Merge branch 'busybox' into merge

157 files changed, 3033 insertions, 1220 deletions

diff --git a/Config.in b/Config.in
index 086812908..0353a0525 100644
--- a/Config.in
+++ b/Config.in
@@ -26,10 +26,14 @@ endchoice
 menu "Busybox Settings"
 
 config DESKTOP
-        bool "Enable options for full-blown desktop systems"
+        bool "Enable compatibility for full-blown desktop systems"
         default y
         help
-          Enable options and features which are not essential.
+          Enable applet options and features which are not essential.
+          Many applet options have dedicated config options to (de)select them
+          under that applet; this options enables those options which have no
+          individual config item for them.
+
           Select this if you plan to use busybox on full-blown desktop machine
           with common Linux distro, which needs higher level of command-line
           compatibility.
@@ -56,13 +60,12 @@ config INCLUDE_SUSv2
           will be supported in head, tail, and fold. (Note: should
           affect renice too.)
 
-config USE_PORTABLE_CODE
-        bool "Avoid using GCC-specific code constructs"
-        default n
+config LONG_OPTS
+        bool "Support --long-options"
+        default y
         help
-          Use this option if you are trying to compile busybox with
-          compiler other than gcc.
-          If you do use gcc, this option may needlessly increase code size.
+          Enable this if you want busybox applets to use the gnu --long-option
+          style, in addition to single character -a -b -c style options.
 
 config SHOW_USAGE
         bool "Show applet usage messages"
@@ -98,33 +101,38 @@ config FEATURE_COMPRESS_USAGE
           and have very little memory, this might not be a win. Otherwise,
           you probably want this.
 
-config BUSYBOX
-        bool "Include busybox applet"
+config LFS
+        bool "Support files > 2 GB"
         default y
         help
-          The busybox applet provides general help regarding busybox and
-          allows the included applets to be listed.  It's also required
-          if applet links are to be installed at runtime.
-
-          If you can live without these features disabling this will save
-          some space.
+          If you want to build BusyBox with large file support, then enable
+          this option. This will have no effect if your kernel or your C
+          library lacks large file support for large files. Some of the
+          programs that can benefit from large file support include dd, gzip,
+          cp, mount, tar, and many others. If you want to access files larger
+          than 2 Gigabytes, enable this option.
 
-config FEATURE_INSTALLER
-        bool "Support --install [-s] to install applet links at runtime"
-        default y
-        depends on BUSYBOX
+config GLOBBING
+        bool "Allow busybox.exe to expand wildcards"
+        default n
+        depends on PLATFORM_MINGW32
         help
-          Enable 'busybox --install [-s]' support. This will allow you to use
-          busybox at runtime to create hard links or symlinks for all the
-          applets that are compiled into busybox.
+          In Microsoft Windows expansion of wildcards on the command line
+          ('globbing') is handled by the C runtime while the BusyBox shell
+          does its own wildcard expansion.  For best results when using the
+          shell globbing by the C runtime should be turned off. If you want
+          the BusyBox binary to handle wildcard expansion using the C runtime
+          set this to 'Y'.
 
-config INSTALL_NO_USR
-        bool "Don't use /usr"
+config SAFE_ENV
+        bool "Manipulate the environment through safe API calls"
         default n
+        depends on PLATFORM_MINGW32
         help
-          Disable use of /usr. busybox --install and "make install"
-          will install applets only to /bin and /sbin,
-          never to /usr/bin or /usr/sbin.
+          Enable this option to use safe API calls when clearing environment
+          variables.  This is necessary if BusyBox is to run on ReactOS or
+          64-bit Windows.  The default is 'N', which must be used if BusyBox
+          is to run on Windows XP.
 
 config PAM
         bool "Support PAM (Pluggable Authentication Modules)"
@@ -133,13 +141,6 @@ config PAM
           Use PAM in some busybox applets (currently login and httpd) instead
           of direct access to password database.
 
-config LONG_OPTS
-        bool "Support --long-options"
-        default y
-        help
-          Enable this if you want busybox applets to use the gnu --long-option
-          style, in addition to single character -a -b -c style options.
-
 config FEATURE_DEVPTS
         bool "Use the devpts filesystem for Unix98 PTYs"
         default y
@@ -150,18 +151,6 @@ config FEATURE_DEVPTS
           /dev/ttyp<number> will be used. To use this option, you should have
           devpts mounted.
 
-config FEATURE_CLEAN_UP
-        bool "Clean up all memory before exiting (usually not needed)"
-        default n
-        help
-          As a size optimization, busybox normally exits without explicitly
-          freeing dynamically allocated memory or closing files. This saves
-          space since the OS will clean up for us, but it can confuse debuggers
-          like valgrind, which report tons of memory and resource leaks.
-
-          Don't enable this unless you have a really good reason to clean
-          things up manually.
-
 config FEATURE_UTMP
         bool "Support utmp file"
         default y
@@ -191,7 +180,7 @@ config FEATURE_PIDFILE
           on applets which require pidfiles to run.
 
 config PID_FILE_PATH
-        string "Path to directory for pidfile"
+        string "Directory for pidfiles"
         default "/var/run"
         depends on FEATURE_PIDFILE
         help
@@ -200,8 +189,40 @@ config PID_FILE_PATH
           this value.  The option has no effect on applets that require you to
           specify a pidfile path.
 
+config BUSYBOX
+        bool "Include busybox applet"
+        default y
+        help
+          The busybox applet provides general help regarding busybox and
+          allows the included applets to be listed.  It's also required
+          if applet links are to be installed at runtime. If you unselect
+          this option, running busybox without any arguments will give
+          just a cryptic error message:
+
+          $ busybox
+          busybox: applet not found
+
+          Running "busybox APPLET [ARGS...]" will still work, of course.
+
+config FEATURE_INSTALLER
+        bool "Support --install [-s] to install applet links at runtime"
+        default y
+        depends on BUSYBOX
+        help
+          Enable 'busybox --install [-s]' support. This will allow you to use
+          busybox at runtime to create hard links or symlinks for all the
+          applets that are compiled into busybox.
+
+config INSTALL_NO_USR
+        bool "Don't use /usr"
+        default n
+        help
+          Disable use of /usr. busybox --install and "make install"
+          will install applets only to /bin and /sbin,
+          never to /usr/bin or /usr/sbin.
+
 config FEATURE_SUID
-        bool "Support SUID/SGID handling"
+        bool "Drop SUID state for most applets"
         default y
         help
           With this option you can install the busybox binary belonging
@@ -209,16 +230,16 @@ config FEATURE_SUID
           root-level operations even when run by ordinary users
           (for example, mounting of user mounts in fstab needs this).
 
-          Busybox will automatically drop privileges for applets
-          that don't need root access.
+          With this option enabled, Busybox drops privileges for applets
+          that don't need root access, before entering their main() function.
 
-          If you are really paranoid and don't want to do this, build two
-          busybox binaries with different applets in them (and the appropriate
-          symlinks pointing to each binary), and only set the suid bit on the
-          one that needs it.
+          If you are really paranoid and don't want even initial busybox code
+          to run under root for evey applet, build two busybox binaries with
+          different applets in them (and the appropriate symlinks pointing
+          to each binary), and only set the suid bit on the one that needs it.
 
-          The applets which require root rights (need suid bit or
-          to be run by root) and will refuse to execute otherwise:
+          Some applets which require root rights (need suid bit on the binary
+          or to be run by root) and will refuse to execute otherwise:
           crontab, login, passwd, su, vlock, wall.
 
           The applets which will use root rights if they have them
@@ -226,16 +247,16 @@ config FEATURE_SUID
           without root right nevertheless:
           findfs, ping[6], traceroute[6], mount.
 
-          Note that if you DONT select this option, but DO make busybox
+          Note that if you DO NOT select this option, but DO make busybox
           suid root, ALL applets will run under root, which is a huge
           security hole (think "cp /some/file /etc/passwd").
 
 config FEATURE_SUID_CONFIG
-        bool "Runtime SUID/SGID configuration via /etc/busybox.conf"
+        bool "Enable SUID configuration via /etc/busybox.conf"
         default y
         depends on FEATURE_SUID
         help
-          Allow the SUID / SGID state of an applet to be determined at runtime
+          Allow the SUID/SGID state of an applet to be determined at runtime
           by checking /etc/busybox.conf. (This is sort of a poor man's sudo.)
           The format of this file is as follows:
 
@@ -255,7 +276,7 @@ config FEATURE_SUID_CONFIG
 
           [SUID]
           su = ssx root.0 # applet su can be run by anyone and runs with
-                          # euid=0/egid=0
+                          # euid=0,egid=0
           su = ssx        # exactly the same
 
           mount = sx- root.disk # applet mount can be run by root and members
@@ -283,24 +304,6 @@ config FEATURE_SUID_CONFIG_QUIET
           check this option to avoid users to be notified about missing
           permissions.
 
-config SELINUX
-        bool "Support NSA Security Enhanced Linux"
-        default n
-        select PLATFORM_LINUX
-        help
-          Enable support for SELinux in applets ls, ps, and id. Also provide
-          the option of compiling in SELinux applets.
-
-          If you do not have a complete SELinux userland installed, this stuff
-          will not compile.  Specifially, libselinux 1.28 or better is
-          directly required by busybox. If the installation is located in a
-          non-standard directory, provide it by invoking make as follows:
-                CFLAGS=-I<libselinux-include-path> \
-                LDFLAGS=-L<libselinux-lib-path> \
-                make
-
-          Most people will leave this set to 'N'.
-
 config FEATURE_PREFER_APPLETS
         bool "exec prefers applets"
         default n
@@ -309,8 +312,9 @@ config FEATURE_PREFER_APPLETS
           call 'exec' to try and find an applicable busybox applet before
           searching the PATH. This is typically done by exec'ing
           /proc/self/exe.
+
           This may affect shell, find -exec, xargs and similar applets.
-          They will use applets even if /bin/<applet> -> busybox link
+          They will use applets even if /bin/APPLET -> busybox link
           is missing (or is not a link to busybox). However, this causes
           problems in chroot jails without mounted /proc and with ps/top
           (command name can be shown as 'exe' for applets started this way).
@@ -325,6 +329,37 @@ config BUSYBOX_EXEC_PATH
           executable. If you haven't got /proc, set this to wherever you
           want to run BusyBox from.
 
+config SELINUX
+        bool "Support NSA Security Enhanced Linux"
+        default n
+        select PLATFORM_LINUX
+        help
+          Enable support for SELinux in applets ls, ps, and id. Also provide
+          the option of compiling in SELinux applets.
+
+          If you do not have a complete SELinux userland installed, this stuff
+          will not compile.  Specifially, libselinux 1.28 or better is
+          directly required by busybox. If the installation is located in a
+          non-standard directory, provide it by invoking make as follows:
+
+                CFLAGS=-I<libselinux-include-path> \
+                LDFLAGS=-L<libselinux-lib-path> \
+                make
+
+          Most people will leave this set to 'N'.
+
+config FEATURE_CLEAN_UP
+        bool "Clean up all memory before exiting (usually not needed)"
+        default n
+        help
+          As a size optimization, busybox normally exits without explicitly
+          freeing dynamically allocated memory or closing files. This saves
+          space since the OS will clean up for us, but it can confuse debuggers
+          like valgrind, which report tons of memory and resource leaks.
+
+          Don't enable this unless you have a really good reason to clean
+          things up manually.
+
 # These are auto-selected by other options
 
 config FEATURE_SYSLOG
@@ -400,29 +435,25 @@ config BUILD_LIBBUSYBOX
           Build a shared library libbusybox.so.N.N.N which contains all
           busybox code.
 
-          This feature allows every applet to be built as a tiny
-          separate executable. Enabling it for "one big busybox binary"
-          approach serves no purpose and increases code size.
-          You should almost certainly say "no" to this.
+          This feature allows every applet to be built as a really tiny
+          separate executable linked against the library:
+          $ size 0_lib/l*
+            text  data   bss     dec    hex filename
+             939   212    28    1179    49b 0_lib/last
+             939   212    28    1179    49b 0_lib/less
+          919138  8328  1556  929022  e2cfe 0_lib/libbusybox.so.1.N.M
 
-### config FEATURE_FULL_LIBBUSYBOX
-###     bool "Feature-complete libbusybox"
-###     default n if !FEATURE_SHARED_BUSYBOX
-###     depends on BUILD_LIBBUSYBOX
-###     help
-###       Build a libbusybox with the complete feature-set, disregarding
-###       the actually selected config.
-###
-###       Normally, libbusybox will only contain the features which are
-###       used by busybox itself. If you plan to write a separate
-###       standalone application which uses libbusybox say 'Y'.
-###
-###       Note: libbusybox is GPL, not LGPL, and exports no stable API that
-###       might act as a copyright barrier. We can and will modify the
-###       exported function set between releases (even minor version number
-###       changes), and happily break out-of-tree features.
-###
-###       Say 'N' if in doubt.
+          This is useful on NOMMU systems which are not capable
+          of sharing executables, but are capable of sharing code
+          in dynamic libraries.
+
+config FEATURE_LIBBUSYBOX_STATIC
+        bool "Pull in all external references into libbusybox"
+        default n
+        depends on BUILD_LIBBUSYBOX
+        help
+          Make libbusybox library independent, not using or requiring
+          any other shared libraries.
 
 config FEATURE_INDIVIDUAL
         bool "Produce a binary for each applet, linked against libbusybox"
@@ -470,39 +501,6 @@ config FEATURE_SHARED_BUSYBOX
 ###
 ###       Say 'N' unless you know what you are doing.
 
-config LFS
-        bool "Build with Large File Support (for accessing files > 2 GB)"
-        default y
-        help
-          If you want to build BusyBox with large file support, then enable
-          this option. This will have no effect if your kernel or your C
-          library lacks large file support for large files. Some of the
-          programs that can benefit from large file support include dd, gzip,
-          cp, mount, tar, and many others. If you want to access files larger
-          than 2 Gigabytes, enable this option. Otherwise, leave it set to 'N'.
-
-config GLOBBING
-        bool "Allow busybox.exe to expand wildcards"
-        default n
-        depends on PLATFORM_MINGW32
-        help
-          In Microsoft Windows expansion of wildcards on the command line
-          ('globbing') is handled by the C runtime while the BusyBox shell
-          does its own wildcard expansion.  For best results when using the
-          shell globbing by the C runtime should be turned off. If you want
-          the BusyBox binary to handle wildcard expansion using the C runtime
-          set this to 'Y'.
-
-config SAFE_ENV
-        bool "Manipulate the environment through safe API calls"
-        default n
-        depends on PLATFORM_MINGW32
-        help
-          Enable this option to use safe API calls when clearing environment
-          variables.  This is necessary if BusyBox is to run on ReactOS or
-          64-bit Windows.  The default is 'N', which must be used if BusyBox
-          is to run on Windows XP.
-
 config CROSS_COMPILER_PREFIX
         string "Cross Compiler prefix"
         default ""
@@ -549,6 +547,14 @@ config EXTRA_LDLIBS
         help
           Additional LDLIBS to pass to the linker with -l.
 
+config USE_PORTABLE_CODE
+        bool "Avoid using GCC-specific code constructs"
+        default n
+        help
+          Use this option if you are trying to compile busybox with
+          compiler other than gcc.
+          If you do use gcc, this option may needlessly increase code size.
+
 comment 'Installation Options ("make install" behavior)'
 
 choice
@@ -709,10 +715,10 @@ config EFENCE
 
 endchoice
 
-endmenu
-
 source libbb/Config.in
 
+endmenu
+
 comment "Applets"
 
 source archival/Config.in
diff --git a/Makefile b/Makefile
index e68958092..8f3bc7ec0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 VERSION = 1
-PATCHLEVEL = 27
+PATCHLEVEL = 28
 SUBLEVEL = 0
 EXTRAVERSION = .git
 NAME = Unnamed
@@ -510,6 +510,8 @@ ifeq ($(dot-config),1)
 # To avoid any implicit rule to kick in, define an empty command
 .config .kconfig.d: ;
 
+-include $(srctree)/arch/$(ARCH)/Makefile
+
 # Now we can define CFLAGS etc according to .config
 include $(srctree)/Makefile.flags
 
@@ -533,8 +535,6 @@ endif
 # Defaults busybox but it is usually overridden in the arch makefile
 all: busybox$(EXEEXT) doc
 
--include $(srctree)/arch/$(ARCH)/Makefile
-
 # arch Makefile may override CC so keep this after arch Makefile is included
 #bbox# NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
 CHECKFLAGS += $(NOSTDINC_FLAGS)
diff --git a/Makefile.flags b/Makefile.flags
index 6b25632a0..6bb6a8fb1 100644
--- a/Makefile.flags
+++ b/Makefile.flags
@@ -15,8 +15,7 @@ CPPFLAGS += \
         -include include/autoconf.h \
         -D_GNU_SOURCE -DNDEBUG \
         $(if $(CONFIG_LFS),-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64) \
-        -D"BB_VER=KBUILD_STR($(BB_VER))" -DBB_BT=AUTOCONF_TIMESTAMP \
-        -D"MINGW_VER=KBUILD_STR($(MINGW_VER))"
+        -D"BB_VER=KBUILD_STR($(BB_VER))" -D"MINGW_VER=KBUILD_STR($(MINGW_VER))"
 
 CFLAGS += $(call cc-option,-Wall,)
 CFLAGS += $(call cc-option,-Wshadow,)
diff --git a/archival/bbunzip.c b/archival/bbunzip.c
index 311c7333e..1e3d6e586 100644
--- a/archival/bbunzip.c
+++ b/archival/bbunzip.c
@@ -7,24 +7,30 @@
 #include "libbb.h"
 #include "bb_archive.h"
 
+//kbuild:lib-$(CONFIG_ZCAT) += bbunzip.o
+//kbuild:lib-$(CONFIG_GUNZIP) += bbunzip.o
+//kbuild:lib-$(CONFIG_BZCAT) += bbunzip.o
+//kbuild:lib-$(CONFIG_BUNZIP2) += bbunzip.o
+
 /* lzop_main() uses bbunpack(), need this: */
 //kbuild:lib-$(CONFIG_LZOP) += bbunzip.o
 //kbuild:lib-$(CONFIG_LZOPCAT) += bbunzip.o
 //kbuild:lib-$(CONFIG_UNLZOP) += bbunzip.o
 /* bzip2_main() too: */
-//kbuild:lib-$(CONFIG_FEATURE_BZIP2_DECOMPRESS) += bbunzip.o
+//kbuild:lib-$(CONFIG_BZIP2) += bbunzip.o
 /* gzip_main() too: */
-//kbuild:lib-$(CONFIG_FEATURE_GZIP_DECOMPRESS) += bbunzip.o
+//kbuild:lib-$(CONFIG_GZIP) += bbunzip.o
 
 /* Note: must be kept in sync with archival/lzop.c */
 enum {
         OPT_STDOUT     = 1 << 0,
         OPT_FORCE      = 1 << 1,
         /* only some decompressors: */
-        OPT_VERBOSE    = 1 << 2,
-        OPT_QUIET      = 1 << 3,
-        OPT_DECOMPRESS = 1 << 4,
-        OPT_TEST       = 1 << 5,
+        OPT_KEEP       = 1 << 2,
+        OPT_VERBOSE    = 1 << 3,
+        OPT_QUIET      = 1 << 4,
+        OPT_DECOMPRESS = 1 << 5,
+        OPT_TEST       = 1 << 6,
         SEAMLESS_MAGIC = (1 << 31) * ENABLE_ZCAT * SEAMLESS_COMPRESSION,
 };
 
@@ -182,10 +188,13 @@ int FAST_FUNC bbunpack(char **argv,
                                 }
                                 /* Delete _source_ file */
                                 del = filename;
+                                if (option_mask32 & OPT_KEEP) /* ... unless -k */
+                                        del = NULL;
                         }
                         if (ENABLE_PLATFORM_MINGW32)
                                 xclose(STDIN_FILENO);
-                        xunlink(del);
+                        if (del)
+                                xunlink(del);
  free_name:
                         if (new_name != filename)
                                 free(new_name);
@@ -242,7 +251,16 @@ char* FAST_FUNC make_new_name_generic(char *filename, const char *expected_ext)
 int uncompress_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int uncompress_main(int argc UNUSED_PARAM, char **argv)
 {
+// (N)compress 4.2.4.4:
+// -d If given, decompression is done instead
+// -c Write output on stdout, don't remove original
+// -b Parameter limits the max number of bits/code
+// -f Forces output file to be generated
+// -v Write compression statistics
+// -V Output vesion and compile options
+// -r Recursive. If a filename is a directory, descend into it and compress everything
         getopt32(argv, "cf");
+
         argv += optind;
 
         return bbunpack(argv, unpack_Z_stream, make_new_name_generic, "Z");
@@ -275,11 +293,12 @@ int uncompress_main(int argc UNUSED_PARAM, char **argv)
  * Ken Turkowski, Dave Mack and Peter Jannesen.
  */
 //usage:#define gunzip_trivial_usage
-//usage:       "[-cft] [FILE]..."
+//usage:       "[-cfkt] [FILE]..."
 //usage:#define gunzip_full_usage "\n\n"
 //usage:       "Decompress FILEs (or stdin)\n"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:     "\n        -t      Test file integrity"
 //usage:
 //usage:#define gunzip_example_usage
@@ -374,7 +393,7 @@ int gunzip_main(int argc UNUSED_PARAM, char **argv)
 #if ENABLE_FEATURE_GUNZIP_LONG_OPTIONS
         applet_long_options = gunzip_longopts;
 #endif
-        getopt32(argv, "cfvqdtn");
+        getopt32(argv, "cfkvqdtn");
         argv += optind;
 
         /* If called as zcat...
@@ -396,11 +415,12 @@ int gunzip_main(int argc UNUSED_PARAM, char **argv)
  * Licensed under GPLv2 or later, see file LICENSE in this source tree.
  */
 //usage:#define bunzip2_trivial_usage
-//usage:       "[-cf] [FILE]..."
+//usage:       "[-cfk] [FILE]..."
 //usage:#define bunzip2_full_usage "\n\n"
 //usage:       "Decompress FILEs (or stdin)\n"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:#define bzcat_trivial_usage
 //usage:       "[FILE]..."
 //usage:#define bzcat_full_usage "\n\n"
@@ -430,11 +450,11 @@ int gunzip_main(int argc UNUSED_PARAM, char **argv)
 //applet:IF_BUNZIP2(APPLET(bunzip2, BB_DIR_USR_BIN, BB_SUID_DROP))
 //                APPLET_ODDNAME:name   main     location        suid_type     help
 //applet:IF_BZCAT(APPLET_ODDNAME(bzcat, bunzip2, BB_DIR_USR_BIN, BB_SUID_DROP, bzcat))
-#if ENABLE_FEATURE_BZIP2_DECOMPRESS
+#if ENABLE_FEATURE_BZIP2_DECOMPRESS || ENABLE_BUNZIP2 || ENABLE_BZCAT
 int bunzip2_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int bunzip2_main(int argc UNUSED_PARAM, char **argv)
 {
-        getopt32(argv, "cfvqdt");
+        getopt32(argv, "cfkvqdt");
         argv += optind;
         if (ENABLE_BZCAT && applet_name[2] == 'c') /* bzcat */
                 option_mask32 |= OPT_STDOUT;
@@ -453,19 +473,21 @@ int bunzip2_main(int argc UNUSED_PARAM, char **argv)
  * Licensed under GPLv2, see file LICENSE in this source tree.
  */
 //usage:#define unlzma_trivial_usage
-//usage:       "[-cf] [FILE]..."
+//usage:       "[-cfk] [FILE]..."
 //usage:#define unlzma_full_usage "\n\n"
 //usage:       "Decompress FILE (or stdin)\n"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:
 //usage:#define lzma_trivial_usage
-//usage:       "-d [-cf] [FILE]..."
+//usage:       "-d [-cfk] [FILE]..."
 //usage:#define lzma_full_usage "\n\n"
 //usage:       "Decompress FILE (or stdin)\n"
 //usage:     "\n        -d      Decompress"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:
 //usage:#define lzcat_trivial_usage
 //usage:       "[FILE]..."
@@ -522,7 +544,7 @@ int bunzip2_main(int argc UNUSED_PARAM, char **argv)
 int unlzma_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int unlzma_main(int argc UNUSED_PARAM, char **argv)
 {
-        IF_LZMA(int opts =) getopt32(argv, "cfvqdt");
+        IF_LZMA(int opts =) getopt32(argv, "cfkvqdt");
 # if ENABLE_LZMA
         /* lzma without -d or -t? */
         if (applet_name[2] == 'm' && !(opts & (OPT_DECOMPRESS|OPT_TEST)))
@@ -539,19 +561,21 @@ int unlzma_main(int argc UNUSED_PARAM, char **argv)
 
 
 //usage:#define unxz_trivial_usage
-//usage:       "[-cf] [FILE]..."
+//usage:       "[-cfk] [FILE]..."
 //usage:#define unxz_full_usage "\n\n"
 //usage:       "Decompress FILE (or stdin)\n"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:
 //usage:#define xz_trivial_usage
-//usage:       "-d [-cf] [FILE]..."
+//usage:       "-d [-cfk] [FILE]..."
 //usage:#define xz_full_usage "\n\n"
 //usage:       "Decompress FILE (or stdin)\n"
 //usage:     "\n        -d      Decompress"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:
 //usage:#define xzcat_trivial_usage
 //usage:       "[FILE]..."
@@ -588,7 +612,7 @@ int unlzma_main(int argc UNUSED_PARAM, char **argv)
 int unxz_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int unxz_main(int argc UNUSED_PARAM, char **argv)
 {
-        IF_XZ(int opts =) getopt32(argv, "cfvqdt");
+        IF_XZ(int opts =) getopt32(argv, "cfkvqdt");
 # if ENABLE_XZ
         /* xz without -d or -t? */
         if (applet_name[2] == '\0' && !(opts & (OPT_DECOMPRESS|OPT_TEST)))
diff --git a/archival/bzip2.c b/archival/bzip2.c
index 7e38e78b3..8afa43802 100644
--- a/archival/bzip2.c
+++ b/archival/bzip2.c
@@ -43,6 +43,7 @@
 //usage:        )
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 
 #include "libbb.h"
 #include "bb_archive.h"
@@ -196,13 +197,13 @@ int bzip2_main(int argc UNUSED_PARAM, char **argv)
 
         opt_complementary = "s2"; /* -s means -2 (compatibility) */
         /* Must match bbunzip's constants OPT_STDOUT, OPT_FORCE! */
-        opt = getopt32(argv, "cfv" IF_FEATURE_BZIP2_DECOMPRESS("dt") "123456789qzs");
+        opt = getopt32(argv, "cfkv" IF_FEATURE_BZIP2_DECOMPRESS("dt") "123456789qzs");
 #if ENABLE_FEATURE_BZIP2_DECOMPRESS /* bunzip2_main may not be visible... */
-        if (opt & 0x18) // -d and/or -t
+        if (opt & 0x30) // -d and/or -t
                 return bunzip2_main(argc, argv);
-        opt >>= 5;
+        opt >>= 6;
 #else
-        opt >>= 3;
+        opt >>= 4;
 #endif
         opt = (uint8_t)opt; /* isolate bits for -1..-8 */
         opt |= 0x100; /* if nothing else, assume -9 */
@@ -213,6 +214,6 @@ int bzip2_main(int argc UNUSED_PARAM, char **argv)
         }
 
         argv += optind;
-        option_mask32 &= 0x7; /* ignore all except -cfv */
+        option_mask32 &= 0xf; /* ignore all except -cfkv */
         return bbunpack(argv, compressStream, append_ext, "bz2");
 }
diff --git a/archival/dpkg.c b/archival/dpkg.c
index 1cd45eda4..da3b0864e 100644
--- a/archival/dpkg.c
+++ b/archival/dpkg.c
@@ -1938,10 +1938,6 @@ int dpkg_main(int argc UNUSED_PARAM, char **argv)
                 for (i = 0; i < STATUS_HASH_PRIME; i++) {
                         free(status_hashtable[i]);
                 }
-
-                free(status_hashtable);
-                free(package_hashtable);
-                free(name_hashtable);
         }
 
         return EXIT_SUCCESS;
diff --git a/archival/gzip.c b/archival/gzip.c
index e698c26cd..c895de426 100644
--- a/archival/gzip.c
+++ b/archival/gzip.c
@@ -84,7 +84,7 @@ aa:      85.1% -- replaced with aa.gz
 //kbuild:lib-$(CONFIG_GZIP) += gzip.o
 
 //usage:#define gzip_trivial_usage
-//usage:       "[-cf" IF_FEATURE_GZIP_DECOMPRESS("dt") IF_FEATURE_GZIP_LEVELS("123456789") "] [FILE]..."
+//usage:       "[-cfk" IF_FEATURE_GZIP_DECOMPRESS("dt") IF_FEATURE_GZIP_LEVELS("123456789") "] [FILE]..."
 //usage:#define gzip_full_usage "\n\n"
 //usage:       "Compress FILEs (or stdin)\n"
 //usage:        IF_FEATURE_GZIP_LEVELS(
@@ -96,6 +96,7 @@ aa:      85.1% -- replaced with aa.gz
 //usage:        )
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -k      Keep input files"
 //usage:
 //usage:#define gzip_example_usage
 //usage:       "$ ls -la /tmp/busybox*\n"
@@ -275,7 +276,7 @@ enum {
  * input file length plus MIN_LOOKAHEAD.
  */
 
-#ifndef ENABLE_FEATURE_GZIP_LEVELS
+#if !ENABLE_FEATURE_GZIP_LEVELS
 
         max_chain_length = 4096,
 /* To speed up deflation, hash chains are never searched beyond this length.
@@ -314,7 +315,7 @@ enum {
 
 struct globals {
 
-#ifdef ENABLE_FEATURE_GZIP_LEVELS
+#if ENABLE_FEATURE_GZIP_LEVELS
         unsigned max_chain_length;
         unsigned max_lazy_match;
         unsigned good_match;
@@ -2196,7 +2197,7 @@ int gzip_main(int argc UNUSED_PARAM, char **argv)
 #endif
 {
         unsigned opt;
-#ifdef ENABLE_FEATURE_GZIP_LEVELS
+#if ENABLE_FEATURE_GZIP_LEVELS
         static const struct {
                 uint8_t good;
                 uint8_t chain_shift;
@@ -2219,13 +2220,13 @@ int gzip_main(int argc UNUSED_PARAM, char **argv)
         applet_long_options = gzip_longopts;
 #endif
         /* Must match bbunzip's constants OPT_STDOUT, OPT_FORCE! */
-        opt = getopt32(argv, "cfv" IF_FEATURE_GZIP_DECOMPRESS("dt") "qn123456789");
+        opt = getopt32(argv, "cfkv" IF_FEATURE_GZIP_DECOMPRESS("dt") "qn123456789");
 #if ENABLE_FEATURE_GZIP_DECOMPRESS /* gunzip_main may not be visible... */
-        if (opt & 0x18) // -d and/or -t
+        if (opt & 0x30) // -d and/or -t
                 return gunzip_main(argc, argv);
 #endif
-#ifdef ENABLE_FEATURE_GZIP_LEVELS
-        opt >>= ENABLE_FEATURE_GZIP_DECOMPRESS ? 7 : 5; /* drop cfv[dt]qn bits */
+#if ENABLE_FEATURE_GZIP_LEVELS
+        opt >>= ENABLE_FEATURE_GZIP_DECOMPRESS ? 8 : 6; /* drop cfkv[dt]qn bits */
         if (opt == 0)
                 opt = 1 << 6; /* default: 6 */
         opt = ffs(opt >> 4); /* Maps -1..-4 to [0], -5 to [1] ... -9 to [5] */
@@ -2234,7 +2235,7 @@ int gzip_main(int argc UNUSED_PARAM, char **argv)
         max_lazy_match   = gzip_level_config[opt].lazy2 * 2;
         nice_match       = gzip_level_config[opt].nice2 * 2;
 #endif
-        option_mask32 &= 0x7; /* retain only -cfv */
+        option_mask32 &= 0xf; /* retain only -cfkv */
 
         /* Allocate all global buffers (for DYN_ALLOC option) */
         ALLOC(uch, G1.l_buf, INBUFSIZ);
diff --git a/archival/libarchive/decompress_unxz.c b/archival/libarchive/decompress_unxz.c
index cd32cc745..350e5358a 100644
--- a/archival/libarchive/decompress_unxz.c
+++ b/archival/libarchive/decompress_unxz.c
@@ -27,11 +27,17 @@ static uint32_t xz_crc32(const uint8_t *buf, size_t size, uint32_t crc)
         return ~crc32_block_endian0(~crc, buf, size, global_crc32_table);
 }
 
-/* We use arch-optimized unaligned accessors */
-#define get_unaligned_le32(buf) ({ uint32_t v; move_from_unaligned32(v, buf); SWAP_LE32(v); })
-#define get_unaligned_be32(buf) ({ uint32_t v; move_from_unaligned32(v, buf); SWAP_BE32(v); })
-#define put_unaligned_le32(val, buf) move_to_unaligned32(buf, SWAP_LE32(val))
-#define put_unaligned_be32(val, buf) move_to_unaligned32(buf, SWAP_BE32(val))
+/* We use arch-optimized unaligned fixed-endian accessors.
+ * They have been moved to libbb (proved to be useful elsewhere as well),
+ * just check that we have them defined:
+ */
+#if !defined(get_unaligned_le32) \
+ || !defined(get_unaligned_be32) \
+ || !defined(put_unaligned_le32) \
+ || !defined(put_unaligned_be32)
+# error get_unaligned_le32 accessors are not defined
+#endif
+#define get_le32(p) (*(uint32_t*)(p))
 
 #include "unxz/xz_dec_bcj.c"
 #include "unxz/xz_dec_lzma2.c"
diff --git a/archival/lzop.c b/archival/lzop.c
index ca61add3c..6ef82b749 100644
--- a/archival/lzop.c
+++ b/archival/lzop.c
@@ -33,13 +33,13 @@
 //config:
 //config:config UNLZOP
 //config:       bool "unlzop"
-//config:       default y
+//config:       default n  # INCOMPAT: upstream lzop does not provide such tool
 //config:       help
 //config:         Lzop decompresion.
 //config:
 //config:config LZOPCAT
 //config:       bool "lzopcat"
-//config:       default y
+//config:       default n  # INCOMPAT: upstream lzop does not provide such tool
 //config:       help
 //config:         Alias to "unlzop -c".
 //config:
@@ -61,12 +61,14 @@
 //kbuild:lib-$(CONFIG_LZOPCAT) += lzop.o
 
 //usage:#define lzop_trivial_usage
-//usage:       "[-cfvd123456789CF] [FILE]..."
+//usage:       "[-cfUvd123456789CF] [FILE]..."
 //usage:#define lzop_full_usage "\n\n"
 //usage:       "        -1..9   Compression level"
 //usage:     "\n        -d      Decompress"
 //usage:     "\n        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -U      Delete input files"
+///////:     "\n        -k      Keep input files" (default, so why bother documenting?)
 //usage:     "\n        -v      Verbose"
 //usage:     "\n        -F      Don't store or verify checksum"
 //usage:     "\n        -C      Also write checksum of compressed block"
@@ -78,10 +80,12 @@
 //usage:     "\n        -F      Don't verify checksum"
 //usage:
 //usage:#define unlzop_trivial_usage
-//usage:       "[-cfvF] [FILE]..."
+//usage:       "[-cfkvF] [FILE]..."
 //usage:#define unlzop_full_usage "\n\n"
 //usage:       "        -c      Write to stdout"
 //usage:     "\n        -f      Force"
+//usage:     "\n        -U      Delete input files"
+///////:     "\n        -k      Keep input files" (default, so why bother documenting?)
 //usage:     "\n        -v      Verbose"
 //usage:     "\n        -F      Don't verify checksum"
 
@@ -472,27 +476,33 @@ struct globals {
 //#define LZOP_VERSION_STRING     "1.01"
 //#define LZOP_VERSION_DATE       "Apr 27th 2003"
 
-#define OPTION_STRING "cfvqdt123456789CF"
+// lzop wants to be weird:
+// unlike all other compressosrs, its -k "keep" option is the default,
+// and -U is used to delete the source. We will invert the bit after getopt().
+#define OPTION_STRING "cfUvqdt123456789CFk"
 
 /* Note: must be kept in sync with archival/bbunzip.c */
 enum {
         OPT_STDOUT      = (1 << 0),
         OPT_FORCE       = (1 << 1),
-        OPT_VERBOSE     = (1 << 2),
-        OPT_QUIET       = (1 << 3),
-        OPT_DECOMPRESS  = (1 << 4),
-        OPT_TEST        = (1 << 5),
-        OPT_1           = (1 << 6),
-        OPT_2           = (1 << 7),
-        OPT_3           = (1 << 8),
-        OPT_4           = (1 << 9),
-        OPT_5           = (1 << 10),
-        OPT_6           = (1 << 11),
-        OPT_789         = (7 << 12),
+        OPT_KEEP        = (1 << 2),
+        OPT_VERBOSE     = (1 << 3),
+        OPT_QUIET       = (1 << 4),
+        OPT_DECOMPRESS  = (1 << 5),
+        OPT_TEST        = (1 << 6),
+        OPT_1           = (1 << 7),
+        OPT_2           = (1 << 8),
+        OPT_3           = (1 << 9),
+        OPT_4           = (1 << 10),
+        OPT_5           = (1 << 11),
+        OPT_6           = (1 << 12),
         OPT_7           = (1 << 13),
         OPT_8           = (1 << 14),
-        OPT_C           = (1 << 15),
-        OPT_F           = (1 << 16),
+        OPT_9           = (1 << 15),
+        OPT_C           = (1 << 16),
+        OPT_F           = (1 << 17),
+        OPT_k           = (1 << 18),
+        OPT_789         = OPT_7 | OPT_8 | OPT_9
 };
 
 /**********************************************************************/
@@ -1125,6 +1135,13 @@ int lzop_main(int argc UNUSED_PARAM, char **argv)
 {
         getopt32(argv, OPTION_STRING);
         argv += optind;
+        /* -U is "anti -k", invert bit for bbunpack(): */
+        option_mask32 ^= OPT_KEEP;
+        /* -k disables -U (if any): */
+        /* opt_complementary = "k-U"; - nope, only handles -Uk, not -kU */
+        if (option_mask32 & OPT_k)
+                option_mask32 |= OPT_KEEP;
+
         /* lzopcat? */
         if (ENABLE_LZOPCAT && applet_name[4] == 'c')
                 option_mask32 |= (OPT_STDOUT | OPT_DECOMPRESS);
diff --git a/archival/tar.c b/archival/tar.c
index be5838d0d..c11b735d5 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -1245,21 +1245,26 @@ int tar_main(int argc UNUSED_PARAM, char **argv)
                 USE_FOR_MMU(IF_DESKTOP(long long) int FAST_FUNC (*xformer)(transformer_state_t *xstate);)
                 USE_FOR_NOMMU(const char *xformer_prog;)
 
-                if (opt & OPT_COMPRESS)
-                        USE_FOR_MMU(xformer = unpack_Z_stream;)
+                if (opt & OPT_COMPRESS) {
+                        USE_FOR_MMU(IF_FEATURE_SEAMLESS_Z(xformer = unpack_Z_stream;))
                         USE_FOR_NOMMU(xformer_prog = "uncompress";)
-                if (opt & OPT_GZIP)
-                        USE_FOR_MMU(xformer = unpack_gz_stream;)
+                }
+                if (opt & OPT_GZIP) {
+                        USE_FOR_MMU(IF_FEATURE_SEAMLESS_GZ(xformer = unpack_gz_stream;))
                         USE_FOR_NOMMU(xformer_prog = "gunzip";)
-                if (opt & OPT_BZIP2)
-                        USE_FOR_MMU(xformer = unpack_bz2_stream;)
+                }
+                if (opt & OPT_BZIP2) {
+                        USE_FOR_MMU(IF_FEATURE_SEAMLESS_BZ2(xformer = unpack_bz2_stream;))
                         USE_FOR_NOMMU(xformer_prog = "bunzip2";)
-                if (opt & OPT_LZMA)
-                        USE_FOR_MMU(xformer = unpack_lzma_stream;)
+                }
+                if (opt & OPT_LZMA) {
+                        USE_FOR_MMU(IF_FEATURE_SEAMLESS_LZMA(xformer = unpack_lzma_stream;))
                         USE_FOR_NOMMU(xformer_prog = "unlzma";)
-                if (opt & OPT_XZ)
-                        USE_FOR_MMU(xformer = unpack_xz_stream;)
+                }
+                if (opt & OPT_XZ) {
+                        USE_FOR_MMU(IF_FEATURE_SEAMLESS_XZ(xformer = unpack_xz_stream;))
                         USE_FOR_NOMMU(xformer_prog = "unxz";)
+                }
 
                 fork_transformer_with_sig(tar_handle->src_fd, xformer, xformer_prog);
                 /* Can't lseek over pipes */
diff --git a/archival/unzip.c b/archival/unzip.c
index 986145d0f..8dfc4e678 100644
--- a/archival/unzip.c
+++ b/archival/unzip.c
@@ -349,6 +349,12 @@ static void unzip_extract(zip_header_t *zip, int dst_fd)
                 return;
         }
 
+// NB: to support symlinks, need to extract symlink target. A-la:
+// xstate.mem_output_size_max = zip->fmt.ucmpsize;
+// ...unpack...
+// if (xstate.mem_output_buf) { success, xstate.mem_output_size is the size }
+// Although archives I've seen have fmt.method == 0 for symlinks.
+
         init_transformer_state(&xstate);
         xstate.bytes_in = zip->fmt.cmpsize;
         xstate.src_fd = zip_fd;
@@ -688,6 +694,20 @@ int unzip_main(int argc, char **argv)
                                 zip.fmt.cmpsize  = cdf.fmt.cmpsize;
                                 zip.fmt.ucmpsize = cdf.fmt.ucmpsize;
                         }
+// Seen in some zipfiles: central directory 9 byte extra field contains
+// a subfield with ID 0x5455 and 5 data bytes, which is a Unix-style UTC mtime.
+// Local header version:
+//  u16 0x5455 ("UT")
+//  u16 size (1 + 4 * n)
+//  u8  flags: bit 0:mtime is present, bit 1:atime is present, bit 2:ctime is present
+//  u32 mtime
+//  u32 atime
+//  u32 ctime
+// Central header version:
+//  u16 0x5455 ("UT")
+//  u16 size (5 (or 1?))
+//  u8  flags: bit 0:mtime is present, bit 1:atime is present, bit 2:ctime is present
+//  u32 mtime (CDF does not store atime/ctime)
 # else
                         /* CDF has the same data as local header, no need to read the latter...
                          * ...not really. An archive was seen with cdf.extra_len == 6 but
@@ -702,6 +722,7 @@ int unzip_main(int argc, char **argv)
                         if ((cdf.fmt.version_made_by >> 8) == 3) {
                                 /* This archive is created on Unix */
                                 dir_mode = file_mode = (cdf.fmt.external_attributes >> 16);
+//TODO: if (S_ISLNK(file_mode)) this is a symlink
                         }
                 }
 #endif
diff --git a/configs/TEST_nommu_defconfig b/configs/TEST_nommu_defconfig
index 7fbbbecc7..6ff68a092 100644
--- a/configs/TEST_nommu_defconfig
+++ b/configs/TEST_nommu_defconfig
@@ -891,7 +891,6 @@ CONFIG_HUSH_FUNCTIONS=y
 CONFIG_HUSH_LOCAL=y
 CONFIG_HUSH_EXPORT_N=y
 CONFIG_HUSH_RANDOM_SUPPORT=y
-CONFIG_MSH=y
 CONFIG_SH_MATH_SUPPORT=y
 CONFIG_SH_MATH_SUPPORT_64=y
 CONFIG_FEATURE_SH_EXTRA_QUIET=y
diff --git a/configs/TEST_noprintf_defconfig b/configs/TEST_noprintf_defconfig
index 3f85ee1df..4b2ef402a 100644
--- a/configs/TEST_noprintf_defconfig
+++ b/configs/TEST_noprintf_defconfig
@@ -898,7 +898,6 @@ CONFIG_FEATURE_SH_IS_NONE=y
 # CONFIG_FEATURE_BASH_IS_ASH is not set
 # CONFIG_FEATURE_BASH_IS_HUSH is not set
 CONFIG_FEATURE_BASH_IS_NONE=y
-# CONFIG_MSH is not set
 # CONFIG_SH_MATH_SUPPORT is not set
 # CONFIG_SH_MATH_SUPPORT_64 is not set
 # CONFIG_FEATURE_SH_EXTRA_QUIET is not set
diff --git a/configs/TEST_rh9_defconfig b/configs/TEST_rh9_defconfig
index 34d8e31e2..52f3e4670 100644
--- a/configs/TEST_rh9_defconfig
+++ b/configs/TEST_rh9_defconfig
@@ -905,7 +905,6 @@ CONFIG_HUSH_FUNCTIONS=y
 CONFIG_HUSH_LOCAL=y
 CONFIG_HUSH_EXPORT_N=y
 CONFIG_HUSH_RANDOM_SUPPORT=y
-CONFIG_MSH=y
 CONFIG_SH_MATH_SUPPORT=y
 CONFIG_SH_MATH_SUPPORT_64=y
 CONFIG_FEATURE_SH_EXTRA_QUIET=y
diff --git a/configs/android2_defconfig b/configs/android2_defconfig
index 20866c32b..9202320a4 100644
--- a/configs/android2_defconfig
+++ b/configs/android2_defconfig
@@ -952,7 +952,6 @@ CONFIG_CTTYHACK=y
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_EXPORT_N is not set
 # CONFIG_HUSH_MODE_X is not set
-# CONFIG_MSH is not set
 # CONFIG_FEATURE_SH_IS_ASH is not set
 # CONFIG_FEATURE_SH_IS_HUSH is not set
 CONFIG_FEATURE_SH_IS_NONE=y
diff --git a/configs/android_502_defconfig b/configs/android_502_defconfig
index bdca9eebb..1901bdbb0 100644
--- a/configs/android_502_defconfig
+++ b/configs/android_502_defconfig
@@ -1098,7 +1098,6 @@ CONFIG_CTTYHACK=y
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_EXPORT_N is not set
 # CONFIG_HUSH_MODE_X is not set
-# CONFIG_MSH is not set
 CONFIG_FEATURE_SH_IS_ASH=y
 # CONFIG_FEATURE_SH_IS_HUSH is not set
 # CONFIG_FEATURE_SH_IS_NONE is not set
diff --git a/configs/android_defconfig b/configs/android_defconfig
index 6ef81750e..ea6e8a79e 100644
--- a/configs/android_defconfig
+++ b/configs/android_defconfig
@@ -984,7 +984,6 @@ CONFIG_CTTYHACK=y
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_EXPORT_N is not set
 # CONFIG_HUSH_MODE_X is not set
-# CONFIG_MSH is not set
 # CONFIG_FEATURE_SH_IS_ASH is not set
 # CONFIG_FEATURE_SH_IS_HUSH is not set
 CONFIG_FEATURE_SH_IS_NONE=y
diff --git a/configs/android_ndk_defconfig b/configs/android_ndk_defconfig
index 35d03b42e..61871fcb1 100644
--- a/configs/android_ndk_defconfig
+++ b/configs/android_ndk_defconfig
@@ -1013,7 +1013,6 @@ CONFIG_CTTYHACK=y
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_EXPORT_N is not set
 # CONFIG_HUSH_MODE_X is not set
-# CONFIG_MSH is not set
 # CONFIG_FEATURE_SH_IS_ASH is not set
 # CONFIG_FEATURE_SH_IS_HUSH is not set
 CONFIG_FEATURE_SH_IS_NONE=y
diff --git a/configs/cygwin_defconfig b/configs/cygwin_defconfig
index 6bfc973ef..54aa44470 100644
--- a/configs/cygwin_defconfig
+++ b/configs/cygwin_defconfig
@@ -955,7 +955,6 @@ CONFIG_HUSH_LOCAL=y
 CONFIG_HUSH_RANDOM_SUPPORT=y
 CONFIG_HUSH_EXPORT_N=y
 CONFIG_HUSH_MODE_X=y
-# CONFIG_MSH is not set
 CONFIG_FEATURE_SH_IS_ASH=y
 # CONFIG_FEATURE_SH_IS_HUSH is not set
 # CONFIG_FEATURE_SH_IS_NONE is not set
diff --git a/configs/freebsd_defconfig b/configs/freebsd_defconfig
index e3d04aedc..fadbca13b 100644
--- a/configs/freebsd_defconfig
+++ b/configs/freebsd_defconfig
@@ -931,7 +931,6 @@ CONFIG_ASH=y
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_EXPORT_N is not set
 # CONFIG_HUSH_MODE_X is not set
-# CONFIG_MSH is not set
 CONFIG_FEATURE_SH_IS_ASH=y
 # CONFIG_FEATURE_SH_IS_HUSH is not set
 # CONFIG_FEATURE_SH_IS_NONE is not set
diff --git a/coreutils/cat.c b/coreutils/cat.c
index 4d9147f8a..a9ba68d6b 100644
--- a/coreutils/cat.c
+++ b/coreutils/cat.c
@@ -13,6 +13,13 @@
 //config:         cat is used to concatenate files and print them to the standard
 //config:         output. Enable this option if you wish to enable the 'cat' utility.
 //config:
+//config:config FEATURE_CATN
+//config:       bool "Enable -n and -b options"
+//config:       default y
+//config:       depends on CAT
+//config:       help
+//config:         -n numbers all output lines while -b numbers nonempty output lines.
+//config:
 //config:config FEATURE_CATV
 //config:       bool "cat -v[etA]"
 //config:       default y
@@ -27,12 +34,19 @@
 /* BB_AUDIT SUSv3 compliant */
 /* http://www.opengroup.org/onlinepubs/007904975/utilities/cat.html */
 
+//usage:#if ENABLE_FEATURE_CATN || ENABLE_FEATURE_CATV
+//usage:#define cat_trivial_usage
+//usage:       "[-" IF_FEATURE_CATN("nb") IF_FEATURE_CATV("vteA") "] [FILE]..."
+//usage:#else
 //usage:#define cat_trivial_usage
-//usage:       "[-nb"IF_FEATURE_CATV("vteA")"] [FILE]..."
+//usage:       "[FILE]..."
+//usage:#endif
 //usage:#define cat_full_usage "\n\n"
 //usage:       "Print FILEs to stdout\n"
+//usage:        IF_FEATURE_CATN(
 //usage:     "\n        -n      Number output lines"
 //usage:     "\n        -b      Number nonempty lines"
+//usage:        )
 //usage:        IF_FEATURE_CATV(
 //usage:     "\n        -v      Show nonprinting characters as ^x or M-x"
 //usage:     "\n        -t      ...and tabs as ^I"
@@ -84,30 +98,35 @@
  * I agree with the argument. Unfortunately, this ship has sailed (1983...).
  * There are dozens of Linux distros and each of them has "cat" which supports -v.
  * It's unrealistic for us to "reeducate" them to use our, incompatible way
- * to achieve "cat -v" effect. The actuall effect would be "users pissed off
+ * to achieve "cat -v" effect. The actual effect would be "users pissed off
  * by gratuitous incompatibility".
  */
-#define CATV_OPT_e (1<<0)
-#define CATV_OPT_t (1<<1)
-#define CATV_OPT_v (1<<2)
+#define CAT_OPT_e (1<<0)
+#define CAT_OPT_t (1<<1)
+#define CAT_OPT_v (1<<2)
+/* -A occupies bit (1<<3) */
+#define CAT_OPT_n ((1<<4) * ENABLE_FEATURE_CATN)
+#define CAT_OPT_b ((1<<5) * ENABLE_FEATURE_CATN)
 static int catv(unsigned opts, char **argv)
 {
         int retval = EXIT_SUCCESS;
         int fd;
+#if ENABLE_FEATURE_CATN
+        unsigned lineno = 0;
+        unsigned eol_char = (opts & (CAT_OPT_n|CAT_OPT_b)) ? '\n' : 0x100;
+        unsigned skip_num_on = (opts & CAT_OPT_b) ? '\n' : 0x100;
+        bool eol_seen = 1;
+#endif
 
-        BUILD_BUG_ON(CATV_OPT_e != VISIBLE_ENDLINE);
-        BUILD_BUG_ON(CATV_OPT_t != VISIBLE_SHOW_TABS);
+        BUILD_BUG_ON(CAT_OPT_e != VISIBLE_ENDLINE);
+        BUILD_BUG_ON(CAT_OPT_t != VISIBLE_SHOW_TABS);
 #if 0 /* These consts match, we can just pass "opts" to visible() */
-        if (opts & CATV_OPT_e)
+        if (opts & CAT_OPT_e)
                 flags |= VISIBLE_ENDLINE;
-        if (opts & CATV_OPT_t)
+        if (opts & CAT_OPT_t)
                 flags |= VISIBLE_SHOW_TABS;
 #endif
 
-        /* Read from stdin if there's nothing else to do. */
-        if (!argv[0])
-                *--argv = (char*)"-";
-
 #define read_buf bb_common_bufsiz1
         setup_common_bufsiz();
         do {
@@ -127,6 +146,11 @@ static int catv(unsigned opts, char **argv)
                         for (i = 0; i < res; i++) {
                                 unsigned char c = read_buf[i];
                                 char buf[sizeof("M-^c")];
+#if ENABLE_FEATURE_CATN
+                                if (eol_seen && c != skip_num_on)
+                                        printf("%6u  ", ++lineno);
+                                eol_seen = (c == eol_char);
+#endif
                                 visible(c, buf, opts);
                                 fputs(buf, stdout);
                         }
@@ -137,43 +161,50 @@ static int catv(unsigned opts, char **argv)
 
         fflush_stdout_and_exit(retval);
 }
+#undef CAT_OPT_n
+#undef CAT_OPT_b
 #endif
 
 int cat_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int cat_main(int argc UNUSED_PARAM, char **argv)
 {
-        struct number_state ns;
         unsigned opts;
 
         IF_FEATURE_CATV(opt_complementary = "Aetv"; /* -A == -vet */)
         /* -u is ignored ("unbuffered") */
-        opts = getopt32(argv, IF_FEATURE_CATV("etvA")"nbu");
+        opts = getopt32(argv, IF_FEATURE_CATV("etvA") IF_FEATURE_CATN("nb") "u");
         argv += optind;
 
+        /* Read from stdin if there's nothing else to do. */
+        if (!argv[0])
+                *--argv = (char*)"-";
+
 #if ENABLE_FEATURE_CATV
         if (opts & 7)
                 return catv(opts, argv);
-//BUG: -v,-e,-t,-A ignore -nb
         opts >>= 4;
 #endif
 
-#define CAT_OPT_n (1<<0)
-#define CAT_OPT_b (1<<1)
-#define CAT_OPT_u (1<<2)
-        if (!(opts & (CAT_OPT_n|CAT_OPT_b))) /* no -n or -b */
-                return bb_cat(argv);
+#if ENABLE_FEATURE_CATN
+# define CAT_OPT_n (1<<0)
+# define CAT_OPT_b (1<<1)
+        if (opts & (CAT_OPT_n|CAT_OPT_b)) { /* -n or -b */
+                struct number_state ns;
+
+                ns.width = 6;
+                ns.start = 1;
+                ns.inc = 1;
+                ns.sep = "\t";
+                ns.empty_str = "\n";
+                ns.all = !(opts & CAT_OPT_b); /* -n without -b */
+                ns.nonempty = (opts & CAT_OPT_b); /* -b (with or without -n) */
+                do {
+                        print_numbered_lines(&ns, *argv);
+                } while (*++argv);
+                fflush_stdout_and_exit(EXIT_SUCCESS);
+        }
+        /*opts >>= 2;*/
+#endif
 
-        if (!*argv)
-                *--argv = (char*)"-";
-        ns.width = 6;
-        ns.start = 1;
-        ns.inc = 1;
-        ns.sep = "\t";
-        ns.empty_str = "\n";
-        ns.all = !(opts & CAT_OPT_b); /* -n without -b */
-        ns.nonempty = (opts & CAT_OPT_b); /* -b (with or without -n) */
-        do {
-                print_numbered_lines(&ns, *argv);
-        } while (*++argv);
-        fflush_stdout_and_exit(EXIT_SUCCESS);
+        return bb_cat(argv);
 }
diff --git a/coreutils/dd.c b/coreutils/dd.c
index 2fccf9d8e..b37615313 100644
--- a/coreutils/dd.c
+++ b/coreutils/dd.c
@@ -133,9 +133,8 @@ enum {
         /* end of input flags */
         FLAG_TWOBUFS = (1 << 6) * ENABLE_FEATURE_DD_IBS_OBS,
         FLAG_COUNT   = 1 << 7,
-        FLAG_STATUS  = 1 << 8,
-        FLAG_STATUS_NONE = 1 << 9,
-        FLAG_STATUS_NOXFER = 1 << 10,
+        FLAG_STATUS_NONE = 1 << 8,
+        FLAG_STATUS_NOXFER = 1 << 9,
 };
 
 static void dd_output_status(int UNUSED_PARAM cur_signal)
@@ -397,7 +396,7 @@ int dd_main(int argc UNUSED_PARAM, char **argv)
                         n = index_in_strings(status_words, val);
                         if (n < 0)
                                 bb_error_msg_and_die(bb_msg_invalid_arg_to, val, "status");
-                        G.flags |= FLAG_STATUS << n;
+                        G.flags |= FLAG_STATUS_NONE << n;
                         /*continue;*/
                 }
 #endif
diff --git a/coreutils/nl.c b/coreutils/nl.c
index 5c64923bb..dc468a90b 100644
--- a/coreutils/nl.c
+++ b/coreutils/nl.c
@@ -35,26 +35,6 @@
 
 #include "libbb.h"
 
-void FAST_FUNC print_numbered_lines(struct number_state *ns, const char *filename)
-{
-        FILE *fp = fopen_or_warn_stdin(filename);
-        unsigned N = ns->start;
-        char *line;
-
-        while ((line = xmalloc_fgetline(fp)) != NULL) {
-                if (ns->all
-                 || (ns->nonempty && line[0])
-                ) {
-                        printf("%*u%s%s\n", ns->width, N, ns->sep, line);
-                        N += ns->inc;
-                } else if (ns->empty_str)
-                        fputs(ns->empty_str, stdout);
-                free(line);
-        }
-
-        fclose(fp);
-}
-
 int nl_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int nl_main(int argc UNUSED_PARAM, char **argv)
 {
diff --git a/coreutils/printf.c b/coreutils/printf.c
index bc22e0ee7..65bb5a935 100644
--- a/coreutils/printf.c
+++ b/coreutils/printf.c
@@ -305,7 +305,7 @@ static char **print_formatted(char *f, char **argv, int *conv_err)
                                 }
                                 break;
                         }
-                        if (strchr("-+ #", *f)) {
+                        if (*f && strchr("-+ #", *f)) {
                                 ++f;
                                 ++direc_length;
                         }
@@ -348,7 +348,7 @@ static char **print_formatted(char *f, char **argv, int *conv_err)
                                 static const char format_chars[] ALIGN1 = "diouxXfeEgGcs";
                                 char *p = strchr(format_chars, *f);
                                 /* needed - try "printf %" without it */
-                                if (p == NULL) {
+                                if (p == NULL || *f == '\0') {
                                         bb_error_msg("%s: invalid format", direc_start);
                                         /* causes main() to exit with error */
                                         return saved_argv - 1;
diff --git a/coreutils/shuf.c b/coreutils/shuf.c
index 9f61f2f7d..217f15c97 100644
--- a/coreutils/shuf.c
+++ b/coreutils/shuf.c
@@ -53,7 +53,7 @@ static void shuffle_lines(char **lines, unsigned numlines)
                 /* RAND_MAX can be as small as 32767 */
                 if (i > RAND_MAX)
                         r ^= rand() << 15;
-                r %= i;
+                r %= i + 1;
                 tmp = lines[i];
                 lines[i] = lines[r];
                 lines[r] = tmp;
diff --git a/coreutils/test.c b/coreutils/test.c
index c949a3cc9..d4f93312a 100644
--- a/coreutils/test.c
+++ b/coreutils/test.c
@@ -563,26 +563,11 @@ static int binop(void)
         /*return 1; - NOTREACHED */
 }
 
-
 static void initialize_group_array(void)
 {
-        int n;
-
-        /* getgroups may be expensive, try to use it only once */
-        ngroups = 32;
-        do {
-                /* FIXME: ash tries so hard to not die on OOM,
-                 * and we spoil it with just one xrealloc here */
-                /* We realloc, because test_main can be entered repeatedly by shell.
-                 * Testcase (ash): 'while true; do test -x some_file; done'
-                 * and watch top. (some_file must have owner != you) */
-                n = ngroups;
-                group_array = xrealloc(group_array, n * sizeof(gid_t));
-                ngroups = getgroups(n, group_array);
-        } while (ngroups > n);
+        group_array = bb_getgroups(&ngroups, NULL);
 }
 
-
 /* Return non-zero if GID is one that we have in our groups list. */
 //XXX: FIXME: duplicate of existing libbb function?
 // see toplevel TODO file:
@@ -610,14 +595,10 @@ static int is_a_group_member(gid_t gid)
 /* Do the same thing access(2) does, but use the effective uid and gid,
    and don't make the mistake of telling root that any file is
    executable. */
-static int test_eaccess(char *path, int mode)
+static int test_eaccess(struct stat *st, int mode)
 {
-        struct stat st;
         unsigned int euid = geteuid();
 
-        if (stat(path, &st) < 0)
-                return -1;
-
         if (euid == 0) {
                 /* Root can read or write any file. */
                 if (mode != X_OK)
@@ -625,16 +606,16 @@ static int test_eaccess(char *path, int mode)
 
                 /* Root can execute any file that has any one of the execute
                  * bits set. */
-                if (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))
+                if (st->st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))
                         return 0;
         }
 
-        if (st.st_uid == euid)  /* owner */
+        if (st->st_uid == euid)  /* owner */
                 mode <<= 6;
-        else if (is_a_group_member(st.st_gid))
+        else if (is_a_group_member(st->st_gid))
                 mode <<= 3;
 
-        if (st.st_mode & mode)
+        if (st->st_mode & mode)
                 return 0;
 
         return -1;
@@ -682,7 +663,7 @@ static int filstat(char *nm, enum token mode)
                         i = W_OK;
                 if (mode == FILEX)
                         i = X_OK;
-                return test_eaccess(nm, i) == 0;
+                return test_eaccess(&s, i) == 0;
         }
         if (is_file_type(mode)) {
                 if (mode == FILREG)
diff --git a/coreutils/uname.c b/coreutils/uname.c
index 4d98fde25..9c6a06ebb 100644
--- a/coreutils/uname.c
+++ b/coreutils/uname.c
@@ -55,10 +55,20 @@
 //config:       help
 //config:         Sets the operating system name reported by uname -o.  The
 //config:         default is "GNU/Linux".
+//config:
+//can't use "ARCH" for this applet, all hell breaks loose in build system :)
+//config:config BBARCH
+//config:       bool "arch"
+//config:       default y
+//config:       help
+//config:         Same as uname -m.
 
 //applet:IF_UNAME(APPLET(uname, BB_DIR_BIN, BB_SUID_DROP))
+//                 APPLET_ODDNAME:name  main   location    suid_type     help
+//applet:IF_BBARCH(APPLET_ODDNAME(arch, uname, BB_DIR_BIN, BB_SUID_DROP, arch))
 
-//kbuild:lib-$(CONFIG_UNAME) += uname.o
+//kbuild:lib-$(CONFIG_UNAME)  += uname.o
+//kbuild:lib-$(CONFIG_BBARCH) += uname.o
 
 /* BB_AUDIT SUSv3 compliant */
 /* http://www.opengroup.org/onlinepubs/007904975/utilities/uname.html */
@@ -81,6 +91,11 @@
 //usage:       "$ uname -a\n"
 //usage:       "Linux debian 2.4.23 #2 Tue Dec 23 17:09:10 MST 2003 i686 GNU/Linux\n"
 
+//usage:#define arch_trivial_usage
+//usage:       ""
+//usage:#define arch_full_usage "\n\n"
+//usage:       "Print system architecture"
+
 #include "libbb.h"
 /* After libbb.h, since it needs sys/types.h on some systems */
 #include <sys/utsname.h>
@@ -92,7 +107,8 @@ typedef struct {
         char os[sizeof(CONFIG_UNAME_OSNAME)];
 } uname_info_t;
 
-static const char options[] ALIGN1 = "snrvmpioa";
+#if ENABLE_UNAME
+#define options "snrvmpioa"
 static const unsigned short utsname_offset[] = {
         offsetof(uname_info_t, name.sysname), /* -s */
         offsetof(uname_info_t, name.nodename), /* -n */
@@ -103,86 +119,97 @@ static const unsigned short utsname_offset[] = {
         offsetof(uname_info_t, platform), /* -i */
         offsetof(uname_info_t, os), /* -o */
 };
+#endif
 
 int uname_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
-int uname_main(int argc UNUSED_PARAM, char **argv)
+int uname_main(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
-#if ENABLE_LONG_OPTS
-        static const char uname_longopts[] ALIGN1 =
-                /* name, has_arg, val */
-                "all\0"               No_argument       "a"
-                "kernel-name\0"       No_argument       "s"
-                "nodename\0"          No_argument       "n"
-                "kernel-release\0"    No_argument       "r"
-                "release\0"           No_argument       "r"
-                "kernel-version\0"    No_argument       "v"
-                "machine\0"           No_argument       "m"
-                "processor\0"         No_argument       "p"
-                "hardware-platform\0" No_argument       "i"
-                "operating-system\0"  No_argument       "o"
-        ;
-#endif
         uname_info_t uname_info;
-#if defined(__sparc__) && defined(__linux__)
-        char *fake_sparc = getenv("FAKE_SPARC");
-#endif
-        const char *unknown_str = "unknown";
-        const char *fmt;
-        const unsigned short *delta;
+        IF_UNAME(const char *unknown_str = "unknown";)
         unsigned toprint;
 
-        IF_LONG_OPTS(applet_long_options = uname_longopts);
-        toprint = getopt32(argv, options);
-
-        if (argv[optind]) { /* coreutils-6.9 compat */
-                bb_show_usage();
-        }
-
-        if (toprint & (1 << 8)) { /* -a => all opts on */
-                toprint = (1 << 8) - 1;
-                unknown_str = ""; /* -a does not print unknown fields */
-        }
-
-        if (toprint == 0) { /* no opts => -s (sysname) */
-                toprint = 1;
-        }
+        toprint = (1 << 4); /* "arch" = "uname -m" */
+
+#if ENABLE_UNAME
+        if (!ENABLE_BBARCH || applet_name[0] == 'u') {
+# if ENABLE_LONG_OPTS
+                static const char uname_longopts[] ALIGN1 =
+                        /* name, has_arg, val */
+                        "all\0"               No_argument       "a"
+                        "kernel-name\0"       No_argument       "s"
+                        "nodename\0"          No_argument       "n"
+                        "kernel-release\0"    No_argument       "r"
+                        "release\0"           No_argument       "r"
+                        "kernel-version\0"    No_argument       "v"
+                        "machine\0"           No_argument       "m"
+                        "processor\0"         No_argument       "p"
+                        "hardware-platform\0" No_argument       "i"
+                        "operating-system\0"  No_argument       "o"
+                ;
+# endif
+                IF_LONG_OPTS(applet_long_options = uname_longopts);
+                toprint = getopt32(argv, options);
+                if (argv[optind]) { /* coreutils-6.9 compat */
+                        bb_show_usage();
+                }
+                if (toprint & (1 << 8)) { /* -a => all opts on */
+                        toprint = (1 << 8) - 1;
+                        unknown_str = ""; /* -a does not print unknown fields */
+                }
+                if (toprint == 0) { /* no opts => -s (sysname) */
+                        toprint = 1;
+                }
+        } /* if "uname" */
+#endif
 
         uname(&uname_info.name); /* never fails */
 
 #if defined(__sparc__) && defined(__linux__)
-        if (fake_sparc && (fake_sparc[0] | 0x20) == 'y') {
-                strcpy(uname_info.name.machine, "sparc");
-        }
-#endif
-        strcpy(uname_info.processor, unknown_str);
-        strcpy(uname_info.platform, unknown_str);
-        strcpy(uname_info.os, CONFIG_UNAME_OSNAME);
-#if 0
-        /* Fedora does something like this */
-        strcpy(uname_info.processor, uname_info.name.machine);
-        strcpy(uname_info.platform, uname_info.name.machine);
-        if (uname_info.platform[0] == 'i'
-         && uname_info.platform[1]
-         && uname_info.platform[2] == '8'
-         && uname_info.platform[3] == '6'
-        ) {
-                uname_info.platform[1] = '3';
+        {
+                char *fake_sparc = getenv("FAKE_SPARC");
+                if (fake_sparc && (fake_sparc[0] | 0x20) == 'y') {
+                        strcpy(uname_info.name.machine, "sparc");
+                }
         }
 #endif
-
-        delta = utsname_offset;
-        fmt = " %s" + 1;
-        do {
-                if (toprint & 1) {
-                        const char *p = (char *)(&uname_info) + *delta;
-                        if (p[0]) {
-                                printf(fmt, p);
-                                fmt = " %s";
-                        }
+        if (ENABLE_BBARCH && (!ENABLE_UNAME || applet_name[0] == 'a')) {
+                puts(uname_info.name.machine);
+        } else {
+#if ENABLE_UNAME
+                /* "uname" */
+                const char *fmt;
+                const unsigned short *delta;
+
+                strcpy(uname_info.processor, unknown_str);
+                strcpy(uname_info.platform, unknown_str);
+                strcpy(uname_info.os, CONFIG_UNAME_OSNAME);
+# if 0
+                /* Fedora does something like this */
+                strcpy(uname_info.processor, uname_info.name.machine);
+                strcpy(uname_info.platform, uname_info.name.machine);
+                if (uname_info.platform[0] == 'i'
+                 && uname_info.platform[1]
+                 && uname_info.platform[2] == '8'
+                 && uname_info.platform[3] == '6'
+                ) {
+                        uname_info.platform[1] = '3';
                 }
-                ++delta;
-        } while (toprint >>= 1);
-        bb_putchar('\n');
+# endif
+                delta = utsname_offset;
+                fmt = " %s" + 1;
+                do {
+                        if (toprint & 1) {
+                                const char *p = (char *)(&uname_info) + *delta;
+                                if (p[0]) {
+                                        printf(fmt, p);
+                                        fmt = " %s";
+                                }
+                        }
+                        ++delta;
+                } while (toprint >>= 1);
+                bb_putchar('\n');
+#endif
+        }
 
         fflush_stdout_and_exit(EXIT_SUCCESS); /* coreutils-6.9 compat */
 }
diff --git a/coreutils/uudecode.c b/coreutils/uudecode.c
index ddce2548b..2fe771f69 100644
--- a/coreutils/uudecode.c
+++ b/coreutils/uudecode.c
@@ -47,10 +47,16 @@ static void FAST_FUNC read_stduu(FILE *src_stream, FILE *dst_stream, int flags U
                 line = xmalloc_fgets_str_len(src_stream, "\n", &line_len);
                 if (!line)
                         break;
-                /* Handle both Unix and MSDOS text, and stray trailing spaces */
+                /* Handle both Unix and MSDOS text.
+                 * Note: space should not be trimmed, some encoders use it instead of "`"
+                 * for padding of last incomplete 4-char block.
+                 */
                 str_len = line_len;
-                while (--str_len >= 0 && isspace(line[str_len]))
+                while (--str_len >= 0
+                 && (line[str_len] == '\n' || line[str_len] == '\r')
+                ) {
                         line[str_len] = '\0';
+                }
 
                 if (strcmp(line, "end") == 0) {
                         return; /* the only non-error exit */
@@ -65,7 +71,7 @@ static void FAST_FUNC read_stduu(FILE *src_stream, FILE *dst_stream, int flags U
 
                 encoded_len = line[0] * 4 / 3;
                 /* Check that line is not too short. (we tolerate
-                 * overly _long_ line to accommodate possible extra '`').
+                 * overly _long_ line to accommodate possible extra "`").
                  * Empty line case is also caught here. */
                 if (str_len <= encoded_len) {
                         break; /* go to bb_error_msg_and_die("short file"); */
diff --git a/examples/mdev.conf.change_blockdev.sh b/examples/mdev.conf.change_blockdev.sh
index 512e43fcc..252d30f53 100755
--- a/examples/mdev.conf.change_blockdev.sh
+++ b/examples/mdev.conf.change_blockdev.sh
@@ -14,7 +14,7 @@ env | sort
 
 while sleep 1; test $cnt != 0; do
         echo "Trying to reread partition table on $DEVNAME ($cnt)"
-        : $((cnt--))
+        cnt=$((cnt-1))
         # If device node doesn't exist, it means the device was removed.
         # Stop trying.
         test -e "$DEVNAME" || { echo "$DEVNAME doesn't exist, aborting"; exit 1; }
diff --git a/examples/var_service/dhcp_if_pinger/run b/examples/var_service/dhcp_if_pinger/run
index e0e87a16a..8aca90c1a 100755
--- a/examples/var_service/dhcp_if_pinger/run
+++ b/examples/var_service/dhcp_if_pinger/run
@@ -30,7 +30,7 @@ test x"$router" != x"" || exec env - sleep "$ping_time"
 failcnt=0
 while true; do
         ping $ping_opts "$router" && exec env - sleep "$ping_time"
-        : $((failcnt++))
+        failcnt=$((failcnt+1))
         msg "Failed to ping $router, fail count:$failcnt"
         test $failcnt -ge $max_fail && break
         env - sleep "$retry_time"
diff --git a/include/libbb.h b/include/libbb.h
index 0bc8cf29e..c58cbc250 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -801,6 +801,8 @@ ssize_t recv_from_to(int fd, void *buf, size_t len, int flags,
 
 uint16_t inet_cksum(uint16_t *addr, int len) FAST_FUNC;
 
+/* 0 if argv[0] is NULL: */
+unsigned string_array_len(char **argv) FAST_FUNC;
 void overlapping_strcpy(char *dst, const char *src) FAST_FUNC;
 char *safe_strncpy(char *dst, const char *src, size_t size) FAST_FUNC;
 char *strncpy_IFNAMSIZ(char *dst, const char *src) FAST_FUNC;
@@ -1057,6 +1059,15 @@ void die_if_bad_username(const char* name) FAST_FUNC;
 #else
 #define die_if_bad_username(name) ((void)(name))
 #endif
+/*
+ * Returns (-1) terminated malloced result of getgroups().
+ * Reallocs group_array (useful for repeated calls).
+ * ngroups is an initial size of array. It is rounded up to 32 for realloc.
+ * ngroups is updated on return.
+ * ngroups can be NULL: bb_getgroups(NULL, NULL) is valid usage.
+ * Dies on errors (on Linux, only xrealloc can cause this, not internal getgroups call).
+ */
+gid_t *bb_getgroups(int *ngroups, gid_t *group_array) FAST_FUNC;
 
 #if ENABLE_FEATURE_UTMP
 void FAST_FUNC write_new_utmp(pid_t pid, int new_type, const char *tty_name, const char *username, const char *hostname);
@@ -1132,7 +1143,7 @@ int spawn_and_wait(char **argv) FAST_FUNC;
 int run_nofork_applet(int applet_no, char **argv) FAST_FUNC;
 #ifndef BUILD_INDIVIDUAL
 extern int find_applet_by_name(const char *name) FAST_FUNC;
-extern void run_applet_no_and_exit(int a, char **argv) NORETURN FAST_FUNC;
+extern void run_applet_no_and_exit(int a, const char *name, char **argv) NORETURN FAST_FUNC;
 #endif
 
 /* Helpers for daemonization.
diff --git a/include/platform.h b/include/platform.h
index 13f818202..5ae82427a 100644
--- a/include/platform.h
+++ b/include/platform.h
@@ -264,6 +264,12 @@ typedef uint64_t bb__aliased_uint64_t FIX_ALIASING;
 } while (0)
 #endif
 
+/* Unaligned, fixed-endian accessors */
+#define get_unaligned_le32(buf) ({ uint32_t v; move_from_unaligned32(v, buf); SWAP_LE32(v); })
+#define get_unaligned_be32(buf) ({ uint32_t v; move_from_unaligned32(v, buf); SWAP_BE32(v); })
+#define put_unaligned_le32(val, buf) move_to_unaligned32(buf, SWAP_LE32(val))
+#define put_unaligned_be32(val, buf) move_to_unaligned32(buf, SWAP_BE32(val))
+
 
 /* ---- Size-saving "small" ints (arch-dependent) ----------- */
 
diff --git a/libbb/Config.src b/libbb/Config.src
index c51640305..16c79dbf0 100644
--- a/libbb/Config.src
+++ b/libbb/Config.src
@@ -3,7 +3,7 @@
 # see scripts/kbuild/config-language.txt.
 #
 
-menu "Busybox Library Tuning"
+comment "Library Tuning"
 
 INSERT
 
@@ -66,7 +66,7 @@ config FEATURE_FAST_TOP
         bool "Faster /proc scanning code (+100 bytes)"
         default n  # all "fast or small" options default to small
         help
-          This option makes top (and ps) ~20% faster (or 20% less CPU hungry),
+          This option makes top and ps ~20% faster (or 20% less CPU hungry),
           but code size is slightly bigger.
 
 config FEATURE_ETC_NETWORKS
@@ -302,13 +302,17 @@ config FEATURE_VERBOSE_CP_MESSAGE
         default n
         help
           Error messages with this feature enabled:
+
             $ cp file /does_not_exist/file
             cp: cannot create '/does_not_exist/file': Path does not exist
             $ cp file /vmlinuz/file
             cp: cannot stat '/vmlinuz/file': Path has non-directory component
+
           If this feature is not enabled, they will be, respectively:
+
             cp: cannot create '/does_not_exist/file': No such file or directory
             cp: cannot stat '/vmlinuz/file': Not a directory
+
           This will cost you ~60 bytes.
 
 config FEATURE_USE_SENDFILE
@@ -376,7 +380,4 @@ config FEATURE_HWIB
         bool "Support infiniband HW"
         default y
         help
-          Support for printing infiniband addresses in
-          network applets.
-
-endmenu
+          Support for printing infiniband addresses in network applets.
diff --git a/libbb/appletlib.c b/libbb/appletlib.c
index a31a73e90..34b73afa5 100644
--- a/libbb/appletlib.c
+++ b/libbb/appletlib.c
@@ -78,6 +78,17 @@
 #endif
 
 
+unsigned FAST_FUNC string_array_len(char **argv)
+{
+        char **start = argv;
+
+        while (*argv)
+                argv++;
+
+        return argv - start;
+}
+
+
 #if ENABLE_SHOW_USAGE && !ENABLE_FEATURE_COMPRESS_USAGE
 static const char usage_messages[] ALIGN1 = UNPACKED_USAGE;
 #else
@@ -675,8 +686,21 @@ static void check_suid(int applet_no)
                 if (geteuid())
                         bb_error_msg_and_die("must be suid to work properly");
         } else if (APPLET_SUID(applet_no) == BB_SUID_DROP) {
-                xsetgid(rgid);  /* drop all privileges */
-                xsetuid(ruid);
+                /*
+                 * Drop all privileges.
+                 *
+                 * Don't check for errors: in normal use, they are impossible,
+                 * and in special cases, exiting is harmful. Example:
+                 * 'unshare --user' when user's shell is also from busybox.
+                 *
+                 * 'unshare --user' creates a new user namespace without any
+                 * uid mappings. Thus, busybox binary is setuid nobody:nogroup
+                 * within the namespace, as that is the only user. However,
+                 * since no uids are mapped, calls to setgid/setuid
+                 * fail (even though they would do nothing).
+                 */
+                setgid(rgid);
+                setuid(ruid);
         }
 #  if ENABLE_FEATURE_SUID_CONFIG
  ret: ;
@@ -919,16 +943,17 @@ static int busybox_main(char **argv)
 # endif
 
 # if NUM_APPLETS > 0
-void FAST_FUNC run_applet_no_and_exit(int applet_no, char **argv)
+void FAST_FUNC run_applet_no_and_exit(int applet_no, const char *name, char **argv)
 {
-        int argc = 1;
-
-        while (argv[argc])
-                argc++;
+        int argc = string_array_len(argv);
 
         /* Reinit some shared global data */
         xfunc_error_retval = EXIT_FAILURE;
-        applet_name = bb_get_last_path_component_nostrip(argv[0]);
+        /*
+         * We do not use argv[0]: do not want to repeat massaging of
+         * "-/sbin/halt" -> "halt", for example.
+         */
+        applet_name = name;
 
         /* Special case. POSIX says "test --help"
          * should be no different from e.g. "test --foo".
@@ -972,7 +997,7 @@ static NORETURN void run_applet_and_exit(const char *name, char **argv)
         {
                 int applet = find_applet_by_name(name);
                 if (applet >= 0)
-                        run_applet_no_and_exit(applet, argv);
+                        run_applet_no_and_exit(applet, name, argv);
         }
 #  endif
 
@@ -1058,7 +1083,11 @@ int main(int argc UNUSED_PARAM, char **argv)
         }
         /* applet_names in this case is just "applet\0\0" */
         lbb_prepare(applet_names IF_FEATURE_INDIVIDUAL(, argv));
+# if ENABLE_BUILD_LIBBUSYBOX
+        return SINGLE_APPLET_MAIN(string_array_len(argv), argv);
+# else
         return SINGLE_APPLET_MAIN(argc, argv);
+# endif
 
 #elif !ENABLE_BUSYBOX && NUM_APPLETS == 0
 
diff --git a/libbb/bb_getgroups.c b/libbb/bb_getgroups.c
new file mode 100644
index 000000000..59ae53738
--- /dev/null
+++ b/libbb/bb_getgroups.c
@@ -0,0 +1,47 @@
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2017 Denys Vlasenko
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+
+//kbuild:lib-y += bb_getgroups.o
+
+#include "libbb.h"
+
+gid_t* FAST_FUNC bb_getgroups(int *ngroups, gid_t *group_array)
+{
+        int n = ngroups ? *ngroups : 0;
+
+        /* getgroups may be a bit expensive, try to use it only once */
+        if (n < 32)
+                n = 32;
+
+        for (;;) {
+// FIXME: ash tries so hard to not die on OOM (when we are called from test),
+// and we spoil it with just one xrealloc here
+                group_array = xrealloc(group_array, (n+1) * sizeof(group_array[0]));
+                n = getgroups(n, group_array);
+                /*
+                 * If buffer is too small, kernel does not return new_n > n.
+                 * It returns -1 and EINVAL:
+                 */
+                if (n >= 0) {
+                        /* Terminator for bb_getgroups(NULL, NULL) usage */
+                        group_array[n] = (gid_t) -1;
+                        break;
+                }
+                if (errno == EINVAL) { /* too small? */
+                        /* This is the way to ask kernel how big the array is */
+                        n = getgroups(0, group_array);
+                        continue;
+                }
+                /* Some other error (should never happen on Linux) */
+                bb_perror_msg_and_die("getgroups");
+        }
+
+        if (ngroups)
+                *ngroups = n;
+        return group_array;
+}
diff --git a/libbb/common_bufsiz.c b/libbb/common_bufsiz.c
index 2847eb57d..f1124ba0e 100644
--- a/libbb/common_bufsiz.c
+++ b/libbb/common_bufsiz.c
@@ -19,6 +19,7 @@
 //config:
 //config:         At link time, "text" is padded to a full page. At runtime, all "text"
 //config:         pages are mapped RO and executable.
+//config:
 //config:         "Data" starts on the next page boundary, but is not padded
 //config:         to a full page at the end. "Bss" starts wherever "data" ends.
 //config:         At runtime, "data" pages are mapped RW and they are file-backed
diff --git a/libbb/copyfd.c b/libbb/copyfd.c
index 7e3531903..921fe3f81 100644
--- a/libbb/copyfd.c
+++ b/libbb/copyfd.c
@@ -119,8 +119,11 @@ static off_t bb_full_fd_action(int src_fd, int dst_fd, off_t size)
         }
  out:
 
+/* some environments don't have munmap(), hide it in #if */
+#if CONFIG_FEATURE_COPYBUF_KB > 4
         if (buffer_size > 4 * 1024)
                 munmap(buffer, buffer_size);
+#endif
         return status ? -1 : total;
 }
 
diff --git a/libbb/dump.c b/libbb/dump.c
index 87c1dce13..211a1ed9e 100644
--- a/libbb/dump.c
+++ b/libbb/dump.c
@@ -58,7 +58,7 @@ static NOINLINE int bb_dump_size(FS *fs)
         const char *p;
         int prec;
 
-        /* figure out the data block bb_dump_size needed for each format unit */
+        /* figure out the data block size needed for each format unit */
         for (cur_size = 0, fu = fs->nextfu; fu; fu = fu->nextfu) {
                 if (fu->bcnt) {
                         cur_size += fu->bcnt * fu->reps;
@@ -311,20 +311,18 @@ static NOINLINE void rewrite(priv_dumper_t *dumper, FS *fs)
         }
 }
 
-static void do_skip(priv_dumper_t *dumper, const char *fname, int statok)
+static void do_skip(priv_dumper_t *dumper, const char *fname)
 {
         struct stat sbuf;
 
-        if (statok) {
-                xfstat(STDIN_FILENO, &sbuf, fname);
-                if (!(S_ISCHR(sbuf.st_mode) || S_ISBLK(sbuf.st_mode) || S_ISFIFO(sbuf.st_mode))
-                 && dumper->pub.dump_skip >= sbuf.st_size
-                ) {
-                        /* If bb_dump_size valid and pub.dump_skip >= size */
-                        dumper->pub.dump_skip -= sbuf.st_size;
-                        dumper->address += sbuf.st_size;
-                        return;
-                }
+        xfstat(STDIN_FILENO, &sbuf, fname);
+        if (S_ISREG(sbuf.st_mode)
+         && dumper->pub.dump_skip >= sbuf.st_size
+        ) {
+                /* If st_size is valid and pub.dump_skip >= st_size */
+                dumper->pub.dump_skip -= sbuf.st_size;
+                dumper->address += sbuf.st_size;
+                return;
         }
         if (fseeko(stdin, dumper->pub.dump_skip, SEEK_SET)) {
                 bb_simple_perror_msg_and_die(fname);
@@ -336,29 +334,26 @@ static void do_skip(priv_dumper_t *dumper, const char *fname, int statok)
 
 static NOINLINE int next(priv_dumper_t *dumper)
 {
-        int statok;
-
         for (;;) {
-                if (*dumper->argv) {
-                        dumper->next__done = statok = 1;
-                        if (!(freopen(*dumper->argv, "r", stdin))) {
-                                bb_simple_perror_msg(*dumper->argv);
-                                dumper->exitval = 1;
-                                ++dumper->argv;
-                                continue;
+                const char *fname = *dumper->argv;
+
+                if (fname) {
+                        dumper->argv++;
+                        if (NOT_LONE_DASH(fname)) {
+                                if (!freopen(fname, "r", stdin)) {
+                                        bb_simple_perror_msg(fname);
+                                        dumper->exitval = 1;
+                                        continue;
+                                }
                         }
                 } else {
                         if (dumper->next__done)
                                 return 0; /* no next file */
-                        dumper->next__done = 1;
-//why stat of stdin is specially prohibited?
-                        statok = 0;
                 }
+                dumper->next__done = 1;
                 if (dumper->pub.dump_skip)
-                        do_skip(dumper, statok ? *dumper->argv : "stdin", statok);
-                if (*dumper->argv)
-                        ++dumper->argv;
-                if (!dumper->pub.dump_skip)
+                        do_skip(dumper, fname ? fname : "stdin");
+                if (dumper->pub.dump_skip == 0)
                         return 1;
         }
         /* NOTREACHED */
@@ -670,7 +665,7 @@ int FAST_FUNC bb_dump_dump(dumper_t *pub_dumper, char **argv)
         FS *tfs;
         int blocksize;
 
-        /* figure out the data block bb_dump_size */
+        /* figure out the data block size */
         blocksize = 0;
         tfs = dumper->pub.fshead;
         while (tfs) {
diff --git a/libbb/getopt32.c b/libbb/getopt32.c
index b87b83538..80f4cc060 100644
--- a/libbb/getopt32.c
+++ b/libbb/getopt32.c
@@ -379,9 +379,7 @@ getopt32(char **argv, const char *applet_opts, ...)
         int spec_flgs = 0;
 
         /* skip 0: some applets cheat: they do not actually HAVE argv[0] */
-        argc = 1;
-        while (argv[argc])
-                argc++;
+        argc = 1 + string_array_len(argv + 1);
 
         va_start(p, applet_opts);
 
diff --git a/libbb/inet_common.c b/libbb/inet_common.c
index 5b4a4a10b..04259f47b 100644
--- a/libbb/inet_common.c
+++ b/libbb/inet_common.c
@@ -11,6 +11,12 @@
 #include "libbb.h"
 #include "inet_common.h"
 
+#if 0
+# define dbg(...) bb_error_msg(__VA_ARGS__)
+#else
+# define dbg(...) ((void)0)
+#endif
+
 int FAST_FUNC INET_resolve(const char *name, struct sockaddr_in *s_in, int hostfirst)
 {
         struct hostent *hp;
@@ -33,9 +39,7 @@ int FAST_FUNC INET_resolve(const char *name, struct sockaddr_in *s_in, int hostf
         }
         /* If we expect this to be a hostname, try hostname database first */
         if (hostfirst) {
-#ifdef DEBUG
-                bb_error_msg("gethostbyname(%s)", name);
-#endif
+                dbg("gethostbyname(%s)", name);
                 hp = gethostbyname(name);
                 if (hp) {
                         memcpy(&s_in->sin_addr, hp->h_addr_list[0],
@@ -45,9 +49,7 @@ int FAST_FUNC INET_resolve(const char *name, struct sockaddr_in *s_in, int hostf
         }
 #if ENABLE_FEATURE_ETC_NETWORKS
         /* Try the NETWORKS database to see if this is a known network. */
-#ifdef DEBUG
-        bb_error_msg("getnetbyname(%s)", name);
-#endif
+        dbg("getnetbyname(%s)", name);
         np = getnetbyname(name);
         if (np) {
                 s_in->sin_addr.s_addr = htonl(np->n_net);
@@ -61,8 +63,8 @@ int FAST_FUNC INET_resolve(const char *name, struct sockaddr_in *s_in, int hostf
 #ifdef DEBUG
         res_init();
         _res.options |= RES_DEBUG;
-        bb_error_msg("gethostbyname(%s)", name);
 #endif
+        dbg("gethostbyname(%s)", name);
         hp = gethostbyname(name);
         if (!hp) {
                 return -1;
@@ -93,17 +95,12 @@ char* FAST_FUNC INET_rresolve(struct sockaddr_in *s_in, int numeric, uint32_t ne
         smallint is_host;
 
         if (s_in->sin_family != AF_INET) {
-#ifdef DEBUG
-                bb_error_msg("rresolve: unsupported address family %d!",
-                                s_in->sin_family);
-#endif
+                dbg("rresolve: unsupported address family %d!", s_in->sin_family);
                 errno = EAFNOSUPPORT;
                 return NULL;
         }
         nip = s_in->sin_addr.s_addr;
-#ifdef DEBUG
-        bb_error_msg("rresolve: %08x mask:%08x num:%08x", (unsigned)nip, netmask, numeric);
-#endif
+        dbg("rresolve: %08x mask:%08x num:%08x", (unsigned)nip, netmask, numeric);
         if (numeric & 0x0FFF)
                 return xmalloc_sockaddr2dotted_noport((void*)s_in);
         if (nip == INADDR_ANY) {
@@ -117,10 +114,8 @@ char* FAST_FUNC INET_rresolve(struct sockaddr_in *s_in, int numeric, uint32_t ne
         pn = cache;
         while (pn) {
                 if (pn->nip == nip && pn->is_host == is_host) {
-#ifdef DEBUG
-                        bb_error_msg("rresolve: found %s %08x in cache",
+                        dbg("rresolve: found %s %08x in cache",
                                 (is_host ? "host" : "net"), (unsigned)nip);
-#endif
                         return xstrdup(pn->name);
                 }
                 pn = pn->next;
@@ -128,19 +123,18 @@ char* FAST_FUNC INET_rresolve(struct sockaddr_in *s_in, int numeric, uint32_t ne
 
         name = NULL;
         if (is_host) {
-#ifdef DEBUG
-                bb_error_msg("sockaddr2host_noport(%08x)", (unsigned)nip);
-#endif
+                dbg("sockaddr2host_noport(%08x)", (unsigned)nip);
                 name = xmalloc_sockaddr2host_noport((void*)s_in);
-        } else if (ENABLE_FEATURE_ETC_NETWORKS) {
+        }
+#if ENABLE_FEATURE_ETC_NETWORKS
+        else {
                 struct netent *np;
-#ifdef DEBUG
-                bb_error_msg("getnetbyaddr(%08x)", (unsigned)ntohl(nip));
-#endif
+                dbg("getnetbyaddr(%08x)", (unsigned)ntohl(nip));
                 np = getnetbyaddr(ntohl(nip), AF_INET);
                 if (np)
                         name = xstrdup(np->n_name);
         }
+#endif
         if (!name)
                 name = xmalloc_sockaddr2dotted_noport((void*)s_in);
 
@@ -183,10 +177,8 @@ int FAST_FUNC INET6_resolve(const char *name, struct sockaddr_in6 *sin6)
 char* FAST_FUNC INET6_rresolve(struct sockaddr_in6 *sin6, int numeric)
 {
         if (sin6->sin6_family != AF_INET6) {
-#ifdef DEBUG
-                bb_error_msg("rresolve: unsupported address family %d!",
+                dbg("rresolve: unsupported address family %d!",
                                 sin6->sin6_family);
-#endif
                 errno = EAFNOSUPPORT;
                 return NULL;
         }
diff --git a/libbb/messages.c b/libbb/messages.c
index d74c237e7..3c0b921cf 100644
--- a/libbb/messages.c
+++ b/libbb/messages.c
@@ -14,12 +14,10 @@
 
 /* allow version to be extended, via CFLAGS */
 #ifndef BB_EXTRA_VERSION
-#define BB_EXTRA_VERSION BB_BT
+#define BB_EXTRA_VERSION " ("AUTOCONF_TIMESTAMP")"
 #endif
 
-#define BANNER "BusyBox v" BB_VER " (" BB_EXTRA_VERSION ")"
-
-const char bb_banner[] ALIGN1 = BANNER;
+const char bb_banner[] ALIGN1 = "BusyBox v" BB_VER BB_EXTRA_VERSION;
 
 
 const char bb_msg_memory_exhausted[] ALIGN1 = "out of memory";
diff --git a/libbb/print_numbered_lines.c b/libbb/print_numbered_lines.c
index 702aed1ea..9a8a51440 100644
--- a/libbb/print_numbered_lines.c
+++ b/libbb/print_numbered_lines.c
@@ -24,6 +24,7 @@ void FAST_FUNC print_numbered_lines(struct number_state *ns, const char *filenam
                         fputs(ns->empty_str, stdout);
                 free(line);
         }
+        ns->start = N;
 
         fclose(fp);
 }
diff --git a/libbb/safe_write.c b/libbb/safe_write.c
index 8f7628016..aad50f5e0 100644
--- a/libbb/safe_write.c
+++ b/libbb/safe_write.c
@@ -13,9 +13,17 @@ ssize_t FAST_FUNC safe_write(int fd, const void *buf, size_t count)
 {
         ssize_t n;
 
-        do {
+        for (;;) {
                 n = write(fd, buf, count);
-        } while (n < 0 && errno == EINTR);
+                if (n >= 0 || errno != EINTR)
+                        break;
+                /* Some callers set errno=0, are upset when they see EINTR.
+                 * Returning EINTR is wrong since we retry write(),
+                 * the "error" was transient.
+                 */
+                errno = 0;
+                /* repeat the write() */
+        }
 
         return n;
 }
diff --git a/libbb/vfork_daemon_rexec.c b/libbb/vfork_daemon_rexec.c
index 9ab49d0a1..4b3ed5a3b 100644
--- a/libbb/vfork_daemon_rexec.c
+++ b/libbb/vfork_daemon_rexec.c
@@ -16,6 +16,7 @@
  */
 
 #include "busybox.h" /* uses applet tables */
+#include "NUM_APPLETS.h"
 
 #if !ENABLE_PLATFORM_MINGW32
 /* This does a fork/exec in one call, using vfork().  Returns PID of new child,
@@ -158,7 +159,7 @@ int FAST_FUNC run_nofork_applet(int applet_no, char **argv)
 int FAST_FUNC spawn_and_wait(char **argv)
 {
         int rc;
-#if ENABLE_FEATURE_PREFER_APPLETS
+#if ENABLE_FEATURE_PREFER_APPLETS && (NUM_APPLETS > 1)
         int a = find_applet_by_name(argv[0]);
 
         if (a >= 0) {
@@ -182,7 +183,7 @@ int FAST_FUNC spawn_and_wait(char **argv)
                          * as of yet (and that should probably always stay true).
                          */
                         /* xfunc_error_retval and applet_name are init by: */
-                        run_applet_no_and_exit(a, argv);
+                        run_applet_no_and_exit(a, argv[0], argv);
                 }
 #  endif
 # endif
diff --git a/loginutils/add-remove-shell.c b/loginutils/add-remove-shell.c
index 922b3333d..54b62c773 100644
--- a/loginutils/add-remove-shell.c
+++ b/loginutils/add-remove-shell.c
@@ -84,7 +84,7 @@ int add_remove_shell_main(int argc UNUSED_PARAM, char **argv)
                 while ((line = xmalloc_fgetline(orig_fp)) != NULL) {
                         char **cpp = argv;
                         while (*cpp) {
-                                if (strcmp(*cpp, line) == 0) {
+                                if (*cpp != dont_add && strcmp(*cpp, line) == 0) {
                                         /* Old file has this shell name */
                                         if (REMOVE_SHELL) {
                                                 /* we are remove-shell */
diff --git a/make_single_applets.sh b/make_single_applets.sh
index 8ad7a7406..329a27d32 100755
--- a/make_single_applets.sh
+++ b/make_single_applets.sh
@@ -54,18 +54,18 @@ for app; do
         fi
 
         if ! yes '' | make oldconfig >busybox_make_${app}.log 2>&1; then
-                : $((fail++))
+                fail=$((fail+1))
                 echo "Config error for ${app}"
                 mv .config busybox_config_${app}
         elif ! make $makeopts >>busybox_make_${app}.log 2>&1; then
-                : $((fail++))
+                fail=$((fail+1))
                 grep -i -e error: -e warning: busybox_make_${app}.log
                 echo "Build error for ${app}"
                 mv .config busybox_config_${app}
         elif ! grep -q '^#define NUM_APPLETS 1$' include/NUM_APPLETS.h; then
                 grep -i -e error: -e warning: busybox_make_${app}.log
                 mv busybox busybox_${app}
-                : $((fail++))
+                fail=$((fail+1))
                 echo "NUM_APPLETS != 1 for ${app}: `cat include/NUM_APPLETS.h`"
                 mv .config busybox_config_${app}
         else
diff --git a/miscutils/beep.c b/miscutils/beep.c
index 14802b543..216f69400 100644
--- a/miscutils/beep.c
+++ b/miscutils/beep.c
@@ -16,7 +16,7 @@
 //config:
 //config:config FEATURE_BEEP_FREQ
 //config:       int "default frequency"
-//config:       range 0 2147483647
+//config:       range 20 50000  # allowing 0 here breaks the build
 //config:       default 4000
 //config:       depends on BEEP
 //config:       help
diff --git a/miscutils/crond.c b/miscutils/crond.c
index 88e7b47b3..c0c8bef11 100644
--- a/miscutils/crond.c
+++ b/miscutils/crond.c
@@ -35,6 +35,22 @@
 //config:       help
 //config:         Command output will be sent to corresponding user via email.
 //config:
+//config:config FEATURE_CROND_SPECIAL_TIMES
+//config:       bool "Support special times (@reboot, @daily, etc) in crontabs"
+//config:       default y
+//config:       depends on CROND
+//config:       help
+//config:         string        meaning
+//config:         ------        -------
+//config:         @reboot       Run once, at startup
+//config:         @yearly       Run once a year:  "0 0 1 1 *"
+//config:         @annually     Same as @yearly:  "0 0 1 1 *"
+//config:         @monthly      Run once a month: "0 0 1 * *"
+//config:         @weekly       Run once a week:  "0 0 * * 0"
+//config:         @daily        Run once a day:   "0 0 * * *"
+//config:         @midnight     Same as @daily:   "0 0 * * *"
+//config:         @hourly       Run once an hour: "0 * * * *"
+//config:
 //config:config FEATURE_CROND_DIR
 //config:       string "crond spool directory"
 //config:       default "/var/spool/cron"
@@ -74,6 +90,7 @@
 
 #define CRON_DIR        CONFIG_FEATURE_CROND_DIR
 #define CRONTABS        CONFIG_FEATURE_CROND_DIR "/crontabs"
+#define CRON_REBOOT     CONFIG_PID_FILE_PATH "/crond.reboot"
 #ifndef SENDMAIL
 # define SENDMAIL       "sendmail"
 #endif
@@ -101,6 +118,8 @@ typedef struct CronLine {
         struct CronLine *cl_next;
         char *cl_cmd;                   /* shell command */
         pid_t cl_pid;                   /* >0:running, <0:needs to be started in this minute, 0:dormant */
+#define START_ME_REBOOT -2
+#define START_ME_NORMAL -1
 #if ENABLE_FEATURE_CROND_CALL_SENDMAIL
         int cl_empty_mail_size;         /* size of mail header only, 0 if no mailfile */
         char *cl_mailto;                /* whom to mail results, may be NULL */
@@ -465,21 +484,85 @@ static void load_crontab(const char *fileName)
 //line of the crontab's owner. HOME and SHELL may be overridden by settings
 //in the crontab; LOGNAME may not.
 
+#if ENABLE_FEATURE_CROND_SPECIAL_TIMES
+                        if (tokens[0][0] == '@') {
+                                /*
+                                 * "@daily /a/script/to/run PARAM1 PARAM2..."
+                                 */
+                                typedef struct SpecialEntry {
+                                        const char *name;
+                                        const char tokens[8];
+                                } SpecialEntry;
+                                static const SpecialEntry SpecAry[] = {
+                                        /*              hour  day   month weekday */
+                                        { "yearly",     "0\0" "1\0" "1\0" "*" },
+                                        { "annually",   "0\0" "1\0" "1\0" "*" },
+                                        { "monthly",    "0\0" "1\0" "*\0" "*" },
+                                        { "weekly",     "0\0" "*\0" "*\0" "0" },
+                                        { "daily",      "0\0" "*\0" "*\0" "*" },
+                                        { "midnight",   "0\0" "*\0" "*\0" "*" },
+                                        { "hourly",     "*\0" "*\0" "*\0" "*" },
+                                        { "reboot",     ""                    },
+                                };
+                                const SpecialEntry *e = SpecAry;
+
+                                if (n < 2)
+                                        continue;
+                                for (;;) {
+                                        if (strcmp(e->name, tokens[0] + 1) == 0) {
+                                                /*
+                                                 * tokens[1] is only the first word of command,
+                                                 * can'r use it.
+                                                 * find the entire command in unmodified string:
+                                                 */
+                                                tokens[5] = skip_whitespace(
+                                                        skip_non_whitespace(
+                                                        skip_whitespace(parser->data)));
+                                                if (e->tokens[0]) {
+                                                        char *et = (char*)e->tokens;
+                                                        /* minute is "0" for all specials */
+                                                        tokens[0] = (char*)"0";
+                                                        tokens[1] = et;
+                                                        tokens[2] = et + 2;
+                                                        tokens[3] = et + 4;
+                                                        tokens[4] = et + 6;
+                                                }
+                                                goto got_it;
+                                        }
+                                        if (!e->tokens[0])
+                                                break;
+                                        e++;
+                                }
+                                continue; /* bad line (unrecognized '@foo') */
+                        }
+#endif
                         /* check if a minimum of tokens is specified */
                         if (n < 6)
                                 continue;
+ IF_FEATURE_CROND_SPECIAL_TIMES(
+  got_it:
+ )
                         *pline = line = xzalloc(sizeof(*line));
-                        /* parse date ranges */
-                        ParseField(file->cf_username, line->cl_Mins, 60, 0, NULL, tokens[0]);
-                        ParseField(file->cf_username, line->cl_Hrs, 24, 0, NULL, tokens[1]);
-                        ParseField(file->cf_username, line->cl_Days, 32, 0, NULL, tokens[2]);
-                        ParseField(file->cf_username, line->cl_Mons, 12, -1, MonAry, tokens[3]);
-                        ParseField(file->cf_username, line->cl_Dow, 7, 0, DowAry, tokens[4]);
-                        /*
-                         * fix days and dow - if one is not "*" and the other
-                         * is "*", the other is set to 0, and vise-versa
-                         */
-                        FixDayDow(line);
+#if ENABLE_FEATURE_CROND_SPECIAL_TIMES
+                        if (tokens[0][0] == '@') { /* "@reboot" line */
+                                file->cf_wants_starting = 1;
+                                line->cl_pid = START_ME_REBOOT; /* wants to start */
+                                /* line->cl_Mins/Hrs/etc stay zero: never match any time */
+                        } else
+#endif
+                        {
+                                /* parse date ranges */
+                                ParseField(file->cf_username, line->cl_Mins, 60, 0, NULL, tokens[0]);
+                                ParseField(file->cf_username, line->cl_Hrs, 24, 0, NULL, tokens[1]);
+                                ParseField(file->cf_username, line->cl_Days, 32, 0, NULL, tokens[2]);
+                                ParseField(file->cf_username, line->cl_Mons, 12, -1, MonAry, tokens[3]);
+                                ParseField(file->cf_username, line->cl_Dow, 7, 0, DowAry, tokens[4]);
+                                /*
+                                 * fix days and dow - if one is not "*" and the other
+                                 * is "*", the other is set to 0, and vise-versa
+                                 */
+                                FixDayDow(line);
+                        }
 #if ENABLE_FEATURE_CROND_CALL_SENDMAIL
                         /* copy mailto (can be NULL) */
                         line->cl_mailto = xstrdup(mailTo);
@@ -664,7 +747,7 @@ fork_job(const char *user, int mailFd, CronLine *line, bool run_sendmail)
         return pid;
 }
 
-static void start_one_job(const char *user, CronLine *line)
+static pid_t start_one_job(const char *user, CronLine *line)
 {
         char mailFile[128];
         int mailFd = -1;
@@ -698,6 +781,8 @@ static void start_one_job(const char *user, CronLine *line)
                         free(mailFile2);
                 }
         }
+
+        return line->cl_pid;
 }
 
 /*
@@ -748,7 +833,7 @@ static void process_finished_job(const char *user, CronLine *line)
 
 #else /* !ENABLE_FEATURE_CROND_CALL_SENDMAIL */
 
-static void start_one_job(const char *user, CronLine *line)
+static pid_t start_one_job(const char *user, CronLine *line)
 {
         const char *shell;
         struct passwd *pas;
@@ -782,6 +867,7 @@ static void start_one_job(const char *user, CronLine *line)
                 pid = 0;
         }
         line->cl_pid = pid;
+        return pid;
 }
 
 #define process_finished_job(user, line)  ((line)->cl_pid = 0)
@@ -825,7 +911,7 @@ static void flag_starting_jobs(time_t t1, time_t t2)
                                                 log8("user %s: process already running: %s",
                                                         file->cf_username, line->cl_cmd);
                                         } else if (line->cl_pid == 0) {
-                                                line->cl_pid = -1;
+                                                line->cl_pid = START_ME_NORMAL;
                                                 file->cf_wants_starting = 1;
                                         }
                                 }
@@ -834,7 +920,20 @@ static void flag_starting_jobs(time_t t1, time_t t2)
         }
 }
 
-static void start_jobs(void)
+#if ENABLE_FEATURE_CROND_SPECIAL_TIMES
+static int touch_reboot_file(void)
+{
+        int fd = open(CRON_REBOOT, O_WRONLY | O_CREAT | O_EXCL | O_TRUNC, 0000);
+        if (fd >= 0) {
+                close(fd);
+                return 1;
+        }
+        /* File (presumably) exists - this is not the first run after reboot */
+        return 0;
+}
+#endif
+
+static void start_jobs(int wants_start)
 {
         CronFile *file;
         CronLine *line;
@@ -846,11 +945,10 @@ static void start_jobs(void)
                 file->cf_wants_starting = 0;
                 for (line = file->cf_lines; line; line = line->cl_next) {
                         pid_t pid;
-                        if (line->cl_pid >= 0)
+                        if (line->cl_pid != wants_start)
                                 continue;
 
-                        start_one_job(file->cf_username, line);
-                        pid = line->cl_pid;
+                        pid = start_one_job(file->cf_username, line);
                         log8("USER %s pid %3d cmd %s",
                                 file->cf_username, (int)pid, line->cl_cmd);
                         if (pid < 0) {
@@ -950,6 +1048,10 @@ int crond_main(int argc UNUSED_PARAM, char **argv)
         log8("crond (busybox "BB_VER") started, log level %d", G.log_level);
         rescan_crontab_dir();
         write_pidfile(CONFIG_PID_FILE_PATH "/crond.pid");
+#if ENABLE_FEATURE_CROND_SPECIAL_TIMES
+        if (touch_reboot_file())
+                start_jobs(START_ME_REBOOT); /* start @reboot entries, if any */
+#endif
 
         /* Main loop */
         t2 = time(NULL);
@@ -1002,7 +1104,7 @@ int crond_main(int argc UNUSED_PARAM, char **argv)
                 } else if (dt > 0) {
                         /* Usual case: time advances forward, as expected */
                         flag_starting_jobs(t1, t2);
-                        start_jobs();
+                        start_jobs(START_ME_NORMAL);
                         sleep_time = 60;
                         if (check_completions() > 0) {
                                 /* some jobs are still running */
diff --git a/miscutils/makedevs.c b/miscutils/makedevs.c
index 9e7ca340f..f436b08f8 100644
--- a/miscutils/makedevs.c
+++ b/miscutils/makedevs.c
@@ -208,17 +208,17 @@ int makedevs_main(int argc UNUSED_PARAM, char **argv)
                 unsigned count = 0;
                 unsigned increment = 0;
                 unsigned start = 0;
-                char name[41];
                 char user[41];
                 char group[41];
-                char *full_name = name;
+                char *full_name;
+                int name_len;
                 uid_t uid;
                 gid_t gid;
 
                 linenum = parser->lineno;
 
-                if ((2 > sscanf(line, "%40s %c %o %40s %40s %u %u %u %u %u",
-                                        name, &type, &mode, user, group,
+                if ((1 > sscanf(line, "%*s%n %c %o %40s %40s %u %u %u %u %u",
+                                        &name_len, &type, &mode, user, group,
                                         &major, &minor, &start, &increment, &count))
                  || ((unsigned)(major | minor | start | count | increment) > 255)
                 ) {
@@ -229,9 +229,11 @@ int makedevs_main(int argc UNUSED_PARAM, char **argv)
 
                 gid = (*group) ? get_ug_id(group, xgroup2gid) : getgid();
                 uid = (*user) ? get_ug_id(user, xuname2uid) : getuid();
+                line[name_len] = '\0';
+                full_name = line;
                 /* We are already in the right root dir,
                  * so make absolute paths relative */
-                if ('/' == *full_name)
+                if ('/' == full_name[0])
                         full_name++;
 
                 if (type == 'd') {
@@ -260,9 +262,7 @@ int makedevs_main(int argc UNUSED_PARAM, char **argv)
                         if (chmod(full_name, mode) < 0)
                                 goto chmod_fail;
                 } else {
-                        dev_t rdev;
                         unsigned i;
-                        char *full_name_inc;
 
                         if (type == 'p') {
                                 mode |= S_IFIFO;
@@ -276,26 +276,29 @@ int makedevs_main(int argc UNUSED_PARAM, char **argv)
                                 continue;
                         }
 
-                        full_name_inc = xmalloc(strlen(full_name) + sizeof(int)*3 + 2);
-                        if (count)
+                        if (count != 0)
                                 count--;
-                        for (i = start; i <= start + count; i++) {
-                                sprintf(full_name_inc, count ? "%s%u" : "%s", full_name, i);
-                                rdev = makedev(major, minor + (i - start) * increment);
-                                if (mknod(full_name_inc, mode, rdev) != 0
+                        for (i = 0; i <= count; i++) {
+                                dev_t rdev;
+                                char *nameN = full_name;
+                                if (count != 0)
+                                        nameN = xasprintf("%s%u", full_name, start + i);
+                                rdev = makedev(major, minor + i * increment);
+                                if (mknod(nameN, mode, rdev) != 0
                                  && errno != EEXIST
                                 ) {
-                                        bb_perror_msg("line %d: can't create node %s", linenum, full_name_inc);
+                                        bb_perror_msg("line %d: can't create node %s", linenum, nameN);
                                         ret = EXIT_FAILURE;
-                                } else if (chown(full_name_inc, uid, gid) < 0) {
-                                        bb_perror_msg("line %d: can't chown %s", linenum, full_name_inc);
+                                } else if (chown(nameN, uid, gid) < 0) {
+                                        bb_perror_msg("line %d: can't chown %s", linenum, nameN);
                                         ret = EXIT_FAILURE;
-                                } else if (chmod(full_name_inc, mode) < 0) {
-                                        bb_perror_msg("line %d: can't chmod %s", linenum, full_name_inc);
+                                } else if (chmod(nameN, mode) < 0) {
+                                        bb_perror_msg("line %d: can't chmod %s", linenum, nameN);
                                         ret = EXIT_FAILURE;
                                 }
+                                if (count != 0)
+                                        free(nameN);
                         }
-                        free(full_name_inc);
                 }
         }
         if (ENABLE_FEATURE_CLEAN_UP)
diff --git a/miscutils/ttysize.c b/miscutils/ttysize.c
index 135ce8535..cba65b148 100644
--- a/miscutils/ttysize.c
+++ b/miscutils/ttysize.c
@@ -25,7 +25,7 @@
 //usage:#define ttysize_trivial_usage
 //usage:       "[w] [h]"
 //usage:#define ttysize_full_usage "\n\n"
-//usage:       "Print dimension(s) of stdin's terminal, on error return 80x25"
+//usage:       "Print dimensions of stdin tty, or 80x24"
 
 #include "libbb.h"
 
@@ -37,7 +37,10 @@ int ttysize_main(int argc UNUSED_PARAM, char **argv)
 
         w = 80;
         h = 24;
-        if (!ioctl(0, TIOCGWINSZ, &wsz)) {
+        if (ioctl(0, TIOCGWINSZ, &wsz) == 0
+         || ioctl(1, TIOCGWINSZ, &wsz) == 0
+         || ioctl(2, TIOCGWINSZ, &wsz) == 0
+        ) {
                 w = wsz.ws_col;
                 h = wsz.ws_row;
         }
diff --git a/miscutils/watchdog.c b/miscutils/watchdog.c
index 07ae64e52..d379a97f4 100644
--- a/miscutils/watchdog.c
+++ b/miscutils/watchdog.c
@@ -35,27 +35,60 @@
 //usage:     "\nUse 500ms to specify period in milliseconds"
 
 #include "libbb.h"
-#include "linux/types.h" /* for __u32 */
-#include "linux/watchdog.h"
+#include <linux/types.h> /* for __u32 */
+#include <linux/watchdog.h>
+
+#ifndef WDIOC_SETOPTIONS
+# define WDIOC_SETOPTIONS 0x5704
+#endif
+#ifndef WDIOC_SETTIMEOUT
+# define WDIOC_SETTIMEOUT 0x5706
+#endif
+#ifndef WDIOC_GETTIMEOUT
+# define WDIOC_GETTIMEOUT 0x5707
+#endif
+#ifndef WDIOS_ENABLECARD
+# define WDIOS_ENABLECARD 2
+#endif
 
 #define OPT_FOREGROUND  (1 << 0)
 #define OPT_STIMER      (1 << 1)
 #define OPT_HTIMER      (1 << 2)
 
-static void watchdog_shutdown(int sig UNUSED_PARAM)
+static void shutdown_watchdog(void)
 {
         static const char V = 'V';
+        write(3, &V, 1);  /* Magic, see watchdog-api.txt in kernel */
+        close(3);
+}
 
+static void shutdown_on_signal(int sig UNUSED_PARAM)
+{
         remove_pidfile(CONFIG_PID_FILE_PATH "/watchdog.pid");
-        write(3, &V, 1);  /* Magic, see watchdog-api.txt in kernel */
-        if (ENABLE_FEATURE_CLEAN_UP)
-                close(3);
+        shutdown_watchdog();
         _exit(EXIT_SUCCESS);
 }
 
+static void watchdog_open(const char* device)
+{
+        /* Use known fd # - avoid needing global 'int fd' */
+        xmove_fd(xopen(device, O_WRONLY), 3);
+
+        /* If the watchdog driver can do something other than cause a reboot
+         * on a timeout, then it's possible this program may be starting from
+         * a state when the watchdog hadn't been previously stopped with
+         * the magic write followed by a close.  In this case the driver may
+         * not start properly, so always do the proper stop first just in case.
+         */
+        shutdown_watchdog();
+
+        xmove_fd(xopen(device, O_WRONLY), 3);
+}
+
 int watchdog_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
-int watchdog_main(int argc, char **argv)
+int watchdog_main(int argc UNUSED_PARAM, char **argv)
 {
+        static const int enable = WDIOS_ENABLECARD;
         static const struct suffix_mult suffixes[] = {
                 { "ms", 1 },
                 { "", 1000 },
@@ -80,31 +113,22 @@ int watchdog_main(int argc, char **argv)
         if (!(opts & OPT_FOREGROUND))
                 bb_daemonize_or_rexec(DAEMON_CHDIR_ROOT, argv);
 
+        /* maybe bb_logenv_override(); here for LOGGING=syslog to work? */
+
         if (opts & OPT_HTIMER)
                 htimer_duration = xatou_sfx(ht_arg, suffixes);
         stimer_duration = htimer_duration / 2;
         if (opts & OPT_STIMER)
                 stimer_duration = xatou_sfx(st_arg, suffixes);
 
-        bb_signals(BB_FATAL_SIGS, watchdog_shutdown);
+        bb_signals(BB_FATAL_SIGS, shutdown_on_signal);
 
-        /* Use known fd # - avoid needing global 'int fd' */
-        xmove_fd(xopen(argv[argc - 1], O_WRONLY), 3);
+        watchdog_open(argv[optind]);
 
         /* WDIOC_SETTIMEOUT takes seconds, not milliseconds */
         htimer_duration = htimer_duration / 1000;
-#ifndef WDIOC_SETTIMEOUT
-# error WDIOC_SETTIMEOUT is not defined, cannot compile watchdog applet
-#else
-# if defined WDIOC_SETOPTIONS && defined WDIOS_ENABLECARD
-        {
-                static const int enable = WDIOS_ENABLECARD;
-                ioctl_or_warn(3, WDIOC_SETOPTIONS, (void*) &enable);
-        }
-# endif
+        ioctl_or_warn(3, WDIOC_SETOPTIONS, (void*) &enable);
         ioctl_or_warn(3, WDIOC_SETTIMEOUT, &htimer_duration);
-#endif
-
 #if 0
         ioctl_or_warn(3, WDIOC_GETTIMEOUT, &htimer_duration);
         printf("watchdog: SW timer is %dms, HW timer is %ds\n",
diff --git a/modutils/modutils.c b/modutils/modutils.c
index dae623ee4..6f7cd9721 100644
--- a/modutils/modutils.c
+++ b/modutils/modutils.c
@@ -75,12 +75,6 @@ void FAST_FUNC replace(char *s, char what, char with)
         }
 }
 
-char* FAST_FUNC replace_underscores(char *s)
-{
-        replace(s, '-', '_');
-        return s;
-}
-
 int FAST_FUNC string_to_llist(char *string, llist_t **llist, const char *delim)
 {
         char *tok;
diff --git a/modutils/modutils.h b/modutils/modutils.h
index 76ce242ba..4a702e97c 100644
--- a/modutils/modutils.h
+++ b/modutils/modutils.h
@@ -48,7 +48,6 @@ module_entry *moddb_get_or_create(module_db *db, const char *s) FAST_FUNC;
 void moddb_free(module_db *db) FAST_FUNC;
 
 void replace(char *s, char what, char with) FAST_FUNC;
-char *replace_underscores(char *s) FAST_FUNC;
 int string_to_llist(char *string, llist_t **llist, const char *delim) FAST_FUNC;
 char *filename2modname(const char *filename, char *modname) FAST_FUNC;
 #if ENABLE_FEATURE_CMDLINE_MODULE_OPTIONS
diff --git a/networking/inetd.c b/networking/inetd.c
index 01e659f13..3bf157b70 100644
--- a/networking/inetd.c
+++ b/networking/inetd.c
@@ -227,7 +227,8 @@
 
 #if ENABLE_FEATURE_INETD_RPC
 # if defined(__UCLIBC__) && ! defined(__UCLIBC_HAS_RPC__)
-#  error "You need to build uClibc with UCLIBC_HAS_RPC for NFS support"
+#  warning "You probably need to build uClibc with UCLIBC_HAS_RPC for NFS support"
+   /* not #error, since user may be using e.g. libtirpc instead */
 # endif
 # include <rpc/rpc.h>
 # include <rpc/pmap_clnt.h>
@@ -1513,8 +1514,11 @@ int inetd_main(int argc UNUSED_PARAM, char **argv)
         } /* for (;;) */
 }
 
-#if !BB_MMU
+#if ENABLE_FEATURE_INETD_SUPPORT_BUILTIN_ECHO \
+ || ENABLE_FEATURE_INETD_SUPPORT_BUILTIN_DISCARD
+# if !BB_MMU
 static const char *const cat_args[] = { "cat", NULL };
+# endif
 #endif
 
 /*
@@ -1525,14 +1529,14 @@ static const char *const cat_args[] = { "cat", NULL };
 /* ARGSUSED */
 static void FAST_FUNC echo_stream(int s, servtab_t *sep UNUSED_PARAM)
 {
-#if BB_MMU
+# if BB_MMU
         while (1) {
                 ssize_t sz = safe_read(s, line, LINE_SIZE);
                 if (sz <= 0)
                         break;
                 xwrite(s, line, sz);
         }
-#else
+# else
         /* We are after vfork here! */
         /* move network socket to stdin/stdout */
         xmove_fd(s, STDIN_FILENO);
@@ -1542,7 +1546,7 @@ static void FAST_FUNC echo_stream(int s, servtab_t *sep UNUSED_PARAM)
         xopen(bb_dev_null, O_WRONLY);
         BB_EXECVP("cat", (char**)cat_args);
         /* on failure we return to main, which does exit(EXIT_FAILURE) */
-#endif
+# endif
 }
 static void FAST_FUNC echo_dg(int s, servtab_t *sep)
 {
@@ -1566,10 +1570,10 @@ static void FAST_FUNC echo_dg(int s, servtab_t *sep)
 /* ARGSUSED */
 static void FAST_FUNC discard_stream(int s, servtab_t *sep UNUSED_PARAM)
 {
-#if BB_MMU
+# if BB_MMU
         while (safe_read(s, line, LINE_SIZE) > 0)
                 continue;
-#else
+# else
         /* We are after vfork here! */
         /* move network socket to stdin */
         xmove_fd(s, STDIN_FILENO);
@@ -1580,7 +1584,7 @@ static void FAST_FUNC discard_stream(int s, servtab_t *sep UNUSED_PARAM)
         xdup2(STDOUT_FILENO, STDERR_FILENO);
         BB_EXECVP("cat", (char**)cat_args);
         /* on failure we return to main, which does exit(EXIT_FAILURE) */
-#endif
+# endif
 }
 /* ARGSUSED */
 static void FAST_FUNC discard_dg(int s, servtab_t *sep UNUSED_PARAM)
diff --git a/networking/libiproute/iproute.c b/networking/libiproute/iproute.c
index cc3443a92..6a41b8331 100644
--- a/networking/libiproute/iproute.c
+++ b/networking/libiproute/iproute.c
@@ -28,7 +28,7 @@ struct filter_t {
         int flushe;
         struct rtnl_handle *rth;
         //int protocol, protocolmask; - write-only fields?!
-        //int scope, scopemask; - unused
+        int scope, scopemask;
         //int type; - read-only
         //int typemask; - unused
         //int tos, tosmask; - unused
@@ -120,6 +120,8 @@ static int FAST_FUNC print_route(const struct sockaddr_nl *who UNUSED_PARAM,
                         return 0;
                 }
         }
+        if ((G_filter.scope ^ r->rtm_scope) & G_filter.scopemask)
+                return 0;
         if (G_filter.rdst.family
          && (r->rtm_family != G_filter.rdst.family || G_filter.rdst.bitlen > r->rtm_dst_len)
         ) {
@@ -270,7 +272,11 @@ static int FAST_FUNC print_route(const struct sockaddr_nl *who UNUSED_PARAM,
                 printf("table %s ", rtnl_rttable_n2a(tid));
 #endif
 
-        /* Todo: parse & show "proto kernel", "scope link" here */
+        /* Todo: parse & show "proto kernel" here */
+        if (!(r->rtm_flags & RTM_F_CLONED)) {
+                if ((r->rtm_scope != RT_SCOPE_UNIVERSE) && G_filter.scopemask != -1)
+                        printf("scope %s ", rtnl_rtscope_n2a(r->rtm_scope));
+        }
 
         if (tb[RTA_PREFSRC] && /*G_filter.rprefsrc.bitlen - always 0*/ 0 != host_len) {
                 /* Do not use format_host(). It is our local addr
@@ -761,10 +767,11 @@ static int iproute_list_or_flush(char **argv, int flush)
         char *id = NULL;
         char *od = NULL;
         static const char keywords[] ALIGN1 =
+                /* If you add stuff here, update iproute_full_usage */
                 /* "ip route list/flush" parameters: */
                 "protocol\0" "dev\0"   "oif\0"   "iif\0"
                 "via\0"      "table\0" "cache\0"
-                "from\0"     "to\0"
+                "from\0"     "to\0"    "scope\0"
                 /* and possible further keywords */
                 "all\0"
                 "root\0"
@@ -775,7 +782,7 @@ static int iproute_list_or_flush(char **argv, int flush)
         enum {
                 KW_proto, KW_dev,   KW_oif,  KW_iif,
                 KW_via,   KW_table, KW_cache,
-                KW_from,  KW_to,
+                KW_from,  KW_to,    KW_scope,
                 /* */
                 KW_all,
                 KW_root,
@@ -834,6 +841,17 @@ static int iproute_list_or_flush(char **argv, int flush)
                         /* The command 'ip route flush cache' is used by OpenSWAN.
                          * Assuming it's a synonym for 'ip route flush table cache' */
                         G_filter.tb = -1;
+                } else if (arg == KW_scope) {
+                        uint32_t scope;
+                        NEXT_ARG();
+                        G_filter.scopemask = -1;
+                        if (rtnl_rtscope_a2n(&scope, *argv)) {
+                                if (strcmp(*argv, "all") != 0)
+                                        invarg_1_to_2(*argv, "scope");
+                                scope = RT_SCOPE_NOWHERE;
+                                G_filter.scopemask = 0;
+                        }
+                        G_filter.scope = scope;
                 } else if (arg == KW_from) {
                         NEXT_ARG();
                         parm = index_in_substrings(keywords, *argv);
diff --git a/networking/libiproute/iprule.c b/networking/libiproute/iprule.c
index 8f3f86286..1bb5e759e 100644
--- a/networking/libiproute/iprule.c
+++ b/networking/libiproute/iprule.c
@@ -17,25 +17,32 @@
 #include <netinet/ip.h>
 #include <arpa/inet.h>
 
+/* from <linux/fib_rules.h>: */
+#define FRA_SUPPRESS_IFGROUP   13
+#define FRA_SUPPRESS_PREFIXLEN 14
+
 #include "ip_common.h"  /* #include "libbb.h" is inside */
 #include "rt_names.h"
 #include "utils.h"
 
-/*
-static void usage(void) __attribute__((noreturn));
-
-static void usage(void)
-{
-        fprintf(stderr, "Usage: ip rule [ list | add | del ] SELECTOR ACTION\n");
-        fprintf(stderr, "SELECTOR := [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK ]\n");
-        fprintf(stderr, "            [ dev STRING ] [ pref NUMBER ]\n");
-        fprintf(stderr, "ACTION := [ table TABLE_ID ] [ nat ADDRESS ]\n");
-        fprintf(stderr, "          [ prohibit | reject | unreachable ]\n");
-        fprintf(stderr, "          [ realms [SRCREALM/]DSTREALM ]\n");
-        fprintf(stderr, "TABLE_ID := [ local | main | default | NUMBER ]\n");
-        exit(-1);
-}
-*/
+/* If you add stuff here, update iprule_full_usage */
+static const char keywords[] ALIGN1 =
+        "from\0""to\0""preference\0""order\0""priority\0"
+        "tos\0""fwmark\0""realms\0""table\0""lookup\0"
+        "suppress_prefixlength\0""suppress_ifgroup\0"
+        "dev\0""iif\0""nat\0""map-to\0""type\0""help\0"
+        ;
+#define keyword_preference            (keywords           + sizeof("from") + sizeof("to"))
+#define keyword_fwmark                (keyword_preference + sizeof("preference") + sizeof("order") + sizeof("priority") + sizeof("tos"))
+#define keyword_realms                (keyword_fwmark     + sizeof("fwmark"))
+#define keyword_suppress_prefixlength (keyword_realms     + sizeof("realms") + sizeof("table") + sizeof("lookup"))
+#define keyword_suppress_ifgroup      (keyword_suppress_prefixlength + sizeof("suppress_prefixlength"))
+enum {
+        ARG_from = 1, ARG_to, ARG_preference, ARG_order, ARG_priority,
+        ARG_tos, ARG_fwmark, ARG_realms, ARG_table, ARG_lookup,
+        ARG_suppress_prefixlength, ARG_suppress_ifgroup,
+        ARG_dev, ARG_iif, ARG_nat, ARG_map_to, ARG_type, ARG_help,
+};
 
 static int FAST_FUNC print_rule(const struct sockaddr_nl *who UNUSED_PARAM,
                                         struct nlmsghdr *n, void *arg UNUSED_PARAM)
@@ -119,6 +126,17 @@ static int FAST_FUNC print_rule(const struct sockaddr_nl *who UNUSED_PARAM,
         else if (r->rtm_table)
                 printf("lookup %s ", rtnl_rttable_n2a(r->rtm_table));
 
+        if (tb[FRA_SUPPRESS_PREFIXLEN]) {
+                int pl = *(uint32_t*)RTA_DATA(tb[FRA_SUPPRESS_PREFIXLEN]);
+                if (pl != -1)
+                        printf("%s %d ", keyword_suppress_prefixlength, pl);
+        }
+        if (tb[FRA_SUPPRESS_IFGROUP]) {
+                int grp = *(uint32_t*)RTA_DATA(tb[FRA_SUPPRESS_IFGROUP]);
+                if (grp != -1)
+                        printf("%s %d ", keyword_suppress_ifgroup, grp);
+        }
+
         if (tb[RTA_FLOW]) {
                 uint32_t to = *(uint32_t*)RTA_DATA(tb[RTA_FLOW]);
                 uint32_t from = to>>16;
@@ -174,15 +192,6 @@ static int iprule_list(char **argv)
 /* Return value becomes exitcode. It's okay to not return at all */
 static int iprule_modify(int cmd, char **argv)
 {
-        static const char keywords[] ALIGN1 =
-                "from\0""to\0""preference\0""order\0""priority\0"
-                "tos\0""fwmark\0""realms\0""table\0""lookup\0""dev\0"
-                "iif\0""nat\0""map-to\0""type\0""help\0";
-        enum {
-                ARG_from = 1, ARG_to, ARG_preference, ARG_order, ARG_priority,
-                ARG_tos, ARG_fwmark, ARG_realms, ARG_table, ARG_lookup, ARG_dev,
-                ARG_iif, ARG_nat, ARG_map_to, ARG_type, ARG_help
-        };
         bool table_ok = 0;
         struct rtnl_handle rth;
         struct {
@@ -232,7 +241,7 @@ static int iprule_modify(int cmd, char **argv)
                 ) {
                         uint32_t pref;
                         NEXT_ARG();
-                        pref = get_u32(*argv, "preference");
+                        pref = get_u32(*argv, keyword_preference);
                         addattr32(&req.n, sizeof(req), RTA_PRIORITY, pref);
                 } else if (key == ARG_tos) {
                         uint32_t tos;
@@ -243,13 +252,13 @@ static int iprule_modify(int cmd, char **argv)
                 } else if (key == ARG_fwmark) {
                         uint32_t fwmark;
                         NEXT_ARG();
-                        fwmark = get_u32(*argv, "fwmark");
+                        fwmark = get_u32(*argv, keyword_fwmark);
                         addattr32(&req.n, sizeof(req), RTA_PROTOINFO, fwmark);
                 } else if (key == ARG_realms) {
                         uint32_t realm;
                         NEXT_ARG();
                         if (get_rt_realms(&realm, *argv))
-                                invarg_1_to_2(*argv, "realms");
+                                invarg_1_to_2(*argv, keyword_realms);
                         addattr32(&req.n, sizeof(req), RTA_FLOW, realm);
                 } else if (key == ARG_table ||
                            key == ARG_lookup
@@ -265,6 +274,16 @@ static int iprule_modify(int cmd, char **argv)
                                 addattr32(&req.n, sizeof(req), RTA_TABLE, tid);
                         }
                         table_ok = 1;
+                } else if (key == ARG_suppress_prefixlength) {
+                        int prefix_length;
+                        NEXT_ARG();
+                        prefix_length = get_u32(*argv, keyword_suppress_prefixlength);
+                        addattr32(&req.n, sizeof(req), FRA_SUPPRESS_PREFIXLEN, prefix_length);
+                } else if (key == ARG_suppress_ifgroup) {
+                        int grp;
+                        NEXT_ARG();
+                        grp = get_u32(*argv, keyword_suppress_ifgroup);
+                        addattr32(&req.n, sizeof(req), FRA_SUPPRESS_IFGROUP, grp);
                 } else if (key == ARG_dev ||
                            key == ARG_iif
                 ) {
diff --git a/networking/tls.c b/networking/tls.c
index db518bf90..fd3cb0dba 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -1199,11 +1199,11 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
         };
         struct client_hello *record;
         int len;
-        int sni_len = sni ? strnlen(sni, 127) : 0;
+        int sni_len = sni ? strnlen(sni, 127 - 9) : 0;
 
         len = sizeof(*record);
         if (sni_len)
-                len += 11 + strlen(sni);
+                len += 11 + sni_len;
         record = tls_get_outbuf(tls, len);
         memset(record, 0, len);
 
diff --git a/networking/tls_aes.c b/networking/tls_aes.c
index 6992f1c90..c137442e9 100644
--- a/networking/tls_aes.c
+++ b/networking/tls_aes.c
@@ -40,10 +40,6 @@
  */
 #include "tls.h"
 
-/* TODO: grep for this and move to libbb */
-#define get_unaligned_be32(buf) ({ uint32_t v; move_from_unaligned32(v, buf); SWAP_BE32(v); })
-
-
 // The lookup-tables are marked const so they can be placed in read-only storage instead of RAM
 // The numbers below can be computed dynamically trading ROM for RAM -
 // This can be useful in (embedded) bootloader applications, where ROM is often limited.
diff --git a/networking/tls_pstm.c b/networking/tls_pstm.c
index bd5bae0b7..e12e6c9d4 100644
--- a/networking/tls_pstm.c
+++ b/networking/tls_pstm.c
@@ -2127,7 +2127,7 @@ int32 pstm_invmod(psPool_t *pool, pstm_int *a, pstm_int *b, pstm_int *c)
 {
         pstm_int        x, y, u, v, B, D;
         int32           res;
-        uint16          neg, sanity;
+        int             neg, sanity; //bbox: was uint16
 
         /* 2. [modified] b must be odd   */
         if (pstm_iseven (b) == 1) {
diff --git a/networking/tls_pstm_montgomery_reduce.c b/networking/tls_pstm_montgomery_reduce.c
index dc2fe0a48..3391755e1 100644
--- a/networking/tls_pstm_montgomery_reduce.c
+++ b/networking/tls_pstm_montgomery_reduce.c
@@ -345,7 +345,7 @@ int32 pstm_montgomery_reduce(psPool_t *pool, pstm_int *a, pstm_int *m,
 {
         pstm_digit      *c, *_c, *tmpm, mu;
         int32           oldused, x, y;
-        int16           pa;
+        int             pa; //bbox: was int16
 
         pa = m->used;
         if (pa > a->alloc) {
diff --git a/networking/tls_pstm_mul_comba.c b/networking/tls_pstm_mul_comba.c
index 47cbb9618..6ba152bc1 100644
--- a/networking/tls_pstm_mul_comba.c
+++ b/networking/tls_pstm_mul_comba.c
@@ -85,7 +85,8 @@ asm(                                                      \
          "addl  %%eax,%0     \n\t"                            \
          "adcl  %%edx,%1     \n\t"                            \
          "adcl  $0,%2        \n\t"                            \
-         :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j)  :"%eax","%edx","%cc");
+         :"=rm"(c0), "=rm"(c1), "=rm"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j)  :"%eax","%edx","%cc");
+        //bbox: ^^^ replaced "=r" with "=rm": %ebx is not available on shared build
 
 /******************************************************************************/
 #elif defined(PSTM_X86_64)
@@ -228,7 +229,7 @@ asm(                               \
 static int32 pstm_mul_comba_gen(psPool_t *pool, pstm_int *A, pstm_int *B,
                         pstm_int *C, pstm_digit *paD, uint32 paDlen)
 {
-        int16           paDfail, pa;
+        int             paDfail, pa; //bbox: was int16
         int32       ix, iy, iz, tx, ty;
         pstm_digit      c0, c1, c2, *tmpx, *tmpy, *dst;
 
diff --git a/networking/tls_pstm_sqr_comba.c b/networking/tls_pstm_sqr_comba.c
index 36cb9ea97..d5c74d2f0 100644
--- a/networking/tls_pstm_sqr_comba.c
+++ b/networking/tls_pstm_sqr_comba.c
@@ -78,7 +78,8 @@ asm(                                            \
          "addl  %%eax,%0     \n\t"                            \
          "adcl  %%edx,%1     \n\t"                            \
          "adcl  $0,%2        \n\t"                            \
-         :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i) :"%eax","%edx","%cc");
+         :"=rm"(c0), "=rm"(c1), "=rm"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i) :"%eax","%edx","%cc");
+        //bbox: ^^^ replaced "=r" with "=rm": %ebx is not available on shared build
 
 #define SQRADD2(i, j)                                     \
 asm(                                            \
@@ -90,7 +91,8 @@ asm(                                            \
          "addl  %%eax,%0     \n\t"                            \
          "adcl  %%edx,%1     \n\t"                            \
          "adcl  $0,%2        \n\t"                            \
-         :"=r"(c0), "=r"(c1), "=r"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j)  :"%eax","%edx","%cc");
+         :"=rm"(c0), "=rm"(c1), "=rm"(c2): "0"(c0), "1"(c1), "2"(c2), "m"(i), "m"(j)  :"%eax","%edx","%cc");
+        //bbox: ^^^ replaced "=r" with "=rm": %ebx is not available on shared build
 
 #define SQRADDSC(i, j)                                    \
 asm(                                                     \
@@ -445,7 +447,7 @@ asm(                               \
 static int32 pstm_sqr_comba_gen(psPool_t *pool, pstm_int *A, pstm_int *B,
                         pstm_digit *paD, uint32 paDlen)
 {
-        int16           paDfail, pa;
+        int             paDfail, pa; //bbox: was int16
         int32       ix, iz;
         pstm_digit  c0, c1, c2, *dst;
 #ifdef PSTM_ISO
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 420695a20..d3eea5def 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -14,6 +14,7 @@ const uint8_t MAC_BCAST_ADDR[6] ALIGN2 = {
         0xff, 0xff, 0xff, 0xff, 0xff, 0xff
 };
 
+#if ENABLE_UDHCPC || ENABLE_UDHCPD
 /* Supported options are easily added here.
  * See RFC2132 for more options.
  * OPTION_REQ: these options are requested by udhcpc (unless -o).
@@ -136,6 +137,7 @@ const char dhcp_option_strings[] ALIGN1 =
         "msstaticroutes""\0"/* DHCP_MS_STATIC_ROUTES */
         "wpad" "\0"        /* DHCP_WPAD           */
         ;
+#endif
 
 /* Lengths of the option types in binary form.
  * Used by:
@@ -190,21 +192,26 @@ static void log_option(const char *pfx, const uint8_t *opt)
 # define log_option(pfx, opt) ((void)0)
 #endif
 
-unsigned FAST_FUNC udhcp_option_idx(const char *name)
+unsigned FAST_FUNC udhcp_option_idx(const char *name, const char *option_strings)
 {
-        int n = index_in_strings(dhcp_option_strings, name);
+        int n = index_in_strings(option_strings, name);
         if (n >= 0)
                 return n;
 
         {
-                char buf[sizeof(dhcp_option_strings)];
-                char *d = buf;
-                const char *s = dhcp_option_strings;
-                while (s < dhcp_option_strings + sizeof(dhcp_option_strings) - 2) {
+                char *buf, *d;
+                const char *s;
+
+                s = option_strings;
+                while (*s)
+                        s += strlen(s) + 1;
+
+                d = buf = xzalloc(s - option_strings);
+                s = option_strings;
+                while (!(*s == '\0' && s[1] == '\0')) {
                         *d++ = (*s == '\0' ? ' ' : *s);
                         s++;
                 }
-                *d = '\0';
                 bb_error_msg_and_die("unknown option '%s', known options: %s", name, buf);
         }
 }
@@ -315,6 +322,7 @@ void FAST_FUNC udhcp_add_binary_option(struct dhcp_packet *packet, uint8_t *addo
         optionptr[end + len] = DHCP_END;
 }
 
+#if ENABLE_UDHCPC || ENABLE_UDHCPD
 /* Add an one to four byte option to a packet */
 void FAST_FUNC udhcp_add_simple_option(struct dhcp_packet *packet, uint8_t code, uint32_t data)
 {
@@ -338,6 +346,7 @@ void FAST_FUNC udhcp_add_simple_option(struct dhcp_packet *packet, uint8_t code,
 
         bb_error_msg("can't add option 0x%02x", code);
 }
+#endif
 
 /* Find option 'code' in opt_list */
 struct option_set* FAST_FUNC udhcp_find_option(struct option_set *opt_list, uint8_t code)
@@ -451,7 +460,7 @@ static NOINLINE void attach_option(
         free(allocated);
 }
 
-int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg)
+int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg, const struct dhcp_optflag *optflags, const char *option_strings)
 {
         struct option_set **opt_list = arg;
         char *opt, *val;
@@ -478,7 +487,7 @@ int FAST_FUNC udhcp_str2optset(const char *const_str, void *arg)
                 bin_optflag.code = optcode;
                 optflag = &bin_optflag;
         } else {
-                optflag = &dhcp_optflags[udhcp_option_idx(opt)];
+                optflag = &optflags[udhcp_option_idx(opt, option_strings)];
         }
 
         retval = 0;
diff --git a/networking/udhcp/common.h b/networking/udhcp/common.h
index ee12cf91b..a9c23a186 100644
--- a/networking/udhcp/common.h
+++ b/networking/udhcp/common.h
@@ -93,8 +93,10 @@ enum {
         OPTION_BIN,
         OPTION_STATIC_ROUTES,
         OPTION_6RD,
-#if ENABLE_FEATURE_UDHCP_RFC3397
+#if ENABLE_FEATURE_UDHCP_RFC3397 || ENABLE_FEATURE_UDHCPC6_RFC3646 || ENABLE_FEATURE_UDHCPC6_RFC4704
         OPTION_DNS_STRING,  /* RFC1035 compressed domain name list */
+#endif
+#if ENABLE_FEATURE_UDHCP_RFC3397
         OPTION_SIP_SERVERS,
 #endif
 
@@ -189,17 +191,21 @@ struct option_set {
         struct option_set *next;
 };
 
+#if ENABLE_UDHCPC || ENABLE_UDHCPD
 extern const struct dhcp_optflag dhcp_optflags[];
 extern const char dhcp_option_strings[] ALIGN1;
+#endif
 extern const uint8_t dhcp_option_lengths[] ALIGN1;
 
-unsigned FAST_FUNC udhcp_option_idx(const char *name);
+unsigned FAST_FUNC udhcp_option_idx(const char *name, const char *option_strings);
 
 uint8_t *udhcp_get_option(struct dhcp_packet *packet, int code) FAST_FUNC;
 int udhcp_end_option(uint8_t *optionptr) FAST_FUNC;
 void udhcp_add_binary_option(struct dhcp_packet *packet, uint8_t *addopt) FAST_FUNC;
+#if ENABLE_UDHCPC || ENABLE_UDHCPD
 void udhcp_add_simple_option(struct dhcp_packet *packet, uint8_t code, uint32_t data) FAST_FUNC;
-#if ENABLE_FEATURE_UDHCP_RFC3397
+#endif
+#if ENABLE_FEATURE_UDHCP_RFC3397 || ENABLE_FEATURE_UDHCPC6_RFC3646 || ENABLE_FEATURE_UDHCPC6_RFC4704
 char *dname_dec(const uint8_t *cstr, int clen, const char *pre) FAST_FUNC;
 uint8_t *dname_enc(const uint8_t *cstr, int clen, const char *src, int *retlen) FAST_FUNC;
 #endif
@@ -284,9 +290,14 @@ void udhcp_dump_packet(struct dhcp_packet *packet) FAST_FUNC;
 /* 2nd param is "uint32_t*" */
 int FAST_FUNC udhcp_str2nip(const char *str, void *arg);
 /* 2nd param is "struct option_set**" */
-int FAST_FUNC udhcp_str2optset(const char *str, void *arg);
+int FAST_FUNC udhcp_str2optset(const char *str,
+                void *arg,
+                const struct dhcp_optflag *optflags,
+                const char *option_strings);
 
+#if ENABLE_UDHCPC || ENABLE_UDHCPD
 void udhcp_init_header(struct dhcp_packet *packet, char type) FAST_FUNC;
+#endif
 
 int udhcp_recv_kernel_packet(struct dhcp_packet *packet, int fd) FAST_FUNC;
 
diff --git a/networking/udhcp/d6_common.h b/networking/udhcp/d6_common.h
index fcec8c15a..310550371 100644
--- a/networking/udhcp/d6_common.h
+++ b/networking/udhcp/d6_common.h
@@ -87,8 +87,47 @@ struct d6_option {
 #define D6_OPT_IA_PD         25
 #define D6_OPT_IAPREFIX      26
 
+/* RFC 4704 "The DHCPv6 Client FQDN Option"
+ * uint16       option-code     OPTION_CLIENT_FQDN (39)
+ * uint16       option-len      1 + length of domain name
+ * uint8        flags
+ * char[]       domain-name     partial or fully qualified domain name
+ *
+ * Flags format is |MBZ|N|O|S|
+ * The "S" bit indicates whether the server SHOULD or SHOULD NOT perform
+ * the AAAA RR (FQDN-to-address) DNS updates.  A client sets the bit to
+ * 0 to indicate that the server SHOULD NOT perform the updates and 1 to
+ * indicate that the server SHOULD perform the updates.  The state of
+ * the bit in the reply from the server indicates the action to be taken
+ * by the server; if it is 1, the server has taken responsibility for
+ * AAAA RR updates for the FQDN.
+ * The "O" bit indicates whether the server has overridden the client's
+ * preference for the "S" bit.  A client MUST set this bit to 0.  A
+ * server MUST set this bit to 1 if the "S" bit in its reply to the
+ * client does not match the "S" bit received from the client.
+ * The "N" bit indicates whether the server SHOULD NOT perform any DNS
+ * updates.  A client sets this bit to 0 to request that the server
+ * SHOULD perform updates (the PTR RR and possibly the AAAA RR based on
+ * the "S" bit) or to 1 to request that the server SHOULD NOT perform
+ * any DNS updates.  A server sets the "N" bit to indicate whether the
+ * server SHALL (0) or SHALL NOT (1) perform DNS updates.  If the "N"
+ * bit is 1, the "S" bit MUST be 0.
+ *
+ * If a client knows only part of its name, it MAY send a name that is not
+ * fully qualified, indicating that it knows part of the name but does not
+ * necessarily know the zone in which the name is to be embedded.
+ * To send a fully qualified domain name, the Domain Name field is set
+ * to the DNS-encoded domain name including the terminating zero-length
+ * label.  To send a partial name, the Domain Name field is set to the
+ * DNS-encoded domain name without the terminating zero-length label.
+ * A client MAY also leave the Domain Name field empty if it desires the
+ * server to provide a name.
+ */
 #define D6_OPT_CLIENT_FQDN   39
 
+#define D6_OPT_TZ_POSIX      41
+#define D6_OPT_TZ_NAME       42
+
 /*** Other shared functions ***/
 
 struct client6_data_t {
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
index 18a104c61..f6d3fb98b 100644
--- a/networking/udhcp/d6_dhcpc.c
+++ b/networking/udhcp/d6_dhcpc.c
@@ -2,26 +2,49 @@
 /*
  * DHCPv6 client.
  *
- * 2011-11.
- * WARNING: THIS CODE IS INCOMPLETE. IT IS NOWHERE NEAR
- * TO BE READY FOR PRODUCTION USE.
+ * WARNING: THIS CODE IS INCOMPLETE.
  *
- * Copyright (C) 2011 Denys Vlasenko.
+ * Copyright (C) 2011-2017 Denys Vlasenko.
  *
  * Licensed under GPLv2, see file LICENSE in this source tree.
  */
 
 //config:config UDHCPC6
-//config:       bool "udhcpc6 (DHCPv6 client, NOT READY)"
+//config:       bool "udhcpc6 (DHCPv6 client, EXPERIMENTAL)"
 //config:       default n  # not yet ready
 //config:       depends on FEATURE_IPV6
 //config:       help
 //config:         udhcpc6 is a DHCPv6 client
+//config:
+//config:config FEATURE_UDHCPC6_RFC3646
+//config:       bool "Support RFC 3646 (DNS server and search list)"
+//config:       default y
+//config:       depends on UDHCPC6
+//config:       help
+//config:         List of DNS servers and domain search list can be requested with
+//config:         "-O dns" and "-O search". If server gives these values,
+//config:         they will be set in environment variables "dns" and "search".
+//config:
+//config:config FEATURE_UDHCPC6_RFC4704
+//config:       bool "Support RFC 4704 (Client FQDN)"
+//config:       default y
+//config:       depends on UDHCPC6
+//config:       help
+//config:         You can request FQDN to be given by server using "-O fqdn".
+//config:
+//config:config FEATURE_UDHCPC6_RFC4833
+//config:       bool "Support RFC 4833 (Timezones)"
+//config:       default y
+//config:       depends on UDHCPC6
+//config:       help
+//config:         You can request POSIX timezone with "-O tz" and timezone name
+//config:         with "-O timezone".
 
 //applet:IF_UDHCPC6(APPLET(udhcpc6, BB_DIR_USR_BIN, BB_SUID_DROP))
 
 //kbuild:lib-$(CONFIG_UDHCPC6) += d6_dhcpc.o d6_packet.o d6_socket.o common.o socket.o signalpipe.o
-
+//kbuild:lib-$(CONFIG_FEATURE_UDHCPC6_RFC3646) += domain_codec.o
+//kbuild:lib-$(CONFIG_FEATURE_UDHCPC6_RFC4704) += domain_codec.o
 
 #include <syslog.h>
 /* Override ENABLE_FEATURE_PIDFILE - ifupdown needs our pidfile to always exist */
@@ -37,6 +60,34 @@
 
 /* "struct client_config_t client_config" is in bb_common_bufsiz1 */
 
+static const struct dhcp_optflag d6_optflags[] = {
+#if ENABLE_FEATURE_UDHCPC6_RFC3646
+        { OPTION_6RD | OPTION_LIST        | OPTION_REQ, D6_OPT_DNS_SERVERS },
+        { OPTION_DNS_STRING | OPTION_LIST | OPTION_REQ, D6_OPT_DOMAIN_LIST },
+#endif
+#if ENABLE_FEATURE_UDHCPC6_RFC4704
+        { OPTION_DNS_STRING,                            D6_OPT_CLIENT_FQDN },
+#endif
+#if ENABLE_FEATURE_UDHCPC6_RFC4833
+        { OPTION_STRING,                                D6_OPT_TZ_POSIX },
+        { OPTION_STRING,                                D6_OPT_TZ_NAME },
+#endif
+        { 0, 0 }
+};
+/* Must match d6_optflags[] order */
+static const char d6_option_strings[] ALIGN1 =
+#if ENABLE_FEATURE_UDHCPC6_RFC3646
+        "dns" "\0"      /* D6_OPT_DNS_SERVERS */
+        "search" "\0"   /* D6_OPT_DOMAIN_LIST */
+#endif
+#if ENABLE_FEATURE_UDHCPC6_RFC4704
+        "fqdn" "\0"     /* D6_OPT_CLIENT_FQDN */
+#endif
+#if ENABLE_FEATURE_UDHCPC6_RFC4833
+        "tz" "\0"       /* D6_OPT_TZ_POSIX */
+        "timezone" "\0" /* D6_OPT_TZ_NAME */
+#endif
+        "\0";
 
 #if ENABLE_LONG_OPTS
 static const char udhcpc6_longopts[] ALIGN1 =
@@ -88,19 +139,17 @@ enum {
         IF_FEATURE_UDHCP_PORT(   OPT_P = 1 << OPTBIT_P,)
 };
 
-static const char opt_req[] = {
-        (D6_OPT_ORO >> 8), (D6_OPT_ORO & 0xff),
-        0, 6,
-        (D6_OPT_DNS_SERVERS >> 8), (D6_OPT_DNS_SERVERS & 0xff),
-        (D6_OPT_DOMAIN_LIST >> 8), (D6_OPT_DOMAIN_LIST & 0xff),
-        (D6_OPT_CLIENT_FQDN >> 8), (D6_OPT_CLIENT_FQDN & 0xff)
-};
-
+#if ENABLE_FEATURE_UDHCPC6_RFC4704
 static const char opt_fqdn_req[] = {
         (D6_OPT_CLIENT_FQDN >> 8), (D6_OPT_CLIENT_FQDN & 0xff),
-        0, 2,
-        0, 0
+        0, 2, /* optlen */
+        0, /* flags: */
+        /* S=0: server SHOULD NOT perform AAAA RR updates */
+        /* O=0: client MUST set this bit to 0 */
+        /* N=0: server SHOULD perform updates (PTR RR only in our case, since S=0) */
+        0 /* empty DNS-encoded name */
 };
+#endif
 
 /*** Utility functions ***/
 
@@ -136,12 +185,6 @@ static void *d6_copy_option(uint8_t *option, uint8_t *option_end, unsigned code)
         return xmemdup(opt, opt[3] + 4);
 }
 
-static void *d6_store_blob(void *dst, const void *src, unsigned len)
-{
-        memcpy(dst, src, len);
-        return dst + len;
-}
-
 
 /*** Script execution code ***/
 
@@ -154,10 +197,12 @@ static char** new_env(void)
 /* put all the parameters into the environment */
 static void option_to_env(uint8_t *option, uint8_t *option_end)
 {
-        char *dlist, *ptr;
+#if ENABLE_FEATURE_UDHCPC6_RFC3646
+        int addrs, option_offset;
+#endif
         /* "length minus 4" */
         int len_m4 = option_end - option - 4;
-        int olen, ooff;
+
         while (len_m4 >= 0) {
                 uint32_t v32;
                 char ipv6str[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")];
@@ -165,6 +210,10 @@ static void option_to_env(uint8_t *option, uint8_t *option_end)
                 if (option[0] != 0 || option[2] != 0)
                         break;
 
+                /* Check if option-length exceeds size of option */
+                if (option[3] > len_m4)
+                        break;
+
                 switch (option[1]) {
                 //case D6_OPT_CLIENTID:
                 //case D6_OPT_SERVERID:
@@ -174,7 +223,7 @@ static void option_to_env(uint8_t *option, uint8_t *option_end)
                         break;
                 //case D6_OPT_IA_TA:
                 case D6_OPT_IAADDR:
-/*   0                   1                   2                   3
+/*  0                   1                   2                   3
  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  * |          OPTION_IAADDR        |          option-len           |
@@ -235,51 +284,76 @@ static void option_to_env(uint8_t *option, uint8_t *option_end)
                         sprint_nip6(ipv6str, option + 4 + 4 + 1);
                         *new_env() = xasprintf("ipv6prefix=%s/%u", ipv6str, (unsigned)(option[4 + 4]));
                         break;
-                case D6_OPT_DNS_SERVERS:
-                        olen = ((option[2] << 8) | option[3]) / 16;
-                        dlist = ptr = malloc (4 + olen * 40 - 1);
-
-                        memcpy (ptr, "dns=", 4);
-                        ptr += 4;
-                        ooff = 0;
-
-                        while (olen--) {
-                                sprint_nip6(ptr, option + 4 + ooff);
-                                ptr += 39;
-                                ooff += 16;
-                                if (olen)
-                                        *ptr++ = ' ';
-                        }
+#if ENABLE_FEATURE_UDHCPC6_RFC3646
+                case D6_OPT_DNS_SERVERS: {
+                        char *dlist;
 
-                        *new_env() = dlist;
+                        /* Make sure payload-size is a multiple of 16 */
+                        if ((option[3] & 0x0f) != 0)
+                                break;
+
+                        /* Get the number of addresses on the option */
+                        addrs = option[3] >> 4;
+
+                        /* Setup environment variable */
+                        *new_env() = dlist = xmalloc(4 + addrs * 40 - 1);
+                        dlist = stpcpy(dlist, "dns=");
+                        option_offset = 0;
+
+                        while (addrs--) {
+                                sprint_nip6(dlist, option + 4 + option_offset);
+                                dlist += 39;
+                                option_offset += 16;
+                                if (addrs)
+                                        *dlist++ = ' ';
+                        }
 
                         break;
-                case D6_OPT_DOMAIN_LIST:
+                }
+                case D6_OPT_DOMAIN_LIST: {
+                        char *dlist;
+
                         dlist = dname_dec(option + 4, (option[2] << 8) | option[3], "search=");
                         if (!dlist)
                                 break;
                         *new_env() = dlist;
                         break;
-                case D6_OPT_CLIENT_FQDN:
-                        // Work around broken ISC DHCPD6
+                }
+#endif
+#if ENABLE_FEATURE_UDHCPC6_RFC4704
+                case D6_OPT_CLIENT_FQDN: {
+                        char *dlist;
+
+                        if (option[3] == 0)
+                                break;
+                        /* Work around broken ISC DHCPD6.
+                         * ISC DHCPD6 does not implement RFC 4704 correctly: It says the first
+                         * byte of option-payload should contain flags where the bits 7-3 are
+                         * reserved for future use and MUST be zero. Instead ISC DHCPD6 just
+                         * writes the entire FQDN as string to option-payload. We assume a
+                         * broken server here if any of the reserved bits are set.
+                         */
                         if (option[4] & 0xf8) {
-                                olen = ((option[2] << 8) | option[3]);
-                                dlist = xmalloc(olen);
-//fixme:
-//- explain
-//- add len error check
-//- merge two allocs into one
-                                memcpy(dlist, option + 4, olen);
-                                *new_env() = xasprintf("fqdn=%s", dlist);
-                                free(dlist);
+                                *new_env() = xasprintf("fqdn=%.*s", (int)option[3], (char*)option + 4);
                                 break;
                         }
-                        dlist = dname_dec(option + 5, ((option[2] << 8) | option[3]) - 1, "fqdn=");
+                        dlist = dname_dec(option + 5, (/*(option[2] << 8) |*/ option[3]) - 1, "fqdn=");
                         if (!dlist)
                                 break;
                         *new_env() = dlist;
                         break;
                 }
+#endif
+#if ENABLE_FEATURE_UDHCPC6_RFC4833
+                /* RFC 4833 Timezones */
+                case D6_OPT_TZ_POSIX:
+                        *new_env() = xasprintf("tz=%.*s", (int)option[3], (char*)option + 4);
+                        break;
+                case D6_OPT_TZ_NAME:
+                        *new_env() = xasprintf("tz_name=%.*s", (int)option[3], (char*)option + 4);
+                        break;
+#endif
+                }
                 len_m4 -= 4 + option[3];
                 option += 4 + option[3];
         }
@@ -346,22 +420,38 @@ static uint8_t *init_d6_packet(struct d6_packet *packet, char type, uint32_t xid
         packet->d6_msg_type = type;
 
         clientid = (void*)client_config.clientid;
-        return d6_store_blob(packet->d6_options, clientid, clientid->len + 2+2);
+        return mempcpy(packet->d6_options, clientid, clientid->len + 2+2);
 }
 
 static uint8_t *add_d6_client_options(uint8_t *ptr)
 {
-        return ptr;
-        //uint8_t c;
-        //int i, end, len;
+        uint8_t *start = ptr;
+        unsigned option;
+
+        ptr += 4;
+        for (option = 1; option < 256; option++) {
+                if (client_config.opt_mask[option >> 3] & (1 << (option & 7))) {
+                        ptr[0] = (option >> 8);
+                        ptr[1] = option;
+                        ptr += 2;
+                }
+        }
 
-        /* Add a "param req" option with the list of options we'd like to have
-         * from stubborn DHCP servers. Pull the data from the struct in common.c.
-         * No bounds checking because it goes towards the head of the packet. */
-        //...
+        if ((ptr - start - 4) != 0) {
+                start[0] = (D6_OPT_ORO >> 8);
+                start[1] = D6_OPT_ORO;
+                start[2] = ((ptr - start - 4) >> 8);
+                start[3] = (ptr - start - 4);
+        } else
+                ptr = start;
 
+#if ENABLE_FEATURE_UDHCPC6_RFC4704
+        ptr = mempcpy(ptr, &opt_fqdn_req, sizeof(opt_fqdn_req));
+#endif
         /* Add -x options if any */
         //...
+
+        return ptr;
 }
 
 static int d6_mcast_from_client_config_ifindex(struct d6_packet *packet, uint8_t *end)
@@ -483,11 +573,7 @@ static NOINLINE int send_d6_discover(uint32_t xid, struct in6_addr *requested_ip
                 iaaddr->len = 16+4+4;
                 memcpy(iaaddr->data, requested_ipv6, 16);
         }
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, len);
-
-        /* Request additional options */
-        opt_ptr = d6_store_blob(opt_ptr, &opt_req, sizeof(opt_req));
-        opt_ptr = d6_store_blob(opt_ptr, &opt_fqdn_req, sizeof(opt_fqdn_req));
+        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, len);
 
         /* Add options:
          * "param req" option according to -O, options specified with -x
@@ -538,13 +624,9 @@ static NOINLINE int send_d6_select(uint32_t xid)
         opt_ptr = init_d6_packet(&packet, D6_MSG_REQUEST, xid);
 
         /* server id */
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
+        opt_ptr = mempcpy(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
         /* IA NA (contains requested IP) */
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
-
-        /* Request additional options */
-        opt_ptr = d6_store_blob(opt_ptr, &opt_req, sizeof(opt_req));
-        opt_ptr = d6_store_blob(opt_ptr, &opt_fqdn_req, sizeof(opt_fqdn_req));
+        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
 
         /* Add options:
          * "param req" option according to -O, options specified with -x
@@ -611,9 +693,9 @@ static NOINLINE int send_d6_renew(uint32_t xid, struct in6_addr *server_ipv6, st
         opt_ptr = init_d6_packet(&packet, DHCPREQUEST, xid);
 
         /* server id */
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
+        opt_ptr = mempcpy(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
         /* IA NA (contains requested IP) */
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
 
         /* Add options:
          * "param req" option according to -O, options specified with -x
@@ -640,9 +722,9 @@ static int send_d6_release(struct in6_addr *server_ipv6, struct in6_addr *our_cu
         /* Fill in: msg type, client id */
         opt_ptr = init_d6_packet(&packet, D6_MSG_RELEASE, random_xid());
         /* server id */
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
+        opt_ptr = mempcpy(opt_ptr, client6_data.server_id, client6_data.server_id->len + 2+2);
         /* IA NA (contains our current IP) */
-        opt_ptr = d6_store_blob(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
+        opt_ptr = mempcpy(opt_ptr, client6_data.ia_na, client6_data.ia_na->len + 2+2);
 
         bb_error_msg("sending %s", "release");
         return d6_send_kernel_packet(
@@ -1051,20 +1133,18 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                 char *optstr = llist_pop(&list_O);
                 unsigned n = bb_strtou(optstr, NULL, 0);
                 if (errno || n > 254) {
-                        n = udhcp_option_idx(optstr);
-                        n = dhcp_optflags[n].code;
+                        n = udhcp_option_idx(optstr, d6_option_strings);
+                        n = d6_optflags[n].code;
                 }
                 client_config.opt_mask[n >> 3] |= 1 << (n & 7);
         }
         if (!(opt & OPT_o)) {
-                /*
                 unsigned i, n;
-                for (i = 0; (n = dhcp_optflags[i].code) != 0; i++) {
-                        if (dhcp_optflags[i].flags & OPTION_REQ) {
+                for (i = 0; (n = d6_optflags[i].code) != 0; i++) {
+                        if (d6_optflags[i].flags & OPTION_REQ) {
                                 client_config.opt_mask[n >> 3] |= 1 << (n & 7);
                         }
                 }
-                */
         }
         while (list_x) {
                 char *optstr = llist_pop(&list_x);
@@ -1073,7 +1153,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                         *colon = ' ';
                 /* now it looks similar to udhcpd's config file line:
                  * "optname optval", using the common routine: */
-                udhcp_str2optset(optstr, &client_config.options);
+                udhcp_str2optset(optstr, &client_config.options, d6_optflags, d6_option_strings);
                 if (colon)
                         *colon = ':'; /* restore it for NOMMU reexec */
         }
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index 6aa6731fb..1a66c610e 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -1346,7 +1346,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                 char *optstr = llist_pop(&list_O);
                 unsigned n = bb_strtou(optstr, NULL, 0);
                 if (errno || n > 254) {
-                        n = udhcp_option_idx(optstr);
+                        n = udhcp_option_idx(optstr, dhcp_option_strings);
                         n = dhcp_optflags[n].code;
                 }
                 client_config.opt_mask[n >> 3] |= 1 << (n & 7);
@@ -1366,7 +1366,7 @@ int udhcpc_main(int argc UNUSED_PARAM, char **argv)
                         *colon = ' ';
                 /* now it looks similar to udhcpd's config file line:
                  * "optname optval", using the common routine: */
-                udhcp_str2optset(optstr, &client_config.options);
+                udhcp_str2optset(optstr, &client_config.options, dhcp_optflags, dhcp_option_strings);
                 if (colon)
                         *colon = ':'; /* restore it for NOMMU reexec */
         }
diff --git a/networking/udhcp/dhcpc.h b/networking/udhcp/dhcpc.h
index 9f423a5b2..7fdbc9a6c 100644
--- a/networking/udhcp/dhcpc.h
+++ b/networking/udhcp/dhcpc.h
@@ -12,6 +12,7 @@ struct client_config_t {
         IF_FEATURE_UDHCP_PORT(uint16_t port;)
         int ifindex;                    /* Index number of the interface to use */
         uint8_t opt_mask[256 / 8];      /* Bitmask of options to send (-O option) */
+// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ TODO: DHCPv6 has 16-bit option numbers
         const char *interface;          /* The name of the interface to use */
         char *pidfile;                  /* Optionally store the process ID */
         const char *script;             /* User script to run at dhcp events */
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 5eff026bc..3a5fc2db7 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -361,6 +361,10 @@ static int FAST_FUNC read_staticlease(const char *const_line, void *arg)
         return 1;
 }
 
+static int FAST_FUNC read_optset(const char *line, void *arg) {
+        return udhcp_str2optset(line, arg, dhcp_optflags, dhcp_option_strings);
+}
+
 struct config_keyword {
         const char *keyword;
         int (*handler)(const char *line, void *var) FAST_FUNC;
@@ -387,8 +391,8 @@ static const struct config_keyword keywords[] = {
         {"pidfile"      , read_str        , OFS(pidfile      ), "/var/run/udhcpd.pid"},
         {"siaddr"       , udhcp_str2nip   , OFS(siaddr_nip   ), "0.0.0.0"},
         /* keywords with no defaults must be last! */
-        {"option"       , udhcp_str2optset, OFS(options      ), ""},
-        {"opt"          , udhcp_str2optset, OFS(options      ), ""},
+        {"option"       , read_optset     , OFS(options      ), ""},
+        {"opt"          , read_optset     , OFS(options      ), ""},
         {"notify_file"  , read_str        , OFS(notify_file  ), NULL},
         {"sname"        , read_str        , OFS(sname        ), NULL},
         {"boot_file"    , read_str        , OFS(boot_file    ), NULL},
diff --git a/networking/udhcp/packet.c b/networking/udhcp/packet.c
index 0a31f2643..9e1b46d2f 100644
--- a/networking/udhcp/packet.c
+++ b/networking/udhcp/packet.c
@@ -12,6 +12,7 @@
 #include <netinet/if_ether.h>
 #include <netpacket/packet.h>
 
+#if ENABLE_UDHCPC || ENABLE_UDHCPD
 void FAST_FUNC udhcp_init_header(struct dhcp_packet *packet, char type)
 {
         memset(packet, 0, sizeof(*packet));
@@ -29,6 +30,7 @@ void FAST_FUNC udhcp_init_header(struct dhcp_packet *packet, char type)
                 packet->options[0] = DHCP_END;
         udhcp_add_simple_option(packet, DHCP_MESSAGE_TYPE, type);
 }
+#endif
 
 #if defined CONFIG_UDHCP_DEBUG && CONFIG_UDHCP_DEBUG >= 2
 void FAST_FUNC udhcp_dump_packet(struct dhcp_packet *packet)
diff --git a/procps/pgrep.c b/procps/pgrep.c
index e932a32bc..3d01c6cff 100644
--- a/procps/pgrep.c
+++ b/procps/pgrep.c
@@ -26,10 +26,11 @@
 //kbuild:lib-$(CONFIG_PKILL) += pgrep.o
 
 //usage:#define pgrep_trivial_usage
-//usage:       "[-flnovx] [-s SID|-P PPID|PATTERN]"
+//usage:       "[-flanovx] [-s SID|-P PPID|PATTERN]"
 //usage:#define pgrep_full_usage "\n\n"
 //usage:       "Display process(es) selected by regex PATTERN\n"
 //usage:     "\n        -l      Show command name too"
+//usage:     "\n        -a      Show command line too"
 //usage:     "\n        -f      Match against entire command line"
 //usage:     "\n        -n      Show the newest process only"
 //usage:     "\n        -o      Show the oldest process only"
@@ -55,13 +56,14 @@
 #include "xregex.h"
 
 /* Idea taken from kill.c */
-#define pgrep (ENABLE_PGREP && applet_name[1] == 'g')
-#define pkill (ENABLE_PKILL && applet_name[1] == 'k')
+#define pgrep (ENABLE_PGREP && (!ENABLE_PKILL || applet_name[1] == 'g'))
+#define pkill (ENABLE_PKILL && (!ENABLE_PGREP || applet_name[1] == 'k'))
 
 enum {
-        /* "vlfxons:P:" */
+        /* "vlafxons:+P:+" */
         OPTBIT_V = 0, /* must be first, we need OPT_INVERT = 0/1 */
         OPTBIT_L,
+        OPTBIT_A,
         OPTBIT_F,
         OPTBIT_X,
         OPTBIT_O,
@@ -72,6 +74,7 @@ enum {
 
 #define OPT_INVERT      (opt & (1 << OPTBIT_V))
 #define OPT_LIST        (opt & (1 << OPTBIT_L))
+#define OPT_LISTFULL    (opt & (1 << OPTBIT_A))
 #define OPT_FULL        (opt & (1 << OPTBIT_F))
 #define OPT_ANCHOR      (opt & (1 << OPTBIT_X))
 #define OPT_FIRST       (opt & (1 << OPTBIT_O))
@@ -82,7 +85,7 @@ enum {
 static void act(unsigned pid, char *cmd, int signo)
 {
         if (pgrep) {
-                if (option_mask32 & (1 << OPTBIT_L)) /* OPT_LIST */
+                if (option_mask32 & ((1 << OPTBIT_L)|(1 << OPTBIT_A))) /* -l or -a */
                         printf("%u %s\n", pid, cmd);
                 else
                         printf("%u\n", pid);
@@ -124,7 +127,7 @@ int pgrep_main(int argc UNUSED_PARAM, char **argv)
         /* Parse remaining options */
         ppid2match = -1;
         sid2match = -1;
-        opt = getopt32(argv, "vlfxons:+P:+", &sid2match, &ppid2match);
+        opt = getopt32(argv, "vlafxons:+P:+", &sid2match, &ppid2match);
         argv += optind;
 
         if (pkill && OPT_LIST) { /* -l: print the whole signal list */
@@ -152,26 +155,37 @@ int pgrep_main(int argc UNUSED_PARAM, char **argv)
         proc = NULL;
         while ((proc = procps_scan(proc, scan_mask)) != NULL) {
                 char *cmd;
+                int cmdlen;
 
                 if (proc->pid == pid)
                         continue;
 
+                if (ppid2match >= 0 && ppid2match != proc->ppid)
+                        continue;
+                if (sid2match >= 0 && sid2match != proc->sid)
+                        continue;
+
+                cmdlen = -1;
                 cmd = proc->argv0;
                 if (!cmd) {
                         cmd = proc->comm;
                 } else {
                         int i = proc->argv_len;
+
+                        if (!OPT_LISTFULL)
+                                cmdlen = strlen(cmd); /* not -a: find first NUL */
+                        /*
+                         * "sleep 11" looks like "sleep""\0""11""\0" in argv0.
+                         * Make sure last "\0" does not get converted to " ":
+                         */
+                        if (i && cmd[i-1] == '\0')
+                                i--;
                         while (--i >= 0) {
                                 if ((unsigned char)cmd[i] < ' ')
                                         cmd[i] = ' ';
                         }
                 }
 
-                if (ppid2match >= 0 && ppid2match != proc->ppid)
-                        continue;
-                if (sid2match >= 0 && sid2match != proc->sid)
-                        continue;
-
                 /* NB: OPT_INVERT is always 0 or 1 */
                 if (!argv[0]
                  || (regexec(&re_buffer, cmd, 1, re_match, 0) == 0 /* match found */
@@ -184,6 +198,8 @@ int pgrep_main(int argc UNUSED_PARAM, char **argv)
                                 cmd_last = xstrdup(cmd);
                                 continue;
                         }
+                        if (cmdlen >= 0)
+                                cmd[cmdlen] = '\0';
                         act(proc->pid, cmd, signo);
                         if (OPT_FIRST)
                                 break;
diff --git a/procps/pstree.c b/procps/pstree.c
index f97e99639..bc9f0c927 100644
--- a/procps/pstree.c
+++ b/procps/pstree.c
@@ -34,7 +34,7 @@
 
 struct child;
 
-#ifdef ENABLE_FEATURE_SHOW_THREADS
+#if ENABLE_FEATURE_SHOW_THREADS
 /* For threads, we add {...} around the comm, so we need two extra bytes */
 # define COMM_DISP_LEN (COMM_LEN + 2)
 #else
diff --git a/scripts/randomtest b/scripts/randomtest
index 287f1c771..1809838a4 100755
--- a/scripts/randomtest
+++ b/scripts/randomtest
@@ -82,6 +82,9 @@ if test x"$LIBC" = x"uclibc"; then
         | grep -v CONFIG_BLKDISCARD \
         | grep -v CONFIG_NSENTER \
         | grep -v CONFIG_UNSHARE \
+        | grep -v CONFIG_FALLOCATE \
+        | grep -v CONFIG_UDHCPC6 \
+        | grep -v CONFIG_ASH_INTERNAL_GLOB \
         >.config.new
         mv .config.new .config
         echo 'CONFIG_STATIC=y' >>.config
@@ -96,6 +99,9 @@ if test x"$LIBC" = x"uclibc"; then
         echo '# CONFIG_BLKDISCARD is not set' >>.config
         echo '# CONFIG_NSENTER is not set' >>.config
         echo '# CONFIG_UNSHARE is not set' >>.config
+        echo '# CONFIG_FALLOCATE is not set' >>.config
+        echo '# CONFIG_UDHCPC6 is not set' >>.config
+        echo 'CONFIG_ASH_INTERNAL_GLOB=y' >>.config
 fi
 
 # If STATIC, remove some things.
diff --git a/scripts/randomtest.loop b/scripts/randomtest.loop
index 710f5fd05..4d14b652f 100755
--- a/scripts/randomtest.loop
+++ b/scripts/randomtest.loop
@@ -1,7 +1,11 @@
 #!/bin/sh
 
+run_testsuite=false
 run_testsuite=true
 
+run_single_test=false
+run_single_test=true
+
 test -d "$1" || { echo "'$1' is not a directory"; exit 1; }
 test -x "$1/scripts/randomtest" || { echo "No scripts/randomtest in '$1'"; exit 1; }
 
@@ -40,6 +44,28 @@ while sleep 1; do
                 fi
                 tail -n10 -- "$dir/testsuite/runtest.log"
         fi
+        if $run_single_test; then
+                (
+                        cd -- "$dir" || exit 1
+                        echo "Running make_single_applets.sh in $dir..."
+
+                        if grep -q '# CONFIG_FEATURE_TFTP_GET is not set' .config \
+                        && grep -q '# CONFIG_FEATURE_TFTP_PUT is not set' .config \
+                        ; then
+                                # If both off, tftp[d] is ifdefed out and test fails.
+                                # Enable one:
+                                sed 's/# CONFIG_FEATURE_TFTP_GET is not set/CONFIG_FEATURE_TFTP_GET=y/' -i .config
+                        fi
+
+                        ./make_single_applets.sh
+                )
+                if test $? != 0; then
+                        echo "Failed make_single_applets.sh in $dir"
+                        exit 1 # you may comment this out...
+                        let fail++
+                        continue
+                fi
+        fi
         rm -rf -- "$dir"
         let cnt++
 done
diff --git a/scripts/trylink b/scripts/trylink
index 9f288c141..ba2d265bc 100755
--- a/scripts/trylink
+++ b/scripts/trylink
@@ -91,7 +91,9 @@ fi
 
 START_GROUP="-Wl,--start-group"
 END_GROUP="-Wl,--end-group"
-INFO_OPTS="-Wl,--warn-common -Wl,-Map,$EXE.map -Wl,--verbose"
+INFO_OPTS() {
+        echo "-Wl,--warn-common -Wl,-Map,$EXE.map -Wl,--verbose"
+}
 
 # gold may not support --sort-common (yet)
 SORT_COMMON="-Wl,--sort-common"
@@ -194,7 +196,7 @@ if ! test -f busybox_ldscript; then
             $GC_SECTIONS \
             $START_GROUP $O_FILES $A_FILES $END_GROUP \
             $l_list \
-            $INFO_OPTS \
+            `INFO_OPTS` \
     || {
         cat $EXE.out
         exit 1
@@ -225,7 +227,7 @@ else
             -Wl,-T,busybox_ldscript \
             $START_GROUP $O_FILES $A_FILES $END_GROUP \
             $l_list \
-            $INFO_OPTS \
+            `INFO_OPTS` \
     || {
         cat $EXE.out
         exit 1
@@ -244,10 +246,14 @@ if test "$CONFIG_BUILD_LIBBUSYBOX" = y; then
     }
     ln -s "libbusybox.so.$BB_VER" "$sharedlib_dir"/libbusybox.so 2>/dev/null
 
+    # Yes, "ld -shared -static" is a thing. It's a shared library which is itself static.
+    LBB_STATIC=""
+    test "$CONFIG_FEATURE_LIBBUSYBOX_STATIC" = y && LBB_STATIC="-Wl,-static"
+
     EXE="$sharedlib_dir/libbusybox.so.${BB_VER}_unstripped"
     try $CC $CFLAGS $LDFLAGS \
             -o $EXE \
-            -shared -fPIC \
+            -shared -fPIC $LBB_STATIC \
             -Wl,--enable-new-dtags \
             -Wl,-z,combreloc \
             -Wl,-soname="libbusybox.so.$BB_VER" \
@@ -256,7 +262,7 @@ if test "$CONFIG_BUILD_LIBBUSYBOX" = y; then
             $SORT_SECTION \
             $START_GROUP $A_FILES $END_GROUP \
             $l_list \
-            $INFO_OPTS \
+            `INFO_OPTS` \
     || {
         echo "Linking $EXE failed"
         cat $EXE.out
@@ -277,7 +283,7 @@ if test "$CONFIG_FEATURE_SHARED_BUSYBOX" = y; then
             $START_GROUP $O_FILES $END_GROUP \
             -L"$sharedlib_dir" -lbusybox \
             $l_list \
-            $INFO_OPTS \
+            `INFO_OPTS` \
     || {
         echo "Linking $EXE failed"
         cat $EXE.out
diff --git a/shell/ash.c b/shell/ash.c
index 5debd82f2..6cc29d25e 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -2566,12 +2566,8 @@ putprompt(const char *s)
 }
 #endif
 
-#if ENABLE_ASH_EXPAND_PRMT
 /* expandstr() needs parsing machinery, so it is far away ahead... */
 static const char *expandstr(const char *ps);
-#else
-#define expandstr(s) s
-#endif
 
 static void
 setprompt_if(smallint do_set, int whichprompt)
@@ -2596,10 +2592,10 @@ setprompt_if(smallint do_set, int whichprompt)
         }
 #if ENABLE_ASH_EXPAND_PRMT
         pushstackmark(&smark, stackblocksize());
-#endif
         putprompt(expandstr(prompt));
-#if ENABLE_ASH_EXPAND_PRMT
         popstackmark(&smark);
+#else
+        putprompt(prompt);
 #endif
 }
 
@@ -4244,15 +4240,19 @@ sprint_status48(char *s, int status, int sigonly)
 
         col = 0;
         if (!WIFEXITED(status)) {
-                if (JOBS && WIFSTOPPED(status))
+#if JOBS
+                if (WIFSTOPPED(status))
                         st = WSTOPSIG(status);
                 else
+#endif
                         st = WTERMSIG(status);
                 if (sigonly) {
                         if (st == SIGINT || st == SIGPIPE)
                                 goto out;
-                        if (JOBS && WIFSTOPPED(status))
+#if JOBS
+                        if (WIFSTOPPED(status))
                                 goto out;
+#endif
                 }
                 st &= 0x7f;
 //TODO: use bbox's get_signame? strsignal adds ~600 bytes to text+rodata
@@ -4501,8 +4501,10 @@ dowait(int block, struct job *job)
                 goto out;
         }
         /* The process wasn't found in job list */
-        if (JOBS && !WIFSTOPPED(status))
+#if JOBS
+        if (!WIFSTOPPED(status))
                 jobless--;
+#endif
  out:
         INT_ON;
 
@@ -6285,6 +6287,7 @@ rmescapes(char *str, int flag)
         while (*p) {
                 if ((unsigned char)*p == CTLQUOTEMARK) {
 // Note: both inquotes and protect_against_glob only affect whether
+// CTLESC,<ch> gets converted to <ch> or to \<ch>
                         inquotes = ~inquotes;
                         p++;
                         protect_against_glob = globbing;
@@ -6297,7 +6300,33 @@ rmescapes(char *str, int flag)
                                 ash_msg_and_raise_error("CTLESC at EOL (shouldn't happen)");
 #endif
                         if (protect_against_glob) {
-                                *q++ = '\\';
+                                /*
+                                 * We used to trust glob() and fnmatch() to eat
+                                 * superfluous escapes (\z where z has no
+                                 * special meaning anyway). But this causes
+                                 * bugs such as string of one greek letter rho
+                                 * (unicode-encoded as two bytes "cf,81")
+                                 * getting encoded as "cf,CTLESC,81"
+                                 * and here, converted to "cf,\,81" -
+                                 * which does not go well with some flavors
+                                 * of fnmatch() in unicode locales
+                                 * (for example, glibc <= 2.22).
+                                 *
+                                 * Lets add "\" only on the chars which need it.
+                                 * Testcases for less obvious chars are shown.
+                                 */
+                                if (*p == '*'
+                                 || *p == '?'
+                                 || *p == '['
+                                 || *p == '\\' /* case '\' in \\ ) echo ok;; *) echo WRONG;; esac */
+                                 || *p == ']' /* case ']' in [a\]] ) echo ok;; *) echo WRONG;; esac */
+                                 || *p == '-' /* case '-' in [a\-c]) echo ok;; *) echo WRONG;; esac */
+                                 || *p == '!' /* case '!' in [\!] ) echo ok;; *) echo WRONG;; esac */
+                                /* Some libc support [^negate], that's why "^" also needs love */
+                                 || *p == '^' /* case '^' in [\^] ) echo ok;; *) echo WRONG;; esac */
+                                ) {
+                                        *q++ = '\\';
+                                }
                         }
                 } else if (*p == '\\' && !inquotes) {
                         /* naked back slash */
@@ -6963,7 +6992,6 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
         char *loc;
         char *rmesc, *rmescend;
         char *str;
-        IF_BASH_SUBSTR(int pos, len, orig_len;)
         int amount, resetloc;
         IF_BASH_PATTERN_SUBST(int workloc;)
         IF_BASH_PATTERN_SUBST(char *repl = NULL;)
@@ -6992,14 +7020,23 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                 /* NOTREACHED */
 
 #if BASH_SUBSTR
-        case VSSUBSTR:
-//TODO: support more general format ${v:EXPR:EXPR},
-// where EXPR follows $(()) rules
+        case VSSUBSTR: {
+                int pos, len, orig_len;
+                char *colon;
+
                 loc = str = stackblock() + strloc;
+
+# if !ENABLE_FEATURE_SH_MATH
+#  define ash_arith number
+# endif
                 /* Read POS in ${var:POS:LEN} */
-                pos = atoi(loc); /* number(loc) errors out on "1:4" */
-                len = str - startp - 1;
+                colon = strchr(loc, ':');
+                if (colon) *colon = '\0';
+                pos = ash_arith(loc);
+                if (colon) *colon = ':';
 
+                /* Read LEN in ${var:POS:LEN} */
+                len = str - startp - 1;
                 /* *loc != '\0', guaranteed by parser */
                 if (quotes) {
                         char *ptr;
@@ -7013,25 +7050,21 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                         }
                 }
                 orig_len = len;
-
                 if (*loc++ == ':') {
                         /* ${var::LEN} */
-                        len = number(loc);
+                        len = ash_arith(loc);
                 } else {
                         /* Skip POS in ${var:POS:LEN} */
                         len = orig_len;
                         while (*loc && *loc != ':') {
-                                /* TODO?
-                                 * bash complains on: var=qwe; echo ${var:1a:123}
-                                if (!isdigit(*loc))
-                                        ash_msg_and_raise_error(msg_illnum, str);
-                                 */
                                 loc++;
                         }
                         if (*loc++ == ':') {
-                                len = number(loc);
+                                len = ash_arith(loc);
                         }
                 }
+#  undef ash_arith
+
                 if (pos < 0) {
                         /* ${VAR:$((-n)):l} starts n chars from the end */
                         pos = orig_len + pos;
@@ -7039,12 +7072,16 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                 if ((unsigned)pos >= orig_len) {
                         /* apart from obvious ${VAR:999999:l},
                          * covers ${VAR:$((-9999999)):l} - result is ""
-                         * (bash-compat)
+                         * (bash compat)
                          */
                         pos = 0;
                         len = 0;
                 }
-                if (len > (orig_len - pos))
+                if (len < 0) {
+                        /* ${VAR:N:-M} sets LEN to strlen()-M */
+                        len = (orig_len - pos) + len;
+                }
+                if ((unsigned)len > (orig_len - pos))
                         len = orig_len - pos;
 
                 for (str = startp; pos; str++, pos--) {
@@ -7060,6 +7097,7 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
                 amount = loc - expdest;
                 STADJUST(amount, expdest);
                 return loc;
+        }
 #endif /* BASH_SUBSTR */
         }
 
@@ -7104,6 +7142,7 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
 #if BASH_PATTERN_SUBST
         workloc = expdest - (char *)stackblock();
         if (subtype == VSREPLACE || subtype == VSREPLACEALL) {
+                int len;
                 char *idx, *end;
 
                 if (!repl) {
@@ -7970,7 +8009,9 @@ expandhere(union node *arg, int fd)
 static int
 patmatch(char *pattern, const char *string)
 {
-        return pmatch(preglob(pattern, 0), string);
+        char *p = preglob(pattern, 0);
+        //bb_error_msg("fnmatch(pattern:'%s',str:'%s')", p, string);
+        return pmatch(p, string);
 }
 
 /*
@@ -8072,7 +8113,7 @@ tryexec(IF_FEATURE_SH_STANDALONE(int applet_no,) char *cmd, char **argv, char **
                         clearenv();
                         while (*envp)
                                 putenv(*envp++);
-                        run_applet_no_and_exit(applet_no, argv);
+                        run_applet_no_and_exit(applet_no, cmd, argv);
                 }
                 /* re-exec ourselves with the new arguments */
                 execve(bb_busybox_exec_path, argv, envp);
@@ -12022,9 +12063,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         smallint dblquote;
         smallint oldstyle;
         IF_FEATURE_SH_MATH(smallint prevsyntax;) /* syntax before arithmetic */
-#if ENABLE_ASH_EXPAND_PRMT
         smallint pssyntax;   /* we are expanding a prompt string */
-#endif
         int varnest;         /* levels of variables expansion */
         IF_FEATURE_SH_MATH(int arinest;)    /* levels of arithmetic expansion */
         IF_FEATURE_SH_MATH(int parenlevel;) /* levels of parens in arithmetic */
@@ -12036,11 +12075,9 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         bqlist = NULL;
         quotef = 0;
         IF_FEATURE_SH_MATH(prevsyntax = 0;)
-#if ENABLE_ASH_EXPAND_PRMT
         pssyntax = (syntax == PSSYNTAX);
         if (pssyntax)
                 syntax = DQSYNTAX;
-#endif
         dblquote = (syntax == DQSYNTAX);
         varnest = 0;
         IF_FEATURE_SH_MATH(arinest = 0;)
@@ -12094,12 +12131,10 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                         } else if (c == '\n') {
                                 nlprompt();
                         } else {
-#if ENABLE_ASH_EXPAND_PRMT
                                 if (c == '$' && pssyntax) {
                                         USTPUTC(CTLESC, out);
                                         USTPUTC('\\', out);
                                 }
-#endif
                                 /* Backslash is retained if we are in "str" and next char isn't special */
                                 if (dblquote
                                  && c != '\\'
@@ -12384,7 +12419,7 @@ parsesub: {
 #if ENABLE_FEATURE_SH_MATH
                         PARSEARITH();
 #else
-                        raise_error_syntax("you disabled math support for $((arith)) syntax");
+                        raise_error_syntax("support for $((arith)) is disabled");
 #endif
                 } else {
                         pungetc();
@@ -12933,7 +12968,6 @@ parseheredoc(void)
 /*
  * called by editline -- any expansions to the prompt should be added here.
  */
-#if ENABLE_ASH_EXPAND_PRMT
 static const char *
 expandstr(const char *ps)
 {
@@ -12959,7 +12993,6 @@ expandstr(const char *ps)
         expandarg(&n, NULL, EXP_QUOTED);
         return stackblock();
 }
-#endif
 
 /*
  * Execute a command or commands contained in a string.
@@ -13497,7 +13530,7 @@ trapcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
         exitcode = 0;
         while (*ap) {
                 signo = get_signum(*ap);
-                if (signo < 0) {
+                if (signo < 0 || signo >= NSIG) {
                         /* Mimic bash message exactly */
                         ash_msg("%s: invalid signal specification", *ap);
                         exitcode = 1;
diff --git a/shell/ash_test/ash-heredoc/heredoc1.right b/shell/ash_test/ash-heredoc/heredoc1.right
index 40aa5a5fe..7fc68f3e1 100644
--- a/shell/ash_test/ash-heredoc/heredoc1.right
+++ b/shell/ash_test/ash-heredoc/heredoc1.right
@@ -1 +1,5 @@
-./heredoc1.tests: line 3: syntax error: unexpected "then"
+qwe
+asd
+123
+456
+Ok
diff --git a/shell/ash_test/ash-heredoc/heredoc1.tests b/shell/ash_test/ash-heredoc/heredoc1.tests
index a912a67c7..2eeb4726b 100755
--- a/shell/ash_test/ash-heredoc/heredoc1.tests
+++ b/shell/ash_test/ash-heredoc/heredoc1.tests
@@ -1,3 +1,9 @@
-# We used to SEGV on this:
-
-<<EOF; then <W
+cat <<000; cat <<www; cat <<eee
+000
+qwe
+asd
+www
+123
+456
+eee
+echo Ok
diff --git a/shell/ash_test/ash-heredoc/heredoc3.right b/shell/ash_test/ash-heredoc/heredoc3.right
index ce0136250..6ed517f74 100644
--- a/shell/ash_test/ash-heredoc/heredoc3.right
+++ b/shell/ash_test/ash-heredoc/heredoc3.right
@@ -1 +1,9 @@
-hello
+exit EOF-f
+"
+echo $f
+echo `echo Hello World`
+moo      
+ EOF-f
+EOF-f   f
+EOF-f 
+Ok
diff --git a/shell/ash_test/ash-heredoc/heredoc3.tests b/shell/ash_test/ash-heredoc/heredoc3.tests
index 96c227cc1..938577a89 100755
--- a/shell/ash_test/ash-heredoc/heredoc3.tests
+++ b/shell/ash_test/ash-heredoc/heredoc3.tests
@@ -1,9 +1,12 @@
-echo hello >greeting
-cat <<EOF &&
-$(cat greeting)
-EOF
-{
-        echo $?
-        cat greeting
-} >/dev/null
-rm greeting
+f=1
+  cat <<- EOF-f""
+                exit EOF-f
+"
+echo $f
+echo `echo Hello World`
+                moo      
+ EOF-f
+EOF-f   f
+EOF-f 
+EOF-f
+echo Ok
diff --git a/shell/ash_test/ash-heredoc/heredoc8.right b/shell/ash_test/ash-heredoc/heredoc8.right
new file mode 100644
index 000000000..af396660e
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc8.right
@@ -0,0 +1 @@
+./heredoc8.tests: line 3: syntax error: unexpected "then"
diff --git a/shell/ash_test/ash-heredoc/heredoc8.tests b/shell/ash_test/ash-heredoc/heredoc8.tests
new file mode 100755
index 000000000..f7bc0737a
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc8.tests
@@ -0,0 +1,3 @@
+# ash used to SEGV on this:
+
+<<EOF; then <W
diff --git a/shell/ash_test/ash-heredoc/heredoc9.right b/shell/ash_test/ash-heredoc/heredoc9.right
new file mode 100644
index 000000000..ce0136250
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc9.right
@@ -0,0 +1 @@
+hello
diff --git a/shell/ash_test/ash-heredoc/heredoc9.tests b/shell/ash_test/ash-heredoc/heredoc9.tests
new file mode 100755
index 000000000..96c227cc1
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc9.tests
@@ -0,0 +1,9 @@
+echo hello >greeting
+cat <<EOF &&
+$(cat greeting)
+EOF
+{
+        echo $?
+        cat greeting
+} >/dev/null
+rm greeting
diff --git a/shell/ash_test/ash-misc/shift1.tests b/shell/ash_test/ash-misc/shift1.tests
index 0992d9b1b..2774b35ea 100755
--- a/shell/ash_test/ash-misc/shift1.tests
+++ b/shell/ash_test/ash-misc/shift1.tests
@@ -1,5 +1,5 @@
 $THIS_SH -c 'shift;    echo "$@"' 0 1 2 3 4
-#We do abort on -1, but then we abort. bash executes echo.
+# We do complain on -1, but then we abort. bash executes echo.
 $THIS_SH -c 'shift -1; echo "$@"' 0 1 2 3 4
 $THIS_SH -c 'shift  0; echo "$@"' 0 1 2 3 4
 $THIS_SH -c 'shift  1; echo "$@"' 0 1 2 3 4
diff --git a/shell/ash_test/ash-misc/sigint1.right b/shell/ash_test/ash-misc/sigint1.right
deleted file mode 100644
index a9094b056..000000000
--- a/shell/ash_test/ash-misc/sigint1.right
+++ /dev/null
@@ -1 +0,0 @@
-Sending SIGINT to main shell PID
diff --git a/shell/ash_test/ash-misc/sigint1.tests b/shell/ash_test/ash-misc/sigint1.tests
deleted file mode 100755
index 3d483d32a..000000000
--- a/shell/ash_test/ash-misc/sigint1.tests
+++ /dev/null
@@ -1,41 +0,0 @@
-# What should happen if non-interactive shell gets SIGINT?
-
-(sleep 1; echo Sending SIGINT to main shell PID; exec kill -INT $$) &
-
-# We create a child which exits with 0 even on SIGINT
-# (The complex command is necessary only if SIGINT is generated by ^C,
-# in this testcase even bare "sleep 2" would do because
-# in the testcase we don't send SIGINT *to the child*...)
-$THIS_SH -c 'trap "exit 0" SIGINT; sleep 2'
-
-# In one second, we (main shell) get SIGINT here.
-# The question is whether we should, or should not, exit.
-
-# bash will not stop here. It will execute next command(s).
-
-# The rationale for this is described here:
-# http://www.cons.org/cracauer/sigint.html
-#
-# Basically, bash will not exit on SIGINT immediately if it waits
-# for a child. It will wait for the child to exit.
-# If child exits NOT by dying on SIGINT, then bash will not exit.
-#
-# The idea is that the following script:
-# | emacs file.txt
-# | more cmds
-# User may use ^C to interrupt editor's ops like search. But then
-# emacs exits normally. User expects that script doesn't stop.
-#
-# This is a nice idea, but detecting "did process really exit
-# with SIGINT?" is racy. Consider:
-# | bash -c 'while true; do /bin/true; done'
-# When ^C is pressed while bash waits for /bin/true to exit,
-# it may happen that /bin/true exits with exitcode 0 before
-# ^C is delivered to it as SIGINT. bash will see SIGINT, then
-# it will see that child exited with 0, and bash will NOT EXIT.
-
-# Therefore we do not implement bash behavior.
-# I'd say that emacs need to put itself into a separate pgrp
-# to isolate shell from getting stray SIGINTs from ^C.
-
-echo Next command after SIGINT was executed
diff --git a/shell/ash_test/ash-misc/tickquote1.tests b/shell/ash_test/ash-misc/tickquote1.tests
index 90d5bbc9b..8416ad996 100755
--- a/shell/ash_test/ash-misc/tickquote1.tests
+++ b/shell/ash_test/ash-misc/tickquote1.tests
@@ -1 +1 @@
-echo `"pwd`
+echo _`"pwd`_
diff --git a/shell/ash_test/ash-misc/wait6.right b/shell/ash_test/ash-misc/wait6.right
new file mode 100644
index 000000000..12decc137
--- /dev/null
+++ b/shell/ash_test/ash-misc/wait6.right
@@ -0,0 +1,2 @@
+0
+3
diff --git a/shell/ash_test/ash-misc/wait6.tests b/shell/ash_test/ash-misc/wait6.tests
new file mode 100755
index 000000000..c23713199
--- /dev/null
+++ b/shell/ash_test/ash-misc/wait6.tests
@@ -0,0 +1,6 @@
+# In bash, "wait $!" extracts correct exitcode even if bg task has already exited
+# It prints 0, then 3:
+(sleep 0; exit 3) & sleep 1
+echo $?
+wait $!
+echo $?
diff --git a/shell/hush_test/hush-bugs/and_or_and_backgrounding.right b/shell/ash_test/ash-parsing/and_or_and_backgrounding.right
index 90ce63e01..90ce63e01 100644
--- a/shell/hush_test/hush-bugs/and_or_and_backgrounding.right
+++ b/shell/ash_test/ash-parsing/and_or_and_backgrounding.right
diff --git a/shell/hush_test/hush-bugs/and_or_and_backgrounding.tests b/shell/ash_test/ash-parsing/and_or_and_backgrounding.tests
index 05acfb863..204d44490 100755
--- a/shell/hush_test/hush-bugs/and_or_and_backgrounding.tests
+++ b/shell/ash_test/ash-parsing/and_or_and_backgrounding.tests
@@ -1,4 +1,3 @@
-# UNFIXED BUG: hush thinks that ; && || & have the same precedence.
 # According to this doc, && || have higher precedence than ; &.
 # See example below.
 # Precedence of ; is not a problem in practice. Precedence of & is.
diff --git a/shell/ash_test/ash-quoting/quoted_punct.right b/shell/ash_test/ash-quoting/quoted_punct.right
new file mode 100644
index 000000000..ab66c3ce0
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quoted_punct.right
@@ -0,0 +1,35 @@
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
diff --git a/shell/ash_test/ash-quoting/quoted_punct.tests b/shell/ash_test/ash-quoting/quoted_punct.tests
new file mode 100755
index 000000000..83ee40bf4
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quoted_punct.tests
@@ -0,0 +1,41 @@
+# Testing glob-escaping of every ASCII punctuation char
+# Some chars have more than one test
+# 21..2f
+case '!' in [\!] ) echo ok;; *) echo 'WRONG!';; esac
+case '"' in [\"] ) echo ok;; *) echo 'WRONG"';; esac
+case '#' in [\#] ) echo ok;; *) echo 'WRONG#';; esac
+case '$' in [\$] ) echo ok;; *) echo 'WRONG$';; esac
+case '%' in [\%] ) echo ok;; *) echo 'WRONG%';; esac
+case '&' in [\&] ) echo ok;; *) echo 'WRONG&';; esac
+case "'" in [\'] ) echo ok;; *) echo "WRONG'";; esac
+case '(' in [\(] ) echo ok;; *) echo 'WRONG(';; esac
+case ')' in [\)] ) echo ok;; *) echo 'WRONG)';; esac
+case '*' in [\*] ) echo ok;; *) echo 'WRONG*';; esac
+case '+' in [\+] ) echo ok;; *) echo 'WRONG+';; esac
+case ',' in [\,] ) echo ok;; *) echo 'WRONG,';; esac
+case '-' in [\-] ) echo ok;; *) echo 'WRONG-';; esac
+case '-' in [a\-c]) echo ok;; *) echo 'WRONGa\-c';; esac
+case '.' in [\.] ) echo ok;; *) echo 'WRONG.';; esac
+case '/' in [\/] ) echo ok;; *) echo 'WRONG/';; esac
+# 3a..40
+case ':' in [\:] ) echo ok;; *) echo 'WRONG:';; esac
+case ';' in [\;] ) echo ok;; *) echo 'WRONG;';; esac
+case '<' in [\<] ) echo ok;; *) echo 'WRONG<';; esac
+case '=' in [\=] ) echo ok;; *) echo 'WRONG=';; esac
+case '>' in [\>] ) echo ok;; *) echo 'WRONG>';; esac
+case '?' in [\?] ) echo ok;; *) echo 'WRONG?';; esac
+case '@' in [\@] ) echo ok;; *) echo 'WRONG@';; esac
+# 5b..60
+case '[' in [\[] ) echo ok;; *) echo 'WRONG[';; esac
+case '\' in [\\] ) echo ok;; *) echo 'WRONG\';; esac
+case '\' in \\ ) echo ok;; *) echo 'WRONG\\';; esac
+case ']' in [\]] ) echo ok;; *) echo 'WRONG]';; esac
+case ']' in [a\]]) echo ok;; *) echo 'WRONGa]';; esac
+case '^' in [\^] ) echo ok;; *) echo 'WRONG^';; esac
+case '_' in [\_] ) echo ok;; *) echo 'WRONG_';; esac
+case '`' in [\`] ) echo ok;; *) echo 'WRONG`';; esac
+# 7b..7e
+case '{' in [\{] ) echo ok;; *) echo 'WRONG{';; esac
+case '|' in [\|] ) echo ok;; *) echo 'WRONG|';; esac
+case '}' in [\}] ) echo ok;; *) echo 'WRONG}';; esac
+case '~' in [\~] ) echo ok;; *) echo 'WRONG~';; esac
diff --git a/shell/ash_test/ash-quoting/unicode_8x_chars.right b/shell/ash_test/ash-quoting/unicode_8x_chars.right
new file mode 100644
index 000000000..7780b88b4
--- /dev/null
+++ b/shell/ash_test/ash-quoting/unicode_8x_chars.right
@@ -0,0 +1,6 @@
+ok
+ok
+ok
+ok
+ok
+ok
diff --git a/shell/ash_test/ash-quoting/unicode_8x_chars.tests b/shell/ash_test/ash-quoting/unicode_8x_chars.tests
new file mode 100755
index 000000000..1258745ec
--- /dev/null
+++ b/shell/ash_test/ash-quoting/unicode_8x_chars.tests
@@ -0,0 +1,28 @@
+# Unicode: cf 80
+case π in
+( "π" ) echo ok ;;
+( * )   echo WRONG ;;
+esac
+# Unicode: cf 81
+case ρ in
+( "ρ" ) echo ok ;;
+( * )   echo WRONG ;;
+esac
+# Unicode: cf 82
+case ς in
+( "ς" ) echo ok ;;
+( * )   echo WRONG ;;
+esac
+
+case "π" in
+( π ) echo ok ;;
+( * ) echo WRONG ;;
+esac
+case "ρ" in
+( ρ ) echo ok ;;
+( * ) echo WRONG ;;
+esac
+case "ς" in
+( ς ) echo ok ;;
+( * ) echo WRONG ;;
+esac
diff --git a/shell/ash_test/ash-redir/redir5.right b/shell/ash_test/ash-redir/redir5.right
index 9d0877765..52cce4feb 100644
--- a/shell/ash_test/ash-redir/redir5.right
+++ b/shell/ash_test/ash-redir/redir5.right
@@ -1,2 +1,4 @@
-./redir5.tests: line 2: 10: Bad file descriptor
-OK
+Backgrounded pipes shall have their stdin redirected to /dev/null
+Zero:0
+Zero:0
+Done
diff --git a/shell/ash_test/ash-redir/redir5.tests b/shell/ash_test/ash-redir/redir5.tests
index 91b0c1ff9..957f9c81f 100755
--- a/shell/ash_test/ash-redir/redir5.tests
+++ b/shell/ash_test/ash-redir/redir5.tests
@@ -1,3 +1,13 @@
-# ash uses fd 10 (usually) for reading the script
-echo LOST >&10
-echo OK
+echo "Backgrounded pipes shall have their stdin redirected to /dev/null"
+
+# 1. bash does not redirect stdin to /dev/null if it is interactive.
+# hush does it always (this is allowed by standards).
+
+# 2. Failure will result in this script hanging
+
+cat & wait; echo Zero:$?
+
+# This does not work for bash! bash bug?
+cat | cat & wait; echo Zero:$?
+
+echo Done
diff --git a/shell/ash_test/ash-redir/redir_to_bad_fd.right b/shell/ash_test/ash-redir/redir_to_bad_fd.right
new file mode 100644
index 000000000..43b8af293
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_to_bad_fd.right
@@ -0,0 +1,2 @@
+./redir_to_bad_fd.tests: line 2: 10: Bad file descriptor
+OK
diff --git a/shell/ash_test/ash-redir/redir_to_bad_fd.tests b/shell/ash_test/ash-redir/redir_to_bad_fd.tests
new file mode 100755
index 000000000..91b0c1ff9
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_to_bad_fd.tests
@@ -0,0 +1,3 @@
+# ash uses fd 10 (usually) for reading the script
+echo LOST >&10
+echo OK
diff --git a/shell/ash_test/ash-vars/var-utf8-length.tests b/shell/ash_test/ash-vars/var-utf8-length.tests
index d04b2cbb6..b6e87f191 100755
--- a/shell/ash_test/ash-vars/var-utf8-length.tests
+++ b/shell/ash_test/ash-vars/var-utf8-length.tests
@@ -1,2 +1,4 @@
+LANG=en_US.UTF-8
+LC_ALL=en_US.UTF-8
 X=abcdÉfghÍjklmnÓpqrstÚvwcyz
 echo ${#X}
diff --git a/shell/ash_test/ash-vars/var_bash1a.tests b/shell/ash_test/ash-vars/var_bash1a.tests
index 551dd9acc..c75c2dc53 100755
--- a/shell/ash_test/ash-vars/var_bash1a.tests
+++ b/shell/ash_test/ash-vars/var_bash1a.tests
@@ -5,7 +5,7 @@ echo "parameter     '${parameter}'"
 echo "varoffset2    '${parameter:${offset}}'"
 echo "varoffset-2   '${parameter:${noffset}}'"
 echo "literal '2'   '${parameter:2}'"
-# This is not inrpreted as ${VAR:POS{:LEN}},
+# This is not interpreted as ${VAR:POS{:LEN}},
 # but as ${VAR:=WORD} - if VAR is unset or null, substitute WORD
 echo "literal '-2'  '${parameter:-2}'"
 echo "literal ' -2' '${parameter: -2}'"
diff --git a/shell/ash_test/ash-vars/var_bash1b.right b/shell/ash_test/ash-vars/var_bash1b.right
new file mode 100644
index 000000000..fafc0f07c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash1b.right
@@ -0,0 +1,23 @@
+all    |0123456
+4:     |456
+4:2    |45
+4:-1   |45
+4:-2   |4
+4:-3   |
+-4:    |3456
+-4:2   |34
+-4:-1  |345
+-4:-2  |34
+-4:-3  |3
+-4:-4  |
+-4:i=2 |34
+-4:i=-2|34
+-4:i=-3|3
+-4:i=-4|
+-5:    |23456
+-6:    |123456
+-7:    |0123456
+-8:    |
+-9:    |
+-9:-99 |
+Ok:0
diff --git a/shell/ash_test/ash-vars/var_bash1b.tests b/shell/ash_test/ash-vars/var_bash1b.tests
new file mode 100755
index 000000000..efbdef35c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash1b.tests
@@ -0,0 +1,24 @@
+set -- 0123456
+        echo "all    |"$1
+        echo "4:     |"${1:4}
+        echo "4:2    |"${1:4:2}
+        echo "4:-1   |"${1:4:-1}
+        echo "4:-2   |"${1:4:-2}
+        echo "4:-3   |"${1:4:-3}
+        echo "-4:    |"${1: -4}
+        echo "-4:2   |"${1: -4:2}
+        echo "-4:-1  |"${1: -4:-1}
+        echo "-4:-2  |"${1: -4:-2}
+        echo "-4:-3  |"${1: -4:-3}
+        echo "-4:-4  |"${1: -4:-4}
+i=2;    echo "-4:i=2 |"${1: -4:i}
+i=-2;   echo "-4:i=-2|"${1: -4:i}
+i=-3;   echo "-4:i=-3|"${1: -4:i}
+i=-4;   echo "-4:i=-4|"${1: -4:i}
+        echo "-5:    |"${1: -5}
+        echo "-6:    |"${1: -6}
+        echo "-7:    |"${1: -7}
+        echo "-8:    |"${1: -8}
+        echo "-9:    |"${1: -9}
+        echo "-9:-99 |"${1: -9:-99}
+echo Ok:$?
diff --git a/shell/ash_test/ash-vars/var_bash6.right b/shell/ash_test/ash-vars/var_bash6.right
new file mode 100644
index 000000000..63fc23df8
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash6.right
@@ -0,0 +1,5 @@
+Expected Actual
+a*z    : a*z
+\z     : \z
+a1z a2z: a1z a2z
+z      : z
diff --git a/shell/ash_test/ash-vars/var_bash6.tests b/shell/ash_test/ash-vars/var_bash6.tests
new file mode 100755
index 000000000..cf2e4f020
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash6.tests
@@ -0,0 +1,9 @@
+# This testcase checks globbing correctness in ${v/a/b}
+
+>a1z; >a2z;
+          echo 'Expected' 'Actual'
+v='a bz'; echo 'a*z    :' "${v/a*z/a*z}"
+v='a bz'; echo '\z     :' "${v/a*z/\z}"
+v='a bz'; echo 'a1z a2z:' ${v/a*z/a*z}
+v='a bz'; echo 'z      :' ${v/a*z/\z}
+rm a1z a2z
diff --git a/shell/ash_test/run-all b/shell/ash_test/run-all
index 354cc1fcf..983e6d184 100755
--- a/shell/ash_test/run-all
+++ b/shell/ash_test/run-all
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-TOPDIR=$PWD
+TOPDIR=`pwd`
 
 test -x ash || {
     echo "No ./ash - creating a link to ../../busybox"
@@ -10,67 +10,73 @@ test -x printenv || gcc -O2 -o printenv printenv.c || exit $?
 test -x recho    || gcc -O2 -o recho    recho.c    || exit $?
 test -x zecho    || gcc -O2 -o zecho    zecho.c    || exit $?
 
-PATH="$PWD:$PATH" # for ash and recho/zecho/printenv
+PATH="`pwd`:$PATH" # for ash and recho/zecho/printenv
 export PATH
 
-THIS_SH="$PWD/ash"
+THIS_SH="`pwd`/ash"
 export THIS_SH
 
 do_test()
 {
-    test -d "$1" || return 0
-#   echo do_test "$1"
-    # $1 but with / replaced by # so that it can be used as filename part
-    noslash=`echo "$1" | sed 's:/:#:g'`
-    (
-    cd "$1" || { echo "cannot cd $1!"; exit 1; }
-    for x in run-*; do
-        test -f "$x" || continue
-        case "$x" in
-            "$0"|run-minimal|run-gprof) ;;
-            *.orig|*~) ;;
-            #*) echo $x ; sh $x ;;
-            *)
-            echo -n "$1/$x: "
-            sh "$x" >"$TOPDIR/$noslash-$x.fail" 2>&1 && \
-            { echo "ok"; rm "$TOPDIR/$noslash-$x.fail"; } || echo "fail";
-            ;;
-        esac
-    done
-    # Many bash run-XXX scripts just do this,
-    # no point in duplication it all over the place
-    for x in *.tests; do
-        test -x "$x" || continue
-        name="${x%%.tests}"
-        test -f "$name.right" || continue
-        echo -n "$1/$x: "
-        {
-            "$THIS_SH" "./$x" >"$name.xx" 2>&1
-            diff -u "$name.xx" "$name.right" >"$TOPDIR/$noslash-$x.fail" \
-            && rm -f "$name.xx" "$TOPDIR/$noslash-$x.fail"
-        } && echo "ok" || echo "fail"
-    done
-    )
+        test -d "$1" || return 0
+        d=${d%/}
+#       echo Running tests in directory "$1"
+        # $1 but with / replaced by # so that it can be used as filename part
+        noslash=`echo "$1" | sed 's:/:#:g'`
+        (
+        cd "$1" || { echo "cannot cd $1!"; exit 1; }
+        for x in run-*; do
+                test -f "$x" || continue
+                case "$x" in
+                        "$0"|run-minimal|run-gprof) ;;
+                        *.orig|*~) ;;
+                        #*) echo $x ; sh $x ;;
+                        *)
+                        echo -n "$1/$x:"
+                        sh "$x" >"$TOPDIR/$noslash-$x.fail" 2>&1 && \
+                        { { echo " ok"; rm "$TOPDIR/$noslash-$x.fail"; } || echo " fail"; }
+                        ;;
+                esac
+        done
+        # Many bash run-XXX scripts just do this,
+        # no point in duplication it all over the place
+        for x in *.tests; do
+                test -x "$x" || continue
+                name="${x%%.tests}"
+                test -f "$name.right" || continue
+#               echo Running test: "$x"
+                echo -n "$1/$x:"
+                {
+                        "$THIS_SH" "./$x" >"$name.xx" 2>&1
+                        diff -u "$name.xx" "$name.right" >"$TOPDIR/$noslash-$x.fail" \
+                        && rm -f "$name.xx" "$TOPDIR/$noslash-$x.fail"
+                } && echo " ok" || echo " fail"
+                done
+        )
 }
 
-# main part of this script
+# Main part of this script
 # Usage: run-all [directories]
 
+ret=0
+
 if [ $# -lt 1 ]; then
-    # All sub directories
-    modules=`ls -d ash-*`
-    # If you want to test ash against hush and msh testsuites
-    # (have to copy hush_test and msh_test dirs to current dir first):
-    #modules=`ls -d ash-* hush_test/hush-* msh_test/msh-*`
+        # All sub directories
+        modules=`ls -d ash-*`
+        # If you want to test ash against hush testsuite
+        # (have to copy hush_test dir to current dir first):
+        #modules=`ls -d ash-* hush_test/hush-*`
 
-    for module in $modules; do
-        do_test $module
-    done
+        for module in $modules; do
+                do_test $module || ret=1
+        done
 else
-    while [ $# -ge 1 ]; do
+        while [ $# -ge 1 ]; do
         if [ -d $1 ]; then
-            do_test $1
+                do_test $1 || ret=1
         fi
         shift
-    done
+        done
 fi
+
+exit ${ret}
diff --git a/shell/hush.c b/shell/hush.c
index 125463a56..f6da826d3 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -41,14 +41,28 @@
  *
  * TODOs:
  *      grep for "TODO" and fix (some of them are easy)
+ *      make complex ${var%...} constructs support optional
+ *      make here documents optional
  *      special variables (done: PWD, PPID, RANDOM)
+ *      follow IFS rules more precisely, including update semantics
  *      tilde expansion
  *      aliases
- *      follow IFS rules more precisely, including update semantics
  *      builtins mandated by standards we don't support:
- *          [un]alias, command, fc, getopts, newgrp, readonly, times
- *      make complex ${var%...} constructs support optional
- *      make here documents optional
+ *          [un]alias, command, fc, getopts, times:
+ *          command -v CMD: print "/path/to/CMD"
+ *              prints "CMD" for builtins
+ *              prints "alias ALIAS='EXPANSION'" for aliases
+ *              prints nothing and sets $? to 1 if not found
+ *          command -V CMD: print "CMD is /path/CMD|a shell builtin|etc"
+ *          command [-p] CMD: run CMD, even if a function CMD also exists
+ *              (can use this to override standalone shell as well)
+ *              -p: use default $PATH
+ *          command BLTIN: disables special-ness (e.g. errors do not abort)
+ *          getopts: getopt() for shells
+ *          times: print getrusage(SELF/CHILDREN).ru_utime/ru_stime
+ *          fc -l[nr] [BEG] [END]: list range of commands in history
+ *          fc [-e EDITOR] [BEG] [END]: edit/rerun range of commands
+ *          fc -s [PAT=REP] [CMD]: rerun CMD, replacing PAT with REP
  *
  * Bash compat TODO:
  *      redirection of stdout+stderr: &> and >&
@@ -64,8 +78,13 @@
  *          The EXPR is evaluated according to ARITHMETIC EVALUATION.
  *          This is exactly equivalent to let "EXPR".
  *      $[EXPR]: synonym for $((EXPR))
+ *      indirect expansion: ${!VAR}
+ *      substring op on @: ${@:n:m}
  *
  * Won't do:
+ *      Some builtins mandated by standards:
+ *          newgrp [GRP]: not a builtin in bash but a suid binary
+ *              which spawns a new shell with new group ID
  *      In bash, export builtin is special, its arguments are assignments
  *          and therefore expansion of them should be "one-word" expansion:
  *              $ export i=`echo 'a  b'` # export has one arg: "i=a  b"
@@ -219,6 +238,13 @@
 //config:       help
 //config:         export -n unexports variables. It is a bash extension.
 //config:
+//config:config HUSH_READONLY
+//config:       bool "readonly builtin"
+//config:       default y
+//config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
+//config:       help
+//config:         Enable support for read-only variables.
+//config:
 //config:config HUSH_KILL
 //config:       bool "kill builtin (supports kill %jobspec)"
 //config:       default y
@@ -268,17 +294,9 @@
 //config:       bool "memleak builtin (debugging)"
 //config:       default n
 //config:       depends on HUSH || SH_IS_HUSH || BASH_IS_HUSH
-//config:
-//config:config MSH
-//config:       bool "msh (deprecated: aliased to hush)"
-//config:       default n
-//config:       select HUSH
-//config:       help
-//config:         msh is deprecated and will be removed, please migrate to hush.
 
 //applet:IF_HUSH(APPLET(hush, BB_DIR_BIN, BB_SUID_DROP))
 //                       APPLET_ODDNAME:name  main  location    suid_type     help
-//applet:IF_MSH(         APPLET_ODDNAME(msh,  hush, BB_DIR_BIN, BB_SUID_DROP, hush))
 //applet:IF_SH_IS_HUSH(  APPLET_ODDNAME(sh,   hush, BB_DIR_BIN, BB_SUID_DROP, hush))
 //applet:IF_BASH_IS_HUSH(APPLET_ODDNAME(bash, hush, BB_DIR_BIN, BB_SUID_DROP, hush))
 
@@ -293,7 +311,7 @@
  * therefore we don't show them either.
  */
 //usage:#define hush_trivial_usage
-//usage:        "[-nxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
+//usage:        "[-enxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
 //usage:#define hush_full_usage "\n\n"
 //usage:        "Unix shell interpreter"
 
@@ -331,9 +349,9 @@
 /* Separate defines document which part of code implements what */
 #define BASH_PATTERN_SUBST ENABLE_HUSH_BASH_COMPAT
 #define BASH_SUBSTR        ENABLE_HUSH_BASH_COMPAT
-#define BASH_TEST2         ENABLE_HUSH_BASH_COMPAT
 #define BASH_SOURCE        ENABLE_HUSH_BASH_COMPAT
 #define BASH_HOSTNAME_VAR  ENABLE_HUSH_BASH_COMPAT
+#define BASH_TEST2         (ENABLE_HUSH_BASH_COMPAT && ENABLE_HUSH_TEST)
 
 
 /* Build knobs */
@@ -410,6 +428,7 @@
 #define debug_printf_expand(...) do {} while (0)
 #define debug_printf_varexp(...) do {} while (0)
 #define debug_printf_glob(...)   do {} while (0)
+#define debug_printf_redir(...)  do {} while (0)
 #define debug_printf_list(...)   do {} while (0)
 #define debug_printf_subst(...)  do {} while (0)
 #define debug_printf_clean(...)  do {} while (0)
@@ -753,6 +772,7 @@ struct function {
 static const char o_opt_strings[] ALIGN1 =
         "pipefail\0"
         "noexec\0"
+        "errexit\0"
 #if ENABLE_HUSH_MODE_X
         "xtrace\0"
 #endif
@@ -760,6 +780,7 @@ static const char o_opt_strings[] ALIGN1 =
 enum {
         OPT_O_PIPEFAIL,
         OPT_O_NOEXEC,
+        OPT_O_ERREXIT,
 #if ENABLE_HUSH_MODE_X
         OPT_O_XTRACE,
 #endif
@@ -816,6 +837,25 @@ struct globals {
 #else
 # define G_saved_tty_pgrp 0
 #endif
+        /* How deeply are we in context where "set -e" is ignored */
+        int errexit_depth;
+        /* "set -e" rules (do we follow them correctly?):
+         * Exit if pipe, list, or compound command exits with a non-zero status.
+         * Shell does not exit if failed command is part of condition in
+         * if/while, part of && or || list except the last command, any command
+         * in a pipe but the last, or if the command's return value is being
+         * inverted with !. If a compound command other than a subshell returns a
+         * non-zero status because a command failed while -e was being ignored, the
+         * shell does not exit. A trap on ERR, if set, is executed before the shell
+         * exits [ERR is a bashism].
+         *
+         * If a compound command or function executes in a context where -e is
+         * ignored, none of the commands executed within are affected by the -e
+         * setting. If a compound command or function sets -e while executing in a
+         * context where -e is ignored, that setting does not have any effect until
+         * the compound command or the command containing the function call completes.
+         */
+
         char o_opt[NUM_OPT_O];
 #if ENABLE_HUSH_MODE_X
 # define G_x_mode (G.o_opt[OPT_O_XTRACE])
@@ -839,6 +879,7 @@ struct globals {
         smallint exiting; /* used to prevent EXIT trap recursion */
         /* These four support $?, $#, and $1 */
         smalluint last_exitcode;
+        smalluint last_bg_pid_exitcode;
 #if ENABLE_HUSH_SET
         /* are global_argv and global_argv[1..n] malloced? (note: not [0]) */
         smalluint global_args_malloced;
@@ -929,6 +970,9 @@ static int builtin_exit(char **argv) FAST_FUNC;
 #if ENABLE_HUSH_EXPORT
 static int builtin_export(char **argv) FAST_FUNC;
 #endif
+#if ENABLE_HUSH_READONLY
+static int builtin_readonly(char **argv) FAST_FUNC;
+#endif
 #if ENABLE_HUSH_JOB
 static int builtin_fg_bg(char **argv) FAST_FUNC;
 static int builtin_jobs(char **argv) FAST_FUNC;
@@ -1047,6 +1091,9 @@ static const struct built_in_command bltins1[] = {
 #if ENABLE_HUSH_READ
         BLTIN("read"     , builtin_read    , "Input into variable"),
 #endif
+#if ENABLE_HUSH_READONLY
+        BLTIN("readonly" , builtin_readonly, "Make variables read-only"),
+#endif
 #if ENABLE_HUSH_FUNCTIONS
         BLTIN("return"   , builtin_return  , "Return from function"),
 #endif
@@ -1154,6 +1201,10 @@ static const struct built_in_command bltins2[] = {
 # define DEBUG_GLOB 0
 #endif
 
+#ifndef debug_printf_redir
+# define debug_printf_redir(...) (indent(), fdprintf(2, __VA_ARGS__))
+#endif
+
 #ifndef debug_printf_list
 # define debug_printf_list(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
@@ -1389,12 +1440,30 @@ static void free_strings(char **strings)
         free(strings);
 }
 
+static int fcntl_F_DUPFD(int fd, int avoid_fd)
+{
+        int newfd;
+ repeat:
+        newfd = fcntl(fd, F_DUPFD, avoid_fd + 1);
+        if (newfd < 0) {
+                if (errno == EBUSY)
+                        goto repeat;
+                if (errno == EINTR)
+                        goto repeat;
+        }
+        return newfd;
+}
 
-static int xdup_and_close(int fd, int F_DUPFD_maybe_CLOEXEC)
+static int xdup_and_close(int fd, int F_DUPFD_maybe_CLOEXEC, int avoid_fd)
 {
-        /* We avoid taking stdio fds. Mimicking ash: use fds above 9 */
-        int newfd = fcntl(fd, F_DUPFD_maybe_CLOEXEC, 10);
+        int newfd;
+ repeat:
+        newfd = fcntl(fd, F_DUPFD_maybe_CLOEXEC, avoid_fd + 1);
         if (newfd < 0) {
+                if (errno == EBUSY)
+                        goto repeat;
+                if (errno == EINTR)
+                        goto repeat;
                 /* fd was not open? */
                 if (errno == EBADF)
                         return fd;
@@ -1432,13 +1501,14 @@ static void fclose_and_forget(FILE *fp)
         }
         fclose(fp);
 }
-static int save_FILEs_on_redirect(int fd)
+static int save_FILEs_on_redirect(int fd, int avoid_fd)
 {
         struct FILE_list *fl = G.FILE_list;
         while (fl) {
                 if (fd == fl->fd) {
                         /* We use it only on script files, they are all CLOEXEC */
-                        fl->fd = xdup_and_close(fd, F_DUPFD_CLOEXEC);
+                        fl->fd = xdup_and_close(fd, F_DUPFD_CLOEXEC, avoid_fd);
+                        debug_printf_redir("redirect_fd %d: matches a script fd, moving it to %d\n", fd, fl->fd);
                         return 1;
                 }
                 fl = fl->next;
@@ -1451,13 +1521,14 @@ static void restore_redirected_FILEs(void)
         while (fl) {
                 int should_be = fileno(fl->fp);
                 if (fl->fd != should_be) {
+                        debug_printf_redir("restoring script fd from %d to %d\n", fl->fd, should_be);
                         xmove_fd(fl->fd, should_be);
                         fl->fd = should_be;
                 }
                 fl = fl->next;
         }
 }
-#if ENABLE_FEATURE_SH_STANDALONE
+#if ENABLE_FEATURE_SH_STANDALONE && BB_MMU
 static void close_all_FILE_list(void)
 {
         struct FILE_list *fl = G.FILE_list;
@@ -1486,8 +1557,6 @@ typedef struct save_arg_t {
 
 static void save_and_replace_G_args(save_arg_t *sv, char **argv)
 {
-        int n;
-
         sv->sv_argv0 = argv[0];
         sv->sv_g_argv = G.global_argv;
         sv->sv_g_argc = G.global_argc;
@@ -1497,10 +1566,7 @@ static void save_and_replace_G_args(save_arg_t *sv, char **argv)
         G.global_argv = argv;
         IF_HUSH_SET(G.global_args_malloced = 0;)
 
-        n = 1;
-        while (*++argv)
-                n++;
-        G.global_argc = n;
+        G.global_argc = 1 + string_array_len(argv + 1);
 }
 
 static void restore_G_args(save_arg_t *sv, char **argv)
@@ -1991,32 +2057,19 @@ static const char* FAST_FUNC get_local_var_value(const char *name)
 
 /* str holds "NAME=VAL" and is expected to be malloced.
  * We take ownership of it.
- * flg_export:
- *  0: do not change export flag
- *     (if creating new variable, flag will be 0)
- *  1: set export flag and putenv the variable
- * -1: clear export flag and unsetenv the variable
- * flg_read_only is set only when we handle -R var=val
  */
-#if !BB_MMU && ENABLE_HUSH_LOCAL
-/* all params are used */
-#elif BB_MMU && ENABLE_HUSH_LOCAL
-#define set_local_var(str, flg_export, local_lvl, flg_read_only) \
-        set_local_var(str, flg_export, local_lvl)
-#elif BB_MMU && !ENABLE_HUSH_LOCAL
-#define set_local_var(str, flg_export, local_lvl, flg_read_only) \
-        set_local_var(str, flg_export)
-#elif !BB_MMU && !ENABLE_HUSH_LOCAL
-#define set_local_var(str, flg_export, local_lvl, flg_read_only) \
-        set_local_var(str, flg_export, flg_read_only)
-#endif
-static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_only)
+#define SETFLAG_EXPORT   (1 << 0)
+#define SETFLAG_UNEXPORT (1 << 1)
+#define SETFLAG_MAKE_RO  (1 << 2)
+#define SETFLAG_LOCAL_SHIFT    3
+static int set_local_var(char *str, unsigned flags)
 {
         struct variable **var_pp;
         struct variable *cur;
         char *free_me = NULL;
         char *eq_sign;
         int name_len;
+        IF_HUSH_LOCAL(unsigned local_lvl = (flags >> SETFLAG_LOCAL_SHIFT);)
 
         eq_sign = strchr(str, '=');
         if (!eq_sign) { /* not expected to ever happen? */
@@ -2034,14 +2087,13 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
 
                 /* We found an existing var with this name */
                 if (cur->flg_read_only) {
-#if !BB_MMU
-                        if (!flg_read_only)
-#endif
-                                bb_error_msg("%s: readonly variable", str);
+                        bb_error_msg("%s: readonly variable", str);
                         free(str);
+//NOTE: in bash, assignment in "export READONLY_VAR=Z" fails, and sets $?=1,
+//but export per se succeeds (does put the var in env). We don't mimic that.
                         return -1;
                 }
-                if (flg_export == -1) { // "&& cur->flg_export" ?
+                if (flags & SETFLAG_UNEXPORT) { // && cur->flg_export ?
                         debug_printf_env("%s: unsetenv '%s'\n", __func__, str);
                         *eq_sign = '\0';
                         unsetenv(str);
@@ -2065,7 +2117,7 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
                          * z=z
                          */
                         if (cur->flg_export)
-                                flg_export = 1;
+                                flags |= SETFLAG_EXPORT;
                         break;
                 }
 #endif
@@ -2096,24 +2148,24 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
 
         /* Not found - create new variable struct */
         cur = xzalloc(sizeof(*cur));
-#if ENABLE_HUSH_LOCAL
-        cur->func_nest_level = local_lvl;
-#endif
+        IF_HUSH_LOCAL(cur->func_nest_level = local_lvl;)
         cur->next = *var_pp;
         *var_pp = cur;
 
  set_str_and_exp:
         cur->varstr = str;
-#if !BB_MMU
-        cur->flg_read_only = flg_read_only;
-#endif
  exp:
-        if (flg_export == 1)
+#if !BB_MMU || ENABLE_HUSH_READONLY
+        if (flags & SETFLAG_MAKE_RO) {
+                cur->flg_read_only = 1;
+        }
+#endif
+        if (flags & SETFLAG_EXPORT)
                 cur->flg_export = 1;
         if (name_len == 4 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
                 cmdedit_update_prompt();
         if (cur->flg_export) {
-                if (flg_export == -1) {
+                if (flags & SETFLAG_UNEXPORT) {
                         cur->flg_export = 0;
                         /* unsetenv was already done */
                 } else {
@@ -2130,10 +2182,9 @@ static int set_local_var(char *str, int flg_export, int local_lvl, int flg_read_
 }
 
 /* Used at startup and after each cd */
-static void set_pwd_var(int exp)
+static void set_pwd_var(unsigned flag)
 {
-        set_local_var(xasprintf("PWD=%s", get_cwd(/*force:*/ 1)),
-                /*exp:*/ exp, /*lvl:*/ 0, /*ro:*/ 0);
+        set_local_var(xasprintf("PWD=%s", get_cwd(/*force:*/ 1)), flag);
 }
 
 static int unset_local_var_len(const char *name, int name_len)
@@ -2191,7 +2242,7 @@ static void unset_vars(char **strings)
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
         char *var = xasprintf("%s=%s", name, val);
-        set_local_var(var, /*flags:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
+        set_local_var(var, /*flag:*/ 0);
 }
 #endif
 
@@ -2234,16 +2285,32 @@ static struct variable *set_vars_and_save_old(char **strings)
                 if (eq) {
                         var_pp = get_ptr_to_local_var(*s, eq - *s);
                         if (var_pp) {
-                                /* Remove variable from global linked list */
                                 var_p = *var_pp;
+                                if (var_p->flg_read_only) {
+                                        char **p;
+                                        bb_error_msg("%s: readonly variable", *s);
+                                        /*
+                                         * "VAR=V BLTIN" unsets VARs after BLTIN completes.
+                                         * If VAR is readonly, leaving it in the list
+                                         * after asssignment error (msg above)
+                                         * causes doubled error message later, on unset.
+                                         */
+                                        debug_printf_env("removing/freeing '%s' element\n", *s);
+                                        free(*s);
+                                        p = s;
+                                        do { *p = p[1]; p++; } while (*p);
+                                        goto next;
+                                }
+                                /* Remove variable from global linked list */
                                 debug_printf_env("%s: removing '%s'\n", __func__, var_p->varstr);
                                 *var_pp = var_p->next;
                                 /* Add it to returned list */
                                 var_p->next = old;
                                 old = var_p;
                         }
-                        set_local_var(*s, /*exp:*/ 1, /*lvl:*/ 0, /*ro:*/ 0);
+                        set_local_var(*s, SETFLAG_EXPORT);
                 }
+ next:
                 s++;
         }
         return old;
@@ -3339,12 +3406,49 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
         debug_printf_parse("done_pipe entered, followup %d\n", type);
         /* Close previous command */
         not_null = done_command(ctx);
-        ctx->pipe->followup = type;
 #if HAS_KEYWORDS
         ctx->pipe->pi_inverted = ctx->ctx_inverted;
         ctx->ctx_inverted = 0;
         ctx->pipe->res_word = ctx->ctx_res_w;
 #endif
+        if (type == PIPE_BG && ctx->list_head != ctx->pipe) {
+                /* Necessary since && and || have precedence over &:
+                 * "cmd1 && cmd2 &" must spawn both cmds, not only cmd2,
+                 * in a backgrounded subshell.
+                 */
+                struct pipe *pi;
+                struct command *command;
+
+                /* Is this actually this construct, all pipes end with && or ||? */
+                pi = ctx->list_head;
+                while (pi != ctx->pipe) {
+                        if (pi->followup != PIPE_AND && pi->followup != PIPE_OR)
+                                goto no_conv;
+                        pi = pi->next;
+                }
+
+                debug_printf_parse("BG with more than one pipe, converting to { p1 &&...pN; } &\n");
+                pi->followup = PIPE_SEQ; /* close pN _not_ with "&"! */
+                pi = xzalloc(sizeof(*pi));
+                pi->followup = PIPE_BG;
+                pi->num_cmds = 1;
+                pi->cmds = xzalloc(sizeof(pi->cmds[0]));
+                command = &pi->cmds[0];
+                if (CMD_NORMAL != 0) /* "if xzalloc didn't do that already" */
+                        command->cmd_type = CMD_NORMAL;
+                command->group = ctx->list_head;
+#if !BB_MMU
+                command->group_as_string = xstrndup(
+                            ctx->as_string.data,
+                            ctx->as_string.length - 1 /* do not copy last char, "&" */
+                );
+#endif
+                /* Replace all pipes in ctx with one newly created */
+                ctx->list_head = ctx->pipe = pi;
+        } else {
+ no_conv:
+                ctx->pipe->followup = type;
+        }
 
         /* Without this check, even just <enter> on command line generates
          * tree of three NOPs (!). Which is harmless but annoying.
@@ -3514,9 +3618,8 @@ static int reserved_word(o_string *word, struct parse_context *ctx)
         if (r->flag & FLAG_START) {
                 struct parse_context *old;
 
-                old = xmalloc(sizeof(*old));
+                old = xmemdup(ctx, sizeof(*ctx));
                 debug_printf_parse("push stack %p\n", old);
-                *old = *ctx;   /* physical copy */
                 initialize_context(ctx);
                 ctx->stack = old;
         } else if (/*ctx->ctx_res_w == RES_NONE ||*/ !(ctx->old_flag & (1 << r->res))) {
@@ -4787,7 +4890,9 @@ static struct pipe *parse_stream(char **pstring,
                                          * Really, ask yourself, why
                                          * "cmd && <newline>" doesn't start
                                          * cmd but waits for more input?
-                                         * No reason...)
+                                         * The only reason is that it might be
+                                         * a "cmd1 && <nl> cmd2 &" construct,
+                                         * cmd1 may need to run in BG).
                                          */
                                         struct pipe *pi = ctx.list_head;
                                         if (pi->num_cmds != 0       /* check #1 */
@@ -5146,7 +5251,7 @@ static struct pipe *parse_stream(char **pstring,
                          * and it will match } earlier (not here). */
                         syntax_error_unexpected_ch(ch);
                         G.last_exitcode = 2;
-                        goto parse_error1;
+                        goto parse_error2;
                 default:
                         if (HUSH_DEBUG)
                                 bb_error_msg_and_die("BUG: unexpected %c\n", ch);
@@ -5155,7 +5260,7 @@ static struct pipe *parse_stream(char **pstring,
 
  parse_error:
         G.last_exitcode = 1;
- parse_error1:
+ parse_error2:
         {
                 struct parse_context *pctx;
                 IF_HAS_KEYWORDS(struct parse_context *p2;)
@@ -5202,7 +5307,7 @@ static struct pipe *parse_stream(char **pstring,
 /*** Execution routines ***/
 
 /* Expansion can recurse, need forward decls: */
-#if !BASH_PATTERN_SUBST
+#if !BASH_PATTERN_SUBST && !ENABLE_HUSH_CASE
 /* only ${var/pattern/repl} (its pattern part) needs additional mode */
 #define expand_string_to_string(str, do_unbackslash) \
         expand_string_to_string(str)
@@ -5330,6 +5435,9 @@ static int expand_on_ifs(int *ended_with_ifs, o_string *output, int n, const cha
 #endif
 static char *encode_then_expand_string(const char *str, int process_bkslash, int do_unbackslash)
 {
+#if !BASH_PATTERN_SUBST
+        const int do_unbackslash = 1;
+#endif
         char *exp_str;
         struct in_str input;
         o_string dest = NULL_O_STRING;
@@ -5628,27 +5736,34 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                         if (errmsg)
                                 goto arith_err;
                         debug_printf_varexp("len:'%s'=%lld\n", exp_word, (long long)len);
-                        if (len >= 0) { /* bash compat: len < 0 is illegal */
-                                if (beg < 0) /* bash compat */
-                                        beg = 0;
-                                debug_printf_varexp("from val:'%s'\n", val);
-                                if (len == 0 || !val || beg >= strlen(val)) {
+                        if (beg < 0) {
+                                /* negative beg counts from the end */
+                                beg = (arith_t)strlen(val) + beg;
+                                if (beg < 0) /* ${v: -999999} is "" */
+                                        beg = len = 0;
+                        }
+                        debug_printf_varexp("from val:'%s'\n", val);
+                        if (len < 0) {
+                                /* in bash, len=-n means strlen()-n */
+                                len = (arith_t)strlen(val) - beg + len;
+                                if (len < 0) /* bash compat */
+                                        die_if_script("%s: substring expression < 0", var);
+                        }
+                        if (len <= 0 || !val || beg >= strlen(val)) {
  arith_err:
-                                        val = NULL;
-                                } else {
-                                        /* Paranoia. What if user entered 9999999999999
-                                         * which fits in arith_t but not int? */
-                                        if (len >= INT_MAX)
-                                                len = INT_MAX;
-                                        val = to_be_freed = xstrndup(val + beg, len);
-                                }
-                                debug_printf_varexp("val:'%s'\n", val);
-                        } else
-#endif /* HUSH_SUBSTR_EXPANSION && FEATURE_SH_MATH */
-                        {
-                                die_if_script("malformed ${%s:...}", var);
                                 val = NULL;
+                        } else {
+                                /* Paranoia. What if user entered 9999999999999
+                                 * which fits in arith_t but not int? */
+                                if (len >= INT_MAX)
+                                        len = INT_MAX;
+                                val = to_be_freed = xstrndup(val + beg, len);
                         }
+                        debug_printf_varexp("val:'%s'\n", val);
+#else /* not (HUSH_SUBSTR_EXPANSION && FEATURE_SH_MATH) */
+                        die_if_script("malformed ${%s:...}", var);
+                        val = NULL;
+#endif
                 } else { /* one of "-=+?" */
                         /* Standard-mandated substitution ops:
                          * ${var?word} - indicate error if unset
@@ -5700,7 +5815,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                                 val = NULL;
                                         } else {
                                                 char *new_var = xasprintf("%s=%s", var, val);
-                                                set_local_var(new_var, /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
+                                                set_local_var(new_var, /*flag:*/ 0);
                                         }
                                 }
                         }
@@ -5949,7 +6064,7 @@ static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
  */
 static char *expand_string_to_string(const char *str, int do_unbackslash)
 {
-#if !BASH_PATTERN_SUBST
+#if !BASH_PATTERN_SUBST && !ENABLE_HUSH_CASE
         const int do_unbackslash = 1;
 #endif
         char *argv[2], **list;
@@ -5982,7 +6097,7 @@ static char *expand_string_to_string(const char *str, int do_unbackslash)
         return (char*)list;
 }
 
-/* Used for "eval" builtin */
+/* Used for "eval" builtin and case string */
 static char* expand_strvec_to_string(char **argv)
 {
         char **list;
@@ -6524,77 +6639,108 @@ static void setup_heredoc(struct redir_struct *redir)
         wait(NULL); /* wait till child has died */
 }
 
-/* fd: redirect wants this fd to be used (e.g. 3>file).
- * Move all conflicting internally used fds,
- * and remember them so that we can restore them later.
- */
-static int save_fds_on_redirect(int fd, int squirrel[3])
+struct squirrel {
+        int orig_fd;
+        int moved_to;
+        /* moved_to = n: fd was moved to n; restore back to orig_fd after redir */
+        /* moved_to = -1: fd was opened by redirect; close orig_fd after redir */
+};
+
+static struct squirrel *add_squirrel(struct squirrel *sq, int fd, int avoid_fd)
 {
-        if (squirrel) {
-                /* Handle redirects of fds 0,1,2 */
+        int i = 0;
 
-                /* If we collide with an already moved stdio fd... */
-                if (fd == squirrel[0]) {
-                        squirrel[0] = xdup_and_close(squirrel[0], F_DUPFD);
-                        return 1;
-                }
-                if (fd == squirrel[1]) {
-                        squirrel[1] = xdup_and_close(squirrel[1], F_DUPFD);
-                        return 1;
-                }
-                if (fd == squirrel[2]) {
-                        squirrel[2] = xdup_and_close(squirrel[2], F_DUPFD);
-                        return 1;
-                }
-                /* If we are about to redirect stdio fd, and did not yet move it... */
-                if (fd <= 2 && squirrel[fd] < 0) {
-                        /* We avoid taking stdio fds */
-                        squirrel[fd] = fcntl(fd, F_DUPFD, 10);
-                        if (squirrel[fd] < 0 && errno != EBADF)
+        if (sq) while (sq[i].orig_fd >= 0) {
+                /* If we collide with an already moved fd... */
+                if (fd == sq[i].moved_to) {
+                        sq[i].moved_to = fcntl_F_DUPFD(sq[i].moved_to, avoid_fd);
+                        debug_printf_redir("redirect_fd %d: already busy, moving to %d\n", fd, sq[i].moved_to);
+                        if (sq[i].moved_to < 0) /* what? */
                                 xfunc_die();
-                        return 0; /* "we did not close fd" */
+                        return sq;
+                }
+                if (fd == sq[i].orig_fd) {
+                        /* Example: echo Hello >/dev/null 1>&2 */
+                        debug_printf_redir("redirect_fd %d: already moved\n", fd);
+                        return sq;
                 }
+                i++;
         }
 
+        sq = xrealloc(sq, (i + 2) * sizeof(sq[0]));
+        sq[i].orig_fd = fd;
+        /* If this fd is open, we move and remember it; if it's closed, moved_to = -1 */
+        sq[i].moved_to = fcntl_F_DUPFD(fd, avoid_fd);
+        debug_printf_redir("redirect_fd %d: previous fd is moved to %d (-1 if it was closed)\n", fd, sq[i].moved_to);
+        if (sq[i].moved_to < 0 && errno != EBADF)
+                xfunc_die();
+        sq[i+1].orig_fd = -1; /* end marker */
+        return sq;
+}
+
+/* fd: redirect wants this fd to be used (e.g. 3>file).
+ * Move all conflicting internally used fds,
+ * and remember them so that we can restore them later.
+ */
+static int save_fds_on_redirect(int fd, int avoid_fd, struct squirrel **sqp)
+{
+        if (avoid_fd < 9) /* the important case here is that it can be -1 */
+                avoid_fd = 9;
+
 #if ENABLE_HUSH_INTERACTIVE
         if (fd != 0 && fd == G.interactive_fd) {
-                G.interactive_fd = xdup_and_close(G.interactive_fd, F_DUPFD_CLOEXEC);
-                return 1;
+                G.interactive_fd = xdup_and_close(G.interactive_fd, F_DUPFD_CLOEXEC, avoid_fd);
+                debug_printf_redir("redirect_fd %d: matches interactive_fd, moving it to %d\n", fd, G.interactive_fd);
+                return 1; /* "we closed fd" */
         }
 #endif
-
         /* Are we called from setup_redirects(squirrel==NULL)? Two cases:
          * (1) Redirect in a forked child. No need to save FILEs' fds,
          * we aren't going to use them anymore, ok to trash.
-         * (2) "exec 3>FILE". Bummer. We can save FILEs' fds,
-         * but how are we doing to use them?
+         * (2) "exec 3>FILE". Bummer. We can save script FILEs' fds,
+         * but how are we doing to restore them?
          * "fileno(fd) = new_fd" can't be done.
          */
-        if (!squirrel)
+        if (!sqp)
                 return 0;
 
-        return save_FILEs_on_redirect(fd);
+        /* If this one of script's fds? */
+        if (save_FILEs_on_redirect(fd, avoid_fd))
+                return 1; /* yes. "we closed fd" */
+
+        /* Check whether it collides with any open fds (e.g. stdio), save fds as needed */
+        *sqp = add_squirrel(*sqp, fd, avoid_fd);
+        return 0; /* "we did not close fd" */
 }
 
-static void restore_redirects(int squirrel[3])
+static void restore_redirects(struct squirrel *sq)
 {
-        int i, fd;
-        for (i = 0; i <= 2; i++) {
-                fd = squirrel[i];
-                if (fd != -1) {
-                        /* We simply die on error */
-                        xmove_fd(fd, i);
+
+        if (sq) {
+                int i = 0;
+                while (sq[i].orig_fd >= 0) {
+                        if (sq[i].moved_to >= 0) {
+                                /* We simply die on error */
+                                debug_printf_redir("restoring redirected fd from %d to %d\n", sq[i].moved_to, sq[i].orig_fd);
+                                xmove_fd(sq[i].moved_to, sq[i].orig_fd);
+                        } else {
+                                /* cmd1 9>FILE; cmd2_should_see_fd9_closed */
+                                debug_printf_redir("restoring redirected fd %d: closing it\n", sq[i].orig_fd);
+                                close(sq[i].orig_fd);
+                        }
+                        i++;
                 }
+                free(sq);
         }
 
-        /* Moved G.interactive_fd stays on new fd, not doing anything for it */
+        /* If moved, G.interactive_fd stays on new fd, not restoring it */
 
         restore_redirected_FILEs();
 }
 
 /* squirrel != NULL means we squirrel away copies of stdin, stdout,
  * and stderr if they are redirected. */
-static int setup_redirects(struct command *prog, int squirrel[])
+static int setup_redirects(struct command *prog, struct squirrel **sqp)
 {
         int openfd, mode;
         struct redir_struct *redir;
@@ -6602,7 +6748,7 @@ static int setup_redirects(struct command *prog, int squirrel[])
         for (redir = prog->redirects; redir; redir = redir->next) {
                 if (redir->rd_type == REDIRECT_HEREDOC2) {
                         /* "rd_fd<<HERE" case */
-                        save_fds_on_redirect(redir->rd_fd, squirrel);
+                        save_fds_on_redirect(redir->rd_fd, /*avoid:*/ 0, sqp);
                         /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
                          * of the heredoc */
                         debug_printf_parse("set heredoc '%s'\n",
@@ -6641,7 +6787,7 @@ static int setup_redirects(struct command *prog, int squirrel[])
                 }
 
                 if (openfd != redir->rd_fd) {
-                        int closed = save_fds_on_redirect(redir->rd_fd, squirrel);
+                        int closed = save_fds_on_redirect(redir->rd_fd, /*avoid:*/ openfd, sqp);
                         if (openfd == REDIRFD_CLOSE) {
                                 /* "rd_fd >&-" means "close me" */
                                 if (!closed) {
@@ -6817,13 +6963,11 @@ static void exec_function(char ***to_free,
                 char **argv)
 {
 # if BB_MMU
-        int n = 1;
+        int n;
 
         argv[0] = G.global_argv[0];
         G.global_argv = argv;
-        while (*++argv)
-                n++;
-        G.global_argc = n;
+        G.global_argc = n = 1 + string_array_len(argv + 1);
         /* On MMU, funcp->body is always non-NULL */
         n = run_list(funcp->body);
         fflush_all();
@@ -7071,7 +7215,7 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                                 /* Do not leak open fds from opened script files etc */
                                 close_all_FILE_list();
                                 debug_printf_exec("running applet '%s'\n", argv[0]);
-                                run_applet_no_and_exit(a, argv);
+                                run_applet_no_and_exit(a, argv[0], argv);
                         }
 # endif
                         /* Re-exec ourselves */
@@ -7168,24 +7312,54 @@ static const char *get_cmdtext(struct pipe *pi)
         return pi->cmdtext;
 }
 
-static void insert_bg_job(struct pipe *pi)
+static void remove_job_from_table(struct pipe *pi)
+{
+        struct pipe *prev_pipe;
+
+        if (pi == G.job_list) {
+                G.job_list = pi->next;
+        } else {
+                prev_pipe = G.job_list;
+                while (prev_pipe->next != pi)
+                        prev_pipe = prev_pipe->next;
+                prev_pipe->next = pi->next;
+        }
+        G.last_jobid = 0;
+        if (G.job_list)
+                G.last_jobid = G.job_list->jobid;
+}
+
+static void delete_finished_job(struct pipe *pi)
+{
+        remove_job_from_table(pi);
+        free_pipe(pi);
+}
+
+static void clean_up_last_dead_job(void)
+{
+        if (G.job_list && !G.job_list->alive_cmds)
+                delete_finished_job(G.job_list);
+}
+
+static void insert_job_into_table(struct pipe *pi)
 {
         struct pipe *job, **jobp;
         int i;
 
-        /* Linear search for the ID of the job to use */
-        pi->jobid = 1;
-        for (job = G.job_list; job; job = job->next)
-                if (job->jobid >= pi->jobid)
-                        pi->jobid = job->jobid + 1;
+        clean_up_last_dead_job();
 
-        /* Add job to the list of running jobs */
+        /* Find the end of the list, and find next job ID to use */
+        i = 0;
         jobp = &G.job_list;
-        while ((job = *jobp) != NULL)
+        while ((job = *jobp) != NULL) {
+                if (job->jobid > i)
+                        i = job->jobid;
                 jobp = &job->next;
-        job = *jobp = xmalloc(sizeof(*job));
+        }
+        pi->jobid = i + 1;
 
-        *job = *pi; /* physical copy */
+        /* Create a new job struct at the end */
+        job = *jobp = xmemdup(pi, sizeof(*pi));
         job->next = NULL;
         job->cmds = xzalloc(sizeof(pi->cmds[0]) * pi->num_cmds);
         /* Cannot copy entire pi->cmds[] vector! This causes double frees */
@@ -7199,31 +7373,6 @@ static void insert_bg_job(struct pipe *pi)
                 printf("[%u] %u %s\n", job->jobid, (unsigned)job->cmds[0].pid, job->cmdtext);
         G.last_jobid = job->jobid;
 }
-
-static void remove_bg_job(struct pipe *pi)
-{
-        struct pipe *prev_pipe;
-
-        if (pi == G.job_list) {
-                G.job_list = pi->next;
-        } else {
-                prev_pipe = G.job_list;
-                while (prev_pipe->next != pi)
-                        prev_pipe = prev_pipe->next;
-                prev_pipe->next = pi->next;
-        }
-        if (G.job_list)
-                G.last_jobid = G.job_list->jobid;
-        else
-                G.last_jobid = 0;
-}
-
-/* Remove a backgrounded job */
-static void delete_finished_bg_job(struct pipe *pi)
-{
-        remove_bg_job(pi);
-        free_pipe(pi);
-}
 #endif /* JOB */
 
 static int job_exited_or_stopped(struct pipe *pi)
@@ -7310,7 +7459,7 @@ static int process_wait_result(struct pipe *fg_pipe, pid_t childpid, int status)
                                 if (G_interactive_fd) {
 #if ENABLE_HUSH_JOB
                                         if (fg_pipe->alive_cmds != 0)
-                                                insert_bg_job(fg_pipe);
+                                                insert_job_into_table(fg_pipe);
 #endif
                                         return rcode;
                                 }
@@ -7339,16 +7488,31 @@ static int process_wait_result(struct pipe *fg_pipe, pid_t childpid, int status)
  found_pi_and_prognum:
         if (dead) {
                 /* child exited */
-                pi->cmds[i].pid = 0;
-                pi->cmds[i].cmd_exitcode = WEXITSTATUS(status);
+                int rcode = WEXITSTATUS(status);
                 if (WIFSIGNALED(status))
-                        pi->cmds[i].cmd_exitcode = 128 + WTERMSIG(status);
+                        rcode = 128 + WTERMSIG(status);
+                pi->cmds[i].cmd_exitcode = rcode;
+                if (G.last_bg_pid == pi->cmds[i].pid)
+                        G.last_bg_pid_exitcode = rcode;
+                pi->cmds[i].pid = 0;
                 pi->alive_cmds--;
                 if (!pi->alive_cmds) {
-                        if (G_interactive_fd)
+                        if (G_interactive_fd) {
                                 printf(JOB_STATUS_FORMAT, pi->jobid,
                                                 "Done", pi->cmdtext);
-                        delete_finished_bg_job(pi);
+                                delete_finished_job(pi);
+                        } else {
+/*
+ * bash deletes finished jobs from job table only in interactive mode,
+ * after "jobs" cmd, or if pid of a new process matches one of the old ones
+ * (see cleanup_dead_jobs(), delete_old_job(), J_NOTIFIED in bash source).
+ * Testcase script: "(exit 3) & sleep 1; wait %1; echo $?" prints 3 in bash.
+ * We only retain one "dead" job, if it's the single job on the list.
+ * This covers most of real-world scenarios where this is useful.
+ */
+                                if (pi != G.job_list)
+                                        delete_finished_job(pi);
+                        }
                 }
         } else {
                 /* child stopped */
@@ -7505,14 +7669,14 @@ static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
 static int redirect_and_varexp_helper(char ***new_env_p,
                 struct variable **old_vars_p,
                 struct command *command,
-                int squirrel[3],
+                struct squirrel **sqp,
                 char **argv_expanded)
 {
         /* setup_redirects acts on file descriptors, not FILEs.
          * This is perfect for work that comes after exec().
          * Is it really safe for inline use?  Experimentally,
          * things seem to work. */
-        int rcode = setup_redirects(command, squirrel);
+        int rcode = setup_redirects(command, sqp);
         if (rcode == 0) {
                 char **new_env = expand_assignments(command->argv, command->assignment_cnt);
                 *new_env_p = new_env;
@@ -7532,8 +7696,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
         struct command *command;
         char **argv_expanded;
         char **argv;
-        /* it is not always needed, but we aim to smaller code */
-        int squirrel[] = { -1, -1, -1 };
+        struct squirrel *squirrel = NULL;
         int rcode;
 
         debug_printf_exec("run_pipe start: members:%d\n", pi->num_cmds);
@@ -7590,7 +7753,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 /* { list } */
                 debug_printf("non-subshell group\n");
                 rcode = 1; /* exitcode if redir failed */
-                if (setup_redirects(command, squirrel) == 0) {
+                if (setup_redirects(command, &squirrel) == 0) {
                         debug_printf_exec(": run_list\n");
                         rcode = run_list(command->group) & 0xff;
                 }
@@ -7617,15 +7780,15 @@ static NOINLINE int run_pipe(struct pipe *pi)
                         /* Ensure redirects take effect (that is, create files).
                          * Try "a=t >file" */
 #if 0 /* A few cases in testsuite fail with this code. FIXME */
-                        rcode = redirect_and_varexp_helper(&new_env, /*old_vars:*/ NULL, command, squirrel, /*argv_expanded:*/ NULL);
+                        rcode = redirect_and_varexp_helper(&new_env, /*old_vars:*/ NULL, command, &squirrel, /*argv_expanded:*/ NULL);
                         /* Set shell variables */
                         if (new_env) {
                                 argv = new_env;
                                 while (*argv) {
-                                        set_local_var(*argv, /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
-                                        /* Do we need to flag set_local_var() errors?
-                                         * "assignment to readonly var" and "putenv error"
-                                         */
+                                        if (set_local_var(*argv, /*flag:*/ 0)) {
+                                                /* assignment to readonly var / putenv error? */
+                                                rcode = 1;
+                                        }
                                         argv++;
                                 }
                         }
@@ -7639,7 +7802,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
 
 #else /* Older, bigger, but more correct code */
 
-                        rcode = setup_redirects(command, squirrel);
+                        rcode = setup_redirects(command, &squirrel);
                         restore_redirects(squirrel);
                         /* Set shell variables */
                         if (G_x_mode)
@@ -7650,10 +7813,10 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                         fprintf(stderr, " %s", p);
                                 debug_printf_exec("set shell var:'%s'->'%s'\n",
                                                 *argv, p);
-                                set_local_var(p, /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
-                                /* Do we need to flag set_local_var() errors?
-                                 * "assignment to readonly var" and "putenv error"
-                                 */
+                                if (set_local_var(p, /*flag:*/ 0)) {
+                                        /* assignment to readonly var / putenv error? */
+                                        rcode = 1;
+                                }
                                 argv++;
                         }
                         if (G_x_mode)
@@ -7702,7 +7865,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                         goto clean_up_and_ret1;
                                 }
                         }
-                        rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, squirrel, argv_expanded);
+                        rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, &squirrel, argv_expanded);
                         if (rcode == 0) {
                                 if (!funcp) {
                                         debug_printf_exec(": builtin '%s' '%s'...\n",
@@ -7743,7 +7906,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 if (ENABLE_FEATURE_SH_NOFORK) {
                         int n = find_applet_by_name(argv_expanded[0]);
                         if (n >= 0 && APPLET_IS_NOFORK(n)) {
-                                rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, squirrel, argv_expanded);
+                                rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, &squirrel, argv_expanded);
                                 if (rcode == 0) {
                                         debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
                                                 argv_expanded[0], argv_expanded[1]);
@@ -7968,6 +8131,7 @@ static int run_list(struct pipe *pi)
         /* Go through list of pipes, (maybe) executing them. */
         for (; pi; pi = IF_HUSH_LOOPS(rword == RES_DONE ? loop_top : ) pi->next) {
                 int r;
+                int sv_errexit_depth;
 
                 if (G.flag_SIGINT)
                         break;
@@ -7977,6 +8141,13 @@ static int run_list(struct pipe *pi)
                 IF_HAS_KEYWORDS(rword = pi->res_word;)
                 debug_printf_exec(": rword=%d cond_code=%d last_rword=%d\n",
                                 rword, cond_code, last_rword);
+
+                sv_errexit_depth = G.errexit_depth;
+                if (IF_HAS_KEYWORDS(rword == RES_IF || rword == RES_ELIF ||)
+                    pi->followup != PIPE_SEQ
+                ) {
+                        G.errexit_depth++;
+                }
 #if ENABLE_HUSH_LOOPS
                 if ((rword == RES_WHILE || rword == RES_UNTIL || rword == RES_FOR)
                  && loop_top == NULL /* avoid bumping G.depth_of_loop twice */
@@ -8054,7 +8225,7 @@ static int run_list(struct pipe *pi)
                         }
                         /* Insert next value from for_lcur */
                         /* note: *for_lcur already has quotes removed, $var expanded, etc */
-                        set_local_var(xasprintf("%s=%s", pi->cmds[0].argv[0], *for_lcur++), /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ 0);
+                        set_local_var(xasprintf("%s=%s", pi->cmds[0].argv[0], *for_lcur++), /*flag:*/ 0);
                         continue;
                 }
                 if (rword == RES_IN) {
@@ -8068,6 +8239,7 @@ static int run_list(struct pipe *pi)
                 if (rword == RES_CASE) {
                         debug_printf_exec("CASE cond_code:%d\n", cond_code);
                         case_word = expand_strvec_to_string(pi->cmds->argv);
+                        unbackslash(case_word);
                         continue;
                 }
                 if (rword == RES_MATCH) {
@@ -8079,9 +8251,10 @@ static int run_list(struct pipe *pi)
                         /* all prev words didn't match, does this one match? */
                         argv = pi->cmds->argv;
                         while (*argv) {
-                                char *pattern = expand_string_to_string(*argv, /*unbackslash:*/ 1);
+                                char *pattern = expand_string_to_string(*argv, /*unbackslash:*/ 0);
                                 /* TODO: which FNM_xxx flags to use? */
                                 cond_code = (fnmatch(pattern, case_word, /*flags:*/ 0) != 0);
+                                debug_printf_exec("fnmatch(pattern:'%s',str:'%s'):%d\n", pattern, case_word, cond_code);
                                 free(pattern);
                                 if (cond_code == 0) { /* match! we will execute this branch */
                                         free(case_word);
@@ -8162,10 +8335,11 @@ static int run_list(struct pipe *pi)
                          * I'm NOT treating inner &'s as jobs */
 #if ENABLE_HUSH_JOB
                         if (G.run_list_level == 1)
-                                insert_bg_job(pi);
+                                insert_job_into_table(pi);
 #endif
                         /* Last command's pid goes to $! */
                         G.last_bg_pid = pi->cmds[pi->num_cmds - 1].pid;
+                        G.last_bg_pid_exitcode = 0;
                         debug_printf_exec(": cmd&: exitcode EXIT_SUCCESS\n");
 /* Check pi->pi_inverted? "! sleep 1 & echo $?": bash says 1. dash and ash says 0 */
                         rcode = EXIT_SUCCESS;
@@ -8187,6 +8361,14 @@ static int run_list(struct pipe *pi)
                         check_and_run_traps();
                 }
 
+                /* Handle "set -e" */
+                if (rcode != 0 && G.o_opt[OPT_O_ERREXIT]) {
+                        debug_printf_exec("ERREXIT:1 errexit_depth:%d\n", G.errexit_depth);
+                        if (G.errexit_depth == 0)
+                                hush_exit(rcode);
+                }
+                G.errexit_depth = sv_errexit_depth;
+
                 /* Analyze how result affects subsequent commands */
 #if ENABLE_HUSH_IF
                 if (rword == RES_IF || rword == RES_ELIF)
@@ -8366,6 +8548,9 @@ static int set_mode(int state, char mode, const char *o_opt)
                         G.o_opt[idx] = state;
                         break;
                 }
+        case 'e':
+                G.o_opt[OPT_O_ERREXIT] = state;
+                break;
         default:
                 return EXIT_FAILURE;
         }
@@ -8425,7 +8610,7 @@ int hush_main(int argc, char **argv)
         putenv(shell_ver->varstr);
 
         /* Export PWD */
-        set_pwd_var(/*exp:*/ 1);
+        set_pwd_var(SETFLAG_EXPORT);
 
 #if BASH_HOSTNAME_VAR
         /* Set (but not export) HOSTNAME unless already set */
@@ -8492,7 +8677,7 @@ int hush_main(int argc, char **argv)
         flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
         builtin_argc = 0;
         while (1) {
-                opt = getopt(argc, argv, "+c:xinsl"
+                opt = getopt(argc, argv, "+c:exinsl"
 #if !BB_MMU
                                 "<:$:R:V:"
 # if ENABLE_HUSH_FUNCTIONS
@@ -8575,8 +8760,9 @@ int hush_main(int argc, char **argv)
                         optarg++;
                         empty_trap_mask = bb_strtoull(optarg, &optarg, 16);
                         if (empty_trap_mask != 0) {
-                                int sig;
+                                IF_HUSH_TRAP(int sig;)
                                 install_special_sighandlers();
+# if ENABLE_HUSH_TRAP
                                 G_traps = xzalloc(sizeof(G_traps[0]) * NSIG);
                                 for (sig = 1; sig < NSIG; sig++) {
                                         if (empty_trap_mask & (1LL << sig)) {
@@ -8584,6 +8770,7 @@ int hush_main(int argc, char **argv)
                                                 install_sighandler(sig, SIG_IGN);
                                         }
                                 }
+# endif
                         }
 # if ENABLE_HUSH_LOOPS
                         optarg++;
@@ -8593,7 +8780,7 @@ int hush_main(int argc, char **argv)
                 }
                 case 'R':
                 case 'V':
-                        set_local_var(xstrdup(optarg), /*exp:*/ 0, /*lvl:*/ 0, /*ro:*/ opt == 'R');
+                        set_local_var(xstrdup(optarg), opt == 'R' ? SETFLAG_MAKE_RO : 0);
                         break;
 # if ENABLE_HUSH_FUNCTIONS
                 case 'F': {
@@ -8608,6 +8795,7 @@ int hush_main(int argc, char **argv)
 #endif
                 case 'n':
                 case 'x':
+                case 'e':
                         if (set_mode(1, opt, NULL) == 0) /* no error */
                                 break;
                 default:
@@ -8694,7 +8882,7 @@ int hush_main(int argc, char **argv)
                         G_saved_tty_pgrp = 0;
 
                 /* try to dup stdin to high fd#, >= 255 */
-                G_interactive_fd = fcntl(STDIN_FILENO, F_DUPFD, 255);
+                G_interactive_fd = fcntl_F_DUPFD(STDIN_FILENO, 254);
                 if (G_interactive_fd < 0) {
                         /* try to dup to any fd */
                         G_interactive_fd = dup(STDIN_FILENO);
@@ -8767,7 +8955,7 @@ int hush_main(int argc, char **argv)
 #elif ENABLE_HUSH_INTERACTIVE
         /* No job control compiled in, only prompt/line editing */
         if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
-                G_interactive_fd = fcntl(STDIN_FILENO, F_DUPFD, 255);
+                G_interactive_fd = fcntl_F_DUPFD(STDIN_FILENO, 254);
                 if (G_interactive_fd < 0) {
                         /* try to dup to any fd */
                         G_interactive_fd = dup(STDIN_FILENO);
@@ -8806,16 +8994,6 @@ int hush_main(int argc, char **argv)
 }
 
 
-#if ENABLE_MSH
-int msh_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
-int msh_main(int argc, char **argv)
-{
-        bb_error_msg("msh is deprecated, please use hush instead");
-        return hush_main(argc, argv);
-}
-#endif
-
-
 /*
  * Built-ins
  */
@@ -8827,12 +9005,8 @@ static int FAST_FUNC builtin_true(char **argv UNUSED_PARAM)
 #if ENABLE_HUSH_TEST || ENABLE_HUSH_ECHO || ENABLE_HUSH_PRINTF || ENABLE_HUSH_KILL
 static int run_applet_main(char **argv, int (*applet_main_func)(int argc, char **argv))
 {
-        int argc = 0;
-        while (*argv) {
-                argc++;
-                argv++;
-        }
-        return applet_main_func(argc, argv - argc);
+        int argc = string_array_len(argv);
+        return applet_main_func(argc, argv);
 }
 #endif
 #if ENABLE_HUSH_TEST || BASH_TEST2
@@ -8909,7 +9083,7 @@ static int FAST_FUNC builtin_cd(char **argv)
          * Note: do not enforce exporting. If PWD was unset or unexported,
          * set it again, but do not export. bash does the same.
          */
-        set_pwd_var(/*exp:*/ 0);
+        set_pwd_var(/*flag:*/ 0);
         return EXIT_SUCCESS;
 }
 
@@ -9147,12 +9321,8 @@ static void print_escaped(const char *s)
 }
 #endif
 
-#if ENABLE_HUSH_EXPORT || ENABLE_HUSH_LOCAL
-# if !ENABLE_HUSH_LOCAL
-#define helper_export_local(argv, exp, lvl) \
-        helper_export_local(argv, exp)
-# endif
-static void helper_export_local(char **argv, int exp, int lvl)
+#if ENABLE_HUSH_EXPORT || ENABLE_HUSH_LOCAL || ENABLE_HUSH_READONLY
+static int helper_export_local(char **argv, unsigned flags)
 {
         do {
                 char *name = *argv;
@@ -9166,7 +9336,7 @@ static void helper_export_local(char **argv, int exp, int lvl)
                         vpp = get_ptr_to_local_var(name, name_end - name);
                         var = vpp ? *vpp : NULL;
 
-                        if (exp == -1) { /* unexporting? */
+                        if (flags & SETFLAG_UNEXPORT) {
                                 /* export -n NAME (without =VALUE) */
                                 if (var) {
                                         var->flg_export = 0;
@@ -9175,7 +9345,7 @@ static void helper_export_local(char **argv, int exp, int lvl)
                                 } /* else: export -n NOT_EXISTING_VAR: no-op */
                                 continue;
                         }
-                        if (exp == 1) { /* exporting? */
+                        if (flags & SETFLAG_EXPORT) {
                                 /* export NAME (without =VALUE) */
                                 if (var) {
                                         var->flg_export = 1;
@@ -9184,28 +9354,45 @@ static void helper_export_local(char **argv, int exp, int lvl)
                                         continue;
                                 }
                         }
+                        if (flags & SETFLAG_MAKE_RO) {
+                                /* readonly NAME (without =VALUE) */
+                                if (var) {
+                                        var->flg_read_only = 1;
+                                        continue;
+                                }
+                        }
 # if ENABLE_HUSH_LOCAL
-                        if (exp == 0 /* local? */
-                         && var && var->func_nest_level == lvl
-                        ) {
-                                /* "local x=abc; ...; local x" - ignore second local decl */
-                                continue;
+                        /* Is this "local" bltin? */
+                        if (!(flags & (SETFLAG_EXPORT|SETFLAG_UNEXPORT|SETFLAG_MAKE_RO))) {
+                                unsigned lvl = flags >> SETFLAG_LOCAL_SHIFT;
+                                if (var && var->func_nest_level == lvl) {
+                                        /* "local x=abc; ...; local x" - ignore second local decl */
+                                        continue;
+                                }
                         }
 # endif
                         /* Exporting non-existing variable.
                          * bash does not put it in environment,
                          * but remembers that it is exported,
                          * and does put it in env when it is set later.
-                         * We just set it to "" and export. */
+                         * We just set it to "" and export.
+                         */
                         /* Or, it's "local NAME" (without =VALUE).
-                         * bash sets the value to "". */
+                         * bash sets the value to "".
+                         */
+                        /* Or, it's "readonly NAME" (without =VALUE).
+                         * bash remembers NAME and disallows its creation
+                         * in the future.
+                         */
                         name = xasprintf("%s=", name);
                 } else {
                         /* (Un)exporting/making local NAME=VALUE */
                         name = xstrdup(name);
                 }
-                set_local_var(name, /*exp:*/ exp, /*lvl:*/ lvl, /*ro:*/ 0);
+                if (set_local_var(name, flags))
+                        return EXIT_FAILURE;
         } while (*++argv);
+        return EXIT_SUCCESS;
 }
 #endif
 
@@ -9251,9 +9438,7 @@ static int FAST_FUNC builtin_export(char **argv)
                 return EXIT_SUCCESS;
         }
 
-        helper_export_local(argv, (opt_unexport ? -1 : 1), 0);
-
-        return EXIT_SUCCESS;
+        return helper_export_local(argv, opt_unexport ? SETFLAG_UNEXPORT : SETFLAG_EXPORT);
 }
 #endif
 
@@ -9264,8 +9449,29 @@ static int FAST_FUNC builtin_local(char **argv)
                 bb_error_msg("%s: not in a function", argv[0]);
                 return EXIT_FAILURE; /* bash compat */
         }
-        helper_export_local(argv, 0, G.func_nest_level);
-        return EXIT_SUCCESS;
+        argv++;
+        return helper_export_local(argv, G.func_nest_level << SETFLAG_LOCAL_SHIFT);
+}
+#endif
+
+#if ENABLE_HUSH_READONLY
+static int FAST_FUNC builtin_readonly(char **argv)
+{
+        argv++;
+        if (*argv == NULL) {
+                /* bash: readonly [-p]: list all readonly VARs
+                 * (-p has no effect in bash)
+                 */
+                struct variable *e;
+                for (e = G.top_var; e; e = e->next) {
+                        if (e->flg_read_only) {
+//TODO: quote value: readonly VAR='VAL'
+                                printf("readonly %s\n", e->varstr);
+                        }
+                }
+                return EXIT_SUCCESS;
+        }
+        return helper_export_local(argv, SETFLAG_MAKE_RO);
 }
 #endif
 
@@ -9379,10 +9585,7 @@ static int FAST_FUNC builtin_set(char **argv)
         /* This realloc's G.global_argv */
         G.global_argv = pp = add_strings_to_strings(g_argv, argv, /*dup:*/ 1);
 
-        n = 1;
-        while (*++pp)
-                n++;
-        G.global_argc = n;
+        G.global_argc = 1 + string_array_len(pp + 1);
 
         return EXIT_SUCCESS;
 
@@ -9398,7 +9601,18 @@ static int FAST_FUNC builtin_shift(char **argv)
         int n = 1;
         argv = skip_dash_dash(argv);
         if (argv[0]) {
-                n = atoi(argv[0]);
+                n = bb_strtou(argv[0], NULL, 10);
+                if (errno || n < 0) {
+                        /* shared string with ash.c */
+                        bb_error_msg("Illegal number: %s", argv[0]);
+                        /*
+                         * ash aborts in this case.
+                         * bash prints error message and set $? to 1.
+                         * Interestingly, for "shift 99999" bash does not
+                         * print error message, but does set $? to 1
+                         * (and does no shifting at all).
+                         */
+                }
         }
         if (n >= 0 && n < G.global_argc) {
                 if (G_global_args_malloced) {
@@ -9511,7 +9725,7 @@ static int FAST_FUNC builtin_trap(char **argv)
                         if (sig < 0 || sig >= NSIG) {
                                 ret = EXIT_FAILURE;
                                 /* Mimic bash message exactly */
-                                bb_perror_msg("trap: %s: invalid signal specification", argv[-1]);
+                                bb_error_msg("trap: %s: invalid signal specification", argv[-1]);
                                 continue;
                         }
 
@@ -9604,6 +9818,9 @@ static int FAST_FUNC builtin_jobs(char **argv UNUSED_PARAM)
 
                 printf(JOB_STATUS_FORMAT, job->jobid, status_string, job->cmdtext);
         }
+
+        clean_up_last_dead_job();
+
         return EXIT_SUCCESS;
 }
 
@@ -9648,14 +9865,14 @@ static int FAST_FUNC builtin_fg_bg(char **argv)
         i = kill(- pi->pgrp, SIGCONT);
         if (i < 0) {
                 if (errno == ESRCH) {
-                        delete_finished_bg_job(pi);
+                        delete_finished_job(pi);
                         return EXIT_SUCCESS;
                 }
                 bb_perror_msg("kill (SIGCONT)");
         }
 
         if (argv[0][0] == 'f') {
-                remove_bg_job(pi);
+                remove_job_from_table(pi); /* FG job shouldn't be in job table */
                 return checkjobs_and_fg_shell(pi);
         }
         return EXIT_SUCCESS;
@@ -9847,8 +10064,12 @@ static int FAST_FUNC builtin_wait(char **argv)
                                 wait_pipe = parse_jobspec(*argv);
                                 if (wait_pipe) {
                                         ret = job_exited_or_stopped(wait_pipe);
-                                        if (ret < 0)
+                                        if (ret < 0) {
                                                 ret = wait_for_child_or_signal(wait_pipe, 0);
+                                        } else {
+                                                /* waiting on "last dead job" removes it */
+                                                clean_up_last_dead_job();
+                                        }
                                 }
                                 /* else: parse_jobspec() already emitted error msg */
                                 continue;
@@ -9864,14 +10085,15 @@ static int FAST_FUNC builtin_wait(char **argv)
                 ret = waitpid(pid, &status, WNOHANG);
                 if (ret < 0) {
                         /* No */
+                        ret = 127;
                         if (errno == ECHILD) {
-                                if (G.last_bg_pid > 0 && pid == G.last_bg_pid) {
+                                if (pid == G.last_bg_pid) {
                                         /* "wait $!" but last bg task has already exited. Try:
                                          * (sleep 1; exit 3) & sleep 2; echo $?; wait $!; echo $?
                                          * In bash it prints exitcode 0, then 3.
                                          * In dash, it is 127.
                                          */
-                                        /* ret = G.last_bg_pid_exitstatus - FIXME */
+                                        ret = G.last_bg_pid_exitcode;
                                 } else {
                                         /* Example: "wait 1". mimic bash message */
                                         bb_error_msg("wait: pid %d is not a child of this shell", (int)pid);
@@ -9880,7 +10102,6 @@ static int FAST_FUNC builtin_wait(char **argv)
                                 /* ??? */
                                 bb_perror_msg("wait %s", *argv);
                         }
-                        ret = 127;
                         continue; /* bash checks all argv[] */
                 }
                 if (ret == 0) {
diff --git a/shell/hush_test/hush-heredoc/heredoc8.right b/shell/hush_test/hush-heredoc/heredoc8.right
new file mode 100644
index 000000000..558858f47
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc8.right
@@ -0,0 +1 @@
+hush: syntax error at 'then'
diff --git a/shell/hush_test/hush-heredoc/heredoc8.tests b/shell/hush_test/hush-heredoc/heredoc8.tests
new file mode 100755
index 000000000..f7bc0737a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc8.tests
@@ -0,0 +1,3 @@
+# ash used to SEGV on this:
+
+<<EOF; then <W
diff --git a/shell/hush_test/hush-misc/errexit1.right b/shell/hush_test/hush-misc/errexit1.right
new file mode 100644
index 000000000..d86bac9de
--- /dev/null
+++ b/shell/hush_test/hush-misc/errexit1.right
@@ -0,0 +1 @@
+OK
diff --git a/shell/hush_test/hush-misc/errexit1.tests b/shell/hush_test/hush-misc/errexit1.tests
new file mode 100755
index 000000000..7b4a15634
--- /dev/null
+++ b/shell/hush_test/hush-misc/errexit1.tests
@@ -0,0 +1,5 @@
+set -e
+(true)
+echo OK
+(false)
+echo FAIL
diff --git a/shell/hush_test/hush-misc/shift1.right b/shell/hush_test/hush-misc/shift1.right
new file mode 100644
index 000000000..e3ab61392
--- /dev/null
+++ b/shell/hush_test/hush-misc/shift1.right
@@ -0,0 +1,10 @@
+2 3 4
+hush: Illegal number: -1
+1 2 3 4
+1 2 3 4
+2 3 4
+3 4
+4
+
+1 2 3 4
+1 2 3 4
diff --git a/shell/hush_test/hush-misc/shift1.tests b/shell/hush_test/hush-misc/shift1.tests
new file mode 100755
index 000000000..f2a264751
--- /dev/null
+++ b/shell/hush_test/hush-misc/shift1.tests
@@ -0,0 +1,10 @@
+$THIS_SH -c 'shift;    echo "$@"' 0 1 2 3 4
+#We complain on -1 and continue.
+$THIS_SH -c 'shift -1; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  0; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  1; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  2; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  3; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  4; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  5; echo "$@"' 0 1 2 3 4
+$THIS_SH -c 'shift  6; echo "$@"' 0 1 2 3 4
diff --git a/shell/hush_test/hush-misc/sigint1.right b/shell/hush_test/hush-misc/sigint1.right
deleted file mode 100644
index a9094b056..000000000
--- a/shell/hush_test/hush-misc/sigint1.right
+++ /dev/null
@@ -1 +0,0 @@
-Sending SIGINT to main shell PID
diff --git a/shell/hush_test/hush-misc/sigint1.tests b/shell/hush_test/hush-misc/sigint1.tests
deleted file mode 100755
index 3d483d32a..000000000
--- a/shell/hush_test/hush-misc/sigint1.tests
+++ /dev/null
@@ -1,41 +0,0 @@
-# What should happen if non-interactive shell gets SIGINT?
-
-(sleep 1; echo Sending SIGINT to main shell PID; exec kill -INT $$) &
-
-# We create a child which exits with 0 even on SIGINT
-# (The complex command is necessary only if SIGINT is generated by ^C,
-# in this testcase even bare "sleep 2" would do because
-# in the testcase we don't send SIGINT *to the child*...)
-$THIS_SH -c 'trap "exit 0" SIGINT; sleep 2'
-
-# In one second, we (main shell) get SIGINT here.
-# The question is whether we should, or should not, exit.
-
-# bash will not stop here. It will execute next command(s).
-
-# The rationale for this is described here:
-# http://www.cons.org/cracauer/sigint.html
-#
-# Basically, bash will not exit on SIGINT immediately if it waits
-# for a child. It will wait for the child to exit.
-# If child exits NOT by dying on SIGINT, then bash will not exit.
-#
-# The idea is that the following script:
-# | emacs file.txt
-# | more cmds
-# User may use ^C to interrupt editor's ops like search. But then
-# emacs exits normally. User expects that script doesn't stop.
-#
-# This is a nice idea, but detecting "did process really exit
-# with SIGINT?" is racy. Consider:
-# | bash -c 'while true; do /bin/true; done'
-# When ^C is pressed while bash waits for /bin/true to exit,
-# it may happen that /bin/true exits with exitcode 0 before
-# ^C is delivered to it as SIGINT. bash will see SIGINT, then
-# it will see that child exited with 0, and bash will NOT EXIT.
-
-# Therefore we do not implement bash behavior.
-# I'd say that emacs need to put itself into a separate pgrp
-# to isolate shell from getting stray SIGINTs from ^C.
-
-echo Next command after SIGINT was executed
diff --git a/shell/hush_test/hush-misc/tickquote1.right b/shell/hush_test/hush-misc/tickquote1.right
new file mode 100644
index 000000000..56f8515b7
--- /dev/null
+++ b/shell/hush_test/hush-misc/tickquote1.right
@@ -0,0 +1 @@
+hush: syntax error: unterminated "
diff --git a/shell/hush_test/hush-misc/tickquote1.tests b/shell/hush_test/hush-misc/tickquote1.tests
new file mode 100755
index 000000000..02e3904f1
--- /dev/null
+++ b/shell/hush_test/hush-misc/tickquote1.tests
@@ -0,0 +1,2 @@
+# UNFIXED BUG: hush does not parse embedded `cmd` at embedding document parse time
+echo _`"pwd`_
diff --git a/shell/hush_test/hush-misc/wait6.right b/shell/hush_test/hush-misc/wait6.right
new file mode 100644
index 000000000..12decc137
--- /dev/null
+++ b/shell/hush_test/hush-misc/wait6.right
@@ -0,0 +1,2 @@
+0
+3
diff --git a/shell/hush_test/hush-misc/wait6.tests b/shell/hush_test/hush-misc/wait6.tests
new file mode 100755
index 000000000..c23713199
--- /dev/null
+++ b/shell/hush_test/hush-misc/wait6.tests
@@ -0,0 +1,6 @@
+# In bash, "wait $!" extracts correct exitcode even if bg task has already exited
+# It prints 0, then 3:
+(sleep 0; exit 3) & sleep 1
+echo $?
+wait $!
+echo $?
diff --git a/shell/hush_test/hush-parsing/and_or_and_backgrounding.right b/shell/hush_test/hush-parsing/and_or_and_backgrounding.right
new file mode 100644
index 000000000..90ce63e01
--- /dev/null
+++ b/shell/hush_test/hush-parsing/and_or_and_backgrounding.right
@@ -0,0 +1,4 @@
+First
+Second
+Third
+Done
diff --git a/shell/hush_test/hush-parsing/and_or_and_backgrounding.tests b/shell/hush_test/hush-parsing/and_or_and_backgrounding.tests
new file mode 100755
index 000000000..204d44490
--- /dev/null
+++ b/shell/hush_test/hush-parsing/and_or_and_backgrounding.tests
@@ -0,0 +1,30 @@
+# According to this doc, && || have higher precedence than ; &.
+# See example below.
+# Precedence of ; is not a problem in practice. Precedence of & is.
+#
+#http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
+#
+#2.9.3 Lists
+#
+#An AND-OR list is a sequence of one or more pipelines separated by
+#the operators "&&" and "||" .
+#
+#A list is a sequence of one or more AND-OR lists separated by the operators
+#';' and '&' and optionally terminated by ';', '&', or <newline>.
+#
+#The operators "&&" and "||" shall have equal precedence and shall be
+#evaluated with left associativity. For example, both of the following
+#commands write solely bar to standard output:
+#
+#    false && echo foo || echo bar
+#    true || echo foo && echo bar
+#
+#A ';' or <newline> terminator shall cause the preceding AND-OR list
+#to be executed sequentially; an '&' shall cause asynchronous execution
+#of the preceding AND-OR list.
+
+echo First && sleep 0.2 && echo Third &
+sleep 0.1
+echo Second
+wait
+echo Done
diff --git a/shell/hush_test/hush-quoting/quoted_punct.right b/shell/hush_test/hush-quoting/quoted_punct.right
new file mode 100644
index 000000000..ab66c3ce0
--- /dev/null
+++ b/shell/hush_test/hush-quoting/quoted_punct.right
@@ -0,0 +1,35 @@
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
+ok
diff --git a/shell/hush_test/hush-quoting/quoted_punct.tests b/shell/hush_test/hush-quoting/quoted_punct.tests
new file mode 100755
index 000000000..83ee40bf4
--- /dev/null
+++ b/shell/hush_test/hush-quoting/quoted_punct.tests
@@ -0,0 +1,41 @@
+# Testing glob-escaping of every ASCII punctuation char
+# Some chars have more than one test
+# 21..2f
+case '!' in [\!] ) echo ok;; *) echo 'WRONG!';; esac
+case '"' in [\"] ) echo ok;; *) echo 'WRONG"';; esac
+case '#' in [\#] ) echo ok;; *) echo 'WRONG#';; esac
+case '$' in [\$] ) echo ok;; *) echo 'WRONG$';; esac
+case '%' in [\%] ) echo ok;; *) echo 'WRONG%';; esac
+case '&' in [\&] ) echo ok;; *) echo 'WRONG&';; esac
+case "'" in [\'] ) echo ok;; *) echo "WRONG'";; esac
+case '(' in [\(] ) echo ok;; *) echo 'WRONG(';; esac
+case ')' in [\)] ) echo ok;; *) echo 'WRONG)';; esac
+case '*' in [\*] ) echo ok;; *) echo 'WRONG*';; esac
+case '+' in [\+] ) echo ok;; *) echo 'WRONG+';; esac
+case ',' in [\,] ) echo ok;; *) echo 'WRONG,';; esac
+case '-' in [\-] ) echo ok;; *) echo 'WRONG-';; esac
+case '-' in [a\-c]) echo ok;; *) echo 'WRONGa\-c';; esac
+case '.' in [\.] ) echo ok;; *) echo 'WRONG.';; esac
+case '/' in [\/] ) echo ok;; *) echo 'WRONG/';; esac
+# 3a..40
+case ':' in [\:] ) echo ok;; *) echo 'WRONG:';; esac
+case ';' in [\;] ) echo ok;; *) echo 'WRONG;';; esac
+case '<' in [\<] ) echo ok;; *) echo 'WRONG<';; esac
+case '=' in [\=] ) echo ok;; *) echo 'WRONG=';; esac
+case '>' in [\>] ) echo ok;; *) echo 'WRONG>';; esac
+case '?' in [\?] ) echo ok;; *) echo 'WRONG?';; esac
+case '@' in [\@] ) echo ok;; *) echo 'WRONG@';; esac
+# 5b..60
+case '[' in [\[] ) echo ok;; *) echo 'WRONG[';; esac
+case '\' in [\\] ) echo ok;; *) echo 'WRONG\';; esac
+case '\' in \\ ) echo ok;; *) echo 'WRONG\\';; esac
+case ']' in [\]] ) echo ok;; *) echo 'WRONG]';; esac
+case ']' in [a\]]) echo ok;; *) echo 'WRONGa]';; esac
+case '^' in [\^] ) echo ok;; *) echo 'WRONG^';; esac
+case '_' in [\_] ) echo ok;; *) echo 'WRONG_';; esac
+case '`' in [\`] ) echo ok;; *) echo 'WRONG`';; esac
+# 7b..7e
+case '{' in [\{] ) echo ok;; *) echo 'WRONG{';; esac
+case '|' in [\|] ) echo ok;; *) echo 'WRONG|';; esac
+case '}' in [\}] ) echo ok;; *) echo 'WRONG}';; esac
+case '~' in [\~] ) echo ok;; *) echo 'WRONG~';; esac
diff --git a/shell/hush_test/hush-quoting/unicode_8x_chars.right b/shell/hush_test/hush-quoting/unicode_8x_chars.right
new file mode 100644
index 000000000..7780b88b4
--- /dev/null
+++ b/shell/hush_test/hush-quoting/unicode_8x_chars.right
@@ -0,0 +1,6 @@
+ok
+ok
+ok
+ok
+ok
+ok
diff --git a/shell/hush_test/hush-quoting/unicode_8x_chars.tests b/shell/hush_test/hush-quoting/unicode_8x_chars.tests
new file mode 100755
index 000000000..1258745ec
--- /dev/null
+++ b/shell/hush_test/hush-quoting/unicode_8x_chars.tests
@@ -0,0 +1,28 @@
+# Unicode: cf 80
+case π in
+( "π" ) echo ok ;;
+( * )   echo WRONG ;;
+esac
+# Unicode: cf 81
+case ρ in
+( "ρ" ) echo ok ;;
+( * )   echo WRONG ;;
+esac
+# Unicode: cf 82
+case ς in
+( "ς" ) echo ok ;;
+( * )   echo WRONG ;;
+esac
+
+case "π" in
+( π ) echo ok ;;
+( * ) echo WRONG ;;
+esac
+case "ρ" in
+( ρ ) echo ok ;;
+( * ) echo WRONG ;;
+esac
+case "ς" in
+( ς ) echo ok ;;
+( * ) echo WRONG ;;
+esac
diff --git a/shell/hush_test/hush-redir/redir3.right b/shell/hush_test/hush-redir/redir3.right
index 3d20bbf68..e3c878b7d 100644
--- a/shell/hush_test/hush-redir/redir3.right
+++ b/shell/hush_test/hush-redir/redir3.right
@@ -1,14 +1,2 @@
-hush: can't open '/does/not/exist': No such file or directory
-One:1
-hush: can't open '/cant/be/created': No such file or directory
-One:1
-Ok
-hush: can't open '/cant/be/created': No such file or directory
-Zero:0
-hush: can't open '/cant/be/created': No such file or directory
-One:1
-hush: can't open '/cant/be/created': No such file or directory
-One:1
-hush: can't open '/cant/be/created': No such file or directory
-Zero:0
-Done
+TEST
+hush: can't duplicate file descriptor: Bad file descriptor
diff --git a/shell/hush_test/hush-redir/redir3.tests b/shell/hush_test/hush-redir/redir3.tests
index 7c28e4324..e37d5e45a 100755
--- a/shell/hush_test/hush-redir/redir3.tests
+++ b/shell/hush_test/hush-redir/redir3.tests
@@ -1,9 +1,5 @@
-echo Error >/does/not/exist; echo One:$?
-t=BAD
-t=Ok >>/cant/be/created; echo One:$?
-echo $t
-! >/cant/be/created; echo Zero:$?
-exec >/cant/be/created; echo One:$?
-exec /bin/true >/cant/be/created; echo One:$?
-! exec /bin/true >/cant/be/created; echo Zero:$?
-echo Done
+# redirects to closed descriptors should not leave these descriptors
+# open afterwards
+echo TEST 9>/dev/null
+echo MUST ERROR OUT >&9
+echo "Output to fd#9: $?"
diff --git a/shell/hush_test/hush-redir/redir_errors.right b/shell/hush_test/hush-redir/redir_errors.right
new file mode 100644
index 000000000..3d20bbf68
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_errors.right
@@ -0,0 +1,14 @@
+hush: can't open '/does/not/exist': No such file or directory
+One:1
+hush: can't open '/cant/be/created': No such file or directory
+One:1
+Ok
+hush: can't open '/cant/be/created': No such file or directory
+Zero:0
+hush: can't open '/cant/be/created': No such file or directory
+One:1
+hush: can't open '/cant/be/created': No such file or directory
+One:1
+hush: can't open '/cant/be/created': No such file or directory
+Zero:0
+Done
diff --git a/shell/hush_test/hush-redir/redir_errors.tests b/shell/hush_test/hush-redir/redir_errors.tests
new file mode 100755
index 000000000..7c28e4324
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_errors.tests
@@ -0,0 +1,9 @@
+echo Error >/does/not/exist; echo One:$?
+t=BAD
+t=Ok >>/cant/be/created; echo One:$?
+echo $t
+! >/cant/be/created; echo Zero:$?
+exec >/cant/be/created; echo One:$?
+exec /bin/true >/cant/be/created; echo One:$?
+! exec /bin/true >/cant/be/created; echo Zero:$?
+echo Done
diff --git a/shell/hush_test/hush-redir/redir_to_bad_fd.right b/shell/hush_test/hush-redir/redir_to_bad_fd.right
new file mode 100644
index 000000000..936911ce5
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_to_bad_fd.right
@@ -0,0 +1 @@
+hush: can't duplicate file descriptor: Bad file descriptor
diff --git a/shell/hush_test/hush-redir/redir_to_bad_fd.tests b/shell/hush_test/hush-redir/redir_to_bad_fd.tests
new file mode 100755
index 000000000..91b0c1ff9
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_to_bad_fd.tests
@@ -0,0 +1,3 @@
+# ash uses fd 10 (usually) for reading the script
+echo LOST >&10
+echo OK
diff --git a/shell/hush_test/hush-signals/signal4.right b/shell/hush_test/hush-signals/signal4.right
new file mode 100644
index 000000000..2d0624714
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal4.right
@@ -0,0 +1,4 @@
+hush: trap: BADNAME: invalid signal specification
+1
+Trapped
+Ok
diff --git a/shell/hush_test/hush-signals/signal4.tests b/shell/hush_test/hush-signals/signal4.tests
new file mode 100755
index 000000000..6f1c4a950
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal4.tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+trap "echo Trapped" BADNAME TERM; echo $?
+kill $$
+echo Ok
diff --git a/shell/hush_test/hush-signals/signal8.right b/shell/hush_test/hush-signals/signal8.right
new file mode 100644
index 000000000..39572f30e
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal8.right
@@ -0,0 +1,3 @@
+Removing traps
+End of exit_func
+Done: 0
diff --git a/shell/hush_test/hush-signals/signal8.tests b/shell/hush_test/hush-signals/signal8.tests
new file mode 100755
index 000000000..731af7477
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal8.tests
@@ -0,0 +1,18 @@
+"$THIS_SH" -c '
+exit_func() {
+    echo "Removing traps"
+    trap - EXIT TERM INT
+    echo "End of exit_func"
+}
+set -e
+trap exit_func EXIT TERM INT
+sleep 2
+exit 77
+' &
+
+sleep 1
+# BUG: ash kills -PGRP, but in non-interactive shell we do not create pgrps!
+# In this case, bash kills by PID, not PGRP.
+kill -TERM %1
+wait
+echo Done: $?
diff --git a/shell/hush_test/hush-signals/signal9.right b/shell/hush_test/hush-signals/signal9.right
new file mode 100644
index 000000000..39572f30e
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal9.right
@@ -0,0 +1,3 @@
+Removing traps
+End of exit_func
+Done: 0
diff --git a/shell/hush_test/hush-signals/signal9.tests b/shell/hush_test/hush-signals/signal9.tests
new file mode 100755
index 000000000..18e71012b
--- /dev/null
+++ b/shell/hush_test/hush-signals/signal9.tests
@@ -0,0 +1,21 @@
+# Note: the inner script is a test which checks for a different bug
+# (ordering between INT handler and exit on "set -e"),
+# but so far I did not figure out how to simulate it non-interactively.
+
+"$THIS_SH" -c '
+exit_func() {
+    echo "Removing traps"
+    trap - EXIT TERM INT
+    echo "End of exit_func"
+}
+set -e
+trap exit_func EXIT TERM INT
+sleep 2
+exit 77
+' &
+
+child=$!
+sleep 1
+kill -TERM $child
+wait
+echo Done: $?
diff --git a/shell/hush_test/hush-vars/readonly0.right b/shell/hush_test/hush-vars/readonly0.right
new file mode 100644
index 000000000..8b750eb5f
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly0.right
@@ -0,0 +1,20 @@
+readonly a=A
+readonly b=B
+Ok:0
+
+hush: a=A: readonly variable
+Fail:1
+hush: a=A: readonly variable
+Fail:1
+
+hush: a=Z: readonly variable
+Fail:1
+
+hush: a=Z: readonly variable
+b=B
+^^^a is not exported
+hush: a=Z: readonly variable
+Visible:42
+
+hush: a: readonly variable
+Fail:1
diff --git a/shell/hush_test/hush-vars/readonly0.tests b/shell/hush_test/hush-vars/readonly0.tests
new file mode 100755
index 000000000..0833ccf29
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly0.tests
@@ -0,0 +1,42 @@
+unset a b
+#
+readonly a=A
+b=B
+readonly b
+# readonly on already readonly var is harmless:
+readonly b a
+readonly | grep '^readonly [ab]='
+# this should work:
+export a b
+export -n a b
+echo Ok:$?
+env | grep -e^a= -e^b=  # shows nothing
+
+echo
+# these should all fail (despite the same value being assigned)
+# bash does not abort even in non-interactive more (in script)
+true; a=A
+echo Fail:$?
+true; readonly a=A
+echo Fail:$?
+
+echo
+# in bash, assignment in export fails, but export succeeds! :)
+# we don't mimic that!
+true; export a=Z
+echo Fail:$?
+#env | grep '^a='
+#echo "^^^a is exported"
+export -n a  # undo that bashism, if it happens
+
+echo
+export b
+# this fails to both set and export a:
+a=Z env | grep '^[ab]='
+echo "^^^a is not exported"
+# but external command does get executed, and $? is not mangled (stays 42):
+(exit 42); a=Z env echo Visible:$?
+
+echo
+true; unset a
+echo Fail:$?
diff --git a/shell/hush_test/hush-vars/readonly2.right b/shell/hush_test/hush-vars/readonly2.right
new file mode 100644
index 000000000..38551d4ad
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly2.right
@@ -0,0 +1,5 @@
+hush: a=Z: readonly variable
+Visible:42
+
+hush: a=Z: readonly variable
+Visible:42
diff --git a/shell/hush_test/hush-vars/readonly2.tests b/shell/hush_test/hush-vars/readonly2.tests
new file mode 100755
index 000000000..b758d9602
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly2.tests
@@ -0,0 +1,7 @@
+unset a
+readonly a=A
+
+# external commands and builtins should behave the same:
+(exit 42); a=Z echo "Visible:$?"
+echo
+(exit 42); a=Z env echo "Visible:$?"
diff --git a/shell/hush_test/hush-vars/var-utf8-length.right b/shell/hush_test/hush-vars/var-utf8-length.right
new file mode 100644
index 000000000..6f4247a62
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-utf8-length.right
@@ -0,0 +1 @@
+26
diff --git a/shell/hush_test/hush-vars/var-utf8-length.tests b/shell/hush_test/hush-vars/var-utf8-length.tests
new file mode 100755
index 000000000..b6e87f191
--- /dev/null
+++ b/shell/hush_test/hush-vars/var-utf8-length.tests
@@ -0,0 +1,4 @@
+LANG=en_US.UTF-8
+LC_ALL=en_US.UTF-8
+X=abcdÉfghÍjklmnÓpqrstÚvwcyz
+echo ${#X}
diff --git a/shell/hush_test/hush-vars/var_bash1a.right b/shell/hush_test/hush-vars/var_bash1a.right
new file mode 100644
index 000000000..1965b5c6c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash1a.right
@@ -0,0 +1,6 @@
+parameter     'abcdef'
+varoffset2    'cdef'
+varoffset-2   'ef'
+literal '2'   'cdef'
+literal '-2'  'abcdef'
+literal ' -2' 'ef'
diff --git a/shell/hush_test/hush-vars/var_bash1a.tests b/shell/hush_test/hush-vars/var_bash1a.tests
new file mode 100755
index 000000000..c75c2dc53
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash1a.tests
@@ -0,0 +1,11 @@
+parameter=abcdef
+offset=2
+noffset=-2
+echo "parameter     '${parameter}'"
+echo "varoffset2    '${parameter:${offset}}'"
+echo "varoffset-2   '${parameter:${noffset}}'"
+echo "literal '2'   '${parameter:2}'"
+# This is not interpreted as ${VAR:POS{:LEN}},
+# but as ${VAR:=WORD} - if VAR is unset or null, substitute WORD
+echo "literal '-2'  '${parameter:-2}'"
+echo "literal ' -2' '${parameter: -2}'"
diff --git a/shell/hush_test/hush-vars/var_bash1b.right b/shell/hush_test/hush-vars/var_bash1b.right
new file mode 100644
index 000000000..fafc0f07c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash1b.right
@@ -0,0 +1,23 @@
+all    |0123456
+4:     |456
+4:2    |45
+4:-1   |45
+4:-2   |4
+4:-3   |
+-4:    |3456
+-4:2   |34
+-4:-1  |345
+-4:-2  |34
+-4:-3  |3
+-4:-4  |
+-4:i=2 |34
+-4:i=-2|34
+-4:i=-3|3
+-4:i=-4|
+-5:    |23456
+-6:    |123456
+-7:    |0123456
+-8:    |
+-9:    |
+-9:-99 |
+Ok:0
diff --git a/shell/hush_test/hush-vars/var_bash1b.tests b/shell/hush_test/hush-vars/var_bash1b.tests
new file mode 100755
index 000000000..efbdef35c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_bash1b.tests
@@ -0,0 +1,24 @@
+set -- 0123456
+        echo "all    |"$1
+        echo "4:     |"${1:4}
+        echo "4:2    |"${1:4:2}
+        echo "4:-1   |"${1:4:-1}
+        echo "4:-2   |"${1:4:-2}
+        echo "4:-3   |"${1:4:-3}
+        echo "-4:    |"${1: -4}
+        echo "-4:2   |"${1: -4:2}
+        echo "-4:-1  |"${1: -4:-1}
+        echo "-4:-2  |"${1: -4:-2}
+        echo "-4:-3  |"${1: -4:-3}
+        echo "-4:-4  |"${1: -4:-4}
+i=2;    echo "-4:i=2 |"${1: -4:i}
+i=-2;   echo "-4:i=-2|"${1: -4:i}
+i=-3;   echo "-4:i=-3|"${1: -4:i}
+i=-4;   echo "-4:i=-4|"${1: -4:i}
+        echo "-5:    |"${1: -5}
+        echo "-6:    |"${1: -6}
+        echo "-7:    |"${1: -7}
+        echo "-8:    |"${1: -8}
+        echo "-9:    |"${1: -9}
+        echo "-9:-99 |"${1: -9:-99}
+echo Ok:$?
diff --git a/shell/hush_test/run-all b/shell/hush_test/run-all
index 837b3f7da..1dd0edc39 100755
--- a/shell/hush_test/run-all
+++ b/shell/hush_test/run-all
@@ -9,6 +9,8 @@ unset LC_NUMERIC
 unset LC_TIME
 unset LC_ALL
 
+TOPDIR=`pwd`
+
 if test ! -x hush; then
         if test ! -x ../../busybox; then
                 echo "Can't run tests. Put hush binary into this directory (`pwd`)"
@@ -38,6 +40,8 @@ do_test()
         test -d "$1" || return 0
         d=${d%/}
 #       echo Running tests in directory "$1"
+        # $1 but with / replaced by # so that it can be used as filename part
+        noslash=`echo "$1" | sed 's:/:#:g'`
         (
         tret=0
         cd "$1" || { echo "cannot cd $1!"; exit 1; }
@@ -49,34 +53,35 @@ do_test()
                         #*) echo $x ; sh $x ;;
                         *)
                         echo -n "$1/$x:"
-                        sh "$x" >"../$1-$x.fail" 2>&1 && \
-                        { { echo " ok"; rm "../$1-$x.fail"; } || echo " fail"; }
+                        sh "$x" >"$TOPDIR/$noslash-$x.fail" 2>&1 && \
+                        { { echo " ok"; rm "$TOPDIR/$noslash-$x.fail"; } || echo " fail"; }
                         ;;
                 esac
         done
         # Many bash run-XXX scripts just do this,
         # no point in duplication it all over the place
         for x in *.tests; do
-        test -x "$x" || continue
-        name="${x%%.tests}"
-        test -f "$name.right" || continue
-#       echo Running test: "$x"
-        echo -n "$1/$x:"
-        (
-                "$THIS_SH" "./$x" >"$name.xx" 2>&1
-                r=$?
-                # filter C library differences
-                sed -i \
-                        -e "/: invalid option /s:'::g" \
-                        "$name.xx"
-                test $r -eq 77 && rm -f "../$1-$x.fail" && exit 77
-                diff -u "$name.xx" "$name.right" >"../$1-$x.fail" && rm -f "$name.xx" "../$1-$x.fail"
-        )
-        case $? in
-                0)  echo " ok";;
-                77) echo " skip (feature disabled)";;
-                *)  echo " fail"; tret=1;;
-        esac
+                test -x "$x" || continue
+                name="${x%%.tests}"
+                test -f "$name.right" || continue
+#               echo Running test: "$x"
+                echo -n "$1/$x:"
+                (
+                        "$THIS_SH" "./$x" >"$name.xx" 2>&1
+                        r=$?
+                        # filter C library differences
+                        sed -i \
+                                -e "/: invalid option /s:'::g" \
+                                "$name.xx"
+                        test $r -eq 77 && rm -f "$TOPDIR/$noslash-$x.fail" && exit 77
+                        diff -u "$name.xx" "$name.right" >"$TOPDIR/$noslash-$x.fail" \
+                        && rm -f "$name.xx" "$TOPDIR/$noslash-$x.fail"
+                )
+                case $? in
+                        0)  echo " ok";;
+                        77) echo " skip (feature disabled)";;
+                        *)  echo " fail"; tret=1;;
+                esac
         done
         exit ${tret}
         )
@@ -92,7 +97,7 @@ if [ $# -lt 1 ]; then
         modules=`ls -d hush-*`
 
         for module in $modules; do
-        do_test $module || ret=1
+                do_test $module || ret=1
         done
 else
         while [ $# -ge 1 ]; do
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 55617b167..154b860f8 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -412,9 +412,7 @@ shell_builtin_ulimit(char **argv)
          */
         GETOPT_RESET();
 
-        argc = 1;
-        while (argv[argc])
-                argc++;
+        argc = string_array_len(argv);
 
         opts = 0;
         while (1) {
diff --git a/testsuite/msh/msh-supports-underscores-in-variable-names b/testsuite/msh/msh-supports-underscores-in-variable-names
deleted file mode 100644
index 9c7834b37..000000000
--- a/testsuite/msh/msh-supports-underscores-in-variable-names
+++ /dev/null
@@ -1 +0,0 @@
-test "`busybox msh -c 'FOO_BAR=foo; echo $FOO_BAR'`" = foo
diff --git a/util-linux/blkdiscard.c b/util-linux/blkdiscard.c
index af0bc946d..85039c5d0 100644
--- a/util-linux/blkdiscard.c
+++ b/util-linux/blkdiscard.c
@@ -28,6 +28,13 @@
 #include "libbb.h"
 #include <linux/fs.h>
 
+#ifndef BLKDISCARD
+#define BLKDISCARD 0x1277
+#endif
+#ifndef BLKSECDISCARD
+#define BLKSECDISCARD 0x127d
+#endif
+
 int blkdiscard_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int blkdiscard_main(int argc UNUSED_PARAM, char **argv)
 {
diff --git a/util-linux/fdisk.c b/util-linux/fdisk.c
index 916d4e30e..4467525c7 100644
--- a/util-linux/fdisk.c
+++ b/util-linux/fdisk.c
@@ -185,6 +185,8 @@ struct hd_geometry {
 
 #define HDIO_GETGEO     0x0301  /* get device geometry */
 
+/* TODO: #if ENABLE_FEATURE_FDISK_WRITABLE */
+/* (currently fdisk_sun/sgi.c do not have proper WRITABLE #ifs) */
 static const char msg_building_new_label[] ALIGN1 =
 "Building a new %s. Changes will remain in memory only,\n"
 "until you decide to write them. After that the previous content\n"
@@ -192,6 +194,7 @@ static const char msg_building_new_label[] ALIGN1 =
 
 static const char msg_part_already_defined[] ALIGN1 =
 "Partition %u is already defined, delete it before re-adding\n";
+/* #endif */
 
 
 struct partition {
diff --git a/util-linux/mkfs_ext2_test.sh b/util-linux/mkfs_ext2_test.sh
index f5347cc04..df22963f2 100755
--- a/util-linux/mkfs_ext2_test.sh
+++ b/util-linux/mkfs_ext2_test.sh
@@ -47,7 +47,7 @@ test_mke2fs() {
 kilobytes=60
 while true; do
     test_mke2fs || exit 1
-    : $((kilobytes++))
+    kilobytes=$((kilobytes+1))
     test $kilobytes = 200 && break
 done
 
@@ -56,7 +56,7 @@ done
 kilobytes=$((1 * 8*1024 - 50))
 while true; do
     test_mke2fs || exit 1
-    : $((kilobytes++))
+    kilobytes=$((kilobytes+1))
     test $kilobytes = $((1 * 8*1024 + 300)) && break
 done
 
@@ -65,7 +65,7 @@ done
 kilobytes=$((2 * 8*1024 - 50))
 while true; do
     test_mke2fs || exit 1
-    : $((kilobytes++))
+    kilobytes=$((kilobytes+1))
     test $kilobytes = $((2 * 8*1024 + 400)) && break
 done
 
@@ -74,7 +74,7 @@ done
 kilobytes=$((3 * 8*1024 - 50))
 while true; do
     test_mke2fs || exit 1
-    : $((kilobytes++))
+    kilobytes=$((kilobytes+1))
     test $kilobytes = $((3 * 8*1024 + 500)) && break
 done
 
@@ -83,7 +83,7 @@ done
 kilobytes=$((4 * 8*1024 - 50))
 while true; do
     test_mke2fs || exit 1
-    : $((kilobytes++))
+    kilobytes=$((kilobytes+1))
     test $kilobytes = $((4 * 8*1024 + 600)) && break
 done
 
@@ -92,7 +92,7 @@ done
 kilobytes=$((5 * 8*1024 - 50))
 while true; do
     test_mke2fs || exit 1
-    : $((kilobytes++))
+    kilobytes=$((kilobytes+1))
     test $kilobytes = $((5 * 8*1024 + 700)) && break
 done
 exit
diff --git a/util-linux/mount.c b/util-linux/mount.c
index 6bb18524d..5fcc7958c 100644
--- a/util-linux/mount.c
+++ b/util-linux/mount.c
@@ -246,7 +246,8 @@
 /* This is just a warning of a common mistake.  Possibly this should be a
  * uclibc faq entry rather than in busybox... */
 # if defined(__UCLIBC__) && ! defined(__UCLIBC_HAS_RPC__)
-#  error "You need to build uClibc with UCLIBC_HAS_RPC for NFS support"
+#  warning "You probably need to build uClibc with UCLIBC_HAS_RPC for NFS support"
+   /* not #error, since user may be using e.g. libtirpc instead */
 # endif
 # include <rpc/rpc.h>
 # include <rpc/pmap_prot.h>
diff --git a/util-linux/setpriv.c b/util-linux/setpriv.c
new file mode 100644
index 000000000..3d8dfea52
--- /dev/null
+++ b/util-linux/setpriv.c
@@ -0,0 +1,451 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * setpriv implementation for busybox based on linux-utils-ng 2.29
+ *
+ * Copyright (C) 2017 by  <assafgordon@gmail.com>
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ *
+ */
+//config:config SETPRIV
+//config:       bool "setpriv"
+//config:       default y
+//config:       select PLATFORM_LINUX
+//config:       select LONG_OPTS
+//config:       help
+//config:         Run a program with different Linux privilege settings.
+//config:         Requires kernel >= 3.5
+//config:
+//config:config FEATURE_SETPRIV_DUMP
+//config:       bool "Support dumping current privilege state"
+//config:       default y
+//config:       depends on SETPRIV
+//config:       help
+//config:         Enables the "--dump" switch to print out the current privilege
+//config:         state. This is helpful for diagnosing problems.
+//config:
+//config:config FEATURE_SETPRIV_CAPABILITIES
+//config:       bool "Support capabilities"
+//config:       default y
+//config:       depends on SETPRIV
+//config:       help
+//config:         Capabilities can be used to grant processes additional rights
+//config:         without the necessity to always execute as the root user.
+//config:         Enabling this option enables "--dump" to show information on
+//config:         capabilities.
+//config:
+//config:config FEATURE_SETPRIV_CAPABILITY_NAMES
+//config:       bool "Support capability names"
+//config:       default y
+//config:       depends on SETPRIV && FEATURE_SETPRIV_CAPABILITIES
+//config:       help
+//config:         Capabilities can be either referenced via a human-readble name,
+//config:         e.g. "net_admin", or using their index, e.g. "cap_12". Enabling
+//config:         this option allows using the human-readable names in addition to
+//config:         the index-based names.
+
+//applet:IF_SETPRIV(APPLET(setpriv, BB_DIR_BIN, BB_SUID_DROP))
+
+//kbuild:lib-$(CONFIG_SETPRIV) += setpriv.o
+
+//usage:#define setpriv_trivial_usage
+//usage:        "[OPTIONS] PROG [ARGS]"
+//usage:#define setpriv_full_usage "\n\n"
+//usage:       "Run PROG with different privilege settings\n"
+//usage:        IF_FEATURE_SETPRIV_DUMP(
+//usage:     "\n-d,--dump               Show current capabilities"
+//usage:        )
+//usage:     "\n--nnp,--no-new-privs    Ignore setuid/setgid bits and file capabilities"
+//usage:        IF_FEATURE_SETPRIV_CAPABILITIES(
+//usage:     "\n--inh-caps CAP,CAP      Set inheritable capabilities"
+//usage:     "\n--ambient-caps CAP,CAP  Set ambient capabilities"
+//usage:        )
+
+//setpriv from util-linux 2.28:
+// -d, --dump               show current state (and do not exec anything)
+// --nnp, --no-new-privs    disallow granting new privileges
+// --inh-caps <caps,...>    set inheritable capabilities
+// --bounding-set <caps>    set capability bounding set
+// --ruid <uid>             set real uid
+// --euid <uid>             set effective uid
+// --rgid <gid>             set real gid
+// --egid <gid>             set effective gid
+// --reuid <uid>            set real and effective uid
+// --regid <gid>            set real and effective gid
+// --clear-groups           clear supplementary groups
+// --keep-groups            keep supplementary groups
+// --groups <group,...>     set supplementary groups
+// --securebits <bits>      set securebits
+// --selinux-label <label>  set SELinux label
+// --apparmor-profile <pr>  set AppArmor profile
+
+#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
+#include <linux/capability.h>
+// #include <sys/capability.h>
+// This header is in libcap, but the functions are in libc.
+// Comment in the header says this above capset/capget:
+/* system calls - look to libc for function to system call mapping */
+extern int capset(cap_user_header_t header, cap_user_data_t data);
+extern int capget(cap_user_header_t header, const cap_user_data_t data);
+// so for bbox, let's just repeat the declarations.
+// This way, libcap needs not be installed in build environment.
+#endif
+#include <sys/prctl.h>
+#include "libbb.h"
+
+#ifndef PR_CAPBSET_READ
+#define PR_CAPBSET_READ 23
+#endif
+
+#ifndef PR_SET_NO_NEW_PRIVS
+#define PR_SET_NO_NEW_PRIVS 38
+#endif
+
+#ifndef PR_GET_NO_NEW_PRIVS
+#define PR_GET_NO_NEW_PRIVS 39
+#endif
+
+#ifndef PR_CAP_AMBIENT
+#define PR_CAP_AMBIENT 47
+#define PR_CAP_AMBIENT_IS_SET 1
+#define PR_CAP_AMBIENT_RAISE 2
+#define PR_CAP_AMBIENT_LOWER 3
+#endif
+
+enum {
+        IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,)
+        IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_INH,)
+        IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_AMB,)
+        OPTBIT_NNP,
+
+        IF_FEATURE_SETPRIV_DUMP(OPT_DUMP = (1 << OPTBIT_DUMP),)
+        IF_FEATURE_SETPRIV_CAPABILITIES(OPT_INH  = (1 << OPTBIT_INH),)
+        IF_FEATURE_SETPRIV_CAPABILITIES(OPT_AMB  = (1 << OPTBIT_AMB),)
+        OPT_NNP  = (1 << OPTBIT_NNP),
+};
+
+#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
+struct caps {
+        struct __user_cap_header_struct header;
+        cap_user_data_t data;
+        int u32s;
+};
+
+# if ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
+static const char *const capabilities[] = {
+        "chown",
+        "dac_override",
+        "dac_read_search",
+        "fowner",
+        "fsetid",
+        "kill",
+        "setgid",
+        "setuid",
+        "setpcap",
+        "linux_immutable",
+        "net_bind_service",
+        "net_broadcast",
+        "net_admin",
+        "net_raw",
+        "ipc_lock",
+        "ipc_owner",
+        "sys_module",
+        "sys_rawio",
+        "sys_chroot",
+        "sys_ptrace",
+        "sys_pacct",
+        "sys_admin",
+        "sys_boot",
+        "sys_nice",
+        "sys_resource",
+        "sys_time",
+        "sys_tty_config",
+        "mknod",
+        "lease",
+        "audit_write",
+        "audit_control",
+        "setfcap",
+        "mac_override",
+        "mac_admin",
+        "syslog",
+        "wake_alarm",
+        "block_suspend",
+        "audit_read",
+};
+# endif /* FEATURE_SETPRIV_CAPABILITY_NAMES */
+
+static void getcaps(struct caps *caps)
+{
+        static const uint8_t versions[] = {
+                _LINUX_CAPABILITY_U32S_3, /* = 2 (fits into byte) */
+                _LINUX_CAPABILITY_U32S_2, /* = 2 */
+                _LINUX_CAPABILITY_U32S_1, /* = 1 */
+        };
+        int i;
+
+        caps->header.pid = 0;
+        for (i = 0; i < ARRAY_SIZE(versions); i++) {
+                caps->header.version = versions[i];
+                if (capget(&caps->header, NULL) == 0)
+                        goto got_it;
+        }
+        bb_simple_perror_msg_and_die("capget");
+ got_it:
+
+        switch (caps->header.version) {
+                case _LINUX_CAPABILITY_VERSION_1:
+                        caps->u32s = _LINUX_CAPABILITY_U32S_1;
+                        break;
+                case _LINUX_CAPABILITY_VERSION_2:
+                        caps->u32s = _LINUX_CAPABILITY_U32S_2;
+                        break;
+                case _LINUX_CAPABILITY_VERSION_3:
+                        caps->u32s = _LINUX_CAPABILITY_U32S_3;
+                        break;
+                default:
+                        bb_error_msg_and_die("unsupported capability version");
+        }
+
+        caps->data = xmalloc(sizeof(caps->data[0]) * caps->u32s);
+        if (capget(&caps->header, caps->data) < 0)
+                bb_simple_perror_msg_and_die("capget");
+}
+
+static void parse_cap(unsigned long *index, const char *cap)
+{
+        unsigned long i;
+
+        switch (cap[0]) {
+        case '-':
+                break;
+        case '+':
+                break;
+        default:
+                bb_error_msg_and_die("invalid capability '%s'", cap);
+                break;
+        }
+
+        cap++;
+        if ((sscanf(cap, "cap_%lu", &i)) == 1) {
+                if (!cap_valid(i))
+                        bb_error_msg_and_die("unsupported capability '%s'", cap);
+                *index = i;
+                return;
+        }
+
+# if ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
+        for (i = 0; i < ARRAY_SIZE(capabilities); i++) {
+                if (strcmp(capabilities[i], cap) != 0)
+                        continue;
+
+                if (!cap_valid(i))
+                        bb_error_msg_and_die("unsupported capability '%s'", cap);
+                *index = i;
+                return;
+        }
+# endif
+
+        bb_error_msg_and_die("unknown capability '%s'", cap);
+}
+
+static void set_inh_caps(char *capstring)
+{
+        struct caps caps;
+
+        getcaps(&caps);
+
+        capstring = strtok(capstring, ",");
+        while (capstring) {
+                unsigned long cap;
+
+                parse_cap(&cap, capstring);
+                if (CAP_TO_INDEX(cap) >= caps.u32s)
+                        bb_error_msg_and_die("invalid capability cap");
+
+                if (capstring[0] == '+')
+                        caps.data[CAP_TO_INDEX(cap)].inheritable |= CAP_TO_MASK(cap);
+                else
+                        caps.data[CAP_TO_INDEX(cap)].inheritable &= ~CAP_TO_MASK(cap);
+                capstring = strtok(NULL, ",");
+        }
+
+        if ((capset(&caps.header, caps.data)) < 0)
+                bb_perror_msg_and_die("capset");
+
+        if (ENABLE_FEATURE_CLEAN_UP)
+                free(caps.data);
+}
+
+static void set_ambient_caps(char *string)
+{
+        char *cap;
+
+        cap = strtok(string, ",");
+        while (cap) {
+                unsigned long index;
+
+                parse_cap(&index, cap);
+                if (cap[0] == '+') {
+                        if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, index, 0, 0) < 0)
+                                bb_perror_msg("cap_ambient_raise");
+                } else {
+                        if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, index, 0, 0) < 0)
+                                bb_perror_msg("cap_ambient_lower");
+                }
+                cap = strtok(NULL, ",");
+        }
+}
+#endif /* FEATURE_SETPRIV_CAPABILITIES */
+
+#if ENABLE_FEATURE_SETPRIV_DUMP
+# if ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
+static void printf_cap(const char *pfx, unsigned cap_no)
+{
+        if (cap_no < ARRAY_SIZE(capabilities)) {
+                printf("%s%s", pfx, capabilities[cap_no]);
+                return;
+        }
+        printf("%scap_%u", pfx, cap_no);
+}
+# else
+#  define printf_cap(pfx, cap_no) printf("%scap_%u", (pfx), (cap_no))
+# endif
+
+static int dump(void)
+{
+        IF_FEATURE_SETPRIV_CAPABILITIES(struct caps caps;)
+        const char *fmt;
+        uid_t ruid, euid, suid;
+        gid_t rgid, egid, sgid;
+        gid_t *gids;
+        int i, ngids, nnp;
+
+        getresuid(&ruid, &euid, &suid); /* never fails in Linux */
+        getresgid(&rgid, &egid, &sgid); /* never fails in Linux */
+        ngids = 0;
+        gids = bb_getgroups(&ngids, NULL); /* never fails in Linux */
+
+        nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
+        if (nnp < 0)
+                bb_perror_msg_and_die("prctl: %s", "GET_NO_NEW_PRIVS");
+
+        printf("uid: %u\n", (unsigned)ruid);
+        printf("euid: %u\n", (unsigned)euid);
+        printf("gid: %u\n", (unsigned)rgid);
+        printf("egid: %u\n", (unsigned)egid);
+
+        printf("Supplementary groups: ");
+        if (ngids == 0) {
+                printf("[none]");
+        } else {
+                fmt = ",%u" + 1;
+                for (i = 0; i < ngids; i++) {
+                        printf(fmt, (unsigned)gids[i]);
+                        fmt = ",%u";
+                }
+        }
+        printf("\nno_new_privs: %d\n", nnp);
+
+# if ENABLE_FEATURE_SETPRIV_CAPABILITIES
+        getcaps(&caps);
+        printf("Inheritable capabilities: ");
+        fmt = "";
+        for (i = 0; cap_valid(i); i++) {
+                unsigned idx = CAP_TO_INDEX(i);
+                if (idx >= caps.u32s) {
+                        printf("\nindex: %u u32s: %u capability: %u\n", idx, caps.u32s, i);
+                        bb_error_msg_and_die("unsupported capability");
+                }
+                if (caps.data[idx].inheritable & CAP_TO_MASK(i)) {
+                        printf_cap(fmt, i);
+                        fmt = ",";
+                }
+        }
+        if (!fmt[0])
+                printf("[none]");
+
+        printf("\nAmbient capabilities: ");
+        fmt = "";
+        for (i = 0; cap_valid(i); i++) {
+                int ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, (unsigned long) i, 0UL, 0UL);
+                if (ret < 0)
+                        bb_perror_msg_and_die("prctl: %s", "CAP_AMBIENT_IS_SET");
+                if (ret) {
+                        printf_cap(fmt, i);
+                        fmt = ",";
+                }
+        }
+        if (i == 0)
+                printf("[unsupported]");
+        else if (!fmt[0])
+                printf("[none]");
+
+        printf("\nCapability bounding set: ");
+        fmt = "";
+        for (i = 0; cap_valid(i); i++) {
+                int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL);
+                if (ret < 0)
+                        bb_perror_msg_and_die("prctl: %s", "CAPBSET_READ");
+                if (ret) {
+                        printf_cap(fmt, i);
+                        fmt = ",";
+                }
+        }
+        if (!fmt[0])
+                printf("[none]");
+        bb_putchar('\n');
+# endif
+
+        if (ENABLE_FEATURE_CLEAN_UP) {
+                IF_FEATURE_SETPRIV_CAPABILITIES(free(caps.data);)
+                free(gids);
+        }
+        return EXIT_SUCCESS;
+}
+#endif /* FEATURE_SETPRIV_DUMP */
+
+int setpriv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int setpriv_main(int argc UNUSED_PARAM, char **argv)
+{
+        static const char setpriv_longopts[] ALIGN1 =
+                IF_FEATURE_SETPRIV_DUMP(
+                "dump\0"         No_argument            "d"
+                )
+                "nnp\0"          No_argument            "\xff"
+                "no-new-privs\0" No_argument            "\xff"
+                IF_FEATURE_SETPRIV_CAPABILITIES(
+                "inh-caps\0"     Required_argument      "\xfe"
+                "ambient-caps\0" Required_argument      "\xfd"
+                )
+                ;
+        int opts;
+        IF_FEATURE_SETPRIV_CAPABILITIES(char *inh_caps, *ambient_caps;)
+
+        applet_long_options = setpriv_longopts;
+        opts = getopt32(argv, "+"IF_FEATURE_SETPRIV_DUMP("d")
+                        IF_FEATURE_SETPRIV_CAPABILITIES("\xfe:\xfd:", &inh_caps, &ambient_caps));
+        argv += optind;
+
+#if ENABLE_FEATURE_SETPRIV_DUMP
+        if (opts & OPT_DUMP) {
+                if (argv[0] || (opts - OPT_DUMP) != 0)
+                        bb_show_usage();
+                return dump();
+        }
+#endif
+        if (opts & OPT_NNP) {
+                if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+                        bb_perror_msg_and_die("prctl: %s", "SET_NO_NEW_PRIVS");
+        }
+
+#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
+        if (opts & OPT_INH)
+                set_inh_caps(inh_caps);
+        if (opts & OPT_AMB)
+                set_ambient_caps(ambient_caps);
+#endif
+
+        if (!argv[0])
+                bb_show_usage();
+        BB_EXECVP_or_die(argv);
+}
diff --git a/util-linux/unshare.c b/util-linux/unshare.c
index 52e8f1421..875e3f86e 100644
--- a/util-linux/unshare.c
+++ b/util-linux/unshare.c
@@ -9,12 +9,13 @@
 //config:config UNSHARE
 //config:       bool "unshare"
 //config:       default y
-//config:       depends on LONG_OPTS && !NOMMU
+//config:       depends on !NOMMU
 //config:       select PLATFORM_LINUX
+//config:       select LONG_OPTS
 //config:       help
 //config:         Run program with some namespaces unshared from parent.
 
-// depends on LONG_OPTS: it is awkward to exclude code which handles --propagation
+// needs LONG_OPTS: it is awkward to exclude code which handles --propagation
 // and --setgroups based on LONG_OPTS, so instead applet requires LONG_OPTS.
 // depends on !NOMMU: we need fork()
 
@@ -32,7 +33,7 @@
 //usage:     "\n        -p,--pid[=FILE]         Unshare PID namespace"
 //usage:     "\n        -U,--user[=FILE]        Unshare user namespace"
 //usage:     "\n        -f,--fork               Fork before execing PROG"
-//usage:     "\n        -r,--map-root-user      Map current user to root (implies -u)"
+//usage:     "\n        -r,--map-root-user      Map current user to root (implies -U)"
 //usage:     "\n        --mount-proc[=DIR]      Mount /proc filesystem first (implies -m)"
 //usage:     "\n        --propagation slave|shared|private|unchanged"
 //usage:     "\n                                Modify mount propagation in mount namespace"