294 files changed, 10574 insertions, 4001 deletions

diff --git a/Config.in b/Config.in
index f6159b30b..d5a69f416 100644
--- a/Config.in
+++ b/Config.in
@@ -218,6 +218,13 @@ config FEATURE_INSTALLER
         busybox at runtime to create hard links or symlinks for all the
         applets that are compiled into busybox.
 
+config FEATURE_VERSION
+        bool "Support --version"
+        default y
+        depends on BUSYBOX
+        help
+        Enable 'busybox --version' support.
+
 config INSTALL_NO_USR
         bool "Don't use /usr"
         default n
@@ -396,27 +403,6 @@ config GLOBBING
           use BusyBox applets from the Windows Command Prompt you can stop
           busybox.exe from expanding wildcards by setting this to 'N'.
 
-choice
-        prompt "Random number generator"
-        default FEATURE_PRNG_SHELL
-        depends on PLATFORM_MINGW32
-        help
-        BusyBox on Microsoft Windows uses a pseudo-random number
-        generator to emulate the Linux /dev/urandom device.  There
-        are two options:
-        - The shell's built-in PRNG.
-        - Bob Jenkins' ISAAC.  This is intended to be a secure PRNG.  It's
-        slightly faster than the shell's PRNG but is larger both in terms
-        of code and runtime memory.
-
-config FEATURE_PRNG_SHELL
-        bool "Use shell PRNG"
-
-config FEATURE_PRNG_ISAAC
-        bool "Use ISAAC PRNG"
-
-endchoice
-
 config FEATURE_RESOURCES
         bool "Include resources in binary"
         default y
@@ -468,8 +454,10 @@ config FEATURE_ICON
         depends on FEATURE_RESOURCES
         help
         Microsoft Windows applications can contain icons which are used in
-        various places in the user interface.  Each icon adds 15 Kbytes to
-        the size of the binary.
+        various places in the user interface.  Two icons are provided in
+        two formats.  ICO icons are 15KB and are supported in all versions
+        of Windows.  PNG icons are 1-2KB and are supported since Windows
+        Vista.
 
 choice
         prompt "Application icon"
@@ -477,13 +465,22 @@ choice
         depends on FEATURE_ICON
 
 config FEATURE_ICON_ATERM
-        bool "Adwaita terminal"
+        bool "ICO Adwaita terminal"
 
 config FEATURE_ICON_STERM
-        bool "Adwaita terminal (symbolic)"
+        bool "ICO Adwaita terminal (symbolic)"
 
 config FEATURE_ICON_ALL
-        bool "All available icons"
+        bool "All available ICO icons"
+
+config FEATURE_PNG_ATERM
+        bool "PNG Adwaita terminal"
+
+config FEATURE_PNG_STERM
+        bool "PNG Adwaita terminal (symbolic)"
+
+config FEATURE_PNG_ALL
+        bool "All available PNG icons"
 
 endchoice
 
@@ -566,6 +563,15 @@ config OVERRIDE_APPLETS
         environment variable.  BB_OVERRIDE_APPLETS is checked first, if it
         allows the applet and this list is non-empty it is checked too.
 
+config UNWIND_TABLES
+        bool "Include stack unwind tables in the binary"
+        default y
+        depends on PLATFORM_MINGW32
+        help
+        Binaries can include support for stack unwinding.  This isn't
+        normally required in BusyBox, but Windows' Control Flow Guard
+        needs it.  Disabling this reduces the size of the binaries.
+
 comment 'Build Options'
 
 config STATIC
diff --git a/Makefile b/Makefile
index ae870ecb7..52a2cff87 100644
--- a/Makefile
+++ b/Makefile
@@ -551,6 +551,7 @@ libs-y		:= \
                 findutils/ \
                 init/ \
                 libbb/ \
+                libbb/yescrypt/ \
                 libpwdgrp/ \
                 loginutils/ \
                 mailutils/ \
@@ -688,8 +689,12 @@ quiet_cmd_busybox__ ?= LINK    $@
       "$(core-y)" \
       "$(libs-y)" \
       "$(LDLIBS)" \
-      "$(CONFIG_EXTRA_LDLIBS)" \
+      $(CONFIG_EXTRA_LDLIBS) \
       && $(srctree)/scripts/generate_BUFSIZ.sh --post include/common_bufsiz.h
+# ^^^ note: CONFIG_xyz strings already have double quotes: their value
+# is '"LIB LIB2"', therefore $(CONFIG_EXTRA_LDLIBS) above must NOT be written
+# as "$(CONFIG_EXTRA_LDLIBS)", it would be passed as ""LIB LIB2"",
+# and LIB2 would end up in $9, not $8 (and lost or misinterpreted).
 
 # Generate System.map
 quiet_cmd_sysmap = SYSMAP
diff --git a/Makefile.custom b/Makefile.custom
index e2f6d1c2f..36170de8a 100644
--- a/Makefile.custom
+++ b/Makefile.custom
@@ -156,12 +156,12 @@ docs/busybox.pod: $(srctree)/docs/busybox_header.pod \
 docs/BusyBox.txt: docs/busybox.pod
         $(disp_doc)
         $(Q)-mkdir -p docs
-        $(Q)-pod2text $< > $@
+        $(Q)-pod2text --quotes=none $< > $@
 
 docs/busybox.1: docs/busybox.pod
         $(disp_doc)
         $(Q)-mkdir -p docs
-        $(Q)-pod2man --center=busybox --release="version $(KERNELVERSION)" $< > $@
+        $(Q)-pod2man --quotes=none --center=busybox --release="version $(KERNELVERSION)" $< > $@
 
 docs/BusyBox.html: docs/busybox.net/BusyBox.html
         $(disp_doc)
diff --git a/Makefile.flags b/Makefile.flags
index f24fd9475..29fabcfb5 100644
--- a/Makefile.flags
+++ b/Makefile.flags
@@ -73,8 +73,13 @@ CFLAGS += $(call cc-option,-falign-jumps=1 -falign-labels=1 -falign-loops=1,)
 endif
 
 # Defeat .eh_frame bloat (gcc 4.6.3 x86-32 defconfig: 20% smaller busybox binary):
+ifneq ($(CONFIG_UNWIND_TABLES),y)
 CFLAGS += $(call cc-option,-fno-unwind-tables,)
 CFLAGS += $(call cc-option,-fno-asynchronous-unwind-tables,)
+else
+CFLAGS += $(call cc-option,-funwind-tables,)
+CFLAGS += $(call cc-option,-fasynchronous-unwind-tables,)
+endif
 # No automatic printf->puts,putchar conversions
 # (try disabling this and comparing assembly, it's instructive)
 CFLAGS += $(call cc-option,-fno-builtin-printf,)
@@ -151,11 +156,15 @@ ifeq ($(CONFIG_PLATFORM_MINGW32),y)
 CFLAGS += -Iwin32 -DHAVE_STRING_H=1 -DHAVE_CONFIG_H=0 -fno-builtin-stpcpy -fno-builtin-stpncpy -fno-ident -fno-builtin-strndup
 # this seems to be necessary for setjmp/longjmp to work with clang
 ifeq ($(lastword $(subst -, ,$(CC))),clang)
+ifeq ($(CONFIG_UNWIND_TABLES),y)
+CFLAGS += $(call cc-option,-fexceptions,)
+else
 CFLAGS += $(call cc-option,-fsjlj-exceptions,)
 endif
+endif
 
 EXEEXT = .exe
-LDLIBS += ws2_32
+LDLIBS += ws2_32 bcrypt secur32
 endif
 
 ifneq ($(CONFIG_PLATFORM_MINGW32),y)
diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 055f9fb24..a000de45b 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -336,6 +336,7 @@ setuidgid - noexec. spawner
 sha1sum - noexec. runner
 sha256sum - noexec. runner
 sha3sum - noexec. runner
+sha384sum - noexec. runner
 sha512sum - noexec. runner
 showkey - interactive, longterm
 shred - runner
diff --git a/applets/usage_pod.c b/applets/usage_pod.c
index 9e6d3f0ee..2c177be90 100644
--- a/applets/usage_pod.c
+++ b/applets/usage_pod.c
@@ -67,30 +67,37 @@ int main(void)
                 }
                 if (col == 0) {
                         col = 6;
-                        printf("\t");
                 } else {
                         printf(", ");
                 }
-                printf("%s", usage_array[i].aname);
+                if (usage_array[i].usage[0] != NOUSAGE_STR[0]) {
+                        /*
+                         * If the applet usage string will be included in the final document
+                         * optimistically link to its header (which is just the applet name).
+                         */
+                        printf("L<C<%1$s>|/\"%1$s\">", usage_array[i].aname);
+                } else {
+                        /* Without a usage string, just output the applet name with no link. */
+                        printf("C<%s>", usage_array[i].aname);
+                }
                 col += len2;
         }
         printf("\n\n");
 
         printf("=head1 COMMAND DESCRIPTIONS\n\n");
-        printf("=over 4\n\n");
 
         for (i = 0; i < num_messages; i++) {
                 if (usage_array[i].aname[0] >= 'a' && usage_array[i].aname[0] <= 'z'
                  && usage_array[i].usage[0] != NOUSAGE_STR[0]
                 ) {
-                        printf("=item B<%s>\n\n", usage_array[i].aname);
+                        /* This is the heading that will be linked from the command list. */
+                        printf("=head2 %s\n\n", usage_array[i].aname);
                         if (usage_array[i].usage[0])
                                 printf("%s %s\n\n", usage_array[i].aname, usage_array[i].usage);
                         else
                                 printf("%s\n\n", usage_array[i].aname);
                 }
         }
-        printf("=back\n\n");
 
         return 0;
 }
diff --git a/archival/Config.src b/archival/Config.src
index 6f4f30c43..cbcd7217c 100644
--- a/archival/Config.src
+++ b/archival/Config.src
@@ -35,4 +35,15 @@ config FEATURE_LZMA_FAST
         This option reduces decompression time by about 25% at the cost of
         a 1K bigger binary.
 
+config FEATURE_PATH_TRAVERSAL_PROTECTION
+        bool "Prevent extraction of filenames with /../ path component"
+        default n
+        help
+        busybox tar and unzip remove "PREFIX/../" (if it exists)
+        from extracted names.
+        This option enables this behavior for all other unpacking applets,
+        such as cpio, ar, rpm.
+        GNU cpio 2.15 has NO such sanity check.
+# try other archivers and document their behavior?
+
 endmenu
diff --git a/archival/bbunzip.c b/archival/bbunzip.c
index fb5deb0ce..1f1f28b61 100644
--- a/archival/bbunzip.c
+++ b/archival/bbunzip.c
@@ -71,8 +71,8 @@ int FAST_FUNC bbunpack(char **argv,
                                         goto err;
                         } else {
                                 /* "clever zcat" with FILE */
-                                /* fail_if_not_compressed because zcat refuses uncompressed input */
-                                int fd = open_zipped(filename, /*fail_if_not_compressed:*/ 1);
+                                /* die_if_not_compressed because zcat refuses uncompressed input */
+                                int fd = open_zipped(filename, /*die_if_not_compressed:*/ 1);
                                 if (fd < 0)
                                         goto err_name;
                                 xmove_fd(fd, STDIN_FILENO);
@@ -80,7 +80,7 @@ int FAST_FUNC bbunpack(char **argv,
                 } else
                 if (option_mask32 & BBUNPK_SEAMLESS_MAGIC) {
                         /* "clever zcat" on stdin */
-                        if (setup_unzip_on_fd(STDIN_FILENO, /*fail_if_not_compressed*/ 1))
+                        if (setup_unzip_on_fd(STDIN_FILENO, /*die_if_not_compressed*/ 1))
                                 goto err;
                 }
 
diff --git a/archival/cpio.c b/archival/cpio.c
index 167931bdb..38d826a3c 100644
--- a/archival/cpio.c
+++ b/archival/cpio.c
@@ -354,6 +354,12 @@ static NOINLINE int cpio_o(void)
 #endif
 #endif
 
+                if (sizeof(st.st_size) > 4
+                 && st.st_size > (off_t)0xffffffff
+                ) {
+                        bb_error_msg_and_die("error: file '%s' is larger than 4GB", name);
+                }
+
                 bytes += printf("070701"
                                 "%08X%08X%08X%08X%08X%08X%08X"
                                 "%08X%08X%08X%08X" /* GNU cpio uses uppercase hex */
@@ -425,6 +431,7 @@ int cpio_main(int argc UNUSED_PARAM, char **argv)
 #endif
 #endif
                 "owner\0"        Required_argument "R"
+                "file\0"         Required_argument "F"
                 "verbose\0"      No_argument       "v"
                 "null\0"         No_argument       "0"
                 "quiet\0"        No_argument       "\xff"
diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
index 049c2c156..8a69711c1 100644
--- a/archival/libarchive/data_extract_all.c
+++ b/archival/libarchive/data_extract_all.c
@@ -65,6 +65,14 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
                 } while (--n != 0);
         }
 #endif
+#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
+        /* Strip leading "/" and up to last "/../" path component */
+        dst_name = (char *)strip_unsafe_prefix(dst_name);
+#endif
+// ^^^ This may be a problem if some applets do need to extract absolute names.
+// (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag).
+// You might think that rpm needs it, but in my tests rpm's internal cpio
+// archive has names like "./usr/bin/FOO", not "/usr/bin/FOO".
 
         if (archive_handle->ah_flags & ARCHIVE_CREATE_LEADING_DIRS) {
                 char *slash = strrchr(dst_name, '/');
diff --git a/archival/libarchive/header_list.c b/archival/libarchive/header_list.c
index 0621aa406..9490b3635 100644
--- a/archival/libarchive/header_list.c
+++ b/archival/libarchive/header_list.c
@@ -8,5 +8,5 @@
 void FAST_FUNC header_list(const file_header_t *file_header)
 {
 //TODO: cpio -vp DIR should output "DIR/NAME", not just "NAME" */
-        puts(file_header->name);
+        puts(printable_string(file_header->name));
 }
diff --git a/archival/libarchive/header_verbose_list.c b/archival/libarchive/header_verbose_list.c
index a575a08a0..e7a09430d 100644
--- a/archival/libarchive/header_verbose_list.c
+++ b/archival/libarchive/header_verbose_list.c
@@ -57,13 +57,13 @@ void FAST_FUNC header_verbose_list(const file_header_t *file_header)
                 ptm->tm_hour,
                 ptm->tm_min,
                 ptm->tm_sec,
-                file_header->name);
+                printable_string(file_header->name));
 
 #endif /* FEATURE_TAR_UNAME_GNAME */
 
         /* NB: GNU tar shows "->" for symlinks and "link to" for hardlinks */
         if (file_header->link_target) {
-                printf(" -> %s", file_header->link_target);
+                printf(" -> %s", printable_string(file_header->link_target));
         }
         bb_putchar('\n');
 }
diff --git a/archival/libarchive/open_transformer.c b/archival/libarchive/open_transformer.c
index 3d202ad26..a949c4509 100644
--- a/archival/libarchive/open_transformer.c
+++ b/archival/libarchive/open_transformer.c
@@ -164,7 +164,7 @@ void FAST_FUNC fork_transformer(int fd, const char *transform_prog)
 /* Used by e.g. rpm which gives us a fd without filename,
  * thus we can't guess the format from filename's extension.
  */
-static transformer_state_t *setup_transformer_on_fd(int fd, int fail_if_not_compressed)
+static transformer_state_t *setup_transformer_on_fd(int fd, int die_if_not_compressed)
 {
         transformer_state_t *xstate;
 
@@ -211,7 +211,7 @@ static transformer_state_t *setup_transformer_on_fd(int fd, int fail_if_not_comp
         }
 
         /* No known magic seen */
-        if (fail_if_not_compressed)
+        if (die_if_not_compressed)
                 bb_simple_error_msg_and_die("no gzip"
                         IF_FEATURE_SEAMLESS_BZ2("/bzip2")
                         IF_FEATURE_SEAMLESS_XZ("/xz")
@@ -247,13 +247,15 @@ static void fork_transformer_and_free(transformer_state_t *xstate)
 /* Used by e.g. rpm which gives us a fd without filename,
  * thus we can't guess the format from filename's extension.
  */
-int FAST_FUNC setup_unzip_on_fd(int fd, int fail_if_not_compressed)
+int FAST_FUNC setup_unzip_on_fd(int fd, int die_if_not_compressed)
 {
-        transformer_state_t *xstate = setup_transformer_on_fd(fd, fail_if_not_compressed);
+        transformer_state_t *xstate = setup_transformer_on_fd(fd, die_if_not_compressed);
 
         if (!xstate->xformer) {
+                /* Not compressed */
+                int retval = xstate->signature_skipped; /* never zero */
                 free(xstate);
-                return 1;
+                return retval;
         }
 
         fork_transformer_and_free(xstate);
@@ -271,7 +273,7 @@ void FAST_FUNC setup_lzma_on_fd(int fd)
 }
 #endif
 
-static transformer_state_t *open_transformer(const char *fname, int fail_if_not_compressed)
+static transformer_state_t *open_transformer(const char *fname, int die_if_not_compressed)
 {
         transformer_state_t *xstate;
         int fd;
@@ -291,18 +293,18 @@ static transformer_state_t *open_transformer(const char *fname, int fail_if_not_
                 }
         }
 
-        xstate = setup_transformer_on_fd(fd, fail_if_not_compressed);
+        xstate = setup_transformer_on_fd(fd, die_if_not_compressed);
 
         return xstate;
 }
 
-int FAST_FUNC open_zipped(const char *fname, int fail_if_not_compressed)
+int FAST_FUNC open_zipped(const char *fname, int die_if_not_compressed)
 {
         int fd;
         transformer_state_t *xstate;
 
-        xstate = open_transformer(fname, fail_if_not_compressed);
-        if (!xstate)
+        xstate = open_transformer(fname, die_if_not_compressed);
+        if (!xstate) /* open error */
                 return -1;
 
         fd = xstate->src_fd;
@@ -333,7 +335,7 @@ void* FAST_FUNC xmalloc_open_zipped_read_close(const char *fname, size_t *maxsz_
         transformer_state_t *xstate;
         char *image;
 
-        xstate = open_transformer(fname, /*fail_if_not_compressed:*/ 0);
+        xstate = open_transformer(fname, /*die_if_not_compressed:*/ 0);
         if (!xstate) /* file open error */
                 return NULL;
 
@@ -378,7 +380,7 @@ void* FAST_FUNC xmalloc_open_zipped_read_close(const char *fname, size_t *maxsz_
         int fd;
         char *image;
 
-        fd = open_zipped(fname, /*fail_if_not_compressed:*/ 0);
+        fd = open_zipped(fname, /*die_if_not_compressed:*/ 0);
         if (fd < 0)
                 return NULL;
 
diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
index 33e487bf9..667081195 100644
--- a/archival/libarchive/unsafe_prefix.c
+++ b/archival/libarchive/unsafe_prefix.c
@@ -14,7 +14,11 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
                         cp++;
                         continue;
                 }
-                if (is_prefixed_with(cp, "/../"+1)) {
+                /* We are called lots of times.
+                 * is_prefixed_with(cp, "../") is slower than open-coding it,
+                 * with minimal code growth (~few bytes).
+                 */
+                if (cp[0] == '.' && cp[1] == '.' && cp[2] == '/') {
                         cp += 3;
                         continue;
                 }
diff --git a/archival/rpm.c b/archival/rpm.c
index d83c33137..c2f0550ff 100644
--- a/archival/rpm.c
+++ b/archival/rpm.c
@@ -330,7 +330,7 @@ static void extract_cpio(int fd, const char *source_rpm)
         archive_handle->src_fd = fd;
         /*archive_handle->offset = 0; - init_handle() did it */
 
-        setup_unzip_on_fd(archive_handle->src_fd, /*fail_if_not_compressed:*/ 1);
+        setup_unzip_on_fd(archive_handle->src_fd, /*die_if_not_compressed:*/ 1);
         while (get_header_cpio(archive_handle) == EXIT_SUCCESS)
                 continue;
 }
@@ -549,6 +549,7 @@ int rpm2cpio_main(int argc UNUSED_PARAM, char **argv)
         //      /* We need to know whether child (gzip/bzip/etc) exits abnormally */
         //      signal(SIGCHLD, check_errors_in_children);
 
+        str = NULL;
         if (ENABLE_FEATURE_SEAMLESS_LZMA
          && (str = rpm_getstr0(TAG_PAYLOADCOMPRESSOR)) != NULL
          && strcmp(str, "lzma") == 0
@@ -557,7 +558,11 @@ int rpm2cpio_main(int argc UNUSED_PARAM, char **argv)
                 // set up decompressor without detection
                 setup_lzma_on_fd(rpm_fd);
         } else {
-                setup_unzip_on_fd(rpm_fd, /*fail_if_not_compressed:*/ 1);
+                int signature_bytes = setup_unzip_on_fd(rpm_fd, /*die_if_not_compressed:*/ 0);
+                if (signature_bytes != 0) {
+                        xlseek(rpm_fd, - signature_bytes, SEEK_CUR);
+                        bb_error_msg("warning, unknown compression '%s'", str);
+                }
         }
 
         if (bb_copyfd_eof(rpm_fd, STDOUT_FILENO) < 0)
diff --git a/archival/tar.c b/archival/tar.c
index 23ea02b5d..fd20d6ce7 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -1188,7 +1188,7 @@ int tar_main(int argc UNUSED_PARAM, char **argv)
                  * on e.g. tarball with 1st file named "BZh5".
                  */
                 ) {
-                        tar_handle->src_fd = open_zipped(tar_filename, /*fail_if_not_compressed:*/ 0);
+                        tar_handle->src_fd = open_zipped(tar_filename, /*die_if_not_compressed:*/ 0);
                         if (tar_handle->src_fd < 0)
                                 bb_perror_msg_and_die("can't open '%s'", tar_filename);
                 } else {
diff --git a/configs/mingw32_defconfig b/configs/mingw32_defconfig
index 6f6bdb14b..f02452053 100644
--- a/configs/mingw32_defconfig
+++ b/configs/mingw32_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.37.0.git
-# Fri Jun 14 12:24:50 2024
+# Busybox version: 1.38.0.git
+# Thu Nov  6 08:23:16 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -44,8 +44,6 @@ CONFIG_BUSYBOX_EXEC_PATH=""
 # Settings for MINGW32
 #
 CONFIG_GLOBBING=y
-CONFIG_FEATURE_PRNG_SHELL=y
-# CONFIG_FEATURE_PRNG_ISAAC is not set
 CONFIG_FEATURE_RESOURCES=y
 CONFIG_FEATURE_VERSIONINFO=y
 # CONFIG_FEATURE_TOOLCHAIN_MANIFEST is not set
@@ -55,6 +53,9 @@ CONFIG_FEATURE_ICON=y
 # CONFIG_FEATURE_ICON_ATERM is not set
 # CONFIG_FEATURE_ICON_STERM is not set
 CONFIG_FEATURE_ICON_ALL=y
+# CONFIG_FEATURE_PNG_ATERM is not set
+# CONFIG_FEATURE_PNG_STERM is not set
+# CONFIG_FEATURE_PNG_ALL is not set
 CONFIG_FEATURE_EURO=y
 # CONFIG_FEATURE_UTF8_INPUT is not set
 # CONFIG_FEATURE_UTF8_OUTPUT is not set
@@ -62,6 +63,7 @@ CONFIG_TERMINAL_MODE=5
 CONFIG_FEATURE_IMPROVED_COLOUR_MAPPING=y
 CONFIG_FEATURE_EXTRA_FILE_DATA=y
 CONFIG_OVERRIDE_APPLETS=""
+# CONFIG_UNWIND_TABLES is not set
 
 #
 # Build Options
@@ -120,6 +122,7 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
+# CONFIG_FEATURE_USE_CNG_API is not set
 CONFIG_MD5_SMALL=1
 CONFIG_SHA1_SMALL=3
 # CONFIG_SHA1_HWACCEL is not set
@@ -225,6 +228,7 @@ CONFIG_FEATURE_UNZIP_BZIP2=y
 CONFIG_FEATURE_UNZIP_LZMA=y
 CONFIG_FEATURE_UNZIP_XZ=y
 CONFIG_FEATURE_LZMA_FAST=y
+# CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION is not set
 
 #
 # Coreutils
@@ -272,7 +276,7 @@ CONFIG_DD=y
 CONFIG_FEATURE_DD_IBS_OBS=y
 CONFIG_FEATURE_DD_STATUS=y
 CONFIG_DF=y
-# CONFIG_FEATURE_DF_FANCY is not set
+CONFIG_FEATURE_DF_FANCY=y
 # CONFIG_FEATURE_SKIP_ROOTFS is not set
 CONFIG_DIRNAME=y
 CONFIG_DOS2UNIX=y
@@ -312,11 +316,12 @@ CONFIG_FEATURE_LS_COLOR_IS_DEFAULT=y
 CONFIG_MD5SUM=y
 CONFIG_SHA1SUM=y
 CONFIG_SHA256SUM=y
+CONFIG_SHA384SUM=y
 CONFIG_SHA512SUM=y
 CONFIG_SHA3SUM=y
 
 #
-# Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum
+# Common options for md5sum, sha1sum, sha256sum, ..., sha3sum
 #
 CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y
 CONFIG_MKDIR=y
@@ -351,7 +356,7 @@ CONFIG_FEATURE_SPLIT_FANCY=y
 CONFIG_STAT=y
 CONFIG_FEATURE_STAT_FORMAT=y
 CONFIG_FEATURE_STAT_FILESYSTEM=y
-# CONFIG_STTY is not set
+CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
 # CONFIG_FEATURE_SYNC_FANCY is not set
@@ -555,6 +560,7 @@ CONFIG_INIT_TERMINAL_TYPE=""
 # CONFIG_USE_BB_SHADOW is not set
 # CONFIG_USE_BB_CRYPT is not set
 # CONFIG_USE_BB_CRYPT_SHA is not set
+# CONFIG_USE_BB_CRYPT_YES is not set
 # CONFIG_ADD_SHELL is not set
 # CONFIG_REMOVE_SHELL is not set
 # CONFIG_ADDGROUP is not set
@@ -657,7 +663,7 @@ CONFIG_CAL=y
 # CONFIG_FEATURE_GPT_LABEL is not set
 # CONFIG_FEATURE_FDISK_ADVANCED is not set
 # CONFIG_FINDFS is not set
-# CONFIG_FLOCK is not set
+CONFIG_FLOCK=y
 # CONFIG_FDFLUSH is not set
 # CONFIG_FREERAMDISK is not set
 # CONFIG_FSCK_MINIX is not set
@@ -898,7 +904,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+CONFIG_FEATURE_TLS_INTERNAL=y
+# CONFIG_FEATURE_TLS_SCHANNEL is not set
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
@@ -964,6 +973,7 @@ CONFIG_IFUPDOWN_IFSTATE_PATH=""
 # CONFIG_IPNEIGH is not set
 # CONFIG_FEATURE_IP_ADDRESS is not set
 # CONFIG_FEATURE_IP_LINK is not set
+CONFIG_FEATURE_IP_LINK_CAN=y
 # CONFIG_FEATURE_IP_ROUTE is not set
 CONFIG_FEATURE_IP_ROUTE_DIR=""
 # CONFIG_FEATURE_IP_TUNNEL is not set
@@ -1187,6 +1197,7 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_CTTYHACK is not set
 # CONFIG_HUSH is not set
 # CONFIG_SHELL_HUSH is not set
+# CONFIG_HUSH_NEED_FOR_SPEED is not set
 # CONFIG_HUSH_BASH_COMPAT is not set
 # CONFIG_HUSH_BRACE_EXPANSION is not set
 # CONFIG_HUSH_BASH_SOURCE_CURDIR is not set
@@ -1198,7 +1209,9 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_HUSH_IF is not set
 # CONFIG_HUSH_LOOPS is not set
 # CONFIG_HUSH_CASE is not set
+# CONFIG_HUSH_ALIAS is not set
 # CONFIG_HUSH_FUNCTIONS is not set
+# CONFIG_HUSH_FUNCTION_KEYWORD is not set
 # CONFIG_HUSH_LOCAL is not set
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_MODE_X is not set
diff --git a/configs/mingw64_defconfig b/configs/mingw64_defconfig
index fbd2bc6e3..c5c50834e 100644
--- a/configs/mingw64_defconfig
+++ b/configs/mingw64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.37.0.git
-# Fri Jun 14 12:24:50 2024
+# Busybox version: 1.38.0.git
+# Thu Nov  6 08:23:16 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -44,8 +44,6 @@ CONFIG_BUSYBOX_EXEC_PATH=""
 # Settings for MINGW32
 #
 CONFIG_GLOBBING=y
-CONFIG_FEATURE_PRNG_SHELL=y
-# CONFIG_FEATURE_PRNG_ISAAC is not set
 CONFIG_FEATURE_RESOURCES=y
 CONFIG_FEATURE_VERSIONINFO=y
 # CONFIG_FEATURE_TOOLCHAIN_MANIFEST is not set
@@ -55,6 +53,9 @@ CONFIG_FEATURE_ICON=y
 # CONFIG_FEATURE_ICON_ATERM is not set
 # CONFIG_FEATURE_ICON_STERM is not set
 CONFIG_FEATURE_ICON_ALL=y
+# CONFIG_FEATURE_PNG_ATERM is not set
+# CONFIG_FEATURE_PNG_STERM is not set
+# CONFIG_FEATURE_PNG_ALL is not set
 CONFIG_FEATURE_EURO=y
 # CONFIG_FEATURE_UTF8_INPUT is not set
 # CONFIG_FEATURE_UTF8_OUTPUT is not set
@@ -62,6 +63,7 @@ CONFIG_TERMINAL_MODE=5
 CONFIG_FEATURE_IMPROVED_COLOUR_MAPPING=y
 CONFIG_FEATURE_EXTRA_FILE_DATA=y
 CONFIG_OVERRIDE_APPLETS=""
+CONFIG_UNWIND_TABLES=y
 
 #
 # Build Options
@@ -120,6 +122,7 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
+# CONFIG_FEATURE_USE_CNG_API is not set
 CONFIG_MD5_SMALL=1
 CONFIG_SHA1_SMALL=3
 # CONFIG_SHA1_HWACCEL is not set
@@ -225,6 +228,7 @@ CONFIG_FEATURE_UNZIP_BZIP2=y
 CONFIG_FEATURE_UNZIP_LZMA=y
 CONFIG_FEATURE_UNZIP_XZ=y
 CONFIG_FEATURE_LZMA_FAST=y
+# CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION is not set
 
 #
 # Coreutils
@@ -272,7 +276,7 @@ CONFIG_DD=y
 CONFIG_FEATURE_DD_IBS_OBS=y
 CONFIG_FEATURE_DD_STATUS=y
 CONFIG_DF=y
-# CONFIG_FEATURE_DF_FANCY is not set
+CONFIG_FEATURE_DF_FANCY=y
 # CONFIG_FEATURE_SKIP_ROOTFS is not set
 CONFIG_DIRNAME=y
 CONFIG_DOS2UNIX=y
@@ -312,11 +316,12 @@ CONFIG_FEATURE_LS_COLOR_IS_DEFAULT=y
 CONFIG_MD5SUM=y
 CONFIG_SHA1SUM=y
 CONFIG_SHA256SUM=y
+CONFIG_SHA384SUM=y
 CONFIG_SHA512SUM=y
 CONFIG_SHA3SUM=y
 
 #
-# Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum
+# Common options for md5sum, sha1sum, sha256sum, ..., sha3sum
 #
 CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y
 CONFIG_MKDIR=y
@@ -351,7 +356,7 @@ CONFIG_FEATURE_SPLIT_FANCY=y
 CONFIG_STAT=y
 CONFIG_FEATURE_STAT_FORMAT=y
 CONFIG_FEATURE_STAT_FILESYSTEM=y
-# CONFIG_STTY is not set
+CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
 # CONFIG_FEATURE_SYNC_FANCY is not set
@@ -555,6 +560,7 @@ CONFIG_INIT_TERMINAL_TYPE=""
 # CONFIG_USE_BB_SHADOW is not set
 # CONFIG_USE_BB_CRYPT is not set
 # CONFIG_USE_BB_CRYPT_SHA is not set
+# CONFIG_USE_BB_CRYPT_YES is not set
 # CONFIG_ADD_SHELL is not set
 # CONFIG_REMOVE_SHELL is not set
 # CONFIG_ADDGROUP is not set
@@ -657,7 +663,7 @@ CONFIG_CAL=y
 # CONFIG_FEATURE_GPT_LABEL is not set
 # CONFIG_FEATURE_FDISK_ADVANCED is not set
 # CONFIG_FINDFS is not set
-# CONFIG_FLOCK is not set
+CONFIG_FLOCK=y
 # CONFIG_FDFLUSH is not set
 # CONFIG_FREERAMDISK is not set
 # CONFIG_FSCK_MINIX is not set
@@ -898,7 +904,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+CONFIG_FEATURE_TLS_INTERNAL=y
+# CONFIG_FEATURE_TLS_SCHANNEL is not set
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
@@ -964,6 +973,7 @@ CONFIG_IFUPDOWN_IFSTATE_PATH=""
 # CONFIG_IPNEIGH is not set
 # CONFIG_FEATURE_IP_ADDRESS is not set
 # CONFIG_FEATURE_IP_LINK is not set
+CONFIG_FEATURE_IP_LINK_CAN=y
 # CONFIG_FEATURE_IP_ROUTE is not set
 CONFIG_FEATURE_IP_ROUTE_DIR=""
 # CONFIG_FEATURE_IP_TUNNEL is not set
@@ -1187,6 +1197,7 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_CTTYHACK is not set
 # CONFIG_HUSH is not set
 # CONFIG_SHELL_HUSH is not set
+# CONFIG_HUSH_NEED_FOR_SPEED is not set
 # CONFIG_HUSH_BASH_COMPAT is not set
 # CONFIG_HUSH_BRACE_EXPANSION is not set
 # CONFIG_HUSH_BASH_SOURCE_CURDIR is not set
@@ -1198,7 +1209,9 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_HUSH_IF is not set
 # CONFIG_HUSH_LOOPS is not set
 # CONFIG_HUSH_CASE is not set
+# CONFIG_HUSH_ALIAS is not set
 # CONFIG_HUSH_FUNCTIONS is not set
+# CONFIG_HUSH_FUNCTION_KEYWORD is not set
 # CONFIG_HUSH_LOCAL is not set
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_MODE_X is not set
diff --git a/configs/mingw64a_defconfig b/configs/mingw64a_defconfig
index e9a88bf62..6daca11db 100644
--- a/configs/mingw64a_defconfig
+++ b/configs/mingw64a_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.37.0.git
-# Fri Jun 14 12:24:50 2024
+# Busybox version: 1.38.0.git
+# Thu Nov  6 08:23:16 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -44,24 +44,26 @@ CONFIG_BUSYBOX_EXEC_PATH=""
 # Settings for MINGW32
 #
 CONFIG_GLOBBING=y
-CONFIG_FEATURE_PRNG_SHELL=y
-# CONFIG_FEATURE_PRNG_ISAAC is not set
 CONFIG_FEATURE_RESOURCES=y
 CONFIG_FEATURE_VERSIONINFO=y
 # CONFIG_FEATURE_TOOLCHAIN_MANIFEST is not set
-CONFIG_FEATURE_APP_MANIFEST=y
-# CONFIG_FEATURE_UTF8_MANIFEST is not set
+# CONFIG_FEATURE_APP_MANIFEST is not set
+CONFIG_FEATURE_UTF8_MANIFEST=y
 CONFIG_FEATURE_ICON=y
 # CONFIG_FEATURE_ICON_ATERM is not set
 # CONFIG_FEATURE_ICON_STERM is not set
-CONFIG_FEATURE_ICON_ALL=y
+# CONFIG_FEATURE_ICON_ALL is not set
+# CONFIG_FEATURE_PNG_ATERM is not set
+# CONFIG_FEATURE_PNG_STERM is not set
+CONFIG_FEATURE_PNG_ALL=y
 CONFIG_FEATURE_EURO=y
-# CONFIG_FEATURE_UTF8_INPUT is not set
-# CONFIG_FEATURE_UTF8_OUTPUT is not set
+CONFIG_FEATURE_UTF8_INPUT=y
+CONFIG_FEATURE_UTF8_OUTPUT=y
 CONFIG_TERMINAL_MODE=5
 CONFIG_FEATURE_IMPROVED_COLOUR_MAPPING=y
 CONFIG_FEATURE_EXTRA_FILE_DATA=y
 CONFIG_OVERRIDE_APPLETS=""
+# CONFIG_UNWIND_TABLES is not set
 
 #
 # Build Options
@@ -120,6 +122,7 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
+CONFIG_FEATURE_USE_CNG_API=y
 CONFIG_MD5_SMALL=1
 CONFIG_SHA1_SMALL=3
 # CONFIG_SHA1_HWACCEL is not set
@@ -145,13 +148,13 @@ CONFIG_FEATURE_EDITING_FANCY_PROMPT=y
 # CONFIG_FEATURE_EDITING_WINCH is not set
 # CONFIG_FEATURE_EDITING_ASK_TERMINAL is not set
 # CONFIG_LOCALE_SUPPORT is not set
-# CONFIG_UNICODE_SUPPORT is not set
+CONFIG_UNICODE_SUPPORT=y
 # CONFIG_UNICODE_USING_LOCALE is not set
-# CONFIG_FEATURE_CHECK_UNICODE_IN_ENV is not set
-CONFIG_SUBST_WCHAR=0
-CONFIG_LAST_SUPPORTED_WCHAR=0
-# CONFIG_UNICODE_COMBINING_WCHARS is not set
-# CONFIG_UNICODE_WIDE_WCHARS is not set
+CONFIG_FEATURE_CHECK_UNICODE_IN_ENV=y
+CONFIG_SUBST_WCHAR=63
+CONFIG_LAST_SUPPORTED_WCHAR=1114111
+CONFIG_UNICODE_COMBINING_WCHARS=y
+CONFIG_UNICODE_WIDE_WCHARS=y
 # CONFIG_UNICODE_BIDI_SUPPORT is not set
 # CONFIG_UNICODE_NEUTRAL_TABLE is not set
 # CONFIG_UNICODE_PRESERVE_BROKEN is not set
@@ -225,6 +228,7 @@ CONFIG_FEATURE_UNZIP_BZIP2=y
 CONFIG_FEATURE_UNZIP_LZMA=y
 CONFIG_FEATURE_UNZIP_XZ=y
 CONFIG_FEATURE_LZMA_FAST=y
+# CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION is not set
 
 #
 # Coreutils
@@ -272,7 +276,7 @@ CONFIG_DD=y
 CONFIG_FEATURE_DD_IBS_OBS=y
 CONFIG_FEATURE_DD_STATUS=y
 CONFIG_DF=y
-# CONFIG_FEATURE_DF_FANCY is not set
+CONFIG_FEATURE_DF_FANCY=y
 # CONFIG_FEATURE_SKIP_ROOTFS is not set
 CONFIG_DIRNAME=y
 CONFIG_DOS2UNIX=y
@@ -312,11 +316,12 @@ CONFIG_FEATURE_LS_COLOR_IS_DEFAULT=y
 CONFIG_MD5SUM=y
 CONFIG_SHA1SUM=y
 CONFIG_SHA256SUM=y
+CONFIG_SHA384SUM=y
 CONFIG_SHA512SUM=y
 CONFIG_SHA3SUM=y
 
 #
-# Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum
+# Common options for md5sum, sha1sum, sha256sum, ..., sha3sum
 #
 CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y
 CONFIG_MKDIR=y
@@ -351,7 +356,7 @@ CONFIG_FEATURE_SPLIT_FANCY=y
 CONFIG_STAT=y
 CONFIG_FEATURE_STAT_FORMAT=y
 CONFIG_FEATURE_STAT_FILESYSTEM=y
-# CONFIG_STTY is not set
+CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
 # CONFIG_FEATURE_SYNC_FANCY is not set
@@ -555,6 +560,7 @@ CONFIG_INIT_TERMINAL_TYPE=""
 # CONFIG_USE_BB_SHADOW is not set
 # CONFIG_USE_BB_CRYPT is not set
 # CONFIG_USE_BB_CRYPT_SHA is not set
+# CONFIG_USE_BB_CRYPT_YES is not set
 # CONFIG_ADD_SHELL is not set
 # CONFIG_REMOVE_SHELL is not set
 # CONFIG_ADDGROUP is not set
@@ -657,7 +663,7 @@ CONFIG_CAL=y
 # CONFIG_FEATURE_GPT_LABEL is not set
 # CONFIG_FEATURE_FDISK_ADVANCED is not set
 # CONFIG_FINDFS is not set
-# CONFIG_FLOCK is not set
+CONFIG_FLOCK=y
 # CONFIG_FDFLUSH is not set
 # CONFIG_FREERAMDISK is not set
 # CONFIG_FSCK_MINIX is not set
@@ -898,7 +904,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+# CONFIG_FEATURE_TLS_INTERNAL is not set
+CONFIG_FEATURE_TLS_SCHANNEL=y
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
@@ -964,6 +973,7 @@ CONFIG_IFUPDOWN_IFSTATE_PATH=""
 # CONFIG_IPNEIGH is not set
 # CONFIG_FEATURE_IP_ADDRESS is not set
 # CONFIG_FEATURE_IP_LINK is not set
+CONFIG_FEATURE_IP_LINK_CAN=y
 # CONFIG_FEATURE_IP_ROUTE is not set
 CONFIG_FEATURE_IP_ROUTE_DIR=""
 # CONFIG_FEATURE_IP_TUNNEL is not set
@@ -1187,6 +1197,7 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_CTTYHACK is not set
 # CONFIG_HUSH is not set
 # CONFIG_SHELL_HUSH is not set
+# CONFIG_HUSH_NEED_FOR_SPEED is not set
 # CONFIG_HUSH_BASH_COMPAT is not set
 # CONFIG_HUSH_BRACE_EXPANSION is not set
 # CONFIG_HUSH_BASH_SOURCE_CURDIR is not set
@@ -1198,7 +1209,9 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_HUSH_IF is not set
 # CONFIG_HUSH_LOOPS is not set
 # CONFIG_HUSH_CASE is not set
+# CONFIG_HUSH_ALIAS is not set
 # CONFIG_HUSH_FUNCTIONS is not set
+# CONFIG_HUSH_FUNCTION_KEYWORD is not set
 # CONFIG_HUSH_LOCAL is not set
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_MODE_X is not set
diff --git a/configs/mingw64u_defconfig b/configs/mingw64u_defconfig
index 61753699d..eac615259 100644
--- a/configs/mingw64u_defconfig
+++ b/configs/mingw64u_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.37.0.git
-# Fri Jun 14 12:24:50 2024
+# Busybox version: 1.38.0.git
+# Thu Nov  6 08:23:16 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -44,8 +44,6 @@ CONFIG_BUSYBOX_EXEC_PATH=""
 # Settings for MINGW32
 #
 CONFIG_GLOBBING=y
-CONFIG_FEATURE_PRNG_SHELL=y
-# CONFIG_FEATURE_PRNG_ISAAC is not set
 CONFIG_FEATURE_RESOURCES=y
 CONFIG_FEATURE_VERSIONINFO=y
 # CONFIG_FEATURE_TOOLCHAIN_MANIFEST is not set
@@ -54,7 +52,10 @@ CONFIG_FEATURE_UTF8_MANIFEST=y
 CONFIG_FEATURE_ICON=y
 # CONFIG_FEATURE_ICON_ATERM is not set
 # CONFIG_FEATURE_ICON_STERM is not set
-CONFIG_FEATURE_ICON_ALL=y
+# CONFIG_FEATURE_ICON_ALL is not set
+# CONFIG_FEATURE_PNG_ATERM is not set
+# CONFIG_FEATURE_PNG_STERM is not set
+CONFIG_FEATURE_PNG_ALL=y
 CONFIG_FEATURE_EURO=y
 CONFIG_FEATURE_UTF8_INPUT=y
 CONFIG_FEATURE_UTF8_OUTPUT=y
@@ -62,6 +63,7 @@ CONFIG_TERMINAL_MODE=5
 CONFIG_FEATURE_IMPROVED_COLOUR_MAPPING=y
 CONFIG_FEATURE_EXTRA_FILE_DATA=y
 CONFIG_OVERRIDE_APPLETS=""
+CONFIG_UNWIND_TABLES=y
 
 #
 # Build Options
@@ -120,6 +122,7 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
+CONFIG_FEATURE_USE_CNG_API=y
 CONFIG_MD5_SMALL=1
 CONFIG_SHA1_SMALL=3
 # CONFIG_SHA1_HWACCEL is not set
@@ -225,6 +228,7 @@ CONFIG_FEATURE_UNZIP_BZIP2=y
 CONFIG_FEATURE_UNZIP_LZMA=y
 CONFIG_FEATURE_UNZIP_XZ=y
 CONFIG_FEATURE_LZMA_FAST=y
+# CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION is not set
 
 #
 # Coreutils
@@ -272,7 +276,7 @@ CONFIG_DD=y
 CONFIG_FEATURE_DD_IBS_OBS=y
 CONFIG_FEATURE_DD_STATUS=y
 CONFIG_DF=y
-# CONFIG_FEATURE_DF_FANCY is not set
+CONFIG_FEATURE_DF_FANCY=y
 # CONFIG_FEATURE_SKIP_ROOTFS is not set
 CONFIG_DIRNAME=y
 CONFIG_DOS2UNIX=y
@@ -312,11 +316,12 @@ CONFIG_FEATURE_LS_COLOR_IS_DEFAULT=y
 CONFIG_MD5SUM=y
 CONFIG_SHA1SUM=y
 CONFIG_SHA256SUM=y
+CONFIG_SHA384SUM=y
 CONFIG_SHA512SUM=y
 CONFIG_SHA3SUM=y
 
 #
-# Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum
+# Common options for md5sum, sha1sum, sha256sum, ..., sha3sum
 #
 CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y
 CONFIG_MKDIR=y
@@ -351,7 +356,7 @@ CONFIG_FEATURE_SPLIT_FANCY=y
 CONFIG_STAT=y
 CONFIG_FEATURE_STAT_FORMAT=y
 CONFIG_FEATURE_STAT_FILESYSTEM=y
-# CONFIG_STTY is not set
+CONFIG_STTY=y
 CONFIG_SUM=y
 CONFIG_SYNC=y
 # CONFIG_FEATURE_SYNC_FANCY is not set
@@ -555,6 +560,7 @@ CONFIG_INIT_TERMINAL_TYPE=""
 # CONFIG_USE_BB_SHADOW is not set
 # CONFIG_USE_BB_CRYPT is not set
 # CONFIG_USE_BB_CRYPT_SHA is not set
+# CONFIG_USE_BB_CRYPT_YES is not set
 # CONFIG_ADD_SHELL is not set
 # CONFIG_REMOVE_SHELL is not set
 # CONFIG_ADDGROUP is not set
@@ -657,7 +663,7 @@ CONFIG_CAL=y
 # CONFIG_FEATURE_GPT_LABEL is not set
 # CONFIG_FEATURE_FDISK_ADVANCED is not set
 # CONFIG_FINDFS is not set
-# CONFIG_FLOCK is not set
+CONFIG_FLOCK=y
 # CONFIG_FDFLUSH is not set
 # CONFIG_FREERAMDISK is not set
 # CONFIG_FSCK_MINIX is not set
@@ -898,7 +904,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+# CONFIG_FEATURE_TLS_INTERNAL is not set
+CONFIG_FEATURE_TLS_SCHANNEL=y
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
@@ -964,6 +973,7 @@ CONFIG_IFUPDOWN_IFSTATE_PATH=""
 # CONFIG_IPNEIGH is not set
 # CONFIG_FEATURE_IP_ADDRESS is not set
 # CONFIG_FEATURE_IP_LINK is not set
+CONFIG_FEATURE_IP_LINK_CAN=y
 # CONFIG_FEATURE_IP_ROUTE is not set
 CONFIG_FEATURE_IP_ROUTE_DIR=""
 # CONFIG_FEATURE_IP_TUNNEL is not set
@@ -1187,6 +1197,7 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_CTTYHACK is not set
 # CONFIG_HUSH is not set
 # CONFIG_SHELL_HUSH is not set
+# CONFIG_HUSH_NEED_FOR_SPEED is not set
 # CONFIG_HUSH_BASH_COMPAT is not set
 # CONFIG_HUSH_BRACE_EXPANSION is not set
 # CONFIG_HUSH_BASH_SOURCE_CURDIR is not set
@@ -1198,7 +1209,9 @@ CONFIG_ASH_GLOB_OPTIONS=y
 # CONFIG_HUSH_IF is not set
 # CONFIG_HUSH_LOOPS is not set
 # CONFIG_HUSH_CASE is not set
+# CONFIG_HUSH_ALIAS is not set
 # CONFIG_HUSH_FUNCTIONS is not set
+# CONFIG_HUSH_FUNCTION_KEYWORD is not set
 # CONFIG_HUSH_LOCAL is not set
 # CONFIG_HUSH_RANDOM_SUPPORT is not set
 # CONFIG_HUSH_MODE_X is not set
diff --git a/console-tools/reset.c b/console-tools/reset.c
index 74fe3cb50..d7d9857a0 100644
--- a/console-tools/reset.c
+++ b/console-tools/reset.c
@@ -17,8 +17,12 @@
 // NOTE: For WIN32 this applet is NOFORK so we can change the screen
 //       buffer for the current process.
 
-//applet:IF_PLATFORM_MINGW32(IF_RESET(APPLET_NOFORK(reset, reset, BB_DIR_USR_BIN, BB_SUID_DROP, reset)))
-//applet:IF_PLATFORM_POSIX(IF_RESET(APPLET_NOEXEC(reset, reset, BB_DIR_USR_BIN, BB_SUID_DROP, reset)))
+//applet:IF_PLATFORM_MINGW32(
+//applet:IF_RESET(APPLET_NOFORK(reset, reset, BB_DIR_USR_BIN, BB_SUID_DROP, reset))
+//applet:)
+//applet:IF_PLATFORM_POSIX(
+//applet:IF_RESET(APPLET_NOEXEC(reset, reset, BB_DIR_USR_BIN, BB_SUID_DROP, reset))
+//applet:)
 
 //kbuild:lib-$(CONFIG_RESET) += reset.o
 
diff --git a/console-tools/showkey.c b/console-tools/showkey.c
index 87532a8ac..5767f2098 100644
--- a/console-tools/showkey.c
+++ b/console-tools/showkey.c
@@ -70,8 +70,8 @@ int showkey_main(int argc UNUSED_PARAM, char **argv)
 
         INIT_G();
 
-        // FIXME: aks are all mutually exclusive
-        getopt32(argv, "aks");
+        // a,k,s are all mutually exclusive
+        getopt32(argv, "^" "aks" "\0" "a--ks:k--as:s--ak");
 
         // prepare for raw mode
         xget1(&tio, &tio0);
diff --git a/coreutils/cp.c b/coreutils/cp.c
index ee40af50b..961de5b42 100644
--- a/coreutils/cp.c
+++ b/coreutils/cp.c
@@ -215,7 +215,8 @@ int cp_main(int argc, char **argv)
                                         (flags & FILEUTILS_DEREFERENCE) ? stat : lstat);
                         if (s_flags < 0) /* error other than ENOENT */
                                 return EXIT_FAILURE;
-                        d_flags = cp_mv_stat(last, &dest_stat);
+                        d_flags = cp_mv_stat2(last, &dest_stat,
+                                        (flags & FILEUTILS_NO_TARGET_DIR) ? lstat : stat);
                         if (d_flags < 0) /* error other than ENOENT */
                                 return EXIT_FAILURE;
 
diff --git a/coreutils/cut.c b/coreutils/cut.c
index f7b501a46..d81f36bcd 100644
--- a/coreutils/cut.c
+++ b/coreutils/cut.c
@@ -27,21 +27,34 @@
 //kbuild:lib-$(CONFIG_CUT) += cut.o
 
 //usage:#define cut_trivial_usage
-//usage:       "[OPTIONS] [FILE]..."
+//usage:       "{-b|c LIST | -f"IF_FEATURE_CUT_REGEX("|F")" LIST [-d SEP] [-s]} [-D] [-O SEP] [FILE]..."
+//  --output-delimiter SEP is too long to fit into 80 char-wide help ----------------^^^^^^^^
 //usage:#define cut_full_usage "\n\n"
 //usage:       "Print selected fields from FILEs to stdout\n"
 //usage:     "\n        -b LIST Output only bytes from LIST"
 //usage:     "\n        -c LIST Output only characters from LIST"
-//usage:     "\n        -d SEP  Field delimiter for input (default -f TAB, -F run of whitespace)"
-//usage:     "\n        -O SEP  Field delimeter for output (default = -d for -f, one space for -F)"
-//usage:     "\n        -D      Don't sort/collate sections or match -fF lines without delimeter"
+//usage:     IF_FEATURE_CUT_REGEX(
+//usage:     "\n        -d SEP  Input field delimiter (default -f TAB, -F run of whitespace)"
+//usage:     ) IF_NOT_FEATURE_CUT_REGEX(
+//usage:     "\n        -d SEP  Input field delimiter (default TAB)"
+//usage:     )
 //usage:     "\n        -f LIST Print only these fields (-d is single char)"
 //usage:     IF_FEATURE_CUT_REGEX(
 //usage:     "\n        -F LIST Print only these fields (-d is regex)"
 //usage:     )
-//usage:     "\n        -s      Output only lines containing delimiter"
+//usage:     "\n        -s      Drop lines with no delimiter (else print them in full)"
+//usage:     "\n        -D      Don't sort ranges; line without delimiters has one field"
+//usage:     IF_LONG_OPTS(
+//usage:     "\n        --output-delimiter SEP  Output field delimeter"
+//usage:     ) IF_NOT_LONG_OPTS(
+//usage:     IF_FEATURE_CUT_REGEX(
+//usage:     "\n        -O SEP  Output field delimeter (default = -d for -f, one space for -F)"
+//usage:     ) IF_NOT_FEATURE_CUT_REGEX(
+//usage:     "\n        -O SEP  Output field delimeter (default = -d)"
+//usage:     )
+//usage:     )
 //usage:     "\n        -n      Ignored"
-//(manpage:-n   with -b: don't split multibyte characters)
+//(manpage:-n with -b: don't split multibyte characters)
 //usage:
 //usage:#define cut_example_usage
 //usage:       "$ echo \"Hello world\" | cut -f 1 -d ' '\n"
@@ -53,11 +66,6 @@
 
 #if ENABLE_FEATURE_CUT_REGEX
 #include "xregex.h"
-#else
-#define regex_t int
-typedef struct { int rm_eo, rm_so; } regmatch_t;
-#define xregcomp(x, ...) *(x) = 0
-#define regexec(...)     0
 #endif
 
 /* This is a NOEXEC applet. Be very careful! */
@@ -65,265 +73,346 @@ typedef struct { int rm_eo, rm_so; } regmatch_t;
 
 /* option vars */
 #define OPT_STR "b:c:f:d:O:sD"IF_FEATURE_CUT_REGEX("F:")"n"
-#define CUT_OPT_BYTE_FLGS     (1 << 0)
-#define CUT_OPT_CHAR_FLGS     (1 << 1)
-#define CUT_OPT_FIELDS_FLGS   (1 << 2)
-#define CUT_OPT_DELIM_FLGS    (1 << 3)
-#define CUT_OPT_ODELIM_FLGS   (1 << 4)
-#define CUT_OPT_SUPPRESS_FLGS (1 << 5)
-#define CUT_OPT_NOSORT_FLGS   (1 << 6)
-#define CUT_OPT_REGEX_FLGS    ((1 << 7) * ENABLE_FEATURE_CUT_REGEX)
-
-struct cut_list {
-        int startpos;
-        int endpos;
+#define OPT_BYTE     (1 << 0)
+#define OPT_CHAR     (1 << 1)
+#define OPT_FIELDS   (1 << 2)
+#define OPT_DELIM    (1 << 3)
+#define OPT_ODELIM   (1 << 4)
+#define OPT_SUPPRESS (1 << 5)
+#define OPT_NOSORT   (1 << 6)
+#define OPT_REGEX    ((1 << 7) * ENABLE_FEATURE_CUT_REGEX)
+
+#define opt_REGEX (option_mask32 & OPT_REGEX)
+
+struct cut_range {
+        unsigned startpos;
+        unsigned endpos;
 };
 
 static int cmpfunc(const void *a, const void *b)
 {
-        return (((struct cut_list *) a)->startpos -
-                        ((struct cut_list *) b)->startpos);
+        const struct cut_range *aa = a;
+        const struct cut_range *bb = b;
+        return aa->startpos - bb->startpos;
 }
 
+#define END_OF_LIST(list_elem)     ((list_elem).startpos == UINT_MAX)
+#define NOT_END_OF_LIST(list_elem) ((list_elem).startpos != UINT_MAX)
+
 static void cut_file(FILE *file, const char *delim, const char *odelim,
-                const struct cut_list *cut_lists, unsigned nlists)
+                const struct cut_range *cut_list)
 {
         char *line;
         unsigned linenum = 0;   /* keep these zero-based to be consistent */
-        regex_t reg;
-        int spos, shoe = option_mask32 & CUT_OPT_REGEX_FLGS;
-
-        if (shoe) xregcomp(&reg, delim, REG_EXTENDED);
+        int first_print = 1;
 
         /* go through every line in the file */
         while ((line = xmalloc_fgetline(file)) != NULL) {
 
                 /* set up a list so we can keep track of what's been printed */
-                int linelen = strlen(line);
-                char *printed = xzalloc(linelen + 1);
-                char *orig_line = line;
+                unsigned linelen = strlen(line);
                 unsigned cl_pos = 0;
 
-                /* cut based on chars/bytes XXX: only works when sizeof(char) == byte */
-                if (option_mask32 & (CUT_OPT_CHAR_FLGS | CUT_OPT_BYTE_FLGS)) {
+                /* Cut based on chars/bytes XXX: only works when sizeof(char) == byte */
+                if (option_mask32 & (OPT_CHAR | OPT_BYTE)) {
+                        char *printed = xzalloc(linelen + 1);
+                        int need_odelim = 0;
+
                         /* print the chars specified in each cut list */
-                        for (; cl_pos < nlists; cl_pos++) {
-                                for (spos = cut_lists[cl_pos].startpos; spos < linelen;) {
+                        for (; NOT_END_OF_LIST(cut_list[cl_pos]); cl_pos++) {
+                                unsigned spos = cut_list[cl_pos].startpos;
+                                while (spos < linelen) {
                                         if (!printed[spos]) {
                                                 printed[spos] = 'X';
+                                                if (need_odelim && spos != 0 && !printed[spos-1]) {
+                                                        need_odelim = 0;
+                                                        fputs_stdout(odelim);
+                                                }
                                                 putchar(line[spos]);
                                         }
-                                        if (++spos > cut_lists[cl_pos].endpos) {
+                                        spos++;
+                                        if (spos > cut_list[cl_pos].endpos) {
+                                                /* will print OSEP (if not empty) */
+                                                need_odelim = (odelim && odelim[0]);
                                                 break;
                                         }
                                 }
                         }
-                } else if (*delim == '\n') {    /* cut by lines */
-                        spos = cut_lists[cl_pos].startpos;
+                        free(printed);
+                /* Cut by lines */
+                } else if (!opt_REGEX && *delim == '\n') {
+                        unsigned spos = cut_list[cl_pos].startpos;
 
-                        /* get out if we have no more lists to process or if the lines
+                        linenum++;
+                        /* get out if we have no more ranges to process or if the lines
                          * are lower than what we're interested in */
-                        if (((int)linenum < spos) || (cl_pos >= nlists))
+                        if (linenum <= spos || END_OF_LIST(cut_list[cl_pos]))
                                 goto next_line;
 
                         /* if the line we're looking for is lower than the one we were
                          * passed, it means we displayed it already, so move on */
-                        while (spos < (int)linenum) {
-                                spos++;
+                        while (++spos < linenum) {
                                 /* go to the next list if we're at the end of this one */
-                                if (spos > cut_lists[cl_pos].endpos) {
+                                if (spos > cut_list[cl_pos].endpos) {
                                         cl_pos++;
-                                        /* get out if there's no more lists to process */
-                                        if (cl_pos >= nlists)
+                                        /* get out if there's no more ranges to process */
+                                        if (END_OF_LIST(cut_list[cl_pos]))
                                                 goto next_line;
-                                        spos = cut_lists[cl_pos].startpos;
+                                        spos = cut_list[cl_pos].startpos;
                                         /* get out if the current line is lower than the one
                                          * we just became interested in */
-                                        if ((int)linenum < spos)
+                                        if (linenum <= spos)
                                                 goto next_line;
                                 }
                         }
 
                         /* If we made it here, it means we've found the line we're
                          * looking for, so print it */
-                        puts(line);
+                        if (first_print) {
+                                first_print = 0;
+                                fputs_stdout(line);
+                        } else
+                                printf("%s%s", odelim, line);
                         goto next_line;
-                } else {                /* cut by fields */
-                        unsigned uu = 0, start = 0, end = 0, out = 0;
-                        int dcount = 0;
+                /* Cut by fields */
+                } else {
+                        unsigned next = 0, start = 0, end = 0;
+                        unsigned dcount = 0; /* we saw Nth delimiter (0 - didn't see any yet) */
+
+                        /* Blank line? Check -s (later check for -s does not catch empty lines) */
+                        if (linelen == 0) {
+                                if (option_mask32 & OPT_SUPPRESS)
+                                        goto next_line;
+                        }
+
+                        if (!odelim)
+                                odelim = "\t";
+                        first_print = 1;
 
-#if ENABLE_PLATFORM_MINGW32
-                        /* An empty line can't contain a delimiter */
-                        if (linelen == 0 && (option_mask32 & CUT_OPT_SUPPRESS_FLGS))
-                                goto next_line;
-#endif
                         /* Loop through bytes, finding next delimiter */
                         for (;;) {
                                 /* End of current range? */
-                                if (end == linelen || dcount > cut_lists[cl_pos].endpos) {
-                                        if (++cl_pos >= nlists) break;
-                                        if (option_mask32 & CUT_OPT_NOSORT_FLGS)
-                                                start = dcount = uu = 0;
-                                        end = 0;
+                                if (end == linelen || dcount > cut_list[cl_pos].endpos) {
+ end_of_range:
+                                        cl_pos++;
+                                        if (END_OF_LIST(cut_list[cl_pos]))
+                                                break;
+                                        if (option_mask32 & OPT_NOSORT)
+                                                start = dcount = next = 0;
+                                        end = 0; /* (why?) */
+                                        //bb_error_msg("End of current range");
                                 }
                                 /* End of current line? */
-                                if (uu == linelen) {
-                                        /* If we've seen no delimiters, check -s */
-                                        if (!cl_pos && !dcount && !shoe) {
-                                                if (option_mask32 & CUT_OPT_SUPPRESS_FLGS)
+                                if (next == linelen) {
+                                        end = linelen; /* print up to end */
+                                        /* If we've seen no delimiters, and no -D, check -s */
+                                        if (!(option_mask32 & OPT_NOSORT) && cl_pos == 0 && dcount == 0) {
+                                                if (option_mask32 & OPT_SUPPRESS)
                                                         goto next_line;
-                                        } else if (dcount < cut_lists[cl_pos].startpos)
-                                                start = linelen;
-                                        end = linelen;
+                                                /* else: will print entire line */
+                                        } else if (dcount < cut_list[cl_pos].startpos) {
+                                                /* echo 1.2 | cut -d. -f1,3: prints "1", not "1." */
+                                                //break;
+                                                /* ^^^ this fails a case with -D:
+                                                 * echo 1 2 | cut -DF 1,3,2:
+                                                 * do not end line processing when didn't find field#3
+                                                 */
+                                                //if (option_mask32 & OPT_NOSORT) - no, just do it always
+                                                goto end_of_range;
+                                        }
+                                        //bb_error_msg("End of current line: s:%d e:%d", start, end);
                                 } else {
                                         /* Find next delimiter */
-                                        if (shoe) {
-                                                regmatch_t rr = {-1, -1};
-
-                                                if (!regexec(&reg, line+uu, 1, &rr, REG_NOTBOL|REG_NOTEOL)) {
-                                                        end = uu + rr.rm_so;
-                                                        uu += rr.rm_eo;
-                                                } else {
-                                                        uu = linelen;
+#if ENABLE_FEATURE_CUT_REGEX
+                                        if (opt_REGEX) {
+                                                regmatch_t rr;
+                                                regex_t *reg = (void*) delim;
+
+                                                if (regexec(reg, line + next, 1, &rr, REG_NOTBOL|REG_NOTEOL) != 0) {
+                                                        /* not found, go to "end of line" logic */
+                                                        next = linelen;
                                                         continue;
                                                 }
-                                        } else if (line[end = uu++] != *delim)
-                                                continue;
-
-                                        /* Got delimiter. Loop if not yet within range. */
-                                        if (dcount++ < cut_lists[cl_pos].startpos) {
-                                                start = uu;
+                                                end = next + rr.rm_so;
+                                                next += (rr.rm_eo ? rr.rm_eo : 1);
+                                                /* ^^^ advancing by at least 1 prevents infinite loops */
+                                                /* testcase: echo "no at sign" | cut -d'@*' -F 1- */
+                                        } else
+#endif
+                                        {
+                                                end = next++;
+                                                if (line[end] != *delim)
+                                                        continue;
+                                        }
+                                        /* Got delimiter */
+                                        dcount++;
+                                        if (dcount <= cut_list[cl_pos].startpos) {
+                                                /* Not yet within range - loop */
+                                                start = next;
                                                 continue;
                                         }
+                                        /* -F N-M preserves intermediate delimiters: */
+                                        //printf "1 2  3  4  5  6  7\n" | toybox cut -O: -F2,4-6,7
+                                        //2:4  5  6:7
+                                        if (opt_REGEX && dcount <= cut_list[cl_pos].endpos)
+                                                continue;
+// NB: toybox does the above for -f too, but it's a compatibility bug:
+//printf "1 2 3 4 5 6 7 8\n" | toybox cut -d' ' -O: -f2,4-6,7
+//2:4 5 6:7  // WRONG!
+//printf "1 2 3 4 5 6 7 8\n" | cut -d' ' --output-delimiter=: -f2,4-6,7
+//2:4:5:6:7  // GNU coreutils 9.1
                                 }
-                                if (end != start || !shoe)
-                                        printf("%s%.*s", out++ ? odelim : "", end-start, line + start);
-                                start = uu;
-                                if (!dcount)
-                                        break;
-                        }
+#if ENABLE_FEATURE_CUT_REGEX
+                                if (end != start || !opt_REGEX)
+#endif
+                                {
+                                        if (first_print) {
+                                                first_print = 0;
+                                                printf("%.*s", end - start, line + start);
+                                        } else
+                                                printf("%s%.*s", odelim, end - start, line + start);
+                                }
+                                start = next;
+                                //if (dcount == 0)
+                                //      break; - why?
+                        } /* byte loop */
                 }
                 /* if we printed anything, finish with newline */
                 putchar('\n');
  next_line:
-                linenum++;
-                free(printed);
-                free(orig_line);
-        }
+                free(line);
+        } /* while (got line) */
+
+        /* For -d$'\n' --output-delimiter=^, the overall output is still terminated with \n, not ^ */
+        if (!opt_REGEX && *delim == '\n' && !first_print)
+                putchar('\n');
 }
 
 int cut_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int cut_main(int argc UNUSED_PARAM, char **argv)
 {
-        /* growable array holding a series of lists */
-        struct cut_list *cut_lists = NULL;
-        unsigned nlists = 0;    /* number of elements in above list */
-        char *sopt, *ltok;
+        /* growable array holding a series of ranges */
+        struct cut_range *cut_list = NULL;
+        unsigned nranges = 0;   /* number of elements in above list */
+        char *LIST, *ltok;
         const char *delim = NULL;
         const char *odelim = NULL;
         unsigned opt;
+#if ENABLE_FEATURE_CUT_REGEX
+        regex_t reg;
+#endif
+#if ENABLE_LONG_OPTS
+        static const char cut_longopts[] ALIGN1 =
+                "output-delimiter\0" Required_argument "O"
+                ;
+#endif
 
 #define ARG "bcf"IF_FEATURE_CUT_REGEX("F")
-        opt = getopt32(argv, "^"
+#if ENABLE_LONG_OPTS
+        opt = getopt32long
+#else
+        opt = getopt32
+#endif
+                (argv, "^"
                         OPT_STR  // = "b:c:f:d:O:sD"IF_FEATURE_CUT_REGEX("F:")"n"
-                        "\0" "b--"ARG":c--"ARG":f--"ARG IF_FEATURE_CUT_REGEX("F--"ARG),
-                        &sopt, &sopt, &sopt, &delim, &odelim IF_FEATURE_CUT_REGEX(, &sopt)
-        );
-        if (!delim || !*delim)
-                delim = (opt & CUT_OPT_REGEX_FLGS) ? "[[:space:]]+" : "\t";
-        if (!odelim) odelim = (opt & CUT_OPT_REGEX_FLGS) ? " " : delim;
+                        "\0" "b:c:f:" IF_FEATURE_CUT_REGEX("F:") /* one of -bcfF is required */
+                        "b--"ARG":c--"ARG":f--"ARG IF_FEATURE_CUT_REGEX(":F--"ARG), /* they are mutually exclusive */
+                IF_LONG_OPTS(cut_longopts,)
+                        &LIST, &LIST, &LIST, &delim, &odelim IF_FEATURE_CUT_REGEX(, &LIST)
+                );
+        if (!odelim)
+                odelim = (opt & OPT_REGEX) ? " " : delim;
+        if (!delim)
+                delim = (opt & OPT_REGEX) ? "[[:space:]]+" : "\t";
 
 //      argc -= optind;
         argv += optind;
-        if (!(opt & (CUT_OPT_BYTE_FLGS | CUT_OPT_CHAR_FLGS | CUT_OPT_FIELDS_FLGS | CUT_OPT_REGEX_FLGS)))
-                bb_simple_error_msg_and_die("expected a list of bytes, characters, or fields");
-
-        /*  non-field (char or byte) cutting has some special handling */
-        if (!(opt & (CUT_OPT_FIELDS_FLGS|CUT_OPT_REGEX_FLGS))) {
-                static const char _op_on_field[] ALIGN1 = " only when operating on fields";
-
-                if (opt & CUT_OPT_SUPPRESS_FLGS) {
-                        bb_error_msg_and_die
-                                ("suppressing non-delimited lines makes sense%s", _op_on_field);
-                }
-                if (opt & CUT_OPT_DELIM_FLGS) {
-                        bb_error_msg_and_die
-                                ("a delimiter may be specified%s", _op_on_field);
-                }
+        //if (!(opt & (OPT_BYTE | OPT_CHAR | OPT_FIELDS | OPT_REGEX)))
+        //      bb_simple_error_msg_and_die("expected a list of bytes, characters, or fields");
+        //^^^ handled by getopt32
+
+        /* non-field (char or byte) cutting has some special handling */
+        if (!(opt & (OPT_FIELDS|OPT_REGEX))) {
+                static const char requires_f[] ALIGN1 = " requires -f"
+                                        IF_FEATURE_CUT_REGEX(" or -F");
+                if (opt & OPT_SUPPRESS)
+                        bb_error_msg_and_die("-s%s", requires_f);
+                if (opt & OPT_DELIM)
+                        bb_error_msg_and_die("-d DELIM%s", requires_f);
         }
 
         /*
          * parse list and put values into startpos and endpos.
-         * valid list formats: N, N-, N-M, -M
-         * more than one list can be separated by commas
+         * valid range formats: N, N-, N-M, -M
+         * more than one range can be separated by commas
          */
-        {
+        /* take apart the ranges, one by one (separated with commas) */
+        while ((ltok = strsep(&LIST, ",")) != NULL) {
                 char *ntok;
-                int s = 0, e = 0;
-
-                /* take apart the lists, one by one (they are separated with commas) */
-                while ((ltok = strsep(&sopt, ",")) != NULL) {
+                int s, e;
+
+                /* it's actually legal to pass an empty list */
+                //if (!ltok[0])
+                //      continue;
+                //^^^ testcase?
+
+                /* get the start pos */
+                ntok = strsep(&ltok, "-");
+                if (!ntok[0]) {
+                        if (!ltok) /* testcase: -f '' */
+                                bb_show_usage();
+                        if (!ltok[0]) /* testcase: -f - */
+                                bb_show_usage();
+                        s = 0; /* "-M" means "1-M" */
+                } else {
+                        /* "N" or "N-[M]" */
+                        /* arrays are zero based, while the user expects
+                         * the first field/char on the line to be char #1 */
+                        s = xatoi_positive(ntok) - 1;
+                }
 
-                        /* it's actually legal to pass an empty list */
-                        if (!ltok[0])
-                                continue;
+                /* get the end pos */
+                if (!ltok) {
+                        e = s; /* "N" means "N-N" */
+                } else if (!ltok[0]) {
+                        /* "N-" means "until the end of the line" */
+                        e = INT_MAX;
+                } else {
+                        /* again, arrays are zero based, fields are 1 based */
+                        e = xatoi_positive(ltok) - 1;
+                }
 
-                        /* get the start pos */
-                        ntok = strsep(&ltok, "-");
-                        if (!ntok[0]) {
-                                s = 0;
-                        } else {
-                                s = xatoi_positive(ntok);
-                                /* account for the fact that arrays are zero based, while
-                                 * the user expects the first char on the line to be char #1 */
-#if !ENABLE_PLATFORM_MINGW32
-                                if (s != 0)
-                                        s--;
-#else
-                                s--;
-#endif
-                        }
+                if (s < 0 || e < s)
+                        bb_error_msg_and_die("invalid range %s-%s", ntok, ltok ?: ntok);
 
-                        /* get the end pos */
-                        if (ltok == NULL) {
-                                e = s;
-                        } else if (!ltok[0]) {
-                                e = INT_MAX;
-                        } else {
-                                e = xatoi_positive(ltok);
-                                /* if the user specified no end position,
-                                 * that means "til the end of the line" */
-#if !ENABLE_PLATFORM_MINGW32
-                                if (!*ltok)
-                                        e = INT_MAX;
-                                else if (e < s)
-                                        bb_error_msg_and_die("%d<%d", e, s);
-#endif
-                                e--;    /* again, arrays are zero based, lines are 1 based */
-                        }
-#if ENABLE_PLATFORM_MINGW32
-                        if (s < 0 || e < s)
-                                bb_error_msg_and_die("invalid range %s-%s", ntok, ltok ?: ntok);
-#endif
+                /* add the new range */
+                cut_list = xrealloc_vector(cut_list, 4, nranges);
+                /* NB: s is always >= 0 */
+                cut_list[nranges].startpos = s;
+                cut_list[nranges].endpos = e;
+                nranges++;
+        }
+        cut_list[nranges].startpos = UINT_MAX; /* end indicator */
 
-                        /* add the new list */
-                        cut_lists = xrealloc_vector(cut_lists, 4, nlists);
-                        /* NB: startpos is always >= 0 */
-                        cut_lists[nlists].startpos = s;
-                        cut_lists[nlists].endpos = e;
-                        nlists++;
-                }
+        /* make sure we got some cut positions out of all that */
+        //if (nranges == 0)
+        //      bb_simple_error_msg_and_die("missing list of positions");
+        //^^^ this is impossible since one of -bcfF is required,
+        // they populate LIST with non-NULL string and when it is parsed,
+        // cut_list[] gets at least one element.
 
-                /* make sure we got some cut positions out of all that */
-                if (nlists == 0)
-                        bb_simple_error_msg_and_die("missing list of positions");
+        /* now that the lists are parsed, we need to sort them to make life
+         * easier on us when it comes time to print the chars / fields / lines
+         */
+        if (!(opt & OPT_NOSORT))
+                qsort(cut_list, nranges, sizeof(cut_list[0]), cmpfunc);
 
-                /* now that the lists are parsed, we need to sort them to make life
-                 * easier on us when it comes time to print the chars / fields / lines
-                 */
-                if (!(opt & CUT_OPT_NOSORT_FLGS))
-                        qsort(cut_lists, nlists, sizeof(cut_lists[0]), cmpfunc);
+#if ENABLE_FEATURE_CUT_REGEX
+        if (opt & OPT_REGEX) {
+                xregcomp(&reg, delim, REG_EXTENDED);
+                delim = (void*) &reg;
         }
+#endif
 
         {
                 exitcode_t retval = EXIT_SUCCESS;
@@ -337,12 +426,12 @@ int cut_main(int argc UNUSED_PARAM, char **argv)
                                 retval = EXIT_FAILURE;
                                 continue;
                         }
-                        cut_file(file, delim, odelim, cut_lists, nlists);
+                        cut_file(file, delim, odelim, cut_list);
                         fclose_if_not_stdin(file);
                 } while (*++argv);
 
                 if (ENABLE_FEATURE_CLEAN_UP)
-                        free(cut_lists);
+                        free(cut_list);
                 fflush_stdout_and_exit(retval);
         }
 }
diff --git a/coreutils/date.c b/coreutils/date.c
index 3a89b6caf..ef482af1b 100644
--- a/coreutils/date.c
+++ b/coreutils/date.c
@@ -289,7 +289,7 @@ int date_main(int argc UNUSED_PARAM, char **argv)
 
                 /* if setting time, set it */
                 if ((opt & OPT_SET) && clock_settime(CLOCK_REALTIME, &ts) < 0) {
-                        bb_simple_perror_msg("can't set date");
+                        bb_simple_perror_msg_and_die("can't set date");
                 }
         }
 
diff --git a/coreutils/dd.c b/coreutils/dd.c
index e6b88acf5..f439326fd 100644
--- a/coreutils/dd.c
+++ b/coreutils/dd.c
@@ -290,12 +290,6 @@ static bool write_and_stats(const void *buf, size_t len, size_t obs,
         return 1;
 }
 
-#if ENABLE_LFS
-# define XATOU_SFX xatoull_sfx
-#else
-# define XATOU_SFX xatoul_sfx
-#endif
-
 #if ENABLE_FEATURE_DD_IBS_OBS
 static int parse_comma_flags(char *val, const char *words, const char *error_in)
 {
@@ -488,15 +482,15 @@ int dd_main(int argc UNUSED_PARAM, char **argv)
                 /* These can be large: */
                 if (what == OP_count) {
                         G.flags |= FLAG_COUNT;
-                        count = XATOU_SFX(val, cwbkMG_suffixes);
+                        count = XATOOFF_SFX(val, cwbkMG_suffixes);
                         /*continue;*/
                 }
                 if (what == OP_seek) {
-                        seek = XATOU_SFX(val, cwbkMG_suffixes);
+                        seek = XATOOFF_SFX(val, cwbkMG_suffixes);
                         /*continue;*/
                 }
                 if (what == OP_skip) {
-                        skip = XATOU_SFX(val, cwbkMG_suffixes);
+                        skip = XATOOFF_SFX(val, cwbkMG_suffixes);
                         /*continue;*/
                 }
                 if (what == OP_if) {
diff --git a/coreutils/df.c b/coreutils/df.c
index 03aa78148..01c41db38 100644
--- a/coreutils/df.c
+++ b/coreutils/df.c
@@ -64,7 +64,9 @@
 //usage:        "[-Pk"
 //usage:        IF_FEATURE_HUMAN_READABLE("mh")
 //usage:        "T"
-//usage:        IF_FEATURE_DF_FANCY("ai] [-B SIZE")
+//usage:        IF_FEATURE_DF_FANCY("a"
+//usage:        IF_PLATFORM_POSIX("i")
+//usage:        "] [-B SIZE")
 //usage:        "] [-t TYPE] [FILESYSTEM]..."
 //usage:#define df_full_usage "\n\n"
 //usage:       "Print filesystem usage statistics\n"
@@ -78,7 +80,9 @@
 //usage:     "\n        -t TYPE Print only mounts of this type"
 //usage:        IF_FEATURE_DF_FANCY(
 //usage:     "\n        -a      Show all filesystems"
+//usage:        IF_PLATFORM_POSIX(
 //usage:     "\n        -i      Inodes"
+//usage:        )
 //usage:     "\n        -B SIZE Blocksize"
 //usage:        )
 //usage:
@@ -109,6 +113,12 @@ static unsigned long kscale(unsigned long b, unsigned long bs)
 }
 #endif
 
+#if ENABLE_PLATFORM_MINGW32
+# define ENABLE_FEATURE_DF_FANCY_POSIX 0
+#else
+# define ENABLE_FEATURE_DF_FANCY_POSIX ENABLE_FEATURE_DF_FANCY
+#endif
+
 int df_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int df_main(int argc UNUSED_PARAM, char **argv)
 {
@@ -124,11 +134,11 @@ int df_main(int argc UNUSED_PARAM, char **argv)
                 OPT_FSTYPE   = (1 << 2),
                 OPT_t        = (1 << 3),
                 OPT_ALL      = (1 << 4) * ENABLE_FEATURE_DF_FANCY,
-                OPT_INODE    = (1 << 5) * ENABLE_FEATURE_DF_FANCY,
-                OPT_BSIZE    = (1 << 6) * ENABLE_FEATURE_DF_FANCY,
-                OPT_HUMAN    = (1 << (4 + 3*ENABLE_FEATURE_DF_FANCY)) * ENABLE_FEATURE_HUMAN_READABLE,
-                OPT_HUMANDEC = (1 << (5 + 3*ENABLE_FEATURE_DF_FANCY)) * ENABLE_FEATURE_HUMAN_READABLE,
-                OPT_MEGA     = (1 << (6 + 3*ENABLE_FEATURE_DF_FANCY)) * ENABLE_FEATURE_HUMAN_READABLE,
+                OPT_INODE    = (1 << 5) * ENABLE_FEATURE_DF_FANCY_POSIX,
+                OPT_BSIZE    = (1 << (5 + ENABLE_FEATURE_DF_FANCY_POSIX)) * ENABLE_FEATURE_DF_FANCY,
+                OPT_HUMAN    = (1 << (4 + 2*ENABLE_FEATURE_DF_FANCY + ENABLE_FEATURE_DF_FANCY_POSIX)) * ENABLE_FEATURE_HUMAN_READABLE,
+                OPT_HUMANDEC = (1 << (5 + 2*ENABLE_FEATURE_DF_FANCY + ENABLE_FEATURE_DF_FANCY_POSIX)) * ENABLE_FEATURE_HUMAN_READABLE,
+                OPT_MEGA     = (1 << (6 + 2*ENABLE_FEATURE_DF_FANCY + ENABLE_FEATURE_DF_FANCY_POSIX)) * ENABLE_FEATURE_HUMAN_READABLE,
         };
         const char *disp_units_hdr = NULL;
         char *chp, *opt_t;
@@ -144,7 +154,11 @@ int df_main(int argc UNUSED_PARAM, char **argv)
 
         opt = getopt32(argv, "^"
                         "kPTt:"
+#if ENABLE_PLATFORM_POSIX
                         IF_FEATURE_DF_FANCY("aiB:")
+#else
+                        IF_FEATURE_DF_FANCY("aB:")
+#endif
                         IF_FEATURE_HUMAN_READABLE("hHm")
                         "\0"
 #if ENABLE_FEATURE_HUMAN_READABLE && ENABLE_FEATURE_DF_FANCY
@@ -155,6 +169,9 @@ int df_main(int argc UNUSED_PARAM, char **argv)
                         , &opt_t
                         IF_FEATURE_DF_FANCY(, &chp)
         );
+        /* -k overrides $POSIXLY_CORRECT: */
+        if (opt & OPT_KILO)
+                df_disp_hr = 1024;
         if (opt & OPT_MEGA)
                 df_disp_hr = 1024*1024;
 
@@ -185,8 +202,8 @@ int df_main(int argc UNUSED_PARAM, char **argv)
         if (disp_units_hdr == NULL) {
 #if ENABLE_FEATURE_HUMAN_READABLE
                 disp_units_hdr = xasprintf("%s-blocks",
-                        /* print df_disp_hr, show no fractionals,
-                         * use suffixes if OPT_POSIX is set in opt */
+                        /* print df_disp_hr; show no fractionals;
+                         * if -P, unit=1 (print it in full, no KMG suffixes) */
                         make_human_readable_str(df_disp_hr, 0, !!(opt & OPT_POSIX))
                 );
 #else
diff --git a/coreutils/expr.c b/coreutils/expr.c
index 3f7e21871..c00559e4c 100644
--- a/coreutils/expr.c
+++ b/coreutils/expr.c
@@ -97,6 +97,10 @@ typedef long arith_t;
 
 /* TODO: use bb_strtol[l]? It's easier to check for errors... */
 
+#if ENABLE_PLATFORM_MINGW32
+# define STRING BB_STRING
+#endif
+
 /* The kinds of value we can have.  */
 enum {
         INTEGER,
diff --git a/coreutils/ls.c b/coreutils/ls.c
index 5d2e96a1e..b8d276e53 100644
--- a/coreutils/ls.c
+++ b/coreutils/ls.c
@@ -98,6 +98,7 @@
 
 //usage:#define ls_trivial_usage
 //usage:        "[-1AaCxd"
+//usage:        IF_PLATFORM_MINGW32("g")
 //usage:        IF_FEATURE_LS_FOLLOWLINKS("LH")
 //usage:        IF_FEATURE_LS_RECURSIVE("R")
 //usage:        IF_FEATURE_LS_FILETYPES("Fp") "lins"
@@ -113,6 +114,7 @@
 //usage:     "\n        -A      Like -a, but exclude . and .."
 //usage:        IF_PLATFORM_MINGW32(
 //usage:     "\n        -aa,-AA Like -a,-A but omit hidden system files"
+//usage:     "\n        -C      List by columns"
 //usage:        )
 ////usage:     "\n      -C      List by columns" - don't show, this is a default anyway
 //usage:     "\n        -x      List by lines"
@@ -129,6 +131,11 @@
 //usage:     "\n        -F      Append indicator (one of */=@|) to names"
 //usage:        )
 //usage:     "\n        -l      Long format"
+//usage:        IF_PLATFORM_MINGW32(
+//usage:     "\n        -g      Long format without group column"
+//usage:        )
+////usage:     "\n      -g      Long format without group column"
+////TODO: support -G too ("suppress owner column", GNUism)
 //usage:     "\n        -i      List inode numbers"
 //usage:     "\n        -n      List numeric UIDs and GIDs instead of names"
 //usage:     "\n        -s      List allocated blocks"
@@ -162,6 +169,8 @@
 //usage:        IF_FEATURE_LS_WIDTH(
 //usage:     "\n        -w N    Format N columns wide"
 //usage:        )
+////usage:     "\n      -Q      Double-quote names"
+////usage:     "\n      -q      Replace unprintable chars with '?'"
 //usage:        IF_FEATURE_LS_COLOR(
 //usage:     "\n        --color[={always,never,auto}]"
 //usage:        )
@@ -199,27 +208,47 @@ SPLIT_SUBDIR    = 2,
 
 /* -Cadi1l  Std options, busybox always supports */
 /* -gnsxA   Std options, busybox always supports */
-/* -Q       GNU option, busybox always supports */
-/* -k       Std option, busybox always supports (by ignoring) */
-/*          It means "for -s, show sizes in kbytes" */
-/*          Seems to only affect "POSIXLY_CORRECT=1 ls -sk" */
-/*          since otherwise -s shows kbytes anyway */
+/* -Q       GNU option, busybox always supports:  */
+/*          -Q, --quote-name                     */
+/*          enclose entry names in double quotes */
 /* -LHRctur Std options, busybox optionally supports */
 /* -Fp      Std options, busybox optionally supports */
 /* -SXvhTw  GNU options, busybox optionally supports */
 /* -T WIDTH Ignored (we don't use tabs on output) */
 /* -Z       SELinux mandated option, busybox optionally supports */
+/* -q       Std option, busybox always supports: */
+/*      https://pubs.opengroup.org/onlinepubs/9699919799/utilities/ls.html: */
+/*      Force each instance of non-printable filename characters and        */
+/*      <tab> characters to be written as the <question-mark> ('?')         */
+/*      character. Implementations may provide this option by default       */
+/*      if the output is to a terminal device.                              */
+/* -k       Std option, busybox always supports (by ignoring) */
+/*          It means "for -s, show sizes in kbytes" */
+/*          Seems to only affect "POSIXLY_CORRECT=1 ls -sk" */
+/*          since otherwise -s shows kbytes anyway */
 #define ls_options \
-        "Cadi1lgnsxAk"       /* 12 opts, total 12 */ \
-        IF_FEATURE_LS_FILETYPES("Fp")    /* 2, 14 */ \
-        IF_FEATURE_LS_RECURSIVE("R")     /* 1, 15 */ \
-        IF_SELINUX("Z")                  /* 1, 16 */ \
-        "Q"                              /* 1, 17 */ \
-        IF_FEATURE_LS_TIMESTAMPS("ctu")  /* 3, 20 */ \
-        IF_FEATURE_LS_SORTFILES("SXrv")  /* 4, 24 */ \
-        IF_FEATURE_LS_FOLLOWLINKS("LH")  /* 2, 26 */ \
-        IF_FEATURE_HUMAN_READABLE("h")   /* 1, 27 */ \
-        IF_FEATURE_LS_WIDTH("T:w:")      /* 2, 29 */
+        "Cadi1lgnsxA"        /* 11 opts, total 11 */ \
+        IF_FEATURE_LS_FILETYPES("Fp")    /* 2, 13 */ \
+        IF_FEATURE_LS_RECURSIVE("R")     /* 1, 14 */ \
+        IF_SELINUX("Z")                  /* 1, 15 */ \
+        "Q"                              /* 1, 16 */ \
+        IF_FEATURE_LS_TIMESTAMPS("ctu")  /* 3, 19 */ \
+        IF_FEATURE_LS_SORTFILES("SXrv")  /* 4, 23 */ \
+        IF_FEATURE_LS_FOLLOWLINKS("LH")  /* 2, 25 */ \
+        IF_FEATURE_HUMAN_READABLE("h")   /* 1, 26 */ \
+        IF_FEATURE_LS_WIDTH("T:w:")      /* 2, 28 */ \
+        IF_LONG_OPTS("\xff")             /* 1, 29 */ \
+        IF_LONG_OPTS("\xfe")             /* 1, 30 */ \
+        IF_LONG_OPTS("\xfd::")           /* 1, 31 */ \
+        "qk"                             /* 2, 33 */
+
+#if ENABLE_LONG_OPTS
+static const char ls_longopts[] ALIGN1 =
+        "full-time\0" No_argument "\xff"
+        "group-directories-first\0" No_argument "\xfe"
+        IF_FEATURE_LS_COLOR("color\0" Optional_argument "\xfd")
+;
+#endif
 
 enum {
         OPT_C = (1 << 0),
@@ -233,29 +262,31 @@ enum {
         OPT_s = (1 << 8),
         OPT_x = (1 << 9),
         OPT_A = (1 << 10),
-        //OPT_k = (1 << 11),
 
-        OPTBIT_F = 12,
-        OPTBIT_p, /* 13 */
+        OPTBIT_F = 11,
+        OPTBIT_p, /* 12 */
         OPTBIT_R = OPTBIT_F + 2 * ENABLE_FEATURE_LS_FILETYPES,
         OPTBIT_Z = OPTBIT_R + 1 * ENABLE_FEATURE_LS_RECURSIVE,
         OPTBIT_Q = OPTBIT_Z + 1 * ENABLE_SELINUX,
-        OPTBIT_c, /* 17 */
-        OPTBIT_t, /* 18 */
-        OPTBIT_u, /* 19 */
+        OPTBIT_c, /* 16 */
+        OPTBIT_t, /* 17 */
+        OPTBIT_u, /* 18 */
         OPTBIT_S = OPTBIT_c + 3 * ENABLE_FEATURE_LS_TIMESTAMPS,
-        OPTBIT_X, /* 21 */
-        OPTBIT_r, /* 22 */
-        OPTBIT_v, /* 23 */
+        OPTBIT_X, /* 20 */
+        OPTBIT_r, /* 21 */
+        OPTBIT_v, /* 22 */
         OPTBIT_L = OPTBIT_S + 4 * ENABLE_FEATURE_LS_SORTFILES,
-        OPTBIT_H, /* 25 */
+        OPTBIT_H, /* 24 */
         OPTBIT_h = OPTBIT_L + 2 * ENABLE_FEATURE_LS_FOLLOWLINKS,
         OPTBIT_T = OPTBIT_h + 1 * ENABLE_FEATURE_HUMAN_READABLE,
-        OPTBIT_w, /* 28 */
+        OPTBIT_w, /* 27 */
         OPTBIT_full_time = OPTBIT_T + 2 * ENABLE_FEATURE_LS_WIDTH,
         OPTBIT_dirs_first,
-        OPTBIT_color, /* 31 */
-        /* with long opts, we use all 32 bits */
+        OPTBIT_color, /* 30 */
+        OPTBIT_q = OPTBIT_color + 1, /* 31 */
+        OPTBIT_k = OPTBIT_q + 1, /* 32 */
+        /* with all options enabled, we use all 32 bits and even one extra bit! */
+        /* this works because -k is ignored, and getopt32 allows such "ignore" options past 31th bit */
 
         OPT_F = (1 << OPTBIT_F) * ENABLE_FEATURE_LS_FILETYPES,
         OPT_p = (1 << OPTBIT_p) * ENABLE_FEATURE_LS_FILETYPES,
@@ -277,6 +308,8 @@ enum {
         OPT_full_time  = (1 << OPTBIT_full_time ) * ENABLE_LONG_OPTS,
         OPT_dirs_first = (1 << OPTBIT_dirs_first) * ENABLE_LONG_OPTS,
         OPT_color      = (1 << OPTBIT_color     ) * ENABLE_FEATURE_LS_COLOR,
+        OPT_q = (1 << OPTBIT_q),
+        //-k is ignored: OPT_k = (1 << OPTBIT_k),
 };
 
 /*
@@ -333,6 +366,7 @@ struct globals {
 #endif
         smallint exit_code;
         smallint show_dirname;
+        smallint tty_out;
 #if ENABLE_FEATURE_LS_WIDTH
         unsigned terminal_width;
 # define G_terminal_width (G.terminal_width)
@@ -353,16 +387,21 @@ struct globals {
         setup_common_bufsiz(); \
         /* we have to zero it out because of NOEXEC */ \
         memset(&G, 0, sizeof(G)); \
-        IF_FEATURE_LS_WIDTH(G_terminal_width = TERMINAL_WIDTH;) \
+        IF_FEATURE_LS_WIDTH(G_terminal_width = ~0U;) \
         IF_FEATURE_LS_TIMESTAMPS(time(&G.current_time_t);) \
 } while (0)
 
 #define ESC "\033"
 
+static int G_isatty(void)
+{
+        if (!G.tty_out) /* not known yet? */
+                G.tty_out = isatty(STDOUT_FILENO) + 1;
+        return (G.tty_out == 2);
+}
 
 /*** Output code ***/
 
-
 /* FYI type values: 1:fifo 2:char 4:dir 6:blk 8:file 10:link 12:socket
  * (various wacky OSes: 13:Sun door 14:BSD whiteout 5:XENIX named file
  *  3/7:multiplexed char/block device)
@@ -425,56 +464,93 @@ static char append_char(mode_t mode)
 }
 #endif
 
+/* Return the number of used columns.
+ * Note that only columnar output uses return value.
+ * -l and -1 modes don't care.
+ * coreutils 7.2 also supports:
+ * ls -b (--escape) = octal escapes (although it doesn't look like working)
+ * ls -N (--literal) = not escape at all
+ */
 static unsigned calc_name_len(const char *name)
 {
         unsigned len;
         uni_stat_t uni_stat;
 
-        // TODO: quote tab as \t, etc, if -Q
-        name = printable_string2(&uni_stat, name);
+        if (!(option_mask32 & (OPT_q|OPT_Q)))
+                return strlen(name);
 
         if (!(option_mask32 & OPT_Q)) {
+                /* the most likely branch: "ls" to tty (it auto-enables -q behavior) */
+                printable_string2(&uni_stat, name);
                 return uni_stat.unicode_width;
         }
 
-        len = 2 + uni_stat.unicode_width;
+        len = 2 + strlen(name);
         while (*name) {
+                unsigned char ch = (unsigned char)*name;
+                if (ch < ' ' || ch > 0x7e) {
+                        ch -= 7;
+                        if (ch <= 6) {
+                                /* quote chars 7..13 as \a,b,t,n,v,f,r */
+                                goto two;
+                        }
+                        /* other chars <32 or >126 as \ooo octal */
+                        len += 3;
+                        goto next;
+                }
                 if (*name == '"' || *name == '\\') {
+ two:
                         len++;
                 }
+ next:
                 name++;
         }
         return len;
 }
-
-/* Return the number of used columns.
- * Note that only columnar output uses return value.
- * -l and -1 modes don't care.
- * coreutils 7.2 also supports:
- * ls -b (--escape) = octal escapes (although it doesn't look like working)
- * ls -N (--literal) = not escape at all
- */
 static unsigned print_name(const char *name)
 {
         unsigned len;
         uni_stat_t uni_stat;
 
-        // TODO: quote tab as \t, etc, if -Q
-        name = printable_string2(&uni_stat, name);
+        if (!(option_mask32 & (OPT_q|OPT_Q))) {
+                fputs_stdout(name);
+                return strlen(name);
+        }
 
         if (!(option_mask32 & OPT_Q)) {
+                /* the most likely branch: "ls" to tty (it auto-enables -q behavior) */
+                name = printable_string2(&uni_stat, name);
                 fputs_stdout(name);
                 return uni_stat.unicode_width;
         }
 
-        len = 2 + uni_stat.unicode_width;
+        len = 2 + strlen(name);
         putchar('"');
         while (*name) {
-                if (*name == '"' || *name == '\\') {
+                unsigned char ch = (unsigned char)*name;
+                if (ch < ' ' || ch > 0x7e) {
+                        putchar('\\');
+                        ch -= 7;
+                        if (ch <= 6) {
+                                /* quote chars 7..13 as \a,b,t,n,v,f,r */
+                                ch = c_escape_conv_str07[1 + 3 * ch];
+                                goto two;
+                        }
+                        /* other chars <32 or >126 as \ooo octal */
+                        ch = (unsigned char)*name;
+                        putchar('0' + (ch>>6));
+                        putchar('0' + ((ch>>3) & 7));
+                        ch = '0' + (ch & 7);
+                        len += 3;
+                        goto put_ch;
+                }
+                if (ch == '"' || ch == '\\') {
                         putchar('\\');
+ two:
                         len++;
                 }
-                putchar(*name);
+ put_ch:
+                putchar(ch);
                 name++;
         }
         putchar('"');
@@ -660,7 +736,7 @@ static void display_files(struct dnode **dn, unsigned nfiles)
         unsigned i, ncols, nrows, row, nc;
         unsigned column;
         unsigned nexttab;
-        unsigned column_width = 0; /* used only by coulmnal output */
+        unsigned column_width = 0; /* used only by columnar output */
 
         if (option_mask32 & (OPT_l|OPT_1)) {
                 ncols = 1;
@@ -709,6 +785,11 @@ static void display_files(struct dnode **dn, unsigned nfiles)
                                 }
                                 nexttab = column + column_width;
                                 column += display_single(dn[i]);
+                        } else {
+                                /* if -w999999999, ncols can be very large */
+                                //bb_error_msg(" col:%u ncol:%u i:%i", nc, ncols, i); sleep1();
+                                /* without "break", we loop millions of times here */
+                                break;
                         }
                 }
                 putchar('\n');
@@ -1155,25 +1236,11 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
         /* need to initialize since --color has _an optional_ argument */
         const char *color_opt = color_str; /* "always" */
 #endif
-#if ENABLE_LONG_OPTS
-        static const char ls_longopts[] ALIGN1 =
-                "full-time\0" No_argument "\xff"
-                "group-directories-first\0" No_argument "\xfe"
-                IF_FEATURE_LS_COLOR("color\0" Optional_argument "\xfd")
-        ;
-#endif
 
         INIT_G();
 
         init_unicode();
 
-#if ENABLE_FEATURE_LS_WIDTH
-        /* obtain the terminal width */
-        G_terminal_width = get_terminal_width(STDIN_FILENO);
-        /* go one less... */
-        G_terminal_width--;
-#endif
-
         /* process options */
         opt = getopt32long(argv, "^"
                 ls_options
@@ -1211,6 +1278,29 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
         exit(0);
 #endif
 
+        /* ftpd secret backdoor? */
+        if (ENABLE_FTPD && applet_name[0] == 'f') {
+                /* dirs first are much nicer */
+                opt = option_mask32 |= OPT_dirs_first;
+                /* don't show SEcontext */
+                IF_SELINUX(opt = option_mask32 &= ~OPT_Z;)
+                /* do not query stdout about size and tty-ness */
+                IF_FEATURE_LS_WIDTH(G_terminal_width = INT_MAX;)
+                G.tty_out = 1; /* not a tty */
+                goto skip_if_ftpd;
+        }
+
+#if ENABLE_FEATURE_LS_WIDTH
+        if ((int)G_terminal_width < 0) {
+                /* obtain the terminal width */
+                G_terminal_width = get_terminal_width(STDIN_FILENO);
+                /* go one less... */
+                G_terminal_width--;
+        }
+        if (G_terminal_width == 0) /* -w0 */
+                G_terminal_width = INT_MAX; /* "infinite" */
+#endif
+
 #if ENABLE_SELINUX
         if (opt & OPT_Z) {
                 if (!is_selinux_enabled())
@@ -1229,7 +1319,7 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
 # endif
                 /* LS_COLORS is unset, or (not empty && not "none") ? */
                 if (!p || (p[0] && strcmp(p, "none") != 0)) {
-                        if (isatty(STDOUT_FILENO)) {
+                        if (G_isatty()) {
                                 /* check isatty() last because it's expensive (syscall) */
                                 G_show_color = 1;
                         }
@@ -1238,23 +1328,28 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
         if (opt & OPT_color) {
                 if (color_opt[0] == 'n')
                         G_show_color = 0;
-                else switch (index_in_substrings(color_str, color_opt)) {
-                case 3:
-                case 4:
-                case 5:
-                        if (!is_TERM_dumb() && isatty(STDOUT_FILENO)) {
-                case 0:
-                case 1:
-                case 2:
-                                G_show_color = 1;
+                else if (!G_show_color) {
+                /* if() is not needed, but avoids extra isatty() if G_show_color is already set */
+                        /* Check --color=COLOR_OPT and maybe set show_color=1 */
+                        switch (index_in_substrings(color_str, color_opt)) {
+                        case 3: // auto
+                        case 4: // tty
+                        case 5: // if-tty
+                                if (!is_TERM_dumb() && G_isatty()) {
+                        case 0: // always
+                        case 1: // yes
+                        case 2: // force
+                                        G_show_color = 1;
+                                }
                         }
                 }
         }
 #endif
+ skip_if_ftpd:
 
         /* sort out which command line options take precedence */
         if (ENABLE_FEATURE_LS_RECURSIVE && (opt & OPT_d))
-                option_mask32 &= ~OPT_R;        /* no recurse if listing only dir */
+                opt = option_mask32 &= ~OPT_R;  /* no recurse if listing only dir */
         if (!(opt & OPT_l)) { /* not -l? */
                 if (ENABLE_FEATURE_LS_TIMESTAMPS && ENABLE_FEATURE_LS_SORTFILES) {
                         /* when to sort by time? -t[cu] sorts by time even with -l */
@@ -1262,19 +1357,17 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
                         /* without -l, bare -c or -u enable sort too */
                         /* (with -l, bare -c or -u just select which time to show) */
                         if (opt & (OPT_c|OPT_u)) {
-                                option_mask32 |= OPT_t;
+                                opt = option_mask32 |= OPT_t;
                         }
                 }
         }
 
         /* choose a display format if one was not already specified by an option */
-        if (!(option_mask32 & (OPT_l|OPT_1|OPT_x|OPT_C)))
-                option_mask32 |= (isatty(STDOUT_FILENO) ? OPT_C : OPT_1);
+        if (!(opt & (OPT_l|OPT_1|OPT_x|OPT_C)))
+                opt = option_mask32 |= (G_isatty() ? OPT_C : OPT_1);
 
-        if (ENABLE_FTPD && applet_name[0] == 'f') {
-                /* ftpd secret backdoor. dirs first are much nicer */
-                option_mask32 |= OPT_dirs_first;
-        }
+        if (!(opt & OPT_q) && G_isatty())
+                opt = option_mask32 |= OPT_q;
 
 #if ENABLE_FEATURE_EXTRA_FILE_DATA
         /* Enable accurate link counts for directories */
diff --git a/coreutils/md5_sha1_sum.c b/coreutils/md5_sha1_sum.c
index 978d328f1..4506aeb56 100644
--- a/coreutils/md5_sha1_sum.c
+++ b/coreutils/md5_sha1_sum.c
@@ -23,6 +23,12 @@
 //config:       help
 //config:       Compute and check SHA256 message digest
 //config:
+//config:config SHA384SUM
+//config:       bool "sha384sum (7.3 kb)"
+//config:       default y
+//config:       help
+//config:       Compute and check SHA384 message digest
+//config:
 //config:config SHA512SUM
 //config:       bool "sha512sum (7.3 kb)"
 //config:       default y
@@ -35,13 +41,13 @@
 //config:       help
 //config:       Compute and check SHA3 message digest
 //config:
-//config:comment "Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum"
-//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
+//config:comment "Common options for md5sum, sha1sum, sha256sum, ..., sha3sum"
+//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA384SUM || SHA512SUM || SHA3SUM
 //config:
 //config:config FEATURE_MD5_SHA1_SUM_CHECK
 //config:       bool "Enable -c, -s and -w options"
 //config:       default y
-//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
+//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA384SUM || SHA512SUM || SHA3SUM
 //config:       help
 //config:       Enabling the -c options allows files to be checked
 //config:       against pre-calculated hash values.
@@ -51,11 +57,13 @@
 //applet:IF_SHA1SUM(APPLET_NOEXEC(sha1sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha1sum))
 //applet:IF_SHA3SUM(APPLET_NOEXEC(sha3sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha3sum))
 //applet:IF_SHA256SUM(APPLET_NOEXEC(sha256sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha256sum))
+//applet:IF_SHA384SUM(APPLET_NOEXEC(sha384sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha384sum))
 //applet:IF_SHA512SUM(APPLET_NOEXEC(sha512sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha512sum))
 
 //kbuild:lib-$(CONFIG_MD5SUM)    += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA1SUM)   += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA256SUM) += md5_sha1_sum.o
+//kbuild:lib-$(CONFIG_SHA384SUM) += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA512SUM) += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA3SUM)   += md5_sha1_sum.o
 
@@ -99,6 +107,16 @@
 //usage:     "\n        -w      Warn about improperly formatted checksum lines"
 //usage:        )
 //usage:
+//usage:#define sha384sum_trivial_usage
+//usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[FILE]..."
+//usage:#define sha384sum_full_usage "\n\n"
+//usage:       "Print" IF_FEATURE_MD5_SHA1_SUM_CHECK(" or check") " SHA384 checksums"
+//usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK( "\n"
+//usage:     "\n        -c      Check sums against list in FILEs"
+//usage:     "\n        -s      Don't output anything, status code shows success"
+//usage:     "\n        -w      Warn about improperly formatted checksum lines"
+//usage:        )
+//usage:
 //usage:#define sha512sum_trivial_usage
 //usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[FILE]..."
 //usage:#define sha512sum_full_usage "\n\n"
@@ -130,11 +148,12 @@
 
 enum {
         /* 4th letter of applet_name is... */
-        HASH_MD5 = 's', /* "md5>s<um" */
-        HASH_SHA1 = '1',
+        HASH_MD5    = 's', /* "md5>s<um" */
+        HASH_SHA1   = '1',
         HASH_SHA256 = '2',
-        HASH_SHA3 = '3',
+        HASH_SHA3   = '3',
         HASH_SHA512 = '5',
+        /* unfortunately, sha384sum has the same '3' as sha3 */
 };
 
 #define FLAG_SILENT  1
@@ -158,10 +177,11 @@ static unsigned char *hash_bin_to_hex(unsigned char *hash_value,
 #endif
 static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned sha3_width)
 {
-        int src_fd, hash_len, count;
+        int src_fd, count;
         union _ctx_ {
                 sha3_ctx_t sha3;
                 sha512_ctx_t sha512;
+                sha384_ctx_t sha384;
                 sha256_ctx_t sha256;
                 sha1_ctx_t sha1;
                 md5_ctx_t md5;
@@ -183,25 +203,31 @@ static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned
                 md5_begin(&context.md5);
                 update = (void*)md5_hash;
                 final = (void*)md5_end;
-                hash_len = 16;
         }
         else if (ENABLE_SHA1SUM && hash_algo == HASH_SHA1) {
                 sha1_begin(&context.sha1);
                 update = (void*)sha1_hash;
                 final = (void*)sha1_end;
-                hash_len = 20;
         }
         else if (ENABLE_SHA256SUM && hash_algo == HASH_SHA256) {
                 sha256_begin(&context.sha256);
                 update = (void*)sha256_hash;
                 final = (void*)sha256_end;
-                hash_len = 32;
+        }
+        else if (ENABLE_SHA384SUM
+         && (ENABLE_SHA3SUM
+                ? (applet_name[4] == '8') /* check for "sha384", but do not match "sha3" */
+                : (hash_algo == '3') /* applet_name = "sha3sum" is not possible */
+                )
+        ) {
+                sha384_begin(&context.sha384);
+                update = (void*)sha384_hash;
+                final = (void*)sha384_end;
         }
         else if (ENABLE_SHA512SUM && hash_algo == HASH_SHA512) {
                 sha512_begin(&context.sha512);
                 update = (void*)sha512_hash;
                 final = (void*)sha512_end;
-                hash_len = 64;
         }
 #if ENABLE_SHA3SUM
         else if (ENABLE_SHA3SUM && hash_algo == HASH_SHA3) {
@@ -219,9 +245,7 @@ static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned
                 ) {
                         bb_error_msg_and_die("bad -a%u", sha3_width);
                 }
-                sha3_width /= 4;
-                context.sha3.input_block_bytes = 1600/8 - sha3_width;
-                hash_len = sha3_width/2;
+                context.sha3.input_block_bytes = 1600/8 - sha3_width/4;
         }
 #endif
         else {
@@ -236,7 +260,7 @@ static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned
                 if (count < 0)
                         bb_perror_msg("can't read '%s'", filename);
                 else /* count == 0 */ {
-                        final(&context, in_buf);
+                        unsigned hash_len = final(&context, in_buf);
                         hash_value = hash_bin_to_hex(in_buf, hash_len);
                 }
         }
@@ -262,14 +286,14 @@ int md5_sha1_sum_main(int argc UNUSED_PARAM, char **argv)
                 /* -b "binary", -t "text" are ignored (shaNNNsum compat) */
                 /* -s and -w require -c */
 #if ENABLE_SHA3SUM
-                if (applet_name[3] == HASH_SHA3)
+                if (applet_name[3] == HASH_SHA3 && (!ENABLE_SHA384SUM || applet_name[4] != '8'))
                         flags = getopt32(argv, "^" "scwbta:+" "\0" "s?c:w?c", &sha3_width);
                 else
 #endif
                         flags = getopt32(argv, "^" "scwbt" "\0" "s?c:w?c");
         } else {
 #if ENABLE_SHA3SUM
-                if (applet_name[3] == HASH_SHA3)
+                if (applet_name[3] == HASH_SHA3 && (!ENABLE_SHA384SUM || applet_name[4] != '8'))
                         getopt32(argv, "a:+", &sha3_width);
                 else
 #endif
diff --git a/coreutils/paste.c b/coreutils/paste.c
index 3e5f20158..78a5c2a14 100644
--- a/coreutils/paste.c
+++ b/coreutils/paste.c
@@ -34,15 +34,46 @@
 
 static void paste_files(FILE** files, int file_cnt, char* delims, int del_cnt)
 {
+#if ENABLE_PLATFORM_MINGW32
+        char **line = xmalloc(file_cnt * sizeof(char *));
+#else
         char *line;
+#endif
         char delim;
         int active_files = file_cnt;
         int i;
 
         while (active_files > 0) {
                 int del_idx = 0;
+#if ENABLE_PLATFORM_MINGW32
+                int got_line = FALSE;
+#endif
 
                 for (i = 0; i < file_cnt; ++i) {
+#if ENABLE_PLATFORM_MINGW32
+                        if (files[i]) {
+                                line[i] = xmalloc_fgetline(files[i]);
+                                if (!line[i]) {
+                                        fclose_if_not_stdin(files[i]);
+                                        files[i] = NULL;
+                                        --active_files;
+                                } else {
+                                        got_line = TRUE;
+                                }
+                        } else {
+                                line[i] = NULL;
+                        }
+                }
+
+                if (!got_line)
+                        break;
+
+                for (i = 0; i < file_cnt; ++i) {
+                        if (line[i]) {
+                                fputs_stdout(line[i]);
+                                free(line[i]);
+                        }
+#else
                         if (files[i] == NULL)
                                 continue;
 
@@ -55,6 +86,7 @@ static void paste_files(FILE** files, int file_cnt, char* delims, int del_cnt)
                         }
                         fputs_stdout(line);
                         free(line);
+#endif
                         delim = '\n';
                         if (i != file_cnt - 1) {
                                 delim = delims[del_idx++];
@@ -65,6 +97,9 @@ static void paste_files(FILE** files, int file_cnt, char* delims, int del_cnt)
                                 fputc(delim, stdout);
                 }
         }
+#if ENABLE_PLATFORM_MINGW32
+        free(line);
+#endif
 }
 
 static void paste_files_separate(FILE** files, char* delims, int del_cnt)
diff --git a/coreutils/stty.c b/coreutils/stty.c
index c88ef07f4..c064ad90a 100644
--- a/coreutils/stty.c
+++ b/coreutils/stty.c
@@ -20,14 +20,29 @@
 //kbuild:lib-$(CONFIG_STTY) += stty.o
 
 //usage:#define stty_trivial_usage
+//usage:     IF_NOT_PLATFORM_MINGW32(
 //usage:       "[-a|g] [-F DEVICE] [SETTING]..."
+//usage:     )
+//usage:     IF_PLATFORM_MINGW32(
+//usage:       "[-a] [SETTING]..."
+//usage:     )
 //usage:#define stty_full_usage "\n\n"
+//usage:     IF_NOT_PLATFORM_MINGW32(
 //usage:       "Without arguments, prints baud rate, line discipline,\n"
 //usage:       "and deviations from stty sane\n"
 //usage:     "\n        -F DEVICE       Open device instead of stdin"
+//usage:     )
+//usage:     IF_PLATFORM_MINGW32(
+//usage:       "Without arguments, prints deviations from stty sane\n"
+//usage:     )
 //usage:     "\n        -a              Print all current settings in human-readable form"
+//usage:     IF_NOT_PLATFORM_MINGW32(
 //usage:     "\n        -g              Print in stty-readable form"
 //usage:     "\n        [SETTING]       See manpage"
+//usage:     )
+//usage:     IF_PLATFORM_MINGW32(
+//usage:     "\n        [SETTING]       [-]echo [-]cooked [-]raw sane size"
+//usage:     )
 
 /* If no args are given, write to stdout the baud rate and settings that
  * have been changed from their defaults.  Mode reading and changes
@@ -294,6 +309,7 @@ struct mode_info {
         const tcflag_t bits;          /* Bits to set for this mode            */
 };
 
+#if !ENABLE_PLATFORM_MINGW32
 enum {
         /* Must match mode_name[] and mode_info[] order! */
         IDX_evenp = 0,
@@ -320,19 +336,30 @@ enum {
         IDX_LCASE,
 #endif
 };
+#else
+enum {
+        /* Must match mode_name[] and mode_info[] order! */
+        IDX_sane = 0,
+        IDX_cooked,
+        IDX_raw,
+};
+#endif
 
 #define MI_ENTRY(N,T,F,B,M) N "\0"
 
 /* Mode names given on command line */
 static const char mode_name[] ALIGN1 =
+#if !ENABLE_PLATFORM_MINGW32
         MI_ENTRY("evenp",    combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("parity",   combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("oddp",     combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("nl",       combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("ek",       combination, OMIT,              0,          0 )
+#endif
         MI_ENTRY("sane",     combination, OMIT,              0,          0 )
         MI_ENTRY("cooked",   combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("raw",      combination, REV        | OMIT, 0,          0 )
+#if !ENABLE_PLATFORM_MINGW32
         MI_ENTRY("pass8",    combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("litout",   combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("cbreak",   combination, REV        | OMIT, 0,          0 )
@@ -454,7 +481,9 @@ static const char mode_name[] ALIGN1 =
 #if IEXTEN
         MI_ENTRY("iexten",   local,       SANE_SET   | REV,  IEXTEN,     0 )
 #endif
+#endif /* !ENABLE_PLATFORM_MINGW32 */
         MI_ENTRY("echo",     local,       SANE_SET   | REV,  ECHO,       0 )
+#if !ENABLE_PLATFORM_MINGW32
         MI_ENTRY("echoe",    local,       SANE_SET   | REV,  ECHOE,      0 )
         MI_ENTRY("crterase", local,       OMIT       | REV,  ECHOE,      0 )
         MI_ENTRY("echok",    local,       SANE_SET   | REV,  ECHOK,      0 )
@@ -482,6 +511,7 @@ static const char mode_name[] ALIGN1 =
 #ifdef EXTPROC
         MI_ENTRY("extproc",  local,       SANE_UNSET | REV,  EXTPROC,    0 )
 #endif
+#endif /* !ENABLE_PLATFORM_MINGW32 */
         ;
 
 #undef MI_ENTRY
@@ -489,14 +519,17 @@ static const char mode_name[] ALIGN1 =
 
 static const struct mode_info mode_info[] ALIGN4 = {
         /* This should be verbatim cut-n-paste copy of the above MI_ENTRYs */
+#if !ENABLE_PLATFORM_MINGW32
         MI_ENTRY("evenp",    combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("parity",   combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("oddp",     combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("nl",       combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("ek",       combination, OMIT,              0,          0 )
+#endif
         MI_ENTRY("sane",     combination, OMIT,              0,          0 )
         MI_ENTRY("cooked",   combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("raw",      combination, REV        | OMIT, 0,          0 )
+#if !ENABLE_PLATFORM_MINGW32
         MI_ENTRY("pass8",    combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("litout",   combination, REV        | OMIT, 0,          0 )
         MI_ENTRY("cbreak",   combination, REV        | OMIT, 0,          0 )
@@ -618,7 +651,9 @@ static const struct mode_info mode_info[] ALIGN4 = {
 #if IEXTEN
         MI_ENTRY("iexten",   local,       SANE_SET   | REV,  IEXTEN,     0 )
 #endif
+#endif /* !ENABLE_PLATFORM_MINGW32 */
         MI_ENTRY("echo",     local,       SANE_SET   | REV,  ECHO,       0 )
+#if !ENABLE_PLATFORM_MINGW32
         MI_ENTRY("echoe",    local,       SANE_SET   | REV,  ECHOE,      0 )
         MI_ENTRY("crterase", local,       OMIT       | REV,  ECHOE,      0 )
         MI_ENTRY("echok",    local,       SANE_SET   | REV,  ECHOK,      0 )
@@ -646,6 +681,7 @@ static const struct mode_info mode_info[] ALIGN4 = {
 #ifdef EXTPROC
         MI_ENTRY("extproc",  local,       SANE_UNSET | REV,  EXTPROC,    0 )
 #endif
+#endif /* !ENABLE_PLATFORM_MINGW32 */
 };
 
 enum {
@@ -653,6 +689,7 @@ enum {
 };
 
 
+#if !ENABLE_PLATFORM_MINGW32
 /* Control characters */
 struct control_info {
         const uint8_t saneval;  /* Value to set for 'stty sane' */
@@ -786,6 +823,7 @@ static const struct control_info control_info[] ALIGN2 = {
 enum {
         NUM_control_info = ARRAY_SIZE(control_info)
 };
+#endif
 
 
 struct globals {
@@ -803,6 +841,7 @@ struct globals {
         G.current_col = 0; /* we are noexec, must clear */ \
 } while (0)
 
+#if !ENABLE_PLATFORM_MINGW32
 static void set_speed_or_die(enum speed_setting type, const char *arg,
                                         struct termios *mode)
 {
@@ -817,6 +856,7 @@ static void set_speed_or_die(enum speed_setting type, const char *arg,
                 cfsetospeed(mode, baud);
         }
 }
+#endif
 
 static NORETURN void perror_on_device_and_die(const char *fmt)
 {
@@ -867,6 +907,7 @@ static void newline(void)
                 wrapf("\n");
 }
 
+#if !ENABLE_PLATFORM_MINGW32
 #ifdef TIOCGWINSZ
 static void set_window_size(int rows, int cols)
 {
@@ -889,6 +930,7 @@ bail:
                 perror_on_device("%s");
 }
 #endif
+#endif
 
 static void display_window_size(int fancy)
 {
@@ -918,6 +960,7 @@ static const struct mode_info *find_mode(const char *name)
         return i >= 0 ? &mode_info[i] : NULL;
 }
 
+#if !ENABLE_PLATFORM_MINGW32
 static const struct control_info *find_control(const char *name)
 {
         int i = index_in_strings(control_name, name);
@@ -954,7 +997,32 @@ static int find_param(const char *name)
                 i |= 0x80;
         return i;
 }
+#else
+enum {
+        param_need_arg = 0x80,
+        param_rows    = 1 | 0x80,
+        param_cols    = 2 | 0x80,
+        param_columns = 3 | 0x80,
+        param_size    = 4,
+};
+
+static int find_param(const char *name)
+{
+        static const char params[] ALIGN1 =
+                "rows\0"    /* 1 */
+                "cols\0"    /* 2 */
+                "columns\0" /* 3 */
+                "size\0";    /* 4 */
+        int i = index_in_strings(params, name) + 1;
+        if (i == 0)
+                return 0;
+        if (i != 4)
+                i |= 0x80;
+        return i;
+}
+#endif
 
+#if !ENABLE_PLATFORM_MINGW32
 static int recover_mode(const char *arg, struct termios *mode)
 {
         int i, n;
@@ -1013,6 +1081,9 @@ static void display_speed(const struct termios *mode, int fancy)
         if (fancy) fmt_str += 9;
         wrapf(fmt_str, tty_baud_to_value(ispeed), tty_baud_to_value(ospeed));
 }
+#else
+# define display_speed(m, f) ((void)0)
+#endif
 
 static void do_display(const struct termios *mode, int all)
 {
@@ -1030,6 +1101,7 @@ static void do_display(const struct termios *mode, int all)
         newline();
 #endif
 
+#if !ENABLE_PLATFORM_MINGW32
         for (i = 0; i != CIDX_min; ++i) {
                 char ch;
                 char buf10[10];
@@ -1059,6 +1131,7 @@ static void do_display(const struct termios *mode, int all)
 #endif
                 wrapf("min = %u; time = %u;", mode->c_cc[VMIN], mode->c_cc[VTIME]);
         newline();
+#endif
 
         for (i = 0; i < NUM_mode_info; ++i) {
                 if (mode_info[i].flags & OMIT)
@@ -1086,6 +1159,7 @@ static void do_display(const struct termios *mode, int all)
 
 static void sane_mode(struct termios *mode)
 {
+#if !ENABLE_PLATFORM_MINGW32
         int i;
 
         for (i = 0; i < NUM_control_info; ++i) {
@@ -1110,6 +1184,11 @@ static void sane_mode(struct termios *mode)
                         *bitsp = val & ~mode_info[i].bits;
                 }
         }
+#else
+        mode->c_lflag |= ECHO;
+        mode->w_mode |= ENABLE_ECHO_INPUT | ENABLE_LINE_INPUT |
+                                        ENABLE_PROCESSED_INPUT;
+#endif
 }
 
 static void set_mode(const struct mode_info *info, int reversed,
@@ -1129,6 +1208,7 @@ static void set_mode(const struct mode_info *info, int reversed,
         }
 
         /* !bitsp - it's a "combination" mode */
+#if !ENABLE_PLATFORM_MINGW32
         if (info == &mode_info[IDX_evenp] || info == &mode_info[IDX_parity]) {
                 if (reversed)
                         mode->c_cflag = (mode->c_cflag & ~PARENB & ~CSIZE) | CS8;
@@ -1150,9 +1230,14 @@ static void set_mode(const struct mode_info *info, int reversed,
         } else if (info == &mode_info[IDX_ek]) {
                 mode->c_cc[VERASE] = CERASE;
                 mode->c_cc[VKILL] = CKILL;
-        } else if (info == &mode_info[IDX_sane]) {
+        }
+        else
+#endif /* !ENABLE_PLATFORM_MINGW32 */
+        if (info == &mode_info[IDX_sane]) {
                 sane_mode(mode);
-        } else if (info == &mode_info[IDX_cbreak]) {
+        }
+#if !ENABLE_PLATFORM_MINGW32
+        else if (info == &mode_info[IDX_cbreak]) {
                 if (reversed)
                         mode->c_lflag |= ICANON;
                 else
@@ -1175,11 +1260,14 @@ static void set_mode(const struct mode_info *info, int reversed,
                         mode->c_iflag &= ~ISTRIP;
                         mode->c_oflag &= ~OPOST;
                 }
-        } else if (info == &mode_info[IDX_raw] || info == &mode_info[IDX_cooked]) {
+        }
+#endif /* !ENABLE_PLATFORM_MINGW32 */
+        else if (info == &mode_info[IDX_raw] || info == &mode_info[IDX_cooked]) {
                 if ((info == &mode_info[IDX_raw] && reversed)
                  || (info == &mode_info[IDX_cooked] && !reversed)
                 ) {
                         /* Cooked mode */
+#if !ENABLE_PLATFORM_MINGW32
                         mode->c_iflag |= BRKINT | IGNPAR | ISTRIP | ICRNL | IXON;
                         mode->c_oflag |= OPOST;
                         mode->c_lflag |= ISIG | ICANON;
@@ -1189,15 +1277,23 @@ static void set_mode(const struct mode_info *info, int reversed,
 #if VTIME == VEOL
                         mode->c_cc[VEOL] = CEOL;
 #endif
+#else
+                        mode->w_mode |= ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT;
+#endif
                 } else {
                         /* Raw mode */
+#if !ENABLE_PLATFORM_MINGW32
                         mode->c_iflag = 0;
                         mode->c_oflag &= ~OPOST;
                         mode->c_lflag &= ~(ISIG | ICANON | XCASE);
                         mode->c_cc[VMIN] = 1;
                         mode->c_cc[VTIME] = 0;
+#else
+                        mode->w_mode &= ~(ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT);
+#endif
                 }
         }
+#if !ENABLE_PLATFORM_MINGW32
 #if IXANY
         else if (info == &mode_info[IDX_decctlq]) {
                 if (reversed)
@@ -1244,8 +1340,10 @@ static void set_mode(const struct mode_info *info, int reversed,
                 mode->c_lflag |= ECHOE | ECHOCTL | ECHOKE;
                 if (IXANY) mode->c_iflag &= ~IXANY;
         }
+#endif /*!ENABLE_PLATFORM_MINGW32 */
 }
 
+#if !ENABLE_PLATFORM_MINGW32
 static void set_control_char_or_die(const struct control_info *info,
                         const char *arg, struct termios *mode)
 {
@@ -1265,6 +1363,7 @@ static void set_control_char_or_die(const struct control_info *info,
                 value = xatoul_range_sfx(arg, 0, 0xff, stty_suffixes);
         mode->c_cc[info->offset] = value;
 }
+#endif
 
 #define STTY_require_set_attr   (1 << 0)
 #define STTY_speed_was_set      (1 << 1)
@@ -1277,7 +1376,9 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
 {
         struct termios mode;
         void (*output_func)(const struct termios *, int);
+#if !ENABLE_PLATFORM_MINGW32
         const char *file_name = NULL;
+#endif
         int display_all = 0;
         int stty_state;
         int k;
@@ -1291,7 +1392,9 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
         k = 0;
         while (argv[++k]) {
                 const struct mode_info *mp;
+#if !ENABLE_PLATFORM_MINGW32
                 const struct control_info *cp;
+#endif
                 const char *arg = argv[k];
                 const char *argnext = argv[k+1];
                 int param;
@@ -1314,6 +1417,7 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                                         output_func = do_display;
                                         display_all = 1;
                                         break;
+#if !ENABLE_PLATFORM_MINGW32
                                 case 'g':
                                         stty_state |= STTY_recoverable_output;
                                         output_func = display_recoverable;
@@ -1334,11 +1438,14 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                                                 }
                                         }
                                         goto end_option;
+#endif
                                 default:
                                         goto invalid_argument;
                                 }
                         }
+#if !ENABLE_PLATFORM_MINGW32
  end_option:
+#endif
                         continue;
                 }
 
@@ -1348,6 +1455,7 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         continue;
                 }
 
+#if !ENABLE_PLATFORM_MINGW32
                 cp = find_control(arg);
                 if (cp) {
                         if (!argnext)
@@ -1358,13 +1466,16 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         ++k;
                         continue;
                 }
+#endif
 
                 param = find_param(arg);
+#if !ENABLE_PLATFORM_MINGW32
                 if (param & param_need_arg) {
                         if (!argnext)
                                 bb_error_msg_and_die(bb_msg_requires_arg, arg);
                         ++k;
                 }
+#endif
 
                 switch (param) {
 #ifdef __linux__
@@ -1381,7 +1492,11 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         xatoul_range_sfx(argnext, 1, INT_MAX, stty_suffixes);
                         break;
                 case param_size:
+# if ENABLE_PLATFORM_MINGW32
+                        break;
+# endif
 #endif
+#if !ENABLE_PLATFORM_MINGW32
                 case param_speed:
                         break;
                 case param_ispeed:
@@ -1392,15 +1507,19 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         /* called for the side effect of xfunc death only */
                         set_speed_or_die(output_speed, argnext, &mode);
                         break;
+#endif
                 default:
+#if !ENABLE_PLATFORM_MINGW32
                         if (recover_mode(arg, &mode) == 1) break;
                         if (tty_value_to_baud(xatou(arg)) != (speed_t) -1) break;
+#endif
  invalid_argument:
                         bb_error_msg_and_die("invalid argument '%s'", arg);
                 }
                 stty_state &= ~STTY_noargs;
         }
 
+#if !ENABLE_PLATFORM_MINGW32
         /* Specifying both -a and -g is an error */
         if ((stty_state & (STTY_verbose_output | STTY_recoverable_output)) ==
                 (STTY_verbose_output | STTY_recoverable_output)
@@ -1413,13 +1532,22 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
         ) {
                 bb_simple_error_msg_and_die("modes may not be set when -a or -g is used");
         }
+#else
+        /* Specifying -a with non-options is an error */
+        if ((stty_state & STTY_verbose_output) && !(stty_state & STTY_noargs)
+        ) {
+                bb_simple_error_msg_and_die("modes may not be set when -a is used");
+        }
+#endif
 
+#if !ENABLE_PLATFORM_MINGW32
         /* Now it is safe to start doing things */
         if (file_name) {
                 G.device_name = file_name;
                 xmove_fd(xopen_nonblocking(G.device_name), STDIN_FILENO);
                 ndelay_off(STDIN_FILENO);
         }
+#endif
 
         /* Initialize to all zeroes so there is no risk memcmp will report a
            spurious difference in an uninitialized portion of the structure */
@@ -1437,9 +1565,13 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
         k = 0;
         while (argv[++k]) {
                 const struct mode_info *mp;
+#if !ENABLE_PLATFORM_MINGW32
                 const struct control_info *cp;
+#endif
                 const char *arg = argv[k];
+#if !ENABLE_PLATFORM_MINGW32
                 const char *argnext = argv[k+1];
+#endif
                 int param;
 
                 if (arg[0] == '-') {
@@ -1459,6 +1591,7 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         continue;
                 }
 
+#if !ENABLE_PLATFORM_MINGW32
                 cp = find_control(arg);
                 if (cp) {
                         ++k;
@@ -1466,6 +1599,7 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         stty_state |= STTY_require_set_attr;
                         continue;
                 }
+#endif
 
                 param = find_param(arg);
                 if (param & param_need_arg) {
@@ -1479,6 +1613,7 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                         stty_state |= STTY_require_set_attr;
                         break;
 #endif
+#if !ENABLE_PLATFORM_MINGW32
 #ifdef TIOCGWINSZ
                 case param_cols:
                 case param_columns:
@@ -1510,15 +1645,24 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
                                 stty_state |= (STTY_require_set_attr | STTY_speed_was_set);
                         } /* else - impossible (caught in the first pass):
                                 bb_error_msg_and_die("invalid argument '%s'", arg); */
+#endif
                 }
         }
 
         if (stty_state & STTY_require_set_attr) {
+#if !ENABLE_PLATFORM_MINGW32
                 struct termios new_mode;
+#else
+                if (mode.c_lflag & ECHO)
+                        mode.w_mode |= ENABLE_ECHO_INPUT;
+                else
+                        mode.w_mode &= ~ENABLE_ECHO_INPUT;
+#endif
 
                 if (tcsetattr(STDIN_FILENO, TCSADRAIN, &mode))
                         perror_on_device_and_die("%s");
 
+#if !ENABLE_PLATFORM_MINGW32
                 /* POSIX (according to Zlotnick's book) tcsetattr returns zero if
                    it performs *any* of the requested operations.  This means it
                    can report 'success' when it has actually failed to perform
@@ -1554,6 +1698,7 @@ int stty_main(int argc UNUSED_PARAM, char **argv)
 #endif
                                 perror_on_device_and_die("%s: cannot perform all requested operations");
                 }
+#endif
         }
 
         return EXIT_SUCCESS;
diff --git a/coreutils/tr.c b/coreutils/tr.c
index 8d779d8ea..f51c4caea 100644
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@@ -117,6 +117,13 @@ static unsigned expand(char *arg, char **buffer_p)
                         arg++;
                         z = arg;
                         ac = bb_process_escape_sequence(&z);
+#if ENABLE_PLATFORM_MINGW32
+                        if (ac == '\\' && *z == '-') {
+                                /* An escaped dash isn't a range, don't fall through */
+                                buffer[pos++] = *z;
+                                continue;
+                        }
+#endif
                         arg = (char *)z;
                         arg--;
                         *arg = ac;
diff --git a/coreutils/truncate.c b/coreutils/truncate.c
index 8826e6b4c..87a47bb09 100644
--- a/coreutils/truncate.c
+++ b/coreutils/truncate.c
@@ -73,6 +73,12 @@ int truncate_main(int argc UNUSED_PARAM, char **argv)
                          * do not report error, exitcode is also 0.
                          */
                 } else {
+#if ENABLE_PLATFORM_MINGW32
+                        struct stat st;
+
+                        if (fstat(fd, &st) == 0 && size > st.st_size)
+                                make_sparse(fd, st.st_size, size);
+#endif
                         if (ftruncate(fd, size) == -1) {
                                 bb_perror_msg("%s: truncate", *argv);
                                 ret = EXIT_FAILURE;
diff --git a/debianutils/which.c b/debianutils/which.c
index 5d564e01d..0e0e97055 100644
--- a/debianutils/which.c
+++ b/debianutils/which.c
@@ -15,8 +15,12 @@
 // NOTE: For WIN32 this applet is NOEXEC as file_is_win32_exe() and
 //       find_executable() both allocate memory.
 
-//applet:IF_PLATFORM_MINGW32(IF_WHICH(APPLET_NOEXEC(which, which, BB_DIR_USR_BIN, BB_SUID_DROP, which)))
-//applet:IF_PLATFORM_POSIX(IF_WHICH(APPLET_NOFORK(which, which, BB_DIR_USR_BIN, BB_SUID_DROP, which)))
+//applet:IF_PLATFORM_MINGW32(
+//applet:IF_WHICH(APPLET_NOEXEC(which, which, BB_DIR_USR_BIN, BB_SUID_DROP, which))
+//applet:)
+//applet:IF_PLATFORM_POSIX(
+//applet:IF_WHICH(APPLET_NOFORK(which, which, BB_DIR_USR_BIN, BB_SUID_DROP, which))
+//applet:)
 
 //kbuild:lib-$(CONFIG_WHICH) += which.o
 
diff --git a/e2fsprogs/fsck.c b/e2fsprogs/fsck.c
index fd4ea737c..f7e93497d 100644
--- a/e2fsprogs/fsck.c
+++ b/e2fsprogs/fsck.c
@@ -423,13 +423,11 @@ static int wait_one(int flags)
         /* if (G.noexecute) { already returned -1; } */
 
         while (1) {
-                pid = waitpid(-1, &status, flags);
+                pid = safe_waitpid(-1, &status, flags);
                 kill_all_if_got_signal();
                 if (pid == 0) /* flags == WNOHANG and no children exited */
                         return -1;
                 if (pid < 0) {
-                        if (errno == EINTR)
-                                continue;
                         if (errno == ECHILD) { /* paranoia */
                                 bb_simple_error_msg("wait: no more children");
                                 return -1;
diff --git a/editors/diff.c b/editors/diff.c
index b324feaa5..8911859cd 100644
--- a/editors/diff.c
+++ b/editors/diff.c
@@ -773,7 +773,7 @@ static int diffreg(char *file[2])
                         fd = fd_tmp;
                         xlseek(fd, 0, SEEK_SET);
                 }
-                fp[i] = fdopen(fd, "r");
+                fp[i] = xfdopen_for_read(fd);
         }
 
         setup_common_bufsiz();
diff --git a/editors/sed.c b/editors/sed.c
index 107e664a0..204417108 100644
--- a/editors/sed.c
+++ b/editors/sed.c
@@ -257,7 +257,12 @@ static FILE *sed_xfopen_w(const char *fname)
 
 static void cleanup_outname(void)
 {
-        if (G.outname) unlink(G.outname);
+        if (G.outname) {
+#if ENABLE_PLATFORM_MINGW32
+                fclose(G.nonstdout);
+#endif
+                unlink(G.outname);
+        }
 }
 
 /* strcpy, replacing "\from" with 'to'. If to is NUL, replacing "\any" with 'any' */
diff --git a/editors/vi.c b/editors/vi.c
index e59083ddb..7ec3427f9 100644
--- a/editors/vi.c
+++ b/editors/vi.c
@@ -3108,6 +3108,10 @@ static void colon(char *buf)
         else if (cmd[0] == '!') {       // run a cmd
                 int retcode;
                 // :!ls   run the <cmd>
+                if (GOT_ADDRESS) {
+                        status_line_bold("Range not allowed");
+                        goto ret;
+                }
                 exp = expand_args(buf + 1);
                 if (exp == NULL)
                         goto ret;
diff --git a/findutils/xargs.c b/findutils/xargs.c
index f0abf1a23..83af75521 100644
--- a/findutils/xargs.c
+++ b/findutils/xargs.c
@@ -846,11 +846,11 @@ int xargs_main(int argc UNUSED_PARAM, char **argv)
          * arguments, but not if the command is a NOFORK applet.  If the rules
          * to detect this situation change xargs_exec() above will also need
          * to be updated. */
-# if ENABLE_FEATURE_XARGS_SUPPORT_PARALLEL
+# if ENABLE_FEATURE_PREFER_APPLETS && (NUM_APPLETS > 1)
+#  if ENABLE_FEATURE_XARGS_SUPPORT_PARALLEL
         if (G.max_procs == 1)
-# endif
+#  endif
         {
-# if ENABLE_FEATURE_PREFER_APPLETS && (NUM_APPLETS > 1)
                 int applet = find_applet_by_name(argv[0]);
                 if (applet >= 0 && APPLET_IS_NOFORK(applet)) {
                         quote = FALSE;
diff --git a/include/libbb.h b/include/libbb.h
index bc1453e12..09ebad1f6 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -281,6 +281,26 @@ PUSH_AND_SET_FUNCTION_VISIBILITY_TO_HIDDEN
 # endif
 #endif
 
+#if ENABLE_FEATURE_TLS_SCHANNEL || ENABLE_FEATURE_USE_CNG_API
+# define SECURITY_WIN32
+# include <windows.h>
+# include <security.h>
+#endif
+
+#if ENABLE_FEATURE_USE_CNG_API
+# include <bcrypt.h>
+
+// these work on Windows >= 10
+# define BCRYPT_HMAC_SHA1_ALG_HANDLE   ((BCRYPT_ALG_HANDLE) 0x000000a1)
+# define BCRYPT_HMAC_SHA256_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x000000b1)
+# define sha1_begin_hmac BCRYPT_HMAC_SHA1_ALG_HANDLE
+# define sha256_begin_hmac BCRYPT_HMAC_SHA256_ALG_HANDLE
+#else
+# define sha1_begin_hmac sha1_begin
+# define sha256_begin_hmac sha256_begin
+# define hmac_uninit(...) ((void)0)
+#endif
+
 /* Tested to work correctly with all int types (IIRC :]) */
 #define MAXINT(T) (T)( \
         ((T)-1) > 0 \
@@ -322,6 +342,7 @@ PUSH_AND_SET_FUNCTION_VISIBILITY_TO_HIDDEN
 /* "long" is long enough on this system */
 typedef unsigned long uoff_t;
 #  define XATOOFF(a) xatoul_range((a), 0, LONG_MAX)
+#  define XATOOFF_SFX(a, s) xatoul_range_sfx((a), 0, LONG_MAX, s)
 /* usage: sz = BB_STRTOOFF(s, NULL, 10); if (errno || sz < 0) die(); */
 #  define BB_STRTOOFF bb_strtoul
 #  define STRTOOFF strtoul
@@ -331,6 +352,7 @@ typedef unsigned long uoff_t;
 /* "long" is too short, need "long long" */
 typedef unsigned long long uoff_t;
 #  define XATOOFF(a) xatoull_range((a), 0, LLONG_MAX)
+#  define XATOOFF_SFX(a, s) xatoull_range_sfx((a), 0, LLONG_MAX, s)
 #  define BB_STRTOOFF bb_strtoull
 #  define STRTOOFF strtoull
 #  define OFF_FMT LL_FMT
@@ -346,12 +368,14 @@ typedef unsigned long long uoff_t;
 # if UINT_MAX == ULONG_MAX
 typedef unsigned long uoff_t;
 #  define XATOOFF(a) xatoi_positive(a)
+#  define XATOOFF_SFX(a, s) xatoul_range_sfx((a), 0, INT_MAX, s)
 #  define BB_STRTOOFF bb_strtou
 #  define STRTOOFF strtol
 #  define OFF_FMT "l"
 # else
 typedef unsigned long uoff_t;
 #  define XATOOFF(a) xatoul_range((a), 0, LONG_MAX)
+#  define XATOOFF_SFX(a, s) xatoul_range_sfx((a), 0, LONG_MAX, s)
 #  define BB_STRTOOFF bb_strtoul
 #  define STRTOOFF strtol
 #  define OFF_FMT "l"
@@ -699,6 +723,8 @@ int sigaction_set(int sig, const struct sigaction *act) FAST_FUNC;
 int sigprocmask_allsigs(int how) FAST_FUNC;
 /* Return old set in the same set: */
 int sigprocmask2(int how, sigset_t *set) FAST_FUNC;
+/* SIG_BLOCK all signals, return old set: */
+int sigblockall(sigset_t *set) FAST_FUNC;
 #else
 #define bb_signals(s, f)
 #define kill_myself_with_sig(s)
@@ -899,7 +925,36 @@ struct hostent *xgethostbyname(const char *name) FAST_FUNC;
 // Also mount.c and inetd.c are using gethostbyname(),
 // + inet_common.c has additional IPv4-only stuff
 
+#if defined CONFIG_FEATURE_TLS_SCHANNEL
+enum schannel_connection_state {
+        BB_SCHANNEL_OPEN = 0,
+        BB_SCHANNEL_CLOSED = 1,
+        BB_SCHANNEL_CLOSED_AND_FREED = 2
+};
+
+typedef struct tls_state {
+        int ofd;
+        int ifd;
+
+        // handles
+        CredHandle cred_handle;
+        CtxtHandle ctx_handle;
+
+        // buffers
+        char in_buffer[16384 + 256]; // input buffer (to read from server), length is maximum TLS packet size
+        unsigned long in_buffer_offset;
+
+        char *out_buffer; // output buffer (for decrypted data, offset from in_buffer)
+        unsigned long out_buffer_length;
+        unsigned long out_buffer_extra;
 
+        // data
+        char *hostname;
+        SecPkgContext_StreamSizes stream_sizes;
+        bool initialized;
+        enum schannel_connection_state connection_state;
+} tls_state_t;
+#else
 struct tls_aes {
         uint32_t key[60];
         unsigned rounds;
@@ -956,12 +1011,14 @@ typedef struct tls_state {
         struct tls_aes aes_decrypt;
         uint8_t H[16]; //used by AES_GCM
 } tls_state_t;
+#endif
 
 static inline tls_state_t *new_tls_state(void)
 {
         tls_state_t *tls = xzalloc(sizeof(*tls));
         return tls;
 }
+
 void tls_handshake(tls_state_t *tls, const char *sni) FAST_FUNC;
 #define TLSLOOP_EXIT_ON_LOCAL_EOF (1 << 0)
 void tls_run_copy_loop(tls_state_t *tls, unsigned flags) FAST_FUNC;
@@ -1071,13 +1128,13 @@ unsigned bb_clk_tck(void) FAST_FUNC;
 
 #if SEAMLESS_COMPRESSION
 /* Autodetects gzip/bzip2 formats. fd may be in the middle of the file! */
-int setup_unzip_on_fd(int fd, int fail_if_not_compressed) FAST_FUNC;
+int setup_unzip_on_fd(int fd, int die_if_not_compressed) FAST_FUNC;
 /* Autodetects .gz etc */
-extern int open_zipped(const char *fname, int fail_if_not_compressed) FAST_FUNC;
+extern int open_zipped(const char *fname, int die_if_not_compressed) FAST_FUNC;
 extern void *xmalloc_open_zipped_read_close(const char *fname, size_t *maxsz_p) FAST_FUNC RETURNS_MALLOC;
 #else
 # define setup_unzip_on_fd(...) (0)
-# define open_zipped(fname, fail_if_not_compressed)  open((fname), O_RDONLY);
+# define open_zipped(fname, die_if_not_compressed)  open((fname), O_RDONLY);
 # define xmalloc_open_zipped_read_close(fname, maxsz_p) xmalloc_open_read_close((fname), (maxsz_p))
 #endif
 /* lzma has no signature, need a little helper. NB: exist only for ENABLE_FEATURE_SEAMLESS_LZMA=y */
@@ -1173,6 +1230,32 @@ char *bin2hex(char *dst, const char *src, int count) FAST_FUNC;
 /* Reverse */
 char* hex2bin(char *dst, const char *src, int count) FAST_FUNC;
 
+/* Returns strlen as a bonus */
+//size_t replace_char(char *s, char what, char with) FAST_FUNC;
+static inline size_t replace_char(char *str, char from, char to)
+{
+        char *p = str;
+        while (*p) {
+                if (*p == from)
+                        *p = to;
+                p++;
+        }
+        return p - str;
+}
+
+extern const char c_escape_conv_str00[];
+#define c_escape_conv_str07 (c_escape_conv_str00+3)
+
+void FAST_FUNC xorbuf_3(void *dst, const void *src1, const void *src2, unsigned count);
+void FAST_FUNC xorbuf(void* buf, const void* mask, unsigned count);
+void FAST_FUNC xorbuf16_aligned_long(void* buf, const void* mask);
+void FAST_FUNC xorbuf64_3_aligned64(void *dst, const void *src1, const void *src2);
+#if BB_UNALIGNED_MEMACCESS_OK
+# define xorbuf16(buf,mask) xorbuf16_aligned_long(buf,mask)
+#else
+void FAST_FUNC xorbuf16(void* buf, const void* mask);
+#endif
+
 /* Generate a UUID */
 void generate_uuid(uint8_t *buf) FAST_FUNC;
 
@@ -1887,18 +1970,25 @@ extern char *pw_encrypt(const char *clear, const char *salt, int cleanup) FAST_F
 extern int obscure(const char *old, const char *newval, const struct passwd *pwdp) FAST_FUNC;
 /*
  * rnd is additional random input. New one is returned.
- * Useful if you call crypt_make_salt many times in a row:
- * rnd = crypt_make_salt(buf1, 4, 0);
- * rnd = crypt_make_salt(buf2, 4, rnd);
- * rnd = crypt_make_salt(buf3, 4, rnd);
+ * Useful if you call crypt_make_rand64encoded many times in a row:
+ * rnd = crypt_make_rand64encoded(buf1, 4, 0);
+ * rnd = crypt_make_rand64encoded(buf2, 4, rnd);
+ * rnd = crypt_make_rand64encoded(buf3, 4, rnd);
  * (otherwise we risk having same salt generated)
  */
-extern int crypt_make_salt(char *p, int cnt /*, int rnd*/) FAST_FUNC;
-/* "$N$" + sha_salt_16_bytes + NUL */
-#define MAX_PW_SALT_LEN (3 + 16 + 1)
+extern int crypt_make_rand64encoded(char *p, int cnt /*, int rnd*/) FAST_FUNC;
+/* Size of char salt[] to hold randomly-generated salt string
+ * sha256/512:
+ * "$5$" ["rounds=999999999$"] "<sha_salt_16_chars><NUL>"
+ * "$6$" ["rounds=999999999$"] "<sha_salt_16_chars><NUL>"
+ * #define MAX_PW_SALT_LEN (3 + sizeof("rounds=999999999$")-1 + 16 + 1)
+ * yescrypt:
+ * "$y$" <up to 8 params of up to 6 chars each> "$" <up to 86 chars salt><NUL>
+ * (86 chars are ascii64-encoded 64 binary bytes)
+ */
+#define MAX_PW_SALT_LEN (3 + 8*6 + 1 + 86 + 1)
 extern char* crypt_make_pw_salt(char p[MAX_PW_SALT_LEN], const char *algo) FAST_FUNC;
 
-
 /* Returns number of lines changed, or -1 on error */
 #if !(ENABLE_FEATURE_ADDUSER_TO_GROUP || ENABLE_FEATURE_DEL_USER_FROM_GROUP)
 #define update_passwd(filename, username, data, member) \
@@ -2041,6 +2131,10 @@ int64_t windows_read_key(int fd, char *buffer, int timeout) FAST_FUNC;
 int64_t safe_read_key(int fd, char *buffer, int timeout) FAST_FUNC;
 void read_key_ungets(char *buffer, const char *str, unsigned len) FAST_FUNC;
 
+int check_got_signal_and_poll(struct pollfd pfd[1], int timeout) FAST_FUNC;
+#if ENABLE_PLATFORM_MINGW32
+# define check_got_signal_and_poll(p, t) poll(p, 1, t)
+#endif
 
 #if ENABLE_FEATURE_EDITING
 /* It's NOT just ENABLEd or disabled. It's a number: */
@@ -2087,7 +2181,7 @@ typedef struct line_input_t {
 # if MAX_HISTORY
         int cnt_history;
         int cur_history;
-        int max_history; /* must never be <= 0 */
+        int max_history; /* must never be < 0 */
 #  if ENABLE_FEATURE_EDITING_SAVEHISTORY
         /* meaning of this field depends on FEATURE_EDITING_SAVE_ON_EXIT:
          * if !FEATURE_EDITING_SAVE_ON_EXIT: "how many lines are
@@ -2153,33 +2247,6 @@ enum { COMM_LEN = 16 };
 # endif
 #endif
 
-struct smaprec {
-        unsigned long mapped_rw;
-        unsigned long mapped_ro;
-        unsigned long shared_clean;
-        unsigned long shared_dirty;
-        unsigned long private_clean;
-        unsigned long private_dirty;
-        unsigned long stack;
-        unsigned long smap_pss, smap_swap;
-        unsigned long smap_size;
-        // For mixed 32/64 userspace, 32-bit pmap still needs
-        // 64-bit field here to correctly show 64-bit processes:
-        unsigned long long smap_start;
-        // (strictly speaking, other fields need to be wider too,
-        // but they are in kbytes, not bytes, and they hold sizes,
-        // not start addresses, sizes tend to be less than 4 terabytes)
-        char smap_mode[5];
-        char *smap_name;
-};
-
-#if !ENABLE_PMAP
-#define procps_read_smaps(pid, total, cb, data) \
-        procps_read_smaps(pid, total)
-#endif
-int FAST_FUNC procps_read_smaps(pid_t pid, struct smaprec *total,
-                void (*cb)(struct smaprec *, void *), void *data);
-
 typedef struct procps_status_t {
 #if !ENABLE_PLATFORM_MINGW32
         DIR *dir;
@@ -2215,7 +2282,13 @@ typedef struct procps_status_t {
 #endif
         unsigned tty_major,tty_minor;
 #if ENABLE_FEATURE_TOPMEM
-        struct smaprec smaps;
+        unsigned long mapped_rw;
+        unsigned long mapped_ro;
+        unsigned long shared_clean;
+        unsigned long shared_dirty;
+        unsigned long private_clean;
+        unsigned long private_dirty;
+        unsigned long stack;
 #endif
         char state[4];
         /* basename of executable in exec(2), read from /proc/N/stat
@@ -2264,11 +2337,15 @@ void free_procps_scan(procps_status_t* sp) FAST_FUNC;
 procps_status_t* procps_scan(procps_status_t* sp, int flags) FAST_FUNC;
 /* Format cmdline (up to col chars) into char buf[size] */
 /* Puts [comm] if cmdline is empty (-> process is a kernel thread) */
-void read_cmdline(char *buf, int size, unsigned pid, const char *comm) FAST_FUNC;
+int read_cmdline(char *buf, int size, unsigned pid, const char *comm) FAST_FUNC;
 pid_t *find_pid_by_name(const char* procName) FAST_FUNC;
 pid_t *pidlist_reverse(pid_t *pidList) FAST_FUNC;
 int starts_with_cpu(const char *str) FAST_FUNC;
 unsigned get_cpu_count(void) FAST_FUNC;
+/* Some internals reused by pmap: */
+unsigned long FAST_FUNC fast_strtoul_10(char **endptr);
+unsigned long long FAST_FUNC fast_strtoull_16(char **endptr);
+char* FAST_FUNC skip_fields(char *str, int count);
 
 
 /* Use strict=1 if you process input from untrusted source:
@@ -2294,6 +2371,56 @@ char *decode_base64(char *dst, const char **pp_src) FAST_FUNC;
 char *decode_base32(char *dst, const char **pp_src) FAST_FUNC;
 void read_base64(FILE *src_stream, FILE *dst_stream, int flags) FAST_FUNC;
 
+int FAST_FUNC i2a64(int i);
+int FAST_FUNC a2i64(char c);
+char* FAST_FUNC num2str64_lsb_first(char *s, unsigned v, int n);
+
+enum {
+        /* how many bytes XYZ_end() fills */
+        MD5_OUTSIZE    = 16,
+        SHA1_OUTSIZE   = 20,
+        SHA256_OUTSIZE = 32,
+        SHA384_OUTSIZE = 48,
+        SHA512_OUTSIZE = 64,
+        //SHA3-224_OUTSIZE = 28,
+        /* size of input block */
+        SHA2_INSIZE     = 64,
+};
+
+#if defined CONFIG_FEATURE_USE_CNG_API
+struct bcrypt_hash_ctx_t {
+        void *handle;
+        void *hash_obj;
+        unsigned int output_size;
+};
+typedef struct bcrypt_hash_ctx_t md5_ctx_t;
+typedef struct bcrypt_hash_ctx_t sha1_ctx_t;
+typedef struct bcrypt_hash_ctx_t sha256_ctx_t;
+typedef struct bcrypt_hash_ctx_t sha384_ctx_t;
+typedef struct bcrypt_hash_ctx_t sha512_ctx_t;
+typedef struct sha3_ctx_t {
+        uint64_t state[25];
+        unsigned bytes_queued;
+        unsigned input_block_bytes;
+} sha3_ctx_t;
+void md5_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
+void sha1_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
+void sha256_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
+void sha384_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
+void sha512_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
+void generic_hash(struct bcrypt_hash_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
+unsigned generic_end(struct bcrypt_hash_ctx_t *ctx, void *resbuf) FAST_FUNC;
+# define md5_hash generic_hash
+# define sha1_hash generic_hash
+# define sha256_hash generic_hash
+# define sha384_hash generic_hash
+# define sha512_hash generic_hash
+# define md5_end generic_end
+# define sha1_end generic_end
+# define sha256_end generic_end
+# define sha384_end generic_end
+# define sha512_end generic_end
+#else
 typedef struct md5_ctx_t {
         uint8_t wbuffer[64]; /* always correctly aligned for uint64_t */
         void (*process_block)(struct md5_ctx_t*) FAST_FUNC;
@@ -2307,6 +2434,7 @@ typedef struct sha512_ctx_t {
         uint64_t hash[8];
         uint8_t wbuffer[128]; /* always correctly aligned for uint64_t */
 } sha512_ctx_t;
+typedef struct sha512_ctx_t sha384_ctx_t;
 typedef struct sha3_ctx_t {
         uint64_t state[25];
         unsigned bytes_queued;
@@ -2324,20 +2452,69 @@ void sha256_begin(sha256_ctx_t *ctx) FAST_FUNC;
 void sha512_begin(sha512_ctx_t *ctx) FAST_FUNC;
 void sha512_hash(sha512_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
 unsigned sha512_end(sha512_ctx_t *ctx, void *resbuf) FAST_FUNC;
+void sha384_begin(sha384_ctx_t *ctx) FAST_FUNC;
+#define sha384_hash sha512_hash
+unsigned sha384_end(sha384_ctx_t *ctx, void *resbuf) FAST_FUNC;
+#endif
 void sha3_begin(sha3_ctx_t *ctx) FAST_FUNC;
 void sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
 unsigned sha3_end(sha3_ctx_t *ctx, void *resbuf) FAST_FUNC;
+void FAST_FUNC sha256_block(const void *in, size_t len, uint8_t hash[32]);
 /* TLS benefits from knowing that sha1 and sha256 share these. Give them "agnostic" names too */
+#if defined CONFIG_FEATURE_USE_CNG_API
+typedef struct bcrypt_hash_ctx_t md5sha_ctx_t;
+#define md5sha_hash generic_hash
+#define sha_end generic_end
+#else
 typedef struct md5_ctx_t md5sha_ctx_t;
 #define md5sha_hash md5_hash
 #define sha_end sha1_end
-enum {
-        MD5_OUTSIZE    = 16,
-        SHA1_OUTSIZE   = 20,
-        SHA256_OUTSIZE = 32,
-        SHA512_OUTSIZE = 64,
-        SHA3_OUTSIZE   = 28,
-};
+#endif
+
+/* RFC 2104 HMAC (hash-based message authentication code) */
+#if !ENABLE_FEATURE_USE_CNG_API
+typedef struct hmac_ctx {
+        md5sha_ctx_t hashed_key_xor_ipad;
+        md5sha_ctx_t hashed_key_xor_opad;
+} hmac_ctx_t;
+#else
+typedef struct bcrypt_hash_ctx_t hmac_ctx_t;
+#endif
+#define HMAC_ONLY_SHA256 (!ENABLE_FEATURE_TLS_SHA1)
+typedef void md5sha_begin_func(md5sha_ctx_t *ctx) FAST_FUNC;
+#if !ENABLE_FEATURE_USE_CNG_API
+#if HMAC_ONLY_SHA256
+#define hmac_begin(ctx,key,key_size,begin) \
+        hmac_begin(ctx,key,key_size)
+#endif
+void FAST_FUNC hmac_begin(hmac_ctx_t *ctx, const uint8_t *key, unsigned key_size, md5sha_begin_func *begin);
+static ALWAYS_INLINE void hmac_hash(hmac_ctx_t *ctx, const void *in, size_t len)
+{
+        md5sha_hash(&ctx->hashed_key_xor_ipad, in, len);
+}
+#else
+# if HMAC_ONLY_SHA256
+#  define hmac_begin(pre,key,key_size,begin) \
+        _hmac_begin(pre, key, key_size, sha256_begin_hmac)
+# else
+#  define hmac_begin _hmac_begin
+# endif
+void _hmac_begin(hmac_ctx_t *pre, uint8_t *key, unsigned key_size,
+        BCRYPT_ALG_HANDLE alg_handle);
+void hmac_uninit(hmac_ctx_t *pre);
+#endif
+unsigned FAST_FUNC hmac_end(hmac_ctx_t *ctx, uint8_t *out);
+#if HMAC_ONLY_SHA256
+#define hmac_block(key,key_size,begin,in,sz,out) \
+        hmac_block(key,key_size,in,sz,out)
+#endif
+unsigned FAST_FUNC hmac_block(const uint8_t *key, unsigned key_size,
+                md5sha_begin_func *begin,
+                const void *in, unsigned sz,
+                uint8_t *out);
+/* HMAC helpers for TLS: */
+void FAST_FUNC hmac_hash_v(hmac_ctx_t *ctx, va_list va);
+unsigned hmac_peek_hash(hmac_ctx_t *ctx, uint8_t *out, ...);
 
 extern uint32_t *global_crc32_table;
 uint32_t *crc32_filltable(uint32_t *tbl256, int endian) FAST_FUNC;
@@ -2473,31 +2650,10 @@ extern struct globals *BB_GLOBAL_CONST ptr_to_globals;
 #define barrier() asm volatile ("":::"memory")
 
 #if defined(__clang_major__) && __clang_major__ >= 9
-/* Clang/llvm drops assignment to "constant" storage. Silently.
- * Needs serious convincing to not eliminate the store.
- */
-static ALWAYS_INLINE void* not_const_pp(const void *p)
-{
-        void *pp;
-        asm volatile (
-                "# forget that p points to const"
-                : /*outputs*/ "=r" (pp)
-                : /*inputs*/ "0" (p)
-        );
-        return pp;
-}
-# if !ENABLE_PLATFORM_MINGW32
-# define ASSIGN_CONST_PTR(pptr, v) do { \
-        *(void**)not_const_pp(pptr) = (void*)(v); \
-        barrier(); \
-} while (0)
-#else
-/* On Windows it seems necessary for this to be a function too. */
-void ASSIGN_CONST_PTR(const void *pptr, const void *ptr) FAST_FUNC;
-#endif
-/* XZALLOC_CONST_PTR() is an out-of-line function to prevent
- * clang from reading pointer before it is assigned.
+/* {ASSIGN,XZALLOC}_CONST_PTR() are out-of-line functions
+ * to prevent clang from reading pointer before it is assigned.
  */
+void ASSIGN_CONST_PTR(const void *pptr, void *v) FAST_FUNC;
 void XZALLOC_CONST_PTR(const void *pptr, size_t size) FAST_FUNC;
 #else
 # define ASSIGN_CONST_PTR(pptr, v) do { \
diff --git a/include/mingw.h b/include/mingw.h
index c41c0f91e..0a8d52d84 100644
--- a/include/mingw.h
+++ b/include/mingw.h
@@ -3,7 +3,7 @@
 #define IMPL(name,ret,retval,...) static inline ret name(__VA_ARGS__) { return retval; }
 
 /* Use 64-bit time on 32-bit platforms. */
-#if !defined(_WIN64)
+#if !defined(_WIN64) && __MINGW64_VERSION_MAJOR >= 10
 # define time_t __time64_t
 # define ctime(t) _ctime64(t)
 # define localtime(t) _localtime64(t)
@@ -255,10 +255,22 @@ int ffs(int i);
 #endif
 
 /*
+ * sys/file.h
+ */
+
+int flock(int fd, int op);
+
+#define LOCK_SH 1
+#define LOCK_EX 2
+#define LOCK_UN 8
+#define LOCK_NB 4
+
+/*
  * sys/ioctl.h
  */
 
 #define TIOCGWINSZ 0x5413
+#define TIOCSWINSZ 0x5414
 
 int ioctl(int fd, int code, ...);
 
@@ -500,7 +512,7 @@ int kill(pid_t pid, int sig);
 int link(const char *oldpath, const char *newpath);
 NOIMPL(mknod,const char *name UNUSED_PARAM, mode_t mode UNUSED_PARAM, dev_t device UNUSED_PARAM);
 /* order of devices must match that in get_dev_type */
-enum {DEV_NULL, DEV_ZERO, DEV_URANDOM, NOT_DEVICE = -1};
+enum {DEV_NULL, DEV_TTY, DEV_ZERO, DEV_URANDOM, NOT_DEVICE = -1};
 int get_dev_type(const char *filename);
 void update_special_fd(int dev, int fd);
 int mingw_open (const char *filename, int oflags, ...);
@@ -639,7 +651,6 @@ int err_win_to_posix(void);
 ULONGLONG CompatGetTickCount64(void);
 #define GetTickCount64 CompatGetTickCount64
 
-ssize_t get_random_bytes(void *buf, ssize_t count);
 int enumerate_links(const char *file, char *name);
 
 int unc_root_len(const char *dir) FAST_FUNC;
@@ -669,3 +680,5 @@ enum {
 };
 int elevation_state(void);
 void set_interp(int i) FAST_FUNC;
+int mingw_shell_execute(SHELLEXECUTEINFO *info);
+void mingw_die_if_error(NTSTATUS status, const char *function_name);
diff --git a/include/platform.h b/include/platform.h
index 5795a0cf3..0db8bf345 100644
--- a/include/platform.h
+++ b/include/platform.h
@@ -208,7 +208,7 @@
 #elif defined(BYTE_ORDER) && BYTE_ORDER == LITTLE_ENDIAN
 # define BB_BIG_ENDIAN 0
 # define BB_LITTLE_ENDIAN 1
-#elif defined(__386__)
+#elif defined(__i386__)
 # define BB_BIG_ENDIAN 0
 # define BB_LITTLE_ENDIAN 1
 #else
@@ -230,6 +230,8 @@
 # define SWAP_LE64(x) bb_bswap_64(x)
 # define IF_BIG_ENDIAN(...) __VA_ARGS__
 # define IF_LITTLE_ENDIAN(...)
+/* How do bytes a,b,c,d (sequential in memory) look if fetched into uint32_t? */
+# define PACK32_BYTES(a,b,c,d) (uint32_t)((d)+((c)<<8)+((b)<<16)+((a)<<24))
 #else
 # define SWAP_BE16(x) bswap_16(x)
 # define SWAP_BE32(x) bswap_32(x)
@@ -239,6 +241,7 @@
 # define SWAP_LE64(x) (x)
 # define IF_BIG_ENDIAN(...)
 # define IF_LITTLE_ENDIAN(...) __VA_ARGS__
+# define PACK32_BYTES(a,b,c,d) (uint32_t)((a)+((b)<<8)+((c)<<16)+((d)<<24))
 #endif
 
 
diff --git a/include/usage.src.h b/include/usage.src.h
index 5d2038834..0881337f8 100644
--- a/include/usage.src.h
+++ b/include/usage.src.h
@@ -17,11 +17,11 @@
 #define scripted_trivial_usage NOUSAGE_STR
 #define scripted_full_usage ""
 
-#if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_SHA
-# define CRYPT_METHODS_HELP_STR "des,md5,sha256/512" \
+#if !ENABLE_USE_BB_CRYPT
+# define CRYPT_METHODS_HELP_STR "des,md5,sha256/512,yescrypt" \
         " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
 #else
-# define CRYPT_METHODS_HELP_STR "des,md5" \
+# define CRYPT_METHODS_HELP_STR "des,md5"IF_USE_BB_CRYPT_SHA(",sha256/512")IF_USE_BB_CRYPT_YES(",yescrypt") \
         " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
 #endif
 
diff --git a/init/bootchartd.c b/init/bootchartd.c
index 0929890a3..a5447c6ad 100644
--- a/init/bootchartd.c
+++ b/init/bootchartd.c
@@ -133,7 +133,7 @@ static void dump_file(FILE *fp, const char *filename)
 static int dump_procs(FILE *fp, int look_for_login_process)
 {
         struct dirent *entry;
-        DIR *dir = opendir("/proc");
+        DIR *dir = xopendir("/proc");
         int found_login_process = 0;
 
         fputs(G.jiffy_line, fp);
diff --git a/init/init.c b/init/init.c
index 2ee1e4cde..294be9952 100644
--- a/init/init.c
+++ b/init/init.c
@@ -1198,17 +1198,29 @@ int init_main(int argc UNUSED_PARAM, char **argv)
                 /* Wait for any child process(es) to exit */
                 while (1) {
                         pid_t wpid;
+                        int status;
                         struct init_action *a;
 
-                        wpid = waitpid(-1, NULL, WNOHANG);
+                        wpid = wait_any_nohang(&status);
                         if (wpid <= 0)
                                 break;
 
                         a = mark_terminated(wpid);
                         if (a) {
-                                message(L_LOG, "process '%s' (pid %u) exited. "
+                                const char *s = "killed, signal";
+                                int ex = WTERMSIG(status);
+                                /* "if (!WIFSIGNALED(status))" generates more code:
+                                 * on linux, WIFEXITED(status) is "WTERMSIG(status) == 0"
+                                 * and WTERMSIG(status) is known, so compiler optimizes.
+                                 */
+                                if (WIFEXITED(status)) {
+                                        s = "exited, exitcode";
+                                        ex = WEXITSTATUS(status);
+                                }
+                                message(L_LOG, "process '%s' (pid %u) %s:%d. "
                                                 "Scheduling for restart.",
-                                                a->command, (unsigned)wpid);
+                                                a->command, (unsigned)wpid,
+                                                s, ex);
                         }
                 }
 
diff --git a/libbb/Config.src b/libbb/Config.src
index 61b4601d6..eff327c2a 100644
--- a/libbb/Config.src
+++ b/libbb/Config.src
@@ -37,6 +37,14 @@ config PASSWORD_MINLEN
         help
         Minimum allowable password length.
 
+config FEATURE_USE_CNG_API
+        bool "Use the Windows CNG API for checksums (Windows 10+ only)"
+        default n
+        depends on PLATFORM_MINGW32
+        help
+        Use the in-built Windows CNG API for checksums.
+        This reduces code size, but is only supported on Windows 10+.
+
 config MD5_SMALL
         int "MD5: Trade bytes for speed (0:fast, 3:slow)"
         default 1  # all "fast or small" options default to small
@@ -67,6 +75,7 @@ config SHA1_SMALL
 config SHA1_HWACCEL
         bool "SHA1: Use hardware accelerated instructions if possible"
         default y
+        depends on !FEATURE_USE_CNG_API
         help
         On x86, this adds ~590 bytes of code. Throughput
         is about twice as fast as fully-unrolled generic code.
@@ -74,6 +83,7 @@ config SHA1_HWACCEL
 config SHA256_HWACCEL
         bool "SHA256: Use hardware accelerated instructions if possible"
         default y
+        depends on !FEATURE_USE_CNG_API
         help
         On x86, this adds ~1k bytes of code.
 
@@ -182,8 +192,8 @@ config FEATURE_EDITING_VI
 config FEATURE_EDITING_HISTORY
         int "History size"
         # Don't allow way too big values here, code uses fixed "char *history[N]" struct member
-        range 0 9999
-        default 255
+        range 0 2000
+        default 200
         depends on FEATURE_EDITING
         help
         Specify command history size (0 - disable).
diff --git a/libbb/appletlib.c b/libbb/appletlib.c
index d6e042775..496d320cd 100644
--- a/libbb/appletlib.c
+++ b/libbb/appletlib.c
@@ -933,7 +933,7 @@ int busybox_main(int argc UNUSED_PARAM, char **argv)
                 full_write1_str(" multi-call binary.\n"); /* reuse */
 #endif
                 full_write1_str(
-                        "BusyBox is copyrighted by many authors between 1998-2024.\n"
+                        "BusyBox is copyrighted by many authors between 1998-2025.\n"
                         "Licensed under GPLv2. See source distribution for detailed\n"
                         "copyright notices.\n"
                         "\n"
@@ -1122,14 +1122,14 @@ int busybox_main(int argc UNUSED_PARAM, char **argv)
 #endif
 
         if (strcmp(argv[1], "--help") == 0) {
-                /* "busybox --help [<applet>]" */
+                /* "busybox --help [APPLET]" */
                 if (!argv[2]
 #  if ENABLE_FEATURE_SH_STANDALONE && ENABLE_FEATURE_TAB_COMPLETION
                  || strcmp(argv[2], "busybox") == 0 /* prevent getting "No help available" */
 #  endif
                 )
                         goto help;
-                /* convert to "<applet> --help" */
+                /* convert to "APPLET --help" */
                 applet_name = argv[0] = argv[2];
                 argv[2] = NULL;
                 if (find_applet_by_name_internal(applet_name) >= 0) {
@@ -1137,8 +1137,16 @@ int busybox_main(int argc UNUSED_PARAM, char **argv)
                         xfunc_error_retval = 0;
                         bb_show_usage();
                 } /* else: unknown applet, fall through (causes "applet not found" later) */
-        } else {
-                /* "busybox <applet> arg1 arg2 ..." */
+        }
+#  if ENABLE_FEATURE_VERSION
+        else if (!argv[2] && strcmp(argv[1], "--version") == 0) {
+                full_write1_str(bb_banner); /* reuse const string */
+                full_write1_str("\n");
+                return 0;
+        }
+#  endif
+        else {
+                /* "busybox APPLET arg1 arg2 ..." */
                 argv++;
                 /* We support "busybox /a/path/to/applet args..." too. Allows for
                  * "#!/bin/busybox"-style wrappers
diff --git a/libbb/bitops.c b/libbb/bitops.c
new file mode 100644
index 000000000..467e1a2d9
--- /dev/null
+++ b/libbb/bitops.c
@@ -0,0 +1,128 @@
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-y += bitops.o
+
+#include "libbb.h"
+
+void FAST_FUNC xorbuf_3(void *dst, const void *src1, const void *src2, unsigned count)
+{
+        uint8_t *d = dst;
+        const uint8_t *s1 = src1;
+        const uint8_t *s2 = src2;
+#if BB_UNALIGNED_MEMACCESS_OK
+        while (count >= sizeof(long)) {
+                *(long*)d = *(long*)s1 ^ *(long*)s2;
+                count -= sizeof(long);
+                d += sizeof(long);
+                s1 += sizeof(long);
+                s2 += sizeof(long);
+        }
+#endif
+        while (count--)
+                *d++ = *s1++ ^ *s2++;
+}
+
+void FAST_FUNC xorbuf(void *dst, const void *src, unsigned count)
+{
+        xorbuf_3(dst, dst, src, count);
+}
+
+void FAST_FUNC xorbuf16_aligned_long(void *dst, const void *src)
+{
+#if defined(__SSE__) /* any x86_64 has it */
+        asm volatile(
+"\n             movups  (%0),%%xmm0"
+"\n             movups  (%1),%%xmm1"   // can't just xorps(%1),%%xmm0:
+"\n             xorps   %%xmm1,%%xmm0" // SSE requires 16-byte alignment
+"\n             movups  %%xmm0,(%0)"
+"\n"
+                : "=r" (dst), "=r" (src)
+                : "0" (dst), "1" (src)
+                : "xmm0", "xmm1", "memory"
+        );
+#else
+        unsigned long *d = dst;
+        const unsigned long *s = src;
+        d[0] ^= s[0];
+# if LONG_MAX <= 0x7fffffffffffffff
+        d[1] ^= s[1];
+#  if LONG_MAX == 0x7fffffff
+        d[2] ^= s[2];
+        d[3] ^= s[3];
+#  endif
+# endif
+#endif
+}
+// The above can be inlined in libbb.h, in a way where compiler
+// is even free to use better addressing modes than (%reg), and
+// to keep the result in a register
+// (to not store it to memory after each XOR):
+//#if defined(__SSE__)
+//#include <xmmintrin.h>
+//^^^ or just: typedef float __m128_u attribute((__vector_size__(16),__may_alias__,__aligned__(1)));
+//static ALWAYS_INLINE void xorbuf16_aligned_long(void *dst, const void *src)
+//{
+//      __m128_u xmm0, xmm1;
+//      asm volatile(
+//"\n           xorps   %1,%0"
+//              : "=x" (xmm0), "=x" (xmm1)
+//              : "0" (*(__m128_u*)dst), "1" (*(__m128_u*)src)
+//      );
+//      *(__m128_u*)dst = xmm0; // this store may be optimized out!
+//}
+//#endif
+// but I don't trust gcc optimizer enough to not generate some monstrosity.
+// See GMULT() function in TLS code as an example.
+
+void FAST_FUNC xorbuf64_3_aligned64(void *dst, const void *src1, const void *src2)
+{
+#if defined(__SSE__) /* any x86_64 has it */
+        asm volatile(
+"\n             movups  0*16(%1),%%xmm0"
+"\n             movups  0*16(%2),%%xmm1" // can't just xorps(%2),%%xmm0:
+"\n             xorps   %%xmm1,%%xmm0"   // SSE requires 16-byte alignment, we have only 8-byte
+"\n             movups  %%xmm0,0*16(%0)"
+"\n             movups  1*16(%1),%%xmm0"
+"\n             movups  1*16(%2),%%xmm1"
+"\n             xorps   %%xmm1,%%xmm0"
+"\n             movups  %%xmm0,1*16(%0)"
+"\n             movups  2*16(%1),%%xmm0"
+"\n             movups  2*16(%2),%%xmm1"
+"\n             xorps   %%xmm1,%%xmm0"
+"\n             movups  %%xmm0,2*16(%0)"
+"\n             movups  3*16(%1),%%xmm0"
+"\n             movups  3*16(%2),%%xmm1"
+"\n             xorps   %%xmm1,%%xmm0"
+"\n             movups  %%xmm0,3*16(%0)"
+"\n"
+                : "=r" (dst), "=r" (src1), "=r" (src2)
+                : "0" (dst), "1" (src1), "2" (src2)
+                : "xmm0", "xmm1", "memory"
+        );
+#else
+        long *d = dst;
+        const long *s1 = src1;
+        const long *s2 = src2;
+        unsigned count = 64 / sizeof(long);
+        do {
+                *d++ = *s1++ ^ *s2++;
+        } while (--count != 0);
+#endif
+}
+
+#if !BB_UNALIGNED_MEMACCESS_OK
+void FAST_FUNC xorbuf16(void *dst, const void *src)
+{
+#define p_aligned(a) (((uintptr_t)(a) & (sizeof(long)-1)) == 0)
+        if (p_aligned(src) && p_aligned(dst)) {
+                xorbuf16_aligned_long(dst, src);
+                return;
+        }
+        xorbuf_3(dst, dst, src, 16);
+}
+#endif
diff --git a/libbb/c_escape.c b/libbb/c_escape.c
new file mode 100644
index 000000000..6c109f2e0
--- /dev/null
+++ b/libbb/c_escape.c
@@ -0,0 +1,20 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-y += c_escape.o
+
+#include "libbb.h"
+
+const char c_escape_conv_str00[] ALIGN1 =
+        "\\""0""\0" // [0]:00
+        "\\""a""\0" // [1]:07
+        "\\""b""\0" // [2]:08
+        "\\""t""\0" // [3]:09
+        "\\""n""\0" // [4]:0a
+        "\\""v""\0" // [5]:0b
+        "\\""f""\0" // [6]:0c
+        "\\""r"     // [7]:0d
+        ;
diff --git a/libbb/concat_path_file.c b/libbb/concat_path_file.c
index 3afb0e3a4..96fcd4a1d 100644
--- a/libbb/concat_path_file.c
+++ b/libbb/concat_path_file.c
@@ -17,6 +17,7 @@
 
 char* FAST_FUNC concat_path_file(const char *path, const char *filename)
 {
+#if 0
         char *lc;
 
         if (!path)
@@ -31,4 +32,78 @@ char* FAST_FUNC concat_path_file(const char *path, const char *filename)
                 filename++;
 #endif
         return xasprintf("%s%s%s", path, (lc==NULL ? "/" : ""), filename);
+#else
+/* ^^^^^^^^^^^ timing of xasprintf-based code above:
+ * real 7.074s
+ * user 0.156s <<<
+ * sys  6.394s
+ *      "rm -rf" of a Linux kernel tree from tmpfs (run time still dominated by in-kernel work, though)
+ * real 6.989s
+ * user 0.055s <<< 3 times less CPU used
+ * sys  6.450s
+ * vvvvvvvvvvv timing of open-coded malloc+memcpy code below (+59 bytes):
+ */
+        char *buf, *p;
+        size_t n1, n2, n3;
+
+        while (*filename == '/')
+                filename++;
+
+        if (!path || !path[0])
+                return xstrdup(filename);
+
+        n1 = strlen(path);
+        n2 = (path[n1 - 1] != '/'); /* 1: "path has no trailing slash" */
+        n3 = strlen(filename) + 1;
+
+        buf = xmalloc(n1 + n2 + n3);
+        p = mempcpy(buf, path, n1);
+        if (n2)
+                *p++ = '/';
+        memcpy(p, filename, n3);
+        return buf;
+#endif
 }
+
+/* If second component comes from struct dirent,
+ * it's possible to eliminate one strlen() by using name length
+ * provided by kernel in struct dirent. See below.
+ * However, the win seems to be insignificant.
+ */
+
+#if 0
+
+/* Extract d_namlen from struct dirent */
+static size_t get_d_namlen(const struct dirent *de)
+{
+#if defined(_DIRENT_HAVE_D_NAMLEN)
+        return de->d_namlen;
+#elif defined(_DIRENT_HAVE_D_RECLEN)
+        const size_t prefix_sz = offsetof(struct dirent, d_name);
+        return de->d_reclen - prefix_sz;
+#else
+        return strlen(de->d_name);
+#endif
+}
+
+char* FAST_FUNC concat_path_dirent(const char *path, const struct dirent *de)
+{
+        char *buf, *p;
+        size_t n1, n2, n3;
+
+        if (!path || !path[0])
+                return xstrdup(de->d_name);
+
+        n1 = strlen(path);
+        n2 = (path[n1 - 1] != '/');
+        n3 = get_d_namlen(de) + 1;
+
+        buf = xmalloc(n1 + n2 + n3);
+        p = mempcpy(buf, path, n1);
+        if (n2)
+                *p++ = '/';
+        memcpy(p, de->d_name, n3);
+        return buf;
+}
+
+#endif
diff --git a/libbb/const_hack.c b/libbb/const_hack.c
index 75163fede..1d175481b 100644
--- a/libbb/const_hack.c
+++ b/libbb/const_hack.c
@@ -9,18 +9,27 @@
 #include "libbb.h"
 
 #if defined(__clang_major__) && __clang_major__ >= 9
-void FAST_FUNC XZALLOC_CONST_PTR(const void *pptr, size_t size)
+/* Clang/llvm drops assignment to "constant" storage. Silently.
+ * Needs serious convincing to not eliminate the store.
+ */
+static ALWAYS_INLINE void* not_const_pp(const void *p)
 {
-        ASSIGN_CONST_PTR(pptr, xzalloc(size));
+        void *pp;
+        asm volatile (
+                "# forget that p points to const"
+                : /*outputs*/ "=r" (pp)
+                : /*inputs*/ "0" (p)
+        );
+        return pp;
 }
-
-# if ENABLE_PLATFORM_MINGW32
-void FAST_FUNC ASSIGN_CONST_PTR(const void *pptr, const void *v)
+void FAST_FUNC ASSIGN_CONST_PTR(const void *pptr, void *v)
+{
+        *(void**)not_const_pp(pptr) = v;
+        barrier();
+}
+void FAST_FUNC XZALLOC_CONST_PTR(const void *pptr, size_t size)
 {
-        do {
-                *(void**)not_const_pp(pptr) = (void*)(v);
-                barrier();
-        } while (0);
+        *(void**)not_const_pp(pptr) = xzalloc(size);
+        barrier();
 }
-# endif
 #endif
diff --git a/libbb/dump.c b/libbb/dump.c
index ffc46f6a7..3dc53d55f 100644
--- a/libbb/dump.c
+++ b/libbb/dump.c
@@ -204,9 +204,11 @@ static NOINLINE void rewrite(priv_dumper_t *dumper, FS *fs)
                                 if (!e)
                                         goto DO_BAD_CONV_CHAR;
                                 pr->flags = F_INT;
-                                if (e > int_convs + 1) /* not d or i? */
-                                        pr->flags = F_UINT;
                                 byte_count_str = "\010\004\002\001";
+                                if (e > int_convs + 1) { /* not d or i? */
+                                        pr->flags = F_UINT;
+                                        byte_count_str++;
+                                }
                                 goto DO_BYTE_COUNT;
                         } else
                         if (strchr(int_convs, *p1)) { /* %d etc */
@@ -512,37 +514,52 @@ static void bpad(PR *pr)
                 continue;
 }
 
-static const char conv_str[] ALIGN1 =
-        "\0"  "\\""0""\0"
-        "\007""\\""a""\0"
-        "\b"  "\\""b""\0"
-        "\f"  "\\""f""\0"
-        "\n"  "\\""n""\0"
-        "\r"  "\\""r""\0"
-        "\t"  "\\""t""\0"
-        "\v"  "\\""v""\0"
-        ;
-
 static void conv_c(PR *pr, unsigned char *p)
 {
-        const char *str = conv_str;
-
-        do {
-                if (*p == *str) {
-                        ++str;
-                        goto strpr; /* map e.g. '\n' to "\\n" */
-                }
-                str += 4;
-        } while (*str);
+        const char *str;
+        unsigned char ch;
+
+        ch = *p;
+        if (ch == 0 || (ch -= 6, (signed char)ch > 0 && ch <= 7)) {
+                /* map chars 0,7..13 to "\0","\{a,b,t,n,v,f,r}" */
+                str = c_escape_conv_str00 + 3 * ch;
+                goto strpr;
+        }
 
         if (isprint_asciionly(*p)) {
                 *pr->cchar = 'c';
                 printf(pr->fmt, *p);
         } else {
+#if defined(__i386__) || defined(__x86_64__)
+                /* Abuse partial register operations */
+                uint32_t buf;
+                unsigned n = *p;
+                asm (           //00000000 00000000 00000000 aabbbccc
+"\n             shll $10,%%eax" //00000000 000000aa bbbccc00 00000000
+"\n             shrw $5,%%ax"   //00000000 000000aa 00000bbb ccc00000
+"\n             shrb $5,%%al"   //00000000 000000aa 00000bbb 00000ccc
+"\n             shll $8,%%eax"  //000000aa 00000bbb 00000ccc 00000000
+"\n             bswapl %%eax"   //00000000 00000ccc 00000bbb 000000aa
+"\n             addl $0x303030,%%eax"
+"\n"            : "=a" (n)
+                : "0" (n)
+                );
+                buf = n;
+                str = (void*)&buf;
+#elif 1
                 char buf[4];
                 /* gcc-8.0.1 needs lots of casts to shut up */
                 sprintf(buf, "%03o", (unsigned)(uint8_t)*p);
                 str = buf;
+#else // use faster version? +20 bytes of code relative to sprintf() method
+                char buf[4];
+                buf[3] = '\0';
+                ch = *p;
+                buf[2] = '0' + (ch & 7); ch >>= 3;
+                buf[1] = '0' + (ch & 7); ch >>= 3;
+                buf[0] = '0' + ch;
+                str = buf;
+#endif
  strpr:
                 *pr->cchar = 's';
                 printf(pr->fmt, str);
@@ -701,15 +718,21 @@ static NOINLINE void display(priv_dumper_t* dumper)
                                                         conv_u(pr, bp);
                                                         break;
                                                 case F_UINT: {
+                                                        union {
+                                                                uint16_t uval16;
+                                                                uint32_t uval32;
+                                                        } u;
                                                         unsigned value = (unsigned char)*bp;
                                                         switch (pr->bcnt) {
                                                         case 1:
                                                                 break;
                                                         case 2:
-                                                                move_from_unaligned16(value, bp);
+                                                                move_from_unaligned16(u.uval16, bp);
+                                                                value = u.uval16;
                                                                 break;
                                                         case 4:
-                                                                move_from_unaligned32(value, bp);
+                                                                move_from_unaligned32(u.uval32, bp);
+                                                                value = u.uval32;
                                                                 break;
                                                         /* case 8: no users yet */
                                                         }
diff --git a/libbb/getopt32.c b/libbb/getopt32.c
index 56040e150..9247588d9 100644
--- a/libbb/getopt32.c
+++ b/libbb/getopt32.c
@@ -93,7 +93,7 @@ getopt32(char **argv, const char *applet_opts, ...)
 
  "!"    If the first character in the applet_opts string is a '!',
         report bad options, missing required options,
-        inconsistent options with all-ones return value (instead of abort.
+        inconsistent options with all-ones return value instead of aborting.
 
  "+"    If the first character in the applet_opts string is a plus,
         then option processing will stop as soon as a non-option is
@@ -265,7 +265,7 @@ Special characters:
         for "long options only" cases, such as tar --exclude=PATTERN,
         wget --header=HDR cases.
 
- "a?b"  A "?" between an option and a group of options means that
+ "a?bc" A "?" between an option and a group of options means that
         at least one of them is required to occur if the first option
         occurs in preceding command line arguments.
 
@@ -348,9 +348,6 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
         unsigned trigger;
         int min_arg = 0;
         int max_arg = -1;
-        int spec_flgs = 0;
-
-#define SHOW_USAGE_IF_ERROR     1
 
         on_off = complementary;
         memset(on_off, 0, sizeof(complementary));
@@ -449,9 +446,7 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
                         continue;
                 c = s[1];
                 if (*s == '?') {
-                        if (c < '0' || c > '9') {
-                                spec_flgs |= SHOW_USAGE_IF_ERROR;
-                        } else {
+                        if (c >= '0' && c <= '9') {
                                 max_arg = c - '0';
                                 s++;
                         }
@@ -465,8 +460,10 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
                         continue;
                 }
                 if (*s == '=') {
-                        min_arg = max_arg = c - '0';
-                        s++;
+                        if (c >= '0' && c <= '9') {
+                                min_arg = max_arg = c - '0';
+                                s++;
+                        }
                         continue;
                 }
                 for (on_off = complementary; on_off->opt_char; on_off++)
@@ -533,6 +530,7 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
          * "fake" short options, like this one:
          * wget $'-\203' "Test: test" http://kernel.org/
          * (supposed to act as --header, but doesn't) */
+ next_opt:
 #if ENABLE_LONG_OPTS
         while ((c = getopt_long(argc, argv, applet_opts,
                         long_options, NULL)) != -1) {
@@ -547,8 +545,16 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
                          * but we construct long opts so that flag
                          * is always NULL (see above) */
                         if (on_off->opt_char == '\0' /* && c != '\0' */) {
-                                /* c is probably '?' - "bad option" */
-                                goto error;
+                                /* We reached the end of complementary[] and did not find -c */
+                                if (c == '?') /* getopt says: "bad option, or option has no required argument" */
+                                        goto error;
+                                /* if there were options beyond 32 bits (example: ls),
+                                 * they got no complementary[] slot, and no result bit.
+                                 * IOW: they must be "accept but ignore" options.
+                                 * For them, we end up here.
+                                 */
+                                //bb_error_msg("ignored option '%c', skipping", c);
+                                goto next_opt;
                         }
                 }
                 if (flags & on_off->incongruously)
diff --git a/libbb/hash_hmac.c b/libbb/hash_hmac.c
new file mode 100644
index 000000000..b3138029f
--- /dev/null
+++ b/libbb/hash_hmac.c
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2025 Denys Vlasenko
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_TLS) += hash_hmac.o
+//kbuild:lib-$(CONFIG_USE_BB_CRYPT_YES) += hash_hmac.o
+
+#include "libbb.h"
+
+// RFC 2104:
+// HMAC(key, text) based on a hash H (say, sha256) is:
+// ipad = [0x36 x INSIZE]
+// opad = [0x5c x INSIZE]
+// HMAC(key, text) = H((key XOR opad) + H((key XOR ipad) + text))
+//
+// H(key XOR opad) and H(key XOR ipad) can be precomputed
+// if we often need HMAC hmac with the same key.
+//
+// text is often given in disjoint pieces.
+#if !ENABLE_FEATURE_USE_CNG_API
+void FAST_FUNC hmac_begin(hmac_ctx_t *ctx, const uint8_t *key, unsigned key_size, md5sha_begin_func *begin)
+{
+#if HMAC_ONLY_SHA256
+#define begin sha256_begin
+#endif
+        uint8_t key_xor_ipad[SHA2_INSIZE];
+        uint8_t key_xor_opad[SHA2_INSIZE];
+        unsigned i;
+
+        // "The authentication key can be of any length up to INSIZE, the
+        // block length of the hash function.  Applications that use keys longer
+        // than INSIZE bytes will first hash the key using H and then use the
+        // resultant OUTSIZE byte string as the actual key to HMAC."
+        if (key_size > SHA2_INSIZE) {
+                uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
+                /* use ctx->hashed_key_xor_ipad as scratch ctx */
+                begin(&ctx->hashed_key_xor_ipad);
+                md5sha_hash(&ctx->hashed_key_xor_ipad, key, key_size);
+                key_size = sha_end(&ctx->hashed_key_xor_ipad, tempkey);
+                key = tempkey;
+        }
+
+        for (i = 0; i < key_size; i++) {
+                key_xor_ipad[i] = key[i] ^ 0x36;
+                key_xor_opad[i] = key[i] ^ 0x5c;
+        }
+        for (; i < SHA2_INSIZE; i++) {
+                key_xor_ipad[i] = 0x36;
+                key_xor_opad[i] = 0x5c;
+        }
+
+        begin(&ctx->hashed_key_xor_ipad);
+        begin(&ctx->hashed_key_xor_opad);
+        md5sha_hash(&ctx->hashed_key_xor_ipad, key_xor_ipad, SHA2_INSIZE);
+        md5sha_hash(&ctx->hashed_key_xor_opad, key_xor_opad, SHA2_INSIZE);
+}
+#undef begin
+
+unsigned FAST_FUNC hmac_end(hmac_ctx_t *ctx, uint8_t *out)
+{
+        unsigned len = sha_end(&ctx->hashed_key_xor_ipad, out);
+        /* out = H((key XOR opad) + out) */
+        md5sha_hash(&ctx->hashed_key_xor_opad, out, len);
+        return sha_end(&ctx->hashed_key_xor_opad, out);
+}
+
+unsigned FAST_FUNC hmac_block(const uint8_t *key, unsigned key_size, md5sha_begin_func *begin, const void *in, unsigned sz, uint8_t *out)
+{
+        hmac_ctx_t ctx;
+        hmac_begin(&ctx, key, key_size, begin);
+        hmac_hash(&ctx, in, sz);
+        return hmac_end(&ctx, out);
+}
+
+/* TLS helpers */
+
+void FAST_FUNC hmac_hash_v(
+                hmac_ctx_t *ctx,
+                va_list va)
+{
+        uint8_t *in;
+
+        /* ctx->hashed_key_xor_ipad contains unclosed "H((key XOR ipad) +" state */
+        /* ctx->hashed_key_xor_opad contains unclosed "H((key XOR opad) +" state */
+
+        /* calculate out = H((key XOR ipad) + text) */
+        while ((in = va_arg(va, uint8_t*)) != NULL) {
+                unsigned size = va_arg(va, unsigned);
+                md5sha_hash(&ctx->hashed_key_xor_ipad, in, size);
+        }
+}
+#else
+void _hmac_begin(hmac_ctx_t *ctx, uint8_t *key, unsigned key_size,
+                                        BCRYPT_ALG_HANDLE alg_handle) {
+        DWORD hash_object_length = 0;
+        ULONG _unused;
+        NTSTATUS status;
+
+        status = BCryptGetProperty(alg_handle, BCRYPT_OBJECT_LENGTH,
+                                (PUCHAR)&hash_object_length, sizeof(DWORD), &_unused, 0);
+        mingw_die_if_error(status, "BCryptGetProperty");
+        status = BCryptGetProperty(alg_handle, BCRYPT_HASH_LENGTH,
+                                (PUCHAR)&ctx->output_size, sizeof(DWORD), &_unused, 0);
+        mingw_die_if_error(status, "BCryptGetProperty");
+
+        ctx->hash_obj = xmalloc(hash_object_length);
+
+        status = BCryptCreateHash(alg_handle, &ctx->handle, ctx->hash_obj,
+                                hash_object_length, key, key_size, BCRYPT_HASH_REUSABLE_FLAG);
+        mingw_die_if_error(status, "BCryptCreateHash");
+}
+
+unsigned FAST_FUNC hmac_end(hmac_ctx_t *ctx, uint8_t *out)
+{
+        NTSTATUS status;
+
+        status = BCryptFinishHash(ctx->handle, out, ctx->output_size, 0);
+        mingw_die_if_error(status, "BCryptFinishHash");
+
+        return ctx->output_size;
+}
+
+void FAST_FUNC hmac_hash_v(hmac_ctx_t *ctx, va_list va)
+{
+        uint8_t *in;
+
+        while ((in = va_arg(va, uint8_t*)) != NULL) {
+                unsigned size = va_arg(va, unsigned);
+                BCryptHashData(ctx->handle, in, size, 0);
+        }
+}
+
+void hmac_uninit(hmac_ctx_t *ctx) {
+        BCryptDestroyHash(ctx->handle);
+        free(ctx->hash_obj);
+}
+#endif
+
+/* Using HMAC state, make a copy of it (IOW: without affecting this state!)
+ * hash in the list of (ptr,size) blocks, and finish the HMAC to out[] buffer.
+ * This function is useful for TLS PRF.
+ */
+unsigned hmac_peek_hash(hmac_ctx_t *ctx, uint8_t *out, ...)
+{
+        hmac_ctx_t tmpctx = *ctx; /* struct copy */
+        va_list va;
+
+        va_start(va, out);
+        hmac_hash_v(&tmpctx, va);
+        va_end(va);
+
+        return hmac_end(&tmpctx, out);
+}
diff --git a/libbb/hash_md5_sha.c b/libbb/hash_md5_sha.c
index 75a61c32c..fd56d831b 100644
--- a/libbb/hash_md5_sha.c
+++ b/libbb/hash_md5_sha.c
@@ -11,7 +11,93 @@
 #define STR1(s) #s
 #define STR(s) STR1(s)
 
-#define NEED_SHA512 (ENABLE_SHA512SUM || ENABLE_USE_BB_CRYPT_SHA)
+#define NEED_SHA512 (ENABLE_SHA512SUM || ENABLE_SHA384SUM || ENABLE_USE_BB_CRYPT_SHA)
+
+#if ENABLE_FEATURE_USE_CNG_API
+# include <windows.h>
+# include <bcrypt.h>
+
+// these work on Windows >= 10
+# define BCRYPT_MD5_ALG_HANDLE    ((BCRYPT_ALG_HANDLE) 0x00000021)
+# define BCRYPT_SHA1_ALG_HANDLE   ((BCRYPT_ALG_HANDLE) 0x00000031)
+# define BCRYPT_SHA256_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x00000041)
+# define BCRYPT_SHA384_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x00000051)
+# define BCRYPT_SHA512_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x00000061)
+
+/* Initialize structure containing state of computation.
+ * (RFC 1321, 3.3: Step 3)
+ */
+
+static void generic_init(struct bcrypt_hash_ctx_t *ctx, BCRYPT_ALG_HANDLE alg_handle) {
+        DWORD hash_object_length = 0;
+        ULONG _unused;
+        NTSTATUS status;
+
+        status = BCryptGetProperty(alg_handle, BCRYPT_OBJECT_LENGTH, (PUCHAR)&hash_object_length, sizeof(DWORD), &_unused, 0);
+        mingw_die_if_error(status, "BCryptGetProperty");
+        status = BCryptGetProperty(alg_handle, BCRYPT_HASH_LENGTH, (PUCHAR)&ctx->output_size, sizeof(DWORD), &_unused, 0);
+        mingw_die_if_error(status, "BCryptGetProperty");
+
+
+        ctx->hash_obj = xmalloc(hash_object_length);
+
+        status = BCryptCreateHash(alg_handle, &ctx->handle, ctx->hash_obj, hash_object_length, NULL, 0, 0);
+        mingw_die_if_error(status, "BCryptCreateHash");
+}
+
+void FAST_FUNC md5_begin(md5_ctx_t *ctx)
+{
+        generic_init(ctx, BCRYPT_MD5_ALG_HANDLE);
+}
+
+void FAST_FUNC sha1_begin(sha1_ctx_t *ctx)
+{
+        generic_init(ctx, BCRYPT_SHA1_ALG_HANDLE);
+}
+
+/* Initialize structure containing state of computation.
+   (FIPS 180-2:5.3.2)  */
+void FAST_FUNC sha256_begin(sha256_ctx_t *ctx)
+{
+        generic_init(ctx, BCRYPT_SHA256_ALG_HANDLE);
+}
+
+#if ENABLE_SHA384SUM
+/* Initialize structure containing state of computation.
+   (FIPS 180-2:5.3.3)  */
+void FAST_FUNC sha384_begin(sha384_ctx_t *ctx)
+{
+        generic_init(ctx, BCRYPT_SHA384_ALG_HANDLE);
+}
+#endif /* ENABLE_SHA384SUM */
+
+#if NEED_SHA512
+/* Initialize structure containing state of computation.
+   (FIPS 180-2:5.3.4)  */
+void FAST_FUNC sha512_begin(sha512_ctx_t *ctx)
+{
+        generic_init(ctx, BCRYPT_SHA512_ALG_HANDLE);
+}
+#endif /* NEED_SHA512 */
+
+void FAST_FUNC generic_hash(struct bcrypt_hash_ctx_t *ctx, const void *buffer, size_t len)
+{
+        /*
+                for perf, no error checking here
+        */
+        /*NTSTATUS status = */ BCryptHashData(ctx->handle, (const PUCHAR)buffer, len, 0);
+        // mingw_die_if_error(status, "BCryptHashData");
+}
+
+unsigned FAST_FUNC generic_end(struct bcrypt_hash_ctx_t *ctx, void *resbuf)
+{
+        NTSTATUS status = BCryptFinishHash(ctx->handle, resbuf, ctx->output_size, 0);
+        mingw_die_if_error(status, "BCryptFinishHash");
+        BCryptDestroyHash(ctx->handle);
+        free(ctx->hash_obj);
+        return ctx->output_size;
+}
+#endif /* !ENABLE_FEATURE_USE_CNG_API */
 
 #if ENABLE_SHA1_HWACCEL || ENABLE_SHA256_HWACCEL
 # if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__))
@@ -80,6 +166,7 @@ static ALWAYS_INLINE uint64_t rotl64(uint64_t x, unsigned n)
         return (x << n) | (x >> (64 - n));
 }
 
+#if !ENABLE_FEATURE_USE_CNG_API
 /* Process the remaining bytes in the buffer */
 static void FAST_FUNC common64_end(md5_ctx_t *ctx, int swap_needed)
 {
@@ -1032,7 +1119,7 @@ static const sha_K_int sha_K[] ALIGN8 = {
         K(0x84c87814a1f0ab72ULL), K(0x8cc702081a6439ecULL),
         K(0x90befffa23631e28ULL), K(0xa4506cebde82bde9ULL),
         K(0xbef9a3f7b2c67915ULL), K(0xc67178f2e372532bULL),
-#if NEED_SHA512  /* [64]+ are used for sha512 only */
+#if NEED_SHA512  /* [64]+ are used for sha384 and sha512 only */
         K(0xca273eceea26619cULL), K(0xd186b8c721c0c207ULL),
         K(0xeada7dd6cde0eb1eULL), K(0xf57d4f7fee6ed178ULL),
         K(0x06f067aa72176fbaULL), K(0x0a637dc5a2c898a6ULL),
@@ -1229,11 +1316,20 @@ static const uint32_t init512_lo[] ALIGN4 = {
         0x137e2179,
 };
 #endif /* NEED_SHA512 */
-
-// Note: SHA-384 is identical to SHA-512, except that initial hash values are
-// 0xcbbb9d5dc1059ed8, 0x629a292a367cd507, 0x9159015a3070dd17, 0x152fecd8f70e5939,
-// 0x67332667ffc00b31, 0x8eb44a8768581511, 0xdb0c2e0d64f98fa7, 0x47b5481dbefa4fa4,
-// and the output is constructed by omitting last two 64-bit words of it.
+#if ENABLE_SHA384SUM
+static const uint64_t init384[] ALIGN8 = {
+        0,
+        0,
+        0xcbbb9d5dc1059ed8,
+        0x629a292a367cd507,
+        0x9159015a3070dd17,
+        0x152fecd8f70e5939,
+        0x67332667ffc00b31,
+        0x8eb44a8768581511,
+        0xdb0c2e0d64f98fa7,
+        0x47b5481dbefa4fa4,
+};
+#endif
 
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.2)  */
@@ -1255,9 +1351,19 @@ void FAST_FUNC sha256_begin(sha256_ctx_t *ctx)
 #endif
 }
 
-#if NEED_SHA512
+#if ENABLE_SHA384SUM
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.3)  */
+void FAST_FUNC sha384_begin(sha512_ctx_t *ctx)
+{
+        memcpy(&ctx->total64, init384, sizeof(init384));
+        /*ctx->total64[0] = ctx->total64[1] = 0; - already done */
+}
+#endif
+
+#if NEED_SHA512
+/* Initialize structure containing state of computation.
+   (FIPS 180-2:5.3.4)  */
 void FAST_FUNC sha512_begin(sha512_ctx_t *ctx)
 {
         int i;
@@ -1332,7 +1438,7 @@ unsigned FAST_FUNC sha1_end(sha1_ctx_t *ctx, void *resbuf)
 }
 
 #if NEED_SHA512
-unsigned FAST_FUNC sha512_end(sha512_ctx_t *ctx, void *resbuf)
+static unsigned FAST_FUNC sha512384_end(sha512_ctx_t *ctx, void *resbuf, unsigned outsize)
 {
         unsigned bufpos = ctx->total64[0] & 127;
 
@@ -1363,11 +1469,22 @@ unsigned FAST_FUNC sha512_end(sha512_ctx_t *ctx, void *resbuf)
                 for (i = 0; i < ARRAY_SIZE(ctx->hash); ++i)
                         ctx->hash[i] = SWAP_BE64(ctx->hash[i]);
         }
-        memcpy(resbuf, ctx->hash, sizeof(ctx->hash));
-        return sizeof(ctx->hash);
+        memcpy(resbuf, ctx->hash, outsize);
+        return outsize;
+}
+unsigned FAST_FUNC sha512_end(sha384_ctx_t *ctx, void *resbuf)
+{
+        return sha512384_end(ctx, resbuf, SHA512_OUTSIZE);
 }
 #endif /* NEED_SHA512 */
 
+#if ENABLE_SHA384SUM
+unsigned FAST_FUNC sha384_end(sha384_ctx_t *ctx, void *resbuf)
+{
+        return sha512384_end(ctx, resbuf, SHA384_OUTSIZE);
+}
+#endif
+#endif /* !ENABLE_FEATURE_USE_CNG_API */
 
 /*
  * The Keccak sponge function, designed by Guido Bertoni, Joan Daemen,
@@ -1904,6 +2021,8 @@ void FAST_FUNC sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len)
 
 unsigned FAST_FUNC sha3_end(sha3_ctx_t *ctx, void *resbuf)
 {
+        unsigned hash_len;
+
         /* Padding */
         uint8_t *buf = (uint8_t*)ctx->state;
         /*
@@ -1926,6 +2045,7 @@ unsigned FAST_FUNC sha3_end(sha3_ctx_t *ctx, void *resbuf)
         sha3_process_block72(ctx->state);
 
         /* Output */
-        memcpy(resbuf, ctx->state, 64);
-        return 64;
+        hash_len = (1600/8 - ctx->input_block_bytes) / 2;
+        memcpy(resbuf, ctx->state, hash_len);
+        return hash_len;
 }
diff --git a/libbb/hash_sha256_block.c b/libbb/hash_sha256_block.c
new file mode 100644
index 000000000..3c4366321
--- /dev/null
+++ b/libbb/hash_sha256_block.c
@@ -0,0 +1,19 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 Denys Vlasenko
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+//kbuild:lib-y += hash_sha256_block.o
+#include "libbb.h"
+
+void FAST_FUNC
+sha256_block(const void *in, size_t len, uint8_t hash[32])
+{
+        sha256_ctx_t ctx;
+        sha256_begin(&ctx);
+        sha256_hash(&ctx, in, len);
+        sha256_end(&ctx, hash);
+}
diff --git a/libbb/hash_sha256_hwaccel_x86-32.S b/libbb/hash_sha256_hwaccel_x86-32.S
index a0e4a571a..8d84055e8 100644
--- a/libbb/hash_sha256_hwaccel_x86-32.S
+++ b/libbb/hash_sha256_hwaccel_x86-32.S
@@ -34,21 +34,21 @@
 #define MSG             %xmm0
 #define STATE0          %xmm1
 #define STATE1          %xmm2
-#define MSGTMP0         %xmm3
-#define MSGTMP1         %xmm4
-#define MSGTMP2         %xmm5
-#define MSGTMP3         %xmm6
+#define MSG0            %xmm3
+#define MSG1            %xmm4
+#define MSG2            %xmm5
+#define MSG3            %xmm6
 
 #define XMMTMP          %xmm7
 
-#define SHUF(a,b,c,d) $(a+(b<<2)+(c<<4)+(d<<6))
+#define SHUF(a,b,c,d) $((a)+((b)<<2)+((c)<<4)+((d)<<6))
 
         .balign 8       # allow decoders to fetch at least 2 first insns
 sha256_process_block64_shaNI:
 
-        movu128         76+0*16(%eax), XMMTMP /* ABCD (little-endian dword order) */
+        movu128         76+0*16(%eax), XMMTMP /* ABCD (shown least-significant-dword-first) */
         movu128         76+1*16(%eax), STATE1 /* EFGH */
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         mova128         STATE1, STATE0
         /* ---          -------------- ABCD -- EFGH */
         shufps          SHUF(1,0,1,0), XMMTMP, STATE0 /* FEBA */
@@ -58,190 +58,208 @@ sha256_process_block64_shaNI:
         mova128         PSHUFFLE_BSWAP32_FLIP_MASK, XMMTMP
         movl            $K256+8*16, SHA256CONSTANTS
 
+// sha256rnds2 instruction uses only lower 64 bits of MSG.
+// The code below needs to move upper 64 bits to lower 64 bits
+// for the second sha256rnds2 invocation
+// (what remains in upper bits does not matter).
+// There are several ways to do it:
+// movhlps    MSG, MSG                // abcd -> cdcd (3 bytes of code)
+// shuf128_32 SHUF(2,3,n,n), MSG, MSG // abcd -> cdXX (4 bytes)
+// punpckhqdq MSG, MSG                // abcd -> cdcd (4 bytes)
+// unpckhpd   MSG, MSG                // abcd -> cdcd (4 bytes)
+// psrldq     $8, MSG                 // abcd -> cd00 (5 bytes)
+// palignr    $8, MSG, MSG            // abcd -> cdab (6 bytes, SSSE3 insn)
+#define MOVE_UPPER64_DOWN(reg) movhlps reg, reg
+//#define MOVE_UPPER64_DOWN(reg) shuf128_32 SHUF(2,3,0,0), reg, reg
+//#define MOVE_UPPER64_DOWN(reg) punpckhqdq reg, reg
+//#define MOVE_UPPER64_DOWN(reg) unpckhpd reg, reg
+//#define MOVE_UPPER64_DOWN(reg) psrldq $8, reg
+//#define MOVE_UPPER64_DOWN(reg) palignr $8, reg, reg
+
         /* Rounds 0-3 */
         movu128         0*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP0
+        mova128         MSG, MSG0
                 paddd           0*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 4-7 */
         movu128         1*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP1
+        mova128         MSG, MSG1
                 paddd           1*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 8-11 */
         movu128         2*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP2
+        mova128         MSG, MSG2
                 paddd           2*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 12-15 */
         movu128         3*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
 /* ...to here */
-        mova128         MSG, MSGTMP3
+        mova128         MSG, MSG3
                 paddd           3*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 16-19 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           4*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 20-23 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           5*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 24-27 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           6*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 28-31 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           7*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 32-35 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           8*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 36-39 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           9*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 40-43 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           10*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 44-47 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           11*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 48-51 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           12*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 52-55 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           13*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 56-59 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           14*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 60-63 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           15*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Write hash values back in the correct order */
         mova128         STATE0, XMMTMP
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         /* ---          -------------- HGDC -- FEBA */
         shufps          SHUF(3,2,3,2), STATE1, STATE0 /* ABCD */
         shufps          SHUF(1,0,1,0), STATE1, XMMTMP /* EFGH */
diff --git a/libbb/hash_sha256_hwaccel_x86-64.S b/libbb/hash_sha256_hwaccel_x86-64.S
index 172c2eae2..ee3abbd1f 100644
--- a/libbb/hash_sha256_hwaccel_x86-64.S
+++ b/libbb/hash_sha256_hwaccel_x86-64.S
@@ -34,24 +34,24 @@
 #define MSG             %xmm0
 #define STATE0          %xmm1
 #define STATE1          %xmm2
-#define MSGTMP0         %xmm3
-#define MSGTMP1         %xmm4
-#define MSGTMP2         %xmm5
-#define MSGTMP3         %xmm6
+#define MSG0            %xmm3
+#define MSG1            %xmm4
+#define MSG2            %xmm5
+#define MSG3            %xmm6
 
 #define XMMTMP          %xmm7
 
 #define SAVE0           %xmm8
 #define SAVE1           %xmm9
 
-#define SHUF(a,b,c,d) $(a+(b<<2)+(c<<4)+(d<<6))
+#define SHUF(a,b,c,d) $((a)+((b)<<2)+((c)<<4)+((d)<<6))
 
         .balign 8       # allow decoders to fetch at least 2 first insns
 sha256_process_block64_shaNI:
 
-        movu128         80+0*16(%rdi), XMMTMP /* ABCD (little-endian dword order) */
+        movu128         80+0*16(%rdi), XMMTMP /* ABCD (shown least-significant-dword-first) */
         movu128         80+1*16(%rdi), STATE1 /* EFGH */
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         mova128         STATE1, STATE0
         /* ---          -------------- ABCD -- EFGH */
         shufps          SHUF(1,0,1,0), XMMTMP, STATE0 /* FEBA */
@@ -65,185 +65,203 @@ sha256_process_block64_shaNI:
         mova128         STATE0, SAVE0
         mova128         STATE1, SAVE1
 
+// sha256rnds2 instruction uses only lower 64 bits of MSG.
+// The code below needs to move upper 64 bits to lower 64 bits
+// for the second sha256rnds2 invocation
+// (what remains in upper bits does not matter).
+// There are several ways to do it:
+// movhlps    MSG, MSG                // abcd -> cdcd (3 bytes of code)
+// shuf128_32 SHUF(2,3,n,n), MSG, MSG // abcd -> cdXX (4 bytes)
+// punpckhqdq MSG, MSG                // abcd -> cdcd (4 bytes)
+// unpckhpd   MSG, MSG                // abcd -> cdcd (4 bytes)
+// psrldq     $8, MSG                 // abcd -> cd00 (5 bytes)
+// palignr    $8, MSG, MSG            // abcd -> cdab (6 bytes, SSSE3 insn)
+#define MOVE_UPPER64_DOWN(reg) movhlps reg, reg
+//#define MOVE_UPPER64_DOWN(reg) shuf128_32 SHUF(2,3,0,0), reg, reg
+//#define MOVE_UPPER64_DOWN(reg) punpckhqdq reg, reg
+//#define MOVE_UPPER64_DOWN(reg) unpckhpd reg, reg
+//#define MOVE_UPPER64_DOWN(reg) psrldq $8, reg
+//#define MOVE_UPPER64_DOWN(reg) palignr $8, reg, reg
+
         /* Rounds 0-3 */
         movu128         0*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP0
+        mova128         MSG, MSG0
                 paddd           0*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 4-7 */
         movu128         1*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP1
+        mova128         MSG, MSG1
                 paddd           1*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 8-11 */
         movu128         2*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP2
+        mova128         MSG, MSG2
                 paddd           2*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 12-15 */
         movu128         3*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
 /* ...to here */
-        mova128         MSG, MSGTMP3
+        mova128         MSG, MSG3
                 paddd           3*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 16-19 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           4*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 20-23 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           5*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 24-27 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           6*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 28-31 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           7*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 32-35 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           8*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 36-39 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           9*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 40-43 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           10*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 44-47 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           11*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 48-51 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           12*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 52-55 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           13*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 56-59 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           14*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 60-63 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           15*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Add current hash values with previously saved */
@@ -252,7 +270,7 @@ sha256_process_block64_shaNI:
 
         /* Write hash values back in the correct order */
         mova128         STATE0, XMMTMP
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         /* ---          -------------- HGDC -- FEBA */
         shufps          SHUF(3,2,3,2), STATE1, STATE0 /* ABCD */
         shufps          SHUF(1,0,1,0), STATE1, XMMTMP /* EFGH */
diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index 8e2b37853..7dc39ca80 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -457,7 +457,7 @@ static void put_cur_glyph_and_inc_cursor(void)
                  * have automargin (IOW: it is moving cursor to next line
                  * by itself (which is wrong for VT-10x terminals)),
                  * this will break things: there will be one extra empty line */
-                puts("\r"); /* + implicit '\n' */
+                fputs("\r\n", stderr);
 #else
                 /* VT-10x terminals don't wrap cursor to next line when last char
                  * on the line is printed - cursor stays "over" this char.
@@ -1302,9 +1302,10 @@ static void showfiles(void)
                         );
                 }
                 if (ENABLE_UNICODE_SUPPORT)
-                        puts(printable_string(matches[n]));
+                        fputs(printable_string(matches[n]), stderr);
                 else
-                        puts(matches[n]);
+                        fputs(matches[n], stderr);
+                bb_putchar_stderr('\n');
         }
 }
 
@@ -1595,8 +1596,8 @@ unsigned FAST_FUNC size_from_HISTFILESIZE(const char *hp)
 # endif
         if (hp) {
                 size = atoi(hp);
-                if (size <= 0)
-                        return 1;
+                if (size < 0)
+                        return 0;
                 if (size > MAX_HISTORY)
                         return MAX_HISTORY;
         }
@@ -1690,18 +1691,21 @@ static void load_history(line_input_t *st_parm)
         /* NB: do not trash old history if file can't be opened */
 
         fp = fopen_for_read(st_parm->hist_file);
-        if (fp) {
-                /* clean up old history */
-                for (idx = st_parm->cnt_history; idx > 0;) {
-                        idx--;
-                        free(st_parm->history[idx]);
-                        st_parm->history[idx] = NULL;
-                }
+        if (!fp)
+                return;
+
+        /* clean up old history */
+        for (idx = st_parm->cnt_history; idx > 0;) {
+                idx--;
+                free(st_parm->history[idx]);
+                st_parm->history[idx] = NULL;
+        }
 
-                /* fill temp_h[], retaining only last MAX_HISTORY lines */
-                memset(temp_h, 0, sizeof(temp_h));
-                idx = 0;
-                st_parm->cnt_history_in_file = 0;
+        /* fill temp_h[], retaining only last max_history lines */
+        memset(temp_h, 0, sizeof(temp_h));
+        idx = 0;
+        st_parm->cnt_history_in_file = 0;
+        if (st_parm->max_history != 0) {
                 while ((line = xmalloc_fgetline(fp)) != NULL) {
                         if (line[0] == '\0') {
                                 free(line);
@@ -1714,34 +1718,34 @@ static void load_history(line_input_t *st_parm)
                         if (idx == st_parm->max_history)
                                 idx = 0;
                 }
-                fclose(fp);
-
-                /* find first non-NULL temp_h[], if any */
-                if (st_parm->cnt_history_in_file) {
-                        while (temp_h[idx] == NULL) {
-                                idx++;
-                                if (idx == st_parm->max_history)
-                                        idx = 0;
-                        }
-                }
+        }
+        fclose(fp);
 
-                /* copy temp_h[] to st_parm->history[] */
-                for (i = 0; i < st_parm->max_history;) {
-                        line = temp_h[idx];
-                        if (!line)
-                                break;
+        /* find first non-NULL temp_h[], if any */
+        if (st_parm->cnt_history_in_file != 0) {
+                while (temp_h[idx] == NULL) {
                         idx++;
                         if (idx == st_parm->max_history)
                                 idx = 0;
-                        line_len = strlen(line);
-                        if (line_len >= MAX_LINELEN)
-                                line[MAX_LINELEN-1] = '\0';
-                        st_parm->history[i++] = line;
                 }
-                st_parm->cnt_history = i;
-                if (ENABLE_FEATURE_EDITING_SAVE_ON_EXIT)
-                        st_parm->cnt_history_in_file = i;
         }
+
+        /* copy temp_h[] to st_parm->history[] */
+        for (i = 0; i < st_parm->max_history;) {
+                line = temp_h[idx];
+                if (!line)
+                        break;
+                idx++;
+                if (idx == st_parm->max_history)
+                        idx = 0;
+                line_len = strlen(line);
+                if (line_len >= MAX_LINELEN)
+                        line[MAX_LINELEN-1] = '\0';
+                st_parm->history[i++] = line;
+        }
+        st_parm->cnt_history = i;
+        if (ENABLE_FEATURE_EDITING_SAVE_ON_EXIT)
+                st_parm->cnt_history_in_file = i;
 }
 
 #  if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
@@ -1749,17 +1753,27 @@ void FAST_FUNC save_history(line_input_t *st)
 {
         FILE *fp;
 
-        if (!st || !st->hist_file)
+        /* bash compat: HISTFILE="" disables history saving */
+        if (!st || !st->hist_file || !st->hist_file[0])
                 return;
         if (st->cnt_history <= st->cnt_history_in_file)
-                return;
+                return; /* no new entries were added */
+        /* note: if st->max_history is 0, we do not abort: we truncate the history to 0 lines */
 
-        fp = fopen(st->hist_file, "a");
+        fp = fopen(st->hist_file, (st->max_history == 0 ? "w" : "a"));
         if (fp) {
                 int i, fd;
                 char *new_name;
                 line_input_t *st_temp;
 
+                /* max_history==0 needs special-casing in general code,
+                 * just handle it in a simpler way: */
+                if (st->max_history == 0) {
+                        /* fopen("w") already truncated it */
+                        fclose(fp);
+                        return;
+                }
+
                 for (i = st->cnt_history_in_file; i < st->cnt_history; i++)
                         fprintf(fp, "%s\n", st->history[i]);
                 fclose(fp);
@@ -1769,6 +1783,8 @@ void FAST_FUNC save_history(line_input_t *st)
                 st_temp = new_line_input_t(st->flags);
                 st_temp->hist_file = st->hist_file;
                 st_temp->max_history = st->max_history;
+                /* load no more than max_history last lines */
+                /* (in unlikely case that file disappeared, st_temp gets empty history) */
                 load_history(st_temp);
 
                 /* write out temp file and replace hist_file atomically */
@@ -1792,13 +1808,13 @@ static void save_history(char *str)
         int fd;
         int len, len2;
 
-        if (!state->hist_file)
+        /* bash compat: HISTFILE="" disables history saving */
+        if (!state->hist_file || !state->hist_file[0])
                 return;
 
         fd = open(state->hist_file, O_WRONLY | O_CREAT | O_APPEND, 0600);
         if (fd < 0)
                 return;
-        xlseek(fd, 0, SEEK_END); /* paranoia */
         len = strlen(str);
         str[len] = '\n'; /* we (try to) do atomic write */
         len2 = full_write(fd, str, len + 1);
@@ -1853,13 +1869,10 @@ static void remember_in_history(char *str)
         if (str[0] == '\0')
                 return;
         i = state->cnt_history;
-        /* Don't save dupes */
-        if (i && strcmp(state->history[i-1], str) == 0)
+        /* Don't save dups */
+        if (i != 0 && strcmp(state->history[i-1], str) == 0)
                 return;
 
-        free(state->history[state->max_history]); /* redundant, paranoia */
-        state->history[state->max_history] = NULL; /* redundant, paranoia */
-
         /* If history[] is full, remove the oldest command */
         /* we need to keep history[state->max_history] empty, hence >=, not > */
         if (i >= state->max_history) {
@@ -1872,7 +1885,7 @@ static void remember_in_history(char *str)
                         state->cnt_history_in_file--;
 # endif
         }
-        /* i <= state->max_history-1 */
+        /* i < state->max_history */
         state->history[i++] = xstrdup(str);
         /* i <= state->max_history */
         state->cur_history = i;
@@ -2260,7 +2273,7 @@ static void parse_and_put_prompt(const char *prmt_ptr)
                                         if (c == 'w')
                                                 break;
                                         cp = strrchr(pbuf, '/');
-                                        if (cp)
+                                        if (cp && cp[1])
                                                 pbuf = (char*)cp + 1;
                                         break;
 // bb_process_escape_sequence does this now:
@@ -2388,7 +2401,6 @@ static int lineedit_read_key(char *read_key_buffer, int timeout)
                                 errno = EINTR;
                                 return -1;
                         }
-//FIXME: still races here with signals, but small window to poll() inside read_key
                         IF_FEATURE_EDITING_WINCH(S.ok_to_redraw = 1;)
                         /* errno = 0; - read_key does this itself */
                         ic = read_key(STDIN_FILENO, read_key_buffer, timeout);
diff --git a/libbb/poll_with_signals.c b/libbb/poll_with_signals.c
new file mode 100644
index 000000000..d3c005418
--- /dev/null
+++ b/libbb/poll_with_signals.c
@@ -0,0 +1,48 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_PLATFORM_POSIX) += poll_with_signals.o
+
+#include "libbb.h"
+
+/* Shells, for example, need their line input and "read" builtin
+ * to be interruptible, and the naive handling of it a-la:
+ *      if (bb_got_signal) {
+ *              errno = EINTR;
+ *              return -1;
+ *      }
+ *      poll(pfd, 1, -1); // signal here would set EINTR
+ * is racy.
+ * This is a bit heavy-handed, but safe wrt races:
+ */
+int FAST_FUNC check_got_signal_and_poll(struct pollfd pfd[1], int timeout)
+{
+        int n;
+        struct timespec tv;
+        sigset_t orig_mask;
+
+        if (bb_got_signal) /* optimization */
+                goto eintr;
+
+        if (timeout >= 0) {
+                tv.tv_sec = timeout / 1000;
+                tv.tv_nsec = (timeout % 1000) * 1000000;
+        }
+        /* test bb_got_signal, then poll(), atomically wrt signals */
+        sigfillset(&orig_mask);
+        sigprocmask2(SIG_BLOCK, &orig_mask);
+        if (bb_got_signal) {
+                sigprocmask2(SIG_SETMASK, &orig_mask);
+ eintr:
+                errno = EINTR; /* inform the caller that we got a signal */
+                return -1;
+        }
+        n = ppoll(pfd, 1, timeout >= 0 ? &tv : NULL, &orig_mask);
+        sigprocmask2(SIG_SETMASK, &orig_mask);
+        return n;
+}
diff --git a/libbb/procps.c b/libbb/procps.c
index 8c9cac125..dfea8af6b 100644
--- a/libbb/procps.c
+++ b/libbb/procps.c
@@ -110,7 +110,7 @@ void FAST_FUNC free_procps_scan(procps_status_t* sp)
 }
 
 #if ENABLE_FEATURE_TOPMEM || ENABLE_PMAP
-static unsigned long long fast_strtoull_16(char **endptr)
+unsigned long long FAST_FUNC fast_strtoull_16(char **endptr)
 {
         unsigned char c;
         char *str = *endptr;
@@ -131,7 +131,7 @@ static unsigned long long fast_strtoull_16(char **endptr)
 
 #if ENABLE_FEATURE_FAST_TOP || ENABLE_FEATURE_TOPMEM || ENABLE_PMAP
 /* We cut a lot of corners here for speed */
-static unsigned long fast_strtoul_10(char **endptr)
+unsigned long FAST_FUNC fast_strtoul_10(char **endptr)
 {
         unsigned char c;
         char *str = *endptr;
@@ -144,6 +144,24 @@ static unsigned long fast_strtoul_10(char **endptr)
         *endptr = str + 1; /* We skip trailing space! */
         return n;
 }
+# if LONG_MAX < LLONG_MAX
+/* For VSZ, which can be very large */
+static unsigned long long fast_strtoull_10(char **endptr)
+{
+        unsigned char c;
+        char *str = *endptr;
+        unsigned long long n = *str - '0';
+
+        /* Need to stop on both ' ' and '\n' */
+        while ((c = *++str) > ' ')
+                n = n*10 + (c - '0');
+
+        *endptr = str + 1; /* We skip trailing space! */
+        return n;
+}
+# else
+#  define fast_strtoull_10(endptr) fast_strtoul_10(endptr)
+# endif
 
 # if ENABLE_FEATURE_FAST_TOP
 static long fast_strtol_10(char **endptr)
@@ -156,7 +174,7 @@ static long fast_strtol_10(char **endptr)
 }
 # endif
 
-static char *skip_fields(char *str, int count)
+char* FAST_FUNC skip_fields(char *str, int count)
 {
         do {
                 while (*str++ != ' ')
@@ -167,35 +185,25 @@ static char *skip_fields(char *str, int count)
 }
 #endif
 
-#if ENABLE_FEATURE_TOPMEM || ENABLE_PMAP
-static char* skip_whitespace_if_prefixed_with(char *buf, const char *prefix)
+#if ENABLE_FEATURE_TOPMEM
+static NOINLINE void procps_read_smaps(pid_t pid, procps_status_t *sp)
 {
-        char *tp = is_prefixed_with(buf, prefix);
-        if (tp) {
-                tp = skip_whitespace(tp);
-        }
-        return tp;
-}
+        // There is A LOT of /proc/PID/smaps data on a big system.
+        // Optimize this for speed, makes "top -m" faster.
+//TODO large speedup:
+//read /proc/PID/smaps_rollup (cumulative stats of all mappings, much faster)
+//and  /proc/PID/maps         to get mapped_ro and mapped_rw (IOW: VSZ,VSZRW)
 
-int FAST_FUNC procps_read_smaps(pid_t pid, struct smaprec *total,
-                void (*cb)(struct smaprec *, void *), void *data)
-{
         FILE *file;
-        struct smaprec currec;
         char filename[sizeof("/proc/%u/smaps") + sizeof(int)*3];
-        char buf[PROCPS_BUFSIZE];
-#if !ENABLE_PMAP
-        void (*cb)(struct smaprec *, void *) = NULL;
-        void *data = NULL;
-#endif
+        char buf[PROCPS_BUFSIZE] ALIGN4;
 
         sprintf(filename, "/proc/%u/smaps", (int)pid);
 
         file = fopen_for_read(filename);
         if (!file)
-                return 1;
+                return;
 
-        memset(&currec, 0, sizeof(currec));
         while (fgets(buf, PROCPS_BUFSIZE, file)) {
                 // Each mapping datum has this form:
                 // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
@@ -203,80 +211,60 @@ int FAST_FUNC procps_read_smaps(pid_t pid, struct smaprec *total,
                 // Rss:                 nnn kB
                 // .....
 
-                char *tp, *p;
-
+                char *tp;
+#define bytes4 *(uint32_t*)buf
+#define Priv   PACK32_BYTES('P','r','i','v')
+#define Shar   PACK32_BYTES('S','h','a','r')
 #define SCAN(S, X) \
-                if ((tp = skip_whitespace_if_prefixed_with(buf, S)) != NULL) { \
-                        total->X += currec.X = fast_strtoul_10(&tp); \
-                        continue;                                    \
+if (memcmp(buf+4, S, sizeof(S)-1) == 0) { \
+        tp = skip_whitespace(buf+4 + sizeof(S)-1); \
+        sp->X += fast_strtoul_10(&tp); \
+        continue; \
+}
+                if (bytes4 == Priv) {
+                        SCAN("ate_Dirty:", private_dirty)
+                        SCAN("ate_Clean:", private_clean)
                 }
-                if (cb) {
-                        SCAN("Pss:"  , smap_pss     );
-                        SCAN("Swap:" , smap_swap    );
+                if (bytes4 == Shar) {
+                        SCAN("ed_Dirty:" , shared_dirty )
+                        SCAN("ed_Clean:" , shared_clean )
                 }
-                SCAN("Private_Dirty:", private_dirty);
-                SCAN("Private_Clean:", private_clean);
-                SCAN("Shared_Dirty:" , shared_dirty );
-                SCAN("Shared_Clean:" , shared_clean );
+#undef bytes4
+#undef Priv
+#undef Shar
 #undef SCAN
                 tp = strchr(buf, '-');
                 if (tp) {
                         // We reached next mapping - the line of this form:
                         // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
 
-                        if (cb) {
-                                /* If we have a previous record, there's nothing more
-                                 * for it, call the callback and clear currec
-                                 */
-                                if (currec.smap_size)
-                                        cb(&currec, data);
-                                free(currec.smap_name);
-                        }
-                        memset(&currec, 0, sizeof(currec));
+                        char *rwx;
+                        unsigned long long sz;
 
                         *tp = ' ';
                         tp = buf;
-                        currec.smap_start = fast_strtoull_16(&tp);
-                        currec.smap_size = (fast_strtoull_16(&tp) - currec.smap_start) >> 10;
-
-                        strncpy(currec.smap_mode, tp, sizeof(currec.smap_mode)-1);
-
+                        sz = fast_strtoull_16(&tp); // start
+                        sz = (fast_strtoull_16(&tp) - sz) >> 10; // end - start
+                        // tp -> "rw-s" string
+                        rwx = tp;
                         // skipping "rw-s FILEOFS M:m INODE "
                         tp = skip_whitespace(skip_fields(tp, 4));
-                        // filter out /dev/something (something != zero)
-                        if (!is_prefixed_with(tp, "/dev/") || strcmp(tp, "/dev/zero\n") == 0) {
-                                if (currec.smap_mode[1] == 'w') {
-                                        currec.mapped_rw = currec.smap_size;
-                                        total->mapped_rw += currec.smap_size;
-                                } else if (currec.smap_mode[1] == '-') {
-                                        currec.mapped_ro = currec.smap_size;
-                                        total->mapped_ro += currec.smap_size;
-                                }
+                        // if not a device memory mapped...
+                        if (memcmp(tp, "/dev/", 5) != 0    // not "/dev/something"
+                         || strcmp(tp + 5, "zero\n") == 0  // or is "/dev/zero" (which isn't a device)
+                        ) {
+                                if (rwx[1] == 'w')
+                                        sp->mapped_rw += sz;
+                                else if (rwx[0] == 'r' || rwx[2] == 'x')
+                                        sp->mapped_ro += sz;
+                                // else: seen "---p" mappings (mmap guard gaps?),
+                                // do NOT account these as VSZ, they aren't really
                         }
-
                         if (strcmp(tp, "[stack]\n") == 0)
-                                total->stack += currec.smap_size;
-                        if (cb) {
-                                p = skip_non_whitespace(tp);
-                                if (p == tp) {
-                                        currec.smap_name = xstrdup("  [ anon ]");
-                                } else {
-                                        *p = '\0';
-                                        currec.smap_name = xstrdup(tp);
-                                }
-                        }
-                        total->smap_size += currec.smap_size;
+                                sp->stack += sz;
                 }
         }
         fclose(file);
-
-        if (cb) {
-                if (currec.smap_size)
-                        cb(&currec, data);
-                free(currec.smap_name);
-        }
-
-        return 0;
 }
 #endif
 
@@ -371,7 +359,8 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
                         char *cp, *comm1;
                         int tty;
 #if !ENABLE_FEATURE_FAST_TOP
-                        unsigned long vsz, rss;
+                        unsigned long long vsz;
+                        unsigned long rss;
 #endif
                         /* see proc(5) for some details on this */
                         strcpy(filename_tail, "stat");
@@ -397,7 +386,7 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
                                 "%ld "                 /* nice */
                                 "%*s %*s "             /* timeout, it_real_value */
                                 "%lu "                 /* start_time */
-                                "%lu "                 /* vsize */
+                                "%llu "                /* vsize - can be very large */
                                 "%lu "                 /* rss */
 # if ENABLE_FEATURE_TOP_SMP_PROCESS
                                 "%*s %*s %*s %*s %*s %*s " /*rss_rlim, start_code, end_code, start_stack, kstk_esp, kstk_eip */
@@ -450,7 +439,7 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
                         cp = skip_fields(cp, 2); /* timeout, it_real_value */
                         sp->start_time = fast_strtoul_10(&cp);
                         /* vsz is in bytes and we want kb */
-                        sp->vsz = fast_strtoul_10(&cp) >> 10;
+                        sp->vsz = fast_strtoull_10(&cp) >> 10;
                         /* vsz is in bytes but rss is in *PAGES*! Can you believe that? */
                         sp->rss = fast_strtoul_10(&cp) << sp->shift_pages_to_kb;
 # if ENABLE_FEATURE_TOP_SMP_PROCESS
@@ -484,7 +473,7 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
 
 #if ENABLE_FEATURE_TOPMEM
                 if (flags & PSSCAN_SMAPS)
-                        procps_read_smaps(pid, &sp->smaps, NULL, NULL);
+                        procps_read_smaps(pid, sp);
 #endif /* TOPMEM */
 #if ENABLE_FEATURE_PS_ADDITIONAL_COLUMNS
                 if (flags & PSSCAN_RUIDGID) {
@@ -567,36 +556,45 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
         return sp;
 }
 
-void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
+int FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
 {
         int sz;
         char filename[sizeof("/proc/%u/cmdline") + sizeof(int)*3];
 
         sprintf(filename, "/proc/%u/cmdline", pid);
         sz = open_read_close(filename, buf, col - 1);
+        if (sz < 0)
+                return sz;
         if (sz > 0) {
-                const char *base;
+                const char *program_basename;
                 int comm_len;
 
                 buf[sz] = '\0';
                 while (--sz >= 0 && buf[sz] == '\0')
                         continue;
-                /* Prevent basename("process foo/bar") = "bar" */
-                strchrnul(buf, ' ')[0] = '\0';
-                base = bb_basename(buf); /* before we replace argv0's NUL with space */
+
+                /* Find "program" in "[-][/PATH/TO/]program" */
+                strchrnul(buf, ' ')[0] = '\0'; /* prevent basename("program foo/bar") = "bar" */
+                program_basename = bb_basename(buf[0] == '-' ? buf + 1 : buf);
+                /* ^^^ note: must do it *before* replacing argv0's NUL with space */
+
+                /* Prevent stuff like this:
+                 *  echo 'sleep 999; exit' >`printf '\ec'`; sh ?c
+                 * messing up top and ps output (or worse).
+                 * This also replaces NULs with spaces, converting
+                 * list of NUL-strings into one string.
+                 */
                 while (sz >= 0) {
                         if ((unsigned char)(buf[sz]) < ' ')
-                                buf[sz] = ' ';
+                                buf[sz] = (buf[sz] ? /*ctrl*/'?' : /*NUL*/' ');
                         sz--;
                 }
-                if (base[0] == '-') /* "-sh" (login shell)? */
-                        base++;
 
                 /* If comm differs from argv0, prepend "{comm} ".
                  * It allows to see thread names set by prctl(PR_SET_NAME).
                  */
                 if (!comm)
-                        return;
+                        return 0;
                 comm_len = strlen(comm);
                 /* Why compare up to comm_len, not COMM_LEN-1?
                  * Well, some processes rewrite argv, and use _spaces_ there
@@ -604,19 +602,20 @@ void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
                  * I prefer to still treat argv0 "process foo bar"
                  * as 'equal' to comm "process".
                  */
-                if (strncmp(base, comm, comm_len) != 0) {
+                if (strncmp(program_basename, comm, comm_len) != 0) {
                         comm_len += 3;
                         if (col > comm_len)
                                 memmove(buf + comm_len, buf, col - comm_len);
                         snprintf(buf, col, "{%s}", comm);
                         if (col <= comm_len)
-                                return;
+                                return 0;
                         buf[comm_len - 1] = ' ';
                         buf[col - 1] = '\0';
                 }
         } else {
                 snprintf(buf, col, "[%s]", comm ? comm : "?");
         }
+        return 0;
 }
 
 #endif  /* ENABLE_PLATFORM_MINGW32 */
diff --git a/libbb/pw_ascii64.c b/libbb/pw_ascii64.c
new file mode 100644
index 000000000..3993932ca
--- /dev/null
+++ b/libbb/pw_ascii64.c
@@ -0,0 +1,91 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 1999-2004 by Erik Andersen <andersen@codepoet.org>
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+
+/* Returns >=64 for invalid chars */
+int FAST_FUNC a2i64(char c)
+{
+        unsigned char ch = c;
+        if (ch >= 'a')
+                /* "a..z" to 38..63 */
+                /* anything after "z": positive int >= 64 */
+                return (ch - 'a' + 38);
+
+        if (ch > 'Z')
+                /* after "Z" but before "a": positive byte >= 64 */
+                return ch;
+
+        if (ch >= 'A')
+                /* "A..Z" to 12..37 */
+                return (ch - 'A' + 12);
+
+        if (ch > '9')
+                return 64;
+
+        /* "./0123456789" to 0,1,2..11 */
+        /* anything before "." becomes positive byte >= 64 */
+        return (unsigned char)(ch - '.');
+}
+
+/* 0..63 ->
+ * "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+ */
+int FAST_FUNC i2a64(int i)
+{
+        i &= 0x3f;
+
+        i += '.';
+        /* the above maps 0..11 to "./0123456789":
+         * ACSII codes of "./" are ('0'-2) and ('0'-1) */
+
+        if (i > '9')
+                i += ('A' - '9' - 1);
+        if (i > 'Z')
+                i += ('a' - 'Z' - 1);
+        return i;
+}
+
+char* FAST_FUNC
+num2str64_lsb_first(char *s, unsigned v, int n)
+{
+        while (--n >= 0) {
+                *s++ = i2a64(v);
+                v >>= 6;
+        }
+        return s;
+}
+
+static void
+num2str64_4chars_msb_first(char *s, unsigned v)
+{
+        *s++ = i2a64(v >> 18); /* bits 23..18 */
+        *s++ = i2a64(v >> 12); /* bits 17..12 */
+        *s++ = i2a64(v >> 6); /* bits 11..6 */
+        *s   = i2a64(v); /* bits 5..0 */
+}
+
+int FAST_FUNC crypt_make_rand64encoded(char *p, int cnt /*, int x */)
+{
+        /* was: x += ... */
+        unsigned x = getpid() + monotonic_us();
+        do {
+                /* x = (x*1664525 + 1013904223) % 2^32 generator is lame
+                 * (low-order bit is not "random", etc...),
+                 * but for our purposes it is good enough */
+                x = x*1664525 + 1013904223;
+                /* BTW, Park and Miller's "minimal standard generator" is
+                 * x = x*16807 % ((2^31)-1)
+                 * It has no problem with visibly alternating lowest bit
+                 * but is also weak in cryptographic sense + needs div,
+                 * which needs more code (and slower) on many CPUs */
+                *p++ = i2a64(x >> 16);
+                *p++ = i2a64(x >> 22);
+        } while (--cnt);
+        *p = '\0';
+        return x;
+}
diff --git a/libbb/pw_encrypt.c b/libbb/pw_encrypt.c
index 3463fd95b..93653de9f 100644
--- a/libbb/pw_encrypt.c
+++ b/libbb/pw_encrypt.c
@@ -13,48 +13,11 @@
 #endif
 #include "libbb.h"
 
-/* static const uint8_t ascii64[] ALIGN1 =
- * "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
- */
-
-static int i64c(int i)
-{
-        i &= 0x3f;
-        if (i == 0)
-                return '.';
-        if (i == 1)
-                return '/';
-        if (i < 12)
-                return ('0' - 2 + i);
-        if (i < 38)
-                return ('A' - 12 + i);
-        return ('a' - 38 + i);
-}
-
-int FAST_FUNC crypt_make_salt(char *p, int cnt /*, int x */)
-{
-        /* was: x += ... */
-        unsigned x = getpid() + monotonic_us();
-        do {
-                /* x = (x*1664525 + 1013904223) % 2^32 generator is lame
-                 * (low-order bit is not "random", etc...),
-                 * but for our purposes it is good enough */
-                x = x*1664525 + 1013904223;
-                /* BTW, Park and Miller's "minimal standard generator" is
-                 * x = x*16807 % ((2^31)-1)
-                 * It has no problem with visibly alternating lowest bit
-                 * but is also weak in cryptographic sense + needs div,
-                 * which needs more code (and slower) on many CPUs */
-                *p++ = i64c(x >> 16);
-                *p++ = i64c(x >> 22);
-        } while (--cnt);
-        *p = '\0';
-        return x;
-}
+#include "pw_ascii64.c"
 
 char* FAST_FUNC crypt_make_pw_salt(char salt[MAX_PW_SALT_LEN], const char *algo)
 {
-        int len = 2/2;
+        int len = 2 / 2;
         char *salt_ptr = salt;
 
         /* Standard chpasswd uses uppercase algos ("MD5", not "md5").
@@ -67,28 +30,61 @@ char* FAST_FUNC crypt_make_pw_salt(char salt[MAX_PW_SALT_LEN], const char *algo)
                 *salt_ptr++ = '$';
 #if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_SHA
                 if ((algo[0]|0x20) == 's') { /* sha */
-                        salt[1] = '5' + (strcasecmp(algo, "sha512") == 0);
-                        len = 16/2;
+                        salt[1] = '5' + (strncasecmp(algo, "sha512", 6) == 0);
+                        len = 16 / 2;
+                }
+#endif
+#if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_YES
+                if ((algo[0]|0x20) == 'y') { /* yescrypt */
+                        int rnd;
+                        salt[1] = 'y';
+// The "j9T$" below is the default "yescrypt parameters" encoded by yescrypt_encode_params_r():
+//shadow-4.17.4/src/passwd.c
+//      salt = crypt_make_salt(NULL, NULL);
+//shadow-4.17.4/lib/salt.c
+//const char *crypt_make_salt(const char *meth, void *arg)
+//      if (streq(method, "YESCRYPT")) {
+//              MAGNUM(result, 'y');
+//              salt_len = YESCRYPT_SALT_SIZE; // 24
+//              rounds = YESCRYPT_get_salt_cost(arg);  // always Y_COST_DEFAULT == 5 for NULL arg
+//              YESCRYPT_salt_cost_to_buf(result, rounds); // always "j9T$"
+//      char *retval = crypt_gensalt(result, rounds, NULL, 0);
+//libxcrypt-4.4.38/lib/crypt-yescrypt.c
+//void gensalt_yescrypt_rn (unsigned long count,
+//                     const uint8_t *rbytes, size_t nrbytes,
+//                     uint8_t *output, size_t o_size)
+//  yescrypt_params_t params = {
+//    .flags = YESCRYPT_DEFAULTS,
+//    .p = 1,
+//  };
+//  if (count < 3) ... else
+//      params.r = 32;                  // N in 4KiB
+//      params.N = 1ULL << (count + 7); // 3 -> 1024, 4 -> 2048, ... 11 -> 262144
+//  yescrypt_encode_params_r(&params, rbytes, nrbytes, outbuf, o_size) // always "$y$j9T$<random>"
+                        len = 22 / 2;
+                        salt_ptr = stpcpy(salt_ptr, "j9T$");
+                        /* append 2*len random chars */
+                        rnd = crypt_make_rand64encoded(salt_ptr, len);
+                        /* fix up last char: it must be in 0..3 range (encoded as one of "./01").
+                         * IOW: salt_ptr[20..21] encode 16th random byte, must not be > 0xff.
+                         * Without this, we can generate salts which are rejected
+                         * by implementations with more strict salt length check.
+                         */
+                        salt_ptr[21] = i2a64(rnd & 3);
+                        /* For "mkpasswd -m yescrypt PASS j9T$<salt>" use case,
+                         * "j9T$" is considered part of salt,
+                         * need to return pointer to 'j'. Without -4,
+                         * we'd end up using "j9T$j9T$<salt>" as salt.
+                         */
+                        return salt_ptr - 4;
                 }
 #endif
         }
-        crypt_make_salt(salt_ptr, len);
+        crypt_make_rand64encoded(salt_ptr, len); /* appends 2*len random chars */
         return salt_ptr;
 }
 
 #if ENABLE_USE_BB_CRYPT
-
-static char*
-to64(char *s, unsigned v, int n)
-{
-        while (--n >= 0) {
-                /* *s++ = ascii64[v & 0x3f]; */
-                *s++ = i64c(v);
-                v >>= 6;
-        }
-        return s;
-}
-
 /*
  * DES and MD5 crypt implementations are taken from uclibc.
  * They were modified to not use static buffers.
@@ -99,6 +95,9 @@ to64(char *s, unsigned v, int n)
 #if ENABLE_USE_BB_CRYPT_SHA
 #include "pw_encrypt_sha.c"
 #endif
+#if ENABLE_USE_BB_CRYPT_YES
+#include "pw_encrypt_yes.c"
+#endif
 
 /* Other advanced crypt ids (TODO?): */
 /* $2$ or $2a$: Blowfish */
@@ -109,7 +108,7 @@ static struct des_ctx *des_ctx;
 /* my_crypt returns malloc'ed data */
 static char *my_crypt(const char *key, const char *salt)
 {
-        /* MD5 or SHA? */
+        /* "$x$...." string? */
         if (salt[0] == '$' && salt[1] && salt[2] == '$') {
                 if (salt[1] == '1')
                         return md5_crypt(xzalloc(MD5_OUT_BUFSIZE), (unsigned char*)key, (unsigned char*)salt);
@@ -117,6 +116,10 @@ static char *my_crypt(const char *key, const char *salt)
                 if (salt[1] == '5' || salt[1] == '6')
                         return sha_crypt((char*)key, (char*)salt);
 #endif
+#if ENABLE_USE_BB_CRYPT_YES
+                if (salt[1] == 'y')
+                        return yes_crypt(key, salt);
+#endif
         }
 
         if (!des_cctx)
diff --git a/libbb/pw_encrypt_des.c b/libbb/pw_encrypt_des.c
index fe8237cfe..ca8aa9bcc 100644
--- a/libbb/pw_encrypt_des.c
+++ b/libbb/pw_encrypt_des.c
@@ -186,39 +186,9 @@ static const uint8_t pbox[32] ALIGN1 = {
          2,  8, 24, 14, 32, 27,  3,  9, 19, 13, 30,  6, 22, 11,  4, 25
 };
 
-static const uint32_t bits32[32] ALIGN4 = {
-        0x80000000, 0x40000000, 0x20000000, 0x10000000,
-        0x08000000, 0x04000000, 0x02000000, 0x01000000,
-        0x00800000, 0x00400000, 0x00200000, 0x00100000,
-        0x00080000, 0x00040000, 0x00020000, 0x00010000,
-        0x00008000, 0x00004000, 0x00002000, 0x00001000,
-        0x00000800, 0x00000400, 0x00000200, 0x00000100,
-        0x00000080, 0x00000040, 0x00000020, 0x00000010,
-        0x00000008, 0x00000004, 0x00000002, 0x00000001
-};
-
 static const uint8_t bits8[8] ALIGN1 = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
 
 
-static int
-ascii_to_bin(char ch)
-{
-        if (ch > 'z')
-                return 0;
-        if (ch >= 'a')
-                return (ch - 'a' + 38);
-        if (ch > 'Z')
-                return 0;
-        if (ch >= 'A')
-                return (ch - 'A' + 12);
-        if (ch > '9')
-                return 0;
-        if (ch >= '.')
-                return (ch - '.');
-        return 0;
-}
-
-
 /* Static stuff that stays resident and doesn't change after
  * being initialized, and therefore doesn't need to be made
  * reentrant. */
@@ -354,11 +324,18 @@ des_init(struct des_ctx *ctx, const struct const_des_ctx *cctx)
         int i, j, b, k, inbit, obit;
         uint32_t p;
         const uint32_t *bits28, *bits24;
+        uint32_t bits32[32];
 
         if (!ctx)
                 ctx = xmalloc(sizeof(*ctx));
         const_ctx = cctx;
 
+        p = 0x80000000U;
+        for (i = 0; p; i++) {
+                bits32[i] = p;
+                p >>= 1;
+        }
+
 #if USE_REPETITIVE_SPEEDUP
         old_rawkey0 = old_rawkey1 = 0;
         old_salt = 0;
@@ -694,21 +671,6 @@ do_des(struct des_ctx *ctx, /*uint32_t l_in, uint32_t r_in,*/ uint32_t *l_out, u
 
 #define DES_OUT_BUFSIZE 21
 
-static void
-to64_msb_first(char *s, unsigned v)
-{
-#if 0
-        *s++ = ascii64[(v >> 18) & 0x3f]; /* bits 23..18 */
-        *s++ = ascii64[(v >> 12) & 0x3f]; /* bits 17..12 */
-        *s++ = ascii64[(v >> 6) & 0x3f]; /* bits 11..6 */
-        *s   = ascii64[v & 0x3f]; /* bits 5..0 */
-#endif
-        *s++ = i64c(v >> 18); /* bits 23..18 */
-        *s++ = i64c(v >> 12); /* bits 17..12 */
-        *s++ = i64c(v >> 6); /* bits 11..6 */
-        *s   = i64c(v); /* bits 5..0 */
-}
-
 static char *
 NOINLINE
 des_crypt(struct des_ctx *ctx, char output[DES_OUT_BUFSIZE],
@@ -740,44 +702,28 @@ des_crypt(struct des_ctx *ctx, char output[DES_OUT_BUFSIZE],
          */
         output[0] = salt_str[0];
         output[1] = salt_str[1];
-        salt = (ascii_to_bin(salt_str[1]) << 6)
-             |  ascii_to_bin(salt_str[0]);
+
+        salt = a2i64(salt_str[0]);
+        if (salt >= 64)
+                return NULL; /* bad salt char */
+        salt |= (a2i64(salt_str[1]) << 6);
+        if (salt >= (64 << 6))
+                return NULL; /* bad salt char */
         setup_salt(ctx, salt); /* set ctx->saltbits for do_des() */
 
         /* Do it. */
         do_des(ctx, /*0, 0,*/ &r0, &r1, 25 /* count */);
 
         /* Now encode the result. */
-#if 0
-{
-        uint32_t l = (r0 >> 8);
-        q = (uint8_t *)output + 2;
-        *q++ = ascii64[(l >> 18) & 0x3f]; /* bits 31..26 of r0 */
-        *q++ = ascii64[(l >> 12) & 0x3f]; /* bits 25..20 of r0 */
-        *q++ = ascii64[(l >> 6) & 0x3f]; /* bits 19..14 of r0 */
-        *q++ = ascii64[l & 0x3f]; /* bits 13..8 of r0 */
-        l = ((r0 << 16) | (r1 >> 16));
-        *q++ = ascii64[(l >> 18) & 0x3f]; /* bits 7..2 of r0 */
-        *q++ = ascii64[(l >> 12) & 0x3f]; /* bits 1..2 of r0 and 31..28 of r1 */
-        *q++ = ascii64[(l >> 6) & 0x3f]; /* bits 27..22 of r1 */
-        *q++ = ascii64[l & 0x3f]; /* bits 21..16 of r1 */
-        l = r1 << 2;
-        *q++ = ascii64[(l >> 12) & 0x3f]; /* bits 15..10 of r1 */
-        *q++ = ascii64[(l >> 6) & 0x3f]; /* bits 9..4 of r1 */
-        *q++ = ascii64[l & 0x3f]; /* bits 3..0 of r1 + 00 */
-        *q = 0;
-}
-#else
         /* Each call takes low-order 24 bits and stores 4 chars */
         /* bits 31..8 of r0 */
-        to64_msb_first(output + 2, (r0 >> 8));
+        num2str64_4chars_msb_first(output + 2, (r0 >> 8));
         /* bits 7..0 of r0 and 31..16 of r1 */
-        to64_msb_first(output + 6, (r0 << 16) | (r1 >> 16));
+        num2str64_4chars_msb_first(output + 6, (r0 << 16) | (r1 >> 16));
         /* bits 15..0 of r1 and two zero bits (plus extra zero byte) */
-        to64_msb_first(output + 10, (r1 << 8));
+        num2str64_4chars_msb_first(output + 10, (r1 << 8));
         /* extra zero byte is encoded as '.', fixing it */
         output[13] = '\0';
-#endif
 
         return output;
 }
diff --git a/libbb/pw_encrypt_md5.c b/libbb/pw_encrypt_md5.c
index 1e52ecaea..92d039f96 100644
--- a/libbb/pw_encrypt_md5.c
+++ b/libbb/pw_encrypt_md5.c
@@ -149,9 +149,9 @@ md5_crypt(char result[MD5_OUT_BUFSIZE], const unsigned char *pw, const unsigned
         final[16] = final[5];
         for (i = 0; i < 5; i++) {
                 unsigned l = (final[i] << 16) | (final[i+6] << 8) | final[i+12];
-                p = to64(p, l, 4);
+                p = num2str64_lsb_first(p, l, 4);
         }
-        p = to64(p, final[11], 2);
+        p = num2str64_lsb_first(p, final[11], 2);
         *p = '\0';
 
         /* Don't leave anything around in vm they could use. */
diff --git a/libbb/pw_encrypt_sha.c b/libbb/pw_encrypt_sha.c
index 5457d7ab6..695a5c07f 100644
--- a/libbb/pw_encrypt_sha.c
+++ b/libbb/pw_encrypt_sha.c
@@ -84,8 +84,7 @@ sha_crypt(/*const*/ char *key_data, /*const*/ char *salt_data)
            as a scratch space later. */
         salt_data = xstrndup(salt_data, salt_len);
         /* add "salt$" to result */
-        strcpy(resptr, salt_data);
-        resptr += salt_len;
+        resptr = stpcpy(resptr, salt_data);
         *resptr++ = '$';
         /* key data doesn't need much processing */
         key_len = strlen(key_data);
@@ -198,7 +197,7 @@ sha_crypt(/*const*/ char *key_data, /*const*/ char *salt_data)
 #define b64_from_24bit(B2, B1, B0, N) \
 do { \
         unsigned w = ((B2) << 16) | ((B1) << 8) | (B0); \
-        resptr = to64(resptr, w, N); \
+        resptr = num2str64_lsb_first(resptr, w, N); \
 } while (0)
         if (_32or64 == 32) { /* sha256 */
                 unsigned i = 0;
diff --git a/libbb/pw_encrypt_yes.c b/libbb/pw_encrypt_yes.c
new file mode 100644
index 000000000..50bd06418
--- /dev/null
+++ b/libbb/pw_encrypt_yes.c
@@ -0,0 +1,24 @@
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+#include "yescrypt/alg-yescrypt.h"
+
+static char *
+yes_crypt(const char *passwd, const char *salt_data)
+{
+        /* prefix, '$', hash, NUL */
+        char buf[YESCRYPT_PREFIX_LEN + 1 + YESCRYPT_HASH_LEN + 1];
+        char *retval;
+
+        retval = yescrypt_r(
+                        (const uint8_t *)passwd, strlen(passwd),
+                        (const uint8_t *)salt_data,
+                        buf, sizeof(buf));
+        /* The returned value is either buf[], or NULL on error */
+
+        return xstrdup(retval);
+}
diff --git a/libbb/read_key.c b/libbb/read_key.c
index 54886cc9c..2414105ee 100644
--- a/libbb/read_key.c
+++ b/libbb/read_key.c
@@ -11,7 +11,7 @@
 
 int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
 {
-        struct pollfd pfd;
+        struct pollfd pfd[1];
         const char *seq;
         int n;
 
@@ -117,8 +117,8 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
                 return windows_read_key(fd, buffer, timeout);
 #endif
 
-        pfd.fd = fd;
-        pfd.events = POLLIN;
+        pfd->fd = fd;
+        pfd->events = POLLIN;
 
         buffer++; /* saved chars counter is in buffer[-1] now */
 
@@ -126,12 +126,16 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
         errno = 0;
         n = (unsigned char)buffer[-1];
         if (n == 0) {
-                /* If no data, wait for input.
-                 * If requested, wait TIMEOUT ms. TIMEOUT = -1 is useful
-                 * if fd can be in non-blocking mode.
-                 */
+                /* No data. Wait for input. */
+
+                /* timeout == -2 means "do not poll". Else: */
                 if (timeout >= -1) {
-                        n = poll(&pfd, 1, timeout);
+                        /* We must poll even if timeout == -1:
+                         * we want to be interrupted if signal arrives,
+                         * regardless of SA_RESTART-ness of that signal!
+                         */
+                        /* test bb_got_signal, then poll(), atomically wrt signals */
+                        n = check_got_signal_and_poll(pfd, timeout);
                         if (n < 0 && errno == EINTR)
                                 return n;
                         if (n == 0) {
@@ -140,6 +144,7 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
                                 return -1;
                         }
                 }
+
                 /* It is tempting to read more than one byte here,
                  * but it breaks pasting. Example: at shell prompt,
                  * user presses "c","a","t" and then pastes "\nline\n".
@@ -178,7 +183,7 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
                                  * so if we block for long it's not really an escape sequence.
                                  * Timeout is needed to reconnect escape sequences
                                  * split up by transmission over a serial console. */
-                                if (safe_poll(&pfd, 1, 50) == 0) {
+                                if (safe_poll(pfd, 1, 50) == 0) {
                                         /* No more data!
                                          * Array is sorted from shortest to longest,
                                          * we can't match anything later in array -
@@ -227,7 +232,7 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
          * n = bytes read. Try to read more until we time out.
          */
         while (n < KEYCODE_BUFFER_SIZE-1) { /* 1 for count byte at buffer[-1] */
-                if (safe_poll(&pfd, 1, 50) == 0) {
+                if (safe_poll(pfd, 1, 50) == 0) {
                         /* No more data! */
                         break;
                 }
diff --git a/libbb/replace.c b/libbb/replace.c
index 6183d3e6f..bc26b04cc 100644
--- a/libbb/replace.c
+++ b/libbb/replace.c
@@ -46,3 +46,17 @@ char* FAST_FUNC xmalloc_substitute_string(const char *src, int count, const char
         //dbg_msg("subst9:'%s'", buf);
         return buf;
 }
+
+#if 0 /* inlined in libbb.h */
+/* Returns strlen as a bonus */
+size_t FAST_FUNC replace_char(char *str, char from, char to)
+{
+        char *p = str;
+        while (*p) {
+                if (*p == from)
+                        *p = to;
+                p++;
+        }
+        return p - str;
+}
+#endif
diff --git a/libbb/signals.c b/libbb/signals.c
index c09a562ed..a1ac2005b 100644
--- a/libbb/signals.c
+++ b/libbb/signals.c
@@ -25,13 +25,6 @@ int FAST_FUNC sigaction_set(int signum, const struct sigaction *act)
         return sigaction(signum, act, NULL);
 }
 
-int FAST_FUNC sigprocmask_allsigs(int how)
-{
-        sigset_t set;
-        sigfillset(&set);
-        return sigprocmask(how, &set, NULL);
-}
-
 int FAST_FUNC sigprocmask2(int how, sigset_t *set)
 {
         // Grr... gcc 8.1.1:
@@ -41,7 +34,26 @@ int FAST_FUNC sigprocmask2(int how, sigset_t *set)
         oset = set;
         return sigprocmask(how, set, oset);
 }
+
+int FAST_FUNC sigprocmask_allsigs(int how)
+{
+        sigset_t set;
+        sigfillset(&set);
+        return sigprocmask2(how, &set);
+}
+
+int FAST_FUNC sigblockall(sigset_t *set)
+{
+#if 0 /* nope. set can be NULL */
+        sigfillset(set);
+        return sigprocmask2(SIG_SETMASK, set);
+#else
+        sigset_t mask;
+        sigfillset(&mask);
+        return sigprocmask(SIG_SETMASK, &mask, set);
 #endif
+}
+#endif /* !ENABLE_PLATFORM_MINGW32 */
 
 void FAST_FUNC bb_signals(int sigs, void (*f)(int))
 {
@@ -84,7 +96,7 @@ void FAST_FUNC sig_block(int sig)
         sigset_t ss;
         sigemptyset(&ss);
         sigaddset(&ss, sig);
-        sigprocmask(SIG_BLOCK, &ss, NULL);
+        sigprocmask2(SIG_BLOCK, &ss);
 }
 
 void FAST_FUNC sig_unblock(int sig)
@@ -92,7 +104,7 @@ void FAST_FUNC sig_unblock(int sig)
         sigset_t ss;
         sigemptyset(&ss);
         sigaddset(&ss, sig);
-        sigprocmask(SIG_UNBLOCK, &ss, NULL);
+        sigprocmask2(SIG_UNBLOCK, &ss);
 }
 
 void FAST_FUNC wait_for_any_sig(void)
diff --git a/libbb/u_signal_names.c b/libbb/u_signal_names.c
index ef2b6f891..e233849c5 100644
--- a/libbb/u_signal_names.c
+++ b/libbb/u_signal_names.c
@@ -27,10 +27,6 @@
 
 #include "libbb.h"
 
-#if ENABLE_PLATFORM_MINGW32
-# undef SIGPIPE
-#endif
-
 #if ENABLE_PLATFORM_POSIX || defined(SIGSTKFLT) || defined(SIGVTALRM)
 # define SIGLEN 7
 #elif defined(SIGWINCH) || (ENABLE_FEATURE_RTMINMAX && \
diff --git a/libbb/xfuncs.c b/libbb/xfuncs.c
index 7df1a4cd3..5609858d1 100644
--- a/libbb/xfuncs.c
+++ b/libbb/xfuncs.c
@@ -333,7 +333,7 @@ int FAST_FUNC get_termios_and_make_raw(int fd, struct termios *newterm, struct t
         *newterm = *oldterm;
 
 #if ENABLE_PLATFORM_MINGW32
-        newterm->imode &=
+        newterm->w_mode &=
                 ~(ENABLE_ECHO_INPUT | ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT);
 #else
         /* Turn off buffered input (ICANON)
diff --git a/libbb/xfuncs_printf.c b/libbb/xfuncs_printf.c
index 0ead3b2eb..5f3de5828 100644
--- a/libbb/xfuncs_printf.c
+++ b/libbb/xfuncs_printf.c
@@ -701,6 +701,14 @@ pid_t FAST_FUNC xfork(void)
 }
 #endif
 
+#if 0
+/* DO NOT DO THIS. This can't be a function.
+ * It works on some arches (x86) but fails on others (ppc64le: SEGV).
+ * The reason is: the child returns from this function
+ * and likely pops up the stack in an arch-dependent way.
+ * When child eventually exits or execs, parent "reappear"
+ * in the now-unwound stack (!) and the behavior is undefined.
+ */
 void FAST_FUNC xvfork_parent_waits_and_exits(void)
 {
         pid_t pid;
@@ -716,6 +724,7 @@ void FAST_FUNC xvfork_parent_waits_and_exits(void)
         }
         /* Child continues */
 }
+#endif
 #endif /* !ENABLE_PLATFORM_MINGW32 */
 
 // Useful when we do know that pid is valid, and we just want to wait
diff --git a/libbb/yescrypt/Kbuild.src b/libbb/yescrypt/Kbuild.src
new file mode 100644
index 000000000..a61211a29
--- /dev/null
+++ b/libbb/yescrypt/Kbuild.src
@@ -0,0 +1,9 @@
+# Makefile for busybox
+#
+# Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+#
+# Licensed under GPLv2, see file LICENSE in this source tree.
+
+lib-y:=
+
+INSERT
diff --git a/libbb/yescrypt/PARAMETERS b/libbb/yescrypt/PARAMETERS
new file mode 100644
index 000000000..d9f5d24e6
--- /dev/null
+++ b/libbb/yescrypt/PARAMETERS
@@ -0,0 +1,196 @@
+        Optimal yescrypt configuration.
+
+yescrypt is very flexible, but configuring it optimally is complicated.
+Here are some guidelines to simplify near-optimal configuration.  We
+start by listing the parameters and their typical values, and then give
+currently recommended parameter sets by use case.
+
+
+        Parameters and their typical values.
+
+Set flags (yescrypt flavor) to YESCRYPT_DEFAULTS to use the currently
+recommended flavor.  (Other flags values exist for compatibility and for
+specialized cases where you think you know what you're doing.)
+
+Set N (block count) based on target memory usage and running time, as
+well as on the value of r (block size in 128 byte units).  N must be a
+power of two.
+
+Set r (block size) to 8 (so that N is in KiB, which is convenient) or to
+another small value (if more optimal or for fine-tuning of the total
+size and/or running time).  Reasonable values for r are from 8 to 96.
+
+Set p (parallelism) to 1 meaning no thread-level parallelism within one
+computation of yescrypt.  (Use of thread-level parallelism within
+yescrypt makes sense for ROM initialization and for key derivation at
+high memory usage, but usually not for password hashing where
+parallelism is available through concurrent authentication attempts.
+Don't use p > 1 unnecessarily.)
+
+Set t (time) to 0 to use the optimal running time for a given memory
+usage.  This will allow you to maximize the memory usage (the value of
+N*r) while staying within your running time constraints.  (Non-zero t
+makes sense in specialized cases where you can't afford higher memory
+usage but can afford more time.)
+
+Set g (upgrades) to 0 because there have been no hash upgrades yet.
+
+Set NROM (block count of ROM) to 0 unless you use a ROM (see below).
+NROM must be a power of two.
+
+
+        Password hashing for user authentication, no ROM.
+
+Small and fast (memory usage 2 MiB, performance like bcrypt cost 2^5 -
+latency 2-3 ms and throughput 10,000+ per second on a 16-core server):
+
+flags = YESCRYPT_DEFAULTS, N = 2048, r = 8, p = 1, t = 0, g = 0, NROM = 0
+
+Large and slow (memory usage 16 MiB, performance like bcrypt cost 2^8 -
+latency 10-30 ms and throughput 1000+ per second on a 16-core server):
+
+flags = YESCRYPT_DEFAULTS, N = 4096, r = 32, p = 1, t = 0, g = 0, NROM = 0
+
+Of course, even heavier and slower settings are possible, if affordable.
+Simply double the value of N as many times as needed.  Since N must be a
+power of two, you may use r (in the range of 8 to 32) or/and t (in the
+range of 0 to 2) for fine-tuning the running time, but first bring N to
+the maximum you can afford.  If this feels too complicated, just use one
+of the two parameter sets given above (preferably the second) as-is.
+
+
+        Password hashing for user authentication, with ROM.
+
+It's similar to the above, except that you need to adjust r, set NROM,
+and initialize the ROM.
+
+First decide on a ROM size, such as making it a large portion of your
+dedicated authentication servers' RAM sizes.  Since NROM (block count)
+must be a power of two, you might need to choose r (block size) based on
+how your desired ROM size corresponds to a power of two.  Also tuning
+for performance on current hardware, you'll likely end up with r in the
+range from slightly below 16 to 32.  For example, to use 15/16 of a
+server's 256 GiB RAM as ROM (thus, making it 240 GiB), you could use
+r=15 or r=30.  To use 23/24 of a server's 384 GiB RAM as ROM (thus,
+making it 368 GiB), you'd use r=23.  Then set NROM to your desired ROM
+size in KiB divided by 128*r.  Note that these examples might (or might
+not) be too extreme, leaving little memory for the rest of the system.
+You could as well opt for 7/8 with r=14 or 11/12 with r=11 or r=22.
+
+Note that higher r may make placing of ROM in e.g. NVMe flash memory
+instead of in RAM more reasonable (or less unreasonable) than it would
+have been with a lower r.  If this is a concern as it relates to
+possible attacks and you do not intend to ever do it defensively, you
+might want to keep r lower (e.g., prefer r=15 over r=30 in the example
+above, even if 30 performs slightly faster).
+
+Your adjustments to r, if you deviate from powers of two, will also
+result in weirder memory usage per hash.  Like 1.75 MiB at r=14 instead
+of 2 MiB at r=8 that you would have used without a ROM.  That's OK.
+
+For ROM initialization, which you do with yescrypt_init_shared(), use
+the same r and NROM that you'd later use for password hashing, choose p
+based on your servers' physical and/or logical CPU count (maybe
+considering eventual upgrades as you won't be able to change this later,
+but without going unnecessarily high - e.g., p=28, p=56, or p=112 make
+sense on servers that currently have 28 physical / 56 logical CPUs), and
+set the rest of the parameters to:
+
+flags = YESCRYPT_DEFAULTS, N = 0, t = 0, g = 0
+
+N is set to 0 because it isn't relevant during ROM initialization (you
+can use different values of N for hashing passwords with the same ROM).
+
+To keep the ROM in e.g. SysV shared memory and reuse it across your
+authentication service restarts, you'd need to allocate the memory and
+set the flags to "YESCRYPT_DEFAULTS | YESCRYPT_SHARED_PREALLOCATED".
+
+For actual password hashing, you'd use your chosen values for N, r,
+NROM, and set the rest of the parameters to:
+
+flags = YESCRYPT_DEFAULTS, p = 1, t = 0, g = 0
+
+Note that although you'd use a large p for ROM initialization, you
+should use p=1 for actual password hashing like you would without a ROM.
+
+Do not forget to pass the ROM into the actual password hashing (and keep
+r and NROM set accordingly).
+
+Since N must be a power of two and r is dependent on ROM size, you may
+use t (in the range of 0 to 2) for fine-tuning the running time, but
+first bring N to the maximum you can afford.
+
+If this feels too complicated, or even if it doesn't, please consider
+engaging Openwall for your yescrypt deployment.  We'd be happy to help.
+
+
+        Password-based key derivation.
+
+(Or rather passphrase-based.)
+
+Use settings similar to those for password hashing without a ROM, but
+adjusted for higher memory usage and running time, and optionally with
+thread-level parallelism.
+
+Small and fast (memory usage 128 MiB, running time under 100 ms on a
+fast desktop):
+
+flags = YESCRYPT_DEFAULTS, N = 32768, r = 32, p = 1, t = 0, g = 0, NROM = 0
+
+Large and fast (memory usage 1 GiB, running time under 200 ms on a fast
+quad-core desktop not including memory allocation overhead, under 250 ms
+with the overhead included), but requires build with OpenMP support (or
+otherwise will run as slow as yet be weaker than its p=1 alternative):
+
+flags = YESCRYPT_DEFAULTS, N = 262144, r = 32, p = 4, t = 0, g = 0, NROM = 0
+
+Large and slower (memory usage 1 GiB, running time under 300 ms on a
+fast quad-core desktop not including memory allocation overhead, under
+350 ms with the overhead included), also requires build with OpenMP
+support (or otherwise will run slower than the p=1 alternative below):
+
+flags = YESCRYPT_DEFAULTS, N = 262144, r = 32, p = 4, t = 2, g = 0, NROM = 0
+
+Large and slow (memory usage 1 GiB, running time under 600 ms on a fast
+desktop not including memory allocation overhead, under 650 ms with the
+overhead included):
+
+flags = YESCRYPT_DEFAULTS, N = 262144, r = 32, p = 1, t = 0, g = 0, NROM = 0
+
+Just like with password hashing, even heavier and slower settings are
+possible, if affordable, and you achieve them by adjusting N, r, t in
+the same way and in the same preferred ranges (please see the section on
+password hashing without a ROM, above).  Unlike with password hashing,
+it makes some sense to go above t=2 if you expect that your users might
+not be able to afford more memory but can afford more time.  However,
+increasing the memory usage provides better protection, and we don't
+recommend forcing your users to wait for more than 1 second as they
+could as well type more characters in that time.  If this feels too
+complicated, just use one of the above parameter sets as-is.
+
+
+        Amortization of memory allocation overhead.
+
+It takes a significant fraction of yescrypt's total running time to
+allocate memory from the operating system, especially considering that
+the kernel zeroizes the memory before handing it over to your program.
+
+Unless you naturally need to compute yescrypt just once per process, you
+may achieve greater efficiency by fully using advanced yescrypt APIs
+that let you preserve and reuse the memory allocation across yescrypt
+invocations.  This is done by reusing the structure pointed to by the
+"yescrypt_local_t *local" argument of yescrypt_r() or yescrypt_kdf()
+without calling yescrypt_free_local() inbetween the repeated invocations
+of yescrypt.
+
+
+        YESCRYPT_DEFAULTS macro.
+
+Please note that the value of the YESCRYPT_DEFAULTS macro might change
+later, so if you use the macro like it's recommended here then for
+results reproducible across versions you might need to store its value
+somewhere along with the hashes or the encrypted data.
+
+If you use yescrypt's standard hash string encoding, then yescrypt
+already encodes and decodes this value for you, so you don't need to
+worry about this.
diff --git a/libbb/yescrypt/README b/libbb/yescrypt/README
new file mode 100644
index 000000000..c1011c56a
--- /dev/null
+++ b/libbb/yescrypt/README
@@ -0,0 +1,4 @@
+The yescrypt code in this directory is adapted from libxcrypt-4.4.38
+with minimal edits, hopefully making it easier to track
+backports by resetting the tree to the commit which created this file,
+then comparing changes in upstream libxcrypt to the tree.
diff --git a/libbb/yescrypt/alg-sha256.c b/libbb/yescrypt/alg-sha256.c
new file mode 100644
index 000000000..dc748c968
--- /dev/null
+++ b/libbb/yescrypt/alg-sha256.c
@@ -0,0 +1,91 @@
+/*-
+ * Copyright 2005-2016 Colin Percival
+ * Copyright 2016-2018,2021 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/**
+ * PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
+ * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
+ * write the output to buf.  The value dkLen must be at most 32 * (2^32 - 1).
+ */
+static void
+PBKDF2_SHA256(const uint8_t *passwd, size_t passwdlen,
+                const uint8_t *salt, size_t saltlen,
+                uint64_t c, uint8_t *buf, size_t dkLen)
+{
+        hmac_ctx_t Phctx, PShctx;
+        uint32_t i;
+
+        /* Compute HMAC state after processing P. */
+        hmac_begin(&Phctx, passwd, passwdlen, sha256_begin);
+
+        /* Compute HMAC state after processing P and S. */
+        PShctx = Phctx;
+        hmac_hash(&PShctx, salt, saltlen);
+
+        /* Iterate through the blocks. */
+        for (i = 0; dkLen != 0; ) {
+                long U[32 / sizeof(long)];
+                long T[32 / sizeof(long)];
+// Do not make these ^^ uint64_t[]. Keep them long[].
+// Even though the XORing loop below is optimized out,
+// gcc is not smart enough to realize that 64-bit alignment of the stack
+// is no longer useful, and generates ~50 more bytes of code on i386...
+                uint32_t ivec;
+                size_t clen;
+                int k;
+
+                /* Generate INT(i). */
+                i++;
+                ivec = SWAP_BE32(i);
+
+                /* Compute U_1 = PRF(P, S || INT(i)). */
+                hmac_peek_hash(&PShctx, (void*)T, &ivec, 4, NULL);
+//TODO: the above is a vararg function, might incur some ABI pain
+//does libbb need a non-vararg version with just one (buf,len)?
+
+                if (c > 1) {
+//in yescrypt, c is always 1, so this if() branch is optimized out
+                        uint64_t j;
+                        /* T_i = U_1 ... */
+                        memcpy(U, T, 32);
+                        for (j = 2; j <= c; j++) {
+                                /* Compute U_j. */
+                                hmac_peek_hash(&Phctx, (void*)U, U, 32, NULL);
+                                /* ... xor U_j ... */
+                                for (k = 0; k < 32 / sizeof(long); k++)
+                                        T[k] ^= U[k];
+                                //TODO: xorbuf32_aligned_long(T, U);
+                        }
+                }
+
+                /* Copy as many bytes as necessary into buf. */
+                clen = dkLen;
+                if (clen > 32)
+                        clen = 32;
+                buf = mempcpy(buf, T, clen);
+                dkLen -= clen;
+        }
+}
diff --git a/libbb/yescrypt/alg-yescrypt-common.c b/libbb/yescrypt/alg-yescrypt-common.c
new file mode 100644
index 000000000..c51823787
--- /dev/null
+++ b/libbb/yescrypt/alg-yescrypt-common.c
@@ -0,0 +1,408 @@
+/*-
+ * Copyright 2013-2018 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if RESTRICTED_PARAMS
+
+#define decode64_uint32(dst, src, min) \
+({ \
+        uint32_t d32 = a2i64(*(src)); \
+        if (d32 > 47) \
+                goto fail; \
+        *(dst) = d32 + (min); \
+        ++src; \
+})
+#define test_decode64_uint32() ((void)0)
+#define FULL_PARAMS(...)
+
+#else
+
+#define FULL_PARAMS(...) __VA_ARGS__
+
+/* Not inlining:
+ * de/encode64 functions are only used to read
+ * yescrypt_params_t field, and convert salt to binary -
+ * both of these are negligible compared to main hashing operation
+ */
+static NOINLINE const uint8_t *decode64_uint32(
+                uint32_t *dst,
+                const uint8_t *src, uint32_t val)
+{
+        uint32_t start = 0, end = 47, bits = 0;
+        uint32_t c;
+
+        if (!src) /* previous decode failed already? */
+                goto fail;
+
+        c = a2i64(*src++);
+        if (c > 63)
+                goto fail;
+
+// The encoding of number N:
+// start = 0 end = 47
+// If N < 48, it is encoded verbatim, else
+// N -= 48
+// start = end+1 = 48
+// end += (64-end)/2 = 55
+// If N < (end+1-start)<<6 = 8<<6, it is encoded as 48+(N>>6)|low6bits (that is, 48...55|<6bit>), else
+// N -= 8<<6
+// start = end+1 = 56
+// end += (64-end)/2 = 59
+// If N < (end+1-start)<<2*6 = 4<<12, it is encoded as 56+(N>>2*6)|low12bits (that is, 56...59|<6bit>|<6bit>), else
+// ...same for 60..61|<6bit>|<6bit>|<6bit>
+// .......same for 62|<6bit>|<6bit>|<6bit>|<6bit>
+// .......same for 63|<6bit>|<6bit>|<6bit>|<6bit>|<6bit>
+        dbg_dec64("c:%d val:0x%08x", (int)c, (unsigned)val);
+        while (c > end) {
+                dbg_dec64("c:%d > end:%d", (int)c, (int)end);
+                val += (end + 1 - start) << bits;
+                dbg_dec64("val+=0x%08x", (int)((end + 1 - start) << bits));
+                dbg_dec64(" val:0x%08x", (unsigned)val);
+                start = end + 1;
+                end += (64 - end) / 2;
+                bits += 6;
+                dbg_dec64("start=%d", (int)start);
+                dbg_dec64("end=%d", (int)end);
+                dbg_dec64("bits=%d", (int)bits);
+        }
+
+        val += (c - start) << bits;
+        dbg_dec64("final val+=0x%08x", (int)((c - start) << bits));
+        dbg_dec64("       val:0x%08x", (unsigned)val);
+
+        while (bits != 0) {
+                c = a2i64(*src++);
+                if (c > 63)
+                        goto fail;
+                bits -= 6;
+                val += c << bits;
+                dbg_dec64("low bits val+=0x%08x", (int)(c << bits));
+                dbg_dec64("          val:0x%08x", (unsigned)val);
+        }
+ ret:
+        *dst = val;
+        return src;
+ fail:
+        val = 0;
+        src = NULL;
+        goto ret;
+}
+
+#if TEST_DECODE64
+static void test_decode64_uint32(void)
+{
+        const uint8_t *src, *end;
+        uint32_t u32;
+        int a = 48;
+        int b = 8<<6;  // 0x0200
+        int c = 4<<12; // 0x04000
+        int d = 2<<18; // 0x080000
+        int e = 1<<24; // 0x1000000
+
+        src = (void*)"wzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x0003ffff+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 4) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+        src = (void*)"xzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x0007ffff+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 4) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+        // Note how the last representable "x---" encoding, 0x7ffff, is exactly d-1!
+        // And if we now increment it, we get:
+        src = (void*)"y....";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x00000000+d+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 5) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+        src = (void*)"yzzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x00ffffff+d+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 5) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+
+        src = (void*)"zzzzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x3fffffff+e+d+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 6) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+
+        bb_error_msg("test_decode64_uint32() OK");
+}
+#else
+# define test_decode64_uint32() ((void)0)
+#endif
+
+#endif /* !RESTRICTED_PARAMS */
+
+#if 1
+static const uint8_t *decode64(
+                uint8_t *dst, size_t *dstlen,
+                const uint8_t *src)
+{
+        unsigned dstpos = 0;
+
+        dbg_dec64("src:'%s'", src);
+        for (;;) {
+                uint32_t c, value = 0;
+                int bits = 0;
+                while (*src != '\0' && *src != '$') {
+                        c = a2i64(*src);
+                        if (c > 63) { /* bad ascii64 char, stop decoding at it */
+                                break;
+                        }
+                        src++;
+                        value |= c << bits;
+                        bits += 6;
+                        if (bits == 24) /* got 4 chars */
+                                goto store;
+                }
+                /* we read entire src, or met a non-ascii64 char (such as "$") */
+                if (bits == 0)
+                        break;
+                /* else: we got last, partial bit block - store it */
+ store:
+                dbg_dec64(" storing bits:%d dstpos:%u v:%08x", bits, dstpos, (int)SWAP_BE32(value)); //BE to see lsb first
+                for (;;) {
+                        if ((*src == '\0' || *src == '$')
+                         && value == 0 && bits < 8
+                        ) {
+                                /* Example: mkpasswd PWD '$y$j9T$123':
+                                 * the "123" is bits:18 value:03,51,00
+                                 * is considered to be 2 bytes, not 3!
+                                 *
+                                 * '$y$j9T$zzz' in upstream fails outright (3rd byte isn't zero).
+                                 * IOW: for upstream, validity of salt depends on VALUE,
+                                 * not just size of salt. Which is a bug.
+                                 * The '$y$j9T$zzz.' salt is the same
+                                 * (it adds 6 zero msbits) but upstream works with it,
+                                 * thus '$y$j9T$zzz' should work too and give the same result.
+                                 */
+                                goto end;
+                        }
+                        if (dstpos >= *dstlen) {
+                                dbg_dec64(" ERR: bits:%d dstpos:%u dst[] is too small", bits, dstpos);
+                                goto fail;
+                        }
+                        *dst++ = value;
+                        dstpos++;
+                        value >>= 8;
+                        bits -= 8;
+                        if (bits <= 0) /* can get negative, if we e.g. had 6 bits */
+                                break;
+                }
+                if (*src == '\0' || *src == '$')
+                        break;
+        }
+ end:
+        *dstlen = dstpos;
+        dbg_dec64("dec64: OK, dst[%d]", (int)dstpos);
+        return src;
+ fail:
+        /* *dstlen = 0; - not needed, caller detects error by seeing NULL */
+        return NULL;
+}
+#else
+/* Buggy (and larger) original code */
+static const uint8_t *decode64(
+                uint8_t *dst, size_t *dstlen,
+                const uint8_t *src, size_t srclen)
+{
+        size_t dstpos = 0;
+
+        while (dstpos <= *dstlen && srclen) {
+                uint32_t value = 0, bits = 0;
+                while (srclen--) {
+                        uint32_t c = a2i64(*src);
+                        if (c > 63) {
+                                srclen = 0;
+                                break;
+                        }
+                        src++;
+                        value |= c << bits;
+                        bits += 6;
+                        if (bits >= 24)
+                                break;
+                }
+                if (!bits)
+                        break;
+                if (bits < 12) /* must have at least one full byte */
+                        goto fail;
+                dbg_dec64(" storing bits:%d v:%08x", (int)bits, (int)SWAP_BE32(value)); //BE to see lsb first
+                while (dstpos++ < *dstlen) {
+                        *dst++ = value;
+                        value >>= 8;
+                        bits -= 8;
+                        if (bits < 8) { /* 2 or 4 */
+                                if (value) /* must be 0 */
+                                        goto fail;
+                                bits = 0;
+                                break;
+                        }
+                }
+                if (bits)
+                        goto fail;
+        }
+
+        if (!srclen && dstpos <= *dstlen) {
+                *dstlen = dstpos;
+                dbg_dec64("dec64: OK, dst[%d]", (int)dstpos);
+                return src;
+        }
+ fail:
+        /* *dstlen = 0; - not needed, caller detects error by seeing NULL */
+        return NULL;
+}
+#endif
+
+static char *encode64(
+                char *dst, size_t dstlen,
+                const uint8_t *src, size_t srclen)
+{
+        while (srclen) {
+                uint32_t value = 0, b = 0;
+                do {
+                        value |= (uint32_t)(*src++ << b);
+                        b += 8;
+                        srclen--;
+                } while (srclen && b < 24);
+
+                b >>= 3; /* number of bits to number of bytes */
+                b++; /* 1, 2 or 3 bytes will become 2, 3 or 4 ascii64 chars */
+                dstlen -= b;
+                if ((ssize_t)dstlen <= 0)
+                        return NULL;
+                dst = num2str64_lsb_first(dst, value, b);
+        }
+        *dst = '\0';
+        return dst;
+}
+
+char *yescrypt_r(
+                const uint8_t *passwd, size_t passwdlen,
+                const uint8_t *setting,
+                char *buf, size_t buflen)
+{
+        struct {
+                yescrypt_ctx_t yctx[1];
+                unsigned char hashbin32[32];
+        } u;
+#define yctx      u.yctx
+#define hashbin32 u.hashbin32
+        char *dst;
+        const uint8_t *src, *saltend;
+        size_t need, prefixlen;
+        uint32_t u32;
+
+        test_decode64_uint32();
+
+        memset(yctx, 0, sizeof(yctx));
+        FULL_PARAMS(yctx->param.p = 1;)
+
+        /* we assume setting starts with "$y$" (caller must ensure this) */
+        src = setting + 3;
+
+        src = decode64_uint32(&yctx->param.flags, src, 0);
+        /* "j9T" returns: 0x2f */
+        //if (!src)
+        //      goto fail;
+
+        if (yctx->param.flags < YESCRYPT_RW) {
+                dbg("yctx->param.flags=0x%x", (unsigned)yctx->param.flags);
+                goto fail; // bbox: we don't support scrypt - only yescrypt
+        } else if (yctx->param.flags <= YESCRYPT_RW + (YESCRYPT_RW_FLAVOR_MASK >> 2)) {
+                /* "j9T" sets flags to 0xb6 */
+                yctx->param.flags = YESCRYPT_RW + ((yctx->param.flags - YESCRYPT_RW) << 2);
+                dbg("yctx->param.flags=0x%x", (unsigned)yctx->param.flags);
+                dbg(" YESCRYPT_RW:%u", !!(yctx->param.flags & YESCRYPT_RW));
+                dbg((yctx->param.flags & YESCRYPT_RW_FLAVOR_MASK) ==
+                       (YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K)
+                    ? " YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K"
+                    : " flags are not standard"
+                );
+        } else {
+                goto fail;
+        }
+
+        src = decode64_uint32(&u32, src, 1);
+        if (/*!src ||*/ u32 > 63)
+                goto fail;
+        yctx->param.N = (uint64_t)1 << u32;
+        /* "j9T" sets to 4096 (1<<12) */
+        dbg("yctx->param.N=%llu (1<<%u)", (unsigned long long)yctx->param.N, (unsigned)u32);
+
+        src = decode64_uint32(&yctx->param.r, src, 1);
+        /* "j9T" sets to 32 */
+        dbg("yctx->param.r=%u", yctx->param.r);
+
+        if (!src)
+                goto fail;
+        if (*src != '$') {
+#if RESTRICTED_PARAMS
+                goto fail;
+#else
+                src = decode64_uint32(&u32, src, 1);
+                dbg("yescrypt has extended params:0x%x", (unsigned)u32);
+                if (u32 & 1)
+                        src = decode64_uint32(&yctx->param.p, src, 2);
+                if (u32 & 2)
+                        src = decode64_uint32(&yctx->param.t, src, 1);
+                if (u32 & 4)
+                        src = decode64_uint32(&yctx->param.g, src, 1);
+                if (u32 & 8) {
+                        src = decode64_uint32(&u32, src, 1);
+                        if (/*!src ||*/ u32 > 63)
+                                goto fail;
+                        yctx->param.NROM = (uint64_t)1 << u32;
+                }
+                if (!src)
+                        goto fail;
+                if (*src != '$')
+                        goto fail;
+#endif
+        }
+
+        yctx->saltlen = sizeof(yctx->salt);
+        src++; /* now points to salt */
+        saltend = decode64(yctx->salt, &yctx->saltlen, src);
+        if (!saltend || (*saltend != '\0' && *saltend != '$'))
+                goto fail; /* salt[] is too small, or bad char during decode */
+        dbg_dec64("salt is %d ascii64 chars -> %d bytes (in binary)", (int)(saltend - src), (int)yctx->saltlen);
+
+        prefixlen = saltend - setting;
+        need = prefixlen + 1 + YESCRYPT_HASH_LEN + 1;
+        if (need > buflen /*overflow is quite unlikely: || need < prefixlen*/)
+                goto fail;
+
+        if (yescrypt_kdf32(yctx, passwd, passwdlen, hashbin32)) {
+                dbg("error in yescrypt_kdf32");
+                goto fail;
+        }
+
+        dst = mempcpy(buf, setting, prefixlen);
+        *dst++ = '$';
+        dst = encode64(dst, buflen - (dst - buf), hashbin32, sizeof(hashbin32));
+        if (!dst)
+                goto fail;
+ ret:
+        free_region(yctx->local);
+        explicit_bzero(&u, sizeof(u));
+        return buf;
+ fail:
+        buf = NULL;
+        goto ret;
+#undef yctx
+#undef hashbin32
+}
diff --git a/libbb/yescrypt/alg-yescrypt-kdf.c b/libbb/yescrypt/alg-yescrypt-kdf.c
new file mode 100644
index 000000000..a9a1bd591
--- /dev/null
+++ b/libbb/yescrypt/alg-yescrypt-kdf.c
@@ -0,0 +1,1212 @@
+/*-
+ * Copyright 2009 Colin Percival
+ * Copyright 2012-2018 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * This file was originally written by Colin Percival as part of the Tarsnap
+ * online backup system.
+ */
+
+#if __STDC_VERSION__ >= 199901L
+/* Have restrict */
+#elif defined(__GNUC__)
+#define restrict __restrict
+#else
+#define restrict
+#endif
+
+#ifdef __GNUC__
+#define unlikely(exp) __builtin_expect(exp, 0)
+#else
+#define unlikely(exp) (exp)
+#endif
+
+typedef union {
+        uint32_t w[16];
+        uint64_t d[8];
+} salsa20_blk_t;
+
+static void salsa20_simd_shuffle(
+                const salsa20_blk_t *Bin,
+                salsa20_blk_t *Bout)
+{
+#define COMBINE(out, in1, in2) \
+do { \
+        Bout->d[out] = Bin->w[in1 * 2] | ((uint64_t)Bin->w[in2 * 2 + 1] << 32); \
+} while (0)
+        COMBINE(0, 0, 2);
+        COMBINE(1, 5, 7);
+        COMBINE(2, 2, 4);
+        COMBINE(3, 7, 1);
+        COMBINE(4, 4, 6);
+        COMBINE(5, 1, 3);
+        COMBINE(6, 6, 0);
+        COMBINE(7, 3, 5);
+#undef COMBINE
+}
+
+static void salsa20_simd_unshuffle(
+                const salsa20_blk_t *Bin,
+                salsa20_blk_t *Bout)
+{
+#define UNCOMBINE(out, in1, in2) \
+do { \
+        Bout->w[out * 2] = Bin->d[in1]; \
+        Bout->w[out * 2 + 1] = Bin->d[in2] >> 32; \
+} while (0)
+        UNCOMBINE(0, 0, 6);
+        UNCOMBINE(1, 5, 3);
+        UNCOMBINE(2, 2, 0);
+        UNCOMBINE(3, 7, 5);
+        UNCOMBINE(4, 4, 2);
+        UNCOMBINE(5, 1, 7);
+        UNCOMBINE(6, 6, 4);
+        UNCOMBINE(7, 3, 1);
+#undef UNCOMBINE
+}
+
+#define DECL_X \
+        salsa20_blk_t X
+#define DECL_Y \
+        salsa20_blk_t Y
+
+#if KDF_UNROLL_COPY
+#define COPY(out, in) \
+do { \
+        (out).d[0] = (in).d[0]; \
+        (out).d[1] = (in).d[1]; \
+        (out).d[2] = (in).d[2]; \
+        (out).d[3] = (in).d[3]; \
+        (out).d[4] = (in).d[4]; \
+        (out).d[5] = (in).d[5]; \
+        (out).d[6] = (in).d[6]; \
+        (out).d[7] = (in).d[7]; \
+} while (0)
+#else
+#define COPY(out, in) \
+do { \
+        memcpy((out).d, (in).d, sizeof((in).d)); \
+} while (0)
+#endif
+
+#define READ_X(in)   COPY(X, in)
+#define WRITE_X(out) COPY(out, X)
+
+/**
+ * salsa20(B):
+ * Apply the Salsa20 core to the provided block.
+ */
+static void salsa20(salsa20_blk_t *restrict B,
+                salsa20_blk_t *restrict Bout,
+                uint32_t doublerounds)
+{
+        salsa20_blk_t X;
+#define x X.w
+
+        salsa20_simd_unshuffle(B, &X);
+
+        do {
+#define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))
+                /* Operate on columns */
+#if KDF_UNROLL_SALSA20
+                x[ 4] ^= R(x[ 0]+x[12], 7); // x[j] ^= R(x[k]+x[l], CONST)
+                x[ 8] ^= R(x[ 4]+x[ 0], 9);
+                x[12] ^= R(x[ 8]+x[ 4],13);
+                x[ 0] ^= R(x[12]+x[ 8],18);
+
+                x[ 9] ^= R(x[ 5]+x[ 1], 7);
+                x[13] ^= R(x[ 9]+x[ 5], 9);
+                x[ 1] ^= R(x[13]+x[ 9],13);
+                x[ 5] ^= R(x[ 1]+x[13],18);
+
+                x[14] ^= R(x[10]+x[ 6], 7);
+                x[ 2] ^= R(x[14]+x[10], 9);
+                x[ 6] ^= R(x[ 2]+x[14],13);
+                x[10] ^= R(x[ 6]+x[ 2],18);
+
+                x[ 3] ^= R(x[15]+x[11], 7);
+                x[ 7] ^= R(x[ 3]+x[15], 9);
+                x[11] ^= R(x[ 7]+x[ 3],13);
+                x[15] ^= R(x[11]+x[ 7],18);
+#else
+                {
+                        unsigned j, k, l;
+                        j = 4; k = 0; l = 12;
+                        for (;;) {
+                                uint32_t t;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t, 7); }); l = k; k = j; j = (j+4) & 0xf;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t, 9); }); l = k; k = j; j = (j+4) & 0xf;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t,13); }); l = k; k = j; j = (j+4) & 0xf;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t,18); });
+                                if (j == 15) break;
+                                l = j + 1; k = j + 5; j = (j+9) & 0xf;
+                        }
+                }
+#endif
+                /* Operate on rows */
+#if KDF_UNROLL_SALSA20
+// i=0 n=0
+                x[ 1] ^= R(x[ 0]+x[ 3], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[ 2] ^= R(x[ 1]+x[ 0], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[ 3] ^= R(x[ 2]+x[ 1],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[ 0] ^= R(x[ 3]+x[ 2],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+// i=4 n=1                                          ^^^j^^^       ^^^k^^^       ^^^l^^^
+                x[ 6] ^= R(x[ 5]+x[ 4], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[ 7] ^= R(x[ 6]+x[ 5], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[ 4] ^= R(x[ 7]+x[ 6],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[ 5] ^= R(x[ 4]+x[ 7],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+// i=8 n=2
+                x[11] ^= R(x[10]+x[ 9], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[ 8] ^= R(x[11]+x[10], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[ 9] ^= R(x[ 8]+x[11],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[10] ^= R(x[ 9]+x[ 8],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+// i=12 n=3
+                x[12] ^= R(x[15]+x[14], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[13] ^= R(x[12]+x[15], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[14] ^= R(x[13]+x[12],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[15] ^= R(x[14]+x[13],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+#else
+                {
+                        unsigned j, k, l;
+                        uint32_t *xrow;
+                        j = 1; k = 0; l = 3;
+                        xrow = &x[0];
+                        for (;;) {
+                                uint32_t t;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t, 7); }); l = k; k = j; j = (j+1) & 3;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t, 9); }); l = k; k = j; j = (j+1) & 3;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t,13); }); l = k; k = j; j = (j+1) & 3;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t,18); });
+                                if (j == 3) break;
+                                l = j; k = j + 1; j = (j+2) & 3;
+                                xrow += 4;
+                        }
+                }
+#endif
+
+#undef R
+        } while (--doublerounds);
+#undef x
+
+        {
+                uint32_t i;
+                salsa20_simd_shuffle(&X, Bout);
+                for (i = 0; i < 16; i++) {
+                        // bbox: note: was unrolled x4
+                        B->w[i] = Bout->w[i] += B->w[i];
+                }
+        }
+#if 0
+        /* Too expensive */
+        explicit_bzero(&X, sizeof(X));
+#endif
+}
+
+/**
+ * Apply the Salsa20/2 core to the block provided in X.
+ */
+#define SALSA20_2(out) \
+        salsa20(&X, &out, 1)
+
+#if 0
+#define XOR(out, in1, in2) \
+do { \
+        (out).d[0] = (in1).d[0] ^ (in2).d[0]; \
+        (out).d[1] = (in1).d[1] ^ (in2).d[1]; \
+        (out).d[2] = (in1).d[2] ^ (in2).d[2]; \
+        (out).d[3] = (in1).d[3] ^ (in2).d[3]; \
+        (out).d[4] = (in1).d[4] ^ (in2).d[4]; \
+        (out).d[5] = (in1).d[5] ^ (in2).d[5]; \
+        (out).d[6] = (in1).d[6] ^ (in2).d[6]; \
+        (out).d[7] = (in1).d[7] ^ (in2).d[7]; \
+} while (0)
+#else
+#define XOR(out, in1, in2) \
+do { \
+        xorbuf64_3_aligned64(&(out).d, &(in1).d, &(in2).d); \
+} while (0)
+#endif
+
+#define XOR_X(in)         XOR(X, X, in)
+#define XOR_X_2(in1, in2) XOR(X, in1, in2)
+#define XOR_X_WRITE_XOR_Y_2(out, in) \
+do { \
+        XOR(Y, out, in); \
+        COPY(out, Y); \
+        XOR(X, X, Y); \
+} while (0)
+
+/**
+ * Apply the Salsa20/8 core to the block provided in X ^ in.
+ */
+#define SALSA20_8_XOR_MEM(in, out) \
+do { \
+        XOR_X(in); \
+        salsa20(&X, &out, 4); \
+} while (0)
+
+#define INTEGERIFY ((uint32_t)X.d[0])
+
+/**
+ * blockmix_salsa8(Bin, Bout, r):
+ * Compute Bout = BlockMix_{salsa20/8, r}(Bin).  The input Bin must be 128r
+ * bytes in length; the output Bout must also be the same size.
+ */
+static void blockmix_salsa8(
+                const salsa20_blk_t *restrict Bin,
+                salsa20_blk_t *restrict Bout,
+                size_t r)
+{
+        size_t i;
+        DECL_X;
+
+        READ_X(Bin[r * 2 - 1]);
+        for (i = 0; i < r; i++) {
+                SALSA20_8_XOR_MEM(Bin[i * 2], Bout[i]);
+                SALSA20_8_XOR_MEM(Bin[i * 2 + 1], Bout[r + i]);
+        }
+}
+
+static uint32_t blockmix_salsa8_xor(
+                const salsa20_blk_t *restrict Bin1,
+                const salsa20_blk_t *restrict Bin2,
+                salsa20_blk_t *restrict Bout,
+                size_t r)
+{
+        size_t i;
+        DECL_X;
+
+        XOR_X_2(Bin1[r * 2 - 1], Bin2[r * 2 - 1]);
+        for (i = 0; i < r; i++) {
+                XOR_X(Bin1[i * 2]);
+                SALSA20_8_XOR_MEM(Bin2[i * 2], Bout[i]);
+                XOR_X(Bin1[i * 2 + 1]);
+                SALSA20_8_XOR_MEM(Bin2[i * 2 + 1], Bout[r + i]);
+        }
+
+        return INTEGERIFY;
+}
+
+/* This is tunable */
+#define Swidth 8
+
+/* Not tunable in this implementation, hard-coded in a few places */
+#define PWXsimple 2
+#define PWXgather 4
+
+/* Derived values.  Not tunable except via Swidth above. */
+#define PWXbytes (PWXgather * PWXsimple * 8)
+#define Sbytes   (3 * (1 << Swidth) * PWXsimple * 8)
+#define Smask    (((1 << Swidth) - 1) * PWXsimple * 8)
+#define Smask2   (((uint64_t)Smask << 32) | Smask)
+
+#define DECL_SMASK2REG       do {} while (0)
+#define FORCE_REGALLOC_3     do {} while (0)
+#define MAYBE_MEMORY_BARRIER do {} while (0)
+
+#define PWXFORM_SIMD(x0, x1) \
+do { \
+        uint64_t x = x0 & Smask2; \
+        uint64_t *p0 = (uint64_t *)(S0 + (uint32_t)x); \
+        uint64_t *p1 = (uint64_t *)(S1 + (x >> 32)); \
+        x0 = ((x0 >> 32) * (uint32_t)x0 + p0[0]) ^ p1[0]; \
+        x1 = ((x1 >> 32) * (uint32_t)x1 + p0[1]) ^ p1[1]; \
+} while (0)
+
+#if KDF_UNROLL_PWXFORM_ROUND
+#define PWXFORM_ROUND \
+do { \
+        PWXFORM_SIMD(X.d[0], X.d[1]); \
+        PWXFORM_SIMD(X.d[2], X.d[3]); \
+        PWXFORM_SIMD(X.d[4], X.d[5]); \
+        PWXFORM_SIMD(X.d[6], X.d[7]); \
+} while (0)
+#else
+#define PWXFORM_ROUND \
+do { \
+        for (int pwxi=0; pwxi<8; pwxi+=2) \
+                PWXFORM_SIMD(X.d[pwxi], X.d[pwxi + 1]); \
+} while (0)
+#endif
+
+/*
+ * This offset helps address the 256-byte write block via the single-byte
+ * displacements encodable in x86(-64) instructions.  It is needed because the
+ * displacements are signed.  Without it, we'd get 4-byte displacements for
+ * half of the writes.  Setting it to 0x80 instead of 0x7c would avoid needing
+ * a displacement for one of the writes, but then the LEA instruction would
+ * need a 4-byte displacement.
+ */
+#define PWXFORM_WRITE_OFFSET 0x7c
+
+#define PWXFORM_WRITE \
+do { \
+        WRITE_X(*(salsa20_blk_t *)(Sw - PWXFORM_WRITE_OFFSET)); \
+        Sw += 64; \
+} while (0)
+
+#if KDF_UNROLL_PWXFORM
+#define PWXFORM \
+do { \
+        uint8_t *Sw = S2 + w + PWXFORM_WRITE_OFFSET; \
+        FORCE_REGALLOC_3; \
+        MAYBE_MEMORY_BARRIER; \
+        PWXFORM_ROUND; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; \
+        w = (w + 64 * 4) & Smask2; \
+        { \
+                uint8_t *Stmp = S2; \
+                S2 = S1; \
+                S1 = S0; \
+                S0 = Stmp; \
+        } \
+} while (0)
+#else
+#define PWXFORM \
+do { \
+        uint8_t *Sw = S2 + w + PWXFORM_WRITE_OFFSET; \
+        FORCE_REGALLOC_3; \
+        MAYBE_MEMORY_BARRIER; \
+        PWXFORM_ROUND; \
+        for (int pwxj=0; pwxj<4; pwxj++) {\
+                PWXFORM_ROUND; PWXFORM_WRITE; \
+        } \
+        PWXFORM_ROUND; \
+        w = (w + 64 * 4) & Smask2; \
+        { \
+                uint8_t *Stmp = S2; \
+                S2 = S1; \
+                S1 = S0; \
+                S0 = Stmp; \
+        } \
+} while (0)
+#endif
+
+typedef struct {
+        uint8_t *S0, *S1, *S2;
+        size_t w;
+} pwxform_ctx_t;
+
+#define Salloc (Sbytes + ((sizeof(pwxform_ctx_t) + 63) & ~63U))
+
+/**
+ * blockmix_pwxform(Bin, Bout, r, S):
+ * Compute Bout = BlockMix_pwxform{salsa20/2, r, S}(Bin).  The input Bin must
+ * be 128r bytes in length; the output Bout must also be the same size.
+ */
+static void blockmix(
+                const salsa20_blk_t *restrict Bin,
+                salsa20_blk_t *restrict Bout,
+                size_t r,
+                pwxform_ctx_t *restrict ctx)
+{
+        uint8_t *S0 = ctx->S0, *S1 = ctx->S1, *S2 = ctx->S2;
+        size_t w = ctx->w;
+        size_t i;
+        DECL_X;
+
+        /* Convert count of 128-byte blocks to max index of 64-byte block */
+        r = r * 2 - 1;
+
+        READ_X(Bin[r]);
+
+        DECL_SMASK2REG;
+
+        i = 0;
+        for (;;) {
+                XOR_X(Bin[i]);
+                PWXFORM;
+                if (unlikely(i >= r))
+                        break;
+                WRITE_X(Bout[i]);
+                i++;
+        }
+
+        ctx->S0 = S0;
+        ctx->S1 = S1;
+        ctx->S2 = S2;
+        ctx->w = w;
+
+        SALSA20_2(Bout[i]);
+}
+
+static uint32_t blockmix_xor(
+                const salsa20_blk_t *Bin1,
+                const salsa20_blk_t *restrict Bin2,
+                salsa20_blk_t *Bout,
+                size_t r,
+                pwxform_ctx_t *restrict ctx)
+{
+        uint8_t *S0 = ctx->S0, *S1 = ctx->S1, *S2 = ctx->S2;
+        size_t w = ctx->w;
+        size_t i;
+        DECL_X;
+
+        /* Convert count of 128-byte blocks to max index of 64-byte block */
+        r = r * 2 - 1;
+
+        XOR_X_2(Bin1[r], Bin2[r]);
+
+        DECL_SMASK2REG;
+
+        i = 0;
+        r--;
+        for (;;) {
+                XOR_X(Bin1[i]);
+                XOR_X(Bin2[i]);
+                PWXFORM;
+                if (unlikely(i > r))
+                        break;
+                WRITE_X(Bout[i]);
+                i++;
+        }
+
+        ctx->S0 = S0;
+        ctx->S1 = S1;
+        ctx->S2 = S2;
+        ctx->w = w;
+
+        SALSA20_2(Bout[i]);
+
+        return INTEGERIFY;
+}
+
+static uint32_t blockmix_xor_save(
+                salsa20_blk_t *restrict Bin1out,
+                salsa20_blk_t *restrict Bin2,
+                size_t r,
+                pwxform_ctx_t *restrict ctx)
+{
+        uint8_t *S0 = ctx->S0, *S1 = ctx->S1, *S2 = ctx->S2;
+        size_t w = ctx->w;
+        size_t i;
+        DECL_X;
+        DECL_Y;
+
+        /* Convert count of 128-byte blocks to max index of 64-byte block */
+        r = r * 2 - 1;
+
+        XOR_X_2(Bin1out[r], Bin2[r]);
+
+        DECL_SMASK2REG;
+
+        i = 0;
+        r--;
+        for (;;) {
+                XOR_X_WRITE_XOR_Y_2(Bin2[i], Bin1out[i]);
+                PWXFORM;
+                if (unlikely(i > r))
+                        break;
+                WRITE_X(Bin1out[i]);
+                i++;
+        }
+
+        ctx->S0 = S0;
+        ctx->S1 = S1;
+        ctx->S2 = S2;
+        ctx->w = w;
+
+        SALSA20_2(Bin1out[i]);
+
+        return INTEGERIFY;
+}
+
+/**
+ * integerify(B, r):
+ * Return the result of parsing B_{2r-1} as a little-endian integer.
+ */
+static inline uint32_t integerify(const salsa20_blk_t *B, size_t r)
+{
+/*
+ * Our 64-bit words are in host byte order, which is why we don't just read
+ * w[0] here (would be wrong on big-endian).  Also, our 32-bit words are
+ * SIMD-shuffled (so the next 32 bits would be part of d[6]), but currently
+ * this does not matter as we only care about the least significant 32 bits.
+ */
+        return (uint32_t)B[2 * r - 1].d[0];
+}
+
+/**
+ * smix1(B, r, N, flags, V, NROM, VROM, XY, ctx):
+ * Compute first loop of B = SMix_r(B, N).  The input B must be 128r bytes in
+ * length; the temporary storage V must be 128rN bytes in length; the temporary
+ * storage XY must be 128r+64 bytes in length.  N must be even and at least 4.
+ * The array V must be aligned to a multiple of 64 bytes, and arrays B and XY
+ * to a multiple of at least 16 bytes.
+ */
+#if DISABLE_NROM_CODE
+#define smix1(B,r,N,flags,V,NROM,VROM,XY,ctx) \
+        smix1(B,r,N,flags,V,XY,ctx)
+#endif
+static void smix1(uint8_t *B, size_t r, uint32_t N,
+                uint32_t flags,
+                salsa20_blk_t *V,
+                uint32_t NROM, const salsa20_blk_t *VROM,
+                salsa20_blk_t *XY,
+                pwxform_ctx_t *ctx)
+{
+#if DISABLE_NROM_CODE
+        uint32_t NROM = 0;
+        const salsa20_blk_t *VROM = NULL;
+#endif
+        size_t s = 2 * r;
+        salsa20_blk_t *X = V, *Y = &V[s];
+        uint32_t i, j;
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = (salsa20_blk_t *)&B[i * 64];
+                salsa20_blk_t *tmp = Y;
+                salsa20_blk_t *dst = &X[i];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_shuffle(tmp, dst);
+        }
+
+        if (VROM) {
+                uint32_t n;
+                const salsa20_blk_t *V_j;
+
+                V_j = &VROM[(NROM - 1) * s];
+                j = blockmix_xor(X, V_j, Y, r, ctx) & (NROM - 1);
+                V_j = &VROM[j * s];
+                X = Y + s;
+                j = blockmix_xor(Y, V_j, X, r, ctx);
+
+                for (n = 2; n < N; n <<= 1) {
+                        uint32_t m = (n < N / 2) ? n : (N - 1 - n);
+                        for (i = 1; i < m; i += 2) {
+                                j &= n - 1;
+                                j += i - 1;
+                                V_j = &V[j * s];
+                                Y = X + s;
+                                j = blockmix_xor(X, V_j, Y, r, ctx) & (NROM - 1);
+                                V_j = &VROM[j * s];
+                                X = Y + s;
+                                j = blockmix_xor(Y, V_j, X, r, ctx);
+                        }
+                }
+                n >>= 1;
+
+                j &= n - 1;
+                j += N - 2 - n;
+                V_j = &V[j * s];
+                Y = X + s;
+                j = blockmix_xor(X, V_j, Y, r, ctx) & (NROM - 1);
+                V_j = &VROM[j * s];
+                blockmix_xor(Y, V_j, XY, r, ctx);
+        } else if (flags & YESCRYPT_RW) {
+//can't use flags___YESCRYPT_RW, smix1() may be called with flags = 0
+                uint32_t n;
+                salsa20_blk_t *V_j;
+
+                blockmix(X, Y, r, ctx);
+                X = Y + s;
+                blockmix(Y, X, r, ctx);
+                j = integerify(X, r);
+
+                for (n = 2; n < N; n <<= 1) {
+                        uint32_t m = (n < N / 2) ? n : (N - 1 - n);
+                        for (i = 1; i < m; i += 2) {
+                                Y = X + s;
+                                j &= n - 1;
+                                j += i - 1;
+                                V_j = &V[j * s];
+                                j = blockmix_xor(X, V_j, Y, r, ctx);
+                                j &= n - 1;
+                                j += i;
+                                V_j = &V[j * s];
+                                X = Y + s;
+                                j = blockmix_xor(Y, V_j, X, r, ctx);
+                        }
+                }
+                n >>= 1;
+
+                j &= n - 1;
+                j += N - 2 - n;
+                V_j = &V[j * s];
+                Y = X + s;
+                j = blockmix_xor(X, V_j, Y, r, ctx);
+                j &= n - 1;
+                j += N - 1 - n;
+                V_j = &V[j * s];
+                blockmix_xor(Y, V_j, XY, r, ctx);
+        } else {
+                N -= 2;
+                do {
+                        blockmix_salsa8(X, Y, r);
+                        X = Y + s;
+                        blockmix_salsa8(Y, X, r);
+                        Y = X + s;
+                } while ((N -= 2));
+
+                blockmix_salsa8(X, Y, r);
+                blockmix_salsa8(Y, XY, r);
+        }
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = &XY[i];
+                salsa20_blk_t *tmp = &XY[s];
+                salsa20_blk_t *dst = (salsa20_blk_t *)&B[i * 64];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_unshuffle(tmp, dst);
+        }
+}
+
+/**
+ * smix2(B, r, N, Nloop, flags, V, NROM, VROM, XY, ctx):
+ * Compute second loop of B = SMix_r(B, N).  The input B must be 128r bytes in
+ * length; the temporary storage V must be 128rN bytes in length; the temporary
+ * storage XY must be 256r bytes in length.  N must be a power of 2 and at
+ * least 2.  Nloop must be even.  The array V must be aligned to a multiple of
+ * 64 bytes, and arrays B and XY to a multiple of at least 16 bytes.
+ */
+#if DISABLE_NROM_CODE
+#define smix2(B,r,N,Nloop,flags,V,NROM,VROM,XY,ctx) \
+        smix2(B,r,N,Nloop,flags,V,XY,ctx)
+#endif
+static void smix2(uint8_t *B, size_t r, uint32_t N, uint64_t Nloop,
+                uint32_t flags,
+                salsa20_blk_t *V,
+                uint32_t NROM, const salsa20_blk_t *VROM,
+                salsa20_blk_t *XY,
+                pwxform_ctx_t *ctx)
+{
+#if DISABLE_NROM_CODE
+        uint32_t NROM = 0;
+        const salsa20_blk_t *VROM = NULL;
+#endif
+        size_t s = 2 * r;
+        salsa20_blk_t *X = XY, *Y = &XY[s];
+        uint32_t i, j;
+
+        if (Nloop == 0)
+                return;
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = (salsa20_blk_t *)&B[i * 64];
+                salsa20_blk_t *tmp = Y;
+                salsa20_blk_t *dst = &X[i];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_shuffle(tmp, dst);
+        }
+
+        j = integerify(X, r) & (N - 1);
+
+/*
+ * Normally, VROM implies YESCRYPT_RW, but we check for these separately
+ * because our SMix resets YESCRYPT_RW for the smix2() calls operating on the
+ * entire V when p > 1.
+ */
+//and this is why bbox can't use flags___YESCRYPT_RW in this function
+        if (VROM && (flags & YESCRYPT_RW)) {
+                do {
+                        salsa20_blk_t *V_j = &V[j * s];
+                        const salsa20_blk_t *VROM_j;
+                        j = blockmix_xor_save(X, V_j, r, ctx) & (NROM - 1);
+                        VROM_j = &VROM[j * s];
+                        j = blockmix_xor(X, VROM_j, X, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else if (VROM) {
+                do {
+                        const salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (NROM - 1);
+                        V_j = &VROM[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else if (flags & YESCRYPT_RW) {
+                do {
+                        salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_xor_save(X, V_j, r, ctx) & (N - 1);
+                        V_j = &V[j * s];
+                        j = blockmix_xor_save(X, V_j, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else if (ctx) {
+                do {
+                        const salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (N - 1);
+                        V_j = &V[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else {
+                do {
+                        const salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_salsa8_xor(X, V_j, Y, r) & (N - 1);
+                        V_j = &V[j * s];
+                        j = blockmix_salsa8_xor(Y, V_j, X, r) & (N - 1);
+                } while (Nloop -= 2);
+        }
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = &X[i];
+                salsa20_blk_t *tmp = Y;
+                salsa20_blk_t *dst = (salsa20_blk_t *)&B[i * 64];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_unshuffle(tmp, dst);
+        }
+}
+
+/**
+ * p2floor(x):
+ * Largest power of 2 not greater than argument.
+ */
+static uint64_t p2floor(uint64_t x)
+{
+        uint64_t y;
+        while ((y = x & (x - 1)))
+                x = y;
+        return x;
+}
+
+/**
+ * smix(B, r, N, p, t, flags, V, NROM, VROM, XY, S, passwd):
+ * Compute B = SMix_r(B, N).  The input B must be 128rp bytes in length; the
+ * temporary storage V must be 128rN bytes in length; the temporary storage
+ * XY must be 256r or 256rp bytes in length (the larger size is required with
+ * OpenMP-enabled builds).  N must be a power of 2 and at least 4.  The array V
+ * must be aligned to a multiple of 64 bytes, and arrays B and XY to a multiple
+ * of at least 16 bytes (aligning them to 64 bytes as well saves cache lines
+ * and helps avoid false sharing in OpenMP-enabled builds when p > 1, but it
+ * might also result in cache bank conflicts).
+ */
+#if DISABLE_NROM_CODE
+#define smix(B,r,N,p,t,flags,V,NROM,VROM,XY,S,passwd) \
+        smix(B,r,N,p,t,flags,V,XY,S,passwd)
+#endif
+static void smix(uint8_t *B, size_t r, uint32_t N, uint32_t p, uint32_t t,
+                uint32_t flags,
+                salsa20_blk_t *V,
+                uint32_t NROM, const salsa20_blk_t *VROM,
+                salsa20_blk_t *XY,
+                uint8_t *S, uint8_t *passwd)
+{
+        size_t s = 2 * r;
+        uint32_t Nchunk;
+        uint64_t Nloop_all, Nloop_rw;
+        uint32_t i;
+
+        Nchunk = N / p;
+        Nloop_all = Nchunk;
+        if (flags___YESCRYPT_RW) {
+                if (t <= 1) {
+                        if (t)
+                                Nloop_all *= 2; /* 2/3 */
+                        Nloop_all = (Nloop_all + 2) / 3; /* 1/3, round up */
+                } else {
+                        Nloop_all *= t - 1;
+                }
+        } else if (t) {
+                if (t == 1)
+                        Nloop_all += (Nloop_all + 1) / 2; /* 1.5, round up */
+                Nloop_all *= t;
+        }
+
+        Nloop_rw = 0;
+        if (flags___YESCRYPT_RW)
+                Nloop_rw = Nloop_all / p;
+
+        Nchunk &= ~(uint32_t)1; /* round down to even */
+        Nloop_all++; Nloop_all &= ~(uint64_t)1; /* round up to even */
+        Nloop_rw++; Nloop_rw &= ~(uint64_t)1; /* round up to even */
+
+        for (i = 0; i < p; i++) {
+                uint32_t Vchunk = i * Nchunk;
+                uint32_t Np = (i < p - 1) ? Nchunk : (N - Vchunk);
+                uint8_t *Bp = &B[128 * r * i];
+                salsa20_blk_t *Vp = &V[Vchunk * s];
+                salsa20_blk_t *XYp = XY;
+                pwxform_ctx_t *ctx_i = NULL;
+                if (flags___YESCRYPT_RW) {
+                        uint8_t *Si = S + i * Salloc;
+                        smix1(Bp, 1, Sbytes / 128, 0 /* no flags */,
+                                (salsa20_blk_t *)Si, 0, NULL, XYp, NULL);
+                        ctx_i = (pwxform_ctx_t *)(Si + Sbytes);
+                        ctx_i->S2 = Si;
+                        ctx_i->S1 = Si + Sbytes / 3;
+                        ctx_i->S0 = Si + Sbytes / 3 * 2;
+                        ctx_i->w = 0;
+                        if (i == 0)
+                                hmac_block(
+                                        /* key,len: */ Bp + (128 * r - 64), 64,
+                                        /* hash fn: */ sha256_begin,
+                                        /* in,len: */  passwd, 32,
+                                        /* outbuf: */  passwd
+                                );
+                }
+                smix1(Bp, r, Np, flags, Vp, NROM, VROM, XYp, ctx_i);
+                smix2(Bp, r, p2floor(Np), Nloop_rw, flags, Vp,
+                        NROM, VROM, XYp, ctx_i);
+        }
+
+        if (Nloop_all > Nloop_rw) {
+                for (i = 0; i < p; i++) {
+                        uint8_t *Bp = &B[128 * r * i];
+                        salsa20_blk_t *XYp = XY;
+                        pwxform_ctx_t *ctx_i = NULL;
+                        if (flags___YESCRYPT_RW) {
+                                uint8_t *Si = S + i * Salloc;
+                                ctx_i = (pwxform_ctx_t *)(Si + Sbytes);
+                        }
+                        smix2(Bp, r, N, Nloop_all - Nloop_rw,
+                                flags & (uint32_t)~YESCRYPT_RW,
+                                V, NROM, VROM, XYp, ctx_i);
+                }
+        }
+}
+
+/* Allocator code */
+
+static void alloc_region(yescrypt_region_t *region, size_t size)
+{
+        uint8_t *base;
+        int flags =
+# ifdef MAP_NOCORE /* huh? */
+                MAP_NOCORE |
+# endif
+                MAP_ANON | MAP_PRIVATE;
+
+        base = mmap(NULL, size, PROT_READ | PROT_WRITE, flags, -1, 0);
+        if (base == MAP_FAILED)
+                bb_die_memory_exhausted();
+
+#if defined(MADV_HUGEPAGE)
+        /* Reduces mkpasswd qweRTY123@-+ '$y$jHT$123'
+         * (which allocates 4 Gbytes)
+         * run time from 10.543s to 5.635s
+         * Seen on linux-5.18.0.
+         */
+        madvise(base, size, MADV_HUGEPAGE);
+#endif
+        //region->base = base;
+        //region->base_size = size;
+        region->aligned = base;
+        region->aligned_size = size;
+}
+
+static void free_region(yescrypt_region_t *region)
+{
+        if (region->aligned)
+                munmap(region->aligned, region->aligned_size);
+        //region->base = NULL;
+        //region->base_size = 0;
+        region->aligned = NULL;
+        region->aligned_size = 0;
+}
+/**
+ * yescrypt_kdf_body(shared, local, passwd, passwdlen, salt, saltlen,
+ *     flags, N, r, p, t, NROM, buf, buflen):
+ * Compute scrypt(passwd[0 .. passwdlen - 1], salt[0 .. saltlen - 1], N, r,
+ * p, buflen), or a revision of scrypt as requested by flags and shared, and
+ * write the result into buf.
+ *
+ * shared and flags may request special modes as described in yescrypt.h.
+ *
+ * local is the thread-local data structure, allowing to preserve and reuse a
+ * memory allocation across calls, thereby reducing its overhead.
+ *
+ * t controls computation time while not affecting peak memory usage.
+ *
+ * Return 0 on success; or -1 on error.
+ *
+ * This optimized implementation currently limits N to the range from 4 to
+ * 2^31, but other implementations might not.
+ */
+static int yescrypt_kdf32_body(
+                yescrypt_ctx_t *yctx,
+                const uint8_t *passwd, size_t passwdlen,
+                uint32_t flags, uint64_t N, uint32_t t,
+                uint8_t *buf32)
+{
+#if !DISABLE_NROM_CODE
+        const salsa20_blk_t *VROM;
+#endif
+        size_t B_size, V_size, XY_size, need;
+        uint8_t *B, *S;
+        salsa20_blk_t *V, *XY;
+        struct {
+                uint8_t sha256[32];
+                uint8_t dk[32];
+        } u;
+#define sha256 u.sha256
+#define dk     u.dk
+        uint8_t *dkp = buf32;
+        uint32_t r, p;
+
+        /* Sanity-check parameters */
+        switch (flags___YESCRYPT_MODE_MASK) {
+        case 0: /* classic scrypt - can't have anything non-standard */
+                if (flags || t || YCTX_param_NROM)
+                        goto out_EINVAL;
+                break;
+        case YESCRYPT_WORM:
+                if (flags != YESCRYPT_WORM || YCTX_param_NROM)
+                        goto out_EINVAL;
+                break;
+        case YESCRYPT_RW:
+                if (flags != (flags & YESCRYPT_KNOWN_FLAGS))
+                        goto out_EINVAL;
+#if PWXsimple == 2 && PWXgather == 4 && Sbytes == 12288
+                if ((flags & YESCRYPT_RW_FLAVOR_MASK) ==
+                    (YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 |
+                    YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K))
+                        break;
+#else
+#error "Unsupported pwxform settings"
+#endif
+                /* FALLTHRU */
+        default:
+                goto out_EINVAL;
+        }
+
+        r = YCTX_param_r;
+        p = YCTX_param_p;
+        if ((uint64_t)r * (uint64_t)p >= 1 << 30) {
+                dbg("r * n >= 2^30");
+                goto out_EINVAL;
+        }
+        if (N > UINT32_MAX) {
+                dbg("N > 0x%lx", (long)UINT32_MAX);
+                goto out_EINVAL;
+        }
+        if (N <= 3
+         || r < 1
+         || p < 1
+        ) {
+                dbg("bad N, r or p");
+                goto out_EINVAL;
+        }
+        if (r > SIZE_MAX / 256 / p
+         || N > SIZE_MAX / 128 / r
+        ) {
+                /* 32-bit testcase: mkpasswd qweRTY123@-+ '$y$jHT$123'
+                 * (works on 64-bit, needs buffer > 4Gbytes)
+                 */
+                dbg("r > SIZE_MAX / 256 / p? %c", "NY"[r > SIZE_MAX / 256 / p]);
+                dbg("N > SIZE_MAX / 128 / r? %c", "NY"[N > SIZE_MAX / 128 / r]);
+                goto out_EINVAL;
+        }
+        if (flags___YESCRYPT_RW) {
+                /* p cannot be greater than SIZE_MAX/Salloc on 64-bit systems,
+                   but it can on 32-bit systems.  */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+                if (N / p <= 3 || p > SIZE_MAX / Salloc) {
+                        dbg("bad p:%ld", (long)p);
+                        goto out_EINVAL;
+                }
+#pragma GCC diagnostic pop
+        }
+
+#if !DISABLE_NROM_CODE
+        VROM = NULL;
+        if (YCTX_param_NROM)
+                goto out_EINVAL;
+#endif
+
+        /* Allocate memory */
+        V = NULL;
+        V_size = (size_t)128 * r * N;
+        need = V_size;
+        B_size = (size_t)128 * r * p;
+        need += B_size;
+        if (need < B_size) {
+                dbg("integer overflow at += B_size(%lu)", (long)B_size);
+                goto out_EINVAL;
+        }
+        XY_size = (size_t)256 * r;
+        need += XY_size;
+        if (need < XY_size) {
+                dbg("integer overflow at += XY_size(%lu)", (long)XY_size);
+                goto out_EINVAL;
+        }
+        if (flags___YESCRYPT_RW) {
+                size_t S_size = (size_t)Salloc * p;
+                need += S_size;
+                if (need < S_size) {
+                        dbg("integer overflow at += S_size(%lu)", (long)S_size);
+                        goto out_EINVAL;
+                }
+        }
+        if (yctx->local->aligned_size < need) {
+                free_region(yctx->local);
+                alloc_region(yctx->local, need);
+                dbg("allocated local:%lu 0x%lx", (long)need, (long)need);
+                /* standard "j9T" params allocate 16Mbytes here */
+        }
+        if (flags & YESCRYPT_ALLOC_ONLY)
+                return -3; /* expected "failure" */
+        B = (uint8_t *)yctx->local->aligned;
+        V = (salsa20_blk_t *)((uint8_t *)B + B_size);
+        XY = (salsa20_blk_t *)((uint8_t *)V + V_size);
+        S = NULL;
+        if (flags___YESCRYPT_RW)
+                S = (uint8_t *)XY + XY_size;
+
+        if (flags) {
+                hmac_block(
+                        /* key,len: */ (const void*)"yescrypt-prehash", (flags & YESCRYPT_PREHASH) ? 16 : 8,
+                        /* hash fn: */ sha256_begin,
+                        /* in,len: */  passwd, passwdlen,
+                        /* outbuf: */  sha256
+                );
+                passwd = sha256;
+                passwdlen = sizeof(sha256);
+        }
+
+        PBKDF2_SHA256(passwd, passwdlen, yctx->salt, yctx->saltlen, 1, B, B_size);
+
+        if (flags)
+                memcpy(sha256, B, sizeof(sha256));
+
+        if (p == 1 || (flags___YESCRYPT_RW)) {
+                smix(B, r, N, p, t, flags, V, YCTX_param_NROM, VROM, XY, S, sha256);
+        } else {
+                uint32_t i;
+                for (i = 0; i < p; i++) {
+                        smix(&B[(size_t)128 * r * i], r, N, 1, t, flags, V,
+                                YCTX_param_NROM, VROM, XY, NULL, NULL);
+                }
+        }
+
+        dkp = buf32;
+        if (flags && /*buflen:*/32 < sizeof(dk)) {
+                PBKDF2_SHA256(passwd, passwdlen, B, B_size, 1, dk, sizeof(dk));
+                dkp = dk;
+        }
+
+        PBKDF2_SHA256(passwd, passwdlen, B, B_size, 1, buf32, /*buflen:*/32);
+
+        /*
+         * Except when computing classic scrypt, allow all computation so far
+         * to be performed on the client.  The final steps below match those of
+         * SCRAM (RFC 5802), so that an extension of SCRAM (with the steps so
+         * far in place of SCRAM's use of PBKDF2 and with SHA-256 in place of
+         * SCRAM's use of SHA-1) would be usable with yescrypt hashes.
+         */
+        if (flags && !(flags & YESCRYPT_PREHASH)) {
+                /* Compute ClientKey */
+                hmac_block(
+                        /* key,len: */ dkp, sizeof(dk),
+                        /* hash fn: */ sha256_begin,
+                        /* in,len: */  "Client Key", 10,
+                        /* outbuf: */  sha256
+                );
+                /* Compute StoredKey */
+                {
+                        size_t clen = /*buflen:*/32;
+                        if (clen > sizeof(dk))
+                                clen = sizeof(dk);
+                        if (sizeof(dk) != 32) { /* not true, optimize it out */
+                                sha256_block(sha256, sizeof(sha256), dk);
+                                memcpy(buf32, dk, clen);
+                        } else {
+                                sha256_block(sha256, sizeof(sha256), buf32);
+                        }
+                }
+        }
+
+        explicit_bzero(&u, sizeof(u));
+
+        /* Success! */
+        return 0;
+
+ out_EINVAL:
+        //bbox does not need this: errno = EINVAL;
+        return -1;
+#undef sha256
+#undef dk
+}
+
+/**
+ * yescrypt_kdf(shared, local, passwd, passwdlen, salt, saltlen, params,
+ *     buf, buflen):
+ * Compute scrypt or its revision as requested by the parameters.  The inputs
+ * to this function are the same as those for yescrypt_kdf_body() above, with
+ * the addition of g, which controls hash upgrades (0 for no upgrades so far).
+ */
+static
+int yescrypt_kdf32(
+                yescrypt_ctx_t *yctx,
+                const uint8_t *passwd, size_t passwdlen,
+                uint8_t *buf32)
+{
+        uint32_t flags = YCTX_param_flags;
+        uint64_t N = YCTX_param_N;
+        uint32_t r = YCTX_param_r;
+        uint32_t p = YCTX_param_p;
+        uint32_t t = YCTX_param_t;
+        uint32_t g = YCTX_param_g;
+        uint8_t dk32[32];
+        int retval;
+
+        /* Support for hash upgrades has been temporarily removed */
+        if (g) {
+                //bbox does not need this: errno = EINVAL;
+                return -1;
+        }
+
+        if ((flags___YESCRYPT_RW)
+         && p >= 1
+         && N / p >= 0x100
+         && N / p * r >= 0x20000
+        ) {
+                if (yescrypt_kdf32_body(yctx,
+                    passwd, passwdlen,
+                    flags | YESCRYPT_ALLOC_ONLY, N, t,
+                    buf32) != -3
+                ) {
+                        dbg("yescrypt_kdf32_body: not -3");
+                        return -1;
+                }
+                retval = yescrypt_kdf32_body(yctx,
+                                passwd, passwdlen,
+                                flags | YESCRYPT_PREHASH, N >> 6, 0,
+                                dk32);
+                if (retval) {
+                        dbg("yescrypt_kdf32_body(PREHASH):%d", retval);
+                        return retval;
+                }
+                passwd = dk32;
+                passwdlen = sizeof(dk32);
+        }
+
+        retval = yescrypt_kdf32_body(yctx,
+                        passwd, passwdlen,
+                        flags, N, t, buf32);
+
+        explicit_bzero(dk32, sizeof(dk32));
+
+        dbg("yescrypt_kdf32_body:%d", retval);
+        return retval;
+}
diff --git a/libbb/yescrypt/alg-yescrypt.h b/libbb/yescrypt/alg-yescrypt.h
new file mode 100644
index 000000000..b69843f5d
--- /dev/null
+++ b/libbb/yescrypt/alg-yescrypt.h
@@ -0,0 +1,247 @@
+/*-
+ * Copyright 2009 Colin Percival
+ * Copyright 2013-2018 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * This file was originally written by Colin Percival as part of the Tarsnap
+ * online backup system.
+ */
+
+// busybox debug and size-reduction configuration
+
+#ifdef YESCRYPT_INTERNAL
+# if 1
+#  define dbg(...) ((void)0)
+# else
+#  define dbg(...) bb_error_msg(__VA_ARGS__)
+# endif
+# if 1
+#  define dbg_dec64(...) ((void)0)
+# else
+#  define dbg_dec64(...) bb_error_msg(__VA_ARGS__)
+# endif
+# define TEST_DECODE64  0
+#endif
+
+// Only accept one-char parameters in salt, and only first three?
+// Almost any reasonable yescrypt hashes in /etc/shadow should
+// only ever use "jXY" parameters which set N and r.
+// Fancy multi-byte-encoded wide integers are not needed for that.
+#define RESTRICTED_PARAMS  1
+// Note: if you enable the above, please also enable
+// YCTX_param_p, YCTX_param_t, YCTX_param_g, YCTX_param_NROM
+// optimizations, and DISABLE_NROM_CODE.
+
+#define DISABLE_NROM_CODE  1
+
+// How much we save by forcing "standard" value by commenting the next line:
+//  160 bytes
+//#define YCTX_param_flags           yctx->param.flags
+//  260 bytes
+//#define flags___YESCRYPT_RW        (flags & YESCRYPT_RW)
+//  140 bytes
+//#define flags___YESCRYPT_MODE_MASK (flags & YESCRYPT_MODE_MASK)
+// ^^^^ forcing the above since the code already requires (checks for) this
+//   50 bytes
+#define YCTX_param_N     yctx->param.N
+// -100 bytes (negative!!!)
+#define YCTX_param_r     yctx->param.r
+//  400 bytes
+//#define YCTX_param_p     yctx->param.p
+//  130 bytes
+//#define YCTX_param_t     yctx->param.t
+//    2 bytes
+//#define YCTX_param_g     yctx->param.g
+//    1 bytes
+// ^^^^ this looks wrong, compiler should be able to constant-propagate the fact that NROM code is dead
+//#define YCTX_param_NROM  yctx->param.NROM
+
+#ifndef YCTX_param_flags
+#define YCTX_param_flags (YESCRYPT_RW | YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K)
+#endif
+#ifndef flags___YESCRYPT_RW
+#define flags___YESCRYPT_RW ((void)flags, YESCRYPT_RW)
+#endif
+#ifndef flags___YESCRYPT_MODE_MASK
+#define flags___YESCRYPT_MODE_MASK ((void)flags, YESCRYPT_RW)
+#endif
+// standard ("j9T") values:
+#ifndef YCTX_param_N
+#define YCTX_param_N     4096
+#endif
+#ifndef YCTX_param_r
+#define YCTX_param_r     32
+#endif
+#ifndef YCTX_param_p
+#define YCTX_param_p     1
+#endif
+#ifndef YCTX_param_t
+#define YCTX_param_t     0
+#endif
+#ifndef YCTX_param_g
+#define YCTX_param_g     0
+#endif
+#ifndef YCTX_param_NROM
+#define YCTX_param_NROM  0
+#endif
+
+// "Faster/smaller code" knobs:
+// -941 bytes:
+#define KDF_UNROLL_COPY 0
+// -5324 bytes if 0:
+#define KDF_UNROLL_PWXFORM_ROUND 0
+// -4864 bytes if 0:
+#define KDF_UNROLL_PWXFORM 0
+// if both this ^^^^^^^^^^ and PWXFORM_ROUND set to 0: -7666 bytes
+// -464 bytes:
+#define KDF_UNROLL_SALSA20 0
+
+/**
+ * Type and possible values for the flags argument of yescrypt_kdf(),
+ * yescrypt_encode_params_r(), yescrypt_encode_params().  Most of these may be
+ * OR'ed together, except that YESCRYPT_WORM stands on its own.
+ * Please refer to the description of yescrypt_kdf() below for the meaning of
+ * these flags.
+ */
+/* yescrypt flags:
+ * bits pos: 7654321076543210
+ *                    ss  r w
+ *                sbox  gg y
+ */
+/* Public */
+#define YESCRYPT_WORM                   1
+#define YESCRYPT_RW                     0x002
+#define YESCRYPT_ROUNDS_3               0x000 //r=0
+#define YESCRYPT_ROUNDS_6               0x004 //r=1
+#define YESCRYPT_GATHER_1               0x000 //gg=00
+#define YESCRYPT_GATHER_2               0x008 //gg=01
+#define YESCRYPT_GATHER_4               0x010 //gg=10
+#define YESCRYPT_GATHER_8               0x018 //gg=11
+#define YESCRYPT_SIMPLE_1               0x000 //ss=00
+#define YESCRYPT_SIMPLE_2               0x020 //ss=01
+#define YESCRYPT_SIMPLE_4               0x040 //ss=10
+#define YESCRYPT_SIMPLE_8               0x060 //ss=11
+#define YESCRYPT_SBOX_6K                0x000 //sbox=0000
+#define YESCRYPT_SBOX_12K               0x080 //sbox=0001
+#define YESCRYPT_SBOX_24K               0x100 //sbox=0010
+#define YESCRYPT_SBOX_48K               0x180 //sbox=0011
+#define YESCRYPT_SBOX_96K               0x200 //sbox=0100
+#define YESCRYPT_SBOX_192K              0x280 //sbox=0101
+#define YESCRYPT_SBOX_384K              0x300 //sbox=0110
+#define YESCRYPT_SBOX_768K              0x380 //sbox=0111
+
+#ifdef YESCRYPT_INTERNAL
+/* Private */
+#define YESCRYPT_MODE_MASK              0x003
+#define YESCRYPT_RW_FLAVOR_MASK         0x3fc
+#define YESCRYPT_ALLOC_ONLY             0x08000000
+#define YESCRYPT_PREHASH                0x10000000
+#endif
+
+#define YESCRYPT_RW_DEFAULTS \
+        (YESCRYPT_RW | \
+        YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | \
+        YESCRYPT_SBOX_12K)
+
+#define YESCRYPT_DEFAULTS YESCRYPT_RW_DEFAULTS
+
+#ifdef YESCRYPT_INTERNAL
+#define YESCRYPT_KNOWN_FLAGS \
+        (YESCRYPT_MODE_MASK | YESCRYPT_RW_FLAVOR_MASK | \
+        YESCRYPT_ALLOC_ONLY | YESCRYPT_PREHASH)
+#endif
+
+/* How many chars base-64 encoded bytes require? */
+#define YESCRYPT_BYTES2CHARS(bytes) ((((bytes) * 8) + 5) / 6)
+/* The /etc/passwd-style hash is "<prefix>$<hash><NUL>" */
+/*
+ * "$y$", up to 8 params of up to 6 chars each, '$', salt
+ * Alternatively, but that's smaller:
+ * "$7$", 3 params encoded as 1+5+5 chars, salt
+ */
+#define YESCRYPT_PREFIX_LEN (3 + 8 * 6 + 1 + YESCRYPT_BYTES2CHARS(32))
+
+#define YESCRYPT_HASH_SIZE 32
+#define YESCRYPT_HASH_LEN  YESCRYPT_BYTES2CHARS(YESCRYPT_HASH_SIZE)
+
+/**
+ * Internal type used by the memory allocator.  Please do not use it directly.
+ * Use yescrypt_shared_t and yescrypt_local_t as appropriate instead, since
+ * they might differ from each other in a future version.
+ */
+typedef struct {
+//      void *base;
+        void *aligned;
+//      size_t base_size;
+        size_t aligned_size;
+} yescrypt_region_t;
+
+/**
+ * yescrypt parameters combined into one struct.  N, r, p are the same as in
+ * classic scrypt, except that the meaning of p changes when YESCRYPT_RW is
+ * set.  flags, t, g, NROM are special to yescrypt.
+ */
+typedef struct {
+        uint32_t flags;
+        uint32_t r;
+        uint64_t N;
+#if !RESTRICTED_PARAMS
+        uint32_t p, t, g;
+        uint64_t NROM;
+#endif
+} yescrypt_params_t;
+
+typedef struct {
+        yescrypt_params_t param;
+
+        /* salt in binary form */
+        /* stored here to cut down on the amount of function paramaters */
+        unsigned char salt[64];
+        size_t saltlen;
+
+        /* used by the memory allocator */
+        //yescrypt_region_t shared[1];
+        yescrypt_region_t local[1];
+} yescrypt_ctx_t;
+
+/**
+ * yescrypt_r(shared, local, passwd, passwdlen, setting, key, buf, buflen):
+ * Compute and encode an scrypt or enhanced scrypt hash of passwd given the
+ * parameters and salt value encoded in setting.  If shared is not NULL, a ROM
+ * is used and YESCRYPT_RW is required.  Otherwise, whether to compute classic
+ * scrypt, YESCRYPT_WORM (a slight deviation from classic scrypt), or
+ * YESCRYPT_RW (time-memory tradeoff discouraging modification) is determined
+ * by the setting string.  shared (if not NULL) and local must be initialized
+ * as described above for yescrypt_kdf().  buf must be large enough (as
+ * indicated by buflen) to hold the encoded hash string.
+ *
+ * Return the encoded hash string on success; or NULL on error.
+ *
+ * MT-safe as long as local and buf are local to the thread.
+ */
+extern char *yescrypt_r(
+            const uint8_t *passwd, size_t passwdlen,
+            const uint8_t *setting,
+            char *buf, size_t buflen
+);
diff --git a/libbb/yescrypt/y.c b/libbb/yescrypt/y.c
new file mode 100644
index 000000000..d5ab8903f
--- /dev/null
+++ b/libbb/yescrypt/y.c
@@ -0,0 +1,16 @@
+/*
+ * The compilation unit for yescrypt-related code.
+ *
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_USE_BB_CRYPT_YES) += y.o
+
+#include "libbb.h"
+
+#define YESCRYPT_INTERNAL
+#include "alg-yescrypt.h"
+#include "alg-sha256.c"
+#include "alg-yescrypt-kdf.c"
+#include "alg-yescrypt-common.c"
diff --git a/loginutils/Config.src b/loginutils/Config.src
index cbb09646b..a7812bd32 100644
--- a/loginutils/Config.src
+++ b/loginutils/Config.src
@@ -91,6 +91,17 @@ config USE_BB_CRYPT_SHA
         With this option off, login will fail password check for any
         user which has password encrypted with these algorithms.
 
+config USE_BB_CRYPT_YES
+        bool "Enable yescrypt functions"
+        default y
+        depends on USE_BB_CRYPT
+        help
+        Enable this if you have passwords starting with "$y$" or
+        in your /etc/passwd or /etc/shadow files. These passwords
+        are hashed using yescrypt algorithms.
+        With this option off, login will fail password check for any
+        user which has password encrypted with these algorithms.
+
 INSERT
 
 endmenu
diff --git a/loginutils/chpasswd.c b/loginutils/chpasswd.c
index 65530b614..353f19961 100644
--- a/loginutils/chpasswd.c
+++ b/loginutils/chpasswd.c
@@ -17,7 +17,7 @@
 //config:       default "des"
 //config:       depends on PASSWD || CRYPTPW || CHPASSWD
 //config:       help
-//config:       Possible choices are "d[es]", "m[d5]", "s[ha256]" or "sha512".
+//config:       Possible choices: "d[es]", "m[d5]", "s[ha256]", "sha512", "yescrypt"
 
 //applet:IF_CHPASSWD(APPLET(chpasswd, BB_DIR_USR_SBIN, BB_SUID_DROP))
 
diff --git a/loginutils/cryptpw.c b/loginutils/cryptpw.c
index 1c338540f..666deff0b 100644
--- a/loginutils/cryptpw.c
+++ b/loginutils/cryptpw.c
@@ -84,8 +84,7 @@ to cryptpw. -a option (alias for -m) came from cryptpw.
 int cryptpw_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int cryptpw_main(int argc UNUSED_PARAM, char **argv)
 {
-        /* Supports: cryptpw -m sha256 PASS 'rounds=999999999$SALT' */
-        char salt[MAX_PW_SALT_LEN + sizeof("rounds=999999999$")];
+        char salt[MAX_PW_SALT_LEN];
         char *salt_ptr;
         char *password;
         const char *opt_m, *opt_S;
@@ -100,7 +99,7 @@ int cryptpw_main(int argc UNUSED_PARAM, char **argv)
         ;
 #endif
         fd = STDIN_FILENO;
-        opt_m = CONFIG_FEATURE_DEFAULT_PASSWD_ALGO;
+        opt_m = NULL;
         opt_S = NULL;
         /* at most two non-option arguments; -P NUM */
         getopt32long(argv, "^" "sP:+S:m:a:" "\0" "?2",
@@ -114,10 +113,34 @@ int cryptpw_main(int argc UNUSED_PARAM, char **argv)
         if (argv[0] && !opt_S)
                 opt_S = argv[1];
 
-        salt_ptr = crypt_make_pw_salt(salt, opt_m);
-        if (opt_S)
-                /* put user's data after the "$N$" prefix */
-                safe_strncpy(salt_ptr, opt_S, sizeof(salt) - (sizeof("$N$")-1));
+        if (opt_S && !opt_S[0]) {
+                /* mkpasswd 5.6.2 compat: SALT of ""
+                 * is treated as not specified
+                 * (both forms: -S "" and argv[1] of "")
+                 */
+                opt_S = NULL;
+        }
+
+        if (opt_m) {
+                /* "cryptpw -m ALGO PASSWORD [SALT]" */
+                /* generate "$x$" algo prefix + random salt */
+                salt_ptr = crypt_make_pw_salt(salt, opt_m);
+                if (opt_S) {
+                        /* "cryptpw -m ALGO PASSWORD SALT" */
+                        /* put SALT data after the "$x$" prefix */
+                        safe_strncpy(salt_ptr, opt_S, sizeof(salt) - (sizeof("$N$")-1));
+                }
+        } else {
+                if (!opt_S) {
+                        /* "cryptpw PASSWORD" */
+                        /* generate random salt with default algo */
+                        crypt_make_pw_salt(salt, CONFIG_FEATURE_DEFAULT_PASSWD_ALGO);
+                } else {
+                        /* "cryptpw PASSWORD '$x$SALT'" */
+                        /* use given salt; algo will be detected by pw_encrypt() */
+                        safe_strncpy(salt, opt_S, sizeof(salt));
+                }
+        }
 
         xmove_fd(fd, STDIN_FILENO);
 
diff --git a/loginutils/sulogin.c b/loginutils/sulogin.c
index 9c927ed79..984889915 100644
--- a/loginutils/sulogin.c
+++ b/loginutils/sulogin.c
@@ -79,7 +79,7 @@ int sulogin_main(int argc UNUSED_PARAM, char **argv)
                         break;
                 }
                 pause_after_failed_login();
-                bb_simple_info_msg("Login incorrect");
+                bb_simple_error_msg("Login incorrect");
         }
 
         /* util-linux 2.36.1 compat: no message */
@@ -119,9 +119,12 @@ int sulogin_main(int argc UNUSED_PARAM, char **argv)
         }
 
         /*
-         * Note: login does this (should we do it too?):
+         * Note: login does this. util-linux's sulogin does NOT.
+         * But it's rather unpleasant to have non-functioning ^C in a shell,
+         * and surprisingly, there is no easy way to remove SIG_IGN from ^C
+         * in the shell. So, we are doing it:
          */
-        /*signal(SIGINT, SIG_DFL);*/
+        signal(SIGINT, SIG_DFL);
 
         /* Exec shell with no additional parameters. Never returns. */
         exec_shell(shell, /* -p? then shell is login:*/(opts & 1), NULL);
diff --git a/loginutils/suw32.c b/loginutils/suw32.c
index b3976dcfd..77c038582 100644
--- a/loginutils/suw32.c
+++ b/loginutils/suw32.c
@@ -48,8 +48,8 @@ int suw32_main(int argc UNUSED_PARAM, char **argv)
         char *opt_command = NULL;
         char *opt_shell = NULL;
         SHELLEXECUTEINFO info;
-        char *bb_path, *cwd, *realcwd, *q, *args;
-        DECLARE_PROC_ADDR(BOOL, ShellExecuteExA, SHELLEXECUTEINFOA *);
+        const char *bb_path;
+        char *cwd, *realcwd, *q, *args;
 
         opt = getopt32(argv, "^c:s:tNW" "\0" "s--N:N--s", &opt_command, &opt_shell);
         argv += optind;
@@ -70,19 +70,17 @@ int suw32_main(int argc UNUSED_PARAM, char **argv)
         }
 #endif
 
-        /* ShellExecuteEx() needs backslash as separator in UNC paths. */
         if (opt_shell) {
                 bb_path = file_is_win32_exe(opt_shell);
                 if (!bb_path)
                         bb_error_msg_and_die("%s: Not found", opt_shell);
                 args = NULL;
         } else {
-                bb_path = xstrdup(bb_busybox_exec_path);
+                bb_path = bb_busybox_exec_path;
                 args = xstrdup("--busybox ash");
                 if (!test_mode)
                         args = xappendword(args, "-t \"BusyBox ash (Admin)\"");
         }
-        slash_to_bs(bb_path);
 
         memset(&info, 0, sizeof(SHELLEXECUTEINFO));
         info.cbSize = sizeof(SHELLEXECUTEINFO);
@@ -137,12 +135,7 @@ int suw32_main(int argc UNUSED_PARAM, char **argv)
         /* info.lpDirectory = NULL; */
         info.nShow = SW_SHOWNORMAL;
 
-        if (!INIT_PROC_ADDR(shell32.dll, ShellExecuteExA)) {
-                ret = -1;
-                goto end;
-        }
-
-        if (!ShellExecuteExA(&info)) {
+        if (!mingw_shell_execute(&info)) {
                 ret = 1;
                 goto end;
         }
@@ -159,7 +152,8 @@ int suw32_main(int argc UNUSED_PARAM, char **argv)
         }
  end:
         if (ENABLE_FEATURE_CLEAN_UP) {
-                free(bb_path);
+                if (bb_path != bb_busybox_exec_path)
+                        free((void *)bb_path);
                 free(cwd);
                 free(realcwd);
                 free(args);
diff --git a/make_single_applets.sh b/make_single_applets.sh
index 7df53397e..45240de14 100755
--- a/make_single_applets.sh
+++ b/make_single_applets.sh
@@ -15,6 +15,7 @@ grep ^IF_ include/applets.h \
 | grep -v '^IF_FEATURE_' \
 | sed 's/IF_\([A-Z0-9._-]*\)(.*/\1/' \
 | grep -v '^BUSYBOX$' \
+| grep -v '^PLATFORM_' \
 | sort | uniq
 `"
 
@@ -31,6 +32,15 @@ done
 allno="`echo "$allno" | sed "s/^CONFIG_BUSYBOX=y\$/# CONFIG_BUSYBOX is not set/"`"
 # disable any CONFIG_script_DEPENDENCIES as well
 allno="`echo "$allno" | sed "s/^\(CONFIG_.*_DEPENDENCIES\)=y\$/# \1 is not set/"`"
+# Select platform
+if grep -q CONFIG_PLATFORM_MINGW32=y .config
+then
+        allno="`echo "$allno" | sed "s/^# CONFIG_PLATFORM_MINGW32 is not set\$/CONFIG_PLATFORM_MINGW32=y/"`"
+        EXE=".exe"
+else
+        allno="`echo "$allno" | sed "s/^# CONFIG_PLATFORM_POSIX is not set\$/CONFIG_PLATFORM_POSIX=y/"`"
+        EXE=""
+fi
 #echo "$allno" >.config_allno
 
 trap 'test -f .config.SV && mv .config.SV .config && touch .config' EXIT
@@ -69,7 +79,7 @@ for app; do
                 mv .config busybox_config_${app}
         elif ! grep -q '^#define NUM_APPLETS 1$' include/NUM_APPLETS.h; then
                 grep -i -e error: -e warning: busybox_make_${app}.log
-                mv busybox busybox_${app}
+                mv busybox${EXE} busybox_${app}${EXE}
                 fail=$((fail+1))
                 echo "NUM_APPLETS != 1 for ${app}: `cat include/NUM_APPLETS.h`"
                 mv .config busybox_config_${app}
@@ -86,7 +96,7 @@ for app; do
                 fi
                 grep -i -e error: -e warning: busybox_make_${app}.log \
                 || rm busybox_make_${app}.log
-                mv busybox busybox_${app}
+                mv busybox${EXE} busybox_${app}${EXE}
                 #mv .config busybox_config_${app}
         fi
         mv .config.SV .config
diff --git a/miscutils/crond.c b/miscutils/crond.c
index b3762d327..6a384fdfb 100644
--- a/miscutils/crond.c
+++ b/miscutils/crond.c
@@ -177,7 +177,7 @@ static void crondlog(unsigned level, const char *msg, va_list va)
 {
         if (level >= G.log_level) {
                 /*
-                 * We are called only for info meesages.
+                 * We are called only for info messages.
                  * Warnings/errors use plain bb_[p]error_msg's, which
                  * need not touch syslog_level
                  * (they are ok with LOG_ERR default).
@@ -989,7 +989,7 @@ static int check_completions(void)
                         if (line->cl_pid <= 0)
                                 continue;
 
-                        r = waitpid(line->cl_pid, NULL, WNOHANG);
+                        r = safe_waitpid(line->cl_pid, NULL, WNOHANG);
                         if (r < 0 || r == line->cl_pid) {
                                 process_finished_job(file->cf_username, line);
                                 if (line->cl_pid == 0) {
@@ -1001,6 +1001,14 @@ static int check_completions(void)
                         /* else: r == 0: "process is still running" */
                         file->cf_has_running = 1;
                 }
+
+                /* Reap any other children we don't actively track.
+                 * Reportedly, some people run crond as init process!
+                 * Thus, we need to reap orphans, like init does.
+                 */
+                while (wait_any_nohang(NULL) > 0)
+                        continue;
+
 //FIXME: if !file->cf_has_running && file->deleted: delete it!
 //otherwise deleted entries will stay forever, right?
                 num_still_running += file->cf_has_running;
diff --git a/miscutils/fbsplash.c b/miscutils/fbsplash.c
index 2934d8eb7..912a501a3 100644
--- a/miscutils/fbsplash.c
+++ b/miscutils/fbsplash.c
@@ -382,7 +382,7 @@ static void fb_drawimage(void)
         if (LONE_DASH(G.image_filename)) {
                 theme_file = stdin;
         } else {
-                int fd = open_zipped(G.image_filename, /*fail_if_not_compressed:*/ 0);
+                int fd = open_zipped(G.image_filename, /*die_if_not_compressed:*/ 0);
                 if (fd < 0)
                         bb_simple_perror_msg_and_die(G.image_filename);
                 theme_file = xfdopen_for_read(fd);
diff --git a/miscutils/less.c b/miscutils/less.c
index 467c76e2a..5a8fc5a74 100644
--- a/miscutils/less.c
+++ b/miscutils/less.c
@@ -1178,7 +1178,7 @@ static int64_t getch_nowait(void)
 
         /* We have kbd_fd in O_NONBLOCK mode, read inside safe_read_key()
          * would not block even if there is no input available */
-        key64 = safe_read_key(kbd_fd, kbd_input, /*timeout off:*/ -2);
+        key64 = safe_read_key(kbd_fd, kbd_input, /*do not poll:*/ -2);
         if ((int)key64 == -1) {
                 if (errno == EAGAIN) {
                         /* No keyboard input available. Since poll() did return,
diff --git a/miscutils/make.c b/miscutils/make.c
index 7316408bf..8026917b3 100644
--- a/miscutils/make.c
+++ b/miscutils/make.c
@@ -257,6 +257,11 @@ enum {
 #define MAKE_FAILURE            0x01
 #define MAKE_DIDSOMETHING       0x02
 
+// Return TRUE if c is allowed in a POSIX 2017 macro or target name
+#define ispname(c) (isalpha(c) || isdigit(c) || c == '.' || c == '_')
+// Return TRUE if c is in the POSIX 'portable filename character set'
+#define isfname(c) (ispname(c) || c == '-')
+
 #define HTABSIZE 39
 
 struct globals {
@@ -271,6 +276,7 @@ struct globals {
         time_t ar_mtime;
         int lineno;     // Physical line number in file
         int dispno;     // Line number for display purposes
+        struct cmd *curr_cmd;
         const char *rulepos;
         int rule_idx;
 #define IF_MAX 10
@@ -302,6 +308,7 @@ struct globals {
 #define ar_mtime        (G.ar_mtime)
 #define lineno          (G.lineno)
 #define dispno          (G.dispno)
+#define curr_cmd        (G.curr_cmd)
 #define rulepos         (G.rulepos)
 #define rule_idx        (G.rule_idx)
 #define clevel          (G.clevel)
@@ -320,11 +327,8 @@ struct globals {
 #endif
 
 static int make(struct name *np, int level);
-
-// Return TRUE if c is allowed in a POSIX 2017 macro or target name
-#define ispname(c) (isalpha(c) || isdigit(c) || c == '.' || c == '_')
-// Return TRUE if c is in the POSIX 'portable filename character set'
-#define isfname(c) (ispname(c) || c == '-')
+static struct name *dyndep(struct name *np, struct rule *infrule,
+                                                                const char **ptsuff);
 
 /*
  * Utility functions.
@@ -336,9 +340,20 @@ static int make(struct name *np, int level);
 static void
 vwarning(FILE *stream, const char *msg, va_list list)
 {
+        const char *m = NULL;
+        int d = 0;
+
+        if (curr_cmd) {
+                m = curr_cmd->c_makefile;
+                d = curr_cmd->c_dispno;
+        } else if (makefile) {
+                m = makefile;
+                d = dispno;
+        }
+
         fprintf(stream, "%s: ", applet_name);
-        if (makefile)
-                fprintf(stream, "(%s:%d): ", makefile, dispno);
+        if (m)
+                fprintf(stream, "(%s:%d): ", m, d);
         vfprintf(stream, msg, list);
         fputc('\n', stream);
 }
@@ -469,8 +484,7 @@ newcmd(struct cmd **cphead, char *str)
         /*(*cphead)->c_next = NULL; - xzalloc did it */
         (*cphead)->c_cmd = xstrdup(str);
         /*(*cphead)->c_refcnt = 0; */
-        if (makefile)
-                (*cphead)->c_makefile = xstrdup(makefile);
+        (*cphead)->c_makefile = xstrdup(makefile);
         (*cphead)->c_dispno = dispno;
 }
 
@@ -725,6 +739,7 @@ addrule(struct name *np, struct depend *dp, struct cmd *cp, int flag)
 {
         struct rule *rp;
         struct rule **rpp;
+        struct cmd *old_cp;
 
         // Can't mix single-colon and double-colon rules
         if (!posix && (np->n_flag & N_TARGET)) {
@@ -741,7 +756,7 @@ addrule(struct name *np, struct depend *dp, struct cmd *cp, int flag)
                 return;
         }
 
-        if (cp && !(np->n_flag & N_DOUBLE) && getcmd(np)) {
+        if (cp && !(np->n_flag & N_DOUBLE) && (old_cp = getcmd(np))) {
                 // Handle the inference rule redefinition case
                 // .DEFAULT rule can also be redefined (as an extension).
                 if ((np->n_flag & N_INFERENCE)
@@ -750,7 +765,17 @@ addrule(struct name *np, struct depend *dp, struct cmd *cp, int flag)
                         freerules(np->n_rule);
                         np->n_rule = NULL;
                 } else {
-                        error("commands defined twice for target %s", np->n_name);
+                        // We're adding commands to a single colon rule which
+                        // already has some.  Clear the old ones first.
+                        warning("overriding rule for target %s", np->n_name);
+                        curr_cmd = old_cp;
+                        warning("previous rule for target %s", np->n_name);
+                        curr_cmd = NULL;
+
+                        for (rp = np->n_rule; rp; rp = rp->r_next) {
+                                freecmds(rp->r_cmd);
+                                rp->r_cmd = NULL;
+                        }
                 }
         }
 
@@ -993,38 +1018,27 @@ suffix(const char *name)
 }
 
 /*
- * Dynamic dependency.  This routine applies the suffix rules
- * to try and find a source and a set of rules for a missing
- * target.  NULL is returned on failure.  On success the name of
- * the implicit prerequisite is returned and the details are
- * placed in the imprule structure provided by the caller.
+ * Search for an inference rule to convert some suffix ('psuff')
+ * to the target suffix 'tsuff'.  The basename of the prerequisite
+ * is 'base'.
  */
 static struct name *
-dyndep(struct name *np, struct rule *imprule)
+dyndep0(char *base, const char *tsuff, struct rule *infrule)
 {
-        char *suff, *newsuff;
-        char *base, *name, *member;
+        char *psuff;
         struct name *xp;                // Suffixes
         struct name *sp;                // Suffix rule
-        struct name *pp = NULL; // Implicit prerequisite
         struct rule *rp;
         struct depend *dp;
         bool chain = FALSE;
 
-        member = NULL;
-        name = splitlib(np->n_name, &member);
-
-        suff = xstrdup(suffix(name));
-        base = member ? member : name;
-        *suffix(base) = '\0';
-
         xp = newname(".SUFFIXES");
  retry:
         for (rp = xp->n_rule; rp; rp = rp->r_next) {
                 for (dp = rp->r_dep; dp; dp = dp->d_next) {
                         // Generate new suffix rule to try
-                        newsuff = dp->d_name->n_name;
-                        sp = findname(auto_concat(newsuff, suff));
+                        psuff = dp->d_name->n_name;
+                        sp = findname(auto_concat(psuff, tsuff));
                         if (sp && sp->n_rule) {
                                 struct name *ip;
                                 int got_ip;
@@ -1032,9 +1046,8 @@ dyndep(struct name *np, struct rule *imprule)
                                 // Has rule already been used in this chain?
                                 if ((sp->n_flag & N_MARK))
                                         continue;
-
                                 // Generate a name for an implicit prerequisite
-                                ip = newname(auto_concat(base, newsuff));
+                                ip = newname(auto_concat(base, psuff));
                                 if ((ip->n_flag & N_DOING))
                                         continue;
 
@@ -1045,20 +1058,19 @@ dyndep(struct name *np, struct rule *imprule)
                                         got_ip = ip->n_tim.tv_sec || (ip->n_flag & N_TARGET);
                                 } else {
                                         sp->n_flag |= N_MARK;
-                                        got_ip = dyndep(ip, NULL) != NULL;
+                                        got_ip = dyndep(ip, NULL, NULL) != NULL;
                                         sp->n_flag &= ~N_MARK;
                                 }
 
                                 if (got_ip) {
                                         // Prerequisite exists or we know how to make it
-                                        if (imprule) {
+                                        if (infrule) {
                                                 dp = NULL;
                                                 newdep(&dp, ip);
-                                                imprule->r_dep = dp;
-                                                imprule->r_cmd = sp->n_rule->r_cmd;
+                                                infrule->r_dep = dp;
+                                                infrule->r_cmd = sp->n_rule->r_cmd;
                                         }
-                                        pp = ip;
-                                        goto finish;
+                                        return ip;
                                 }
                         }
                 }
@@ -1069,9 +1081,87 @@ dyndep(struct name *np, struct rule *imprule)
                 chain = TRUE;
                 goto retry;
         }
- finish:
-        free(suff);
+        return NULL;
+}
+
+/*
+ * If 'name' ends with 'suffix' return an allocated string containing
+ * the name with the suffix removed, else return NULL.
+ */
+static char *
+has_suffix(const char *name, const char *suffix)
+{
+        ssize_t delta = strlen(name) - strlen(suffix);
+        char *base = NULL;
+
+        if (delta > 0 && strcmp(name + delta, suffix) == 0) {
+                base = xstrdup(name);
+                base[delta] = '\0';
+        }
+
+        return base;
+}
+
+/*
+ * Dynamic dependency.  This routine applies the suffix rules
+ * to try and find a source and a set of rules for a missing
+ * target.  NULL is returned on failure.  On success the name of
+ * the implicit prerequisite is returned and the rule used is
+ * placed in the infrule structure provided by the caller.
+ */
+static struct name *
+dyndep(struct name *np, struct rule *infrule, const char **ptsuff)
+{
+        const char *tsuff;
+        char *base, *name, *member;
+        struct name *pp = NULL; // Implicit prerequisite
+
+        member = NULL;
+        name = splitlib(np->n_name, &member);
+
+        // POSIX only allows inference rules with one or two periods.
+        // As an extension this restriction is lifted, but not for
+        // targets of the form lib.a(member.o).
+        if (!posix && member == NULL) {
+                struct name *xp = newname(".SUFFIXES");
+                int found_suffix = FALSE;
+
+                for (struct rule *rp = xp->n_rule; rp; rp = rp->r_next) {
+                        for (struct depend *dp = rp->r_dep; dp; dp = dp->d_next) {
+                                tsuff = dp->d_name->n_name;
+                                base = has_suffix(name, tsuff);
+                                if (base) {
+                                        found_suffix = TRUE;
+                                        pp = dyndep0(base, tsuff, infrule);
+                                        free(base);
+                                        if (pp) {
+                                                goto done;
+                                        }
+                                }
+                        }
+                }
+
+                if (!found_suffix) {
+                        // The name didn't have a known suffix. Try single-suffix rule.
+                        tsuff = "";
+                        pp = dyndep0(name, tsuff, infrule);
+                        if (pp) {
+ done:
+                                if (ptsuff) {
+                                        *ptsuff = tsuff;
+                                }
+                        }
+                }
+        } else {
+                tsuff = xstrdup(suffix(name));
+                base = member ? member : name;
+                *suffix(base) = '\0';
+
+                pp = dyndep0(base, tsuff, infrule);
+                free((void *)tsuff);
+        }
         free(name);
+
         return pp;
 }
 
@@ -1789,9 +1879,10 @@ readline(FILE *fd, int want_command)
 }
 
 /*
- * Return TRUE if the argument is a known suffix.
+ * Return a pointer to the suffix name if the argument is a known suffix
+ * or NULL if it isn't.
  */
-static int
+static const char *
 is_suffix(const char *s)
 {
         struct name *np;
@@ -1802,7 +1893,39 @@ is_suffix(const char *s)
         for (rp = np->n_rule; rp; rp = rp->r_next) {
                 for (dp = rp->r_dep; dp; dp = dp->d_next) {
                         if (strcmp(s, dp->d_name->n_name) == 0) {
-                                return TRUE;
+                                return dp->d_name->n_name;
+                        }
+                }
+        }
+        return NULL;
+}
+
+/*
+ * Return TRUE if the argument is formed by concatenating two
+ * known suffixes.
+ */
+static int
+is_inference_target(const char *s)
+{
+        struct name *np;
+        struct rule *rp1, *rp2;
+        struct depend *dp1, *dp2;
+
+        np = newname(".SUFFIXES");
+        for (rp1 = np->n_rule; rp1; rp1 = rp1->r_next) {
+                for (dp1 = rp1->r_dep; dp1; dp1 = dp1->d_next) {
+                        const char *suff1 = dp1->d_name->n_name;
+                        size_t len = strlen(suff1);
+
+                        if (strncmp(s, suff1, len) == 0) {
+                                for (rp2 = np->n_rule; rp2; rp2 = rp2->r_next) {
+                                        for (dp2 = rp2->r_dep; dp2; dp2 = dp2->d_next) {
+                                                const char *suff2 = dp2->d_name->n_name;
+                                                if (strcmp(s + len, suff2) == 0) {
+                                                        return TRUE;
+                                                }
+                                        }
+                                }
                         }
                 }
         }
@@ -1824,7 +1947,6 @@ enum {
 static int
 target_type(char *s)
 {
-        char *sfx;
         int ret;
         static const char *s_name =
                 ".DEFAULT\0"
@@ -1854,9 +1976,6 @@ target_type(char *s)
                 T_SPECIAL,
         };
 
-        if (*s != '.')
-                return T_NORMAL;
-
         // Check for one of the known special targets
         ret = index_in_strings(s_name, s);
         if (ret >= 0)
@@ -1864,16 +1983,23 @@ target_type(char *s)
 
         // Check for an inference rule
         ret = T_NORMAL;
-        sfx = suffix(s);
-        if (is_suffix(sfx)) {
-                if (s == sfx) { // Single suffix rule
+        if (!posix) {
+                if (is_suffix(s) || is_inference_target(s)) {
                         ret = T_INFERENCE | T_NOPREREQ | T_COMMAND;
-                } else {
-                        // Suffix is valid, check that prefix is too
-                        *sfx = '\0';
-                        if (is_suffix(s))
+                }
+        } else {
+                // In POSIX inference rule targets must contain one or two dots
+                char *sfx = suffix(s);
+                if (*s == '.' && is_suffix(sfx)) {
+                        if (s == sfx) { // Single suffix rule
                                 ret = T_INFERENCE | T_NOPREREQ | T_COMMAND;
-                        *sfx = '.';
+                        } else {
+                                // Suffix is valid, check that prefix is too
+                                *sfx = '\0';
+                                if (is_suffix(s))
+                                        ret = T_INFERENCE | T_NOPREREQ | T_COMMAND;
+                                *sfx = '.';
+                        }
                 }
         }
         return ret;
@@ -2069,6 +2195,20 @@ pragmas_from_env(void)
 #endif
 
 /*
+ * Determine if a line is a target rule with an inline command.
+ * Return a pointer to the semicolon separator if it is, else NULL.
+ */
+static char *
+inline_command(char *line)
+{
+        char *p = find_char(line, ':');
+
+        if (p)
+                p = strchr(p, ';');
+        return p;
+}
+
+/*
  * Parse input from the makefile and construct a tree structure of it.
  */
 static void
@@ -2287,9 +2427,9 @@ input(FILE *fd, int ilevel)
                 cp = NULL;
                 s = strchr(q, ';');
                 if (s) {
-                        // Retrieve command from expanded copy of line
+                        // Retrieve command from original or expanded copy of line
                         char *copy3 = expand_macros(copy, FALSE);
-                        if ((p = find_colon(copy3)) && (p = strchr(p, ';')))
+                        if ((p = inline_command(copy)) || (p = inline_command(copy3)))
                                 newcmd(&cp, process_command(p + 1));
                         free(copy3);
                         *s = '\0';
@@ -2486,8 +2626,7 @@ docmds(struct name *np, struct cmd *cp)
                 uint32_t ssilent, signore, sdomake;
 
                 // Location of command in makefile (for use in error messages)
-                makefile = cp->c_makefile;
-                dispno = cp->c_dispno;
+                curr_cmd = cp;
                 opts &= ~OPT_make;      // We want to know if $(MAKE) is expanded
                 q = command = expand_macros(cp->c_cmd, FALSE);
                 ssilent = silent || (np->n_flag & N_SILENT) || dotouch;
@@ -2581,13 +2720,38 @@ docmds(struct name *np, struct cmd *cp)
                 estat = MAKE_DIDSOMETHING;
         }
 
-        makefile = NULL;
+        curr_cmd = NULL;
         return estat;
 }
 
+/*
+ * Remove the suffix from a name, either the one provided in 'tsuff'
+ * or, if 'tsuff' is NULL, one of the known suffixes.
+ */
+static char *
+remove_suffix(const char *name, const char *tsuff)
+{
+        char *base = NULL;
+
+        if (tsuff != NULL) {
+                base = has_suffix(name, tsuff);
+        } else {
+                struct name *xp = newname(".SUFFIXES");
+                for (struct rule *rp = xp->n_rule; rp; rp = rp->r_next) {
+                        for (struct depend *dp = rp->r_dep; dp; dp = dp->d_next) {
+                                base = has_suffix(name, dp->d_name->n_name);
+                                if (base) {
+                                        return base;
+                                }
+                        }
+                }
+        }
+        return base;
+}
+
 static int
 make1(struct name *np, struct cmd *cp, char *oodate, char *allsrc,
-                char *dedup, struct name *implicit)
+                char *dedup, struct name *implicit, const char *tsuff)
 {
         char *name, *member = NULL, *base = NULL, *prereq = NULL;
 
@@ -2603,7 +2767,7 @@ make1(struct name *np, struct cmd *cp, char *oodate, char *allsrc,
                 char *s;
 
                 // As an extension, if we're not dealing with an implicit
-                // rule set $< to the first out-of-date prerequisite.
+                // prerequisite set $< to the first out-of-date prerequisite.
                 if (implicit == NULL) {
                         if (oodate) {
                                 s = strchr(oodate, ' ');
@@ -2614,15 +2778,26 @@ make1(struct name *np, struct cmd *cp, char *oodate, char *allsrc,
                 } else
                         prereq = implicit->n_name;
 
-                base = member ? member : name;
-                s = suffix(base);
-                // As an extension, if we're not dealing with an implicit
-                // rule and the target ends with a known suffix, remove it
-                // and set $* to the stem, else to an empty string.
-                if (implicit == NULL && !is_suffix(s))
-                        base = NULL;
-                else
-                        *s = '\0';
+                if (!posix && member == NULL) {
+                        // As an extension remove a suffix that doesn't necessarily
+                        // start with a period from a target, but not for targets
+                        // of the form lib.a(member.o).
+                        base = remove_suffix(name, tsuff);
+                        if (base) {
+                                free(name);
+                                name = base;
+                        }
+                } else {
+                        base = member ? member : name;
+                        s = suffix(base);
+                        // As an extension, if we're not dealing with an implicit
+                        // prerequisite and the target ends with a known suffix,
+                        // remove it and set $* to the stem, else to an empty string.
+                        if (implicit == NULL && !is_suffix(s))
+                                base = NULL;
+                        else
+                                *s = '\0';
+                }
         }
         setmacro("<", prereq, 0 | M_VALID);
         setmacro("*", base, 0 | M_VALID);
@@ -2667,11 +2842,12 @@ make(struct name *np, int level)
         struct depend *dp;
         struct rule *rp;
         struct name *impdep = NULL;     // implicit prerequisite
-        struct rule imprule;
+        struct rule infrule;
         struct cmd *sc_cmd = NULL;      // commands for single-colon rule
         char *oodate = NULL;
         char *allsrc = NULL;
         char *dedup = NULL;
+        const char *tsuff = NULL;
         struct timespec dtim = {1, 0};
         int estat = 0;
 
@@ -2690,10 +2866,10 @@ make(struct name *np, int level)
                 // as an extension, not for phony targets)
                 sc_cmd = getcmd(np);
                 if (!sc_cmd && (posix || !(np->n_flag & N_PHONY))) {
-                        impdep = dyndep(np, &imprule);
+                        impdep = dyndep(np, &infrule, &tsuff);
                         if (impdep) {
-                                sc_cmd = imprule.r_cmd;
-                                addrule(np, imprule.r_dep, NULL, FALSE);
+                                sc_cmd = infrule.r_cmd;
+                                addrule(np, infrule.r_dep, NULL, FALSE);
                         }
                 }
 
@@ -2708,14 +2884,15 @@ make(struct name *np, int level)
                         }
                         impdep = np;
                 }
-        }
-        else {
+        } else {
                 // If any double-colon rule has no commands we need
-                // an inference rule (but, as an extension, not for phony targets)
+                // an inference rule.
                 for (rp = np->n_rule; rp; rp = rp->r_next) {
                         if (!rp->r_cmd) {
-                                if (posix || !(np->n_flag & N_PHONY))
-                                        impdep = dyndep(np, &imprule);
+                                // Phony targets don't need an inference rule.
+                                if (!posix && (np->n_flag & N_PHONY))
+                                        continue;
+                                impdep = dyndep(np, &infrule, &tsuff);
                                 if (!impdep) {
                                         if (doinclude)
                                                 return 1;
@@ -2741,11 +2918,14 @@ make(struct name *np, int level)
                 // Each double-colon rule is handled separately.
                 if ((np->n_flag & N_DOUBLE)) {
                         // If the rule has no commands use the inference rule.
+                        // Unless there isn't one, as allowed for phony targets.
                         if (!rp->r_cmd) {
-                                locdep = impdep;
-                                imprule.r_dep->d_next = rp->r_dep;
-                                rp->r_dep = imprule.r_dep;
-                                rp->r_cmd = imprule.r_cmd;
+                                if (impdep) {
+                                        locdep = impdep;
+                                        infrule.r_dep->d_next = rp->r_dep;
+                                        rp->r_dep = infrule.r_dep;
+                                        rp->r_cmd = infrule.r_cmd;
+                                }
                         }
                         // A rule with no prerequisities is executed unconditionally.
                         if (!rp->r_dep)
@@ -2776,7 +2956,7 @@ make(struct name *np, int level)
                         if (((np->n_flag & N_PHONY) || timespec_le(&np->n_tim, &dtim))) {
                                 if (!(estat & MAKE_FAILURE)) {
                                         estat |= make1(np, rp->r_cmd, oodate, allsrc,
-                                                                                dedup, locdep);
+                                                                                dedup, locdep, tsuff);
                                         dtim = (struct timespec){1, 0};
                                 }
                                 free(oodate);
@@ -2792,7 +2972,7 @@ make(struct name *np, int level)
                 }
         }
         if ((np->n_flag & N_DOUBLE) && impdep)
-                free(imprule.r_dep);
+                free(infrule.r_dep);
 
         np->n_flag |= N_DONE;
         np->n_flag &= ~N_DOING;
@@ -2801,7 +2981,8 @@ make(struct name *np, int level)
                                 ((np->n_flag & N_PHONY) || (timespec_le(&np->n_tim, &dtim)))) {
                 if (!(estat & MAKE_FAILURE)) {
                         if (sc_cmd)
-                                estat |= make1(np, sc_cmd, oodate, allsrc, dedup, impdep);
+                                estat |= make1(np, sc_cmd, oodate, allsrc, dedup,
+                                                                impdep, tsuff);
                         else if (!doinclude && level == 0 && !(estat & MAKE_DIDSOMETHING))
                                 warning("nothing to be done for %s", np->n_name);
                 } else if (!doinclude && !quest) {
diff --git a/miscutils/man.c b/miscutils/man.c
index 3954455b4..38c1b9aa3 100644
--- a/miscutils/man.c
+++ b/miscutils/man.c
@@ -143,7 +143,7 @@ static int run_pipe(char *man_filename, int man, int level)
 
  ordinary_manpage:
         close(STDIN_FILENO);
-        open_zipped(man_filename, /*fail_if_not_compressed:*/ 0); /* guaranteed to use fd 0 (STDIN_FILENO) */
+        open_zipped(man_filename, /*die_if_not_compressed:*/ 0); /* guaranteed to use fd 0 (STDIN_FILENO) */
         if (man) {
                 int w = get_terminal_width(-1);
                 if (w > 10)
diff --git a/modutils/modprobe-small.c b/modutils/modprobe-small.c
index 77e42e3fb..31a215a29 100644
--- a/modutils/modprobe-small.c
+++ b/modutils/modprobe-small.c
@@ -186,15 +186,6 @@ static char* find_keyword(char *ptr, size_t len, const char *word)
         return NULL;
 }
 
-static void replace(char *s, char what, char with)
-{
-        while (*s) {
-                if (what == *s)
-                        *s = with;
-                ++s;
-        }
-}
-
 static char *filename2modname(const char *filename, char *modname)
 {
         int i;
@@ -230,7 +221,7 @@ static char* str_2_list(const char *str)
         dst[len] = '\0';
         memcpy(dst, str, len);
 //TODO: protect against 2+ spaces: "word  word"
-        replace(dst, ' ', '\0');
+        replace_char(dst, ' ', '\0');
         return dst;
 }
 
@@ -369,14 +360,14 @@ static int parse_module(module_info *info, const char *pathname)
         }
         bksp(); /* remove last ' ' */
         info->aliases = copy_stringbuf();
-        replace(info->aliases, '-', '_');
+        replace_char(info->aliases, '-', '_');
 
         /* "dependency1 depandency2" */
         reset_stringbuf();
         ptr = find_keyword(module_image, len, "depends=");
         if (ptr && *ptr) {
-                replace(ptr, ',', ' ');
-                replace(ptr, '-', '_');
+                replace_char(ptr, ',', ' ');
+                replace_char(ptr, '-', '_');
                 dbg2_error_msg("dep:'%s'", ptr);
                 append(ptr);
         }
@@ -707,7 +698,7 @@ static int process_module(char *name, const char *cmdline_options)
 
         dbg1_error_msg("process_module('%s','%s')", name, cmdline_options);
 
-        replace(name, '-', '_');
+        replace_char(name, '-', '_');
 
         dbg1_error_msg("already_loaded:%d is_remove:%d", already_loaded(name), is_remove);
 
@@ -735,7 +726,7 @@ static int process_module(char *name, const char *cmdline_options)
                 char *opt_filename = xasprintf("/etc/modules/%s", name);
                 options = xmalloc_open_read_close(opt_filename, NULL);
                 if (options)
-                        replace(options, '\n', ' ');
+                        replace_char(options, '\n', ' ');
 #if ENABLE_FEATURE_CMDLINE_MODULE_OPTIONS
                 if (cmdline_options) {
                         /* NB: cmdline_options always have one leading ' '
diff --git a/modutils/modprobe.c b/modutils/modprobe.c
index 543f53e99..f890abe53 100644
--- a/modutils/modprobe.c
+++ b/modutils/modprobe.c
@@ -579,7 +579,7 @@ int modprobe_main(int argc UNUSED_PARAM, char **argv)
                 parser_t *p = config_open2(CONFIG_DEFAULT_DEPMOD_FILE, xfopen_for_read);
 
                 for (i = 0; argv[i]; i++)
-                        replace(argv[i], '-', '_');
+                        replace_char(argv[i], '-', '_');
 
                 while (config_read(p, tokens, 2, 1, "# \t", PARSE_NORMAL)) {
                         colon = last_char_is(tokens[0], ':');
diff --git a/modutils/modutils.c b/modutils/modutils.c
index cbff20961..862f71f57 100644
--- a/modutils/modutils.c
+++ b/modutils/modutils.c
@@ -69,15 +69,6 @@ void FAST_FUNC moddb_free(module_db *db)
         }
 }
 
-void FAST_FUNC replace(char *s, char what, char with)
-{
-        while (*s) {
-                if (what == *s)
-                        *s = with;
-                ++s;
-        }
-}
-
 int FAST_FUNC string_to_llist(char *string, llist_t **llist, const char *delim)
 {
         char *tok;
diff --git a/modutils/modutils.h b/modutils/modutils.h
index 4a702e97c..9b05116d1 100644
--- a/modutils/modutils.h
+++ b/modutils/modutils.h
@@ -47,7 +47,6 @@ module_entry *moddb_get(module_db *db, const char *s) FAST_FUNC;
 module_entry *moddb_get_or_create(module_db *db, const char *s) FAST_FUNC;
 void moddb_free(module_db *db) FAST_FUNC;
 
-void replace(char *s, char what, char with) FAST_FUNC;
 int string_to_llist(char *string, llist_t **llist, const char *delim) FAST_FUNC;
 char *filename2modname(const char *filename, char *modname) FAST_FUNC;
 #if ENABLE_FEATURE_CMDLINE_MODULE_OPTIONS
diff --git a/networking/Config.src b/networking/Config.src
index 0942645c3..aa0806a18 100644
--- a/networking/Config.src
+++ b/networking/Config.src
@@ -72,9 +72,28 @@ config FEATURE_HWIB
         help
         Support for printing infiniband addresses in network applets.
 
+choice
+        prompt "TLS implementation"
+        default FEATURE_TLS_INTERNAL
+
+config FEATURE_TLS_INTERNAL
+        bool "Internal"
+        depends on TLS
+        help
+        Use the BusyBox default internal TLS implementation.
+
+config FEATURE_TLS_SCHANNEL
+        bool "Schannel SSP"
+        depends on TLS && PLATFORM_MINGW32
+        help
+        Use the Schannel SSP to provide TLS support.
+        Reduces code size and enables certificate checking.
+
+endchoice
+
 config FEATURE_TLS_SHA1
         bool "In TLS code, support ciphers which use deprecated SHA1"
-        depends on TLS
+        depends on FEATURE_TLS_INTERNAL
         default n
         help
         Selecting this option increases interoperability with very old
@@ -83,6 +102,15 @@ config FEATURE_TLS_SHA1
         Most TLS servers support SHA256 today (2018), since SHA1 is
         considered possibly insecure (although not yet definitely broken).
 
+config FEATURE_TLS_SCHANNEL_1_3
+        bool "Enable TLS 1.3 support for Schannel"
+        depends on FEATURE_TLS_SCHANNEL
+        default n
+        help
+        Enable TLS 1.3 support for Schannel.
+        This only works on Windows 11/Server 2022
+        and up.
+
 INSERT
 
 source networking/udhcp/Config.in
diff --git a/networking/ftpd.c b/networking/ftpd.c
index 0d6a289c7..c3125410e 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -190,54 +190,39 @@ struct globals {
 } while (0)
 
 
+/* escape_text("pfx:", str, (0xff << 8) + '\r')
+ * Duplicate 0xff, append \r ^^^^^^^^^^^^^^^^^^
+ */
 static char *
 escape_text(const char *prepend, const char *str, unsigned escapee)
 {
-        unsigned retlen, remainlen, chunklen;
-        char *ret, *found;
+        char *ret, *p;
         char append;
 
         append = (char)escapee;
         escapee >>= 8;
 
-        remainlen = strlen(str);
-        retlen = strlen(prepend);
-        ret = xmalloc(retlen + remainlen * 2 + 1 + 1);
-        strcpy(ret, prepend);
+        ret = xmalloc(strlen(prepend) + strlen(str) * 2 + 1 + 1);
+        p = stpcpy(ret, prepend);
 
         for (;;) {
-                found = strchrnul(str, escapee);
-                chunklen = found - str + 1;
+                char *found = strchrnul(str, escapee);
 
-                /* Copy chunk up to and including escapee (or NUL) to ret */
-                memcpy(ret + retlen, str, chunklen);
-                retlen += chunklen;
+                /* Copy up to and including escapee (or NUL) */
+                p = mempcpy(p, str, found - str + 1);
 
                 if (*found == '\0') {
                         /* It wasn't escapee, it was NUL! */
-                        ret[retlen - 1] = append; /* replace NUL */
-                        ret[retlen] = '\0'; /* add NUL */
                         break;
                 }
-                ret[retlen++] = escapee; /* duplicate escapee */
                 str = found + 1;
+                *p++ = escapee; /* duplicate escapee */
         }
+        p[-1] = append; /* replace NUL */
+        *p = '\0'; /* add NUL */
         return ret;
 }
 
-/* Returns strlen as a bonus */
-static unsigned
-replace_char(char *str, char from, char to)
-{
-        char *p = str;
-        while (*p) {
-                if (*p == from)
-                        *p = to;
-                p++;
-        }
-        return p - str;
-}
-
 static void
 verbose_log(const char *str)
 {
diff --git a/networking/hostname.c b/networking/hostname.c
index 36cb70866..101b89e77 100644
--- a/networking/hostname.c
+++ b/networking/hostname.c
@@ -25,8 +25,8 @@
 //applet:IF_DNSDOMAINNAME(APPLET_NOEXEC(dnsdomainname, hostname, BB_DIR_BIN, BB_SUID_DROP, dnsdomainname))
 //applet:IF_HOSTNAME(     APPLET_NOEXEC(hostname,      hostname, BB_DIR_BIN, BB_SUID_DROP, hostname     ))
 
-//kbuild: lib-$(CONFIG_HOSTNAME) += hostname.o
-//kbuild: lib-$(CONFIG_DNSDOMAINNAME) += hostname.o
+//kbuild:lib-$(CONFIG_HOSTNAME) += hostname.o
+//kbuild:lib-$(CONFIG_DNSDOMAINNAME) += hostname.o
 
 //usage:#define hostname_trivial_usage
 //usage:       "[-sidf] [HOSTNAME | -F FILE]"
diff --git a/networking/httpd.c b/networking/httpd.c
index 1dae602ee..50595104c 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -3074,7 +3074,7 @@ int httpd_main(int argc UNUSED_PARAM, char **argv)
                 salt[0] = '$';
                 salt[1] = '1';
                 salt[2] = '$';
-                crypt_make_salt(salt + 3, 4);
+                crypt_make_rand64encoded(salt + 3, 8 / 2); /* 8 chars */
                 puts(pw_encrypt(pass, salt, /*cleanup:*/ 0));
                 return 0;
         }
diff --git a/networking/libiproute/iproute.c b/networking/libiproute/iproute.c
index cd77f642f..a30f070eb 100644
--- a/networking/libiproute/iproute.c
+++ b/networking/libiproute/iproute.c
@@ -302,24 +302,22 @@ static int FAST_FUNC print_route(const struct sockaddr_nl *who UNUSED_PARAM,
                 printf("notify ");
         }
 
-        if (r->rtm_family == AF_INET6) {
-                struct rta_cacheinfo *ci = NULL;
-                if (tb[RTA_CACHEINFO]) {
-                        ci = RTA_DATA(tb[RTA_CACHEINFO]);
-                }
-                if ((r->rtm_flags & RTM_F_CLONED) || (ci && ci->rta_expires)) {
+        if (r->rtm_family == AF_INET || r->rtm_family == AF_INET6) {
+                if (r->rtm_family == AF_INET) {
                         if (r->rtm_flags & RTM_F_CLONED) {
                                 printf("%c    cache ", _SL_);
+                                /* upstream: print_cache_flags() prints more here */
                         }
+                }
+                if (tb[RTA_CACHEINFO]) {
+                        struct rta_cacheinfo *ci = RTA_DATA(tb[RTA_CACHEINFO]);
                         if (ci->rta_expires) {
                                 printf(" expires %dsec", ci->rta_expires / get_hz());
                         }
                         if (ci->rta_error != 0) {
                                 printf(" error %d", ci->rta_error);
                         }
-                } else if (ci) {
-                        if (ci->rta_error != 0)
-                                printf(" error %d", ci->rta_error);
+                        /* upstream: print_rta_cacheinfo() prints more here */
                 }
         }
         if (tb[RTA_IIF] && G_filter.iif == 0) {
diff --git a/networking/ntpd.c b/networking/ntpd.c
index dcbdb8e60..efe9f5326 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -205,7 +205,7 @@
 #define MINDISP         0.01    /* minimum dispersion (sec) */
 #define MAXDISP         16      /* maximum dispersion (sec) */
 #define MAXSTRAT        16      /* maximum stratum (infinity metric) */
-#define MAXDIST         1       /* distance threshold (sec) */
+#define MAXDIST         3       /* distance threshold (sec): do not use peers who are farther away */
 #define MIN_SELECTED    1       /* minimum intersection survivors */
 #define MIN_CLUSTERED   3       /* minimum cluster survivors */
 
@@ -1057,7 +1057,7 @@ step_time(double offset)
         }
         tval = tvn.tv_sec;
         strftime_YYYYMMDDHHMMSS(buf, sizeof(buf), &tval);
-        bb_info_msg("setting time to %s.%06u (offset %+fs)", buf, (unsigned)tvn.tv_usec, offset);
+        bb_error_msg("setting time to %s.%06u (offset %+fs)", buf, (unsigned)tvn.tv_usec, offset);
         //maybe? G.FREQHOLD_cnt = 0;
 
         /* Correct various fields which contain time-relative values: */
@@ -1645,7 +1645,7 @@ update_local_clock(peer_t *p)
         /* 65536 is one ppm */
         tmx.freq = G.discipline_freq_drift * 65536e6;
 #endif
-        tmx.modes = ADJ_OFFSET | ADJ_STATUS | ADJ_TIMECONST;// | ADJ_MAXERROR | ADJ_ESTERROR;
+        tmx.modes = ADJ_OFFSET | ADJ_STATUS | ADJ_TIMECONST | ADJ_MAXERROR | ADJ_ESTERROR;
 
         tmx.offset = (long)(offset * 1000000); /* usec */
         if (SLEW_THRESHOLD < STEP_THRESHOLD) {
@@ -1738,16 +1738,23 @@ update_local_clock(peer_t *p)
         if (tmx.constant < 0)
                 tmx.constant = 0;
 
-        //tmx.esterror = (uint32_t)(clock_jitter * 1e6);
-        //tmx.maxerror = (uint32_t)((sys_rootdelay / 2 + sys_rootdisp) * 1e6);
+        /* For ADJ_MAXERROR and ADJ_ESTERROR: */
+        /* kernel increments this by 500us each second, sets STA_UNSYNC if exceeds 16 seconds: */
+        tmx.maxerror = (uint32_t)((G.rootdelay / 2 + G.rootdisp) * 1000000.0);
+        /* (without ADJ_MAXERROR, time adjustment still works, but kernel uses
+         * conservative maxerror value and quickly sets STA_UNSYNC)
+         */
+        /* esterror is not used by kernel, presumably may be used by other programs reading adjtimex result: */
+        tmx.esterror = (uint32_t)(G.discipline_jitter * 1000000.0);
+
         rc = adjtimex(&tmx);
         if (rc < 0)
                 bb_simple_perror_msg_and_die("adjtimex");
         /* NB: here kernel returns constant == G.poll_exp, not == G.poll_exp - 4.
          * Not sure why. Perhaps it is normal.
          */
-        VERB4 bb_error_msg("adjtimex:%d freq:%ld offset:%+ld status:0x%x",
-                                rc, (long)tmx.freq, (long)tmx.offset, tmx.status);
+        VERB4 bb_error_msg("adjtimex:%d freq:%ld offset:%+ld esterror:%ld maxerror:%ld status:0x%x",
+                                rc, (long)tmx.freq, (long)tmx.offset, (long)tmx.esterror, (long)tmx.maxerror, tmx.status);
         G.kernel_freq_drift = tmx.freq / 65536;
         VERB2 bb_error_msg("update from:%s offset:%+f delay:%f jitter:%f clock drift:%+.3fppm tc:%d",
                         p->p_dotted,
@@ -1976,7 +1983,7 @@ recv_and_process_peer_pkt(peer_t *p)
 
         p->reachable_bits |= 1;
         if ((MAX_VERBOSE && G.verbose) || (option_mask32 & OPT_w)) {
-                bb_info_msg("reply from %s: offset:%+f delay:%f status:0x%02x strat:%d refid:0x%08x rootdelay:%f reach:0x%02x",
+                bb_error_msg("reply from %s: offset:%+f delay:%f status:0x%02x strat:%d refid:0x%08x rootdelay:%f reach:0x%02x",
                         p->p_dotted,
                         offset,
                         p->p_raw_delay,
diff --git a/networking/telnetd.c b/networking/telnetd.c
index bfeea1400..a5a783047 100644
--- a/networking/telnetd.c
+++ b/networking/telnetd.c
@@ -104,8 +104,8 @@
 //usage:#define telnetd_full_usage "\n\n"
 //usage:       "Handle incoming telnet connections"
 //usage:        IF_NOT_FEATURE_TELNETD_STANDALONE(" via inetd") "\n"
-//usage:     "\n        -l LOGIN        Exec LOGIN on connect"
-//usage:     "\n        -f ISSUE_FILE   Display ISSUE_FILE instead of /etc/issue"
+//usage:     "\n        -l LOGIN        Exec LOGIN on connect (default /bin/login)"
+//usage:     "\n        -f ISSUE_FILE   Display ISSUE_FILE instead of /etc/issue.net"
 //usage:     "\n        -K              Close connection as soon as login exits"
 //usage:     "\n                        (normally wait until all programs close slave pty)"
 //usage:        IF_FEATURE_TELNETD_STANDALONE(
diff --git a/networking/tftp.c b/networking/tftp.c
index f5b4367ca..b698a9288 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -250,7 +250,7 @@ static int tftp_blksize_check(const char *blksize_str, int maxsize)
                 return -1;
         }
 # if ENABLE_TFTP_DEBUG
-        bb_info_msg("using blksize %u", blksize);
+        bb_error_msg("using blksize %u", blksize);
 # endif
         return blksize;
 }
diff --git a/networking/tls.c b/networking/tls.c
index 9f1dd67ec..97217f435 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -10,18 +10,19 @@
 //Config.src also defines FEATURE_TLS_SHA1 option
 
 //kbuild:lib-$(CONFIG_TLS) += tls.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm_montgomery_reduce.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm_mul_comba.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm_sqr_comba.o
-//kbuild:lib-$(CONFIG_TLS) += tls_aes.o
-//kbuild:lib-$(CONFIG_TLS) += tls_aesgcm.o
-//kbuild:lib-$(CONFIG_TLS) += tls_rsa.o
-//kbuild:lib-$(CONFIG_TLS) += tls_fe.o
-//kbuild:lib-$(CONFIG_TLS) += tls_sp_c32.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm_montgomery_reduce.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm_mul_comba.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm_sqr_comba.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_aes.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_aesgcm.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_rsa.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_fe.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_sp_c32.o
 
 #include "tls.h"
 
+#if !ENABLE_FEATURE_TLS_SCHANNEL
 // Usually enabled. You can disable some of them to force only
 // specific ciphers to be advertized to server.
 // (this would not exclude code to handle disabled ciphers, no code size win)
@@ -188,8 +189,6 @@
 #define TLS_MAX_OUTBUF          (1 << 14)
 
 enum {
-        SHA_INSIZE     = 64,
-
         AES128_KEYSIZE = 16,
         AES256_KEYSIZE = 32,
 
@@ -335,34 +334,6 @@ void FAST_FUNC tls_get_random(void *buf, unsigned len)
                 xfunc_die();
 }
 
-static void xorbuf3(void *dst, const void *src1, const void *src2, unsigned count)
-{
-        uint8_t *d = dst;
-        const uint8_t *s1 = src1;
-        const uint8_t* s2 = src2;
-        while (count--)
-                *d++ = *s1++ ^ *s2++;
-}
-
-void FAST_FUNC xorbuf(void *dst, const void *src, unsigned count)
-{
-        xorbuf3(dst, dst, src, count);
-}
-
-void FAST_FUNC xorbuf_aligned_AES_BLOCK_SIZE(void *dst, const void *src)
-{
-        unsigned long *d = dst;
-        const unsigned long *s = src;
-        d[0] ^= s[0];
-#if ULONG_MAX <= 0xffffffffffffffff
-        d[1] ^= s[1];
- #if ULONG_MAX == 0xffffffff
-        d[2] ^= s[2];
-        d[3] ^= s[3];
- #endif
-#endif
-}
-
 #if !TLS_DEBUG_HASH
 # define hash_handshake(tls, fmt, buffer, len) \
          hash_handshake(tls, buffer, len)
@@ -393,128 +364,6 @@ static void hash_handshake(tls_state_t *tls, const char *fmt, const void *buffer
 # define TLS_MAC_SIZE(tls) (tls)->MAC_size
 #endif
 
-// RFC 2104:
-// HMAC(key, text) based on a hash H (say, sha256) is:
-// ipad = [0x36 x INSIZE]
-// opad = [0x5c x INSIZE]
-// HMAC(key, text) = H((key XOR opad) + H((key XOR ipad) + text))
-//
-// H(key XOR opad) and H(key XOR ipad) can be precomputed
-// if we often need HMAC hmac with the same key.
-//
-// text is often given in disjoint pieces.
-typedef struct hmac_precomputed {
-        md5sha_ctx_t hashed_key_xor_ipad;
-        md5sha_ctx_t hashed_key_xor_opad;
-} hmac_precomputed_t;
-
-typedef void md5sha_begin_func(md5sha_ctx_t *ctx) FAST_FUNC;
-#if !ENABLE_FEATURE_TLS_SHA1
-#define hmac_begin(pre,key,key_size,begin) \
-        hmac_begin(pre,key,key_size)
-#define begin sha256_begin
-#endif
-static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size, md5sha_begin_func *begin)
-{
-        uint8_t key_xor_ipad[SHA_INSIZE];
-        uint8_t key_xor_opad[SHA_INSIZE];
-//      uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
-        unsigned i;
-
-        // "The authentication key can be of any length up to INSIZE, the
-        // block length of the hash function.  Applications that use keys longer
-        // than INSIZE bytes will first hash the key using H and then use the
-        // resultant OUTSIZE byte string as the actual key to HMAC."
-        if (key_size > SHA_INSIZE) {
-                bb_simple_error_msg_and_die("HMAC key>64"); //does not happen (yet?)
-//              md5sha_ctx_t ctx;
-//              begin(&ctx);
-//              md5sha_hash(&ctx, key, key_size);
-//              key_size = sha_end(&ctx, tempkey);
-//              //key = tempkey; - right? RIGHT? why does it work without this?
-//              // because SHA_INSIZE is 64, but hmac() is always called with
-//              // key_size = tls->MAC_size = SHA1/256_OUTSIZE (20 or 32),
-//              // and prf_hmac_sha256() -> hmac_sha256() key sizes are:
-//              // - RSA_PREMASTER_SIZE is 48
-//              // - CURVE25519_KEYSIZE is 32
-//              // - master_secret[] is 48
-        }
-
-        for (i = 0; i < key_size; i++) {
-                key_xor_ipad[i] = key[i] ^ 0x36;
-                key_xor_opad[i] = key[i] ^ 0x5c;
-        }
-        for (; i < SHA_INSIZE; i++) {
-                key_xor_ipad[i] = 0x36;
-                key_xor_opad[i] = 0x5c;
-        }
-
-        begin(&pre->hashed_key_xor_ipad);
-        begin(&pre->hashed_key_xor_opad);
-        md5sha_hash(&pre->hashed_key_xor_ipad, key_xor_ipad, SHA_INSIZE);
-        md5sha_hash(&pre->hashed_key_xor_opad, key_xor_opad, SHA_INSIZE);
-}
-#undef begin
-
-static unsigned hmac_sha_precomputed_v(
-                hmac_precomputed_t *pre,
-                uint8_t *out,
-                va_list va)
-{
-        uint8_t *text;
-        unsigned len;
-
-        /* pre->hashed_key_xor_ipad contains unclosed "H((key XOR ipad) +" state */
-        /* pre->hashed_key_xor_opad contains unclosed "H((key XOR opad) +" state */
-
-        /* calculate out = H((key XOR ipad) + text) */
-        while ((text = va_arg(va, uint8_t*)) != NULL) {
-                unsigned text_size = va_arg(va, unsigned);
-                md5sha_hash(&pre->hashed_key_xor_ipad, text, text_size);
-        }
-        len = sha_end(&pre->hashed_key_xor_ipad, out);
-
-        /* out = H((key XOR opad) + out) */
-        md5sha_hash(&pre->hashed_key_xor_opad, out, len);
-        return sha_end(&pre->hashed_key_xor_opad, out);
-}
-
-static unsigned hmac_sha_precomputed(hmac_precomputed_t *pre_init, uint8_t *out, ...)
-{
-        hmac_precomputed_t pre;
-        va_list va;
-        unsigned len;
-
-        va_start(va, out);
-        pre = *pre_init; /* struct copy */
-        len = hmac_sha_precomputed_v(&pre, out, va);
-        va_end(va);
-        return len;
-}
-
-#if !ENABLE_FEATURE_TLS_SHA1
-#define hmac(tls,out,key,key_size,...) \
-        hmac(out,key,key_size, __VA_ARGS__)
-#endif
-static unsigned hmac(tls_state_t *tls, uint8_t *out, uint8_t *key, unsigned key_size, ...)
-{
-        hmac_precomputed_t pre;
-        va_list va;
-        unsigned len;
-
-        va_start(va, key_size);
-
-        hmac_begin(&pre, key, key_size,
-                        (ENABLE_FEATURE_TLS_SHA1 && tls->MAC_size == SHA1_OUTSIZE)
-                                ? sha1_begin
-                                : sha256_begin
-        );
-        len = hmac_sha_precomputed_v(&pre, out, va);
-
-        va_end(va);
-        return len;
-}
-
 // RFC 5246:
 // 5.  HMAC and the Pseudorandom Function
 //...
@@ -559,7 +408,7 @@ static void prf_hmac_sha256(/*tls_state_t *tls,*/
                 const char *label,
                 uint8_t *seed, unsigned seed_size)
 {
-        hmac_precomputed_t pre;
+        hmac_ctx_t ctx;
         uint8_t a[TLS_MAX_MAC_SIZE];
         uint8_t *out_p = outbuf;
         unsigned label_size = strlen(label);
@@ -569,26 +418,27 @@ static void prf_hmac_sha256(/*tls_state_t *tls,*/
 #define SEED   label, label_size, seed, seed_size
 #define A      a, MAC_size
 
-        hmac_begin(&pre, secret, secret_size, sha256_begin);
+        hmac_begin(&ctx, secret, secret_size, sha256_begin_hmac);
 
         /* A(1) = HMAC_hash(secret, seed) */
-        hmac_sha_precomputed(&pre, a, SEED, NULL);
+        hmac_peek_hash(&ctx, a, SEED, NULL);
 
         for (;;) {
                 /* HMAC_hash(secret, A(1) + seed) */
                 if (outbuf_size <= MAC_size) {
                         /* Last, possibly incomplete, block */
                         /* (use a[] as temp buffer) */
-                        hmac_sha_precomputed(&pre, a, A, SEED, NULL);
+                        hmac_peek_hash(&ctx, a, A, SEED, NULL);
                         memcpy(out_p, a, outbuf_size);
+                        hmac_uninit(&ctx);
                         return;
                 }
                 /* Not last block. Store directly to result buffer */
-                hmac_sha_precomputed(&pre, out_p, A, SEED, NULL);
+                hmac_peek_hash(&ctx, out_p, A, SEED, NULL);
                 out_p += MAC_size;
                 outbuf_size -= MAC_size;
                 /* A(2) = HMAC_hash(secret, A(1)) */
-                hmac_sha_precomputed(&pre, a, A, NULL);
+                hmac_peek_hash(&ctx, a, A, NULL);
         }
 #undef A
 #undef SECRET
@@ -655,6 +505,32 @@ static void *tls_get_zeroed_outbuf(tls_state_t *tls, int len)
         return record;
 }
 
+/* Calculate the HMAC over the list of blocks */
+#if !ENABLE_FEATURE_TLS_SHA1
+#define hmac_blocks(tls,out,key,key_size,...) \
+        hmac_blocks(out,key,key_size, __VA_ARGS__)
+#endif
+static unsigned hmac_blocks(tls_state_t *tls, uint8_t *out, uint8_t *key, unsigned key_size, ...)
+{
+        hmac_ctx_t ctx;
+        va_list va;
+        unsigned len;
+
+        hmac_begin(&ctx, key, key_size,
+                        (ENABLE_FEATURE_TLS_SHA1 && tls->MAC_size == SHA1_OUTSIZE)
+                                ? sha1_begin_hmac
+                                : sha256_begin_hmac
+        );
+
+        va_start(va, key_size);
+        hmac_hash_v(&ctx, va);
+        va_end(va);
+
+        len = hmac_end(&ctx, out);
+        hmac_uninit(&ctx);
+        return len;
+}
+
 static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, unsigned type)
 {
         uint8_t *buf = tls->outbuf + OUTBUF_PFX;
@@ -676,7 +552,7 @@ static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, un
         xhdr->len16_lo = size & 0xff;
 
         /* Calculate MAC signature */
-        hmac(tls, buf + size, /* result */
+        hmac_blocks(tls, buf + size, /* result */
                 tls->client_write_MAC_key, TLS_MAC_SIZE(tls),
                 &tls->write_seq64_be, sizeof(tls->write_seq64_be),
                 xhdr, RECHDR_LEN,
@@ -865,8 +741,13 @@ static void xwrite_encrypted_aesgcm(tls_state_t *tls, unsigned size, unsigned ty
                 cnt++;
                 COUNTER(nonce) = htonl(cnt); /* yes, first cnt here is 2 (!) */
                 aes_encrypt_one_block(&tls->aes_encrypt, nonce, scratch);
-                n = remaining > AES_BLOCK_SIZE ? AES_BLOCK_SIZE : remaining;
-                xorbuf(buf, scratch, n);
+                if (remaining >= AES_BLOCK_SIZE) {
+                        n = AES_BLOCK_SIZE;
+                        xorbuf_AES_BLOCK_SIZE(buf, scratch);
+                } else {
+                        n = remaining;
+                        xorbuf(buf, scratch, n);
+                }
                 buf += n;
                 remaining -= n;
         }
@@ -1024,7 +905,7 @@ static void tls_aesgcm_decrypt(tls_state_t *tls, uint8_t *buf, int size)
                 COUNTER(nonce) = htonl(cnt); /* yes, first cnt here is 2 (!) */
                 aes_encrypt_one_block(&tls->aes_decrypt, nonce, scratch);
                 n = remaining > AES_BLOCK_SIZE ? AES_BLOCK_SIZE : remaining;
-                xorbuf3(buf, scratch, buf + 8, n);
+                xorbuf_3(buf, scratch, buf + 8, n);
                 buf += n;
                 remaining -= n;
         }
@@ -2481,3 +2362,500 @@ void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags)
                 }
         }
 }
+#else
+#include <stdbool.h>
+
+#if ENABLE_FEATURE_TLS_SCHANNEL_1_3
+#include <subauth.h>
+#endif
+
+#define SCHANNEL_USE_BLACKLISTS
+
+#include <security.h>
+#include <schannel.h>
+
+#ifndef SECBUFFER_ALERT
+# define SECBUFFER_ALERT 17
+#endif
+
+#ifndef SP_PROT_TLS1_0_CLIENT
+# define SP_PROT_TLS1_0_CLIENT 0x00000080
+# define SP_PROT_TLS1_1_CLIENT 0x00000200
+# define SP_PROT_TLS1_2_CLIENT 0x00000800
+# define SCH_USE_STRONG_CRYPTO 0x00400000
+#endif
+
+#define BB_SCHANNEL_ISC_FLAGS                                                                                             \
+    (ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_REPLAY_DETECT |                   \
+     ISC_REQ_SEQUENCE_DETECT | ISC_REQ_STREAM | ISC_REQ_USE_SUPPLIED_CREDS)
+
+#define SEC_STATUS_FAIL(status) ((status) != SEC_E_OK)
+
+static char *hresult_to_error_string(HRESULT result) {
+        char *output = NULL;
+
+        FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM
+                                   | FORMAT_MESSAGE_IGNORE_INSERTS |
+                                   FORMAT_MESSAGE_MAX_WIDTH_MASK, NULL, result,
+                                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                                   (char *) &output, 0, NULL);
+        return output;
+}
+
+static void init_sec_buffer(SecBuffer *buffer, void *pvBuffer, unsigned long cbBuffer, unsigned long BufferType) {
+    buffer->BufferType = BufferType;
+    buffer->cbBuffer = cbBuffer;
+    buffer->pvBuffer = pvBuffer;
+}
+
+#define init_sec_buffer_empty(buffer, BufferType) init_sec_buffer(buffer, NULL, 0, BufferType)
+
+static void init_sec_buffer_desc(SecBufferDesc *desc, SecBuffer *buffers, unsigned long buffer_count) {
+    desc->ulVersion = SECBUFFER_VERSION;
+    desc->cBuffers = buffer_count;
+    desc->pBuffers = buffers;
+}
+
+static ssize_t tls_read(tls_state_t *state, char *buf, ssize_t len) {
+        ssize_t amount_read = 0;
+
+        if (state->connection_state > BB_SCHANNEL_OPEN) {
+                goto Success;
+        }
+
+        while (len > 0) {
+                if (state->out_buffer) {
+                        unsigned long copy_amount =
+                            min(len, (ssize_t)state->out_buffer_length);
+                        memcpy(buf, state->out_buffer, copy_amount);
+
+                        amount_read += copy_amount;
+                        buf += copy_amount;
+                        len -= copy_amount;
+
+                        if (copy_amount == state->out_buffer_length) {
+                                if (state->out_buffer_extra > 0) {
+                                        memmove(
+                                            state->in_buffer,
+                                            state->in_buffer +
+                                                (state->in_buffer_offset - state->out_buffer_extra),
+                                            state->in_buffer_offset - (state->in_buffer_offset -
+                                                                       state->out_buffer_extra));
+                                        state->in_buffer_offset = state->out_buffer_extra;
+                                } else {
+                                        state->in_buffer_offset = 0;
+                                }
+
+                                state->out_buffer = NULL;
+                                state->out_buffer_length = 0;
+                                state->out_buffer_extra = 0;
+
+                        } else {
+                                state->out_buffer_length -= copy_amount;
+                                state->out_buffer += copy_amount;
+                        }
+                } else {
+                        SecBuffer buffers[4];
+                        SecBufferDesc desc;
+                        SECURITY_STATUS status;
+
+                        init_sec_buffer(&buffers[0],
+                                        state->in_buffer,
+                                        state->in_buffer_offset,
+                                        SECBUFFER_DATA);
+                        init_sec_buffer_empty(&buffers[1], SECBUFFER_EMPTY);
+                        init_sec_buffer_empty(&buffers[2], SECBUFFER_EMPTY);
+                        init_sec_buffer_empty(&buffers[3], SECBUFFER_EMPTY);
+
+                        init_sec_buffer_desc(&desc, buffers, _countof(buffers));
+
+                        status = DecryptMessage(&state->ctx_handle, &desc, 0, NULL);
+
+                        switch (status) {
+                                case SEC_E_OK: {
+                                        state->out_buffer = buffers[1].pvBuffer;
+                                        state->out_buffer_length = buffers[1].cbBuffer;
+                                        state->out_buffer_extra = state->in_buffer_offset;
+
+                                        if (buffers[3].BufferType == SECBUFFER_EXTRA) {
+                                                state->out_buffer_extra = buffers[3].cbBuffer;
+                                        } else {
+                                                state->out_buffer_extra = 0;
+                                        }
+
+                                        continue;
+                                }
+                                case SEC_I_CONTEXT_EXPIRED: {
+                                        // Shut down the connection
+                                        state->connection_state = BB_SCHANNEL_CLOSED;
+                                        goto Success;
+                                }
+                                case SEC_E_INCOMPLETE_MESSAGE: {
+                                        int result = safe_read(state->ifd,
+                                                state->in_buffer + state->in_buffer_offset,
+                                                sizeof(state->in_buffer) - state->in_buffer_offset);
+                                        if (result == 0) {
+                                                state->connection_state = BB_SCHANNEL_CLOSED;
+                                                goto Success;
+                                        } else if (result < 0) {
+                                                bb_error_msg_and_die("schannel: read() failed");
+                                        }
+
+                                        state->in_buffer_offset += result;
+                                        continue;
+                                }
+                                case SEC_I_RENEGOTIATE: {
+                                        DWORD flags = BB_SCHANNEL_ISC_FLAGS;
+
+                                        SecBuffer in_buffers[2];
+                                        SecBufferDesc in_buffers_desc;
+
+                                        SecBuffer out_buffers[2];
+                                        SecBufferDesc out_buffers_desc;
+
+                                        init_sec_buffer(&in_buffers[0],
+                                                                        buffers[3].pvBuffer,
+                                                                        buffers[3].cbBuffer,
+                                                                        SECBUFFER_TOKEN);
+                                        init_sec_buffer_empty(&in_buffers[1], SECBUFFER_EMPTY);
+
+                                        init_sec_buffer_empty(&out_buffers[0], SECBUFFER_TOKEN);
+                                        init_sec_buffer_empty(&out_buffers[1], SECBUFFER_ALERT);
+
+                                        init_sec_buffer_desc(
+                                                &in_buffers_desc, in_buffers, _countof(in_buffers));
+                                        init_sec_buffer_desc(
+                                                &out_buffers_desc, out_buffers, _countof(out_buffers));
+
+                                        status = InitializeSecurityContextA(&state->cred_handle,
+                                                                                                                &state->ctx_handle,
+                                                                                                                state->hostname,
+                                                                                                                flags,
+                                                                                                                0,
+                                                                                                                0,
+                                                                                                                &in_buffers_desc,
+                                                                                                                0,
+                                                                                                                &state->ctx_handle,
+                                                                                                                &out_buffers_desc,
+                                                                                                                &flags,
+                                                                                                                0);
+
+                                        if (SEC_STATUS_FAIL(status)) {
+                                                bb_error_msg_and_die("schannel: renegotiate failed: (0x%08lx): %s",
+                                                        status, hresult_to_error_string(status));
+                                        }
+
+                                        if (in_buffers[1].BufferType == SECBUFFER_EXTRA) {
+                                                memmove(state->in_buffer,
+                                                                state->in_buffer + (state->in_buffer_offset -
+                                                                                                        in_buffers[1].cbBuffer),
+                                                                in_buffers[1].cbBuffer);
+                                                state->in_buffer_offset = in_buffers[1].cbBuffer;
+                                        } else {
+                                                state->in_buffer_offset = 0;
+                                        }
+
+                                        continue;
+                                }
+                                default: {
+                                        bb_error_msg_and_die("schannel: DecryptMessage failed: (0x%08lx): %s", 
+                                                status, hresult_to_error_string(status));
+                                }
+                        }
+                }
+        }
+
+Success:
+        return amount_read;
+}
+
+static void tls_write(tls_state_t *state, char *buf, size_t len) {
+        if (state->connection_state > BB_SCHANNEL_OPEN) {
+                bb_error_msg_and_die("schannel: attempted to write to a closed connection");
+        }
+
+        while (len > 0) {
+                SECURITY_STATUS status;
+                unsigned long copy_amount =
+                    min(len, (size_t)state->stream_sizes.cbMaximumMessage);
+                char *write_buffer = _alloca(sizeof(state->in_buffer));
+
+                SecBuffer buffers[4];
+                SecBufferDesc desc;
+
+                init_sec_buffer(&buffers[0],
+                                write_buffer,
+                                state->stream_sizes.cbHeader,
+                                SECBUFFER_STREAM_HEADER);
+                init_sec_buffer(&buffers[1],
+                                write_buffer + state->stream_sizes.cbHeader,
+                                copy_amount,
+                                SECBUFFER_DATA);
+                init_sec_buffer(&buffers[2],
+                                write_buffer + state->stream_sizes.cbHeader +
+                                    copy_amount,
+                                state->stream_sizes.cbTrailer,
+                                SECBUFFER_STREAM_TRAILER);
+                init_sec_buffer_empty(&buffers[3], SECBUFFER_EMPTY);
+
+                init_sec_buffer_desc(&desc, buffers, _countof(buffers));
+
+                memcpy(buffers[1].pvBuffer, buf, copy_amount);
+
+                status = EncryptMessage(&state->ctx_handle, 0, &desc, 0);
+                if (SEC_STATUS_FAIL(status)) {
+                        bb_error_msg_and_die("schannel: EncryptMessage failed: (0x%08lx): %s", 
+                                status, hresult_to_error_string(status));
+                }
+
+                xwrite(state->ofd, write_buffer,
+                           buffers[0].cbBuffer + buffers[1].cbBuffer +
+                           buffers[2].cbBuffer);
+
+                len -= copy_amount;
+        }
+}
+
+static void tls_disconnect(tls_state_t * state) {
+        SECURITY_STATUS status;
+
+        DWORD token = SCHANNEL_SHUTDOWN;
+        DWORD flags = BB_SCHANNEL_ISC_FLAGS;
+
+        SecBuffer buf_token;
+        SecBufferDesc buf_token_desc;
+
+        SecBuffer out_buffer;
+        SecBufferDesc out_buffer_desc;
+
+        if (state->connection_state == BB_SCHANNEL_CLOSED_AND_FREED)
+                return;
+        state->connection_state = BB_SCHANNEL_CLOSED_AND_FREED;
+
+        init_sec_buffer(&buf_token, &token, sizeof(token), SECBUFFER_TOKEN);
+        init_sec_buffer_desc(&buf_token_desc, &buf_token, 1);
+
+        ApplyControlToken(&state->ctx_handle, &buf_token_desc);
+
+        init_sec_buffer_empty(&out_buffer, SECBUFFER_TOKEN);
+        init_sec_buffer_desc(&out_buffer_desc, &out_buffer, 1);
+
+        status = InitializeSecurityContextA(&state->cred_handle,
+                                            &state->ctx_handle,
+                                            state->hostname,
+                                            flags,
+                                            0,
+                                            0,
+                                            NULL,
+                                            0,
+                                            &state->ctx_handle,
+                                            &out_buffer_desc,
+                                            &flags,
+                                            0);
+
+        if ((status == SEC_E_OK) || (status == SEC_I_CONTEXT_EXPIRED)) {
+                write(state->ofd, out_buffer.pvBuffer, out_buffer.cbBuffer);
+                FreeContextBuffer(out_buffer.pvBuffer);
+        }
+
+        DeleteSecurityContext(&state->ctx_handle);
+        FreeCredentialsHandle(&state->cred_handle);
+        free(state->hostname);
+}
+
+
+void FAST_FUNC tls_handshake(tls_state_t *state, const char *hostname) {
+        SECURITY_STATUS status;
+
+#if ENABLE_FEATURE_TLS_SCHANNEL_1_3
+        SCH_CREDENTIALS credential = {.dwVersion = SCH_CREDENTIALS_VERSION,
+                .dwCredFormat = 0,
+                .cCreds = 0,
+                .paCred = NULL,
+                .hRootStore = NULL,
+                .cMappers = 0,
+                .aphMappers = NULL,
+                .dwSessionLifespan = 0,
+                .dwFlags =
+                        SCH_CRED_AUTO_CRED_VALIDATION | SCH_CRED_NO_DEFAULT_CREDS |
+                        SCH_USE_STRONG_CRYPTO,
+                .cTlsParameters = 0,
+                .pTlsParameters = NULL
+        };
+#else
+        SCHANNEL_CRED credential = {.dwVersion = SCHANNEL_CRED_VERSION,
+                .cCreds = 0,
+                .paCred = NULL,
+                .hRootStore = NULL,
+                .cMappers = 0,
+                .aphMappers = NULL,
+                .cSupportedAlgs = 0,
+                .palgSupportedAlgs = NULL,
+                .grbitEnabledProtocols =
+                        SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_1_CLIENT |
+                        SP_PROT_TLS1_2_CLIENT,
+                .dwMinimumCipherStrength = 0,
+                .dwMaximumCipherStrength = 0,
+                .dwSessionLifespan = 0,
+                .dwFlags =
+                        SCH_CRED_AUTO_CRED_VALIDATION | SCH_CRED_NO_DEFAULT_CREDS |
+                        SCH_USE_STRONG_CRYPTO,
+                .dwCredFormat = 0
+        };
+#endif
+
+        state->in_buffer_offset = 0;
+
+        state->out_buffer = NULL;
+        state->out_buffer_length = 0;
+        state->out_buffer_extra = 0;
+
+        state->hostname = xstrdup(hostname);
+        state->initialized = false;
+        state->connection_state = BB_SCHANNEL_OPEN;
+
+        if (SEC_STATUS_FAIL(status = AcquireCredentialsHandleA(NULL,
+                                                               (SEC_CHAR *)UNISP_NAME_A,
+                                                               SECPKG_CRED_OUTBOUND,
+                                                               NULL,
+                                                               &credential,
+                                                               NULL,
+                                                               NULL,
+                                                               &state->cred_handle,
+                                                               NULL))) {
+                bb_error_msg_and_die("schannel: AcquireCredentialsHandleA failed: (0x%08lx): %s",
+                        status, hresult_to_error_string(status));
+        }
+
+        // InitializeSecurityContext loop
+        while (true) {
+                DWORD flags = BB_SCHANNEL_ISC_FLAGS;
+
+                SecBuffer in_buffers[2];
+                SecBufferDesc in_buffers_desc;
+
+                SecBuffer out_buffers[2];
+                SecBufferDesc out_buffers_desc;
+
+                init_sec_buffer(&in_buffers[0],
+                                state->in_buffer,
+                                state->in_buffer_offset,
+                                SECBUFFER_TOKEN);
+                init_sec_buffer_empty(&in_buffers[1], SECBUFFER_EMPTY);
+
+                init_sec_buffer_empty(&out_buffers[0], SECBUFFER_TOKEN);
+                init_sec_buffer_empty(&out_buffers[1], SECBUFFER_ALERT);
+
+                init_sec_buffer_desc(
+                    &in_buffers_desc, in_buffers, _countof(in_buffers));
+                init_sec_buffer_desc(
+                    &out_buffers_desc, out_buffers, _countof(out_buffers));
+
+                status = InitializeSecurityContextA(
+                    &state->cred_handle,
+                    state->initialized ? &state->ctx_handle : NULL,
+                    state->hostname,
+                    flags,
+                    0,
+                    0,
+                    state->initialized ? &in_buffers_desc : NULL,
+                    0,
+                    &state->ctx_handle,
+                    &out_buffers_desc,
+                    &flags,
+                    0);
+
+                state->initialized = true;
+
+                if (in_buffers[1].BufferType == SECBUFFER_EXTRA) {
+                        memmove(state->in_buffer,
+                                state->in_buffer +
+                                    (state->in_buffer_offset - in_buffers[1].cbBuffer),
+                                in_buffers[1].cbBuffer);
+                        state->in_buffer_offset = in_buffers[1].cbBuffer;
+                }
+
+                switch (status) {
+                        case SEC_E_OK: {
+                                state->in_buffer_offset =
+                                        (in_buffers[1].BufferType == SECBUFFER_EXTRA)
+                                                ? in_buffers[1].cbBuffer
+                                                : 0;
+
+                                if (out_buffers[0].cbBuffer > 0) {
+                                        xwrite(state->ifd, out_buffers[0].pvBuffer, out_buffers[0].cbBuffer);
+                                        FreeContextBuffer(out_buffers[0].pvBuffer);
+                                }
+
+                                goto Success;
+                        }
+                        case SEC_I_CONTINUE_NEEDED: {
+                                xwrite(state->ofd, out_buffers[0].pvBuffer, out_buffers[0].cbBuffer);
+                                FreeContextBuffer(out_buffers[0].pvBuffer);
+                                if (in_buffers[1].BufferType != SECBUFFER_EXTRA) {
+                                        state->in_buffer_offset = 0;
+                                }
+                                break;
+                        }
+                        case SEC_E_INCOMPLETE_MESSAGE: {
+                                int amount_read =
+                                        safe_read(state->ifd, state->in_buffer + state->in_buffer_offset,
+                                                                sizeof(state->in_buffer) - state->in_buffer_offset);
+                                if (amount_read <= 0) {
+                                        bb_error_msg_and_die("schannel: handshake read() failed");
+                                }
+
+                                state->in_buffer_offset += amount_read;
+                                continue;
+                        }
+                        default: {
+                                bb_error_msg_and_die("schannel: handshake failed: (0x%08lx): %s",
+                                        status, hresult_to_error_string(status));
+                        }
+                }
+        }
+
+Success:
+        QueryContextAttributes(
+            &state->ctx_handle, SECPKG_ATTR_STREAM_SIZES, &state->stream_sizes);
+        return;
+}
+
+void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags) {
+        char buffer[65536];
+
+        struct pollfd pfds[2];
+
+        pfds[0].fd = STDIN_FILENO;
+        pfds[0].events = POLLIN;
+        pfds[1].fd = tls->ifd;
+        pfds[1].events = POLLIN;
+
+        for (;;) {
+                int nread;
+
+                if (safe_poll(pfds, 2, -1) < 0)
+                        bb_simple_perror_msg_and_die("poll");
+
+                if (pfds[0].revents) {
+                        nread = safe_read(STDIN_FILENO, buffer, sizeof(buffer));
+                        if (nread < 1) {
+                                pfds[0].fd = -1;
+                                tls_disconnect(tls);
+                                if (flags & TLSLOOP_EXIT_ON_LOCAL_EOF)
+                                        break;
+                        } else {
+                                tls_write(tls, buffer, nread);
+                        }
+                }
+                if (pfds[1].revents) {
+                        nread = tls_read(tls, buffer, sizeof(buffer));
+                        if (nread < 1) {
+                                tls_disconnect(tls);
+                                break;
+                        }
+                        xwrite(STDOUT_FILENO, buffer, nread);
+                }
+        }
+}
+#endif
diff --git a/networking/tls.h b/networking/tls.h
index 0173b87b2..eee5a7617 100644
--- a/networking/tls.h
+++ b/networking/tls.h
@@ -11,6 +11,7 @@
 #include "libbb.h"
 
 
+#if !ENABLE_FEATURE_TLS_SCHANNEL
 /* Config tweaks */
 #define HAVE_NATIVE_INT64
 #undef  USE_1024_KEY_SPEED_OPTIMIZATIONS
@@ -82,10 +83,9 @@ typedef  int16_t  int16;
 
 void tls_get_random(void *buf, unsigned len) FAST_FUNC;
 
-void xorbuf(void* buf, const void* mask, unsigned count) FAST_FUNC;
-
 #define ALIGNED_long ALIGNED(sizeof(long))
-void xorbuf_aligned_AES_BLOCK_SIZE(void* buf, const void* mask) FAST_FUNC;
+#define xorbuf_aligned_AES_BLOCK_SIZE(dst,src) xorbuf16_aligned_long(dst,src)
+#define xorbuf_AES_BLOCK_SIZE(dst,src)         xorbuf16(dst,src)
 
 #define matrixCryptoGetPrngData(buf, len, userPtr) (tls_get_random(buf, len), PS_SUCCESS)
 
@@ -120,3 +120,4 @@ void curve_P256_compute_pubkey_and_premaster(
 void curve_P256_compute_pubkey_and_premaster_NEW(
                 uint8_t *pubkey2x32, uint8_t *premaster32,
                 const uint8_t *peerkey2x32) FAST_FUNC;
+#endif
diff --git a/networking/tls_aesgcm.c b/networking/tls_aesgcm.c
index 5ddcdd2ad..9c2381a57 100644
--- a/networking/tls_aesgcm.c
+++ b/networking/tls_aesgcm.c
@@ -167,10 +167,7 @@ void FAST_FUNC aesgcm_GHASH(byte* h,
         blocks = cSz / AES_BLOCK_SIZE;
         partial = cSz % AES_BLOCK_SIZE;
         while (blocks--) {
-            if (BB_UNALIGNED_MEMACCESS_OK) // c is not guaranteed to be aligned
-                xorbuf_aligned_AES_BLOCK_SIZE(x, c);
-            else
-                xorbuf(x, c, AES_BLOCK_SIZE);
+            xorbuf_AES_BLOCK_SIZE(x, c);
             GMULT(x, h);
             c += AES_BLOCK_SIZE;
         }
diff --git a/networking/udhcp/d6_dhcpc.c b/networking/udhcp/d6_dhcpc.c
index 79cef1999..19c961d5c 100644
--- a/networking/udhcp/d6_dhcpc.c
+++ b/networking/udhcp/d6_dhcpc.c
@@ -148,10 +148,11 @@ enum {
         OPT_o = 1 << 12,
         OPT_x = 1 << 13,
         OPT_f = 1 << 14,
-        OPT_l = 1 << 15,
-        OPT_d = 1 << 16,
+        OPT_m = 1 << 15,
+        OPT_l = 1 << 16,
+        OPT_d = 1 << 17,
 /* The rest has variable bit positions, need to be clever */
-        OPTBIT_d = 16,
+        OPTBIT_d = 17,
         USE_FOR_MMU(             OPTBIT_b,)
         ///IF_FEATURE_UDHCPC_ARPING(OPTBIT_a,)
         IF_FEATURE_UDHCP_PORT(   OPTBIT_P,)
@@ -268,6 +269,23 @@ static void option_to_env(const uint8_t *option, const uint8_t *option_end)
                 //case D6_OPT_SERVERID:
                 case D6_OPT_IA_NA:
                 case D6_OPT_IA_PD:
+/*  0                   1                   2                   3
+ *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |         OPTION_IA_PD          |         option-length         |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                         IAID (4 octets)                       |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                              T1                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * |                              T2                               |
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ * .                                                               .
+ * .                          IA_PD-options                        .
+ * .                                                               .
+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+                        /* recurse to handle "IA_PD-options" field */
                         option_to_env(option + 16, option + 4 + option[3]);
                         break;
                 //case D6_OPT_IA_TA:
@@ -604,6 +622,31 @@ static NOINLINE int send_d6_info_request(void)
         return d6_mcast_from_client_data_ifindex(&packet, opt_ptr);
 }
 
+/*
+ * RFC 3315 10. Identity Association
+ *
+ * An "identity-association" (IA) is a construct through which a server
+ * and a client can identify, group, and manage a set of related IPv6
+ * addresses.  Each IA consists of an IAID and associated configuration
+ * information.
+ *
+ * A client must associate at least one distinct IA with each of its
+ * network interfaces for which it is to request the assignment of IPv6
+ * addresses from a DHCP server.  The client uses the IAs assigned to an
+ * interface to obtain configuration information from a server for that
+ * interface.  Each IA must be associated with exactly one interface.
+ *
+ * The IAID uniquely identifies the IA and must be chosen to be unique
+ * among the IAIDs on the client.  The IAID is chosen by the client.
+ * For any given use of an IA by the client, the IAID for that IA MUST
+ * be consistent across restarts of the DHCP client...
+ */
+/* Generate IAID. We base it on our MAC address' last 4 bytes */
+static void generate_iaid(uint8_t *iaid)
+{
+        memcpy(iaid, &client_data.client_mac[2], 4);
+}
+
 /* Multicast a DHCPv6 Solicit packet to the network, with an optionally requested IP.
  *
  * RFC 3315 17.1.1. Creation of Solicit Messages
@@ -703,7 +746,7 @@ static NOINLINE int send_d6_discover(struct in6_addr *requested_ipv6)
                 client6_data.ia_na = xzalloc(len);
                 client6_data.ia_na->code = D6_OPT_IA_NA;
                 client6_data.ia_na->len = len - 4;
-                *(bb__aliased_uint32_t*)client6_data.ia_na->data = rand(); /* IAID */
+                generate_iaid(client6_data.ia_na->data); /* IAID */
                 if (requested_ipv6) {
                         struct d6_option *iaaddr = (void*)(client6_data.ia_na->data + 4+4+4);
                         iaaddr->code = D6_OPT_IAADDR;
@@ -721,7 +764,7 @@ static NOINLINE int send_d6_discover(struct in6_addr *requested_ipv6)
                 client6_data.ia_pd = xzalloc(len);
                 client6_data.ia_pd->code = D6_OPT_IA_PD;
                 client6_data.ia_pd->len = len - 4;
-                *(bb__aliased_uint32_t*)client6_data.ia_pd->data = rand(); /* IAID */
+                generate_iaid(client6_data.ia_pd->data); /* IAID */
                 opt_ptr = mempcpy(opt_ptr, client6_data.ia_pd, len);
         }
 
@@ -1131,12 +1174,11 @@ static void client_background(void)
 //usage:#endif
 //usage:#define udhcpc6_trivial_usage
 //usage:       "[-fbq"IF_UDHCP_VERBOSE("v")"R] [-t N] [-T SEC] [-A SEC|-n] [-i IFACE] [-s PROG]\n"
-//usage:       "        [-p PIDFILE]"IF_FEATURE_UDHCP_PORT(" [-P PORT]")" [-ldo] [-r IPv6] [-x OPT:VAL]... [-O OPT]..."
+//usage:       "        [-p PIDFILE]"IF_FEATURE_UDHCP_PORT(" [-P PORT]")" [-mldo] [-r IPv6] [-x OPT:VAL]... [-O OPT]..."
 //usage:#define udhcpc6_full_usage "\n"
 //usage:     "\n        -i IFACE        Interface to use (default "CONFIG_UDHCPC_DEFAULT_INTERFACE")"
 //usage:     "\n        -p FILE         Create pidfile"
 //usage:     "\n        -s PROG         Run PROG at DHCP events (default "CONFIG_UDHCPC6_DEFAULT_SCRIPT")"
-//usage:     "\n        -B              Request broadcast replies"
 //usage:     "\n        -t N            Send up to N discover packets"
 //usage:     "\n        -T SEC          Pause between packets (default 3)"
 //usage:     "\n        -A SEC          Wait if lease is not obtained (default 20)"
@@ -1154,6 +1196,7 @@ static void client_background(void)
 ////usage:      IF_FEATURE_UDHCPC_ARPING(
 ////usage:     "\n      -a              Use arping to validate offered address"
 ////usage:      )
+//usage:     "\n        -m              Send multicast renew requests rather than unicast ones"
 //usage:     "\n        -l              Send 'information request' instead of 'solicit'"
 //usage:     "\n                        (used for servers which do not assign IPv6 addresses)"
 //usage:     "\n        -r IPv6         Request this address ('no' to not request any IP)"
@@ -1211,7 +1254,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
         /* Parse command line */
         opt = getopt32long(argv, "^"
                 /* O,x: list; -T,-t,-A take numeric param */
-                "i:np:qRr:s:T:+t:+SA:+O:*ox:*fld"
+                "i:np:qRr:s:T:+t:+SA:+O:*ox:*fmld"
                 USE_FOR_MMU("b")
                 ///IF_FEATURE_UDHCPC_ARPING("a")
                 IF_FEATURE_UDHCP_PORT("P:")
@@ -1464,7 +1507,7 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                                         if (opt & OPT_l)
                                                 send_d6_info_request();
                                         else
-                                                send_d6_renew(&srv6_buf, requested_ipv6);
+                                                send_d6_renew(OPT_m ? NULL : &srv6_buf, requested_ipv6);
                                         timeout = discover_timeout;
                                         packet_num++;
                                         continue;
@@ -1606,62 +1649,6 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
                 case RENEW_REQUESTED:
                 case REBINDING:
                         if (packet.d6_msg_type == D6_MSG_REPLY) {
-                                unsigned start;
-                                uint32_t lease_seconds;
-                                struct d6_option *option;
-                                unsigned address_timeout;
-                                unsigned prefix_timeout;
- type_is_ok:
-                                change_listen_mode(LISTEN_NONE);
-
-                                address_timeout = 0;
-                                prefix_timeout = 0;
-                                option = d6_find_option(packet.d6_options, packet_end, D6_OPT_STATUS_CODE);
-                                if (option && (option->data[0] | option->data[1]) != 0) {
-///FIXME:
-//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-//    |       OPTION_STATUS_CODE      |         option-len            |
-//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-//    |          status-code          |                               |
-//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
-//    .                        status-message                         .
-//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-// so why do we think it's NAK if data[0] is zero but data[1] is not? That's wrong...
-// we should also check that option->len is ok (i.e. not 0), right?
-                                        /* return to init state */
-                                        bb_info_msg("received DHCP NAK (%u)", option->data[4]);
-                                        d6_run_script(packet.d6_options,
-                                                        packet_end, "nak");
-                                        if (client_data.state != REQUESTING)
-                                                d6_run_script_no_option("deconfig");
-                                        sleep(3); /* avoid excessive network traffic */
-                                        client_data.state = INIT_SELECTING;
-                                        client_data.first_secs = 0; /* make secs field count from 0 */
-                                        requested_ipv6 = NULL;
-                                        timeout = 0;
-                                        packet_num = 0;
-                                        continue;
-                                }
-                                option = d6_copy_option(packet.d6_options, packet_end, D6_OPT_SERVERID);
-                                if (!option) {
-                                        bb_simple_info_msg("no server ID, ignoring packet");
-                                        continue;
-                                        /* still selecting - this server looks bad */
-                                }
-//Note: we do not bother comparing server IDs in Advertise and Reply msgs.
-//server_id variable is used solely for creation of proper server_id option
-//in outgoing packets. (why DHCPv6 even introduced it is a mystery).
-                                free(client6_data.server_id);
-                                client6_data.server_id = option;
-                                if (packet.d6_msg_type == D6_MSG_ADVERTISE) {
-                                        /* enter requesting state */
-                                        change_listen_mode(LISTEN_RAW);
-                                        client_data.state = REQUESTING;
-                                        timeout = 0;
-                                        packet_num = 0;
-                                        continue;
-                                }
-                                /* It's a D6_MSG_REPLY */
 /*
  * RFC 3315 18.1.8. Receipt of Reply Messages
  *
@@ -1747,6 +1734,67 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
  * .                                                               .
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  */
+                                unsigned start;
+                                uint32_t lease_seconds;
+                                struct d6_option *option;
+                                unsigned address_timeout;
+                                unsigned prefix_timeout;
+ type_is_ok:
+                                change_listen_mode(LISTEN_NONE);
+
+                                address_timeout = 0;
+                                prefix_timeout = 0;
+                                option = d6_find_option(packet.d6_options, packet_end, D6_OPT_STATUS_CODE);
+                                if (option) {
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |       OPTION_STATUS_CODE      |         option-len            |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |          status-code          |                               |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
+//    .                        status-message                         .
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+                                        unsigned len, status;
+                                        len = ((unsigned)option->len_hi << 8) + option->len;
+                                        if (len < 2) {
+                                                bb_simple_error_msg("invalid OPTION_STATUS_CODE, ignoring packet");
+                                                continue;
+                                        }
+                                        status = ((unsigned)option->data[0] << 8) + option->data[1];
+                                        if (status != 0) {
+//TODO: handle status == 5 (UseMulticast)?
+                                                /* return to init state */
+                                                bb_info_msg("received DHCP NAK: %u '%.*s'", status, len - 2, option->data + 2);
+                                                d6_run_script(packet.d6_options, packet_end, "nak");
+                                                if (client_data.state != REQUESTING)
+                                                        d6_run_script_no_option("deconfig");
+                                                sleep(3); /* avoid excessive network traffic */
+                                                client_data.state = INIT_SELECTING;
+                                                client_data.first_secs = 0; /* make secs field count from 0 */
+                                                requested_ipv6 = NULL;
+                                                timeout = 0;
+                                                packet_num = 0;
+                                                continue;
+                                        }
+                                }
+                                option = d6_copy_option(packet.d6_options, packet_end, D6_OPT_SERVERID);
+                                if (!option) {
+                                        bb_simple_info_msg("no server ID, ignoring packet");
+                                        continue;
+                                        /* still selecting - this server looks bad */
+                                }
+//Note: we do not bother comparing server IDs in Advertise and Reply msgs.
+//server_id variable is used solely for creation of proper server_id option
+//in outgoing packets. (why DHCPv6 even introduced it is a mystery).
+                                free(client6_data.server_id);
+                                client6_data.server_id = option;
+                                if (packet.d6_msg_type == D6_MSG_ADVERTISE) {
+                                        /* enter requesting state */
+                                        change_listen_mode(LISTEN_RAW);
+                                        client_data.state = REQUESTING;
+                                        timeout = 0;
+                                        packet_num = 0;
+                                        continue;
+                                }
                                 if (option_mask32 & OPT_r) {
                                         struct d6_option *iaaddr;
 
@@ -1790,6 +1838,21 @@ int udhcpc6_main(int argc UNUSED_PARAM, char **argv)
 
                                         free(client6_data.ia_pd);
                                         client6_data.ia_pd = d6_copy_option(packet.d6_options, packet_end, D6_OPT_IA_PD);
+//  0                   1                   2                   3
+//  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+// |         OPTION_IA_PD          |         option-length         |
+// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+// |                         IAID (4 octets)                       |
+// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+// |                              T1                               |
+// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+// |                              T2                               |
+// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+// .                                                               .
+// .                          IA_PD-options                        .
+// .                                                               .
+// +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                         if (!client6_data.ia_pd) {
                                                 bb_info_msg("no %s option%s", "IA_PD", ", ignoring packet");
                                                 continue;
diff --git a/networking/udhcp/d6_packet.c b/networking/udhcp/d6_packet.c
index 142de9b43..1d7541948 100644
--- a/networking/udhcp/d6_packet.c
+++ b/networking/udhcp/d6_packet.c
@@ -153,13 +153,15 @@ int FAST_FUNC d6_send_kernel_packet_from_client_data_ifindex(
         }
         setsockopt_reuseaddr(fd);
 
-        memset(&sa, 0, sizeof(sa));
-        sa.sin6_family = AF_INET6;
-        sa.sin6_port = htons(source_port);
-        sa.sin6_addr = *src_ipv6; /* struct copy */
-        if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
-                msg = "bind(%s)";
-                goto ret_close;
+        if (src_ipv6) {
+                memset(&sa, 0, sizeof(sa));
+                sa.sin6_family = AF_INET6;
+                sa.sin6_port = htons(source_port);
+                sa.sin6_addr = *src_ipv6; /* struct copy */
+                if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
+                        msg = "bind(%s)";
+                        goto ret_close;
+                }
         }
 
         memset(&sa, 0, sizeof(sa));
diff --git a/networking/udhcp/dhcpd.c b/networking/udhcp/dhcpd.c
index 2904119e5..b9cbd6464 100644
--- a/networking/udhcp/dhcpd.c
+++ b/networking/udhcp/dhcpd.c
@@ -575,29 +575,51 @@ static void send_packet_to_client(struct dhcp_packet *dhcp_pkt, int force_broadc
         const uint8_t *chaddr;
         uint32_t ciaddr;
 
-        // Was:
+        // Logic:
         //if (force_broadcast) { /* broadcast */ }
         //else if (dhcp_pkt->ciaddr) { /* unicast to dhcp_pkt->ciaddr */ }
+        // ^^^ dhcp_pkt->ciaddr comes from client's request packet.
+        // We expect such clients to have an UDP socket listening on that IP.
         //else if (dhcp_pkt->flags & htons(BROADCAST_FLAG)) { /* broadcast */ }
         //else { /* unicast to dhcp_pkt->yiaddr */ }
-        // But this is wrong: yiaddr is _our_ idea what client's IP is
-        // (for example, from lease file). Client may not know that,
-        // and may not have UDP socket listening on that IP!
-        // We should never unicast to dhcp_pkt->yiaddr!
-        // dhcp_pkt->ciaddr, OTOH, comes from client's request packet,
-        // and can be used.
-
-        if (force_broadcast
-         || (dhcp_pkt->flags & htons(BROADCAST_FLAG))
-         || dhcp_pkt->ciaddr == 0
+        // ^^^ The last case is confusing, but *should* work.
+        // It's a case where client have sent a DISCOVER
+        // and does not have a kernel UDP socket listening on the IP
+        // we are offering in yiaddr (it does not know the IP yet)!
+        // This *should* work because client *should* listen on a raw socket
+        // instead at this time (IOW: it should examine ALL IPv4 packets
+        // "by hand", not relying on kernel's UDP stack.)
+
+        chaddr = dhcp_pkt->chaddr;
+
+        if (dhcp_pkt->ciaddr == 0
+         || force_broadcast /* sending DHCPNAK pkt? */
         ) {
-                log1s("broadcasting packet to client");
-                ciaddr = INADDR_BROADCAST;
-                chaddr = MAC_BCAST_ADDR;
+                if (dhcp_pkt->flags & htons(BROADCAST_FLAG)
+                 || force_broadcast /* sending DHCPNAK pkt? */
+                ) {
+// RFC 2131:
+// If 'giaddr' is zero and 'ciaddr' is zero, and the broadcast bit is
+// set, then the server broadcasts DHCPOFFER and DHCPACK messages to
+// 0xffffffff. ...
+// In all cases, when 'giaddr' is zero, the server broadcasts any DHCPNAK
+// messages to 0xffffffff.
+                        ciaddr = INADDR_BROADCAST;
+                        chaddr = MAC_BCAST_ADDR;
+                        log1s("broadcasting packet to client");
+                } else {
+// If the broadcast bit is not set and 'giaddr' is zero and
+// 'ciaddr' is zero, then the server unicasts DHCPOFFER and DHCPACK
+// messages to the client's hardware address and 'yiaddr' address.
+                        ciaddr = dhcp_pkt->yiaddr;
+                        log1("unicasting packet to client %ciaddr", 'y');
+                }
         } else {
-                log1s("unicasting packet to client ciaddr");
+// If the 'giaddr'
+// field is zero and the 'ciaddr' field is nonzero, then the server
+// unicasts DHCPOFFER and DHCPACK messages to the address in 'ciaddr'.
                 ciaddr = dhcp_pkt->ciaddr;
-                chaddr = dhcp_pkt->chaddr;
+                log1("unicasting packet to client %ciaddr", 'c');
         }
 
         udhcp_send_raw_packet(dhcp_pkt,
@@ -624,6 +646,10 @@ static void send_packet_to_relay(struct dhcp_packet *dhcp_pkt)
 static void send_packet(struct dhcp_packet *dhcp_pkt, int force_broadcast)
 {
         if (dhcp_pkt->gateway_nip)
+// RFC 2131:
+// If the 'giaddr' field in a DHCP message from a client is non-zero,
+// the server sends any return messages to the 'DHCP server' port on the
+// BOOTP relay agent whose address appears in 'giaddr'.
                 send_packet_to_relay(dhcp_pkt);
         else
                 send_packet_to_client(dhcp_pkt, force_broadcast);
diff --git a/procps/pgrep.c b/procps/pgrep.c
index 9773a72c4..adbdd08b7 100644
--- a/procps/pgrep.c
+++ b/procps/pgrep.c
@@ -270,16 +270,16 @@ int pgrep_main(int argc UNUSED_PARAM, char **argv)
                 if (!match) {
  again:
                         match = (regexec(&re_buffer, cmd, 1, re_match, 0) == 0);
+                        if (match && OPT_ANCHOR) {
+                                /* -x requires full string match */
+                                match = (re_match[0].rm_so == 0 && cmd[re_match[0].rm_eo] == '\0');
+                        }
                         if (!match && cmd != proc->comm) {
                                 /* if argv[] did not match, try comm */
                                 cmdlen = -1;
                                 cmd = proc->comm;
                                 goto again;
                         }
-                        if (match && OPT_ANCHOR) {
-                                /* -x requires full string match */
-                                match = (re_match[0].rm_so == 0 && cmd[re_match[0].rm_eo] == '\0');
-                        }
                 }
 
                 /* NB: OPT_INVERT is always 0 or 1 */
diff --git a/procps/pmap.c b/procps/pmap.c
index 49f7688d9..0cac265c8 100644
--- a/procps/pmap.c
+++ b/procps/pmap.c
@@ -29,10 +29,14 @@
 
 #if ULLONG_MAX == 0xffffffff
 # define TABS "\t"
+# define SIZEWIDTHx "7"
+# define SIZEWIDTH  "9"
 # define AFMTLL "8"
 # define DASHES ""
 #else
 # define TABS "\t\t"
+# define SIZEWIDTHx "15"
+# define SIZEWIDTH  "17"
 # define AFMTLL "16"
 # define DASHES "--------"
 #endif
@@ -42,49 +46,160 @@ enum {
         OPT_q = 1 << 1,
 };
 
-static void print_smaprec(struct smaprec *currec, void *data)
-{
-        unsigned opt = (uintptr_t)data;
+struct smaprec {
+        // For mixed 32/64 userspace, 32-bit pmap still needs
+        // 64-bit field here to correctly show 64-bit processes:
+        unsigned long long smap_start;
+        // Make size wider too:
+        // I've seen 1203765248 kb large "---p" mapping in a browser,
+        // this cuts close to 4 terabytes.
+        unsigned long long smap_size;
+        // (strictly speaking, other fields need to be wider too,
+        // but they are in kbytes, not bytes, and they hold sizes,
+        // not start addresses, sizes tend to be less than 4 terabytes)
+        unsigned long private_dirty;
+        unsigned long smap_pss, smap_swap;
+        char smap_mode[5];
+        char *smap_name;
+};
 
+// How long the filenames and command lines we want to handle?
+#define PMAP_BUFSZ 4096
+
+static void print_smaprec(struct smaprec *currec)
+{
         printf("%0" AFMTLL "llx ", currec->smap_start);
 
-        if (opt & OPT_x)
-                printf("%7lu %7lu %7lu %7lu ",
+        if (option_mask32 & OPT_x)
+                printf("%7llu %7lu %7lu %7lu ",
                         currec->smap_size,
                         currec->smap_pss,
                         currec->private_dirty,
                         currec->smap_swap);
         else
-                printf("%7luK", currec->smap_size);
+                printf("%7lluK", currec->smap_size);
+
+        printf(" %.4s  %s\n", currec->smap_mode, currec->smap_name ? : "  [ anon ]");
+}
+
+/* libbb's procps_read_smaps() looks somewhat similar,
+ * but the collected information is sufficiently different
+ * that merging them into one function is not a good idea
+ * (unless you feel masochistic today).
+ */
+static int read_smaps(pid_t pid, char buf[PMAP_BUFSZ], struct smaprec *total)
+{
+        FILE *file;
+        struct smaprec currec;
+        char filename[sizeof("/proc/%u/smaps") + sizeof(int)*3];
+
+        sprintf(filename, "/proc/%u/smaps", (int)pid);
+
+        file = fopen_for_read(filename);
+        if (!file)
+                return 1;
+
+        memset(&currec, 0, sizeof(currec));
+        while (fgets(buf, PMAP_BUFSZ, file)) {
+                // Each mapping datum has this form:
+                // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
+                // Size:                nnn kB
+                // Rss:                 nnn kB
+                // .....
+
+                char *tp, *p;
+
+#define bytes4 *(uint32_t*)buf
+#define Pss_   PACK32_BYTES('P','s','s',':')
+#define Swap   PACK32_BYTES('S','w','a','p')
+#define Priv   PACK32_BYTES('P','r','i','v')
+#define FETCH(X, N) \
+        tp = skip_whitespace(buf+4 + (N)); \
+        total->X += currec.X = fast_strtoul_10(&tp); \
+        continue
+#define SCAN(S, X) \
+if (memcmp(buf+4, S, sizeof(S)-1) == 0) { \
+        FETCH(X, sizeof(S)-1); \
+}
+                if (bytes4 == Pss_) {
+                        FETCH(smap_pss, 0);
+                }
+                if (bytes4 == Swap && buf[4] == ':') {
+                        FETCH(smap_swap, 1);
+                }
+                if (bytes4 == Priv) {
+                        SCAN("ate_Dirty:", private_dirty);
+                }
+#undef bytes4
+#undef Pss_
+#undef Swap
+#undef Priv
+#undef FETCH
+#undef SCAN
+                tp = strchr(buf, '-');
+                if (tp) {
+                        // We reached next mapping - the line of this form:
+                        // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
+
+                        // If we have a previous record, there's nothing more
+                        // for it, print and clear currec
+                        if (currec.smap_size)
+                                print_smaprec(&currec);
+                        free(currec.smap_name);
+                        memset(&currec, 0, sizeof(currec));
+
+                        *tp = ' ';
+                        tp = buf;
+                        currec.smap_start = fast_strtoull_16(&tp);
+                        currec.smap_size = (fast_strtoull_16(&tp) - currec.smap_start) >> 10;
+                        strncpy(currec.smap_mode, tp, sizeof(currec.smap_mode)-1);
+
+                        // skipping "rw-s FILEOFS M:m INODE "
+                        tp = skip_fields(tp, 4);
+                        tp = skip_whitespace(tp); // there may be many spaces, can't just "tp++"
+                        p = strchrnul(tp, '\n');
+                        if (p != tp) {
+                                currec.smap_name = xstrndup(tp, p - tp);
+                        }
+                        total->smap_size += currec.smap_size;
+                }
+        } // while (got line)
+        fclose(file);
+
+        if (currec.smap_size)
+                print_smaprec(&currec);
+        free(currec.smap_name);
 
-        printf(" %.4s  %s\n", currec->smap_mode, currec->smap_name);
+        return 0;
 }
 
 static int procps_get_maps(pid_t pid, unsigned opt)
 {
         struct smaprec total;
         int ret;
-        char buf[256];
+        char buf[PMAP_BUFSZ] ALIGN4;
+
+        ret = read_cmdline(buf, sizeof(buf), pid, NULL);
+        if (ret < 0)
+                return ret;
 
-        read_cmdline(buf, sizeof(buf), pid, NULL);
         printf("%u: %s\n", (int)pid, buf);
 
         if (!(opt & OPT_q) && (opt & OPT_x))
                 puts("Address" TABS "  Kbytes     PSS   Dirty    Swap  Mode  Mapping");
 
         memset(&total, 0, sizeof(total));
-
-        ret = procps_read_smaps(pid, &total, print_smaprec, (void*)(uintptr_t)opt);
+        ret = read_smaps(pid, buf, &total);
         if (ret)
                 return ret;
 
         if (!(opt & OPT_q)) {
                 if (opt & OPT_x)
                         printf("--------" DASHES "  ------  ------  ------  ------\n"
-                                "total" TABS " %7lu %7lu %7lu %7lu\n",
+                                "total kB %"SIZEWIDTHx"llu %7lu %7lu %7lu\n",
                                 total.smap_size, total.smap_pss, total.private_dirty, total.smap_swap);
                 else
-                        printf("mapped: %luK\n", total.smap_size);
+                        printf(" total %"SIZEWIDTH"lluK\n", total.smap_size);
         }
 
         return 0;
diff --git a/procps/top.c b/procps/top.c
index 09d31c673..7902e82f0 100644
--- a/procps/top.c
+++ b/procps/top.c
@@ -117,10 +117,15 @@
 
 #include "libbb.h"
 
-#define ESC "\033"
+#define ESC     "\033"
+#define HOME    ESC"[H"
+#define CLREOS  ESC"[J"
+#define CLREOL  ESC"[K"
+#define REVERSE ESC"[7m"
+#define NORMAL  ESC"[m"
 
 typedef struct top_status_t {
-        unsigned long vsz;
+        unsigned long memsize;
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
         unsigned long ticks;
         unsigned pcpu; /* delta of ticks */
@@ -161,13 +166,16 @@ struct globals {
         top_status_t *top;
         int ntop;
         smallint inverted;
+        smallint first_line_printed;
 #if ENABLE_FEATURE_TOPMEM
         smallint sort_field;
 #endif
 #if ENABLE_FEATURE_TOP_SMP_CPU
         smallint smp_cpu_info; /* one/many cpu info lines? */
 #endif
-        unsigned lines;  /* screen height */
+        int lines_remaining;
+        unsigned lines;     /* screen height */
+        unsigned scr_width; /* width, clamped <= LINE_BUF_SIZE-2 */
 #if ENABLE_FEATURE_TOP_INTERACTIVE
         struct termios initial_settings;
         int scroll_ofs;
@@ -212,7 +220,6 @@ struct globals {
 #define cpu_prev_jif     (G.cpu_prev_jif      )
 #define num_cpus         (G.num_cpus          )
 #define total_pcpu       (G.total_pcpu        )
-#define line_buf         (G.line_buf          )
 #define INIT_G() do { \
         SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
         BUILD_BUG_ON(LINE_BUF_SIZE <= 80); \
@@ -241,8 +248,8 @@ static int pid_sort(top_status_t *P, top_status_t *Q)
 static int mem_sort(top_status_t *P, top_status_t *Q)
 {
         /* We want to avoid unsigned->signed and truncation errors */
-        if (Q->vsz < P->vsz) return -1;
-        return Q->vsz != P->vsz; /* 0 if ==, 1 if > */
+        if (Q->memsize < P->memsize) return -1;
+        return Q->memsize != P->memsize; /* 0 if ==, 1 if > */
 }
 
 
@@ -283,9 +290,9 @@ static NOINLINE int read_cpu_jiffy(FILE *fp, jiffy_counts_t *p_jif)
 #endif
         int ret;
 
-        if (!fgets(line_buf, LINE_BUF_SIZE, fp) || line_buf[0] != 'c' /* not "cpu" */)
+        if (!fgets(G.line_buf, LINE_BUF_SIZE, fp) || G.line_buf[0] != 'c' /* not "cpu" */)
                 return 0;
-        ret = sscanf(line_buf, fmt,
+        ret = sscanf(G.line_buf, fmt,
                         &p_jif->usr, &p_jif->nic, &p_jif->sys, &p_jif->idle,
                         &p_jif->iowait, &p_jif->irq, &p_jif->softirq,
                         &p_jif->steal);
@@ -362,7 +369,7 @@ static void do_stats(void)
 
         get_jiffy_counts();
         total_pcpu = 0;
-        /* total_vsz = 0; */
+        /* total_memsize = 0; */
         new_hist = xmalloc(sizeof(new_hist[0]) * ntop);
         /*
          * Make a pass through the data to get stats.
@@ -394,7 +401,7 @@ static void do_stats(void)
                         i = (i+1) % prev_hist_count;
                         /* hist_iterations++; */
                 } while (i != last_i);
-                /* total_vsz += cur->vsz; */
+                /* total_memsize += cur->memsize; */
         }
 
         /*
@@ -407,6 +414,39 @@ static void do_stats(void)
 
 #endif /* FEATURE_TOP_CPU_USAGE_PERCENTAGE */
 
+static void print_line_buf(void)
+{
+        const char *fmt;
+
+        G.lines_remaining--;
+        fmt = OPT_BATCH_MODE ? "\n""%.*s" : "\n""%.*s"CLREOL;
+        if (!G.first_line_printed) {
+                G.first_line_printed = 1;
+                /* Go to top */
+                fmt = OPT_BATCH_MODE ? "%.*s" : HOME"%.*s"CLREOL;
+        }
+        printf(fmt, G.scr_width - 1, G.line_buf);
+}
+
+static void print_line_bold(void)
+{
+        G.lines_remaining--;
+//we never print first line in bold
+//      if (!G.first_line_printed) {
+//              printf(OPT_BATCH_MODE ? "%.*s" : HOME"%.*s"CLREOL, G.scr_width - 1, G.line_buf);
+//              G.first_line_printed = 1;
+//      } else {
+                printf(OPT_BATCH_MODE ? "\n""%.*s" : "\n"REVERSE"%.*s"NORMAL CLREOL, G.scr_width - 1, G.line_buf);
+//      }
+}
+
+static void print_end(void)
+{
+        fputs_stdout(OPT_BATCH_MODE ? "\n" : CLREOS"\r");
+        /* next print will be "first line" (will clear the screen) */
+        G.first_line_printed = 0;
+}
+
 #if ENABLE_FEATURE_TOP_CPU_GLOBAL_PERCENTS && ENABLE_FEATURE_TOP_DECIMALS
 /* formats 7 char string (8 with terminating NUL) */
 static char *fmt_100percent_8(char pbuf[8], unsigned value, unsigned total)
@@ -433,7 +473,7 @@ static char *fmt_100percent_8(char pbuf[8], unsigned value, unsigned total)
 #endif
 
 #if ENABLE_FEATURE_TOP_CPU_GLOBAL_PERCENTS
-static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
+static void display_cpus(void)
 {
         /*
          * xxx% = (cur_jif.xxx - prev_jif.xxx) / (cur_jif.total - prev_jif.total) * 100%
@@ -469,8 +509,8 @@ static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
 # else
         /* Loop thru CPU(s) */
         n_cpu_lines = smp_cpu_info ? num_cpus : 1;
-        if (n_cpu_lines > *lines_rem_p)
-                n_cpu_lines = *lines_rem_p;
+        if (n_cpu_lines > G.lines_remaining)
+                n_cpu_lines = G.lines_remaining;
 
         for (i = 0; i < n_cpu_lines; i++) {
                 p_jif = &cpu_jif[i];
@@ -488,7 +528,7 @@ static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
                         CALC_STAT(softirq);
                         /*CALC_STAT(steal);*/
 
-                        snprintf(scrbuf, scr_width,
+                        sprintf(G.line_buf,
                                 /* Barely fits in 79 chars when in "decimals" mode. */
 # if ENABLE_FEATURE_TOP_SMP_CPU
                                 "CPU%s:"FMT"usr"FMT"sys"FMT"nic"FMT"idle"FMT"io"FMT"irq"FMT"sirq",
@@ -501,16 +541,15 @@ static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
                                 /*, SHOW_STAT(steal) - what is this 'steal' thing? */
                                 /* I doubt anyone wants to know it */
                         );
-                        puts(scrbuf);
+                        print_line_buf();
                 }
         }
 # undef SHOW_STAT
 # undef CALC_STAT
 # undef FMT
-        *lines_rem_p -= i;
 }
 #else  /* !ENABLE_FEATURE_TOP_CPU_GLOBAL_PERCENTS */
-# define display_cpus(scr_width, scrbuf, lines_rem) ((void)0)
+# define display_cpus() ((void)0)
 #endif
 
 enum {
@@ -564,52 +603,55 @@ static void parse_meminfo(unsigned long meminfo[MI_MAX])
         fclose(f);
 }
 
-static unsigned long display_header(int scr_width, int *lines_rem_p)
+static void cmdline_to_line_buf_and_print(unsigned offset, unsigned pid, const char *comm)
+{
+        int width = G.scr_width - offset;
+        if (width > 1) /* wider than to fit just the NUL? */
+                read_cmdline(G.line_buf + offset, width, pid, comm);
+//TODO: read_cmdline() sanitizes control chars, but not chars above 0x7e
+        print_line_buf();
+}
+
+static unsigned long display_header(void)
 {
-        char scrbuf[100]; /* [80] was a bit too low on 8Gb ram box */
         char *buf;
         unsigned long meminfo[MI_MAX];
 
         parse_meminfo(meminfo);
 
         /* Output memory info */
-        if (scr_width > (int)sizeof(scrbuf))
-                scr_width = sizeof(scrbuf);
-        snprintf(scrbuf, scr_width,
+        sprintf(G.line_buf,
                 "Mem: %luK used, %luK free, %luK shrd, %luK buff, %luK cached",
                 meminfo[MI_MEMTOTAL] - meminfo[MI_MEMFREE],
                 meminfo[MI_MEMFREE],
                 meminfo[MI_MEMSHARED] + meminfo[MI_SHMEM],
                 meminfo[MI_BUFFERS],
                 meminfo[MI_CACHED]);
-        /* Go to top & clear to the end of screen */
-        printf(OPT_BATCH_MODE ? "%s\n" : ESC"[H" ESC"[J" "%s\n", scrbuf);
-        (*lines_rem_p)--;
+        print_line_buf();
 
         /* Display CPU time split as percentage of total time.
          * This displays either a cumulative line or one line per CPU.
          */
-        display_cpus(scr_width, scrbuf, lines_rem_p);
+        display_cpus();
 
         /* Read load average as a string */
-        buf = stpcpy(scrbuf, "Load average: ");
-        open_read_close("loadavg", buf, sizeof(scrbuf) - sizeof("Load average: "));
-        scrbuf[scr_width - 1] = '\0';
+        buf = stpcpy(G.line_buf, "Load average: ");
+        open_read_close("loadavg", buf, sizeof(G.line_buf) - sizeof("Load average: "));
+        G.line_buf[sizeof(G.line_buf) - 1] = '\0'; /* paranoia */
         strchrnul(buf, '\n')[0] = '\0';
-        puts(scrbuf);
-        (*lines_rem_p)--;
+        print_line_buf();
 
         return meminfo[MI_MEMTOTAL];
 }
 
-static NOINLINE void display_process_list(int lines_rem, int scr_width)
+static NOINLINE void display_process_list(void)
 {
         enum {
                 BITS_PER_INT = sizeof(int) * 8
         };
 
         top_status_t *s;
-        unsigned long total_memory = display_header(scr_width, &lines_rem); /* or use total_vsz? */
+        unsigned long total_memory = display_header();
         /* xxx_shift and xxx_scale variables allow us to replace
          * expensive divides with multiply and shift */
         unsigned pmem_shift, pmem_scale, pmem_half;
@@ -621,7 +663,7 @@ static NOINLINE void display_process_list(int lines_rem, int scr_width)
 
 #if ENABLE_FEATURE_TOP_DECIMALS
 # define UPSCALE 1000
-typedef struct { unsigned quot, rem; } bb_div_t;
+        typedef struct { unsigned quot, rem; } bb_div_t;
 /* Used to have "div_t name = div((val), 10)" here
  * (IOW: intended to use libc-compatible way to divide and use
  * both result and remainder, but musl does not inline div()...)
@@ -629,28 +671,34 @@ typedef struct { unsigned quot, rem; } bb_div_t;
  */
 # define CALC_STAT(name, val) bb_div_t name = { (val) / 10, (val) % 10 }
 # define SHOW_STAT(name) name.quot, '0'+name.rem
+# define SANITIZE(name)  if (name.quot > 99) name.quot = 99, name.rem = (unsigned char)('+' - '0')
 # define FMT "%3u.%c"
 #else
 # define UPSCALE 100
 # define CALC_STAT(name, val) unsigned name = (val)
+# define SANITIZE(name)  if (name > 99) name = 99
 # define SHOW_STAT(name) name
 # define FMT "%4u%%"
 #endif
 
-        /* what info of the processes is shown */
-        printf(OPT_BATCH_MODE ? "%.*s" : ESC"[7m" "%.*s" ESC"[m", scr_width,
-                "  PID  PPID USER     STAT   VSZ %VSZ"
+        strcpy(G.line_buf, "  PID  PPID USER     STAT   RSS %RSS"
                 IF_FEATURE_TOP_SMP_PROCESS(" CPU")
                 IF_FEATURE_TOP_CPU_USAGE_PERCENTAGE(" %CPU")
                 " COMMAND");
-        lines_rem--;
-
-        /*
-         * %VSZ = s->vsz/MemTotal
+        print_line_bold();
+
+        /* %RSS = s->memsize / MemTotal * 100%
+         * Calculate this with multiply and shift. Example:
+         * shift = 12
+         * scale = 100 * 0x1000 / total_memory
+         * percent_mem = (size_mem * scale) >> shift
+         *            ~= (size_mem >> shift) * scale
+         *            ~= (size_mem >> shift) * 100 * (1 << shift) / total_memory
+         *            ~= size_mem * 100 / total_memory
          */
         pmem_shift = BITS_PER_INT-11;
         pmem_scale = UPSCALE*(1U<<(BITS_PER_INT-11)) / total_memory;
-        /* s->vsz is in kb. we want (s->vsz * pmem_scale) to never overflow */
+        /* s->memsize is in kb. we want (s->memsize * pmem_scale) to never overflow */
         while (pmem_scale >= 512) {
                 pmem_scale /= 4;
                 pmem_shift -= 2;
@@ -689,25 +737,29 @@ typedef struct { unsigned quot, rem; } bb_div_t;
         pcpu_half = (1U << pcpu_shift) / (ENABLE_FEATURE_TOP_DECIMALS ? 20 : 2);
         /* printf(" pmem_scale=%u pcpu_scale=%u ", pmem_scale, pcpu_scale); */
 #endif
+        if (G.lines_remaining > ntop - G_scroll_ofs)
+                G.lines_remaining = ntop - G_scroll_ofs;
 
         /* Ok, all preliminary data is ready, go through the list */
-        scr_width += 2; /* account for leading '\n' and trailing NUL */
-        if (lines_rem > ntop - G_scroll_ofs)
-                lines_rem = ntop - G_scroll_ofs;
         s = top + G_scroll_ofs;
-        while (--lines_rem >= 0) {
+        while (G.lines_remaining > 0) {
                 int n;
                 char *ppu;
                 char ppubuf[sizeof(int)*3 * 2 + 12];
-                char vsz_str_buf[8];
+                char memsize_str_buf[8];
                 unsigned col;
 
-                CALC_STAT(pmem, (s->vsz*pmem_scale + pmem_half) >> pmem_shift);
+                CALC_STAT(pmem, (s->memsize*pmem_scale + pmem_half) >> pmem_shift);
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
                 CALC_STAT(pcpu, (s->pcpu*pcpu_scale + pcpu_half) >> pcpu_shift);
 #endif
+                /* VSZ can be much larger than total memory
+                 * (seen values close to 2Tbyte), don't try to display
+                 * "uses 12345.6% of MemTotal" (won't fit the column)
+                 */
+                SANITIZE(pmem);
 
-                smart_ulltoa5(s->vsz, vsz_str_buf, " mgtpezy");
+                smart_ulltoa5(s->memsize, memsize_str_buf, " mgtpezy");
                 /* PID PPID USER STAT VSZ %VSZ [%CPU] COMMAND */
                 n = sprintf(ppubuf, "%5u %5u %-8.8s", s->pid, s->ppid, get_cached_username(s->uid));
                 ppu = ppubuf;
@@ -736,27 +788,23 @@ typedef struct { unsigned quot, rem; } bb_div_t;
                         ppu[6+6+8] = '\0'; /* truncate USER */
                 }
  shortened:
-                col = snprintf(line_buf, scr_width,
-                                "\n" "%s %s  %.5s" FMT
+                col = sprintf(G.line_buf,
+                                "%s %s  %.5s" FMT
                                 IF_FEATURE_TOP_SMP_PROCESS(" %3d")
                                 IF_FEATURE_TOP_CPU_USAGE_PERCENTAGE(FMT)
                                 " ",
                                 ppu,
-                                s->state, vsz_str_buf,
+                                s->state, memsize_str_buf,
                                 SHOW_STAT(pmem)
                                 IF_FEATURE_TOP_SMP_PROCESS(, s->last_seen_on_cpu)
                                 IF_FEATURE_TOP_CPU_USAGE_PERCENTAGE(, SHOW_STAT(pcpu))
                 );
-                if ((int)(scr_width - col) > 1)
-                        read_cmdline(line_buf + col, scr_width - col, s->pid, s->comm);
-                fputs_stdout(line_buf);
+                cmdline_to_line_buf_and_print(col, s->pid, s->comm);
                 /* printf(" %d/%d %lld/%lld", s->pcpu, total_pcpu,
                         cur_jif.busy - prev_jif.busy, cur_jif.total - prev_jif.total); */
                 s++;
         }
         /* printf(" %d", hist_iterations); */
-        bb_putchar(OPT_BATCH_MODE ? '\n' : '\r');
-        fflush_all();
 }
 #undef UPSCALE
 #undef SHOW_STAT
@@ -828,36 +876,34 @@ static int topmem_sort(char *a, char *b)
 }
 
 /* display header info (meminfo / loadavg) */
-static void display_topmem_header(int scr_width, int *lines_rem_p)
+static void display_topmem_header(void)
 {
         unsigned long meminfo[MI_MAX];
 
         parse_meminfo(meminfo);
 
-        snprintf(line_buf, LINE_BUF_SIZE,
+        sprintf(G.line_buf,
                 "Mem total:%lu anon:%lu map:%lu free:%lu",
                 meminfo[MI_MEMTOTAL],
                 meminfo[MI_ANONPAGES],
                 meminfo[MI_MAPPED],
                 meminfo[MI_MEMFREE]);
-        printf(OPT_BATCH_MODE ? "%.*s\n" : ESC"[H" ESC"[J" "%.*s\n", scr_width, line_buf);
+        print_line_buf();
 
-        snprintf(line_buf, LINE_BUF_SIZE,
+        sprintf(G.line_buf,
                 " slab:%lu buf:%lu cache:%lu dirty:%lu write:%lu",
                 meminfo[MI_SLAB],
                 meminfo[MI_BUFFERS],
                 meminfo[MI_CACHED],
                 meminfo[MI_DIRTY],
                 meminfo[MI_WRITEBACK]);
-        printf("%.*s\n", scr_width, line_buf);
+        print_line_buf();
 
-        snprintf(line_buf, LINE_BUF_SIZE,
+        sprintf(G.line_buf,
                 "Swap total:%lu free:%lu", // TODO: % used?
                 meminfo[MI_SWAPTOTAL],
                 meminfo[MI_SWAPFREE]);
-        printf("%.*s\n", scr_width, line_buf);
-
-        (*lines_rem_p) -= 3;
+        print_line_buf();
 }
 
 /* see http://en.wikipedia.org/wiki/Tera */
@@ -870,75 +916,57 @@ static void ulltoa4_and_space(unsigned long long ul, char buf[5])
         smart_ulltoa4(ul, buf, " mgtpezy")[0] = ' ';
 }
 
-static NOINLINE void display_topmem_process_list(int lines_rem, int scr_width)
+static NOINLINE void display_topmem_process_list(void)
 {
-#define HDR_STR "  PID   VSZ VSZRW   RSS (SHR) DIRTY (SHR) STACK"
-#define MIN_WIDTH sizeof(HDR_STR)
         const topmem_status_t *s = topmem + G_scroll_ofs;
         char *cp, ch;
 
-        display_topmem_header(scr_width, &lines_rem);
+        display_topmem_header();
 
-        strcpy(line_buf, HDR_STR " COMMAND");
+        strcpy(G.line_buf, "  PID   VSZ VSZRW   RSS (SHR) DIRTY (SHR) STACK COMMAND");
         /* Mark the ^FIELD^ we sort by */
-        cp = &line_buf[5 + sort_field * 6];
+        cp = &G.line_buf[5 + sort_field * 6];
         ch = "^_"[inverted];
         cp[6] = ch;
         do *cp++ = ch; while (*cp == ' ');
+        print_line_bold();
 
-        printf(OPT_BATCH_MODE ? "%.*s" : ESC"[7m" "%.*s" ESC"[m", scr_width, line_buf);
-        lines_rem--;
-
-        if (lines_rem > ntop - G_scroll_ofs)
-                lines_rem = ntop - G_scroll_ofs;
-        while (--lines_rem >= 0) {
+        if (G.lines_remaining > ntop - G_scroll_ofs)
+                G.lines_remaining = ntop - G_scroll_ofs;
+        while (G.lines_remaining > 0) {
                 /* PID VSZ VSZRW RSS (SHR) DIRTY (SHR) COMMAND */
-                int n = sprintf(line_buf, "%5u ", s->pid);
+                int n = sprintf(G.line_buf, "%5u ", s->pid);
                 if (n > 7) {
                         /* PID is 7 chars long (up to 4194304) */
-                        ulltoa4_and_space(s->vsz  , &line_buf[8]);
-                        ulltoa4_and_space(s->vszrw, &line_buf[8+5]);
+                        ulltoa4_and_space(s->vsz  , &G.line_buf[8]);
+                        ulltoa4_and_space(s->vszrw, &G.line_buf[8+5]);
                         /* the next field (RSS) starts at 8+10 = 3*6 */
                 } else {
                         if (n == 7) /* PID is 6 chars long */
-                                ulltoa4_and_space(s->vsz, &line_buf[7]);
+                                ulltoa4_and_space(s->vsz, &G.line_buf[7]);
                                 /* the next field (VSZRW) starts at 7+5 = 2*6 */
                         else /* PID is 5 chars or less */
-                                ulltoa5_and_space(s->vsz, &line_buf[6]);
-                        ulltoa5_and_space(s->vszrw, &line_buf[2*6]);
-                }
-                ulltoa5_and_space(s->rss     , &line_buf[3*6]);
-                ulltoa5_and_space(s->rss_sh  , &line_buf[4*6]);
-                ulltoa5_and_space(s->dirty   , &line_buf[5*6]);
-                ulltoa5_and_space(s->dirty_sh, &line_buf[6*6]);
-                ulltoa5_and_space(s->stack   , &line_buf[7*6]);
-                line_buf[8*6] = '\0';
-                if (scr_width > (int)MIN_WIDTH) {
-                        read_cmdline(&line_buf[8*6], scr_width - MIN_WIDTH, s->pid, s->comm);
+                                ulltoa5_and_space(s->vsz, &G.line_buf[6]);
+                        ulltoa5_and_space(s->vszrw, &G.line_buf[2*6]);
                 }
-                printf("\n""%.*s", scr_width, line_buf);
+                ulltoa5_and_space(s->rss     , &G.line_buf[3*6]);
+                ulltoa5_and_space(s->rss_sh  , &G.line_buf[4*6]);
+                ulltoa5_and_space(s->dirty   , &G.line_buf[5*6]);
+                ulltoa5_and_space(s->dirty_sh, &G.line_buf[6*6]);
+                ulltoa5_and_space(s->stack   , &G.line_buf[7*6]);
+                G.line_buf[8*6] = '\0';
+                cmdline_to_line_buf_and_print(8*6, s->pid, s->comm);
                 s++;
         }
-        bb_putchar(OPT_BATCH_MODE ? '\n' : '\r');
-        fflush_all();
-#undef HDR_STR
-#undef MIN_WIDTH
 }
 
-#else
-void display_topmem_process_list(int lines_rem, int scr_width);
-int topmem_sort(char *a, char *b);
-#endif /* TOPMEM */
-
-/*
- * end TOPMEM support
- */
+#endif /* end TOPMEM support */
 
 enum {
         TOP_MASK = 0
                 | PSSCAN_PID
                 | PSSCAN_PPID
-                | PSSCAN_VSZ
+                | PSSCAN_RSS
                 | PSSCAN_STIME
                 | PSSCAN_UTIME
                 | PSSCAN_STATE
@@ -950,7 +978,7 @@ enum {
                 | PSSCAN_SMAPS
                 | PSSCAN_COMM,
         EXIT_MASK = 0,
-        NO_RESCAN_MASK = (unsigned)-1,
+        ONLY_REDRAW = (unsigned)-1,
 };
 
 #if ENABLE_FEATURE_TOP_INTERACTIVE
@@ -963,15 +991,22 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
         }
 
         while (1) {
-                int32_t c;
+                int32_t c, cc;
 
                 c = safe_read_key(STDIN_FILENO, G.kbd_input, interval * 1000);
-                if (c == -1 && errno != EAGAIN) {
-                        /* error/EOF */
-                        option_mask32 |= OPT_EOF;
+                if (c == -1) {
+                        if (errno != EAGAIN)
+                                /* error/EOF */
+                                option_mask32 |= OPT_EOF;
+                        /* else: timeout - rescan and refresh */
                         break;
                 }
                 interval = 0;
+                /* "continue" statements below return to do one additional
+                 * quick attempt to read a key. This prevents
+                 * long sequence of e.g. "nnnnnnnnnnnnnnnnnnnnnnnnnn"
+                 * to cause lots of rescans.
+                 */
 
                 if (c == initial_settings.c_cc[VINTR])
                         return EXIT_MASK;
@@ -1005,9 +1040,10 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
                                 G_scroll_ofs = ntop - 1;
                         if (G_scroll_ofs < 0)
                                 G_scroll_ofs = 0;
-                        return NO_RESCAN_MASK;
+                        return ONLY_REDRAW;
                 }
 
+                cc = c;
                 c |= 0x20; /* lowercase */
                 if (c == 'q')
                         return EXIT_MASK;
@@ -1055,9 +1091,17 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
                         continue;
                 }
 #  if ENABLE_FEATURE_TOPMEM
+                if (cc == 'S') {
+                        if (--sort_field < 0)
+                                sort_field = NUM_SORT_FIELD - 1;
+                        if (--sort_field < 0)
+                                sort_field = NUM_SORT_FIELD - 1;
+                }
                 if (c == 's') {
-                        scan_mask = TOPMEM_MASK;
                         sort_field = (sort_field + 1) % NUM_SORT_FIELD;
+                        if (scan_mask == TOPMEM_MASK)
+                                return ONLY_REDRAW;
+                        scan_mask = TOPMEM_MASK;
                         free(prev_hist);
                         prev_hist = NULL;
                         prev_hist_count = 0;
@@ -1066,7 +1110,7 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
 #  endif
                 if (c == 'r') {
                         inverted ^= 1;
-                        continue;
+                        return ONLY_REDRAW;
                 }
 #  if ENABLE_FEATURE_TOP_SMP_CPU
                 /* procps-2.0.18 uses 'C', 3.2.7 uses '1' */
@@ -1088,8 +1132,8 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
                 }
 #  endif
 # endif
-                break; /* unknown key -> force refresh */
-        }
+                /* Unknown key. Eat remaining buffered input (if any) */
+        } /* while (1) */
 
         return scan_mask;
 }
@@ -1155,12 +1199,15 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 {
         duration_t interval;
         int iterations;
-        unsigned col;
+        unsigned opt;
         char *str_interval, *str_iterations;
         unsigned scan_mask = TOP_MASK;
 
         INIT_G();
 
+//worth it?
+//      setvbuf(stdout, /*buf*/ NULL, _IOFBF, /*size*/ 0);
+
         interval = 5; /* default update interval is 5 seconds */
         iterations = 0; /* infinite */
 #if ENABLE_FEATURE_TOP_SMP_CPU
@@ -1172,13 +1219,13 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 
         /* all args are options; -n NUM */
         make_all_argv_opts(argv); /* options can be specified w/o dash */
-        col = getopt32(argv, "d:n:bHm", &str_interval, &str_iterations);
+        opt = getopt32(argv, "d:n:bHm", &str_interval, &str_iterations);
         /* NB: -m and -H are accepted even if not configured */
 #if ENABLE_FEATURE_TOPMEM
-        if (col & OPT_m) /* -m (busybox specific) */
+        if (opt & OPT_m) /* -m (busybox specific) */
                 scan_mask = TOPMEM_MASK;
 #endif
-        if (col & OPT_d) {
+        if (opt & OPT_d) {
                 /* work around for "-d 1" -> "-d -1" done by make_all_argv_opts() */
                 if (str_interval[0] == '-')
                         str_interval++;
@@ -1187,18 +1234,17 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                 if (interval > INT_MAX / 1000)
                         interval = INT_MAX / 1000;
         }
-        if (col & OPT_n) {
+        if (opt & OPT_n) {
                 if (str_iterations[0] == '-')
                         str_iterations++;
                 iterations = xatou(str_iterations);
         }
 #if ENABLE_FEATURE_SHOW_THREADS
-        if (col & OPT_H) {
+        if (opt & OPT_H) {
                 scan_mask |= PSSCAN_TASKS;
         }
 #endif
 
-        /* change to /proc */
         xchdir("/proc");
 
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
@@ -1226,23 +1272,22 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 #endif
 
         while (scan_mask != EXIT_MASK) {
-                IF_FEATURE_TOP_INTERACTIVE(unsigned new_mask;)
+                IF_FEATURE_TOP_INTERACTIVE(unsigned new_mask = scan_mask;)
                 procps_status_t *p = NULL;
 
-                if (OPT_BATCH_MODE) {
-                        G.lines = INT_MAX;
-                        col = LINE_BUF_SIZE - 2; /* +2 bytes for '\n', NUL */
-                } else {
+                G.lines = INT_MAX;
+                G.scr_width = LINE_BUF_SIZE - 2; /* +2 bytes for '\n', NUL */
+                if (!OPT_BATCH_MODE) {
                         G.lines = 24; /* default */
-                        col = 79;
+                        G.scr_width = 80;
                         /* We output to stdout, we need size of stdout (not stdin)! */
-                        get_terminal_width_height(STDOUT_FILENO, &col, &G.lines);
-                        if (G.lines < 5 || col < 10) {
+                        get_terminal_width_height(STDOUT_FILENO, &G.scr_width, &G.lines);
+                        if (G.lines < 5 || G.scr_width < 10) {
                                 sleep_for_duration(interval);
                                 continue;
                         }
-                        if (col > LINE_BUF_SIZE - 2)
-                                col = LINE_BUF_SIZE - 2;
+                        if (G.scr_width > LINE_BUF_SIZE - 2)
+                                G.scr_width = LINE_BUF_SIZE - 2;
                 }
 
                 /* read process IDs & status for all the processes */
@@ -1255,7 +1300,7 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                                 top = xrealloc_vector(top, 6, ntop++);
                                 top[n].pid = p->pid;
                                 top[n].ppid = p->ppid;
-                                top[n].vsz = p->vsz;
+                                top[n].memsize = p->rss;
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
                                 top[n].ticks = p->stime + p->utime;
 #endif
@@ -1268,20 +1313,20 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                         }
 #if ENABLE_FEATURE_TOPMEM
                         else { /* TOPMEM */
-                                if (!(p->smaps.mapped_ro | p->smaps.mapped_rw))
+                                if (!(p->mapped_ro | p->mapped_rw))
                                         continue; /* kernel threads are ignored */
                                 n = ntop;
                                 /* No bug here - top and topmem are the same */
                                 top = xrealloc_vector(topmem, 6, ntop++);
                                 strcpy(topmem[n].comm, p->comm);
                                 topmem[n].pid      = p->pid;
-                                topmem[n].vsz      = p->smaps.mapped_rw + p->smaps.mapped_ro;
-                                topmem[n].vszrw    = p->smaps.mapped_rw;
-                                topmem[n].rss_sh   = p->smaps.shared_clean + p->smaps.shared_dirty;
-                                topmem[n].rss      = p->smaps.private_clean + p->smaps.private_dirty + topmem[n].rss_sh;
-                                topmem[n].dirty    = p->smaps.private_dirty + p->smaps.shared_dirty;
-                                topmem[n].dirty_sh = p->smaps.shared_dirty;
-                                topmem[n].stack    = p->smaps.stack;
+                                topmem[n].vsz      = p->mapped_rw + p->mapped_ro;
+                                topmem[n].vszrw    = p->mapped_rw;
+                                topmem[n].rss_sh   = p->shared_clean + p->shared_dirty;
+                                topmem[n].rss      = p->private_clean + p->private_dirty + topmem[n].rss_sh;
+                                topmem[n].dirty    = p->private_dirty + p->shared_dirty;
+                                topmem[n].dirty_sh = p->shared_dirty;
+                                topmem[n].stack    = p->stack;
                         }
 #endif
                 } /* end of "while we read /proc" */
@@ -1310,30 +1355,40 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                         qsort(topmem, ntop, sizeof(topmem_status_t), (void*)topmem_sort);
                 }
 #endif
- IF_FEATURE_TOP_INTERACTIVE(display:)
+ IF_FEATURE_TOP_INTERACTIVE(redraw:)
+                G.lines_remaining = G.lines;
                 IF_FEATURE_TOPMEM(if (scan_mask != TOPMEM_MASK)) {
-                        display_process_list(G.lines, col);
+                        display_process_list();
                 }
 #if ENABLE_FEATURE_TOPMEM
                 else { /* TOPMEM */
-                        display_topmem_process_list(G.lines, col);
+                        display_topmem_process_list();
                 }
 #endif
+                print_end();
+                fflush_all();
                 if (iterations >= 0 && !--iterations)
                         break;
 #if !ENABLE_FEATURE_TOP_INTERACTIVE
                 clearmems();
                 sleep_for_duration(interval);
 #else
-                new_mask = handle_input(scan_mask, interval);
-                if (new_mask == NO_RESCAN_MASK)
-                        goto display;
+                new_mask = handle_input(scan_mask,
+                        /* After "redraw with no rescan", have one
+                         * key timeout shorter that normal
+                         * (IOW: rescan sooner):
+                         */
+                        (new_mask == ONLY_REDRAW ? 1 : interval)
+                );
+                if (new_mask == ONLY_REDRAW)
+                        goto redraw;
                 scan_mask = new_mask;
                 clearmems();
 #endif
         } /* end of "while (not Q)" */
 
-        bb_putchar('\n');
+        if (!OPT_BATCH_MODE)
+                bb_putchar('\n');
 #if ENABLE_FEATURE_TOP_INTERACTIVE
         reset_term();
 #endif
diff --git a/runit/chpst.c b/runit/chpst.c
index 2be1a5775..3d04ee50d 100644
--- a/runit/chpst.c
+++ b/runit/chpst.c
@@ -38,7 +38,8 @@ ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 //config:       bool "setuidgid (4.2 kb)"
 //config:       default y
 //config:       help
-//config:       Sets soft resource limits as specified by options
+//config:       Sets UID and GID to those of the given account, and execs
+//config:       specified program.
 //config:
 //config:config ENVUIDGID
 //config:       bool "envuidgid (4.1 kb)"
@@ -466,7 +467,8 @@ int chpst_main(int argc UNUSED_PARAM, char **argv)
         /* nice should be done before xsetuid */
         if (opt & OPT_n) {
                 errno = 0;
-                if (nice(xatoi(nicestr)) == -1)
+                nice(xatoi(nicestr));
+                if (errno)
                         bb_simple_perror_msg_and_die("nice");
         }
 
diff --git a/scripts/kconfig/libcurses/addch.c b/scripts/kconfig/libcurses/addch.c
index f3c25d389..3d1f9c04b 100644
--- a/scripts/kconfig/libcurses/addch.c
+++ b/scripts/kconfig/libcurses/addch.c
@@ -90,23 +90,25 @@ addch
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    addch                       Y       Y       Y
-    waddch                      Y       Y       Y
-    mvaddch                     Y       Y       Y
-    mvwaddch                    Y       Y       Y
-    echochar                    Y       Y       Y
-    wechochar                   Y       Y       Y
-    add_wch                     Y       Y       Y
-    wadd_wch                    Y       Y       Y
-    mvadd_wch                   Y       Y       Y
-    mvwadd_wch                  Y       Y       Y
-    echo_wchar                  Y       Y       Y
-    wecho_wchar                 Y       Y       Y
-    addrawch                    -       -       -
-    waddrawch                   -       -       -
-    mvaddrawch                  -       -       -
-    mvwaddrawch                 -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   addch                 |    Y   |    Y    |   Y
+   waddch                |    Y   |    Y    |   Y
+   mvaddch               |    Y   |    Y    |   Y
+   mvwaddch              |    Y   |    Y    |   Y
+   echochar              |    Y   |    Y    |   Y
+   wechochar             |    Y   |    Y    |   Y
+   add_wch               |    Y   |    Y    |   Y
+   wadd_wch              |    Y   |    Y    |   Y
+   mvadd_wch             |    Y   |    Y    |   Y
+   mvwadd_wch            |    Y   |    Y    |   Y
+   echo_wchar            |    Y   |    Y    |   Y
+   wecho_wchar           |    Y   |    Y    |   Y
+   addrawch              |    -   |    -    |   -
+   waddrawch             |    -   |    -    |   -
+   mvaddrawch            |    -   |    -    |   -
+   mvwaddrawch           |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/addstr.c b/scripts/kconfig/libcurses/addstr.c
index 47f8f4e10..bc286d4b5 100644
--- a/scripts/kconfig/libcurses/addstr.c
+++ b/scripts/kconfig/libcurses/addstr.c
@@ -43,23 +43,25 @@ addstr
    All functions return OK or ERR.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    addstr                      Y       Y       Y
-    waddstr                     Y       Y       Y
-    mvaddstr                    Y       Y       Y
-    mvwaddstr                   Y       Y       Y
-    addnstr                     Y       Y       Y
-    waddnstr                    Y       Y       Y
-    mvaddnstr                   Y       Y       Y
-    mvwaddnstr                  Y       Y       Y
-    addwstr                     Y       Y       Y
-    waddwstr                    Y       Y       Y
-    mvaddwstr                   Y       Y       Y
-    mvwaddwstr                  Y       Y       Y
-    addnwstr                    Y       Y       Y
-    waddnwstr                   Y       Y       Y
-    mvaddnwstr                  Y       Y       Y
-    mvwaddnwstr                 Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   addstr                |    Y   |    Y    |   Y
+   waddstr               |    Y   |    Y    |   Y
+   mvaddstr              |    Y   |    Y    |   Y
+   mvwaddstr             |    Y   |    Y    |   Y
+   addnstr               |    Y   |    Y    |   Y
+   waddnstr              |    Y   |    Y    |   Y
+   mvaddnstr             |    Y   |    Y    |   Y
+   mvwaddnstr            |    Y   |    Y    |   Y
+   addwstr               |    Y   |    Y    |   Y
+   waddwstr              |    Y   |    Y    |   Y
+   mvaddwstr             |    Y   |    Y    |   Y
+   mvwaddwstr            |    Y   |    Y    |   Y
+   addnwstr              |    Y   |    Y    |   Y
+   waddnwstr             |    Y   |    Y    |   Y
+   mvaddnwstr            |    Y   |    Y    |   Y
+   mvwaddnwstr           |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/attr.c b/scripts/kconfig/libcurses/attr.c
index 3ab5a5637..d7bc36c73 100644
--- a/scripts/kconfig/libcurses/attr.c
+++ b/scripts/kconfig/libcurses/attr.c
@@ -96,36 +96,38 @@ attr
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    attroff                     Y       Y       Y
-    wattroff                    Y       Y       Y
-    attron                      Y       Y       Y
-    wattron                     Y       Y       Y
-    attrset                     Y       Y       Y
-    wattrset                    Y       Y       Y
-    standend                    Y       Y       Y
-    wstandend                   Y       Y       Y
-    standout                    Y       Y       Y
-    wstandout                   Y       Y       Y
-    color_set                   Y       Y       Y
-    wcolor_set                  Y       Y       Y
-    attr_get                    Y       Y       Y
-    wattr_get                   Y       Y       Y
-    attr_on                     Y       Y       Y
-    wattr_on                    Y       Y       Y
-    attr_off                    Y       Y       Y
-    wattr_off                   Y       Y       Y
-    attr_set                    Y       Y       Y
-    wattr_set                   Y       Y       Y
-    chgat                       Y       Y       Y
-    wchgat                      Y       Y       Y
-    mvchgat                     Y       Y       Y
-    mvwchgat                    Y       Y       Y
-    getattrs                    -       Y       Y
-    underend                    -       -       Y
-    wunderend                   -       -       Y
-    underscore                  -       -       Y
-    wunderscore                 -       -       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   attroff               |    Y   |    Y    |   Y
+   wattroff              |    Y   |    Y    |   Y
+   attron                |    Y   |    Y    |   Y
+   wattron               |    Y   |    Y    |   Y
+   attrset               |    Y   |    Y    |   Y
+   wattrset              |    Y   |    Y    |   Y
+   standend              |    Y   |    Y    |   Y
+   wstandend             |    Y   |    Y    |   Y
+   standout              |    Y   |    Y    |   Y
+   wstandout             |    Y   |    Y    |   Y
+   color_set             |    Y   |    Y    |   Y
+   wcolor_set            |    Y   |    Y    |   Y
+   attr_get              |    Y   |    Y    |   Y
+   wattr_get             |    Y   |    Y    |   Y
+   attr_on               |    Y   |    Y    |   Y
+   wattr_on              |    Y   |    Y    |   Y
+   attr_off              |    Y   |    Y    |   Y
+   wattr_off             |    Y   |    Y    |   Y
+   attr_set              |    Y   |    Y    |   Y
+   wattr_set             |    Y   |    Y    |   Y
+   chgat                 |    Y   |    Y    |   Y
+   wchgat                |    Y   |    Y    |   Y
+   mvchgat               |    Y   |    Y    |   Y
+   mvwchgat              |    Y   |    Y    |   Y
+   getattrs              |    -   |    Y    |   Y
+   underend              |    -   |    -    |   Y
+   wunderend             |    -   |    -    |   Y
+   underscore            |    -   |    -    |   Y
+   wunderscore           |    -   |    -    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/beep.c b/scripts/kconfig/libcurses/beep.c
index 0b97137fd..b679eed3c 100644
--- a/scripts/kconfig/libcurses/beep.c
+++ b/scripts/kconfig/libcurses/beep.c
@@ -26,9 +26,11 @@ beep
    These functions return ERR if called before initscr(), otherwise OK.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    beep                        Y       Y       Y
-    flash                       Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   beep                  |    Y   |    Y    |   Y
+   flash                 |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/bkgd.c b/scripts/kconfig/libcurses/bkgd.c
index af2d0e054..c92df28be 100644
--- a/scripts/kconfig/libcurses/bkgd.c
+++ b/scripts/kconfig/libcurses/bkgd.c
@@ -48,18 +48,20 @@ bkgd
    case they return ERR.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    bkgd                        Y       Y       Y
-    bkgdset                     Y       Y       Y
-    getbkgd                     Y       Y       Y
-    wbkgd                       Y       Y       Y
-    wbkgdset                    Y       Y       Y
-    bkgrnd                      Y       Y       Y
-    bkgrndset                   Y       Y       Y
-    getbkgrnd                   Y       Y       Y
-    wbkgrnd                     Y       Y       Y
-    wbkgrndset                  Y       Y       Y
-    wgetbkgrnd                  Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   bkgd                  |    Y   |    Y    |   Y
+   bkgdset               |    Y   |    Y    |   Y
+   getbkgd               |    Y   |    Y    |   Y
+   wbkgd                 |    Y   |    Y    |   Y
+   wbkgdset              |    Y   |    Y    |   Y
+   bkgrnd                |    Y   |    Y    |   Y
+   bkgrndset             |    Y   |    Y    |   Y
+   getbkgrnd             |    Y   |    Y    |   Y
+   wbkgrnd               |    Y   |    Y    |   Y
+   wbkgrndset            |    Y   |    Y    |   Y
+   wgetbkgrnd            |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/border.c b/scripts/kconfig/libcurses/border.c
index 302c46ea2..409f2351a 100644
--- a/scripts/kconfig/libcurses/border.c
+++ b/scripts/kconfig/libcurses/border.c
@@ -46,14 +46,16 @@ border
    border(), wborder(), and box() draw a border around the edge of the
    window. If any argument is zero, an appropriate default is used:
 
-    ls    left side of border             ACS_VLINE
-    rs    right side of border            ACS_VLINE
-    ts    top side of border              ACS_HLINE
-    bs    bottom side of border           ACS_HLINE
-    tl    top left corner of border       ACS_ULCORNER
-    tr    top right corner of border      ACS_URCORNER
-    bl    bottom left corner of border    ACS_LLCORNER
-    br    bottom right corner of border   ACS_LRCORNER
+   Name | Element                       | Default
+   :----|:------------------------------|:------------
+   ls   | left side of border           | ACS_VLINE
+   rs   | right side of border          | ACS_VLINE
+   ts   | top side of border            | ACS_HLINE
+   bs   | bottom side of border         | ACS_HLINE
+   tl   | top left corner of border     | ACS_ULCORNER
+   tr   | top right corner of border    | ACS_URCORNER
+   bl   | bottom left corner of border  | ACS_LLCORNER
+   br   | bottom right corner of border | ACS_LRCORNER
 
    hline() and whline() draw a horizontal line, using ch, starting from
    the current cursor position. The cursor position does not change. The
@@ -74,29 +76,31 @@ border
    These functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    border                      Y       Y       Y
-    wborder                     Y       Y       Y
-    box                         Y       Y       Y
-    hline                       Y       Y       Y
-    vline                       Y       Y       Y
-    whline                      Y       Y       Y
-    wvline                      Y       Y       Y
-    mvhline                     Y       Y       Y
-    mvvline                     Y       Y       Y
-    mvwhline                    Y       Y       Y
-    mvwvline                    Y       Y       Y
-    border_set                  Y       Y       Y
-    wborder_set                 Y       Y       Y
-    box_set                     Y       Y       Y
-    hline_set                   Y       Y       Y
-    vline_set                   Y       Y       Y
-    whline_set                  Y       Y       Y
-    wvline_set                  Y       Y       Y
-    mvhline_set                 Y       Y       Y
-    mvvline_set                 Y       Y       Y
-    mvwhline_set                Y       Y       Y
-    mvwvline_set                Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   border                |    Y   |    Y    |   Y
+   wborder               |    Y   |    Y    |   Y
+   box                   |    Y   |    Y    |   Y
+   hline                 |    Y   |    Y    |   Y
+   vline                 |    Y   |    Y    |   Y
+   whline                |    Y   |    Y    |   Y
+   wvline                |    Y   |    Y    |   Y
+   mvhline               |    Y   |    Y    |   Y
+   mvvline               |    Y   |    Y    |   Y
+   mvwhline              |    Y   |    Y    |   Y
+   mvwvline              |    Y   |    Y    |   Y
+   border_set            |    Y   |    Y    |   Y
+   wborder_set           |    Y   |    Y    |   Y
+   box_set               |    Y   |    Y    |   Y
+   hline_set             |    Y   |    Y    |   Y
+   vline_set             |    Y   |    Y    |   Y
+   whline_set            |    Y   |    Y    |   Y
+   wvline_set            |    Y   |    Y    |   Y
+   mvhline_set           |    Y   |    Y    |   Y
+   mvvline_set           |    Y   |    Y    |   Y
+   mvwhline_set          |    Y   |    Y    |   Y
+   mvwvline_set          |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/clear.c b/scripts/kconfig/libcurses/clear.c
index acb8edf81..e10b321c3 100644
--- a/scripts/kconfig/libcurses/clear.c
+++ b/scripts/kconfig/libcurses/clear.c
@@ -38,15 +38,17 @@ clear
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    clear                       Y       Y       Y
-    wclear                      Y       Y       Y
-    erase                       Y       Y       Y
-    werase                      Y       Y       Y
-    clrtobot                    Y       Y       Y
-    wclrtobot                   Y       Y       Y
-    clrtoeol                    Y       Y       Y
-    wclrtoeol                   Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   clear                 |    Y   |    Y    |   Y
+   wclear                |    Y   |    Y    |   Y
+   erase                 |    Y   |    Y    |   Y
+   werase                |    Y   |    Y    |   Y
+   clrtobot              |    Y   |    Y    |   Y
+   wclrtobot             |    Y   |    Y    |   Y
+   clrtoeol              |    Y   |    Y    |   Y
+   wclrtoeol             |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/color.c b/scripts/kconfig/libcurses/color.c
index 3335ae082..372dad948 100644
--- a/scripts/kconfig/libcurses/color.c
+++ b/scripts/kconfig/libcurses/color.c
@@ -92,20 +92,22 @@ color
    find_pair() return a pair number, or -1 on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    has_colors                  Y       Y       Y
-    start_color                 Y       Y       Y
-    init_pair                   Y       Y       Y
-    pair_content                Y       Y       Y
-    can_change_color            Y       Y       Y
-    init_color                  Y       Y       Y
-    color_content               Y       Y       Y
-    alloc_pair                  -       Y       -
-    assume_default_colors       -       Y       Y
-    find_pair                   -       Y       -
-    free_pair                   -       Y       -
-    use_default_colors          -       Y       Y
-    PDC_set_line_color          -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   has_colors            |    Y   |    Y    |   Y
+   start_color           |    Y   |    Y    |   Y
+   init_pair             |    Y   |    Y    |   Y
+   pair_content          |    Y   |    Y    |   Y
+   can_change_color      |    Y   |    Y    |   Y
+   init_color            |    Y   |    Y    |   Y
+   color_content         |    Y   |    Y    |   Y
+   alloc_pair            |    -   |    Y    |   -
+   assume_default_colors |    -   |    Y    |   Y
+   find_pair             |    -   |    Y    |   -
+   free_pair             |    -   |    Y    |   -
+   use_default_colors    |    -   |    Y    |   Y
+   PDC_set_line_color    |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/curses.h b/scripts/kconfig/libcurses/curses.h
index e4ba3776a..f58fe66df 100644
--- a/scripts/kconfig/libcurses/curses.h
+++ b/scripts/kconfig/libcurses/curses.h
@@ -9,26 +9,28 @@
 
 Define before inclusion (only those needed):
 
-    XCURSES         if building / built for X11
-    PDC_RGB         if you want to use RGB color definitions
-                    (Red = 1, Green = 2, Blue = 4) instead of BGR
-    PDC_WIDE        if building / built with wide-character support
-    PDC_DLL_BUILD   if building / built as a Windows DLL
-    PDC_NCMOUSE     to use the ncurses mouse API instead
-                    of PDCurses' traditional mouse API
+   Macro         | Meaning / value
+   :-------------|-------------------------------------------------
+   XCURSES       | if building / built for X11
+   PDC_RGB       | RGB color (Red = 1, Green = 2, Blue = 4) vs. BGR
+   PDC_WIDE      | if building / built with wide-character support
+   PDC_DLL_BUILD | if building / built as a Windows DLL
+   PDC_NCMOUSE   | use ncurses mouse API vs. traditional PDCurses
 
 Defined by this header:
 
-    PDCURSES        PDCurses-only features are available
-    PDC_BUILD       API build version
-    PDC_VER_MAJOR   major version number
-    PDC_VER_MINOR   minor version number
-    PDC_VERDOT      version string
+   Macro         | Meaning / value
+   :-------------|-------------------------------------------------
+   PDCURSES      | PDCurses-only features are available
+   PDC_BUILD     | API build version
+   PDC_VER_MAJOR | major version number
+   PDC_VER_MINOR | minor version number
+   PDC_VERDOT    | version string
 
 **man-end****************************************************************/
 
 #define PDCURSES        1
-#define PDC_BUILD    3907
+#define PDC_BUILD    3908
 #define PDC_VER_MAJOR   3
 #define PDC_VER_MINOR   9
 #define PDC_VERDOT   "3.9"
@@ -420,10 +422,9 @@ Text Attributes
 
 PDCurses uses a 32-bit integer for its chtype:
 
-    +--------------------------------------------------------------------+
-    |31|30|29|28|27|26|25|24|23|22|21|20|19|18|17|16|15|14|13|..| 2| 1| 0|
-    +--------------------------------------------------------------------+
-          color pair        |     modifiers         |   character eg 'a'
+   color pair             | modifiers             | character eg 'a'
+   -----------------------|-----------------------|--------------------
+   31 30 29 28 27 26 25 24|23 22 21 20 19 18 17 16|15 14 13 ..  2  1  0
 
 There are 256 color pairs (8 bits), 8 bits for modifiers, and 16 bits
 for character data. The modifiers are bold, underline, right-line,
diff --git a/scripts/kconfig/libcurses/getch.c b/scripts/kconfig/libcurses/getch.c
index 8719ca39c..9d771ec0e 100644
--- a/scripts/kconfig/libcurses/getch.c
+++ b/scripts/kconfig/libcurses/getch.c
@@ -75,19 +75,21 @@ getch
    character or function key token.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    getch                       Y       Y       Y
-    wgetch                      Y       Y       Y
-    mvgetch                     Y       Y       Y
-    mvwgetch                    Y       Y       Y
-    ungetch                     Y       Y       Y
-    flushinp                    Y       Y       Y
-    get_wch                     Y       Y       Y
-    wget_wch                    Y       Y       Y
-    mvget_wch                   Y       Y       Y
-    mvwget_wch                  Y       Y       Y
-    unget_wch                   Y       Y       Y
-    PDC_get_key_modifiers       -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   getch                 |    Y   |    Y    |   Y
+   wgetch                |    Y   |    Y    |   Y
+   mvgetch               |    Y   |    Y    |   Y
+   mvwgetch              |    Y   |    Y    |   Y
+   ungetch               |    Y   |    Y    |   Y
+   flushinp              |    Y   |    Y    |   Y
+   get_wch               |    Y   |    Y    |   Y
+   wget_wch              |    Y   |    Y    |   Y
+   mvget_wch             |    Y   |    Y    |   Y
+   mvwget_wch            |    Y   |    Y    |   Y
+   unget_wch             |    Y   |    Y    |   Y
+   PDC_get_key_modifiers |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/getyx.c b/scripts/kconfig/libcurses/getyx.c
index 5f104df99..6aa894ed0 100644
--- a/scripts/kconfig/libcurses/getyx.c
+++ b/scripts/kconfig/libcurses/getyx.c
@@ -54,21 +54,23 @@ getyx
    values, or ERR in the case of a NULL window.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    getyx                       Y       Y       Y
-    getparyx                    Y       Y       Y
-    getbegyx                    Y       Y       Y
-    getmaxyx                    Y       Y       Y
-    getsyx                      -       Y       Y
-    setsyx                      -       Y       Y
-    getbegy                     -       Y       Y
-    getbegx                     -       Y       Y
-    getcury                     -       Y       Y
-    getcurx                     -       Y       Y
-    getpary                     -       Y       Y
-    getparx                     -       Y       Y
-    getmaxy                     -       Y       Y
-    getmaxx                     -       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   getyx                 |    Y   |    Y    |   Y
+   getparyx              |    Y   |    Y    |   Y
+   getbegyx              |    Y   |    Y    |   Y
+   getmaxyx              |    Y   |    Y    |   Y
+   getsyx                |    -   |    Y    |   Y
+   setsyx                |    -   |    Y    |   Y
+   getbegy               |    -   |    Y    |   Y
+   getbegx               |    -   |    Y    |   Y
+   getcury               |    -   |    Y    |   Y
+   getcurx               |    -   |    Y    |   Y
+   getpary               |    -   |    Y    |   Y
+   getparx               |    -   |    Y    |   Y
+   getmaxy               |    -   |    Y    |   Y
+   getmaxx               |    -   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/inch.c b/scripts/kconfig/libcurses/inch.c
index 2bd4430f6..28b57e222 100644
--- a/scripts/kconfig/libcurses/inch.c
+++ b/scripts/kconfig/libcurses/inch.c
@@ -31,15 +31,17 @@ inch
    returned.) Note that in PDCurses, chtype and cchar_t are the same.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    inch                        Y       Y       Y
-    winch                       Y       Y       Y
-    mvinch                      Y       Y       Y
-    mvwinch                     Y       Y       Y
-    in_wch                      Y       Y       Y
-    win_wch                     Y       Y       Y
-    mvin_wch                    Y       Y       Y
-    mvwin_wch                   Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   inch                  |    Y   |    Y    |   Y
+   winch                 |    Y   |    Y    |   Y
+   mvinch                |    Y   |    Y    |   Y
+   mvwinch               |    Y   |    Y    |   Y
+   in_wch                |    Y   |    Y    |   Y
+   win_wch               |    Y   |    Y    |   Y
+   mvin_wch              |    Y   |    Y    |   Y
+   mvwin_wch             |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/initscr.c b/scripts/kconfig/libcurses/initscr.c
index 66940a3cf..a4208642a 100644
--- a/scripts/kconfig/libcurses/initscr.c
+++ b/scripts/kconfig/libcurses/initscr.c
@@ -83,17 +83,19 @@ initscr
    returns OK, and resize_term(), which returns either OK or ERR.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    initscr                     Y       Y       Y
-    endwin                      Y       Y       Y
-    isendwin                    Y       Y       Y
-    newterm                     Y       Y       Y
-    set_term                    Y       Y       Y
-    delscreen                   Y       Y       Y
-    resize_term                 -       Y       Y
-    set_tabsize                 -       Y       Y
-    curses_version              -       Y       -
-    is_termresized              -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   initscr               |    Y   |    Y    |   Y
+   endwin                |    Y   |    Y    |   Y
+   isendwin              |    Y   |    Y    |   Y
+   newterm               |    Y   |    Y    |   Y
+   set_term              |    Y   |    Y    |   Y
+   delscreen             |    Y   |    Y    |   Y
+   resize_term           |    -   |    Y    |   Y
+   set_tabsize           |    -   |    Y    |   Y
+   curses_version        |    -   |    Y    |   -
+   is_termresized        |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/inopts.c b/scripts/kconfig/libcurses/inopts.c
index 30e18f611..a1c4b49f8 100644
--- a/scripts/kconfig/libcurses/inopts.c
+++ b/scripts/kconfig/libcurses/inopts.c
@@ -106,32 +106,34 @@ inopts
    always returns FALSE. All others return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    cbreak                      Y       Y       Y
-    nocbreak                    Y       Y       Y
-    echo                        Y       Y       Y
-    noecho                      Y       Y       Y
-    halfdelay                   Y       Y       Y
-    intrflush                   Y       Y       Y
-    keypad                      Y       Y       Y
-    meta                        Y       Y       Y
-    nl                          Y       Y       Y
-    nonl                        Y       Y       Y
-    nodelay                     Y       Y       Y
-    notimeout                   Y       Y       Y
-    raw                         Y       Y       Y
-    noraw                       Y       Y       Y
-    noqiflush                   Y       Y       Y
-    qiflush                     Y       Y       Y
-    timeout                     Y       Y       Y
-    wtimeout                    Y       Y       Y
-    wgetdelay                   -       Y       -
-    typeahead                   Y       Y       Y
-    crmode                      Y       Y       Y
-    nocrmode                    Y       Y       Y
-    is_keypad                   -       Y       Y
-    is_nodelay                  -       Y       -
-    is_notimeout                -       Y       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   cbreak                |    Y   |    Y    |   Y
+   nocbreak              |    Y   |    Y    |   Y
+   echo                  |    Y   |    Y    |   Y
+   noecho                |    Y   |    Y    |   Y
+   halfdelay             |    Y   |    Y    |   Y
+   intrflush             |    Y   |    Y    |   Y
+   keypad                |    Y   |    Y    |   Y
+   meta                  |    Y   |    Y    |   Y
+   nl                    |    Y   |    Y    |   Y
+   nonl                  |    Y   |    Y    |   Y
+   nodelay               |    Y   |    Y    |   Y
+   notimeout             |    Y   |    Y    |   Y
+   raw                   |    Y   |    Y    |   Y
+   noraw                 |    Y   |    Y    |   Y
+   noqiflush             |    Y   |    Y    |   Y
+   qiflush               |    Y   |    Y    |   Y
+   timeout               |    Y   |    Y    |   Y
+   wtimeout              |    Y   |    Y    |   Y
+   wgetdelay             |    -   |    Y    |   -
+   typeahead             |    Y   |    Y    |   Y
+   crmode                |    Y   |    Y    |   Y
+   nocrmode              |    Y   |    Y    |   Y
+   is_keypad             |    -   |    Y    |   Y
+   is_nodelay            |    -   |    Y    |   -
+   is_notimeout          |    -   |    Y    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/kernel.c b/scripts/kconfig/libcurses/kernel.c
index afb2d0661..0f5a73c21 100644
--- a/scripts/kconfig/libcurses/kernel.c
+++ b/scripts/kconfig/libcurses/kernel.c
@@ -71,20 +71,22 @@ kernel
    curs_set(), which returns the previous visibility.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    def_prog_mode               Y       Y       Y
-    def_shell_mode              Y       Y       Y
-    reset_prog_mode             Y       Y       Y
-    reset_shell_mode            Y       Y       Y
-    resetty                     Y       Y       Y
-    savetty                     Y       Y       Y
-    ripoffline                  Y       Y       Y
-    curs_set                    Y       Y       Y
-    napms                       Y       Y       Y
-    fixterm                     -       Y       -
-    resetterm                   -       Y       -
-    saveterm                    -       Y       -
-    draino                      -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   def_prog_mode         |    Y   |    Y    |   Y
+   def_shell_mode        |    Y   |    Y    |   Y
+   reset_prog_mode       |    Y   |    Y    |   Y
+   reset_shell_mode      |    Y   |    Y    |   Y
+   resetty               |    Y   |    Y    |   Y
+   savetty               |    Y   |    Y    |   Y
+   ripoffline            |    Y   |    Y    |   Y
+   curs_set              |    Y   |    Y    |   Y
+   napms                 |    Y   |    Y    |   Y
+   fixterm               |    -   |    Y    |   -
+   resetterm             |    -   |    Y    |   -
+   saveterm              |    -   |    Y    |   -
+   draino                |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/move.c b/scripts/kconfig/libcurses/move.c
index 96496445e..38db1d19a 100644
--- a/scripts/kconfig/libcurses/move.c
+++ b/scripts/kconfig/libcurses/move.c
@@ -28,10 +28,12 @@ move
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    move                        Y       Y       Y
-    mvcur                       Y       Y       Y
-    wmove                       Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   move                  |    Y   |    Y    |   Y
+   mvcur                 |    Y   |    Y    |   Y
+   wmove                 |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/outopts.c b/scripts/kconfig/libcurses/outopts.c
index e0a55e437..4c8950959 100644
--- a/scripts/kconfig/libcurses/outopts.c
+++ b/scripts/kconfig/libcurses/outopts.c
@@ -75,23 +75,25 @@ outopts
    return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    clearok                     Y       Y       Y
-    idlok                       Y       Y       Y
-    idcok                       Y       Y       Y
-    immedok                     Y       Y       Y
-    leaveok                     Y       Y       Y
-    setscrreg                   Y       Y       Y
-    wsetscrreg                  Y       Y       Y
-    wgetscrreg                  -       Y       -
-    scrollok                    Y       Y       Y
-    is_cleared                  -       Y       -
-    is_idlok                    -       Y       -
-    is_idcok                    -       Y       -
-    is_immedok                  -       Y       -
-    is_leaveok                  -       Y       Y
-    is_scrollok                 -       Y       -
-    raw_output                  -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   clearok               |    Y   |    Y    |   Y
+   idlok                 |    Y   |    Y    |   Y
+   idcok                 |    Y   |    Y    |   Y
+   immedok               |    Y   |    Y    |   Y
+   leaveok               |    Y   |    Y    |   Y
+   setscrreg             |    Y   |    Y    |   Y
+   wsetscrreg            |    Y   |    Y    |   Y
+   wgetscrreg            |    -   |    Y    |   -
+   scrollok              |    Y   |    Y    |   Y
+   is_cleared            |    -   |    Y    |   -
+   is_idlok              |    -   |    Y    |   -
+   is_idcok              |    -   |    Y    |   -
+   is_immedok            |    -   |    Y    |   -
+   is_leaveok            |    -   |    Y    |   Y
+   is_scrollok           |    -   |    Y    |   -
+   raw_output            |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/overlay.c b/scripts/kconfig/libcurses/overlay.c
index ae1903da8..75a93d83c 100644
--- a/scripts/kconfig/libcurses/overlay.c
+++ b/scripts/kconfig/libcurses/overlay.c
@@ -39,10 +39,12 @@ overlay
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    overlay                     Y       Y       Y
-    overwrite                   Y       Y       Y
-    copywin                     Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   overlay               |    Y   |    Y    |   Y
+   overwrite             |    Y   |    Y    |   Y
+   copywin               |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/pad.c b/scripts/kconfig/libcurses/pad.c
index 3dfdfe5d6..8b44dabd4 100644
--- a/scripts/kconfig/libcurses/pad.c
+++ b/scripts/kconfig/libcurses/pad.c
@@ -62,14 +62,16 @@ pad
    All functions except is_pad() return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    newpad                      Y       Y       Y
-    subpad                      Y       Y       Y
-    prefresh                    Y       Y       Y
-    pnoutrefresh                Y       Y       Y
-    pechochar                   Y       Y       Y
-    pecho_wchar                 Y       Y       Y
-    is_pad                      -       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   newpad                |    Y   |    Y    |   Y
+   subpad                |    Y   |    Y    |   Y
+   prefresh              |    Y   |    Y    |   Y
+   pnoutrefresh          |    Y   |    Y    |   Y
+   pechochar             |    Y   |    Y    |   Y
+   pecho_wchar           |    Y   |    Y    |   Y
+   is_pad                |    -   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/pdcclip.c b/scripts/kconfig/libcurses/pdcclip.c
index 740221280..6184ad2d9 100644
--- a/scripts/kconfig/libcurses/pdcclip.c
+++ b/scripts/kconfig/libcurses/pdcclip.c
@@ -24,26 +24,27 @@ clipboard
    memory returned, via PDC_freeclipboard(). The length of the clipboard
    contents is returned in the length argument.
 
-   PDC_setclipboard copies the supplied text into the system's
+   PDC_setclipboard() copies the supplied text into the system's
    clipboard, emptying the clipboard prior to the copy.
 
    PDC_clearclipboard() clears the internal clipboard.
 
 ### Return Values
 
-   indicator of success/failure of call.
-   PDC_CLIP_SUCCESS        the call was successful
-   PDC_CLIP_MEMORY_ERROR   unable to allocate sufficient memory for
-                           the clipboard contents
-   PDC_CLIP_EMPTY          the clipboard contains no text
-   PDC_CLIP_ACCESS_ERROR   no clipboard support
+    PDC_CLIP_SUCCESS        the call was successful
+    PDC_CLIP_MEMORY_ERROR   unable to allocate sufficient memory for
+                            the clipboard contents
+    PDC_CLIP_EMPTY          the clipboard contains no text
+    PDC_CLIP_ACCESS_ERROR   no clipboard support
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    PDC_getclipboard            -       -       -
-    PDC_setclipboard            -       -       -
-    PDC_freeclipboard           -       -       -
-    PDC_clearclipboard          -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   PDC_getclipboard      |    -   |    -    |   -
+   PDC_setclipboard      |    -   |    -    |   -
+   PDC_freeclipboard     |    -   |    -    |   -
+   PDC_clearclipboard    |    -   |    -    |   -
 
 **man-end****************************************************************/
 
@@ -143,7 +144,12 @@ int PDC_clearclipboard(void)
 {
     PDC_LOG(("PDC_clearclipboard() - called\n"));
 
-    EmptyClipboard();
+    if (OpenClipboard(NULL))
+        if (EmptyClipboard())
+        {
+            CloseClipboard();
+            return PDC_CLIP_SUCCESS;
+        }
 
-    return PDC_CLIP_SUCCESS;
+    return PDC_CLIP_ACCESS_ERROR;
 }
diff --git a/scripts/kconfig/libcurses/pdcsetsc.c b/scripts/kconfig/libcurses/pdcsetsc.c
index a2d1b6dc3..1e9fc9b0d 100644
--- a/scripts/kconfig/libcurses/pdcsetsc.c
+++ b/scripts/kconfig/libcurses/pdcsetsc.c
@@ -31,9 +31,12 @@ pdcsetsc
    platforms.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    PDC_set_blink               -       -       -
-    PDC_set_title               -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   PDC_set_blink         |    -   |    -    |   -
+   PDC_set_bold          |    -   |    -    |   -
+   PDC_set_title         |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/printw.c b/scripts/kconfig/libcurses/printw.c
index 38e7fd112..a753638a5 100644
--- a/scripts/kconfig/libcurses/printw.c
+++ b/scripts/kconfig/libcurses/printw.c
@@ -32,13 +32,15 @@ printw
    error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    printw                      Y       Y       Y
-    wprintw                     Y       Y       Y
-    mvprintw                    Y       Y       Y
-    mvwprintw                   Y       Y       Y
-    vwprintw                    Y       Y       Y
-    vw_printw                   Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   printw                |    Y   |    Y    |   Y
+   wprintw               |    Y   |    Y    |   Y
+   mvprintw              |    Y   |    Y    |   Y
+   mvwprintw             |    Y   |    Y    |   Y
+   vwprintw              |    Y   |    Y    |   Y
+   vw_printw             |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/refresh.c b/scripts/kconfig/libcurses/refresh.c
index 306f4efb3..1dce414e5 100644
--- a/scripts/kconfig/libcurses/refresh.c
+++ b/scripts/kconfig/libcurses/refresh.c
@@ -45,13 +45,15 @@ refresh
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    refresh                     Y       Y       Y
-    wrefresh                    Y       Y       Y
-    wnoutrefresh                Y       Y       Y
-    doupdate                    Y       Y       Y
-    redrawwin                   Y       Y       Y
-    wredrawln                   Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   refresh               |    Y   |    Y    |   Y
+   wrefresh              |    Y   |    Y    |   Y
+   wnoutrefresh          |    Y   |    Y    |   Y
+   doupdate              |    Y   |    Y    |   Y
+   redrawwin             |    Y   |    Y    |   Y
+   wredrawln             |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/scroll.c b/scripts/kconfig/libcurses/scroll.c
index d2f3d1704..a53d71bad 100644
--- a/scripts/kconfig/libcurses/scroll.c
+++ b/scripts/kconfig/libcurses/scroll.c
@@ -31,10 +31,12 @@ scroll
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    scroll                      Y       Y       Y
-    scrl                        Y       Y       Y
-    wscrl                       Y       Y       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   scroll                |    Y   |    Y    |   Y
+   scrl                  |    Y   |    Y    |   Y
+   wscrl                 |    Y   |    Y    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/slk.c b/scripts/kconfig/libcurses/slk.c
index a9fca13d3..e8dde752c 100644
--- a/scripts/kconfig/libcurses/slk.c
+++ b/scripts/kconfig/libcurses/slk.c
@@ -46,12 +46,12 @@ slk
    slk_init() requires a single parameter which describes the format of
    the SLKs as follows:
 
-   0       3-2-3 format
-   1       4-4 format
-   2       4-4-4 format (ncurses extension)
-   3       4-4-4 format with index line (ncurses extension)
-   2 lines used
-   55      5-5 format (pdcurses format)
+    0       3-2-3 format
+    1       4-4 format
+    2       4-4-4 format (ncurses extension)
+    3       4-4-4 format with index line (ncurses extension)
+    2 lines used
+    55      5-5 format (pdcurses format)
 
    slk_refresh(), slk_noutrefresh() and slk_touch() are analogous to
    refresh(), noutrefresh() and touch().
@@ -61,26 +61,28 @@ slk
    All functions return OK on success and ERR on error.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    slk_init                    Y       Y       Y
-    slk_set                     Y       Y       Y
-    slk_refresh                 Y       Y       Y
-    slk_noutrefresh             Y       Y       Y
-    slk_label                   Y       Y       Y
-    slk_clear                   Y       Y       Y
-    slk_restore                 Y       Y       Y
-    slk_touch                   Y       Y       Y
-    slk_attron                  Y       Y       Y
-    slk_attrset                 Y       Y       Y
-    slk_attroff                 Y       Y       Y
-    slk_attr_on                 Y       Y       Y
-    slk_attr_set                Y       Y       Y
-    slk_attr_off                Y       Y       Y
-    slk_wset                    Y       Y       Y
-    PDC_mouse_in_slk            -       -       -
-    PDC_slk_free                -       -       -
-    PDC_slk_initialize          -       -       -
-    slk_wlabel                  -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   slk_init              |    Y   |    Y    |   Y
+   slk_set               |    Y   |    Y    |   Y
+   slk_refresh           |    Y   |    Y    |   Y
+   slk_noutrefresh       |    Y   |    Y    |   Y
+   slk_label             |    Y   |    Y    |   Y
+   slk_clear             |    Y   |    Y    |   Y
+   slk_restore           |    Y   |    Y    |   Y
+   slk_touch             |    Y   |    Y    |   Y
+   slk_attron            |    Y   |    Y    |   Y
+   slk_attrset           |    Y   |    Y    |   Y
+   slk_attroff           |    Y   |    Y    |   Y
+   slk_attr_on           |    Y   |    Y    |   Y
+   slk_attr_set          |    Y   |    Y    |   Y
+   slk_attr_off          |    Y   |    Y    |   Y
+   slk_wset              |    Y   |    Y    |   Y
+   PDC_mouse_in_slk      |    -   |    -    |   -
+   PDC_slk_free          |    -   |    -    |   -
+   PDC_slk_initialize    |    -   |    -    |   -
+   slk_wlabel            |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/touch.c b/scripts/kconfig/libcurses/touch.c
index 2fd03cce5..7ea0b64b2 100644
--- a/scripts/kconfig/libcurses/touch.c
+++ b/scripts/kconfig/libcurses/touch.c
@@ -49,14 +49,16 @@ touch
    is_wintouched() and is_linetouched().
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    touchwin                    Y       Y       Y
-    touchline                   Y       Y       Y
-    untouchwin                  Y       Y       Y
-    wtouchln                    Y       Y       Y
-    is_linetouched              Y       Y       Y
-    is_wintouched               Y       Y       Y
-    touchoverlap                -       -       Y
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   touchwin              |    Y   |    Y    |   Y
+   touchline             |    Y   |    Y    |   Y
+   untouchwin            |    Y   |    Y    |   Y
+   wtouchln              |    Y   |    Y    |   Y
+   is_linetouched        |    Y   |    Y    |   Y
+   is_wintouched         |    Y   |    Y    |   Y
+   touchoverlap          |    -   |    -    |   Y
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/libcurses/window.c b/scripts/kconfig/libcurses/window.c
index 4ae5b0861..891d0c05b 100644
--- a/scripts/kconfig/libcurses/window.c
+++ b/scripts/kconfig/libcurses/window.c
@@ -124,26 +124,28 @@ window
    NOT cancelled for those windows.
 
 ### Portability
-                             X/Open  ncurses  NetBSD
-    newwin                      Y       Y       Y
-    delwin                      Y       Y       Y
-    mvwin                       Y       Y       Y
-    subwin                      Y       Y       Y
-    derwin                      Y       Y       Y
-    mvderwin                    Y       Y       Y
-    dupwin                      Y       Y       Y
-    wgetparent                  -       Y       -
-    wsyncup                     Y       Y       Y
-    syncok                      Y       Y       Y
-    is_subwin                   -       Y       -
-    is_syncok                   -       Y       -
-    wcursyncup                  Y       Y       Y
-    wsyncdown                   Y       Y       Y
-    wresize                     -       Y       Y
-    resize_window               -       -       -
-    PDC_makelines               -       -       -
-    PDC_makenew                 -       -       -
-    PDC_sync                    -       -       -
+
+   Function              | X/Open | ncurses | NetBSD
+   :---------------------|:------:|:-------:|:------:
+   newwin                |    Y   |    Y    |   Y
+   delwin                |    Y   |    Y    |   Y
+   mvwin                 |    Y   |    Y    |   Y
+   subwin                |    Y   |    Y    |   Y
+   derwin                |    Y   |    Y    |   Y
+   mvderwin              |    Y   |    Y    |   Y
+   dupwin                |    Y   |    Y    |   Y
+   wgetparent            |    -   |    Y    |   -
+   wsyncup               |    Y   |    Y    |   Y
+   syncok                |    Y   |    Y    |   Y
+   is_subwin             |    -   |    Y    |   -
+   is_syncok             |    -   |    Y    |   -
+   wcursyncup            |    Y   |    Y    |   Y
+   wsyncdown             |    Y   |    Y    |   Y
+   wresize               |    -   |    Y    |   Y
+   resize_window         |    -   |    -    |   -
+   PDC_makelines         |    -   |    -    |   -
+   PDC_makenew           |    -   |    -    |   -
+   PDC_sync              |    -   |    -    |   -
 
 **man-end****************************************************************/
 
diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh
index a608d4c5e..885586865 100755
--- a/scripts/kconfig/lxdialog/check-lxdialog.sh
+++ b/scripts/kconfig/lxdialog/check-lxdialog.sh
@@ -53,7 +53,7 @@ trap "rm -f $tmp" 0 1 2 3 15
 check() {
         $cc -x c - -o $tmp 2>/dev/null <<'EOF'
 #include CURSES_LOC
-int main() {}
+int main() { return 0; }
 EOF
         if [ $? != 0 ]; then
             echo " *** Unable to find the ncurses libraries or the"       1>&2
diff --git a/scripts/mk_mingw64u_defconfig b/scripts/mk_mingw64u_defconfig
index 19124d735..5561a0900 100755
--- a/scripts/mk_mingw64u_defconfig
+++ b/scripts/mk_mingw64u_defconfig
@@ -32,6 +32,7 @@ set_build_opts \
     CONFIG_LAST_SUPPORTED_WCHAR=1114111 \
     CONFIG_UNICODE_COMBINING_WCHARS=y \
     CONFIG_UNICODE_WIDE_WCHARS=y \
+    CONFIG_FEATURE_USE_CNG_API=y \
     < "$configs"/mingw64_defconfig \
     > "$configs"/mingw64u_defconfig
 
diff --git a/selinux/sestatus.c b/selinux/sestatus.c
index 098a4d189..cf664cc18 100644
--- a/selinux/sestatus.c
+++ b/selinux/sestatus.c
@@ -131,13 +131,13 @@ static void display_verbose(void)
         puts("\nFile contexts:");
 
         cterm = xmalloc_ttyname(0);
-//FIXME: if cterm == NULL, we segfault!??
-        puts(cterm);
         if (cterm && lgetfilecon(cterm, &con) >= 0) {
                 printf(COL_FMT "%s\n", "Controlling term:", con);
                 if (ENABLE_FEATURE_CLEAN_UP)
                         freecon(con);
         }
+        if (ENABLE_FEATURE_CLEAN_UP)
+                free(cterm);
 
         for (i = 0; fc[i] != NULL; i++) {
                 struct stat stbuf;
diff --git a/shell/Config.src b/shell/Config.src
index 5efbf9995..5b3fe08f3 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -166,9 +166,10 @@ config FEATURE_SH_HISTFILESIZE
         default y
         depends on SHELL_ASH || SHELL_HUSH
         help
-        This option makes busybox shells to use $HISTFILESIZE variable
-        to set shell history size. Note that its max value is capped
-        by "History size" setting in library tuning section.
+        This option makes busybox shells to use $HISTSIZE and
+        $HISTFILESIZE variables to set shell history size.
+        Note that its max value is capped by "History size" setting
+        in library tuning section.
 
 config FEATURE_SH_EMBEDDED_SCRIPTS
         bool "Embed scripts in the binary"
diff --git a/shell/Kbuild.src b/shell/Kbuild.src
index a287fce4e..6bba4989f 100644
--- a/shell/Kbuild.src
+++ b/shell/Kbuild.src
@@ -9,4 +9,3 @@ lib-y:=
 INSERT
 
 lib-$(CONFIG_FEATURE_SH_MATH) += math.o
-lib-$(CONFIG_FEATURE_PRNG_SHELL) += random.o
diff --git a/shell/ash.c b/shell/ash.c
index 3919118f0..12c95c338 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -384,10 +384,16 @@ union node;
 struct strlist;
 struct job;
 
+#if defined(_WIN64)
+# define ALIGN64 ALIGNED(16)
+#else
+# define ALIGN64
+#endif
+
 struct forkshell {
         /* filled by forkshell_copy() */
-        struct globals_var *gvp;
         struct globals_misc *gmp;
+        struct globals_var *gvp;
         struct tblentry **cmdtable;
 #if ENABLE_ASH_ALIAS
         struct alias **atab;
@@ -401,7 +407,6 @@ struct forkshell {
         unsigned njobs;
         struct job *curjob;
 #endif
-        /* struct parsefile *g_parsefile; */
         HANDLE hMapFile;
         char *old_base;
         int size;
@@ -426,8 +431,8 @@ struct forkshell {
         int fd[3];
         union node *n;
         char **argv;
-        char *path;
-};
+        const char *path;
+} ALIGN64;
 
 enum {
         FS_OPENHERE,
@@ -461,7 +466,7 @@ static void forkshell_print(FILE *fp0, struct forkshell *fs, const char **notes)
 
 /* ============ Shell options */
 
-/* If you add/change options hare, update --help text too */
+/* If you add/change options here, update --help text too */
 static const char *const optletters_optnames[] ALIGN_PTR = {
         "e"   "errexit",
         "f"   "noglob",
@@ -534,6 +539,65 @@ static const char *const optletters_optnames[] ALIGN_PTR = {
 enum { NOPTS = ARRAY_SIZE(optletters_optnames) };
 
 
+/* ============ Parser data */
+
+struct strlist {
+        struct strlist *next;
+        char *text;
+};
+
+struct alias;
+
+struct strpush {
+        struct strpush *prev;   /* preceding string on stack */
+        char *prev_string;
+        int prev_left_in_line;
+#if ENABLE_ASH_ALIAS
+        struct alias *ap;       /* if push was associated with an alias */
+#endif
+        char *string;           /* remember the string since it may change */
+
+        /* Delay freeing so we can stop nested aliases. */
+        struct strpush *spfree;
+
+        /* Remember last two characters for pungetc. */
+        int lastc[2];
+
+        /* Number of outstanding calls to pungetc. */
+        int unget;
+};
+
+/*
+ * The parsefile structure pointed to by the global variable parsefile
+ * contains information about the current file being read.
+ */
+struct parsefile {
+        struct parsefile *prev; /* preceding file on stack */
+        int linno;              /* current line */
+        int pf_fd;              /* file descriptor (or -1 if string) */
+        int left_in_line;       /* number of chars left in this line */
+        int left_in_buffer;     /* number of chars left in this buffer past the line */
+        char *next_to_pgetc;    /* next char in buffer */
+        char *buf;              /* input buffer */
+        struct strpush *strpush; /* for pushing strings at this level */
+        struct strpush basestrpush; /* so pushing one is fast */
+
+        /* Delay freeing so we can stop nested aliases. */
+        struct strpush *spfree;
+
+        /* Remember last two characters for pungetc. */
+        int lastc[2];
+
+        /* Number of outstanding calls to pungetc. */
+        int unget;
+
+#if ENABLE_PLATFORM_MINGW32
+        /* True if a trailing CR from a previous read was left unprocessed. */
+        int cr;
+#endif
+};
+
+
 /* ============ Misc data */
 
 #define msg_illnum "Illegal number: %s"
@@ -558,6 +622,9 @@ struct globals_misc {
         smallint job_warning;   /* user was warned about stopped jobs (can be 2, 1 or 0). */
 #endif
         smallint inps4;         /* Prevent PS4 nesting. */
+#if !ENABLE_PLATFORM_MINGW32
+        smallint vforked;
+#endif
         int savestatus;         /* exit status of last command outside traps */
         int rootpid;            /* pid of main shell */
         /* shell level: 0 for the main shell, 1 for its children, and so on */
@@ -581,9 +648,6 @@ struct globals_misc {
         char *physdir; // = nullstr;    /* physical working directory */
 
         char *arg0; /* value of $0 */
-#if ENABLE_PLATFORM_MINGW32
-        char *commandname;
-#endif
 
         struct jmploc *exception_handler;
 
@@ -595,8 +659,10 @@ struct globals_misc {
          */
         volatile /*sig_atomic_t*/ smallint pending_int; /* 1 = got SIGINT */
 #if !ENABLE_PLATFORM_MINGW32
-        volatile /*sig_atomic_t*/ smallint got_sigchld; /* 1 = got SIGCHLD */
+        volatile /*sig_atomic_t*/ smallint gotsigchld;  /* 1 = got SIGCHLD */
         volatile /*sig_atomic_t*/ smallint pending_sig; /* last pending signal */
+#else
+        volatile /*sig_atomic_t*/ smallint waitcmd_int; /* SIGINT in wait */
 #endif
         smallint exception_type; /* kind of exception: */
 #define EXINT 0         /* SIGINT received */
@@ -669,8 +735,14 @@ struct globals_misc {
 
         char **trap_ptr;        /* used only by "trap hack" */
 
+        char *commandname;             /* currently executing command */
+        struct parsefile *g_parsefile; /* = &basepf, current input file */
+        struct parsefile basepf;       /* top level input file */
+
         /* Rarely referenced stuff */
 
+        struct jmploc main_handler;
+
         /* Cached supplementary group array (for testing executable'ity of files) */
         struct cached_groupinfo groupinfo;
 
@@ -685,6 +757,11 @@ extern struct globals_misc *BB_GLOBAL_CONST ash_ptr_to_globals_misc;
 #define back_exitstatus   (G_misc.back_exitstatus )
 #define job_warning       (G_misc.job_warning)
 #define inps4       (G_misc.inps4      )
+#if !ENABLE_PLATFORM_MINGW32
+#define vforked     (G_misc.vforked    )
+#else
+#define vforked     0
+#endif
 #define savestatus  (G_misc.savestatus )
 #define rootpid     (G_misc.rootpid    )
 #define shlvl       (G_misc.shlvl      )
@@ -701,14 +778,14 @@ extern struct globals_misc *BB_GLOBAL_CONST ash_ptr_to_globals_misc;
 #define curdir      (G_misc.curdir     )
 #define physdir     (G_misc.physdir    )
 #define arg0        (G_misc.arg0       )
-#if ENABLE_PLATFORM_MINGW32
-#define commandname (G_misc.commandname)
-#endif
 #define exception_handler (G_misc.exception_handler)
 #define exception_type    (G_misc.exception_type   )
 #define suppress_int      (G_misc.suppress_int     )
 #define pending_int       (G_misc.pending_int      )
-#define got_sigchld       (G_misc.got_sigchld      )
+#if ENABLE_PLATFORM_MINGW32
+#define waitcmd_int       (G_misc.waitcmd_int      )
+#endif
+#define gotsigchld        (G_misc.gotsigchld       )
 #define pending_sig       (G_misc.pending_sig      )
 #define nullstr     (G_misc.nullstr    )
 #define optlist     (G_misc.optlist    )
@@ -717,6 +794,10 @@ extern struct globals_misc *BB_GLOBAL_CONST ash_ptr_to_globals_misc;
 #define may_have_traps    (G_misc.may_have_traps   )
 #define trap        (G_misc.trap       )
 #define trap_ptr    (G_misc.trap_ptr   )
+#define commandname (G_misc.commandname)
+#define g_parsefile (G_misc.g_parsefile  )
+#define basepf      (G_misc.basepf     )
+#define main_handler      (G_misc.main_handler     )
 #define groupinfo   (G_misc.groupinfo  )
 #define random_gen  (G_misc.random_gen )
 #define backgndpid  (G_misc.backgndpid )
@@ -733,6 +814,7 @@ extern struct globals_misc *BB_GLOBAL_CONST ash_ptr_to_globals_misc;
         curdir = nullstr; \
         physdir = nullstr; \
         trap_ptr = trap; \
+        g_parsefile = &basepf; \
         groupinfo.euid = -1; \
         groupinfo.egid = -1; \
 } while (0)
@@ -780,73 +862,26 @@ var_end(const char *var)
         return var;
 }
 
-
-/* ============ Parser data */
-
-/*
- * ash_vmsg() needs parsefile->fd, hence parsefile definition is moved up.
- */
-struct strlist {
-        struct strlist *next;
-        char *text;
-};
-
-struct alias;
-
-struct strpush {
-        struct strpush *prev;   /* preceding string on stack */
-        char *prev_string;
-        int prev_left_in_line;
-#if ENABLE_ASH_ALIAS
-        struct alias *ap;       /* if push was associated with an alias */
-#endif
-        char *string;           /* remember the string since it may change */
-
-        /* Delay freeing so we can stop nested aliases. */
-        struct strpush *spfree;
-
-        /* Remember last two characters for pungetc. */
-        int lastc[2];
-
-        /* Number of outstanding calls to pungetc. */
-        int unget;
-};
-
-/*
- * The parsefile structure pointed to by the global variable parsefile
- * contains information about the current file being read.
+#if !ENABLE_PLATFORM_MINGW32
+/* Our signal logic never blocks individual signals
+ * using signal mask - only by setting SIG_IGN handler.
+ * Therefore just unmasking all of them instead of "restore old mask"
+ * approach is safe, modulo a case where the shell itself inherited
+ * a _masked_ signal.
  */
-struct parsefile {
-        struct parsefile *prev; /* preceding file on stack */
-        int linno;              /* current line */
-        int pf_fd;              /* file descriptor (or -1 if string) */
-        int left_in_line;       /* number of chars left in this line */
-        int left_in_buffer;     /* number of chars left in this buffer past the line */
-        char *next_to_pgetc;    /* next char in buffer */
-        char *buf;              /* input buffer */
-        struct strpush *strpush; /* for pushing strings at this level */
-        struct strpush basestrpush; /* so pushing one is fast */
-
-        /* Delay freeing so we can stop nested aliases. */
-        struct strpush *spfree;
-
-        /* Remember last two characters for pungetc. */
-        int lastc[2];
-
-        /* Number of outstanding calls to pungetc. */
-        int unget;
-
-#if ENABLE_PLATFORM_MINGW32
-        /* True if a trailing CR from a previous read was left unprocessed. */
-        int cr;
+static void
+sigclearmask(void)
+{
+        sigprocmask_allsigs(SIG_UNBLOCK);
+}
 #endif
-};
 
-static struct parsefile basepf;        /* top level input file */
-static struct parsefile *g_parsefile = &basepf;  /* current input file */
-#if ENABLE_PLATFORM_POSIX
-static char *commandname;              /* currently executing command */
-#endif
+/* Reset handler when entering a subshell */
+static void
+reset_exception_handler(void)
+{
+        exception_handler = &main_handler;
+}
 
 
 /* ============ Interrupts / exceptions */
@@ -860,13 +895,13 @@ static void exitshell(void) NORETURN;
  * more fun than worrying about efficiency and portability. :-))
  */
 #if DEBUG_INTONOFF
-# define INT_OFF do { \
-        TRACE(("%s:%d INT_OFF(%d)\n", __func__, __LINE__, suppress_int)); \
+# define INTOFF do { \
+        TRACE(("%s:%d INTOFF(%d)\n", __func__, __LINE__, suppress_int)); \
         suppress_int++; \
         barrier(); \
 } while (0)
 #else
-# define INT_OFF do { \
+# define INTOFF do { \
         suppress_int++; \
         barrier(); \
 } while (0)
@@ -885,7 +920,11 @@ raise_exception(int e)
         if (exception_handler == NULL)
                 abort();
 #endif
-        INT_OFF;
+
+        if (vforked)
+                _exit(exitstatus);
+
+        INTOFF;
         exception_type = e;
         longjmp(exception_handler->loc, 1);
 }
@@ -896,24 +935,25 @@ raise_exception(int e)
 } while (0)
 #endif
 
+#if ENABLE_PLATFORM_MINGW32
+static void
+write_ctrl_c(void)
+{
+        console_write("^C", 2);
+}
+#endif
+
 /*
  * Called when a SIGINT is received.  (If the user specifies
  * that SIGINT is to be trapped or ignored using the trap builtin, then
  * this routine is not called.)  suppress_int is nonzero when interrupts
- * are held using the INT_OFF macro.  (The test for iflag is just
+ * are held using the INTOFF macro.  (The test for iflag is just
  * defensive programming.)
  */
-static void raise_interrupt(void) IF_NOT_PLATFORM_MINGW32(NORETURN);
+static void raise_interrupt(void) NORETURN;
 static void
 raise_interrupt(void)
 {
-#if ENABLE_PLATFORM_MINGW32
-        /* Contrary to the comment above on Windows raise_interrupt() is
-         * called when SIGINT is trapped or ignored.  We detect this here
-         * and return without doing anything. */
-        if (trap[SIGINT])
-                return;
-#endif
         pending_int = 0;
 #if !ENABLE_PLATFORM_MINGW32
         /* Signal is not automatically unmasked after it is raised,
@@ -929,12 +969,13 @@ raise_interrupt(void)
                 raise(SIGINT);
 #else
                 fflush_all();
+                kill(-getpid(), SIGINT);
                 _exit(SIGINT << 24);
 #endif
         }
 #if ENABLE_PLATFORM_MINGW32
         if (iflag)
-                write(STDOUT_FILENO, "^C", 2);
+                write_ctrl_c();
 #endif
         /* bash: ^C even on empty command line sets $? */
         exitstatus = SIGINT + 128;
@@ -957,12 +998,12 @@ int_on(void)
         barrier();
 }
 #if DEBUG_INTONOFF
-# define INT_ON do { \
-        TRACE(("%s:%d INT_ON(%d)\n", __func__, __LINE__, suppress_int-1)); \
+# define INTON do { \
+        TRACE(("%s:%d INTON(%d)\n", __func__, __LINE__, suppress_int-1)); \
         int_on(); \
 } while (0)
 #else
-# define INT_ON int_on()
+# define INTON int_on()
 #endif
 static IF_NOT_ASH_OPTIMIZE_FOR_SIZE(inline) void
 force_int_on(void)
@@ -973,7 +1014,7 @@ force_int_on(void)
                 raise_interrupt(); /* does not return */
         barrier();
 }
-#define FORCE_INT_ON force_int_on()
+#define FORCEINTON force_int_on()
 
 #define SAVE_INT(v) ((v) = suppress_int)
 
@@ -991,27 +1032,27 @@ force_int_on(void)
 static void
 outstr(const char *p, FILE *file)
 {
-        INT_OFF;
+        INTOFF;
         fputs(p, file);
-        INT_ON;
+        INTON;
 }
 
 static void
 flush_stdout_stderr(void)
 {
-        INT_OFF;
+        INTOFF;
         fflush_all();
-        INT_ON;
+        INTON;
 }
 
 /* Was called outcslow(c,FILE*), but c was always '\n' */
 static void
 newline_and_flush(FILE *dest)
 {
-        INT_OFF;
+        INTOFF;
         putc('\n', dest);
         fflush(dest);
-        INT_ON;
+        INTON;
 }
 
 static int out1fmt(const char *, ...) __attribute__((__format__(__printf__,1,2)));
@@ -1021,11 +1062,11 @@ out1fmt(const char *fmt, ...)
         va_list ap;
         int r;
 
-        INT_OFF;
+        INTOFF;
         va_start(ap, fmt);
         r = vprintf(fmt, ap);
         va_end(ap);
-        INT_ON;
+        INTON;
         return r;
 }
 
@@ -1036,11 +1077,11 @@ fmtstr(char *outbuf, size_t length, const char *fmt, ...)
         va_list ap;
         int ret;
 
-        INT_OFF;
+        INTOFF;
         va_start(ap, fmt);
         ret = vsnprintf(outbuf, length, fmt, ap);
         va_end(ap);
-        INT_ON;
+        INTON;
         return ret > (int)length ? length : ret;
 }
 
@@ -1077,28 +1118,47 @@ out2str(const char *p)
 # define CTL_LAST CTLFROMPROC
 #endif
 
-/* variable substitution byte (follows CTLVAR) */
-#define VSTYPE  0x0f            /* type of variable substitution */
-#define VSNUL   0x10            /* colon--treat the empty string as unset */
-
-/* values of VSTYPE field */
-#define VSNORMAL        0x1     /* normal variable:  $var or ${var} */
-#define VSMINUS         0x2     /* ${var-text} */
-#define VSPLUS          0x3     /* ${var+text} */
-#define VSQUESTION      0x4     /* ${var?message} */
-#define VSASSIGN        0x5     /* ${var=text} */
+/* ${VAR[ops]} encoding is CTLVAR,<type_byte>,"VARNAME=",<ops_encoded(details?)>,CTLENDVAR */
+/* variable type byte (follows CTLVAR) */
+#define VSTYPE         0x0f     /* type of variable substitution */
+#define VSNUL          0x10     /* colon: the op is one of :- :+ :? := */
+/* values of VSTYPE field. The first 5 must be in this order, "}-+?=" string is used elsewhere to index into them */
+#define VSNORMAL        0x1     /* $var or ${var} */
+#define VSMINUS         0x2     /* ${var[:]-text} */
+#define VSPLUS          0x3     /* ${var[:]+text} */
+#define VSQUESTION      0x4     /* ${var[:]?message} */
+#define VSASSIGN        0x5     /* ${var[:]=text} */
 #define VSTRIMRIGHT     0x6     /* ${var%pattern} */
 #define VSTRIMRIGHTMAX  0x7     /* ${var%%pattern} */
 #define VSTRIMLEFT      0x8     /* ${var#pattern} */
 #define VSTRIMLEFTMAX   0x9     /* ${var##pattern} */
 #define VSLENGTH        0xa     /* ${#var} */
 #if BASH_SUBSTR
-#define VSSUBSTR        0xc     /* ${var:position:length} */
+#define VSSUBSTR        0xb     /* ${var:position:length} */
 #endif
 #if BASH_PATTERN_SUBST
-#define VSREPLACE       0xd     /* ${var/pattern/replacement} */
-#define VSREPLACEALL    0xe     /* ${var//pattern/replacement} */
+#define VSREPLACE       0xc     /* ${var/pattern/replacement} */
+#define VSREPLACEALL    0xd     /* ${var//pattern/replacement} */
+#endif
+static const char vstype_suffix[][3] ALIGN1 = {
+        [VSNORMAL       - VSNORMAL] = "}", // $var or ${var}
+        [VSMINUS        - VSNORMAL] = "-", // ${var-text}
+        [VSPLUS         - VSNORMAL] = "+", // ${var+text}
+        [VSQUESTION     - VSNORMAL] = "?", // ${var?message}
+        [VSASSIGN       - VSNORMAL] = "=", // ${var=text}
+        [VSTRIMRIGHT    - VSNORMAL] = "%", // ${var%pattern}
+        [VSTRIMRIGHTMAX - VSNORMAL] = "%%",// ${var%%pattern}
+        [VSTRIMLEFT     - VSNORMAL] = "#", // ${var#pattern}
+        [VSTRIMLEFTMAX  - VSNORMAL] = "##",// ${var##pattern}
+        [VSLENGTH       - VSNORMAL] = "",  // ${#var}
+#if BASH_SUBSTR
+        [VSSUBSTR       - VSNORMAL] = ":", // ${var:position:length}
 #endif
+#if BASH_PATTERN_SUBST
+        [VSREPLACE      - VSNORMAL] = "/", // ${var/pattern/replacement}
+        [VSREPLACEALL   - VSNORMAL] = "//",// ${var//pattern/replacement}
+#endif
+};
 
 static const char dolatstr[] ALIGN1 = {
         CTLQUOTEMARK, CTLVAR, VSNORMAL, '@', '=', CTLQUOTEMARK, '\0'
@@ -1127,14 +1187,15 @@ static const char dolatstr[] ALIGN1 = {
 #endif
 #define NCLOBBER 18
 #define NFROM    19
-#define NFROMTO  20
-#define NAPPEND  21
-#define NTOFD    22
-#define NFROMFD  23
-#define NHERE    24
-#define NXHERE   25
-#define NNOT     26
-#define N_NUMBER 27
+#define NFROMSTR 20
+#define NFROMTO  21
+#define NAPPEND  22
+#define NTOFD    23
+#define NFROMFD  24
+#define NHERE    25
+#define NXHERE   26
+#define NNOT     27
+#define N_NUMBER 28
 
 union node;
 
@@ -1472,7 +1533,9 @@ sharg(union node *arg, FILE *fp)
 
                         if (subtype & VSNUL)
                                 putc(':', fp);
-
+#if 1
+                        fputs(vstype_suffix[(subtype & VSTYPE) - VSNORMAL], fp);
+#else
                         switch (subtype & VSTYPE) {
                         case VSNORMAL:
                                 putc('}', fp);
@@ -1508,6 +1571,7 @@ sharg(union node *arg, FILE *fp)
                         default:
                                 out1fmt("<subtype %d>", subtype);
                         }
+#endif
                         break;
                 case CTLENDVAR:
                         putc('}', fp);
@@ -1562,6 +1626,7 @@ shcmd(union node *cmd, FILE *fp)
 #endif
                 case NTOFD:    s = ">&"; dftfd = 1; break;
                 case NFROM:    s = "<"; break;
+                case NFROMSTR: s = "<<<"; break;
                 case NFROMFD:  s = "<&"; break;
                 case NFROMTO:  s = "<>"; break;
                 default:       s = "*error*"; break;
@@ -1648,13 +1713,14 @@ showtree(union node *n)
 static void
 ash_vmsg(const char *msg, va_list ap)
 {
+//In dash, the order/format is different:
+// arg0: LINENO: [commandname:] MSG
+//If you fix it, change testsuite to match
         fprintf(stderr, "%s: ", arg0);
-        if (commandname) {
-                if (strcmp(arg0, commandname))
-                        fprintf(stderr, "%s: ", commandname);
-                if (!iflag || g_parsefile->pf_fd > 0)
-                        fprintf(stderr, "line %d: ", errlinno);
-        }
+        if (commandname && strcmp(arg0, commandname) != 0)
+                fprintf(stderr, "%s: ", commandname);
+        if (!iflag || g_parsefile->pf_fd > 0)
+                fprintf(stderr, "line %d: ", errlinno);
         vfprintf(stderr, msg, ap);
         newline_and_flush(stderr);
 }
@@ -1683,6 +1749,7 @@ ash_vmsg_and_raise(int cond, const char *msg, va_list ap)
         /* NOTREACHED */
 }
 
+/* This function is called sh_error() in dash */
 static void ash_msg_and_raise_error(const char *, ...) NORETURN;
 static void
 ash_msg_and_raise_error(const char *msg, ...)
@@ -1737,17 +1804,60 @@ ash_msg(const char *fmt, ...)
 }
 
 /*
+ * Types of operations (passed to the errmsg routine).
+ */
+#define E_OPEN 01       /* opening a file */
+#define E_CREAT 02      /* creating a file */
+#define E_EXEC 04       /* executing a program */
+/*
  * Return a string describing an error.  The returned string may be a
  * pointer to a static buffer that will be overwritten on the next call.
  * Action describes the operation that got the error.
  */
 static const char *
-errmsg(int e, const char *em)
+errmsg(int e, int action)
+{
+        if (e != ENOENT && e != ENOTDIR)
+                return strerror(e);
+
+        if (action & E_OPEN)
+                return "no such file";
+        else if (action & E_CREAT)
+                return "nonexistent directory";
+        else
+                return "not found";
+}
+
+static int sh_open_fail(const char *, int, int) NORETURN;
+static int sh_open_fail(const char *pathname, int flags, int e)
 {
-        if (e == ENOENT || e == ENOTDIR) {
-                return em;
+        const char *word;
+        int action;
+
+        word = "open";
+        action = E_OPEN;
+        if (flags & O_CREAT) {
+                word = "create";
+                action = E_CREAT;
         }
-        return strerror(e);
+
+        ash_msg_and_raise_error("can't %s %s: %s", word, pathname, errmsg(e, action));
+}
+
+static int sh_open(const char *pathname, int flags, int mayfail)
+{
+        int fd;
+        int e;
+
+        do {
+                fd = open(pathname, flags, 0666);
+                e = errno;
+        } while (fd < 0 && e == EINTR && !pending_sig);
+
+        if (mayfail || fd >= 0)
+                return fd;
+
+        sh_open_fail(pathname, flags, e);
 }
 
 
@@ -1821,7 +1931,6 @@ struct stackmark {
         size_t stacknleft;
 };
 
-
 struct globals_memstack {
         struct stack_block *g_stackp; // = &stackbase;
         char *g_stacknxt; // = stackbase.space;
@@ -1844,7 +1953,6 @@ extern struct globals_memstack *BB_GLOBAL_CONST ash_ptr_to_globals_memstack;
         sstrend = stackbase.space + MINSIZE; \
 } while (0)
 
-
 #define stackblock()     ((void *)g_stacknxt)
 #define stackblocksize() g_stacknleft
 
@@ -1874,14 +1982,14 @@ stalloc(size_t nbytes)
                 len = sizeof(struct stack_block) - MINSIZE + blocksize;
                 if (len < blocksize)
                         ash_msg_and_raise_error(bb_msg_memory_exhausted);
-                INT_OFF;
+                INTOFF;
                 sp = ckmalloc(len);
                 sp->prev = g_stackp;
                 g_stacknxt = sp->space;
                 g_stacknleft = blocksize;
                 sstrend = g_stacknxt + blocksize;
                 g_stackp = sp;
-                INT_ON;
+                INTON;
         }
         p = g_stacknxt;
         g_stacknxt += aligned;
@@ -1947,7 +2055,7 @@ popstackmark(struct stackmark *mark)
         if (!mark->stackp)
                 return;
 
-        INT_OFF;
+        INTOFF;
         while (g_stackp != mark->stackp) {
                 sp = g_stackp;
                 g_stackp = sp->prev;
@@ -1956,7 +2064,7 @@ popstackmark(struct stackmark *mark)
         g_stacknxt = mark->stacknxt;
         g_stacknleft = mark->stacknleft;
         sstrend = mark->stacknxt + mark->stacknleft;
-        INT_ON;
+        INTON;
 }
 
 /*
@@ -1985,7 +2093,7 @@ growstackblock(size_t min)
                 struct stack_block *prevstackp;
                 size_t grosslen;
 
-                INT_OFF;
+                INTOFF;
                 sp = g_stackp;
                 prevstackp = sp->prev;
                 grosslen = newlen + sizeof(struct stack_block) - MINSIZE;
@@ -1995,7 +2103,7 @@ growstackblock(size_t min)
                 g_stacknxt = sp->space;
                 g_stacknleft = newlen;
                 sstrend = sp->space + newlen;
-                INT_ON;
+                INTON;
         } else {
                 char *oldspace = g_stacknxt;
                 size_t oldlen = g_stacknleft;
@@ -2361,7 +2469,6 @@ struct localvar {
 # define VIMPORT        0x400   /* variable was imported from environment */
 #endif
 
-
 /* Need to be before varinit_data[] */
 #if ENABLE_LOCALE_SUPPORT
 static void FAST_FUNC
@@ -2856,7 +2963,7 @@ setvar(const char *name, const char *val, int flags)
                 vallen = strlen(val);
         }
 
-        INT_OFF;
+        INTOFF;
         nameeq = ckzalloc(namelen + vallen + 2);
         p = mempcpy(nameeq, name, namelen);
         if (val) {
@@ -2864,7 +2971,7 @@ setvar(const char *name, const char *val, int flags)
                 strcpy(p, val);
         }
         vp = setvareq(nameeq, flags | VNOSAVE);
-        INT_ON;
+        INTON;
 
         return vp;
 }
@@ -3419,7 +3526,7 @@ setpwd(const char *val, int setold)
         if (setold) {
                 setvar("OLDPWD", oldcur, VEXPORT);
         }
-        INT_OFF;
+        INTOFF;
         if (physdir != nullstr) {
                 if (physdir != oldcur)
                         free(physdir);
@@ -3436,7 +3543,7 @@ setpwd(const char *val, int setold)
                 free(oldcur);
         }
         curdir = dir;
-        INT_ON;
+        INTON;
         setvar("PWD", dir, VEXPORT);
 }
 
@@ -3454,7 +3561,7 @@ docd(const char *dest, int flags)
 
         TRACE(("docd(\"%s\", %d) called\n", dest, flags));
 
-        INT_OFF;
+        INTOFF;
         if (!(flags & CD_PHYSICAL)) {
                 dir = updatepwd(dest);
                 if (dir)
@@ -3466,7 +3573,7 @@ docd(const char *dest, int flags)
         setpwd(dir, 1);
         hashcd();
  out:
-        INT_ON;
+        INTON;
         return err;
 }
 
@@ -3581,7 +3688,6 @@ pwdcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 
 /* ============ ... */
 
-
 #define IBUFSIZ (ENABLE_FEATURE_EDITING ? CONFIG_FEATURE_EDITING_MAX_LEN : 1024)
 
 /* Syntax classes */
@@ -3988,13 +4094,11 @@ struct alias {
         int flag;
 };
 
-
 static struct alias **atab; // [ATABSIZE];
 #define INIT_G_alias() do { \
         atab = xzalloc(ATABSIZE * sizeof(atab[0])); \
 } while (0)
 
-
 static struct alias **
 __lookupalias(const char *name)
 {
@@ -4056,7 +4160,7 @@ setalias(const char *name, const char *val)
 
         app = __lookupalias(name);
         ap = *app;
-        INT_OFF;
+        INTOFF;
         if (ap) {
                 if (!(ap->flag & ALIASINUSE)) {
                         free(ap->val);
@@ -4072,7 +4176,7 @@ setalias(const char *name, const char *val)
                 /*ap->next = NULL;*/
                 *app = ap;
         }
-        INT_ON;
+        INTON;
 }
 
 static int
@@ -4083,9 +4187,9 @@ unalias(const char *name)
         app = __lookupalias(name);
 
         if (*app) {
-                INT_OFF;
+                INTOFF;
                 *app = freealias(*app);
-                INT_ON;
+                INTON;
                 return 0;
         }
 
@@ -4098,7 +4202,7 @@ rmaliases(void)
         struct alias *ap, **app;
         int i;
 
-        INT_OFF;
+        INTOFF;
         for (i = 0; i < ATABSIZE; i++) {
                 app = &atab[i];
                 for (ap = *app; ap; ap = *app) {
@@ -4108,7 +4212,7 @@ rmaliases(void)
                         }
                 }
         }
-        INT_ON;
+        INTON;
 }
 
 static void
@@ -4176,7 +4280,6 @@ unaliascmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 
 #endif /* ASH_ALIAS */
 
-
 /* Mode argument to forkshell.  Don't change FORK_FG or FORK_BG. */
 #define FORK_FG    0
 #define FORK_BG    1
@@ -4230,20 +4333,19 @@ struct job {
         struct job *prev_job;   /* previous job */
 };
 
-static struct job *makejob(/*union node *,*/ int);
 #if !ENABLE_PLATFORM_MINGW32
 static int forkshell(struct job *, union node *, int);
 #endif
 static int waitforjob(struct job *);
 
 #if !JOBS && !JOBS_WIN32
-enum { doing_jobctl = 0 };
+enum { jobctl = 0 };
 #define setjobctl(on) do {} while (0)
 #elif JOBS_WIN32
-static smallint doing_jobctl; //references:8
-#define setjobctl(on) do { if (rootshell) doing_jobctl = on; } while (0)
+static smallint jobctl; //references:8
+#define setjobctl(on) do { if (rootshell) jobctl = on; } while (0)
 #else /* JOBS */
-static smallint doing_jobctl; //references:8
+static smallint jobctl; //references:8
 static void setjobctl(int);
 #endif
 
@@ -4259,22 +4361,30 @@ ignoresig(int signo)
                 /* No, need to do it */
                 signal(signo, SIG_IGN);
         }
-        sigmode[signo - 1] = S_HARD_IGN;
+        if (!vforked)
+                sigmode[signo - 1] = S_HARD_IGN;
 }
 
 /*
  * Only one usage site - in setsignal()
+ * This function is called onsig() in dash
  */
 static void
 signal_handler(int signo)
 {
+        // parent momentarily has vforked == 1 too, but it masks
+        // all signals until after it resets vforked to 0.
+        if (vforked)
+                /* We are vfork child, DO NOT MODIFY ANY VARIABLES! */
+                return;
+
         if (signo == SIGCHLD) {
-                got_sigchld = 1;
+                gotsigchld = 1;
                 if (!trap[SIGCHLD])
                         return;
         }
 #if ENABLE_FEATURE_EDITING
-        bb_got_signal = signo; /* for read_line_input: "we got a signal" */
+        bb_got_signal = signo; /* for read_line_input / read builtin: "we got a signal" */
 #endif
         gotsig[signo - 1] = 1;
         pending_sig = signo;
@@ -4295,10 +4405,13 @@ signal_handler(int signo)
 static void
 setsignal(int signo)
 {
+        int lvforked;
         char *t;
         char cur_act, new_act;
         struct sigaction act;
 
+        lvforked = vforked;
+
         t = trap[signo];
         new_act = S_DFL;
         if (t != NULL) { /* trap for this sig is set */
@@ -4307,7 +4420,7 @@ setsignal(int signo)
                         new_act = S_IGN;
         }
 
-        if (rootshell && new_act == S_DFL) {
+        if (rootshell && new_act == S_DFL && !lvforked) {
                 switch (signo) {
                 case SIGINT:
                         if (iflag || minusc || sflag == 0)
@@ -4377,8 +4490,8 @@ setsignal(int signo)
         if (cur_act == S_HARD_IGN || cur_act == new_act)
                 return;
 
-        *t = new_act;
-
+        if (!lvforked)
+                *t = new_act;
         act.sa_handler = SIG_DFL;
         switch (new_act) {
         case S_CATCH:
@@ -4641,7 +4754,7 @@ freejob(struct job *jp)
         int i;
 #endif
 
-        INT_OFF;
+        INTOFF;
 #if ENABLE_PLATFORM_POSIX || JOBS_WIN32
         for (i = jp->nprocs, ps = jp->ps; --i >= 0; ps++) {
                 if (ps->ps_cmd != nullstr)
@@ -4652,14 +4765,29 @@ freejob(struct job *jp)
                 free(jp->ps);
         jp->used = 0;
         set_curjob(jp, CUR_DELETE);
-        INT_ON;
+        INTON;
 }
 
 #if JOBS
 static void
 xtcsetpgrp(int fd, pid_t pgrp)
 {
-        if (tcsetpgrp(fd, pgrp))
+        int err;
+
+        sigblockall(NULL);
+        err = tcsetpgrp(fd, pgrp);
+        sigclearmask();
+        // Unmasking signals would cause any arrived signal to trigger, so why?
+        // Generally yes, but there are exceptions. Such as:
+        // """
+        // Attempts to use tcsetpgrp() from a process which is a member of
+        // a background process group on a fd associated with its controlling
+        // terminal shall cause the process group to be sent a SIGTTOU signal.
+        // If the calling thread is blocking SIGTTOU signals or the process
+        // is ignoring SIGTTOU signals, the process shall be allowed
+        // to perform the operation, and no signal is sent."""
+
+        if (err)
                 ash_msg_and_raise_perror("can't set tty process group");
 }
 
@@ -4678,11 +4806,11 @@ setjobctl(int on)
         int fd;
         int pgrp;
 
-        if (on == doing_jobctl || rootshell == 0)
+        if (on == jobctl || rootshell == 0)
                 return;
         if (on) {
                 int ofd;
-                ofd = fd = open(_PATH_TTY, O_RDWR);
+                ofd = fd = sh_open(_PATH_TTY, O_RDWR, 1);
                 if (fd < 0) {
         /* BTW, bash will try to open(ttyname(0)) if open("/dev/tty") fails.
          * That sometimes helps to acquire controlling tty.
@@ -4738,7 +4866,7 @@ setjobctl(int on)
                 fd = -1;
         }
         ttyfd = fd;
-        doing_jobctl = on;
+        jobctl = on;
 }
 #endif
 
@@ -4827,7 +4955,7 @@ restartjob(struct job *jp, int mode)
         int status;
         pid_t pgid;
 
-        INT_OFF;
+        INTOFF;
         if (jp->state == JOBDONE)
                 goto out;
         jp->state = JOBRUNNING;
@@ -4847,7 +4975,7 @@ restartjob(struct job *jp, int mode)
         } while (--i);
  out:
         status = (mode == FORK_FG) ? waitforjob(jp) : 0;
-        INT_ON;
+        INTON;
         return status;
 }
 
@@ -4916,9 +5044,12 @@ static BOOL WINAPI ctrl_handler(DWORD dwCtrlType)
 # if ENABLE_FEATURE_EDITING
                 bb_got_signal = SIGINT; /* for read_line_input: "we got a signal" */
 # endif
-                if (!suppress_int && !(rootshell && iflag))
-                        raise_interrupt();
-                pending_int = 1;
+                waitcmd_int = -waitcmd_int;
+                if (!trap[SIGINT]) {
+                        if (!suppress_int && !(rootshell && iflag))
+                                raise_interrupt();
+                        pending_int = 1;
+                }
                 return TRUE;
         }
         return FALSE;
@@ -4929,7 +5060,7 @@ static BOOL WINAPI ctrl_handler(DWORD dwCtrlType)
  * They don't support waitpid(-1)
  */
 static pid_t
-waitpid_child(int *status, int wait_flags)
+waitpid_child(int *status, DWORD blocking)
 {
         struct job *jb;
         int pid_nr = 0;
@@ -4955,24 +5086,26 @@ waitpid_child(int *status, int wait_flags)
         }
 
         if (pid_nr) {
-                idx = WaitForMultipleObjects(pid_nr, proclist, FALSE,
-                                        wait_flags & WNOHANG ? 0 : INFINITE);
-                if (idx < pid_nr) {
-                        GetExitCodeProcess(proclist[idx], &win_status);
-                        *status = exit_code_to_wait_status(win_status);
-                        pid = GetProcessId(proclist[idx]);
-                }
+                do {
+                        idx = WaitForMultipleObjects(pid_nr, proclist, FALSE, blocking);
+                        if (idx < pid_nr) {
+                                GetExitCodeProcess(proclist[idx], &win_status);
+                                *status = exit_code_to_wait_status(win_status);
+                                pid = GetProcessId(proclist[idx]);
+                                break;
+                        }
+                } while (blocking && !pending_int && waitcmd_int != 1);
         }
         return pid;
 }
-#define waitpid(p, s, f) waitpid_child(s, f)
 #endif
 
-#define DOWAIT_NONBLOCK 0
-#define DOWAIT_BLOCK    1
-#define DOWAIT_BLOCK_OR_SIG 2
+/* Inside dowait(): */
+#define DOWAIT_NONBLOCK 0       /* waitpid() will use WNOHANG and won't wait for signals */
+#define DOWAIT_BLOCK    1       /* waitpid() will NOT use WNOHANG */
+#define DOWAIT_CHILD_OR_SIG 2   /* waitpid() will use WNOHANG and if got 0, will wait for signals, then loop back */
 #if BASH_WAIT_N
-# define DOWAIT_JOBSTATUS 0x10   /* OR this to get job's exitstatus instead of pid */
+# define DOWAIT_JOBSTATUS 0x10  /* OR this to get job's exitstatus instead of pid */
 #endif
 
 static int
@@ -4984,40 +5117,48 @@ waitproc(int block, int *status)
         int err;
 
 #if JOBS
-        if (doing_jobctl)
+        if (jobctl)
                 flags |= WUNTRACED;
 #endif
 
         do {
-                got_sigchld = 0;
+                gotsigchld = 0;
                 do
                         err = waitpid(-1, status, flags);
                 while (err < 0 && errno == EINTR);
 
+                /* Return if error (for example, ECHILD); or if pid found;
+                 * or if "block" is DOWAIT_NONBLOCK (=0), in this case return -1.
+                 */
                 if (err || (err = -!block))
                         break;
 
-                sigfillset(&oldmask);
-                sigprocmask2(SIG_SETMASK, &oldmask); /* mask is updated */
-                while (!got_sigchld && !pending_sig)
-                        sigsuspend(&oldmask);
-                sigprocmask(SIG_SETMASK, &oldmask, NULL);
+                /* "block" is DOWAIT_CHILD_OR_SIG. All children are running
+                 * (waitpid(WNOHAG) above returned 0), wait for signals:
+                 */
+
                 //simpler, but unsafe: a signal can set pending_sig after check, but before pause():
-                //while (!got_sigchld && !pending_sig)
+                //while (!gotsigchld && !pending_sig)
                 //      pause();
 
-        } while (got_sigchld);
+                sigblockall(&oldmask);
+
+                while (!gotsigchld && !pending_sig)
+                        sigsuspend(&oldmask);
+
+                sigclearmask();
+        } while (gotsigchld);
+        /* If we fall off the loop, err is 0, which means we got a !SIGCHLD signal */
 
         return err;
 #else
-        int flags = block == DOWAIT_BLOCK ? 0 : WNOHANG;
+        // Only DOWAIT_NONBLOCK is non-blocking, other values block.
         *status = 0;
-        return waitpid(-1, status, flags);
+        return waitpid_child(status, block != DOWAIT_NONBLOCK);
 #endif
 }
 
-static int
-waitone(int block, struct job *job)
+static int waitone(int block, struct job *job)
 {
         int pid;
         int status;
@@ -5030,25 +5171,25 @@ waitone(int block, struct job *job)
 
         TRACE(("dowait(0x%x) called\n", block));
 
-        /* It's wrong to call waitpid() outside of INT_OFF region:
+        /* It's wrong to call waitpid() outside of INTOFF region:
          * signal can arrive just after syscall return and handler can
          * longjmp away, losing stop/exit notification processing.
          * Thus, for "jobs" builtin, and for waiting for a fg job,
-         * we call waitpid() (blocking or non-blocking) inside INT_OFF.
+         * we call waitpid() (blocking or non-blocking) inside INTOFF.
          *
          * However, for "wait" builtin it is wrong to simply call waitpid()
-         * in INT_OFF region: "wait" needs to wait for any running job
+         * in INTOFF region: "wait" needs to wait for any running job
          * to change state, but should exit on any trap too.
-         * In INT_OFF region, a signal just before syscall entry can set
+         * In INTOFF region, a signal just before syscall entry can set
          * pending_sig variables, but we can't check them, and we would
          * either enter a sleeping waitpid() (BUG), or need to busy-loop.
          *
-         * Because of this, we run inside INT_OFF, but use a special routine
+         * Because of this, we run inside INTOFF, but use a special routine
          * which combines waitpid() and sigsuspend().
          * This is the reason why we need to have a handler for SIGCHLD:
          * SIG_DFL handler does not wake sigsuspend().
          */
-        INT_OFF;
+        INTOFF;
         pid = waitproc(block, &status);
         TRACE(("wait returns pid %d, status=%d\n", pid, status));
         if (pid <= 0)
@@ -5056,36 +5197,34 @@ waitone(int block, struct job *job)
 
         for (jp = curjob; jp; jp = jp->prev_job) {
                 int jobstate;
-                struct procstat *ps;
-                struct procstat *psend;
+                struct procstat *sp;
+                struct procstat *spend;
                 if (jp->state == JOBDONE)
                         continue;
                 jobstate = JOBDONE;
-                ps = jp->ps;
-                psend = ps + jp->nprocs;
+                spend = jp->ps + jp->nprocs;
+                sp = jp->ps;
                 do {
-                        if (ps->ps_pid == pid) {
-                                TRACE(("Job %d: changing status of proc %d "
-                                        "from 0x%x to 0x%x\n",
-                                        jobno(jp), pid, ps->ps_status, status));
-                                ps->ps_status = status;
+                        if (sp->ps_pid == pid) {
+                                TRACE(("Job %d: changing status of proc %d from 0x%x to 0x%x\n", jobno(jp), pid, sp->ps_status, status));
+                                sp->ps_status = status;
                                 thisjob = jp;
 #if ENABLE_PLATFORM_MINGW32
-                                CloseHandle(ps->ps_proc);
-                                ps->ps_proc = NULL;
+                                CloseHandle(sp->ps_proc);
+                                sp->ps_proc = NULL;
 #endif
                         }
-                        if (ps->ps_status == -1)
+                        if (sp->ps_status == -1)
                                 jobstate = JOBRUNNING;
 #if JOBS
                         if (jobstate == JOBRUNNING)
                                 continue;
-                        if (WIFSTOPPED(ps->ps_status)) {
-                                jp->stopstatus = ps->ps_status;
+                        if (WIFSTOPPED(sp->ps_status)) {
+                                jp->stopstatus = sp->ps_status;
                                 jobstate = JOBSTOPPED;
                         }
 #endif
-                } while (++ps < psend);
+                } while (++sp < spend);
                 if (!thisjob)
                         continue;
 
@@ -5097,8 +5236,7 @@ waitone(int block, struct job *job)
                          */
                         thisjob->changed = 1;
                         if (thisjob->state != jobstate) {
-                                TRACE(("Job %d: changing state from %d to %d\n",
-                                        jobno(thisjob), thisjob->state, jobstate));
+                                TRACE(("Job %d: changing state from %d to %d\n", jobno(thisjob), thisjob->state, jobstate));
                                 thisjob->state = jobstate;
 #if JOBS
                                 if (jobstate == JOBSTOPPED)
@@ -5110,7 +5248,7 @@ waitone(int block, struct job *job)
         }
         /* The process wasn't found in job list */
  out:
-        INT_ON;
+        INTON;
 
 #if BASH_WAIT_N
         if (want_jobexitstatus) {
@@ -5133,11 +5271,10 @@ waitone(int block, struct job *job)
         return pid;
 }
 
-static int
-dowait(int block, struct job *jp)
+static int dowait(int block, struct job *jp)
 {
 #if !ENABLE_PLATFORM_MINGW32
-        smallint gotchld = *(volatile smallint *)&got_sigchld;
+        smallint gotchld = *(volatile smallint *)&gotsigchld;
         int rpid;
         int pid;
 
@@ -5161,7 +5298,7 @@ dowait(int block, struct job *jp)
 #else
         int pid = 1;
 
-        while (jp ? jp->state == JOBRUNNING : pid > 0)
+        while ((jp ? jp->state == JOBRUNNING : pid > 0) && waitcmd_int != 1)
                 pid = waitone(block, jp);
 
         return pid;
@@ -5374,17 +5511,28 @@ waitcmd(int argc UNUSED_PARAM, char **argv)
          * with an exit status greater than 128, immediately after which
          * the trap is executed."
          */
+#if ENABLE_PLATFORM_MINGW32
+                        waitcmd_int = -1;
+#endif
 #if BASH_WAIT_N
-                        status = dowait(DOWAIT_BLOCK_OR_SIG | DOWAIT_JOBSTATUS, NULL);
+                        status = dowait(DOWAIT_CHILD_OR_SIG | DOWAIT_JOBSTATUS, NULL);
 #else
-                        dowait(DOWAIT_BLOCK_OR_SIG, NULL);
+                        dowait(DOWAIT_CHILD_OR_SIG, NULL);
 #endif
                         /* if child sends us a signal *and immediately exits*,
                          * dowait() returns pid > 0. Check this case,
                          * not "if (dowait() < 0)"!
                          */
+#if ENABLE_PLATFORM_MINGW32
+                        if (waitcmd_int == 1) {
+                                write_ctrl_c();
+                                return 128 | SIGINT;
+                        }
+                        waitcmd_int = 0;
+#else
                         if (pending_sig)
                                 goto sigout;
+#endif
 #if BASH_WAIT_N
                         if (one) {
                                 /* wait -n waits for one _job_, not one _process_.
@@ -5418,7 +5566,7 @@ waitcmd(int argc UNUSED_PARAM, char **argv)
                         job = getjob(*argv, 0);
                 }
                 /* loop until process terminated or stopped */
-                dowait(DOWAIT_BLOCK_OR_SIG, job);
+                dowait(DOWAIT_CHILD_OR_SIG, job);
                 if (pending_sig)
                         goto sigout;
                 job->waited = 1;
@@ -5481,7 +5629,7 @@ growjobtab(void)
  * Called with interrupts off.
  */
 static struct job *
-makejob(/*union node *node,*/ int nprocs)
+makejob(int nprocs)
 {
         int i;
         struct job *jp;
@@ -5496,7 +5644,7 @@ makejob(/*union node *node,*/ int nprocs)
                 if (jp->state != JOBDONE || !jp->waited)
                         continue;
 #if JOBS || JOBS_WIN32
-                if (doing_jobctl)
+                if (jobctl)
                         continue;
 #endif
                 freejob(jp);
@@ -5505,8 +5653,8 @@ makejob(/*union node *node,*/ int nprocs)
         memset(jp, 0, sizeof(*jp));
 #if JOBS
         /* jp->jobctl is a bitfield.
-         * "jp->jobctl |= doing_jobctl" likely to give awful code */
-        if (doing_jobctl)
+         * "jp->jobctl |= jobctl" likely to give awful code */
+        if (jobctl)
                 jp->jobctl = 1;
 #endif
         jp->prev_job = curjob;
@@ -5531,13 +5679,6 @@ static char *cmdnextc;
 static void
 cmdputs(const char *s)
 {
-        static const char vstype[VSTYPE + 1][3] ALIGN1 = {
-                "", "}", "-", "+", "?", "=",
-                "%", "%%", "#", "##"
-                IF_BASH_SUBSTR(, ":")
-                IF_BASH_PATTERN_SUBST(, "/", "//")
-        };
-
         const char *p, *str;
         char cc[2];
         char *nextc;
@@ -5600,32 +5741,34 @@ cmdputs(const char *s)
                 case '=':
                         if (subtype == 0)
                                 break;
+                        /* We are in variable name */
                         if ((subtype & VSTYPE) != VSNORMAL)
                                 quoted <<= 1;
-                        str = vstype[subtype & VSTYPE];
-                        if (subtype & VSNUL)
-                                c = ':';
-                        else
-                                goto checkstr;
+                        str = vstype_suffix[(subtype & VSTYPE) - VSNORMAL];
+                        if (!(subtype & VSNUL))
+                                goto dostr;
+                        c = ':';
                         break;
-                case '\'':
+                case '$':
+                        /* Can happen inside quotes, or in variable name $$ */
+                        if (subtype != 0)
+                                // Testcase:
+                                // $ true $$ &
+                                // $ <cr>
+                                // [1]+ Done  true ${$} // shows ${\$} without "if (subtype)" check
+                                break;
+                        /* Not in variable name - show as \$ */
+                case '\'': /* These can only happen inside quotes */
                 case '\\':
                 case '"':
-                case '$':
-                        /* These can only happen inside quotes */
                         cc[0] = c;
                         str = cc;
-//FIXME:
-// $ true $$ &
-// $ <cr>
-// [1]+  Done    true ${\$}   <<=== BUG: ${\$} is not a valid way to write $$ (${$} would be ok)
                         c = '\\';
                         break;
                 default:
                         break;
                 }
                 USTPUTC(c, nextc);
- checkstr:
                 if (!str)
                         continue;
  dostr:
@@ -5637,7 +5780,7 @@ cmdputs(const char *s)
         if (quoted & 1) {
                 USTPUTC('"', nextc);
         }
-        *nextc = 0;
+        *nextc = '\0';
         cmdnextc = nextc;
 }
 
@@ -5761,6 +5904,9 @@ cmdtxt(union node *n)
         case NXHERE:
                 p = "<<...";
                 goto dotail2;
+        case NFROMSTR:
+                p = "<<<";
+                goto dotail2;
         case NCASE:
                 cmdputs("case ");
                 cmdputs(n->ncase.expr->narg.text);
@@ -5848,7 +5994,7 @@ clear_traps(void)
 {
         char **tp;
 
-        INT_OFF;
+        INTOFF;
         for (tp = trap; tp <= &trap[NTRAP_LAST]; tp++) {
                 if (*tp && **tp) {      /* trap not NULL or "" (SIG_IGN) */
                         if (trap_ptr == trap)
@@ -5860,7 +6006,7 @@ clear_traps(void)
                 }
         }
         may_have_traps = 0;
-        INT_ON;
+        INTON;
 }
 
 #if !ENABLE_PLATFORM_MINGW32
@@ -5872,18 +6018,28 @@ static void closescript(void);
 static NOINLINE void
 forkchild(struct job *jp, union node *n, int mode)
 {
+        int lvforked;
         int oldlvl;
 
         TRACE(("Child shell %d\n", getpid()));
         oldlvl = shlvl;
-        shlvl++;
+        lvforked = vforked;
+
+        if (!lvforked) {
+                shlvl++;
+
+                closescript();
+
+#if JOBS
+                /* do job control only in root shell */
+                jobctl = 0;
+#endif
+        }
 
         /* man bash: "Non-builtin commands run by bash have signal handlers
          * set to the values inherited by the shell from its parent".
          * Do we do it correctly? */
 
-        closescript();
-
         if (n && n->type == NCMD        /* is it single cmd? */
         /* && n->ncmd.args->type == NARG - always true? */
          && n->ncmd.args && strcmp(n->ncmd.args->narg.text, "trap") == 0
@@ -5929,10 +6085,9 @@ forkchild(struct job *jp, union node *n, int mode)
                 trap_ptr = xmemdup(trap, sizeof(trap));
                 /* Fall through into clearing traps */
         }
-        clear_traps();
+        if (!lvforked)
+                clear_traps();
 #if JOBS
-        /* do job control only in root shell */
-        doing_jobctl = 0;
         if (mode != FORK_NOJOB && jp->jobctl && oldlvl == 0) {
                 pid_t pgrp;
 
@@ -5955,8 +6110,7 @@ forkchild(struct job *jp, union node *n, int mode)
                 ignoresig(SIGQUIT);
                 if (jp->nprocs == 0) {
                         close(0);
-                        if (open(bb_dev_null, O_RDONLY) != 0)
-                                ash_msg_and_raise_perror("can't open '%s'", bb_dev_null);
+                        sh_open(_PATH_DEVNULL, O_RDONLY, 0);
                 }
         }
         if (oldlvl == 0) {
@@ -5987,6 +6141,10 @@ forkchild(struct job *jp, union node *n, int mode)
                 return;
         }
 #endif
+
+        if (lvforked)
+                return;
+
         for (jp = curjob; jp; jp = jp->prev_job)
                 freejob(jp);
 }
@@ -6005,8 +6163,17 @@ forkparent(struct job *jp, union node *n, int mode, HANDLE proc)
 {
 #if ENABLE_PLATFORM_MINGW32
         pid_t pid = GetProcessId(proc);
+#else
+        if (pid < 0) {
+                TRACE(("Fork failed, errno=%d", errno));
+                if (jp)
+                        freejob(jp);
+                ash_msg_and_raise_perror("can't fork");
+                /* NOTREACHED */
+        }
 #endif
-        TRACE(("In parent shell: child = %d\n", pid));
+
+        TRACE(("In parent shell:  child = %d\n", pid));
         if (!jp) /* jp is NULL when called by openhere() for heredoc support */
                 return;
 #if JOBS
@@ -6040,7 +6207,7 @@ forkparent(struct job *jp, union node *n, int mode, HANDLE proc)
                 ps->ps_proc = proc;
 #endif
 #if JOBS || JOBS_WIN32
-                if (doing_jobctl && n)
+                if (jobctl && n)
                         ps->ps_cmd = commandtext(n);
 #endif
         }
@@ -6055,20 +6222,43 @@ forkshell(struct job *jp, union node *n, int mode)
 
         TRACE(("forkshell(%%%d, %p, %d) called\n", jobno(jp), n, mode));
         pid = fork();
-        if (pid < 0) {
-                TRACE(("Fork failed, errno=%d", errno));
-                if (jp)
-                        freejob(jp);
-                ash_msg_and_raise_perror("can't fork");
-        }
         if (pid == 0) {
                 CLEAR_RANDOM_T(&random_gen); /* or else $RANDOM repeats in child */
                 forkchild(jp, n, mode);
-        } else {
+        } else
                 forkparent(jp, n, mode, pid);
-        }
+
         return pid;
 }
+
+static void shellexec(char *prog, char **argv, const char *path, int idx) NORETURN;
+
+static struct job*
+vforkexec(union node *n, char **argv, const char *path, int idx)
+{
+        struct job *jp;
+        int pid;
+
+        jp = makejob(1);
+
+        sigblockall(NULL);
+        vforked = 1;
+
+        pid = vfork();
+
+        if (!pid) {
+                forkchild(jp, n, FORK_FG);
+                sigclearmask();
+                shellexec(argv[0], argv, path, idx);
+                /* NOTREACHED */
+        }
+
+        vforked = 0;
+        sigclearmask();
+        forkparent(jp, n, FORK_FG, pid);
+
+        return jp;
+}
 #endif
 
 /*
@@ -6193,7 +6383,6 @@ stoppedjobs(void)
 }
 #endif
 
-
 /*
  * Code for dealing with input/output redirection.
  */
@@ -6208,26 +6397,11 @@ stoppedjobs(void)
  * data to a pipe.  If the document is short, we can stuff the data in
  * the pipe without forking.
  */
-/* openhere needs this forward reference */
-static void expandhere(union node *arg);
 static int
-openhere(union node *redir)
+write2pipe(int pip[2], const char *p, size_t len)
 {
-        char *p;
-        int pip[2];
-        size_t len = 0;
         IF_PLATFORM_MINGW32(struct forkshell fs);
 
-        if (pipe(pip) < 0)
-                ash_msg_and_raise_perror("can't create pipe");
-
-        p = redir->nhere.doc->narg.text;
-        if (redir->type == NXHERE) {
-                expandhere(redir->nhere.doc);
-                p = stackblock();
-        }
-
-        len = strlen(p);
         if (len <= PIPE_BUF) {
                 xwrite(pip[1], p, len);
                 goto out;
@@ -6258,89 +6432,113 @@ openhere(union node *redir)
         return pip[0];
 }
 
+/* openhere needs this forward reference */
+static void expandhere(union node *arg);
+static int
+openhere(union node *redir)
+{
+        char *p;
+        int pip[2];
+
+        if (pipe(pip) < 0)
+                ash_msg_and_raise_perror("can't create pipe");
+
+        p = redir->nhere.doc->narg.text;
+        if (redir->type == NXHERE) {
+                expandhere(redir->nhere.doc);
+                p = stackblock();
+        }
+
+        return write2pipe(pip, p, strlen(p));
+}
+
+static int
+openherestr(char *str)
+{
+        int pip[2];
+        size_t len;
+
+        if (pipe(pip) < 0)
+                ash_msg_and_raise_perror("can't create pipe");
+
+        len = strlen(str);
+        str[len] = '\n';
+        write2pipe(pip, str, len + 1);
+        str[len] = '\0';
+        return pip[0];
+}
+
 static int
 openredirect(union node *redir)
 {
         struct stat sb;
         char *fname;
+        int flags;
         int f;
 
         switch (redir->nfile.type) {
-/* Can't happen, our single caller does this itself */
-//      case NTOFD:
-//      case NFROMFD:
-//              return -1;
-        case NHERE:
-        case NXHERE:
-                return openhere(redir);
-        }
-
-        /* For N[X]HERE, reading redir->nfile.expfname would touch beyond
-         * allocated space. Do it only when we know it is safe.
-         */
-        fname = redir->nfile.expfname;
-
-        switch (redir->nfile.type) {
-        default:
-#if DEBUG
-                abort();
-#endif
         case NFROM:
-                f = open(fname, O_RDONLY);
-                if (f < 0)
-                        goto eopen;
+                flags = O_RDONLY;
+ do_open:
+                f = sh_open(redir->nfile.expfname, flags, 0);
+#if ENABLE_PLATFORM_MINGW32
+                if (redir->nfile.type == NAPPEND)
+                        lseek(f, 0, SEEK_END);
+#endif
                 break;
-        case NFROMTO:
-                f = open(fname, O_RDWR|O_CREAT, 0666);
-                if (f < 0)
-                        goto ecreate;
+        case NFROMSTR:
+                f = openherestr(redir->nfile.expfname);
                 break;
+        case NFROMTO:
+                flags = O_RDWR|O_CREAT;
+                goto do_open;
         case NTO:
 #if BASH_REDIR_OUTPUT
         case NTO2:
 #endif
                 /* Take care of noclobber mode. */
                 if (Cflag) {
+                        fname = redir->nfile.expfname;
                         if (stat(fname, &sb) < 0) {
-                                f = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0666);
-                                if (f < 0)
-                                        goto ecreate;
-                        } else if (!S_ISREG(sb.st_mode)) {
-                                f = open(fname, O_WRONLY, 0666);
-                                if (f < 0)
-                                        goto ecreate;
-                                if (!fstat(f, &sb) && S_ISREG(sb.st_mode)) {
-                                        close(f);
-                                        errno = EEXIST;
-                                        goto ecreate;
-                                }
-                        } else {
-                                errno = EEXIST;
+                                flags = O_WRONLY|O_CREAT|O_EXCL;
+                                goto do_open;
+                        }
+
+                        if (S_ISREG(sb.st_mode))
+                                goto ecreate;
+
+                        f = sh_open(fname, O_WRONLY, 0);
+                        if (!fstat(f, &sb) && S_ISREG(sb.st_mode)) {
+                                close(f);
                                 goto ecreate;
                         }
                         break;
                 }
                 /* FALLTHROUGH */
         case NCLOBBER:
-                f = open(fname, O_WRONLY|O_CREAT|O_TRUNC, 0666);
-                if (f < 0)
-                        goto ecreate;
-                break;
+                flags = O_WRONLY|O_CREAT|O_TRUNC;
+                goto do_open;
         case NAPPEND:
-                f = open(fname, O_WRONLY|O_CREAT|O_APPEND, 0666);
-                if (f < 0)
-                        goto ecreate;
-#if ENABLE_PLATFORM_MINGW32
-                lseek(f, 0, SEEK_END);
+                flags = O_WRONLY|O_CREAT|O_APPEND;
+                goto do_open;
+/* Can't happen, our single caller does this itself */
+//      case NTOFD:
+//      case NFROMFD:
+//              return -1;
+        default:
+#ifdef DEBUG
+                abort();
 #endif
+                /* Fall through to eliminate warning. */
+        case NHERE:
+        case NXHERE:
+                f = openhere(redir);
                 break;
         }
 
         return f;
  ecreate:
-        ash_msg_and_raise_error("can't create %s: %s", fname, errmsg(errno, "nonexistent directory"));
- eopen:
-        ash_msg_and_raise_error("can't open %s: %s", fname, errmsg(errno, "no such file"));
+        sh_open_fail(fname, O_CREAT, EEXIST);
 }
 
 /*
@@ -6593,7 +6791,7 @@ redirect(union node *redir, int flags)
                 return;
 
         sv = NULL;
-        INT_OFF;
+        INTOFF;
         if (flags & REDIR_PUSH)
                 sv = redirlist;
         do {
@@ -6658,7 +6856,7 @@ redirect(union node *redir, int flags)
 #endif
                 }
         } while ((redir = redir->nfile.next) != NULL);
-        INT_ON;
+        INTON;
 
 //dash:#define REDIR_SAVEFD2 03        /* set preverrout */
 #define REDIR_SAVEFD2 0
@@ -6746,7 +6944,7 @@ popredir(int drop)
 
         if (redirlist == NULL)
                 return;
-        INT_OFF;
+        INTOFF;
         rp = redirlist;
         for (i = 0; i < rp->pair_count; i++) {
                 int fd = rp->two_fd[i].orig_fd;
@@ -6766,7 +6964,7 @@ popredir(int drop)
         }
         redirlist = rp->next;
         free(rp);
-        INT_ON;
+        INTON;
 }
 
 static void
@@ -6793,11 +6991,11 @@ ash_arith(const char *s)
         math_state.setvar    = setvar0;
         //math_state.endofname = endofname;
 
-        INT_OFF;
+        INTOFF;
         result = arith(&math_state, s);
         if (math_state.errmsg)
                 ash_msg_and_raise_error(math_state.errmsg);
-        INT_ON;
+        INTON;
 
         return result;
 }
@@ -7018,7 +7216,7 @@ ifsfree(void)
         if (!p)
                 goto out;
 
-        INT_OFF;
+        INTOFF;
         do {
                 struct ifsregion *ifsp;
                 ifsp = p->next;
@@ -7026,7 +7224,7 @@ ifsfree(void)
                 p = ifsp;
         } while (p);
         ifsfirst.next = NULL;
-        INT_ON;
+        INTON;
  out:
         ifslastp = NULL;
 }
@@ -7241,11 +7439,11 @@ recordregion(int start, int end, int nulonly)
         if (ifslastp == NULL) {
                 ifsp = &ifsfirst;
         } else {
-                INT_OFF;
+                INTOFF;
                 ifsp = ckzalloc(sizeof(*ifsp));
                 /*ifsp->next = NULL; - ckzalloc did it */
                 ifslastp->next = ifsp;
-                INT_ON;
+                INTON;
         }
         ifslastp = ifsp;
         ifslastp->begoff = start;
@@ -7262,11 +7460,11 @@ removerecordregions(int endoff)
         if (ifsfirst.endoff > endoff) {
                 while (ifsfirst.next) {
                         struct ifsregion *ifsp;
-                        INT_OFF;
+                        INTOFF;
                         ifsp = ifsfirst.next->next;
                         free(ifsfirst.next);
                         ifsfirst.next = ifsp;
-                        INT_ON;
+                        INTON;
                 }
                 if (ifsfirst.begoff > endoff) {
                         ifslastp = NULL;
@@ -7282,11 +7480,11 @@ removerecordregions(int endoff)
                 ifslastp = ifslastp->next;
         while (ifslastp->next) {
                 struct ifsregion *ifsp;
-                INT_OFF;
+                INTOFF;
                 ifsp = ifslastp->next->next;
                 free(ifslastp->next);
                 ifslastp->next = ifsp;
-                INT_ON;
+                INTON;
         }
         if (ifslastp->endoff > endoff)
                 ifslastp->endoff = endoff;
@@ -7399,7 +7597,7 @@ evalbackcmd(union node *n, struct backcmd *result
         if (pipe(pip) < 0)
                 ash_msg_and_raise_perror("can't create pipe");
         /* process substitution uses NULL job, like openhere() */
-        jp = (ctl == CTLBACKQ) ? makejob(/*n,*/ 1) : NULL;
+        jp = (ctl == CTLBACKQ) ? makejob(1) : NULL;
 #if ENABLE_PLATFORM_MINGW32
         memset(&fs, 0, sizeof(fs));
         fs.fpid = FS_EVALBACKCMD;
@@ -7411,7 +7609,8 @@ evalbackcmd(union node *n, struct backcmd *result
 #else
         if (forkshell(jp, n, FORK_NOJOB) == 0) {
                 /* child */
-                FORCE_INT_ON;
+                reset_exception_handler();
+                FORCEINTON;
                 close(pip[ip]);
                 /* ic is index of child end of pipe *and* fd to connect it to */
                 if (pip[ic] != ic) {
@@ -7473,7 +7672,7 @@ expbackq(union node *cmd, int flag IF_BASH_PROCESS_SUBST(, int ctl))
         if (flag & EXP_DISCARD)
                 goto out;
 
-        INT_OFF;
+        INTOFF;
         startloc = expdest - (char *)stackblock();
         pushstackmark(&smark, startloc);
         evalbackcmd(cmd, &in IF_BASH_PROCESS_SUBST(, ctl));
@@ -7507,7 +7706,7 @@ expbackq(union node *cmd, int flag IF_BASH_PROCESS_SUBST(, int ctl))
                 back_exitstatus = waitforjob(in.jp);
         }
  done:
-        INT_ON;
+        INTON;
 
         /* Eat all trailing newlines */
         dest = expdest;
@@ -8611,7 +8810,7 @@ expandmeta(struct strlist *str /*, int flag*/)
                 if (!hasmeta(str->text))
                         goto nometa;
 
-                INT_OFF;
+                INTOFF;
                 p = preglob(str->text, RMESCAPE_ALLOC | RMESCAPE_HEAP);
 // GLOB_NOMAGIC (GNU): if no *?[ chars in pattern, return it even if no match
 // GLOB_NOCHECK: if no match, return unchanged pattern (sans \* escapes?)
@@ -8642,12 +8841,12 @@ expandmeta(struct strlist *str /*, int flag*/)
 #endif
                         addglob(&pglob);
                         globfree(&pglob);
-                        INT_ON;
+                        INTON;
                         break;
                 case GLOB_NOMATCH:
  //nometa2:
                         globfree(&pglob);
-                        INT_ON;
+                        INTON;
  nometa:
                         *exparg.lastp = str;
                         rmescapes(str->text, 0, NULL);
@@ -8655,7 +8854,7 @@ expandmeta(struct strlist *str /*, int flag*/)
                         break;
                 default:        /* GLOB_NOSPACE */
                         globfree(&pglob);
-                        INT_ON;
+                        INTON;
                         ash_msg_and_raise_error(bb_msg_memory_exhausted);
                 }
                 str = str->next;
@@ -8915,7 +9114,7 @@ expandmeta(struct strlist *str /*, int flag*/)
                         goto nometa;
                 savelastp = exparg.lastp;
 
-                INT_OFF;
+                INTOFF;
                 p = preglob(str->text, RMESCAPE_ALLOC | RMESCAPE_HEAP);
                 len = strlen(p);
                 exp.dir_max = len + PATH_MAX;
@@ -8925,7 +9124,7 @@ expandmeta(struct strlist *str /*, int flag*/)
                 free(exp.dir);
                 if (p != str->text)
                         free(p);
-                INT_ON;
+                INTON;
                 if (exparg.lastp == savelastp) {
                         /*
                          * no matches
@@ -9128,7 +9327,7 @@ tryexec(IF_FEATURE_SH_STANDALONE(int applet_no,) const char *cmd, char **argv, c
                                 argv[0] = (char *)"Which";
                         }
 # else
-                if (APPLET_IS_NOEXEC(applet_no)) {
+                if (!vforked && APPLET_IS_NOEXEC(applet_no)) {
 # endif
 #if !ENABLE_PLATFORM_MINGW32 || !defined(_UCRT)
                         /* If building for UCRT move this up into shellexec() to
@@ -9232,9 +9431,11 @@ tryexec(IF_FEATURE_SH_STANDALONE(int applet_no,) const char *cmd, char **argv, c
  * have to change the find_command routine as well.
  * argv[-1] must exist and be writable! See tryexec() for why.
  */
+#if ENABLE_PLATFORM_MINGW32
 static struct builtincmd *find_builtin(const char *name);
 static void shellexec(char *prog, char **argv, const char *path, int idx,
                                                 int noexec) NORETURN;
+#endif
 static void shellexec(char *prog, char **argv, const char *path, int idx,
                                                 int noexec)
 {
@@ -9325,7 +9526,7 @@ static void shellexec(char *prog, char **argv, const char *path, int idx,
         exitstatus = exerrno;
         TRACE(("shellexec failed for %s, errno %d, suppress_int %d\n",
                 prog, e, suppress_int));
-        ash_msg_and_raise(EXEND, "%s: %s", prog, errmsg(e, "not found"));
+        ash_msg_and_raise(EXEND, "%s: %s", prog, errmsg(e, E_EXEC));
         /* NOTREACHED */
 }
 
@@ -9358,7 +9559,7 @@ clearcmdentry(void)
         struct tblentry **pp;
         struct tblentry *cmdp;
 
-        INT_OFF;
+        INTOFF;
         for (tblp = cmdtable; tblp < &cmdtable[CMDTABLESIZE]; tblp++) {
                 pp = tblp;
                 while ((cmdp = *pp) != NULL) {
@@ -9375,7 +9576,7 @@ clearcmdentry(void)
                         }
                 }
         }
-        INT_ON;
+        INTON;
 }
 
 /*
@@ -9429,13 +9630,13 @@ delete_cmd_entry(void)
 {
         struct tblentry *cmdp;
 
-        INT_OFF;
+        INTOFF;
         cmdp = *lastcmdentry;
         *lastcmdentry = cmdp->next;
         if (cmdp->cmdtype == CMDFUNCTION)
                 freefunc(cmdp->param.func);
         free(cmdp);
-        INT_ON;
+        INTON;
 }
 
 /*
@@ -9903,7 +10104,6 @@ commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 }
 #endif
 
-
 /*static int funcblocksize;     // size of structures in function */
 /*static int funcstringsize;    // size of strings in node */
 static void *funcblock;         /* block to allocate function from */
@@ -10026,6 +10226,7 @@ calcsize(int funcblocksize, union node *n)
 #endif
         case NCLOBBER:
         case NFROM:
+        case NFROMSTR:
         case NFROMTO:
         case NAPPEND:
                 funcblocksize = calcsize(funcblocksize, n->nfile.fname);
@@ -10242,6 +10443,7 @@ copynode(union node *n)
 #endif
         case NCLOBBER:
         case NFROM:
+        case NFROMSTR:
         case NFROMTO:
         case NAPPEND:
                 new->nfile.fname = copynode(n->nfile.fname);
@@ -10304,11 +10506,11 @@ defun(union node *func)
 {
         struct cmdentry entry;
 
-        INT_OFF;
+        INTOFF;
         entry.cmdtype = CMDFUNCTION;
         entry.u.func = copyfunc(func);
         addcmdentry(func->ndefun.text, &entry);
-        INT_ON;
+        INTON;
 }
 
 /* Reasons for skipping commands (see comment on breakcmd routine) */
@@ -10392,8 +10594,10 @@ dotrap(void)
         int status, last_status;
         char *p;
 
-        if (!pending_int)
+        if (!pending_int && waitcmd_int != 1) {
+                waitcmd_int = 0;
                 return;
+        }
 
         status = savestatus;
         last_status = status;
@@ -10401,7 +10605,7 @@ dotrap(void)
                 status = exitstatus;
                 savestatus = status;
         }
-        pending_int = 0;
+        pending_int = waitcmd_int = 0;
         barrier();
 
         TRACE(("dotrap entered\n"));
@@ -10470,7 +10674,7 @@ evaltree(union node *n, int flags)
 #endif
         case NNOT:
                 status = !evaltree(n->nnot.com, EV_TESTED);
-                goto setstatus;
+                break;
         case NREDIR:
                 errlinno = lineno = n->nredir.linno;
                 expredir(n->nredir.redirect);
@@ -10481,7 +10685,7 @@ evaltree(union node *n, int flags)
                 }
                 if (n->nredir.redirect)
                         popredir(/*drop:*/ 0);
-                goto setstatus;
+                break;
         case NCMD:
                 evalfn = evalcommand;
  checkexit:
@@ -10525,7 +10729,7 @@ evaltree(union node *n, int flags)
                 evalfn = evaltree;
  calleval:
                 status = evalfn(n, flags);
-                goto setstatus;
+                break;
         }
         case NIF:
                 status = evaltree(n->nif.test, EV_TESTED);
@@ -10539,17 +10743,18 @@ evaltree(union node *n, int flags)
                         goto evaln;
                 }
                 status = 0;
-                goto setstatus;
+                break;
         case NDEFUN:
                 defun(n);
                 /* Not necessary. To test it:
                  * "false; f() { qwerty; }; echo $?" should print 0.
                  */
                 /* status = 0; */
- setstatus:
-                exitstatus = status;
                 break;
         }
+
+        exitstatus = status;
+
  out:
         /* Order of checks below is important:
          * signal handlers trigger before exit caused by "set -e".
@@ -10718,6 +10923,7 @@ evalsubshell(union node *n, int flags)
 
 #if ENABLE_PLATFORM_MINGW32
         if (!backgnd && (flags & EV_EXIT) && !may_have_traps) {
+                reset_exception_handler();
                 expredir(n->nredir.redirect);
                 redirect(n->nredir.redirect, 0);
                 evaltreenr(n->nredir.n, flags);
@@ -10728,10 +10934,10 @@ evalsubshell(union node *n, int flags)
         if (!backgnd && (flags & EV_EXIT) && !may_have_traps)
                 goto nofork;
 #endif
-        INT_OFF;
+        INTOFF;
         if (backgnd == FORK_FG)
                 get_tty_state();
-        jp = makejob(/*n,*/ 1);
+        jp = makejob(1);
 #if ENABLE_PLATFORM_MINGW32
         memset(&fs, 0, sizeof(fs));
         fs.fpid = FS_EVALSUBSHELL;
@@ -10741,11 +10947,12 @@ evalsubshell(union node *n, int flags)
 #else
         if (forkshell(jp, n, backgnd) == 0) {
                 /* child */
-                INT_ON;
+                INTON;
                 flags |= EV_EXIT;
                 if (backgnd)
                         flags &= ~EV_TESTED;
  nofork:
+                reset_exception_handler();
                 redirect(n->nredir.redirect, 0);
                 evaltreenr(n->nredir.n, flags);
                 /* never returns */
@@ -10755,7 +10962,7 @@ evalsubshell(union node *n, int flags)
         status = 0;
         if (backgnd == FORK_FG)
                 status = waitforjob(jp);
-        INT_ON;
+        INTON;
         return status;
 }
 
@@ -10776,6 +10983,7 @@ expredir(union node *n)
                 switch (redir->type) {
                 case NFROMTO:
                 case NFROM:
+                case NFROMSTR:
                 case NTO:
 #if BASH_REDIR_OUTPUT
                 case NTO2:
@@ -10844,10 +11052,10 @@ evalpipe(union node *n, int flags)
         for (lp = n->npipe.cmdlist; lp; lp = lp->next)
                 pipelen++;
         flags |= EV_EXIT;
-        INT_OFF;
+        INTOFF;
         if (n->npipe.pipe_backgnd == 0)
                 get_tty_state();
-        jp = makejob(/*n,*/ pipelen);
+        jp = makejob(pipelen);
         prevfd = -1;
         for (lp = n->npipe.cmdlist; lp; lp = lp->next) {
                 prehash(lp->n);
@@ -10870,7 +11078,8 @@ evalpipe(union node *n, int flags)
 #else
                 if (forkshell(jp, lp->n, n->npipe.pipe_backgnd) == 0) {
                         /* child */
-                        INT_ON;
+                        reset_exception_handler();
+                        INTON;
                         if (pip[1] >= 0) {
                                 close(pip[0]);
                         }
@@ -10898,7 +11107,7 @@ evalpipe(union node *n, int flags)
                 status = waitforjob(jp);
                 TRACE(("evalpipe:  job done exit status %d\n", status));
         }
-        INT_ON;
+        INTON;
 
         return status;
 }
@@ -11002,7 +11211,7 @@ poplocalvars(int keep)
         int var_type;
 #endif
 
-        INT_OFF;
+        INTOFF;
         ll = localvar_stack;
         localvar_stack = ll->next;
 
@@ -11057,7 +11266,7 @@ poplocalvars(int keep)
                 }
                 free(lvp);
         }
-        INT_ON;
+        INTON;
 }
 
 /*
@@ -11073,12 +11282,12 @@ pushlocalvars(int push)
         if (!push)
                 goto out;
 
-        INT_OFF;
+        INTOFF;
         ll = ckzalloc(sizeof(*ll));
         /*ll->lv = NULL; - zalloc did it */
         ll->next = top;
         localvar_stack = ll;
-        INT_ON;
+        INTON;
  out:
         return top;
 }
@@ -11115,13 +11324,13 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
         if (e) {
                 goto funcdone;
         }
-        INT_OFF;
+        INTOFF;
         exception_handler = &jmploc;
         shellparam.malloced = 0;
         func->count++;
         funcname = func->n.ndefun.text;
         funcline = func->n.ndefun.linno;
-        INT_ON;
+        INTON;
         shellparam.nparam = argc - 1;
         shellparam.p = argv + 1;
 #if ENABLE_ASH_GETOPTS
@@ -11130,7 +11339,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
 #endif
         evaltree(func->n.ndefun.body, flags & EV_TESTED);
  funcdone:
-        INT_OFF;
+        INTOFF;
         funcname = savefuncname;
         if (savetrap) {
                 if (!trap[NTRAP_ERR])
@@ -11144,7 +11353,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
         freeparam(&shellparam);
         shellparam = saveparam;
         exception_handler = savehandler;
-        INT_ON;
+        INTON;
         evalskip &= ~(SKIPFUNC | SKIPFUNCDEF);
         return e;
 }
@@ -11163,7 +11372,7 @@ mklocal(char *name, int flags)
         struct var *vp;
         char *eq = strchr(name, '=');
 
-        INT_OFF;
+        INTOFF;
         /* Cater for duplicate "local". Examples:
          * x=0; f() { local x=1; echo $x; local x; echo $x; }; f; echo $x
          * x=0; f() { local x=1; echo $x; local x=2; echo $x; }; f; echo $x
@@ -11214,7 +11423,7 @@ mklocal(char *name, int flags)
         lvp->next = localvar_stack->lv;
         localvar_stack->lv = lvp;
  ret:
-        INT_ON;
+        INTON;
 }
 
 /*
@@ -11772,7 +11981,7 @@ evalcommand(union node *cmd, int flags)
                         char *sv_argv0;
 #endif
 
-                        INT_OFF;
+                        INTOFF;
                         sv_environ = environ;
                         environ = listvars(VEXPORT, VUNSET, varlist.list, /*end:*/ NULL);
                         /*
@@ -11802,10 +12011,11 @@ evalcommand(union node *cmd, int flags)
                          * our signals to SA_RESTART?
                          */
                         /*clearerr(stdout);*/
-                        INT_ON;
+                        INTON;
                         break;
                 }
 #endif
+                /* Fork off a child process if necessary. */
                 /* Can we avoid forking? For example, very last command
                  * in a script or a subshell does not need forking,
                  * we can just exec it.
@@ -11815,7 +12025,7 @@ evalcommand(union node *cmd, int flags)
                         /* No, forking off a child is necessary */
                         struct forkshell fs;
 
-                        INT_OFF;
+                        INTOFF;
                         memset(&fs, 0, sizeof(fs));
                         fs.fpid = FS_SHELLEXEC;
                         fs.argv = argv;
@@ -11828,16 +12038,10 @@ evalcommand(union node *cmd, int flags)
 #else
                 if (!(flags & EV_EXIT) || may_have_traps) {
                         /* No, forking off a child is necessary */
-                        INT_OFF;
+                        INTOFF;
                         get_tty_state();
-                        jp = makejob(/*cmd,*/ 1);
-                        if (forkshell(jp, cmd, FORK_FG) != 0) {
-                                /* parent */
-                                break;
-                        }
-                        /* child */
-                        FORCE_INT_ON;
-                        /* fall through to exec'ing external program */
+                        jp = vforkexec(cmd, argv, path, cmdentry.u.index);
+                        break;
                 }
 #endif
                 shellexec(argv[0], argv, path, cmdentry.u.index, FALSE);
@@ -11861,7 +12065,7 @@ evalcommand(union node *cmd, int flags)
         status = waitforjob(jp);
         if (jp)
                 TRACE(("forked child exited with %d\n", status));
-        FORCE_INT_ON;
+        FORCEINTON;
 
  out:
         if (cmd->ncmd.redirect)
@@ -11919,7 +12123,6 @@ goodname(const char *p)
         return endofname(p)[0] == '\0';
 }
 
-
 /*
  * Search for a command.  This is called before we fork so that the
  * location of the command will be available in the parent as well as
@@ -11999,7 +12202,7 @@ pushstring(char *s, struct alias *ap)
         int len;
 
         len = strlen(s);
-        INT_OFF;
+        INTOFF;
         if (g_parsefile->strpush || g_parsefile->spfree) {
                 sp = ckzalloc(sizeof(*sp));
                 sp->prev = g_parsefile->strpush;
@@ -12023,14 +12226,14 @@ pushstring(char *s, struct alias *ap)
         g_parsefile->left_in_line = len;
         g_parsefile->unget = 0;
         g_parsefile->spfree = NULL;
-        INT_ON;
+        INTON;
 }
 
 static void popstring(void)
 {
         struct strpush *sp = g_parsefile->strpush;
 
-        INT_OFF;
+        INTOFF;
 #if ENABLE_ASH_ALIAS
         if (sp->ap) {
                 if (g_parsefile->next_to_pgetc[-1] == ' '
@@ -12049,7 +12252,7 @@ static void popstring(void)
         memcpy(g_parsefile->lastc, sp->lastc, sizeof(sp->lastc));
         g_parsefile->strpush = sp->prev;
         g_parsefile->spfree = sp;
-        INT_ON;
+        INTON;
 }
 
 #if ENABLE_PLATFORM_MINGW32
@@ -12146,11 +12349,11 @@ preadfd(void)
                  * #(bash 5.0.17 exits after first "T", looks like a bug)
                  */
                 bb_got_signal = 0;
-                INT_OFF; /* no longjmp'ing out of read_line_input please */
+                INTOFF; /* no longjmp'ing out of read_line_input please */
                 nr = read_line_input(line_input_state, cmdedit_prompt, buf, IBUFSIZ);
                 if (bb_got_signal == SIGINT)
                         write(STDOUT_FILENO, "^C\n", 3);
-                INT_ON; /* here non-blocked SIGINT will longjmp */
+                INTON; /* here non-blocked SIGINT will longjmp */
                 if (nr == 0) {
                         /* ^C pressed, "convert" to SIGINT */
 # if !ENABLE_PLATFORM_MINGW32
@@ -12160,7 +12363,6 @@ preadfd(void)
                          * is SIG_IGNed on startup, it stays SIG_IGNed)
                          */
 # else
-                        raise_interrupt();
                         write(STDOUT_FILENO, "^C\n", 3);
 # endif
                         if (trap[SIGINT]) {
@@ -12173,6 +12375,10 @@ preadfd(void)
                                 buf[1] = '\0';
                                 return 1;
                         }
+# if ENABLE_PLATFORM_MINGW32
+                        else
+                                raise_interrupt();
+# endif
                         exitstatus = 128 + SIGINT;
                         /* bash behavior on ^C + ignored SIGINT: */
                         goto again;
@@ -12316,7 +12522,7 @@ nlnoprompt(void)
 
 static void freestrings(struct strpush *sp)
 {
-        INT_OFF;
+        INTOFF;
         do {
                 struct strpush *psp;
 #if ENABLE_ASH_ALIAS
@@ -12335,7 +12541,7 @@ static void freestrings(struct strpush *sp)
         } while (sp);
 
         g_parsefile->spfree = NULL;
-        INT_ON;
+        INTON;
 }
 
 static int __pgetc(void)
@@ -12468,7 +12674,7 @@ popfile(void)
         if (pf == &basepf)
                 return;
 
-        INT_OFF;
+        INTOFF;
         if (pf->pf_fd >= 0)
                 close(pf->pf_fd);
         free(pf->buf);
@@ -12480,7 +12686,7 @@ popfile(void)
         }
         g_parsefile = pf->prev;
         free(pf);
-        INT_ON;
+        INTON;
 }
 
 static void
@@ -12543,14 +12749,10 @@ setinputfile(const char *fname, int flags)
 {
         int fd;
 
-        INT_OFF;
-        fd = open(fname, O_RDONLY | O_CLOEXEC);
-        if (fd < 0) {
-                if (flags & INPUT_NOFILE_OK)
-                        goto out;
-                exitstatus = 127;
-                ash_msg_and_raise_perror("can't open '%s'", fname);
-        }
+        INTOFF;
+        fd = sh_open(fname, O_RDONLY, flags & INPUT_NOFILE_OK);
+        if (fd < 0)
+                goto out;
         if (fd < 10)
                 fd = savefd(fd);
         else if (O_CLOEXEC == 0) /* old libc */
@@ -12558,7 +12760,7 @@ setinputfile(const char *fname, int flags)
 
         setinputfd(fd, flags & INPUT_PUSH_FILE);
  out:
-        INT_ON;
+        INTON;
         return fd;
 }
 
@@ -12568,13 +12770,13 @@ setinputfile(const char *fname, int flags)
 static void
 setinputstring(char *string)
 {
-        INT_OFF;
+        INTOFF;
         pushfile();
         g_parsefile->next_to_pgetc = string;
         g_parsefile->left_in_line = strlen(string);
         g_parsefile->buf = NULL;
         g_parsefile->linno = lineno;
-        INT_ON;
+        INTON;
 }
 
 
@@ -12870,7 +13072,7 @@ shiftcmd(int argc UNUSED_PARAM, char **argv)
                 n = number(argv[1]);
         if (n > shellparam.nparam)
                 return 1;
-        INT_OFF;
+        INTOFF;
         shellparam.nparam -= n;
         for (ap1 = shellparam.p; --n >= 0; ap1++) {
                 if (shellparam.malloced)
@@ -12883,7 +13085,7 @@ shiftcmd(int argc UNUSED_PARAM, char **argv)
         shellparam.optind = 1;
         shellparam.optoff = -1;
 #endif
-        INT_ON;
+        INTON;
         return 0;
 }
 
@@ -12937,7 +13139,7 @@ setcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
         if (!argv[1])
                 return showvars(nullstr, 0, VUNSET);
 
-        INT_OFF;
+        INTOFF;
         retval = options(/*login_sh:*/ NULL);
         if (retval == 0) { /* if no parse error... */
                 optschanged();
@@ -12945,7 +13147,7 @@ setcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                         setparam(argptr);
                 }
         }
-        INT_ON;
+        INTON;
         return retval;
 }
 
@@ -13355,7 +13557,7 @@ fixredir(union node *n, const char *text, int err)
                  * silently truncate results to word width.
                  */
                 if (err)
-                        raise_error_syntax("bad fd number");
+                        ash_msg_and_raise_error("bad fd number");
                 n->ndup.vname = makename();
         }
 }
@@ -13788,12 +13990,12 @@ decode_dollar_squote(void)
 #endif
 
 /* Used by expandstr to get here-doc like behaviour. */
-#define FAKEEOFMARK ((char*)(uintptr_t)1)
+#define FAKEEOFMARK ((struct heredoc*)(uintptr_t)1)
 
 static ALWAYS_INLINE int
-realeofmark(const char *eofmark)
+realeofmark(struct heredoc *here)
 {
-        return eofmark && eofmark != FAKEEOFMARK;
+        return here && here != FAKEEOFMARK;
 }
 
 /*
@@ -13815,7 +14017,7 @@ realeofmark(const char *eofmark)
 #define PARSEPROCSUB()  {style = PSUB; goto parsebackq; parsebackq_psreturn:;}
 #define PARSEARITH()    {goto parsearith; parsearith_return:;}
 static int
-readtoken1(int c, int syntax, char *eofmark, int striptabs)
+readtoken1(int c, int syntax, struct heredoc *eofmark)
 {
         /* NB: syntax parameter fits into smallint */
         /* c parameter is an unsigned char or PEOF */
@@ -14067,23 +14269,30 @@ checkend: {
                 int markloc;
                 char *p;
 
-                if (striptabs) {
+                if (eofmark->striptabs) {
                         while (c == '\t')
-                                c = pgetc();
+                                if (eofmark->here->type == NHERE)
+                                        c = pgetc();  /* dash always does pgetc() */
+                                else /* NXHERE */
+                                        c = pgetc_eatbnl();
+                                /* (see heredoc_bkslash_newline3a.tests) */
                 }
 
                 markloc = out - (char *)stackblock();
-                for (p = eofmark; STPUTC(c, out), *p; p++) {
+                for (p = eofmark->eofmark; STPUTC(c, out), *p; p++) {
                         if (c != *p)
                                 goto more_heredoc;
-                        /* FIXME: fails for backslash-newlined terminator:
+                        /* dash still has this not fixed (as of 2025-08)
                          * cat <<EOF
                          * ...
                          * EO\
                          * F
                          * (see heredoc_bkslash_newline2.tests)
                          */
-                        c = pgetc();
+                        if (eofmark->here->type == NHERE)
+                                c = pgetc(); /* dash always does pgetc() */
+                        else /* NXHERE */
+                                c = pgetc_eatbnl();
                 }
 
                 if (c == '\n' || c == PEOF) {
@@ -14093,7 +14302,6 @@ checkend: {
                         needprompt = doprompt;
                 } else {
                         int len_here;
-
  more_heredoc:
                         p = (char *)stackblock() + markloc + 1;
                         len_here = out - p;
@@ -14156,6 +14364,11 @@ parseredir: {
                 c = pgetc_eatbnl();
                 switch (c) {
                 case '<':
+                        c = pgetc_eatbnl();
+                        if (c == '<') {
+                                np->type = NFROMSTR;
+                                break;
+                        }
                         if (sizeof(struct nfile) != sizeof(struct nhere)) {
                                 np = stzalloc(sizeof(struct nhere));
                                 /*np->nfile.fd = 0; - stzalloc did it */
@@ -14163,7 +14376,6 @@ parseredir: {
                         np->type = NHERE;
                         heredoc = stzalloc(sizeof(struct heredoc));
                         heredoc->here = np;
-                        c = pgetc_eatbnl();
                         if (c == '-') {
                                 heredoc->striptabs = 1;
                         } else {
@@ -14602,7 +14814,7 @@ xxreadtoken(void)
                 }
         } /* for (;;) */
 
-        return readtoken1(c, BASESYNTAX, (char *) NULL, 0);
+        return readtoken1(c, BASESYNTAX, NULL);
 }
 #else /* old xxreadtoken */
 #define RETURN(token)   return lasttoken = token
@@ -14653,7 +14865,7 @@ xxreadtoken(void)
                 }
                 break;
         }
-        return readtoken1(c, BASESYNTAX, (char *)NULL, 0);
+        return readtoken1(c, BASESYNTAX, NULL);
 #undef RETURN
 }
 #endif /* old xxreadtoken */
@@ -14759,9 +14971,9 @@ parseheredoc(void)
                 tokpushback = 0;
                 setprompt_if(needprompt, 2);
                 if (here->here->type == NHERE)
-                        readtoken1(pgetc(), SQSYNTAX, here->eofmark, here->striptabs);
+                        readtoken1(pgetc(), SQSYNTAX, here);
                 else
-                        readtoken1(pgetc_eatbnl(), DQSYNTAX, here->eofmark, here->striptabs);
+                        readtoken1(pgetc_eatbnl(), DQSYNTAX, here);
                 n = stzalloc(sizeof(struct narg));
                 n->narg.type = NARG;
                 /*n->narg.next = NULL; - stzalloc did it */
@@ -14772,7 +14984,6 @@ parseheredoc(void)
         }
 }
 
-
 static const char *
 expandstr(const char *ps, int syntax_type)
 {
@@ -14805,8 +15016,7 @@ expandstr(const char *ps, int syntax_type)
          * PS1='$(date "+%H:%M:%S) > '
          */
         exception_handler = &jmploc;
-        readtoken1(pgetc_eatbnl(), syntax_type, FAKEEOFMARK, 0);
-
+        readtoken1(pgetc_eatbnl(), syntax_type, FAKEEOFMARK);
         n.narg.type = NARG;
         n.narg.next = NULL;
         n.narg.text = wordtext;
@@ -14943,7 +15153,7 @@ cmdloop(int top)
 
                 setstackmark(&smark);
 #if JOBS || JOBS_WIN32
-                if (doing_jobctl)
+                if (jobctl)
                         showjobs(SHOW_CHANGED|SHOW_STDERR);
 #endif
                 inter = 0;
@@ -15355,11 +15565,11 @@ find_command(char *name, struct cmdentry *entry, int act, const char *path)
                         entry->u.index = idx;
                         return;
                 }
-                INT_OFF;
+                INTOFF;
                 cmdp = cmdlookup(name, 1);
                 cmdp->cmdtype = CMDNORMAL;
                 cmdp->param.index = idx;
-                INT_ON;
+                INTON;
                 goto success;
         }
 
@@ -15379,7 +15589,7 @@ find_command(char *name, struct cmdentry *entry, int act, const char *path)
                         return;
                 }
 #endif
-                ash_msg("%s: %s", name, errmsg(e, "not found"));
+                ash_msg("%s: %s", name, errmsg(e, E_EXEC));
         }
  fail:
         entry->cmdtype = CMDUNKNOWN;
@@ -15391,18 +15601,17 @@ find_command(char *name, struct cmdentry *entry, int act, const char *path)
                 entry->u.cmd = bcmd;
                 return;
         }
-        INT_OFF;
+        INTOFF;
         cmdp = cmdlookup(name, 1);
         cmdp->cmdtype = CMDBUILTIN;
         cmdp->param.cmd = bcmd;
-        INT_ON;
+        INTON;
  success:
         cmdp->rehash = 0;
         entry->cmdtype = cmdp->cmdtype;
         entry->u = cmdp->param;
 }
 
-
 /*
  * The trap builtin.
  */
@@ -15458,7 +15667,7 @@ trapcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                         exitcode = 1;
                         goto next;
                 }
-                INT_OFF;
+                INTOFF;
                 if (action) {
                         if (LONE_DASH(action))
                                 action = NULL;
@@ -15495,7 +15704,7 @@ trapcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                 if (signo != 0 && signo < NSIG)
                         setsignal(signo);
 #endif
-                INT_ON;
+                INTON;
  next:
                 ap++;
         }
@@ -15808,10 +16017,11 @@ readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
          * to jump out of it.
          */
  again:
-        INT_OFF;
+        INTOFF;
         r = shell_builtin_read(&params);
-        INT_ON;
+        INTON;
 
+#if !ENABLE_PLATFORM_MINGW32
         if ((uintptr_t)r == 1 && errno == EINTR) {
                 /* To get SIGCHLD: sleep 1 & read x; echo $x
                  * Correct behavior is to not exit "read"
@@ -15820,11 +16030,18 @@ readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                         goto again;
         }
 
-#if ENABLE_PLATFORM_MINGW32
+        if ((uintptr_t)r == 2) /* -t SEC timeout? */
+                /* bash: "The exit status is greater than 128 if the timeout is exceeded." */
+                /* The actual value observed with bash 5.2.15: */
+                return 128 + SIGALRM;
+#else /* ENABLE_PLATFORM_MINGW32 */
         if ((uintptr_t)r == 2) {
+                /* Timeout, return 128 + SIGALRM */
+                return 142;
+        } else if ((uintptr_t)r == 3) {
                 /* ^C pressed, propagate event */
                 if (trap[SIGINT]) {
-                        write(STDOUT_FILENO, "^C", 2);
+                        write_ctrl_c();
                         pending_int = 1;
                         dotrap();
                         if (!(rootshell && iflag))
@@ -15859,10 +16076,10 @@ umaskcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                 symbolic_mode = 1;
         }
 
-        INT_OFF;
+        INTOFF;
         mask = umask(0);
         umask(mask);
-        INT_ON;
+        INTON;
 
         if (*argptr == NULL) {
                 if (symbolic_mode) {
@@ -15969,8 +16186,25 @@ exitshell(void)
         char *p;
 
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
-        save_history(line_input_state); /* may be NULL */
+        if (line_input_state) {
+                const char *hp;
+# if ENABLE_FEATURE_SH_HISTFILESIZE
+// in bash:
+// HISTFILESIZE controls the on-disk history file size (in lines, 0=no history):
+// "When this variable is assigned a value, the history file is truncated, if necessary"
+// but we do it only at exit, not on assignment:
+                /* Use HISTFILESIZE to limit file size */
+                hp = lookupvar("HISTFILESIZE");
+                if (hp)
+                        line_input_state->max_history = size_from_HISTFILESIZE(hp);
+# endif
+                /* HISTFILE: "If unset, the command history is not saved when a shell exits." */
+                hp = lookupvar("HISTFILE");
+                line_input_state->hist_file = hp;
+                save_history(line_input_state); /* no-op if hist_file is NULL or "" */
+        }
 #endif
+
         savestatus = exitstatus;
         TRACE(("pid %d, exitshell(%d)\n", getpid(), savestatus));
         if (setjmp(loc.loc))
@@ -16020,11 +16254,13 @@ init(void)
 {
 #if ENABLE_PLATFORM_MINGW32
         int import = 0;
-#else
+#endif
+
         /* we will never free this */
         basepf.next_to_pgetc = basepf.buf = ckzalloc(IBUFSIZ);
         basepf.linno = 1;
 
+#if !ENABLE_PLATFORM_MINGW32
         sigmode[SIGCHLD - 1] = S_DFL; /* ensure we install handler even if it is SIG_IGNed */
         setsignal(SIGCHLD);
 #endif
@@ -16144,7 +16380,6 @@ init(void)
         }
 }
 
-
 //usage:#define ash_trivial_usage
 //usage:        "[-il] [-|+Cabefmnuvx] [-|+o OPT]... [-c 'SCRIPT' [ARG0 ARGS] | FILE ARGS | -s ARGS]"
 ////////        comes from ^^^^^^^^^^optletters
@@ -16155,18 +16390,15 @@ init(void)
  * Process the shell command line arguments.
  */
 static int
-procargs(char **argv)
+procargs(char **xargv)
 {
         int i;
-        const char *xminusc;
-        char **xargv;
         int login_sh;
 
-        xargv = argv;
 #if ENABLE_PLATFORM_MINGW32
         login_sh = applet_name[0] == 'l';
 #else
-        login_sh = xargv[0] && xargv[0][0] == '-';
+        login_sh = /*xargv[0] &&*/ xargv[0][0] == '-';
 #endif
 #if NUM_SCRIPTS > 0
         if (minusc)
@@ -16183,9 +16415,8 @@ procargs(char **argv)
                 raise_exception(EXERROR); /* does not return */
         }
         xargv = argptr;
-        xminusc = minusc;
         if (*xargv == NULL) {
-                if (xminusc)
+                if (minusc)
                         ash_msg_and_raise_error(bb_msg_requires_arg, "-c");
                 sflag = 1;
         }
@@ -16207,7 +16438,7 @@ procargs(char **argv)
         debug = 1;
 #endif
         /* POSIX 1003.2: first arg after "-c CMD" is $0, remainder $1... */
-        if (xminusc) {
+        if (minusc) {
                 minusc = *xargv++;
                 if (*xargv)
                         goto setarg0;
@@ -16218,7 +16449,6 @@ procargs(char **argv)
 #endif
  setarg0:
                 arg0 = *xargv++;
-                commandname = arg0;
         }
 
         shellparam.p = xargv;
@@ -16283,17 +16513,12 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
 /* note: 'argc' is used only if embedded scripts are enabled */
 {
         volatile smallint state;
-        struct jmploc jmploc;
         struct stackmark smark;
         int login_sh;
 
 #if ENABLE_PLATFORM_MINGW32
         INIT_G_memstack();
 
-        /* from init() */
-        basepf.next_to_pgetc = basepf.buf = ckzalloc(IBUFSIZ);
-        basepf.linno = 1;
-
         if (argc == 3 && !strcmp(argv[1], "--fs")) {
                 forkshell_init(argv[2]);
                 /* only reached in case of error */
@@ -16317,7 +16542,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
 #endif
 
         state = 0;
-        if (setjmp(jmploc.loc)) {
+        if (setjmp(main_handler.loc)) {
                 smallint e;
                 smallint s;
 
@@ -16336,7 +16561,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                 }
 
                 popstackmark(&smark);
-                FORCE_INT_ON; /* enable interrupts */
+                FORCEINTON; /* enable interrupts */
                 if (s == 1)
                         goto state1;
                 if (s == 2)
@@ -16345,7 +16570,7 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                         goto state3;
                 goto state4;
         }
-        exception_handler = &jmploc;
+        exception_handler = &main_handler;
         rootpid = getpid();
 
         init();
@@ -16463,18 +16688,23 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                         if (!hp) {
                                 hp = lookupvar("HOME");
                                 if (hp) {
-                                        INT_OFF;
+                                        INTOFF;
                                         hp = concat_path_file(hp, ".ash_history");
                                         setvar0("HISTFILE", hp);
                                         free((char*)hp);
-                                        INT_ON;
+                                        INTON;
                                         hp = lookupvar("HISTFILE");
                                 }
                         }
                         if (hp)
                                 line_input_state->hist_file = xstrdup(hp);
 # if ENABLE_FEATURE_SH_HISTFILESIZE
-                        hp = lookupvar("HISTFILESIZE");
+                        hp = lookupvar("HISTSIZE");
+                        /* Using HISTFILESIZE above to limit max_history would be WRONG:
+                         * users may set HISTFILESIZE=0 in their profile scripts
+                         * to prevent _saving_ of history files, but still want to have
+                         * non-zero history limit for in-memory list.
+                         */
                         line_input_state->max_history = size_from_HISTFILESIZE(hp);
 # endif
                 }
@@ -16537,7 +16767,7 @@ forkshell_evalbackcmd(struct forkshell *fs)
         pip[ip] = fs->fd[ip];
         pip[ic] = fs->fd[ic];
 
-        FORCE_INT_ON;
+        FORCEINTON;
         close(pip[ip]);
         if (pip[ic] != ic) {
                 /*close(ic);*/
@@ -16557,7 +16787,7 @@ forkshell_evalsubshell(struct forkshell *fs)
         int flags = fs->flags;
 
         TRACE(("ash: subshell: %s\n",__PRETTY_FUNCTION__));
-        INT_ON;
+        INTON;
         flags |= EV_EXIT;
         if (fs->mode)
                 flags &= ~EV_TESTED;
@@ -16576,7 +16806,7 @@ forkshell_evalpipe(struct forkshell *fs)
         int pip[2] = {fs->fd[0], fs->fd[1]};
 
         TRACE(("ash: subshell: %s\n",__PRETTY_FUNCTION__));
-        INT_ON;
+        INTON;
         if (pip[1] >= 0) {
                 close(pip[0]);
         }
@@ -16596,9 +16826,9 @@ forkshell_shellexec(struct forkshell *fs)
 {
         int idx = fs->fd[0];
         char **argv = fs->argv;
-        char *path = fs->path;
+        const char *path = fs->path;
 
-        FORCE_INT_ON;
+        FORCEINTON;
         shellexec(argv[0], argv, path, idx, TRUE);
 }
 
@@ -17148,6 +17378,8 @@ globals_misc_size(struct datasize ds)
 #undef physdir
 #undef arg0
 #undef commandname
+#undef g_parsefile
+#undef basepf
 #undef nullstr
 #undef trap
 static struct globals_misc *
@@ -17176,6 +17408,8 @@ globals_misc_copy(void)
                 new->trap[i] = nodeckstrdup(p->trap[i]);
                 SAVE_PTR(new->trap[i], xasprintf("trap[%d]", i), FREE);
         }
+        new->g_parsefile = NULL;
+        memset(&new->basepf, 0, sizeof(struct parsefile));
         return new;
 }
 
@@ -17188,8 +17422,8 @@ forkshell_size(struct forkshell *fs)
         if (fs->fpid == FS_OPENHERE)
                 return ds;
 
-        ds = globals_var_size(ds);
         ds = globals_misc_size(ds);
+        ds = globals_var_size(ds);
         ds = cmdtable_size(ds);
 
         ds.funcblocksize = calcsize(ds.funcblocksize, fs->n);
@@ -17221,11 +17455,11 @@ forkshell_copy(struct forkshell *fs, struct forkshell *new)
         if (fs->fpid == FS_OPENHERE)
                 return;
 
-        new->gvp = globals_var_copy();
         new->gmp = globals_misc_copy();
+        new->gvp = globals_var_copy();
         new->cmdtable = cmdtable_copy();
-        SAVE_PTR(new->gvp, "gvp", NO_FREE);
         SAVE_PTR(new->gmp, "gmp", NO_FREE);
+        SAVE_PTR(new->gvp, "gvp", NO_FREE);
         SAVE_PTR(new->cmdtable, "cmdtable", NO_FREE);
 
         new->n = copynode(fs->n);
@@ -17262,7 +17496,7 @@ forkshell_copy(struct forkshell *fs, struct forkshell *new)
 
 #if FORKSHELL_DEBUG
 #define NUM_BLOCKS FUNCSTRING
-enum {GVP, GMP, CMDTABLE, NODE, ARGV, ATAB, HISTORY, JOBTAB, FUNCSTRING};
+enum {GMP, GVP, CMDTABLE, NODE, ARGV, ATAB, HISTORY, JOBTAB, FUNCSTRING};
 
 /* fp0 and notes can each be NULL */
 static void
@@ -17327,8 +17561,8 @@ forkshell_print(FILE *fp0, struct forkshell *fs, const char **notes)
                 lptr[ARGV] = fs->argv ? (char *)fs->argv : lptr[ATAB];
                 lptr[NODE] = fs->n ? (char *)fs->n : lptr[ARGV];
                 lptr[CMDTABLE] = (char *)fs->cmdtable;
-                lptr[GMP] = (char *)fs->gmp;
                 lptr[GVP] = (char *)fs->gvp;
+                lptr[GMP] = (char *)fs->gmp;
 
                 fprintf(fp, "funcblocksize %6d = ", fs->funcblocksize);
                 total = 0;
@@ -17470,7 +17704,6 @@ forkshell_init(const char *idstr)
         int i;
         char **ptr;
         char *lrelocate;
-        struct jmploc jmploc;
 
         if (sscanf(idstr, "%p", &map_handle) != 1)
                 return;
@@ -17508,9 +17741,14 @@ forkshell_init(const char *idstr)
         }
         fs->gmp->trap_ptr = fs->gmp->trap;
 
+        /* from init() */
+        fs->gmp->basepf.next_to_pgetc = fs->gmp->basepf.buf = ckzalloc(IBUFSIZ);
+        fs->gmp->basepf.linno = 1;
+        fs->gmp->g_parsefile = &fs->gmp->basepf;
+
         /* Set global variables */
-        ASSIGN_CONST_PTR(&ash_ptr_to_globals_var, fs->gvp);
         ASSIGN_CONST_PTR(&ash_ptr_to_globals_misc, fs->gmp);
+        ASSIGN_CONST_PTR(&ash_ptr_to_globals_var, fs->gvp);
         cmdtable = fs->cmdtable;
 #if ENABLE_ASH_ALIAS
         atab = fs->atab;        /* will be NULL for FS_SHELLEXEC */
@@ -17533,11 +17771,11 @@ forkshell_init(const char *idstr)
 
         reinitvar();
 
-        if (setjmp(jmploc.loc)) {
+        if (setjmp(main_handler.loc)) {
                 exitreset();
                 exitshell();
         }
-        exception_handler = &jmploc;
+        exception_handler = &main_handler;
 
         shlvl++;
         if (fs->mode == FORK_BG) {
@@ -17566,7 +17804,7 @@ forkshell_init(const char *idstr)
         clear_traps();
 #if JOBS_WIN32
         /* do job control only in root shell */
-        doing_jobctl = 0;
+        jobctl = 0;
 
         if (fs->n && fs->n->type == NCMD && fs->n->ncmd.args &&
                         strcmp(fs->n->ncmd.args->narg.text, "jobs") == 0) {
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2a.right b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2a.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2a.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2a.tests b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2a.tests
new file mode 100755
index 000000000..eb2223031
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline2a.tests
@@ -0,0 +1,4 @@
+cat <<-EOF
+        Ok1
+        EO\
+F
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3.right b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3.tests b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3.tests
new file mode 100755
index 000000000..de21132d1
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+Ok1
+\
+EOF
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3a.right b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3a.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3a.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3a.tests b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3a.tests
new file mode 100755
index 000000000..da3860804
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_bkslash_newline3a.tests
@@ -0,0 +1,4 @@
+cat <<-EOF
+Ok1
+        \
+        EOF
diff --git a/shell/ash_test/ash-heredoc/herestring1.right b/shell/ash_test/ash-heredoc/herestring1.right
new file mode 100644
index 000000000..555937daa
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/herestring1.right
@@ -0,0 +1,33 @@
+one
+_two
+\_three
+\_four
+\_two
+\_three
+\\_four
+two_newlines
+
+/bin/c*
+star_*
+star_*
+star_*
+star_\*
+star_*
+star_\*
+line1
+line2
+        line3
+line1
+line2
+        line3
+512
+256
+128
+64
+32
+16
+8
+4
+2
+v-$a-\t-\-\"-\x-`-\--\z-\*-\?-
+v-$a-\t-\-"-\x-`-\--\z-\*-\?-
diff --git a/shell/ash_test/ash-heredoc/herestring1.tests b/shell/ash_test/ash-heredoc/herestring1.tests
new file mode 100755
index 000000000..fb7bd0dda
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/herestring1.tests
@@ -0,0 +1,35 @@
+cat <<<one
+cat <<<\_two
+cat <<<"\_three"
+cat <<<'\_four'
+cat <<<\\_two
+cat <<<"\\_three"
+cat <<<'\\_four'
+
+cat <<<$'two_newlines\n'
+
+cat <<</bin/c*
+
+cat <<<star_*
+cat <<<star_\*
+cat <<<"star_*"
+cat <<<"star_\*"
+cat <<<'star_*'
+cat <<<'star_\*'
+
+var=$'line1
+line2
+        line3'
+
+cat <<<$var
+
+cat <<<"$var"
+
+i=10
+until test $((--i)) = 0; do
+        cat <<<$((2**i))
+done
+
+a=qwerty
+cat <<<`echo v'-$a-\t-\\-\"-\x-\`-\--\z-\*-\?-'`
+cat <<<"`echo v'-$a-\t-\\-\"-\x-\`-\--\z-\*-\?-'`"
diff --git a/shell/ash_test/ash-misc/assignment2.right b/shell/ash_test/ash-misc/assignment2.right
index 179c71c5a..246694462 100644
--- a/shell/ash_test/ash-misc/assignment2.right
+++ b/shell/ash_test/ash-misc/assignment2.right
@@ -1,2 +1,4 @@
 ./assignment2.tests: line 2: a=b: not found
 127
+./assignment2.tests: line 4: ab=c: not found
+127
diff --git a/shell/ash_test/ash-misc/assignment2.tests b/shell/ash_test/ash-misc/assignment2.tests
index f6938434c..a93a48d09 100755
--- a/shell/ash_test/ash-misc/assignment2.tests
+++ b/shell/ash_test/ash-misc/assignment2.tests
@@ -1,3 +1,5 @@
 # This must not be interpreted as an assignment
 a''=b true
 echo $?
+a'b'=c true
+echo $?
diff --git a/shell/ash_test/ash-misc/func6.right b/shell/ash_test/ash-misc/func6.right
new file mode 100644
index 000000000..01e79c32a
--- /dev/null
+++ b/shell/ash_test/ash-misc/func6.right
@@ -0,0 +1,3 @@
+1
+2
+3
diff --git a/shell/ash_test/ash-misc/func6.tests b/shell/ash_test/ash-misc/func6.tests
new file mode 100755
index 000000000..5f1699c42
--- /dev/null
+++ b/shell/ash_test/ash-misc/func6.tests
@@ -0,0 +1,8 @@
+{ f() { echo $1; } }
+f 1
+
+{ f() ( echo $1; )}
+f 2
+
+{ f()(echo $1)}
+f 3
diff --git a/shell/ash_test/ash-misc/func7.right b/shell/ash_test/ash-misc/func7.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/ash_test/ash-misc/func7.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/ash_test/ash-misc/func7.tests b/shell/ash_test/ash-misc/func7.tests
new file mode 100755
index 000000000..f5e03b6e1
--- /dev/null
+++ b/shell/ash_test/ash-misc/func7.tests
@@ -0,0 +1 @@
+if f() { echo Ok:$?; } then f; fi
diff --git a/shell/ash_test/ash-read/read_ifs2.right b/shell/ash_test/ash-read/read_ifs2.right
new file mode 100644
index 000000000..797137dae
--- /dev/null
+++ b/shell/ash_test/ash-read/read_ifs2.right
@@ -0,0 +1,9 @@
+|X|Y:Z:|
+|X|Y:Z|
+|X|Y|
+|X|Y|
+|X||
+|X||
+|||
+Whitespace should be trimmed too:
+|X|Y|
diff --git a/shell/ash_test/ash-read/read_ifs2.tests b/shell/ash_test/ash-read/read_ifs2.tests
new file mode 100755
index 000000000..f01a68978
--- /dev/null
+++ b/shell/ash_test/ash-read/read_ifs2.tests
@@ -0,0 +1,9 @@
+echo "X:Y:Z:" | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y:Z"  | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y:"   | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y"    | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:"     | (IFS=": " read x y; echo "|$x|$y|")
+echo "X"      | (IFS=": " read x y; echo "|$x|$y|")
+echo ""       | (IFS=": " read x y; echo "|$x|$y|")
+echo Whitespace should be trimmed too:
+echo "X:Y  : " | (IFS=": " read x y; echo "|$x|$y|")
diff --git a/shell/ash_test/ash-read/read_t.right b/shell/ash_test/ash-read/read_t.right
index 04126cbe6..3eedae275 100644
--- a/shell/ash_test/ash-read/read_t.right
+++ b/shell/ash_test/ash-read/read_t.right
@@ -1,4 +1,4 @@
-><
-><
->test<
->test<
+>te:142<
+>:142<
+>test:0<
+>test:0<
diff --git a/shell/ash_test/ash-read/read_t.tests b/shell/ash_test/ash-read/read_t.tests
index d65f1aeaa..9fbeec517 100755
--- a/shell/ash_test/ash-read/read_t.tests
+++ b/shell/ash_test/ash-read/read_t.tests
@@ -1,10 +1,10 @@
-# bash 3.2 outputs:
+# bash 5.2 outputs:
 
-# ><
-{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply<")
-# ><
-{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply<")
-# >test<
-{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply<")
-# >test<
-{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply<")
+# >te:142<
+{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply:$?<")
+# >:142<
+{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply:$?<")
+# >test:0<
+{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply:$?<")
+# >test:0<
+{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply:$?<")
diff --git a/shell/ash_test/ash-redir/redir_EINTR1.right b/shell/ash_test/ash-redir/redir_EINTR1.right
new file mode 100644
index 000000000..287d91f67
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_EINTR1.right
@@ -0,0 +1,2 @@
+Hello
+Done:0
diff --git a/shell/ash_test/ash-redir/redir_EINTR1.tests b/shell/ash_test/ash-redir/redir_EINTR1.tests
new file mode 100755
index 000000000..cede4d4d8
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_EINTR1.tests
@@ -0,0 +1,13 @@
+rm -f test.fifo
+mkfifo test.fifo
+
+(sleep 1; kill -chld $$) &
+(sleep 2; echo Hello >test.fifo) &
+
+# We get open("test.fifo") interrupted by SIGCHLD from the first subshell.
+# The shell MUST retry the open (no printing of error messages).
+# Then, the second subshell opens fifo for writing and open unblocks and succeeds.
+cat <test.fifo
+
+echo "Done:$?"
+rm -f test.fifo
diff --git a/shell/ash_test/ash-redir/redir_EINTR2.right b/shell/ash_test/ash-redir/redir_EINTR2.right
new file mode 100644
index 000000000..287d91f67
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_EINTR2.right
@@ -0,0 +1,2 @@
+Hello
+Done:0
diff --git a/shell/ash_test/ash-redir/redir_EINTR2.tests b/shell/ash_test/ash-redir/redir_EINTR2.tests
new file mode 100755
index 000000000..3d343c7ea
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir_EINTR2.tests
@@ -0,0 +1,14 @@
+rm -f test.fifo
+mkfifo test.fifo
+
+(sleep 1; kill -chld $$) &
+(sleep 2; echo Hello >test.fifo) &
+
+# We get open("test.fifo") interrupted by SIGCHLD from the first subshell.
+# The shell MUST retry the open (no printing of error messages).
+# Then, the second subshell opens fifo for writing and open unblocks and succeeds.
+read HELLO <test.fifo
+echo "$HELLO"
+
+echo "Done:$?"
+rm -f test.fifo
diff --git a/shell/ash_test/ash-vars/var_backslash1.right b/shell/ash_test/ash-vars/var_backslash1.right
new file mode 100644
index 000000000..3f2c21289
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_backslash1.right
@@ -0,0 +1,35 @@
+a is '\*bc'
+b is '\'
+c is '*'
+${a##?*} removes everything:    || - matches one char, then all
+${a##?"*"} removes \*:          |bc| - matches one char, then *
+${a##\*} removes nothing:       |\*bc| - first char is not *
+${a##\\*} removes everything:   || - matches \, then all
+${a##\\\*} removes \*:          |bc| - matches \, then *
+${a##?$c} removes everything:   || - matches one char, then all
+${a##?"$c"} removes \*:         |bc| - matches one char, then *
+${a##\\$c} removes everything:  || - matches \, then all
+${a##\\\$c} removes nothing:    |\*bc| - matches \, but then second char is not $
+${a##\\"$c"} removes \*:        |bc| - matches \, then *
+${a##$b} removes \:             |*bc| - matches \
+${a##"$b"} removes \:           |*bc| - matches \
+
+Single quote tests:
+${a##?'*'} removes \*:          |bc| - matches one char, then *
+${a##'\'*} removes everything:  || - matches \, then all
+${a##'\'\*} removes \*:         |bc| - matches \, then *
+${a##'\*'} removes \*:          |bc| - matches \, then *
+${a##'\'$c} removes everything: || - matches \, then all
+${a##'\'\$c} removes nothing:   |\*bc| - matches \, but then second char is not $
+${a##'\'"$c"} removes \*:       |bc| - matches \, then *
+
+${a##"$b"?} removes \*:         |bc| - matches \, then one char
+${a##"$b"*} removes everything: || - matches \, then all
+${a##"$b""?"} removes nothing:  |\*bc| - second char is not ?
+${a##"$b""*"} removes \*:       |bc| - matches \, then *
+${a##"$b"\*} removes \*:        |bc| - matches \, then *
+${a##"$b"$c} removes everything:|| - matches \, then all
+${a##"$b""$c"} removes \*:      |bc| - matches \, then *
+${a##"$b?"} removes nothing:    |\*bc| - second char is not ?
+${a##"$b*"} removes \*:         |bc| - matches \, then *
+${a##"$b$c"} removes \*:        |bc| - matches \, then *
diff --git a/shell/ash_test/ash-vars/var_backslash1.tests b/shell/ash_test/ash-vars/var_backslash1.tests
new file mode 100755
index 000000000..015a6107b
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_backslash1.tests
@@ -0,0 +1,48 @@
+a='\*bc'
+b='\'
+c='*'
+echo "a is '$a'"
+echo "b is '$b'"
+echo "c is '$c'"
+echo '${a##?*} removes everything:    '"|${a##?*}|"' - matches one char, then all'
+echo '${a##?"*"} removes \*:          '"|${a##?"*"}|"' - matches one char, then *'
+echo '${a##\*} removes nothing:       '"|${a##\*}|"' - first char is not *'
+echo '${a##\\*} removes everything:   '"|${a##\\*}|"' - matches \, then all'
+echo '${a##\\\*} removes \*:          '"|${a##\\\*}|"' - matches \, then *'
+echo '${a##?$c} removes everything:   '"|${a##?$c}|"' - matches one char, then all'
+echo '${a##?"$c"} removes \*:         '"|${a##?"$c"}|"' - matches one char, then *'
+echo '${a##\\$c} removes everything:  '"|${a##\\$c}|"' - matches \, then all'
+echo '${a##\\\$c} removes nothing:    '"|${a##\\\$c}|"' - matches \, but then second char is not $'
+echo '${a##\\"$c"} removes \*:        '"|${a##\\"$c"}|"' - matches \, then *'
+echo '${a##$b} removes \:             '"|${a##$b}|"' - matches \'
+echo '${a##"$b"} removes \:           '"|${a##"$b"}|"' - matches \'
+echo
+sq="'"
+echo 'Single quote tests:'
+echo '${a##?'$sq'*'$sq'} removes \*:          '"|${a##?'*'}|"' - matches one char, then *'
+echo '${a##'$sq'\'$sq'*} removes everything:  '"|${a##'\'*}|"' - matches \, then all'
+echo '${a##'$sq'\'$sq'\*} removes \*:         '"|${a##'\'\*}|"' - matches \, then *'
+echo '${a##'$sq'\*'$sq'} removes \*:          '"|${a##'\*'}|"' - matches \, then *'
+echo '${a##'$sq'\'$sq'$c} removes everything: '"|${a##'\'$c}|"' - matches \, then all'
+echo '${a##'$sq'\'$sq'\$c} removes nothing:   '"|${a##'\'\$c}|"' - matches \, but then second char is not $'
+echo '${a##'$sq'\'$sq'"$c"} removes \*:       '"|${a##'\'"$c"}|"' - matches \, then *'
+echo
+## In bash, this isn't working as expected
+#echo '${a##$b?} removes \*:           '"|${a##$b?}|"' - matches \, then one char'   # bash prints |\*bc|
+#echo '${a##$b*} removes everything:   '"|${a##$b*}|"' - matches \, then all'        # bash prints |\*bc|
+#echo '${a##$b$c} removes everything:  '"|${a##$b$c}|"' - matches \, then all'       # bash prints |\*bc|
+#echo '${a##$b"$c"} removes \*:        '"|${a##$b"$c"}|"' - matches \, then *'       # bash prints |\*bc|
+## the cause seems to be that $b emits backslash that "glues" onto next character if there is one:
+## a='\*bc'; b='\'; c='*'; echo "|${a##?$b*}|"  # bash prints |bc| - the $b* works as \* (matches literal *)
+## a='\*bc'; b='\'; c='*'; echo "|${a##\\$b*}|" # bash prints |bc|
+#echo
+echo '${a##"$b"?} removes \*:         '"|${a##"$b"?}|"' - matches \, then one char'
+echo '${a##"$b"*} removes everything: '"|${a##"$b"*}|"' - matches \, then all'
+echo '${a##"$b""?"} removes nothing:  '"|${a##"$b""?"}|"' - second char is not ?'  # bash prints |bc|
+echo '${a##"$b""*"} removes \*:       '"|${a##"$b""*"}|"' - matches \, then *'
+echo '${a##"$b"\*} removes \*:        '"|${a##"$b"\*}|"' - matches \, then *'
+echo '${a##"$b"$c} removes everything:'"|${a##"$b"$c}|"' - matches \, then all'
+echo '${a##"$b""$c"} removes \*:      '"|${a##"$b""$c"}|"' - matches \, then *'
+echo '${a##"$b?"} removes nothing:    '"|${a##"$b?"}|"' - second char is not ?'  # bash prints |bc|
+echo '${a##"$b*"} removes \*:         '"|${a##"$b*"}|"' - matches \, then *'     # bash prints ||
+echo '${a##"$b$c"} removes \*:        '"|${a##"$b$c"}|"' - matches \, then *'
diff --git a/shell/ash_test/printenv.c b/shell/ash_test/printenv.c
index c86308d3b..f0f41984d 100644
--- a/shell/ash_test/printenv.c
+++ b/shell/ash_test/printenv.c
@@ -31,9 +31,7 @@
 extern char **environ;
 
 int
-main (argc, argv)
-     int argc;
-     char **argv;
+main (int argc, char **argv)
 {
   register char **envp, *eval;
   int len;
diff --git a/shell/ash_test/recho.c b/shell/ash_test/recho.c
index 42a5feafd..7e96b14cc 100644
--- a/shell/ash_test/recho.c
+++ b/shell/ash_test/recho.c
@@ -27,7 +27,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-void strprint();
+void strprint(char *);
 
 int main(int argc, char **argv)
 {
diff --git a/shell/hush.c b/shell/hush.c
index 04dda0734..da0db7948 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -44,23 +44,20 @@
  *      make complex ${var%...} constructs support optional
  *      make here documents optional
  *      special variables (done: PWD, PPID, RANDOM)
- *      follow IFS rules more precisely, including update semantics
  *      tilde expansion
- *      aliases
  *      "command" missing features:
  *          command -p CMD: run CMD using default $PATH
  *              (can use this to override standalone shell as well?)
  *          command BLTIN: disables special-ness (e.g. errors do not abort)
  *          command -V CMD1 CMD2 CMD3 (multiple args) (not in standard)
  *      builtins mandated by standards we don't support:
- *          [un]alias, fc:
  *          fc -l[nr] [BEG] [END]: list range of commands in history
  *          fc [-e EDITOR] [BEG] [END]: edit/rerun range of commands
  *          fc -s [PAT=REP] [CMD]: rerun CMD, replacing PAT with REP
  *
  * Bash compat TODO:
  *      redirection of stdout+stderr: &> and >&
- *      reserved words: function select
+ *      reserved words: select
  *      advanced test: [[ ]]
  *      process substitution: <(list) and >(list)
  *      let EXPR [EXPR...]
@@ -102,7 +99,7 @@
 //config:
 //config:       It will compile and work on no-mmu systems.
 //config:
-//config:       It does not handle select, aliases, tilde expansion,
+//config:       It does not handle select, tilde expansion,
 //config:       &>file and >&file redirection of stdout+stderr.
 //config:
 // This option is visible (has a description) to make it possible to select
@@ -115,6 +112,11 @@
 //config:# It's only needed to get "nice" menuconfig indenting.
 //config:if SHELL_HUSH || HUSH || SH_IS_HUSH || BASH_IS_HUSH
 //config:
+//config:config HUSH_NEED_FOR_SPEED
+//config:       bool "Faster, but larger code"
+//config:       default y
+//config:       depends on SHELL_HUSH
+//config:
 //config:config HUSH_BASH_COMPAT
 //config:       bool "bash-compatible extensions"
 //config:       default y
@@ -189,6 +191,13 @@
 //config:       help
 //config:       Enable case ... esac statement. +400 bytes.
 //config:
+//config:config HUSH_ALIAS
+//config:       bool "Support aliases"
+//config:       default y
+//config:       depends on SHELL_HUSH
+//config:       help
+//config:       Enable aliases.
+//config:
 //config:config HUSH_FUNCTIONS
 //config:       bool "Support funcname() { commands; } syntax"
 //config:       default y
@@ -196,6 +205,13 @@
 //config:       help
 //config:       Enable support for shell functions. +800 bytes.
 //config:
+//config:config HUSH_FUNCTION_KEYWORD
+//config:       bool "Support function keyword"
+//config:       default y
+//config:       depends on HUSH_FUNCTIONS
+//config:       help
+//config:       Support "function FUNCNAME { CMD; }" syntax.
+//config:
 //config:config HUSH_LOCAL
 //config:       bool "local builtin"
 //config:       default y
@@ -392,6 +408,8 @@
 
 /* Build knobs */
 #define LEAK_HUNTING 0
+#define LEAK_PRINTF(...) fdprintf(__VA_ARGS__)
+//#define LEAK_PRINTF(...) do { if (ptr_to_globals && G.root_pid == getpid()) fdprintf(__VA_ARGS__); } while (0)
 #define BUILD_AS_NOMMU 0
 /* Enable/disable sanity checks. Ok to enable in production,
  * only adds a bit of bloat. Set to >1 to get non-production level verbosity.
@@ -551,25 +569,22 @@ typedef struct o_string {
         smallint has_empty_slot;
         smallint ended_in_ifs;
 } o_string;
+#define IS_NULL_WORD(str) \
+        ((str).length == 0 && !(str).has_quoted_part)
 enum {
-        EXP_FLAG_SINGLEWORD     = 0x80, /* must be 0x80 */
-        EXP_FLAG_GLOB           = 0x2,
-        /* Protect newly added chars against globbing
-         * by prepending \ to *, ?, [, \ */
-        EXP_FLAG_ESC_GLOB_CHARS = 0x1,
+        /* Protect all newly added chars against globbing by prepending \ to *, ?, [, -, \ */
+        EXP_FLAG_GLOBPROTECT_CHARS = 0x1,
+        /* Protect quoted vars against globbing */
+        EXP_FLAG_GLOBPROTECT_VARS  = 0x2,
+        /* On word-split, perform globbing (one word may become many) */
+        EXP_FLAG_DO_GLOBBING       = 0x4,
+        /* Do not word-split */
+        EXP_FLAG_SINGLEWORD        = 0x80,
+        /* ^^^^ EXP_FLAG_SINGLEWORD must be 0x80 */
 };
 /* Used for initialization: o_string foo = NULL_O_STRING; */
 #define NULL_O_STRING { NULL }
 
-#ifndef debug_printf_parse
-static const char *const assignment_flag[] ALIGN_PTR = {
-        "MAYBE_ASSIGNMENT",
-        "DEFINITELY_ASSIGNMENT",
-        "NOT_ASSIGNMENT",
-        "WORD_IS_KEYWORD",
-};
-#endif
-
 /* We almost can use standard FILE api, but we need an ability to move
  * its fd when redirects coincide with it. No api exists for that
  * (RFE for it at https://sourceware.org/bugzilla/show_bug.cgi?id=21902).
@@ -587,22 +602,28 @@ typedef struct HFILE {
 
 typedef struct in_str {
         const char *p;
+#if ENABLE_HUSH_ALIAS
+        /* During alias expansion, p is saved in saved_ibuf, and replaced by alias expansion */
+        const char *saved_ibuf;
+        char *albuf; /* malloced */
+#endif
         int peek_buf[2];
         int last_char;
         HFILE *file;
 } in_str;
 
-/* The descrip member of this structure is only used to make
+/* The descrip3 member of this structure is only used to make
  * debugging output pretty */
 static const struct {
         int32_t mode;
         signed char default_fd;
-        char descrip[3];
+        char descrip3[3];
 } redir_table[] ALIGN4 = {
         { O_RDONLY,                  0, "<"  },
         { O_CREAT|O_TRUNC|O_WRONLY,  1, ">"  },
         { O_CREAT|O_APPEND|O_WRONLY, 1, ">>" },
         { O_CREAT|O_RDWR,            1, "<>" },
+        { O_RDONLY,                  0, "<<<" },
         { O_RDONLY,                  0, "<<" },
 /* Should not be needed. Bogus default_fd helps in debugging */
 /*      { O_RDONLY,                 77, "<<" }, */
@@ -622,12 +643,13 @@ struct redir_struct {
          */
 };
 typedef enum redir_type {
-        REDIRECT_INPUT     = 0,
-        REDIRECT_OVERWRITE = 1,
-        REDIRECT_APPEND    = 2,
-        REDIRECT_IO        = 3,
-        REDIRECT_HEREDOC   = 4,
-        REDIRECT_HEREDOC2  = 5, /* REDIRECT_HEREDOC after heredoc is loaded */
+        REDIRECT_INPUT      = 0,
+        REDIRECT_OVERWRITE  = 1,
+        REDIRECT_APPEND     = 2,
+        REDIRECT_IO         = 3,
+        REDIRECT_HERESTRING = 4,
+        REDIRECT_HEREDOC    = 5,
+        REDIRECT_HEREDOC2   = 6, /* REDIRECT_HEREDOC after heredoc is loaded */
 
         REDIRFD_CLOSE      = -3,
         REDIRFD_SYNTAX_ERR = -2,
@@ -656,8 +678,12 @@ struct command {
 # define CMD_SINGLEWORD_NOGLOB 3
 #endif
 #if ENABLE_HUSH_FUNCTIONS
-# define CMD_FUNCDEF 4
+# if ENABLE_HUSH_FUNCTION_KEYWORD
+#  define CMD_FUNCTION_KWORD 4
+# endif
+# define CMD_FUNCDEF 5
 #endif
+/* ^^^ if you change this, update CMDTYPE[] array too */
 
         smalluint cmd_exitcode;
         /* if non-NULL, this "command" is { list }, ( list ), or a compound statement */
@@ -693,7 +719,9 @@ struct command {
 };
 /* Is there anything in this command at all? */
 #define IS_NULL_CMD(cmd) \
-        (!(cmd)->group && !(cmd)->argv && !(cmd)->redirects)
+        (!(cmd)->group && !(cmd)->argv && !(cmd)->redirects \
+                /* maybe? IF_HUSH_FUNCTION_KEYWORD(&& !(cmd)->cmd_type) */ \
+        )
 
 struct pipe {
         struct pipe *next;
@@ -734,13 +762,9 @@ struct parse_context {
 #if !BB_MMU
         o_string as_string;
 #endif
-        smallint is_assignment; /* 0:maybe, 1:yes, 2:no, 3:keyword */
+        smallint is_assignment;
 #if HAS_KEYWORDS
         smallint ctx_res_w;
-        smallint ctx_inverted; /* "! cmd | cmd" */
-#if ENABLE_HUSH_CASE
-        smallint ctx_dsemicolon; /* ";;" seen */
-#endif
         /* bitmask of FLAG_xxx, for figuring out valid reserved words */
         int old_flag;
         /* group we are enclosed in:
@@ -759,9 +783,14 @@ enum {
         MAYBE_ASSIGNMENT      = 0,
         DEFINITELY_ASSIGNMENT = 1,
         NOT_ASSIGNMENT        = 2,
-        /* Not an assignment, but next word may be: "if v=xyz cmd;" */
-        WORD_IS_KEYWORD       = 3,
 };
+#ifndef debug_printf_parse
+static const char *const assignment_flag[] ALIGN_PTR = {
+        "MAYBE_ASSIGNMENT",
+        "DEFINITELY_ASSIGNMENT",
+        "NOT_ASSIGNMENT",
+};
+#endif
 
 /* On program start, environ points to initial environment.
  * putenv adds new pointers into it, unsetenv removes them.
@@ -795,6 +824,14 @@ struct function {
 };
 #endif
 
+#if ENABLE_HUSH_ALIAS
+struct alias {
+        struct alias *next;
+        char *str;
+        smallint dont_recurse;
+};
+#endif
+
 /* set -/+o OPT support. (TODO: make it optional)
  * bash supports the following opts:
  * allexport       off
@@ -916,6 +953,7 @@ struct globals {
 #endif
         /* set by signal handler if SIGINT is received _and_ its trap is not set */
         smallint flag_SIGINT;
+        smallint flag_startup_done;
 #if ENABLE_HUSH_LOOPS
         smallint flag_break_continue;
 #endif
@@ -930,6 +968,12 @@ struct globals {
 # define G_flag_return_in_progress 0
 #endif
         smallint exiting; /* used to prevent EXIT trap recursion */
+#if !BB_MMU
+        smallint reexeced_on_NOMMU;
+# define G_reexeced_on_NOMMU (G.reexeced_on_NOMMU)
+#else
+# define G_reexeced_on_NOMMU 0
+#endif
         /* These support $? */
         smalluint last_exitcode;
         smalluint expand_exitcode;
@@ -970,6 +1014,9 @@ struct globals {
 # endif
         struct function *top_func;
 #endif
+#if ENABLE_HUSH_ALIAS
+        struct alias *top_alias;
+#endif
         /* Signal and trap handling */
 #if ENABLE_HUSH_FAST
         unsigned count_SIGCHLD;
@@ -1072,6 +1119,10 @@ static int builtin_jobs(char **argv) FAST_FUNC;
 #if ENABLE_HUSH_GETOPTS
 static int builtin_getopts(char **argv) FAST_FUNC;
 #endif
+#if ENABLE_HUSH_ALIAS
+static int builtin_alias(char **argv) FAST_FUNC;
+static int builtin_unalias(char **argv) FAST_FUNC;
+#endif
 #if ENABLE_HUSH_HELP
 static int builtin_help(char **argv) FAST_FUNC;
 #endif
@@ -1149,6 +1200,9 @@ struct built_in_command {
 static const struct built_in_command bltins1[] ALIGN_PTR = {
         BLTIN("."        , builtin_source  , "Run commands in file"),
         BLTIN(":"        , builtin_true    , NULL),
+#if ENABLE_HUSH_ALIAS
+        BLTIN("alias"    , builtin_alias   , "Define or display aliases"),
+#endif
 #if ENABLE_HUSH_JOB
         BLTIN("bg"       , builtin_fg_bg   , "Resume job in background"),
 #endif
@@ -1200,7 +1254,7 @@ static const struct built_in_command bltins1[] ALIGN_PTR = {
         BLTIN("return"   , builtin_return  , "Return from function"),
 #endif
 #if ENABLE_HUSH_SET
-        BLTIN("set"      , builtin_set     , "Set positional parameters"),
+        BLTIN("set"      , builtin_set     , "Set options or positional parameters"),
 #endif
         BLTIN("shift"    , builtin_shift   , "Shift positional parameters"),
 #if BASH_SOURCE
@@ -1210,7 +1264,7 @@ static const struct built_in_command bltins1[] ALIGN_PTR = {
         BLTIN("times"    , builtin_times   , NULL),
 #endif
 #if ENABLE_HUSH_TRAP
-        BLTIN("trap"     , builtin_trap    , "Trap signals"),
+        BLTIN("trap"     , builtin_trap    , "Define or display signal handlers"),
 #endif
         BLTIN("true"     , builtin_true    , NULL),
 #if ENABLE_HUSH_TYPE
@@ -1222,6 +1276,9 @@ static const struct built_in_command bltins1[] ALIGN_PTR = {
 #if ENABLE_HUSH_UMASK
         BLTIN("umask"    , builtin_umask   , "Set file creation mask"),
 #endif
+#if ENABLE_HUSH_ALIAS
+        BLTIN("unalias"  , builtin_unalias , "Delete aliases"),
+#endif
 #if ENABLE_HUSH_UNSET
         BLTIN("unset"    , builtin_unset   , "Unset variables"),
 #endif
@@ -1352,30 +1409,67 @@ static void debug_print_strings(const char *prefix, char **vv)
 static void *xxmalloc(int lineno, size_t size)
 {
         void *ptr = xmalloc((size + 0xff) & ~0xff);
-        fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
+        LEAK_PRINTF(2, "line %d: malloc %p\n", lineno, ptr);
+        return ptr;
+}
+static void *xxzalloc(int lineno, size_t size)
+{
+        void *ptr = xzalloc((size + 0xff) & ~0xff);
+        LEAK_PRINTF(2, "line %d: zalloc %p\n", lineno, ptr);
         return ptr;
 }
 static void *xxrealloc(int lineno, void *ptr, size_t size)
 {
+        char *p = ptr;
         ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
-        fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
+        if (p != ptr)
+                LEAK_PRINTF(2, "line %d: realloc %p\n", lineno, ptr);
+        return ptr;
+}
+static void *xxrealloc_getcwd_or_warn(int lineno, char *ptr)
+{
+        char *p = ptr;
+        ptr = xrealloc_getcwd_or_warn(ptr);
+        if (p != ptr)
+                LEAK_PRINTF(2, "line %d: xrealloc_getcwd_or_warn %p\n", lineno, ptr);
         return ptr;
 }
 static char *xxstrdup(int lineno, const char *str)
 {
         char *ptr = xstrdup(str);
-        fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
+        LEAK_PRINTF(2, "line %d: strdup %p\n", lineno, ptr);
+        return ptr;
+}
+static char *xxstrndup(int lineno, const char *str, size_t n)
+{
+        char *ptr = xstrndup(str, n);
+        LEAK_PRINTF(2, "line %d: strndup %p\n", lineno, ptr);
+        return ptr;
+}
+static char *xxasprintf(int lineno, const char *f, ...)
+{
+        char *ptr;
+        va_list args;
+        va_start(args, f);
+        if (vasprintf(&ptr, f, args) < 0)
+                bb_die_memory_exhausted();
+        va_end(args);
+        LEAK_PRINTF(2, "line %d: xasprintf %p\n", lineno, ptr);
         return ptr;
 }
 static void xxfree(void *ptr)
 {
-        fdprintf(2, "free %p\n", ptr);
+        LEAK_PRINTF(2, "free %p\n", ptr);
         free(ptr);
 }
-# define xmalloc(s)     xxmalloc(__LINE__, s)
-# define xrealloc(p, s) xxrealloc(__LINE__, p, s)
-# define xstrdup(s)     xxstrdup(__LINE__, s)
-# define free(p)        xxfree(p)
+# define xmalloc(s)        xxmalloc(__LINE__, s)
+# define xzalloc(s)        xxzalloc(__LINE__, s)
+# define xrealloc(p, s)    xxrealloc(__LINE__, p, s)
+# define xrealloc_getcwd_or_warn(p) xxrealloc_getcwd_or_warn(__LINE__, p)
+# define xstrdup(s)        xxstrdup(__LINE__, s)
+# define xstrndup(s, n)    xxstrndup(__LINE__, s, n)
+# define xasprintf(f, ...) xxasprintf(__LINE__, f, __VA_ARGS__)
+# define free(p)           xxfree(p)
 #endif
 
 /*
@@ -1391,11 +1485,14 @@ static void xxfree(void *ptr)
 # define syntax_error_unterm_ch(lineno, ch)     syntax_error_unterm_ch(ch)
 # define syntax_error_unterm_str(lineno, s)     syntax_error_unterm_str(s)
 # define syntax_error_unexpected_ch(lineno, ch) syntax_error_unexpected_ch(ch)
+# define syntax_error_unexpected_str(lineno, s) syntax_error_unexpected_str(s)
 #endif
 
 static void die_if_script(void)
 {
-        if (!G_interactive_fd) {
+        if (G.flag_startup_done /* when not yet set, allows "hush -l" to not die on errors in /etc/profile */
+         && !G_interactive_fd
+        ) {
                 if (G.last_exitcode) /* sometines it's 2, not 1 (bash compat) */
                         xfunc_error_retval = G.last_exitcode;
                 xfunc_die();
@@ -1438,24 +1535,27 @@ static void syntax_error_unterm_str(unsigned lineno UNUSED_PARAM, const char *s)
 //      die_if_script();
 }
 
-static void syntax_error_unterm_ch(unsigned lineno, char ch)
+static void syntax_error_unterm_ch(unsigned lineno, int ch)
 {
         char msg[2] = { ch, '\0' };
-        syntax_error_unterm_str(lineno, msg);
+        syntax_error_unterm_str(lineno, ch == EOF ? "EOF" : msg);
 }
 
-static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
+static void syntax_error_unexpected_str(unsigned lineno UNUSED_PARAM, const char *s)
 {
-        char msg[2];
-        msg[0] = ch;
-        msg[1] = '\0';
 #if HUSH_DEBUG >= 2
         bb_error_msg("hush.c:%u", lineno);
 #endif
-        bb_error_msg("syntax error: unexpected %s", ch == EOF ? "EOF" : msg);
+        bb_error_msg("syntax error: unexpected %s", s);
         die_if_script();
 }
 
+static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
+{
+        char msg[2] = { ch, '\0' };
+        syntax_error_unexpected_str(lineno, ch == EOF ? "EOF" : msg);
+}
+
 #if HUSH_DEBUG < 2
 # undef msg_and_die_if_script
 # undef syntax_error
@@ -1463,6 +1563,7 @@ static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
 # undef syntax_error_unterm_ch
 # undef syntax_error_unterm_str
 # undef syntax_error_unexpected_ch
+# undef syntax_error_unexpected_str
 #else
 # define msg_and_die_if_script(...)     msg_and_die_if_script(__LINE__, __VA_ARGS__)
 # define syntax_error(msg)              syntax_error(__LINE__, msg)
@@ -1470,6 +1571,7 @@ static void syntax_error_unexpected_ch(unsigned lineno UNUSED_PARAM, int ch)
 # define syntax_error_unterm_ch(ch)     syntax_error_unterm_ch(__LINE__, ch)
 # define syntax_error_unterm_str(s)     syntax_error_unterm_str(__LINE__, s)
 # define syntax_error_unexpected_ch(ch) syntax_error_unexpected_ch(__LINE__, ch)
+# define syntax_error_unexpected_str(s) syntax_error_unexpected_str(__LINE__, s)
 #endif
 
 /*
@@ -1619,6 +1721,21 @@ static int xdup_CLOEXEC_and_close(int fd, int avoid_fd)
         return newfd;
 }
 
+#if ENABLE_HUSH_ALIAS
+static void enable_all_aliases(void)
+{
+        if (G_interactive_fd) {
+                struct alias *alias = G.top_alias;
+                while (alias) {
+                        alias->dont_recurse = 0;
+                        alias = alias->next;
+                }
+        }
+}
+#else
+#define enable_all_aliases() ((void)0)
+#endif
+
 /*
  * Manipulating HFILEs
  */
@@ -1929,7 +2046,7 @@ static void restore_G_args(save_arg_t *sv, char **argv)
  * "trap - SIGxxx":
  *    if sig is in special_sig_mask, set handler back to:
  *        record_pending_signo, or to IGN if it's a tty stop signal
- *    if sig is in fatal_sig_mask, set handler back to sigexit.
+ *    if sig is in fatal_sig_mask, set handler back to restore_ttypgrp_and_killsig_or__exit.
  *    else: set handler back to SIG_DFL
  * "trap 'cmd' SIGxxx":
  *    set handler to record_pending_signo.
@@ -1973,7 +2090,7 @@ static void record_pending_signo(int sig)
          || (G_traps && G_traps[SIGCHLD] && G_traps[SIGCHLD][0])
          /* ^^^ if SIGCHLD, interrupt line reading only if it has a trap */
         ) {
-                bb_got_signal = sig; /* for read_line_input: "we got a signal" */
+                bb_got_signal = sig; /* for read_line_input / read builtin: "we got a signal" */
         }
 #endif
 #if ENABLE_HUSH_FAST
@@ -2002,19 +2119,6 @@ static sighandler_t install_sighandler(int sig, sighandler_t handler)
         return old_sa.sa_handler;
 }
 
-static void hush_exit(int exitcode) NORETURN;
-
-static void restore_ttypgrp_and__exit(void) NORETURN;
-static void restore_ttypgrp_and__exit(void)
-{
-        /* xfunc has failed! die die die */
-        /* no EXIT traps, this is an escape hatch! */
-        G.exiting = 1;
-        hush_exit(xfunc_error_retval);
-}
-
-#if ENABLE_HUSH_JOB
-
 /* Needed only on some libc:
  * It was observed that on exit(), fgetc'ed buffered data
  * gets "unwound" via lseek(fd, -NUM, SEEK_CUR).
@@ -2028,26 +2132,20 @@ static void restore_ttypgrp_and__exit(void)
  * and in `cmd` handling.
  * If set as die_func(), this makes xfunc_die() exit via _exit(), not exit():
  */
-static void fflush_and__exit(void) NORETURN;
-static void fflush_and__exit(void)
+static NORETURN void fflush_and__exit(void)
 {
         fflush_all();
         _exit(xfunc_error_retval);
 }
 
-/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
-# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
-/* After [v]fork, in parent: restore tty pgrp on xfunc death */
-# define enable_restore_tty_pgrp_on_exit()  (die_func = restore_ttypgrp_and__exit)
-
+#if ENABLE_HUSH_JOB
 /* Restores tty foreground process group, and exits.
  * May be called as signal handler for fatal signal
  * (will resend signal to itself, producing correct exit state)
  * or called directly with -EXITCODE.
  * We also call it if xfunc is exiting.
  */
-static void sigexit(int sig) NORETURN;
-static void sigexit(int sig)
+static NORETURN void restore_ttypgrp_and_killsig_or__exit(int sig)
 {
         /* Careful: we can end up here after [v]fork. Do not restore
          * tty pgrp then, only top-level shell process does that */
@@ -2065,6 +2163,19 @@ static void sigexit(int sig)
 
         kill_myself_with_sig(sig); /* does not return */
 }
+
+static NORETURN void fflush_restore_ttypgrp_and__exit(void)
+{
+        /* xfunc has failed! die die die */
+        fflush_all();
+        restore_ttypgrp_and_killsig_or__exit(- xfunc_error_retval);
+}
+
+/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
+# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
+/* After [v]fork, in parent: restore tty pgrp on xfunc death */
+# define enable_restore_tty_pgrp_on_exit()  (die_func = fflush_restore_ttypgrp_and__exit)
+
 #else
 
 # define disable_restore_tty_pgrp_on_exit() ((void)0)
@@ -2081,7 +2192,7 @@ static sighandler_t pick_sighandler(unsigned sig)
 #if ENABLE_HUSH_JOB
                 /* is sig fatal? */
                 if (G_fatal_sig_mask & sigmask)
-                        handler = sigexit;
+                        handler = restore_ttypgrp_and_killsig_or__exit;
                 else
 #endif
                 /* sig has special handling? */
@@ -2099,11 +2210,33 @@ static sighandler_t pick_sighandler(unsigned sig)
         return handler;
 }
 
-/* Restores tty foreground process group, and exits. */
-static void hush_exit(int exitcode)
+static const char* FAST_FUNC get_local_var_value(const char *name);
+
+/* Self-explanatory.
+ * Restores tty foreground process group too.
+ */
+static NORETURN void save_history_run_exit_trap_and_exit(int exitcode)
 {
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
-        save_history(G.line_input_state); /* may be NULL */
+        if (G.line_input_state
+         && getpid() == G.root_pid /* exits in subshells do not save history */
+        ) {
+                const char *hp;
+# if ENABLE_FEATURE_SH_HISTFILESIZE
+// in bash:
+// HISTFILESIZE controls the on-disk history file size (in lines, 0=no history):
+// "When this variable is assigned a value, the history file is truncated, if necessary"
+// but we do it only at exit, not on every assignment:
+                /* Use HISTFILESIZE to limit file size */
+                hp = get_local_var_value("HISTFILESIZE");
+                if (hp)
+                        G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
+# endif
+                /* HISTFILE: "If unset, the command history is not saved when a shell exits." */
+                hp = get_local_var_value("HISTFILE");
+                G.line_input_state->hist_file = hp;
+                save_history(G.line_input_state); /* no-op if hist_file is NULL or "" */
+        }
 #endif
 
         fflush_all();
@@ -2137,7 +2270,7 @@ static void hush_exit(int exitcode)
 
         fflush_all();
 #if ENABLE_HUSH_JOB
-        sigexit(- (exitcode & 0xff));
+        restore_ttypgrp_and_killsig_or__exit(- (exitcode & 0xff));
 #else
         _exit(exitcode);
 #endif
@@ -2222,7 +2355,7 @@ static int check_and_run_traps(void)
                                 }
                         }
                         /* this restores tty pgrp, then kills us with SIGHUP */
-                        sigexit(SIGHUP);
+                        restore_ttypgrp_and_killsig_or__exit(SIGHUP);
                 }
 #endif
 #if ENABLE_HUSH_FAST
@@ -2375,7 +2508,7 @@ static int set_local_var(char *str, unsigned flags)
                 if (cur->flg_read_only) {
                         bb_error_msg("%s: readonly variable", str);
                         free(str);
-//NOTE: in bash, assignment in "export READONLY_VAR=Z" fails, and sets $?=1,
+//NOTE: in bash, assignment in "export READONLY_VAR=Z" fails, and sets $? to 1,
 //but export per se succeeds (does put the var in env). We don't mimic that.
                         return -1;
                 }
@@ -2433,10 +2566,10 @@ static int set_local_var(char *str, unsigned flags)
 
                 /* Replace the value in the found "struct variable" */
                 if (cur->max_len != 0) {
-                        if (cur->max_len >= strnlen(str, cur->max_len + 1)) {
-                                /* This one is from startup env, reuse space */
-                                debug_printf_env("reusing startup env for '%s'\n", str);
-                                strcpy(cur->varstr, str);
+                        /* This one is from startup env, try to reuse space */
+                        int new_len = stpncpy(cur->varstr, str, cur->max_len + 1) - cur->varstr;
+                        if (new_len <= cur->max_len) {
+                                debug_printf_env("reused startup env for '%s'\n", str);
                                 goto free_and_exp;
                         }
                         /* Can't reuse */
@@ -2453,7 +2586,7 @@ static int set_local_var(char *str, unsigned flags)
                 goto set_str_and_exp;
         }
 
-        /* Not found or shadowed - create new variable struct */
+        /* Not found, or found but shadowed - create new variable struct */
         debug_printf_env("%s: alloc new var '%s'/%u\n", __func__, str, local_lvl);
         cur = xzalloc(sizeof(*cur));
         cur->var_nest_level = local_lvl;
@@ -2669,20 +2802,16 @@ static const char *setup_prompt_string(void)
         debug_printf("prompt_str '%s'\n", prompt_str);
         return prompt_str;
 }
-static int get_user_input(struct in_str *i)
+static int show_prompt_and_get_stdin(struct in_str *i)
 {
 # if ENABLE_FEATURE_EDITING
         /* In EDITING case, this function reads next input line,
          * saves it in i->p, then returns 1st char of it.
          */
-        int r;
-        const char *prompt_str;
-
-        prompt_str = setup_prompt_string();
         for (;;) {
-                reinit_unicode_for_hush();
-                G.flag_SIGINT = 0;
+                int r;
 
+                G.flag_SIGINT = 0;
                 bb_got_signal = 0;
                 if (!sigisemptyset(&G.pending_set)) {
                         /* Whoops, already got a signal, do not call read_line_input */
@@ -2702,6 +2831,8 @@ static int get_user_input(struct in_str *i)
                          * #^^^ prints "T", prints prompt, repeats
                          * #(bash 5.0.17 exits after first "T", looks like a bug)
                          */
+                        const char *prompt_str = setup_prompt_string();
+                        reinit_unicode_for_hush();
                         r = read_line_input(G.line_input_state, prompt_str,
                                 G.user_input_buf, CONFIG_FEATURE_EDITING_MAX_LEN-1
                         );
@@ -2732,7 +2863,7 @@ static int get_user_input(struct in_str *i)
                 /* it was a signal: go back, read another input line */
         }
         i->p = G.user_input_buf;
-        return (unsigned char)*i->p++;
+        return (unsigned char)*i->p++; /* can't be NUL */
 # else
         /* In !EDITING case, this function gets called for every char.
          * Buffering happens deeper in the call chain, in hfgetc(i->file).
@@ -2773,13 +2904,13 @@ static int get_user_input(struct in_str *i)
 }
 /* This is the magic location that prints prompts
  * and gets data back from the user */
-static int fgetc_interactive(struct in_str *i)
+static int i_getch_interactive(struct in_str *i)
 {
         int ch;
         /* If it's interactive stdin, get new line. */
         if (G_interactive_fd && i->file == G.HFILE_stdin) {
                 /* Returns first char (or EOF), the rest is in i->p[] */
-                ch = get_user_input(i);
+                ch = show_prompt_and_get_stdin(i);
                 G.promptmode = 1; /* PS2 */
                 debug_printf_prompt("%s promptmode=%d\n", __func__, G.promptmode);
         } else {
@@ -2789,7 +2920,7 @@ static int fgetc_interactive(struct in_str *i)
         return ch;
 }
 #else  /* !INTERACTIVE */
-static ALWAYS_INLINE int fgetc_interactive(struct in_str *i)
+static ALWAYS_INLINE int i_getch_interactive(struct in_str *i)
 {
         int ch;
         do ch = hfgetc(i->file); while (ch == '\0');
@@ -2797,37 +2928,88 @@ static ALWAYS_INLINE int fgetc_interactive(struct in_str *i)
 }
 #endif  /* !INTERACTIVE */
 
+#if ENABLE_HUSH_ALIAS
+static ALWAYS_INLINE int i_has_alias_buffer(struct in_str *i)
+{
+        return i->saved_ibuf && i->p && *i->p;
+}
+static void i_prepend_to_alias_buffer(struct in_str *i, char *prepend, char ch)
+{
+        if (i->saved_ibuf) {
+                /* Nested alias expansion example:
+                 * alias a='b c'; alias b='echo A:'
+                 * a
+                 * ^^^ runs "echo A: c"
+                 */
+                char *old = i->albuf;
+                //bb_error_msg("before'%s' p'%s'", i->albuf, i->p);
+                i->albuf = xasprintf("%s%c%s", prepend, ch, i->p);
+                i->p = i->albuf;
+                //bb_error_msg("after'%s' p'%s'", i->albuf, i->p);
+                free(old);
+                return;
+        }
+        i->saved_ibuf = i->p;
+        i->p = i->albuf = xasprintf("%s%c", prepend, ch);
+        //bb_error_msg("albuf'%s'", i->albuf);
+}
+static void i_free_alias_buffer(struct in_str *i)
+{
+        if (i->saved_ibuf) {
+                /* We are here if alias expansion has ended just now */
+                free(i->albuf);
+                i->p = i->saved_ibuf;
+                i->saved_ibuf = NULL;
+/* We re-enable aliases only if expansion has finished, not on command boundaries.
+ * Example:
+ * alias a="nice&&a"
+ * a;a
+ * This should run "nice" and then "can't execute 'a': No such file or directory",
+ * then should run "nice" again and then "can't execute 'a': No such file or directory" again
+ * because the second "a" in alias definition must not expand (to prevent infinite expansion),
+ * but the "a" after ; must expand (there is no danger of infinite expansion).
+ * alias a="nice&&nice"
+ * a;a&&a
+ * should execute "nice" six times.
+ */
+                debug_printf_parse("end of alias\n");
+                enable_all_aliases();
+        }
+}
+#else
+# define i_has_alias_buffer(i)  0
+# define i_free_alias_buffer(i) ((void)0)
+#endif
+
 static int i_getch(struct in_str *i)
 {
         int ch;
 
-        if (!i->file) {
-                /* string-based in_str */
+ IF_HUSH_ALIAS(again:)
+        if (i->p) {
+                /* string-based in_str, or line editing buffer, or alias buffer */
                 ch = (unsigned char)*i->p;
                 if (ch != '\0') {
                         i->p++;
-                        i->last_char = ch;
-#if ENABLE_HUSH_LINENO_VAR
-                        if (ch == '\n') {
-                                G.parse_lineno++;
-                                debug_printf_parse("G.parse_lineno++ = %u\n", G.parse_lineno);
-                        }
+                        goto out;
+                }
+#if ENABLE_HUSH_ALIAS
+                if (i->saved_ibuf) {
+                        i_free_alias_buffer(i);
+                        goto again;
+                }
 #endif
-                        return ch;
+                /* If string-based in_str, end-of-string is EOF */
+                if (!i->file) {
+                        debug_printf("i_getch: got EOF from string\n");
+                        return EOF;
                 }
-                return EOF;
         }
 
         /* FILE-based in_str */
 
-#if ENABLE_FEATURE_EDITING
-        /* This can be stdin, check line editing char[] buffer */
-        if (i->p && *i->p != '\0') {
-                ch = (unsigned char)*i->p++;
-                goto out;
-        }
-#endif
-        /* peek_buf[] is an int array, not char. Can contain EOF. */
+        /* Use what i_peek / i_peek2 saved (if anything) */
+        /* peek_buf[] is an int array, not char - can contain EOF */
         ch = i->peek_buf[0];
         if (ch != 0) {
                 int ch2 = i->peek_buf[1];
@@ -2838,70 +3020,71 @@ static int i_getch(struct in_str *i)
                 goto out;
         }
 
-        ch = fgetc_interactive(i);
+        ch = i_getch_interactive(i);
  out:
-        debug_printf("file_get: got '%c' %d\n", ch, ch);
-        i->last_char = ch;
+        debug_printf("i_getch: got '%c' %d\n", ch, ch);
 #if ENABLE_HUSH_LINENO_VAR
         if (ch == '\n') {
                 G.parse_lineno++;
                 debug_printf_parse("G.parse_lineno++ = %u\n", G.parse_lineno);
         }
 #endif
+        i->last_char = ch;
         return ch;
 }
 
+/* Called often, has optimizations to make it faster:
+ * = May return NUL instead of EOF.
+ *   It's ok because use cases are "got '&', peek next ch to see whether it is '&'"
+ * = Must not be called after '\n' (it would cause unexpected line editing prompt).
+ */
 static int i_peek(struct in_str *i)
 {
         int ch;
 
-        if (!i->file) {
-                /* string-based in_str */
-                /* Doesn't report EOF on NUL. None of the callers care. */
+        if (i->p) {
+                /* string-based in_str, or line editing buffer, or alias buffer */
+#if ENABLE_HUSH_ALIAS
+                if (*i->p == '\0' && i->saved_ibuf) {
+                        /* corner case: "an_alias&&..." expansion will have
+                         * i->p = "<alias_expansion>&", i->saved_ibuf = "&..."
+                         * and at the end of it, we must not return NUL,
+                         * this would logically split && into & & during parsing.
+                         */
+                        return (unsigned char)*i->saved_ibuf;
+                }
+#endif
                 return (unsigned char)*i->p;
         }
 
-        /* FILE-based in_str */
+        /* Now we know it is a file-based in_str. */
 
-#if ENABLE_FEATURE_EDITING && ENABLE_HUSH_INTERACTIVE
-        /* This can be stdin, check line editing char[] buffer */
-        if (i->p && *i->p != '\0')
-                return (unsigned char)*i->p;
-#endif
         /* peek_buf[] is an int array, not char. Can contain EOF. */
         ch = i->peek_buf[0];
-        if (ch != 0)
-                return ch;
+        if (ch == 0) {
+                /* We did not read it yet, get it now */
+                do ch = hfgetc(i->file); while (ch == '\0');
+                i->peek_buf[0] = ch;
+        }
 
-        /* Need to get a new char */
-        ch = fgetc_interactive(i);
         debug_printf("file_peek: got '%c' %d\n", ch, ch);
-
-        /* Save it by either rolling back line editing buffer, or in i->peek_buf[0] */
-#if ENABLE_FEATURE_EDITING && ENABLE_HUSH_INTERACTIVE
-        if (i->p) {
-                i->p -= 1;
-                return ch;
-        }
-#endif
-        i->peek_buf[0] = ch;
-        /*i->peek_buf[1] = 0; - already is */
         return ch;
 }
 
-/* Only ever called if i_peek() was called, and did not return EOF.
- * IOW: we know the previous peek saw an ordinary char, not EOF, not NUL,
- * not end-of-line. Therefore we never need to read a new editing line here.
+/* Called if i_peek() was called, and saw an ordinary char
+ * (not EOF, not NUL, not end-of-line).
+ * Therefore we never need to read a new editing line here.
  */
 static int i_peek2(struct in_str *i)
 {
         int ch;
 
-        /* There are two cases when i->p[] buffer exists.
+        /* There are three cases when i->p[] buffer exists.
+         * (0) alias expansion in progress.
          * (1) it's a string in_str.
          * (2) It's a file, and we have a saved line editing buffer.
-         * In both cases, we know that i->p[0] exists and not NUL, and
-         * the peek2 result is in i->p[1].
+         * In all cases, we know that i->p[0] exists and not NUL.
+         * The peek2 result is in i->p[1].
          */
         if (i->p)
                 return (unsigned char)i->p[1];
@@ -3003,7 +3186,7 @@ static void o_grow_by(o_string *o, int len)
         }
 }
 
-static void o_addchr(o_string *o, int ch)
+static ALWAYS_INLINE void INLINED_o_addchr(o_string *o, int ch)
 {
         debug_printf("o_addchr: '%c' o->length=%d o=%p\n", ch, o->length, o);
         if (o->length < o->maxlen) {
@@ -3017,6 +3200,10 @@ static void o_addchr(o_string *o, int ch)
         o_grow_by(o, 1);
         goto add;
 }
+static void o_addchr(o_string *o, int ch)
+{
+        INLINED_o_addchr(o, ch);
+}
 
 #if 0
 /* Valid only if we know o_string is not empty */
@@ -3127,7 +3314,7 @@ static void o_addqchr(o_string *o, int ch)
 static void o_addQchr(o_string *o, int ch)
 {
         int sz = 1;
-        if ((o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)
+        if ((o->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS)
          && strchr("*?[-\\" MAYBE_BRACES, ch)
         ) {
                 sz++;
@@ -3170,7 +3357,7 @@ static void o_addqblock(o_string *o, const char *str, int len)
 
 static void o_addQblock(o_string *o, const char *str, int len)
 {
-        if (!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS)) {
+        if (!(o->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS)) {
                 o_addblock(o, str, len);
                 return;
         }
@@ -3182,6 +3369,11 @@ static void o_addQstr(o_string *o, const char *str)
         o_addQblock(o, str, strlen(str));
 }
 
+static void o_addqstr(o_string *o, const char *str)
+{
+        o_addqblock(o, str, strlen(str));
+}
+
 /* A special kind of o_string for $VAR and `cmd` expansion.
  * It contains char* list[] at the beginning, which is grown in 16 element
  * increments. Actual string data starts at the next multiple of 16 * (char*).
@@ -3200,11 +3392,11 @@ static void debug_print_list(const char *prefix, o_string *o, int n)
         int i = 0;
 
         indent();
-        fdprintf(2, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d glob:%d quoted:%d escape:%d\n",
+        fdprintf(2, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d do_glob:%d has_quoted:%d globprotect:%d\n",
                         prefix, list, n, string_start, o->length, o->maxlen,
-                        !!(o->o_expflags & EXP_FLAG_GLOB),
+                        !!(o->o_expflags & EXP_FLAG_DO_GLOBBING),
                         o->has_quoted_part,
-                        !!(o->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+                        !!(o->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS));
         while (i < n) {
                 indent();
                 fdprintf(2, " list[%d]=%d '%s' %p\n", i, (int)(uintptr_t)list[i],
@@ -3327,7 +3519,19 @@ static int glob_needed(const char *s)
                         s += 2;
                         continue;
                 }
-                if (*s == '*' || *s == '[' || *s == '?' || *s == '{')
+                if (*s == '*' || *s == '?')
+                        return 1;
+                /* Only force glob if "..[..].." detected.
+                 * Not merely "[", "[[", "][" etc.
+                 * Optimization to avoid glob()
+                 * on "[ COND ]" and "[[ COND ]]":
+                 *  strace hush -c 'i=0; while [ $((++i)) != 50000 ]; do :; done'
+                 * shouldn't be doing 50000 stat("[").
+                 * (Can do it for "{" too, but it's not a common case).
+                 */
+                if (*s == '[' && strchr(s+1, ']'))
+                        return 1;
+                if (*s == '{' /* && strchr(s+1, '}')*/)
                         return 1;
                 s++;
         }
@@ -3518,7 +3722,16 @@ static int glob_needed(const char *s)
                         s += 2;
                         continue;
                 }
-                if (*s == '*' || *s == '[' || *s == '?')
+                if (*s == '*' || *s == '?')
+                        return 1;
+                /* Only force glob if "..[..].." detected.
+                 * Not merely "[", "[[", "][" etc.
+                 * Optimization to avoid glob()
+                 * on "[ COND ]" and "[[ COND ]]":
+                 *  strace hush -c 'i=0; while [ $((++i)) != 50000 ]; do :; done'
+                 * shouldn't be doing 50000 stat("[").
+                 */
+                if (*s == '[' && strchr(s+1, ']'))
                         return 1;
                 s++;
         }
@@ -3585,11 +3798,11 @@ static int perform_glob(o_string *o, int n)
 
 #endif /* !HUSH_BRACE_EXPANSION */
 
-/* If o->o_expflags & EXP_FLAG_GLOB, glob the string so far remembered.
+/* If o->o_expflags & EXP_FLAG_DO_GLOBBING, glob the string so far remembered.
  * Otherwise, just finish current list[] and start new */
 static int o_save_ptr(o_string *o, int n)
 {
-        if (o->o_expflags & EXP_FLAG_GLOB) {
+        if (o->o_expflags & EXP_FLAG_DO_GLOBBING) {
                 /* If o->has_empty_slot, list[n] was already globbed
                  * (if it was requested back then when it was filled)
                  * so don't do that again! */
@@ -3665,8 +3878,8 @@ static struct pipe *free_pipe(struct pipe *pi)
                 //command->group_as_string = NULL;
 #endif
                 for (r = command->redirects; r; r = rnext) {
-                        debug_printf_clean("   redirect %d%s",
-                                        r->rd_fd, redir_table[r->rd_type].descrip);
+                        debug_printf_clean("   redirect %d%.3s",
+                                        r->rd_fd, redir_table[r->rd_type].descrip3);
                         /* guard against the case >$FOO, where foo is unset or blank */
                         if (r->rd_filename) {
                                 debug_printf_clean(" fname:'%s'\n", r->rd_filename);
@@ -3735,7 +3948,7 @@ static void debug_print_tree(struct pipe *pi, int lvl)
 # endif
 # if ENABLE_HUSH_CASE
                 [RES_CASE ] = "CASE" ,
-                [RES_CASE_IN ] = "CASE_IN" ,
+                [RES_CASE_IN] = "CASE_IN",
                 [RES_MATCH] = "MATCH",
                 [RES_CASE_BODY] = "CASE_BODY",
                 [RES_ESAC ] = "ESAC" ,
@@ -3744,11 +3957,13 @@ static void debug_print_tree(struct pipe *pi, int lvl)
                 [RES_SNTX ] = "SNTX" ,
         };
         static const char *const CMDTYPE[] ALIGN_PTR = {
-                "{}",
-                "()",
-                "[noglob]",
+                "{}",       //CMD_NORMAL
+                "()",       //CMD_SUBSHELL
+                "[test2]",  //CMD_TEST2_SINGLEWORD_NOGLOB
+                "[noglob]", //CMD_SINGLEWORD_NOGLOB
 # if ENABLE_HUSH_FUNCTIONS
-                "func()",
+                "func()",   //CMD_FUNCTION_KWORD
+                "funcdef",  //CMD_FUNCDEF
 # endif
         };
 
@@ -3812,9 +4027,11 @@ static struct pipe *new_pipe(void)
         return pi;
 }
 
-/* Command (member of a pipe) is complete, or we start a new pipe
- * if ctx->command is NULL.
- * No errors possible here.
+/* Parsing of command (member of a pipe) is completed.
+ * If it's not null, a new empty command structure is added
+ * to the current pipe, and ctx->command is set to it.
+ * Return the current number of already parsed commands in the pipe.
+ * No errors are possible here.
  */
 static int done_command(struct parse_context *ctx)
 {
@@ -3830,17 +4047,16 @@ static int done_command(struct parse_context *ctx)
                 ctx->pending_redirect = NULL;
         }
 #endif
-
         if (command) {
                 if (IS_NULL_CMD(command)) {
-                        debug_printf_parse("done_command: skipping null cmd, num_cmds=%d\n", pi->num_cmds);
+                        debug_printf_parse("done_command: skipping null cmd, num_cmds:%d\n", pi->num_cmds);
                         goto clear_and_ret;
                 }
                 pi->num_cmds++;
                 debug_printf_parse("done_command: ++num_cmds=%d\n", pi->num_cmds);
                 //debug_print_tree(ctx->list_head, 20);
         } else {
-                debug_printf_parse("done_command: initializing, num_cmds=%d\n", pi->num_cmds);
+                debug_printf_parse("done_command: initializing, num_cmds:%d\n", pi->num_cmds);
         }
 
         /* Only real trickiness here is that the uncommitted
@@ -3851,21 +4067,36 @@ static int done_command(struct parse_context *ctx)
         memset(command, 0, sizeof(*command));
 #if ENABLE_HUSH_LINENO_VAR
         command->lineno = G.parse_lineno;
-        debug_printf_parse("command->lineno = G.parse_lineno (%u)\n", G.parse_lineno);
+        debug_printf_parse("command->lineno=G.parse_lineno (%u)\n", G.parse_lineno);
 #endif
-        return pi->num_cmds; /* used only for 0/nonzero check */
+        return pi->num_cmds;
 }
 
-static void done_pipe(struct parse_context *ctx, pipe_style type)
+/* Parsing of a pipe is completed.
+ * Finish parsing current command via done_command().
+ * (If the pipe is not empty, but done_command() did not change the number
+ * of commands in pipe, return value is 1. Used for catching syntax errors)
+ * Then append a new pipe with one empty command.
+ */
+static int done_pipe(struct parse_context *ctx, pipe_style type)
 {
-        int not_null;
+        int num_cmds;
+        int oldnum;
+        int last_cmd_is_null;
 
         debug_printf_parse("done_pipe entered, followup %d\n", type);
         /* Close previous command */
-        not_null = done_command(ctx);
+        oldnum = ctx->pipe->num_cmds;
+        num_cmds = done_command(ctx);
+
+        /* This is true if this was a non-empty pipe,
+         * but done_command didn't add a new member to it.
+         * Usually it is a syntax error.
+         * Examples: "date | | ...", "date | ; ..."
+         */
+        last_cmd_is_null = (oldnum != 0 && num_cmds == oldnum);
+
 #if HAS_KEYWORDS
-        ctx->pipe->pi_inverted = ctx->ctx_inverted;
-        ctx->ctx_inverted = 0;
         ctx->pipe->res_word = ctx->ctx_res_w;
 #endif
         if (type == PIPE_BG && ctx->list_head != ctx->pipe) {
@@ -3904,7 +4135,7 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
                 ctx->list_head = ctx->pipe = pi;
                 /* for cases like "cmd && &", do not be tricked by last command
                  * being null - the entire {...} & is NOT null! */
-                not_null = 1;
+                num_cmds = 1;
         } else {
  no_conv:
                 ctx->pipe->followup = type;
@@ -3912,8 +4143,8 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
 
         /* Without this check, even just <enter> on command line generates
          * tree of three NOPs (!). Which is harmless but annoying.
-         * IOW: it is safe to do it unconditionally. */
-        if (not_null
+         * IOW: it is safe to do the following unconditionally. */
+        if (num_cmds != 0
 #if ENABLE_HUSH_IF
          || ctx->ctx_res_w == RES_FI
 #endif
@@ -3928,37 +4159,39 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
         ) {
                 struct pipe *new_p;
                 debug_printf_parse("done_pipe: adding new pipe: "
-                                "not_null:%d ctx->ctx_res_w:%d\n",
-                                not_null, ctx->ctx_res_w);
+                                "num_cmds:%d ctx->ctx_res_w:%d\n",
+                                num_cmds, ctx->ctx_res_w);
                 new_p = new_pipe();
                 ctx->pipe->next = new_p;
                 ctx->pipe = new_p;
                 /* RES_THEN, RES_DO etc are "sticky" -
                  * they remain set for pipes inside if/while.
                  * This is used to control execution.
-                 * RES_FOR and RES_IN are NOT sticky (needed to support
-                 * cases where variable or value happens to match a keyword):
                  */
 #if ENABLE_HUSH_LOOPS
+                /* RES_FOR and RES_IN are NOT sticky (needed to support
+                 * cases where variable or value happens to match a keyword):
+                 */
                 if (ctx->ctx_res_w == RES_FOR
                  || ctx->ctx_res_w == RES_IN)
                         ctx->ctx_res_w = RES_NONE;
 #endif
 #if ENABLE_HUSH_CASE
-                if (ctx->ctx_res_w == RES_MATCH)
-                        ctx->ctx_res_w = RES_CASE_BODY;
                 if (ctx->ctx_res_w == RES_CASE)
                         ctx->ctx_res_w = RES_CASE_IN;
+                if (ctx->ctx_res_w == RES_MATCH)
+                        ctx->ctx_res_w = RES_CASE_BODY;
 #endif
-                ctx->command = NULL; /* trick done_command below */
                 /* Create the memory for command, roughly:
                  * ctx->pipe->cmds = new struct command;
                  * ctx->command = &ctx->pipe->cmds[0];
                  */
+                ctx->command = NULL;
                 done_command(ctx);
                 //debug_print_tree(ctx->list_head, 10);
         }
-        debug_printf_parse("done_pipe return\n");
+        debug_printf_parse("done_pipe return: last_cmd_is_null:%d\n", last_cmd_is_null);
+        return last_cmd_is_null;
 }
 
 static void initialize_context(struct parse_context *ctx)
@@ -3972,6 +4205,10 @@ static void initialize_context(struct parse_context *ctx)
          * ctx->command = &ctx->pipe->cmds[0];
          */
         done_command(ctx);
+        /* If very first arg is "" or '', ctx.word.data may end up NULL.
+         * Prevent this:
+         */
+        ctx->word.data = xzalloc(1); /* start as "", not as NULL */
 }
 
 /* If a reserved word is found and processed, parse context is modified
@@ -4008,39 +4245,39 @@ enum {
         FLAG_START = (1 << RES_XXXX ),
 };
 
-static const struct reserved_combo* match_reserved_word(o_string *word)
-{
-        /* Mostly a list of accepted follow-up reserved words.
-         * FLAG_END means we are done with the sequence, and are ready
-         * to turn the compound list into a command.
-         * FLAG_START means the word must start a new compound list.
-         */
-        static const struct reserved_combo reserved_list[] ALIGN4 = {
+/* Mostly a list of accepted follow-up reserved words.
+ * FLAG_END means we are done with the sequence, and are ready
+ * to turn the compound list into a command.
+ * FLAG_START means the word must start a new compound list.
+ */
+static const struct reserved_combo reserved_list[] ALIGN4 = {
 # if ENABLE_HUSH_IF
-                { "!",     RES_NONE,  NOT_ASSIGNMENT  , 0 },
-                { "if",    RES_IF,    MAYBE_ASSIGNMENT, FLAG_THEN | FLAG_START },
-                { "then",  RES_THEN,  MAYBE_ASSIGNMENT, FLAG_ELIF | FLAG_ELSE | FLAG_FI },
-                { "elif",  RES_ELIF,  MAYBE_ASSIGNMENT, FLAG_THEN },
-                { "else",  RES_ELSE,  MAYBE_ASSIGNMENT, FLAG_FI   },
-                { "fi",    RES_FI,    NOT_ASSIGNMENT  , FLAG_END  },
+        { "!",     RES_NONE,  NOT_ASSIGNMENT  , 0 },
+        { "if",    RES_IF,    MAYBE_ASSIGNMENT, FLAG_THEN | FLAG_START },
+        { "then",  RES_THEN,  MAYBE_ASSIGNMENT, FLAG_ELIF | FLAG_ELSE | FLAG_FI },
+        { "elif",  RES_ELIF,  MAYBE_ASSIGNMENT, FLAG_THEN },
+        { "else",  RES_ELSE,  MAYBE_ASSIGNMENT, FLAG_FI   },
+        { "fi",    RES_FI,    NOT_ASSIGNMENT  , FLAG_END  },
 # endif
 # if ENABLE_HUSH_LOOPS
-                { "for",   RES_FOR,   NOT_ASSIGNMENT  , FLAG_IN | FLAG_DO | FLAG_START },
-                { "while", RES_WHILE, MAYBE_ASSIGNMENT, FLAG_DO | FLAG_START },
-                { "until", RES_UNTIL, MAYBE_ASSIGNMENT, FLAG_DO | FLAG_START },
-                { "in",    RES_IN,    NOT_ASSIGNMENT  , FLAG_DO   },
-                { "do",    RES_DO,    MAYBE_ASSIGNMENT, FLAG_DONE },
-                { "done",  RES_DONE,  NOT_ASSIGNMENT  , FLAG_END  },
+        { "for",   RES_FOR,   NOT_ASSIGNMENT  , FLAG_IN | FLAG_DO | FLAG_START },
+        { "while", RES_WHILE, MAYBE_ASSIGNMENT, FLAG_DO | FLAG_START },
+        { "until", RES_UNTIL, MAYBE_ASSIGNMENT, FLAG_DO | FLAG_START },
+        { "in",    RES_IN,    NOT_ASSIGNMENT  , FLAG_DO   },
+        { "do",    RES_DO,    MAYBE_ASSIGNMENT, FLAG_DONE },
+        { "done",  RES_DONE,  NOT_ASSIGNMENT  , FLAG_END  },
 # endif
 # if ENABLE_HUSH_CASE
-                { "case",  RES_CASE,  NOT_ASSIGNMENT  , FLAG_MATCH | FLAG_START },
-                { "esac",  RES_ESAC,  NOT_ASSIGNMENT  , FLAG_END  },
+        { "case",  RES_CASE,  NOT_ASSIGNMENT  , FLAG_MATCH | FLAG_START },
+        { "esac",  RES_ESAC,  NOT_ASSIGNMENT  , FLAG_END  },
 # endif
-        };
+};
+static const struct reserved_combo* match_reserved_word(const char *word)
+{
         const struct reserved_combo *r;
 
         for (r = reserved_list; r < reserved_list + ARRAY_SIZE(reserved_list); r++) {
-                if (strcmp(word->data, r->literal) == 0)
+                if (strcmp(word, r->literal) == 0)
                         return r;
         }
         return NULL;
@@ -4051,16 +4288,36 @@ static const struct reserved_combo* reserved_word(struct parse_context *ctx)
 {
 # if ENABLE_HUSH_CASE
         static const struct reserved_combo reserved_match = {
-                "",        RES_MATCH, NOT_ASSIGNMENT , FLAG_MATCH | FLAG_ESAC
+                "", RES_MATCH, NOT_ASSIGNMENT, FLAG_MATCH | FLAG_ESAC
         };
 # endif
         const struct reserved_combo *r;
 
-        if (ctx->word.has_quoted_part)
-                return 0;
-        r = match_reserved_word(&ctx->word);
+# if ENABLE_HUSH_FUNCTION_KEYWORD
+        /* This is ~60 bytes smaller than adding "function" to reserved_list[] */
+        if (strcmp(ctx->word.data, "function") == 0) {
+                ctx->command->cmd_type = CMD_FUNCTION_KWORD;
+                /* Return something harmless !NULL */
+                return &reserved_list[0];
+        }
+# endif
+
+        r = match_reserved_word(ctx->word.data);
         if (!r)
                 return r; /* NULL */
+# if ENABLE_HUSH_CASE /* "case" syntax has a curveball */
+        if (ctx->ctx_res_w == RES_MATCH
+         && r->res != RES_ESAC
+        ) {
+                /* We are at WORD in ";; WORD" or "case .. in WORD".
+                 * Here, only "esac" is a keyword.
+                 * Else WORD is a case pattern, can be keyword-like:
+                 *  if) echo got_if;;
+                 * is allowed.
+                 */
+                return NULL;
+        }
+# endif
 
         debug_printf("found reserved word %s, res %d\n", r->literal, r->res);
 # if ENABLE_HUSH_CASE
@@ -4070,11 +4327,13 @@ static const struct reserved_combo* reserved_word(struct parse_context *ctx)
         } else
 # endif
         if (r->flag == 0) { /* '!' */
-                if (ctx->ctx_inverted) { /* bash doesn't accept '! ! true' */
-                        syntax_error("! ! command");
+                if (ctx->pipe->num_cmds != 0 /* bash disallows: nice | ! cat */
+                /* || ctx->pipe->pi_inverted - bash used to disallow "! ! true" bash 5.2.15 allows it */
+                ) {
+                        syntax_error_unexpected_ch('!');
                         ctx->ctx_res_w = RES_SNTX;
                 }
-                ctx->ctx_inverted = 1;
+                ctx->pipe->pi_inverted = 1 - ctx->pipe->pi_inverted;
                 return r;
         }
         if (r->flag & FLAG_START) {
@@ -4141,8 +4400,11 @@ static const struct reserved_combo* reserved_word(struct parse_context *ctx)
 }
 #endif /* HAS_KEYWORDS */
 
-/* Word is complete, look at it and update parsing context.
- * Normal return is 0. Syntax errors return 1.
+/* Parsing of a word is complete.
+ * Look at it and update current command:
+ * update current command's argv/cmd_type/etc, fill in redirect name and type,
+ * check reserved-ness and assignment-ness, etc...
+ * Normal return is 0. Syntax errors print error message and return 1.
  * Note: on return, word is reset, but not o_free'd!
  */
 static int done_word(struct parse_context *ctx)
@@ -4150,8 +4412,8 @@ static int done_word(struct parse_context *ctx)
         struct command *command = ctx->command;
 
         debug_printf_parse("done_word entered: '%s' %p\n", ctx->word.data, command);
-        if (ctx->word.length == 0 && !ctx->word.has_quoted_part) {
-                debug_printf_parse("done_word return 0: true null, ignored\n");
+        if (IS_NULL_WORD(ctx->word)) {
+                debug_printf_parse("done_word return 0: no word, ignored\n");
                 return 0;
         }
 
@@ -4178,7 +4440,7 @@ static int done_word(struct parse_context *ctx)
 // as written:
 // <<EOF$t
 // <<EOF$((1))
-// <<EOF`true`  [this case also makes heredoc "quoted", a-la <<"EOF". Probably bash-4.3.43 bug]
+// <<EOF`true`  [bash 4.3.43 bug: this case also makes heredoc "quoted", a-la <<"EOF". Fixed by 5.2.15]
 
                 ctx->pending_redirect->rd_filename = xstrdup(ctx->word.data);
                 /* Cater for >\file case:
@@ -4195,124 +4457,124 @@ static int done_word(struct parse_context *ctx)
                 }
                 debug_printf_parse("word stored in rd_filename: '%s'\n", ctx->word.data);
                 ctx->pending_redirect = NULL;
-        } else {
+                goto ret;
+        }
+
 #if HAS_KEYWORDS
-# if ENABLE_HUSH_CASE
-                if (ctx->ctx_dsemicolon
-                 && strcmp(ctx->word.data, "esac") != 0 /* not "... pattern) cmd;; esac" */
-                ) {
-                        /* already done when ctx_dsemicolon was set to 1: */
-                        /* ctx->ctx_res_w = RES_MATCH; */
-                        ctx->ctx_dsemicolon = 0;
-                } else
-# endif
 # if defined(CMD_TEST2_SINGLEWORD_NOGLOB)
-                if (command->cmd_type == CMD_TEST2_SINGLEWORD_NOGLOB
-                 && strcmp(ctx->word.data, "]]") == 0
-                ) {
-                        /* allow "[[ ]] >file" etc */
-                        command->cmd_type = CMD_SINGLEWORD_NOGLOB;
-                } else
+        if (command->cmd_type == CMD_TEST2_SINGLEWORD_NOGLOB
+         && !ctx->word.has_quoted_part
+         && strcmp(ctx->word.data, "]]") == 0
+        ) {
+                /* End test2-specific parsing rules */
+                /* Allow "[[ ]] >file" etc (> is a redirect symbol again) */
+                command->cmd_type = CMD_SINGLEWORD_NOGLOB;
+        } else
 # endif
-                if (!command->argv /* if it's the first word... */
+        /* Is it a place where keyword can appear? */
+//FIXME: this is wrong, it allows invalid syntax: { echo t; } if true; then echo YES; fi
+        if ((!command->argv             /* if it's the first word of command... */
+# if ENABLE_HUSH_FUNCTIONS
+            || command->cmd_type == CMD_FUNCDEF /* ^^^ or after FUNC() {} */
+# endif
+            )
+         && !ctx->word.has_quoted_part /* ""WORD never matches any keywords */
+         && !command->redirects        /* no redirects yet... disallows: </dev/null if true; then... */
 # if ENABLE_HUSH_LOOPS
-                 && ctx->ctx_res_w != RES_FOR /* ...not after FOR or IN */
-                 && ctx->ctx_res_w != RES_IN
+         && ctx->ctx_res_w != RES_FOR  /* not after "for" or "in" */
+         && ctx->ctx_res_w != RES_IN
 # endif
 # if ENABLE_HUSH_CASE
-                 && ctx->ctx_res_w != RES_CASE
+         && ctx->ctx_res_w != RES_CASE /* not after "case" */
 # endif
-                ) {
-                        const struct reserved_combo *reserved;
-                        reserved = reserved_word(ctx);
-                        debug_printf_parse("checking for reserved-ness: %d\n", !!reserved);
-                        if (reserved) {
+        ) {
+                const struct reserved_combo *reserved;
+                reserved = reserved_word(ctx);
+                debug_printf_parse("checking for reserved-ness: %d\n", !!reserved);
+                if (reserved) {
 # if ENABLE_HUSH_LINENO_VAR
 /* Case:
- * "while ...; do
- *      cmd ..."
+ * while ...; do
+ *     CMD
  * If we don't close the pipe _now_, immediately after "do", lineno logic
- * sees "cmd" as starting at "do" - i.e., at the previous line.
+ * sees CMD as starting at "do" - i.e., at the previous line.
  */
-                                if (0
-                                 IF_HUSH_IF(|| reserved->res == RES_THEN)
-                                 IF_HUSH_IF(|| reserved->res == RES_ELIF)
-                                 IF_HUSH_IF(|| reserved->res == RES_ELSE)
-                                 IF_HUSH_LOOPS(|| reserved->res == RES_DO)
-                                ) {
-                                        done_pipe(ctx, PIPE_SEQ);
-                                }
-# endif
-                                o_reset_to_empty_unquoted(&ctx->word);
-                                debug_printf_parse("done_word return %d\n",
-                                                (ctx->ctx_res_w == RES_SNTX));
-                                return (ctx->ctx_res_w == RES_SNTX);
+                        if (0
+                         IF_HUSH_IF(|| reserved->res == RES_THEN)
+                         IF_HUSH_IF(|| reserved->res == RES_ELIF)
+                         IF_HUSH_IF(|| reserved->res == RES_ELSE)
+                         IF_HUSH_LOOPS(|| reserved->res == RES_DO)
+                        ) {
+                                done_pipe(ctx, PIPE_SEQ);
                         }
+# endif
+                        o_reset_to_empty_unquoted(&ctx->word);
+                        debug_printf_parse("done_word return %d\n",
+                                        (ctx->ctx_res_w == RES_SNTX));
+                        return (ctx->ctx_res_w == RES_SNTX);
+                }
 # if defined(CMD_TEST2_SINGLEWORD_NOGLOB)
-                        if (strcmp(ctx->word.data, "[[") == 0) {
-                                command->cmd_type = CMD_TEST2_SINGLEWORD_NOGLOB;
-                        } else
+                if (strcmp(ctx->word.data, "[[") == 0) {
+                        /* Inside [[ ]], parsing rules are different */
+                        command->cmd_type = CMD_TEST2_SINGLEWORD_NOGLOB;
+                } else
 # endif
 # if defined(CMD_SINGLEWORD_NOGLOB)
-                        if (0
-                        /* In bash, local/export/readonly are special, args
-                         * are assignments and therefore expansion of them
-                         * should be "one-word" expansion:
-                         *  $ export i=`echo 'a  b'` # one arg: "i=a  b"
-                         * compare with:
-                         *  $ ls i=`echo 'a  b'`     # two args: "i=a" and "b"
-                         *  ls: cannot access i=a: No such file or directory
-                         *  ls: cannot access b: No such file or directory
-                         * Note: bash 3.2.33(1) does this only if export word
-                         * itself is not quoted:
-                         *  $ export i=`echo 'aaa  bbb'`; echo "$i"
-                         *  aaa  bbb
-                         *  $ "export" i=`echo 'aaa  bbb'`; echo "$i"
-                         *  aaa
-                         */
-                         IF_HUSH_LOCAL(   || strcmp(ctx->word.data, "local") == 0)
-                         IF_HUSH_EXPORT(  || strcmp(ctx->word.data, "export") == 0)
-                         IF_HUSH_READONLY(|| strcmp(ctx->word.data, "readonly") == 0)
-                        ) {
-                                command->cmd_type = CMD_SINGLEWORD_NOGLOB;
-                        }
+                if (0
+                /* In bash, local/export/readonly are special, args
+                 * are assignments and therefore expansion of them
+                 * should be "one-word" expansion:
+                 *  $ export i=`echo 'a  b'` # one arg: "i=a  b"
+                 * compare with:
+                 *  $ ls i=`echo 'a  b'`     # two args: "i=a" and "b"
+                 *  ls: cannot access i=a: No such file or directory
+                 *  ls: cannot access b: No such file or directory
+                 * Note: bash 3.2.33(1) does this only if export word
+                 * itself is not quoted:
+                 *  $ export i=`echo 'aaa  bbb'`; echo "$i"
+                 *  aaa  bbb
+                 *  $ "export" i=`echo 'aaa  bbb'`; echo "$i"
+                 *  aaa
+                 */
+                 IF_HUSH_LOCAL(   || strcmp(ctx->word.data, "local") == 0)
+                 IF_HUSH_EXPORT(  || strcmp(ctx->word.data, "export") == 0)
+                 IF_HUSH_READONLY(|| strcmp(ctx->word.data, "readonly") == 0)
+                ) {
+                        command->cmd_type = CMD_SINGLEWORD_NOGLOB;
+                }
 # else
-                        { /* empty block to pair "if ... else" */ }
+                { /* empty block to pair "if ... else" */ }
 # endif
-                }
+        }
 #endif /* HAS_KEYWORDS */
 
-                if (command->group) {
-                        /* "{ echo foo; } echo bar" - bad */
-                        syntax_error_at(ctx->word.data);
-                        debug_printf_parse("done_word return 1: syntax error, "
-                                        "groups and arglists don't mix\n");
-                        return 1;
-                }
+        if (command->group) {
+                /* "{ echo foo; } echo bar" - bad */
+                syntax_error_at(ctx->word.data);
+                debug_printf_parse("done_word return 1: syntax error, "
+                                "groups and arglists don't mix\n");
+                return 1;
+        }
 
-                /* If this word wasn't an assignment, next ones definitely
-                 * can't be assignments. Even if they look like ones. */
-                if (ctx->is_assignment != DEFINITELY_ASSIGNMENT
-                 && ctx->is_assignment != WORD_IS_KEYWORD
-                ) {
-                        ctx->is_assignment = NOT_ASSIGNMENT;
-                } else {
-                        if (ctx->is_assignment == DEFINITELY_ASSIGNMENT) {
-                                command->assignment_cnt++;
-                                debug_printf_parse("++assignment_cnt=%d\n", command->assignment_cnt);
-                        }
-                        debug_printf_parse("ctx->is_assignment was:'%s'\n", assignment_flag[ctx->is_assignment]);
-                        ctx->is_assignment = MAYBE_ASSIGNMENT;
-                }
-                debug_printf_parse("ctx->is_assignment='%s'\n", assignment_flag[ctx->is_assignment]);
-                command->argv = add_string_to_strings(command->argv, xstrdup(ctx->word.data));
-                debug_print_strings("word appended to argv", command->argv);
+        /* If this word wasn't an assignment, next ones definitely
+         * can't be assignments. Even if they look like ones. */
+        if (ctx->is_assignment != DEFINITELY_ASSIGNMENT) {
+                ctx->is_assignment = NOT_ASSIGNMENT;
+        } else {
+                /* This was an assignment word, next one maybe will be too */
+                command->assignment_cnt++;
+                debug_printf_parse("++assignment_cnt=%d\n", command->assignment_cnt);
+                ctx->is_assignment = MAYBE_ASSIGNMENT;
         }
+        debug_printf_parse("ctx->is_assignment='%s'\n", assignment_flag[ctx->is_assignment]);
+
+        command->argv = add_string_to_strings(command->argv, xstrdup(ctx->word.data));
+        debug_print_strings("word appended to argv", command->argv);
 
 #if ENABLE_HUSH_LOOPS
         if (ctx->ctx_res_w == RES_FOR) {
                 if (ctx->word.has_quoted_part
-                 || endofname(command->argv[0])[0] != '\0'
+                 || endofname(ctx->word.data)[0] != '\0'
                 ) {
                         /* bash says just "not a valid identifier" */
                         syntax_error("bad for loop variable");
@@ -4327,13 +4589,16 @@ static int done_word(struct parse_context *ctx)
 #endif
 #if ENABLE_HUSH_CASE
         /* Force CASE to have just one word */
-        if (ctx->ctx_res_w == RES_CASE) {
+        if (ctx->ctx_res_w == RES_CASE)
                 done_pipe(ctx, PIPE_SEQ);
-        }
+//TODO syntax check?
+//      if (ctx->ctx_res_w == RES_MATCH)
+//              eat all following spaces and tabs (but not newlines),
+//              check that next char is | or )
 #endif
 
+ ret:
         o_reset_to_empty_unquoted(&ctx->word);
-
         debug_printf_parse("done_word return 0\n");
         return 0;
 }
@@ -4368,7 +4633,7 @@ static int parse_redir_right_fd(o_string *as_string, struct in_str *input)
         }
         d = 0;
         ok = 0;
-        while (ch != EOF && isdigit(ch)) {
+        while (/*ch != EOF &&*/ isdigit(ch)) {
                 d = d*10 + (ch-'0');
                 ok = 1;
                 ch = i_getch(input);
@@ -4396,31 +4661,31 @@ static int parse_redirect(struct parse_context *ctx,
         int dup_num;
 
         dup_num = REDIRFD_TO_FILE;
-        if (style != REDIRECT_HEREDOC) {
+        if (style != REDIRECT_HEREDOC && style != REDIRECT_HERESTRING) {
                 /* Check for a '>&1' type redirect */
                 dup_num = parse_redir_right_fd(&ctx->as_string, input);
                 if (dup_num == REDIRFD_SYNTAX_ERR)
                         return 1;
-        } else {
-                int ch = i_peek_and_eat_bkslash_nl(input);
-                dup_num = (ch == '-'); /* HEREDOC_SKIPTABS bit is 1 */
-                if (dup_num) { /* <<-... */
-                        ch = i_getch(input);
-                        nommu_addchr(&ctx->as_string, ch);
-                        ch = i_peek(input);
+                if (style == REDIRECT_OVERWRITE && dup_num == REDIRFD_TO_FILE) {
+                        int ch = i_peek_and_eat_bkslash_nl(input);
+                        if (ch == '|') {
+                                /* >|FILE redirect ("clobbering" >).
+                                 * Since we do not support "set -o noclobber" yet,
+                                 * >| and > are the same for now. Just eat |.
+                                 */
+                                ch = i_getch(input);
+                                nommu_addchr(&ctx->as_string, ch);
+                        }
                 }
-        }
-
-        if (style == REDIRECT_OVERWRITE && dup_num == REDIRFD_TO_FILE) {
+        } else if (style == REDIRECT_HEREDOC) {
                 int ch = i_peek_and_eat_bkslash_nl(input);
-                if (ch == '|') {
-                        /* >|FILE redirect ("clobbering" >).
-                         * Since we do not support "set -o noclobber" yet,
-                         * >| and > are the same for now. Just eat |.
-                         */
+                dup_num = (ch == '-'); /* HEREDOC_SKIPTABS bit is 1 */
+                if (dup_num) { /* "<<-HEREDOC"? */
                         ch = i_getch(input);
                         nommu_addchr(&ctx->as_string, ch);
                 }
+        } else { /* REDIRECT_HERESTRING */
+                dup_num  = 0; /* make sure no bits like HEREDOC_QUOTED are set */
         }
 
         /* Create a new redir_struct and append it to the linked list */
@@ -4434,11 +4699,14 @@ static int parse_redirect(struct parse_context *ctx,
         redir->rd_type = style;
         redir->rd_fd = (fd == -1) ? redir_table[style].default_fd : fd;
 
-        debug_printf_parse("redirect type %d %s\n", redir->rd_fd,
-                                redir_table[style].descrip);
+        debug_printf_parse("redirect type %d %.3s\n", redir->rd_fd,
+                                redir_table[style].descrip3);
 
         redir->rd_dup = dup_num;
-        if (style != REDIRECT_HEREDOC && dup_num != REDIRFD_TO_FILE) {
+        if (style != REDIRECT_HEREDOC
+         && style != REDIRECT_HERESTRING
+         && dup_num != REDIRFD_TO_FILE
+        ) {
                 /* Erik had a check here that the file descriptor in question
                  * is legit; I postpone that to "run time"
                  * A "-" representation of "close me" shows up as a -3 here */
@@ -4447,7 +4715,7 @@ static int parse_redirect(struct parse_context *ctx,
         } else {
 #if 0           /* Instead we emit error message at run time */
                 if (ctx->pending_redirect) {
-                        /* For example, "cmd > <file" */
+                        /* For example, "CMD > <FILE" */
                         syntax_error("invalid redirect");
                 }
 #endif
@@ -4462,10 +4730,10 @@ static int parse_redirect(struct parse_context *ctx,
  * supposed to tell which file descriptor to redirect.  This routine
  * looks for such preceding numbers.  In an ideal world this routine
  * needs to handle all the following classes of redirects...
- *     echo 2>foo     # redirects fd  2 to file "foo", nothing passed to echo
- *     echo 49>foo    # redirects fd 49 to file "foo", nothing passed to echo
- *     echo -2>foo    # redirects fd  1 to file "foo",    "-2" passed to echo
- *     echo 49x>foo   # redirects fd  1 to file "foo",   "49x" passed to echo
+ *     echo 2>FILE     # redirects fd  2 to FILE, nothing passed to echo
+ *     echo 49>FILE    # redirects fd 49 to FILE, nothing passed to echo
+ *     echo -2>FILE    # redirects fd  1 to FILE,    "-2" passed to echo
+ *     echo 49x>FILE   # redirects fd  1 to FILE,   "49x" passed to echo
  *
  * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
  * "2.7 Redirection
@@ -4502,7 +4770,7 @@ static char *fetch_till_str(o_string *as_string,
 {
         o_string heredoc = NULL_O_STRING;
         unsigned past_EOL;
-        int prev = 0; /* not \ */
+        int prev = 0; /* not '\' */
         int ch;
 
         /* Starting with "" is necessary for this case:
@@ -4538,7 +4806,15 @@ static char *fetch_till_str(o_string *as_string,
                                         past_EOL = heredoc.length;
                                         /* Get 1st char of next line, possibly skipping leading tabs */
                                         do {
-                                                ch = i_getch(input);
+                                                if (heredoc_flags & HEREDOC_QUOTED)
+                                                        ch = i_getch(input);
+                                                else { /* see heredoc_bkslash_newline3a.tests:
+                                                         * cat <<-EOF
+                                                         * <tab>\
+                                                         * <tab>EOF
+                                                         */
+                                                        ch = i_getch_and_eat_bkslash_nl(input);
+                                                }
                                                 if (ch != EOF)
                                                         nommu_addchr(as_string, ch);
                                         } while ((heredoc_flags & HEREDOC_SKIPTABS) && ch == '\t');
@@ -4564,7 +4840,7 @@ static char *fetch_till_str(o_string *as_string,
                                 prev = 0; /* not '\' */
                                 continue;
                         }
-                }
+                } /* if (\n or EOF) */
                 if (ch == EOF) {
                         o_free(&heredoc);
                         return NULL; /* error */
@@ -4607,6 +4883,11 @@ static int fetch_heredocs(o_string *as_string, struct pipe *pi, int heredoc_cnt,
 
                                         redir->rd_type = REDIRECT_HEREDOC2;
                                         /* redir->rd_dup is (ab)used to indicate <<- */
+                                        if (!redir->rd_filename) {
+                                                /* examples: "echo <<", "echo <<<", "echo <<>" */
+                                                syntax_error("missing here document terminator");
+                                                return -1;
+                                        }
                                         p = fetch_till_str(as_string, input,
                                                         redir->rd_filename, redir->rd_dup);
                                         if (!p) {
@@ -4643,8 +4924,7 @@ static struct pipe *parse_stream(char **pstring,
                 struct in_str *input,
                 int end_trigger);
 
-/* Returns number of heredocs not yet consumed,
- * or -1 on error.
+/* Returns number of heredocs not yet consumed, or -1 on error.
  */
 static int parse_group(struct parse_context *ctx,
                 struct in_str *input, int ch)
@@ -4664,25 +4944,36 @@ static int parse_group(struct parse_context *ctx,
 
         debug_printf_parse("parse_group entered\n");
 #if ENABLE_HUSH_FUNCTIONS
-        if (ch == '(' && !ctx->word.has_quoted_part) {
+        if ((ch == '('
+# if ENABLE_HUSH_FUNCTION_KEYWORD
+            || command->cmd_type == CMD_FUNCTION_KWORD /* "function WORD" */
+# endif
+            )
+         && !ctx->word.has_quoted_part
+        ) {
                 if (ctx->word.length)
                         if (done_word(ctx))
                                 return -1;
                 if (!command->argv)
                         goto skip; /* (... */
                 if (command->argv[1]) { /* word word ... (... */
-                        syntax_error_unexpected_ch('(');
+                        if (ch == '(')
+                                syntax_error_unexpected_ch('(');
+                        else
+                                syntax_error("expected funcdef");
                         return -1;
                 }
-                /* it is "word(..." or "word (..." */
-                do
-                        ch = i_getch(input);
-                while (ch == ' ' || ch == '\t');
-                if (ch != ')') {
-                        syntax_error_unexpected_ch(ch);
-                        return -1;
+                if (ch == '(') {
+                        /* it is "word(..." or "word (..." */
+                        do
+                                ch = i_getch(input);
+                        while (ch == ' ' || ch == '\t');
+                        if (ch != ')') {
+                                syntax_error_unexpected_ch(ch);
+                                return -1;
+                        }
+                        nommu_addchr(&ctx->as_string, ch);
                 }
-                nommu_addchr(&ctx->as_string, ch);
                 do
                         ch = i_getch(input);
                 while (ch == ' ' || ch == '\t' || ch == '\n');
@@ -4703,13 +4994,10 @@ static int parse_group(struct parse_context *ctx,
 
 #if 0 /* Prevented by caller */
         if (command->argv /* word [word]{... */
-         || ctx->word.length /* word{... */
-         || ctx->word.has_quoted_part /* ""{... */
+         || !IS_NULL_WORD(ctx->word) /* word{... or ""{... */
         ) {
-                syntax_error(NULL);
                 debug_printf_parse("parse_group return -1: "
                         "syntax error, groups and arglists don't mix\n");
-                return -1;
         }
 #endif
 
@@ -4987,16 +5275,16 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
 # if BB_MMU
 #define parse_dollar_squote(as_string, dest, input) \
         parse_dollar_squote(dest, input)
-#define as_string NULL
 # endif
 static int parse_dollar_squote(o_string *as_string, o_string *dest, struct in_str *input)
 {
         int start;
         int ch = i_peek_and_eat_bkslash_nl(input);  /* first character after the $ */
-        debug_printf_parse("parse_dollar_squote entered: ch='%c'\n", ch);
+
         if (ch != '\'')
                 return 0;
 
+        debug_printf_parse("parse_dollar_squote entered: ch='%c'\n", ch);
         dest->has_quoted_part = 1;
         start = dest->length;
 
@@ -5071,7 +5359,6 @@ static int parse_dollar_squote(o_string *as_string, o_string *dest, struct in_st
         }
 
         return 1;
-# undef as_string
 }
 #else
 # define parse_dollar_squote(as_string, dest, input) 0
@@ -5349,7 +5636,6 @@ static int parse_dollar(o_string *as_string,
 #if BB_MMU
 #define encode_string(as_string, dest, input, dquote_end) \
         encode_string(dest, input, dquote_end)
-#define as_string NULL
 #endif
 static int encode_string(o_string *as_string,
                 o_string *dest,
@@ -5376,8 +5662,8 @@ static int encode_string(o_string *as_string,
         if (ch != '\n') {
                 next = i_peek(input);
         }
-        debug_printf_parse("\" ch=%c (%d) escape=%d\n",
-                        ch, ch, !!(dest->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
+        debug_printf_parse("\" ch:%c (%d) globprotect:%d\n",
+                        ch, ch, !!(dest->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS));
         if (ch == '\\') {
                 if (next == EOF) {
                         /* Testcase: in interactive shell a file with
@@ -5405,8 +5691,6 @@ static int encode_string(o_string *as_string,
                 goto again;
         }
         if (ch == '$') {
-                //if (parse_dollar_squote(as_string, dest, input))
-                //      goto again;
                 if (!parse_dollar(as_string, dest, input, /*quote_mask:*/ 0x80)) {
                         debug_printf_parse("encode_string return 0: "
                                         "parse_dollar returned 0 (error)\n");
@@ -5433,9 +5717,113 @@ static int encode_string(o_string *as_string,
                 o_addchr(dest, SPECIAL_VAR_SYMBOL);
         }
         goto again;
-#undef as_string
 }
 
+#if ENABLE_HUSH_ALIAS
+static char* end_of_alias_name(const char *name)
+{
+        while (*name) {
+                if (!isalnum(*name)
+// Uncommented chars are allowed in alias names.
+// Commented out with // are disallowed in bash: space, "$&'();<=>\`|
+// Commented out with //bb are allowed in bash, but disallowed in hush: !#*-/?[]{}~
+// (do you really want alias named '?' to be allowed?)
+//               && *name != ' '  // 20
+//bb             && *name != '!'  // 21
+//               && *name != '"'  // 22
+//bb             && *name != '#'  // 23
+//               && *name != '$'  // 24
+                 && *name != '%'  // 25
+//               && *name != '&'  // 26
+//               && *name != '\'' // 27
+//               && *name != '('  // 28
+//               && *name != ')'  // 29
+//bb             && *name != '*'  // 2a
+                 && *name != '+'  // 2b
+                 && *name != ','  // 2c
+//bb             && *name != '-'  // 2d bash _can_ set it: "alias -- -=STR" (and it lists it as "alias -- -='STR'" in "alias" output!)
+                 && *name != '.'  // 2e seen Fedora defining alias "l."
+//bb             && *name != '/'  // 2f
+                 && *name != ':'  // 3a
+//               && *name != ';'  // 3b
+//               && *name != '<'  // 3c
+//               && *name != '='  // 3d
+//               && *name != '>'  // 3e
+//bb             && *name != '?'  // 3f
+                 && *name != '@'  // 40
+//bb             && *name != '['  // 5b
+//               && *name != '\\' // 5c
+//bb             && *name != ']'  // 5d
+                 && *name != '^'  // 5e
+                 && *name != '_'  // 5f
+//               && *name != '`'  // 60
+//bb             && *name != '{'  // 7b
+//               && *name != '|'  // 7c
+//bb             && *name != '}'  // 7d
+//bb             && *name != '~'  // 7e
+                ) {
+                        break; /* disallowed char, stop */
+                }
+                name++;
+        }
+        return (char*)name;
+}
+#define is_name(c)      ((c) == '_' || isalpha((unsigned char)(c)))
+#define is_in_name(c)   ((c) == '_' || isalnum((unsigned char)(c)))
+
+static struct alias **find_alias_slot(const char *name, const char *eq)
+{
+        unsigned len;
+        struct alias *alias;
+        struct alias **aliaspp;
+
+        len = eq - name;
+        aliaspp = &G.top_alias;
+        while ((alias = *aliaspp) != NULL) {
+                //bb_error_msg("alias->str'%s' name'%.*s'", alias->str, len, name);
+                if (strncmp(name, alias->str, len) == 0
+                 && alias->str[len] == '='
+                ) {
+                        //bb_error_msg("match!");
+                        break;
+                }
+                aliaspp = &alias->next;
+        }
+        return aliaspp;
+}
+
+static ALWAYS_INLINE const struct alias *find_alias(const char *name)
+{
+        //bb_error_msg("%s:%d: -> find_alias_slot", __func__, __LINE__);
+        return *find_alias_slot(name, strchr(name, '\0'));
+}
+
+static const struct alias *word_matches_alias(struct parse_context *ctx)
+{
+        if (ctx->ctx_res_w != RES_CASE_BODY
+/*       && !ctx.command->argv - caller checked this */
+         && !ctx->word.has_quoted_part
+         && ctx->word.data[0] != '\0' /* optimization */
+        ) {
+                const char *word = ctx->word.data;
+                const char *end = end_of_alias_name(word);
+                if (*end == '\0') {
+                        struct alias *alias;
+
+                        //bb_error_msg("%s:%d: -> find_alias_slot", __func__, __LINE__);
+                        alias = *find_alias_slot(word, end);
+                        if (alias && !alias->dont_recurse) {
+                                alias->dont_recurse = 1;
+                                o_reset_to_empty_unquoted(&ctx->word);
+                                return alias;
+                        }
+                }
+        }
+        return NULL;
+}
+
+#endif /* ENABLE_HUSH_ALIAS */
+
 /*
  * Scan input until EOF or end_trigger char.
  * Return a list of pipes to execute, or NULL on EOF
@@ -5449,6 +5837,8 @@ static struct pipe *parse_stream(char **pstring,
                 struct in_str *input,
                 int end_trigger)
 {
+        IF_HUSH_ALIAS(const struct alias *alias;)
+        struct pipe *pi;
         struct parse_context ctx;
         int heredoc_cnt;
 
@@ -5459,13 +5849,9 @@ static struct pipe *parse_stream(char **pstring,
                         end_trigger ? end_trigger : 'X');
         debug_enter();
 
+        enable_all_aliases();
         initialize_context(&ctx);
 
-        /* If very first arg is "" or '', ctx.word.data may end up NULL.
-         * Preventing this:
-         */
-        ctx.word.data = xzalloc(1); /* start as "", not as NULL */
-
         /* We used to separate words on $IFS here. This was wrong.
          * $IFS is used only for word splitting when $var is expanded,
          * here we should use blank chars as separators, not $IFS
@@ -5473,74 +5859,29 @@ static struct pipe *parse_stream(char **pstring,
 
         heredoc_cnt = 0;
         while (1) {
-                const char *is_blank;
-                const char *is_special;
                 int ch;
                 int next;
                 int redir_fd;
                 redir_type redir_style;
 
                 ch = i_getch(input);
-                debug_printf_parse(": ch=%c (%d) escape=%d\n",
-                                ch, ch, !!(ctx.word.o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                if (ch == EOF) {
-                        struct pipe *pi;
-
-                        if (heredoc_cnt) {
-                                syntax_error_unterm_str("here document");
-                                goto parse_error_exitcode1;
-                        }
-                        if (end_trigger == ')') {
-                                syntax_error_unterm_ch('(');
-                                goto parse_error_exitcode1;
-                        }
-                        if (end_trigger == '}') {
-                                syntax_error_unterm_ch('{');
-                                goto parse_error_exitcode1;
-                        }
-
-                        if (done_word(&ctx)) {
-                                goto parse_error_exitcode1;
-                        }
-                        o_free_and_set_NULL(&ctx.word);
-                        done_pipe(&ctx, PIPE_SEQ);
-
-                        /* Do we sit inside of any if's, loops or case's? */
-                        if (HAS_KEYWORDS
-                        IF_HAS_KEYWORDS(&& (ctx.ctx_res_w != RES_NONE || ctx.old_flag != 0))
-                        ) {
-                                syntax_error_unterm_str("compound statement");
-                                goto parse_error_exitcode1;
-                        }
-
-                        pi = ctx.list_head;
-                        /* If we got nothing... */
-                        /* (this makes bare "&" cmd a no-op.
-                         * bash says: "syntax error near unexpected token '&'") */
-                        if (pi->num_cmds == 0
-                        IF_HAS_KEYWORDS(&& pi->res_word == RES_NONE)
-                        ) {
-                                free_pipe_list(pi);
-                                pi = NULL;
-                        }
-#if !BB_MMU
-                        debug_printf_parse("as_string1 '%s'\n", ctx.as_string.data);
-                        if (pstring)
-                                *pstring = ctx.as_string.data;
-                        else
-                                o_free(&ctx.as_string);
-#endif
-                        // heredoc_cnt must be 0 here anyway
-                        //if (heredoc_cnt_ptr)
-                        //      *heredoc_cnt_ptr = heredoc_cnt;
-                        debug_leave();
-                        debug_printf_heredoc("parse_stream return heredoc_cnt:%d\n", heredoc_cnt);
-                        debug_printf_parse("parse_stream return %p: EOF\n", pi);
-                        return pi;
+                debug_printf_parse(": ch:%c (%d) globprotect:%d\n",
+                                ch, ch, !!(ctx.word.o_expflags & EXP_FLAG_GLOBPROTECT_CHARS));
+# if ENABLE_HUSH_NEED_FOR_SPEED
+                if ((ch >= '.' && ch <= ':') /* ASCII "./0123456789:" */
+                        /* can't include preceding "+,-" above: "-" needs glob-escaping (example?) */
+                 || (ch >= '@' && ch <= 'Z') /* ASCII "@A..Z" */
+                 || (ch >= 'a' && ch <= 'z') /* ASCII "a..Z" */
+                        /* can't include preceding "^_`" above because of "`". Pity. "_" is relatively common */
+                ) {
+                        /* These are never special and just go into the current word */
+                        /* ~5% faster parsing of typical shell scripts */
+                        INLINED_o_addchr(&ctx.word, ch);
+                        continue;
                 }
-
+#endif
                 /* Handle "'" and "\" first, as they won't play nice with
-                 * i_peek_and_eat_bkslash_nl() anyway:
+                 * i_peek_and_eat_bkslash_nl():
                  *   echo z\\
                  * and
                  *   echo '\
@@ -5561,9 +5902,9 @@ static struct pipe *parse_stream(char **pstring,
                         if (ch == EOF) {
                                 /* Testcase: eval 'echo Ok\' */
                                 /* bash-4.3.43 was removing backslash,
-                                 * but 4.4.19 retains it, most other shells too
+                                 * but 4.4.19 retains it, most other shells retain too
                                  */
-                                continue; /* get next char */
+                                break;
                         }
                         /* Example: echo Hello \2>file
                          * we need to know that word 2 is quoted
@@ -5573,14 +5914,25 @@ static struct pipe *parse_stream(char **pstring,
                         o_addchr(&ctx.word, ch);
                         continue; /* get next char */
                 }
+                if (ch == EOF)
+                        break;
                 nommu_addchr(&ctx.as_string, ch);
                 if (ch == '\'') {
                         ctx.word.has_quoted_part = 1;
-                        next = i_getch(input);
-                        if (next == '\'' && !ctx.pending_redirect)
-                                goto insert_empty_quoted_str_marker;
-
-                        ch = next;
+                        ch = i_getch(input);
+                        if (ch == '\'' && !ctx.pending_redirect/*why?*/) {
+ insert_empty_quoted_str_marker:
+                                nommu_addchr(&ctx.as_string, ch);
+//Just inserting nothing doesn't work: consider
+// CMD $EMPTYVAR
+// CMD ''
+//At execution time both will expand argv[1] to empty string
+//and thus the argument will "vanish".
+//But for second CMD, it should not vanish!
+                                o_addchr(&ctx.word, SPECIAL_VAR_SYMBOL);
+                                o_addchr(&ctx.word, SPECIAL_VAR_SYMBOL);
+                                continue; /* get next char */
+                        }
                         while (1) {
                                 if (ch == EOF) {
                                         syntax_error_unterm_ch('\'');
@@ -5600,135 +5952,173 @@ static struct pipe *parse_stream(char **pstring,
                         continue; /* get next char */
                 }
 
-                next = '\0';
-                if (ch != '\n')
-                        next = i_peek_and_eat_bkslash_nl(input);
-
-                is_special = "{}<>&|();#" /* special outside of "str" */
-                                "$\"" IF_HUSH_TICK("`") /* always special */
-                                SPECIAL_VAR_SYMBOL_STR;
-#if defined(CMD_TEST2_SINGLEWORD_NOGLOB)
-                if (ctx.command->cmd_type == CMD_TEST2_SINGLEWORD_NOGLOB) {
-                        /* In [[ ]], {}<>&|() are not special */
-                        is_special += 8;
-                } else
-#endif
-                /* Are { and } special here? */
-                if (ctx.command->argv /* word [word]{... - non-special */
-                 || ctx.word.length       /* word{... - non-special */
-                 || ctx.word.has_quoted_part     /* ""{... - non-special */
-                 || (next != ';'             /* }; - special */
-                    && next != ')'           /* }) - special */
-                    && next != '('           /* {( - special */
-                    && next != '&'           /* }& and }&& ... - special */
-                    && next != '|'           /* }|| ... - special */
-                    && !strchr(defifs, next) /* {word - non-special */
-                    )
-                ) {
-                        /* They are not special, skip "{}" */
-                        is_special += 2;
-                }
-                is_special = strchr(is_special, ch);
-                is_blank = strchr(defifs, ch);
-
-                if (!is_special && !is_blank) { /* ordinary char */
- ordinary_char:
-                        o_addQchr(&ctx.word, ch);
-                        if ((ctx.is_assignment == MAYBE_ASSIGNMENT
-                            || ctx.is_assignment == WORD_IS_KEYWORD)
-                         && ch == '='
-                         && endofname(ctx.word.data)[0] == '='
-                        ) {
-                                ctx.is_assignment = DEFINITELY_ASSIGNMENT;
-                                debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
+                if (ch == ' ' || ch == '\t') {
+#if ENABLE_HUSH_ALIAS
+                        /* Check for alias expansion (only for first word of command) */
+                        if (G_interactive_fd && !ctx.command->argv) {
+                                alias = word_matches_alias(&ctx);
+                                if (alias) {
+ add_to_albuf_and_get_next_char:
+                                        i_prepend_to_alias_buffer(input, strchr(alias->str, '=') + 1, ch);
+                                        continue; /* get next char (which will be from albuf) */
+                                }
                         }
-                        continue;
-                }
+#endif
 
-                if (is_blank) {
 #if ENABLE_HUSH_LINENO_VAR
-/* Case:
- * "while ...; do<whitespace><newline>
- *      cmd ..."
- * would think that "cmd" starts in <whitespace> -
+/* "while ...; do<whitespace><newline>
+ *     CMD"
+ * would think that CMD starts in <whitespace> -
  * i.e., at the previous line.
- * We need to skip all whitespace before newlines.
+ * Need to skip whitespace up to next newline (and eat it)
+ * or not-whitespace (and do not eat it).
  */
-                        while (ch != '\n') {
+                        for (;;) {
                                 next = i_peek(input);
                                 if (next != ' ' && next != '\t' && next != '\n')
                                         break; /* next char is not ws */
                                 ch = i_getch(input);
+                                if (ch == '\n')
+                                        goto ch_is_newline;
                         }
-                        /* ch == last eaten whitespace char */
 #endif
-                        if (done_word(&ctx)) {
+                        if (done_word(&ctx))
                                 goto parse_error_exitcode1;
+#if ENABLE_HUSH_FUNCTION_KEYWORD
+                        if (ctx.command->cmd_type == CMD_FUNCTION_KWORD
+                         && ctx.command->argv /* "function WORD" */
+                        )
+                                 goto parse_group;
+#endif
+                        continue;  /* get next char */
+                }
+
+                if (ch == '\n') {
+ IF_HUSH_LINENO_VAR(ch_is_newline:)
+#if ENABLE_HUSH_ALIAS
+                        /* Check for alias expansion (only for first word of command) */
+                        if (G_interactive_fd && !ctx.command->argv) {
+                                alias = word_matches_alias(&ctx);
+                                if (alias)
+                                        goto add_to_albuf_and_get_next_char;
                         }
-                        if (ch == '\n') {
-                                /* Is this a case when newline is simply ignored?
-                                 * Some examples:
-                                 * "cmd | <newline> cmd ..."
-                                 * "case ... in <newline> word) ..."
+#endif
+                        if (done_word(&ctx))
+                                goto parse_error_exitcode1;
+                        /* Is this a case when newline is simply ignored?
+                         * Some examples:
+                         * "CMD | <newline> CMD ..."
+                         * "case ... in <newline> PATTERN) ..."
+                         */
+                        if (IS_NULL_CMD(ctx.command)
+                         && heredoc_cnt == 0
+                        ) {
+                                /* This newline can be ignored. But...
+                                 * Without check #1, interactive shell
+                                 * ignores even bare <newline>,
+                                 * and shows the continuation prompt:
+                                 * ps1$ <enter>
+                                 * ps2> _   <=== wrong, should be ps1
+                                 * Without check #2, "CMD & <newline>"
+                                 * is similarly mistreated.
+                                 * (BTW, this makes "CMD & CMD"
+                                 * and "CMD && CMD" non-orthogonal.
+                                 * Really, ask yourself, why
+                                 * "CMD && <newline>" doesn't start
+                                 * CMD but waits for more input?
+                                 * The only reason is that it might be
+                                 * a "CMD1 && <nl> CMD2 &" construct:
+                                 * CMD1 may need to run in BG).
                                  */
-                                if (IS_NULL_CMD(ctx.command)
-                                 && ctx.word.length == 0
-                                 && !ctx.word.has_quoted_part
-                                 && heredoc_cnt == 0
+                                pi = ctx.list_head;
+                                if (pi->num_cmds != 0       /* check #1 */
+                                 && pi->followup != PIPE_BG /* check #2 */
                                 ) {
-                                        /* This newline can be ignored. But...
-                                         * Without check #1, interactive shell
-                                         * ignores even bare <newline>,
-                                         * and shows the continuation prompt:
-                                         * ps1_prompt$ <enter>
-                                         * ps2> _   <=== wrong, should be ps1
-                                         * Without check #2, "cmd & <newline>"
-                                         * is similarly mistreated.
-                                         * (BTW, this makes "cmd & cmd"
-                                         * and "cmd && cmd" non-orthogonal.
-                                         * Really, ask yourself, why
-                                         * "cmd && <newline>" doesn't start
-                                         * cmd but waits for more input?
-                                         * The only reason is that it might be
-                                         * a "cmd1 && <nl> cmd2 &" construct,
-                                         * cmd1 may need to run in BG).
-                                         */
-                                        struct pipe *pi = ctx.list_head;
-                                        if (pi->num_cmds != 0       /* check #1 */
-                                         && pi->followup != PIPE_BG /* check #2 */
-                                        ) {
-                                                continue;
-                                        }
+                                        debug_printf_parse("newline is treated as ws\n");
+                                        continue; /* ignore newline */
                                 }
-                                /* Treat newline as a command separator. */
-                                done_pipe(&ctx, PIPE_SEQ);
-                                debug_printf_heredoc("heredoc_cnt:%d\n", heredoc_cnt);
-                                if (heredoc_cnt) {
-                                        heredoc_cnt = fetch_heredocs(&ctx.as_string, ctx.list_head, heredoc_cnt, input);
-                                        if (heredoc_cnt != 0)
-                                                goto parse_error_exitcode1;
+                        }
+#if ENABLE_HUSH_FUNCTION_KEYWORD
+                        if (ctx.command->cmd_type == CMD_FUNCTION_KWORD) {
+                                if (!ctx.command->argv) {
+                                        /* Testcase: sh -c $'function\n' */
+                                        syntax_error("expected funcdef");
+                                        goto parse_error_exitcode1;
                                 }
-                                ctx.is_assignment = MAYBE_ASSIGNMENT;
-                                debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
-                                ch = ';';
-                                /* note: if (is_blank) continue;
-                                 * will still trigger for us */
+                                /* "function WORD" */
+                                goto parse_group;
+                        }
+#endif
+                        /* Treat newline as a command separator */
+                        done_pipe(&ctx, PIPE_SEQ);
+                        debug_printf_heredoc("heredoc_cnt:%d\n", heredoc_cnt);
+                        if (heredoc_cnt) {
+                                heredoc_cnt = fetch_heredocs(&ctx.as_string, ctx.list_head, heredoc_cnt, input);
+                                if (heredoc_cnt != 0)
+                                        goto parse_error_exitcode1;
+                        }
+                        ctx.is_assignment = MAYBE_ASSIGNMENT;
+                        debug_printf_parse("newline is treated as ';', ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
+                        next = '\0';
+                        ch = ';';
+                } else {
+                        const char *is_special;
+
+                        next = i_peek_and_eat_bkslash_nl(input);
+                        is_special = "{}<>&|();#" /* special outside of "str" */
+                                "$\"" IF_HUSH_TICK("`") /* always special */
+                                SPECIAL_VAR_SYMBOL_STR;
+#if defined(CMD_TEST2_SINGLEWORD_NOGLOB)
+                        if (ctx.command->cmd_type == CMD_TEST2_SINGLEWORD_NOGLOB) {
+                                /* In [[ ]], {}<>&|() are not special */
+                                is_special += 8;
+                        } else
+#endif
+                        /* Are { and } special here? */
+                        if ((ctx.command->argv /* WORD [WORD]{... - non-special */
+#if ENABLE_HUSH_FUNCTIONS
+                            && ctx.command->cmd_type != CMD_FUNCDEF /* ^^^ unless FUNC() {} */
+#endif
+                            )
+                         || !IS_NULL_WORD(ctx.word)  /* WORD{... ""{... - non-special */
+                         || (next != ';'             /* }; - special */
+                            && next != ')'           /* }) - special */
+                            && next != '('           /* {( - special */
+                            && next != '&'           /* }& and }&& ... - special */
+                            && next != '|'           /* }|| ... - special */
+                            && !strchr(defifs, next) /* {WORD - non-special */
+                            )
+                        ) {
+                                /* They are not special, skip "{}" */
+                                is_special += 2;
+                        }
+                        if (!strchr(is_special, ch)) { /* ordinary char? */
+ ordinary_char:
+                                o_addQchr(&ctx.word, ch);
+                                if (ctx.is_assignment == MAYBE_ASSIGNMENT
+                                 && ch == '='
+                                 && !ctx.word.has_quoted_part  /* a''=b a'b'c=d: not assignments */
+                                 && endofname(ctx.word.data)[0] == '='
+                                ) {
+                                        ctx.is_assignment = DEFINITELY_ASSIGNMENT;
+                                        debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
+                                }
+                                continue; /* get next char */
                         }
                 }
 
-                /* "cmd}" or "cmd }..." without semicolon or &:
-                 * } is an ordinary char in this case, even inside { cmd; }
-                 * Pathological example: { ""}; } should exec "}" cmd
+                /* "CMD}" or "CMD }..." without semicolon or &:
+                 * } is an ordinary char in this case, even inside { CMD; }
+                 * Pathological example: { ""}; } should run "}" command.
                  */
                 if (ch == '}') {
-                        if (ctx.word.length != 0 /* word} */
-                         || ctx.word.has_quoted_part    /* ""} */
-                        ) {
+                        if (!IS_NULL_WORD(ctx.word)) {
+                                /* WORD} or ""} */
                                 goto ordinary_char;
                         }
-                        if (!IS_NULL_CMD(ctx.command)) { /* cmd } */
-                                /* Generally, there should be semicolon: "cmd; }"
-                                 * However, bash allows to omit it if "cmd" is
+                        if (!IS_NULL_CMD(ctx.command)) { /* CMD } */
+                                /* Generally, there should be semicolon: "CMD; }"
+                                 * However, bash allows to omit it if "CMD" is
                                  * a group. Examples:
                                  * { { echo 1; } }
                                  * {(echo 1)}
@@ -5740,14 +6130,17 @@ static struct pipe *parse_stream(char **pstring,
                                         goto term_group;
                                 goto ordinary_char;
                         }
-                        if (!IS_NULL_PIPE(ctx.pipe)) /* cmd | } */
-                                /* Can't be an end of {cmd}, skip the check */
-                                goto skip_end_trigger;
+                        if (!IS_NULL_PIPE(ctx.pipe)) /* CMD | } */
+                                /* Can't be an end of {CMD}, skip the check */
+                                goto rbrace_skips_end_trigger;
                         /* else: } does terminate a group */
                 }
  term_group:
                 if (end_trigger && end_trigger == ch
-                 && (ch != ';' || heredoc_cnt == 0)
+                 && (ch != ';'
+                    /* it's ";". Can exit parse_stream() only if have no heredocs to consume, and alias buffer is empty */
+                    || (heredoc_cnt == 0 && !i_has_alias_buffer(input))
+                    )
 #if ENABLE_HUSH_CASE
                  && (ch != ')'
                     || ctx.ctx_res_w != RES_MATCH
@@ -5755,13 +6148,32 @@ static struct pipe *parse_stream(char **pstring,
                     )
 #endif
                 ) {
-                        if (done_word(&ctx)) {
+#if ENABLE_HUSH_ALIAS
+                        /* Check for alias expansion (only for first word of command) */
+                        if (G_interactive_fd && !ctx.command->argv) {
+                                alias = word_matches_alias(&ctx);
+                                if (alias)
+                                        goto add_to_albuf_and_get_next_char;
+                        }
+#endif
+                        if (done_word(&ctx))
+                                goto parse_error_exitcode1;
+#if ENABLE_HUSH_FUNCTION_KEYWORD
+                        if (ctx.command->cmd_type == CMD_FUNCTION_KWORD) {
+                                /* Testcase: sh -c '(function)' */
+                                syntax_error("expected funcdef");
                                 goto parse_error_exitcode1;
                         }
-                        done_pipe(&ctx, PIPE_SEQ);
+#endif
+                        if (done_pipe(&ctx, PIPE_SEQ)) {
+                                /* Testcase: sh -c 'date|;not_reached' */
+                                syntax_error_unterm_ch('|');
+                                goto parse_error_exitcode1;
+                        };
                         ctx.is_assignment = MAYBE_ASSIGNMENT;
                         debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
                         /* Do we sit outside of any if's, loops or case's? */
+//TODO? just check ctx.stack != NULL instead?
                         if (!HAS_KEYWORDS
                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
                         ) {
@@ -5786,21 +6198,18 @@ static struct pipe *parse_stream(char **pstring,
                                                 "end_trigger char found\n",
                                                 ctx.list_head);
                                 debug_leave();
+                                i_free_alias_buffer(input);
                                 return ctx.list_head;
                         }
                 }
 
-                if (is_blank)
-                        continue;
-
                 /* Catch <, > before deciding whether this word is
                  * an assignment. a=1 2>z b=2: b=2 is still assignment */
                 switch (ch) {
                 case '>':
                         redir_fd = redirect_opt_num(&ctx.word);
-                        if (done_word(&ctx)) {
+                        if (done_word(&ctx))
                                 goto parse_error_exitcode1;
-                        }
                         redir_style = REDIRECT_OVERWRITE;
                         if (next == '>') {
                                 redir_style = REDIRECT_APPEND;
@@ -5818,9 +6227,8 @@ static struct pipe *parse_stream(char **pstring,
                         continue; /* get next char */
                 case '<':
                         redir_fd = redirect_opt_num(&ctx.word);
-                        if (done_word(&ctx)) {
+                        if (done_word(&ctx))
                                 goto parse_error_exitcode1;
-                        }
                         redir_style = REDIRECT_INPUT;
                         if (next == '<') {
                                 redir_style = REDIRECT_HEREDOC;
@@ -5828,6 +6236,14 @@ static struct pipe *parse_stream(char **pstring,
                                 debug_printf_heredoc("++heredoc_cnt=%d\n", heredoc_cnt);
                                 ch = i_getch(input);
                                 nommu_addchr(&ctx.as_string, ch);
+                                /* Check for here-string (<<<) */
+                                next = i_peek(input);
+                                if (next == '<') {
+                                        redir_style = REDIRECT_HERESTRING;
+                                        ch = i_getch(input);
+                                        nommu_addchr(&ctx.as_string, ch);
+                                        heredoc_cnt--; /* here-strings don't use heredoc lines */
+                                }
                         } else if (next == '>') {
                                 redir_style = REDIRECT_IO;
                                 ch = i_getch(input);
@@ -5843,13 +6259,13 @@ static struct pipe *parse_stream(char **pstring,
                                 goto parse_error_exitcode1;
                         continue; /* get next char */
                 case '#':
-                        if (ctx.word.length == 0 && !ctx.word.has_quoted_part) {
-                                /* skip "#comment" */
+                        if (IS_NULL_WORD(ctx.word)) {
+                                /* skip "#COMMENT" */
                                 /* note: we do not add it to &ctx.as_string */
 /* TODO: in bash:
  * comment inside $() goes to the next \n, even inside quoted string (!):
- * cmd "$(cmd2 #comment)" - syntax error
- * cmd "`cmd2 #comment`" - ok
+ * CMD "$(CMD2 #COMMENT)" - syntax error
+ * CMD "`CMD2 #COMMENT`" - ok
  * We accept both (comment ends where command subst ends, in both cases).
  */
                                 while (1) {
@@ -5860,16 +6276,16 @@ static struct pipe *parse_stream(char **pstring,
                                         }
                                         ch = i_getch(input);
                                         if (ch == EOF)
-                                                break;
+                                                goto eof;
                                 }
                                 continue; /* get next char */
                         }
                         break;
                 }
- skip_end_trigger:
+ rbrace_skips_end_trigger:
 
                 if (ctx.is_assignment == MAYBE_ASSIGNMENT
-                 /* check that we are not in word in "a=1 2>word b=1": */
+                 /* check that we are not in WORD in "a=1 2>WORD b=1": */
                  && !ctx.pending_redirect
                 ) {
                         /* ch is a special char and thus this word
@@ -5892,8 +6308,8 @@ static struct pipe *parse_stream(char **pstring,
                         o_addchr(&ctx.word, ch);
                         continue; /* get next char */
                 case '$':
-                        if (parse_dollar_squote(&ctx.as_string, &ctx.word, input))
-                                continue; /* get next char */
+                        if (next == '\'' && parse_dollar_squote(&ctx.as_string, &ctx.word, input))
+                                continue; /* ate $'...', get next char */
                         if (!parse_dollar(&ctx.as_string, &ctx.word, input, /*quote_mask:*/ 0)) {
                                 debug_printf_parse("parse_stream parse error: "
                                         "parse_dollar returned 0 (error)\n");
@@ -5903,18 +6319,14 @@ static struct pipe *parse_stream(char **pstring,
                 case '"':
                         ctx.word.has_quoted_part = 1;
                         if (next == '"' && !ctx.pending_redirect) {
-                                i_getch(input); /* eat second " */
- insert_empty_quoted_str_marker:
-                                nommu_addchr(&ctx.as_string, next);
-                                o_addchr(&ctx.word, SPECIAL_VAR_SYMBOL);
-                                o_addchr(&ctx.word, SPECIAL_VAR_SYMBOL);
-                                continue; /* get next char */
+                                ch = i_getch(input); /* eat second " */
+                                goto insert_empty_quoted_str_marker;
                         }
                         if (ctx.is_assignment == NOT_ASSIGNMENT)
-                                ctx.word.o_expflags |= EXP_FLAG_ESC_GLOB_CHARS;
+                                ctx.word.o_expflags |= EXP_FLAG_GLOBPROTECT_CHARS;
                         if (!encode_string(&ctx.as_string, &ctx.word, input, '"'))
                                 goto parse_error_exitcode1;
-                        ctx.word.o_expflags &= ~EXP_FLAG_ESC_GLOB_CHARS;
+                        ctx.word.o_expflags &= ~EXP_FLAG_GLOBPROTECT_CHARS;
                         continue; /* get next char */
 #if ENABLE_HUSH_TICK
                 case '`': {
@@ -5935,112 +6347,240 @@ static struct pipe *parse_stream(char **pstring,
                 }
 #endif
                 case ';':
-#if ENABLE_HUSH_CASE
- case_semi:
+#if ENABLE_HUSH_ALIAS
+                        /* Check for alias expansion (only for first word of command) */
+                        if (G_interactive_fd && !ctx.command->argv) {
+                                alias = word_matches_alias(&ctx);
+                                if (alias)
+                                        goto add_to_albuf_and_get_next_char;
+                        }
 #endif
-                        if (done_word(&ctx)) {
+                        if (done_word(&ctx))
+                                goto parse_error_exitcode1;
+#if ENABLE_HUSH_FUNCTION_KEYWORD
+                        if (ctx.command->cmd_type == CMD_FUNCTION_KWORD) {
+                                /* Testcase: sh -c '{ function; }'; sh -c '{ function f; }' */
+                                syntax_error("expected funcdef");
                                 goto parse_error_exitcode1;
                         }
+#endif
                         done_pipe(&ctx, PIPE_SEQ);
 #if ENABLE_HUSH_CASE
-                        /* Eat multiple semicolons, detect
-                         * whether it means something special */
-                        while (1) {
-                                ch = i_peek_and_eat_bkslash_nl(input);
-                                if (ch != ';')
-                                        break;
+                        if (ctx.ctx_res_w == RES_CASE_BODY
+                         && next == ';' /* and next char is ';' too? */
+                        ) {
                                 ch = i_getch(input);
                                 nommu_addchr(&ctx.as_string, ch);
-                                if (ctx.ctx_res_w == RES_CASE_BODY) {
-                                        ctx.ctx_dsemicolon = 1;
-                                        ctx.ctx_res_w = RES_MATCH;
-                                        break;
-                                }
+                                ctx.ctx_res_w = RES_MATCH; /* "we are in PATTERN)" */
                         }
 #endif
- new_cmd:
+ finished_cmd:
                         /* We just finished a cmd. New one may start
                          * with an assignment */
                         ctx.is_assignment = MAYBE_ASSIGNMENT;
                         debug_printf_parse("ctx.is_assignment='%s'\n", assignment_flag[ctx.is_assignment]);
                         continue; /* get next char */
                 case '&':
-                        if (done_word(&ctx)) {
+#if ENABLE_HUSH_ALIAS
+                        /* Check for alias expansion (only for first word of command) */
+                        if (G_interactive_fd && !ctx.command->argv) {
+                                alias = word_matches_alias(&ctx);
+                                if (alias)
+                                        goto add_to_albuf_and_get_next_char;
+                        }
+#endif
+                        if (done_word(&ctx))
+                                goto parse_error_exitcode1;
+                        if (ctx.pipe->num_cmds == 0 && IS_NULL_CMD(ctx.command)) {
+                                /* Testcase: sh -c '&& date' */
+                                /* Testcase: sh -c '&' */
+                                syntax_error_unexpected_str("&&" + (next != '&'));
                                 goto parse_error_exitcode1;
                         }
                         if (next == '&') {
                                 ch = i_getch(input);
                                 nommu_addchr(&ctx.as_string, ch);
-                                done_pipe(&ctx, PIPE_AND);
+                                if (done_pipe(&ctx, PIPE_AND)) {
+                                        /* Testcase: sh -c 'date | && date' */
+                                        syntax_error_unterm_ch('|');
+                                        goto parse_error_exitcode1;
+                                }
                         } else {
-                                done_pipe(&ctx, PIPE_BG);
+                                if (done_pipe(&ctx, PIPE_BG)) {
+                                        /* Testcase: sh -c 'date | &' */
+                                        syntax_error_unterm_ch('|');
+                                        goto parse_error_exitcode1;
+                                }
                         }
-                        goto new_cmd;
+                        goto finished_cmd;
                 case '|':
-                        if (done_word(&ctx)) {
-                                goto parse_error_exitcode1;
-                        }
 #if ENABLE_HUSH_CASE
-                        if (ctx.ctx_res_w == RES_MATCH)
-                                break; /* we are in case's "word | word)" */
+                        if (ctx.ctx_res_w == RES_MATCH) {
+//                              if (IS_NULL_WORD(ctx.word)) {
+//                                      /* Testcase: sh -c 'case w in |w) nice; esac' */
+//                                      /* Testcase: sh -c 'case w in v||w) nice; esac' */
+//also rejects valid: sh -c 'case w in v |w) nice; esac'
+//                                      syntax_error_unexpected_ch(ch);
+//                                      goto parse_error_exitcode1;
+//                              }
+                                if (done_word(&ctx))
+                                        goto parse_error_exitcode1;
+                                continue; /* get next char */
+                        }
 #endif
+#if ENABLE_HUSH_ALIAS
+                        /* Check for alias expansion (only for first word of command) */
+                        if (G_interactive_fd && !ctx.command->argv) {
+                                alias = word_matches_alias(&ctx);
+                                if (alias)
+                                        goto add_to_albuf_and_get_next_char;
+                        }
+#endif
+                        if (done_word(&ctx))
+                                goto parse_error_exitcode1;
                         if (next == '|') { /* || */
                                 ch = i_getch(input);
                                 nommu_addchr(&ctx.as_string, ch);
-                                done_pipe(&ctx, PIPE_OR);
+                                if (ctx.pipe->num_cmds == 0 && IS_NULL_CMD(ctx.command)) {
+                                        /* Testcase: sh -c '|| date' */
+                                        syntax_error_unexpected_str("||");
+                                        goto parse_error_exitcode1;
+                                }
+                                if (done_pipe(&ctx, PIPE_OR)) {
+                                        /* Testcase: sh -c 'date | || date' */
+                                        syntax_error_unterm_ch('|');
+                                        goto parse_error_exitcode1;
+                                }
                         } else {
-                                /* we could pick up a file descriptor choice here
-                                 * with redirect_opt_num(), but bash doesn't do it.
-                                 * "echo foo 2| cat" yields "foo 2". */
+                                if (IS_NULL_CMD(ctx.command)) {
+                                        /* Testcase: sh -c '| cat' */
+                                        /* Testcase: sh -c 'date | | cat' */
+                                        syntax_error_unexpected_ch('|');
+                                        goto parse_error_exitcode1;
+                                }
                                 done_command(&ctx);
                         }
-                        goto new_cmd;
+                        goto finished_cmd;
                 case '(':
 #if ENABLE_HUSH_CASE
-                        /* "case... in [(]word)..." - skip '(' */
+                        /* "case... in (PATTERNS)..."? */
                         if (ctx.ctx_res_w == RES_MATCH
-                         && ctx.command->argv == NULL /* not (word|(... */
-                         && ctx.word.length == 0 /* not word(... */
-                         && ctx.word.has_quoted_part == 0 /* not ""(... */
+                         && ctx.command->argv == NULL /* not WORD (... */
+                         && IS_NULL_WORD(ctx.word)    /* not WORD(... or ""(... */
                         ) {
-                                continue; /* get next char */
+                                continue; /* skip '(',  get next char */
                         }
 #endif
                         /* fall through */
                 case '{': {
-                        int n = parse_group(&ctx, input, ch);
-                        if (n < 0) {
+                        int n;
+ /* "function WORD" -> */
+ IF_HUSH_FUNCTION_KEYWORD(parse_group:)
+                        /* Try to parse as { CMDS; } or (CMDS) */
+                        n = parse_group(&ctx, input, ch);
+                        if (n < 0)
                                 goto parse_error_exitcode1;
-                        }
                         debug_printf_heredoc("parse_group done, needs heredocs:%d\n", n);
                         heredoc_cnt += n;
-                        goto new_cmd;
+                        goto finished_cmd;
                 }
                 case ')':
 #if ENABLE_HUSH_CASE
-                        if (ctx.ctx_res_w == RES_MATCH)
-                                goto case_semi;
+                        if (ctx.ctx_res_w == RES_MATCH) {
+//                              if (IS_NULL_WORD(ctx.word)) {
+//                                      /* Testcase: sh -c 'case w in w|) nice; esac' */
+//also rejects valid: sh -c 'case w in w ) nice; esac'
+//                                      syntax_error_unexpected_ch(ch);
+//                                      goto parse_error_exitcode1;
+//                              }
+                                if (done_word(&ctx))
+                                        goto parse_error_exitcode1;
+//FIXME: accepts "W1 W2) CMD;;" as if it was "W1|W2) CMD;;", should not allow this syntax at all
+                                done_pipe(&ctx, PIPE_SEQ);
+                                goto finished_cmd;
+                        }
 #endif
-                case '}':
-                        /* proper use of this character is caught by end_trigger:
+                /* case ')' and !RES_MATCH: falls through to the error: */
+                        /* Testcase for bad ')' ? */
+                /* case '}': */
+                        /* Proper use of this character is caught by end_trigger:
                          * if we see {, we call parse_group(..., end_trigger='}')
-                         * and it will match } earlier (not here). */
+                         * and it will match } earlier (not here).
+                         */
+                        /* Testcase for bad '}' ? */
+                default: /* all other chars should not ever reach this... */
                         G.last_exitcode = 2;
                         syntax_error_unexpected_ch(ch);
                         goto parse_error;
-                default:
-                        if (HUSH_DEBUG)
-                                bb_error_msg_and_die("BUG: unexpected %c", ch);
                 }
         } /* while (1) */
+ eof:
+        /* Reached EOF */
+        if (heredoc_cnt) {
+                syntax_error_unterm_str("here document");
+                goto parse_error_exitcode1;
+        }
+        if (end_trigger == ')') {
+                syntax_error_unterm_ch('(');
+                goto parse_error_exitcode1;
+        }
+        if (end_trigger == '}') {
+                syntax_error_unterm_ch('{');
+                goto parse_error_exitcode1;
+        }
+
+        if (done_word(&ctx))
+                goto parse_error_exitcode1;
+#if ENABLE_HUSH_FUNCTION_KEYWORD
+        if (ctx.command->cmd_type == CMD_FUNCTION_KWORD) {
+                /* Testcase: sh -c 'function'; sh -c 'function f' */
+                syntax_error("expected funcdef");
+                goto parse_error_exitcode1;
+        }
+#endif
+        o_free_and_set_NULL(&ctx.word);
+        if (done_pipe(&ctx, PIPE_SEQ)) {
+                /* Testcase: sh -c 'date |' */
+                syntax_error_unterm_ch('|');
+                goto parse_error_exitcode1;
+        }
+// TODO: catch 'date &&<whitespace><EOF>' and 'date ||<whitespace><EOF>' too
+
+#if HAS_KEYWORDS
+        /* Do we sit inside of any if's, loops or case's? */
+        if (ctx.ctx_res_w != RES_NONE || ctx.old_flag != 0) {
+                syntax_error_unterm_str("compound statement");
+                goto parse_error_exitcode1;
+        }
+#endif
+        pi = ctx.list_head;
+        /* If we got nothing... */
+        if (pi->num_cmds == 0
+        IF_HAS_KEYWORDS(&& pi->res_word == RES_NONE)
+        ) {
+                free_pipe_list(pi);
+                pi = NULL;
+        }
+#if !BB_MMU
+        debug_printf_parse("as_string1 '%s'\n", ctx.as_string.data);
+        if (pstring)
+                *pstring = ctx.as_string.data;
+        else
+                o_free(&ctx.as_string);
+#endif
+        // heredoc_cnt must be 0 here anyway
+        //if (heredoc_cnt_ptr)
+        //      *heredoc_cnt_ptr = heredoc_cnt;
+        debug_leave();
+        debug_printf_heredoc("parse_stream return heredoc_cnt:%d\n", heredoc_cnt);
+        debug_printf_parse("parse_stream return %p: EOF\n", pi);
+        i_free_alias_buffer(input);
+        return pi;
 
  parse_error_exitcode1:
         G.last_exitcode = 1;
  parse_error:
         {
-                struct parse_context *pctx;
-                IF_HAS_KEYWORDS(struct parse_context *p2;)
-
                 /* Clean up allocated tree.
                  * Sample for finding leaks on syntax error recovery path.
                  * Run it from interactive shell, watch pmap `pidof hush`.
@@ -6049,44 +6589,39 @@ static struct pipe *parse_stream(char **pstring,
                  * while if (true | { true;}); then echo ok; fi; do break; done
                  * while if (true | { true;}); then echo ok; fi; do (if echo ok; break; then :; fi) | cat; break; done
                  */
-                pctx = &ctx;
+                IF_HAS_KEYWORDS(struct parse_context *stk;)
+                struct parse_context *pctx = &ctx;
                 do {
                         /* Update pipe/command counts,
                          * otherwise freeing may miss some */
                         done_pipe(pctx, PIPE_SEQ);
-                        debug_printf_clean("freeing list %p from ctx %p\n",
-                                        pctx->list_head, pctx);
+                        debug_printf_clean("freeing list %p from ctx %p\n", pctx->list_head, pctx);
                         debug_print_tree(pctx->list_head, 0);
                         free_pipe_list(pctx->list_head);
                         debug_printf_clean("freed list %p\n", pctx->list_head);
 #if !BB_MMU
                         o_free(&pctx->as_string);
 #endif
-                        IF_HAS_KEYWORDS(p2 = pctx->stack;)
-                        if (pctx != &ctx) {
+                        IF_HAS_KEYWORDS(stk = pctx->stack;)
+                        if (pctx != &ctx)
                                 free(pctx);
-                        }
-                        IF_HAS_KEYWORDS(pctx = p2;)
+                        IF_HAS_KEYWORDS(pctx = stk;)
                 } while (HAS_KEYWORDS && pctx);
-
-                o_free(&ctx.word);
+        }
+        o_free(&ctx.word);
 #if !BB_MMU
-                if (pstring)
-                        *pstring = NULL;
+        if (pstring)
+                *pstring = NULL;
 #endif
-                debug_leave();
-                return ERR_PTR;
-        }
+        debug_leave();
+        i_free_alias_buffer(input);
+        return ERR_PTR;
 }
 
 /*
  * Execution routines
  */
 /* Expansion can recurse, need forward decls: */
-#if !BASH_PATTERN_SUBST && !ENABLE_HUSH_CASE
-#define expand_string_to_string(str, EXP_flags, do_unbackslash) \
-        expand_string_to_string(str)
-#endif
 static char *expand_string_to_string(const char *str, int EXP_flags, int do_unbackslash);
 #if ENABLE_HUSH_TICK
 static int process_command_subs(o_string *dest, const char *s);
@@ -6151,7 +6686,7 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
                 word_len = strcspn(str, G.ifs);
                 if (word_len) {
                         /* We have WORD_LEN leading non-IFS chars */
-                        if (!(output->o_expflags & EXP_FLAG_GLOB)) {
+                        if (!(output->o_expflags & EXP_FLAG_DO_GLOBBING)) {
                                 o_addblock(output, str, word_len);
                         } else {
                                 /* Protect backslashes against globbing up :)
@@ -6244,7 +6779,7 @@ static char *encode_then_expand_string(const char *str)
 //TODO: error check (encode_string returns 0 on error)?
         //bb_error_msg("'%s' -> '%s'", str, dest.data);
         exp_str = expand_string_to_string(dest.data,
-                        EXP_FLAG_ESC_GLOB_CHARS,
+                        EXP_FLAG_GLOBPROTECT_CHARS, /* example: `echo '_\t_\\_\"_'` in heredoc */
                         /*unbackslash:*/ 1
         );
         //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
@@ -6279,15 +6814,11 @@ static const char *first_special_char_in_vararg(const char *cp)
  * a dquoted string: "${var#"zz"}"), the difference only comes later
  * (word splitting and globbing of the ${var...} result).
  */
-#if !BASH_PATTERN_SUBST
-#define encode_then_expand_vararg(str, handle_squotes, do_unbackslash) \
-        encode_then_expand_vararg(str, handle_squotes)
-#endif
-static char *encode_then_expand_vararg(const char *str, int handle_squotes, int do_unbackslash)
-{
-#if !BASH_PATTERN_SUBST && ENABLE_HUSH_CASE
-        const int do_unbackslash = 0;
-#endif
+static char *encode_then_expand_vararg(const char *str,
+                int handle_squotes,  /* 'str' substrings are parsed as literals (unless inside "")*/
+                int protect_vars,    /* glob-protect double-quoted $VARS */
+                int do_unbackslash   /* run unbackslash on result before returning it */
+) {
         char *exp_str;
         struct in_str input;
         o_string dest = NULL_O_STRING;
@@ -6322,7 +6853,7 @@ static char *encode_then_expand_vararg(const char *str, int handle_squotes, int
                         goto ret; /* error */
                 }
                 if (ch == '"') {
-                        dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
+                        dest.o_expflags ^= EXP_FLAG_GLOBPROTECT_CHARS;
                         continue;
                 }
                 if (ch == '\\') {
@@ -6338,7 +6869,10 @@ static char *encode_then_expand_vararg(const char *str, int handle_squotes, int
                 if (ch == '$') {
                         if (parse_dollar_squote(NULL, &dest, &input))
                                 continue;
-                        if (!parse_dollar(NULL, &dest, &input, /*quote_mask:*/ 0x80)) {
+                        if (!parse_dollar(NULL, &dest, &input,
+                                        /*quote_mask:*/ (dest.o_expflags & EXP_FLAG_GLOBPROTECT_CHARS) ? 0x80 : 0
+                                )
+                        ) {
                                 debug_printf_parse("%s: error: parse_dollar returned 0 (error)\n", __func__);
                                 goto ret;
                         }
@@ -6350,7 +6884,7 @@ static char *encode_then_expand_vararg(const char *str, int handle_squotes, int
                         o_addchr(&dest, SPECIAL_VAR_SYMBOL);
                         o_addchr(&dest, 0x80 | '`');
                         if (!add_till_backquote(&dest, &input,
-                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_ESC_GLOB_CHARS set */
+                                        /*in_dquote:*/ (dest.o_expflags & EXP_FLAG_GLOBPROTECT_CHARS)
                                 )
                         ) {
                                 goto ret; /* error */
@@ -6363,9 +6897,12 @@ static char *encode_then_expand_vararg(const char *str, int handle_squotes, int
                 o_addQchr(&dest, ch);
         } /* for (;;) */
 
-        debug_printf_parse("encode: '%s' -> '%s'\n", str, dest.data);
+        debug_printf_parse("encode(do_unbackslash:%d): '%s' -> '%s'\n", do_unbackslash, str, dest.data);
         exp_str = expand_string_to_string(dest.data,
-                        do_unbackslash ? EXP_FLAG_ESC_GLOB_CHARS : 0,
+                        0
+                        | (do_unbackslash ? EXP_FLAG_GLOBPROTECT_CHARS : 0)
+                        | (protect_vars ? EXP_FLAG_GLOBPROTECT_VARS : 0)
+                        ,
                         do_unbackslash
         );
  ret:
@@ -6409,7 +6946,10 @@ static NOINLINE int encode_then_append_var_plusminus(o_string *output, int n,
                 if (!dest.o_expflags) {
                         if (ch == EOF)
                                 break;
-                        if (!dquoted && !(output->o_expflags & EXP_FLAG_SINGLEWORD) && strchr(G.ifs, ch)) {
+                        if (!dquoted
+                         && !(output->o_expflags & EXP_FLAG_SINGLEWORD)
+                         && strchr(G.ifs, ch)
+                        ) {
                                 /* PREFIX${x:d${e}f ...} and we met space: expand "d${e}f" and start new word.
                                  * do not assume we are at the start of the word (PREFIX above).
                                  */
@@ -6449,7 +6989,7 @@ static NOINLINE int encode_then_append_var_plusminus(o_string *output, int n,
                         goto ret; /* error */
                 }
                 if (ch == '"') {
-                        dest.o_expflags ^= EXP_FLAG_ESC_GLOB_CHARS;
+                        dest.o_expflags ^= EXP_FLAG_GLOBPROTECT_CHARS;
                         if (dest.o_expflags) {
                                 o_addchr(&dest, SPECIAL_VAR_SYMBOL);
                                 o_addchr(&dest, SPECIAL_VAR_SYMBOL);
@@ -6479,7 +7019,7 @@ static NOINLINE int encode_then_append_var_plusminus(o_string *output, int n,
                         o_addchr(&dest, SPECIAL_VAR_SYMBOL);
                         o_addchr(&dest, (dest.o_expflags || dquoted) ? 0x80 | '`' : '`');
                         if (!add_till_backquote(&dest, &input,
-                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_ESC_GLOB_CHARS set */
+                                        /*in_dquote:*/ dest.o_expflags /* nonzero if EXP_FLAG_GLOBPROTECT_CHARS set */
                                 )
                         ) {
                                 goto ret; /* error */
@@ -6607,27 +7147,39 @@ static char *replace_pattern(char *val, const char *pattern, const char *repl, c
 #endif /* BASH_PATTERN_SUBST */
 
 static int append_str_maybe_ifs_split(o_string *output, int n,
-                int first_ch, const char *val)
+                int quoted, const char *val)
 {
-        if (!(first_ch & 0x80)) { /* unquoted $VAR */
-                debug_printf_expand("unquoted '%s', output->o_escape:%d\n", val,
-                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                if (val && val[0])
+        if (!quoted) { /* unquoted $VAR */
+                debug_printf_expand("unquoted variable value '%s', o_escape:%d o_varescape:%d, singleword:%d\n", val,
+                                !!(output->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS),
+                                !!(output->o_expflags & EXP_FLAG_GLOBPROTECT_VARS),
+                                !!(output->o_expflags & EXP_FLAG_SINGLEWORD)
+                );
+                if (val && val[0]) {
+                        if (output->o_expflags & EXP_FLAG_SINGLEWORD)
+                                goto singleword;
                         n = expand_on_ifs(output, n, val);
+                }
         } else { /* quoted "$VAR" */
                 output->has_quoted_part = 1;
-                debug_printf_expand("quoted '%s', output->o_escape:%d\n", val,
-                                !!(output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS));
-                if (val && val[0])
-                        o_addQstr(output, val);
+                debug_printf_expand("quoted variable value '%s', o_escape:%d o_varescape:%d\n", val,
+                                !!(output->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS),
+                                !!(output->o_expflags & EXP_FLAG_GLOBPROTECT_VARS)
+                );
+                if (val && val[0]) {
+                        if (output->o_expflags & EXP_FLAG_GLOBPROTECT_VARS)
+                                o_addqstr(output, val);
+                        else
+ singleword:
+                                o_addQstr(output, val);
+                }
         }
         return n;
 }
 
 /* Handle <SPECIAL_VAR_SYMBOL>varname...<SPECIAL_VAR_SYMBOL> construct.
  */
-static NOINLINE int expand_one_var(o_string *output, int n,
-                int first_ch, char *arg, char **pp)
+static NOINLINE int expand_one_var(o_string *output, int n, char *arg, char **pp)
 {
         const char *val;
         char *to_be_freed;
@@ -6763,7 +7315,11 @@ static NOINLINE int expand_one_var(o_string *output, int n,
                                 if (exp_op == *exp_word)  /* ## or %% */
                                         exp_word++;
                                 debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
-                                exp_exp_word = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 0);
+                                exp_exp_word = encode_then_expand_vararg(exp_word,
+                                                /*handle_squotes:*/ 1,   /* 'str' are processed (and glob-protected) */
+                                                /*globprotect_vars:*/ 1, /* value of "$VAR" is not glob-expanded */
+                                                /*unbackslash:*/ 0
+                                );
                                 if (exp_exp_word)
                                         exp_word = exp_exp_word;
                                 debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
@@ -6810,7 +7366,11 @@ static NOINLINE int expand_one_var(o_string *output, int n,
                                  * (note that a*z _pattern_ is never globbed!)
                                  */
                                 char *pattern, *repl, *t;
-                                pattern = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 0);
+                                pattern = encode_then_expand_vararg(exp_word,
+                                                /*handle_squotes:*/ 1,
+                                                /*globprotect_vars:*/ 0,
+                                                /*unbackslash:*/ 0
+                                );
                                 if (!pattern)
                                         pattern = xstrdup(exp_word);
                                 debug_printf_varexp("pattern:'%s'->'%s'\n", exp_word, pattern);
@@ -6818,7 +7378,11 @@ static NOINLINE int expand_one_var(o_string *output, int n,
                                 exp_word = p;
                                 p = strchr(p, SPECIAL_VAR_SYMBOL);
                                 *p = '\0';
-                                repl = encode_then_expand_vararg(exp_word, /*handle_squotes:*/ 1, /*unbackslash:*/ 1);
+                                repl = encode_then_expand_vararg(exp_word,
+                                                /*handle_squotes:*/ 1,
+                                                /*globprotect_vars:*/ 0,
+                                                /*unbackslash:*/ 1
+                                );
                                 debug_printf_varexp("repl:'%s'->'%s'\n", exp_word, repl);
                                 /* HACK ALERT. We depend here on the fact that
                                  * G.global_argv and results of utoa and get_local_var_value
@@ -6971,6 +7535,7 @@ static NOINLINE int expand_one_var(o_string *output, int n,
                                         /* ${var=word} - assign and use default value */
                                         to_be_freed = encode_then_expand_vararg(exp_word,
                                                         /*handle_squotes:*/ !(arg0 & 0x80),
+                                                        /*globprotect_vars:*/ 0,
                                                         /*unbackslash:*/ 0
                                         );
                                         if (to_be_freed)
@@ -7015,7 +7580,7 @@ static NOINLINE int expand_one_var(o_string *output, int n,
         arg[0] = arg0;
         *pp = p;
 
-        n = append_str_maybe_ifs_split(output, n, first_ch, val);
+        n = append_str_maybe_ifs_split(output, n, /*quoted:*/ (arg0 & 0x80), val);
 
         free(to_be_freed);
         return n;
@@ -7143,7 +7708,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         G.last_exitcode = process_command_subs(&subst_result, arg);
                         G.expand_exitcode = G.last_exitcode;
                         debug_printf_subst("SUBST RES:%d '%s'\n", G.last_exitcode, subst_result.data);
-                        n = append_str_maybe_ifs_split(output, n, first_ch, subst_result.data);
+                        n = append_str_maybe_ifs_split(output, n, /*quoted:*/(first_ch & 0x80), subst_result.data);
                         o_free(&subst_result);
                         break;
                 }
@@ -7161,7 +7726,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
                         sprintf(arith_buf, ARITH_FMT, res);
                         if (res < 0
                          && first_ch == (char)('+'|0x80)
-                        /* && (output->o_expflags & EXP_FLAG_ESC_GLOB_CHARS) */
+                        /* && (output->o_expflags & EXP_FLAG_GLOBPROTECT_CHARS) */
                         ) {
                                 /* Quoted negative ariths, like filename[0"$((-9))"],
                                  * should not be interpreted as glob ranges.
@@ -7176,7 +7741,7 @@ static NOINLINE int expand_vars_to_list(o_string *output, int n, char *arg)
 #endif
                 default:
                         /* <SPECIAL_VAR_SYMBOL>varname[ops]<SPECIAL_VAR_SYMBOL> */
-                        n = expand_one_var(output, n, first_ch, arg, &p);
+                        n = expand_one_var(output, n, arg, &p);
                         break;
                 } /* switch (char after <SPECIAL_VAR_SYMBOL>) */
 
@@ -7244,7 +7809,7 @@ static char **expand_variables(char **argv, unsigned expflags)
 
 static char **expand_strvec_to_strvec(char **argv)
 {
-        return expand_variables(argv, EXP_FLAG_GLOB | EXP_FLAG_ESC_GLOB_CHARS);
+        return expand_variables(argv, EXP_FLAG_DO_GLOBBING | EXP_FLAG_GLOBPROTECT_CHARS);
 }
 
 #if defined(CMD_SINGLEWORD_NOGLOB) || defined(CMD_TEST2_SINGLEWORD_NOGLOB)
@@ -7262,10 +7827,6 @@ static char **expand_strvec_to_strvec_singleword_noglob(char **argv)
  */
 static char *expand_string_to_string(const char *str, int EXP_flags, int do_unbackslash)
 {
-#if !BASH_PATTERN_SUBST && !ENABLE_HUSH_CASE
-        const int do_unbackslash = 1;
-        const int EXP_flags = EXP_FLAG_ESC_GLOB_CHARS;
-#endif
         char *argv[2], **list;
 
         debug_printf_expand("string_to_string<='%s'\n", str);
@@ -7334,7 +7895,7 @@ static char **expand_assignments(char **argv, int count)
         for (i = 0; i < count; i++) {
                 p = add_string_to_strings(p,
                         expand_string_to_string(argv[i],
-                                EXP_FLAG_ESC_GLOB_CHARS,
+                                EXP_FLAG_GLOBPROTECT_CHARS,
                                 /*unbackslash:*/ 1
                         )
                 );
@@ -7366,11 +7927,6 @@ static void switch_off_special_sigs(unsigned mask)
 }
 
 #if BB_MMU
-/* never called */
-void re_execute_shell(char ***to_free, const char *s,
-                char *g_argv0, char **g_argv,
-                char **builtin_argv) NORETURN;
-
 static void reset_traps_to_defaults(void)
 {
         /* This function is always called in a child shell
@@ -7420,10 +7976,8 @@ static void reset_traps_to_defaults(void)
 
 #else /* !BB_MMU */
 
-static void re_execute_shell(char ***to_free, const char *s,
-                char *g_argv0, char **g_argv,
-                char **builtin_argv) NORETURN;
-static void re_execute_shell(char ***to_free, const char *s,
+static NORETURN void re_execute_shell(
+                char * *volatile * to_free, const char *s,
                 char *g_argv0, char **g_argv,
                 char **builtin_argv)
 {
@@ -7653,7 +8207,13 @@ static int generate_stream_from_string(const char *s, pid_t *pid_p)
         pid_t pid;
         int channel[2];
 # if !BB_MMU
-        char **to_free = NULL;
+        /* _volatile_ pointer to "char*".
+         * Or else compiler can peek from inside re_execute_shell()
+         * and see that this pointer is a local var (i.e. not globally visible),
+         * and decide to optimize out the store to it. Yes,
+         * it was seen in the wild.
+         */
+        char * *volatile to_free = NULL;
 # endif
 
         xpipe(channel);
@@ -7800,16 +8360,29 @@ static void setup_heredoc(struct redir_struct *redir)
         const char *heredoc = redir->rd_filename;
         char *expanded;
 #if !BB_MMU
-        char **to_free;
+        char * *volatile to_free;
 #endif
 
         expanded = NULL;
-        if (!(redir->rd_dup & HEREDOC_QUOTED)) {
+        if (redir->rd_type == REDIRECT_HERESTRING) {
+                heredoc = expanded = expand_string_to_string(heredoc,
+                        EXP_FLAG_GLOBPROTECT_CHARS,
+                        /* ^^^^why? testcases:
+                         * cat <<<`echo '_\t_\\_\"_'`   prints _\t_\_\"_<newline>
+                         * cat <<<"`echo '_\t_\\_\"_'`" prints _\t_\_"_<newline>
+                         */
+                        /*unbackslash:*/ 1
+                        /* ^^^^^^^^^^ cat <<<\_  prints _<newline> */
+                );
+        } else if (!(redir->rd_dup & HEREDOC_QUOTED)) {
                 expanded = encode_then_expand_string(heredoc);
                 if (expanded)
                         heredoc = expanded;
         }
+
         len = strlen(heredoc);
+        if (redir->rd_type == REDIRECT_HERESTRING)
+                expanded[len++] = '\n';
 
         close(redir->rd_fd); /* often saves dup2+close in xmove_fd */
         xpiped_pair(pair);
@@ -8053,7 +8626,7 @@ static void restore_redirects(struct squirrel *sq)
                  * Redirect moves ->fd to e.g. 10,
                  * and it is not restored above (we do not restore script fds
                  * after redirects, we just use new, "moved" fds).
-                 * However for stdin, get_user_input() -> read_line_input(),
+                 * However for stdin, show_prompt_and_get_stdin() -> read_line_input(),
                  * and read builtin, depend on fd == STDIN_FILENO.
                  */
                 debug_printf_redir("restoring %d to stdin\n", G.HFILE_stdin->fd);
@@ -8105,12 +8678,14 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                 int newfd;
                 int closed;
 
-                if (redir->rd_type == REDIRECT_HEREDOC2) {
-                        /* "rd_fd<<HERE" case */
+                if (redir->rd_type == REDIRECT_HEREDOC2
+                 || redir->rd_type == REDIRECT_HERESTRING
+                ) {
+                        /* "rd_fd<<HEREDOC_EOF" and "rd_fd<<<WORD" cases */
                         if (save_fd_on_redirect(redir->rd_fd, /*avoid:*/ 0, sqp) < 0)
                                 return 1;
-                        /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
-                         * of the heredoc */
+                        /* for REDIRECT_HEREDOC2, rd_filename holds _contents_ of the heredoc */
+                        /* for REDIRECT_HERESTRING, rd_filename holds "WORD" */
                         debug_printf_redir("set heredoc '%s'\n",
                                         redir->rd_filename);
                         setup_heredoc(redir);
@@ -8132,7 +8707,9 @@ static int setup_redirects(struct command *prog, struct squirrel **sqp)
                         }
                         mode = redir_table[redir->rd_type].mode;
                         p = expand_string_to_string(redir->rd_filename,
-                                EXP_FLAG_ESC_GLOB_CHARS, /*unbackslash:*/ 1);
+                                        EXP_FLAG_GLOBPROTECT_CHARS,
+                                        /*unbackslash:*/ 1
+                        );
                         newfd = open_or_warn(p, mode);
                         free(p);
                         if (newfd < 0) {
@@ -8275,7 +8852,7 @@ static const struct built_in_command *find_builtin(const char *name)
         return find_builtin_helper(name, bltins2, &bltins2[ARRAY_SIZE(bltins2)]);
 }
 
-#if ENABLE_HUSH_JOB && ENABLE_FEATURE_TAB_COMPLETION
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_TAB_COMPLETION
 static const char * FAST_FUNC hush_command_name(int i)
 {
         if (/*i >= 0 && */ i < ARRAY_SIZE(bltins1)) {
@@ -8441,10 +9018,8 @@ static void unset_func(const char *name)
 #define exec_function(to_free, funcp, argv) \
         exec_function(funcp, argv)
 # endif
-static void exec_function(char ***to_free,
-                const struct function *funcp,
-                char **argv) NORETURN;
-static void exec_function(char ***to_free,
+static NORETURN void exec_function(
+                char * *volatile *to_free,
                 const struct function *funcp,
                 char **argv)
 {
@@ -8540,10 +9115,8 @@ static int run_function(const struct function *funcp, char **argv)
 #define exec_builtin(to_free, x, argv) \
         exec_builtin(to_free, argv)
 #endif
-static void exec_builtin(char ***to_free,
-                const struct built_in_command *x,
-                char **argv) NORETURN;
-static void exec_builtin(char ***to_free,
+static NORETURN void exec_builtin(
+                char * *volatile *to_free,
                 const struct built_in_command *x,
                 char **argv)
 {
@@ -8566,8 +9139,7 @@ static void exec_builtin(char ***to_free,
 #endif
 }
 
-static void execvp_or_die(char **argv) NORETURN;
-static void execvp_or_die(char **argv)
+static NORETURN void execvp_or_die(char **argv)
 {
         int e;
         debug_printf_exec("execing '%s'\n", argv[0]);
@@ -8688,10 +9260,8 @@ static void if_command_vV_print_and_exit(char opt_vV, char *cmd, const char *exp
  * The at_exit handlers apparently confuse the calling process,
  * in particular stdin handling. Not sure why? -- because of vfork! (vda)
  */
-static void pseudo_exec_argv(nommu_save_t *nommu_save,
-                char **argv, int assignment_cnt,
-                char **argv_expanded) NORETURN;
-static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
+static NORETURN NOINLINE void pseudo_exec_argv(
+                volatile nommu_save_t *nommu_save,
                 char **argv, int assignment_cnt,
                 char **argv_expanded)
 {
@@ -8717,7 +9287,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 #if BB_MMU
         G.shadowed_vars_pp = NULL; /* "don't save, free them instead" */
 #else
-        G.shadowed_vars_pp = &nommu_save->old_vars;
+        /* cast away volatility */
+        G.shadowed_vars_pp = (struct variable **)&nommu_save->old_vars;
         G.var_nest_level++;
 #endif
         set_vars_and_save_old(new_env);
@@ -8844,10 +9415,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 
 /* Called after [v]fork() in run_pipe
  */
-static void pseudo_exec(nommu_save_t *nommu_save,
-                struct command *command,
-                char **argv_expanded) NORETURN;
-static void pseudo_exec(nommu_save_t *nommu_save,
+static NORETURN void pseudo_exec(
+                volatile nommu_save_t *nommu_save,
                 struct command *command,
                 char **argv_expanded)
 {
@@ -8874,13 +9443,14 @@ static void pseudo_exec(nommu_save_t *nommu_save,
                  */
 #if BB_MMU
                 int rcode;
-                debug_printf_exec("pseudo_exec: run_list\n");
+                debug_printf_exec("pseudo_exec: run_list(command->group)\n");
                 reset_traps_to_defaults();
                 rcode = run_list(command->group);
                 /* OK to leak memory by not calling free_pipe_list,
                  * since this process is about to exit */
                 _exit(rcode);
 #else
+                debug_printf_exec("pseudo_exec: re_exec(command->group_as_string)\n");
                 re_execute_shell(&nommu_save->argv_from_re_execing,
                                 command->group_as_string,
                                 G.global_argv[0],
@@ -9456,7 +10026,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                         i = 0;
                         while (i < command->assignment_cnt) {
                                 char *p = expand_string_to_string(argv[i],
-                                                EXP_FLAG_ESC_GLOB_CHARS,
+                                                EXP_FLAG_GLOBPROTECT_CHARS,
                                                 /*unbackslash:*/ 1
                                 );
 #if ENABLE_HUSH_MODE_X
@@ -9678,13 +10248,20 @@ static NOINLINE int run_pipe(struct pipe *pi)
 #if ENABLE_HUSH_LINENO_VAR
                 G.execute_lineno = command->lineno;
 #endif
-
                 command->pid = BB_MMU ? fork() : vfork();
                 if (!command->pid) { /* child */
-#if ENABLE_HUSH_JOB
                         disable_restore_tty_pgrp_on_exit();
-                        CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
 
+#if ENABLE_HUSH_INTERACTIVE
+                        if (BB_MMU && pi->followup == PIPE_BG) {
+                                /* This disables alias expansion in . FILE & */
+                                /* (bash does it only for (. FILE)& */
+                                G.interactive_fd = 0;
+                        }
+#endif
+                        if (BB_MMU)
+                                CLEAR_RANDOM_T(&G.random_gen); /* or else $RANDOM repeats in child */
+#if ENABLE_HUSH_JOB
                         /* Every child adds itself to new process group
                          * with pgid == pid_of_first_child_in_pipe */
                         if (G.run_list_level == 1 && G_interactive_fd) {
@@ -9732,8 +10309,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
 
                         /* Stores to nommu_save list of env vars putenv'ed
                          * (NOMMU, on MMU we don't need that) */
-                        /* cast away volatility... */
-                        pseudo_exec((nommu_save_t*) &nommu_save, command, argv_expanded);
+                        pseudo_exec(&nommu_save, command, argv_expanded);
                         /* pseudo_exec() does not return */
                 }
 
@@ -9978,7 +10554,9 @@ static int run_list(struct pipe *pi)
                 if (rword == RES_CASE) {
                         debug_printf_exec("CASE cond_code:%d\n", cond_code);
                         case_word = expand_string_to_string(pi->cmds->argv[0],
-                                EXP_FLAG_ESC_GLOB_CHARS, /*unbackslash:*/ 1);
+                                        EXP_FLAG_GLOBPROTECT_CHARS,
+                                        /*unbackslash:*/ 1
+                        );
                         debug_printf_exec("CASE word1:'%s'\n", case_word);
                         //unbackslash(case_word);
                         //debug_printf_exec("CASE word2:'%s'\n", case_word);
@@ -9996,7 +10574,7 @@ static int run_list(struct pipe *pi)
                                 char *pattern;
                                 debug_printf_exec("expand_string_to_string('%s')\n", *argv);
                                 pattern = expand_string_to_string(*argv,
-                                                EXP_FLAG_ESC_GLOB_CHARS,
+                                                EXP_FLAG_GLOBPROTECT_CHARS,
                                                 /*unbackslash:*/ 0
                                 );
                                 /* TODO: which FNM_xxx flags to use? */
@@ -10121,7 +10699,7 @@ static int run_list(struct pipe *pi)
                 if (rcode != 0 && G.o_opt[OPT_O_ERREXIT]) {
                         debug_printf_exec("ERREXIT:1 errexit_depth:%d\n", G.errexit_depth);
                         if (G.errexit_depth == 0)
-                                hush_exit(rcode);
+                                save_history_run_exit_trap_and_exit(rcode);
                 }
                 G.errexit_depth = sv_errexit_depth;
 
@@ -10195,6 +10773,53 @@ static int run_and_free_list(struct pipe *pi)
 /*
  * Initialization and main
  */
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING
+static void init_line_editing(void)
+{
+        G.line_input_state = new_line_input_t(FOR_SHELL);
+# if ENABLE_FEATURE_TAB_COMPLETION
+        G.line_input_state->get_exe_name = hush_command_name;
+# endif
+# if EDITING_HAS_sh_get_var
+        G.line_input_state->sh_get_var = get_local_var_value;
+# endif
+# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
+        {
+                const char *hp = get_local_var_value("HISTFILE");
+                if (!hp) {
+                        hp = get_local_var_value("HOME");
+                        if (hp) {
+                                hp = concat_path_file(hp, ".hush_history");
+                                /* Make HISTFILE set on exit (else history won't be saved) */
+                                set_local_var_from_halves("HISTFILE", hp);
+                        }
+                } else {
+                        hp = xstrdup(hp);
+                }
+                if (hp) {
+                        G.line_input_state->hist_file = hp;
+                }
+#  if ENABLE_FEATURE_SH_HISTFILESIZE
+                hp = get_local_var_value("HISTSIZE");
+                /* Using HISTFILESIZE above to limit max_history would be WRONG:
+                 * users may set HISTFILESIZE=0 in their profile scripts
+                 * to prevent _saving_ of history files, but still want to have
+                 * non-zero history limit for in-memory list.
+                 */
+// in bash, runtime history size is controlled by HISTSIZE (0=no history),
+// HISTFILESIZE controls on-disk history file size (in lines, 0=no history):
+                G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
+// HISTFILESIZE: "The shell sets the default value to the value of HISTSIZE after reading any startup files."
+// HISTSIZE: "The shell sets the default value to 500 after reading any startup files."
+// (meaning: if the value wasn't set after startup files, the default value is set as described above)
+#  endif
+        }
+# endif
+}
+#else
+# define init_line_editing() ((void)0)
+#endif
+
 static void install_sighandlers(unsigned mask)
 {
         sighandler_t old_handler;
@@ -10333,7 +10958,6 @@ static int set_mode(int state, char mode, const char *o_opt)
 int hush_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int hush_main(int argc, char **argv)
 {
-        pid_t cached_getpid;
         enum {
                 OPT_login = (1 << 0),
         };
@@ -10346,6 +10970,11 @@ int hush_main(int argc, char **argv)
         struct variable *shell_ver;
 
         INIT_G();
+#if ENABLE_HUSH_JOB
+        die_func = fflush_restore_ttypgrp_and__exit;
+#else
+        die_func = fflush_and__exit;
+#endif
         if (EXIT_SUCCESS != 0) /* if EXIT_SUCCESS == 0, it is already done */
                 G.last_exitcode = EXIT_SUCCESS;
 #if !BB_MMU
@@ -10368,14 +10997,11 @@ int hush_main(int argc, char **argv)
 # endif
         G.pre_trap_exitcode = -1;
 #endif
-
 #if ENABLE_HUSH_FAST
         G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
 #endif
-
-        cached_getpid = getpid();   /* for tcsetpgrp() during init */
-        G.root_pid = cached_getpid; /* for $PID  (NOMMU can override via -$HEXPID:HEXPPID:...) */
-        G.root_ppid = getppid();    /* for $PPID (NOMMU can override) */
+        G.root_pid = getpid();   /* for $PID  (NOMMU can override via -$HEXPID:HEXPPID:...) */
+        G.root_ppid = getppid(); /* for $PPID (NOMMU can override) */
 
         /* Deal with HUSH_VERSION */
         debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
@@ -10424,7 +11050,7 @@ int hush_main(int argc, char **argv)
         if (!get_local_var_value("PATH"))
                 set_local_var_from_halves("PATH", bb_default_root_path);
 
-        /* PS1/PS2 are set later, if we determine that we are interactive */
+        /* PS1/PS2/HISTFILE are set later, if we determine that we are interactive */
 
         /* bash also exports SHLVL and _,
          * and sets (but doesn't export) the following variables:
@@ -10446,7 +11072,6 @@ int hush_main(int argc, char **argv)
          * BASH_SOURCE=()
          * DIRSTACK=()
          * PIPESTATUS=([0]="0")
-         * HISTFILE=/<xxx>/.bash_history
          * HISTFILESIZE=500
          * HISTSIZE=500
          * MAILCHECK=60
@@ -10459,27 +11084,24 @@ int hush_main(int argc, char **argv)
          * PS4='+ '
          */
 
+        /* Shell is non-interactive at first. We need to call
+         * install_special_sighandlers() if we are going to execute "sh <script>",
+         * "sh -c <cmds>" or login shell's /etc/profile and friends.
+         * If we later decide that we are interactive, we run
+         * install_special_sighandlers() in order to intercept more signals.
+         */
+        install_special_sighandlers();
+
 #if NUM_SCRIPTS > 0
         if (argc < 0) {
                 char *script = get_script_content(-argc - 1);
                 G.global_argv = argv;
                 G.global_argc = string_array_len(argv);
-                //install_special_sighandlers(); - needed?
                 parse_and_run_string(script);
                 goto final_return;
         }
 #endif
 
-        /* Initialize some more globals to non-zero values */
-        die_func = restore_ttypgrp_and__exit;
-
-        /* Shell is non-interactive at first. We need to call
-         * install_special_sighandlers() if we are going to execute "sh <script>",
-         * "sh -c <cmds>" or login shell's /etc/profile and friends.
-         * If we later decide that we are interactive, we run install_special_sighandlers()
-         * in order to intercept (more) signals.
-         */
-
         /* Parse options */
         /* http://www.opengroup.org/onlinepubs/9699919799/utilities/sh.html */
         flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
@@ -10543,6 +11165,7 @@ int hush_main(int argc, char **argv)
                 case '$': {
                         unsigned long long empty_trap_mask;
 
+                        G.reexeced_on_NOMMU = 1;
                         G.root_pid = bb_strtou(optarg, &optarg, 16);
                         optarg++;
                         G.root_ppid = bb_strtou(optarg, &optarg, 16);
@@ -10556,7 +11179,6 @@ int hush_main(int argc, char **argv)
                         empty_trap_mask = bb_strtoull(optarg, &optarg, 16);
                         if (empty_trap_mask != 0) {
                                 IF_HUSH_TRAP(int sig;)
-                                install_special_sighandlers();
 # if ENABLE_HUSH_TRAP
                                 G_traps = xzalloc(sizeof(G_traps[0]) * NSIG);
                                 for (sig = 1; sig < NSIG; sig++) {
@@ -10622,7 +11244,9 @@ int hush_main(int argc, char **argv)
         G.global_argv[0] = argv[0];
 
         /* If we are login shell... */
-        if (flags & OPT_login) {
+        if (!G_reexeced_on_NOMMU /* reexeced hush should never be a login shell */
+         && (flags & OPT_login)
+        ) {
                 const char *hp = NULL;
                 HFILE *input;
 
@@ -10630,7 +11254,6 @@ int hush_main(int argc, char **argv)
                 input = hfopen("/etc/profile");
  run_profile:
                 if (input != NULL) {
-                        install_special_sighandlers();
                         parse_and_run_file(input);
                         hfclose(input);
                 }
@@ -10652,6 +11275,10 @@ int hush_main(int argc, char **argv)
                         }
                 }
         }
+        /* "hush -l" doesn't die in startup scripts, but after -l is processed,
+         * it can die if scripts. Set the flag to achieve this behavior.
+         */
+        G.flag_startup_done = 1;
 
         /* -c takes effect *after* -l */
         if (G.opt_c) {
@@ -10667,8 +11294,6 @@ int hush_main(int argc, char **argv)
                  */
                 char *script;
 
-                install_special_sighandlers();
-
                 G.global_argc--;
                 G.global_argv++;
 #if !BB_MMU
@@ -10719,7 +11344,6 @@ int hush_main(int argc, char **argv)
                         bb_simple_perror_msg_and_die(G.global_argv[0]);
                 }
                 xfunc_error_retval = 1;
-                install_special_sighandlers();
                 parse_and_run_file(input);
 #if ENABLE_FEATURE_CLEAN_UP
                 hfclose(input);
@@ -10735,126 +11359,86 @@ int hush_main(int argc, char **argv)
 
         /* A shell is interactive if the '-i' flag was given,
          * or if all of the following conditions are met:
-         *    no -c command
-         *    no arguments remaining or the -s flag given
+         *    not -c 'CMD'
+         *    not running a script (no arguments remaining, or -s flag given)
          *    standard input is a terminal
          *    standard output is a terminal
          * Refer to Posix.2, the description of the 'sh' utility.
          */
-#if ENABLE_HUSH_JOB
-        if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
-                G_saved_tty_pgrp = tcgetpgrp(STDIN_FILENO);
-                debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
-                if (G_saved_tty_pgrp < 0)
-                        G_saved_tty_pgrp = 0;
-
-                /* try to dup stdin to high fd#, >= 255 */
+#if ENABLE_HUSH_INTERACTIVE
+        if (!G_reexeced_on_NOMMU
+         && isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)
+        ) {
+                /* Try to dup stdin to high fd#, >= 255 */
                 G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
                 if (G_interactive_fd < 0) {
-                        /* try to dup to any fd */
+                        /* Try to dup to any fd */
                         G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
-                        if (G_interactive_fd < 0) {
-                                /* give up */
+                        if (G_interactive_fd < 0)
+                                /* Give up */
                                 G_interactive_fd = 0;
-                                G_saved_tty_pgrp = 0;
-                        }
                 }
-        }
-        debug_printf("interactive_fd:%d\n", G_interactive_fd);
-        if (G_interactive_fd) {
-                if (G_saved_tty_pgrp) {
-                        /* If we were run as 'hush &', sleep until we are
-                         * in the foreground (tty pgrp == our pgrp).
-                         * If we get started under a job aware app (like bash),
-                         * make sure we are now in charge so we don't fight over
-                         * who gets the foreground */
-                        while (1) {
-                                pid_t shell_pgrp = getpgrp();
-                                G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
-                                if (G_saved_tty_pgrp == shell_pgrp)
-                                        break;
-                                /* send TTIN to ourself (should stop us) */
-                                kill(- shell_pgrp, SIGTTIN);
+                debug_printf("interactive_fd:%d\n", G_interactive_fd);
+                if (G_interactive_fd) {
+// TODO? bash:
+// if interactive but not a login shell, sources ~/.bashrc
+// (--norc turns this off, --rcfile <file> overrides)
+# if ENABLE_HUSH_JOB
+                        /* Can we do job control? */
+                        G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                        debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
+                        if (G_saved_tty_pgrp < 0)
+                                G_saved_tty_pgrp = 0; /* no */
+                        if (G_saved_tty_pgrp) {
+                                /* If we were run as 'hush &', sleep until we are
+                                 * in the foreground (tty pgrp == our pgrp).
+                                 * If we get started under a job aware app (like bash),
+                                 * make sure we are now in charge so we don't fight over
+                                 * who gets the foreground */
+                                while (1) {
+                                        pid_t shell_pgrp = getpgrp();
+                                        if (G_saved_tty_pgrp == shell_pgrp) {
+/* Often both pgrps here are set to our pid - but not always!
+ * Example: sh -c 'echo $$; hush; echo FIN'
+ * Here, the parent shell is not interactive, so it does NOT set up
+ * a separate process group for its children, and we (hush) initially
+ * run in parent's process group (until we set up our own a few lines down).
+ */
+                                                //bb_error_msg("process groups tty:%d hush:%d", G_saved_tty_pgrp, shell_pgrp);
+                                                break;
+                                        }
+                                        /* Send TTIN to ourself (should stop us) */
+                                        kill(- shell_pgrp, SIGTTIN);
+                                        G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                                }
                         }
-                }
-
-                /* Install more signal handlers */
-                install_special_sighandlers();
-
-                if (G_saved_tty_pgrp) {
-                        /* Set other signals to restore saved_tty_pgrp */
-                        install_fatal_sighandlers();
-                        /* Put ourselves in our own process group
-                         * (bash, too, does this only if ctty is available) */
-                        bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
-                        /* Grab control of the terminal */
-                        tcsetpgrp(G_interactive_fd, cached_getpid);
-                }
-                enable_restore_tty_pgrp_on_exit();
-
-# if ENABLE_FEATURE_EDITING
-                G.line_input_state = new_line_input_t(FOR_SHELL);
-#  if ENABLE_FEATURE_TAB_COMPLETION
-                G.line_input_state->get_exe_name = hush_command_name;
-#  endif
-#  if EDITING_HAS_sh_get_var
-                G.line_input_state->sh_get_var = get_local_var_value;
-#  endif
 # endif
-# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
-                {
-                        const char *hp = get_local_var_value("HISTFILE");
-                        if (!hp) {
-                                hp = get_local_var_value("HOME");
-                                if (hp)
-                                        hp = concat_path_file(hp, ".hush_history");
-                        } else {
-                                hp = xstrdup(hp);
-                        }
-                        if (hp) {
-                                G.line_input_state->hist_file = hp;
-                                //set_local_var(xasprintf("HISTFILE=%s", ...));
+                        /* Install more signal handlers */
+                        install_special_sighandlers();
+# if ENABLE_HUSH_JOB
+                        if (G_saved_tty_pgrp) {
+                                /* Set fatal signals to restore saved_tty_pgrp */
+                                install_fatal_sighandlers();
+                                /* (The if() is an optimization: can avoid two redundant syscalls) */
+                                if (G_saved_tty_pgrp != G.root_pid) {
+                                        /* Put ourselves in our own process group
+                                         * (bash, too, does this only if ctty is available) */
+                                        bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
+                                        /* Grab control of the terminal */
+                                        tcsetpgrp(G_interactive_fd, G.root_pid);
+                                }
                         }
-#  if ENABLE_FEATURE_SH_HISTFILESIZE
-                        hp = get_local_var_value("HISTFILESIZE");
-                        G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
-#  endif
-                }
 # endif
-        } else {
-                install_special_sighandlers();
-        }
-#elif ENABLE_HUSH_INTERACTIVE
-        /* No job control compiled in, only prompt/line editing */
-        if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
-                G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
-                if (G_interactive_fd < 0) {
-                        /* try to dup to any fd */
-                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
-                        if (G_interactive_fd < 0)
-                                /* give up */
-                                G_interactive_fd = 0;
-                }
-        }
-        install_special_sighandlers();
-#else
-        /* We have interactiveness code disabled */
-        install_special_sighandlers();
-#endif
-        /* bash:
-         * if interactive but not a login shell, sources ~/.bashrc
-         * (--norc turns this off, --rcfile <file> overrides)
-         */
+# if ENABLE_FEATURE_EDITING_FANCY_PROMPT
+                        /* Set (but not export) PS1/2 unless already set */
+                        if (!get_local_var_value("PS1"))
+                                set_local_var_from_halves("PS1", "\\w \\$ ");
+                        if (!get_local_var_value("PS2"))
+                                set_local_var_from_halves("PS2", "> ");
+# endif
+                        init_line_editing();
 
-        if (G_interactive_fd) {
-#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
-                /* Set (but not export) PS1/2 unless already set */
-                if (!get_local_var_value("PS1"))
-                        set_local_var_from_halves("PS1", "\\w \\$ ");
-                if (!get_local_var_value("PS2"))
-                        set_local_var_from_halves("PS2", "> ");
-#endif
-                if (!ENABLE_FEATURE_SH_EXTRA_QUIET) {
+# if !ENABLE_FEATURE_SH_EXTRA_QUIET
                         /* note: ash and hush share this string */
                         printf("\n\n%s %s\n"
                                 IF_HUSH_HELP("Enter 'help' for a list of built-in commands.\n")
@@ -10862,13 +11446,15 @@ int hush_main(int argc, char **argv)
                                 bb_banner,
                                 "hush - the humble shell"
                         );
-                }
-        }
+# endif
+                } /* if become interactive */
+        } /* if on tty */
+#endif /* if INTERACTIVE is allowed by build config */
 
         parse_and_run_file(hfopen(NULL)); /* stdin */
 
  final_return:
-        hush_exit(G.last_exitcode);
+        save_history_run_exit_trap_and_exit(G.last_exitcode);
 }
 
 /*
@@ -11054,19 +11640,19 @@ static int FAST_FUNC builtin_exit(char **argv)
          * TODO: we can use G.exiting = -1 as indicator "last cmd was exit"
          */
 
-        /* note: EXIT trap is run by hush_exit */
+        /* note: EXIT trap is run by save_history_run_exit_trap_and_exit */
         argv = skip_dash_dash(argv);
         if (argv[0] == NULL) {
 #if ENABLE_HUSH_TRAP
                 if (G.pre_trap_exitcode >= 0) /* "exit" in trap uses $? from before the trap */
-                        hush_exit(G.pre_trap_exitcode);
+                        save_history_run_exit_trap_and_exit(G.pre_trap_exitcode);
 #endif
-                hush_exit(G.last_exitcode);
+                save_history_run_exit_trap_and_exit(G.last_exitcode);
         }
         /* mimic bash: exit 123abc == exit 255 + error msg */
         xfunc_error_retval = 255;
         /* bash: exit -2 == exit 254, no error msg */
-        hush_exit(xatoi(argv[0]) & 0xff);
+        save_history_run_exit_trap_and_exit(xatoi(argv[0]) & 0xff);
 }
 
 #if ENABLE_HUSH_TYPE
@@ -11080,12 +11666,14 @@ static int FAST_FUNC builtin_type(char **argv)
                 char *path = NULL;
 
                 if (0) {} /* make conditional compile easier below */
-                /*else if (find_alias(*argv))
-                        type = "an alias";*/
 # if ENABLE_HUSH_FUNCTIONS
                 else if (find_function(*argv))
                         type = "a function";
 # endif
+# if ENABLE_HUSH_ALIAS
+                else if (find_alias(*argv))
+                        type = "an alias";
+# endif
                 else if (find_builtin(*argv))
                         type = "a shell builtin";
                 else {
@@ -11172,6 +11760,11 @@ static int FAST_FUNC builtin_read(char **argv)
                         goto again;
         }
 
+        if ((uintptr_t)r == 2) /* -t SEC timeout? */
+                /* bash: "The exit status is greater than 128 if the timeout is exceeded." */
+                /* The actual value observed with bash 5.2.15: */
+                return 128 + SIGALRM;
+
         if ((uintptr_t)r > 1) {
                 bb_simple_error_msg(r);
                 r = (char*)(uintptr_t)1;
@@ -11220,7 +11813,7 @@ static int FAST_FUNC builtin_umask(char **argv)
 }
 #endif
 
-#if ENABLE_HUSH_EXPORT || ENABLE_HUSH_READONLY || ENABLE_HUSH_SET || ENABLE_HUSH_TRAP
+#if ENABLE_HUSH_EXPORT || ENABLE_HUSH_READONLY || ENABLE_HUSH_SET || ENABLE_HUSH_TRAP || ENABLE_HUSH_ALIAS
 static void print_escaped(const char *s)
 {
 //TODO? bash "set" does not quote variables which contain only alnums and "%+,-./:=@_~",
@@ -11245,6 +11838,18 @@ static void print_escaped(const char *s)
                 putchar('"');
         } while (*s);
 }
+static void print_pfx_escaped_nl(const char *pfx, const char *s)
+{
+        const char *p = strchr(s, '=');
+        if (p) {
+                if (pfx)
+                        printf("%s %.*s", pfx, (int)(p - s) + 1, s);
+                else
+                        printf("%.*s", (int)(p - s) + 1, s);
+                print_escaped(p + 1);
+                putchar('\n');
+        }
+}
 #endif
 
 #if ENABLE_HUSH_EXPORT || ENABLE_HUSH_LOCAL || ENABLE_HUSH_READONLY
@@ -11355,14 +11960,7 @@ static int FAST_FUNC builtin_export(char **argv)
                                  * bash: declare -x VAR="VAL"
                                  * we follow ash example */
                                 const char *s = *e++;
-                                const char *p = strchr(s, '=');
-
-                                if (!p) /* wtf? take next variable */
-                                        continue;
-                                /* "export VAR=" */
-                                printf("%s %.*s", "export", (int)(p - s) + 1, s);
-                                print_escaped(p + 1);
-                                putchar('\n');
+                                print_pfx_escaped_nl("export", s);
 # endif
                         }
                         /*fflush_all(); - done after each builtin anyway */
@@ -11404,15 +12002,7 @@ static int FAST_FUNC builtin_readonly(char **argv)
                 struct variable *e;
                 for (e = G.top_var; e; e = e->next) {
                         if (e->flg_read_only) {
-                                const char *s = e->varstr;
-                                const char *p = strchr(s, '=');
-
-                                if (!p) /* wtf? take next variable */
-                                        continue;
-                                /* "readonly VAR=" */
-                                printf("%s %.*s", "readonly", (int)(p - s) + 1, s);
-                                print_escaped(p + 1);
-                                putchar('\n');
+                                print_pfx_escaped_nl("readonly", e->varstr);
                         }
                 }
                 return EXIT_SUCCESS;
@@ -11491,15 +12081,7 @@ static int FAST_FUNC builtin_set(char **argv)
         if (arg == NULL) {
                 struct variable *e;
                 for (e = G.top_var; e; e = e->next) {
-                        const char *s = e->varstr;
-                        const char *p = strchr(s, '=');
-
-                        if (!p) /* wtf? take next variable */
-                                continue;
-                        /* var= */
-                        printf("%.*s", (int)(p - s) + 1, s);
-                        print_escaped(p + 1);
-                        putchar('\n');
+                        print_pfx_escaped_nl(NULL, e->varstr);
                 }
                 return EXIT_SUCCESS;
         }
@@ -12059,8 +12641,7 @@ static int wait_for_child_or_signal(struct pipe *waitfor_pipe, pid_t waitfor_pid
                  * Or else we may race with SIGCHLD, lose it,
                  * and get stuck in sigsuspend...
                  */
-                sigfillset(&oldset); /* block all signals, remember old set */
-                sigprocmask2(SIG_SETMASK, &oldset);
+                sigblockall(&oldset); /* block all signals, remember old set */
 
                 if (!sigisemptyset(&G.pending_set)) {
                         /* Crap! we raced with some signal! */
@@ -12077,7 +12658,7 @@ static int wait_for_child_or_signal(struct pipe *waitfor_pipe, pid_t waitfor_pid
                         debug_printf_exec("job_exited_or_stopped:%d\n", rcode);
                         if (rcode >= 0) {
                                 ret = rcode;
-                                sigprocmask(SIG_SETMASK, &oldset, NULL);
+                                sigprocmask2(SIG_SETMASK, &oldset);
                                 break;
                         }
                 }
@@ -12095,7 +12676,7 @@ static int wait_for_child_or_signal(struct pipe *waitfor_pipe, pid_t waitfor_pid
                                 ret = 127;
                         }
 # endif
-                        sigprocmask(SIG_SETMASK, &oldset, NULL);
+                        sigprocmask2(SIG_SETMASK, &oldset);
                         break;
                 }
                 /* Wait for SIGCHLD or any other signal */
@@ -12113,7 +12694,7 @@ static int wait_for_child_or_signal(struct pipe *waitfor_pipe, pid_t waitfor_pid
                  * making "wait" commands in SCRIPT block forever.
                  */
  restore:
-                sigprocmask(SIG_SETMASK, &oldset, NULL);
+                sigprocmask2(SIG_SETMASK, &oldset);
  check_sig:
                 /* So, did we get a signal? */
                 sig = check_and_run_traps();
@@ -12375,3 +12956,103 @@ static int FAST_FUNC builtin_memleak(char **argv UNUSED_PARAM)
         return l;
 }
 #endif
+
+#if ENABLE_HUSH_ALIAS
+static void new_alias(char *str, char *eq)
+{
+        struct alias *alias, **aliaspp;
+
+        //bb_error_msg("%s:%d: -> find_alias_slot", __func__, __LINE__);
+        aliaspp = find_alias_slot(str, eq);
+        str = xstrdup(str);
+        alias = *aliaspp;
+        if (alias) {
+                /* Replace existing alias */
+                free(alias->str);
+                alias->str = str;
+        } else {
+                /* Create new alias */
+                alias = xzalloc(sizeof(*alias));
+                alias->str = str;
+                *aliaspp = alias;
+        }
+}
+static int FAST_FUNC builtin_alias(char **argv)
+{
+        const struct alias *alias;
+
+        if (!argv[1]) {
+                alias = G.top_alias;
+                while (alias) {
+                        print_pfx_escaped_nl("alias", alias->str);
+                        alias = alias->next;
+                }
+                return 0;
+        }
+
+        while (*++argv) {
+                char *eq = end_of_alias_name(*argv);
+                if (*eq == '=' && eq != *argv) {
+                        /* alias NAME=VALUE */
+                        new_alias(*argv, eq);
+                } else {
+                        eq = strchrnul(eq, '=');
+                        if (*eq == '=') {
+                                /* alias 'NA&ME=VALUE' (invalid chars in name) */
+                                bb_error_msg("alias: '%.*s': invalid alias name", (int)(eq - *argv), *argv);
+                                continue; /* continue processing argv (bash compat)  */
+                        }
+                        /* alias SOMETHING_WITHOUT_EQUAL_SIGN */
+                        //bb_error_msg("%s:%d: -> find_alias_slot", __func__, __LINE__);
+                        alias = *find_alias_slot(*argv, eq);
+                        if (alias) {
+                                print_pfx_escaped_nl("alias", alias->str);
+                        } else {
+                                bb_error_msg("unalias: '%s': not found" + 2, *argv);
+                                /* return 1; - no, continue processing argv (bash compat) */
+                        }
+                }
+        }
+        return 0;
+}
+
+static void unset_alias(struct alias **aliaspp)
+{
+        struct alias *alias = *aliaspp;
+
+        *aliaspp = alias->next;
+        free(alias->str);
+        free(alias);
+}
+static int FAST_FUNC builtin_unalias(char **argv)
+{
+        int ret = 0;
+
+        if (!argv[1]) {
+                bb_simple_error_msg("usage: unalias -a | NAME...");
+                return EXIT_FAILURE;
+        }
+
+        while (*++argv) {
+                struct alias **aliaspp;
+
+                if (strcmp(*argv, "-a") == 0) {
+                        /* Remove all aliases */
+                        while (G.top_alias) {
+                                unset_alias(&G.top_alias);
+                        }
+                        /* bash: "unalias -a NO_SUCH_ALIAS" says nothing (won't try to unalias NO_SUCH_ALIAS): */
+                        break;
+                }
+                //bb_error_msg("%s:%d: -> find_alias_slot", __func__, __LINE__);
+                aliaspp = find_alias_slot(*argv, strchr(*argv, '\0')); /* think of "unalias a=b" case! */
+                if (*aliaspp) {
+                        unset_alias(aliaspp);
+                } else {
+                        bb_error_msg("unalias: '%s': not found", *argv);
+                        ret = EXIT_FAILURE;
+                }
+        }
+        return ret;
+}
+#endif
diff --git a/shell/hush_leaktool.sh b/shell/hush_leaktool.sh
index ca35ec144..3edd3df61 100755
--- a/shell/hush_leaktool.sh
+++ b/shell/hush_leaktool.sh
@@ -7,7 +7,7 @@ freelist=`grep 'free 0x' "$output" | cut -d' ' -f2 | sort | uniq | xargs`
 
 grep -v free "$output" >"$output.leaked"
 
-i=8
+i=16
 list=
 for freed in $freelist; do
     list="$list -e $freed"
@@ -15,7 +15,7 @@ for freed in $freelist; do
     echo Dropping $list
     grep -F -v $list <"$output.leaked" >"$output.temp"
     mv "$output.temp" "$output.leaked"
-    i=8
+    i=16
     list=
 done
 if test "$list"; then
@@ -23,3 +23,17 @@ if test "$list"; then
     grep -F -v $list <"$output.leaked" >"$output.temp"
     mv "$output.temp" "$output.leaked"
 fi
+
+# All remaining allocations are on addresses which were never freed.
+# * Sort them by line, grouping together allocations which allocated the same address.
+#       A leaky allocation will give many different addresses (because it's never freed,
+#       the address can not be reused).
+# * Remove the address (field #4).
+# * Count the allocations per every unique source line and alloc type.
+# * Show largest counts on top.
+cat output.leaked \
+        | sort -u \
+        | cut -d' ' -f1-3 \
+        | uniq -c \
+        | sort -rn \
+>output.leaked.counted_uniq_alloc_address
diff --git a/shell/hush_test/hush-misc/tickquote1.right b/shell/hush_test/hush-bugs/tickquote1.right
index 56f8515b7..56f8515b7 100644
--- a/shell/hush_test/hush-misc/tickquote1.right
+++ b/shell/hush_test/hush-bugs/tickquote1.right
diff --git a/shell/hush_test/hush-misc/tickquote1.tests b/shell/hush_test/hush-bugs/tickquote1.tests
index 02e3904f1..02e3904f1 100755
--- a/shell/hush_test/hush-misc/tickquote1.tests
+++ b/shell/hush_test/hush-bugs/tickquote1.tests
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2a.right b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2a.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2a.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2a.tests b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2a.tests
new file mode 100755
index 000000000..eb2223031
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline2a.tests
@@ -0,0 +1,4 @@
+cat <<-EOF
+        Ok1
+        EO\
+F
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3.right b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3.tests b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3.tests
new file mode 100755
index 000000000..de21132d1
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3.tests
@@ -0,0 +1,4 @@
+cat <<EOF
+Ok1
+\
+EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3a.right b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3a.right
new file mode 100644
index 000000000..3d79316d7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3a.right
@@ -0,0 +1 @@
+Ok1
diff --git a/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3a.tests b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3a.tests
new file mode 100755
index 000000000..da3860804
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_bkslash_newline3a.tests
@@ -0,0 +1,4 @@
+cat <<-EOF
+Ok1
+        \
+        EOF
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right
new file mode 100644
index 000000000..7af73557a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right
@@ -0,0 +1 @@
+hush: syntax error: missing here document terminator
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests
new file mode 100755
index 000000000..33ccde26b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests
@@ -0,0 +1,2 @@
+echo <<
+echo Done:
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right
new file mode 100644
index 000000000..7af73557a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right
@@ -0,0 +1 @@
+hush: syntax error: missing here document terminator
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests
new file mode 100755
index 000000000..fcda11045
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests
@@ -0,0 +1,2 @@
+echo << >
+echo Done:
diff --git a/shell/hush_test/hush-heredoc/herestring1.right b/shell/hush_test/hush-heredoc/herestring1.right
new file mode 100644
index 000000000..555937daa
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/herestring1.right
@@ -0,0 +1,33 @@
+one
+_two
+\_three
+\_four
+\_two
+\_three
+\\_four
+two_newlines
+
+/bin/c*
+star_*
+star_*
+star_*
+star_\*
+star_*
+star_\*
+line1
+line2
+        line3
+line1
+line2
+        line3
+512
+256
+128
+64
+32
+16
+8
+4
+2
+v-$a-\t-\-\"-\x-`-\--\z-\*-\?-
+v-$a-\t-\-"-\x-`-\--\z-\*-\?-
diff --git a/shell/hush_test/hush-heredoc/herestring1.tests b/shell/hush_test/hush-heredoc/herestring1.tests
new file mode 100755
index 000000000..fb7bd0dda
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/herestring1.tests
@@ -0,0 +1,35 @@
+cat <<<one
+cat <<<\_two
+cat <<<"\_three"
+cat <<<'\_four'
+cat <<<\\_two
+cat <<<"\\_three"
+cat <<<'\\_four'
+
+cat <<<$'two_newlines\n'
+
+cat <<</bin/c*
+
+cat <<<star_*
+cat <<<star_\*
+cat <<<"star_*"
+cat <<<"star_\*"
+cat <<<'star_*'
+cat <<<'star_\*'
+
+var=$'line1
+line2
+        line3'
+
+cat <<<$var
+
+cat <<<"$var"
+
+i=10
+until test $((--i)) = 0; do
+        cat <<<$((2**i))
+done
+
+a=qwerty
+cat <<<`echo v'-$a-\t-\\-\"-\x-\`-\--\z-\*-\?-'`
+cat <<<"`echo v'-$a-\t-\\-\"-\x-\`-\--\z-\*-\?-'`"
diff --git a/shell/hush_test/hush-misc/assignment2.right b/shell/hush_test/hush-misc/assignment2.right
index 9d1860be7..5e54b408b 100644
--- a/shell/hush_test/hush-misc/assignment2.right
+++ b/shell/hush_test/hush-misc/assignment2.right
@@ -1,2 +1,4 @@
 hush: can't execute 'a=b': No such file or directory
 127
+hush: can't execute 'ab=c': No such file or directory
+127
diff --git a/shell/hush_test/hush-misc/assignment2.tests b/shell/hush_test/hush-misc/assignment2.tests
index f6938434c..a93a48d09 100755
--- a/shell/hush_test/hush-misc/assignment2.tests
+++ b/shell/hush_test/hush-misc/assignment2.tests
@@ -1,3 +1,5 @@
 # This must not be interpreted as an assignment
 a''=b true
 echo $?
+a'b'=c true
+echo $?
diff --git a/shell/hush_test/hush-misc/case2.right b/shell/hush_test/hush-misc/case2.right
new file mode 100644
index 000000000..4780199de
--- /dev/null
+++ b/shell/hush_test/hush-misc/case2.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected )
diff --git a/shell/hush_test/hush-misc/case2.tests b/shell/hush_test/hush-misc/case2.tests
new file mode 100755
index 000000000..b9475392e
--- /dev/null
+++ b/shell/hush_test/hush-misc/case2.tests
@@ -0,0 +1,6 @@
+# had a parser bug which incorrectly detected ";;"
+case w in
+a);
+b);;
+esac
+echo Should not be reached
diff --git a/shell/hush_test/hush-misc/case3.right b/shell/hush_test/hush-misc/case3.right
new file mode 100644
index 000000000..4780199de
--- /dev/null
+++ b/shell/hush_test/hush-misc/case3.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected )
diff --git a/shell/hush_test/hush-misc/case3.tests b/shell/hush_test/hush-misc/case3.tests
new file mode 100755
index 000000000..7ef6a18a9
--- /dev/null
+++ b/shell/hush_test/hush-misc/case3.tests
@@ -0,0 +1,7 @@
+# had a parser bug which incorrectly detected ";;"
+case w in
+a) true
+;
+b);;
+esac
+echo Should not be reached
diff --git a/shell/hush_test/hush-misc/case4.right b/shell/hush_test/hush-misc/case4.right
new file mode 100644
index 000000000..02a29ccbc
--- /dev/null
+++ b/shell/hush_test/hush-misc/case4.right
@@ -0,0 +1,2 @@
+Keyword-like word may be in pattern
+Ok:0
diff --git a/shell/hush_test/hush-misc/case4.tests b/shell/hush_test/hush-misc/case4.tests
new file mode 100755
index 000000000..63b9dfd99
--- /dev/null
+++ b/shell/hush_test/hush-misc/case4.tests
@@ -0,0 +1,8 @@
+if=if
+case if in
+if) echo "Keyword-like word may be in pattern";;
+fi) echo "Not reached";;
+# esac) echo "Not reached";; # not accepted by bash 5.2.15
+do) echo "Not reached"
+esac
+echo Ok:$?
diff --git a/shell/hush_test/hush-misc/func6.right b/shell/hush_test/hush-misc/func6.right
new file mode 100644
index 000000000..01e79c32a
--- /dev/null
+++ b/shell/hush_test/hush-misc/func6.right
@@ -0,0 +1,3 @@
+1
+2
+3
diff --git a/shell/hush_test/hush-misc/func6.tests b/shell/hush_test/hush-misc/func6.tests
new file mode 100755
index 000000000..5f1699c42
--- /dev/null
+++ b/shell/hush_test/hush-misc/func6.tests
@@ -0,0 +1,8 @@
+{ f() { echo $1; } }
+f 1
+
+{ f() ( echo $1; )}
+f 2
+
+{ f()(echo $1)}
+f 3
diff --git a/shell/hush_test/hush-misc/func7.right b/shell/hush_test/hush-misc/func7.right
new file mode 100644
index 000000000..7b24a35ff
--- /dev/null
+++ b/shell/hush_test/hush-misc/func7.right
@@ -0,0 +1 @@
+Ok:0
diff --git a/shell/hush_test/hush-misc/func7.tests b/shell/hush_test/hush-misc/func7.tests
new file mode 100755
index 000000000..f5e03b6e1
--- /dev/null
+++ b/shell/hush_test/hush-misc/func7.tests
@@ -0,0 +1 @@
+if f() { echo Ok:$?; } then f; fi
diff --git a/shell/hush_test/hush-misc/sig_exitcode.tests b/shell/hush_test/hush-misc/sig_exitcode.tests
index 7879dc854..67b4500f4 100755
--- a/shell/hush_test/hush-misc/sig_exitcode.tests
+++ b/shell/hush_test/hush-misc/sig_exitcode.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 exec 2>&1
 
 $THIS_SH -c 'kill -9 $$'
diff --git a/shell/hush_test/hush-misc/syntax_err_negate.right b/shell/hush_test/hush-misc/syntax_err_negate.right
index 8c7010629..39db799ea 100644
--- a/shell/hush_test/hush-misc/syntax_err_negate.right
+++ b/shell/hush_test/hush-misc/syntax_err_negate.right
@@ -1,2 +1,2 @@
-bash 3.2 fails this
-hush: syntax error: ! ! command
+0:0
+1:1
diff --git a/shell/hush_test/hush-misc/syntax_err_negate.tests b/shell/hush_test/hush-misc/syntax_err_negate.tests
index d61b1b09f..64f0f8a75 100755
--- a/shell/hush_test/hush-misc/syntax_err_negate.tests
+++ b/shell/hush_test/hush-misc/syntax_err_negate.tests
@@ -1,2 +1,3 @@
-echo bash 3.2 fails this
-! ! true
+# bash 3.2 fails this, 5.2.15 allows
+! ! true; echo 0:$?
+! ! ! true; echo 1:$?
diff --git a/shell/hush_test/hush-misc/wait1.tests b/shell/hush_test/hush-misc/wait1.tests
index f9cf6d48c..54120319b 100755
--- a/shell/hush_test/hush-misc/wait1.tests
+++ b/shell/hush_test/hush-misc/wait1.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 2 & sleep 1 & wait $!
 echo $?
 jobs
diff --git a/shell/hush_test/hush-misc/wait2.tests b/shell/hush_test/hush-misc/wait2.tests
index be20f95a5..60f382c9f 100755
--- a/shell/hush_test/hush-misc/wait2.tests
+++ b/shell/hush_test/hush-misc/wait2.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 3 & sleep 2 & sleep 1
 wait $!
 echo $?
diff --git a/shell/hush_test/hush-misc/wait3.tests b/shell/hush_test/hush-misc/wait3.tests
index ac541c3fc..aceed1126 100755
--- a/shell/hush_test/hush-misc/wait3.tests
+++ b/shell/hush_test/hush-misc/wait3.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 2 & (sleep 1;exit 3) & wait $!
 echo $?
 jobs
diff --git a/shell/hush_test/hush-misc/wait4.tests b/shell/hush_test/hush-misc/wait4.tests
index cc34059ac..c979a38b6 100755
--- a/shell/hush_test/hush-misc/wait4.tests
+++ b/shell/hush_test/hush-misc/wait4.tests
@@ -1,2 +1,5 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 1 | (sleep 1;exit 3) & wait %1
 echo Three:$?
diff --git a/shell/hush_test/hush-misc/wait5.tests b/shell/hush_test/hush-misc/wait5.tests
index 1b4762d89..e0ac8c251 100755
--- a/shell/hush_test/hush-misc/wait5.tests
+++ b/shell/hush_test/hush-misc/wait5.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 0 | (sleep 0;exit 3) &
 sleep 1
 echo Zero:$?
diff --git a/shell/hush_test/hush-misc/wait6.tests b/shell/hush_test/hush-misc/wait6.tests
index c23713199..c09002ab0 100755
--- a/shell/hush_test/hush-misc/wait6.tests
+++ b/shell/hush_test/hush-misc/wait6.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 # In bash, "wait $!" extracts correct exitcode even if bg task has already exited
 # It prints 0, then 3:
 (sleep 0; exit 3) & sleep 1
diff --git a/shell/hush_test/hush-parsing/bad_cmd1.right b/shell/hush_test/hush-parsing/bad_cmd1.right
new file mode 100644
index 000000000..ad7f80d96
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_cmd1.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected ||
diff --git a/shell/hush_test/hush-parsing/bad_cmd1.tests b/shell/hush_test/hush-parsing/bad_cmd1.tests
new file mode 100755
index 000000000..b4bf53a75
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_cmd1.tests
@@ -0,0 +1 @@
+||date
diff --git a/shell/hush_test/hush-parsing/bad_cmd2.right b/shell/hush_test/hush-parsing/bad_cmd2.right
new file mode 100644
index 000000000..9c3ed0a65
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_cmd2.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected &&
diff --git a/shell/hush_test/hush-parsing/bad_cmd2.tests b/shell/hush_test/hush-parsing/bad_cmd2.tests
new file mode 100755
index 000000000..13580e14a
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_cmd2.tests
@@ -0,0 +1 @@
+&&date
diff --git a/shell/hush_test/hush-parsing/bad_cmd3.right b/shell/hush_test/hush-parsing/bad_cmd3.right
new file mode 100644
index 000000000..05618a2d9
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_cmd3.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected &
diff --git a/shell/hush_test/hush-parsing/bad_cmd3.tests b/shell/hush_test/hush-parsing/bad_cmd3.tests
new file mode 100755
index 000000000..bec7e5180
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_cmd3.tests
@@ -0,0 +1 @@
+& date
diff --git a/shell/hush_test/hush-parsing/bad_pipe1.right b/shell/hush_test/hush-parsing/bad_pipe1.right
new file mode 100644
index 000000000..c8ce26235
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe1.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected |
diff --git a/shell/hush_test/hush-parsing/bad_pipe1.tests b/shell/hush_test/hush-parsing/bad_pipe1.tests
new file mode 100755
index 000000000..ca5f2ec48
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe1.tests
@@ -0,0 +1 @@
+|date
diff --git a/shell/hush_test/hush-parsing/bad_pipe2.right b/shell/hush_test/hush-parsing/bad_pipe2.right
new file mode 100644
index 000000000..6d63482b8
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe2.right
@@ -0,0 +1 @@
+hush: syntax error: unterminated |
diff --git a/shell/hush_test/hush-parsing/bad_pipe2.tests b/shell/hush_test/hush-parsing/bad_pipe2.tests
new file mode 100755
index 000000000..d0aa5c73c
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe2.tests
@@ -0,0 +1 @@
+date|
diff --git a/shell/hush_test/hush-parsing/bad_pipe3.right b/shell/hush_test/hush-parsing/bad_pipe3.right
new file mode 100644
index 000000000..6d63482b8
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe3.right
@@ -0,0 +1 @@
+hush: syntax error: unterminated |
diff --git a/shell/hush_test/hush-parsing/bad_pipe3.tests b/shell/hush_test/hush-parsing/bad_pipe3.tests
new file mode 100755
index 000000000..ab312d139
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe3.tests
@@ -0,0 +1 @@
+date|;
diff --git a/shell/hush_test/hush-parsing/bad_pipe4.right b/shell/hush_test/hush-parsing/bad_pipe4.right
new file mode 100644
index 000000000..6d63482b8
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe4.right
@@ -0,0 +1 @@
+hush: syntax error: unterminated |
diff --git a/shell/hush_test/hush-parsing/bad_pipe4.tests b/shell/hush_test/hush-parsing/bad_pipe4.tests
new file mode 100755
index 000000000..c39098c8b
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe4.tests
@@ -0,0 +1 @@
+date| &
diff --git a/shell/hush_test/hush-parsing/bad_pipe5.right b/shell/hush_test/hush-parsing/bad_pipe5.right
new file mode 100644
index 000000000..6d63482b8
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe5.right
@@ -0,0 +1 @@
+hush: syntax error: unterminated |
diff --git a/shell/hush_test/hush-parsing/bad_pipe5.tests b/shell/hush_test/hush-parsing/bad_pipe5.tests
new file mode 100755
index 000000000..d5866ce79
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe5.tests
@@ -0,0 +1 @@
+date| && date
diff --git a/shell/hush_test/hush-parsing/bad_pipe6.right b/shell/hush_test/hush-parsing/bad_pipe6.right
new file mode 100644
index 000000000..6d63482b8
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe6.right
@@ -0,0 +1 @@
+hush: syntax error: unterminated |
diff --git a/shell/hush_test/hush-parsing/bad_pipe6.tests b/shell/hush_test/hush-parsing/bad_pipe6.tests
new file mode 100755
index 000000000..1a9476b92
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe6.tests
@@ -0,0 +1 @@
+date| || date
diff --git a/shell/hush_test/hush-parsing/bad_pipe7.right b/shell/hush_test/hush-parsing/bad_pipe7.right
new file mode 100644
index 000000000..c8ce26235
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe7.right
@@ -0,0 +1 @@
+hush: syntax error: unexpected |
diff --git a/shell/hush_test/hush-parsing/bad_pipe7.tests b/shell/hush_test/hush-parsing/bad_pipe7.tests
new file mode 100755
index 000000000..b048affb0
--- /dev/null
+++ b/shell/hush_test/hush-parsing/bad_pipe7.tests
@@ -0,0 +1 @@
+date| |date
diff --git a/shell/hush_test/hush-read/read_t.right b/shell/hush_test/hush-read/read_t.right
index 04126cbe6..3eedae275 100644
--- a/shell/hush_test/hush-read/read_t.right
+++ b/shell/hush_test/hush-read/read_t.right
@@ -1,4 +1,4 @@
-><
-><
->test<
->test<
+>te:142<
+>:142<
+>test:0<
+>test:0<
diff --git a/shell/hush_test/hush-read/read_t.tests b/shell/hush_test/hush-read/read_t.tests
index d65f1aeaa..9fbeec517 100755
--- a/shell/hush_test/hush-read/read_t.tests
+++ b/shell/hush_test/hush-read/read_t.tests
@@ -1,10 +1,10 @@
-# bash 3.2 outputs:
+# bash 5.2 outputs:
 
-# ><
-{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply<")
-# ><
-{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply<")
-# >test<
-{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply<")
-# >test<
-{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply<")
+# >te:142<
+{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply:$?<")
+# >:142<
+{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply:$?<")
+# >test:0<
+{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply:$?<")
+# >test:0<
+{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply:$?<")
diff --git a/shell/hush_test/hush-redir/redir_EINTR1.right b/shell/hush_test/hush-redir/redir_EINTR1.right
new file mode 100644
index 000000000..287d91f67
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_EINTR1.right
@@ -0,0 +1,2 @@
+Hello
+Done:0
diff --git a/shell/hush_test/hush-redir/redir_EINTR1.tests b/shell/hush_test/hush-redir/redir_EINTR1.tests
new file mode 100755
index 000000000..cede4d4d8
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_EINTR1.tests
@@ -0,0 +1,13 @@
+rm -f test.fifo
+mkfifo test.fifo
+
+(sleep 1; kill -chld $$) &
+(sleep 2; echo Hello >test.fifo) &
+
+# We get open("test.fifo") interrupted by SIGCHLD from the first subshell.
+# The shell MUST retry the open (no printing of error messages).
+# Then, the second subshell opens fifo for writing and open unblocks and succeeds.
+cat <test.fifo
+
+echo "Done:$?"
+rm -f test.fifo
diff --git a/shell/hush_test/hush-redir/redir_EINTR2.right b/shell/hush_test/hush-redir/redir_EINTR2.right
new file mode 100644
index 000000000..287d91f67
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_EINTR2.right
@@ -0,0 +1,2 @@
+Hello
+Done:0
diff --git a/shell/hush_test/hush-redir/redir_EINTR2.tests b/shell/hush_test/hush-redir/redir_EINTR2.tests
new file mode 100755
index 000000000..3d343c7ea
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_EINTR2.tests
@@ -0,0 +1,14 @@
+rm -f test.fifo
+mkfifo test.fifo
+
+(sleep 1; kill -chld $$) &
+(sleep 2; echo Hello >test.fifo) &
+
+# We get open("test.fifo") interrupted by SIGCHLD from the first subshell.
+# The shell MUST retry the open (no printing of error messages).
+# Then, the second subshell opens fifo for writing and open unblocks and succeeds.
+read HELLO <test.fifo
+echo "$HELLO"
+
+echo "Done:$?"
+rm -f test.fifo
diff --git a/shell/hush_test/hush-redir/redir_and_constructs1.right b/shell/hush_test/hush-redir/redir_and_constructs1.right
new file mode 100644
index 000000000..232cd8734
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_and_constructs1.right
@@ -0,0 +1,2 @@
+hush: can't execute '!': No such file or directory
+127:127
diff --git a/shell/hush_test/hush-redir/redir_and_constructs1.tests b/shell/hush_test/hush-redir/redir_and_constructs1.tests
new file mode 100755
index 000000000..a92731e04
--- /dev/null
+++ b/shell/hush_test/hush-redir/redir_and_constructs1.tests
@@ -0,0 +1,2 @@
+# Reserved words are not recognized after redirects
+</dev/null ! true; echo 127:$?
diff --git a/shell/hush_test/hush-signals/catch.tests b/shell/hush_test/hush-signals/catch.tests
index d2a21d17e..4b1a08e8f 100755
--- a/shell/hush_test/hush-signals/catch.tests
+++ b/shell/hush_test/hush-signals/catch.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test ("User defined signal 2" text not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 # avoid ugly warnings about signals not being caught
 trap ":" USR1 USR2
 
diff --git a/shell/hush_test/hush-signals/signal1.tests b/shell/hush_test/hush-signals/signal1.tests
index 61943467a..c83fa1254 100755
--- a/shell/hush_test/hush-signals/signal1.tests
+++ b/shell/hush_test/hush-signals/signal1.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 trap "echo got signal" USR1
 
 for try in 1 2 3 4 5; do
diff --git a/shell/hush_test/hush-signals/signal8.tests b/shell/hush_test/hush-signals/signal8.tests
index 731af7477..cd5790164 100755
--- a/shell/hush_test/hush-signals/signal8.tests
+++ b/shell/hush_test/hush-signals/signal8.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 "$THIS_SH" -c '
 exit_func() {
     echo "Removing traps"
diff --git a/shell/hush_test/hush-signals/signal_read2.tests b/shell/hush_test/hush-signals/signal_read2.tests
index eab5b9b5b..11accd5ab 100755
--- a/shell/hush_test/hush-signals/signal_read2.tests
+++ b/shell/hush_test/hush-signals/signal_read2.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test ("Hangup" not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 $THIS_SH -c '
 (sleep 1; kill -HUP $$) &
 while true; do
diff --git a/shell/hush_test/hush-signals/subshell.tests b/shell/hush_test/hush-signals/subshell.tests
index d877f2b82..856c922d3 100755
--- a/shell/hush_test/hush-signals/subshell.tests
+++ b/shell/hush_test/hush-signals/subshell.tests
@@ -1,5 +1,8 @@
 # Non-empty traps should be reset in subshell
 
+# If job control is disabled, skip the test ("Terminated" text not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 # HUP is special in interactive shells
 trap '' HUP
 # QUIT is always special
diff --git a/shell/hush_test/hush-vars/var_backslash1.right b/shell/hush_test/hush-vars/var_backslash1.right
new file mode 100644
index 000000000..3f2c21289
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_backslash1.right
@@ -0,0 +1,35 @@
+a is '\*bc'
+b is '\'
+c is '*'
+${a##?*} removes everything:    || - matches one char, then all
+${a##?"*"} removes \*:          |bc| - matches one char, then *
+${a##\*} removes nothing:       |\*bc| - first char is not *
+${a##\\*} removes everything:   || - matches \, then all
+${a##\\\*} removes \*:          |bc| - matches \, then *
+${a##?$c} removes everything:   || - matches one char, then all
+${a##?"$c"} removes \*:         |bc| - matches one char, then *
+${a##\\$c} removes everything:  || - matches \, then all
+${a##\\\$c} removes nothing:    |\*bc| - matches \, but then second char is not $
+${a##\\"$c"} removes \*:        |bc| - matches \, then *
+${a##$b} removes \:             |*bc| - matches \
+${a##"$b"} removes \:           |*bc| - matches \
+
+Single quote tests:
+${a##?'*'} removes \*:          |bc| - matches one char, then *
+${a##'\'*} removes everything:  || - matches \, then all
+${a##'\'\*} removes \*:         |bc| - matches \, then *
+${a##'\*'} removes \*:          |bc| - matches \, then *
+${a##'\'$c} removes everything: || - matches \, then all
+${a##'\'\$c} removes nothing:   |\*bc| - matches \, but then second char is not $
+${a##'\'"$c"} removes \*:       |bc| - matches \, then *
+
+${a##"$b"?} removes \*:         |bc| - matches \, then one char
+${a##"$b"*} removes everything: || - matches \, then all
+${a##"$b""?"} removes nothing:  |\*bc| - second char is not ?
+${a##"$b""*"} removes \*:       |bc| - matches \, then *
+${a##"$b"\*} removes \*:        |bc| - matches \, then *
+${a##"$b"$c} removes everything:|| - matches \, then all
+${a##"$b""$c"} removes \*:      |bc| - matches \, then *
+${a##"$b?"} removes nothing:    |\*bc| - second char is not ?
+${a##"$b*"} removes \*:         |bc| - matches \, then *
+${a##"$b$c"} removes \*:        |bc| - matches \, then *
diff --git a/shell/hush_test/hush-vars/var_backslash1.tests b/shell/hush_test/hush-vars/var_backslash1.tests
new file mode 100755
index 000000000..015a6107b
--- /dev/null
+++ b/shell/hush_test/hush-vars/var_backslash1.tests
@@ -0,0 +1,48 @@
+a='\*bc'
+b='\'
+c='*'
+echo "a is '$a'"
+echo "b is '$b'"
+echo "c is '$c'"
+echo '${a##?*} removes everything:    '"|${a##?*}|"' - matches one char, then all'
+echo '${a##?"*"} removes \*:          '"|${a##?"*"}|"' - matches one char, then *'
+echo '${a##\*} removes nothing:       '"|${a##\*}|"' - first char is not *'
+echo '${a##\\*} removes everything:   '"|${a##\\*}|"' - matches \, then all'
+echo '${a##\\\*} removes \*:          '"|${a##\\\*}|"' - matches \, then *'
+echo '${a##?$c} removes everything:   '"|${a##?$c}|"' - matches one char, then all'
+echo '${a##?"$c"} removes \*:         '"|${a##?"$c"}|"' - matches one char, then *'
+echo '${a##\\$c} removes everything:  '"|${a##\\$c}|"' - matches \, then all'
+echo '${a##\\\$c} removes nothing:    '"|${a##\\\$c}|"' - matches \, but then second char is not $'
+echo '${a##\\"$c"} removes \*:        '"|${a##\\"$c"}|"' - matches \, then *'
+echo '${a##$b} removes \:             '"|${a##$b}|"' - matches \'
+echo '${a##"$b"} removes \:           '"|${a##"$b"}|"' - matches \'
+echo
+sq="'"
+echo 'Single quote tests:'
+echo '${a##?'$sq'*'$sq'} removes \*:          '"|${a##?'*'}|"' - matches one char, then *'
+echo '${a##'$sq'\'$sq'*} removes everything:  '"|${a##'\'*}|"' - matches \, then all'
+echo '${a##'$sq'\'$sq'\*} removes \*:         '"|${a##'\'\*}|"' - matches \, then *'
+echo '${a##'$sq'\*'$sq'} removes \*:          '"|${a##'\*'}|"' - matches \, then *'
+echo '${a##'$sq'\'$sq'$c} removes everything: '"|${a##'\'$c}|"' - matches \, then all'
+echo '${a##'$sq'\'$sq'\$c} removes nothing:   '"|${a##'\'\$c}|"' - matches \, but then second char is not $'
+echo '${a##'$sq'\'$sq'"$c"} removes \*:       '"|${a##'\'"$c"}|"' - matches \, then *'
+echo
+## In bash, this isn't working as expected
+#echo '${a##$b?} removes \*:           '"|${a##$b?}|"' - matches \, then one char'   # bash prints |\*bc|
+#echo '${a##$b*} removes everything:   '"|${a##$b*}|"' - matches \, then all'        # bash prints |\*bc|
+#echo '${a##$b$c} removes everything:  '"|${a##$b$c}|"' - matches \, then all'       # bash prints |\*bc|
+#echo '${a##$b"$c"} removes \*:        '"|${a##$b"$c"}|"' - matches \, then *'       # bash prints |\*bc|
+## the cause seems to be that $b emits backslash that "glues" onto next character if there is one:
+## a='\*bc'; b='\'; c='*'; echo "|${a##?$b*}|"  # bash prints |bc| - the $b* works as \* (matches literal *)
+## a='\*bc'; b='\'; c='*'; echo "|${a##\\$b*}|" # bash prints |bc|
+#echo
+echo '${a##"$b"?} removes \*:         '"|${a##"$b"?}|"' - matches \, then one char'
+echo '${a##"$b"*} removes everything: '"|${a##"$b"*}|"' - matches \, then all'
+echo '${a##"$b""?"} removes nothing:  '"|${a##"$b""?"}|"' - second char is not ?'  # bash prints |bc|
+echo '${a##"$b""*"} removes \*:       '"|${a##"$b""*"}|"' - matches \, then *'
+echo '${a##"$b"\*} removes \*:        '"|${a##"$b"\*}|"' - matches \, then *'
+echo '${a##"$b"$c} removes everything:'"|${a##"$b"$c}|"' - matches \, then all'
+echo '${a##"$b""$c"} removes \*:      '"|${a##"$b""$c"}|"' - matches \, then *'
+echo '${a##"$b?"} removes nothing:    '"|${a##"$b?"}|"' - second char is not ?'  # bash prints |bc|
+echo '${a##"$b*"} removes \*:         '"|${a##"$b*"}|"' - matches \, then *'     # bash prints ||
+echo '${a##"$b$c"} removes \*:        '"|${a##"$b$c"}|"' - matches \, then *'
diff --git a/shell/hush_test/run-all b/shell/hush_test/run-all
index 7345fee43..ff29ca0b1 100755
--- a/shell/hush_test/run-all
+++ b/shell/hush_test/run-all
@@ -67,9 +67,12 @@ do_test()
 #               echo Running test: "$x"
                 echo -n "$1/$x:"
                 (
-                        "$THIS_SH" "./$x" 2>&1 | \
-                                grep -va "^hush: using fallback suid method$" >"$name.xx"
+                        "$THIS_SH" "./$x" >"$name.xx" 2>&1
                         r=$?
+                        # filter !FEATURE_SUID_CONFIG_QUIET message
+                        sed -i \
+                                -e "/^hush: using fallback suid method$/d" \
+                                "$name.xx"
                         # filter C library differences
                         sed -i \
                                 -e "/: invalid option /s:'::g" \
diff --git a/shell/random.c b/shell/random.c
index ffe0cc937..56c7c5a3c 100644
--- a/shell/random.c
+++ b/shell/random.c
@@ -19,17 +19,6 @@
 # include "random.h"
 # define RAND_BASH_MASK 0x7fff
 
-# if ENABLE_FEATURE_PRNG_SHELL
-uint32_t FAST_FUNC
-next_random(random_t *rnd)
-{
-        return full_random(rnd) & RAND_BASH_MASK;
-}
-#  undef RAND_BASH_MASK
-#  define RAND_BASH_MASK 0xffffffff
-#  define next_random full_random
-# endif
-
 #else
 # include <stdint.h>
 # include <unistd.h>
diff --git a/shell/random.h b/shell/random.h
index 75fe0f69f..c4eb44c13 100644
--- a/shell/random.h
+++ b/shell/random.h
@@ -35,9 +35,6 @@ typedef struct random_t {
         ((rnd)->galois_LFSR = 0)
 
 uint32_t next_random(random_t *rnd) FAST_FUNC;
-#if ENABLE_FEATURE_PRNG_SHELL
-uint32_t full_random(random_t *rnd) FAST_FUNC;
-#endif
 
 POP_SAVED_FUNCTION_VISIBILITY
 
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 7fb5f8c58..657f0df8f 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -55,7 +55,7 @@ const char* FAST_FUNC
 shell_builtin_read(struct builtin_read_params *params)
 {
         struct pollfd pfd[1];
-#define fd (pfd[0].fd) /* -u FD */
+#define fd (pfd->fd) /* -u FD */
         unsigned err;
         unsigned end_ms; /* -t TIMEOUT */
         int nchars; /* -n NUM */
@@ -144,7 +144,7 @@ shell_builtin_read(struct builtin_read_params *params)
                  * bash seems to ignore -p PROMPT for this use case.
                  */
                 int r;
-                pfd[0].events = POLLIN;
+                pfd->events = POLLIN;
                 r = poll(pfd, 1, /*timeout:*/ 0);
                 /* Return 0 only if poll returns 1 ("one fd ready"), else return 1: */
                 return (const char *)(uintptr_t)(r <= 0);
@@ -209,8 +209,8 @@ shell_builtin_read(struct builtin_read_params *params)
                          * 32-bit unix time wrapped (year 2038+).
                          */
                         if (timeout <= 0) { /* already late? */
-                                retval = (const char *)(uintptr_t)1;
-                                goto ret;
+                                retval = (const char *)(uintptr_t)2;
+                                break;
                         }
                 }
 
@@ -219,15 +219,23 @@ shell_builtin_read(struct builtin_read_params *params)
                  * regardless of SA_RESTART-ness of that signal!
                  */
                 errno = 0;
-                pfd[0].events = POLLIN;
-//TODO race with a signal arriving just before the poll!
+                pfd->events = POLLIN;
+
 #if ENABLE_PLATFORM_MINGW32
-                /* Don't poll if timeout is -1, it hurts performance. */
+                /* Don't poll if timeout is -1, it hurts performance.  The
+                 * caution above about interrupts isn't relevant on Windows
+                 * where Ctrl-C causes an event, not a signal.
+                 */
                 if (timeout >= 0)
 #endif
-                if (poll(pfd, 1, timeout) <= 0) {
-                        /* timed out, or EINTR */
+                /* test bb_got_signal, then poll(), atomically wrt signals */
+                if (check_got_signal_and_poll(pfd, timeout) <= 0) {
+                        /* timed out, or some error */
                         err = errno;
+                        if (!err) { /* timed out */
+                                retval = (const char *)(uintptr_t)2;
+                                break;
+                        }
                         retval = (const char *)(uintptr_t)1;
                         goto ret;
                 }
@@ -238,15 +246,18 @@ shell_builtin_read(struct builtin_read_params *params)
                         key = windows_read_key(fd, NULL, timeout);
                         if (key == 0x03) {
                                 /* ^C pressed */
-                                retval = (const char *)(uintptr_t)2;
+                                retval = (const char *)(uintptr_t)3;
                                 goto ret;
                         }
-                        else if (key == -1 || (key == 0x1a && bufpos == 0)) {
-                                /* timeout or ^Z at start of buffer */
+                        else if (key == -1) {
+                                /* timeout */
+                                retval = (const char *)(uintptr_t)2;
+                                break;
+                        } else if (key == 0x1a && bufpos == 0) {
+                                /* ^Z at start of buffer */
                                 retval = (const char *)(uintptr_t)1;
-                                goto ret;
-                        }
-                        else if (key == '\b') {
+                                break;
+                        } else if (key == '\b') {
                                 if (bufpos > 0) {
                                         --bufpos;
                                         ++nchars;
@@ -278,7 +289,7 @@ shell_builtin_read(struct builtin_read_params *params)
                                  *   and exit BS context.
                                  * - CR LF not in BS context: replace CR with LF */
                                 buffer[--bufpos] = c;
-                                ++nchars;
+                                nchars += 1 + (backslash == 2);
                         }
                 } else if (backslash == 2) {
                         /* We saw BS CR ??, keep escaped CR, exit BS context,
@@ -298,6 +309,9 @@ shell_builtin_read(struct builtin_read_params *params)
                                 backslash = 0;
                                 if (c != '\n')
                                         goto put;
+#if ENABLE_PLATFORM_MINGW32
+                                ++nchars;
+#endif
                                 continue;
                         }
                         if (c == '\\') {
@@ -338,7 +352,7 @@ shell_builtin_read(struct builtin_read_params *params)
                 }
  put:
                 bufpos++;
-        } while (--nchars);
+        } while (IF_PLATFORM_MINGW32(backslash ||) --nchars);
 
         if (argv[0]) {
                 /* Remove trailing space $IFS chars */
diff --git a/sysklogd/syslogd.c b/sysklogd/syslogd.c
index 7558051f0..2cbb22b6d 100644
--- a/sysklogd/syslogd.c
+++ b/sysklogd/syslogd.c
@@ -1045,7 +1045,7 @@ static int NOINLINE syslogd_init(char **argv)
 #endif
         /* If they have not specified remote logging, then log locally */
         if (ENABLE_FEATURE_REMOTE_LOG && !(opts & OPT_remotelog)) // -R
-                option_mask32 |= OPT_locallog;
+                option_mask32 = (opts |= OPT_locallog);
 #if ENABLE_FEATURE_SYSLOGD_CFG
         parse_syslogdcfg(opt_f);
 #endif
diff --git a/testsuite/cpio.tests b/testsuite/cpio.tests
index 85e746589..a4462c53e 100755
--- a/testsuite/cpio.tests
+++ b/testsuite/cpio.tests
@@ -154,6 +154,29 @@ testing "cpio -R with extract" \
 " "" ""
 SKIP=
 
+# Create an archive containing a file with "../dont_write" filename.
+# See that it will not be allowed to unpack.
+# NB: GNU cpio 2.15 DOES NOT do such checks.
+optional FEATURE_PATH_TRAVERSAL_PROTECTION
+rm -rf cpio.testdir
+mkdir -p cpio.testdir/prepare/inner
+echo "file outside of destination was written" > cpio.testdir/prepare/dont_write
+echo "data" > cpio.testdir/prepare/inner/to_extract
+mkdir -p cpio.testdir/extract
+testing "cpio extract file outside of destination" "\
+(cd cpio.testdir/prepare/inner && echo -e '../dont_write\nto_extract' | cpio -o -H newc) | (cd cpio.testdir/extract && cpio -vi 2>&1)
+echo \$?
+ls cpio.testdir/dont_write 2>&1" \
+"\
+cpio: removing leading '../' from member names
+../dont_write
+to_extract
+1 blocks
+0
+ls: cpio.testdir/dont_write: No such file or directory
+" "" ""
+SKIP=
+
 # Clean up
 rm -rf cpio.testdir cpio.testdir2 2>/dev/null
 
diff --git a/testsuite/cryptpw.tests b/testsuite/cryptpw.tests
index 0dd91fe15..83bfde521 100755
--- a/testsuite/cryptpw.tests
+++ b/testsuite/cryptpw.tests
@@ -22,21 +22,93 @@ testing "cryptpw des zz" \
 #SKIP=
 
 optional USE_BB_CRYPT_SHA
-testing "cryptpw sha256" \
-        "cryptpw -m sha256 QWErty '123456789012345678901234567890'" \
-        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' "" ""
+# Note: mkpasswd-5.6.2 won't accept "-m sha256", wants "-m sha256crypt"
+testing 'cryptpw sha256' \
+        'cryptpw -m sha256 QWErty 1234567890123456' \
+        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' \
+        '' ''
+# mkpasswd-5.6.2 does not allow overlong salts, we truncate (at 16 chars for sha256)
+testing 'cryptpw sha256 overlong' \
+        'cryptpw -m sha256 QWErty 123456789012345678901234567890' \
+        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' \
+        '' ''
+testing 'cryptpw sha256 implicit' \
+        'cryptpw QWErty \$5\$1234567890123456' \
+        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' \
+        '' ''
+testing 'cryptpw sha256 rounds=99999' \
+        'cryptpw -m sha256 QWErty rounds=99999\$123456789012345678901234567890' \
+        '$5$rounds=99999$1234567890123456$aYellycJGZM6AKyVzaQsSrDBdTixubtMnM6J.MN0xM8\n' \
+        '' ''
+testing 'cryptpw sha256 rounds=99999 implicit' \
+        'cryptpw QWErty \$5\$rounds=99999\$123456789012345678901234567890' \
+        '$5$rounds=99999$1234567890123456$aYellycJGZM6AKyVzaQsSrDBdTixubtMnM6J.MN0xM8\n' \
+        '' ''
 
-testing "cryptpw sha256 rounds=99999" \
-        "cryptpw -m sha256 QWErty 'rounds=99999\$123456789012345678901234567890'" \
-        '$5$rounds=99999$1234567890123456$aYellycJGZM6AKyVzaQsSrDBdTixubtMnM6J.MN0xM8\n' "" ""
-
-testing "cryptpw sha512" \
-        "cryptpw -m sha512 QWErty '123456789012345678901234567890'" \
-        '$6$1234567890123456$KB7QqxFyqmJSWyQYcCuGeFukgz1bPQoipWZf7.9L7z3k8UNTXa6UikbKcUGDc2ANn7DOGmDaroxDgpK16w/RE0\n' "" ""
+testing 'cryptpw sha512' \
+        'cryptpw -m sha512 QWErty 123456789012345678901234567890' \
+        '$6$1234567890123456$KB7QqxFyqmJSWyQYcCuGeFukgz1bPQoipWZf7.9L7z3k8UNTXa6UikbKcUGDc2ANn7DOGmDaroxDgpK16w/RE0\n' \
+        '' ''
+testing 'cryptpw sha512crypt' \
+        'cryptpw -m sha512crypt QWErty 123456789012345678901234567890' \
+        '$6$1234567890123456$KB7QqxFyqmJSWyQYcCuGeFukgz1bPQoipWZf7.9L7z3k8UNTXa6UikbKcUGDc2ANn7DOGmDaroxDgpK16w/RE0\n' \
+        '' ''
+testing 'cryptpw sha512 rounds=99999' \
+        'cryptpw -m sha512 QWErty rounds=99999\$123456789012345678901234567890' \
+        '$6$rounds=99999$1234567890123456$BfF6gD6ZjUmwawH5QaAglYAxtU./yvsz0fcQ464l49aMI2DZW3j5ri28CrxK7riPWNpLuUpfaIdY751SBYKUH.\n' \
+        '' ''
+SKIP=
 
-testing "cryptpw sha512 rounds=99999" \
-        "cryptpw -m sha512 QWErty 'rounds=99999\$123456789012345678901234567890'" \
-        '$6$rounds=99999$1234567890123456$BfF6gD6ZjUmwawH5QaAglYAxtU./yvsz0fcQ464l49aMI2DZW3j5ri28CrxK7riPWNpLuUpfaIdY751SBYKUH.\n' "" ""
+optional USE_BB_CRYPT_YES
+testing 'cryptpw yescrypt' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$123456789012345678901234' \
+        '$y$j9T$123456789012345678901234$AKxw5OX/T4jD.v./IW.5tE/j7izNjw06fg3OvH1LsN9\n' \
+        '' ''
+testing 'cryptpw yescrypt with non-standard N=2048 instead of 4096 (j8T instead of j9T)' \
+        'cryptpw -m yescrypt qweRTY123@-+ j8T\$123456789012345678901234' \
+        '$y$j8T$123456789012345678901234$JQUUfopCxlfZNE8f.THJwbOkhy.XtB3GIjo9HUVioWB\n' \
+        '' ''
+# mkpasswd-5.6.2 allows short salts for yescrypt
+# ...but there is a catch. Not all of them.
+# The "partial" (not fitting in whole bytes) ascii64-encoded salt
+# is a special case. For example, "$zzz" would not even work in upstream.
+testing 'cryptpw yescrypt with empty salt' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$' \
+        '$y$j9T$$hpeksL94GXNRwnA00L3c8WFy0khFAUbCpBSak.N3Bp.\n' \
+        '' ''
+testing 'cryptpw yescrypt with 3-char salt' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$123' \
+        '$y$j9T$123$A34DMIGUbUIo3bjx66Wtk2IFoREMIw6d49it25KQh2D\n' \
+        '' ''
+# "." is not allowed in mkpasswd-5.6.2
+# ....................................
+# ".." is decoded into one zero byte (not two)
+testing 'cryptpw yescrypt with 2-char salt ".."' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$..' \
+        '$y$j9T$..$yVHeOayxOGg6cHL3.dg10u7T.qSgySfLN3uhSVSLNn/\n' \
+        '' ''
+# "..." is decoded into two zero bytes (not three, not one)
+testing 'cryptpw yescrypt with 3-char salt "..."' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$...' \
+        '$y$j9T$...$xHvJ5USZ7hFyXYbOijtEOMfZRS23cWIxu2eIBXRymA5\n' \
+        '' ''
+# "...." is decoded into three zero bytes (no surprises here)
+testing 'cryptpw yescrypt with 4-char salt "...."' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$....' \
+        '$y$j9T$....$wOnauYL2/NEtr6YQi9pi8AtV7L57sEbVOAnWJIcP9q2\n' \
+        '' ''
+# 84 chars = 21 4-char blocks which decode into 21*3 = 63 bytes.
+# The last byte of the maximum allowed salt size has to come from an incomplete
+# char block. E.g. "z/" encodes byte 0x7f. "z1" is 0xff.
+# Anything larger (e.g. "z2") is an error (it encodes 0x13f).
+testing 'cryptpw yescrypt with 86-char salt (max size)' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$123456789012345678901234567890123456789012345678901234567890123456789012345678901234z/' \
+        '$y$j9T$123456789012345678901234567890123456789012345678901234567890123456789012345678901234z/$Exxe8IoPXiddFsqj7iqCanRf8FyquAoB0/uceLmLjG.\n' \
+        '' ''
+testing 'cryptpw yescrypt implicit' \
+        'cryptpw qweRTY123@-+ \$y\$j9T\$123456789012345678901234' \
+        '$y$j9T$123456789012345678901234$AKxw5OX/T4jD.v./IW.5tE/j7izNjw06fg3OvH1LsN9\n' \
+        '' ''
 SKIP=
 
 exit $FAILCOUNT
diff --git a/testsuite/cut.tests b/testsuite/cut.tests
index a31f41f7f..21cfea809 100755
--- a/testsuite/cut.tests
+++ b/testsuite/cut.tests
@@ -23,14 +23,30 @@ the quick brown fox jumps over the lazy dog
 
 testing "cut -b a,a,a" "cut -b 3,3,3 input" "e\np\ne\n" "$abc" ""
 
-testing "cut -b overlaps" "cut -b 1-3,2-5,7-9,9-10 input" \
-  "one:to:th\nalphabeta\nthe qick \n" "$abc" ""
-testing "-b encapsulated" "cut -b 3-8,4-6 input" "e:two:\npha:be\ne quic\n" \
-  "$abc" ""
-# --output-delimiter not implemnted (yet?)
-#testing "cut -bO overlaps" \
-#  "cut --output-delimiter ' ' -b 1-3,2-5,7-9,9-10 input" \
-#  "one:t o:th\nalpha beta\nthe q ick \n" "$abc" ""
+testing "cut -b overlaps" \
+        "cut -b 1-3,2-5,7-9,9-10 input" \
+        "\
+one:to:th
+alphabeta
+the qick \n" \
+        "$abc" ""
+testing "-b encapsulated" \
+        "cut -b 3-8,4-6 input" \
+        "\
+e:two:
+pha:be
+e quic\n" \
+        "$abc" ""
+optional LONG_OPTS
+testing "cut -b --output-delimiter overlaps" \
+        "cut --output-delimiter='^' -b 1-3,2-5,7-9,9-10 input" \
+        "\
+one:t^o:th
+alpha^beta
+the q^ick \n" \
+        "$abc" ""
+SKIP=
+
 testing "cut high-low error" "cut -b 8-3 input 2>/dev/null || echo err" "err\n" \
   "$abc" ""
 
@@ -68,10 +84,27 @@ testing "cut with -d -f( ) -s" "cut -d' ' -f3 -s input && echo yes" "yes\n" "$in
 testing "cut with -d -f(a) -s" "cut -da -f3 -s input" "n\nsium:Jim\n\ncion:Ed\n" "$input" ""
 testing "cut with -d -f(a) -s -n" "cut -da -f3 -s -n input" "n\nsium:Jim\n\ncion:Ed\n" "$input" ""
 
+input="\
+
+foo bar baz
+
+bing bong boop
+
+"
+testing "cut with -d -s omits blank lines" "cut -d' ' -f2 -s input" "bar\nbong\n" "$input" ""
+
 # substitute for awk
 optional FEATURE_CUT_REGEX
-testing "cut -DF" "cut -DF 2,7,5" \
-  "said and your\nare\nis demand. supply\nforecast :\nyou you better,\n\nEm: Took hate\n" "" \
+testing "cut -DF unordered" "cut -DF 2,7,5" \
+        "\
+said and your
+are
+is demand. supply
+forecast :
+you you better,
+
+Em: Took hate
+" "" \
 "Bother, said Pooh. It's your husband, and he has a gun.
 Cheerios are donut seeds.
 Talk is cheap because supply exceeds demand.
@@ -79,9 +112,92 @@ Weather forecast for tonight : dark.
 Apple: you can buy better, but you can't pay more.
 Subcalifragilisticexpialidocious.
 Auntie Em: Hate you, hate Kansas. Took the dog. Dorothy."
+
+# No delimiter found: print entire line regardless of -F RANGES
+testing "cut -F1" "cut -d: -F1" \
+        "the_only_field\n" "" \
+        "the_only_field\n"
+testing "cut -F2" "cut -d: -F2" \
+        "the_only_field\n" "" \
+        "the_only_field\n"
+# No delimiter found and -s: skip entire line
+testing "cut -sF1" "cut -d: -sF1" \
+        "" "" \
+        "the_only_field\n"
+#^^^ the above is probably mishandled by toybox, it prints the line
+testing "cut -sF2" "cut -d: -sF2" \
+        "" "" \
+        "the_only_field\n"
+# -D disables special handling of lines with no delimiters, the line is treated as the 1st field
+testing "cut -DF1" "cut -d: -DF1" \
+        "the_only_field\n" "" \
+        "the_only_field\n"
+testing "cut -DF2" "cut -d: -DF2" \
+        "\n" "" \
+        "the_only_field\n"
+
+optional FEATURE_CUT_REGEX LONG_OPTS
+testing "cut -F preserves intermediate delimiters" \
+        "cut --output-delimiter=: -F2,4-6,7" \
+        "2:4            5  6:7\n" \
+        "" "1 2  3  4\t\t5  6  7 8\n"
+SKIP=
+
+optional LONG_OPTS
+testing "cut -f does not preserve intermediate delimiters" \
+        "cut --output-delimiter=: -d' ' -f2,4-6,7" \
+        "2:4:5:6:7\n" \
+        "" "1 2 3 4 5 6 7 8\n"
+SKIP=
+
+testing "cut empty field" "cut -d ':' -f 1-3" \
+        "a::b\n" \
+        "" "a::b\n"
+testing "cut empty field 2" "cut -d ':' -f 3-5" \
+        "b::c\n" \
+        "" "a::b::c:d\n"
+testing "cut non-existing field" "cut -d ':' -f1,3" \
+        "1\n" \
+        "" "1:\n"
+
+# cut -d$'\n' has a special meaning: "select input lines".
+# I didn't find any documentation for this feature.
+testing "cut -dNEWLINE" \
+        "cut -d'
+' -f4,2,6-8" \
+        "2\n4\n6\n7\n" \
+        "" "1\n2\n3\n4\n5\n6\n7"
+
+optional LONG_OPTS
+testing "cut -dNEWLINE --output-delimiter" \
+        "cut -d'
+' --output-delimiter=@@ -f4,2,6-8" \
+        "2@@4@@6@@7\n" \
+        "" "1\n2\n3\n4\n5\n6\n7"
+
+testing "cut -dNEWLINE --output-delimiter 2" \
+        "cut -d'
+' --output-delimiter=@@ -f4,2,6-8" \
+        "2@@4@@6@@7\n" \
+        "" "1\n2\n3\n4\n5\n6\n7\n"
+
+testing "cut -dNEWLINE --output-delimiter EMPTY_INPUT" \
+        "cut -d'
+' --output-delimiter=@@ -f4,2,6-8" \
+        "" \
+        "" ""
 SKIP=
 
-testing "cut empty field" "cut -d ':' -f 1-3" "a::b\n" "" "a::b\n"
-testing "cut empty field 2" "cut -d ':' -f 3-5" "b::c\n" "" "a::b::c:d\n"
+# This seems to work as if delimiter is never found.
+# We test here that -d '' does *not* operate as if there was no -d
+# and delimiter has defaulted to TAB:
+testing "cut -d EMPTY" \
+        "cut -d '' -f2-" \
+        "1 2\t3 4 5\n" \
+        "" "1 2\t3 4 5\n"
+testing "cut -d EMPTY -s" \
+        "cut -d '' -f2- -s" \
+        "" \
+        "" "1 2\t3 4 5\n"
 
 exit $FAILCOUNT
diff --git a/testsuite/hexdump.tests b/testsuite/hexdump.tests
index be0379cfc..d2c0a5dc8 100755
--- a/testsuite/hexdump.tests
+++ b/testsuite/hexdump.tests
@@ -5,6 +5,17 @@
 
 . ./testing.sh
 
+input=\
+"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
+"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
+"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
+"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
+"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+
+little_endian=false
+{ printf '\0\1' | hexdump -d | grep -q 256; } && little_endian=true
+readonly little_endian
+
 # testing "description" "command" "result" "infile" "stdin"
 testing 'hexdump -C with four NULs' \
         'hexdump -C' \
@@ -43,12 +54,17 @@ testing "hexdump -e %3_u" \
   80  81  82  83  84  85  86  87  88  89  8a  8b  8c  8d  8e  8f
   f0  f1  f2  f3  f4  f5  f6  f7  f8  f9  fa  fb  fc  fd  fe  ff
 " \
-        "" \
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
-"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
-"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
-"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
-"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"\
+        "" "$input"
+
+testing "hexdump -e %3_c" \
+        "hexdump -e '16/1 \" %3_c\" \"\n\"'" \
+'  \\0 001 002 003 004 005 006  \\a  \\b  \\t  \\n  \\v  \\f  \\r 016 017
+ 020 021 022 023 024 025 026 027 030 031 032 033 034 035 036 037
+   p   q   r   s   t   u   v   w   x   y   z   {   |   }   ~ 177
+ 200 201 202 203 204 205 206 207 210 211 212 213 214 215 216 217
+ 360 361 362 363 364 365 366 367 370 371 372 373 374 375 376 377
+' \
+        "" "$input"
 
 testing "hexdump -e /1 %d" \
         "hexdump -e '16/1 \" %4d\" \"\n\"'" \
@@ -59,27 +75,74 @@ testing "hexdump -e /1 %d" \
  -128 -127 -126 -125 -124 -123 -122 -121 -120 -119 -118 -117 -116 -115 -114 -113
   -16  -15  -14  -13  -12  -11  -10   -9   -8   -7   -6   -5   -4   -3   -2   -1
 " \
-        "" \
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
-"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
-"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
-"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
-"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"\
+        "" "$input"
 
-testing "hexdump -e /2 %d" \
-        "hexdump -e '8/2 \" %6d\" \"\n\"'" \
-        "\
+$little_endian || SKIP=1
+testing "hexdump -e /2 %d (little endian)" \
+        "hexdump -e '8/2 \" %6d\" \"\n\"'" \
+        "\
     256    770   1284   1798   2312   2826   3340   3854
    4368   4882   5396   5910   6424   6938   7452   7966
   29040  29554  30068  30582  31096  31610  32124  32638
  -32384 -31870 -31356 -30842 -30328 -29814 -29300 -28786
   -3600  -3086  -2572  -2058  -1544  -1030   -516     -2
 " \
+        "" "$input"
+SKIP=
+
+$little_endian && SKIP=1
+testing "hexdump -e /2 %d (big endian)" \
+        "hexdump -e '8/2 \" %6d\" \"\n\"'" \
+        "\
+      1    515   1029   1543   2057   2571   3085   3599
+   4113   4627   5141   5655   6169   6683   7197   7711
+  28785  29299  29813  30327  30841  31355  31869  32383
+ -32639 -32125 -31611 -31097 -30583 -30069 -29555 -29041
+  -3855  -3341  -2827  -2313  -1799  -1285   -771   -257
+" \
+        "" "$input"
+SKIP=
+
+$little_endian || SKIP=1
+testing "hexdump -e /2 %x (little endian)" \
+        "hexdump -e '8/2 \" %6x\" \"\n\"'" \
+        "\
+    100    302    504    706    908    b0a    d0c    f0e
+   1110   1312   1514   1716   1918   1b1a   1d1c   1f1e
+   7170   7372   7574   7776   7978   7b7a   7d7c   7f7e
+   8180   8382   8584   8786   8988   8b8a   8d8c   8f8e
+   f1f0   f3f2   f5f4   f7f6   f9f8   fbfa   fdfc   fffe
+" \
+        "" "$input"
+SKIP=
+
+$little_endian && SKIP=1
+testing "hexdump -e /2 %x (big endian)" \
+        "hexdump -e '8/2 \" %6x\" \"\n\"'" \
+        "\
+      1    203    405    607    809    a0b    c0d    e0f
+   1011   1213   1415   1617   1819   1a1b   1c1d   1e1f
+   7071   7273   7475   7677   7879   7a7b   7c7d   7e7f
+   8081   8283   8485   8687   8889   8a8b   8c8d   8e8f
+   f0f1   f2f3   f4f5   f6f7   f8f9   fafb   fcfd   feff
+" \
+        "" "$input"
+SKIP=
+
+$little_endian || SKIP=1
+testing "hexdump -n4 -e '\"%u\"' (little endian)" \
+        "hexdump -n4 -e '\"%u\"'" \
+        "12345678" \
         "" \
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
-"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
-"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
-"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
-"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"\
+        "\x4e\x61\xbc\x00AAAA"
+SKIP=
+
+$little_endian && SKIP=1
+testing "hexdump -n4 -e '\"%u\"' (big endian)" \
+        "hexdump -n4 -e '\"%u\"'" \
+        "1315027968" \
+        "" \
+        "\x4e\x61\xbc\x00AAAA"
+SKIP=
 
 exit $FAILCOUNT
diff --git a/testsuite/ls.tests b/testsuite/ls.tests
index 9309d366b..a95911034 100755
--- a/testsuite/ls.tests
+++ b/testsuite/ls.tests
@@ -19,7 +19,7 @@ test x"$CONFIG_UNICODE_SUPPORT" = x"y" \
 && test x"$CONFIG_LAST_SUPPORTED_WCHAR" = x"767" \
 && test x"$CONFIG_FEATURE_LS_SORTFILES" = x"y" \
 && testing "ls unicode test with codepoints limited to 767" \
-"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1 ls.testdir" \
+"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1q ls.testdir" \
 '0001_1__Some_correct_UTF-8_text___________________________________________|
 0002_2__Boundary_condition_test_cases_____________________________________|
 0003_2.1__First_possible_sequence_of_a_certain_length_____________________|
@@ -138,7 +138,7 @@ test x"$CONFIG_UNICODE_SUPPORT" = x"y" \
 && test x"$CONFIG_SUBST_WCHAR" = x"63" \
 && test x"$CONFIG_LAST_SUPPORTED_WCHAR" = x"0" \
 && testing "ls unicode test with unlimited codepoints" \
-"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1 ls.testdir" \
+"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1q ls.testdir" \
 '0001_1__Some_correct_UTF-8_text___________________________________________|
 0002_2__Boundary_condition_test_cases_____________________________________|
 0003_2.1__First_possible_sequence_of_a_certain_length_____________________|
@@ -262,6 +262,28 @@ test x"$CONFIG_FEATURE_LS_SORTFILES" = x"y" \
 "A\nB\nA\nB\nA\nB\n" \
 "" ""
 
+rm -rf ls.testdir 2>/dev/null
+mkdir ls.testdir || exit 1
+touch "`printf "ls.testdir/\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f_\x7f\x80\xfe\xff_\x22_\x27_\x5c"`"
+
+sq="'"
+
+# testing "test name" "command" "expected result" "file input" "stdin"
+testing "ls -q" \
+'ls -q ls.testdir' \
+'???????????????????????????????_????_"_'$sq'_\\''\n' \
+"" ""
+
+testing "ls -Q" \
+'ls -Q ls.testdir' \
+'"\\001\\002\\003\\004\\005\\006\\a\\b\\t\\n\\v\\f\\r\\016\\017\\020\\021\\022\\023\\024\\025\\026\\027\\030\\031\\032\\033\\034\\035\\036\\037_\\177\\200\\376\\377_\\"_'$sq'_\\\\"\n' \
+"" ""
+
+testing "ls -qQ" \
+'ls -qQ ls.testdir' \
+'"\\001\\002\\003\\004\\005\\006\\a\\b\\t\\n\\v\\f\\r\\016\\017\\020\\021\\022\\023\\024\\025\\026\\027\\030\\031\\032\\033\\034\\035\\036\\037_\\177\\200\\376\\377_\\"_'$sq'_\\\\"\n' \
+"" ""
+
 # Clean up
 rm -rf ls.testdir 2>/dev/null
 
diff --git a/testsuite/make.tests b/testsuite/make.tests
index 376bdcc15..fabdbe45c 100755
--- a/testsuite/make.tests
+++ b/testsuite/make.tests
@@ -86,6 +86,16 @@ test.k:
 '
 cd .. || exit 1; rm -rf make.tempdir 2>/dev/null
 
+# Check that single-suffix inference rules work.
+mkdir make.tempdir && cd make.tempdir || exit 1
+touch test.sh
+testing "make single-suffix inference rule works" \
+        "make -f - -s; echo $?" \
+        "0\n" "" '
+test:
+'
+cd .. || exit 1; rm -rf make.tempdir 2>/dev/null
+
 # There was a bug where the failure of a build command didn't result
 # in make returning a non-zero exit status.
 testing "make return error if command fails" \
@@ -541,6 +551,36 @@ testing "make chained inference rules" \
 '
 cd .. || exit 1; rm -rf make.tempdir 2>/dev/null
 
+# Suffixes with multiple periods are supported
+mkdir make.tempdir && cd make.tempdir || exit 1
+touch x.c.c
+testing "make support multi-period suffixes" \
+        "make -f -" "cat x.c.c >x.o.o\nx\n" "" '
+.SUFFIXES: .c.c .o.o
+x.o.o:
+.c.c.o.o:
+        cat $< >$@
+        @echo $*
+'
+cd .. || exit 1; rm -rf make.tempdir 2>/dev/null
+
+# Suffixes with no periods are supported
+mkdir make.tempdir && cd make.tempdir || exit 1
+touch filex
+testing "make support suffixes without any periods" \
+        "make -f -" "cp filex fileh\nfile\ncp filex filez\nfile\n" "" '
+.SUFFIXES: x h z
+all: fileh filez
+fileh:
+filez: filex
+        cp filex filez
+        @echo $*
+xh:
+        cp $< $@
+        @echo $*
+'
+cd .. || exit 1; rm -rf make.tempdir 2>/dev/null
+
 # make supports *, ? and [] wildcards in targets and prerequisites
 mkdir make.tempdir && cd make.tempdir || exit 1
 touch -t 202206171201 t1a t2aa t3b
diff --git a/testsuite/md5sum.tests b/testsuite/md5sum.tests
index cca26dc64..a6d2b7ffb 100755
--- a/testsuite/md5sum.tests
+++ b/testsuite/md5sum.tests
@@ -9,6 +9,7 @@
 # efe30c482e0b687e0cca0612f42ca29b
 # d41337e834377140ae7f98460d71d908598ef04f
 # 8e1d3ed57ebc130f0f72508446559eeae06451ae6d61b1e8ce46370cfb8963c3
+# c01420bb6613d4bd00396a82033e59e81486cbb045ae0dd2b4c3332e581b3ce09fb1946d6e283acec685778ff205d485
 # fe413e0f177324d1353893ca0772ceba83fd41512ba63895a0eebb703ef9feac2fb4e92b2cb430b3bda41b46b0cb4ea8307190a5cc795157cfb680a9cd635d0f
 
 if ! test "$1"; then
@@ -31,9 +32,9 @@ text=`yes "$text" | head -c 9999`
 result=`(
 n=0
 while test $n -le 999; do
-        echo "$text" | head -c $n | "$sum"
+        echo "$text" | head -c $n | $sum
         n=$(($n+1))
-done | "$sum"
+done | $sum
 )`
 if test x"$result" != x"$expected  -"; then
         echo "FAIL: $sum (r:$result exp:$expected)"
@@ -44,7 +45,7 @@ fi
 
 # GNU compat: -c EMPTY must fail (exitcode 1)!
 >EMPTY
-if "$sum" -c EMPTY 2>/dev/null; then
+if $sum -c EMPTY 2>/dev/null; then
         echo "FAIL: $sum -c EMPTY"
         : $((FAILCOUNT++))
 else
diff --git a/testsuite/od.tests b/testsuite/od.tests
index 4f245a7e8..c863bf2e8 100755
--- a/testsuite/od.tests
+++ b/testsuite/od.tests
@@ -61,7 +61,8 @@ testing "od -a (DESKTOP)" \
 "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
 SKIP=
 
-testing "od -B" \
+$little_endian || SKIP=1
+testing "od -B (little-endian)" \
         "od -B" \
 "\
 0000000 001001 005003 041101 177103
@@ -70,6 +71,16 @@ testing "od -B" \
         "" "$input"
 SKIP=
 
+$little_endian && SKIP=1
+testing "od -B (big-endian)" \
+        "od -B" \
+"\
+0000000 000402 001412 040502 041776
+0000010
+" \
+       "" "$input"
+SKIP=
+
 $little_endian || SKIP=1
 testing "od -o (little-endian)" \
         "od -o" \
diff --git a/testsuite/paste/paste-long-short b/testsuite/paste/paste-long-short
new file mode 100644
index 000000000..e626d730e
--- /dev/null
+++ b/testsuite/paste/paste-long-short
@@ -0,0 +1,19 @@
+cat > foo <<EOF
+foo1
+foo2
+foo3
+EOF
+
+cat > bar <<EOF
+bar1
+bar2
+EOF
+
+cat > baz <<EOF
+foo1    bar1
+foo2    bar2
+foo3    
+EOF
+
+busybox paste foo bar > qux
+diff -u baz qux
diff --git a/testsuite/paste/paste-short-long b/testsuite/paste/paste-short-long
new file mode 100644
index 000000000..785da60a7
--- /dev/null
+++ b/testsuite/paste/paste-short-long
@@ -0,0 +1,19 @@
+cat > foo <<EOF
+foo1
+foo2
+EOF
+
+cat > bar <<EOF
+bar1
+bar2
+bar3
+EOF
+
+cat > baz <<EOF
+foo1    bar1
+foo2    bar2
+        bar3
+EOF
+
+busybox paste foo bar > qux
+diff -u baz qux
diff --git a/testsuite/sha384sum.tests b/testsuite/sha384sum.tests
new file mode 100755
index 000000000..f1449d195
--- /dev/null
+++ b/testsuite/sha384sum.tests
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+. ./md5sum.tests sha384sum c01420bb6613d4bd00396a82033e59e81486cbb045ae0dd2b4c3332e581b3ce09fb1946d6e283acec685778ff205d485
diff --git a/testsuite/sha3sum.tests b/testsuite/sha3sum.tests
index 2cd8e3bf2..631141735 100755
--- a/testsuite/sha3sum.tests
+++ b/testsuite/sha3sum.tests
@@ -1,3 +1,7 @@
 #!/bin/sh
 
-. ./md5sum.tests sha3sum 11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9
+   (. ./md5sum.tests sha3sum         11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9) \
+&& (. ./md5sum.tests "sha3sum -a224" 11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9) \
+&& (. ./md5sum.tests "sha3sum -a256" 6f69c8d36a9a579a943d878dab38c179d2a9dde12b244aa8840002c0f3d5bb73) \
+&& (. ./md5sum.tests "sha3sum -a384" 303913449042257996a869e0378323193b4f58d90eea801b12186a3d65640bd3403d3404c63527424ec43dff842c0cd0) \
+&& (. ./md5sum.tests "sha3sum -a512" e14814dccc2fef967af74eb6710885b35dfe660a362c0609b642404987d24a13dac66ad037e6affa5c42631110231655fcf4c972b1457ac49fb83af8113fc51f)
diff --git a/testsuite/tr.tests b/testsuite/tr.tests
index 5cca299ac..96f88ccf3 100755
--- a/testsuite/tr.tests
+++ b/testsuite/tr.tests
@@ -15,6 +15,10 @@ testing "tr understands 0-9A-F" \
         "tr -cd '[0-9A-F]'" \
         "19AF" "" "19AFH\n"
 
+testing "tr does not treat [p\\-r] as a range" \
+        "tr '[p\-r]' '+'" \
+        "o+q+s+" "" "opqrs-"
+
 optional FEATURE_TR_CLASSES
 testing "tr understands [:xdigit:]" \
         "tr -cd '[:xdigit:]'" \
diff --git a/testsuite/wget/wget-handles-https b/testsuite/wget/wget-handles-https
new file mode 100644
index 000000000..11915f42f
--- /dev/null
+++ b/testsuite/wget/wget-handles-https
@@ -0,0 +1,4 @@
+test x"$SKIP_INTERNET_TESTS" != x"" && exit
+
+busybox wget -q -O foo https://www.google.com/
+test -s foo
diff --git a/util-linux/chrt.c b/util-linux/chrt.c
index 51d08584e..f64fa6aa6 100644
--- a/util-linux/chrt.c
+++ b/util-linux/chrt.c
@@ -17,9 +17,9 @@
 //kbuild:lib-$(CONFIG_CHRT) += chrt.o
 
 //usage:#define chrt_trivial_usage
-//usage:       "-m | -p [PRIO] PID | [-rfobi] PRIO PROG ARGS"
+//usage:       "-m | [-rfobi] { -p [PRIO] PID | PRIO PROG ARGS }"
 //usage:#define chrt_full_usage "\n\n"
-//usage:       "Change scheduling priority and class for a process\n"
+//usage:       "Change scheduling priority and class (default RR) for a process\n"
 //usage:     "\n        -m      Show min/max priorities"
 //usage:     "\n        -p      Operate on PID"
 //usage:     "\n        -r      Set SCHED_RR class"
@@ -133,7 +133,14 @@ int chrt_main(int argc UNUSED_PARAM, char **argv)
                         pid_str = *argv;
                 }
                 /* else "-p PID", and *argv == NULL */
-                pid = xatoul_range(pid_str, 1, ((unsigned)(pid_t)ULONG_MAX) >> 1);
+                pid = xatoul_range(pid_str, 0, ((unsigned)(pid_t)ULONG_MAX) >> 1);
+
+                /* sched_{get,set}scheduler accept PID 0 to mean the calling process,
+                 * but this is needed to display the actual PID like util-linux's chrt
+                 */
+                if (pid == 0) {
+                        pid = getpid();
+                }
         } else {
                 priority = *argv++;
                 if (!*argv)
diff --git a/util-linux/eject.c b/util-linux/eject.c
index b9813262b..4fa6dbd94 100644
--- a/util-linux/eject.c
+++ b/util-linux/eject.c
@@ -31,7 +31,7 @@
 //kbuild:lib-$(CONFIG_EJECT) += eject.o
 
 //usage:#define eject_trivial_usage
-//usage:       "[-t] [-T] [DEVICE]"
+//usage:       IF_FEATURE_EJECT_SCSI("[-s] ") "[-t] [-T] [DEVICE]"
 //usage:#define eject_full_usage "\n\n"
 //usage:       "Eject DEVICE or default /dev/cdrom\n"
 //usage:        IF_FEATURE_EJECT_SCSI(
diff --git a/util-linux/last.c b/util-linux/last.c
index 7530d013d..aafd01bb9 100644
--- a/util-linux/last.c
+++ b/util-linux/last.c
@@ -157,7 +157,7 @@ int last_main(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                         ut.ut_user, ut.ut_line, ut.ut_host, ctime(&t_tmp) + 4);
  next:
                 pos -= sizeof(ut);
-                if (pos <= 0)
+                if (pos < 0)
                         break; /* done. */
                 xlseek(file, pos, SEEK_SET);
         }
diff --git a/util-linux/lspci.c b/util-linux/lspci.c
index b38b46be3..25be23a01 100644
--- a/util-linux/lspci.c
+++ b/util-linux/lspci.c
@@ -47,7 +47,7 @@ static int FAST_FUNC fileAction(struct recursive_state *state UNUSED_PARAM,
         int pci_class = 0, pci_vid = 0, pci_did = 0;
         int pci_subsys_vid = 0, pci_subsys_did = 0;
 
-        char *uevent_filename = concat_path_file(fileName, "/uevent");
+        char *uevent_filename = concat_path_file(fileName, "uevent");
         parser = config_open2(uevent_filename, fopen_for_read);
         free(uevent_filename);
 
diff --git a/util-linux/lsusb.c b/util-linux/lsusb.c
index 0a9e505f4..f7d0de32d 100644
--- a/util-linux/lsusb.c
+++ b/util-linux/lsusb.c
@@ -50,7 +50,7 @@ static int FAST_FUNC fileAction(struct recursive_state *state UNUSED_PARAM,
         char *tokens[4];
         char *busnum = NULL, *devnum = NULL;
         int product_vid = 0, product_did = 0;
-        char *uevent_filename = concat_path_file(fileName, "/uevent");
+        char *uevent_filename = concat_path_file(fileName, "uevent");
 
         parser = config_open2(uevent_filename, fopen_for_read);
         free(uevent_filename);
diff --git a/util-linux/nsenter.c b/util-linux/nsenter.c
index 9a250e43c..425d5175f 100644
--- a/util-linux/nsenter.c
+++ b/util-linux/nsenter.c
@@ -251,7 +251,14 @@ int nsenter_main(int argc UNUSED_PARAM, char **argv)
          * explicitly requested by the user not to.
          */
         if (!(opts & OPT_nofork) && (opts & OPT_pid)) {
-                xvfork_parent_waits_and_exits();
+                pid_t pid = xvfork();
+                if (pid > 0) {
+                        /* Parent */
+                        int exit_status = wait_for_exitstatus(pid);
+                        if (WIFSIGNALED(exit_status))
+                                kill_myself_with_sig(WTERMSIG(exit_status));
+                        return WEXITSTATUS(exit_status);
+                }
                 /* Child continues */
         }
 
diff --git a/util-linux/unshare.c b/util-linux/unshare.c
index a9f56f388..f58cdd93e 100644
--- a/util-linux/unshare.c
+++ b/util-linux/unshare.c
@@ -333,7 +333,14 @@ int unshare_main(int argc UNUSED_PARAM, char **argv)
          * that'll become PID 1 in this new namespace.
          */
         if (opts & OPT_fork) {
-                xvfork_parent_waits_and_exits();
+                pid_t pid = xvfork();
+                if (pid > 0) {
+                        /* Parent */
+                        int exit_status = wait_for_exitstatus(pid);
+                        if (WIFSIGNALED(exit_status))
+                                kill_myself_with_sig(WTERMSIG(exit_status));
+                        return WEXITSTATUS(exit_status);
+                }
                 /* Child continues */
         }
 
diff --git a/win32/Kbuild b/win32/Kbuild
index 1bb79bfd3..019c83030 100644
--- a/win32/Kbuild
+++ b/win32/Kbuild
@@ -7,12 +7,12 @@ lib-y:=
 lib-$(CONFIG_PLATFORM_MINGW32) += dirent.o
 lib-$(CONFIG_PLATFORM_MINGW32) += dirname.o
 lib-$(CONFIG_PLATFORM_MINGW32) += env.o
+lib-$(CONFIG_PLATFORM_MINGW32) += flock.o
 lib-$(CONFIG_PLATFORM_MINGW32) += fnmatch.o
 lib-$(CONFIG_PLATFORM_MINGW32) += fsync.o
 lib-$(CONFIG_PLATFORM_MINGW32) += glob.o
 lib-$(CONFIG_PLATFORM_MINGW32) += inet_pton.o
 lib-$(CONFIG_PLATFORM_MINGW32) += ioctl.o
-lib-$(CONFIG_FEATURE_PRNG_ISAAC) += isaac.o
 lib-$(CONFIG_PLATFORM_MINGW32) += mingw.o
 lib-$(CONFIG_PLATFORM_MINGW32) += process.o
 lib-$(CONFIG_PLATFORM_MINGW32) += match_class.o
@@ -22,7 +22,6 @@ lib-$(CONFIG_PLATFORM_MINGW32) += poll.o
 lib-$(CONFIG_PLATFORM_MINGW32) += popen.o
 lib-$(CONFIG_PLATFORM_MINGW32) += regex.o
 lib-$(CONFIG_PLATFORM_MINGW32) += select.o
-lib-$(CONFIG_FEATURE_PRNG_SHELL) += sh_random.o
 lib-$(CONFIG_PLATFORM_MINGW32) += statfs.o
 lib-$(CONFIG_PLATFORM_MINGW32) += strndup.o
 lib-$(CONFIG_PLATFORM_MINGW32) += strptime.o
diff --git a/win32/dirent.c b/win32/dirent.c
index 795fc779c..f0e8deae2 100644
--- a/win32/dirent.c
+++ b/win32/dirent.c
@@ -3,7 +3,9 @@
 struct DIR {
         struct dirent dd_dir;
         HANDLE dd_handle;     /* FindFirstFile handle */
-        int dd_stat;          /* 0-based index */
+        int not_first;
+        int got_dot;
+        int got_dotdot;
 };
 
 static inline void finddata2dirent(struct dirent *ent, WIN32_FIND_DATAA *fdata)
@@ -59,9 +61,11 @@ DIR *opendir(const char *name)
         }
 
         /* initialize DIR structure and copy first dir entry */
-        dir = xmalloc(sizeof(DIR));
+        dir = xzalloc(sizeof(DIR));
         dir->dd_handle = h;
-        dir->dd_stat = 0;
+        /* dir->not_first = 0; */
+        /* dir->got_dot = 0; */
+        /* dir->got_dotdot = 0; */
         finddata2dirent(&dir->dd_dir, &fdata);
         return dir;
 }
@@ -74,11 +78,17 @@ struct dirent *readdir(DIR *dir)
         }
 
         /* if first entry, dirent has already been set up by opendir */
-        if (dir->dd_stat) {
+        if (dir->not_first) {
                 /* get next entry and convert from WIN32_FIND_DATA to dirent */
                 WIN32_FIND_DATAA fdata;
                 if (FindNextFileA(dir->dd_handle, &fdata)) {
                         finddata2dirent(&dir->dd_dir, &fdata);
+                } else if (!dir->got_dot) {
+                        strcpy(dir->dd_dir.d_name, ".");
+                        dir->dd_dir.d_type = DT_DIR;
+                } else if (!dir->got_dotdot) {
+                        strcpy(dir->dd_dir.d_name, "..");
+                        dir->dd_dir.d_type = DT_DIR;
                 } else {
                         DWORD lasterr = GetLastError();
                         /* POSIX says you shouldn't set errno when readdir can't
@@ -89,7 +99,15 @@ struct dirent *readdir(DIR *dir)
                 }
         }
 
-        ++dir->dd_stat;
+        /* Have we seen '.' or '..'? */
+        if (dir->dd_dir.d_name[0] == '.') {
+                if (dir->dd_dir.d_name[1] == '\0')
+                        dir->got_dot = TRUE;
+                else if (dir->dd_dir.d_name[1] == '.' && dir->dd_dir.d_name[2] == '\0')
+                        dir->got_dotdot = TRUE;
+        }
+
+        dir->not_first = TRUE;
         return &dir->dd_dir;
 }
 
diff --git a/win32/flock.c b/win32/flock.c
new file mode 100644
index 000000000..260b40171
--- /dev/null
+++ b/win32/flock.c
@@ -0,0 +1,132 @@
+/* Emulate flock on platforms that lack it, primarily Windows and MinGW.
+
+   This is derived from sqlite3 sources.
+   https://www.sqlite.org/src/finfo?name=src/os_win.c
+   https://www.sqlite.org/copyright.html
+
+   Written by Richard W.M. Jones <rjones.at.redhat.com>
+
+   Copyright (C) 2008-2025 Free Software Foundation, Inc.
+
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public License
+   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
+
+#include "libbb.h"
+#include <sys/file.h>
+
+/* LockFileEx */
+
+# include <errno.h>
+
+/* _get_osfhandle */
+#  include <io.h>
+
+/* Determine the current size of a file.  Because the other braindead
+ * APIs we'll call need lower/upper 32 bit pairs, keep the file size
+ * like that too.
+ */
+static BOOL
+file_size (HANDLE h, DWORD * lower, DWORD * upper)
+{
+  *lower = GetFileSize (h, upper);
+  return 1;
+}
+
+/* LOCKFILE_FAIL_IMMEDIATELY is undefined on some Windows systems. */
+# ifndef LOCKFILE_FAIL_IMMEDIATELY
+#  define LOCKFILE_FAIL_IMMEDIATELY 1
+# endif
+
+/* Acquire a lock. */
+static BOOL
+do_lock (HANDLE h, int non_blocking, int exclusive)
+{
+  BOOL res;
+  DWORD size_lower, size_upper;
+  OVERLAPPED ovlp;
+  int flags = 0;
+
+  /* We're going to lock the whole file, so get the file size. */
+  res = file_size (h, &size_lower, &size_upper);
+  if (!res)
+    return 0;
+
+  /* Start offset is 0, and also zero the remaining members of this struct. */
+  memset (&ovlp, 0, sizeof ovlp);
+
+  if (non_blocking)
+    flags |= LOCKFILE_FAIL_IMMEDIATELY;
+  if (exclusive)
+    flags |= LOCKFILE_EXCLUSIVE_LOCK;
+
+  return LockFileEx (h, flags, 0, size_lower, size_upper, &ovlp);
+}
+
+/* Unlock reader or exclusive lock. */
+static BOOL
+do_unlock (HANDLE h)
+{
+  int res;
+  DWORD size_lower, size_upper;
+
+  res = file_size (h, &size_lower, &size_upper);
+  if (!res)
+    return 0;
+
+  return UnlockFile (h, 0, 0, size_lower, size_upper);
+}
+
+/* Now our BSD-like flock operation. */
+int
+flock (int fd, int operation)
+{
+  HANDLE h = (HANDLE) _get_osfhandle (fd);
+  DWORD res;
+  int non_blocking;
+
+  if (h == INVALID_HANDLE_VALUE)
+    {
+      errno = EBADF;
+      return -1;
+    }
+
+  non_blocking = operation & LOCK_NB;
+  operation &= ~LOCK_NB;
+
+  switch (operation)
+    {
+    case LOCK_SH:
+      res = do_lock (h, non_blocking, 0);
+      break;
+    case LOCK_EX:
+      res = do_lock (h, non_blocking, 1);
+      break;
+    case LOCK_UN:
+      res = do_unlock (h);
+      break;
+    default:
+      errno = EINVAL;
+      return -1;
+    }
+
+  /* Map Windows errors into Unix errnos.  As usual MSDN fails to
+   * document the permissible error codes.
+   */
+  if (!res)
+    {
+      errno = err_win_to_posix();
+      return -1;
+    }
+
+  return 0;
+}
diff --git a/win32/glob.c b/win32/glob.c
index 1cc6483e7..35a1e9a65 100644
--- a/win32/glob.c
+++ b/win32/glob.c
@@ -298,7 +298,7 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
                         if (append(&tail, pat, strlen(pat), 0))
                                 return GLOB_NOSPACE;
                         cnt++;
-                } else
+                } else if (!error)
                         return GLOB_NOMATCH;
         }
 
diff --git a/win32/inet_pton.c b/win32/inet_pton.c
index f229a9355..eec8bd2fe 100644
--- a/win32/inet_pton.c
+++ b/win32/inet_pton.c
@@ -78,6 +78,7 @@ int inet_pton(int af, const char *restrict s, void *restrict a0)
                         if (s[j]!='.' || (i<6 && brk<0)) return 0;
                         need_v4=1;
                         i++;
+                        ip[i&7]=0;
                         break;
                 }
                 s += j+1;
diff --git a/win32/ioctl.c b/win32/ioctl.c
index 93f9f504d..2a7f75285 100644
--- a/win32/ioctl.c
+++ b/win32/ioctl.c
@@ -1,5 +1,7 @@
 #include "libbb.h"
+#include "lazyload.h"
 
+#if ENABLE_STTY || ENABLE_TTYSIZE
 static int mingw_get_terminal_width_height(struct winsize *win)
 {
         int fd;
@@ -21,6 +23,45 @@ static int mingw_get_terminal_width_height(struct winsize *win)
 
         return -1;
 }
+#endif
+
+#if ENABLE_STTY && 0
+static int mingw_set_terminal_width_height(struct winsize *win)
+{
+        BOOL ret;
+        DECLARE_PROC_ADDR(BOOL, GetConsoleScreenBufferInfoEx, HANDLE,
+                                PCONSOLE_SCREEN_BUFFER_INFOEX);
+        DECLARE_PROC_ADDR(BOOL, SetConsoleScreenBufferInfoEx, HANDLE,
+                                PCONSOLE_SCREEN_BUFFER_INFOEX);
+
+        if (!INIT_PROC_ADDR(kernel32.dll, GetConsoleScreenBufferInfoEx))
+                return -1;
+        if (!INIT_PROC_ADDR(kernel32.dll, SetConsoleScreenBufferInfoEx))
+                return -1;
+
+        for (int fd = STDOUT_FILENO; fd <= STDERR_FILENO; ++fd) {
+                CONSOLE_SCREEN_BUFFER_INFOEX sbi;
+                HANDLE handle = (HANDLE)_get_osfhandle(fd);
+
+                sbi.cbSize = sizeof(sbi);
+                if (handle != INVALID_HANDLE_VALUE &&
+                                (ret=GetConsoleScreenBufferInfoEx(handle, &sbi)) != 0) {
+                        if (sbi.dwSize.X != win->ws_col) {
+                                sbi.dwSize.X = win->ws_col;
+                        }
+                        if (sbi.dwSize.Y < win->ws_row) {
+                                sbi.dwSize.Y = win->ws_row;
+                        }
+                        sbi.srWindow.Bottom = sbi.srWindow.Top + win->ws_row;
+                        sbi.srWindow.Right = sbi.srWindow.Left + win->ws_col;
+                        ret = SetConsoleScreenBufferInfoEx(handle, &sbi);
+                        break;
+                }
+        }
+
+        return ret ? 0 : -1;
+}
+#endif
 
 int ioctl(int fd UNUSED_PARAM, int code, ...)
 {
@@ -31,10 +72,18 @@ int ioctl(int fd UNUSED_PARAM, int code, ...)
         va_start(ap, code);
 
         switch (code) {
+#if ENABLE_STTY || ENABLE_TTYSIZE
         case TIOCGWINSZ:
                 arg = va_arg(ap, void *);
                 ret = mingw_get_terminal_width_height((struct winsize *)arg);
                 break;
+#endif
+#if ENABLE_STTY && 0
+        case TIOCSWINSZ:
+                arg = va_arg(ap, void *);
+                ret = mingw_set_terminal_width_height((struct winsize *)arg);
+                break;
+#endif
         default:
                 ret = -1;
                 errno = EINVAL;
diff --git a/win32/isaac.c b/win32/isaac.c
deleted file mode 100644
index 19b96de94..000000000
--- a/win32/isaac.c
+++ /dev/null
@@ -1,192 +0,0 @@
-/*
-------------------------------------------------------------------------------
-readable.c: My random number generator, ISAAC.
-(c) Bob Jenkins, March 1996, Public Domain
-You may use this code in any way you wish, and it is free.  No warrantee.
-* May 2008 -- made it not depend on standard.h
-------------------------------------------------------------------------------
-
-  The original version of this file was downloaded from Bob Jenkins website:
-
-     http://burtleburtle.net/bob/rand/isaacafa.html
-
-  The isaac and randinit functions have been slightly modified to silence
-  warnings in modern compilers; the get_entropy and get_random_bytes have
-  been added.
-
-  These changes were made by R M Yorston and are also dedicated to the
-  public domain.
-*/
-#include "libbb.h"
-#include <ntsecapi.h>
-
-typedef struct {
-        /* external results */
-        uint32_t randrsl[256];
-
-        /* internal state */
-        uint32_t mm[256];
-        uint32_t aa, bb, cc;
-} isaac_t;
-
-
-static void isaac(isaac_t *t)
-{
-   register uint32_t i,x,y;
-
-   t->cc = t->cc + 1;    /* cc just gets incremented once per 256 results */
-   t->bb = t->bb + t->cc;   /* then combined with bb */
-
-   for (i=0; i<256; ++i)
-   {
-     x = t->mm[i];
-     switch (i%4)
-     {
-     case 0: t->aa = t->aa^(t->aa<<13); break;
-     case 1: t->aa = t->aa^(t->aa>>6); break;
-     case 2: t->aa = t->aa^(t->aa<<2); break;
-     case 3: t->aa = t->aa^(t->aa>>16); break;
-     }
-     t->aa              = t->mm[(i+128)%256] + t->aa;
-     t->mm[i]      = y  = t->mm[(x>>2)%256] + t->aa + t->bb;
-     t->randrsl[i] = t->bb = t->mm[(y>>10)%256] + x;
-
-     /* Note that bits 2..9 are chosen from x but 10..17 are chosen
-        from y.  The only important thing here is that 2..9 and 10..17
-        don't overlap.  2..9 and 10..17 were then chosen for speed in
-        the optimized version (rand.c) */
-     /* See http://burtleburtle.net/bob/rand/isaac.html
-        for further explanations and analysis. */
-   }
-}
-
-
-/* if (flag!=0), then use the contents of randrsl[] to initialize mm[]. */
-#define mix(a,b,c,d,e,f,g,h) \
-{ \
-   a^=b<<11; d+=a; b+=c; \
-   b^=c>>2;  e+=b; c+=d; \
-   c^=d<<8;  f+=c; d+=e; \
-   d^=e>>16; g+=d; e+=f; \
-   e^=f<<10; h+=e; f+=g; \
-   f^=g>>4;  a+=f; g+=h; \
-   g^=h<<8;  b+=g; h+=a; \
-   h^=a>>9;  c+=h; a+=b; \
-}
-
-static void randinit(isaac_t *t, int flag)
-{
-   int i;
-   uint32_t a,b,c,d,e,f,g,h;
-   t->aa = t->bb = t->cc = 0;
-   a=b=c=d=e=f=g=h=0x9e3779b9;  /* the golden ratio */
-
-   for (i=0; i<4; ++i)          /* scramble it */
-   {
-     mix(a,b,c,d,e,f,g,h);
-   }
-
-   for (i=0; i<256; i+=8)   /* fill in mm[] with messy stuff */
-   {
-     if (flag)                  /* use all the information in the seed */
-     {
-       a+=t->randrsl[i  ]; b+=t->randrsl[i+1]; c+=t->randrsl[i+2];
-       d+=t->randrsl[i+3]; e+=t->randrsl[i+4]; f+=t->randrsl[i+5];
-       g+=t->randrsl[i+6]; h+=t->randrsl[i+7];
-     }
-     mix(a,b,c,d,e,f,g,h);
-     t->mm[i  ]=a; t->mm[i+1]=b; t->mm[i+2]=c; t->mm[i+3]=d;
-     t->mm[i+4]=e; t->mm[i+5]=f; t->mm[i+6]=g; t->mm[i+7]=h;
-   }
-
-   if (flag)
-   {        /* do a second pass to make all of the seed affect all of mm */
-     for (i=0; i<256; i+=8)
-     {
-       a+=t->mm[i  ]; b+=t->mm[i+1]; c+=t->mm[i+2]; d+=t->mm[i+3];
-       e+=t->mm[i+4]; f+=t->mm[i+5]; g+=t->mm[i+6]; h+=t->mm[i+7];
-       mix(a,b,c,d,e,f,g,h);
-       t->mm[i  ]=a; t->mm[i+1]=b; t->mm[i+2]=c; t->mm[i+3]=d;
-       t->mm[i+4]=e; t->mm[i+5]=f; t->mm[i+6]=g; t->mm[i+7]=h;
-     }
-   }
-
-   isaac(t);            /* fill in the first set of results */
-}
-
-/*
- * Stuff a few bytes of random-ish data into the generator state.
- * This is unlikely to be very robust:  don't rely on it for
- * anything that needs to be secure.
- */
-static void get_entropy(isaac_t *t)
-{
-        if (!RtlGenRandom(t->randrsl, sizeof(uint32_t)*256))
-                GetSystemTimeAsFileTime((FILETIME *)t->randrsl);
-
-#if 0
-        {
-                unsigned char *p = (unsigned char *)t->randrsl;
-                int j;
-
-                for (j=0; j<256; ++j) {
-                        fprintf(stderr, "%02x", p[j]);
-                        if ((j&31) == 31) {
-                                fprintf(stderr, "\n");
-                        }
-                        else if ((j&3) == 3) {
-                                fprintf(stderr, " ");
-                        }
-                }
-                fprintf(stderr, "\n");
-        }
-#endif
-}
-
-#define RAND_BYTES sizeof(t->randrsl)
-#define RAND_WORDS (sizeof(t->randrsl)/sizeof(t->randrsl[0]))
-
-/*
- * Place 'count' random bytes in the buffer 'buf'.  You're responsible
- * for ensuring the buffer is big enough.
- */
-ssize_t get_random_bytes(void *buf, ssize_t count)
-{
-        static isaac_t *t = NULL;
-        static int rand_index = 0;
-        ssize_t save_count = count;
-        unsigned char *ptr;
-
-        if (buf == NULL || count < 0) {
-                errno = EINVAL;
-                return -1;
-        }
-
-        if (!t) {
-                t = xzalloc(sizeof(isaac_t));
-
-                get_entropy(t);
-                randinit(t, 1);
-                isaac(t);
-                rand_index = 0;
-        }
-
-        ptr = (unsigned char *)t->randrsl;
-        while (count > 0) {
-                int bytes_left = RAND_BYTES - rand_index;
-                ssize_t delta = MIN(bytes_left, count);
-
-                memcpy(buf, ptr+rand_index, delta);
-                buf += delta;
-                count -= delta;
-                rand_index += delta;
-
-                if (rand_index >= RAND_BYTES) {
-                        /* generate more */
-                        isaac(t);
-                        rand_index = 0;
-                }
-        }
-
-        return save_count;
-}
diff --git a/win32/mingw.c b/win32/mingw.c
index 7a5198ccf..7c4a3547f 100644
--- a/win32/mingw.c
+++ b/win32/mingw.c
@@ -6,6 +6,7 @@
 #endif
 #include <ntdef.h>
 #include <psapi.h>
+#include <ntsecapi.h>
 
 #if defined(__MINGW64_VERSION_MAJOR)
 #if ENABLE_GLOBBING
@@ -194,7 +195,7 @@ static int rand_fd = -1;
 int get_dev_type(const char *filename)
 {
         if (filename && is_prefixed_with(filename, "/dev/"))
-                return index_in_strings("null\0zero\0urandom\0", filename+5);
+                return index_in_strings("null\0tty\0zero\0urandom\0", filename+5);
 
         return NOT_DEVICE;
 }
@@ -230,14 +231,15 @@ int mingw_open (const char *filename, int oflags, ...)
         int special = (oflags & O_SPECIAL);
         int dev = get_dev_type(filename);
 
-        /* /dev/null is always allowed, others only if O_SPECIAL is set */
-        if (dev == DEV_NULL || (special && dev != NOT_DEVICE)) {
+        /* /dev/zero and /dev/urandom are only allowed if O_SPECIAL is set */
+        if (dev == DEV_NULL)
                 filename = "nul";
-                oflags = O_RDWR;
-        }
-        else if ((fd=get_dev_fd(filename)) >= 0) {
+        else if (dev == DEV_TTY)
+                filename = "con";
+        else if (special && dev != NOT_DEVICE)
+                filename = "nul";
+        else if ((fd=get_dev_fd(filename)) >= 0)
                 return fd;
-        }
 
         if ((oflags & O_CREAT)) {
                 va_start(args, oflags);
@@ -284,12 +286,36 @@ ssize_t FAST_FUNC mingw_open_read_close(const char *fn, void *buf, size_t size)
 FILE *mingw_fopen (const char *filename, const char *otype)
 {
         int fd;
+        FILE *stream;
+        int dev = get_dev_type(filename);
 
-        if (get_dev_type(filename) == DEV_NULL)
+        if (dev == DEV_NULL)
                 filename = "nul";
+        else if (dev == DEV_TTY)
+                filename = "con";
         else if ((fd=get_dev_fd(filename)) >= 0)
                 return fdopen(fd, otype);
-        return fopen(filename, otype);
+        stream = fopen(filename, otype);
+        if (stream == NULL && errno == EACCES && strcmp(otype, "r") == 0 &&
+                        mingw_is_directory(filename))
+                errno = EISDIR;
+        return stream;
+}
+
+static ssize_t get_random_bytes(void *buf, ssize_t count)
+{
+        // 32-bit mingw-w64 didn't support RtlGenRandom until 7.0.0
+#if !defined(__MINGW64_VERSION_MAJOR) || \
+                                (__MINGW64_VERSION_MAJOR < 7 && !defined(__MINGW64__))
+        DECLARE_PROC_ADDR(BOOLEAN, SystemFunction036, PVOID, ULONG);
+
+        if (!INIT_PROC_ADDR(advapi32.dll, SystemFunction036))
+                return -1;
+# define RtlGenRandom SystemFunction036
+#endif
+        if (count < 0 || !RtlGenRandom(buf, count))
+                return -1;
+        return count;
 }
 
 #undef read
@@ -363,8 +389,9 @@ static inline mode_t file_attr_to_st_mode(DWORD attr)
 static int get_file_attr(const char *fname, WIN32_FILE_ATTRIBUTE_DATA *fdata)
 {
         char *want_dir;
+        int dev = get_dev_type(fname);
 
-        if (get_dev_type(fname) == DEV_NULL || get_dev_fd(fname) >= 0) {
+        if (dev == DEV_NULL || dev == DEV_TTY || get_dev_fd(fname) >= 0) {
                 /* Fake attributes for special devices */
                 /* Though not /dev/zero or /dev/urandom */
                 FILETIME epoch = {0xd53e8000, 0x019db1de};      // Unix epoch as FILETIME
@@ -2538,3 +2565,34 @@ char * FAST_FUNC exe_relative_path(const char *tail)
         free(exepath);
         return relpath;
 }
+
+int mingw_shell_execute(SHELLEXECUTEINFO *info)
+{
+        DECLARE_PROC_ADDR(BOOL, ShellExecuteExA, SHELLEXECUTEINFOA *);
+        char *lpath;
+        int ret;
+
+        if (!INIT_PROC_ADDR(shell32.dll, ShellExecuteExA)) {
+                errno = ENOSYS;
+                return FALSE;
+        }
+
+        // ShellExecuteEx() needs backslash as separator in UNC paths.
+        lpath = xstrdup(info->lpFile);
+        slash_to_bs(lpath);
+        info->lpFile = lpath;
+
+        ret = ShellExecuteExA(info);
+
+        free(lpath);
+        return ret;
+}
+
+#if ENABLE_FEATURE_USE_CNG_API
+void mingw_die_if_error(NTSTATUS status, const char *function_name) {
+        if (!NT_SUCCESS(status)) {
+                bb_error_msg_and_die("call to %s failed: 0x%08lX",
+                                                                function_name, (unsigned long)status);
+        }
+}
+#endif
diff --git a/win32/paths.h b/win32/paths.h
index e69de29bb..dc81f1b7a 100644
--- a/win32/paths.h
+++ b/win32/paths.h
@@ -0,0 +1 @@
+#define _PATH_DEVNULL "/dev/null"
diff --git a/win32/process.c b/win32/process.c
index e7c9ca187..b4686db47 100644
--- a/win32/process.c
+++ b/win32/process.c
@@ -4,6 +4,10 @@
 #include "lazyload.h"
 #include "NUM_APPLETS.h"
 
+#ifndef ERROR_ELEVATION_REQUIRED
+# define ERROR_ELEVATION_REQUIRED __MSABI_LONG(740)
+#endif
+
 pid_t waitpid(pid_t pid, int *status, int options)
 #if ENABLE_TIME
 {
@@ -331,7 +335,9 @@ mingw_spawn_interpreter(int mode, const char *prog, char *const *argv,
         } else {
                 errno = ENOENT;
         }
+#if ENABLE_FEATURE_PREFER_APPLETS && NUM_APPLETS > 1
  done:
+#endif
         free(path);
         free(new_argv);
         return ret;
@@ -499,6 +505,38 @@ static NORETURN void wait_for_child(HANDLE child, const char *cmd)
         exit((int)code);
 }
 
+static intptr_t
+shell_execute(const char *path, char *const *argv)
+{
+        SHELLEXECUTEINFO info;
+        char *args;
+
+        memset(&info, 0, sizeof(SHELLEXECUTEINFO));
+        info.cbSize = sizeof(SHELLEXECUTEINFO);
+        info.fMask = SEE_MASK_NOCLOSEPROCESS;
+        /* info.hwnd = NULL; */
+        info.lpVerb = "runas";
+        info.lpFile = path;
+
+        args = NULL;
+        if (*argv++) {
+                while (*argv) {
+                        char *q = quote_arg(*argv++);
+                        args = xappendword(args, q);
+                        free(q);
+                }
+        }
+
+        info.lpParameters = args;
+        /* info.lpDirectory = NULL; */
+        info.nShow = SW_SHOWNORMAL;
+
+        mingw_shell_execute(&info);
+
+        free(args);
+        return info.hProcess ? (intptr_t)info.hProcess : -1;
+}
+
 int
 mingw_execvp(const char *cmd, char *const *argv)
 {
@@ -512,6 +550,16 @@ int
 mingw_execve(const char *cmd, char *const *argv, char *const *envp)
 {
         intptr_t ret = mingw_spawn_interpreter(P_NOWAIT, cmd, argv, envp, 0);
+
+        if (ret == -1 && GetLastError() == ERROR_ELEVATION_REQUIRED) {
+                // Command exists but failed because it wants elevated privileges.
+                // Try again using ShellExecuteEx().
+                SetLastError(0);
+                ret = shell_execute(cmd, argv);
+                if (GetLastError())
+                        exit(1);
+        }
+
         if (ret != -1)
                 wait_for_child((HANDLE)ret, cmd);
         return ret;
@@ -751,7 +799,7 @@ UNUSED_PARAM
         return sp;
 }
 
-void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
+int FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
 {
         const char *str, *cmdline;
 
@@ -763,6 +811,7 @@ void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
         else
                 cmdline = comm;
         safe_strncpy(buf, cmdline, col);
+        return 0;
 }
 
 /**
diff --git a/win32/resources/Kbuild.src b/win32/resources/Kbuild.src
index d056a5964..cf1239c5b 100644
--- a/win32/resources/Kbuild.src
+++ b/win32/resources/Kbuild.src
@@ -25,5 +25,4 @@ quiet_cmd_windres = WINDRES $@
 
 win32/resources/resources.o: win32/resources/resources.rc .config
 win32/resources/resources.o: win32/resources/aterm.ico win32/resources/sterm.ico
-win32/resources/resources.o: win32/resources/utf8.manifest
-win32/resources/resources.o: win32/resources/app.manifest
+win32/resources/resources.o: win32/resources/aterm.png win32/resources/sterm.png
diff --git a/win32/resources/app.manifest b/win32/resources/app.manifest
deleted file mode 100644
index 5e76b7b8e..000000000
--- a/win32/resources/app.manifest
+++ /dev/null
@@ -1,24 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
-  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
-    <security>
-      <requestedPrivileges>
-        <requestedExecutionLevel level="asInvoker"/>
-      </requestedPrivileges>
-    </security>
-  </trustInfo>
-  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
-    <application>
-      <!--The ID below indicates application support for Windows Vista -->
-      <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
-      <!--The ID below indicates application support for Windows 7 -->
-      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
-      <!--The ID below indicates application support for Windows 8 -->
-      <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
-      <!--The ID below indicates application support for Windows 8.1 -->
-      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
-      <!--The ID below indicates application support for Windows 10 -->
-      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
-    </application>
-  </compatibility>
-</assembly>
diff --git a/win32/resources/aterm.png b/win32/resources/aterm.png
new file mode 100644
index 000000000..87a3bc6ef
--- /dev/null
+++ b/win32/resources/aterm.png
diff --git a/win32/resources/resources.rc b/win32/resources/resources.rc
index 5d06dda3c..379224828 100644
--- a/win32/resources/resources.rc
+++ b/win32/resources/resources.rc
@@ -9,6 +9,13 @@
 2 ICON "sterm.ico"
 #endif
 
+#if ENABLE_FEATURE_PNG_ATERM || ENABLE_FEATURE_PNG_ALL
+1 ICON "aterm.png"
+#endif
+#if ENABLE_FEATURE_PNG_STERM || ENABLE_FEATURE_PNG_ALL
+2 ICON "sterm.png"
+#endif
+
 #if ENABLE_FEATURE_VERSIONINFO
 1 VERSIONINFO
 FILEVERSION     BB_VERSION,BB_PATCHLEVEL,BB_SUBLEVEL,BB_EXTRAVERSION
@@ -37,9 +44,57 @@ END
 
 /* Hardcode numeric value for MANIFEST for llvm windres */
 #if ENABLE_FEATURE_UTF8_MANIFEST
-1 24 "utf8.manifest"
+1 24
+BEGIN
+  "<?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?>"
+  "<assembly manifestVersion=""1.0"" xmlns=""urn:schemas-microsoft-com:asm.v1"">"
+    "<assemblyIdentity type=""win32"" name=""busybox.exe"" version=""" xstr(BB_VERSION) "." xstr(BB_PATCHLEVEL) "." xstr(BB_SUBLEVEL) "." xstr(BB_EXTRAVERSION) """/>"
+      "<application>"
+      "<windowsSettings>"
+        "<activeCodePage xmlns=""http://schemas.microsoft.com/SMI/2019/WindowsSettings"">UTF-8</activeCodePage>"
+      "</windowsSettings>"
+    "</application>"
+    "<trustInfo xmlns=""urn:schemas-microsoft-com:asm.v3"">"
+      "<security>"
+        "<requestedPrivileges>"
+          "<requestedExecutionLevel level=""asInvoker""/>"
+        "</requestedPrivileges>"
+      "</security>"
+    "</trustInfo>"
+    "<compatibility xmlns=""urn:schemas-microsoft-com:compatibility.v1"">"
+      "<application>"
+        "<supportedOS Id=""{e2011457-1546-43c5-a5fe-008deee3d3f0}""/>"  /* Application support for Windows Vista */
+        "<supportedOS Id=""{35138b9a-5d96-4fbd-8e2d-a2440225f93a}""/>"  /* Application support for Windows 7 */
+        "<supportedOS Id=""{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}""/>"  /* Application support for Windows 8 */
+        "<supportedOS Id=""{1f676c76-80e1-4239-95bb-83d0f6d0da78}""/>"  /* Application support for Windows 8.1 */
+        "<supportedOS Id=""{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}""/>"  /* Application support for Windows 10 */
+      "</application>"
+    "</compatibility>"
+  "</assembly>"
+END
 #endif
 
 #if ENABLE_FEATURE_APP_MANIFEST
-1 24 "app.manifest"
+1 24
+BEGIN
+  "<?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?>"
+  "<assembly xmlns=""urn:schemas-microsoft-com:asm.v1"" manifestVersion=""1.0"">"
+    "<trustInfo xmlns=""urn:schemas-microsoft-com:asm.v3"">"
+      "<security>"
+        "<requestedPrivileges>"
+          "<requestedExecutionLevel level=""asInvoker""/>"
+        "</requestedPrivileges>"
+      "</security>"
+    "</trustInfo>"
+    "<compatibility xmlns=""urn:schemas-microsoft-com:compatibility.v1"">"
+      "<application>"
+        "<supportedOS Id=""{e2011457-1546-43c5-a5fe-008deee3d3f0}""/>"  /* Application support for Windows Vista */
+        "<supportedOS Id=""{35138b9a-5d96-4fbd-8e2d-a2440225f93a}""/>"  /* Application support for Windows 7 */
+        "<supportedOS Id=""{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}""/>"  /* Application support for Windows 8 */
+        "<supportedOS Id=""{1f676c76-80e1-4239-95bb-83d0f6d0da78}""/>"  /* Application support for Windows 8.1 */
+        "<supportedOS Id=""{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}""/>"  /* Application support for Windows 10 */
+      "</application>"
+    "</compatibility>"
+  "</assembly>"
+END
 #endif
diff --git a/win32/resources/sterm.png b/win32/resources/sterm.png
new file mode 100644
index 000000000..9232b4625
--- /dev/null
+++ b/win32/resources/sterm.png
diff --git a/win32/resources/utf8.manifest b/win32/resources/utf8.manifest
deleted file mode 100644
index efe6a3d2f..000000000
--- a/win32/resources/utf8.manifest
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
-  <assemblyIdentity type="win32" name="busybox.exe" version="6.0.0.0"/>
-    <application>
-    <windowsSettings>
-      <activeCodePage xmlns="http://schemas.microsoft.com/SMI/2019/WindowsSettings">UTF-8</activeCodePage>
-    </windowsSettings>
-  </application>
-  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
-    <security>
-      <requestedPrivileges>
-        <requestedExecutionLevel level="asInvoker"/>
-      </requestedPrivileges>
-    </security>
-  </trustInfo>
-  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
-    <application>
-      <!--The ID below indicates application support for Windows Vista -->
-      <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
-      <!--The ID below indicates application support for Windows 7 -->
-      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
-      <!--The ID below indicates application support for Windows 8 -->
-      <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
-      <!--The ID below indicates application support for Windows 8.1 -->
-      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
-      <!--The ID below indicates application support for Windows 10 -->
-      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
-    </application>
-  </compatibility>
-</assembly>
diff --git a/win32/select.c b/win32/select.c
index 2be221ac8..46a051cfc 100644
--- a/win32/select.c
+++ b/win32/select.c
@@ -273,8 +273,11 @@ mingw_select (int nfds, fd_set *rfds, fd_set *wfds, fd_set *xfds,
   int i, fd, rc;
   clock_t tend = 0;
 
-  if (nfds > FD_SETSIZE)
-    nfds = FD_SETSIZE;
+  if (nfds < 0 || nfds > FD_SETSIZE)
+    {
+      errno = EINVAL;
+      return -1;
+    }
 
   if (!timeout)
     wait_timeout = INFINITE;
diff --git a/win32/sh_random.c b/win32/sh_random.c
deleted file mode 100644
index 10e942e80..000000000
--- a/win32/sh_random.c
+++ /dev/null
@@ -1,59 +0,0 @@
-#include "libbb.h"
-#include <ntsecapi.h>
-#include "../shell/random.h"
-
-/*
- * Obtain a few bytes of random-ish data to initialise the generator.
- * This is unlikely to be very robust:  don't rely on it for
- * anything that needs to be secure.
- */
-static void get_entropy(uint32_t state[2])
-{
-#if defined(__MINGW64_VERSION_MAJOR) && \
-                (__MINGW64_VERSION_MAJOR >= 7 || defined(__MINGW64__))
-        if (!RtlGenRandom(state, sizeof(state[0])*2))
-#endif
-                GetSystemTimeAsFileTime((FILETIME *)state);
-
-#if 0
-        {
-                unsigned char *p = (unsigned char *)state;
-                int j;
-
-                for (j=0; j<8; ++j) {
-                        fprintf(stderr, "%02x", *p++);
-                        if ((j&3) == 3) {
-                                fprintf(stderr, " ");
-                        }
-                }
-                fprintf(stderr, "\n");
-        }
-#endif
-}
-
-ssize_t get_random_bytes(void *buf, ssize_t count)
-{
-        static random_t rnd;
-        ssize_t save_count = count;
-        uint32_t value;
-        unsigned char *ptr = (unsigned char *)&value;
-
-        if (buf == NULL || count < 0) {
-                errno = EINVAL;
-                return -1;
-        }
-
-        if (UNINITED_RANDOM_T(&rnd)) {
-                uint32_t state[2] = {0, 0};
-
-                get_entropy(state);
-                INIT_RANDOM_T(&rnd, state[0] ? state[0] : 1, state[1]);
-        }
-
-        for (;count > 0; buf+=4, count-=4) {
-                value = full_random(&rnd);
-                memcpy(buf, ptr, count >= 4 ? 4 : count);
-        }
-
-        return save_count;
-}
diff --git a/win32/strptime.c b/win32/strptime.c
index 3205b95a2..c12e96202 100644
--- a/win32/strptime.c
+++ b/win32/strptime.c
@@ -1,23 +1,23 @@
-/* Copyright (C) 2002, 2004-2005, 2007, 2009-2020 Free Software Foundation,
+/* Copyright (C) 2002, 2004-2005, 2007, 2009-2024 Free Software Foundation,
    Inc.
    This file is part of the GNU C Library.
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
+   This file is free software: you can redistribute it and/or modify
+   it under the terms of the GNU Lesser General Public License as
+   published by the Free Software Foundation; either version 2.1 of the
+   License, or (at your option) any later version.
 
-   This program is distributed in the hope that it will be useful,
+   This file is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
+   GNU Lesser General Public License for more details.
 
-   You should have received a copy of the GNU General Public License along
-   with this program; if not, see <https://www.gnu.org/licenses/>.  */
+   You should have received a copy of the GNU Lesser General Public License
+   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
 
 /*
  * File from gnulib (https://www.gnu.org/software/gnulib/), processed with
- *    coan source -U_LIBC -U_NL_CURRENT -UHAVE_TM_GMTOFF strptime.c
+ *    coan source -U_LIBC -U_NL_CURRENT -UHAVE_STRUCT_TM_TM_GMTOFF strptime.c
  * and lightly edited.
  *
  * A form of support for tm_gmtoff was later restored.
@@ -30,7 +30,7 @@
 #include <ctype.h>
 #include <limits.h>
 #include <string.h>
-#include <stdbool.h>
+#include <strings.h>
 
 
 enum ptime_locale_status { not, loc, raw };
@@ -543,23 +543,23 @@ __strptime_internal (const char *rp, const char *fmt, struct tm *tm,
 
   if ((have_uweek || have_wweek) && have_wday)
     {
-      int save_wday = tm->tm_wday;
-      int save_mday = tm->tm_mday;
-      int save_mon = tm->tm_mon;
+      int saved_wday = tm->tm_wday;
+      int saved_mday = tm->tm_mday;
+      int saved_mon = tm->tm_mon;
       int w_offset = have_uweek ? 0 : 1;
 
       tm->tm_mday = 1;
       tm->tm_mon = 0;
       day_of_the_week (tm);
       if (have_mday)
-        tm->tm_mday = save_mday;
+        tm->tm_mday = saved_mday;
       if (have_mon)
-        tm->tm_mon = save_mon;
+        tm->tm_mon = saved_mon;
 
       if (!have_yday)
         tm->tm_yday = ((7 - (tm->tm_wday - w_offset)) % 7
                        + (week_no - 1) *7
-                       + save_wday - w_offset);
+                       + saved_wday - w_offset);
 
       if (!have_mday || !have_mon)
         {
@@ -575,7 +575,7 @@ __strptime_internal (const char *rp, const char *fmt, struct tm *tm,
                  - __mon_yday[__isleap(1900 + tm->tm_year)][t_mon - 1] + 1);
         }
 
-      tm->tm_wday = save_wday;
+      tm->tm_wday = saved_wday;
     }
 
   return (char *) rp;
diff --git a/win32/termios.c b/win32/termios.c
index f18ff7c3b..b94f68f59 100644
--- a/win32/termios.c
+++ b/win32/termios.c
@@ -2,12 +2,10 @@
 
 int tcsetattr(int fd, int mode UNUSED_PARAM, const struct termios *t)
 {
-        if (terminal_mode(FALSE) & VT_INPUT) {
-                HANDLE h = (HANDLE)_get_osfhandle(fd);
-                if (!SetConsoleMode(h, t->imode)) {
-                        errno = err_win_to_posix();
-                        return -1;
-                }
+        HANDLE h = (HANDLE)_get_osfhandle(fd);
+        if (!SetConsoleMode(h, t->w_mode)) {
+                errno = err_win_to_posix();
+                return -1;
         }
 
         return 0;
@@ -15,16 +13,20 @@ int tcsetattr(int fd, int mode UNUSED_PARAM, const struct termios *t)
 
 int tcgetattr(int fd, struct termios *t)
 {
-        if (terminal_mode(FALSE) & VT_INPUT) {
-                HANDLE h = (HANDLE)_get_osfhandle(fd);
-                if (!GetConsoleMode(h, &t->imode)) {
-                        errno = err_win_to_posix();
-                        return -1;
-                }
+        HANDLE h = (HANDLE)_get_osfhandle(fd);
+        if (!GetConsoleMode(h, &t->w_mode)) {
+                errno = err_win_to_posix();
+                return -1;
         }
+
         t->c_cc[VINTR] = 3;     // ctrl-c
         t->c_cc[VEOF] = 4;      // ctrl-d
 
+        if (t->w_mode & ENABLE_ECHO_INPUT)
+                t->c_lflag |= ECHO;
+        else
+                t->c_lflag &= ~ECHO;
+
         return 0;
 }
 
diff --git a/win32/termios.h b/win32/termios.h
index 8408aa3e3..60c51119b 100644
--- a/win32/termios.h
+++ b/win32/termios.h
@@ -1,23 +1,32 @@
 #ifndef TERMIOS_H
 #define TERMIOS_H
 
-#define VINTR 0
-#define VEOF  1
+#define ECHO    0x0004
 
-#define TCIFLUSH    0
-#define TCSAFLUSH   1
-#define TCSANOW     2
-#define TCSADRAIN   3
-#define TCSADFLUSH  4
+#define VINTR           0
+#define VEOF            1
+
+#define TCIFLUSH        0
+#define TCSAFLUSH       1
+#define TCSANOW         2
+#define TCSADRAIN       3
+#define TCSADFLUSH      4
+
+#define CSIZE   0
 
 typedef unsigned char cc_t;
+typedef unsigned int  tcflag_t;
 typedef unsigned int  speed_t;
 
-#define NCCS            2
+#define NCCS            18
 struct termios {
+        tcflag_t        c_iflag;
+        tcflag_t        c_oflag;
+        tcflag_t        c_cflag;
+        tcflag_t        c_lflag;
+        char            c_line;
         cc_t            c_cc[NCCS];
-        unsigned long   imode;
-        unsigned long   omode;
+        unsigned long   w_mode;
 };
 
 struct winsize {
diff --git a/win32/winansi.c b/win32/winansi.c
index c7529c453..427c71f11 100644
--- a/win32/winansi.c
+++ b/win32/winansi.c
@@ -160,7 +160,7 @@ int FAST_FUNC terminal_mode(int reset)
                                         mode |= VT_INPUT;
                                 }
 
-                                if (newmode != oldmode) {
+                                if (reset && newmode != oldmode) {
                                         if (!SetConsoleMode(h, newmode)) {
                                                 if (mode >= 4)
                                                         mode &= ~VT_INPUT;
@@ -1182,7 +1182,7 @@ char *winansi_fgets(char *s, int size, FILE *stream)
 /* Ensure that isatty(fd) returns 0 for the NUL device */
 int mingw_isatty(int fd)
 {
-        int result = _isatty(fd);
+        int result = _isatty(fd) != 0;
 
         if (result) {
                 HANDLE handle = (HANDLE) _get_osfhandle(fd);