Merge branch 'busybox' into merge

56 files changed, 840 insertions, 516 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 5ec035043..35438a887 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -204,7 +204,6 @@
 
 #define JOBS ENABLE_ASH_JOB_CONTROL
 
-#include <setjmp.h>
 #include <fnmatch.h>
 #include <sys/times.h>
 #include <sys/utsname.h> /* for setting $HOSTNAME */
@@ -5755,7 +5754,7 @@ openredirect(union node *redir)
                                 f = open(fname, O_WRONLY, 0666);
                                 if (f < 0)
                                         goto ecreate;
-                                if (fstat(f, &sb) < 0 && S_ISREG(sb.st_mode)) {
+                                if (!fstat(f, &sb) && S_ISREG(sb.st_mode)) {
                                         close(f);
                                         errno = EEXIST;
                                         goto ecreate;
@@ -6255,10 +6254,9 @@ static int substr_atoi(const char *s)
  * performs globbing, and thus diverges from what we do).
  */
 #define EXP_CASE        0x10    /* keeps quotes around for CASE pattern */
-#define EXP_QPAT        0x20    /* pattern in quoted parameter expansion */
-#define EXP_VARTILDE2   0x40    /* expand tildes after colons only */
-#define EXP_WORD        0x80    /* expand word in parameter expansion */
-#define EXP_QUOTED      0x100   /* expand word in double quotes */
+#define EXP_VARTILDE2   0x20    /* expand tildes after colons only */
+#define EXP_WORD        0x40    /* expand word in parameter expansion */
+#define EXP_QUOTED      0x80    /* expand word in double quotes */
 /*
  * rmescape() flags
  */
@@ -6268,7 +6266,7 @@ static int substr_atoi(const char *s)
 #define RMESCAPE_HEAP   0x10    /* Malloc strings instead of stalloc */
 
 /* Add CTLESC when necessary. */
-#define QUOTES_ESC     (EXP_FULL | EXP_CASE | EXP_QPAT)
+#define QUOTES_ESC     (EXP_FULL | EXP_CASE)
 /* Do not skip NUL characters. */
 #define QUOTES_KEEPNUL EXP_TILDE
 
@@ -6343,7 +6341,10 @@ ifsbreakup(char *string, struct arglist *arglist)
                 realifs = ifsset() ? ifsval() : defifs;
                 ifsp = &ifsfirst;
                 do {
+                        int afternul;
+
                         p = string + ifsp->begoff;
+                        afternul = nulonly;
                         nulonly = ifsp->nulonly;
                         ifs = nulonly ? nullstr : realifs;
                         ifsspc = 0;
@@ -6355,7 +6356,7 @@ ifsbreakup(char *string, struct arglist *arglist)
                                         p++;
                                         continue;
                                 }
-                                if (!nulonly)
+                                if (!(afternul || nulonly))
                                         ifsspc = (strchr(defifs, *p) != NULL);
                                 /* Ignore IFS whitespace at start */
                                 if (q == start && ifsspc) {
@@ -6457,7 +6458,6 @@ rmescapes(char *str, int flag, int *slash_position)
                 IF_BASH_PATTERN_SUBST('/',) CTLESC, CTLQUOTEMARK, '\0' };
 
         char *p, *q, *r;
-        unsigned inquotes;
         unsigned protect_against_glob;
         unsigned globbing;
 
@@ -6488,18 +6488,21 @@ rmescapes(char *str, int flag, int *slash_position)
                 }
         }
 
-        inquotes = 0;
         globbing = flag & RMESCAPE_GLOB;
         protect_against_glob = globbing;
         while (*p) {
                 if ((unsigned char)*p == CTLQUOTEMARK) {
-// Note: both inquotes and protect_against_glob only affect whether
+// Note: protect_against_glob only affect whether
 // CTLESC,<ch> gets converted to <ch> or to \<ch>
-                        inquotes = ~inquotes;
                         p++;
                         protect_against_glob = globbing;
                         continue;
                 }
+                if (*p == '\\') {
+                        /* naked back slash */
+                        protect_against_glob = 0;
+                        goto copy;
+                }
                 if ((unsigned char)*p == CTLESC) {
                         p++;
 #if DEBUG
@@ -6535,10 +6538,6 @@ rmescapes(char *str, int flag, int *slash_position)
                                         *q++ = '\\';
                                 }
                         }
-                } else if (*p == '\\' && !inquotes) {
-                        /* naked back slash */
-                        protect_against_glob = 0;
-                        goto copy;
                 }
 #if BASH_PATTERN_SUBST
                 else if (slash_position && p == str + *slash_position) {
@@ -7032,12 +7031,12 @@ argstr(char *p, int flags)
                 case CTLENDVAR: /* ??? */
                         goto breakloop;
                 case CTLQUOTEMARK:
-                        inquotes ^= EXP_QUOTED;
                         /* "$@" syntax adherence hack */
-                        if (inquotes && !memcmp(p, dolatstr + 1, DOLATSTRLEN - 1)) {
-                                p = evalvar(p + 1, flags | inquotes) + 1;
+                        if (!inquotes && !memcmp(p, dolatstr + 1, DOLATSTRLEN - 1)) {
+                                p = evalvar(p + 1, flags | EXP_QUOTED) + 1;
                                 goto start;
                         }
+                        inquotes ^= EXP_QUOTED;
  addquote:
                         if (flags & QUOTES_ESC) {
                                 p--;
@@ -7048,16 +7047,6 @@ argstr(char *p, int flags)
                 case CTLESC:
                         startloc++;
                         length++;
-
-                        /*
-                         * Quoted parameter expansion pattern: remove quote
-                         * unless inside inner quotes or we have a literal
-                         * backslash.
-                         */
-                        if (((flags | inquotes) & (EXP_QPAT | EXP_QUOTED)) ==
-                            EXP_QPAT && *p != '\\')
-                                break;
-
                         goto addquote;
                 case CTLVAR:
                         TRACE(("argstr: evalvar('%s')\n", p));
@@ -7248,15 +7237,24 @@ subevalvar(char *p, char *varname, int strloc, int subtype,
         }
 #endif
         argstr_flags = EXP_TILDE;
-        if (subtype != VSASSIGN && subtype != VSQUESTION)
-                argstr_flags |= (flag & (EXP_QUOTED | EXP_QPAT) ? EXP_QPAT : EXP_CASE);
+        if (subtype != VSASSIGN
+         && subtype != VSQUESTION
+#if BASH_SUBSTR
+         && subtype != VSSUBSTR
+#endif
+        ) {
+                /* EXP_CASE keeps CTLESC's */
+                argstr_flags = EXP_TILDE | EXP_CASE;
+        }
         argstr(p, argstr_flags);
+        //bb_error_msg("str0:'%s'", (char *)stackblock() + strloc);
 #if BASH_PATTERN_SUBST
         slash_pos = -1;
         if (repl) {
                 slash_pos = expdest - ((char *)stackblock() + strloc);
                 STPUTC('/', expdest);
-                argstr(repl + 1, argstr_flags);
+                //bb_error_msg("repl+1:'%s'", repl + 1);
+                argstr(repl + 1, EXP_TILDE); /* EXP_TILDE: echo "${v/x/~}" expands ~ ! */
                 *repl = '/';
         }
 #endif
@@ -11182,6 +11180,34 @@ pgetc_eatbnl(void)
         return c;
 }
 
+struct synstack {
+        smalluint syntax;
+        uint8_t innerdq   :1;
+        uint8_t varpushed :1;
+        uint8_t dblquote  :1;
+        int varnest;            /* levels of variables expansion */
+        int dqvarnest;          /* levels of variables expansion within double quotes */
+        int parenlevel;         /* levels of parens in arithmetic */
+        struct synstack *prev;
+        struct synstack *next;
+};
+
+static void
+synstack_push(struct synstack **stack, struct synstack *next, int syntax)
+{
+        memset(next, 0, sizeof(*next));
+        next->syntax = syntax;
+        next->next = *stack;
+        (*stack)->prev = next;
+        *stack = next;
+}
+
+static ALWAYS_INLINE void
+synstack_pop(struct synstack **stack)
+{
+        *stack = (*stack)->next;
+}
+
 /*
  * To handle the "." command, a stack of input files is used.  Pushfile
  * adds a new entry to the stack and popfile restores the previous level.
@@ -12443,19 +12469,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         size_t len;
         struct nodelist *bqlist;
         smallint quotef;
-        smallint dblquote;
         smallint oldstyle;
-        IF_FEATURE_SH_MATH(smallint prevsyntax;) /* syntax before arithmetic */
         smallint pssyntax;   /* we are expanding a prompt string */
-        int varnest;         /* levels of variables expansion */
-        IF_FEATURE_SH_MATH(int arinest;)    /* levels of arithmetic expansion */
-        IF_FEATURE_SH_MATH(int parenlevel;) /* levels of parens in arithmetic */
-        int dqvarnest;       /* levels of variables expansion within double quotes */
         IF_BASH_DOLLAR_SQUOTE(smallint bash_dollar_squote = 0;)
+        /* syntax stack */
+        struct synstack synbase = { };
+        struct synstack *synstack = &synbase;
 
-        bqlist = NULL;
-        quotef = 0;
-        IF_FEATURE_SH_MATH(prevsyntax = 0;)
 #if ENABLE_ASH_EXPAND_PRMT
         pssyntax = (syntax == PSSYNTAX);
         if (pssyntax)
@@ -12463,11 +12483,12 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
 #else
         pssyntax = 0; /* constant */
 #endif
-        dblquote = (syntax == DQSYNTAX);
-        varnest = 0;
-        IF_FEATURE_SH_MATH(arinest = 0;)
-        IF_FEATURE_SH_MATH(parenlevel = 0;)
-        dqvarnest = 0;
+        synstack->syntax = syntax;
+
+        if (syntax == DQSYNTAX)
+                synstack->dblquote = 1;
+        quotef = 0;
+        bqlist = NULL;
 
         STARTSTACKSTR(out);
  loop:
@@ -12475,9 +12496,9 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
         CHECKEND();     /* set c to PEOF if at end of here document */
         for (;;) {      /* until end of line or end of word */
                 CHECKSTRSPACE(4, out);  /* permit 4 calls to USTPUTC */
-                switch (SIT(c, syntax)) {
+                switch (SIT(c, synstack->syntax)) {
                 case CNL:       /* '\n' */
-                        if (syntax == BASESYNTAX)
+                        if (synstack->syntax == BASESYNTAX)
                                 goto endword;   /* exit outer loop */
                         USTPUTC(c, out);
                         nlprompt();
@@ -12497,13 +12518,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                 if (c & 0x100) {
                                         /* Unknown escape. Encode as '\z' */
                                         c = (unsigned char)c;
-                                        if (eofmark == NULL || dblquote)
+                                        if (eofmark == NULL || synstack->dblquote)
                                                 USTPUTC(CTLESC, out);
                                         USTPUTC('\\', out);
                                 }
                         }
 #endif
-                        if (eofmark == NULL || dblquote)
+                        if (!eofmark || synstack->dblquote || synstack->varnest)
                                 USTPUTC(CTLESC, out);
                         USTPUTC(c, out);
                         break;
@@ -12523,20 +12544,13 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                                 /* Backslash is retained if we are in "str"
                                  * and next char isn't dquote-special.
                                  */
-                                if (dblquote
+                                if (synstack->dblquote
                                  && c != '\\'
                                  && c != '`'
                                  && c != '$'
-                                 && (c != '"' || eofmark != NULL)
+                                 && (c != '"' || (eofmark != NULL && !synstack->varnest))
+                                 && (c != '}' || !synstack->varnest)
                                 ) {
-//dash survives not doing USTPUTC(CTLESC), but merely by chance:
-//Example: "\z" gets encoded as "\<CTLESC>z".
-//rmescapes() then emits "\", "\z", protecting z from globbing.
-//But it's wrong, should protect _both_ from globbing:
-//everything in double quotes is not globbed.
-//Unlike dash, we have a fix in rmescapes() which emits bare "z"
-//for "<CTLESC>z" since "z" is not glob-special (else unicode may break),
-//and glob would see "\z" and eat "\". Thus:
                                         USTPUTC(CTLESC, out); /* protect '\' from glob */
                                         USTPUTC('\\', out);
                                 }
@@ -12546,56 +12560,62 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                         }
                         break;
                 case CSQUOTE:
-                        syntax = SQSYNTAX;
+                        synstack->syntax = SQSYNTAX;
  quotemark:
                         if (eofmark == NULL) {
                                 USTPUTC(CTLQUOTEMARK, out);
                         }
                         break;
                 case CDQUOTE:
-                        syntax = DQSYNTAX;
-                        dblquote = 1;
+                        synstack->syntax = DQSYNTAX;
+                        synstack->dblquote = 1;
+ toggledq:
+                        if (synstack->varnest)
+                                synstack->innerdq ^= 1;
                         goto quotemark;
                 case CENDQUOTE:
                         IF_BASH_DOLLAR_SQUOTE(bash_dollar_squote = 0;)
-                        if (eofmark != NULL && varnest == 0) {
+                        if (eofmark != NULL && synstack->varnest == 0) {
                                 USTPUTC(c, out);
-                        } else {
-                                if (dqvarnest == 0) {
-                                        syntax = BASESYNTAX;
-                                        dblquote = 0;
-                                }
-                                quotef = 1;
-                                goto quotemark;
+                                break;
                         }
-                        break;
+
+                        if (synstack->dqvarnest == 0) {
+                                synstack->syntax = BASESYNTAX;
+                                synstack->dblquote = 0;
+                        }
+
+                        quotef = 1;
+
+                        if (c == '"')
+                                goto toggledq;
+
+                        goto quotemark;
                 case CVAR:      /* '$' */
                         PARSESUB();             /* parse substitution */
                         break;
                 case CENDVAR:   /* '}' */
-                        if (varnest > 0) {
-                                varnest--;
-                                if (dqvarnest > 0) {
-                                        dqvarnest--;
-                                }
+                        if (!synstack->innerdq && synstack->varnest > 0) {
+                                if (!--synstack->varnest && synstack->varpushed)
+                                        synstack_pop(&synstack);
+                                else if (synstack->dqvarnest > 0)
+                                        synstack->dqvarnest--;
                                 c = CTLENDVAR;
                         }
                         USTPUTC(c, out);
                         break;
 #if ENABLE_FEATURE_SH_MATH
                 case CLP:       /* '(' in arithmetic */
-                        parenlevel++;
+                        synstack->parenlevel++;
                         USTPUTC(c, out);
                         break;
                 case CRP:       /* ')' in arithmetic */
-                        if (parenlevel > 0) {
-                                parenlevel--;
+                        if (synstack->parenlevel > 0) {
+                                synstack->parenlevel--;
                         } else {
                                 if (pgetc_eatbnl() == ')') {
                                         c = CTLENDARI;
-                                        if (--arinest == 0) {
-                                                syntax = prevsyntax;
-                                        }
+                                        synstack_pop(&synstack);
                                 } else {
                                         /*
                                          * unbalanced parens
@@ -12621,7 +12641,7 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
                 case CIGN:
                         break;
                 default:
-                        if (varnest == 0) {
+                        if (synstack->varnest == 0) {
 #if BASH_REDIR_OUTPUT
                                 if (c == '&') {
 //Can't call pgetc_eatbnl() here, this requires three-deep pungetc()
@@ -12640,12 +12660,12 @@ readtoken1(int c, int syntax, char *eofmark, int striptabs)
  endword:
 
 #if ENABLE_FEATURE_SH_MATH
-        if (syntax == ARISYNTAX)
+        if (synstack->syntax == ARISYNTAX)
                 raise_error_syntax("missing '))'");
 #endif
-        if (syntax != BASESYNTAX && eofmark == NULL)
+        if (synstack->syntax != BASESYNTAX && eofmark == NULL)
                 raise_error_syntax("unterminated quoted string");
-        if (varnest != 0) {
+        if (synstack->varnest != 0) {
                 /* { */
                 raise_error_syntax("missing '}'");
         }
@@ -12827,7 +12847,7 @@ parsesub: {
          || (c != '(' && c != '{' && !is_name(c) && !is_special(c))
         ) {
 #if BASH_DOLLAR_SQUOTE
-                if (syntax != DQSYNTAX && c == '\'')
+                if (synstack->syntax != DQSYNTAX && c == '\'')
                         bash_dollar_squote = 1;
                 else
 #endif
@@ -12847,6 +12867,8 @@ parsesub: {
                 }
         } else {
                 /* $VAR, $<specialchar>, ${...}, or PEOA/PEOF */
+                smalluint newsyn = synstack->syntax;
+
                 USTPUTC(CTLVAR, out);
                 typeloc = out - (char *)stackblock();
                 STADJUST(1, out);
@@ -12905,6 +12927,8 @@ parsesub: {
                         static const char types[] ALIGN1 = "}-+?=";
                         /* ${VAR...} but not $VAR or ${#VAR} */
                         /* c == first char after VAR */
+                        int cc = c;
+
                         switch (c) {
                         case ':':
                                 c = pgetc_eatbnl();
@@ -12929,21 +12953,24 @@ parsesub: {
                                 break;
                         }
                         case '%':
-                        case '#': {
-                                int cc = c;
+                        case '#':
                                 subtype = (c == '#' ? VSTRIMLEFT : VSTRIMRIGHT);
                                 c = pgetc_eatbnl();
-                                if (c != cc)
-                                        goto badsub;
-                                subtype++;
+                                if (c == cc)
+                                        subtype++;
+                                else
+                                        pungetc();
+
+                                newsyn = BASESYNTAX;
                                 break;
-                        }
 #if BASH_PATTERN_SUBST
                         case '/':
                                 /* ${v/[/]pattern/repl} */
 //TODO: encode pattern and repl separately.
-// Currently ${v/$var_with_slash/repl} is horribly broken
+// Currently cases like: v=1;echo ${v/$((1/1))/ONE}
+// are broken (should print "ONE")
                                 subtype = VSREPLACE;
+                                newsyn = BASESYNTAX;
                                 c = pgetc_eatbnl();
                                 if (c != '/')
                                         goto badsub;
@@ -12955,11 +12982,26 @@ parsesub: {
  badsub:
                         pungetc();
                 }
+
+                if (newsyn == ARISYNTAX)
+                        newsyn = DQSYNTAX;
+
+                if ((newsyn != synstack->syntax || synstack->innerdq)
+                 && subtype != VSNORMAL
+                ) {
+                        synstack_push(&synstack,
+                                synstack->prev ?: alloca(sizeof(*synstack)),
+                                newsyn);
+
+                        synstack->varpushed = 1;
+                        synstack->dblquote = newsyn != BASESYNTAX;
+                }
+
                 ((unsigned char *)stackblock())[typeloc] = subtype;
                 if (subtype != VSNORMAL) {
-                        varnest++;
-                        if (dblquote)
-                                dqvarnest++;
+                        synstack->varnest++;
+                        if (synstack->dblquote)
+                                synstack->dqvarnest++;
                 }
                 STPUTC('=', out);
         }
@@ -13016,7 +13058,7 @@ parsebackq: {
                         case '\\':
                                 pc = pgetc(); /* or pgetc_eatbnl()? why (example)? */
                                 if (pc != '\\' && pc != '`' && pc != '$'
-                                 && (!dblquote || pc != '"')
+                                 && (!synstack->dblquote || pc != '"')
                                 ) {
                                         STPUTC('\\', pout);
                                 }
@@ -13091,10 +13133,11 @@ parsebackq: {
  * Parse an arithmetic expansion (indicate start of one and set state)
  */
 parsearith: {
-        if (++arinest == 1) {
-                prevsyntax = syntax;
-                syntax = ARISYNTAX;
-        }
+
+        synstack_push(&synstack,
+                        synstack->prev ?: alloca(sizeof(*synstack)),
+                        ARISYNTAX);
+        synstack->dblquote = 1;
         USTPUTC(CTLARI, out);
         goto parsearith_return;
 }
@@ -14542,7 +14585,7 @@ init(void)
 
 
 //usage:#define ash_trivial_usage
-//usage:        "[-/+OPTIONS] [-/+o OPT]... [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
+//usage:        "[-/+OPTIONS] [-/+o OPT]... [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS] / -s [ARGS]]"
 //usage:#define ash_full_usage "\n\n"
 //usage:        "Unix shell interpreter"
 
diff --git a/shell/ash_test/ash-arith/arith_nested1.right b/shell/ash_test/ash-arith/arith_nested1.right
new file mode 100644
index 000000000..d00491fd7
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith_nested1.right
@@ -0,0 +1 @@
+1
diff --git a/shell/ash_test/ash-arith/arith_nested1.tests b/shell/ash_test/ash-arith/arith_nested1.tests
new file mode 100755
index 000000000..28571b833
--- /dev/null
+++ b/shell/ash_test/ash-arith/arith_nested1.tests
@@ -0,0 +1 @@
+echo $(( ( $((1)) ) ))
diff --git a/shell/ash_test/ash-heredoc/heredoc_var_expand1.right b/shell/ash_test/ash-heredoc/heredoc_var_expand1.right
new file mode 100644
index 000000000..eb221832d
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_var_expand1.right
@@ -0,0 +1,4 @@
+
+Ok1:0
+
+Ok2:0
diff --git a/shell/ash_test/ash-heredoc/heredoc_var_expand1.tests b/shell/ash_test/ash-heredoc/heredoc_var_expand1.tests
new file mode 100755
index 000000000..3b00bab7b
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_var_expand1.tests
@@ -0,0 +1,11 @@
+x='*'
+
+cat <<- EOF
+        ${x#'*'}
+EOF
+echo Ok1:$?
+
+cat <<EOF
+${x#'*'}
+EOF
+echo Ok2:$?
diff --git a/shell/ash_test/ash-misc/assignment5.right b/shell/ash_test/ash-misc/assignment5.right
new file mode 100644
index 000000000..a91554c09
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment5.right
@@ -0,0 +1,5 @@
+Zero1:0
+Zero2:0
+Zero3:0
+Zero4:0 x:1 y:1
+Three:3 x:1 y:1
diff --git a/shell/ash_test/ash-misc/assignment5.tests b/shell/ash_test/ash-misc/assignment5.tests
new file mode 100755
index 000000000..0b8104285
--- /dev/null
+++ b/shell/ash_test/ash-misc/assignment5.tests
@@ -0,0 +1,9 @@
+true;  a=1; echo Zero1:$?
+false; a=1; echo Zero2:$?
+false || a=1; echo Zero3:$?
+
+false || x=$? y=`echo $?`; echo Zero4:$? x:$x y:$y
+false || x=$? y=`echo $?; exit 3`; echo Three:$? x:$x y:$y
+
+#ash sets z=1 instead of z=3. disabled for now
+#false || x=$? y=`echo $?; exit 3` z=`echo $?`; echo x:$x y:$y z:$z
diff --git a/shell/ash_test/ash-misc/func5.right b/shell/ash_test/ash-misc/func5.right
index 2c9d316b3..01e79c32a 100644
--- a/shell/ash_test/ash-misc/func5.right
+++ b/shell/ash_test/ash-misc/func5.right
@@ -1,6 +1,3 @@
 1
 2
 3
-1
-2
-3
diff --git a/shell/ash_test/ash-misc/func5.tests b/shell/ash_test/ash-misc/func5.tests
index e967208cc..5c33560bc 100755
--- a/shell/ash_test/ash-misc/func5.tests
+++ b/shell/ash_test/ash-misc/func5.tests
@@ -6,8 +6,3 @@ f 2
 
 f() ( echo $1 )
 f 3
-
-f() for i in 1 2 3; do
-        echo $i
-done
-f
diff --git a/shell/ash_test/ash-misc/func_compound1.right b/shell/ash_test/ash-misc/func_compound1.right
new file mode 100644
index 000000000..01e79c32a
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_compound1.right
@@ -0,0 +1,3 @@
+1
+2
+3
diff --git a/shell/ash_test/ash-misc/func_compound1.tests b/shell/ash_test/ash-misc/func_compound1.tests
new file mode 100755
index 000000000..20c8bf18b
--- /dev/null
+++ b/shell/ash_test/ash-misc/func_compound1.tests
@@ -0,0 +1,4 @@
+f() for i in 1 2 3; do
+        echo $i
+done
+f
diff --git a/shell/ash_test/ash-parsing/starquoted3.right b/shell/ash_test/ash-parsing/starquoted3.right
new file mode 100644
index 000000000..fea246c14
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted3.right
@@ -0,0 +1,2 @@
+<a>
+<>
diff --git a/shell/ash_test/ash-parsing/starquoted3.tests b/shell/ash_test/ash-parsing/starquoted3.tests
new file mode 100755
index 000000000..8eefe4245
--- /dev/null
+++ b/shell/ash_test/ash-parsing/starquoted3.tests
@@ -0,0 +1 @@
+set -- a ""; space=" "; printf "<%s>\n" "$@"$space
diff --git a/shell/ash_test/ash-quoting/bkslash_case2.right b/shell/ash_test/ash-quoting/bkslash_case2.right
new file mode 100644
index 000000000..8d2038bff
--- /dev/null
+++ b/shell/ash_test/ash-quoting/bkslash_case2.right
@@ -0,0 +1,3 @@
+ok1
+ok2
+Ok:0
diff --git a/shell/ash_test/ash-quoting/bkslash_case2.tests b/shell/ash_test/ash-quoting/bkslash_case2.tests
new file mode 100755
index 000000000..348ddc236
--- /dev/null
+++ b/shell/ash_test/ash-quoting/bkslash_case2.tests
@@ -0,0 +1,13 @@
+x='\abc'
+
+case "$x" in
+\\*) echo ok1;;
+*)   echo BUG1;;
+esac
+
+case $x in
+\\*) echo ok2;;
+*)   echo BUG2;;
+esac
+
+echo Ok:$?
diff --git a/shell/ash_test/ash-quoting/quote_in_varexp1.right b/shell/ash_test/ash-quoting/quote_in_varexp1.right
new file mode 100644
index 000000000..99a0aea7c
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quote_in_varexp1.right
@@ -0,0 +1,2 @@
+''
+Ok:0
diff --git a/shell/ash_test/ash-quoting/quote_in_varexp1.tests b/shell/ash_test/ash-quoting/quote_in_varexp1.tests
new file mode 100755
index 000000000..1b97b0556
--- /dev/null
+++ b/shell/ash_test/ash-quoting/quote_in_varexp1.tests
@@ -0,0 +1,2 @@
+x="''''"; echo "${x#"${x+''}"''}"
+echo Ok:$?
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp3.right b/shell/ash_test/ash-quoting/squote_in_varexp3.right
new file mode 100644
index 000000000..223b7836f
--- /dev/null
+++ b/shell/ash_test/ash-quoting/squote_in_varexp3.right
@@ -0,0 +1 @@
+B
diff --git a/shell/ash_test/ash-quoting/squote_in_varexp3.tests b/shell/ash_test/ash-quoting/squote_in_varexp3.tests
new file mode 100755
index 000000000..028a88fd9
--- /dev/null
+++ b/shell/ash_test/ash-quoting/squote_in_varexp3.tests
@@ -0,0 +1 @@
+x=\'B; echo "${x#\'}"
diff --git a/shell/ash_test/ash-redir/redir_exec1.right b/shell/ash_test/ash-redir/redir_exec1.right
new file mode 100644
index 000000000..d4393d10c
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_exec1.right
@@ -0,0 +1,2 @@
+redir_exec1.tests: line 1: can't create /cant/be/created: nonexistent directory
+First
diff --git a/shell/ash_test/ash-redir/redir_exec1.tests b/shell/ash_test/ash-redir/redir_exec1.tests
new file mode 100755
index 000000000..290e1cb39
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_exec1.tests
@@ -0,0 +1,2 @@
+v=`echo First >&2` exec >/cant/be/created
+echo One:$?
diff --git a/shell/ash_test/ash-vars/var_bash3.right b/shell/ash_test/ash-vars/var_bash3.right
index a97c850ea..8899d981c 100644
--- a/shell/ash_test/ash-vars/var_bash3.right
+++ b/shell/ash_test/ash-vars/var_bash3.right
@@ -1,6 +1,6 @@
 1 a041#c
 2 a041#c
-3 a\041#c
+3 a041#c
 4 a\041#c
 5 a\041#c
 6 a\041#c
@@ -17,4 +17,4 @@
 17 a\tc
 18 a\tc
 19 atc
-20 a\tc
+20 atc
diff --git a/shell/ash_test/ash-vars/var_bash4.right b/shell/ash_test/ash-vars/var_bash4.right
index 0ef1bf661..9067e58e6 100644
--- a/shell/ash_test/ash-vars/var_bash4.right
+++ b/shell/ash_test/ash-vars/var_bash4.right
@@ -3,26 +3,26 @@ Replace str:   _\\_\z_
 Pattern:       single backslash and star: "replace literal star"
 Unquoted:      a_\_z_b\*c
 Unquoted =:    a_\_z_b\*c
-Quoted:        a_\_\z_b\*c
-Quoted =:      a_\_\z_b\*c
+Quoted:        a_\_z_b\*c
+Quoted =:      a_\_z_b\*c
 Pattern:       double backslash and star: "replace backslash and everything after it"
 Unquoted:      a*b_\_z_
 Unquoted =:    a*b_\_z_
-Quoted:        a*b_\_\z_
-Quoted =:      a*b_\_\z_
+Quoted:        a*b_\_z_
+Quoted =:      a*b_\_z_
 
 Source:        a\bc
 Replace str:   _\\_\z_
 Pattern:       single backslash and b: "replace b"
 Unquoted:      a\_\_z_c
 Unquoted =:    a\_\_z_c
-Quoted:        a\_\_\z_c
-Quoted =:      a\_\_\z_c
+Quoted:        a\_\_z_c
+Quoted =:      a\_\_z_c
 Pattern:       double backslash and b: "replace backslash and b"
 Unquoted:      a_\_z_c
 Unquoted =:    a_\_z_c
-Quoted:        a_\_\z_c
-Quoted =:      a_\_\z_c
+Quoted:        a_\_z_c
+Quoted =:      a_\_z_c
 
 Source:        a\bc
 Replace str:   _\\_\z_ (as variable $s)
diff --git a/shell/ash_test/ash-vars/var_bash6.right b/shell/ash_test/ash-vars/var_bash6.right
index 63fc23df8..115ff8b04 100644
--- a/shell/ash_test/ash-vars/var_bash6.right
+++ b/shell/ash_test/ash-vars/var_bash6.right
@@ -1,5 +1,5 @@
 Expected Actual
 a*z    : a*z
-\z     : \z
+z      : z
 a1z a2z: a1z a2z
 z      : z
diff --git a/shell/ash_test/ash-vars/var_bash6.tests b/shell/ash_test/ash-vars/var_bash6.tests
index cf2e4f020..686834177 100755
--- a/shell/ash_test/ash-vars/var_bash6.tests
+++ b/shell/ash_test/ash-vars/var_bash6.tests
@@ -3,7 +3,7 @@
 >a1z; >a2z;
           echo 'Expected' 'Actual'
 v='a bz'; echo 'a*z    :' "${v/a*z/a*z}"
-v='a bz'; echo '\z     :' "${v/a*z/\z}"
+v='a bz'; echo 'z      :' "${v/a*z/\z}"
 v='a bz'; echo 'a1z a2z:' ${v/a*z/a*z}
 v='a bz'; echo 'z      :' ${v/a*z/\z}
 rm a1z a2z
diff --git a/shell/ash_test/ash-vars/var_bash7.right b/shell/ash_test/ash-vars/var_bash7.right
new file mode 100644
index 000000000..223b7836f
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash7.right
@@ -0,0 +1 @@
+B
diff --git a/shell/ash_test/ash-vars/var_bash7.tests b/shell/ash_test/ash-vars/var_bash7.tests
new file mode 100755
index 000000000..c4ce03f7f
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_bash7.tests
@@ -0,0 +1 @@
+x=AB; echo "${x#$'\x41'}"
diff --git a/shell/hush.c b/shell/hush.c
index 06fe0e405..d5ea3b21f 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -79,20 +79,6 @@
  *      Some builtins mandated by standards:
  *          newgrp [GRP]: not a builtin in bash but a suid binary
  *              which spawns a new shell with new group ID
- *      In bash, export builtin is special, its arguments are assignments
- *          and therefore expansion of them should be "one-word" expansion:
- *              $ export i=`echo 'a  b'` # export has one arg: "i=a  b"
- *          compare with:
- *              $ ls i=`echo 'a  b'`     # ls has two args: "i=a" and "b"
- *              ls: cannot access i=a: No such file or directory
- *              ls: cannot access b: No such file or directory
- *          Note1: same applies to local builtin.
- *          Note2: bash 3.2.33(1) does this only if export word itself
- *          is not quoted:
- *              $ export i=`echo 'aaa  bbb'`; echo "$i"
- *              aaa  bbb
- *              $ "export" i=`echo 'aaa  bbb'`; echo "$i"
- *              aaa
  */
 //config:config HUSH
 //config:       bool "hush (64 kb)"
@@ -326,13 +312,13 @@
 //kbuild:lib-$(CONFIG_BASH_IS_HUSH) += hush.o match.o shell_common.o
 //kbuild:lib-$(CONFIG_HUSH_RANDOM_SUPPORT) += random.o
 
-/* -i (interactive) and -s (read stdin) are also accepted,
- * but currently do nothing, therefore aren't shown in help.
+/* -i (interactive) is also accepted,
+ * but does nothing, therefore not shown in help.
  * NOMMU-specific options are not meant to be used by users,
  * therefore we don't show them either.
  */
 //usage:#define hush_trivial_usage
-//usage:        "[-enxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS]]"
+//usage:        "[-enxl] [-c 'SCRIPT' [ARG0 [ARGS]] / FILE [ARGS] / -s [ARGS]]"
 //usage:#define hush_full_usage "\n\n"
 //usage:        "Unix shell interpreter"
 
@@ -454,6 +440,7 @@
 #define debug_printf_redir(...)  do {} while (0)
 #define debug_printf_list(...)   do {} while (0)
 #define debug_printf_subst(...)  do {} while (0)
+#define debug_printf_prompt(...) do {} while (0)
 #define debug_printf_clean(...)  do {} while (0)
 
 #define ERR_PTR ((void*)(long)1)
@@ -489,7 +476,6 @@ static const char hush_version_str[] ALIGN1 = "HUSH_VERSION="BB_VER;
  */
 #if !BB_MMU
 typedef struct nommu_save_t {
-        char **new_env;
         struct variable *old_vars;
         char **argv;
         char **argv_from_re_execing;
@@ -566,9 +552,6 @@ static const char *const assignment_flag[] = {
 
 typedef struct in_str {
         const char *p;
-#if ENABLE_HUSH_INTERACTIVE
-        smallint promptmode; /* 0: PS1, 1: PS2 */
-#endif
         int peek_buf[2];
         int last_char;
         FILE *file;
@@ -623,15 +606,17 @@ typedef enum redir_type {
 
 struct command {
         pid_t pid;                  /* 0 if exited */
-        int assignment_cnt;         /* how many argv[i] are assignments? */
+        unsigned assignment_cnt;    /* how many argv[i] are assignments? */
 #if ENABLE_HUSH_LINENO_VAR
         unsigned lineno;
 #endif
         smallint cmd_type;          /* CMD_xxx */
 #define CMD_NORMAL   0
 #define CMD_SUBSHELL 1
-#if BASH_TEST2
-/* used for "[[ EXPR ]]" */
+#if BASH_TEST2 || ENABLE_HUSH_LOCAL || ENABLE_HUSH_EXPORT || ENABLE_HUSH_READONLY
+/* used for "[[ EXPR ]]", and to prevent word splitting and globbing in
+ * "export v=t*"
+ */
 # define CMD_SINGLEWORD_NOGLOB 2
 #endif
 #if ENABLE_HUSH_FUNCTIONS
@@ -742,10 +727,8 @@ struct parse_context {
 struct variable {
         struct variable *next;
         char *varstr;        /* points to "name=" portion */
-#if ENABLE_HUSH_LOCAL
-        unsigned func_nest_level;
-#endif
         int max_len;         /* if > 0, name is part of initial env; else name is malloced */
+        uint16_t var_nest_level;
         smallint flg_export; /* putenv should be done on this var */
         smallint flg_read_only;
 };
@@ -843,7 +826,7 @@ struct globals {
          * _AND_ if we decided to act interactively */
         int interactive_fd;
         const char *PS1;
-        const char *PS2;
+        IF_FEATURE_EDITING_FANCY_PROMPT(const char *PS2;)
 # define G_interactive_fd (G.interactive_fd)
 #else
 # define G_interactive_fd 0
@@ -891,6 +874,9 @@ struct globals {
 #else
 # define G_x_mode 0
 #endif
+#if ENABLE_HUSH_INTERACTIVE
+        smallint promptmode; /* 0: PS1, 1: PS2 */
+#endif
         smallint flag_SIGINT;
 #if ENABLE_HUSH_LOOPS
         smallint flag_break_continue;
@@ -906,8 +892,9 @@ struct globals {
 # define G_flag_return_in_progress 0
 #endif
         smallint exiting; /* used to prevent EXIT trap recursion */
-        /* These four support $?, $#, and $1 */
+        /* These support $?, $#, and $1 */
         smalluint last_exitcode;
+        smalluint expand_exitcode;
         smalluint last_bg_pid_exitcode;
 #if ENABLE_HUSH_SET
         /* are global_argv and global_argv[1..n] malloced? (note: not [0]) */
@@ -933,12 +920,13 @@ struct globals {
         const char *cwd;
         struct variable *top_var;
         char **expanded_assignments;
+        struct variable **shadowed_vars_pp;
+        unsigned var_nest_level;
 #if ENABLE_HUSH_FUNCTIONS
-        struct function *top_func;
 # if ENABLE_HUSH_LOCAL
-        struct variable **shadowed_vars_pp;
-        unsigned func_nest_level;
+        unsigned func_nest_level; /* solely to prevent "local v" in non-functions */
 # endif
+        struct function *top_func;
 #endif
         /* Signal and trap handling */
 #if ENABLE_HUSH_FAST
@@ -1261,6 +1249,10 @@ static const struct built_in_command bltins2[] = {
 # define debug_printf_subst(...) (indent(), fdprintf(2, __VA_ARGS__))
 #endif
 
+#ifndef debug_printf_prompt
+# define debug_printf_prompt(...) (indent(), fdprintf(2, __VA_ARGS__))
+#endif
+
 #ifndef debug_printf_clean
 # define debug_printf_clean(...) (indent(), fdprintf(2, __VA_ARGS__))
 # define DEBUG_CLEAN 1
@@ -1407,7 +1399,7 @@ static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
 #endif
 
 
-#if ENABLE_HUSH_INTERACTIVE
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
 static void cmdedit_update_prompt(void);
 #else
 # define cmdedit_update_prompt() ((void)0)
@@ -2136,40 +2128,58 @@ static const char* FAST_FUNC get_local_var_value(const char *name)
         return NULL;
 }
 
+static void handle_changed_special_names(const char *name, unsigned name_len)
+{
+        if (ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
+         && name_len == 3 && name[0] == 'P' && name[1] == 'S'
+        ) {
+                cmdedit_update_prompt();
+                return;
+        }
+
+        if ((ENABLE_HUSH_LINENO_VAR || ENABLE_HUSH_GETOPTS)
+         && name_len == 6
+        ) {
+#if ENABLE_HUSH_LINENO_VAR
+                if (strncmp(name, "LINENO", 6) == 0) {
+                        G.lineno_var = NULL;
+                        return;
+                }
+#endif
+#if ENABLE_HUSH_GETOPTS
+                if (strncmp(name, "OPTIND", 6) == 0) {
+                        G.getopt_count = 0;
+                        return;
+                }
+#endif
+        }
+}
+
 /* str holds "NAME=VAL" and is expected to be malloced.
  * We take ownership of it.
  */
 #define SETFLAG_EXPORT   (1 << 0)
 #define SETFLAG_UNEXPORT (1 << 1)
 #define SETFLAG_MAKE_RO  (1 << 2)
-#define SETFLAG_LOCAL_SHIFT    3
+#define SETFLAG_VARLVL_SHIFT   3
 static int set_local_var(char *str, unsigned flags)
 {
-        struct variable **var_pp;
+        struct variable **cur_pp;
         struct variable *cur;
         char *free_me = NULL;
         char *eq_sign;
         int name_len;
-        IF_HUSH_LOCAL(unsigned local_lvl = (flags >> SETFLAG_LOCAL_SHIFT);)
+        unsigned local_lvl = (flags >> SETFLAG_VARLVL_SHIFT);
 
         eq_sign = strchr(str, '=');
-        if (!eq_sign) { /* not expected to ever happen? */
-                free(str);
-                return -1;
-        }
+        if (HUSH_DEBUG && !eq_sign)
+                bb_error_msg_and_die("BUG in setvar");
 
         name_len = eq_sign - str + 1; /* including '=' */
-#if ENABLE_HUSH_LINENO_VAR
-        if (G.lineno_var) {
-                if (name_len == 7 && strncmp("LINENO", str, 6) == 0)
-                        G.lineno_var = NULL;
-        }
-#endif
-
-        var_pp = &G.top_var;
-        while ((cur = *var_pp) != NULL) {
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
                 if (strncmp(cur->varstr, str, name_len) != 0) {
-                        var_pp = &cur->next;
+                        cur_pp = &cur->next;
                         continue;
                 }
 
@@ -2187,15 +2197,7 @@ static int set_local_var(char *str, unsigned flags)
                         unsetenv(str);
                         *eq_sign = '=';
                 }
-#if ENABLE_HUSH_LOCAL
-                if (cur->func_nest_level < local_lvl) {
-                        /* New variable is declared as local,
-                         * and existing one is global, or local
-                         * from enclosing function.
-                         * Remove and save old one: */
-                        *var_pp = cur->next;
-                        cur->next = *G.shadowed_vars_pp;
-                        *G.shadowed_vars_pp = cur;
+                if (cur->var_nest_level < local_lvl) {
                         /* bash 3.2.33(1) and exported vars:
                          * # export z=z
                          * # f() { local z=a; env | grep ^z; }
@@ -2206,17 +2208,46 @@ static int set_local_var(char *str, unsigned flags)
                          */
                         if (cur->flg_export)
                                 flags |= SETFLAG_EXPORT;
+                        /* New variable is local ("local VAR=VAL" or
+                         * "VAR=VAL cmd")
+                         * and existing one is global, or local
+                         * on a lower level that new one.
+                         * Remove it from global variable list:
+                         */
+                        *cur_pp = cur->next;
+                        if (G.shadowed_vars_pp) {
+                                /* Save in "shadowed" list */
+                                debug_printf_env("shadowing %s'%s'/%u by '%s'/%u\n",
+                                        cur->flg_export ? "exported " : "",
+                                        cur->varstr, cur->var_nest_level, str, local_lvl
+                                );
+                                cur->next = *G.shadowed_vars_pp;
+                                *G.shadowed_vars_pp = cur;
+                        } else {
+                                /* Came from pseudo_exec_argv(), no need to save: delete it */
+                                debug_printf_env("shadow-deleting %s'%s'/%u by '%s'/%u\n",
+                                        cur->flg_export ? "exported " : "",
+                                        cur->varstr, cur->var_nest_level, str, local_lvl
+                                );
+                                if (cur->max_len == 0) /* allocated "VAR=VAL"? */
+                                        free_me = cur->varstr; /* then free it later */
+                                free(cur);
+                        }
                         break;
                 }
-#endif
+
                 if (strcmp(cur->varstr + name_len, eq_sign + 1) == 0) {
+                        debug_printf_env("assignement '%s' does not change anything\n", str);
  free_and_exp:
                         free(str);
                         goto exp;
                 }
+
+                /* Replace the value in the found "struct variable" */
                 if (cur->max_len != 0) {
-                        if (cur->max_len >= strlen(str)) {
+                        if (cur->max_len >= strnlen(str, cur->max_len + 1)) {
                                 /* This one is from startup env, reuse space */
+                                debug_printf_env("reusing startup env for '%s'\n", str);
                                 strcpy(cur->varstr, str);
                                 goto free_and_exp;
                         }
@@ -2234,11 +2265,11 @@ static int set_local_var(char *str, unsigned flags)
                 goto set_str_and_exp;
         }
 
-        /* Not found - create new variable struct */
+        /* Not found or shadowed - create new variable struct */
         cur = xzalloc(sizeof(*cur));
-        IF_HUSH_LOCAL(cur->func_nest_level = local_lvl;)
-        cur->next = *var_pp;
-        *var_pp = cur;
+        cur->var_nest_level = local_lvl;
+        cur->next = *cur_pp;
+        *cur_pp = cur;
 
  set_str_and_exp:
         cur->varstr = str;
@@ -2250,20 +2281,13 @@ static int set_local_var(char *str, unsigned flags)
 #endif
         if (flags & SETFLAG_EXPORT)
                 cur->flg_export = 1;
-        if (name_len == 4 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
-                cmdedit_update_prompt();
-#if ENABLE_HUSH_GETOPTS
-        /* defoptindvar is a "OPTIND=..." constant string */
-        if (strncmp(cur->varstr, defoptindvar, 7) == 0)
-                G.getopt_count = 0;
-#endif
         if (cur->flg_export) {
                 if (flags & SETFLAG_UNEXPORT) {
                         cur->flg_export = 0;
                         /* unsetenv was already done */
                 } else {
                         int i;
-                        debug_printf_env("%s: putenv '%s'\n", __func__, cur->varstr);
+                        debug_printf_env("%s: putenv '%s'/%u\n", __func__, cur->varstr, cur->var_nest_level);
                         i = putenv(cur->varstr);
                         /* only now we can free old exported malloced string */
                         free(free_me);
@@ -2271,6 +2295,9 @@ static int set_local_var(char *str, unsigned flags)
                 }
         }
         free(free_me);
+
+        handle_changed_special_names(cur->varstr, name_len - 1);
+
         return 0;
 }
 
@@ -2283,39 +2310,33 @@ static void set_pwd_var(unsigned flag)
 static int unset_local_var_len(const char *name, int name_len)
 {
         struct variable *cur;
-        struct variable **var_pp;
-
-        if (!name)
-                return EXIT_SUCCESS;
+        struct variable **cur_pp;
 
-#if ENABLE_HUSH_GETOPTS
-        if (name_len == 6 && strncmp(name, "OPTIND", 6) == 0)
-                G.getopt_count = 0;
-#endif
-#if ENABLE_HUSH_LINENO_VAR
-        if (name_len == 6 && G.lineno_var && strncmp(name, "LINENO", 6) == 0)
-                G.lineno_var = NULL;
-#endif
-
-        var_pp = &G.top_var;
-        while ((cur = *var_pp) != NULL) {
-                if (strncmp(cur->varstr, name, name_len) == 0 && cur->varstr[name_len] == '=') {
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
+                if (strncmp(cur->varstr, name, name_len) == 0
+                 && cur->varstr[name_len] == '='
+                ) {
                         if (cur->flg_read_only) {
                                 bb_error_msg("%s: readonly variable", name);
                                 return EXIT_FAILURE;
                         }
-                        *var_pp = cur->next;
+
+                        *cur_pp = cur->next;
                         debug_printf_env("%s: unsetenv '%s'\n", __func__, cur->varstr);
                         bb_unsetenv(cur->varstr);
-                        if (name_len == 3 && cur->varstr[0] == 'P' && cur->varstr[1] == 'S')
-                                cmdedit_update_prompt();
                         if (!cur->max_len)
                                 free(cur->varstr);
                         free(cur);
-                        return EXIT_SUCCESS;
+
+                        break;
                 }
-                var_pp = &cur->next;
+                cur_pp = &cur->next;
         }
+
+        /* Handle "unset PS1" et al even if did not find the variable to unset */
+        handle_changed_special_names(name, name_len);
+
         return EXIT_SUCCESS;
 }
 
@@ -2326,21 +2347,6 @@ static int unset_local_var(const char *name)
 }
 #endif
 
-static void unset_vars(char **strings)
-{
-        char **v;
-
-        if (!strings)
-                return;
-        v = strings;
-        while (*v) {
-                const char *eq = strchrnul(*v, '=');
-                unset_local_var_len(*v, (int)(eq - *v));
-                v++;
-        }
-        free(strings);
-}
-
 #if BASH_HOSTNAME_VAR || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_READ || ENABLE_HUSH_GETOPTS
 static void FAST_FUNC set_local_var_from_halves(const char *name, const char *val)
 {
@@ -2362,22 +2368,27 @@ static void add_vars(struct variable *var)
                 var->next = G.top_var;
                 G.top_var = var;
                 if (var->flg_export) {
-                        debug_printf_env("%s: restoring exported '%s'\n", __func__, var->varstr);
+                        debug_printf_env("%s: restoring exported '%s'/%u\n", __func__, var->varstr, var->var_nest_level);
                         putenv(var->varstr);
                 } else {
-                        debug_printf_env("%s: restoring variable '%s'\n", __func__, var->varstr);
+                        debug_printf_env("%s: restoring variable '%s'/%u\n", __func__, var->varstr, var->var_nest_level);
                 }
                 var = next;
         }
 }
 
-static struct variable *set_vars_and_save_old(char **strings)
+/* We put strings[i] into variable table and possibly putenv them.
+ * If variable is read only, we can free the strings[i]
+ * which attempts to overwrite it.
+ * The strings[] vector itself is freed.
+ */
+static void set_vars_and_save_old(char **strings)
 {
         char **s;
-        struct variable *old = NULL;
 
         if (!strings)
-                return old;
+                return;
+
         s = strings;
         while (*s) {
                 struct variable *var_p;
@@ -2404,19 +2415,20 @@ static struct variable *set_vars_and_save_old(char **strings)
                                         do { *p = p[1]; p++; } while (*p);
                                         goto next;
                                 }
-                                /* Remove variable from global linked list */
-                                debug_printf_env("%s: removing '%s'\n", __func__, var_p->varstr);
-                                *var_pp = var_p->next;
-                                /* Add it to returned list */
-                                var_p->next = old;
-                                old = var_p;
+                                /* below, set_local_var() with nest level will
+                                 * "shadow" (remove) this variable from
+                                 * global linked list.
+                                 */
                         }
-                        set_local_var(*s, SETFLAG_EXPORT);
+                        //bb_error_msg("G.var_nest_level:%d", G.var_nest_level);
+                        set_local_var(*s, (G.var_nest_level << SETFLAG_VARLVL_SHIFT) | SETFLAG_EXPORT);
+                } else if (HUSH_DEBUG) {
+                        bb_error_msg_and_die("BUG in varexp4");
                 }
- next:
                 s++;
+ next: ;
         }
-        return old;
+        free(strings);
 }
 
 
@@ -2452,36 +2464,36 @@ static void reinit_unicode_for_hush(void)
  *      \
  * It exercises a lot of corner cases.
  */
+# if ENABLE_FEATURE_EDITING_FANCY_PROMPT
 static void cmdedit_update_prompt(void)
 {
-        if (ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
-                G.PS1 = get_local_var_value("PS1");
-                if (G.PS1 == NULL)
-                        G.PS1 = "\\w \\$ ";
-                G.PS2 = get_local_var_value("PS2");
-        } else {
-                G.PS1 = NULL;
-        }
+        G.PS1 = get_local_var_value("PS1");
+        if (G.PS1 == NULL)
+                G.PS1 = "";
+        G.PS2 = get_local_var_value("PS2");
         if (G.PS2 == NULL)
-                G.PS2 = "> ";
+                G.PS2 = "";
 }
-static const char *setup_prompt_string(int promptmode)
+# endif
+static const char *setup_prompt_string(void)
 {
         const char *prompt_str;
-        debug_printf("setup_prompt_string %d ", promptmode);
-        if (!ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
-                /* Set up the prompt */
-                if (promptmode == 0) { /* PS1 */
+
+        debug_printf_prompt("%s promptmode:%d\n", __func__, G.promptmode);
+
+        IF_FEATURE_EDITING_FANCY_PROMPT(    prompt_str = G.PS2;)
+        IF_NOT_FEATURE_EDITING_FANCY_PROMPT(prompt_str = "> ";)
+        if (G.promptmode == 0) { /* PS1 */
+                if (!ENABLE_FEATURE_EDITING_FANCY_PROMPT) {
+                        /* No fancy prompts supported, (re)generate "CURDIR $ " by hand */
                         free((char*)G.PS1);
                         /* bash uses $PWD value, even if it is set by user.
                          * It uses current dir only if PWD is unset.
                          * We always use current dir. */
                         G.PS1 = xasprintf("%s %c ", get_cwd(0), (geteuid() != 0) ? '$' : '#');
-                        prompt_str = G.PS1;
-                } else
-                        prompt_str = G.PS2;
-        } else
-                prompt_str = (promptmode == 0) ? G.PS1 : G.PS2;
+                }
+                prompt_str = G.PS1;
+        }
         debug_printf("prompt_str '%s'\n", prompt_str);
         return prompt_str;
 }
@@ -2490,7 +2502,7 @@ static int get_user_input(struct in_str *i)
         int r;
         const char *prompt_str;
 
-        prompt_str = setup_prompt_string(i->promptmode);
+        prompt_str = setup_prompt_string();
 # if ENABLE_FEATURE_EDITING
         for (;;) {
                 reinit_unicode_for_hush();
@@ -2560,7 +2572,8 @@ static int fgetc_interactive(struct in_str *i)
         if (G_interactive_fd && i->file == stdin) {
                 /* Returns first char (or EOF), the rest is in i->p[] */
                 ch = get_user_input(i);
-                i->promptmode = 1; /* PS2 */
+                G.promptmode = 1; /* PS2 */
+                debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
         } else {
                 /* Not stdin: script file, sourced file, etc */
                 do ch = fgetc(i->file); while (ch == '\0');
@@ -2733,7 +2746,6 @@ static int i_peek_and_eat_bkslash_nl(struct in_str *input)
 static void setup_file_in_str(struct in_str *i, FILE *f)
 {
         memset(i, 0, sizeof(*i));
-        /* i->promptmode = 0; - PS1 (memset did it) */
         i->file = f;
         /* i->p = NULL; */
 }
@@ -2741,7 +2753,6 @@ static void setup_file_in_str(struct in_str *i, FILE *f)
 static void setup_string_in_str(struct in_str *i, const char *s)
 {
         memset(i, 0, sizeof(*i));
-        /* i->promptmode = 0; - PS1 (memset did it) */
         /*i->file = NULL */;
         i->p = s;
 }
@@ -3933,14 +3944,37 @@ static int done_word(o_string *word, struct parse_context *ctx)
                                                 (ctx->ctx_res_w == RES_SNTX));
                                 return (ctx->ctx_res_w == RES_SNTX);
                         }
-# if BASH_TEST2
-                        if (strcmp(word->data, "[[") == 0) {
+# if defined(CMD_SINGLEWORD_NOGLOB)
+                        if (0
+#  if BASH_TEST2
+                         || strcmp(word->data, "[[") == 0
+#  endif
+                        /* In bash, local/export/readonly are special, args
+                         * are assignments and therefore expansion of them
+                         * should be "one-word" expansion:
+                         *  $ export i=`echo 'a  b'` # one arg: "i=a  b"
+                         * compare with:
+                         *  $ ls i=`echo 'a  b'`     # two args: "i=a" and "b"
+                         *  ls: cannot access i=a: No such file or directory
+                         *  ls: cannot access b: No such file or directory
+                         * Note: bash 3.2.33(1) does this only if export word
+                         * itself is not quoted:
+                         *  $ export i=`echo 'aaa  bbb'`; echo "$i"
+                         *  aaa  bbb
+                         *  $ "export" i=`echo 'aaa  bbb'`; echo "$i"
+                         *  aaa
+                         */
+                        IF_HUSH_LOCAL(    || strcmp(word->data, "local") == 0)
+                        IF_HUSH_EXPORT(   || strcmp(word->data, "export") == 0)
+                        IF_HUSH_READONLY( || strcmp(word->data, "readonly") == 0)
+                        ) {
                                 command->cmd_type = CMD_SINGLEWORD_NOGLOB;
                         }
                         /* fall through */
 # endif
                 }
-#endif
+#endif /* HAS_KEYWORDS */
+
                 if (command->group) {
                         /* "{ echo foo; } echo bar" - bad */
                         syntax_error_at(word->data);
@@ -4240,7 +4274,6 @@ static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_
 
                                         redir->rd_type = REDIRECT_HEREDOC2;
                                         /* redir->rd_dup is (ab)used to indicate <<- */
-bb_error_msg("redir->rd_filename:'%s'",  redir->rd_filename);
                                         p = fetch_till_str(&ctx->as_string, input,
                                                         redir->rd_filename, redir->rd_dup);
                                         if (!p) {
@@ -4286,6 +4319,11 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
         /* dest contains characters seen prior to ( or {.
          * Typically it's empty, but for function defs,
          * it contains function name (without '()'). */
+#if BB_MMU
+# define as_string NULL
+#else
+        char *as_string = NULL;
+#endif
         struct pipe *pipe_list;
         int endch;
         struct command *command = ctx->command;
@@ -4314,7 +4352,7 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
                 do
                         ch = i_getch(input);
                 while (ch == ' ' || ch == '\t' || ch == '\n');
-                if (ch != '{') {
+                if (ch != '{' && ch != '(') {
                         syntax_error_unexpected_ch(ch);
                         return 1;
                 }
@@ -4336,13 +4374,13 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
         }
 #endif
 
-#if ENABLE_HUSH_FUNCTIONS
- skip:
-#endif
+ IF_HUSH_FUNCTIONS(skip:)
+
         endch = '}';
         if (ch == '(') {
                 endch = ')';
-                command->cmd_type = CMD_SUBSHELL;
+                IF_HUSH_FUNCTIONS(if (command->cmd_type != CMD_FUNCDEF))
+                        command->cmd_type = CMD_SUBSHELL;
         } else {
                 /* bash does not allow "{echo...", requires whitespace */
                 ch = i_peek(input);
@@ -4358,38 +4396,54 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
                 }
         }
 
-        {
-#if BB_MMU
-# define as_string NULL
-#else
-                char *as_string = NULL;
-#endif
-                pipe_list = parse_stream(&as_string, input, endch);
+        pipe_list = parse_stream(&as_string, input, endch);
 #if !BB_MMU
-                if (as_string)
-                        o_addstr(&ctx->as_string, as_string);
+        if (as_string)
+                o_addstr(&ctx->as_string, as_string);
 #endif
-                /* empty ()/{} or parse error? */
-                if (!pipe_list || pipe_list == ERR_PTR) {
-                        /* parse_stream already emitted error msg */
-                        if (!BB_MMU)
-                                free(as_string);
-                        debug_printf_parse("parse_group return 1: "
-                                "parse_stream returned %p\n", pipe_list);
-                        return 1;
-                }
-                command->group = pipe_list;
+
+        /* empty ()/{} or parse error? */
+        if (!pipe_list || pipe_list == ERR_PTR) {
+                /* parse_stream already emitted error msg */
+                if (!BB_MMU)
+                        free(as_string);
+                debug_printf_parse("parse_group return 1: "
+                        "parse_stream returned %p\n", pipe_list);
+                return 1;
+        }
 #if !BB_MMU
-                as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
-                command->group_as_string = as_string;
-                debug_printf_parse("end of group, remembering as:'%s'\n",
-                                command->group_as_string);
+        as_string[strlen(as_string) - 1] = '\0'; /* plink ')' or '}' */
+        command->group_as_string = as_string;
+        debug_printf_parse("end of group, remembering as:'%s'\n",
+                        command->group_as_string);
 #endif
-#undef as_string
+
+#if ENABLE_HUSH_FUNCTIONS
+        /* Convert "f() (cmds)" to "f() {(cmds)}" */
+        if (command->cmd_type == CMD_FUNCDEF && endch == ')') {
+                struct command *cmd2;
+
+                cmd2 = xzalloc(sizeof(*cmd2));
+                cmd2->cmd_type = CMD_SUBSHELL;
+                cmd2->group = pipe_list;
+# if !BB_MMU
+//UNTESTED!
+                cmd2->group_as_string = command->group_as_string;
+                command->group_as_string = xasprintf("(%s)", command->group_as_string);
+# endif
+
+                pipe_list = new_pipe();
+                pipe_list->cmds = cmd2;
+                pipe_list->num_cmds = 1;
         }
+#endif
+
+        command->group = pipe_list;
+
         debug_printf_parse("parse_group return 0\n");
         return 0;
         /* command remains "open", available for possible redirects */
+#undef as_string
 }
 
 #if ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS
@@ -4499,6 +4553,9 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
 # endif
         end_ch &= (DOUBLE_CLOSE_CHAR_FLAG - 1);
 
+        G.promptmode = 1; /* PS2 */
+        debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
+
         while (1) {
                 ch = i_getch(input);
                 if (ch == EOF) {
@@ -4564,6 +4621,7 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
                         continue;
                 }
         }
+        debug_printf_parse("%s return '%s' ch:'%c'\n", __func__, dest->data, ch);
         return ch;
 }
 #endif /* ENABLE_HUSH_TICK || ENABLE_FEATURE_SH_MATH || ENABLE_HUSH_DOLLAR_OPS */
@@ -5477,7 +5535,7 @@ static struct pipe *parse_stream(char **pstring,
                         goto parse_error2;
                 default:
                         if (HUSH_DEBUG)
-                                bb_error_msg_and_die("BUG: unexpected %c\n", ch);
+                                bb_error_msg_and_die("BUG: unexpected %c", ch);
                 }
         } /* while (1) */
 
@@ -5916,11 +5974,11 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 /* pattern uses non-standard expansion.
                                  * repl should be unbackslashed and globbed
                                  * by the usual expansion rules:
-                                 * >az; >bz;
-                                 * v='a bz'; echo "${v/a*z/a*z}" prints "a*z"
-                                 * v='a bz'; echo "${v/a*z/\z}"  prints "\z"
-                                 * v='a bz'; echo ${v/a*z/a*z}   prints "az"
-                                 * v='a bz'; echo ${v/a*z/\z}    prints "z"
+                                 *  >az >bz
+                                 *  v='a bz'; echo "${v/a*z/a*z}" #prints "a*z"
+                                 *  v='a bz'; echo "${v/a*z/\z}"  #prints "z"
+                                 *  v='a bz'; echo ${v/a*z/a*z}   #prints "az"
+                                 *  v='a bz'; echo ${v/a*z/\z}    #prints "z"
                                  * (note that a*z _pattern_ is never globbed!)
                                  */
                                 char *pattern, *repl, *t;
@@ -5932,7 +5990,7 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
                                 exp_word = p;
                                 p = strchr(p, SPECIAL_VAR_SYMBOL);
                                 *p = '\0';
-                                repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ arg0 & 0x80, /*unbackslash:*/ 1);
+                                repl = encode_then_expand_string(exp_word, /*process_bkslash:*/ 0, /*unbackslash:*/ 1);
                                 debug_printf_varexp("repl:'%s'->'%s'\n", exp_word, repl);
                                 /* HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
@@ -6199,6 +6257,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                          * and $IFS-split */
                         debug_printf_subst("SUBST '%s' first_ch %x\n", arg, first_ch);
                         G.last_exitcode = process_command_subs(&subst_result, arg);
+                        G.expand_exitcode = G.last_exitcode;
                         debug_printf_subst("SUBST RES:%d '%s'\n", G.last_exitcode, subst_result.data);
                         val = subst_result.data;
                         goto store_val;
@@ -6300,7 +6359,7 @@ static char **expand_strvec_to_strvec(char **argv)
         return expand_variables(argv, EXP_FLAG_GLOB | EXP_FLAG_ESC_GLOB_CHARS);
 }
 
-#if BASH_TEST2
+#if defined(CMD_SINGLEWORD_NOGLOB)
 static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 {
         return expand_variables(argv, EXP_FLAG_SINGLEWORD);
@@ -6308,7 +6367,7 @@ static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
 #endif
 
 /* Used for expansion of right hand of assignments,
- * $((...)), heredocs, variable espansion parts.
+ * $((...)), heredocs, variable expansion parts.
  *
  * NB: should NOT do globbing!
  * "export v=/bin/c*; env | grep ^v=" outputs "v=/bin/c*"
@@ -6348,7 +6407,7 @@ static char *expand_string_to_string(const char *str, int do_unbackslash)
         return (char*)list;
 }
 
-#if ENABLE_HUSH_CASE
+#if 0
 static char* expand_strvec_to_string(char **argv)
 {
         char **list;
@@ -6619,8 +6678,10 @@ static void parse_and_run_stream(struct in_str *inp, int end_trigger)
                 struct pipe *pipe_list;
 
 #if ENABLE_HUSH_INTERACTIVE
-                if (end_trigger == ';')
-                        inp->promptmode = 0; /* PS1 */
+                if (end_trigger == ';') {
+                        G.promptmode = 0; /* PS1 */
+                        debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
+                }
 #endif
                 pipe_list = parse_stream(NULL, inp, end_trigger);
                 if (!pipe_list || pipe_list == ERR_PTR) { /* EOF/error */
@@ -7329,8 +7390,9 @@ static void exec_function(char ***to_free,
 // for "more correctness" we might want to close those extra fds here:
 //?     close_saved_fds_and_FILE_fds();
 
-        /* "we are in function, ok to use return" */
+        /* "we are in a function, ok to use return" */
         G_flag_return_in_progress = -1;
+        G.var_nest_level++;
         IF_HUSH_LOCAL(G.func_nest_level++;)
 
         /* On MMU, funcp->body is always non-NULL */
@@ -7350,6 +7412,53 @@ static void exec_function(char ***to_free,
 # endif
 }
 
+static void enter_var_nest_level(void)
+{
+        G.var_nest_level++;
+        debug_printf_env("var_nest_level++ %u\n", G.var_nest_level);
+
+        /* Try: f() { echo -n .; f; }; f
+         * struct variable::var_nest_level is uint16_t,
+         * thus limiting recursion to < 2^16.
+         * In any case, with 8 Mbyte stack SEGV happens
+         * not too long after 2^16 recursions anyway.
+         */
+        if (G.var_nest_level > 0xff00)
+                bb_error_msg_and_die("fatal recursion (depth %u)", G.var_nest_level);
+}
+
+static void leave_var_nest_level(void)
+{
+        struct variable *cur;
+        struct variable **cur_pp;
+
+        cur_pp = &G.top_var;
+        while ((cur = *cur_pp) != NULL) {
+                if (cur->var_nest_level < G.var_nest_level) {
+                        cur_pp = &cur->next;
+                        continue;
+                }
+                /* Unexport */
+                if (cur->flg_export) {
+                        debug_printf_env("unexporting nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        bb_unsetenv(cur->varstr);
+                }
+                /* Remove from global list */
+                *cur_pp = cur->next;
+                /* Free */
+                if (!cur->max_len) {
+                        debug_printf_env("freeing nested '%s'/%u\n", cur->varstr, cur->var_nest_level);
+                        free(cur->varstr);
+                }
+                free(cur);
+        }
+
+        G.var_nest_level--;
+        debug_printf_env("var_nest_level-- %u\n", G.var_nest_level);
+        if (HUSH_DEBUG && (int)G.var_nest_level < 0)
+                bb_error_msg_and_die("BUG: nesting underflow");
+}
+
 static int run_function(const struct function *funcp, char **argv)
 {
         int rc;
@@ -7358,9 +7467,12 @@ static int run_function(const struct function *funcp, char **argv)
 
         save_and_replace_G_args(&sv, argv);
 
-        /* "we are in function, ok to use return" */
+        /* "We are in function, ok to use return" */
         sv_flg = G_flag_return_in_progress;
         G_flag_return_in_progress = -1;
+
+        /* Make "local" variables properly shadow previous ones */
+        IF_HUSH_LOCAL(enter_var_nest_level();)
         IF_HUSH_LOCAL(G.func_nest_level++;)
 
         /* On MMU, funcp->body is always non-NULL */
@@ -7375,30 +7487,9 @@ static int run_function(const struct function *funcp, char **argv)
                 rc = run_list(funcp->body);
         }
 
-# if ENABLE_HUSH_LOCAL
-        {
-                struct variable *var;
-                struct variable **var_pp;
+        IF_HUSH_LOCAL(G.func_nest_level--;)
+        IF_HUSH_LOCAL(leave_var_nest_level();)
 
-                var_pp = &G.top_var;
-                while ((var = *var_pp) != NULL) {
-                        if (var->func_nest_level < G.func_nest_level) {
-                                var_pp = &var->next;
-                                continue;
-                        }
-                        /* Unexport */
-                        if (var->flg_export)
-                                bb_unsetenv(var->varstr);
-                        /* Remove from global list */
-                        *var_pp = var->next;
-                        /* Free */
-                        if (!var->max_len)
-                                free(var->varstr);
-                        free(var);
-                }
-                G.func_nest_level--;
-        }
-# endif
         G_flag_return_in_progress = sv_flg;
 
         restore_G_args(&sv, argv);
@@ -7535,10 +7626,10 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                 char **argv_expanded)
 {
         const struct built_in_command *x;
+        struct variable **sv_shadowed;
         char **new_env;
-#if ENABLE_HUSH_COMMAND
-        char opt_vV = 0;
-#endif
+        IF_HUSH_COMMAND(char opt_vV = 0;)
+        IF_HUSH_FUNCTIONS(const struct function *funcp;)
 
         new_env = expand_assignments(argv, assignment_cnt);
         dump_cmd_in_x_mode(new_env);
@@ -7552,15 +7643,14 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                 _exit(EXIT_SUCCESS);
         }
 
+        sv_shadowed = G.shadowed_vars_pp;
 #if BB_MMU
-        set_vars_and_save_old(new_env);
-        free(new_env); /* optional */
-        /* we can also destroy set_vars_and_save_old's return value,
-         * to save memory */
+        G.shadowed_vars_pp = NULL; /* "don't save, free them instead" */
 #else
-        nommu_save->new_env = new_env;
-        nommu_save->old_vars = set_vars_and_save_old(new_env);
+        G.shadowed_vars_pp = &nommu_save->old_vars;
 #endif
+        set_vars_and_save_old(new_env);
+        G.shadowed_vars_pp = sv_shadowed;
 
         if (argv_expanded) {
                 argv = argv_expanded;
@@ -7579,12 +7669,9 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 
 #if ENABLE_HUSH_FUNCTIONS
         /* Check if the command matches any functions (this goes before bltins) */
-        {
-                const struct function *funcp = find_function(argv[0]);
-                if (funcp) {
-                        exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
-                }
-        }
+        funcp = find_function(argv[0]);
+        if (funcp)
+                exec_function(&nommu_save->argv_from_re_execing, funcp, argv);
 #endif
 
 #if ENABLE_HUSH_COMMAND
@@ -7693,6 +7780,15 @@ static void pseudo_exec(nommu_save_t *nommu_save,
                 struct command *command,
                 char **argv_expanded)
 {
+#if ENABLE_HUSH_FUNCTIONS
+        if (command->cmd_type == CMD_FUNCDEF) {
+                /* Ignore funcdefs in pipes:
+                 * true | f() { cmd }
+                 */
+                _exit(0);
+        }
+#endif
+
         if (command->argv) {
                 pseudo_exec_argv(nommu_save, command->argv,
                                 command->assignment_cnt, argv_expanded);
@@ -8111,29 +8207,29 @@ static int checkjobs_and_fg_shell(struct pipe *fg_pipe)
  * subshell:     ( list ) [&]
  */
 #if !ENABLE_HUSH_MODE_X
-#define redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel, argv_expanded) \
-        redirect_and_varexp_helper(new_env_p, old_vars_p, command, squirrel)
+#define redirect_and_varexp_helper(old_vars_p, command, squirrel, argv_expanded) \
+        redirect_and_varexp_helper(old_vars_p, command, squirrel)
 #endif
-static int redirect_and_varexp_helper(char ***new_env_p,
-                struct variable **old_vars_p,
+static int redirect_and_varexp_helper(
                 struct command *command,
                 struct squirrel **sqp,
                 char **argv_expanded)
 {
+        /* Assignments occur before redirects. Try:
+         * a=`sleep 1` sleep 2 3>/qwe/rty
+         */
+
+        char **new_env = expand_assignments(command->argv, command->assignment_cnt);
+        dump_cmd_in_x_mode(new_env);
+        dump_cmd_in_x_mode(argv_expanded);
+        /* this takes ownership of new_env[i] elements, and frees new_env: */
+        set_vars_and_save_old(new_env);
+
         /* setup_redirects acts on file descriptors, not FILEs.
          * This is perfect for work that comes after exec().
          * Is it really safe for inline use?  Experimentally,
          * things seem to work. */
-        int rcode = setup_redirects(command, sqp);
-        if (rcode == 0) {
-                char **new_env = expand_assignments(command->argv, command->assignment_cnt);
-                *new_env_p = new_env;
-                dump_cmd_in_x_mode(new_env);
-                dump_cmd_in_x_mode(argv_expanded);
-                if (old_vars_p)
-                        *old_vars_p = set_vars_and_save_old(new_env);
-        }
-        return rcode;
+        return setup_redirects(command, sqp);
 }
 static NOINLINE int run_pipe(struct pipe *pi)
 {
@@ -8221,13 +8317,10 @@ static NOINLINE int run_pipe(struct pipe *pi)
         argv = command->argv ? command->argv : (char **) &null_ptr;
         {
                 const struct built_in_command *x;
-#if ENABLE_HUSH_FUNCTIONS
-                const struct function *funcp;
-#else
-                enum { funcp = 0 };
-#endif
-                char **new_env = NULL;
-                struct variable *old_vars = NULL;
+                IF_HUSH_FUNCTIONS(const struct function *funcp;)
+                IF_NOT_HUSH_FUNCTIONS(enum { funcp = 0 };)
+                struct variable **sv_shadowed;
+                struct variable *old_vars;
 
 #if ENABLE_HUSH_LINENO_VAR
                 if (G.lineno_var)
@@ -8235,99 +8328,109 @@ static NOINLINE int run_pipe(struct pipe *pi)
 #endif
 
                 if (argv[command->assignment_cnt] == NULL) {
-                        /* Assignments, but no command */
-                        /* Ensure redirects take effect (that is, create files).
-                         * Try "a=t >file" */
-#if 0 /* A few cases in testsuite fail with this code. FIXME */
-                        rcode = redirect_and_varexp_helper(&new_env, /*old_vars:*/ NULL, command, &squirrel, /*argv_expanded:*/ NULL);
-                        /* Set shell variables */
-                        if (new_env) {
-                                argv = new_env;
-                                while (*argv) {
-                                        if (set_local_var(*argv, /*flag:*/ 0)) {
-                                                /* assignment to readonly var / putenv error? */
-                                                rcode = 1;
-                                        }
-                                        argv++;
-                                }
-                        }
-                        /* Redirect error sets $? to 1. Otherwise,
-                         * if evaluating assignment value set $?, retain it.
-                         * Try "false; q=`exit 2`; echo $?" - should print 2: */
-                        if (rcode == 0)
-                                rcode = G.last_exitcode;
-                        /* Exit, _skipping_ variable restoring code: */
-                        goto clean_up_and_ret0;
-
-#else /* Older, bigger, but more correct code */
-
+                        /* Assignments, but no command.
+                         * Ensure redirects take effect (that is, create files).
+                         * Try "a=t >file"
+                         */
+                        unsigned i;
+                        G.expand_exitcode = 0;
+ only_assignments:
                         rcode = setup_redirects(command, &squirrel);
                         restore_redirects(squirrel);
+
                         /* Set shell variables */
                         if (G_x_mode)
                                 bb_putchar_stderr('+');
-                        while (*argv) {
-                                char *p = expand_string_to_string(*argv, /*unbackslash:*/ 1);
+                        i = 0;
+                        while (i < command->assignment_cnt) {
+                                char *p = expand_string_to_string(argv[i], /*unbackslash:*/ 1);
                                 if (G_x_mode)
                                         fprintf(stderr, " %s", p);
-                                debug_printf_exec("set shell var:'%s'->'%s'\n",
-                                                *argv, p);
+                                debug_printf_env("set shell var:'%s'->'%s'\n", *argv, p);
                                 if (set_local_var(p, /*flag:*/ 0)) {
                                         /* assignment to readonly var / putenv error? */
                                         rcode = 1;
                                 }
-                                argv++;
+                                i++;
                         }
                         if (G_x_mode)
                                 bb_putchar_stderr('\n');
                         /* Redirect error sets $? to 1. Otherwise,
                          * if evaluating assignment value set $?, retain it.
-                         * Try "false; q=`exit 2`; echo $?" - should print 2: */
+                         * Else, clear $?:
+                         *  false; q=`exit 2`; echo $? - should print 2
+                         *  false; x=1; echo $? - should print 0
+                         * Because of the 2nd case, we can't just use G.last_exitcode.
+                         */
                         if (rcode == 0)
-                                rcode = G.last_exitcode;
+                                rcode = G.expand_exitcode;
                         IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
                         debug_leave();
                         debug_printf_exec("run_pipe: return %d\n", rcode);
                         return rcode;
-#endif
                 }
 
                 /* Expand the rest into (possibly) many strings each */
-#if BASH_TEST2
-                if (command->cmd_type == CMD_SINGLEWORD_NOGLOB) {
+#if defined(CMD_SINGLEWORD_NOGLOB)
+                if (command->cmd_type == CMD_SINGLEWORD_NOGLOB)
                         argv_expanded = expand_strvec_to_strvec_singleword_noglob(argv + command->assignment_cnt);
-                } else
+                else
 #endif
-                {
                         argv_expanded = expand_strvec_to_strvec(argv + command->assignment_cnt);
-                }
 
-                /* if someone gives us an empty string: `cmd with empty output` */
+                /* If someone gives us an empty string: `cmd with empty output` */
                 if (!argv_expanded[0]) {
                         free(argv_expanded);
-                        debug_leave();
-                        return G.last_exitcode;
+                        /* `false` still has to set exitcode 1 */
+                        G.expand_exitcode = G.last_exitcode;
+                        goto only_assignments;
                 }
 
-#if ENABLE_HUSH_FUNCTIONS
+                old_vars = NULL;
+                sv_shadowed = G.shadowed_vars_pp;
+
                 /* Check if argv[0] matches any functions (this goes before bltins) */
-                funcp = find_function(argv_expanded[0]);
-#endif
-                x = NULL;
-                if (!funcp)
+                IF_HUSH_FUNCTIONS(funcp = find_function(argv_expanded[0]);)
+                IF_HUSH_FUNCTIONS(x = NULL;)
+                IF_HUSH_FUNCTIONS(if (!funcp))
                         x = find_builtin(argv_expanded[0]);
                 if (x || funcp) {
-                        if (!funcp) {
-                                if (x->b_function == builtin_exec && argv_expanded[1] == NULL) {
-                                        debug_printf("exec with redirects only\n");
-                                        rcode = setup_redirects(command, NULL);
-                                        /* rcode=1 can be if redir file can't be opened */
-                                        goto clean_up_and_ret1;
-                                }
+                        if (x && x->b_function == builtin_exec && argv_expanded[1] == NULL) {
+                                debug_printf("exec with redirects only\n");
+                                /*
+                                 * Variable assignments are executed, but then "forgotten":
+                                 *  a=`sleep 1;echo A` exec 3>&-; echo $a
+                                 * sleeps, but prints nothing.
+                                 */
+                                enter_var_nest_level();
+                                G.shadowed_vars_pp = &old_vars;
+                                rcode = redirect_and_varexp_helper(command, /*squirrel:*/ NULL, argv_expanded);
+                                G.shadowed_vars_pp = sv_shadowed;
+                                /* rcode=1 can be if redir file can't be opened */
+
+                                goto clean_up_and_ret1;
                         }
-                        rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, &squirrel, argv_expanded);
+
+                        /* Bump var nesting, or this will leak exported $a:
+                         * a=b true; env | grep ^a=
+                         */
+                        enter_var_nest_level();
+                        /* Collect all variables "shadowed" by helper
+                         * (IOW: old vars overridden by "var1=val1 var2=val2 cmd..." syntax)
+                         * into old_vars list:
+                         */
+                        G.shadowed_vars_pp = &old_vars;
+                        rcode = redirect_and_varexp_helper(command, &squirrel, argv_expanded);
                         if (rcode == 0) {
                                 if (!funcp) {
+                                        /* Do not collect *to old_vars list* vars shadowed
+                                         * by e.g. "local VAR" builtin (collect them
+                                         * in the previously nested list instead):
+                                         * don't want them to be restored immediately
+                                         * after "local" completes.
+                                         */
+                                        G.shadowed_vars_pp = sv_shadowed;
+
                                         debug_printf_exec(": builtin '%s' '%s'...\n",
                                                 x->b_cmd, argv_expanded[1]);
                                         fflush_all();
@@ -8336,72 +8439,74 @@ static NOINLINE int run_pipe(struct pipe *pi)
                                 }
 #if ENABLE_HUSH_FUNCTIONS
                                 else {
-# if ENABLE_HUSH_LOCAL
-                                        struct variable **sv;
-                                        sv = G.shadowed_vars_pp;
-                                        G.shadowed_vars_pp = &old_vars;
-# endif
                                         debug_printf_exec(": function '%s' '%s'...\n",
                                                 funcp->name, argv_expanded[1]);
                                         rcode = run_function(funcp, argv_expanded) & 0xff;
-# if ENABLE_HUSH_LOCAL
-                                        G.shadowed_vars_pp = sv;
-# endif
+                                        /*
+                                         * But do collect *to old_vars list* vars shadowed
+                                         * within function execution. To that end, restore
+                                         * this pointer _after_ function run:
+                                         */
+                                        G.shadowed_vars_pp = sv_shadowed;
                                 }
 #endif
                         }
- clean_up_and_ret:
-                        unset_vars(new_env);
-                        add_vars(old_vars);
-/* clean_up_and_ret0: */
-                        restore_redirects(squirrel);
-                        /*
-                         * Try "usleep 99999999" + ^C + "echo $?"
-                         * with FEATURE_SH_NOFORK=y.
-                         */
-                        if (!funcp) {
-                                /* It was builtin or nofork.
-                                 * if this would be a real fork/execed program,
-                                 * it should have died if a fatal sig was received.
-                                 * But OTOH, there was no separate process,
-                                 * the sig was sent to _shell_, not to non-existing
-                                 * child.
-                                 * Let's just handle ^C only, this one is obvious:
-                                 * we aren't ok with exitcode 0 when ^C was pressed
-                                 * during builtin/nofork.
+                } else
+                if (ENABLE_FEATURE_SH_NOFORK && NUM_APPLETS > 1) {
+                        int n = find_applet_by_name(argv_expanded[0]);
+                        if (n < 0 || !APPLET_IS_NOFORK(n))
+                                goto must_fork;
+
+                        enter_var_nest_level();
+                        /* Collect all variables "shadowed" by helper into old_vars list */
+                        G.shadowed_vars_pp = &old_vars;
+                        rcode = redirect_and_varexp_helper(command, &squirrel, argv_expanded);
+                        G.shadowed_vars_pp = sv_shadowed;
+
+                        if (rcode == 0) {
+                                debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
+                                        argv_expanded[0], argv_expanded[1]);
+                                /*
+                                 * Note: signals (^C) can't interrupt here.
+                                 * We remember them and they will be acted upon
+                                 * after applet returns.
+                                 * This makes applets which can run for a long time
+                                 * and/or wait for user input ineligible for NOFORK:
+                                 * for example, "yes" or "rm" (rm -i waits for input).
                                  */
-                                if (sigismember(&G.pending_set, SIGINT))
-                                        rcode = 128 + SIGINT;
+                                rcode = run_nofork_applet(n, argv_expanded);
                         }
+                } else
+                        goto must_fork;
+
+                restore_redirects(squirrel);
  clean_up_and_ret1:
-                        free(argv_expanded);
-                        IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
-                        debug_leave();
-                        debug_printf_exec("run_pipe return %d\n", rcode);
-                        return rcode;
-                }
+                leave_var_nest_level();
+                add_vars(old_vars);
 
-                if (ENABLE_FEATURE_SH_NOFORK && NUM_APPLETS > 1) {
-                        int n = find_applet_by_name(argv_expanded[0]);
-                        if (n >= 0 && APPLET_IS_NOFORK(n)) {
-                                rcode = redirect_and_varexp_helper(&new_env, &old_vars, command, &squirrel, argv_expanded);
-                                if (rcode == 0) {
-                                        debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
-                                                argv_expanded[0], argv_expanded[1]);
-                                        /*
-                                         * Note: signals (^C) can't interrupt here.
-                                         * We remember them and they will be acted upon
-                                         * after applet returns.
-                                         * This makes applets which can run for a long time
-                                         * and/or wait for user input ineligible for NOFORK:
-                                         * for example, "yes" or "rm" (rm -i waits for input).
-                                         */
-                                        rcode = run_nofork_applet(n, argv_expanded);
-                                }
-                                goto clean_up_and_ret;
-                        }
+                /*
+                 * Try "usleep 99999999" + ^C + "echo $?"
+                 * with FEATURE_SH_NOFORK=y.
+                 */
+                if (!funcp) {
+                        /* It was builtin or nofork.
+                         * if this would be a real fork/execed program,
+                         * it should have died if a fatal sig was received.
+                         * But OTOH, there was no separate process,
+                         * the sig was sent to _shell_, not to non-existing
+                         * child.
+                         * Let's just handle ^C only, this one is obvious:
+                         * we aren't ok with exitcode 0 when ^C was pressed
+                         * during builtin/nofork.
+                         */
+                        if (sigismember(&G.pending_set, SIGINT))
+                                rcode = 128 + SIGINT;
                 }
-                /* It is neither builtin nor applet. We must fork. */
+                free(argv_expanded);
+                IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
+                debug_leave();
+                debug_printf_exec("run_pipe return %d\n", rcode);
+                return rcode;
         }
 
  must_fork:
@@ -8418,7 +8523,6 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 struct fd_pair pipefds;
 #if !BB_MMU
                 volatile nommu_save_t nommu_save;
-                nommu_save.new_env = NULL;
                 nommu_save.old_vars = NULL;
                 nommu_save.argv = NULL;
                 nommu_save.argv_from_re_execing = NULL;
@@ -8511,7 +8615,6 @@ static NOINLINE int run_pipe(struct pipe *pi)
                 /* Clean up after vforked child */
                 free(nommu_save.argv);
                 free(nommu_save.argv_from_re_execing);
-                unset_vars(nommu_save.new_env);
                 add_vars(nommu_save.old_vars);
 #endif
                 free(argv_expanded);
@@ -8732,8 +8835,10 @@ static int run_list(struct pipe *pi)
 #if ENABLE_HUSH_CASE
                 if (rword == RES_CASE) {
                         debug_printf_exec("CASE cond_code:%d\n", cond_code);
-                        case_word = expand_strvec_to_string(pi->cmds->argv);
-                        unbackslash(case_word);
+                        case_word = expand_string_to_string(pi->cmds->argv[0], 1);
+                        debug_printf_exec("CASE word1:'%s'\n", case_word);
+                        //unbackslash(case_word);
+                        //debug_printf_exec("CASE word2:'%s'\n", case_word);
                         continue;
                 }
                 if (rword == RES_MATCH) {
@@ -9060,9 +9165,9 @@ int hush_main(int argc, char **argv)
 {
         enum {
                 OPT_login = (1 << 0),
+                OPT_s     = (1 << 1),
         };
         unsigned flags;
-        int opt;
         unsigned builtin_argc;
         char **e;
         struct variable *cur_var;
@@ -9112,6 +9217,14 @@ int hush_main(int argc, char **argv)
         /* Export PWD */
         set_pwd_var(SETFLAG_EXPORT);
 
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
+        /* Set (but not export) PS1/2 unless already set */
+        if (!get_local_var_value("PS1"))
+                set_local_var_from_halves("PS1", "\\w \\$ ");
+        if (!get_local_var_value("PS2"))
+                set_local_var_from_halves("PS2", "> ");
+#endif
+
 #if BASH_HOSTNAME_VAR
         /* Set (but not export) HOSTNAME unless already set */
         if (!get_local_var_value("HOSTNAME")) {
@@ -9150,8 +9263,6 @@ int hush_main(int argc, char **argv)
          * OPTERR=1
          * OPTIND=1
          * IFS=$' \t\n'
-         * PS1='\s-\v\$ '
-         * PS2='> '
          * PS4='+ '
          */
 #endif
@@ -9185,7 +9296,7 @@ int hush_main(int argc, char **argv)
         flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
         builtin_argc = 0;
         while (1) {
-                opt = getopt(argc, argv, "+c:exinsl"
+                int opt = getopt(argc, argv, "+c:exinsl"
 #if !BB_MMU
                                 "<:$:R:V:"
 # if ENABLE_HUSH_FUNCTIONS
@@ -9243,8 +9354,7 @@ int hush_main(int argc, char **argv)
                         /* G_interactive_fd++; */
                         break;
                 case 's':
-                        /* "-s" means "read from stdin", but this is how we always
-                         * operate, so simply do nothing here. */
+                        flags |= OPT_s;
                         break;
                 case 'l':
                         flags |= OPT_login;
@@ -9347,7 +9457,8 @@ int hush_main(int argc, char **argv)
                  */
         }
 
-        if (G.global_argv[1]) {
+        /* -s is: hush -s ARGV1 ARGV2 (no SCRIPT) */
+        if (!(flags & OPT_s) && G.global_argv[1]) {
                 FILE *input;
                 /*
                  * "bash <script>" (which is never interactive (unless -i?))
@@ -9909,8 +10020,8 @@ static int helper_export_local(char **argv, unsigned flags)
 # if ENABLE_HUSH_LOCAL
                         /* Is this "local" bltin? */
                         if (!(flags & (SETFLAG_EXPORT|SETFLAG_UNEXPORT|SETFLAG_MAKE_RO))) {
-                                unsigned lvl = flags >> SETFLAG_LOCAL_SHIFT;
-                                if (var && var->func_nest_level == lvl) {
+                                unsigned lvl = flags >> SETFLAG_VARLVL_SHIFT;
+                                if (var && var->var_nest_level == lvl) {
                                         /* "local x=abc; ...; local x" - ignore second local decl */
                                         continue;
                                 }
@@ -9934,6 +10045,7 @@ static int helper_export_local(char **argv, unsigned flags)
                         /* (Un)exporting/making local NAME=VALUE */
                         name = xstrdup(name);
                 }
+                debug_printf_env("%s: set_local_var('%s')\n", __func__, name);
                 if (set_local_var(name, flags))
                         return EXIT_FAILURE;
         } while (*++argv);
@@ -9995,7 +10107,11 @@ static int FAST_FUNC builtin_local(char **argv)
                 return EXIT_FAILURE; /* bash compat */
         }
         argv++;
-        return helper_export_local(argv, G.func_nest_level << SETFLAG_LOCAL_SHIFT);
+        /* Since all builtins run in a nested variable level,
+         * need to use level - 1 here. Or else the variable will be removed at once
+         * after builtin returns.
+         */
+        return helper_export_local(argv, (G.var_nest_level - 1) << SETFLAG_VARLVL_SHIFT);
 }
 #endif
 
diff --git a/shell/hush_test/hush-arith/arith_nested1.right b/shell/hush_test/hush-arith/arith_nested1.right
new file mode 100644
index 000000000..d00491fd7
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith_nested1.right
@@ -0,0 +1 @@
+1
diff --git a/shell/hush_test/hush-arith/arith_nested1.tests b/shell/hush_test/hush-arith/arith_nested1.tests
new file mode 100755
index 000000000..28571b833
--- /dev/null
+++ b/shell/hush_test/hush-arith/arith_nested1.tests
@@ -0,0 +1 @@
+echo $(( ( $((1)) ) ))
diff --git a/shell/hush_test/hush-misc/assignment5.right b/shell/hush_test/hush-misc/assignment5.right
new file mode 100644
index 000000000..a91554c09
--- /dev/null
+++ b/shell/hush_test/hush-misc/assignment5.right
@@ -0,0 +1,5 @@
+Zero1:0
+Zero2:0
+Zero3:0
+Zero4:0 x:1 y:1
+Three:3 x:1 y:1
diff --git a/shell/hush_test/hush-misc/assignment5.tests b/shell/hush_test/hush-misc/assignment5.tests
new file mode 100755
index 000000000..0b8104285
--- /dev/null
+++ b/shell/hush_test/hush-misc/assignment5.tests
@@ -0,0 +1,9 @@
+true;  a=1; echo Zero1:$?
+false; a=1; echo Zero2:$?
+false || a=1; echo Zero3:$?
+
+false || x=$? y=`echo $?`; echo Zero4:$? x:$x y:$y
+false || x=$? y=`echo $?; exit 3`; echo Three:$? x:$x y:$y
+
+#ash sets z=1 instead of z=3. disabled for now
+#false || x=$? y=`echo $?; exit 3` z=`echo $?`; echo x:$x y:$y z:$z
diff --git a/shell/hush_test/hush-misc/func5.tests b/shell/hush_test/hush-misc/func5.tests
index 9c5f9fa48..5c33560bc 100755
--- a/shell/hush_test/hush-misc/func5.tests
+++ b/shell/hush_test/hush-misc/func5.tests
@@ -1,9 +1,8 @@
 f() { echo $1; }
 f 1
 
-# hush fails on this syntax, but i've never seen anyone use it ...
-#f() ( echo $1; )
+f() ( echo $1; )
 f 2
 
-#f() ( echo $1 )
+f() ( echo $1 )
 f 3
diff --git a/shell/hush_test/hush-parsing/starquoted3.right b/shell/hush_test/hush-parsing/starquoted3.right
new file mode 100644
index 000000000..fea246c14
--- /dev/null
+++ b/shell/hush_test/hush-parsing/starquoted3.right
@@ -0,0 +1,2 @@
+<a>
+<>
diff --git a/shell/hush_test/hush-parsing/starquoted3.tests b/shell/hush_test/hush-parsing/starquoted3.tests
new file mode 100755
index 000000000..8eefe4245
--- /dev/null
+++ b/shell/hush_test/hush-parsing/starquoted3.tests
@@ -0,0 +1 @@
+set -- a ""; space=" "; printf "<%s>\n" "$@"$space
diff --git a/shell/hush_test/hush-psubst/falsetick2.right b/shell/hush_test/hush-psubst/falsetick2.right
new file mode 100644
index 000000000..670f560f1
--- /dev/null
+++ b/shell/hush_test/hush-psubst/falsetick2.right
@@ -0,0 +1 @@
+Two:2 v:[]
diff --git a/shell/hush_test/hush-psubst/falsetick2.tests b/shell/hush_test/hush-psubst/falsetick2.tests
new file mode 100755
index 000000000..cfbd1a5de
--- /dev/null
+++ b/shell/hush_test/hush-psubst/falsetick2.tests
@@ -0,0 +1,3 @@
+v=v
+v=`exit 2` `false`
+echo Two:$? v:"[$v]"
diff --git a/shell/hush_test/hush-quoting/bkslash_case2.right b/shell/hush_test/hush-quoting/bkslash_case2.right
new file mode 100644
index 000000000..8d2038bff
--- /dev/null
+++ b/shell/hush_test/hush-quoting/bkslash_case2.right
@@ -0,0 +1,3 @@
+ok1
+ok2
+Ok:0
diff --git a/shell/hush_test/hush-quoting/bkslash_case2.tests b/shell/hush_test/hush-quoting/bkslash_case2.tests
new file mode 100755
index 000000000..348ddc236
--- /dev/null
+++ b/shell/hush_test/hush-quoting/bkslash_case2.tests
@@ -0,0 +1,13 @@
+x='\abc'
+
+case "$x" in
+\\*) echo ok1;;
+*)   echo BUG1;;
+esac
+
+case $x in
+\\*) echo ok2;;
+*)   echo BUG2;;
+esac
+
+echo Ok:$?
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp3.right b/shell/hush_test/hush-quoting/squote_in_varexp3.right
new file mode 100644
index 000000000..223b7836f
--- /dev/null
+++ b/shell/hush_test/hush-quoting/squote_in_varexp3.right
@@ -0,0 +1 @@
+B
diff --git a/shell/hush_test/hush-quoting/squote_in_varexp3.tests b/shell/hush_test/hush-quoting/squote_in_varexp3.tests
new file mode 100755
index 000000000..028a88fd9
--- /dev/null
+++ b/shell/hush_test/hush-quoting/squote_in_varexp3.tests
@@ -0,0 +1 @@
+x=\'B; echo "${x#\'}"
diff --git a/shell/hush_test/hush-redir/redir_backquote1.right b/shell/hush_test/hush-redir/redir_backquote1.right
new file mode 100644
index 000000000..810cc2314
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_backquote1.right
@@ -0,0 +1,11 @@
+hush: can't open '/cant/be/created': No such file or directory
+First
+One:1 v1:[]
+hush: can't open '/cant/be/created': No such file or directory
+Second
+One:1 v2:[]
+Third
+Zero:0 v3:[]
+Fourth
+Zero:0 v4:[]
+Zero:0 v5:[1]
diff --git a/shell/hush_test/hush-redir/redir_backquote1.tests b/shell/hush_test/hush-redir/redir_backquote1.tests
new file mode 100755
index 000000000..41bb4913c
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_backquote1.tests
@@ -0,0 +1,19 @@
+v=v
+v=`echo First >&2` `` >/cant/be/created
+echo One:$? v1:"[$v]"
+
+v=v
+v=`echo Second >&2` `true` >/cant/be/created
+echo One:$? v2:"[$v]"
+
+v=v
+v=`echo Third >&2` `true` 2>/dev/null
+echo Zero:$? v3:"[$v]"
+
+v=v
+v=`echo Fourth >&2` `false` 2>/dev/null
+echo Zero:$? v4:"[$v]"
+
+v=v
+v=`echo $?` `false` 2>/dev/null
+echo Zero:$? v5:"[$v]"
diff --git a/shell/hush_test/hush-redir/redir_exec1.right b/shell/hush_test/hush-redir/redir_exec1.right
new file mode 100644
index 000000000..6ff8fc832
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_exec1.right
@@ -0,0 +1,3 @@
+First
+hush: can't open '/cant/be/created': No such file or directory
+One:1
diff --git a/shell/hush_test/hush-redir/redir_exec1.tests b/shell/hush_test/hush-redir/redir_exec1.tests
new file mode 100755
index 000000000..290e1cb39
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_exec1.tests
@@ -0,0 +1,2 @@
+v=`echo First >&2` exec >/cant/be/created
+echo One:$?
diff --git a/shell/hush_test/hush-vars/readonly3.right b/shell/hush_test/hush-vars/readonly3.right
new file mode 100644
index 000000000..acd931243
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly3.right
@@ -0,0 +1,4 @@
+hush: v=2: readonly variable
+hush: v=3: readonly variable
+1
+Ok:1
diff --git a/shell/hush_test/hush-vars/readonly3.tests b/shell/hush_test/hush-vars/readonly3.tests
new file mode 100755
index 000000000..17780cfda
--- /dev/null
+++ b/shell/hush_test/hush-vars/readonly3.tests
@@ -0,0 +1,4 @@
+readonly v=1
+# there was a bug causing second assignment to be not checked
+v=2 v=3 echo $v
+echo Ok:$v
diff --git a/shell/hush_test/hush-vars/var_bash3.right b/shell/hush_test/hush-vars/var_bash3.right
index a97c850ea..8899d981c 100644
--- a/shell/hush_test/hush-vars/var_bash3.right
+++ b/shell/hush_test/hush-vars/var_bash3.right
@@ -1,6 +1,6 @@
 1 a041#c
 2 a041#c
-3 a\041#c
+3 a041#c
 4 a\041#c
 5 a\041#c
 6 a\041#c
@@ -17,4 +17,4 @@
 17 a\tc
 18 a\tc
 19 atc
-20 a\tc
+20 atc
diff --git a/shell/hush_test/hush-vars/var_bash4.right b/shell/hush_test/hush-vars/var_bash4.right
index 0ef1bf661..9067e58e6 100644
--- a/shell/hush_test/hush-vars/var_bash4.right
+++ b/shell/hush_test/hush-vars/var_bash4.right
@@ -3,26 +3,26 @@ Replace str:   _\\_\z_
 Pattern:       single backslash and star: "replace literal star"
 Unquoted:      a_\_z_b\*c
 Unquoted =:    a_\_z_b\*c
-Quoted:        a_\_\z_b\*c
-Quoted =:      a_\_\z_b\*c
+Quoted:        a_\_z_b\*c
+Quoted =:      a_\_z_b\*c
 Pattern:       double backslash and star: "replace backslash and everything after it"
 Unquoted:      a*b_\_z_
 Unquoted =:    a*b_\_z_
-Quoted:        a*b_\_\z_
-Quoted =:      a*b_\_\z_
+Quoted:        a*b_\_z_
+Quoted =:      a*b_\_z_
 
 Source:        a\bc
 Replace str:   _\\_\z_
 Pattern:       single backslash and b: "replace b"
 Unquoted:      a\_\_z_c
 Unquoted =:    a\_\_z_c
-Quoted:        a\_\_\z_c
-Quoted =:      a\_\_\z_c
+Quoted:        a\_\_z_c
+Quoted =:      a\_\_z_c
 Pattern:       double backslash and b: "replace backslash and b"
 Unquoted:      a_\_z_c
 Unquoted =:    a_\_z_c
-Quoted:        a_\_\z_c
-Quoted =:      a_\_\z_c
+Quoted:        a_\_z_c
+Quoted =:      a_\_z_c
 
 Source:        a\bc
 Replace str:   _\\_\z_ (as variable $s)
diff --git a/shell/hush_test/hush-vars/var_bash6.right b/shell/hush_test/hush-vars/var_bash6.right
index 63fc23df8..115ff8b04 100644
--- a/shell/hush_test/hush-vars/var_bash6.right
+++ b/shell/hush_test/hush-vars/var_bash6.right
@@ -1,5 +1,5 @@
 Expected Actual
 a*z    : a*z
-\z     : \z
+z      : z
 a1z a2z: a1z a2z
 z      : z
diff --git a/shell/hush_test/hush-vars/var_bash6.tests b/shell/hush_test/hush-vars/var_bash6.tests
index cf2e4f020..686834177 100755
--- a/shell/hush_test/hush-vars/var_bash6.tests
+++ b/shell/hush_test/hush-vars/var_bash6.tests
@@ -3,7 +3,7 @@
 >a1z; >a2z;
           echo 'Expected' 'Actual'
 v='a bz'; echo 'a*z    :' "${v/a*z/a*z}"
-v='a bz'; echo '\z     :' "${v/a*z/\z}"
+v='a bz'; echo 'z      :' "${v/a*z/\z}"
 v='a bz'; echo 'a1z a2z:' ${v/a*z/a*z}
 v='a bz'; echo 'z      :' ${v/a*z/\z}
 rm a1z a2z
diff --git a/shell/hush_test/hush-vars/var_nested1.right b/shell/hush_test/hush-vars/var_nested1.right
new file mode 100644
index 000000000..f4bc5f4b6
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested1.right
@@ -0,0 +1,3 @@
+Expected:AB Actual:AB
+Expected:Ab Actual:Ab
+Expected:ab Actual:ab
diff --git a/shell/hush_test/hush-vars/var_nested1.tests b/shell/hush_test/hush-vars/var_nested1.tests
new file mode 100755
index 000000000..59e4a14fa
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested1.tests
@@ -0,0 +1,16 @@
+f() { a=A; b=B; }
+
+a=a
+b=b
+f
+echo Expected:AB Actual:$a$b
+
+a=a
+b=b
+b= f
+echo Expected:Ab Actual:$a$b
+
+a=a
+b=b
+a= b= f
+echo Expected:ab Actual:$a$b
diff --git a/shell/hush_test/hush-vars/var_nested2.right b/shell/hush_test/hush-vars/var_nested2.right
new file mode 100644
index 000000000..c930d971c
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested2.right
@@ -0,0 +1 @@
+aB
diff --git a/shell/hush_test/hush-vars/var_nested2.tests b/shell/hush_test/hush-vars/var_nested2.tests
new file mode 100755
index 000000000..e8865861e
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_nested2.tests
@@ -0,0 +1,2 @@
+# the bug was easier to trigger in one-liner form
+a=a; b=b; f() { a=A; b=B; }; a= f; echo $a$b
diff --git a/shell/shell_common.c b/shell/shell_common.c
index a44ad0caf..aa0791285 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -18,7 +18,6 @@
  */
 #include "libbb.h"
 #include "shell_common.h"
-#include <sys/resource.h> /* getrlimit */
 
 #if !ENABLE_PLATFORM_MINGW32
 const char defifsvar[] ALIGN1 = "IFS= \t\n";