LONG_OPTIONS
+# if ENABLE_FEATURE_CP_REFLINK
+        char *reflink = NULL;
+# endif
         flags = getopt32long(argv, "^"
                 FILEUTILS_CP_OPTSTR
                 "\0"
@@ -99,7 +108,22 @@ int cp_main(int argc, char **argv)
                 "update\0"         No_argument "u"
                 "remove-destination\0" No_argument "\xff"
                 "parents\0"        No_argument "\xfe"
+# if ENABLE_FEATURE_CP_REFLINK
+                "reflink\0"        Optional_argument "\xfd"
+                , &reflink
+# endif
         );
+# if ENABLE_FEATURE_CP_REFLINK
+        BUILD_BUG_ON(OPT_reflink != FILEUTILS_REFLINK);
+        if (flags & FILEUTILS_REFLINK) {
+                if (!reflink)
+                        flags |= FILEUTILS_REFLINK_ALWAYS;
+                else if (strcmp(reflink, "always") == 0)
+                        flags |= FILEUTILS_REFLINK_ALWAYS;
+                else if (strcmp(reflink, "auto") != 0)
+                        bb_show_usage();
+        }
+# endif
 #else
         flags = getopt32(argv, "^"
                 FILEUTILS_CP_OPTSTR
diff --git a/coreutils/install.c b/coreutils/install.c
index 2e4dc257f..8270490bd 100644
--- a/coreutils/install.c
+++ b/coreutils/install.c
@@ -214,7 +214,11 @@ int install_main(int argc, char **argv)
                         dest = last;
                         if (opts & OPT_MKDIR_LEADING) {
                                 char *ddir = xstrdup(dest);
-                                bb_make_directory(dirname(ddir), 0755, mkdir_flags);
+                                /*
+                                 * -D -t DIR1/DIR2/F3 FILE: create DIR1/DIR2/F3, copy FILE there
+                                 * -D FILE DIR1/DIR2/F3: create DIR1/DIR2, copy FILE there as F3
+                                 */
+                                bb_make_directory((opts & OPT_TARGET) ? ddir : dirname(ddir), 0755, mkdir_flags);
                                 /* errors are not checked. copy_file
                                  * will fail if dir is not created.
                                  */
diff --git a/coreutils/nproc.c b/coreutils/nproc.c
index 336b176ca..0ea8d1001 100644
--- a/coreutils/nproc.c
+++ b/coreutils/nproc.c
@@ -14,10 +14,14 @@
 //kbuild:lib-$(CONFIG_NPROC) += nproc.o
 
 //usage:#define nproc_trivial_usage
-//usage:        ""
-//TODO: "[--all] [--ignore=N]"
+//usage:        ""IF_LONG_OPTS("--all --ignore=N")
 //usage:#define nproc_full_usage "\n\n"
-//usage:        "Print number of CPUs"
+//usage:        "Print number of available CPUs"
+//usage:        IF_LONG_OPTS(
+//usage:     "\n"
+//usage:     "\n        --all           Number of installed CPUs"
+//usage:     "\n        --ignore=N      Exclude N CPUs"
+//usage:        )
 
 #include <sched.h>
 #include "libbb.h"
@@ -26,13 +30,30 @@ int nproc_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int nproc_main(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
         unsigned long mask[1024];
-        unsigned i, count = 0;
-
-        //getopt32(argv, "");
-
-        //if --all, count /sys/devices/system/cpu/cpuN dirs, else:
+        int count = 0;
+#if ENABLE_LONG_OPTS
+        int ignore = 0;
+        int opts = getopt32long(argv, "\xfe:+",
+                        "ignore\0" Required_argument "\xfe"
+                        "all\0"    No_argument       "\xff"
+                        , &ignore
+        );
 
+        if (opts & (1 << 1)) {
+                DIR *cpusd = opendir("/sys/devices/system/cpu");
+                if (cpusd) {
+                        struct dirent *de;
+                        while (NULL != (de = readdir(cpusd))) {
+                                char *cpuid = strstr(de->d_name, "cpu");
+                                if (cpuid && isdigit(cpuid[strlen(cpuid) - 1]))
+                                        count++;
+                        }
+                        closedir(cpusd);
+                }
+        } else
+#endif
         if (sched_getaffinity(0, sizeof(mask), (void*)mask) == 0) {
+                int i;
                 for (i = 0; i < ARRAY_SIZE(mask); i++) {
                         unsigned long m = mask[i];
                         while (m) {
@@ -42,8 +63,11 @@ int nproc_main(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                         }
                 }
         }
-        if (count == 0)
-                count++;
+
+        IF_LONG_OPTS(count -= ignore;)
+        if (count <= 0)
+                count = 1;
+
         printf("%u\n", count);
 
         return 0;
diff --git a/coreutils/readlink.c b/coreutils/readlink.c
index b8e327d11..49361cea0 100644
--- a/coreutils/readlink.c
+++ b/coreutils/readlink.c
@@ -86,7 +86,7 @@ int readlink_main(int argc UNUSED_PARAM, char **argv)
 
         /* NOFORK: only one alloc is allowed; must free */
         if (opt & 1) { /* -f */
-                buf = xmalloc_realpath(fname);
+                buf = xmalloc_realpath_coreutils(fname);
         } else {
                 buf = xmalloc_readlink_or_warn(fname);
         }
diff --git a/coreutils/realpath.c b/coreutils/realpath.c
index aa878fcd2..43923681c 100644
--- a/coreutils/realpath.c
+++ b/coreutils/realpath.c
@@ -38,7 +38,7 @@ int realpath_main(int argc UNUSED_PARAM, char **argv)
 
         do {
                 /* NOFORK: only one alloc is allowed; must free */
-                char *resolved_path = xmalloc_realpath(*argv);
+                char *resolved_path = xmalloc_realpath_coreutils(*argv);
                 if (resolved_path != NULL) {
                         puts(resolved_path);
                         free(resolved_path);
diff --git a/coreutils/sort.c b/coreutils/sort.c
index 4d741e76d..05e5c9071 100644
--- a/coreutils/sort.c
+++ b/coreutils/sort.c
@@ -60,6 +60,7 @@
 //usage:        IF_FEATURE_SORT_BIG(
 //usage:     "\n        -g      General numerical sort"
 //usage:     "\n        -M      Sort month"
+//usage:     "\n        -V      Sort version"
 //usage:     "\n        -t CHAR Field separator"
 //usage:     "\n        -k N[,M] Sort by Nth field"
 //usage:        )
@@ -91,32 +92,33 @@
 
 /* These are sort types */
 enum {
-        FLAG_n  = 1,            /* Numeric sort */
-        FLAG_g  = 2,            /* Sort using strtod() */
-        FLAG_M  = 4,            /* Sort date */
+        FLAG_n  = 1 << 0,       /* Numeric sort */
+        FLAG_g  = 1 << 1,       /* Sort using strtod() */
+        FLAG_M  = 1 << 2,       /* Sort date */
+        FLAG_V  = 1 << 3,       /* Sort version */
 /* ucsz apply to root level only, not keys.  b at root level implies bb */
-        FLAG_u  = 8,            /* Unique */
-        FLAG_c  = 0x10,         /* Check: no output, exit(!ordered) */
-        FLAG_s  = 0x20,         /* Stable sort, no ascii fallback at end */
-        FLAG_z  = 0x40,         /* Input and output is NUL terminated, not \n */
+        FLAG_u  = 1 << 4,       /* Unique */
+        FLAG_c  = 1 << 5,       /* Check: no output, exit(!ordered) */
+        FLAG_s  = 1 << 6,       /* Stable sort, no ascii fallback at end */
+        FLAG_z  = 1 << 7,       /* Input and output is NUL terminated, not \n */
 /* These can be applied to search keys, the previous four can't */
-        FLAG_b  = 0x80,         /* Ignore leading blanks */
-        FLAG_r  = 0x100,        /* Reverse */
-        FLAG_d  = 0x200,        /* Ignore !(isalnum()|isspace()) */
-        FLAG_f  = 0x400,        /* Force uppercase */
-        FLAG_i  = 0x800,        /* Ignore !isprint() */
-        FLAG_m  = 0x1000,       /* ignored: merge already sorted files; do not sort */
-        FLAG_S  = 0x2000,       /* ignored: -S, --buffer-size=SIZE */
-        FLAG_T  = 0x4000,       /* ignored: -T, --temporary-directory=DIR */
-        FLAG_o  = 0x8000,
-        FLAG_k  = 0x10000,
-        FLAG_t  = 0x20000,
+        FLAG_b  = 1 << 8,       /* Ignore leading blanks */
+        FLAG_r  = 1 << 9,       /* Reverse */
+        FLAG_d  = 1 << 10,      /* Ignore !(isalnum()|isspace()) */
+        FLAG_f  = 1 << 11,      /* Force uppercase */
+        FLAG_i  = 1 << 12,      /* Ignore !isprint() */
+        FLAG_m  = 1 << 13,      /* ignored: merge already sorted files; do not sort */
+        FLAG_S  = 1 << 14,      /* ignored: -S, --buffer-size=SIZE */
+        FLAG_T  = 1 << 15,      /* ignored: -T, --temporary-directory=DIR */
+        FLAG_o  = 1 << 16,
+        FLAG_k  = 1 << 17,
+        FLAG_t  = 1 << 18,
         FLAG_bb = 0x80000000,   /* Ignore trailing blanks  */
         FLAG_no_tie_break = 0x40000000,
 };
 
 static const char sort_opt_str[] ALIGN1 = "^"
-                        "ngMucszbrdfimS:T:o:k:*t:"
+                        "ngMVucszbrdfimS:T:o:k:*t:"
                         "\0" "o--o:t--t"/*-t, -o: at most one of each*/;
 /*
  * OPT_STR must not be string literal, needs to have stable address:
@@ -273,10 +275,15 @@ static int compare_keys(const void *xarg, const void *yarg)
                 y = *(char **)yarg;
 #endif
                 /* Perform actual comparison */
-                switch (flags & (FLAG_n | FLAG_M | FLAG_g)) {
+                switch (flags & (FLAG_n | FLAG_g | FLAG_M | FLAG_V)) {
                 default:
                         bb_error_msg_and_die("unknown sort type");
                         break;
+#if defined(HAVE_STRVERSCMP) && HAVE_STRVERSCMP == 1
+                case FLAG_V:
+                        retval = strverscmp(x, y);
+                        break;
+#endif
                 /* Ascii sort */
                 case 0:
 #if ENABLE_LOCALE_SUPPORT
diff --git a/debianutils/Config.src b/debianutils/Config.src
index 61daeb047..17b0d8945 100644
--- a/debianutils/Config.src
+++ b/debianutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Debian Utilities"
diff --git a/docs/Kconfig-language.txt b/docs/Kconfig-language.txt
new file mode 100644
index 000000000..0ba8932ba
--- /dev/null
+++ b/docs/Kconfig-language.txt
@@ -0,0 +1,255 @@
+Introduction
+------------
+
+The configuration database is collection of configuration options
+organized in a tree structure:
+
+    +- Code maturity level options
+    |  +- Prompt for development and/or incomplete code/drivers
+    +- General setup
+    |  +- Networking support
+    |  +- System V IPC
+    |  +- BSD Process Accounting
+    |  +- Sysctl support
+    +- Loadable module support
+    |  +- Enable loadable module support
+    |     +- Set version information on all module symbols
+    |     +- Kernel module loader
+    +- ...
+
+Every entry has its own dependencies. These dependencies are used
+to determine the visible of an entry. Any child entry is only
+visible if its parent entry is also visible.
+
+Menu entries
+------------
+
+Most entries define a config option, all other entries help to organize
+them. A single configuration option is defined like this:
+
+config MODVERSIONS
+    bool "Set version information on all module symbols"
+    depends MODULES
+    help
+      Usually, modules have to be recompiled whenever you switch to a new
+      kernel.  ...
+
+Every line starts with a key word and can be followed by multiple
+arguments.  "config" starts a new config entry. The following lines
+define attributes for this config option. Attributes can be the type of
+the config option, input prompt, dependencies, help text and default
+values. A config option can be defined multiple times with the same
+name, but every definition can have only a single input prompt and the
+type must not conflict.
+
+Menu attributes
+---------------
+
+A menu entry can have a number of attributes. Not all of them are
+applicable everywhere (see syntax).
+
+- type definition: "bool"/"tristate"/"string"/"hex"/"integer"
+  Every config option must have a type. There are only two basic types:
+  tristate and string, the other types base on these two. The type
+  definition optionally accepts an input prompt, so these two examples
+  are equivalent:
+
+    bool "Networking support"
+  and
+    bool
+    prompt "Networking support"
+
+- input prompt: "prompt" <prompt> ["if" <expr>]
+  Every menu entry can have at most one prompt, which is used to display
+  to the user. Optionally dependencies only for this prompt can be added
+  with "if".
+
+- default value: "default" <symbol> ["if" <expr>]
+  A config option can have any number of default values. If multiple
+  default values are visible, only the first defined one is active.
+  Default values are not limited to the menu entry, where they are
+  defined, this means the default can be defined somewhere else or be
+  overridden by an earlier definition.
+  The default value is only assigned to the config symbol if no other
+  value was set by the user (via the input prompt above). If an input
+  prompt is visible the default value is presented to the user and can
+  be overridden by him.
+  Optionally dependencies only for this default value can be added with
+  "if".
+
+- dependencies: "depends on"/"requires" <expr>
+  This defines a dependency for this menu entry. If multiple
+  dependencies are defined they are connected with '&&'. Dependencies
+  are applied to all other options within this menu entry (which also
+  accept "if" expression), so these two examples are equivalent:
+
+    bool "foo" if BAR
+    default y if BAR
+  and
+    depends on BAR
+    bool "foo"
+    default y
+
+- help text: "help"
+  This defines a help text. The end of the help text is determined by
+  the level indentation, this means it ends at the first line which has
+  a smaller indentation than the first line of the help text.
+
+
+Menu dependencies
+-----------------
+
+Dependencies define the visibility of a menu entry and can also reduce
+the input range of tristate symbols. The tristate logic used in the
+expressions uses one more state than normal boolean logic to express the
+module state. Dependency expressions have the following syntax:
+
+<expr> ::= <symbol>                             (1)
+           <symbol> '=' <symbol>                (2)
+           <symbol> '!=' <symbol>               (3)
+           '(' <expr> ')'                       (4)
+           '!' <expr>                           (5)
+           <expr> '||' <expr>                   (6)
+           <expr> '&&' <expr>                   (7)
+
+Expressions are listed in decreasing order of precedence.
+
+(1) Convert the symbol into an expression. Boolean and tristate symbols
+    are simply converted into the respective expression values. All
+    other symbol types result in 'n'.
+(2) If the values of both symbols are equal, it returns 'y',
+    otherwise 'n'.
+(3) If the values of both symbols are equal, it returns 'n',
+    otherwise 'y'.
+(4) Returns the value of the expression. Used to override precedence.
+(5) Returns the result of (2-/expr/).
+(6) Returns the result of min(/expr/, /expr/).
+(7) Returns the result of max(/expr/, /expr/).
+
+An expression can have a value of 'n', 'm' or 'y' (or 0, 1, 2
+respectively for calculations). A menu entry becomes visible when it's
+expression evaluates to 'm' or 'y'.
+
+There are two type of symbols: constant and nonconstant symbols.
+Nonconstant symbols are the most common ones and are defined with the
+'config' statement. Nonconstant symbols consist entirely of alphanumeric
+characters or underscores.
+Constant symbols are only part of expressions. Constant symbols are
+always surrounded by single or double quotes. Within the quote any
+other character is allowed and the quotes can be escaped using '\'.
+
+Menu structure
+--------------
+
+The position of a menu entry in the tree is determined in two ways. First
+it can be specified explicitely:
+
+menu "Network device support"
+    depends NET
+
+config NETDEVICES
+    ...
+
+endmenu
+
+All entries within the "menu" ... "endmenu" block become a submenu of
+"Network device support". All subentries inherit the dependencies from
+the menu entry, e.g. this means the dependency "NET" is added to the
+dependency list of the config option NETDEVICES.
+
+The other way to generate the menu structure is done by analyzing the
+dependencies. If a menu entry somehow depends on the previous entry, it
+can be made a submenu of it. First the the previous (parent) symbol must
+be part of the dependency list and then one of these two condititions
+must be true:
+- the child entry must become invisible, if the parent is set to 'n'
+- the child entry must only be visible, if the parent is visible
+
+config MODULES
+    bool "Enable loadable module support"
+
+config MODVERSIONS
+    bool "Set version information on all module symbols"
+    depends MODULES
+
+comment "module support disabled"
+    depends !MODULES
+
+MODVERSIONS directly depends on MODULES, this means it's only visible if
+MODULES is different from 'n'. The comment on the other hand is always
+visible when MODULES it's visible (the (empty) dependency of MODULES is
+also part of the comment dependencies).
+
+
+Kconfig syntax
+--------------
+
+The configuration file describes a series of menu entries, where every
+line starts with a keyword (except help texts). The following keywords
+end a menu entry:
+- config
+- choice/endchoice
+- comment
+- menu/endmenu
+- if/endif
+- source
+The first four also start the definition of a menu entry.
+
+config:
+
+    "config" <symbol>
+    <config options>
+
+This defines a config symbol <symbol> and accepts any of above
+attributes as options.
+
+choices:
+
+    "choice"
+    <choice options>
+    <choice block>
+    "endchoice"
+
+This defines a choice group and accepts any of above attributes as
+options. A choice can only be of type bool or tristate, while a boolean
+choice only allows a single config entry to be selected, a tristate
+choice also allows any number of config entries to be set to 'm'. This
+can be used if multiple drivers for a single hardware exists and only a
+single driver can be compiled/loaded into the kernel, but all drivers
+can be compiled as modules.
+A choice accepts another option "optional", which allows to set the
+choice to 'n' and no entry needs to be selected.
+
+comment:
+
+    "comment" <prompt>
+    <comment options>
+
+This defines a comment which is displayed to the user during the
+configuration process and is also echoed to the output files. The only
+possible options are dependencies.
+
+menu:
+
+    "menu" <prompt>
+    <menu options>
+    <menu block>
+    "endmenu"
+
+This defines a menu block, see "Menu structure" above for more
+information. The only possible options are dependencies.
+
+if:
+
+    "if" <expr>
+    <if block>
+    "endif"
+
+This defines an if block. The dependency expression <expr> is appended
+to all enclosed menu entries.
+
+source:
+
+    "source" <prompt>
+
+This reads the specified configuration file. This file is always parsed.
diff --git a/e2fsprogs/Config.src b/e2fsprogs/Config.src
index a20d849e6..ad15f470c 100644
--- a/e2fsprogs/Config.src
+++ b/e2fsprogs/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Linux Ext2 FS Progs"
diff --git a/e2fsprogs/fsck.c b/e2fsprogs/fsck.c
index 1c285bb92..f5aa3dbe4 100644
--- a/e2fsprogs/fsck.c
+++ b/e2fsprogs/fsck.c
@@ -414,7 +414,7 @@ static void kill_all_if_got_signal(void)
 static int wait_one(int flags)
 {
         int status;
-        int sig;
+        int exitcode;
         struct fsck_instance *inst, *prev;
         pid_t pid;
 
@@ -448,15 +448,16 @@ static int wait_one(int flags)
         }
  child_died:
 
-        status = WEXITSTATUS(status);
+        exitcode = WEXITSTATUS(status);
         if (WIFSIGNALED(status)) {
+                unsigned sig;
                 sig = WTERMSIG(status);
-                status = EXIT_UNCORRECTED;
+                exitcode = EXIT_UNCORRECTED;
                 if (sig != SIGINT) {
                         printf("Warning: %s %s terminated "
-                                "by signal %d\n",
+                                "by signal %u\n",
                                 inst->prog, inst->device, sig);
-                        status = EXIT_ERROR;
+                        exitcode = EXIT_ERROR;
                 }
         }
 
@@ -492,12 +493,12 @@ static int wait_one(int flags)
         else
                 G.instance_list = inst->next;
         if (G.verbose > 1)
-                printf("Finished with %s (exit status %d)\n",
-                        inst->device, status);
+                printf("Finished with %s (exit status %u)\n",
+                        inst->device, exitcode);
         G.num_running--;
         free_instance(inst);
 
-        return status;
+        return exitcode;
 }
 
 /*
diff --git a/editors/Config.src b/editors/Config.src
index 0920bc494..3b2e4a6c0 100644
--- a/editors/Config.src
+++ b/editors/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Editors"
diff --git a/editors/vi.c b/editors/vi.c
index 26487bee6..e79787977 100644
--- a/editors/vi.c
+++ b/editors/vi.c
@@ -752,7 +752,10 @@ static int query_screen_dimensions(void)
         return err;
 }
 #else
-# define query_screen_dimensions() (0)
+static ALWAYS_INLINE int query_screen_dimensions(void)
+{
+        return 0;
+}
 #endif
 
 static void edit_file(char *fn)
@@ -1069,10 +1072,13 @@ static void colon(char *buf)
         not_implemented(p);
 #else
 
-        char c, *orig_buf, *buf1, *q, *r;
+        char c, *buf1, *q, *r;
         char *fn, cmd[MAX_INPUT_LEN], args[MAX_INPUT_LEN];
         int i, l, li, b, e;
         int useforce;
+# if ENABLE_FEATURE_VI_SEARCH || ENABLE_FEATURE_ALLOW_EXEC
+        char *orig_buf;
+# endif
 
         // :3154        // if (-e line 3154) goto it  else stay put
         // :4,33w! foo  // write a portion of buffer to file "foo"
@@ -1104,8 +1110,10 @@ static void colon(char *buf)
         // look for optional address(es)  :.  :1  :1,9   :'q,'a   :%
         buf = get_address(buf, &b, &e);
 
+# if ENABLE_FEATURE_VI_SEARCH || ENABLE_FEATURE_ALLOW_EXEC
         // remember orig command line
         orig_buf = buf;
+# endif
 
         // get the COMMAND into cmd[]
         buf1 = cmd;
@@ -1149,7 +1157,7 @@ static void colon(char *buf)
                         dot_skip_over_ws();
                 }
         }
-#if ENABLE_FEATURE_ALLOW_EXEC
+# if ENABLE_FEATURE_ALLOW_EXEC
         else if (cmd[0] == '!') {       // run a cmd
                 int retcode;
                 // :!ls   run the <cmd>
@@ -1161,7 +1169,7 @@ static void colon(char *buf)
                 rawmode();
                 Hit_Return();                   // let user see results
         }
-#endif
+# endif
         else if (cmd[0] == '=' && !cmd[1]) {    // where is the address
                 if (b < 0) {    // no addr given- use defaults
                         b = e = count_lines(text, dot);
@@ -1196,7 +1204,7 @@ static void colon(char *buf)
 
                 size = init_text_buffer(fn);
 
-#if ENABLE_FEATURE_VI_YANKMARK
+# if ENABLE_FEATURE_VI_YANKMARK
                 if (Ureg >= 0 && Ureg < 28) {
                         free(reg[Ureg]);        //   free orig line reg- for 'U'
                         reg[Ureg] = NULL;
@@ -1205,7 +1213,7 @@ static void colon(char *buf)
                         free(reg[YDreg]);       //   free default yank/delete register
                         reg[YDreg] = NULL;
                 }
-#endif
+# endif
                 // how many lines in text[]?
                 li = count_lines(text, end - 1);
                 status_line("'%s'%s"
@@ -1352,16 +1360,16 @@ static void colon(char *buf)
                         optind = -1; /* start from 0th file */
                         editing = 0;
                 }
-#if ENABLE_FEATURE_VI_SET
+# if ENABLE_FEATURE_VI_SET
         } else if (strncmp(cmd, "set", i) == 0) {       // set or clear features
-#if ENABLE_FEATURE_VI_SETOPTS
+#  if ENABLE_FEATURE_VI_SETOPTS
                 char *argp;
-#endif
+#  endif
                 i = 0;                  // offset into args
                 // only blank is regarded as args delimiter. What about tab '\t'?
                 if (!args[0] || strcasecmp(args, "all") == 0) {
                         // print out values of all options
-#if ENABLE_FEATURE_VI_SETOPTS
+#  if ENABLE_FEATURE_VI_SETOPTS
                         status_line_bold(
                                 "%sautoindent "
                                 "%sflash "
@@ -1374,10 +1382,10 @@ static void colon(char *buf)
                                 showmatch ? "" : "no",
                                 tabstop
                         );
-#endif
+#  endif
                         goto ret;
                 }
-#if ENABLE_FEATURE_VI_SETOPTS
+#  if ENABLE_FEATURE_VI_SETOPTS
                 argp = args;
                 while (*argp) {
                         if (strncmp(argp, "no", 2) == 0)
@@ -1395,16 +1403,17 @@ static void colon(char *buf)
                         argp = skip_non_whitespace(argp);
                         argp = skip_whitespace(argp);
                 }
-#endif /* FEATURE_VI_SETOPTS */
-#endif /* FEATURE_VI_SET */
-#if ENABLE_FEATURE_VI_SEARCH
+#  endif /* FEATURE_VI_SETOPTS */
+# endif /* FEATURE_VI_SET */
+
+# if ENABLE_FEATURE_VI_SEARCH
         } else if (cmd[0] == 's') {     // substitute a pattern with a replacement pattern
                 char *F, *R, *flags;
                 size_t len_F, len_R;
                 int gflag;              // global replace flag
-#if ENABLE_FEATURE_VI_UNDO
+#  if ENABLE_FEATURE_VI_UNDO
                 int dont_chain_first_item = ALLOW_UNDO;
-#endif
+#  endif
 
                 // F points to the "find" pattern
                 // R points to the "replace" pattern
@@ -1441,9 +1450,9 @@ static void colon(char *buf)
                                 // we found the "find" pattern - delete it
                                 // For undo support, the first item should not be chained
                                 text_hole_delete(found, found + len_F - 1, dont_chain_first_item);
-#if ENABLE_FEATURE_VI_UNDO
+#  if ENABLE_FEATURE_VI_UNDO
                                 dont_chain_first_item = ALLOW_UNDO_CHAIN;
-#endif
+#  endif
                                 // insert the "replace" patern
                                 bias = string_insert(found, R, ALLOW_UNDO_CHAIN);
                                 found += bias;
@@ -1459,7 +1468,7 @@ static void colon(char *buf)
                         }
                         q = next_line(ls);
                 }
-#endif /* FEATURE_VI_SEARCH */
+# endif /* FEATURE_VI_SEARCH */
         } else if (strncmp(cmd, "version", i) == 0) {  // show software version
                 status_line(BB_VER);
         } else if (strncmp(cmd, "write", i) == 0  // write text to file
@@ -1474,12 +1483,12 @@ static void colon(char *buf)
                 if (args[0]) {
                         fn = args;
                 }
-#if ENABLE_FEATURE_VI_READONLY
+# if ENABLE_FEATURE_VI_READONLY
                 if (readonly_mode && !useforce) {
                         status_line_bold("'%s' is read only", fn);
                         goto ret;
                 }
-#endif
+# endif
                 //if (useforce) {
                         // if "fn" is not write-able, chmod u+w
                         // sprintf(syscmd, "chmod u+w %s", fn);
@@ -1519,7 +1528,7 @@ static void colon(char *buf)
                                 }
                         }
                 }
-#if ENABLE_FEATURE_VI_YANKMARK
+# if ENABLE_FEATURE_VI_YANKMARK
         } else if (strncmp(cmd, "yank", i) == 0) {      // yank lines
                 if (b < 0) {    // no addr given- use defaults
                         q = begin_line(dot);    // assume .,. for the range
@@ -1529,7 +1538,7 @@ static void colon(char *buf)
                 li = count_lines(q, r);
                 status_line("Yank %d lines (%d chars) into [%c]",
                                 li, strlen(reg[YDreg]), what_reg());
-#endif
+# endif
         } else {
                 // cmd unknown
                 not_implemented(cmd);
@@ -1537,10 +1546,10 @@ static void colon(char *buf)
  ret:
         dot = bound_dot(dot);   // make sure "dot" is valid
         return;
-#if ENABLE_FEATURE_VI_SEARCH
+# if ENABLE_FEATURE_VI_SEARCH
  colon_s_fail:
         status_line(":s expression missing delimiters");
-#endif
+# endif
 #endif /* FEATURE_VI_COLON */
 }
 
diff --git a/examples/var_service/dhcp_if/README b/examples/var_service/dhcp_if/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/dhcp_if/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/dhcp_if/dhcp_handler b/examples/var_service/dhcp_if/dhcp_handler
index 3d44a6022..6a97e8543 100755
--- a/examples/var_service/dhcp_if/dhcp_handler
+++ b/examples/var_service/dhcp_if/dhcp_handler
@@ -52,7 +52,7 @@ if test x"$1" != x"bound" && test x"$1" != x"renew" ; then
         rm "$file_ntpconf"
         rm "$dir_ipconf/$file_ipconf"
         rm "$dir_ntpconf/$file_ntpconf"
-        sv u /var/service/fw
+        svc -u fw
         exit
 fi
 
@@ -67,10 +67,10 @@ if test $? != 0; then
         echo "Reconfiguring fw"
         mkdir -p "$dir_ipconf" 2>/dev/null
         cp "$file_ipconf" "$dir_ipconf/$file_ipconf"
-        sv u /var/service/fw
+        svc -u fw
 fi
 
-if test -d /var/service/ntpd; then
+if test -d ../ntpd; then
         ./convert2ntpconf "$file_ntpconf"
         # Reconfigure ntp server addresses if needed
         diff --brief "$file_ntpconf" "$dir_ntpconf/$file_ntpconf" >/dev/null 2>&1
@@ -78,7 +78,7 @@ if test -d /var/service/ntpd; then
                 echo "Reconfiguring ntp"
                 mkdir -p "$dir_ntpconf" 2>/dev/null
                 cp "$file_ntpconf" "$dir_ntpconf/$file_ntpconf"
-                sv t /var/service/ntpd
-                sv u /var/service/ntpd
+                svc -t ntpd
+                svc -u ntpd
         fi
 fi
diff --git a/examples/var_service/dhcp_if/finish b/examples/var_service/dhcp_if/finish
index 5e7667a2d..8ce188336 100755
--- a/examples/var_service/dhcp_if/finish
+++ b/examples/var_service/dhcp_if/finish
@@ -14,4 +14,4 @@ rm "$file_ipconf"
 rm "$file_ntpconf"
 rm "$dir_ipconf/$file_ipconf"
 rm "$dir_ntpconf/$file_ntpconf"
-sv u /var/service/fw
+svc -u fw
diff --git a/examples/var_service/dhcp_if/log/run b/examples/var_service/dhcp_if/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/dhcp_if/log/run
+++ b/examples/var_service/dhcp_if/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/dhcp_if/p_log b/examples/var_service/dhcp_if/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/dhcp_if/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/dhcp_if/w_log b/examples/var_service/dhcp_if/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/dhcp_if/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/dhcp_if_pinger/README b/examples/var_service/dhcp_if_pinger/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/dhcp_if_pinger/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/dhcp_if_pinger/run b/examples/var_service/dhcp_if_pinger/run
index 8aca90c1a..25341243f 100755
--- a/examples/var_service/dhcp_if_pinger/run
+++ b/examples/var_service/dhcp_if_pinger/run
@@ -21,9 +21,9 @@ if test -f "$0.log"; then
         mv "$0.log.new" "$0.log"
 fi
 
-test -f "/var/service/dhcp_$if/env.out" || exec env - sleep "$ping_time"
+test -f "../dhcp_$if/env.out" || exec env - sleep "$ping_time"
 
-. "/var/service/dhcp_$if/env.out"
+. "../dhcp_$if/env.out"
 test x"$router" != x"" || exec env - sleep "$ping_time"
 
 #msg "Pinging $router"
@@ -36,12 +36,12 @@ while true; do
         env - sleep "$retry_time"
 done
 
-test -d "/var/service/dhcp_$if" && {
-        msg "Restarting /var/service/dhcp_$if"
-        sv t "/var/service/dhcp_$if"
+test -d "../dhcp_$if" && {
+        msg "Restarting dhcp_$if"
+        svc -t "dhcp_$if"
 }
-test -d "/var/service/supplicant_$if" && {
-        msg "Restarting /var/service/supplicant_$if"
-        sv t "/var/service/supplicant_$if"
+test -d "../supplicant_$if" && {
+        msg "Restarting supplicant_$if"
+        svc -t "supplicant_$if"
 }
 exec env - sleep "$ping_time"
diff --git a/examples/var_service/dhcpd_if/README b/examples/var_service/dhcpd_if/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/dhcpd_if/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/dhcpd_if/log/run b/examples/var_service/dhcpd_if/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/dhcpd_if/log/run
+++ b/examples/var_service/dhcpd_if/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/dhcpd_if/p_log b/examples/var_service/dhcpd_if/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/dhcpd_if/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/dhcpd_if/w_log b/examples/var_service/dhcpd_if/w_log
deleted file mode 100755
index dba76c69b..000000000
--- a/examples/var_service/dhcpd_if/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir
-watch -n1 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b0-$((w-2))'
diff --git a/examples/var_service/dnsmasq/log/run b/examples/var_service/dnsmasq/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/dnsmasq/log/run
+++ b/examples/var_service/dnsmasq/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/dnsmasq/p_log b/examples/var_service/dnsmasq/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/dnsmasq/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/dnsmasq/w_log b/examples/var_service/dnsmasq/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/dnsmasq/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/ftpd/README b/examples/var_service/ftpd/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/ftpd/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/ftpd/log/run b/examples/var_service/ftpd/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/ftpd/log/run
+++ b/examples/var_service/ftpd/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/ftpd/p_log b/examples/var_service/ftpd/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/ftpd/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/ftpd/w_log b/examples/var_service/ftpd/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/ftpd/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/fw/README b/examples/var_service/fw/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/fw/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/fw/etc/dnsmasq_servers.conf b/examples/var_service/fw/etc/dnsmasq_servers.conf
index 68313605f..c39fe6e43 100644
--- a/examples/var_service/fw/etc/dnsmasq_servers.conf
+++ b/examples/var_service/fw/etc/dnsmasq_servers.conf
@@ -35,4 +35,4 @@ $empty && echo "server=8.8.8.8"
 $empty && echo "server=8.8.4.4"
 
 # SIGHUP: make dnsmasq reload config
-sv h dnsmasq
+svc -h dnsmasq
diff --git a/examples/var_service/fw/run b/examples/var_service/fw/run
index 1fd71cc01..41078d0ab 100755
--- a/examples/var_service/fw/run
+++ b/examples/var_service/fw/run
@@ -8,7 +8,7 @@ extif="if"
 ext_open_tcp="22 80 88" # space-separated
 
 # Make ourself one-shot
-sv o .
+svc -o .
 # Debug
 #date '+%Y-%m-%d %H:%M:%S' >>"$0.log"
 
diff --git a/examples/var_service/getty_tty1/README b/examples/var_service/getty_tty1/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/getty_tty1/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/getty_tty1/cfg b/examples/var_service/getty_tty1/cfg
index 0f63e5233..ab973f738 100755
--- a/examples/var_service/getty_tty1/cfg
+++ b/examples/var_service/getty_tty1/cfg
@@ -10,7 +10,7 @@ ttyname=`tty`
 ttybase="${ttyname%%[0123456789]*}"     # strip numeric tail
 
 if test x"$ttybase" = x"/dev/vc/" -o x"$ttybase" = x"/dev/tty"; then
-        echo "* Activating Cyrillic KOI8-R -> CP866 font map"
+        echo "* Activating font map"
         echo -ne "\033(K" >"$ttyname"
 
         echo "* Loading screen font"
@@ -18,9 +18,9 @@ if test x"$ttybase" = x"/dev/vc/" -o x"$ttybase" = x"/dev/tty"; then
                 -C "$ttyname" \
                 -m "$PWD/koi8r_to_uni.trans" \
                 "$PWD/alt08x16+unimap.fnt" \
-        || echo "! setfont failure"
+        || echo "setfont exit code: $?"
 
         echo "* Loading keymap"
-        loadkeys "$PWD/ru_koi8r.keymap" \
-        || echo "! loadkeys failure"
+        loadkeys "$PWD/unicode_cyrillic.keymap" \
+        || echo "loadkeys exit code: $?"
 fi
diff --git a/examples/var_service/getty_tty1/login.sh b/examples/var_service/getty_tty1/login.sh
index d69b6fd55..f8b53fc03 100755
--- a/examples/var_service/getty_tty1/login.sh
+++ b/examples/var_service/getty_tty1/login.sh
@@ -6,7 +6,8 @@ ttybase="${ttyname%%[0123456789]*}"     # strip numeric tail
 if test "$ttybase" = "/dev/tty"; then
         tail="${ttyname:8}"
         echo "* Setting terminal device's owner to $LOGIN_UID:$LOGIN_GID"
-        chown "$LOGIN_UID:$LOGIN_GID" "/dev/vcs$tail" "/dev/vcsa$tail"
+        test -c "/dev/vcs$tail" && chown "$LOGIN_UID:$LOGIN_GID" "/dev/vcs$tail"
+        test -c "/dev/vcsa$tail" && chown "$LOGIN_UID:$LOGIN_GID" "/dev/vcsa$tail"
 fi
 # We can do this also, but login does it itself
 # chown "$LOGIN_UID:$LOGIN_GID" "$ttyname"
diff --git a/examples/var_service/getty_tty1/ru_koi8r.keymap b/examples/var_service/getty_tty1/ru_koi8r.keymap
deleted file mode 100644
index 6c811539c..000000000
--- a/examples/var_service/getty_tty1/ru_koi8r.keymap
+++ /dev/null
@@ -1,183 +0,0 @@
-keymaps 0,1, 2,3, 4,6, 8,10, 12,14
-#
-# This one is for generating koi8r Russian chars
-# Cyr/Lat switches:  RightAlt, Shift+Ctrl, Ctrl+Shift
-# (last one does not work for dark and obscure reasons 8( )
-#
-# plain,shift, plain,shift, ctrl,ctrl alt,alt ctrlalt,ctrlalt
-# lat--------  cyr--------  lat  cyr  lat cyr lat     cyr
-#
-#Shift                     1
-#AltGr (cyr)               2
-#Control                   4
-#Alt                       8
-#ShiftL                   16
-#ShiftR                   32
-#CtrlL                    64
-#CtrlR                   128
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode   1 =   Escape          Escape          Escape          Escape          Escape                  Escape                  Meta_Escape             Meta_Escape             SAK                     SAK
-keycode   2 =   one             exclam          one             exclam          exclam                  exclam                  Meta_one                Meta_one
-keycode   3 =   two             at              two             at              nul                     nul                     Meta_two                Meta_two
-keycode   4 =   three           numbersign      three           numbersign      three                   three                   Meta_three              Meta_three
-keycode   5 =   four            dollar          four            dollar          Control_backslash       Control_backslash       Meta_four               Meta_four
-keycode   6 =   five            percent         five            percent         Control_bracketright    Control_bracketright    Meta_five               Meta_five
-keycode   7 =   six             asciicircum     six             asciicircum     Control_asciicircum     Control_asciicircum     Meta_six                Meta_six
-keycode   8 =   seven           ampersand       seven           ampersand       Control_underscore      Control_underscore      Meta_seven              Meta_seven
-keycode   9 =   eight           asterisk        eight           asterisk        eight                   eight                   Meta_eight              Meta_eight
-keycode  10 =   nine            parenleft       nine            parenleft       nine                    nine                    Meta_nine               Meta_nine
-keycode  11 =   zero            parenright      zero            parenright      zero                    zero                    Meta_zero               Meta_zero
-keycode  12 =   minus           underscore      minus           underscore      Control_underscore      Control_underscore      Meta_minus              Meta_minus
-keycode  13 =   equal           plus            equal           plus            equal                   equal                   Meta_equal              Meta_equal
-keycode  14 =   Delete          Delete          Delete          Delete          BackSpace               BackSpace               Meta_Delete             Meta_Delete
-keycode  15 =   Tab             Tab             Tab             Tab             Tab                     Tab                     Meta_Tab                Meta_Tab
-keycode  16 =   q               Q               202             234             Control_q               Control_q               Meta_q                  Meta_q                  Meta_Control_q          Meta_Control_q
-keycode  17 =   w               W               195             227             Control_w               Control_w               Meta_w                  Meta_w                  Meta_Control_w          Meta_Control_w
-keycode  18 =   e               E               213             245             Control_e               Control_e               Meta_e                  Meta_e                  Meta_Control_e          Meta_Control_e
-keycode  19 =   r               R               203             235             Control_r               Control_r               Meta_r                  Meta_r                  Meta_Control_r          Meta_Control_r
-keycode  20 =   t               T               197             229             Control_t               Control_t               Meta_t                  Meta_t                  Meta_Control_t          Meta_Control_t
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode  21 =   y               Y               206             238             Control_y               Control_y               Meta_y                  Meta_y                  Meta_Control_y          Meta_Control_y
-keycode  22 =   u               U               199             231             Control_u               Control_u               Meta_u                  Meta_u                  Meta_Control_u          Meta_Control_u
-keycode  23 =   i               I               219             251             Control_i               Control_i               Meta_i                  Meta_i                  Meta_Control_i          Meta_Control_i
-keycode  24 =   o               O               221             253             Control_o               Control_o               Meta_o                  Meta_o                  Meta_Control_o          Meta_Control_o
-keycode  25 =   p               P               218             250             Control_p               Control_p               Meta_p                  Meta_p                  Meta_Control_p          Meta_Control_p
-keycode  26 =   bracketleft     braceleft       200             232             Escape                  Escape                  Meta_bracketleft        Meta_bracketleft
-keycode  27 =   bracketright    braceright      223             255             Control_bracketright    Control_bracketright
-keycode  28 =   Return
-# Shift+Ctrl - Cyrillic
-keycode  29 =   Control         AltGr_Lock      Control         AltGr_Lock      Control                 Control                 Control                 Control                 Control                 Control
-keycode  30 =   a               A               198             230             Control_a               Control_a               Meta_a                  Meta_a                  Meta_Control_a          Meta_Control_a
-keycode  31 =   s               S               217             249             Control_s               Control_s               Meta_s                  Meta_s                  Meta_Control_s          Meta_Control_s
-keycode  32 =   d               D               215             247             Control_d               Control_d               Meta_d                  Meta_d                  Meta_Control_d          Meta_Control_d
-keycode  33 =   f               F               193             225             Control_f               Control_f               Meta_f                  Meta_f                  Meta_Control_f          Meta_Control_f
-keycode  34 =   g               G               208             240             Control_g               Control_g               Meta_g                  Meta_g                  Meta_Control_g          Meta_Control_g
-keycode  35 =   h               H               210             242             Control_h               Control_h               Meta_h                  Meta_h                  Meta_Control_h          Meta_Control_h
-keycode  36 =   j               J               207             239             Control_j               Control_j               Meta_j                  Meta_j                  Meta_Control_j          Meta_Control_j
-keycode  37 =   k               K               204             236             Control_k               Control_k               Meta_k                  Meta_k                  Meta_Control_k          Meta_Control_k
-keycode  38 =   l               L               196             228             Control_l               Control_l               Meta_l                  Meta_l                  Meta_Control_l          Meta_Control_l
-keycode  39 =   semicolon       colon           214             246             semicolon               semicolon               Meta_semicolon          Meta_semicolon
-keycode  40 =   apostrophe      quotedbl        220             252             Control_g               Control_g               Meta_apostrophe         Meta_apostrophe
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode  41 =   grave           asciitilde      grave           asciitilde      nul                     nul                     Meta_grave              Meta_grave
-keycode  42 =   Shift
-keycode  43 =   backslash       bar             backslash       bar             Control_backslash       Control_backslash       Meta_backslash          Meta_backslash
-keycode  44 =   z               Z               209             241             Control_z               Control_z               Meta_z                  Meta_z                  Meta_Control_z          Meta_Control_z
-keycode  45 =   x               X               222             254             Control_x               Control_x               Meta_x                  Meta_x                  Meta_Control_x          Meta_Control_x
-keycode  46 =   c               C               211             243             Control_c               Control_c               Meta_c                  Meta_c                  Meta_Control_c          Meta_Control_c
-keycode  47 =   v               V               205             237             Control_v               Control_v               Meta_v                  Meta_v                  Meta_Control_v          Meta_Control_v
-keycode  48 =   b               B               201             233             Control_b               Control_b               Meta_b                  Meta_b                  Meta_Control_b          Meta_Control_b
-keycode  49 =   n               N               212             244             Control_n               Control_n               Meta_n                  Meta_n                  Meta_Control_n          Meta_Control_n
-keycode  50 =   m               M               216             248             Control_m               Control_m               Meta_m                  Meta_m                  Meta_Control_m          Meta_Control_m
-keycode  51 =   comma           less            194             226             comma                   comma                   Meta_comma              Meta_comma
-keycode  52 =   period          greater         192             224             Compose                 Compose                 Meta_period             Meta_period
-keycode  53 =   slash           question        slash           question        Delete                  Delete                  Meta_slash              Meta_slash              Meta_question           Meta_question
-# Ctrl+Shift - Cyrillic (not working???)
-keycode  54 =   Shift           Shift           Shift           Shift           AltGr_Lock              AltGr_Lock              Shift                   Shift                   Shift                   Shift
-keycode  55 =   KP_Multiply
-keycode  56 =   Alt
-keycode  57 =   space           space           space           space           nul                     nul                     Meta_space              Meta_space
-keycode  58 =   Caps_Lock
-keycode  59 =   F1              F11             F1              F11             F1                      F1                      Console_1               Console_1               Console_1               Console_1
-keycode  60 =   F2              F12             F2              F12             F2                      F2                      Console_2               Console_2               Console_2               Console_2
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode  61 =   F3              F13             F3              F13             F3                      F3                      Console_3               Console_3               Console_3               Console_3
-keycode  62 =   F4              F14             F4              F14             F4                      F4                      Console_4               Console_4               Console_4               Console_4
-keycode  63 =   F5              F15             F5              F15             F5                      F5                      Console_5               Console_5               Console_5               Console_5
-keycode  64 =   F6              F16             F6              F16             F6                      F6                      Console_6               Console_6               Console_6               Console_6
-keycode  65 =   F7              F17             F7              F17             F7                      F7                      Console_7               Console_7               Console_7               Console_7
-keycode  66 =   F8              F18             F8              F18             F8                      F8                      Console_8               Console_8               Console_8               Console_8
-keycode  67 =   F9              F19             F9              F19             F9                      F9                      Console_9               Console_9               Console_9               Console_9
-keycode  68 =   F10             F20             F10             F20             F10                     F10                     Console_10              Console_10              Console_10              Console_10
-keycode  69 =   Num_Lock        Bare_Num_Lock   Num_Lock        Bare_Num_Lock
-keycode  70 =   Scroll_Lock     Show_Memory     Scroll_Lock     Show_Memory     Show_State              Show_State
-keycode  71 =   KP_7            KP_7            KP_7            KP_7            KP_7                    KP_7                    Ascii_7                 Ascii_7
-keycode  72 =   KP_8            KP_8            KP_8            KP_8            KP_8                    KP_8                    Ascii_8                 Ascii_8
-keycode  73 =   KP_9            KP_9            KP_9            KP_9            KP_9                    KP_9                    Ascii_9                 Ascii_9
-keycode  74 =   KP_Subtract     KP_Subtract     KP_Subtract     KP_Subtract     KP_Subtract             KP_Subtract             KP_Subtract             KP_Subtract
-keycode  75 =   KP_4            KP_4            KP_4            KP_4            KP_4                    KP_4                    Ascii_4                 Ascii_4
-keycode  76 =   KP_5            KP_5            KP_5            KP_5            KP_5                    KP_5                    Ascii_5                 Ascii_5
-keycode  77 =   KP_6            KP_6            KP_6            KP_6            KP_6                    KP_6                    Ascii_6                 Ascii_6
-keycode  78 =   KP_Add          KP_Add          KP_Add          KP_Add          KP_Add                  KP_Add                  KP_Add                  KP_Add
-keycode  79 =   KP_1            KP_1            KP_1            KP_1            KP_1                    KP_1                    Ascii_1                 Ascii_1
-keycode  80 =   KP_2            KP_2            KP_2            KP_2            KP_2                    KP_2                    Ascii_2                 Ascii_2
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode  81 =   KP_3            KP_3            KP_3            KP_3            KP_3                    KP_3                    Ascii_3                 Ascii_3
-keycode  82 =   KP_0            KP_0            KP_0            KP_0            KP_0                    KP_0                    Ascii_0                 Ascii_0
-keycode  83 =   KP_Period       KP_Period       KP_Period       KP_Period       KP_Period               KP_Period               KP_Period               KP_Period               Boot                    Boot
-keycode  84 =   Last_Console
-keycode  85 =
-keycode  86 =   less            greater         less            greater         less                    less                    Meta_less               Meta_less
-keycode  87 =   F11             F11             F11             F11             F11                     F11                     Console_11              Console_11              Console_11              Console_11
-keycode  88 =   F12             F12             F12             F12             F12                     F12                     Console_12              Console_12              Console_12              Console_12
-keycode  89 =
-keycode  90 =
-keycode  91 =
-keycode  92 =
-keycode  93 =
-keycode  94 =
-keycode  95 =
-keycode  96 =   KP_Enter
-keycode  97 =   Control
-keycode  98 =   KP_Divide
-keycode  99 =   Control_backslash
-# Right Alt - Cyrillic
-keycode 100 =   AltGr_Lock
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode 101 =   Break
-keycode 102 =   Find
-keycode 103 =   Up
-keycode 104 =   Prior           Scroll_Backward Prior           Scroll_Backward Prior                   Prior                   Prior                   Prior                   Prior                   Prior
-keycode 105 =   Left            Left            Left            Left            Left                    Left                    Left                    Left                    Decr_Console            Decr_Console
-keycode 106 =   Right           Right           Right           Right           Right                   Right                   Right                   Right                   Incr_Console            Incr_Console
-keycode 107 =   Select
-keycode 108 =   Down
-keycode 109 =   Next            Scroll_Forward  Next            Scroll_Forward  Next                    Next                    Next                    Next                    Next                    Next
-keycode 110 =   Insert
-keycode 111 =   Remove          Remove          Remove          Remove          Remove                  Remove                  Remove                  Remove                  Boot                    Boot
-keycode 112 =   Macro
-keycode 113 =   F13
-keycode 114 =   F14
-keycode 115 =   Help
-keycode 116 =   Do
-keycode 117 =   F17
-keycode 118 =   KP_MinPlus
-keycode 119 =   Pause
-keycode 120 =
-#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
-keycode 121 =
-keycode 122 =
-keycode 123 =
-keycode 124 =
-keycode 125 =
-keycode 126 =
-keycode 127 =
-
-string F1 = "\033[[A"
-string F2 = "\033[[B"
-string F3 = "\033[[C"
-string F4 = "\033[[D"
-string F5 = "\033[[E"
-string F6 = "\033[17~"
-string F7 = "\033[18~"
-string F8 = "\033[19~"
-string F9 = "\033[20~"
-string F10 = "\033[21~"
-string F11 = "\033[23~"
-string F12 = "\033[24~"
-string F13 = "\033[25~"
-string F14 = "\033[26~"
-string F15 = "\033[28~"
-string F16 = "\033[29~"
-string F17 = "\033[31~"
-string F18 = "\033[32~"
-string F19 = "\033[33~"
-string F20 = "\033[34~"
-string Find = "\033[1~"
-string Insert = "\033[2~"
-string Remove = "\033[3~"
-string Select = "\033[4~"
-string Prior = "\033[5~"
-string Next = "\033[6~"
-string Macro = "\033[M"
-string Pause = "\033[P"
diff --git a/examples/var_service/getty_tty1/run b/examples/var_service/getty_tty1/run
index c7c413ba4..c5b291b4d 100755
--- a/examples/var_service/getty_tty1/run
+++ b/examples/var_service/getty_tty1/run
@@ -1,9 +1,5 @@
 #!/bin/sh
 
-exec >/dev/null
-exec 2>&1
-exec </dev/null
-
 user=root
 baud=38400
 delay=3
@@ -25,6 +21,4 @@ test -x ./cfg && . ./cfg
 
 exec \
 env - "TERM=$TERM" PATH="$PATH" LOGIN_PRE_SUID_SCRIPT="$PWD/login.sh" \
-softlimit \
-setuidgid "$user" \
 getty "$baud" "$tty" "$TERM"
diff --git a/examples/var_service/getty_tty1/unicode_cyrillic.keymap b/examples/var_service/getty_tty1/unicode_cyrillic.keymap
new file mode 100644
index 000000000..49911cd10
--- /dev/null
+++ b/examples/var_service/getty_tty1/unicode_cyrillic.keymap
@@ -0,0 +1,200 @@
+keymaps 0,1, 2,3, 4,6, 8,9, 10,11, 12,14
+#
+# This one is for generating Unicode Curillic chars
+# Cyr/Lat switches: RightAlt, Shift+Ctrl, Ctrl+Shift, Win keys
+#
+# plain,shift, plain,shift, ctrl,ctrl alt,shiftalt alt,shiftalt ctrlalt,ctrlalt
+# lat--------  cyr--------  lat  cyr  lat--------- cyr--------- lat     cyr
+#
+#Shift                     1
+#AltGr (cyr)               2
+#Control                   4
+#Alt                       8
+#ShiftL                   16
+#ShiftR                   32
+#CtrlL                    64
+#CtrlR                   128
+
+# L/R Ctrl: Shift+Ctrl - Cyrillic
+keycode  29 =   Control         AltGr_Lock      Control         AltGr_Lock      Control                 Control                 Control                 Control                 Control                 Control                 Control                 Control
+keycode  97 =   Control         AltGr_Lock      Control         AltGr_Lock      Control                 Control                 Control                 Control                 Control                 Control                 Control                 Control
+# L/R Shift: Ctrl+Shift - Cyrillic
+keycode  42 =   Shift           Shift           Shift           Shift           AltGr_Lock              AltGr_Lock              Shift                   Shift                   Shift                   Shift                   Shift                   Shift
+keycode  54 =   Shift           Shift           Shift           Shift           AltGr_Lock              AltGr_Lock              Shift                   Shift                   Shift                   Shift                   Shift                   Shift
+# Right Alt: Cyrillic
+keycode 100 =   AltGr_Lock
+# L/R Win: Cyrillic
+keycode 125 =   AltGr_Lock
+keycode 126 =   AltGr_Lock
+
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt shift ============= alt cyr =============== alt shift cur ========= ctrlalt =============== ctrlalt cyr ===========
+keycode   1 =   Escape          Escape          Escape          Escape          Escape                  Escape                  Meta_Escape             Meta_Escape             Meta_Escape             Meta_Escape             SAK                     SAK
+keycode   2 =   one             exclam          one             exclam          exclam                  exclam                  Meta_one                Meta_one                Meta_one                Meta_one
+keycode   3 =   two             at              two             at              nul                     nul                     Meta_two                Meta_two                Meta_two                Meta_two
+keycode   4 =   three           numbersign      three           numbersign      three                   three                   Meta_three              Meta_three              Meta_three              Meta_three
+keycode   5 =   four            dollar          four            dollar          Control_backslash       Control_backslash       Meta_four               Meta_four               Meta_four               Meta_four
+keycode   6 =   five            percent         five            percent         Control_bracketright    Control_bracketright    Meta_five               Meta_five               Meta_five               Meta_five
+keycode   7 =   six             asciicircum     six             asciicircum     Control_asciicircum     Control_asciicircum     Meta_six                Meta_six                Meta_six                Meta_six
+keycode   8 =   seven           ampersand       seven           ampersand       Control_underscore      Control_underscore      Meta_seven              Meta_seven              Meta_seven              Meta_seven
+keycode   9 =   eight           asterisk        eight           asterisk        eight                   eight                   Meta_eight              Meta_eight              Meta_eight              Meta_eight
+keycode  10 =   nine            parenleft       nine            parenleft       nine                    nine                    Meta_nine               Meta_nine               Meta_nine               Meta_nine
+keycode  11 =   zero            parenright      zero            parenright      zero                    zero                    Meta_zero               Meta_zero               Meta_zero               Meta_zero
+keycode  12 =   minus           underscore      minus           underscore      Control_underscore      Control_underscore      Meta_minus              Meta_minus              Meta_minus              Meta_minus
+keycode  13 =   equal           plus            equal           plus            equal                   equal                   Meta_equal              Meta_equal              Meta_equal              Meta_equal
+keycode  14 =   Delete          Delete          Delete          Delete          BackSpace               BackSpace               Meta_Delete             Meta_Delete             Meta_Delete             Meta_Delete
+keycode  15 =   Tab             Tab             Tab             Tab             Tab                     Tab                     Meta_Tab                Meta_Tab                Meta_Tab                Meta_Tab
+keycode  16 =   +q              +Q              +U+0439         +U+0419         Control_q               Control_q               Meta_q                  Meta_q                  Meta_q                  Meta_q                  Meta_Control_q          Meta_Control_q
+keycode  17 =   +w              +W              +U+0446         +U+0426         Control_w               Control_w               Meta_w                  Meta_w                  Meta_w                  Meta_w                  Meta_Control_w          Meta_Control_w
+keycode  18 =   +e              +E              +U+0443         +U+0423         Control_e               Control_e               Meta_e                  Meta_e                  Meta_e                  Meta_e                  Meta_Control_e          Meta_Control_e
+keycode  19 =   +r              +R              +U+043a         +U+041a         Control_r               Control_r               Meta_r                  Meta_r                  Meta_r                  Meta_r                  Meta_Control_r          Meta_Control_r
+keycode  20 =   +t              +T              +U+0435         +U+0415         Control_t               Control_t               Meta_t                  Meta_t                  Meta_t                  Meta_t                  Meta_Control_t          Meta_Control_t
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt =================== alt cyr =============== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
+keycode  21 =   +y              +Y              +U+043d         +U+041d         Control_y               Control_y               Meta_y                  Meta_y                  Meta_y                  Meta_y                  Meta_Control_y          Meta_Control_y
+keycode  22 =   +u              +U              +U+0433         +U+0413         Control_u               Control_u               Meta_u                  Meta_u                  Meta_u                  Meta_u                  Meta_Control_u          Meta_Control_u
+keycode  23 =   +i              +I              +U+0448         +U+0428         Control_i               Control_i               Meta_i                  Meta_i                  Meta_i                  Meta_i                  Meta_Control_i          Meta_Control_i
+keycode  24 =   +o              +O              +U+0449         +U+0429         Control_o               Control_o               Meta_o                  Meta_o                  Meta_o                  Meta_o                  Meta_Control_o          Meta_Control_o
+keycode  25 =   +p              +P              +U+0437         +U+0417         Control_p               Control_p               Meta_p                  Meta_p                  Meta_p                  Meta_p                  Meta_Control_p          Meta_Control_p
+keycode  26 =   bracketleft     braceleft       +U+0445         +U+0425         Escape                  Escape                  Meta_bracketleft        Meta_bracketleft        Meta_bracketleft        Meta_bracketleft
+keycode  27 =   bracketright    braceright      +U+044a         +U+042a         Control_bracketright    Control_bracketright
+keycode  28 =   Return
+# LCtrl
+#keycode  29 =
+keycode  30 =   +a              +A              +U+0444         +U+0424         Control_a               Control_a               Meta_a                  Meta_a                  Meta_a                  Meta_a                  Meta_Control_a          Meta_Control_a
+keycode  31 =   +s              +S              +U+044b         +U+042b         Control_s               Control_s               Meta_s                  Meta_s                  Meta_s                  Meta_s                  Meta_Control_s          Meta_Control_s
+keycode  32 =   +d              +D              +U+0432         +U+0412         Control_d               Control_d               Meta_d                  Meta_d                  Meta_d                  Meta_d                  Meta_Control_d          Meta_Control_d
+keycode  33 =   +f              +F              +U+0430         +U+0410         Control_f               Control_f               Meta_f                  Meta_f                  Meta_f                  Meta_f                  Meta_Control_f          Meta_Control_f
+keycode  34 =   +g              +G              +U+043f         +U+041f         Control_g               Control_g               Meta_g                  Meta_g                  Meta_g                  Meta_g                  Meta_Control_g          Meta_Control_g
+keycode  35 =   +h              +H              +U+0440         +U+0420         Control_h               Control_h               Meta_h                  Meta_h                  Meta_h                  Meta_h                  Meta_Control_h          Meta_Control_h
+keycode  36 =   +j              +J              +U+043e         +U+041e         Control_j               Control_j               Meta_j                  Meta_j                  Meta_j                  Meta_j                  Meta_Control_j          Meta_Control_j
+keycode  37 =   +k              +K              +U+043b         +U+041b         Control_k               Control_k               Meta_k                  Meta_k                  Meta_k                  Meta_k                  Meta_Control_k          Meta_Control_k
+keycode  38 =   +l              +L              +U+0434         +U+0414         Control_l               Control_l               Meta_l                  Meta_l                  Meta_l                  Meta_l                  Meta_Control_l          Meta_Control_l
+keycode  39 =   semicolon       colon           +U+0436         +U+0416         semicolon               semicolon               Meta_semicolon          Meta_semicolon          Meta_semicolon          Meta_semicolon
+keycode  40 =   apostrophe      quotedbl        +U+044d         +U+042d         Control_g               Control_g               Meta_apostrophe         Meta_apostrophe         Meta_apostrophe         Meta_apostrophe
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt =================== alt cyr =============== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
+keycode  41 =   grave           asciitilde      grave           asciitilde      nul                     nul                     Meta_grave              Meta_grave              Meta_grave              Meta_grave
+# LShift
+#keycode  42 =
+keycode  43 =   backslash       bar             backslash       bar             Control_backslash       Control_backslash       Meta_backslash          Meta_backslash          Meta_backslash          Meta_backslash
+keycode  44 =   +z              +Z              +U+044f         +U+042f         Control_z               Control_z               Meta_z                  Meta_z                  Meta_z                  Meta_z                  Meta_Control_z          Meta_Control_z
+keycode  45 =   +x              +X              +U+0447         +U+0427         Control_x               Control_x               Meta_x                  Meta_x                  Meta_x                  Meta_x                  Meta_Control_x          Meta_Control_x
+keycode  46 =   +c              +C              +U+0441         +U+0421         Control_c               Control_c               Meta_c                  Meta_c                  Meta_c                  Meta_c                  Meta_Control_c          Meta_Control_c
+keycode  47 =   +v              +V              +U+043c         +U+041c         Control_v               Control_v               Meta_v                  Meta_v                  Meta_v                  Meta_v                  Meta_Control_v          Meta_Control_v
+keycode  48 =   +b              +B              +U+0438         +U+0418         Control_b               Control_b               Meta_b                  Meta_b                  Meta_b                  Meta_b                  Meta_Control_b          Meta_Control_b
+keycode  49 =   +n              +N              +U+0442         +U+0422         Control_n               Control_n               Meta_n                  Meta_n                  Meta_n                  Meta_n                  Meta_Control_n          Meta_Control_n
+keycode  50 =   +m              +M              +U+044c         +U+042c         Control_m               Control_m               Meta_m                  Meta_m                  Meta_m                  Meta_m                  Meta_Control_m          Meta_Control_m
+keycode  51 =   comma           less            +U+0431         +U+0411         comma                   comma                   Meta_comma              Meta_comma              Meta_comma              Meta_comma
+keycode  52 =   period          greater         +U+044e         +U+042e         Compose                 Compose                 Meta_period             Meta_period             Meta_period             Meta_period
+keycode  53 =   slash           question        slash           question        Delete                  Delete                  Meta_slash              Meta_question           Meta_slash              Meta_question           Meta_question           Meta_question
+# RShift
+#keycode  54 =
+keycode  55 =   KP_Multiply
+keycode  56 =   Alt
+keycode  57 =   space           space           space           space           nul                     nul                     Meta_space              Meta_space              Meta_space              Meta_space
+keycode  58 =   Caps_Lock
+keycode  59 =   F1              F11             F1              F11             F1                      F1                      Console_1               Console_1               Console_1               Console_1               Console_1               Console_1
+keycode  60 =   F2              F12             F2              F12             F2                      F2                      Console_2               Console_2               Console_2               Console_2               Console_2               Console_2
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt =================== alt cyr =============== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
+keycode  61 =   F3              F13             F3              F13             F3                      F3                      Console_3               Console_3               Console_3               Console_3               Console_3               Console_3
+keycode  62 =   F4              F14             F4              F14             F4                      F4                      Console_4               Console_4               Console_4               Console_4               Console_4               Console_4
+keycode  63 =   F5              F15             F5              F15             F5                      F5                      Console_5               Console_5               Console_5               Console_5               Console_5               Console_5
+keycode  64 =   F6              F16             F6              F16             F6                      F6                      Console_6               Console_6               Console_6               Console_6               Console_6               Console_6
+keycode  65 =   F7              F17             F7              F17             F7                      F7                      Console_7               Console_7               Console_7               Console_7               Console_7               Console_7
+keycode  66 =   F8              F18             F8              F18             F8                      F8                      Console_8               Console_8               Console_8               Console_8               Console_8               Console_8
+keycode  67 =   F9              F19             F9              F19             F9                      F9                      Console_9               Console_9               Console_9               Console_9               Console_9               Console_9
+keycode  68 =   F10             F20             F10             F20             F10                     F10                     Console_10              Console_10              Console_10              Console_10              Console_10              Console_10
+keycode  69 =   Num_Lock        Bare_Num_Lock   Num_Lock        Bare_Num_Lock
+keycode  70 =   Scroll_Lock     Show_Memory     Scroll_Lock     Show_Memory     Show_State              Show_State
+keycode  71 =   KP_7            KP_7            KP_7            KP_7            KP_7                    KP_7                    Ascii_7                 Ascii_7                 Ascii_7                 Ascii_7
+keycode  72 =   KP_8            KP_8            KP_8            KP_8            KP_8                    KP_8                    Ascii_8                 Ascii_8                 Ascii_8                 Ascii_8
+keycode  73 =   KP_9            KP_9            KP_9            KP_9            KP_9                    KP_9                    Ascii_9                 Ascii_9                 Ascii_9                 Ascii_9
+keycode  74 =   KP_Subtract     KP_Subtract     KP_Subtract     KP_Subtract     KP_Subtract             KP_Subtract             KP_Subtract             KP_Subtract             KP_Subtract             KP_Subtract
+keycode  75 =   KP_4            KP_4            KP_4            KP_4            KP_4                    KP_4                    Ascii_4                 Ascii_4                 Ascii_4                 Ascii_4
+keycode  76 =   KP_5            KP_5            KP_5            KP_5            KP_5                    KP_5                    Ascii_5                 Ascii_5                 Ascii_5                 Ascii_5
+keycode  77 =   KP_6            KP_6            KP_6            KP_6            KP_6                    KP_6                    Ascii_6                 Ascii_6                 Ascii_6                 Ascii_6
+keycode  78 =   KP_Add          KP_Add          KP_Add          KP_Add          KP_Add                  KP_Add                  KP_Add                  KP_Add                  KP_Add                  KP_Add
+keycode  79 =   KP_1            KP_1            KP_1            KP_1            KP_1                    KP_1                    Ascii_1                 Ascii_1                 Ascii_1                 Ascii_1
+keycode  80 =   KP_2            KP_2            KP_2            KP_2            KP_2                    KP_2                    Ascii_2                 Ascii_2                 Ascii_2                 Ascii_2
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt =================== alt cyr =============== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
+keycode  81 =   KP_3            KP_3            KP_3            KP_3            KP_3                    KP_3                    Ascii_3                 Ascii_3                 Ascii_3                 Ascii_3
+keycode  82 =   KP_0            KP_0            KP_0            KP_0            KP_0                    KP_0                    Ascii_0                 Ascii_0                 Ascii_0                 Ascii_0
+keycode  83 =   KP_Period       KP_Period       KP_Period       KP_Period       KP_Period               KP_Period               KP_Period               KP_Period               KP_Period               KP_Period               Boot                    Boot
+keycode  84 =   Last_Console
+keycode  85 =
+keycode  86 =   less            greater         less            greater         less                    less                    Meta_less               Meta_less               Meta_less               Meta_less
+keycode  87 =   F11             F11             F11             F11             F11                     F11                     Console_11              Console_11              Console_11              Console_11              Console_11              Console_11
+keycode  88 =   F12             F12             F12             F12             F12                     F12                     Console_12              Console_12              Console_12              Console_12              Console_12              Console_12
+keycode  89 =
+keycode  90 =
+keycode  91 =
+keycode  92 =
+keycode  93 =
+keycode  94 =
+keycode  95 =
+keycode  96 =   KP_Enter
+# RControl
+#keycode  97 =
+keycode  98 =   KP_Divide
+keycode  99 =   Control_backslash
+# RAlt
+#keycode 100 =
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt shift ============= alt cyr =============== alt shift cyr ========= ctrlalt =============== ctrlalt cyr ===========
+keycode 101 =   Break
+keycode 102 =   Find
+keycode 103 =   Up
+keycode 104 =   Prior           Scroll_Backward Prior           Scroll_Backward Prior                   Prior                   Prior                   Prior                   Prior                   Prior                   Prior                   Prior
+keycode 105 =   Left            Left            Left            Left            Left                    Left                    Left                    Left                    Left                    Left                    Decr_Console            Decr_Console
+keycode 106 =   Right           Right           Right           Right           Right                   Right                   Right                   Right                   Right                   Right                   Incr_Console            Incr_Console
+keycode 107 =   Select
+keycode 108 =   Down
+keycode 109 =   Next            Scroll_Forward  Next            Scroll_Forward  Next                    Next                    Next                    Next                    Next                    Next                    Next                    Next
+keycode 110 =   Insert
+keycode 111 =   Remove          Remove          Remove          Remove          Remove                  Remove                  Remove                  Remove                  Remove                  Remove                  Boot                    Boot
+keycode 112 =   Macro
+keycode 113 =   F13
+keycode 114 =   F14
+keycode 115 =   Help
+keycode 116 =   Do
+keycode 117 =   F17
+keycode 118 =   KP_MinPlus
+keycode 119 =   Pause
+keycode 120 =
+#============== plain ========= shift========== plain cyr ===== shift cyr ===== ctrl ================== ctrl cyr ============== alt =================== alt =================== alt cyr =============== alt cyr =============== ctrlalt =============== ctrlalt cyr ===========
+keycode 121 =
+keycode 122 =
+keycode 123 =
+keycode 124 =
+# LWin
+#keycode 125 =
+# RWin
+#keycode 126 =
+# RMenu
+keycode 127 =
+
+string F1 = "\033[[A"
+string F2 = "\033[[B"
+string F3 = "\033[[C"
+string F4 = "\033[[D"
+string F5 = "\033[[E"
+string F6 = "\033[17~"
+string F7 = "\033[18~"
+string F8 = "\033[19~"
+string F9 = "\033[20~"
+string F10 = "\033[21~"
+string F11 = "\033[23~"
+string F12 = "\033[24~"
+string F13 = "\033[25~"
+string F14 = "\033[26~"
+string F15 = "\033[28~"
+string F16 = "\033[29~"
+string F17 = "\033[31~"
+string F18 = "\033[32~"
+string F19 = "\033[33~"
+string F20 = "\033[34~"
+string Find = "\033[1~"
+string Insert = "\033[2~"
+string Remove = "\033[3~"
+string Select = "\033[4~"
+string Prior = "\033[5~"
+string Next = "\033[6~"
+string Macro = "\033[M"
+string Pause = "\033[P"
diff --git a/examples/var_service/gpm/README b/examples/var_service/gpm/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/gpm/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/httpd/README b/examples/var_service/httpd/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/httpd/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/httpd/log/run b/examples/var_service/httpd/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/httpd/log/run
+++ b/examples/var_service/httpd/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/httpd/p_log b/examples/var_service/httpd/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/httpd/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/httpd/w_log b/examples/var_service/httpd/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/httpd/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/ifplugd_if/README b/examples/var_service/ifplugd_if/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/ifplugd_if/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/ifplugd_if/ifplugd_handler b/examples/var_service/ifplugd_if/ifplugd_handler
index 4962fcf98..0749019f1 100755
--- a/examples/var_service/ifplugd_if/ifplugd_handler
+++ b/examples/var_service/ifplugd_if/ifplugd_handler
@@ -3,13 +3,18 @@
 # $1: interface
 # $2: state
 
-if test -d "/var/service/dhcp_$1"; then
-        if test x"$2" = x"down"; then
-                echo "Downing /var/service/dhcp_$1"
-                sv d "/var/service/dhcp_$1"
-        fi
-        if test x"$2" = x"up"; then
-                echo "Upping /var/service/dhcp_$1"
-                sv u "/var/service/dhcp_$1"
-        fi
+if test x"$2" = x"down"; then
+        echo "Downing dhcp_$1"
+        svc -d "dhcp_$1"
+        echo "Downing zcip_$1"
+        svc -d "zcip_$1"
 fi
+if test x"$2" = x"up"; then
+        echo "Upping dhcp_$1"
+        svc -u "dhcp_$1"
+        echo "Upping zcip_$1"
+        svc -u "zcip_$1"
+fi
+# Parent ifplugd exits if we exit with nonzero.
+# Do not startle it:
+exit 0
diff --git a/examples/var_service/ifplugd_if/log/run b/examples/var_service/ifplugd_if/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/ifplugd_if/log/run
+++ b/examples/var_service/ifplugd_if/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/ifplugd_if/p_log b/examples/var_service/ifplugd_if/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/ifplugd_if/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/ifplugd_if/w_log b/examples/var_service/ifplugd_if/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/ifplugd_if/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/inetd/README b/examples/var_service/inetd/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/inetd/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/inetd/log/run b/examples/var_service/inetd/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/inetd/log/run
+++ b/examples/var_service/inetd/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/inetd/p_log b/examples/var_service/inetd/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/inetd/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/inetd/w_log b/examples/var_service/inetd/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/inetd/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/nmeter/README b/examples/var_service/nmeter/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/nmeter/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/ntpd/README b/examples/var_service/ntpd/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/ntpd/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/ntpd/log/run b/examples/var_service/ntpd/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/ntpd/log/run
+++ b/examples/var_service/ntpd/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/ntpd/p_log b/examples/var_service/ntpd/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/ntpd/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/ntpd/run b/examples/var_service/ntpd/run
index 6f2a68188..5c90aad41 100755
--- a/examples/var_service/ntpd/run
+++ b/examples/var_service/ntpd/run
@@ -6,12 +6,22 @@ exec 2>&1
 exec </dev/null
 
 user=root
+start_delay=15
+net_down_delay=5
 pool="us.pool.ntp.org" # replace "us" with your country code
 
 service="${PWD##*/}"
 rundir="/var/run/service/$service"
 default_p_opt="-p 0.$pool -p 1.$pool -p 2.$pool -p 3.$pool"
 
+echo "* Checking network"
+test -f /var/run/service/fw/up || exec sleep $net_down_delay
+
+# With multiple interfaces (e.g. wired+wireless) going up,
+# networking scripts may restart ntpd service several times
+# in quick succession. Do not be too eager to start sending
+# NTP requests:
+sleep $start_delay
 
 # Make sure rundir/ exists
 mkdir -p "$rundir" 2>/dev/null
@@ -20,30 +30,25 @@ chmod -R a=rX "$rundir"
 rm -rf rundir 2>/dev/null
 ln -s "$rundir" rundir
 
-
-echo "* Checking network"
-test -f /var/run/service/fw/up || exec sleep 7
-sleep 5  # to let it settle
-
 # Grab config from dhcp
 cfg=-1
 for f in rundir/*.ntpconf; do
-        test -f "$f" || continue
-        . "$f"
+        test -f "$f" || continue
+        . "$f"
 done
 
 # Select peers
 p_opt=""
 cfg=0
 while test x"${ntpip[$cfg]}" != x""; do
-        p_opt="$p_opt -p ${ntpip[$cfg]}"
-        let cfg=cfg+1
+        p_opt="$p_opt -p ${ntpip[$cfg]}"
+        let cfg=cfg+1
 done
 test x"$p_opt" == x"" && p_opt="$default_p_opt"
 
 if test x"$p_opt" == x""; then
         echo "* No NTP peers configured, stopping"
-        sv o .
+        svc -o .
         exec sleep 1
 fi
 
diff --git a/examples/var_service/ntpd/w_log b/examples/var_service/ntpd/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/ntpd/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/std_service_logger b/examples/var_service/std_service_logger
new file mode 100755
index 000000000..ee68ad12b
--- /dev/null
+++ b/examples/var_service/std_service_logger
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+user=logger
+
+exec >/dev/null 2>&1
+
+service="${PWD%/log}"
+service="${service##*/}"
+logdir="/var/log/service/$service"
+
+mkdir -p "$logdir"
+chown -R "$user": "$logdir"
+chmod -R go-rwxst,u+rwX "$logdir"
+# TODO: if "$logdir/config" does not exist,
+# based on service's preferences, write some setup in it:
+# e.g. smaller nNUM directive ("I'm not that important,
+# save 2 rather than default 10 one-megabyte log files")
+
+# Convenience symlink in this log/ directory:
+rm logdir
+ln -s "$logdir" logdir
+
+# Make current dir accessible to logger:
+chmod a+rX .
+
+args=""
+test "$LOG_NOTIMESTAMP" || args="-tt"
+
+exec \
+env - PATH="$PATH" \
+chpst -u "$user" -m $((20 * 1024*1024)) \
+svlogd $args "$logdir"
diff --git a/examples/var_service/supplicant_if/README b/examples/var_service/supplicant_if/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/supplicant_if/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/supplicant_if/log/run b/examples/var_service/supplicant_if/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/supplicant_if/log/run
+++ b/examples/var_service/supplicant_if/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/supplicant_if/p_log b/examples/var_service/supplicant_if/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/supplicant_if/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/supplicant_if/w_log b/examples/var_service/supplicant_if/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/supplicant_if/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/sview b/examples/var_service/sview
new file mode 100755
index 000000000..716c1079c
--- /dev/null
+++ b/examples/var_service/sview
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+test "$1" || {
+        echo "Syntax: ${0##*/} SERVICE"
+        exit 1
+}
+
+test x"$1" = x"${1#*/}" -a x"$1" != x"." && {
+        # has no slashes and is not a "."
+        cd "/var/service/$1" || exit $?
+        set -- "."
+}
+
+test -x "$1/view" && exec "$1/view"
+
+cd "log/logdir" || exit $?
+
+h=`ttysize h`
+exec tail -n $((h-1)) -F current 2>&1
diff --git a/examples/var_service/svpage b/examples/var_service/svpage
new file mode 100755
index 000000000..31c3d6dd7
--- /dev/null
+++ b/examples/var_service/svpage
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+test "$1" || {
+        echo "Syntax: ${0##*/} SERVICE"
+        exit 1
+}
+
+test x"$1" = x"${1#*/}" -a x"$1" != x"." && {
+        # has no slashes and is not a "."
+        cd "/var/service/$1" || exit $?
+        set -- "."
+}
+
+test -x "$1/page" && exec "$1/page"
+
+cd "log/logdir" || exit $?
+
+test "$PAGER" || PAGER=less
+cat @* current | $PAGER
diff --git a/examples/var_service/tftpd/README b/examples/var_service/tftpd/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/tftpd/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/tftpd/log/run b/examples/var_service/tftpd/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/tftpd/log/run
+++ b/examples/var_service/tftpd/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/tftpd/p_log b/examples/var_service/tftpd/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/tftpd/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/tftpd/w_log b/examples/var_service/tftpd/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/tftpd/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/zcip_if/README b/examples/var_service/zcip_if/README
deleted file mode 100644
index 4ddccb22d..000000000
--- a/examples/var_service/zcip_if/README
+++ /dev/null
@@ -1,5 +0,0 @@
-The real README file is one directory up.
-
-This directory's run script can have useful comments.
-If it doesn't but you feel it should, please send a patch
-to busybox's mailing list.
diff --git a/examples/var_service/zcip_if/finish b/examples/var_service/zcip_if/finish
index 95995cf5f..7955cf3b8 100755
--- a/examples/var_service/zcip_if/finish
+++ b/examples/var_service/zcip_if/finish
@@ -1,5 +1,5 @@
 #!/bin/sh
-# executed when service is taken down ("sv d .")
+# executed when service is taken down
 
 service=${PWD##*/}
 file_ipconf="$service.ipconf"
@@ -10,4 +10,4 @@ echo "Finish: deconfiguring"
 rm "env.out"
 rm "$file_ipconf"
 rm "$dir_ipconf/$file_ipconf"
-sv u /var/service/fw
+svc -u fw
diff --git a/examples/var_service/zcip_if/log/run b/examples/var_service/zcip_if/log/run
index 69d74b73f..756be4e7e 100755
--- a/examples/var_service/zcip_if/log/run
+++ b/examples/var_service/zcip_if/log/run
@@ -1,21 +1,2 @@
 #!/bin/sh
-
-user=logger
-
-logdir="/var/log/service/`(cd ..;basename $PWD)`"
-mkdir -p "$logdir" 2>/dev/null
-chown -R "$user": "$logdir"
-chmod -R go-rwxst,u+rwX "$logdir"
-rm -rf logdir
-ln -s "$logdir" logdir
-
-# make this dir accessible to logger
-chmod a+rX .
-
-exec >/dev/null
-exec 2>&1
-exec \
-env - PATH="$PATH" \
-softlimit \
-setuidgid "$user" \
-svlogd -tt "$logdir"
+exec std_service_logger
diff --git a/examples/var_service/zcip_if/p_log b/examples/var_service/zcip_if/p_log
deleted file mode 100755
index a2521be05..000000000
--- a/examples/var_service/zcip_if/p_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-cat @* current | $PAGER
diff --git a/examples/var_service/zcip_if/w_log b/examples/var_service/zcip_if/w_log
deleted file mode 100755
index aa36ef13b..000000000
--- a/examples/var_service/zcip_if/w_log
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-cd log/logdir || exit 1
-watch -n2 'w=`ttysize w`; h=`ttysize h`; tail -$((h-3)) current 2>&1 | cut -b1-$((w-2))'
diff --git a/examples/var_service/zcip_if/zcip_handler b/examples/var_service/zcip_if/zcip_handler
index 3c6ca788b..625450f7b 100755
--- a/examples/var_service/zcip_if/zcip_handler
+++ b/examples/var_service/zcip_if/zcip_handler
@@ -28,7 +28,7 @@ if test x"$1" != x"config"; then
         echo "Deconfiguring"
         rm "$file_ipconf"
         rm "$dir_ipconf/$file_ipconf"
-        sv u /var/service/fw
+        svc -u fw
         exit
 fi
 
@@ -43,5 +43,5 @@ if test $? != 0; then
         echo "Reconfiguring fw"
         mkdir -p "$dir_ipconf" 2>/dev/null
         cp "$file_ipconf" "$dir_ipconf/$file_ipconf"
-        sv u /var/service/fw
+        svc -u fw
 fi
diff --git a/findutils/Config.src b/findutils/Config.src
index 9ee71a845..c28c5844e 100644
--- a/findutils/Config.src
+++ b/findutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Finding Utilities"
diff --git a/findutils/find.c b/findutils/find.c
index 07321c81a..6407c6c5a 100644
--- a/findutils/find.c
+++ b/findutils/find.c
@@ -95,6 +95,11 @@
 //config:       Enable searching based on file type (file,
 //config:       directory, socket, device, etc.).
 //config:
+//config:config FEATURE_FIND_EXECUTABLE
+//config:       bool "Enable -executable: file is executable"
+//config:       default y
+//config:       depends on FIND
+//config:
 //config:config FEATURE_FIND_XDEV
 //config:       bool "Enable -xdev: 'stay in filesystem'"
 //config:       default y
@@ -182,6 +187,13 @@
 //config:       If the file is a directory, don't descend into it. Useful for
 //config:       exclusion .svn and CVS directories.
 //config:
+//config:config FEATURE_FIND_QUIT
+//config:       bool "Enable -quit: exit"
+//config:       default y
+//config:       depends on FIND
+//config:       help
+//config:       If this action is reached, 'find' exits.
+//config:
 //config:config FEATURE_FIND_DELETE
 //config:       bool "Enable -delete: delete files/dirs"
 //config:       default y
@@ -265,6 +277,9 @@
 //usage:        IF_FEATURE_FIND_TYPE(
 //usage:     "\n        -type X         File type is X (one of: f,d,l,b,c,s,p)"
 //usage:        )
+//usage:        IF_FEATURE_FIND_EXECUTABLE(
+//usage:     "\n        -executable     File is executable"
+//usage:        )
 //usage:        IF_FEATURE_FIND_PERM(
 //usage:     "\n        -perm MASK      At least one mask bit (+MASK), all bits (-MASK),"
 //usage:     "\n                        or exactly MASK bits are set in file's mode"
@@ -318,6 +333,9 @@
 //usage:        IF_FEATURE_FIND_DELETE(
 //usage:     "\n        -delete         Delete current file/directory. Turns on -depth option"
 //usage:        )
+//usage:        IF_FEATURE_FIND_QUIT(
+//usage:     "\n        -quit           Exit"
+//usage:        )
 //usage:
 //usage:#define find_example_usage
 //usage:       "$ find / -name passwd\n"
@@ -365,6 +383,7 @@ IF_FEATURE_FIND_PATH(   ACTS(path,  const char *pattern; bool ipath;))
 IF_FEATURE_FIND_REGEX(  ACTS(regex, regex_t compiled_pattern;))
 IF_FEATURE_FIND_PRINT0( ACTS(print0))
 IF_FEATURE_FIND_TYPE(   ACTS(type,  int type_mask;))
+IF_FEATURE_FIND_EXECUTABLE(ACTS(executable))
 IF_FEATURE_FIND_PERM(   ACTS(perm,  char perm_char; mode_t perm_mask;))
 IF_FEATURE_FIND_MTIME(  ACTS(mtime, char mtime_char; unsigned mtime_days;))
 IF_FEATURE_FIND_MMIN(   ACTS(mmin,  char mmin_char; unsigned mmin_mins;))
@@ -375,6 +394,7 @@ IF_FEATURE_FIND_SIZE(   ACTS(size,  char size_char; off_t size;))
 IF_FEATURE_FIND_CONTEXT(ACTS(context, security_context_t context;))
 IF_FEATURE_FIND_PAREN(  ACTS(paren, action ***subexpr;))
 IF_FEATURE_FIND_PRUNE(  ACTS(prune))
+IF_FEATURE_FIND_QUIT(   ACTS(quit))
 IF_FEATURE_FIND_DELETE( ACTS(delete))
 IF_FEATURE_FIND_EXEC(   ACTS(exec,
                                 char **exec_argv; /* -exec ARGS */
@@ -402,6 +422,7 @@ struct globals {
         action ***actions;
         smallint need_print;
         smallint xdev_on;
+        smalluint exitstatus;
         recurse_flags_t recurse_flags;
         IF_FEATURE_FIND_EXEC_PLUS(unsigned max_argv_len;)
 } FIX_ALIASING;
@@ -566,6 +587,12 @@ ACTF(type)
         return ((statbuf->st_mode & S_IFMT) == ap->type_mask);
 }
 #endif
+#if ENABLE_FEATURE_FIND_EXECUTABLE
+ACTF(executable)
+{
+        return access(fileName, X_OK) == 0;
+}
+#endif
 #if ENABLE_FEATURE_FIND_PERM
 ACTF(perm)
 {
@@ -774,6 +801,12 @@ ACTF(prune)
         return SKIP + TRUE;
 }
 #endif
+#if ENABLE_FEATURE_FIND_QUIT
+ACTF(quit)
+{
+        exit(G.exitstatus);
+}
+#endif
 #if ENABLE_FEATURE_FIND_DELETE
 ACTF(delete)
 {
@@ -954,8 +987,10 @@ static action*** parse_params(char **argv)
                                 PARM_print     ,
         IF_FEATURE_FIND_PRINT0( PARM_print0    ,)
         IF_FEATURE_FIND_PRUNE(  PARM_prune     ,)
+        IF_FEATURE_FIND_QUIT(   PARM_quit      ,)
         IF_FEATURE_FIND_DELETE( PARM_delete    ,)
         IF_FEATURE_FIND_EXEC(   PARM_exec      ,)
+        IF_FEATURE_FIND_EXECUTABLE(PARM_executable,)
         IF_FEATURE_FIND_PAREN(  PARM_char_brace,)
         /* All options/actions starting from here require argument */
                                 PARM_name      ,
@@ -997,8 +1032,10 @@ static action*** parse_params(char **argv)
                                 "-print\0"
         IF_FEATURE_FIND_PRINT0( "-print0\0" )
         IF_FEATURE_FIND_PRUNE(  "-prune\0"  )
+        IF_FEATURE_FIND_QUIT(   "-quit\0"  )
         IF_FEATURE_FIND_DELETE( "-delete\0" )
         IF_FEATURE_FIND_EXEC(   "-exec\0"   )
+        IF_FEATURE_FIND_EXECUTABLE("-executable\0")
         IF_FEATURE_FIND_PAREN(  "(\0"       )
         /* All options/actions starting from here require argument */
                                 "-name\0"
@@ -1152,6 +1189,12 @@ static action*** parse_params(char **argv)
                         (void) ALLOC_ACTION(prune);
                 }
 #endif
+#if ENABLE_FEATURE_FIND_QUIT
+                else if (parm == PARM_quit) {
+                        dbg("%d", __LINE__);
+                        (void) ALLOC_ACTION(quit);
+                }
+#endif
 #if ENABLE_FEATURE_FIND_DELETE
                 else if (parm == PARM_delete) {
                         dbg("%d", __LINE__);
@@ -1262,6 +1305,11 @@ static action*** parse_params(char **argv)
                         dbg("created:type mask:%x", ap->type_mask);
                 }
 #endif
+#if ENABLE_FEATURE_FIND_EXECUTABLE
+                else if (parm == PARM_executable) {
+                        (void) ALLOC_ACTION(executable);
+                }
+#endif
 #if ENABLE_FEATURE_FIND_PERM
 /* -perm BITS   File's mode bits are exactly BITS (octal or symbolic).
  *              Symbolic modes use mode 0 as a point of departure.
@@ -1401,7 +1449,7 @@ static action*** parse_params(char **argv)
 int find_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int find_main(int argc UNUSED_PARAM, char **argv)
 {
-        int i, firstopt, status = EXIT_SUCCESS;
+        int i, firstopt;
         char **past_HLP, *saved;
 
         INIT_G();
@@ -1475,10 +1523,10 @@ int find_main(int argc UNUSED_PARAM, char **argv)
                                 NULL,           /* user data */
                                 0)              /* depth */
                 ) {
-                        status |= EXIT_FAILURE;
+                        G.exitstatus |= EXIT_FAILURE;
                 }
         }
 
-        IF_FEATURE_FIND_EXEC_PLUS(status |= flush_exec_plus();)
-        return status;
+        IF_FEATURE_FIND_EXEC_PLUS(G.exitstatus |= flush_exec_plus();)
+        return G.exitstatus;
 }
diff --git a/findutils/grep.c b/findutils/grep.c
index 88de0d4ef..3e8ea9239 100644
--- a/findutils/grep.c
+++ b/findutils/grep.c
@@ -704,10 +704,15 @@ int grep_main(int argc UNUSED_PARAM, char **argv)
         /* do normal option parsing */
 #if ENABLE_FEATURE_GREP_CONTEXT
         /* -H unsets -h; -C unsets -A,-B */
-        opts = getopt32(argv,
-                "^" OPTSTR_GREP "\0" "H-h:C-AB",
+        opts = getopt32long(argv, "^"
+                OPTSTR_GREP
+                        "\0"
+                        "H-h:C-AB",
+                "color\0" Optional_argument "\xff",
                 &pattern_head, &fopt, &max_matches,
-                &lines_after, &lines_before, &Copt);
+                &lines_after, &lines_before, &Copt
+                , NULL
+        );
 
         if (opts & OPT_C) {
                 /* -C unsets prev -A and -B, but following -A or -B
diff --git a/findutils/xargs.c b/findutils/xargs.c
index df2300207..4399783ea 100644
--- a/findutils/xargs.c
+++ b/findutils/xargs.c
@@ -606,7 +606,7 @@ static int xargs_ask_confirmation(void)
 //usage:        )
 //usage:     "\n        -r      Don't run command if input is empty"
 //usage:        IF_FEATURE_XARGS_SUPPORT_ZERO_TERM(
-//usage:     "\n        -0      Input is separated by NUL characters"
+//usage:     "\n        -0      Input is separated by NULs"
 //usage:        )
 //usage:        IF_FEATURE_XARGS_SUPPORT_ARGS_FILE(
 //usage:     "\n        -a FILE Read from FILE instead of stdin"
diff --git a/include/bb_archive.h b/include/bb_archive.h
index 2182fcc3c..ace9c8e23 100644
--- a/include/bb_archive.h
+++ b/include/bb_archive.h
@@ -74,8 +74,8 @@ typedef struct archive_handle_t {
         /* Currently processed file's header */
         file_header_t *file_header;
 
-        /* List of symlink placeholders */
-        llist_t *symlink_placeholders;
+        /* List of link placeholders */
+        llist_t *link_placeholders;
 
         /* Process the header component, e.g. tar -t */
         void FAST_FUNC (*action_header)(const file_header_t *);
@@ -126,10 +126,10 @@ typedef struct archive_handle_t {
 #if ENABLE_FEATURE_AR_CREATE
         const char *ar__name;
         struct archive_handle_t *ar__out;
-# if ENABLE_FEATURE_AR_LONG_FILENAMES
+#endif
+#if ENABLE_FEATURE_AR_LONG_FILENAMES
         char *ar__long_names;
         unsigned ar__long_name_size;
-# endif
 #endif
 } archive_handle_t;
 /* bits in ah_flags */
@@ -213,13 +213,14 @@ void seek_by_jump(int fd, off_t amount) FAST_FUNC;
 void seek_by_read(int fd, off_t amount) FAST_FUNC;
 
 const char *strip_unsafe_prefix(const char *str) FAST_FUNC;
-void create_or_remember_symlink(llist_t **symlink_placeholders,
+void create_or_remember_link(llist_t **link_placeholders,
                 const char *target,
-                const char *linkname) FAST_FUNC;
+                const char *linkname,
+                int hard_link) FAST_FUNC;
 #if !ENABLE_PLATFORM_MINGW32
-void create_symlinks_from_list(llist_t *list) FAST_FUNC;
+void create_links_from_list(llist_t *list) FAST_FUNC;
 #else
-#define create_symlinks_from_list(l) (void)0
+#define create_links_from_list(l) (void)0
 #endif
 
 void data_align(archive_handle_t *archive_handle, unsigned boundary) FAST_FUNC;
diff --git a/include/libbb.h b/include/libbb.h
index fb9167ce3..0264282dd 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -428,6 +428,9 @@ enum {	/* cp.c, mv.c, install.c depend on these values. CAREFUL when changing th
         FILEUTILS_PRESERVE_SECURITY_CONTEXT = 1 << 15, /* -c */
 #endif
         FILEUTILS_RMDEST          = 1 << (16 - !ENABLE_SELINUX), /* --remove-destination */
+        /* bit 17 skipped for "cp --parents" */
+        FILEUTILS_REFLINK         = 1 << (18 - !ENABLE_SELINUX), /* cp --reflink=auto */
+        FILEUTILS_REFLINK_ALWAYS  = 1 << (19 - !ENABLE_SELINUX), /* cp --reflink[=always] */
         /*
          * Hole. cp may have some bits set here,
          * they should not affect remove_file()/copy_file()
@@ -503,6 +506,7 @@ DIR *xopendir(const char *path) FAST_FUNC;
 DIR *warn_opendir(const char *path) FAST_FUNC;
 
 char *xmalloc_realpath(const char *path) FAST_FUNC RETURNS_MALLOC;
+char *xmalloc_realpath_coreutils(const char *path) FAST_FUNC RETURNS_MALLOC;
 char *xmalloc_readlink(const char *path) FAST_FUNC RETURNS_MALLOC;
 char *xmalloc_readlink_or_warn(const char *path) FAST_FUNC RETURNS_MALLOC;
 /* !RETURNS_MALLOC: it's a realloc-like function */
diff --git a/init/Config.src b/init/Config.src
index 5767c93f0..b19b0bea1 100644
--- a/init/Config.src
+++ b/init/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Init Utilities"
diff --git a/klibc-utils/Config.src b/klibc-utils/Config.src
index fe7cb1315..cf4552e51 100644
--- a/klibc-utils/Config.src
+++ b/klibc-utils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "klibc-utils"
diff --git a/libbb/Config.src b/libbb/Config.src
index 16e16480b..312aa1831 100644
--- a/libbb/Config.src
+++ b/libbb/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 comment "Library Tuning"
diff --git a/libbb/appletlib.c b/libbb/appletlib.c
index f250264d9..7df75c665 100644
--- a/libbb/appletlib.c
+++ b/libbb/appletlib.c
@@ -177,8 +177,11 @@ void FAST_FUNC bb_show_usage(void)
                 else {
                         full_write2_str("\nUsage: ");
                         full_write2_str(applet_name);
-                        full_write2_str(" ");
-                        full_write2_str(p);
+                        if (p[0]) {
+                                if (p[0] != '\n')
+                                        full_write2_str(" ");
+                                full_write2_str(p);
+                        }
                         full_write2_str("\n");
                 }
                 if (ENABLE_FEATURE_CLEAN_UP)
@@ -747,7 +750,7 @@ static void install_links(const char *busybox, int use_symbolic_links,
          * busybox.h::bb_install_loc_t, or else... */
         int (*lf)(const char *, const char *);
         char *fpc;
-        const char *appname = applet_names;
+        const char *appname = applet_names;
         unsigned i;
         int rc;
 
diff --git a/libbb/copy_file.c b/libbb/copy_file.c
index c60765d95..7cd9cd978 100644
--- a/libbb/copy_file.c
+++ b/libbb/copy_file.c
@@ -343,8 +343,27 @@ int FAST_FUNC copy_file(const char *source, const char *dest, int flags)
                         }
                 }
 #endif
+#if ENABLE_FEATURE_CP_REFLINK
+# undef BTRFS_IOCTL_MAGIC
+# define BTRFS_IOCTL_MAGIC 0x94
+# undef BTRFS_IOC_CLONE
+# define BTRFS_IOC_CLONE _IOW (BTRFS_IOCTL_MAGIC, 9, int)
+                if (flags & FILEUTILS_REFLINK) {
+                        retval = ioctl(dst_fd, BTRFS_IOC_CLONE, src_fd);
+                        if (retval == 0)
+                                goto do_close;
+                        /* reflink did not work */
+                        if (flags & FILEUTILS_REFLINK_ALWAYS) {
+                                bb_perror_msg("failed to clone '%s' from '%s'", dest, source);
+                                goto do_close;
+                        }
+                        /* fall through to standard copy */
+                        retval = 0;
+                }
+#endif
                 if (bb_copyfd_eof(src_fd, dst_fd) == -1)
                         retval = -1;
+ IF_FEATURE_CP_REFLINK(do_close:)
                 /* Careful with writing... */
                 if (close(dst_fd) < 0) {
                         bb_perror_msg("error writing to '%s'", dest);
diff --git a/libbb/dump.c b/libbb/dump.c
index 5941ef902..b4b49d709 100644
--- a/libbb/dump.c
+++ b/libbb/dump.c
@@ -387,7 +387,10 @@ static unsigned char *get(priv_dumper_t *dumper)
                         if (need == blocksize) {
                                 return NULL;
                         }
-                        if (dumper->pub.dump_vflag != ALL && !memcmp(dumper->get__curp, dumper->get__savp, nread)) {
+                        if (dumper->pub.dump_vflag != ALL   /* not "show all"? */
+                         && dumper->pub.dump_vflag != FIRST /* not first line? */
+                         && memcmp(dumper->get__curp, dumper->get__savp, nread) == 0 /* same data? */
+                        ) {
                                 if (dumper->pub.dump_vflag != DUP) {
                                         puts("*");
                                 }
@@ -399,7 +402,7 @@ static unsigned char *get(priv_dumper_t *dumper)
                 }
                 n = fread(dumper->get__curp + nread, sizeof(unsigned char),
                                 dumper->pub.dump_length == -1 ? need : MIN(dumper->pub.dump_length, need), stdin);
-                if (!n) {
+                if (n == 0) {
                         if (ferror(stdin)) {
                                 bb_simple_perror_msg(dumper->argv[-1]);
                         }
@@ -411,9 +414,10 @@ static unsigned char *get(priv_dumper_t *dumper)
                         dumper->pub.dump_length -= n;
                 }
                 need -= n;
-                if (!need) {
-                        if (dumper->pub.dump_vflag == ALL || dumper->pub.dump_vflag == FIRST
-                         || memcmp(dumper->get__curp, dumper->get__savp, blocksize)
+                if (need == 0) {
+                        if (dumper->pub.dump_vflag == ALL   /* "show all"? */
+                         || dumper->pub.dump_vflag == FIRST /* first line? */
+                         || memcmp(dumper->get__curp, dumper->get__savp, blocksize) != 0 /* not same data? */
                         ) {
                                 if (dumper->pub.dump_vflag == DUP || dumper->pub.dump_vflag == FIRST) {
                                         dumper->pub.dump_vflag = WAIT;
diff --git a/libbb/loop.c b/libbb/loop.c
index f0d4296ae..c78535a20 100644
--- a/libbb/loop.c
+++ b/libbb/loop.c
@@ -106,6 +106,10 @@ int FAST_FUNC set_loop(char **device, const char *file, unsigned long long offse
                 return -errno;
         }
 
+//TODO: use LOOP_CTL_GET_FREE instead of trying every loopN in sequence? a-la:
+// fd = open("/dev/loop-control", O_RDWR);
+// loopN = ioctl(fd, LOOP_CTL_GET_FREE);
+//
         /* Find a loop device.  */
         try = *device ? *device : dev;
         /* 1048575 (0xfffff) is a max possible minor number in Linux circa 2010 */
diff --git a/libbb/nuke_str.c b/libbb/nuke_str.c
index 240e68004..b5385e956 100644
--- a/libbb/nuke_str.c
+++ b/libbb/nuke_str.c
@@ -12,7 +12,7 @@
 
 void FAST_FUNC nuke_str(char *str)
 {
-        if (str) {
+        if (str) {
                 while (*str)
                         *str++ = 0;
                 /* or: memset(str, 0, strlen(str)); - not as small as above */
diff --git a/libbb/pw_encrypt.c b/libbb/pw_encrypt.c
index 1edf4b6f0..86455cd0d 100644
--- a/libbb/pw_encrypt.c
+++ b/libbb/pw_encrypt.c
@@ -6,6 +6,7 @@
  *
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
+#include <crypt.h>
 #include "libbb.h"
 
 /* static const uint8_t ascii64[] ALIGN1 =
diff --git a/libbb/xfuncs_printf.c b/libbb/xfuncs_printf.c
index 21263ccfe..a0db2b86e 100644
--- a/libbb/xfuncs_printf.c
+++ b/libbb/xfuncs_printf.c
@@ -222,6 +222,7 @@ void FAST_FUNC xdup2(int from, int to)
 {
         if (dup2(from, to) != to)
                 bb_perror_msg_and_die("can't duplicate file descriptor");
+                //              " %d to %d", from, to);
 }
 
 // "Renumber" opened fd
diff --git a/libbb/xreadlink.c b/libbb/xreadlink.c
index b3118b433..9ae70de99 100644
--- a/libbb/xreadlink.c
+++ b/libbb/xreadlink.c
@@ -122,3 +122,33 @@ char* FAST_FUNC xmalloc_realpath(const char *path)
         return xstrdup(realpath(path, buf));
 #endif
 }
+
+char* FAST_FUNC xmalloc_realpath_coreutils(const char *path)
+{
+        char *buf;
+
+        errno = 0;
+        buf = xmalloc_realpath(path);
+        /*
+         * There is one case when "readlink -f" and
+         * "realpath" from coreutils succeed,
+         * even though file does not exist, such as:
+         *     /tmp/file_does_not_exist
+         * (the directory must exist).
+         */
+        if (!buf && errno == ENOENT) {
+                char *last_slash = strrchr(path, '/');
+                if (last_slash) {
+                        *last_slash++ = '\0';
+                        buf = xmalloc_realpath(path);
+                        if (buf) {
+                                unsigned len = strlen(buf);
+                                buf = xrealloc(buf, len + strlen(last_slash) + 2);
+                                buf[len++] = '/';
+                                strcpy(buf + len, last_slash);
+                        }
+                }
+        }
+
+        return buf;
+}
diff --git a/loginutils/Config.src b/loginutils/Config.src
index 680f42118..cbb09646b 100644
--- a/loginutils/Config.src
+++ b/loginutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Login/Password Management Utilities"
diff --git a/mailutils/popmaildir.c b/mailutils/popmaildir.c
index a4aad3662..589456715 100644
--- a/mailutils/popmaildir.c
+++ b/mailutils/popmaildir.c
@@ -265,7 +265,7 @@ int popmaildir_main(int argc UNUSED_PARAM, char **argv)
 
                 // atomically move message to ./new/
                 target = xstrdup(filename);
-                strncpy(target, "new", 3);
+                memcpy(target, "new", 3);
                 // ... or just stop receiving on failure
                 if (rename_or_warn(filename, target))
                         break;
diff --git a/mailutils/sendmail.c b/mailutils/sendmail.c
index 4ca91fad8..0170f2870 100644
--- a/mailutils/sendmail.c
+++ b/mailutils/sendmail.c
@@ -173,7 +173,7 @@ static char *angle_address(char *str)
         char *s, *e;
 
         e = trim(str);
-        if (e != str && e[-1] == '>') {
+        if (e != str && *--e == '>') {
                 s = strrchr(str, '<');
                 if (s) {
                         *e = '\0';
diff --git a/miscutils/Config.src b/miscutils/Config.src
index 7325fb8fa..d10b00b28 100644
--- a/miscutils/Config.src
+++ b/miscutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Miscellaneous Utilities"
diff --git a/miscutils/hexedit.c b/miscutils/hexedit.c
index 95c930d12..298eb8149 100644
--- a/miscutils/hexedit.c
+++ b/miscutils/hexedit.c
@@ -153,7 +153,8 @@ static void redraw(unsigned cursor)
                 i++;
         }
 
-        printf(ESC"[%u;%uH", 1 + cursor / 16, 1 + pos + (cursor & 0xf) * 3);
+        G.row = cursor / 16;
+        printf(ESC"[%u;%uH", 1 + G.row, 1 + pos + (cursor & 0xf) * 3);
 }
 
 static void redraw_cur_line(void)
@@ -367,6 +368,8 @@ int hexedit_main(int argc UNUSED_PARAM, char **argv)
                                 if (G.current_byte > G.eof_byte) {
                                         /* _after_ eof - don't allow this */
                                         G.current_byte -= 16;
+                                        if (G.current_byte < G.baseaddr)
+                                                move_mapping_lower();
                                         break;
                                 }
                         }
diff --git a/modutils/Config.src b/modutils/Config.src
index e413702bb..188296814 100644
--- a/modutils/Config.src
+++ b/modutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Linux Module Utilities"
diff --git a/networking/Config.src b/networking/Config.src
index 492c60da4..2ce5287de 100644
--- a/networking/Config.src
+++ b/networking/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Networking Utilities"
diff --git a/networking/nc_bloaty.c b/networking/nc_bloaty.c
index 64098648a..42c84de45 100644
--- a/networking/nc_bloaty.c
+++ b/networking/nc_bloaty.c
@@ -791,7 +791,7 @@ int nc_main(int argc UNUSED_PARAM, char **argv)
                 "np:s:uvw:+"/* -w N */ IF_NC_SERVER("lk")
                 IF_NC_EXTRA("i:o:z")
                         "\0"
-                        "?2:vv:ll", /* max 2 params; -v and -l are counters */
+                        "?2:vv"IF_NC_SERVER(":ll"), /* max 2 params; -v and -l are counters */
                 &str_p, &str_s, &o_wait
                 IF_NC_EXTRA(, &str_i, &str_o)
                         , &o_verbose IF_NC_SERVER(, &cnt_l)
diff --git a/networking/nslookup.c b/networking/nslookup.c
index fd241a5ca..3a614b0c6 100644
--- a/networking/nslookup.c
+++ b/networking/nslookup.c
@@ -712,11 +712,11 @@ static void add_query(int type, const char *dname)
 static char *make_ptr(const char *addrstr)
 {
         unsigned char addr[16];
-        int i;
 
 #if ENABLE_FEATURE_IPV6
         if (inet_pton(AF_INET6, addrstr, addr)) {
                 if (memcmp(addr, v4_mapped, 12) != 0) {
+                        int i;
                         char resbuf[80];
                         char *ptr = resbuf;
                         for (i = 0; i < 16; i++) {
diff --git a/networking/ntpd.c b/networking/ntpd.c
index 6cd497090..7b800369e 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -93,10 +93,10 @@
 
 #include "libbb.h"
 #include <math.h>
-#include <netinet/ip.h> /* For IPTOS_LOWDELAY definition */
+#include <netinet/ip.h> /* For IPTOS_DSCP_AF21 definition */
 #include <sys/timex.h>
-#ifndef IPTOS_LOWDELAY
-# define IPTOS_LOWDELAY 0x10
+#ifndef IPTOS_DSCP_AF21
+# define IPTOS_DSCP_AF21 0x48
 #endif
 
 
@@ -149,6 +149,7 @@
  */
 
 #define INITIAL_SAMPLES    4    /* how many samples do we want for init */
+#define MIN_FREQHOLD      10    /* adjust offset, but not freq in this many first adjustments */
 #define BAD_DELAY_GROWTH   4    /* drop packet if its delay grew by more than this */
 
 #define RETRY_INTERVAL    32    /* on send/recv error, retry in N secs (need to be power of 2) */
@@ -910,7 +911,7 @@ send_query_to_peer(peer_t *p)
 #if ENABLE_FEATURE_IPV6
                 if (family == AF_INET)
 #endif
-                        setsockopt_int(fd, IPPROTO_IP, IP_TOS, IPTOS_LOWDELAY);
+                        setsockopt_int(fd, IPPROTO_IP, IP_TOS, IPTOS_DSCP_AF21);
                 free(local_lsa);
         }
 
@@ -1753,7 +1754,7 @@ update_local_clock(peer_t *p)
 //15:19:39.114 update from:<IP> offset:+0.327022 delay:0.158384 jitter:0.108538 clock drift:-1.393ppm tc:4
 //15:20:12.715 update from:<IP> offset:+0.275596 delay:0.158297 jitter:0.097292 clock drift:-1.393ppm tc:4
 //15:20:45.111 update from:<IP> offset:+0.225715 delay:0.158271 jitter:0.087841 clock drift:-1.393ppm tc:4
-// If allwed to continue, it would start increasing tmx.freq now.
+// If allowed to continue, it would start increasing tmx.freq now.
 // Instead, it was ^Ced, and started anew:
 //15:21:15.043 no valid datapoints, no peer selected
 //15:21:17.408 update from:<IP> offset:+0.175910 delay:0.158314 jitter:0.076683 clock drift:-1.393ppm tc:4
@@ -1776,9 +1777,9 @@ update_local_clock(peer_t *p)
 //15:31:53.473 update from:<IP> offset:+0.000007 delay:0.158142 jitter:0.010922 clock drift:+9.343ppm tc:6
 //15:32:58.902 update from:<IP> offset:-0.000728 delay:0.158222 jitter:0.009454 clock drift:+9.298ppm tc:6
                         /*
-                         * This expression would choose 15 in the above example.
+                         * This expression would choose MIN_FREQHOLD + 7 in the above example.
                          */
-                        G.FREQHOLD_cnt = 8 + ((unsigned)(abs(tmx.offset)) >> 16);
+                        G.FREQHOLD_cnt = MIN_FREQHOLD + ((unsigned)(abs(tmx.offset)) >> 16);
                 }
                 G.FREQHOLD_cnt--;
                 tmx.status |= STA_FREQHOLD;
@@ -2320,7 +2321,7 @@ static NOINLINE void ntp_init(char **argv)
                                 xfunc_die();
                 }
                 socket_want_pktinfo(G_listen_fd);
-                setsockopt_int(G_listen_fd, IPPROTO_IP, IP_TOS, IPTOS_LOWDELAY);
+                setsockopt_int(G_listen_fd, IPPROTO_IP, IP_TOS, IPTOS_DSCP_AF21);
         }
 #endif
         /* I hesitate to set -20 prio. -15 should be high enough for timekeeping */
diff --git a/networking/tls.c b/networking/tls.c
index ec5a56d57..fce1d0ea6 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -1088,6 +1088,8 @@ static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
  * We need Certificate.tbsCertificate.subjectPublicKeyInfo.publicKey
  */
         uint8_t *end = der + len;
+        uint8_t tag_class, pc, tag_number;
+        int version_present;
 
         /* enter "Certificate" item: [der, end) will be only Cert */
         der = enter_der_item(der, &end);
@@ -1095,8 +1097,24 @@ static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
         /* enter "tbsCertificate" item: [der, end) will be only tbsCert */
         der = enter_der_item(der, &end);
 
+        /*
+         * Skip version field only if it is present. For a v1 certificate, the
+         * version field won't be present since v1 is the default value for the
+         * version field and fields with default values should be omitted (see
+         * RFC 5280 sections 4.1 and 4.1.2.1). If the version field is present
+         * it will have a tag class of 2 (context-specific), bit 6 as 1
+         * (constructed), and a tag number of 0 (see ITU-T X.690 sections 8.1.2
+         * and 8.14).
+         */
+        tag_class = der[0] >> 6; /* bits 8-7 */
+        pc = (der[0] & 32) >> 5; /* bit 6 */
+        tag_number = der[0] & 31; /* bits 5-1 */
+        version_present = tag_class == 2 && pc == 1 && tag_number == 0;
+        if (version_present) {
+                der = skip_der_item(der, end); /* version */
+        }
+
         /* skip up to subjectPublicKeyInfo */
-        der = skip_der_item(der, end); /* version */
         der = skip_der_item(der, end); /* serialNumber */
         der = skip_der_item(der, end); /* signatureAlgo */
         der = skip_der_item(der, end); /* issuer */
diff --git a/networking/udhcp/Config.src b/networking/udhcp/Config.src
index 50bff2e8c..e5958804b 100644
--- a/networking/udhcp/Config.src
+++ b/networking/udhcp/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 config UDHCPD
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index fbf9c6878..e5fd74f91 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -65,6 +65,7 @@ const struct dhcp_optflag dhcp_optflags[] = {
 #endif
         { OPTION_STRING                           , 0xd1 }, /* DHCP_PXE_CONF_FILE */
         { OPTION_STRING                           , 0xd2 }, /* DHCP_PXE_PATH_PREFIX */
+        { OPTION_U32                              , 0xd3 }, /* DHCP_REBOOT_TIME   */
         { OPTION_6RD                              , 0xd4 }, /* DHCP_6RD           */
         { OPTION_STATIC_ROUTES | OPTION_LIST      , 0xf9 }, /* DHCP_MS_STATIC_ROUTES */
         { OPTION_STRING                           , 0xfc }, /* DHCP_WPAD          */
@@ -92,50 +93,51 @@ const struct dhcp_optflag dhcp_optflags[] = {
  */
 /* Must match dhcp_optflags[] order */
 const char dhcp_option_strings[] ALIGN1 =
-        "subnet" "\0"      /* DHCP_SUBNET         */
-        "timezone" "\0"    /* DHCP_TIME_OFFSET    */
-        "router" "\0"      /* DHCP_ROUTER         */
-//      "timesrv" "\0"     /* DHCP_TIME_SERVER    */
-//      "namesrv" "\0"     /* DHCP_NAME_SERVER    */
-        "dns" "\0"         /* DHCP_DNS_SERVER     */
-//      "logsrv" "\0"      /* DHCP_LOG_SERVER     */
-//      "cookiesrv" "\0"   /* DHCP_COOKIE_SERVER  */
-        "lprsrv" "\0"      /* DHCP_LPR_SERVER     */
-        "hostname" "\0"    /* DHCP_HOST_NAME      */
-        "bootsize" "\0"    /* DHCP_BOOT_SIZE      */
-        "domain" "\0"      /* DHCP_DOMAIN_NAME    */
-        "swapsrv" "\0"     /* DHCP_SWAP_SERVER    */
-        "rootpath" "\0"    /* DHCP_ROOT_PATH      */
-        "ipttl" "\0"       /* DHCP_IP_TTL         */
-        "mtu" "\0"         /* DHCP_MTU            */
-        "broadcast" "\0"   /* DHCP_BROADCAST      */
-        "routes" "\0"      /* DHCP_ROUTES         */
-        "nisdomain" "\0"   /* DHCP_NIS_DOMAIN     */
-        "nissrv" "\0"      /* DHCP_NIS_SERVER     */
-        "ntpsrv" "\0"      /* DHCP_NTP_SERVER     */
-        "wins" "\0"        /* DHCP_WINS_SERVER    */
-        "lease" "\0"       /* DHCP_LEASE_TIME     */
-        "serverid" "\0"    /* DHCP_SERVER_ID      */
-        "message" "\0"     /* DHCP_ERR_MESSAGE    */
-        "tftp" "\0"        /* DHCP_TFTP_SERVER_NAME */
-        "bootfile" "\0"    /* DHCP_BOOT_FILE      */
-//      "userclass" "\0"   /* DHCP_USER_CLASS     */
+        "subnet" "\0"           /* DHCP_SUBNET          */
+        "timezone" "\0"         /* DHCP_TIME_OFFSET     */
+        "router" "\0"           /* DHCP_ROUTER          */
+//      "timesrv" "\0"          /* DHCP_TIME_SERVER     */
+//      "namesrv" "\0"          /* DHCP_NAME_SERVER     */
+        "dns" "\0"              /* DHCP_DNS_SERVER      */
+//      "logsrv" "\0"           /* DHCP_LOG_SERVER      */
+//      "cookiesrv" "\0"        /* DHCP_COOKIE_SERVER   */
+        "lprsrv" "\0"           /* DHCP_LPR_SERVER      */
+        "hostname" "\0"         /* DHCP_HOST_NAME       */
+        "bootsize" "\0"         /* DHCP_BOOT_SIZE       */
+        "domain" "\0"           /* DHCP_DOMAIN_NAME     */
+        "swapsrv" "\0"          /* DHCP_SWAP_SERVER     */
+        "rootpath" "\0"         /* DHCP_ROOT_PATH       */
+        "ipttl" "\0"            /* DHCP_IP_TTL          */
+        "mtu" "\0"              /* DHCP_MTU             */
+        "broadcast" "\0"        /* DHCP_BROADCAST       */
+        "routes" "\0"           /* DHCP_ROUTES          */
+        "nisdomain" "\0"        /* DHCP_NIS_DOMAIN      */
+        "nissrv" "\0"           /* DHCP_NIS_SERVER      */
+        "ntpsrv" "\0"           /* DHCP_NTP_SERVER      */
+        "wins" "\0"             /* DHCP_WINS_SERVER     */
+        "lease" "\0"            /* DHCP_LEASE_TIME      */
+        "serverid" "\0"         /* DHCP_SERVER_ID       */
+        "message" "\0"          /* DHCP_ERR_MESSAGE     */
+        "tftp" "\0"             /* DHCP_TFTP_SERVER_NAME*/
+        "bootfile" "\0"         /* DHCP_BOOT_FILE       */
+//      "userclass" "\0"        /* DHCP_USER_CLASS      */
 #if ENABLE_FEATURE_UDHCP_RFC3397
-        "search" "\0"      /* DHCP_DOMAIN_SEARCH  */
+        "search" "\0"           /* DHCP_DOMAIN_SEARCH   */
 // doesn't work in udhcpd.conf since OPTION_SIP_SERVERS
 // is not handled yet by "string->option" conversion code:
-        "sipsrv" "\0"      /* DHCP_SIP_SERVERS    */
+        "sipsrv" "\0"           /* DHCP_SIP_SERVERS     */
 #endif
-        "staticroutes" "\0"/* DHCP_STATIC_ROUTES  */
+        "staticroutes" "\0"     /* DHCP_STATIC_ROUTES   */
 #if ENABLE_FEATURE_UDHCP_8021Q
-        "vlanid" "\0"      /* DHCP_VLAN_ID        */
-        "vlanpriority" "\0"/* DHCP_VLAN_PRIORITY  */
+        "vlanid" "\0"           /* DHCP_VLAN_ID         */
+        "vlanpriority" "\0"     /* DHCP_VLAN_PRIORITY   */
 #endif
-        "pxeconffile" "\0" /* DHCP_PXE_CONF_FILE  */
-        "pxepathprefix" "\0" /* DHCP_PXE_PATH_PREFIX  */
-        "ip6rd" "\0"       /* DHCP_6RD            */
-        "msstaticroutes""\0"/* DHCP_MS_STATIC_ROUTES */
-        "wpad" "\0"        /* DHCP_WPAD           */
+        "pxeconffile" "\0"      /* DHCP_PXE_CONF_FILE   */
+        "pxepathprefix" "\0"    /* DHCP_PXE_PATH_PREFIX */
+        "reboottime" "\0"       /* DHCP_REBOOT_TIME     */
+        "ip6rd" "\0"            /* DHCP_6RD             */
+        "msstaticroutes" "\0"   /* DHCP_MS_STATIC_ROUTES*/
+        "wpad" "\0"             /* DHCP_WPAD            */
         ;
 #endif
 
@@ -379,12 +381,18 @@ int FAST_FUNC udhcp_str2nip(const char *str, void *arg)
  * and to parse udhcpd.conf's "opt OPTNAME OPTVAL" directives.
  */
 /* helper: add an option to the opt_list */
+#if !ENABLE_UDHCPC6
+#define attach_option(opt_list, optflag, buffer, length, dhcpv6) \
+        attach_option(opt_list, optflag, buffer, length)
+#endif
 static NOINLINE void attach_option(
                 struct option_set **opt_list,
                 const struct dhcp_optflag *optflag,
                 char *buffer,
-                int length)
+                int length,
+                bool dhcpv6)
 {
+        IF_NOT_UDHCPC6(bool dhcpv6 = 0;)
         struct option_set *existing;
         char *allocated = NULL;
 
@@ -410,10 +418,21 @@ static NOINLINE void attach_option(
                 /* make a new option */
                 log2("attaching option %02x to list", optflag->code);
                 new = xmalloc(sizeof(*new));
-                new->data = xmalloc(length + OPT_DATA);
-                new->data[OPT_CODE] = optflag->code;
-                new->data[OPT_LEN] = length;
-                memcpy(new->data + OPT_DATA, (allocated ? allocated : buffer), length);
+                if (!dhcpv6) {
+                        new->data = xmalloc(length + OPT_DATA);
+                        new->data[OPT_CODE] = optflag->code;
+                        new->data[OPT_LEN] = length;
+                        memcpy(new->data + OPT_DATA, (allocated ? allocated : buffer),
+                                        length);
+                } else {
+                        new->data = xmalloc(length + D6_OPT_DATA);
+                        new->data[D6_OPT_CODE] = optflag->code >> 8;
+                        new->data[D6_OPT_CODE + 1] = optflag->code & 0xff;
+                        new->data[D6_OPT_LEN] = length >> 8;
+                        new->data[D6_OPT_LEN + 1] = length & 0xff;
+                        memcpy(new->data + D6_OPT_DATA, (allocated ? allocated : buffer),
+                                        length);
+                }
 
                 curr = opt_list;
                 while (*curr && (*curr)->data[OPT_CODE] < optflag->code)
@@ -450,7 +469,9 @@ static NOINLINE void attach_option(
         free(allocated);
 }
 
-int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg, const struct dhcp_optflag *optflags, const char *option_strings)
+int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg,
+                const struct dhcp_optflag *optflags, const char *option_strings,
+                bool dhcpv6)
 {
         struct option_set **opt_list = arg;
         char *opt;
@@ -489,9 +510,10 @@ int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg, const struct dh
                 int length;
                 char *val;
 
-                if (optflag->flags == OPTION_BIN)
-                        val = trim(strtok(NULL, "")); /* do not split "'q w e'" */
-                else
+                if (optflag->flags == OPTION_BIN) {
+                        val = strtok(NULL, ""); /* do not split "'q w e'" */
+                        trim(val);
+                } else
                         val = strtok(NULL, ", \t");
                 if (!val)
                         break;
@@ -601,7 +623,7 @@ case_OPTION_STRING:
                 }
 
                 if (retval)
-                        attach_option(opt_list, optflag, opt, length);
+                        attach_option(opt_list, optflag, opt, length, dhcpv6);
         } while (retval && (optflag->flags & OPTION_LIST));
 
         return retval;
diff --git a/networking/udhcp/common.h b/networking/udhcp/common.h
index 13059f106..7ad603d33 100644
--- a/networking/udhcp/common.h
+++ b/networking/udhcp/common.h
@@ -122,9 +122,9 @@ enum {
 //#define DHCP_LOG_SERVER       0x07 /* port 704 UDP log (not syslog)
 //#define DHCP_COOKIE_SERVER    0x08 /* "quote of the day" server */
 //#define DHCP_LPR_SERVER       0x09
-#define DHCP_HOST_NAME          0x0c /* either client informs server or server gives name to client */
+#define DHCP_HOST_NAME          0x0c /* 12: either client informs server or server gives name to client */
 //#define DHCP_BOOT_SIZE        0x0d
-//#define DHCP_DOMAIN_NAME      0x0f /* server gives domain suffix */
+//#define DHCP_DOMAIN_NAME      0x0f /* 15: server gives domain suffix */
 //#define DHCP_SWAP_SERVER      0x10
 //#define DHCP_ROOT_PATH        0x11
 //#define DHCP_IP_TTL           0x17
@@ -135,35 +135,40 @@ enum {
 //#define DHCP_NIS_SERVER       0x29
 //#define DHCP_NTP_SERVER       0x2a
 //#define DHCP_WINS_SERVER      0x2c
-#define DHCP_REQUESTED_IP       0x32 /* sent by client if specific IP is wanted */
-#define DHCP_LEASE_TIME         0x33
-#define DHCP_OPTION_OVERLOAD    0x34
-#define DHCP_MESSAGE_TYPE       0x35
-#define DHCP_SERVER_ID          0x36 /* by default server's IP */
-#define DHCP_PARAM_REQ          0x37 /* list of options client wants */
-//#define DHCP_ERR_MESSAGE      0x38 /* error message when sending NAK etc */
-#define DHCP_MAX_SIZE           0x39
-#define DHCP_VENDOR             0x3c /* client's vendor (a string) */
-#define DHCP_CLIENT_ID          0x3d /* by default client's MAC addr, but may be arbitrarily long */
-//#define DHCP_TFTP_SERVER_NAME 0x42 /* same as 'sname' field */
-//#define DHCP_BOOT_FILE        0x43 /* same as 'file' field */
-//#define DHCP_USER_CLASS       0x4d /* RFC 3004. set of LASCII strings. "I am a printer" etc */
-#define DHCP_FQDN               0x51 /* client asks to update DNS to map its FQDN to its new IP */
-//#define DHCP_DOMAIN_SEARCH    0x77 /* RFC 3397. set of ASCIZ string, DNS-style compressed */
-//#define DHCP_SIP_SERVERS      0x78 /* RFC 3361. flag byte, then: 0: domain names, 1: IP addrs */
-//#define DHCP_STATIC_ROUTES    0x79 /* RFC 3442. (mask,ip,router) tuples */
-//#define DHCP_VLAN_ID          0x84 /* 802.1P VLAN ID */
-//#define DHCP_VLAN_PRIORITY    0x85 /* 802.1Q VLAN priority */
-//#define DHCP_PXE_CONF_FILE    0xd1 /* RFC 5071 Configuration File */
-//#define DHCP_PXE_PATH_PREFIX  0xd2 /* RFC 5071 Configuration File */
-//#define DHCP_MS_STATIC_ROUTES 0xf9 /* Microsoft's pre-RFC 3442 code for 0x79? */
-//#define DHCP_WPAD             0xfc /* MSIE's Web Proxy Autodiscovery Protocol */
-#define DHCP_END                0xff
+#define DHCP_REQUESTED_IP       0x32 /* 50: sent by client if specific IP is wanted */
+#define DHCP_LEASE_TIME         0x33 /* 51: */
+#define DHCP_OPTION_OVERLOAD    0x34 /* 52: */
+#define DHCP_MESSAGE_TYPE       0x35 /* 53: */
+#define DHCP_SERVER_ID          0x36 /* 54: server's IP */
+#define DHCP_PARAM_REQ          0x37 /* 55: list of options client wants */
+//#define DHCP_ERR_MESSAGE      0x38 /* 56: error message when sending NAK etc */
+#define DHCP_MAX_SIZE           0x39 /* 57: */
+#define DHCP_VENDOR             0x3c /* 60: client's vendor (a string) */
+#define DHCP_CLIENT_ID          0x3d /* 61: by default client's MAC addr, but may be arbitrarily long */
+//#define DHCP_TFTP_SERVER_NAME 0x42 /* 66: same as 'sname' field */
+//#define DHCP_BOOT_FILE        0x43 /* 67: same as 'file' field */
+//#define DHCP_USER_CLASS       0x4d /* 77: RFC 3004. set of LASCII strings. "I am a printer" etc */
+#define DHCP_FQDN               0x51 /* 81: client asks to update DNS to map its FQDN to its new IP */
+//#define DHCP_DOMAIN_SEARCH    0x77 /* 119: RFC 3397. set of ASCIZ string, DNS-style compressed */
+//#define DHCP_SIP_SERVERS      0x78 /* 120: RFC 3361. flag byte, then: 0: domain names, 1: IP addrs */
+//#define DHCP_STATIC_ROUTES    0x79 /* 121: RFC 3442. (mask,ip,router) tuples */
+//#define DHCP_VLAN_ID          0x84 /* 132: 802.1P VLAN ID */
+//#define DHCP_VLAN_PRIORITY    0x85 /* 133: 802.1Q VLAN priority */
+//#define DHCP_PXE_CONF_FILE    0xd1 /* 209: RFC 5071 Configuration File */
+//#define DHCP_PXE_PATH_PREFIX  0xd2 /* 210: RFC 5071 Configuration File */
+//#define DHCP_REBOOT_TIME      0xd3 /* 211: RFC 5071 Reboot time */
+//#define DHCP_MS_STATIC_ROUTES 0xf9 /* 249: Microsoft's pre-RFC 3442 code for 0x79? */
+//#define DHCP_WPAD             0xfc /* 252: MSIE's Web Proxy Autodiscovery Protocol */
+#define DHCP_END                0xff /* 255: */
 
 /* Offsets in option byte sequence */
 #define OPT_CODE                0
 #define OPT_LEN                 1
 #define OPT_DATA                2
+/* Offsets in option byte sequence for DHCPv6 */
+#define D6_OPT_CODE             0
+#define D6_OPT_LEN              2
+#define D6_OPT_DATA             4
 /* Bits in "overload" option */
 #define OPTION_FIELD            0
 #define FILE_FIELD              1
@@ -290,10 +295,15 @@ void udhcp_dump_packet(struct dhcp_packet *packet) FAST_FUNC;
 /* 2nd param is "uint32_t*" */
 int FAST_FUNC udhcp_str2nip(const char *str, void *arg);
 /* 2nd param is "struct option_set**" */
+#if !ENABLE_UDHCPC6
+#define udhcp_str2optset(str, arg, optflags, option_strings, dhcpv6) \
+        udhcp_str2optset(str, arg, optflags, option_strings)
+#endif
 int FAST_FUNC udhcp_str2optset(const char *str,
                 void *arg,
                 const struct dhcp_optflag *optflags,
-                const char *option_strings);
+                const char *option_strings,
+                bool dhcpv6);
 
 #if ENABLE_UDHCPC || ENABLE_UDHCPD
 void udhcp_init_header(struct dhcp_packet *packet, char type) FAST_FUNC;
@@ -308,9 +318,7 @@ int udhcp_send_raw_packet(struct dhcp_packet *dhcp_pkt,
 
 int udhcp_send_kernel_packet(struct dhcp_packet *dhcp_pkt,
                 uint32_t source_nip, int source_port,
-                uint32_t dest_nip, int dest_port,
-                int send_flags
-) FAST_FUNC;
+                uint32_t dest_nip, int dest_port) FAST_FUNC;
 
 void udhcp_sp_setup(void) FAST_FUNC;
 void udhcp_sp_fd_set(struct pollfd *pfds, int extra_fd) FAST_FUNC;
diff --git a/networking/udhcp/d6_common.h b/networking/udhcp/d6_common.h
index e9c0397ae..d0506e2bb 100644
--- a/networking/udhcp/d6_common.h
+++ b/networking/udhcp/d6_common.h
@@ -128,6 +128,9 @@ struct d6_option {
 #define D6_OPT_TZ_POSIX      41
 #define D6_OPT_TZ_NAME       42
 
+#define D6_OPT_BOOT_URL      59
+#define D6_OPT_BOOT_PARAM    60
+
 /*** Other shared functions ***/
 
 struct client6_data_t {
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
index 85d9da724..ed2255ef3 100644
--- a/networking/udhcp/d6_dhcpc.c
+++ b/networking/udhcp/d6_dhcpc.c
@@ -38,6 +38,14 @@
 //config:       help
 //config:       You can request POSIX timezone with "-O tz" and timezone name
 //config:       with "-O timezone".
+//config:
+//config:config FEATURE_UDHCPC6_RFC5970
+//config:       bool "Support RFC 5970 (Network Boot)"
+//config:       default y
+//config:       depends on UDHCPC6
+//config:       help
+//config:       You can request bootfile-url with "-O bootfile_url" and
+//config:       bootfile-params with "-O bootfile_params".
 
 //applet:IF_UDHCPC6(APPLET(udhcpc6, BB_DIR_USR_BIN, BB_SUID_DROP))
 
@@ -71,6 +79,12 @@ static const struct dhcp_optflag d6_optflags[] = {
         { OPTION_STRING,                                D6_OPT_TZ_POSIX },
         { OPTION_STRING,                                D6_OPT_TZ_NAME },
 #endif
+#if ENABLE_FEATURE_UDHCPC6_RFC5970
+        { OPTION_STRING,                                D6_OPT_BOOT_URL },
+        { OPTION_STRING,                                D6_OPT_BOOT_PARAM },
+#endif
+        { OPTION_STRING,                                0xd1 }, /* DHCP_PXE_CONF_FILE */
+        { OPTION_STRING,                                0xd2 }, /* DHCP_PXE_PATH_PREFIX */
         { 0, 0 }
 };
 /* Must match d6_optflags[] order */
@@ -86,6 +100,12 @@ static const char d6_option_strings[] ALIGN1 =
         "tz" "\0"       /* D6_OPT_TZ_POSIX */
         "timezone" "\0" /* D6_OPT_TZ_NAME */
 #endif
+#if ENABLE_FEATURE_UDHCPC6_RFC5970
+        "bootfile_url" "\0" /* D6_OPT_BOOT_URL */
+        "bootfile_param" "\0" /* D6_OPT_BOOT_PARAM */
+#endif
+        "pxeconffile" "\0" /* DHCP_PXE_CONF_FILE  */
+        "pxepathprefix" "\0" /* DHCP_PXE_PATH_PREFIX  */
         "\0";
 
 #if ENABLE_LONG_OPTS
@@ -195,8 +215,37 @@ static char** new_env(void)
         return &client6_data.env_ptr[client6_data.env_idx++];
 }
 
+static char *string_option_to_env(const uint8_t *option,
+                const uint8_t *option_end)
+{
+        const char *ptr, *name = NULL;
+        unsigned val_len;
+        int i;
+
+        ptr = d6_option_strings;
+        i = 0;
+        while (*ptr) {
+                if (d6_optflags[i].code == option[1]) {
+                        name = ptr;
+                        goto found;
+                }
+                ptr += strlen(ptr) + 1;
+                i++;
+        }
+        bb_error_msg("can't find option name for 0x%x, skipping", option[1]);
+        return NULL;
+
+ found:
+        val_len = (option[2] << 8) | option[3];
+        if (val_len + &option[D6_OPT_DATA] > option_end) {
+                bb_error_msg("option data exceeds option length");
+                return NULL;
+        }
+        return xasprintf("%s=%.*s", name, val_len, (char*)option + 4);
+}
+
 /* put all the parameters into the environment */
-static void option_to_env(uint8_t *option, uint8_t *option_end)
+static void option_to_env(const uint8_t *option, const uint8_t *option_end)
 {
 #if ENABLE_FEATURE_UDHCPC6_RFC3646
         int addrs, option_offset;
@@ -239,6 +288,10 @@ static void option_to_env(uint8_t *option, uint8_t *option_end)
  * |                        valid-lifetime                         |
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
+                        /* Make sure payload contains an address */
+                        if (option[3] < 24)
+                                break;
+
                         sprint_nip6(ipv6str, option + 4);
                         *new_env() = xasprintf("ipv6=%s", ipv6str);
 
@@ -354,13 +407,23 @@ static void option_to_env(uint8_t *option, uint8_t *option_end)
                         *new_env() = xasprintf("tz_name=%.*s", (int)option[3], (char*)option + 4);
                         break;
 #endif
+                case D6_OPT_BOOT_URL:
+                case D6_OPT_BOOT_PARAM:
+                case 0xd1: /* DHCP_PXE_CONF_FILE */
+                case 0xd2: /* DHCP_PXE_PATH_PREFIX */
+                        {
+                        char *tmp = string_option_to_env(option, option_end);
+                        if (tmp)
+                                *new_env() = tmp;
+                        break;
+                        }
                 }
                 len_m4 -= 4 + option[3];
                 option += 4 + option[3];
         }
 }
 
-static char **fill_envp(struct d6_packet *packet)
+static char **fill_envp(const uint8_t *option, const uint8_t *option_end)
 {
         char **envp, **curr;
 
@@ -369,8 +432,8 @@ static char **fill_envp(struct d6_packet *packet)
 
         *new_env() = xasprintf("interface=%s", client_config.interface);
 
-        if (packet)
-                option_to_env(packet->d6_options, packet->d6_options + sizeof(packet->d6_options));
+        if (option)
+                option_to_env(option, option_end);
 
         envp = curr = client6_data.env_ptr;
         while (*curr)
@@ -380,12 +443,13 @@ static char **fill_envp(struct d6_packet *packet)
 }
 
 /* Call a script with a par file and env vars */
-static void d6_run_script(struct d6_packet *packet, const char *name)
+static void d6_run_script(const uint8_t *option, const uint8_t *option_end,
+                const char *name)
 {
         char **envp, **curr;
         char *argv[3];
 
-        envp = fill_envp(packet);
+        envp = fill_envp(option, option_end);
 
         /* call script */
         log1("executing %s %s", client_config.script, name);
@@ -401,6 +465,11 @@ static void d6_run_script(struct d6_packet *packet, const char *name)
         free(envp);
 }
 
+/* Call a script with a par file and no env var */
+static void d6_run_script_no_option(const char *name)
+{
+        d6_run_script(NULL, NULL, name);
+}
 
 /*** Sending/receiving packets ***/
 
@@ -426,8 +495,10 @@ static uint8_t *init_d6_packet(struct d6_packet *packet, char type, uint32_t xid
 
 static uint8_t *add_d6_client_options(uint8_t *ptr)
 {
+        struct option_set *curr;
         uint8_t *start = ptr;
         unsigned option;
+        uint16_t len;
 
         ptr += 4;
         for (option = 1; option < 256; option++) {
@@ -450,7 +521,12 @@ static uint8_t *add_d6_client_options(uint8_t *ptr)
         ptr = mempcpy(ptr, &opt_fqdn_req, sizeof(opt_fqdn_req));
 #endif
         /* Add -x options if any */
-        //...
+        curr = client_config.options;
+        while (curr) {
+                len = (curr->data[D6_OPT_LEN] << 8) | curr->data[D6_OPT_LEN + 1];
+                ptr = mempcpy(ptr, curr->data, D6_OPT_DATA + len);
+                curr = curr->next;
+        }
 
         return ptr;
 }
@@ -727,15 +803,13 @@ static NOINLINE int send_d6_renew(uint32_t xid, struct in6_addr *server_ipv6, st
         opt_ptr = add_d6_client_options(opt_ptr);
 
         bb_error_msg("sending %s", "renew");
-        if (server_ipv6) {
+        if (server_ipv6)
                 return d6_send_kernel_packet(
                         &packet, (opt_ptr - (uint8_t*) &packet),
                         our_cur_ipv6, CLIENT_PORT6,
                         server_ipv6, SERVER_PORT6,
                         client_config.ifindex
-                        /* TODO? send_flags: MSG_DONTROUTE (see IPv4 code for reason why) */
                 );
-        }
         return d6_mcast_from_client_config_ifindex(&packet, opt_ptr);
 }
 
@@ -969,7 +1043,7 @@ static void perform_renew(void)
                 state = RENEW_REQUESTED;
                 break;
         case RENEW_REQUESTED: /* impatient are we? fine, square 1 */
-                d6_run_script(NULL, "deconfig");
+                d6_run_script_no_option("deconfig");
         case REQUESTING:
         case RELEASED:
                 change_listen_mode(LISTEN_RAW);
@@ -998,7 +1072,7 @@ static void perform_d6_release(struct in6_addr *server_ipv6, struct in6_addr *ou
  * Users requested to be notified in all cases, even if not in one
  * of the states above.
  */
-        d6_run_script(NULL, "deconfig");
+        d6_run_script_no_option("deconfig");
         change_listen_mode(LISTEN_NONE);
         state = RELEASED;
 }
@@ -1157,7 +1231,10 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
         }
         while (list_x) {
                 char *optstr = xstrdup(llist_pop(&list_x));
-                udhcp_str2optset(optstr, &client_config.options, d6_optflags, d6_option_strings);
+                udhcp_str2optset(optstr, &client_config.options,
+                                d6_optflags, d6_option_strings,
+                                /*dhcpv6:*/ 1
+                );
                 free(optstr);
         }
 
@@ -1204,7 +1281,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
         udhcp_sp_setup();
 
         state = INIT_SELECTING;
-        d6_run_script(NULL, "deconfig");
+        d6_run_script_no_option("deconfig");
         change_listen_mode(LISTEN_RAW);
         packet_num = 0;
         timeout = 0;
@@ -1285,7 +1362,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                                         continue;
                                 }
  leasefail:
-                                d6_run_script(NULL, "leasefail");
+                                d6_run_script_no_option("leasefail");
 #if BB_MMU /* -b is not supported on NOMMU */
                                 if (opt & OPT_b) { /* background if no lease */
                                         bb_error_msg("no lease, forking to background");
@@ -1359,7 +1436,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                                 }
                                 /* Timed out, enter init state */
                                 bb_error_msg("lease lost, entering init state");
-                                d6_run_script(NULL, "deconfig");
+                                d6_run_script_no_option("deconfig");
                                 state = INIT_SELECTING;
                                 client_config.first_secs = 0; /* make secs field count from 0 */
                                 /*timeout = 0; - already is */
@@ -1466,9 +1543,10 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                                 if (option && (option->data[0] | option->data[1]) != 0) {
                                         /* return to init state */
                                         bb_error_msg("received DHCP NAK (%u)", option->data[4]);
-                                        d6_run_script(&packet, "nak");
+                                        d6_run_script(packet.d6_options,
+                                                        packet_end, "nak");
                                         if (state != REQUESTING)
-                                                d6_run_script(NULL, "deconfig");
+                                                d6_run_script_no_option("deconfig");
                                         change_listen_mode(LISTEN_RAW);
                                         sleep(3); /* avoid excessive network traffic */
                                         state = INIT_SELECTING;
@@ -1665,7 +1743,8 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                                 if (timeout < 0x10)
                                         timeout = 0x10;
                                 /* enter bound state */
-                                d6_run_script(&packet, state == REQUESTING ? "bound" : "renew");
+                                d6_run_script(packet.d6_options, packet_end,
+                                        (state == REQUESTING ? "bound" : "renew"));
 
                                 state = BOUND;
                                 change_listen_mode(LISTEN_NONE);
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index bd9e8fdc2..c2805a009 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -693,16 +693,10 @@ static int raw_bcast_from_client_config_ifindex(struct dhcp_packet *packet, uint
 
 static int bcast_or_ucast(struct dhcp_packet *packet, uint32_t ciaddr, uint32_t server)
 {
-        if (server) {
-                /* Without MSG_DONTROUTE, the packet was seen routed over
-                 * _other interface_ if server ID is bogus (example: 1.1.1.1).
-                 */
+        if (server)
                 return udhcp_send_kernel_packet(packet,
                         ciaddr, CLIENT_PORT,
-                        server, SERVER_PORT,
-                        /*send_flags: "to hosts only on directly connected networks" */ MSG_DONTROUTE
-                );
-        }
+                        server, SERVER_PORT);
         return raw_bcast_from_client_config_ifindex(packet, ciaddr);
 }
 
@@ -1337,7 +1331,10 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
         }
         while (list_x) {
                 char *optstr = xstrdup(llist_pop(&list_x));
-                udhcp_str2optset(optstr, &client_config.options, dhcp_optflags, dhcp_option_strings);
+                udhcp_str2optset(optstr, &client_config.options,
+                                dhcp_optflags, dhcp_option_strings,
+                                /*dhcpv6:*/ 0
+                );
                 free(optstr);
         }
 
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 19f94a2d7..a8cd3f03b 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -362,7 +362,10 @@ static int FAST_FUNC read_staticlease(const char *const_line, void *arg)
 }
 
 static int FAST_FUNC read_optset(const char *line, void *arg) {
-        return udhcp_str2optset(line, arg, dhcp_optflags, dhcp_option_strings);
+        return udhcp_str2optset(line, arg,
+                        dhcp_optflags, dhcp_option_strings,
+                        /*dhcpv6:*/ 0
+        );
 }
 
 struct config_keyword {
@@ -588,9 +591,7 @@ static void send_packet_to_relay(struct dhcp_packet *dhcp_pkt)
 
         udhcp_send_kernel_packet(dhcp_pkt,
                         server_config.server_nip, SERVER_PORT,
-                        dhcp_pkt->gateway_nip, SERVER_PORT,
-                        /*send_flags:*/ 0
-        );
+                        dhcp_pkt->gateway_nip, SERVER_PORT);
 }
 
 static void send_packet(struct dhcp_packet *dhcp_pkt, int force_broadcast)
diff --git a/networking/udhcp/packet.c b/networking/udhcp/packet.c
index fc2bb5416..ff16904f7 100644
--- a/networking/udhcp/packet.c
+++ b/networking/udhcp/packet.c
@@ -189,8 +189,7 @@ int FAST_FUNC udhcp_send_raw_packet(struct dhcp_packet *dhcp_pkt,
 /* Let the kernel do all the work for packet generation */
 int FAST_FUNC udhcp_send_kernel_packet(struct dhcp_packet *dhcp_pkt,
                 uint32_t source_nip, int source_port,
-                uint32_t dest_nip, int dest_port,
-                int send_flags)
+                uint32_t dest_nip, int dest_port)
 {
         struct sockaddr_in sa;
         unsigned padding;
@@ -227,8 +226,8 @@ int FAST_FUNC udhcp_send_kernel_packet(struct dhcp_packet *dhcp_pkt,
         padding = DHCP_OPTIONS_BUFSIZE - 1 - udhcp_end_option(dhcp_pkt->options);
         if (padding > DHCP_SIZE - 300)
                 padding = DHCP_SIZE - 300;
-        result = send(fd, dhcp_pkt, DHCP_SIZE - padding, send_flags);
-        msg = "send";
+        result = safe_write(fd, dhcp_pkt, DHCP_SIZE - padding);
+        msg = "write";
  ret_close:
         close(fd);
         if (result < 0) {
diff --git a/networking/wget.c b/networking/wget.c
index 85eae061b..bd2f4edcf 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -137,6 +137,7 @@
 //usage:       "Retrieve files via HTTP or FTP\n"
 //usage:        IF_FEATURE_WGET_LONG_OPTIONS(
 //usage:     "\n        --spider        Only check URL existence: $? is 0 if exists"
+///////:     "\n        --no-check-certificate  Don't validate the server's certificate"
 //usage:        )
 //usage:     "\n        -c              Continue retrieval of aborted transfer"
 //usage:     "\n        -q              Quiet"
@@ -271,6 +272,7 @@ enum {
         WGET_OPT_HEADER     = (1 << 10) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
         WGET_OPT_POST_DATA  = (1 << 11) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
         WGET_OPT_SPIDER     = (1 << 12) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
+        WGET_OPT_NO_CHECK_CERT = (1 << 13) * ENABLE_FEATURE_WGET_LONG_OPTIONS,
 };
 
 enum {
@@ -721,6 +723,9 @@ static void spawn_ssl_client(const char *host, int network_fd, int flags)
         int pid;
         char *servername, *p;
 
+        if (!(option_mask32 & WGET_OPT_NO_CHECK_CERT))
+                bb_error_msg("note: TLS certificate validation not implemented");
+
         servername = xstrdup(host);
         p = strrchr(servername, ':');
         if (p) *p = '\0';
@@ -1362,6 +1367,7 @@ However, in real world it was observed that some web servers
                                                 /* server.user remains untouched */
                                                 free(server.allocated);
                                                 server.allocated = NULL;
+                                                server.protocol = target.protocol;
                                                 server.host = target.host;
                                                 /* strip_ipv6_scope_id(target.host); - no! */
                                                 /* we assume remote never gives us IPv6 addr with scope id */
@@ -1434,10 +1440,9 @@ IF_DESKTOP(	"tries\0"            Required_argument "t")
                 "header\0"           Required_argument "\xff"
                 "post-data\0"        Required_argument "\xfe"
                 "spider\0"           No_argument       "\xfd"
+                "no-check-certificate\0" No_argument   "\xfc"
                 /* Ignored (we always use PASV): */
 IF_DESKTOP(     "passive-ftp\0"      No_argument       "\xf0")
-                /* Ignored (we don't do ssl) */
-IF_DESKTOP(     "no-check-certificate\0" No_argument   "\xf0")
                 /* Ignored (we don't support caching) */
 IF_DESKTOP(     "no-cache\0"         No_argument       "\xf0")
 IF_DESKTOP(     "no-verbose\0"       No_argument       "\xf0")
@@ -1497,6 +1502,7 @@ IF_DESKTOP(	"no-parent\0"        No_argument       "\xf0")
         if (option_mask32 & WGET_OPT_HEADER) bb_error_msg("--header");
         if (option_mask32 & WGET_OPT_POST_DATA) bb_error_msg("--post-data");
         if (option_mask32 & WGET_OPT_SPIDER) bb_error_msg("--spider");
+        if (option_mask32 & WGET_OPT_NO_CHECK_CERT) bb_error_msg("--no-check-certificate");
         exit(0);
 #endif
         argv += optind;
diff --git a/printutils/Config.src b/printutils/Config.src
index e53b9d093..5f1d65f6c 100644
--- a/printutils/Config.src
+++ b/printutils/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Print Utilities"
diff --git a/procps/Config.src b/procps/Config.src
index 515d79938..2b1b8ab11 100644
--- a/procps/Config.src
+++ b/procps/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Process Utilities"
diff --git a/runit/Config.src b/runit/Config.src
index 8cde89680..403ec8724 100644
--- a/runit/Config.src
+++ b/runit/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Runit Utilities"
diff --git a/scripts/bb_release b/scripts/bb_release
index 8aa380438..2e146bf84 100755
--- a/scripts/bb_release
+++ b/scripts/bb_release
@@ -15,20 +15,8 @@ VERSION=`ls busybox-*.tar.gz | sed 's/busybox-\(.*\)\.tar\.gz/\1/'`
 
 zcat busybox-$VERSION.tar.gz | bzip2 > busybox-$VERSION.tar.bz2
 
-test -f busybox-$VERSION.tar.gz || { echo "no busybox-$VERSION.tar.gz"; exit 1; }
-test -f busybox-$VERSION.tar.bz2 || { echo "no busybox-$VERSION.tar.bz2"; exit 1; }
-
-signit()
-{
-echo "$1 released `date -r $1 -R`
-
-MD5:  `md5sum $1`
-SHA1: `sha1sum $1`
-
-To verify this signature, you can obtain my public key
-from http://busybox.net/~vda/vda_pubkey.gpg
-" | gpg --clearsign > "$1.sign"
-}
-
-signit busybox-$VERSION.tar.gz
-signit busybox-$VERSION.tar.bz2
+for releasefile in busybox-$VERSION.tar.gz busybox-$VERSION.tar.bz2; do
+    test -f $releasefile || { echo "no $releasefile"; exit 1; }
+    gpg --detach-sign $releasefile
+    sha256sum $releasefile > $releasefile.sha256
+done
diff --git a/scripts/randomtest b/scripts/randomtest
index 635978338..94709a99f 100755
--- a/scripts/randomtest
+++ b/scripts/randomtest
@@ -57,6 +57,8 @@ if test x"$LIBC" = x"glibc"; then
         | grep -v CONFIG_FEATURE_2_4_MODULES \
         | grep -v CONFIG_FEATURE_USE_BSS_TAIL \
         | grep -v CONFIG_DEBUG_SANITIZE \
+        | grep -v CONFIG_FEATURE_MOUNT_NFS \
+        | grep -v CONFIG_FEATURE_INETD_RPC \
         >.config.new
         mv .config.new .config
         echo '# CONFIG_STATIC is not set' >>.config
@@ -66,6 +68,9 @@ if test x"$LIBC" = x"glibc"; then
         echo '# CONFIG_FEATURE_2_4_MODULES is not set' >>.config
         echo '# CONFIG_FEATURE_USE_BSS_TAIL is not set' >>.config
         echo '# CONFIG_DEBUG_SANITIZE is not set' >>.config
+        # 2018: current glibc versions no longer include rpc/rpc.h
+        echo '# CONFIG_FEATURE_MOUNT_NFS is not set' >>.config
+        echo '# CONFIG_FEATURE_INETD_RPC is not set' >>.config
 fi
 
 # If uclibc, build static, and remove some things
@@ -86,6 +91,7 @@ if test x"$LIBC" = x"uclibc"; then
         | grep -v CONFIG_UNSHARE \
         | grep -v CONFIG_FALLOCATE \
         | grep -v CONFIG_UDHCPC6 \
+        | grep -v CONFIG_NSLOOKUP \
         | grep -v CONFIG_ASH_INTERNAL_GLOB \
         >.config.new
         mv .config.new .config
@@ -103,6 +109,7 @@ if test x"$LIBC" = x"uclibc"; then
         echo '# CONFIG_UNSHARE is not set' >>.config
         echo '# CONFIG_FALLOCATE is not set' >>.config
         echo '# CONFIG_UDHCPC6 is not set' >>.config
+        echo '# CONFIG_NSLOOKUP is not set' >>.config
         echo 'CONFIG_ASH_INTERNAL_GLOB=y' >>.config
 fi
 
diff --git a/selinux/Config.src b/selinux/Config.src
index 9cb755a0f..f8fcdadf9 100644
--- a/selinux/Config.src
+++ b/selinux/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "SELinux Utilities"
diff --git a/shell/Config.src b/shell/Config.src
index 81c4ec874..959d3cb42 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Shells"
diff --git a/shell/ash.c b/shell/ash.c
index 7fa9dae21..4bd1c2c9d 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -8929,7 +8929,8 @@ describe_command(char *command, const char *path, int describe_command_verbose)
 
         case CMDFUNCTION:
                 if (describe_command_verbose) {
-                        out1str(" is a shell function");
+                        /*out1str(" is a shell function");*/
+                        out1str(" is a function"); /* bash says this */
                 } else {
                         out1str(command);
                 }
diff --git a/shell/ash_test/ash-glob/glob_altvalue1.right b/shell/ash_test/ash-glob/glob_altvalue1.right
new file mode 100644
index 000000000..bd3592229
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_altvalue1.right
@@ -0,0 +1,7 @@
+1u: glob_altvalue1.tests
+2u: glob_altvalue1.t*
+3u: glob_altvalue1.t*
+4u: glob_altvalue1.t*
+1q: glob_altvalue1.t*
+2q: 'glob_altvalue1.t*'
+3q: glob_altvalue1.t*
diff --git a/shell/ash_test/ash-glob/glob_altvalue1.tests b/shell/ash_test/ash-glob/glob_altvalue1.tests
new file mode 100755
index 000000000..5483d63e6
--- /dev/null
+++ b/shell/ash_test/ash-glob/glob_altvalue1.tests
@@ -0,0 +1,13 @@
+x=x
+
+echo 1u: ${x:+glob_altvalue1.t*}
+echo 2u: ${x:+'glob_altvalue1.t*'}
+echo 3u: ${x:+"glob_altvalue1.t*"}
+echo 4u: ${x:+glob_altvalue1.t\*}
+##echo 5u: ${x:+"glob_altvalue1.t\*"}
+
+echo 1q: "${x:+glob_altvalue1.t*}"
+echo 2q: "${x:+'glob_altvalue1.t*'}"
+echo 3q: "${x:+"glob_altvalue1.t*"}"
+##echo 4q: "${x:+glob_altvalue1.t\*}"
+##echo 5q: "${x:+"glob_altvalue1.t\*"}"
diff --git a/shell/ash_test/ash-heredoc/heredoc.right b/shell/ash_test/ash-heredoc/heredoc.right
index baf115166..85d36dae9 100644
--- a/shell/ash_test/ash-heredoc/heredoc.right
+++ b/shell/ash_test/ash-heredoc/heredoc.right
@@ -16,6 +16,6 @@ tab 3
 abc
 def ghi
 jkl mno
-fff is a shell function
+fff is a function
 hi
 there
diff --git a/shell/ash_test/ash-heredoc/heredocA.right b/shell/ash_test/ash-heredoc/heredocA.right
new file mode 100644
index 000000000..7326d9603
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocA.right
@@ -0,0 +1 @@
+Ok
diff --git a/shell/ash_test/ash-heredoc/heredocA.tests b/shell/ash_test/ash-heredoc/heredocA.tests
new file mode 100755
index 000000000..440aaf906
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocA.tests
@@ -0,0 +1,4 @@
+{ cat <<EOF ;
+Ok
+EOF
+}
diff --git a/shell/ash_test/ash-heredoc/heredocB.right b/shell/ash_test/ash-heredoc/heredocB.right
new file mode 100644
index 000000000..43ba0b4f9
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocB.right
@@ -0,0 +1,3 @@
+one - alpha
+two - beta
+three - gamma
diff --git a/shell/ash_test/ash-heredoc/heredocB.tests b/shell/ash_test/ash-heredoc/heredocB.tests
new file mode 100755
index 000000000..45ea4687f
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredocB.tests
@@ -0,0 +1,12 @@
+while read line1; do
+        read line2 <&3
+        echo $line1 - $line2
+done <<EOF1 3<<EOF2
+one
+two
+three
+EOF1
+alpha
+beta
+gamma
+EOF2
diff --git a/shell/ash_test/ash-heredoc/heredoc_after_compound1.right b/shell/ash_test/ash-heredoc/heredoc_after_compound1.right
new file mode 100644
index 000000000..9052f7d1f
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_after_compound1.right
@@ -0,0 +1,2 @@
+Ok1
+Ok2
diff --git a/shell/ash_test/ash-heredoc/heredoc_after_compound1.tests b/shell/ash_test/ash-heredoc/heredoc_after_compound1.tests
new file mode 100755
index 000000000..e7cfb5be1
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_after_compound1.tests
@@ -0,0 +1,3 @@
+{ cat <<EOF; }; echo Ok2
+Ok1
+EOF
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.right b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.tests b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.tests
new file mode 100755
index 000000000..1d2a26504
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+Ok1
+EO\
+F
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty3.right b/shell/ash_test/ash-heredoc/heredoc_empty3.right
new file mode 100644
index 000000000..0b54a9c93
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty3.right
@@ -0,0 +1,2 @@
+
+Ok
diff --git a/shell/ash_test/ash-heredoc/heredoc_empty3.tests b/shell/ash_test/ash-heredoc/heredoc_empty3.tests
new file mode 100755
index 000000000..828c2dd89
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_empty3.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+
+Ok
+EOF
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue1.right b/shell/ash_test/ash-quoting/dollar_altvalue1.right
new file mode 100644
index 000000000..5cd495d3b
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue1.right
@@ -0,0 +1,16 @@
+Unquoted b c d
+|b|
+|c|
+|d|
+Unquoted 'b c' d
+|b c|
+|d|
+Unquoted "b c" d
+|b c|
+|d|
+Quoted b c d
+|b c d|
+Quoted 'b c' d
+|'b c' d|
+Quoted "b c" d
+|b c d|
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue1.tests b/shell/ash_test/ash-quoting/dollar_altvalue1.tests
new file mode 100755
index 000000000..f4dc8caec
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue1.tests
@@ -0,0 +1,16 @@
+f() { for i; do echo "|$i|"; done; }
+x=a
+
+echo Unquoted b c d
+f ${x:+b c d}
+echo Unquoted "'b c' d"
+f ${x:+'b c' d}
+echo Unquoted '"b c" d'
+f ${x:+"b c" d}
+
+echo Quoted b c d
+f "${x:+b c d}"
+echo Quoted "'b c' d"
+f "${x:+'b c' d}"
+echo Quoted '"b c" d'
+f "${x:+"b c" d}"
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue2.right b/shell/ash_test/ash-quoting/dollar_altvalue2.right
new file mode 100644
index 000000000..7cf37e379
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue2.right
@@ -0,0 +1,69 @@
+Unquoted '':
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Unquoted "":
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Quoted '':
+start:
+|''|
+end
+start:
+|'' |
+end
+start:
+| ''|
+end
+start:
+| '' |
+end
+start:
+|'' ''|
+end
+
+Quoted "":
+start:
+||
+end
+start:
+| |
+end
+start:
+| |
+end
+start:
+|  |
+end
+start:
+| |
+end
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue2.tests b/shell/ash_test/ash-quoting/dollar_altvalue2.tests
new file mode 100755
index 000000000..3377eb27f
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue2.tests
@@ -0,0 +1,33 @@
+f() { echo start:; for i; do echo "|$i|"; done; echo end; }
+x=a
+
+echo "Unquoted '':"
+f ${x:+''}
+f ${x:+'' }
+f ${x:+ ''}
+f ${x:+ '' }
+f ${x:+'' ''}
+
+echo
+echo 'Unquoted "":'
+f ${x:+""}
+f ${x:+"" }
+f ${x:+ ""}
+f ${x:+ "" }
+f ${x:+"" ""}
+
+echo
+echo "Quoted '':"
+f "${x:+''}"
+f "${x:+'' }"
+f "${x:+ ''}"
+f "${x:+ '' }"
+f "${x:+'' ''}"
+
+echo
+echo 'Quoted "":'
+f "${x:+""}"
+f "${x:+"" }"
+f "${x:+ ""}"
+f "${x:+ "" }"
+f "${x:+"" ""}"
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue9.right b/shell/ash_test/ash-quoting/dollar_altvalue9.right
new file mode 100644
index 000000000..39342fe7c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue9.right
@@ -0,0 +1,26 @@
+Unquoted 1:
+|a|
+|x y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|zb|
+Quoted 1:
+|a 'x y' 1 2 ''  1 2 A B C D zb|
+Unquoted 2:
+|ax y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|z|
+|b|
+Quoted 2:
+|a 'x y' 1 2 ''  1 2 A B C D z b|
diff --git a/shell/ash_test/ash-quoting/dollar_altvalue9.tests b/shell/ash_test/ash-quoting/dollar_altvalue9.tests
new file mode 100755
index 000000000..27a6f4f3c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_altvalue9.tests
@@ -0,0 +1,17 @@
+f() { for i; do echo "|$i|"; done; }
+
+echo Unquoted 1:
+x='1 2'; f a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b
+echo Quoted 1:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b"
+
+echo Unquoted 2:
+x='1 2'; f a${x:+'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b
+echo Quoted 2:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b"
+
+#echo Unquoted 3:
+#e=
+#x='1 2'; f a${x:+'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b
+#echo Quoted 3:
+#x='1 2'; f "a${x:+ 'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b"
diff --git a/shell/ash_test/ash-quoting/dollar_repl_bash1.right b/shell/ash_test/ash-quoting/dollar_repl_bash1.right
new file mode 100644
index 000000000..f5e9309f4
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_repl_bash1.right
@@ -0,0 +1,14 @@
+|y|
+|zx|
+|y|
+|zx|
+|y zx|
+|y zx|
+|y|
+|zy|
+|z|
+|y|
+|zy|
+|z|
+|y zy z|
+|y zy z|
diff --git a/shell/ash_test/ash-quoting/dollar_repl_bash1.tests b/shell/ash_test/ash-quoting/dollar_repl_bash1.tests
new file mode 100755
index 000000000..912635925
--- /dev/null
+++ b/shell/ash_test/ash-quoting/dollar_repl_bash1.tests
@@ -0,0 +1,12 @@
+f() { for i; do echo "|$i|"; done; }
+v=xx
+
+f ${v/'x'/"y z"}
+f ${v/"x"/'y z'}
+f "${v/'x'/"y z"}"
+f "${v/"x"/'y z'}"
+
+f ${v//'x'/"y z"}
+f ${v//"x"/'y z'}
+f "${v//'x'/"y z"}"
+f "${v//"x"/'y z'}"
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp.right b/shell/ash_test/ash-quoting/squote_in_varexp.right
index a75c0bfd6..4a457021b 100644
--- a/shell/ash_test/ash-quoting/squote_in_varexp.right
+++ b/shell/ash_test/ash-quoting/squote_in_varexp.right
@@ -1,5 +1,9 @@
 z
 z
+z
+z
+y
+y
 y
 y
 Ok:0
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp.tests b/shell/ash_test/ash-quoting/squote_in_varexp.tests
index a2d05a246..4afc52107 100755
--- a/shell/ash_test/ash-quoting/squote_in_varexp.tests
+++ b/shell/ash_test/ash-quoting/squote_in_varexp.tests
@@ -1,6 +1,10 @@
 x=yz
 echo ${x#'y'}
 echo "${x#'y'}"
+echo ${x#"y"}
+echo "${x#"y"}"
 echo ${x%'z'}
 echo "${x%'z'}"
+echo ${x%"z"}
+echo "${x%"z"}"
 echo Ok:$?
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp2.right b/shell/ash_test/ash-quoting/squote_in_varexp2.right
index 9d0add3c5..d03047024 100644
--- a/shell/ash_test/ash-quoting/squote_in_varexp2.right
+++ b/shell/ash_test/ash-quoting/squote_in_varexp2.right
@@ -1,3 +1,5 @@
 Nothing:
 Nothing:
+Nothing:
+Nothing:
 Ok:0
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp2.tests b/shell/ash_test/ash-quoting/squote_in_varexp2.tests
index 806ad12b9..2797725cc 100755
--- a/shell/ash_test/ash-quoting/squote_in_varexp2.tests
+++ b/shell/ash_test/ash-quoting/squote_in_varexp2.tests
@@ -1,4 +1,6 @@
 x='\\\\'
 printf Nothing:'%s\n' ${x#'\\\\'}
 printf Nothing:'%s\n' "${x#'\\\\'}"
+printf Nothing:'%s\n' ${x#"\\\\\\\\"}
+printf Nothing:'%s\n' "${x#"\\\\\\\\"}"
 echo Ok:$?
diff --git a/shell/ash_test/ash-redir/redir_script.tests b/shell/ash_test/ash-redir/redir_script.tests
index 740daa461..a8d93ce4f 100755
--- a/shell/ash_test/ash-redir/redir_script.tests
+++ b/shell/ash_test/ash-redir/redir_script.tests
@@ -27,6 +27,10 @@ test x"$fds1" = x"$fds" \
 test x"$fds1" = x" 10>&- 3>&-" && \
 test x"$fds"  = x" 11>&- 3>&-" \
 && { echo "Ok: script fd is not closed"; exit 0; }
+# or we see that fd 3 moved to fd 10:
+test x"$fds1" = x" 3>&- 4>&-" && \
+test x"$fds"  = x" 10>&- 3>&-" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
 
 echo "Bug: script fd is closed"
 echo "fds1:$fds1"
diff --git a/shell/ash_test/ash-z_slow/many_ifs.tests b/shell/ash_test/ash-z_slow/many_ifs.tests
index 1f5b1b3a6..cf9a89874 100755
--- a/shell/ash_test/ash-z_slow/many_ifs.tests
+++ b/shell/ash_test/ash-z_slow/many_ifs.tests
@@ -229,8 +229,8 @@ do
                                                 '')     split "$d0$f1$d1$f2$d2$f3$d3" "[2]($f1)($f2)" "($f1)($f2)" ;;
                                                 ' ')    ;;
                                                 *)      x=$f2$d2$f3$d3
-                                                        x=${x# } #was x=${x#' '} hush needs fixing for this to work
-                                                        x=${x% } #was x=${x%' '}
+                                                        x=${x#' '}
+                                                        x=${x%' '}
                                                         split "$d0$f1$d1$f2$d2$f3$d3" "[3]($f1)($f2)($f3)" "($f1)($x)"
                                                         ;;
                                                 esac
diff --git a/shell/hush.c b/shell/hush.c
index c77700175..e3c6e2de9 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -357,6 +357,9 @@
 #else
 # define CLEAR_RANDOM_T(rnd) ((void)0)
 #endif
+#ifndef O_CLOEXEC
+# define O_CLOEXEC 0
+#endif
 #ifndef F_DUPFD_CLOEXEC
 # define F_DUPFD_CLOEXEC F_DUPFD
 #endif
@@ -439,21 +442,22 @@
 
 /* If you comment out one of these below, it will be #defined later
  * to perform debug printfs to stderr: */
-#define debug_printf(...)        do {} while (0)
+#define debug_printf(...)         do {} while (0)
 /* Finer-grained debug switches */
-#define debug_printf_parse(...)  do {} while (0)
-#define debug_print_tree(a, b)   do {} while (0)
-#define debug_printf_exec(...)   do {} while (0)
-#define debug_printf_env(...)    do {} while (0)
-#define debug_printf_jobs(...)   do {} while (0)
-#define debug_printf_expand(...) do {} while (0)
-#define debug_printf_varexp(...) do {} while (0)
-#define debug_printf_glob(...)   do {} while (0)
-#define debug_printf_redir(...)  do {} while (0)
-#define debug_printf_list(...)   do {} while (0)
-#define debug_printf_subst(...)  do {} while (0)
-#define debug_printf_prompt(...) do {} while (0)
-#define debug_printf_clean(...)  do {} while (0)
+#define debug_printf_parse(...)   do {} while (0)
+#define debug_printf_heredoc(...) do {} while (0)
+#define debug_print_tree(a, b)    do {} while (0)
+#define debug_printf_exec(...)    do {} while (0)
+#define debug_printf_env(...)     do {} while (0)
+#define debug_printf_jobs(...)    do {} while (0)
+#define debug_printf_expand(...)  do {} while (0)
+#define debug_printf_varexp(...)  do {} while (0)
+#define debug_printf_glob(...)    do {} while (0)
+#define debug_printf_redir(...)   do {} while (0)
+#define debug_printf_list(...)    do {} while (0)
+#define debug_printf_subst(...)   do {} while (0)
+#define debug_printf_prompt(...)  do {} while (0)
+#define debug_printf_clean(...)   do {} while (0)
 
 #define ERR_PTR ((void*)(long)1)
 
@@ -534,6 +538,7 @@ typedef struct o_string {
          * possibly empty one: word"", wo''rd etc. */
         smallint has_quoted_part;
         smallint has_empty_slot;
+        smallint ended_in_ifs;
 } o_string;
 enum {
         EXP_FLAG_SINGLEWORD     = 0x80, /* must be 0x80 */
@@ -554,11 +559,27 @@ static const char *const assignment_flag[] = {
 };
 #endif
 
+/* We almost can use standard FILE api, but we need an ability to move
+ * its fd when redirects coincide with it. No api exists for that
+ * (RFE for it at https://sourceware.org/bugzilla/show_bug.cgi?id=21902).
+ * HFILE is our internal alternative. Only supports reading.
+ * Since we now can, we incorporate linked list of all opened HFILEs
+ * into the struct (used to be a separate mini-list).
+ */
+typedef struct HFILE {
+        char *cur;
+        char *end;
+        struct HFILE *next_hfile;
+        int is_stdin;
+        int fd;
+        char buf[1024];
+} HFILE;
+
 typedef struct in_str {
         const char *p;
         int peek_buf[2];
         int last_char;
-        FILE *file;
+        HFILE *file;
 } in_str;
 
 /* The descrip member of this structure is only used to make
@@ -812,14 +833,6 @@ enum {
         NUM_OPT_O
 };
 
-
-struct FILE_list {
-        struct FILE_list *next;
-        FILE *fp;
-        int fd;
-};
-
-
 /* "Globals" within this file */
 /* Sorted roughly by size (smaller offsets == smaller code) */
 struct globals {
@@ -952,7 +965,7 @@ struct globals {
         unsigned lineno;
         char *lineno_var;
 #endif
-        struct FILE_list *FILE_list;
+        HFILE *HFILE_list;
         /* Which signals have non-DFL handler (even with no traps set)?
          * Set at the start to:
          * (SIGQUIT + maybe SPECIAL_INTERACTIVE_SIGS + maybe SPECIAL_JOBSTOP_SIGS)
@@ -1218,6 +1231,10 @@ static const struct built_in_command bltins2[] = {
 # define debug_printf_parse(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
+#ifndef debug_printf_heredoc
+# define debug_printf_heredoc(...) (indent(), fdprintf(2, __VA_ARGS__))
+#endif
+
 #ifndef debug_printf_exec
 #define debug_printf_exec(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
@@ -1557,83 +1574,115 @@ static int xdup_CLOEXEC_and_close(int fd, int avoid_fd)
 }
 
 
-/* Manipulating the list of open FILEs */
-static FILE *remember_FILE(FILE *fp)
+/* Manipulating HFILEs */
+static HFILE *hfopen(const char *name)
 {
-        if (fp) {
-                struct FILE_list *n = xmalloc(sizeof(*n));
-                n->next = G.FILE_list;
-                G.FILE_list = n;
-                n->fp = fp;
-                n->fd = fileno(fp);
-                close_on_exec_on(n->fd);
+        HFILE *fp;
+        int fd;
+
+        fd = STDIN_FILENO;
+        if (name) {
+                fd = open(name, O_RDONLY | O_CLOEXEC);
+                if (fd < 0)
+                        return NULL;
+                if (O_CLOEXEC == 0) /* ancient libc */
+                        close_on_exec_on(fd);
         }
+
+        fp = xmalloc(sizeof(*fp));
+        fp->is_stdin = (name == NULL);
+        fp->fd = fd;
+        fp->cur = fp->end = fp->buf;
+        fp->next_hfile = G.HFILE_list;
+        G.HFILE_list = fp;
         return fp;
 }
-static void fclose_and_forget(FILE *fp)
+static void hfclose(HFILE *fp)
 {
-        struct FILE_list **pp = &G.FILE_list;
+        HFILE **pp = &G.HFILE_list;
         while (*pp) {
-                struct FILE_list *cur = *pp;
-                if (cur->fp == fp) {
-                        *pp = cur->next;
-                        free(cur);
+                HFILE *cur = *pp;
+                if (cur == fp) {
+                        *pp = cur->next_hfile;
                         break;
                 }
-                pp = &cur->next;
+                pp = &cur->next_hfile;
         }
-        fclose(fp);
+        if (fp->fd >= 0)
+                close(fp->fd);
+        free(fp);
 }
-static int save_FILEs_on_redirect(int fd, int avoid_fd)
+static int refill_HFILE_and_getc(HFILE *fp)
 {
-        struct FILE_list *fl = G.FILE_list;
+        int n;
+
+        if (fp->fd < 0) {
+                /* Already saw EOF */
+                return EOF;
+        }
+        /* Try to buffer more input */
+        fp->cur = fp->buf;
+        n = safe_read(fp->fd, fp->buf, sizeof(fp->buf));
+        if (n < 0) {
+                bb_perror_msg("read error");
+                n = 0;
+        }
+        fp->end = fp->buf + n;
+        if (n == 0) {
+                /* EOF/error */
+                close(fp->fd);
+                fp->fd = -1;
+                return EOF;
+        }
+        return (unsigned char)(*fp->cur++);
+}
+/* Inlined for common case of non-empty buffer.
+ */
+static ALWAYS_INLINE int hfgetc(HFILE *fp)
+{
+        if (fp->cur < fp->end)
+                return (unsigned char)(*fp->cur++);
+        /* Buffer empty */
+        return refill_HFILE_and_getc(fp);
+}
+static int move_HFILEs_on_redirect(int fd, int avoid_fd)
+{
+        HFILE *fl = G.HFILE_list;
         while (fl) {
                 if (fd == fl->fd) {
                         /* We use it only on script files, they are all CLOEXEC */
                         fl->fd = xdup_CLOEXEC_and_close(fd, avoid_fd);
                         debug_printf_redir("redirect_fd %d: matches a script fd, moving it to %d\n", fd, fl->fd);
-                        return 1;
+                        return 1; /* "found and moved" */
                 }
-                fl = fl->next;
-        }
-        return 0;
-}
-static void restore_redirected_FILEs(void)
-{
-        struct FILE_list *fl = G.FILE_list;
-        while (fl) {
-                int should_be = fileno(fl->fp);
-                if (fl->fd != should_be) {
-                        debug_printf_redir("restoring script fd from %d to %d\n", fl->fd, should_be);
-                        xmove_fd(fl->fd, should_be);
-                        fl->fd = should_be;
-                }
-                fl = fl->next;
+                fl = fl->next_hfile;
         }
+        return 0; /* "not in the list" */
 }
 #if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
-static void close_all_FILE_list(void)
+static void close_all_HFILE_list(void)
 {
-        struct FILE_list *fl = G.FILE_list;
+        HFILE *fl = G.HFILE_list;
         while (fl) {
-                /* fclose would also free FILE object.
+                /* hfclose would also free HFILE object.
                  * It is disastrous if we share memory with a vforked parent.
                  * I'm not sure we never come here after vfork.
                  * Therefore just close fd, nothing more.
                  */
-                /*fclose(fl->fp); - unsafe */
-                close(fl->fd);
-                fl = fl->next;
+                /*hfclose(fl); - unsafe */
+                if (fl->fd >= 0)
+                        close(fl->fd);
+                fl = fl->next_hfile;
         }
 }
 #endif
-static int fd_in_FILEs(int fd)
+static int fd_in_HFILEs(int fd)
 {
-        struct FILE_list *fl = G.FILE_list;
+        HFILE *fl = G.HFILE_list;
         while (fl) {
                 if (fl->fd == fd)
                         return 1;
-                fl = fl->next;
+                fl = fl->next_hfile;
         }
         return 0;
 }
@@ -2333,6 +2382,7 @@ static void set_pwd_var(unsigned flag)
         set_local_var(xasprintf("PWD=%s", get_cwd(/*force:*/ 1)), flag);
 }
 
+#if ENABLE_HUSH_UNSET || ENABLE_HUSH_GETOPTS
 static int unset_local_var_len(const char *name, int name_len)
 {
         struct variable *cur;
@@ -2366,14 +2416,14 @@ static int unset_local_var_len(const char *name, int name_len)
         return EXIT_SUCCESS;
 }
 
-#if ENABLE_HUSH_UNSET || ENABLE_HUSH_GETOPTS
 static int unset_local_var(const char *name)
 {
         return unset_local_var_len(name, strlen(name));
 }
 #endif
 
-#if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS
+#if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS \
+ || (ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT)
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
         char *var = xasprintf("%s=%s", name, val);
@@ -2422,35 +2472,33 @@ static void set_vars_and_save_old(char **strings)
                 char *eq;
 
                 eq = strchr(*s, '=');
-                if (eq) {
-                        var_pp = get_ptr_to_local_var(*s, eq - *s);
-                        if (var_pp) {
-                                var_p = *var_pp;
-                                if (var_p->flg_read_only) {
-                                        char **p;
-                                        bb_error_msg("%s: readonly variable", *s);
-                                        /*
-                                         * "VAR=V BLTIN" unsets VARs after BLTIN completes.
-                                         * If VAR is readonly, leaving it in the list
-                                         * after asssignment error (msg above)
-                                         * causes doubled error message later, on unset.
-                                         */
-                                        debug_printf_env("removing/freeing '%s' element\n", *s);
-                                        free(*s);
-                                        p = s;
-                                        do { *p = p[1]; p++; } while (*p);
-                                        goto next;
-                                }
-                                /* below, set_local_var() with nest level will
-                                 * "shadow" (remove) this variable from
-                                 * global linked list.
-                                 */
-                        }
-                        debug_printf_env("%s: env override '%s'/%u\n", __func__, *s, G.var_nest_level);
-                        set_local_var(*s, (G.var_nest_level << SETFLAG_VARLVL_SHIFT) | SETFLAG_EXPORT);
-                } else if (HUSH_DEBUG) {
+                if (HUSH_DEBUG && !eq)
                         bb_error_msg_and_die("BUG in varexp4");
+                var_pp = get_ptr_to_local_var(*s, eq - *s);
+                if (var_pp) {
+                        var_p = *var_pp;
+                        if (var_p->flg_read_only) {
+                                char **p;
+                                bb_error_msg("%s: readonly variable", *s);
+                                /*
+                                 * "VAR=V BLTIN" unsets VARs after BLTIN completes.
+                                 * If VAR is readonly, leaving it in the list
+                                 * after asssignment error (msg above)
+                                 * causes doubled error message later, on unset.
+                                 */
+                                debug_printf_env("removing/freeing '%s' element\n", *s);
+                                free(*s);
+                                p = s;
+                                do { *p = p[1]; p++; } while (*p);
+                                goto next;
+                        }
+                        /* below, set_local_var() with nest level will
+                         * "shadow" (remove) this variable from
+                         * global linked list.
+                         */
                 }
+                debug_printf_env("%s: env override '%s'/%u\n", __func__, *s, G.var_nest_level);
+                set_local_var(*s, (G.var_nest_level << SETFLAG_VARLVL_SHIFT) | SETFLAG_EXPORT);
                 s++;
  next: ;
         }
@@ -2469,7 +2517,7 @@ static void reinit_unicode_for_hush(void)
          */
         if (ENABLE_FEATURE_CHECK_UNICODE_IN_ENV
          || ENABLE_UNICODE_USING_LOCALE
-        ) {
+        ) {
                 const char *s = get_local_var_value("LC_ALL");
                 if (!s) s = get_local_var_value("LC_CTYPE");
                 if (!s) s = get_local_var_value("LANG");
@@ -2575,7 +2623,7 @@ static int get_user_input(struct in_str *i)
                 }
                 fflush_all();
 //FIXME: here ^C or SIGINT will have effect only after <Enter>
-                r = fgetc(i->file);
+                r = hfgetc(i->file);
                 /* In !ENABLE_FEATURE_EDITING we don't use read_line_input,
                  * no ^C masking happens during fgetc, no special code for ^C:
                  * it generates SIGINT as usual.
@@ -2595,22 +2643,22 @@ static int fgetc_interactive(struct in_str *i)
 {
         int ch;
         /* If it's interactive stdin, get new line. */
-        if (G_interactive_fd && i->file == stdin) {
+        if (G_interactive_fd && i->file->is_stdin) {
                 /* Returns first char (or EOF), the rest is in i->p[] */
                 ch = get_user_input(i);
                 G.promptmode = 1; /* PS2 */
                 debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
         } else {
                 /* Not stdin: script file, sourced file, etc */
-                do ch = fgetc(i->file); while (ch == '\0');
+                do ch = hfgetc(i->file); while (ch == '\0');
         }
         return ch;
 }
 #else
-static inline int fgetc_interactive(struct in_str *i)
+static ALWAYS_INLINE int fgetc_interactive(struct in_str *i)
 {
         int ch;
-        do ch = fgetc(i->file); while (ch == '\0');
+        do ch = hfgetc(i->file); while (ch == '\0');
         return ch;
 }
 #endif  /* INTERACTIVE */
@@ -2725,7 +2773,7 @@ static int i_peek2(struct in_str *i)
         ch = i->peek_buf[1];
         if (ch == 0) {
                 /* We did not read it yet, get it now */
-                do ch = fgetc(i->file); while (ch == '\0');
+                do ch = hfgetc(i->file); while (ch == '\0');
                 i->peek_buf[1] = ch;
         }
 
@@ -2769,10 +2817,10 @@ static int i_peek_and_eat_bkslash_nl(struct in_str *input)
         }
 }
 
-static void setup_file_in_str(struct in_str *i, FILE *f)
+static void setup_file_in_str(struct in_str *i, HFILE *fp)
 {
         memset(i, 0, sizeof(*i));
-        i->file = f;
+        i->file = fp;
         /* i->p = NULL; */
 }
 
@@ -2797,13 +2845,13 @@ static void o_reset_to_empty_unquoted(o_string *o)
                 o->data[0] = '\0';
 }
 
-static void o_free(o_string *o)
+static void o_free_and_set_NULL(o_string *o)
 {
         free(o->data);
         memset(o, 0, sizeof(*o));
 }
 
-static ALWAYS_INLINE void o_free_unsafe(o_string *o)
+static ALWAYS_INLINE void o_free(o_string *o)
 {
         free(o->data);
 }
@@ -3342,7 +3390,6 @@ static char **o_finalize_list(o_string *o, int n)
         char **list;
         int string_start;
 
-        n = o_save_ptr(o, n); /* force growth for list[n] if necessary */
         if (DEBUG_EXPAND)
                 debug_print_list("finalized", o, n);
         debug_printf_expand("finalized n:%d\n", n);
@@ -3530,6 +3577,8 @@ static void debug_print_tree(struct pipe *pi, int lvl)
                                 fdprintf(2, " '%s'", *argv);
                                 argv++;
                         }
+                        if (command->redirects)
+                                fdprintf(2, " {redir}");
                         fdprintf(2, "\n");
                         prn++;
                 }
@@ -3853,7 +3902,7 @@ static const struct reserved_combo* reserved_word(struct parse_context *ctx)
                         int len = old->as_string.length;
                         /* Concatenate halves */
                         o_addstr(&old->as_string, ctx->as_string.data);
-                        o_free_unsafe(&ctx->as_string);
+                        o_free(&ctx->as_string);
                         /* Find where leading keyword starts in first half */
                         str = old->as_string.data + len;
                         if (str > old->as_string.data)
@@ -4227,6 +4276,14 @@ static char *fetch_till_str(o_string *as_string,
         int prev = 0; /* not \ */
         int ch;
 
+        /* Starting with "" is necessary for this case:
+         * cat <<EOF
+         *
+         * xxx
+         * EOF
+         */
+        heredoc.data = xzalloc(1); /* start as "", not as NULL */
+
         goto jump_in;
 
         while (1) {
@@ -4236,9 +4293,10 @@ static char *fetch_till_str(o_string *as_string,
                 if (ch == '\n' || ch == EOF) {
  check_heredoc_end:
                         if ((heredoc_flags & HEREDOC_QUOTED) || prev != '\\') {
+                                /* End-of-line, and not a line continuation */
                                 if (strcmp(heredoc.data + past_EOL, word) == 0) {
                                         heredoc.data[past_EOL] = '\0';
-                                        debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
+                                        debug_printf_heredoc("parsed '%s' heredoc '%s'\n", word, heredoc.data);
                                         return heredoc.data;
                                 }
                                 if (ch == '\n') {
@@ -4261,17 +4319,32 @@ static char *fetch_till_str(o_string *as_string,
                                         if (ch == '\n')
                                                 goto check_heredoc_end;
                                 }
+                        } else {
+                                /* Backslash-line continuation in an unquoted
+                                 * heredoc. This does not need special handling
+                                 * for heredoc body (unquoted heredocs are
+                                 * expanded on "execution" and that would take
+                                 * care of this case too), but not the case
+                                 * of line continuation *in terminator*:
+                                 *  cat <<EOF
+                                 *  Ok1
+                                 *  EO\
+                                 *  F
+                                 */
+                                heredoc.data[--heredoc.length] = '\0';
+                                prev = 0; /* not '\' */
+                                continue;
                         }
                 }
                 if (ch == EOF) {
-                        o_free_unsafe(&heredoc);
-                        return NULL;
+                        o_free(&heredoc);
+                        return NULL; /* error */
                 }
                 o_addchr(&heredoc, ch);
                 nommu_addchr(as_string, ch);
                 if (prev == '\\' && ch == '\\')
                         /* Correctly handle foo\\<eol> (not a line cont.) */
-                        prev = 0; /* not \ */
+                        prev = 0; /* not '\' */
                 else
                         prev = ch;
         }
@@ -4280,21 +4353,24 @@ static char *fetch_till_str(o_string *as_string,
 /* Look at entire parse tree for not-yet-loaded REDIRECT_HEREDOCs
  * and load them all. There should be exactly heredoc_cnt of them.
  */
-static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_str *input)
+#if BB_MMU
+#define fetch_heredocs(as_string, pi, heredoc_cnt, input) \
+        fetch_heredocs(pi, heredoc_cnt, input)
+#endif
+static int fetch_heredocs(o_string *as_string, struct pipe *pi, int heredoc_cnt, struct in_str *input)
 {
-        struct pipe *pi = ctx->list_head;
-
         while (pi && heredoc_cnt) {
                 int i;
                 struct command *cmd = pi->cmds;
 
-                debug_printf_parse("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
+                debug_printf_heredoc("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
                                 pi->num_cmds,
-                                cmd->argv ? cmd->argv[0] : "NONE");
+                                cmd->argv ? cmd->argv[0] : "NONE"
+                );
                 for (i = 0; i < pi->num_cmds; i++) {
                         struct redir_struct *redir = cmd->redirects;
 
-                        debug_printf_parse("fetch_heredocs: %d cmd argv0:'%s'\n",
+                        debug_printf_heredoc("fetch_heredocs: %d cmd argv0:'%s'\n",
                                         i, cmd->argv ? cmd->argv[0] : "NONE");
                         while (redir) {
                                 if (redir->rd_type == REDIRECT_HEREDOC) {
@@ -4302,11 +4378,11 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
 
                                         redir->rd_type = REDIRECT_HEREDOC2;
                                         /* redir->rd_dup is (ab)used to indicate <<- */
-                                        p = fetch_till_str(&ctx->as_string, input,
+                                        p = fetch_till_str(as_string, input,
                                                         redir->rd_filename, redir->rd_dup);
                                         if (!p) {
                                                 syntax_error("unexpected EOF in here document");
-                                                return 1;
+                                                return -1;
                                         }
                                         free(redir->rd_filename);
                                         redir->rd_filename = p;
@@ -4314,31 +4390,36 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
                                 }
                                 redir = redir->next;
                         }
+                        if (cmd->group) {
+                                //bb_error_msg("%s:%u heredoc_cnt:%d", __func__, __LINE__, heredoc_cnt);
+                                heredoc_cnt = fetch_heredocs(as_string, cmd->group, heredoc_cnt, input);
+                                //bb_error_msg("%s:%u heredoc_cnt:%d", __func__, __LINE__, heredoc_cnt);
+                                if (heredoc_cnt < 0)
+                                        return heredoc_cnt; /* error */
+                        }
                         cmd++;
                 }
                 pi = pi->next;
         }
-#if 0
-        /* Should be 0. If it isn't, it's a parse error */
-        if (heredoc_cnt)
-                bb_error_msg_and_die("heredoc BUG 2");
-#endif
-        return 0;
+        return heredoc_cnt;
 }
 
 
 static int run_list(struct pipe *pi);
 #if BB_MMU
-#define parse_stream(pstring, input, end_trigger) \
-        parse_stream(input, end_trigger)
+#define parse_stream(pstring, heredoc_cnt_ptr, input, end_trigger) \
+        parse_stream(heredoc_cnt_ptr, input, end_trigger)
 #endif
 static struct pipe *parse_stream(char **pstring,
+                int *heredoc_cnt_ptr,
                 struct in_str *input,
                 int end_trigger);
 
-
+/* Returns number of heredocs not yet consumed,
+ * or -1 on error.
+ */
 static int parse_group(struct parse_context *ctx,
-        struct in_str *input, int ch)
+                struct in_str *input, int ch)
 {
         /* ctx->word contains characters seen prior to ( or {.
          * Typically it's empty, but for function defs,
@@ -4349,6 +4430,7 @@ static int parse_group(struct parse_context *ctx,
         char *as_string = NULL;
 #endif
         struct pipe *pipe_list;
+        int heredoc_cnt = 0;
         int endch;
         struct command *command = ctx->command;
 
@@ -4357,12 +4439,12 @@ static int parse_group(struct parse_context *ctx,
         if (ch == '(' && !ctx->word.has_quoted_part) {
                 if (ctx->word.length)
                         if (done_word(ctx))
-                                return 1;
+                                return -1;
                 if (!command->argv)
                         goto skip; /* (... */
                 if (command->argv[1]) { /* word word ... (... */
                         syntax_error_unexpected_ch('(');
-                        return 1;
+                        return -1;
                 }
                 /* it is "word(..." or "word (..." */
                 do
@@ -4370,7 +4452,7 @@ static int parse_group(struct parse_context *ctx,
                 while (ch == ' ' || ch == '\t');
                 if (ch != ')') {
                         syntax_error_unexpected_ch(ch);
-                        return 1;
+                        return -1;
                 }
                 nommu_addchr(&ctx->as_string, ch);
                 do
@@ -4378,7 +4460,7 @@ static int parse_group(struct parse_context *ctx,
                 while (ch == ' ' || ch == '\t' || ch == '\n');
                 if (ch != '{' && ch != '(') {
                         syntax_error_unexpected_ch(ch);
-                        return 1;
+                        return -1;
                 }
                 nommu_addchr(&ctx->as_string, ch);
                 command->cmd_type = CMD_FUNCDEF;
@@ -4392,9 +4474,9 @@ static int parse_group(struct parse_context *ctx,
          || ctx->word.has_quoted_part /* ""{... */
         ) {
                 syntax_error(NULL);
-                debug_printf_parse("parse_group return 1: "
+                debug_printf_parse("parse_group return -1: "
                         "syntax error, groups and arglists don't mix\n");
-                return 1;
+                return -1;
         }
 #endif
 
@@ -4412,7 +4494,7 @@ static int parse_group(struct parse_context *ctx,
                  && ch != '('   /* but "{(..." is allowed (without whitespace) */
                 ) {
                         syntax_error_unexpected_ch(ch);
-                        return 1;
+                        return -1;
                 }
                 if (ch != '(') {
                         ch = i_getch(input);
@@ -4420,7 +4502,9 @@ static int parse_group(struct parse_context *ctx,
                 }
         }
 
-        pipe_list = parse_stream(&as_string, input, endch);
+        debug_printf_heredoc("calling parse_stream, heredoc_cnt:%d\n", heredoc_cnt);
+        pipe_list = parse_stream(&as_string, &heredoc_cnt, input, endch);
+        debug_printf_heredoc("parse_stream returned: heredoc_cnt:%d\n", heredoc_cnt);
 #if !BB_MMU
         if (as_string)
                 o_addstr(&ctx->as_string, as_string);
@@ -4431,9 +4515,9 @@ static int parse_group(struct parse_context *ctx,
                 /* parse_stream already emitted error msg */
                 if (!BB_MMU)
                         free(as_string);
-                debug_printf_parse("parse_group return 1: "
+                debug_printf_parse("parse_group return -1: "
                         "parse_stream returned %p\n", pipe_list);
-                return 1;
+                return -1;
         }
 #if !BB_MMU
         as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
@@ -4464,15 +4548,14 @@ static int parse_group(struct parse_context *ctx,
 
         command->group = pipe_list;
 
-        debug_printf_parse("parse_group return 0\n");
-        return 0;
+        debug_printf_parse("parse_group return %d\n", heredoc_cnt);
+        return heredoc_cnt;
         /* command remains "open", available for possible redirects */
 #undef as_string
 }
 
 #if ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS
 /* Subroutines for copying $(...) and `...` things */
-static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote);
 /* '...' */
 static int add_till_single_quote(o_string *dest, struct in_str *input)
 {
@@ -4487,7 +4570,21 @@ static int add_till_single_quote(o_string *dest, struct in_str *input)
                 o_addchr(dest, ch);
         }
 }
+static int add_till_single_quote_dquoted(o_string *dest, struct in_str *input)
+{
+        while (1) {
+                int ch = i_getch(input);
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('\'');
+                        return 0;
+                }
+                if (ch == '\'')
+                        return 1;
+                o_addqchr(dest, ch);
+        }
+}
 /* "...\"...`..`...." - do we need to handle "...$(..)..." too? */
+static int add_till_backquote(o_string *dest, struct in_str *input, int in_dquote);
 static int add_till_double_quote(o_string *dest, struct in_str *input)
 {
         while (1) {
@@ -4577,7 +4674,9 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
 # endif
         end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
 
+#if ENABLE_HUSH_INTERACTIVE
         G.promptmode = 1; /* PS2 */
+#endif
         debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
 
         while (1) {
@@ -4885,34 +4984,15 @@ static int parse_dollar(o_string *as_string,
 }
 
 #if BB_MMU
-# if BASH_PATTERN_SUBST
-#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
-        encode_string(dest, input, dquote_end, process_bkslash)
-# else
-/* only ${var/pattern/repl} (its pattern part) needs additional mode */
-#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
+#define encode_string(as_string, dest, input, dquote_end) \
         encode_string(dest, input, dquote_end)
-# endif
 #define as_string NULL
-
-#else /* !MMU */
-
-# if BASH_PATTERN_SUBST
-/* all parameters are needed, no macro tricks */
-# else
-#define encode_string(as_string, dest, input, dquote_end, process_bkslash) \
-        encode_string(as_string, dest, input, dquote_end)
-# endif
 #endif
 static int encode_string(o_string *as_string,
                 o_string *dest,
                 struct in_str *input,
-                int dquote_end,
-                int process_bkslash)
+                int dquote_end)
 {
-#if !BASH_PATTERN_SUBST
-        const int process_bkslash = 1;
-#endif
         int ch;
         int next;
 
@@ -4935,7 +5015,7 @@ static int encode_string(o_string *as_string,
         }
         debug_printf_parse("\" ch=%c (%d) escape=%d\n",
                         ch, ch, !!(dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-        if (process_bkslash && ch == '\\') {
+        if (ch == '\\') {
                 if (next == EOF) {
                         /* Testcase: in interactive shell a file with
                          *  echo "unterminated string\<eof>
@@ -4995,6 +5075,7 @@ static int encode_string(o_string *as_string,
  * or return ERR_PTR.
  */
 static struct pipe *parse_stream(char **pstring,
+                int *heredoc_cnt_ptr,
                 struct in_str *input,
                 int end_trigger)
 {
@@ -5013,8 +5094,7 @@ static struct pipe *parse_stream(char **pstring,
         /* If very first arg is "" or '', ctx.word.data may end up NULL.
          * Preventing this:
          */
-        o_addchr(&ctx.word, '\0');
-        ctx.word.length = 0;
+        ctx.word.data = xzalloc(1); /* start as "", not as NULL */
 
         /* We used to separate words on $IFS here. This was wrong.
          * $IFS is used only for word splitting when $var is expanded,
@@ -5052,7 +5132,7 @@ static struct pipe *parse_stream(char **pstring,
                         if (done_word(&ctx)) {
                                 goto parse_error;
                         }
-                        o_free(&ctx.word);
+                        o_free_and_set_NULL(&ctx.word);
                         done_pipe(&ctx, PIPE_SEQ);
                         pi = ctx.list_head;
                         /* If we got nothing... */
@@ -5069,9 +5149,13 @@ static struct pipe *parse_stream(char **pstring,
                         if (pstring)
                                 *pstring = ctx.as_string.data;
                         else
-                                o_free_unsafe(&ctx.as_string);
+                                o_free(&ctx.as_string);
 #endif
+                        // heredoc_cnt must be 0 here anyway
+                        //if (heredoc_cnt_ptr)
+                        //      *heredoc_cnt_ptr = heredoc_cnt;
                         debug_leave();
+                        debug_printf_heredoc("parse_stream return heredoc_cnt:%d\n", heredoc_cnt);
                         debug_printf_parse("parse_stream return %p\n", pi);
                         return pi;
                 }
@@ -5198,7 +5282,9 @@ static struct pipe *parse_stream(char **pstring,
                                  * "case ... in <newline> word) ..."
                                  */
                                 if (IS_NULL_CMD(ctx.command)
-                                 && ctx.word.length == 0 && !ctx.word.has_quoted_part
+                                 && ctx.word.length == 0
+                                 && !ctx.word.has_quoted_part
+                                 && heredoc_cnt == 0
                                 ) {
                                         /* This newline can be ignored. But...
                                          * Without check #1, interactive shell
@@ -5226,12 +5312,11 @@ static struct pipe *parse_stream(char **pstring,
                                 }
                                 /* Treat newline as a command separator. */
                                 done_pipe(&ctx, PIPE_SEQ);
-                                debug_printf_parse("heredoc_cnt:%d\n", heredoc_cnt);
+                                debug_printf_heredoc("heredoc_cnt:%d\n", heredoc_cnt);
                                 if (heredoc_cnt) {
-                                        if (fetch_heredocs(heredoc_cnt, &ctx, input)) {
+                                        heredoc_cnt = fetch_heredocs(&ctx.as_string, ctx.list_head, heredoc_cnt, input);
+                                        if (heredoc_cnt != 0)
                                                 goto parse_error;
-                                        }
-                                        heredoc_cnt = 0;
                                 }
                                 ctx.is_assignment = MAYBE_ASSIGNMENT;
                                 debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
@@ -5280,19 +5365,6 @@ static struct pipe *parse_stream(char **pstring,
                     )
 #endif
                 ) {
-                        if (heredoc_cnt) {
-                                /* This is technically valid:
-                                 * { cat <<HERE; }; echo Ok
-                                 * heredoc
-                                 * heredoc
-                                 * HERE
-                                 * but we don't support this.
-                                 * We require heredoc to be in enclosing {}/(),
-                                 * if any.
-                                 */
-                                syntax_error_unterm_str("here document");
-                                goto parse_error;
-                        }
                         if (done_word(&ctx)) {
                                 goto parse_error;
                         }
@@ -5303,13 +5375,13 @@ static struct pipe *parse_stream(char **pstring,
                         if (!HAS_KEYWORDS
                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
                         ) {
-                                o_free(&ctx.word);
+                                o_free_and_set_NULL(&ctx.word);
 #if !BB_MMU
                                 debug_printf_parse("as_string2 '%s'\n", ctx.as_string.data);
                                 if (pstring)
                                         *pstring = ctx.as_string.data;
                                 else
-                                        o_free_unsafe(&ctx.as_string);
+                                        o_free(&ctx.as_string);
 #endif
                                 if (ch != ';' && IS_NULL_PIPE(ctx.list_head)) {
                                         /* Example: bare "{ }", "()" */
@@ -5317,6 +5389,9 @@ static struct pipe *parse_stream(char **pstring,
                                         syntax_error_unexpected_ch(ch);
                                         goto parse_error2;
                                 }
+                                if (heredoc_cnt_ptr)
+                                        *heredoc_cnt_ptr = heredoc_cnt;
+                                debug_printf_heredoc("parse_stream return heredoc_cnt:%d\n", heredoc_cnt);
                                 debug_printf_parse("parse_stream return %p: "
                                                 "end_trigger char found\n",
                                                 ctx.list_head);
@@ -5360,7 +5435,7 @@ static struct pipe *parse_stream(char **pstring,
                         if (next == '<') {
                                 redir_style = REDIRECT_HEREDOC;
                                 heredoc_cnt++;
-                                debug_printf_parse("++heredoc_cnt=%d\n", heredoc_cnt);
+                                debug_printf_heredoc("++heredoc_cnt=%d\n", heredoc_cnt);
                                 ch = i_getch(input);
                                 nommu_addchr(&ctx.as_string, ch);
                         } else if (next == '>') {
@@ -5444,7 +5519,7 @@ static struct pipe *parse_stream(char **pstring,
                         }
                         if (ctx.is_assignment == NOT_ASSIGNMENT)
                                 ctx.word.o_expflags |= EXP_FLAG_ESC_GLOB_CHARS;
-                        if (!encode_string(&ctx.as_string, &ctx.word, input, '"', /*process_bkslash:*/ 1))
+                        if (!encode_string(&ctx.as_string, &ctx.word, input, '"'))
                                 goto parse_error;
                         ctx.word.o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
                         continue; /* get next char */
@@ -5538,16 +5613,22 @@ static struct pipe *parse_stream(char **pstring,
                                 continue; /* get next char */
                         }
 #endif
-                case '{':
-                        if (parse_group(&ctx, input, ch) != 0) {
+                        /* fall through */
+                case '{': {
+                        int n = parse_group(&ctx, input, ch);
+                        if (n < 0) {
                                 goto parse_error;
                         }
+                        debug_printf_heredoc("parse_group done, needs heredocs:%d\n", n);
+                        heredoc_cnt += n;
                         goto new_cmd;
+                }
                 case ')':
 #if ENABLE_HUSH_CASE
                         if (ctx.ctx_res_w == RES_MATCH)
                                 goto case_semi;
 #endif
+
                 case '}':
                         /* proper use of this character is caught by end_trigger:
                          * if we see {, we call parse_group(..., end_trigger='}')
@@ -5587,7 +5668,7 @@ static struct pipe *parse_stream(char **pstring,
                         free_pipe_list(pctx->list_head);
                         debug_printf_clean("freed list %p\n", pctx->list_head);
 #if !BB_MMU
-                        o_free_unsafe(&pctx->as_string);
+                        o_free(&pctx->as_string);
 #endif
                         IF_HAS_KEYWORDS(p2 = pctx->stack;)
                         if (pctx != &ctx) {
@@ -5618,6 +5699,7 @@ static char *expand_string_to_string(const char *str, int EXP_flags, int do_unba
 #if ENABLE_HUSH_TICK
 static int process_command_subs(o_string *dest, const char *s);
 #endif
+static int expand_vars_to_list(o_string *output, int n, char *arg);
 
 /* expand_strvec_to_strvec() takes a list of strings, expands
  * all variable references within and returns a pointer to
@@ -5662,10 +5744,10 @@ static void o_addblock_duplicate_backslash(o_string *o, const char *str, int len
 /* Store given string, finalizing the word and starting new one whenever
  * we encounter IFS char(s). This is used for expanding variable values.
  * End-of-string does NOT finalize word: think about 'echo -$VAR-'.
- * Return in *ended_with_ifs:
+ * Return in output->ended_in_ifs:
  * 1 - ended with IFS char, else 0 (this includes case of empty str).
  */
-static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const char *str)
+static int expand_on_ifs(o_string *output, int n, const char *str)
 {
         int last_is_ifs = 0;
 
@@ -5728,8 +5810,7 @@ static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const cha
                 }
         }
 
-        if (ended_with_ifs)
-                *ended_with_ifs = last_is_ifs;
+        output->ended_in_ifs = last_is_ifs;
         debug_print_list("expand_on_ifs[1]", output, n);
         return n;
 }
@@ -5741,45 +5822,288 @@ static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const cha
  * Returns malloced string.
  * As an optimization, we return NULL if expansion is not needed.
  */
-#if !BASH_PATTERN_SUBST
-/* only ${var/pattern/repl} (its pattern part) needs additional mode */
-#define encode_then_expand_string(str, process_bkslash, do_unbackslash) \
-        encode_then_expand_string(str)
-#endif
-static char *encode_then_expand_string(const char *str, int process_bkslash, int do_unbackslash)
+static char *encode_then_expand_string(const char *str)
 {
-#if !BASH_PATTERN_SUBST
-        enum { do_unbackslash = 1 };
-#endif
         char *exp_str;
         struct in_str input;
         o_string dest = NULL_O_STRING;
+        const char *cp;
 
-        if (!strchr(str, '$')
-         && !strchr(str, '\\')
+        cp = str;
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') break;
+                if (*cp == '\\') break;
 #if ENABLE_HUSH_TICK
-         && !strchr(str, '`')
+                if (*cp == '`') break;
 #endif
-        ) {
-                return NULL;
+                cp++;
         }
 
         /* We need to expand. Example:
          * echo $(($a + `echo 1`)) $((1 + $((2)) ))
          */
         setup_string_in_str(&input, str);
-        encode_string(NULL, &dest, &input, EOF, process_bkslash);
+        encode_string(NULL, &dest, &input, EOF);
 //TODO: error check (encode_string returns 0 on error)?
         //bb_error_msg("'%s' -> '%s'", str, dest.data);
         exp_str = expand_string_to_string(dest.data,
+                        EXP_FLAG_ESC_GLOB_CHARS,
+                        /*unbackslash:*/ 1
+        );
+        //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
+        o_free(&dest);
+        return exp_str;
+}
+
+/* Expanding ARG in ${var#ARG}, ${var%ARG}, or ${var/ARG/ARG}.
+ * These can contain single- and double-quoted strings,
+ * and treated as if the ARG string is initially unquoted. IOW:
+ * ${var#ARG} and "${var#ARG}" treat ARG the same (ARG can even be
+ * a dquoted string: "${var#"zz"}"), the difference only comes later
+ * (word splitting and globbing of the ${var...} result).
+ */
+#if !BASH_PATTERN_SUBST
+#define encode_then_expand_vararg(str, handle_squotes, do_unbackslash) \
+        encode_then_expand_vararg(str, handle_squotes)
+#endif
+static char *encode_then_expand_vararg(const char *str, int handle_squotes, int do_unbackslash)
+{
+#if !BASH_PATTERN_SUBST
+        const int do_unbackslash = 0;
+#endif
+        char *exp_str;
+        struct in_str input;
+        o_string dest = NULL_O_STRING;
+        const char *cp;
+
+        cp = str;
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') break;
+                if (*cp == '\\') break;
+                if (*cp == '\'') break;
+                if (*cp == '"') break;
+#if ENABLE_HUSH_TICK
+                if (*cp == '`') break;
+#endif
+                cp++;
+        }
+
+        setup_string_in_str(&input, str);
+        dest.data = xzalloc(1); /* start as "", not as NULL */
+        exp_str = NULL;
+
+        for (;;) {
+                int ch;
+
+                ch = i_getch(&input);
+                debug_printf_parse("%s: ch=%c (%d) escape=%d\n",
+                                __func__, ch, ch, !!dest.o_expflags);
+
+                if (!dest.o_expflags) {
+                        if (ch == EOF)
+                                break;
+                        if (handle_squotes && ch == '\'') {
+                                if (!add_till_single_quote_dquoted(&dest, &input))
+                                        goto ret; /* error */
+                                continue;
+                        }
+                }
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('"');
+                        goto ret; /* error */
+                }
+                if (ch == '"') {
+                        dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
+                        continue;
+                }
+                if (ch == '\\') {
+                        ch = i_getch(&input);
+                        if (ch == EOF) {
+//example? error message?       syntax_error_unterm_ch('"');
+                                debug_printf_parse("%s: error: \\<eof>\n", __func__);
+                                goto ret;
+                        }
+                        o_addqchr(&dest, ch);
+                        continue;
+                }
+                if (ch == '$') {
+                        if (!parse_dollar(NULL, &dest, &input, /*quote_mask:*/ 0x80)) {
+                                debug_printf_parse("%s: error: parse_dollar returned 0 (error)\n", __func__);
+                                goto ret;
+                        }
+                        continue;
+                }
+#if ENABLE_HUSH_TICK
+                if (ch == '`') {
+                        //unsigned pos = dest->length;
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(&dest, 0x80 | '`');
+                        if (!add_till_backquote(&dest, &input,
+                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_ESC_GLOB_CHARS set */
+                                )
+                        ) {
+                                goto ret; /* error */
+                        }
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
+                        continue;
+                }
+#endif
+                o_addQchr(&dest, ch);
+        } /* for (;;) */
+
+        debug_printf_parse("encode: '%s' -> '%s'\n", str, dest.data);
+        exp_str = expand_string_to_string(dest.data,
                         do_unbackslash ? EXP_FLAG_ESC_GLOB_CHARS : 0,
                         do_unbackslash
         );
-        //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
-        o_free_unsafe(&dest);
+ ret:
+        debug_printf_parse("expand: '%s' -> '%s'\n", dest.data, exp_str);
+        o_free(&dest);
         return exp_str;
 }
 
+/* Expanding ARG in ${var+ARG}, ${var-ARG}
+ */
+static int encode_then_append_var_plusminus(o_string *output, int n,
+                const char *str, int dquoted)
+{
+        struct in_str input;
+        o_string dest = NULL_O_STRING;
+
+#if 0 //todo?
+        const char *cp;
+        cp = str;
+        for (;;) {
+                if (!*cp) return NULL; /* string has no special chars */
+                if (*cp == '$') break;
+                if (*cp == '\\') break;
+                if (*cp == '\'') break;
+                if (*cp == '"') break;
+#if ENABLE_HUSH_TICK
+                if (*cp == '`') break;
+#endif
+                cp++;
+        }
+#endif
+
+        setup_string_in_str(&input, str);
+
+        for (;;) {
+                int ch;
+
+                ch = i_getch(&input);
+                debug_printf_parse("%s: ch=%c (%d) escape=%x\n",
+                                __func__, ch, ch, dest.o_expflags);
+
+                if (!dest.o_expflags) {
+                        if (ch == EOF)
+                                break;
+                        if (!dquoted && strchr(G.ifs, ch)) {
+                                /* PREFIX${x:d${e}f ...} and we met space: expand "d${e}f" and start new word.
+                                 * do not assume we are at the start of the word (PREFIX above).
+                                 */
+                                if (dest.data) {
+                                        n = expand_vars_to_list(output, n, dest.data);
+                                        o_free_and_set_NULL(&dest);
+                                        o_addchr(output, '\0');
+                                        n = o_save_ptr(output, n); /* create next word */
+                                } else
+                                if (output->length != o_get_last_ptr(output, n)
+                                 || output->has_quoted_part
+                                ) {
+                                        /* For these cases:
+                                         * f() { for i; do echo "|$i|"; done; }; x=x
+                                         * f a${x:+ }b  # 1st condition
+                                         * |a|
+                                         * |b|
+                                         * f ""${x:+ }b  # 2nd condition
+                                         * ||
+                                         * |b|
+                                         */
+                                        o_addchr(output, '\0');
+                                        n = o_save_ptr(output, n); /* create next word */
+                                }
+                                continue;
+                        }
+                        if (!dquoted && ch == '\'') {
+                                if (!add_till_single_quote_dquoted(&dest, &input))
+                                        goto ret; /* error */
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                continue;
+                        }
+                }
+                if (ch == EOF) {
+                        syntax_error_unterm_ch('"');
+                        goto ret; /* error */
+                }
+                if (ch == '"') {
+                        dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
+                        if (dest.o_expflags) {
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                                o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        }
+                        continue;
+                }
+                if (ch == '\\') {
+                        ch = i_getch(&input);
+                        if (ch == EOF) {
+//example? error message?       syntax_error_unterm_ch('"');
+                                debug_printf_parse("%s: error: \\<eof>\n", __func__);
+                                goto ret;
+                        }
+                        o_addqchr(&dest, ch);
+                        continue;
+                }
+                if (ch == '$') {
+                        if (!parse_dollar(NULL, &dest, &input, /*quote_mask:*/ (dest.o_expflags || dquoted) ? 0x80 : 0)) {
+                                debug_printf_parse("%s: error: parse_dollar returned 0 (error)\n", __func__);
+                                goto ret;
+                        }
+                        continue;
+                }
+#if ENABLE_HUSH_TICK
+                if (ch == '`') {
+                        //unsigned pos = dest->length;
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        o_addchr(&dest, (dest.o_expflags || dquoted) ? 0x80 | '`' : '`');
+                        if (!add_till_backquote(&dest, &input,
+                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_ESC_GLOB_CHARS set */
+                                )
+                        ) {
+                                goto ret; /* error */
+                        }
+                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
+                        //debug_printf_subst("SUBST RES3 '%s'\n", dest->data + pos);
+                        continue;
+                }
+#endif
+                if (dquoted) {
+                        /* Always glob-protect if in dquotes:
+                         * x=x; echo "${x:+/bin/c*}" - prints: /bin/c*
+                         * x=x; echo "${x:+"/bin/c*"}" - prints: /bin/c*
+                         */
+                        o_addqchr(&dest, ch);
+                } else {
+                        /* Glob-protect only if char is quoted:
+                         * x=x; echo ${x:+/bin/c*} - prints many filenames
+                         * x=x; echo ${x:+"/bin/c*"} - prints: /bin/c*
+                         */
+                        o_addQchr(&dest, ch);
+                }
+        } /* for (;;) */
+
+        if (dest.data) {
+                n = expand_vars_to_list(output, n, dest.data);
+        }
+ ret:
+        o_free(&dest);
+        return n;
+}
+
 #if ENABLE_FEATURE_SH_MATH
 static arith_t expand_and_evaluate_arith(const char *arg, const char **errmsg_p)
 {
@@ -5790,7 +6114,7 @@ static arith_t expand_and_evaluate_arith(const char *arg, const char **errmsg_p)
         math_state.lookupvar = get_local_var_value;
         math_state.setvar = set_local_var_from_halves;
         //math_state.endofname = endofname;
-        exp_str = encode_then_expand_string(arg, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
+        exp_str = encode_then_expand_string(arg);
         res = arith(&math_state, exp_str ? exp_str : arg);
         free(exp_str);
         if (errmsg_p)
@@ -5857,16 +6181,33 @@ static char *replace_pattern(char *val, const char *pattern, const char *repl, c
 }
 #endif /* BASH_PATTERN_SUBST */
 
-/* Helper:
- * Handles <SPECIAL_VAR_SYMBOL>varname...<SPECIAL_VAR_SYMBOL> construct.
+static int append_str_maybe_ifs_split(o_string *output, int n,
+                int first_ch, const char *val)
+{
+        if (!(first_ch & 0x80)) { /* unquoted $VAR */
+                debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
+                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+                if (val && val[0])
+                        n = expand_on_ifs(output, n, val);
+        } else { /* quoted "$VAR" */
+                output->has_quoted_part = 1;
+                debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
+                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+                if (val && val[0])
+                        o_addQstr(output, val);
+        }
+        return n;
+}
+
+/* Handle <SPECIAL_VAR_SYMBOL>varname...<SPECIAL_VAR_SYMBOL> construct.
  */
-static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, char **pp)
+static NOINLINE int expand_one_var(o_string *output, int n,
+                int first_ch, char *arg, char **pp)
 {
         const char *val;
         char *to_be_freed;
         char *p;
         char *var;
-        char first_char;
         char exp_op;
         char exp_save = exp_save; /* for compiler */
         char *exp_saveptr; /* points to expansion operator */
@@ -5880,10 +6221,10 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         var = arg;
         exp_saveptr = arg[1] ? strchr(VAR_ENCODED_SUBST_OPS, arg[1]) : NULL;
         arg0 = arg[0];
-        first_char = arg[0] = arg0 & 0x7f;
+        arg[0] = (arg0 & 0x7f);
         exp_op = 0;
 
-        if (first_char == '#' && arg[1] /* ${#...} but not ${#} */
+        if (arg[0] == '#' && arg[1] /* ${#...} but not ${#} */
          && (!exp_saveptr               /* and ( not(${#<op_char>...}) */
             || (arg[2] == '\0' && strchr(SPECIAL_VARS_STR, arg[1])) /* or ${#C} "len of $C" ) */
             )           /* NB: skipping ^^^specvar check mishandles ${#::2} */
@@ -5894,7 +6235,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         } else {
                 /* Maybe handle parameter expansion */
                 if (exp_saveptr /* if 2nd char is one of expansion operators */
-                 && strchr(NUMERIC_SPECVARS_STR, first_char) /* 1st char is special variable */
+                 && strchr(NUMERIC_SPECVARS_STR, arg[0]) /* 1st char is special variable */
                 ) {
                         /* ${?:0}, ${#[:]%0} etc */
                         exp_saveptr = var + 1;
@@ -5923,9 +6264,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         /* Look up the variable in question */
         if (isdigit(var[0])) {
                 /* parse_dollar should have vetted var for us */
-                int n = xatoi_positive(var);
-                if (n < G.global_argc)
-                        val = G.global_argv[n];
+                int nn = xatoi_positive(var);
+                if (nn < G.global_argc)
+                        val = G.global_argv[nn];
                 /* else val remains NULL: $N with too big N */
         } else {
                 switch (var[0]) {
@@ -5963,6 +6304,9 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                          * Word is expanded to produce a glob pattern.
                          * Then var's value is matched to it and matching part removed.
                          */
+//FIXME: ${x#...${...}...}
+//should evaluate inner ${...} even if x is "" and no shrinking of it is possible -
+//inner ${...} may have side effects!
                         if (val && val[0]) {
                                 char *t;
                                 char *exp_exp_word;
@@ -5971,20 +6315,16 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 if (exp_op == *exp_word)  /* ## or %% */
                                         exp_word++;
                                 debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
-                                /*
-                                 * process_bkslash:1 unbackslash:1 breaks this:
-                                 * a='a\\'; echo ${a%\\\\} # correct output is: a
-                                 * process_bkslash:1 unbackslash:0 breaks this:
-                                 * a='a}'; echo ${a%\}}    # correct output is: a
-                                 */
-                                exp_exp_word = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 0);
+                                exp_exp_word = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 0);
                                 if (exp_exp_word)
                                         exp_word = exp_exp_word;
-                                debug_printf_expand("expand: exp_exp_word:'%s'\n", exp_word);
-                                /* HACK ALERT. We depend here on the fact that
+                                debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
+                                /*
+                                 * HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
                                  * are actually in writable memory:
-                                 * scan_and_match momentarily stores NULs there. */
+                                 * scan_and_match momentarily stores NULs there.
+                                 */
                                 t = (char*)val;
                                 loc = scan_and_match(t, exp_word, scan_flags);
                                 debug_printf_expand("op:%c str:'%s' pat:'%s' res:'%s'\n", exp_op, t, exp_word, loc);
@@ -6017,7 +6357,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                  * (note that a*z _pattern_ is never globbed!)
                                  */
                                 char *pattern, *repl, *t;
-                                pattern = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 0);
+                                pattern = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 0);
                                 if (!pattern)
                                         pattern = xstrdup(exp_word);
                                 debug_printf_varexp("pattern:'%s'->'%s'\n", exp_word, pattern);
@@ -6025,7 +6365,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 exp_word = p;
                                 p = strchr(p, SPECIAL_VAR_SYMBOL);
                                 *p = '\0';
-                                repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 1);
+                                repl = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 1);
                                 debug_printf_varexp("repl:'%s'->'%s'\n", exp_word, repl);
                                 /* HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
@@ -6121,6 +6461,34 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                          *
                          * Colon forms (${var:-word}, ${var:=word} etc) do the same,
                          * but also treat null var as if it is unset.
+                         *
+                         * Word-splitting and single quote behavior:
+                         *
+                         * $ f() { for i; do echo "|$i|"; done; };
+                         *
+                         * $ x=; f ${x:?'x y' z}
+                         * bash: x: x y z              #BUG: does not abort, ${} results in empty expansion
+                         * $ x=; f "${x:?'x y' z}"
+                         * bash: x: x y z       # dash prints: dash: x: 'x y' z   #BUG: does not abort, ${} results in ""
+                         *
+                         * $ x=; f ${x:='x y' z}
+                         * |x|
+                         * |y|
+                         * |z|
+                         * $ x=; f "${x:='x y' z}"
+                         * |'x y' z|
+                         *
+                         * $ x=x; f ${x:+'x y' z}
+                         * |x y|
+                         * |z|
+                         * $ x=x; f "${x:+'x y' z}"
+                         * |'x y' z|
+                         *
+                         * $ x=; f ${x:-'x y' z}
+                         * |x y|
+                         * |z|
+                         * $ x=; f "${x:-'x y' z}"
+                         * |'x y' z|
                          */
                         int use_word = (!val || ((exp_save == ':') && !val[0]));
                         if (exp_op == '+')
@@ -6128,33 +6496,51 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                         debug_printf_expand("expand: op:%c (null:%s) test:%i\n", exp_op,
                                         (exp_save == ':') ? "true" : "false", use_word);
                         if (use_word) {
-                                to_be_freed = encode_then_expand_string(exp_word, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
-                                if (to_be_freed)
-                                        exp_word = to_be_freed;
-                                if (exp_op == '?') {
-                                        /* mimic bash message */
-                                        msg_and_die_if_script("%s: %s",
-                                                var,
-                                                exp_word[0]
-                                                ? exp_word
-                                                : "parameter null or not set"
-                                                /* ash has more specific messages, a-la: */
-                                                /*: (exp_save == ':' ? "parameter null or not set" : "parameter not set")*/
+                                if (exp_op == '+' || exp_op == '-') {
+                                        /* ${var+word} - use alternative value */
+                                        /* ${var-word} - use default value */
+                                        n = encode_then_append_var_plusminus(output, n, exp_word,
+                                                        /*dquoted:*/ (arg0 & 0x80)
                                         );
-//TODO: how interactive bash aborts expansion mid-command?
+                                        val = NULL;
                                 } else {
-                                        val = exp_word;
-                                }
-
-                                if (exp_op == '=') {
-                                        /* ${var=[word]} or ${var:=[word]} */
-                                        if (isdigit(var[0]) || var[0] == '#') {
+                                        /* ${var?word} - indicate error if unset */
+                                        /* ${var=word} - assign and use default value */
+                                        to_be_freed = encode_then_expand_vararg(exp_word,
+                                                        /*handle_squotes:*/ !(arg0 & 0x80),
+                                                        /*unbackslash:*/ 0
+                                        );
+                                        if (to_be_freed)
+                                                exp_word = to_be_freed;
+                                        if (exp_op == '?') {
                                                 /* mimic bash message */
-                                                msg_and_die_if_script("$%s: cannot assign in this way", var);
-                                                val = NULL;
+                                                msg_and_die_if_script("%s: %s",
+                                                        var,
+                                                        exp_word[0]
+                                                        ? exp_word
+                                                        : "parameter null or not set"
+                                                        /* ash has more specific messages, a-la: */
+                                                        /*: (exp_save == ':' ? "parameter null or not set" : "parameter not set")*/
+                                                );
+//TODO: how interactive bash aborts expansion mid-command?
+//It aborts the entire line, returns to prompt:
+// $ f() { for i; do echo "|$i|"; done; }; x=; f "${x:?'x y' z}"; echo YO
+// bash: x: x y z
+// $
+// ("echo YO" is not executed, neither the f function call)
                                         } else {
-                                                char *new_var = xasprintf("%s=%s", var, val);
-                                                set_local_var(new_var, /*flag:*/ 0);
+                                                val = exp_word;
+                                        }
+                                        if (exp_op == '=') {
+                                                /* ${var=[word]} or ${var:=[word]} */
+                                                if (isdigit(var[0]) || var[0] == '#') {
+                                                        /* mimic bash message */
+                                                        msg_and_die_if_script("$%s: cannot assign in this way", var);
+                                                        val = NULL;
+                                                } else {
+                                                        char *new_var = xasprintf("%s=%s", var, val);
+                                                        set_local_var(new_var, /*flag:*/ 0);
+                                                }
                                         }
                                 }
                         }
@@ -6164,10 +6550,12 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
         } /* if (exp_op) */
 
         arg[0] = arg0;
-
         *pp = p;
-        *to_be_freed_pp = to_be_freed;
-        return val;
+
+        n = append_str_maybe_ifs_split(output, n, first_ch, val);
+
+        free(to_be_freed);
+        return n;
 }
 
 /* Expand all variable references in given string, adding words to list[]
@@ -6181,30 +6569,22 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
          * expansion of right-hand side of assignment == 1-element expand.
          */
         char cant_be_null = 0; /* only bit 0x80 matters */
-        int ended_in_ifs = 0;  /* did last unquoted expansion end with IFS chars? */
         char *p;
 
         debug_printf_expand("expand_vars_to_list: arg:'%s' singleword:%x\n", arg,
                         !!(output->o_expflags & EXP_FLAG_SINGLEWORD));
-        debug_print_list("expand_vars_to_list", output, n);
-        n = o_save_ptr(output, n);
         debug_print_list("expand_vars_to_list[0]", output, n);
 
         while ((p = strchr(arg, SPECIAL_VAR_SYMBOL)) != NULL) {
                 char first_ch;
-                char *to_be_freed = NULL;
-                const char *val = NULL;
-#if ENABLE_HUSH_TICK
-                o_string subst_result = NULL_O_STRING;
-#endif
 #if ENABLE_FEATURE_SH_MATH
                 char arith_buf[sizeof(arith_t)*3 + 2];
 #endif
 
-                if (ended_in_ifs) {
+                if (output->ended_in_ifs) {
                         o_addchr(output, '\0');
                         n = o_save_ptr(output, n);
-                        ended_in_ifs = 0;
+                        output->ended_in_ifs = 0;
                 }
 
                 o_addblock(output, arg, p - arg);
@@ -6235,7 +6615,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         cant_be_null |= first_ch; /* do it for "$@" _now_, when we know it's not empty */
                         if (!(first_ch & 0x80)) { /* unquoted $* or $@ */
                                 while (G.global_argv[i]) {
-                                        n = expand_on_ifs(NULL, output, n, G.global_argv[i]);
+                                        n = expand_on_ifs(output, n, G.global_argv[i]);
                                         debug_printf_expand("expand_vars_to_list: argv %d (last %d)\n", i, G.global_argc - 1);
                                         if (G.global_argv[i++][0] && G.global_argv[i]) {
                                                 /* this argv[] is not empty and not last:
@@ -6272,19 +6652,25 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         }
                         break;
                 }
-                case SPECIAL_VAR_SYMBOL: /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
+                case SPECIAL_VAR_SYMBOL: {
+                        /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_SYMBOL> */
                         /* "Empty variable", used to make "" etc to not disappear */
                         output->has_quoted_part = 1;
-                        arg++;
                         cant_be_null = 0x80;
+                        arg++;
                         break;
+                }
                 case SPECIAL_VAR_QUOTED_SVS:
                         /* <SPECIAL_VAR_SYMBOL><SPECIAL_VAR_QUOTED_SVS><SPECIAL_VAR_SYMBOL> */
+                        /* "^C variable", represents literal ^C char (possible in scripts) */
+                        o_addchr(output, SPECIAL_VAR_SYMBOL);
                         arg++;
-                        val = SPECIAL_VAR_SYMBOL_STR;
                         break;
 #if ENABLE_HUSH_TICK
-                case '`': /* <SPECIAL_VAR_SYMBOL>`cmd<SPECIAL_VAR_SYMBOL> */
+                case '`': {
+                        /* <SPECIAL_VAR_SYMBOL>`cmd<SPECIAL_VAR_SYMBOL> */
+                        o_string subst_result = NULL_O_STRING;
+
                         *p = '\0'; /* replace trailing <SPECIAL_VAR_SYMBOL> */
                         arg++;
                         /* Can't just stuff it into output o_string,
@@ -6294,11 +6680,14 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         G.last_exitcode = process_command_subs(&subst_result, arg);
                         G.expand_exitcode = G.last_exitcode;
                         debug_printf_subst("SUBST RES:%d '%s'\n", G.last_exitcode, subst_result.data);
-                        val = subst_result.data;
-                        goto store_val;
+                        n = append_str_maybe_ifs_split(output, n, first_ch, subst_result.data);
+                        o_free(&subst_result);
+                        break;
+                }
 #endif
 #if ENABLE_FEATURE_SH_MATH
-                case '+': { /* <SPECIAL_VAR_SYMBOL>+cmd<SPECIAL_VAR_SYMBOL> */
+                case '+': {
+                        /* <SPECIAL_VAR_SYMBOL>+arith<SPECIAL_VAR_SYMBOL> */
                         arith_t res;
 
                         arg++; /* skip '+' */
@@ -6307,62 +6696,43 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         res = expand_and_evaluate_arith(arg, NULL);
                         debug_printf_subst("ARITH RES '"ARITH_FMT"'\n", res);
                         sprintf(arith_buf, ARITH_FMT, res);
-                        val = arith_buf;
+                        o_addstr(output, arith_buf);
                         break;
                 }
 #endif
                 default:
-                        val = expand_one_var(&to_be_freed, arg, &p);
- IF_HUSH_TICK(store_val:)
-                        if (!(first_ch & 0x80)) { /* unquoted $VAR */
-                                debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
-                                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                                if (val && val[0]) {
-                                        n = expand_on_ifs(&ended_in_ifs, output, n, val);
-                                        val = NULL;
-                                }
-                        } else { /* quoted $VAR, val will be appended below */
-                                output->has_quoted_part = 1;
-                                debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
-                                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                        }
+                        /* <SPECIAL_VAR_SYMBOL>varname[ops]<SPECIAL_VAR_SYMBOL> */
+                        n = expand_one_var(output, n, first_ch, arg, &p);
                         break;
                 } /* switch (char after <SPECIAL_VAR_SYMBOL>) */
 
-                if (val && val[0]) {
-                        o_addQstr(output, val);
-                }
-                free(to_be_freed);
-
                 /* Restore NULL'ed SPECIAL_VAR_SYMBOL.
                  * Do the check to avoid writing to a const string. */
                 if (*p != SPECIAL_VAR_SYMBOL)
                         *p = SPECIAL_VAR_SYMBOL;
-
-#if ENABLE_HUSH_TICK
-                o_free(&subst_result);
-#endif
                 arg = ++p;
         } /* end of "while (SPECIAL_VAR_SYMBOL is found) ..." */
 
-        if (arg[0]) {
-                if (ended_in_ifs) {
+        if (*arg) {
+                /* handle trailing string */
+                if (output->ended_in_ifs) {
                         o_addchr(output, '\0');
                         n = o_save_ptr(output, n);
                 }
                 debug_print_list("expand_vars_to_list[a]", output, n);
                 /* this part is literal, and it was already pre-quoted
-                 * if needed (much earlier), do not use o_addQstr here! */
-                o_addstr_with_NUL(output, arg);
+                 * if needed (much earlier), do not use o_addQstr here!
+                 */
+                o_addstr(output, arg);
                 debug_print_list("expand_vars_to_list[b]", output, n);
-        } else if (output->length == o_get_last_ptr(output, n) /* expansion is empty */
-         && !(cant_be_null & 0x80) /* and all vars were not quoted. */
+        } else
+        if (output->length == o_get_last_ptr(output, n) /* expansion is empty */
+         && !(cant_be_null & 0x80)   /* and all vars were not quoted */
+         && !output->has_quoted_part
         ) {
                 n--;
                 /* allow to reuse list[n] later without re-growth */
                 output->has_empty_slot = 1;
-        } else {
-                o_addchr(output, '\0');
         }
 
         return n;
@@ -6377,9 +6747,18 @@ static char **expand_variables(char **argv, unsigned expflags)
         output.o_expflags = expflags;
 
         n = 0;
-        while (*argv) {
-                n = expand_vars_to_list(&output, n, *argv);
-                argv++;
+        for (;;) {
+                /* go to next list[n] */
+                output.ended_in_ifs = 0;
+                n = o_save_ptr(&output, n);
+
+                if (!*argv)
+                        break;
+
+                /* expand argv[i] */
+                n = expand_vars_to_list(&output, n, *argv++);
+                /* if (!output->has_empty_slot) -- need this?? */
+                        o_addchr(&output, '\0');
         }
         debug_print_list("expand_variables", &output, n);
 
@@ -6429,13 +6808,20 @@ static char *expand_string_to_string(const char *str, int EXP_flags, int do_unba
         argv[0] = (char*)str;
         argv[1] = NULL;
         list = expand_variables(argv, EXP_flags | EXP_FLAG_SINGLEWORD);
-        if (HUSH_DEBUG)
-                if (!list[0] || list[1])
-                        bb_error_msg_and_die("BUG in varexp2");
-        /* actually, just move string 2*sizeof(char*) bytes back */
-        overlapping_strcpy((char*)list, list[0]);
-        if (do_unbackslash)
-                unbackslash((char*)list);
+        if (!list[0]) {
+                /* Example where it happens:
+                 * x=; echo ${x:-"$@"}
+                 */
+                ((char*)list)[0] = '\0';
+        } else {
+                if (HUSH_DEBUG)
+                        if (list[1])
+                                bb_error_msg_and_die("BUG in varexp2");
+                /* actually, just move string 2*sizeof(char*) bytes back */
+                overlapping_strcpy((char*)list, list[0]);
+                if (do_unbackslash)
+                        unbackslash((char*)list);
+        }
         debug_printf_expand("string_to_string=>'%s'\n", (char*)list);
         return (char*)list;
 }
@@ -6722,7 +7108,7 @@ static void parse_and_run_stream(struct in_str *inp, int end_trigger)
                         debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
                 }
 #endif
-                pipe_list = parse_stream(NULL, inp, end_trigger);
+                pipe_list = parse_stream(NULL, NULL, inp, end_trigger);
                 if (!pipe_list || pipe_list == ERR_PTR) { /* EOF/error */
                         /* If we are in "big" script
                          * (not in `cmd` or something similar)...
@@ -6763,19 +7149,19 @@ static void parse_and_run_string(const char *s)
         //IF_HUSH_LINENO_VAR(G.lineno = sv;)
 }
 
-static void parse_and_run_file(FILE *f)
+static void parse_and_run_file(HFILE *fp)
 {
         struct in_str input;
         IF_HUSH_LINENO_VAR(unsigned sv = G.lineno;)
 
         IF_HUSH_LINENO_VAR(G.lineno = 1;)
-        setup_file_in_str(&input, f);
+        setup_file_in_str(&input, fp);
         parse_and_run_stream(&input, ';');
         IF_HUSH_LINENO_VAR(G.lineno = sv;)
 }
 
 #if ENABLE_HUSH_TICK
-static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
+static int generate_stream_from_string(const char *s, pid_t *pid_p)
 {
         pid_t pid;
         int channel[2];
@@ -6877,7 +7263,7 @@ static FILE *generate_stream_from_string(const char *s, pid_t *pid_p)
         free(to_free);
 # endif
         close(channel[1]);
-        return remember_FILE(xfdopen_for_read(channel[0]));
+        return channel[0];
 }
 
 /* Return code is exit status of the process that is run. */
@@ -6887,7 +7273,7 @@ static int process_command_subs(o_string *dest, const char *s)
         pid_t pid;
         int status, ch, eol_cnt;
 
-        fp = generate_stream_from_string(s, &pid);
+        fp = xfdopen_for_read(generate_stream_from_string(s, &pid));
 
         /* Now send results of command back into original context */
         eol_cnt = 0;
@@ -6906,7 +7292,7 @@ static int process_command_subs(o_string *dest, const char *s)
         }
 
         debug_printf("done reading from `cmd` pipe, closing it\n");
-        fclose_and_forget(fp);
+        fclose(fp);
         /* We need to extract exitcode. Test case
          * "true; echo `sleep 1; false` $?"
          * should print 1 */
@@ -6931,7 +7317,7 @@ static void setup_heredoc(struct redir_struct *redir)
 
         expanded = NULL;
         if (!(redir->rd_dup & HEREDOC_QUOTED)) {
-                expanded = encode_then_expand_string(heredoc, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
+                expanded = encode_then_expand_string(heredoc);
                 if (expanded)
                         heredoc = expanded;
         }
@@ -7084,19 +7470,54 @@ static int save_fd_on_redirect(int fd, int avoid_fd, struct squirrel **sqp)
                 return 1; /* "we closed fd" */
         }
 #endif
-        /* Are we called from setup_redirects(squirrel==NULL)? Two cases:
-         * (1) Redirect in a forked child. No need to save FILEs' fds,
-         * we aren't going to use them anymore, ok to trash.
-         * (2) "exec 3>FILE". Bummer. We can save script FILEs' fds,
-         * but how are we doing to restore them?
-         * "fileno(fd) = new_fd" can't be done.
+        /* Are we called from setup_redirects(squirrel==NULL)
+         * in redirect in a [v]forked child?
          */
-        if (!sqp)
+        if (sqp == NULL) {
+                /* No need to move script fds.
+                 * For NOMMU case, it's actively wrong: we'd change ->fd
+                 * fields in memory for the parent, but parent's fds
+                 * aren't be moved, it would use wrong fd!
+                 * Reproducer: "cmd 3>FILE" in script.
+                 * If we would call move_HFILEs_on_redirect(), child would:
+                 *  fcntl64(3, F_DUPFD_CLOEXEC, 10)   = 10
+                 *  close(3)                          = 0
+                 * and change ->fd to 10 if fd#3 is a script fd. WRONG.
+                 */
+                //bb_error_msg("sqp == NULL: [v]forked child");
                 return 0;
+        }
 
         /* If this one of script's fds? */
-        if (save_FILEs_on_redirect(fd, avoid_fd))
-                return 1; /* yes. "we closed fd" */
+        if (move_HFILEs_on_redirect(fd, avoid_fd))
+                return 1; /* yes. "we closed fd" (actually moved it) */
+
+        /* Are we called for "exec 3>FILE"? Came through
+         * redirect_and_varexp_helper(squirrel=ERR_PTR) -> setup_redirects(ERR_PTR)
+         * This case used to fail for this script:
+         *  exec 3>FILE
+         *  echo Ok
+         *  ...100000 more lines...
+         *  echo Ok
+         * as follows:
+         *  read(3, "exec 3>FILE\necho Ok\necho Ok"..., 1024) = 1024
+         *  open("FILE", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 4
+         *  dup2(4, 3)                        = 3
+         *  ^^^^^^^^ oops, we lost fd#3 opened to our script!
+         *  close(4)                          = 0
+         *  write(1, "Ok\n", 3)               = 3
+         *  ...                               = 3
+         *  write(1, "Ok\n", 3)               = 3
+         *  read(3, 0x94fbc08, 1024)          = -1 EBADF (Bad file descriptor)
+         *  ^^^^^^^^ oops, wrong fd!!!
+         * With this case separate from sqp == NULL and *after* move_HFILEs,
+         * it now works:
+         */
+        if (sqp == ERR_PTR) {
+                /* Don't preserve redirected fds: exec is _meant_ to change these */
+                //bb_error_msg("sqp == ERR_PTR: exec >FILE");
+                return 0;
+        }
 
         /* Check whether it collides with any open fds (e.g. stdio), save fds as needed */
         *sqp = add_squirrel(*sqp, fd, avoid_fd);
@@ -7122,8 +7543,6 @@ static void restore_redirects(struct squirrel *sq)
         }
 
         /* If moved, G.interactive_fd stays on new fd, not restoring it */
-
-        restore_redirected_FILEs();
 }
 
 #if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
@@ -7131,7 +7550,7 @@ static void close_saved_fds_and_FILE_fds(void)
 {
         if (G_interactive_fd)
                 close(G_interactive_fd);
-        close_all_FILE_list();
+        close_all_HFILE_list();
 }
 #endif
 
@@ -7144,7 +7563,7 @@ static int internally_opened_fd(int fd, struct squirrel *sq)
                 return 1;
 #endif
         /* If this one of script's fds? */
-        if (fd_in_FILEs(fd))
+        if (fd_in_HFILEs(fd))
                 return 1;
 
         if (sq) for (i = 0; sq[i].orig_fd >= 0; i++) {
@@ -7169,7 +7588,7 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                         save_fd_on_redirect(redir->rd_fd, /*avoid:*/ 0, sqp);
                         /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
                          * of the heredoc */
-                        debug_printf_parse("set heredoc '%s'\n",
+                        debug_printf_redir("set heredoc '%s'\n",
                                         redir->rd_filename);
                         setup_heredoc(redir);
                         continue;
@@ -7181,8 +7600,7 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                         int mode;
 
                         if (redir->rd_filename == NULL) {
-                                /*
-                                 * Examples:
+                                /* Examples:
                                  * "cmd >" (no filename)
                                  * "cmd > <file" (2nd redirect starts too early)
                                  */
@@ -7238,7 +7656,7 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                          */
                 } else {
                         /* if newfd is a script fd or saved fd, simulate EBADF */
-                        if (internally_opened_fd(newfd, sqp ? *sqp : NULL)) {
+                        if (internally_opened_fd(newfd, sqp && sqp != ERR_PTR ? *sqp : NULL)) {
                                 //errno = EBADF;
                                 //bb_perror_msg_and_die("can't duplicate file descriptor");
                                 newfd = -1; /* same effect as code above */
@@ -7312,6 +7730,58 @@ static const struct built_in_command *find_builtin(const char *name)
         return find_builtin_helper(name, bltins2, &bltins2[ARRAY_SIZE(bltins2)]);
 }
 
+static void remove_nested_vars(void)
+{
+        struct variable *cur;
+        struct variable **cur_pp;
+
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
+                if (cur->var_nest_level <= G.var_nest_level) {
+                        cur_pp = &cur->next;
+                        continue;
+                }
+                /* Unexport */
+                if (cur->flg_export) {
+                        debug_printf_env("unexporting nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        bb_unsetenv(cur->varstr);
+                }
+                /* Remove from global list */
+                *cur_pp = cur->next;
+                /* Free */
+                if (!cur->max_len) {
+                        debug_printf_env("freeing nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        free(cur->varstr);
+                }
+                free(cur);
+        }
+}
+
+static void enter_var_nest_level(void)
+{
+        G.var_nest_level++;
+        debug_printf_env("var_nest_level++ %u\n", G.var_nest_level);
+
+        /* Try: f() { echo -n .; f; }; f
+         * struct variable::var_nest_level is uint16_t,
+         * thus limiting recursion to < 2^16.
+         * In any case, with 8 Mbyte stack SEGV happens
+         * not too long after 2^16 recursions anyway.
+         */
+        if (G.var_nest_level > 0xff00)
+                bb_error_msg_and_die("fatal recursion (depth %u)", G.var_nest_level);
+}
+
+static void leave_var_nest_level(void)
+{
+        G.var_nest_level--;
+        debug_printf_env("var_nest_level-- %u\n", G.var_nest_level);
+        if (HUSH_DEBUG && (int)G.var_nest_level < 0)
+                bb_error_msg_and_die("BUG: nesting underflow");
+
+        remove_nested_vars();
+}
+
 #if ENABLE_HUSH_FUNCTIONS
 static struct function **find_function_slot(const char *name)
 {
@@ -7398,58 +7868,6 @@ static void unset_func(const char *name)
 }
 # endif
 
-static void remove_nested_vars(void)
-{
-        struct variable *cur;
-        struct variable **cur_pp;
-
-        cur_pp = &G.top_var;
-        while ((cur = *cur_pp) != NULL) {
-                if (cur->var_nest_level <= G.var_nest_level) {
-                        cur_pp = &cur->next;
-                        continue;
-                }
-                /* Unexport */
-                if (cur->flg_export) {
-                        debug_printf_env("unexporting nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
-                        bb_unsetenv(cur->varstr);
-                }
-                /* Remove from global list */
-                *cur_pp = cur->next;
-                /* Free */
-                if (!cur->max_len) {
-                        debug_printf_env("freeing nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
-                        free(cur->varstr);
-                }
-                free(cur);
-        }
-}
-
-static void enter_var_nest_level(void)
-{
-        G.var_nest_level++;
-        debug_printf_env("var_nest_level++ %u\n", G.var_nest_level);
-
-        /* Try: f() { echo -n .; f; }; f
-         * struct variable::var_nest_level is uint16_t,
-         * thus limiting recursion to < 2^16.
-         * In any case, with 8 Mbyte stack SEGV happens
-         * not too long after 2^16 recursions anyway.
-         */
-        if (G.var_nest_level > 0xff00)
-                bb_error_msg_and_die("fatal recursion (depth %u)", G.var_nest_level);
-}
-
-static void leave_var_nest_level(void)
-{
-        G.var_nest_level--;
-        debug_printf_env("var_nest_level-- %u\n", G.var_nest_level);
-        if (HUSH_DEBUG && (int)G.var_nest_level < 0)
-                bb_error_msg_and_die("BUG: nesting underflow");
-
-        remove_nested_vars();
-}
-
 # if BB_MMU
 #define exec_function(to_free, funcp, argv) \
         exec_function(funcp, argv)
@@ -8253,8 +8671,8 @@ static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
  * subshell:     ( list ) [&]
  */
 #if !ENABLE_HUSH_MODE_X
-#define redirect_and_varexp_helper(old_vars_p, command, squirrel, argv_expanded) \
-        redirect_and_varexp_helper(old_vars_p, command, squirrel)
+#define redirect_and_varexp_helper(command, sqp, argv_expanded) \
+        redirect_and_varexp_helper(command, sqp)
 #endif
 static int redirect_and_varexp_helper(
                 struct command *command,
@@ -8271,10 +8689,6 @@ static int redirect_and_varexp_helper(
         /* this takes ownership of new_env[i] elements, and frees new_env: */
         set_vars_and_save_old(new_env);
 
-        /* setup_redirects acts on file descriptors, not FILEs.
-         * This is perfect for work that comes after exec().
-         * Is it really safe for inline use?  Experimentally,
-         * things seem to work. */
         return setup_redirects(command, sqp);
 }
 static NOINLINE int run_pipe(struct pipe *pi)
@@ -8363,7 +8777,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 }
 #endif
                 /* { list } */
-                debug_printf("non-subshell group\n");
+                debug_printf_exec("non-subshell group\n");
                 rcode = 1; /* exitcode if redir failed */
                 if (setup_redirects(command, &squirrel) == 0) {
                         debug_printf_exec(": run_list\n");
@@ -8475,7 +8889,10 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                  */
                                 enter_var_nest_level();
                                 G.shadowed_vars_pp = &old_vars;
-                                rcode = redirect_and_varexp_helper(command, /*squirrel:*/ NULL, argv_expanded);
+                                rcode = redirect_and_varexp_helper(command,
+                                        /*squirrel:*/ ERR_PTR,
+                                        argv_expanded
+                                );
                                 G.shadowed_vars_pp = sv_shadowed;
                                 /* rcode=1 can be if redir file can't be opened */
 
@@ -9528,14 +9945,13 @@ int hush_main(int argc, char **argv)
 
         /* If we are login shell... */
         if (flags & OPT_login) {
-                FILE *input;
+                HFILE *input;
                 debug_printf("sourcing /etc/profile\n");
-                input = fopen_for_read("/etc/profile");
+                input = hfopen("/etc/profile");
                 if (input != NULL) {
-                        remember_FILE(input);
                         install_special_sighandlers();
                         parse_and_run_file(input);
-                        fclose_and_forget(input);
+                        hfclose(input);
                 }
                 /* bash: after sourcing /etc/profile,
                  * tries to source (in the given order):
@@ -9548,7 +9964,7 @@ int hush_main(int argc, char **argv)
 
         /* -s is: hush -s ARGV1 ARGV2 (no SCRIPT) */
         if (!(flags & OPT_s) && G.global_argv[1]) {
-                FILE *input;
+                HFILE *input;
                 /*
                  * "bash <script>" (which is never interactive (unless -i?))
                  * sources $BASH_ENV here (without scanning $PATH).
@@ -9559,13 +9975,15 @@ int hush_main(int argc, char **argv)
                 G.global_argv++;
                 debug_printf("running script '%s'\n", G.global_argv[0]);
                 xfunc_error_retval = 127; /* for "hush /does/not/exist" case */
-                input = xfopen_for_read(G.global_argv[0]);
+                input = hfopen(G.global_argv[0]);
+                if (!input) {
+                        bb_simple_perror_msg_and_die(G.global_argv[0]);
+                }
                 xfunc_error_retval = 1;
-                remember_FILE(input);
                 install_special_sighandlers();
                 parse_and_run_file(input);
 #if ENABLE_FEATURE_CLEAN_UP
-                fclose_and_forget(input);
+                hfclose(input);
 #endif
                 goto final_return;
         }
@@ -9666,7 +10084,7 @@ int hush_main(int argc, char **argv)
                 G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
                 if (G_interactive_fd < 0) {
                         /* try to dup to any fd */
-                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO);
+                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
                         if (G_interactive_fd < 0)
                                 /* give up */
                                 G_interactive_fd = 0;
@@ -9695,7 +10113,7 @@ int hush_main(int argc, char **argv)
                 );
         }
 
-        parse_and_run_file(stdin);
+        parse_and_run_file(hfopen(NULL)); /* stdin */
 
  final_return:
         hush_exit(G.last_exitcode);
@@ -9803,41 +10221,41 @@ static int FAST_FUNC builtin_pwd(char **argv UNUSED_PARAM)
 
 static int FAST_FUNC builtin_eval(char **argv)
 {
-        int rcode = EXIT_SUCCESS;
-
         argv = skip_dash_dash(argv);
-        if (argv[0]) {
-                char *str = NULL;
 
-                if (argv[1]) {
-                        /* "The eval utility shall construct a command by
-                         * concatenating arguments together, separating
-                         * each with a <space> character."
-                         */
-                        char *p;
-                        unsigned len = 0;
-                        char **pp = argv;
-                        do
-                                len += strlen(*pp) + 1;
-                        while (*++pp);
-                        str = p = xmalloc(len);
-                        pp = argv;
-                        do {
-                                p = stpcpy(p, *pp);
-                                *p++ = ' ';
-                        } while (*++pp);
-                        p[-1] = '\0';
-                }
+        if (!argv[0])
+                return EXIT_SUCCESS;
 
+        if (!argv[1]) {
                 /* bash:
                  * eval "echo Hi; done" ("done" is syntax error):
                  * "echo Hi" will not execute too.
                  */
-                parse_and_run_string(str ? str : argv[0]);
+                parse_and_run_string(argv[0]);
+        } else {
+                /* "The eval utility shall construct a command by
+                 * concatenating arguments together, separating
+                 * each with a <space> character."
+                 */
+                char *str, *p;
+                unsigned len = 0;
+                char **pp = argv;
+                do
+                        len += strlen(*pp) + 1;
+                while (*++pp);
+                str = p = xmalloc(len);
+                pp = argv;
+                for (;;) {
+                        p = stpcpy(p, *pp);
+                        pp++;
+                        if (!*pp)
+                                break;
+                        *p++ = ' ';
+                }
+                parse_and_run_string(str);
                 free(str);
-                rcode = G.last_exitcode;
         }
-        return rcode;
+        return G.last_exitcode;
 }
 
 static int FAST_FUNC builtin_exec(char **argv)
@@ -10506,7 +10924,7 @@ Test that VAR is a valid variable name?
 static int FAST_FUNC builtin_source(char **argv)
 {
         char *arg_path, *filename;
-        FILE *input;
+        HFILE *input;
         save_arg_t sv;
         char *args_need_save;
 #if ENABLE_HUSH_FUNCTIONS
@@ -10530,10 +10948,10 @@ static int FAST_FUNC builtin_source(char **argv)
                         return EXIT_FAILURE;
                 }
         }
-        input = remember_FILE(fopen_or_warn(filename, "r"));
+        input = hfopen(filename);
         free(arg_path);
         if (!input) {
-                /* bb_perror_msg("%s", *argv); - done by fopen_or_warn */
+                bb_perror_msg("%s", filename);
                 /* POSIX: non-interactive shell should abort here,
                  * not merely fail. So far no one complained :)
                  */
@@ -10552,7 +10970,7 @@ static int FAST_FUNC builtin_source(char **argv)
         /* "false; . ./empty_line; echo Zero:$?" should print 0 */
         G.last_exitcode = 0;
         parse_and_run_file(input);
-        fclose_and_forget(input);
+        hfclose(input);
 
         if (args_need_save) /* can't use argv[1] instead: "shift" can mangle it */
                 restore_G_args(&sv, argv);
diff --git a/shell/hush_test/hush-glob/glob_altvalue1.right b/shell/hush_test/hush-glob/glob_altvalue1.right
new file mode 100644
index 000000000..bd3592229
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_altvalue1.right
@@ -0,0 +1,7 @@
+1u: glob_altvalue1.tests
+2u: glob_altvalue1.t*
+3u: glob_altvalue1.t*
+4u: glob_altvalue1.t*
+1q: glob_altvalue1.t*
+2q: 'glob_altvalue1.t*'
+3q: glob_altvalue1.t*
diff --git a/shell/hush_test/hush-glob/glob_altvalue1.tests b/shell/hush_test/hush-glob/glob_altvalue1.tests
new file mode 100755
index 000000000..5483d63e6
--- /dev/null
+++ b/shell/hush_test/hush-glob/glob_altvalue1.tests
@@ -0,0 +1,13 @@
+x=x
+
+echo 1u: ${x:+glob_altvalue1.t*}
+echo 2u: ${x:+'glob_altvalue1.t*'}
+echo 3u: ${x:+"glob_altvalue1.t*"}
+echo 4u: ${x:+glob_altvalue1.t\*}
+##echo 5u: ${x:+"glob_altvalue1.t\*"}
+
+echo 1q: "${x:+glob_altvalue1.t*}"
+echo 2q: "${x:+'glob_altvalue1.t*'}"
+echo 3q: "${x:+"glob_altvalue1.t*"}"
+##echo 4q: "${x:+glob_altvalue1.t\*}"
+##echo 5q: "${x:+"glob_altvalue1.t\*"}"
diff --git a/shell/hush_test/hush-heredoc/heredoc.right b/shell/hush_test/hush-heredoc/heredoc.right
new file mode 100644
index 000000000..9b9e2aae9
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc.right
@@ -0,0 +1,20 @@
+there
+one - alpha
+two - beta
+three - gamma
+hi\
+there$a
+stuff
+hi\
+there
+EO\
+F
+hi
+hi
+tab 1
+tab 2
+tab 3
+abc
+def ghi
+jkl mno
+fff is a function
diff --git a/shell/hush_test/hush-heredoc/heredoc.tests b/shell/hush_test/hush-heredoc/heredoc.tests
new file mode 100755
index 000000000..39345c51b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc.tests
@@ -0,0 +1,97 @@
+# check order and content of multiple here docs
+
+cat << EOF1 << EOF2
+hi
+EOF1
+there
+EOF2
+
+while read line1; do
+        read line2 <&3
+        echo $line1 - $line2
+done <<EOF1 3<<EOF2
+one
+two
+three
+EOF1
+alpha
+beta
+gamma
+EOF2
+
+
+# check quoted here-doc is protected
+
+a=foo
+cat << 'EOF'
+hi\
+there$a
+stuff
+EOF
+
+# check that quoted here-documents don't have \newline processing done
+
+cat << 'EOF'
+hi\
+there
+EO\
+F
+EOF
+true
+
+# check that \newline is removed at start of here-doc
+cat << EO\
+F
+hi
+EOF
+
+# check that \newline removal works for here-doc delimiter
+cat << EOF
+hi
+EO\
+F
+
+# check operation of tab removal in here documents
+cat <<- EOF
+        tab 1
+        tab 2
+        tab 3
+        EOF
+
+# check appending of text to file from here document
+rm -f /tmp/bash-zzz
+cat > /tmp/bash-zzz << EOF
+abc
+EOF
+cat >> /tmp/bash-zzz << EOF
+def ghi
+jkl mno
+EOF
+cat /tmp/bash-zzz
+rm -f /tmp/bash-zzz
+
+# make sure command printing puts the here-document as the last redirection
+# on the line, and the function export code preserves syntactic correctness
+fff()
+{
+  ed /tmp/foo <<ENDOFINPUT >/dev/null
+/^name/d
+w
+q
+ENDOFINPUT
+aa=1
+}
+
+type fff
+#ash# export -f fff
+#ash# ${THIS_SH} -c 'type fff'
+
+#hush# bash warns: "here-document at line N delimited by end-of-file",
+#hush# ash allows it,
+#hush# hush errors out for now:
+#hush# # check that end of file delimits a here-document
+#hush# # THIS MUST BE LAST!
+#hush#
+#hush# cat << EOF
+#hush# hi
+#hush# there
diff --git a/shell/hush_test/hush-heredoc/heredoc9.right b/shell/hush_test/hush-heredoc/heredoc9.right
new file mode 100644
index 000000000..ce0136250
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc9.right
@@ -0,0 +1 @@
+hello
diff --git a/shell/hush_test/hush-heredoc/heredoc9.tests b/shell/hush_test/hush-heredoc/heredoc9.tests
new file mode 100755
index 000000000..96c227cc1
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc9.tests
@@ -0,0 +1,9 @@
+echo hello >greeting
+cat <<EOF &&
+$(cat greeting)
+EOF
+{
+        echo $?
+        cat greeting
+} >/dev/null
+rm greeting
diff --git a/shell/hush_test/hush-heredoc/heredocA.right b/shell/hush_test/hush-heredoc/heredocA.right
new file mode 100644
index 000000000..7326d9603
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocA.right
@@ -0,0 +1 @@
+Ok
diff --git a/shell/hush_test/hush-heredoc/heredocA.tests b/shell/hush_test/hush-heredoc/heredocA.tests
new file mode 100755
index 000000000..440aaf906
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocA.tests
@@ -0,0 +1,4 @@
+{ cat <<EOF ;
+Ok
+EOF
+}
diff --git a/shell/hush_test/hush-heredoc/heredocB.right b/shell/hush_test/hush-heredoc/heredocB.right
new file mode 100644
index 000000000..43ba0b4f9
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocB.right
@@ -0,0 +1,3 @@
+one - alpha
+two - beta
+three - gamma
diff --git a/shell/hush_test/hush-heredoc/heredocB.tests b/shell/hush_test/hush-heredoc/heredocB.tests
new file mode 100755
index 000000000..45ea4687f
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredocB.tests
@@ -0,0 +1,12 @@
+while read line1; do
+        read line2 <&3
+        echo $line1 - $line2
+done <<EOF1 3<<EOF2
+one
+two
+three
+EOF1
+alpha
+beta
+gamma
+EOF2
diff --git a/shell/hush_test/hush-heredoc/heredoc_after_compound1.right b/shell/hush_test/hush-heredoc/heredoc_after_compound1.right
new file mode 100644
index 000000000..9052f7d1f
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_after_compound1.right
@@ -0,0 +1,2 @@
+Ok1
+Ok2
diff --git a/shell/hush_test/hush-heredoc/heredoc_after_compound1.tests b/shell/hush_test/hush-heredoc/heredoc_after_compound1.tests
new file mode 100755
index 000000000..e7cfb5be1
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_after_compound1.tests
@@ -0,0 +1,3 @@
+{ cat <<EOF; }; echo Ok2
+Ok1
+EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.right b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.tests b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.tests
new file mode 100755
index 000000000..1d2a26504
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+Ok1
+EO\
+F
diff --git a/shell/hush_test/hush-heredoc/heredoc_empty3.right b/shell/hush_test/hush-heredoc/heredoc_empty3.right
new file mode 100644
index 000000000..0b54a9c93
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_empty3.right
@@ -0,0 +1,2 @@
+
+Ok
diff --git a/shell/hush_test/hush-heredoc/heredoc_empty3.tests b/shell/hush_test/hush-heredoc/heredoc_empty3.tests
new file mode 100755
index 000000000..828c2dd89
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_empty3.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+
+Ok
+EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc_var_expand1.right b/shell/hush_test/hush-heredoc/heredoc_var_expand1.right
new file mode 100644
index 000000000..eb221832d
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_var_expand1.right
@@ -0,0 +1,4 @@
+
+Ok1:0
+
+Ok2:0
diff --git a/shell/hush_test/hush-heredoc/heredoc_var_expand1.tests b/shell/hush_test/hush-heredoc/heredoc_var_expand1.tests
new file mode 100755
index 000000000..3b00bab7b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_var_expand1.tests
@@ -0,0 +1,11 @@
+x='*'
+
+cat <<- EOF
+        ${x#'*'}
+EOF
+echo Ok1:$?
+
+cat <<EOF
+${x#'*'}
+EOF
+echo Ok2:$?
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue1.right b/shell/hush_test/hush-quoting/dollar_altvalue1.right
new file mode 100644
index 000000000..5cd495d3b
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue1.right
@@ -0,0 +1,16 @@
+Unquoted b c d
+|b|
+|c|
+|d|
+Unquoted 'b c' d
+|b c|
+|d|
+Unquoted "b c" d
+|b c|
+|d|
+Quoted b c d
+|b c d|
+Quoted 'b c' d
+|'b c' d|
+Quoted "b c" d
+|b c d|
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue1.tests b/shell/hush_test/hush-quoting/dollar_altvalue1.tests
new file mode 100755
index 000000000..f4dc8caec
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue1.tests
@@ -0,0 +1,16 @@
+f() { for i; do echo "|$i|"; done; }
+x=a
+
+echo Unquoted b c d
+f ${x:+b c d}
+echo Unquoted "'b c' d"
+f ${x:+'b c' d}
+echo Unquoted '"b c" d'
+f ${x:+"b c" d}
+
+echo Quoted b c d
+f "${x:+b c d}"
+echo Quoted "'b c' d"
+f "${x:+'b c' d}"
+echo Quoted '"b c" d'
+f "${x:+"b c" d}"
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue2.right b/shell/hush_test/hush-quoting/dollar_altvalue2.right
new file mode 100644
index 000000000..7cf37e379
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue2.right
@@ -0,0 +1,69 @@
+Unquoted '':
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Unquoted "":
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+end
+start:
+||
+||
+end
+
+Quoted '':
+start:
+|''|
+end
+start:
+|'' |
+end
+start:
+| ''|
+end
+start:
+| '' |
+end
+start:
+|'' ''|
+end
+
+Quoted "":
+start:
+||
+end
+start:
+| |
+end
+start:
+| |
+end
+start:
+|  |
+end
+start:
+| |
+end
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue2.tests b/shell/hush_test/hush-quoting/dollar_altvalue2.tests
new file mode 100755
index 000000000..3377eb27f
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue2.tests
@@ -0,0 +1,33 @@
+f() { echo start:; for i; do echo "|$i|"; done; echo end; }
+x=a
+
+echo "Unquoted '':"
+f ${x:+''}
+f ${x:+'' }
+f ${x:+ ''}
+f ${x:+ '' }
+f ${x:+'' ''}
+
+echo
+echo 'Unquoted "":'
+f ${x:+""}
+f ${x:+"" }
+f ${x:+ ""}
+f ${x:+ "" }
+f ${x:+"" ""}
+
+echo
+echo "Quoted '':"
+f "${x:+''}"
+f "${x:+'' }"
+f "${x:+ ''}"
+f "${x:+ '' }"
+f "${x:+'' ''}"
+
+echo
+echo 'Quoted "":'
+f "${x:+""}"
+f "${x:+"" }"
+f "${x:+ ""}"
+f "${x:+ "" }"
+f "${x:+"" ""}"
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue9.right b/shell/hush_test/hush-quoting/dollar_altvalue9.right
new file mode 100644
index 000000000..39342fe7c
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue9.right
@@ -0,0 +1,26 @@
+Unquoted 1:
+|a|
+|x y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|zb|
+Quoted 1:
+|a 'x y' 1 2 ''  1 2 A B C D zb|
+Unquoted 2:
+|ax y|
+|1|
+|2|
+||
+|1 2|
+|A|
+|B|
+|C D|
+|z|
+|b|
+Quoted 2:
+|a 'x y' 1 2 ''  1 2 A B C D z b|
diff --git a/shell/hush_test/hush-quoting/dollar_altvalue9.tests b/shell/hush_test/hush-quoting/dollar_altvalue9.tests
new file mode 100755
index 000000000..27a6f4f3c
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_altvalue9.tests
@@ -0,0 +1,17 @@
+f() { for i; do echo "|$i|"; done; }
+
+echo Unquoted 1:
+x='1 2'; f a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b
+echo Quoted 1:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z}b"
+
+echo Unquoted 2:
+x='1 2'; f a${x:+'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b
+echo Quoted 2:
+x='1 2'; f "a${x:+ 'x y' $x ''  "$x" `echo A B` "`echo C D`" z }b"
+
+#echo Unquoted 3:
+#e=
+#x='1 2'; f a${x:+'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b
+#echo Quoted 3:
+#x='1 2'; f "a${x:+ 'x y' $x ''  "$x" $e $e "$e" $e `echo A B` "`echo C D`" z }b"
diff --git a/shell/hush_test/hush-quoting/dollar_repl_bash1.right b/shell/hush_test/hush-quoting/dollar_repl_bash1.right
new file mode 100644
index 000000000..f5e9309f4
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_repl_bash1.right
@@ -0,0 +1,14 @@
+|y|
+|zx|
+|y|
+|zx|
+|y zx|
+|y zx|
+|y|
+|zy|
+|z|
+|y|
+|zy|
+|z|
+|y zy z|
+|y zy z|
diff --git a/shell/hush_test/hush-quoting/dollar_repl_bash1.tests b/shell/hush_test/hush-quoting/dollar_repl_bash1.tests
new file mode 100755
index 000000000..912635925
--- /dev/null
+++ b/shell/hush_test/hush-quoting/dollar_repl_bash1.tests
@@ -0,0 +1,12 @@
+f() { for i; do echo "|$i|"; done; }
+v=xx
+
+f ${v/'x'/"y z"}
+f ${v/"x"/'y z'}
+f "${v/'x'/"y z"}"
+f "${v/"x"/'y z'}"
+
+f ${v//'x'/"y z"}
+f ${v//"x"/'y z'}
+f "${v//'x'/"y z"}"
+f "${v//"x"/'y z'}"
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp.right b/shell/hush_test/hush-quoting/squote_in_varexp.right
index a75c0bfd6..4a457021b 100644
--- a/shell/hush_test/hush-quoting/squote_in_varexp.right
+++ b/shell/hush_test/hush-quoting/squote_in_varexp.right
@@ -1,5 +1,9 @@
 z
 z
+z
+z
+y
+y
 y
 y
 Ok:0
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp.tests b/shell/hush_test/hush-quoting/squote_in_varexp.tests
index a2d05a246..4afc52107 100755
--- a/shell/hush_test/hush-quoting/squote_in_varexp.tests
+++ b/shell/hush_test/hush-quoting/squote_in_varexp.tests
@@ -1,6 +1,10 @@
 x=yz
 echo ${x#'y'}
 echo "${x#'y'}"
+echo ${x#"y"}
+echo "${x#"y"}"
 echo ${x%'z'}
 echo "${x%'z'}"
+echo ${x%"z"}
+echo "${x%"z"}"
 echo Ok:$?
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp2.right b/shell/hush_test/hush-quoting/squote_in_varexp2.right
index 9d0add3c5..d03047024 100644
--- a/shell/hush_test/hush-quoting/squote_in_varexp2.right
+++ b/shell/hush_test/hush-quoting/squote_in_varexp2.right
@@ -1,3 +1,5 @@
 Nothing:
 Nothing:
+Nothing:
+Nothing:
 Ok:0
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp2.tests b/shell/hush_test/hush-quoting/squote_in_varexp2.tests
index 806ad12b9..2797725cc 100755
--- a/shell/hush_test/hush-quoting/squote_in_varexp2.tests
+++ b/shell/hush_test/hush-quoting/squote_in_varexp2.tests
@@ -1,4 +1,6 @@
 x='\\\\'
 printf Nothing:'%s\n' ${x#'\\\\'}
 printf Nothing:'%s\n' "${x#'\\\\'}"
+printf Nothing:'%s\n' ${x#"\\\\\\\\"}
+printf Nothing:'%s\n' "${x#"\\\\\\\\"}"
 echo Ok:$?
diff --git a/shell/hush_test/hush-redir/redir_script.tests b/shell/hush_test/hush-redir/redir_script.tests
index 740daa461..a8d93ce4f 100755
--- a/shell/hush_test/hush-redir/redir_script.tests
+++ b/shell/hush_test/hush-redir/redir_script.tests
@@ -27,6 +27,10 @@ test x"$fds1" = x"$fds" \
 test x"$fds1" = x" 10>&- 3>&-" && \
 test x"$fds"  = x" 11>&- 3>&-" \
 && { echo "Ok: script fd is not closed"; exit 0; }
+# or we see that fd 3 moved to fd 10:
+test x"$fds1" = x" 3>&- 4>&-" && \
+test x"$fds"  = x" 10>&- 3>&-" \
+&& { echo "Ok: script fd is not closed"; exit 0; }
 
 echo "Bug: script fd is closed"
 echo "fds1:$fds1"
diff --git a/shell/hush_test/hush-z_slow/many_ifs.tests b/shell/hush_test/hush-z_slow/many_ifs.tests
index 1f5b1b3a6..cf9a89874 100755
--- a/shell/hush_test/hush-z_slow/many_ifs.tests
+++ b/shell/hush_test/hush-z_slow/many_ifs.tests
@@ -229,8 +229,8 @@ do
                                                 '')     split "$d0$f1$d1$f2$d2$f3$d3" "[2]($f1)($f2)" "($f1)($f2)" ;;
                                                 ' ')    ;;
                                                 *)      x=$f2$d2$f3$d3
-                                                        x=${x# } #was x=${x#' '} hush needs fixing for this to work
-                                                        x=${x% } #was x=${x%' '}
+                                                        x=${x#' '}
+                                                        x=${x%' '}
                                                         split "$d0$f1$d1$f2$d2$f3$d3" "[3]($f1)($f2)($f3)" "($f1)($x)"
                                                         ;;
                                                 esac
diff --git a/shell/random.c b/shell/random.c
index 614172279..ffe0cc937 100644
--- a/shell/random.c
+++ b/shell/random.c
@@ -57,11 +57,11 @@ next_random(random_t *rnd)
          * Choices for a,b,c: 10,13,10; 8,9,22; 2,7,3; 23,3,24
          * (given by algorithm author)
          */
-        enum {
-                a = 2,
-                b = 7,
-                c = 3,
-        };
+        enum {
+                a = 2,
+                b = 7,
+                c = 3,
+        };
 
         uint32_t t;
 
@@ -165,7 +165,7 @@ int main(int argc, char **argv)
                 write(1, buf, sizeof(buf));
         }
 
-        return 0;
+        return 0;
 }
 
 #endif
diff --git a/sysklogd/Config.src b/sysklogd/Config.src
index 684e7d414..321be0117 100644
--- a/sysklogd/Config.src
+++ b/sysklogd/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "System Logging Utilities"
diff --git a/testsuite/bzcat.tests b/testsuite/bzcat.tests
index 32c1c5d7f..ad05dcb2c 100755
--- a/testsuite/bzcat.tests
+++ b/testsuite/bzcat.tests
@@ -30,10 +30,11 @@ hello_bz2() {
     $ECHO -ne "\x17\x72\x45\x38\x50\x90\x5b\xb8\xe8\xa3"
 }
 
+test x"$CONFIG_ZCAT" = x"y" && \
 for ext in \
-    `test x"$CONFIG_GUNZIP"     = x"y" && echo gz` \
-    `test x"$CONFIG_BUNZIP2"    = x"y" && echo bz2` \
-    `test x"$CONFIG_UNCOMPRESS" = x"y" && echo Z`
+    `test x"$CONFIG_FEATURE_SEAMLESS_GZ"  = x"y" && echo gz` \
+    `test x"$CONFIG_FEATURE_SEAMLESS_BZ2" = x"y" && echo bz2` \
+    `test x"$CONFIG_FEATURE_SEAMLESS_Z"   = x"y" && echo Z`
 do
     prep() {
         rm -f t1.$ext t2.$ext t_actual
@@ -47,6 +48,8 @@ do
             echo "PASS: $1"
         else
             echo "FAIL: $1"
+            #echo "t_actual:"
+            #cat t_actual
             FAILCOUNT=$((FAILCOUNT + 1))
         fi
     }
@@ -95,7 +98,8 @@ testing "bzcat can handle compressed zero-length bzip2 files" \
 ## compress algorithm
 
 # "input" file is compressed (.Z) file with "a\n" data
-test x"$CONFIG_UNCOMPRESS" = x"y" && \
+test x"$CONFIG_ZCAT" = x"y" && \
+test x"$CONFIG_FEATURE_SEAMLESS_Z" = x"y" && \
 testing "zcat can print many files" \
 "zcat input input; echo \$?" \
 "\
@@ -107,7 +111,8 @@ a
 " ""
 
 # "input" file is compressed (.Z) zero byte file
-test x"$CONFIG_UNCOMPRESS" = x"y" && \
+test x"$CONFIG_ZCAT" = x"y" && \
+test x"$CONFIG_FEATURE_SEAMLESS_Z" = x"y" && \
 testing "zcat can handle compressed zero-length (.Z) files" \
 "zcat input input; echo \$?" \
 "0\n" \
diff --git a/testsuite/cat.tests b/testsuite/cat.tests
index 404ebedeb..10970dc90 100755
--- a/testsuite/cat.tests
+++ b/testsuite/cat.tests
@@ -6,16 +6,20 @@
 . ./testing.sh
 
 # testing "description" "command" "result" "infile" "stdin"
+optional FEATURE_CATV
 testing 'cat -e' \
         'cat -e' \
         'foo$\n' \
         '' \
         'foo\n'
+SKIP=
 
+optional FEATURE_CATV
 testing 'cat -v' \
         'cat -v' \
         'foo\n' \
         '' \
         'foo\n'
+SKIP=
 
 exit $FAILCOUNT
diff --git a/testsuite/hexdump.tests b/testsuite/hexdump.tests
new file mode 100755
index 000000000..45a0c1300
--- /dev/null
+++ b/testsuite/hexdump.tests
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# Copyright 2018 by Denys Vlasenko <vda.linux@googlemail.com>
+# Licensed under GPLv2, see file LICENSE in this source tree.
+
+. ./testing.sh
+
+# testing "description" "command" "result" "infile" "stdin"
+testing 'hexdump -C with four NULs' \
+        'hexdump -C' \
+        "\
+00000000  00 00 00 00                                       |....|
+00000004
+" \
+        '' \
+        '\0\0\0\0'
+
+exit $FAILCOUNT
diff --git a/testsuite/mount.tests b/testsuite/mount.tests
index a0bc50888..91c2e8b42 100755
--- a/testsuite/mount.tests
+++ b/testsuite/mount.tests
@@ -10,9 +10,11 @@ test "`id -u`" = 0 || {
         exit 0
 }
 
+# Without MOUNT_LOOP_CREATE, the test will fail if /dev/loopN's do not exist
 if test x"$CONFIG_MKFS_MINIX" != x"y" \
 || test x"$CONFIG_FEATURE_MINIX2" != x"y" \
 || test x"$CONFIG_FEATURE_MOUNT_LOOP" != x"y" \
+|| test x"$CONFIG_FEATURE_MOUNT_LOOP_CREATE" != x"y" \
 || test x"$CONFIG_FEATURE_MOUNT_FLAGS" != x"y" \
 || test x"$CONFIG_FEATURE_DEVFS" = x"y" \
 ; then
diff --git a/testsuite/pidof.tests b/testsuite/pidof.tests
index 2a06d2b1c..cd10de4e0 100755
--- a/testsuite/pidof.tests
+++ b/testsuite/pidof.tests
@@ -18,15 +18,22 @@ testing "pidof (exit with success)" "pidof pidof > /dev/null; echo \$?" \
 
 testing "pidof this" "pidof pidof.tests | grep -o -w $$" "$$\n" "" ""
 
+test x"`cat /proc/1/comm`" = x"init" && {
 optional FEATURE_PIDOF_SINGLE
 testing "pidof -s" "pidof -s init" "1\n" "" ""
 SKIP=
+}
 
+test x"`cat /proc/1/comm`" = x"init" && {
 optional FEATURE_PIDOF_OMIT FEATURE_PIDOF_SINGLE
 # This test fails now because process name matching logic has changed,
 # but new logic is not "wrong" either... see find_pid_by_name.c comments
 #testing "pidof -o %PPID" "pidof -o %PPID pidof.tests | grep -o -w $$" "" "" ""
 testing "pidof -o %PPID NOP" "pidof -o %PPID -s init" "1\n" "" ""
+SKIP=
+}
+
+optional FEATURE_PIDOF_OMIT
 testing "pidof -o init" "pidof -o 1 init | grep -o -w 1" "" "" ""
 SKIP=
 
diff --git a/testsuite/tar.tests b/testsuite/tar.tests
index 1675b07b1..d71a34910 100755
--- a/testsuite/tar.tests
+++ b/testsuite/tar.tests
@@ -336,7 +336,7 @@ SKIP=
 cd .. || exit 1; rm -rf tar.tempdir 2>/dev/null
 
 mkdir tar.tempdir && cd tar.tempdir || exit 1
-optional FEATURE_SEAMLESS_BZ2 FEATURE_TAR_AUTODETECT
+optional FEATURE_SEAMLESS_BZ2 FEATURE_TAR_AUTODETECT LS
 testing "Symlink attack: create symlink and then write through it" '\
 exec 2>&1
 uudecode -o input && tar xvf input; echo $?
@@ -365,4 +365,22 @@ n8fYaKlioCTzL2oXYczyUUIP4u5IpwoSEwWdtoA=
 SKIP=
 cd .. || exit 1; rm -rf tar.tempdir 2>/dev/null
 
+mkdir tar.tempdir && cd tar.tempdir || exit 1
+optional FEATURE_TAR_CREATE
+testing "Symlinks and hardlinks coexist" '\
+mkdir dir
+>dir/a
+ln -s ../dir/a dir/b
+ln dir/b dir/c
+mkdir new
+tar cf - dir/* | tar -C new -xvf - 2>&1
+' "\
+dir/a
+dir/b
+dir/c
+" \
+"" ""
+SKIP=
+cd .. || exit 1; rm -rf tar.tempdir 2>/dev/null
+
 exit $FAILCOUNT
diff --git a/testsuite/unexpand/unexpand-works-like-GNU b/testsuite/unexpand/unexpand-works-like-GNU
index a5258363f..111b277b5 100644
--- a/testsuite/unexpand/unexpand-works-like-GNU
+++ b/testsuite/unexpand/unexpand-works-like-GNU
@@ -1,3 +1,7 @@
+# coreutils 8.25 often says "input line is too long"
+# on ELF executables. In this case, do not run the test:
+unexpand ../../busybox >/dev/null || exit 0
+
 rm -f foo bar
 echo "       y" | unexpand ../../busybox > foo
 echo "       y" | busybox unexpand ../../busybox > bar
diff --git a/testsuite/unzip.tests b/testsuite/unzip.tests
index 6bcb6b3a2..af53de9df 100755
--- a/testsuite/unzip.tests
+++ b/testsuite/unzip.tests
@@ -14,7 +14,7 @@
 # Create a scratch directory
 
 mkdir temp
-cd temp || exit 90
+cd temp || exit $?
 
 # Create test file to work with.
 
@@ -54,9 +54,22 @@ SKIP=
 
 rm -f *
 
-optional CONFIG_FEATURE_UNZIP_LZMA
-testing "unzip (archive with corrupted lzma)" "unzip -p ../unzip_bad_lzma_1.zip 2>&1; echo \$?" \
+optional FEATURE_UNZIP_LZMA
+testing "unzip (archive with corrupted lzma 1)" "unzip -p ../unzip_bad_lzma_1.zip 2>&1; echo \$?" \
 "unzip: removing leading '/' from member names
+unzip: corrupted data
+unzip: inflate error
+1
+" \
+"" ""
+SKIP=
+
+rm -f *
+
+optional FEATURE_UNZIP_LZMA
+testing "unzip (archive with corrupted lzma 2)" "unzip -p ../unzip_bad_lzma_2.zip 2>&1; echo \$?" \
+"unzip: removing leading '/' from member names
+unzip: corrupted data
 unzip: inflate error
 1
 " \
diff --git a/testsuite/unzip_bad_lzma_2.zip b/testsuite/unzip_bad_lzma_2.zip
new file mode 100644
index 000000000..cdb917088
--- /dev/null
+++ b/testsuite/unzip_bad_lzma_2.zip
diff --git a/util-linux/Config.src b/util-linux/Config.src
index 68fcc266f..0fad3e5c0 100644
--- a/util-linux/Config.src
+++ b/util-linux/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 menu "Linux System Utilities"
diff --git a/util-linux/fdisk.c b/util-linux/fdisk.c
index 7275535e6..cdcba0a03 100644
--- a/util-linux/fdisk.c
+++ b/util-linux/fdisk.c
@@ -2004,12 +2004,6 @@ check_consistency(const struct partition *p, int partition)
                 printf("     phys=(%u,%u,%u) ", pec, peh, pes);
                 printf("logical=(%u,%u,%u)\n", lec, leh, les);
         }
-
-/* Ending on cylinder boundary? */
-        if (peh != (g_heads - 1) || pes != g_sectors) {
-                printf("Partition %u does not end on cylinder boundary\n",
-                        partition + 1);
-        }
 }
 
 static void
diff --git a/util-linux/fdisk_sgi.c b/util-linux/fdisk_sgi.c
index 30def09c6..1cf0af5cc 100644
--- a/util-linux/fdisk_sgi.c
+++ b/util-linux/fdisk_sgi.c
@@ -425,7 +425,7 @@ create_sgiinfo(void)
         /* I keep SGI's habit to write the sgilabel to the second block */
         sgilabel->directory[0].vol_file_start = SGI_SSWAP32(2);
         sgilabel->directory[0].vol_file_size = SGI_SSWAP32(sizeof(sgiinfo));
-        strncpy((char*)sgilabel->directory[0].vol_file_name, "sgilabel", 8);
+        memcpy((char*)sgilabel->directory[0].vol_file_name, "sgilabel", 8);
 }
 
 static sgiinfo *fill_sgiinfo(void);
diff --git a/util-linux/mkfs_vfat.c b/util-linux/mkfs_vfat.c
index 26a919536..92f0e3b1a 100644
--- a/util-linux/mkfs_vfat.c
+++ b/util-linux/mkfs_vfat.c
@@ -522,7 +522,7 @@ int mkfs_vfat_main(int argc UNUSED_PARAM, char **argv)
                 //STORE_LE(boot_blk->reserved2[3], 0,0,0);
                 STORE_LE(boot_blk->vi.ext_boot_sign, 0x29);
                 STORE_LE(boot_blk->vi.volume_id32, volume_id);
-                strncpy(boot_blk->vi.fs_type, "FAT32   ", sizeof(boot_blk->vi.fs_type));
+                memcpy(boot_blk->vi.fs_type, "FAT32   ", sizeof(boot_blk->vi.fs_type));
                 strncpy(boot_blk->vi.volume_label, volume_label, sizeof(boot_blk->vi.volume_label));
                 memcpy(boot_blk->boot_code, boot_code, sizeof(boot_code));
                 STORE_LE(boot_blk->boot_sign, BOOT_SIGN);
diff --git a/util-linux/nsenter.c b/util-linux/nsenter.c
index c6933c8d5..ae8103a52 100644
--- a/util-linux/nsenter.c
+++ b/util-linux/nsenter.c
@@ -105,14 +105,14 @@ static const struct namespace_descr ns_list[] = {
 /*
  * Upstream nsenter doesn't support the short option for --preserve-credentials
  */
-static const char opt_str[] ALIGN1 = "U::i::u::n::p::m::""t+S+G+r::w::F";
+static const char opt_str[] ALIGN1 = "U::i::u::n::p::m::""t:+S:+G:+r::w::F";
 
 #if ENABLE_LONG_OPTS
 static const char nsenter_longopts[] ALIGN1 =
         "user\0"                        Optional_argument       "U"
         "ipc\0"                         Optional_argument       "i"
         "uts\0"                         Optional_argument       "u"
-        "network\0"                     Optional_argument       "n"
+        "net\0"                         Optional_argument       "n"
         "pid\0"                         Optional_argument       "p"
         "mount\0"                       Optional_argument       "m"
         "target\0"                      Required_argument       "t"
diff --git a/util-linux/unshare.c b/util-linux/unshare.c
index 7c295da1f..fffee28a0 100644
--- a/util-linux/unshare.c
+++ b/util-linux/unshare.c
@@ -73,7 +73,7 @@
 #include "libbb.h"
 
 static void mount_or_die(const char *source, const char *target,
-                 const char *fstype, unsigned long mountflags)
+                const char *fstype, unsigned long mountflags)
 {
         if (mount(source, target, fstype, mountflags, NULL)) {
                 bb_perror_msg_and_die("can't mount %s on %s (flags:0x%lx)",
diff --git a/util-linux/volume_id/Config.src b/util-linux/volume_id/Config.src
index ac208c9cc..fe3b14a71 100644
--- a/util-linux/volume_id/Config.src
+++ b/util-linux/volume_id/Config.src
@@ -1,6 +1,6 @@
 #
 # For a description of the syntax of this configuration file,
-# see scripts/kbuild/config-language.txt.
+# see docs/Kconfig-language.txt.
 #
 
 config VOLUMEID