121 files changed, 5443 insertions, 1551 deletions

diff --git a/Makefile b/Makefile
index 3109e4fcf..52a2cff87 100644
--- a/Makefile
+++ b/Makefile
@@ -551,6 +551,7 @@ libs-y		:= \
                 findutils/ \
                 init/ \
                 libbb/ \
+                libbb/yescrypt/ \
                 libpwdgrp/ \
                 loginutils/ \
                 mailutils/ \
diff --git a/Makefile.custom b/Makefile.custom
index e2f6d1c2f..36170de8a 100644
--- a/Makefile.custom
+++ b/Makefile.custom
@@ -156,12 +156,12 @@ docs/busybox.pod: $(srctree)/docs/busybox_header.pod \
 docs/BusyBox.txt: docs/busybox.pod
         $(disp_doc)
         $(Q)-mkdir -p docs
-        $(Q)-pod2text $< > $@
+        $(Q)-pod2text --quotes=none $< > $@
 
 docs/busybox.1: docs/busybox.pod
         $(disp_doc)
         $(Q)-mkdir -p docs
-        $(Q)-pod2man --center=busybox --release="version $(KERNELVERSION)" $< > $@
+        $(Q)-pod2man --quotes=none --center=busybox --release="version $(KERNELVERSION)" $< > $@
 
 docs/BusyBox.html: docs/busybox.net/BusyBox.html
         $(disp_doc)
diff --git a/Makefile.flags b/Makefile.flags
index a26e61e7b..29fabcfb5 100644
--- a/Makefile.flags
+++ b/Makefile.flags
@@ -164,7 +164,7 @@ endif
 endif
 
 EXEEXT = .exe
-LDLIBS += ws2_32 bcrypt
+LDLIBS += ws2_32 bcrypt secur32
 endif
 
 ifneq ($(CONFIG_PLATFORM_MINGW32),y)
diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 055f9fb24..a000de45b 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -336,6 +336,7 @@ setuidgid - noexec. spawner
 sha1sum - noexec. runner
 sha256sum - noexec. runner
 sha3sum - noexec. runner
+sha384sum - noexec. runner
 sha512sum - noexec. runner
 showkey - interactive, longterm
 shred - runner
diff --git a/applets/usage_pod.c b/applets/usage_pod.c
index 9e6d3f0ee..2c177be90 100644
--- a/applets/usage_pod.c
+++ b/applets/usage_pod.c
@@ -67,30 +67,37 @@ int main(void)
                 }
                 if (col == 0) {
                         col = 6;
-                        printf("\t");
                 } else {
                         printf(", ");
                 }
-                printf("%s", usage_array[i].aname);
+                if (usage_array[i].usage[0] != NOUSAGE_STR[0]) {
+                        /*
+                         * If the applet usage string will be included in the final document
+                         * optimistically link to its header (which is just the applet name).
+                         */
+                        printf("L<C<%1$s>|/\"%1$s\">", usage_array[i].aname);
+                } else {
+                        /* Without a usage string, just output the applet name with no link. */
+                        printf("C<%s>", usage_array[i].aname);
+                }
                 col += len2;
         }
         printf("\n\n");
 
         printf("=head1 COMMAND DESCRIPTIONS\n\n");
-        printf("=over 4\n\n");
 
         for (i = 0; i < num_messages; i++) {
                 if (usage_array[i].aname[0] >= 'a' && usage_array[i].aname[0] <= 'z'
                  && usage_array[i].usage[0] != NOUSAGE_STR[0]
                 ) {
-                        printf("=item B<%s>\n\n", usage_array[i].aname);
+                        /* This is the heading that will be linked from the command list. */
+                        printf("=head2 %s\n\n", usage_array[i].aname);
                         if (usage_array[i].usage[0])
                                 printf("%s %s\n\n", usage_array[i].aname, usage_array[i].usage);
                         else
                                 printf("%s\n\n", usage_array[i].aname);
                 }
         }
-        printf("=back\n\n");
 
         return 0;
 }
diff --git a/archival/cpio.c b/archival/cpio.c
index 933d520c2..38d826a3c 100644
--- a/archival/cpio.c
+++ b/archival/cpio.c
@@ -431,6 +431,7 @@ int cpio_main(int argc UNUSED_PARAM, char **argv)
 #endif
 #endif
                 "owner\0"        Required_argument "R"
+                "file\0"         Required_argument "F"
                 "verbose\0"      No_argument       "v"
                 "null\0"         No_argument       "0"
                 "quiet\0"        No_argument       "\xff"
diff --git a/configs/mingw32_defconfig b/configs/mingw32_defconfig
index e874c84a9..6e8f1d5e4 100644
--- a/configs/mingw32_defconfig
+++ b/configs/mingw32_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.38.0.git
-# Mon Jun  9 11:54:15 2025
+# Fri Aug  8 08:27:35 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -901,7 +901,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+CONFIG_FEATURE_TLS_INTERNAL=y
+# CONFIG_FEATURE_TLS_SCHANNEL is not set
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
diff --git a/configs/mingw64_defconfig b/configs/mingw64_defconfig
index 38d5d379e..3a5d1248a 100644
--- a/configs/mingw64_defconfig
+++ b/configs/mingw64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.38.0.git
-# Mon Jun  9 11:54:15 2025
+# Fri Aug  8 08:27:35 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -901,7 +901,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+CONFIG_FEATURE_TLS_INTERNAL=y
+# CONFIG_FEATURE_TLS_SCHANNEL is not set
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
diff --git a/configs/mingw64a_defconfig b/configs/mingw64a_defconfig
index ef52bdc56..d17737721 100644
--- a/configs/mingw64a_defconfig
+++ b/configs/mingw64a_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.38.0.git
-# Mon Jun  9 11:54:15 2025
+# Fri Aug  8 08:27:35 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -121,7 +121,7 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_ON_STACK is not set
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
-# CONFIG_FEATURE_USE_CNG_API is not set
+CONFIG_FEATURE_USE_CNG_API=y
 CONFIG_MD5_SMALL=1
 CONFIG_SHA1_SMALL=3
 # CONFIG_SHA1_HWACCEL is not set
@@ -901,7 +901,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+# CONFIG_FEATURE_TLS_INTERNAL is not set
+CONFIG_FEATURE_TLS_SCHANNEL=y
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
diff --git a/configs/mingw64u_defconfig b/configs/mingw64u_defconfig
index 7c468d022..adb1552f2 100644
--- a/configs/mingw64u_defconfig
+++ b/configs/mingw64u_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.38.0.git
-# Mon Jun  9 11:54:15 2025
+# Fri Aug  8 08:27:35 2025
 #
 CONFIG_HAVE_DOT_CONFIG=y
 # CONFIG_PLATFORM_POSIX is not set
@@ -901,7 +901,10 @@ CONFIG_FEATURE_PREFER_IPV4_ADDRESS=y
 # CONFIG_FEATURE_ETC_NETWORKS is not set
 # CONFIG_FEATURE_ETC_SERVICES is not set
 # CONFIG_FEATURE_HWIB is not set
+# CONFIG_FEATURE_TLS_INTERNAL is not set
+CONFIG_FEATURE_TLS_SCHANNEL=y
 # CONFIG_FEATURE_TLS_SHA1 is not set
+# CONFIG_FEATURE_TLS_SCHANNEL_1_3 is not set
 # CONFIG_ARP is not set
 # CONFIG_ARPING is not set
 # CONFIG_BRCTL is not set
diff --git a/coreutils/date.c b/coreutils/date.c
index 3a89b6caf..ef482af1b 100644
--- a/coreutils/date.c
+++ b/coreutils/date.c
@@ -289,7 +289,7 @@ int date_main(int argc UNUSED_PARAM, char **argv)
 
                 /* if setting time, set it */
                 if ((opt & OPT_SET) && clock_settime(CLOCK_REALTIME, &ts) < 0) {
-                        bb_simple_perror_msg("can't set date");
+                        bb_simple_perror_msg_and_die("can't set date");
                 }
         }
 
diff --git a/coreutils/df.c b/coreutils/df.c
index c87c07ee4..01c41db38 100644
--- a/coreutils/df.c
+++ b/coreutils/df.c
@@ -169,6 +169,9 @@ int df_main(int argc UNUSED_PARAM, char **argv)
                         , &opt_t
                         IF_FEATURE_DF_FANCY(, &chp)
         );
+        /* -k overrides $POSIXLY_CORRECT: */
+        if (opt & OPT_KILO)
+                df_disp_hr = 1024;
         if (opt & OPT_MEGA)
                 df_disp_hr = 1024*1024;
 
@@ -199,8 +202,8 @@ int df_main(int argc UNUSED_PARAM, char **argv)
         if (disp_units_hdr == NULL) {
 #if ENABLE_FEATURE_HUMAN_READABLE
                 disp_units_hdr = xasprintf("%s-blocks",
-                        /* print df_disp_hr, show no fractionals,
-                         * use suffixes if OPT_POSIX is set in opt */
+                        /* print df_disp_hr; show no fractionals;
+                         * if -P, unit=1 (print it in full, no KMG suffixes) */
                         make_human_readable_str(df_disp_hr, 0, !!(opt & OPT_POSIX))
                 );
 #else
diff --git a/coreutils/expr.c b/coreutils/expr.c
index 3f7e21871..c00559e4c 100644
--- a/coreutils/expr.c
+++ b/coreutils/expr.c
@@ -97,6 +97,10 @@ typedef long arith_t;
 
 /* TODO: use bb_strtol[l]? It's easier to check for errors... */
 
+#if ENABLE_PLATFORM_MINGW32
+# define STRING BB_STRING
+#endif
+
 /* The kinds of value we can have.  */
 enum {
         INTEGER,
diff --git a/coreutils/ls.c b/coreutils/ls.c
index 5d2e96a1e..2153554e8 100644
--- a/coreutils/ls.c
+++ b/coreutils/ls.c
@@ -129,6 +129,8 @@
 //usage:     "\n        -F      Append indicator (one of */=@|) to names"
 //usage:        )
 //usage:     "\n        -l      Long format"
+////usage:     "\n      -g      Long format without group column"
+////TODO: support -G too ("suppress owner column", GNUism)
 //usage:     "\n        -i      List inode numbers"
 //usage:     "\n        -n      List numeric UIDs and GIDs instead of names"
 //usage:     "\n        -s      List allocated blocks"
@@ -162,6 +164,8 @@
 //usage:        IF_FEATURE_LS_WIDTH(
 //usage:     "\n        -w N    Format N columns wide"
 //usage:        )
+////usage:     "\n      -Q      Double-quote names"
+////usage:     "\n      -q      Replace unprintable chars with '?'"
 //usage:        IF_FEATURE_LS_COLOR(
 //usage:     "\n        --color[={always,never,auto}]"
 //usage:        )
@@ -199,27 +203,47 @@ SPLIT_SUBDIR    = 2,
 
 /* -Cadi1l  Std options, busybox always supports */
 /* -gnsxA   Std options, busybox always supports */
-/* -Q       GNU option, busybox always supports */
-/* -k       Std option, busybox always supports (by ignoring) */
-/*          It means "for -s, show sizes in kbytes" */
-/*          Seems to only affect "POSIXLY_CORRECT=1 ls -sk" */
-/*          since otherwise -s shows kbytes anyway */
+/* -Q       GNU option, busybox always supports:  */
+/*          -Q, --quote-name                     */
+/*          enclose entry names in double quotes */
 /* -LHRctur Std options, busybox optionally supports */
 /* -Fp      Std options, busybox optionally supports */
 /* -SXvhTw  GNU options, busybox optionally supports */
 /* -T WIDTH Ignored (we don't use tabs on output) */
 /* -Z       SELinux mandated option, busybox optionally supports */
+/* -q       Std option, busybox always supports: */
+/*      https://pubs.opengroup.org/onlinepubs/9699919799/utilities/ls.html: */
+/*      Force each instance of non-printable filename characters and        */
+/*      <tab> characters to be written as the <question-mark> ('?')         */
+/*      character. Implementations may provide this option by default       */
+/*      if the output is to a terminal device.                              */
+/* -k       Std option, busybox always supports (by ignoring) */
+/*          It means "for -s, show sizes in kbytes" */
+/*          Seems to only affect "POSIXLY_CORRECT=1 ls -sk" */
+/*          since otherwise -s shows kbytes anyway */
 #define ls_options \
-        "Cadi1lgnsxAk"       /* 12 opts, total 12 */ \
-        IF_FEATURE_LS_FILETYPES("Fp")    /* 2, 14 */ \
-        IF_FEATURE_LS_RECURSIVE("R")     /* 1, 15 */ \
-        IF_SELINUX("Z")                  /* 1, 16 */ \
-        "Q"                              /* 1, 17 */ \
-        IF_FEATURE_LS_TIMESTAMPS("ctu")  /* 3, 20 */ \
-        IF_FEATURE_LS_SORTFILES("SXrv")  /* 4, 24 */ \
-        IF_FEATURE_LS_FOLLOWLINKS("LH")  /* 2, 26 */ \
-        IF_FEATURE_HUMAN_READABLE("h")   /* 1, 27 */ \
-        IF_FEATURE_LS_WIDTH("T:w:")      /* 2, 29 */
+        "Cadi1lgnsxA"        /* 11 opts, total 11 */ \
+        IF_FEATURE_LS_FILETYPES("Fp")    /* 2, 13 */ \
+        IF_FEATURE_LS_RECURSIVE("R")     /* 1, 14 */ \
+        IF_SELINUX("Z")                  /* 1, 15 */ \
+        "Q"                              /* 1, 16 */ \
+        IF_FEATURE_LS_TIMESTAMPS("ctu")  /* 3, 19 */ \
+        IF_FEATURE_LS_SORTFILES("SXrv")  /* 4, 23 */ \
+        IF_FEATURE_LS_FOLLOWLINKS("LH")  /* 2, 25 */ \
+        IF_FEATURE_HUMAN_READABLE("h")   /* 1, 26 */ \
+        IF_FEATURE_LS_WIDTH("T:w:")      /* 2, 28 */ \
+        IF_LONG_OPTS("\xff")             /* 1, 29 */ \
+        IF_LONG_OPTS("\xfe")             /* 1, 30 */ \
+        IF_LONG_OPTS("\xfd")             /* 1, 31 */ \
+        "qk"                             /* 2, 33 */
+
+#if ENABLE_LONG_OPTS
+static const char ls_longopts[] ALIGN1 =
+        "full-time\0" No_argument "\xff"
+        "group-directories-first\0" No_argument "\xfe"
+        IF_FEATURE_LS_COLOR("color\0" Optional_argument "\xfd")
+;
+#endif
 
 enum {
         OPT_C = (1 << 0),
@@ -233,29 +257,31 @@ enum {
         OPT_s = (1 << 8),
         OPT_x = (1 << 9),
         OPT_A = (1 << 10),
-        //OPT_k = (1 << 11),
 
-        OPTBIT_F = 12,
-        OPTBIT_p, /* 13 */
+        OPTBIT_F = 11,
+        OPTBIT_p, /* 12 */
         OPTBIT_R = OPTBIT_F + 2 * ENABLE_FEATURE_LS_FILETYPES,
         OPTBIT_Z = OPTBIT_R + 1 * ENABLE_FEATURE_LS_RECURSIVE,
         OPTBIT_Q = OPTBIT_Z + 1 * ENABLE_SELINUX,
-        OPTBIT_c, /* 17 */
-        OPTBIT_t, /* 18 */
-        OPTBIT_u, /* 19 */
+        OPTBIT_c, /* 16 */
+        OPTBIT_t, /* 17 */
+        OPTBIT_u, /* 18 */
         OPTBIT_S = OPTBIT_c + 3 * ENABLE_FEATURE_LS_TIMESTAMPS,
-        OPTBIT_X, /* 21 */
-        OPTBIT_r, /* 22 */
-        OPTBIT_v, /* 23 */
+        OPTBIT_X, /* 20 */
+        OPTBIT_r, /* 21 */
+        OPTBIT_v, /* 22 */
         OPTBIT_L = OPTBIT_S + 4 * ENABLE_FEATURE_LS_SORTFILES,
-        OPTBIT_H, /* 25 */
+        OPTBIT_H, /* 24 */
         OPTBIT_h = OPTBIT_L + 2 * ENABLE_FEATURE_LS_FOLLOWLINKS,
         OPTBIT_T = OPTBIT_h + 1 * ENABLE_FEATURE_HUMAN_READABLE,
-        OPTBIT_w, /* 28 */
+        OPTBIT_w, /* 27 */
         OPTBIT_full_time = OPTBIT_T + 2 * ENABLE_FEATURE_LS_WIDTH,
         OPTBIT_dirs_first,
-        OPTBIT_color, /* 31 */
-        /* with long opts, we use all 32 bits */
+        OPTBIT_color, /* 30 */
+        OPTBIT_q = OPTBIT_color + 1, /* 31 */
+        OPTBIT_k = OPTBIT_q + 1, /* 32 */
+        /* with all options enabled, we use all 32 bits and even one extra bit! */
+        /* this works because -k is ignored, and getopt32 allows such "ignore" options past 31th bit */
 
         OPT_F = (1 << OPTBIT_F) * ENABLE_FEATURE_LS_FILETYPES,
         OPT_p = (1 << OPTBIT_p) * ENABLE_FEATURE_LS_FILETYPES,
@@ -277,6 +303,8 @@ enum {
         OPT_full_time  = (1 << OPTBIT_full_time ) * ENABLE_LONG_OPTS,
         OPT_dirs_first = (1 << OPTBIT_dirs_first) * ENABLE_LONG_OPTS,
         OPT_color      = (1 << OPTBIT_color     ) * ENABLE_FEATURE_LS_COLOR,
+        OPT_q = (1 << OPTBIT_q),
+        //-k is ignored: OPT_k = (1 << OPTBIT_k),
 };
 
 /*
@@ -333,6 +361,7 @@ struct globals {
 #endif
         smallint exit_code;
         smallint show_dirname;
+        smallint tty_out;
 #if ENABLE_FEATURE_LS_WIDTH
         unsigned terminal_width;
 # define G_terminal_width (G.terminal_width)
@@ -353,16 +382,21 @@ struct globals {
         setup_common_bufsiz(); \
         /* we have to zero it out because of NOEXEC */ \
         memset(&G, 0, sizeof(G)); \
-        IF_FEATURE_LS_WIDTH(G_terminal_width = TERMINAL_WIDTH;) \
+        IF_FEATURE_LS_WIDTH(G_terminal_width = ~0U;) \
         IF_FEATURE_LS_TIMESTAMPS(time(&G.current_time_t);) \
 } while (0)
 
 #define ESC "\033"
 
+static int G_isatty(void)
+{
+        if (!G.tty_out) /* not known yet? */
+                G.tty_out = isatty(STDOUT_FILENO) + 1;
+        return (G.tty_out == 2);
+}
 
 /*** Output code ***/
 
-
 /* FYI type values: 1:fifo 2:char 4:dir 6:blk 8:file 10:link 12:socket
  * (various wacky OSes: 13:Sun door 14:BSD whiteout 5:XENIX named file
  *  3/7:multiplexed char/block device)
@@ -425,56 +459,93 @@ static char append_char(mode_t mode)
 }
 #endif
 
+/* Return the number of used columns.
+ * Note that only columnar output uses return value.
+ * -l and -1 modes don't care.
+ * coreutils 7.2 also supports:
+ * ls -b (--escape) = octal escapes (although it doesn't look like working)
+ * ls -N (--literal) = not escape at all
+ */
 static unsigned calc_name_len(const char *name)
 {
         unsigned len;
         uni_stat_t uni_stat;
 
-        // TODO: quote tab as \t, etc, if -Q
-        name = printable_string2(&uni_stat, name);
+        if (!(option_mask32 & (OPT_q|OPT_Q)))
+                return strlen(name);
 
         if (!(option_mask32 & OPT_Q)) {
+                /* the most likely branch: "ls" to tty (it auto-enables -q behavior) */
+                printable_string2(&uni_stat, name);
                 return uni_stat.unicode_width;
         }
 
-        len = 2 + uni_stat.unicode_width;
+        len = 2 + strlen(name);
         while (*name) {
+                unsigned char ch = (unsigned char)*name;
+                if (ch < ' ' || ch > 0x7e) {
+                        ch -= 7;
+                        if (ch <= 6) {
+                                /* quote chars 7..13 as \a,b,t,n,v,f,r */
+                                goto two;
+                        }
+                        /* other chars <32 or >126 as \ooo octal */
+                        len += 3;
+                        goto next;
+                }
                 if (*name == '"' || *name == '\\') {
+ two:
                         len++;
                 }
+ next:
                 name++;
         }
         return len;
 }
-
-/* Return the number of used columns.
- * Note that only columnar output uses return value.
- * -l and -1 modes don't care.
- * coreutils 7.2 also supports:
- * ls -b (--escape) = octal escapes (although it doesn't look like working)
- * ls -N (--literal) = not escape at all
- */
 static unsigned print_name(const char *name)
 {
         unsigned len;
         uni_stat_t uni_stat;
 
-        // TODO: quote tab as \t, etc, if -Q
-        name = printable_string2(&uni_stat, name);
+        if (!(option_mask32 & (OPT_q|OPT_Q))) {
+                fputs_stdout(name);
+                return strlen(name);
+        }
 
         if (!(option_mask32 & OPT_Q)) {
+                /* the most likely branch: "ls" to tty (it auto-enables -q behavior) */
+                name = printable_string2(&uni_stat, name);
                 fputs_stdout(name);
                 return uni_stat.unicode_width;
         }
 
-        len = 2 + uni_stat.unicode_width;
+        len = 2 + strlen(name);
         putchar('"');
         while (*name) {
-                if (*name == '"' || *name == '\\') {
+                unsigned char ch = (unsigned char)*name;
+                if (ch < ' ' || ch > 0x7e) {
                         putchar('\\');
+                        ch -= 7;
+                        if (ch <= 6) {
+                                /* quote chars 7..13 as \a,b,t,n,v,f,r */
+                                ch = c_escape_conv_str07[1 + 3 * ch];
+                                goto two;
+                        }
+                        /* other chars <32 or >126 as \ooo octal */
+                        ch = (unsigned char)*name;
+                        putchar('0' + (ch>>6));
+                        putchar('0' + ((ch>>3) & 7));
+                        ch = '0' + (ch & 7);
+                        len += 3;
+                        goto put_ch;
+                }
+                if (ch == '"' || ch == '\\') {
+                        putchar('\\');
+ two:
                         len++;
                 }
-                putchar(*name);
+ put_ch:
+                putchar(ch);
                 name++;
         }
         putchar('"');
@@ -660,7 +731,7 @@ static void display_files(struct dnode **dn, unsigned nfiles)
         unsigned i, ncols, nrows, row, nc;
         unsigned column;
         unsigned nexttab;
-        unsigned column_width = 0; /* used only by coulmnal output */
+        unsigned column_width = 0; /* used only by columnar output */
 
         if (option_mask32 & (OPT_l|OPT_1)) {
                 ncols = 1;
@@ -709,6 +780,11 @@ static void display_files(struct dnode **dn, unsigned nfiles)
                                 }
                                 nexttab = column + column_width;
                                 column += display_single(dn[i]);
+                        } else {
+                                /* if -w999999999, ncols can be very large */
+                                //bb_error_msg(" col:%u ncol:%u i:%i", nc, ncols, i); sleep1();
+                                /* without "break", we loop millions of times here */
+                                break;
                         }
                 }
                 putchar('\n');
@@ -1155,25 +1231,11 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
         /* need to initialize since --color has _an optional_ argument */
         const char *color_opt = color_str; /* "always" */
 #endif
-#if ENABLE_LONG_OPTS
-        static const char ls_longopts[] ALIGN1 =
-                "full-time\0" No_argument "\xff"
-                "group-directories-first\0" No_argument "\xfe"
-                IF_FEATURE_LS_COLOR("color\0" Optional_argument "\xfd")
-        ;
-#endif
 
         INIT_G();
 
         init_unicode();
 
-#if ENABLE_FEATURE_LS_WIDTH
-        /* obtain the terminal width */
-        G_terminal_width = get_terminal_width(STDIN_FILENO);
-        /* go one less... */
-        G_terminal_width--;
-#endif
-
         /* process options */
         opt = getopt32long(argv, "^"
                 ls_options
@@ -1211,6 +1273,29 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
         exit(0);
 #endif
 
+        /* ftpd secret backdoor? */
+        if (ENABLE_FTPD && applet_name[0] == 'f') {
+                /* dirs first are much nicer */
+                opt = option_mask32 |= OPT_dirs_first;
+                /* don't show SEcontext */
+                IF_SELINUX(opt = option_mask32 &= ~OPT_Z;)
+                /* do not query stdout about size and tty-ness */
+                IF_FEATURE_LS_WIDTH(G_terminal_width = INT_MAX;)
+                G.tty_out = 1; /* not a tty */
+                goto skip_if_ftpd;
+        }
+
+#if ENABLE_FEATURE_LS_WIDTH
+        if ((int)G_terminal_width < 0) {
+                /* obtain the terminal width */
+                G_terminal_width = get_terminal_width(STDIN_FILENO);
+                /* go one less... */
+                G_terminal_width--;
+        }
+        if (G_terminal_width == 0) /* -w0 */
+                G_terminal_width = INT_MAX; /* "infinite" */
+#endif
+
 #if ENABLE_SELINUX
         if (opt & OPT_Z) {
                 if (!is_selinux_enabled())
@@ -1229,7 +1314,7 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
 # endif
                 /* LS_COLORS is unset, or (not empty && not "none") ? */
                 if (!p || (p[0] && strcmp(p, "none") != 0)) {
-                        if (isatty(STDOUT_FILENO)) {
+                        if (G_isatty()) {
                                 /* check isatty() last because it's expensive (syscall) */
                                 G_show_color = 1;
                         }
@@ -1238,23 +1323,28 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
         if (opt & OPT_color) {
                 if (color_opt[0] == 'n')
                         G_show_color = 0;
-                else switch (index_in_substrings(color_str, color_opt)) {
-                case 3:
-                case 4:
-                case 5:
-                        if (!is_TERM_dumb() && isatty(STDOUT_FILENO)) {
-                case 0:
-                case 1:
-                case 2:
-                                G_show_color = 1;
+                else if (!G_show_color) {
+                /* if() is not needed, but avoids extra isatty() if G_show_color is already set */
+                        /* Check --color=COLOR_OPT and maybe set show_color=1 */
+                        switch (index_in_substrings(color_str, color_opt)) {
+                        case 3: // auto
+                        case 4: // tty
+                        case 5: // if-tty
+                                if (!is_TERM_dumb() && G_isatty()) {
+                        case 0: // always
+                        case 1: // yes
+                        case 2: // force
+                                        G_show_color = 1;
+                                }
                         }
                 }
         }
 #endif
+ skip_if_ftpd:
 
         /* sort out which command line options take precedence */
         if (ENABLE_FEATURE_LS_RECURSIVE && (opt & OPT_d))
-                option_mask32 &= ~OPT_R;        /* no recurse if listing only dir */
+                opt = option_mask32 &= ~OPT_R;  /* no recurse if listing only dir */
         if (!(opt & OPT_l)) { /* not -l? */
                 if (ENABLE_FEATURE_LS_TIMESTAMPS && ENABLE_FEATURE_LS_SORTFILES) {
                         /* when to sort by time? -t[cu] sorts by time even with -l */
@@ -1262,19 +1352,17 @@ int ls_main(int argc UNUSED_PARAM, char **argv)
                         /* without -l, bare -c or -u enable sort too */
                         /* (with -l, bare -c or -u just select which time to show) */
                         if (opt & (OPT_c|OPT_u)) {
-                                option_mask32 |= OPT_t;
+                                opt = option_mask32 |= OPT_t;
                         }
                 }
         }
 
         /* choose a display format if one was not already specified by an option */
-        if (!(option_mask32 & (OPT_l|OPT_1|OPT_x|OPT_C)))
-                option_mask32 |= (isatty(STDOUT_FILENO) ? OPT_C : OPT_1);
+        if (!(opt & (OPT_l|OPT_1|OPT_x|OPT_C)))
+                opt = option_mask32 |= (G_isatty() ? OPT_C : OPT_1);
 
-        if (ENABLE_FTPD && applet_name[0] == 'f') {
-                /* ftpd secret backdoor. dirs first are much nicer */
-                option_mask32 |= OPT_dirs_first;
-        }
+        if (!(opt & OPT_q) && G_isatty())
+                opt = option_mask32 |= OPT_q;
 
 #if ENABLE_FEATURE_EXTRA_FILE_DATA
         /* Enable accurate link counts for directories */
diff --git a/coreutils/md5_sha1_sum.c b/coreutils/md5_sha1_sum.c
index 978d328f1..4506aeb56 100644
--- a/coreutils/md5_sha1_sum.c
+++ b/coreutils/md5_sha1_sum.c
@@ -23,6 +23,12 @@
 //config:       help
 //config:       Compute and check SHA256 message digest
 //config:
+//config:config SHA384SUM
+//config:       bool "sha384sum (7.3 kb)"
+//config:       default y
+//config:       help
+//config:       Compute and check SHA384 message digest
+//config:
 //config:config SHA512SUM
 //config:       bool "sha512sum (7.3 kb)"
 //config:       default y
@@ -35,13 +41,13 @@
 //config:       help
 //config:       Compute and check SHA3 message digest
 //config:
-//config:comment "Common options for md5sum, sha1sum, sha256sum, sha512sum, sha3sum"
-//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
+//config:comment "Common options for md5sum, sha1sum, sha256sum, ..., sha3sum"
+//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA384SUM || SHA512SUM || SHA3SUM
 //config:
 //config:config FEATURE_MD5_SHA1_SUM_CHECK
 //config:       bool "Enable -c, -s and -w options"
 //config:       default y
-//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA512SUM || SHA3SUM
+//config:       depends on MD5SUM || SHA1SUM || SHA256SUM || SHA384SUM || SHA512SUM || SHA3SUM
 //config:       help
 //config:       Enabling the -c options allows files to be checked
 //config:       against pre-calculated hash values.
@@ -51,11 +57,13 @@
 //applet:IF_SHA1SUM(APPLET_NOEXEC(sha1sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha1sum))
 //applet:IF_SHA3SUM(APPLET_NOEXEC(sha3sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha3sum))
 //applet:IF_SHA256SUM(APPLET_NOEXEC(sha256sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha256sum))
+//applet:IF_SHA384SUM(APPLET_NOEXEC(sha384sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha384sum))
 //applet:IF_SHA512SUM(APPLET_NOEXEC(sha512sum, md5_sha1_sum, BB_DIR_USR_BIN, BB_SUID_DROP, sha512sum))
 
 //kbuild:lib-$(CONFIG_MD5SUM)    += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA1SUM)   += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA256SUM) += md5_sha1_sum.o
+//kbuild:lib-$(CONFIG_SHA384SUM) += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA512SUM) += md5_sha1_sum.o
 //kbuild:lib-$(CONFIG_SHA3SUM)   += md5_sha1_sum.o
 
@@ -99,6 +107,16 @@
 //usage:     "\n        -w      Warn about improperly formatted checksum lines"
 //usage:        )
 //usage:
+//usage:#define sha384sum_trivial_usage
+//usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[FILE]..."
+//usage:#define sha384sum_full_usage "\n\n"
+//usage:       "Print" IF_FEATURE_MD5_SHA1_SUM_CHECK(" or check") " SHA384 checksums"
+//usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK( "\n"
+//usage:     "\n        -c      Check sums against list in FILEs"
+//usage:     "\n        -s      Don't output anything, status code shows success"
+//usage:     "\n        -w      Warn about improperly formatted checksum lines"
+//usage:        )
+//usage:
 //usage:#define sha512sum_trivial_usage
 //usage:        IF_FEATURE_MD5_SHA1_SUM_CHECK("[-c[sw]] ")"[FILE]..."
 //usage:#define sha512sum_full_usage "\n\n"
@@ -130,11 +148,12 @@
 
 enum {
         /* 4th letter of applet_name is... */
-        HASH_MD5 = 's', /* "md5>s<um" */
-        HASH_SHA1 = '1',
+        HASH_MD5    = 's', /* "md5>s<um" */
+        HASH_SHA1   = '1',
         HASH_SHA256 = '2',
-        HASH_SHA3 = '3',
+        HASH_SHA3   = '3',
         HASH_SHA512 = '5',
+        /* unfortunately, sha384sum has the same '3' as sha3 */
 };
 
 #define FLAG_SILENT  1
@@ -158,10 +177,11 @@ static unsigned char *hash_bin_to_hex(unsigned char *hash_value,
 #endif
 static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned sha3_width)
 {
-        int src_fd, hash_len, count;
+        int src_fd, count;
         union _ctx_ {
                 sha3_ctx_t sha3;
                 sha512_ctx_t sha512;
+                sha384_ctx_t sha384;
                 sha256_ctx_t sha256;
                 sha1_ctx_t sha1;
                 md5_ctx_t md5;
@@ -183,25 +203,31 @@ static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned
                 md5_begin(&context.md5);
                 update = (void*)md5_hash;
                 final = (void*)md5_end;
-                hash_len = 16;
         }
         else if (ENABLE_SHA1SUM && hash_algo == HASH_SHA1) {
                 sha1_begin(&context.sha1);
                 update = (void*)sha1_hash;
                 final = (void*)sha1_end;
-                hash_len = 20;
         }
         else if (ENABLE_SHA256SUM && hash_algo == HASH_SHA256) {
                 sha256_begin(&context.sha256);
                 update = (void*)sha256_hash;
                 final = (void*)sha256_end;
-                hash_len = 32;
+        }
+        else if (ENABLE_SHA384SUM
+         && (ENABLE_SHA3SUM
+                ? (applet_name[4] == '8') /* check for "sha384", but do not match "sha3" */
+                : (hash_algo == '3') /* applet_name = "sha3sum" is not possible */
+                )
+        ) {
+                sha384_begin(&context.sha384);
+                update = (void*)sha384_hash;
+                final = (void*)sha384_end;
         }
         else if (ENABLE_SHA512SUM && hash_algo == HASH_SHA512) {
                 sha512_begin(&context.sha512);
                 update = (void*)sha512_hash;
                 final = (void*)sha512_end;
-                hash_len = 64;
         }
 #if ENABLE_SHA3SUM
         else if (ENABLE_SHA3SUM && hash_algo == HASH_SHA3) {
@@ -219,9 +245,7 @@ static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned
                 ) {
                         bb_error_msg_and_die("bad -a%u", sha3_width);
                 }
-                sha3_width /= 4;
-                context.sha3.input_block_bytes = 1600/8 - sha3_width;
-                hash_len = sha3_width/2;
+                context.sha3.input_block_bytes = 1600/8 - sha3_width/4;
         }
 #endif
         else {
@@ -236,7 +260,7 @@ static uint8_t *hash_file(unsigned char *in_buf, const char *filename, unsigned
                 if (count < 0)
                         bb_perror_msg("can't read '%s'", filename);
                 else /* count == 0 */ {
-                        final(&context, in_buf);
+                        unsigned hash_len = final(&context, in_buf);
                         hash_value = hash_bin_to_hex(in_buf, hash_len);
                 }
         }
@@ -262,14 +286,14 @@ int md5_sha1_sum_main(int argc UNUSED_PARAM, char **argv)
                 /* -b "binary", -t "text" are ignored (shaNNNsum compat) */
                 /* -s and -w require -c */
 #if ENABLE_SHA3SUM
-                if (applet_name[3] == HASH_SHA3)
+                if (applet_name[3] == HASH_SHA3 && (!ENABLE_SHA384SUM || applet_name[4] != '8'))
                         flags = getopt32(argv, "^" "scwbta:+" "\0" "s?c:w?c", &sha3_width);
                 else
 #endif
                         flags = getopt32(argv, "^" "scwbt" "\0" "s?c:w?c");
         } else {
 #if ENABLE_SHA3SUM
-                if (applet_name[3] == HASH_SHA3)
+                if (applet_name[3] == HASH_SHA3 && (!ENABLE_SHA384SUM || applet_name[4] != '8'))
                         getopt32(argv, "a:+", &sha3_width);
                 else
 #endif
diff --git a/coreutils/tr.c b/coreutils/tr.c
index 8d779d8ea..f51c4caea 100644
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@@ -117,6 +117,13 @@ static unsigned expand(char *arg, char **buffer_p)
                         arg++;
                         z = arg;
                         ac = bb_process_escape_sequence(&z);
+#if ENABLE_PLATFORM_MINGW32
+                        if (ac == '\\' && *z == '-') {
+                                /* An escaped dash isn't a range, don't fall through */
+                                buffer[pos++] = *z;
+                                continue;
+                        }
+#endif
                         arg = (char *)z;
                         arg--;
                         *arg = ac;
diff --git a/e2fsprogs/fsck.c b/e2fsprogs/fsck.c
index fd4ea737c..f7e93497d 100644
--- a/e2fsprogs/fsck.c
+++ b/e2fsprogs/fsck.c
@@ -423,13 +423,11 @@ static int wait_one(int flags)
         /* if (G.noexecute) { already returned -1; } */
 
         while (1) {
-                pid = waitpid(-1, &status, flags);
+                pid = safe_waitpid(-1, &status, flags);
                 kill_all_if_got_signal();
                 if (pid == 0) /* flags == WNOHANG and no children exited */
                         return -1;
                 if (pid < 0) {
-                        if (errno == EINTR)
-                                continue;
                         if (errno == ECHILD) { /* paranoia */
                                 bb_simple_error_msg("wait: no more children");
                                 return -1;
diff --git a/editors/diff.c b/editors/diff.c
index b324feaa5..8911859cd 100644
--- a/editors/diff.c
+++ b/editors/diff.c
@@ -773,7 +773,7 @@ static int diffreg(char *file[2])
                         fd = fd_tmp;
                         xlseek(fd, 0, SEEK_SET);
                 }
-                fp[i] = fdopen(fd, "r");
+                fp[i] = xfdopen_for_read(fd);
         }
 
         setup_common_bufsiz();
diff --git a/editors/sed.c b/editors/sed.c
index 107e664a0..204417108 100644
--- a/editors/sed.c
+++ b/editors/sed.c
@@ -257,7 +257,12 @@ static FILE *sed_xfopen_w(const char *fname)
 
 static void cleanup_outname(void)
 {
-        if (G.outname) unlink(G.outname);
+        if (G.outname) {
+#if ENABLE_PLATFORM_MINGW32
+                fclose(G.nonstdout);
+#endif
+                unlink(G.outname);
+        }
 }
 
 /* strcpy, replacing "\from" with 'to'. If to is NUL, replacing "\any" with 'any' */
diff --git a/include/libbb.h b/include/libbb.h
index 19becf428..60037ed3d 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -281,6 +281,26 @@ PUSH_AND_SET_FUNCTION_VISIBILITY_TO_HIDDEN
 # endif
 #endif
 
+#if ENABLE_FEATURE_TLS_SCHANNEL || ENABLE_FEATURE_USE_CNG_API
+# define SECURITY_WIN32
+# include <windows.h>
+# include <security.h>
+#endif
+
+#if ENABLE_FEATURE_USE_CNG_API
+# include <bcrypt.h>
+
+// these work on Windows >= 10
+# define BCRYPT_HMAC_SHA1_ALG_HANDLE   ((BCRYPT_ALG_HANDLE) 0x000000a1)
+# define BCRYPT_HMAC_SHA256_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x000000b1)
+# define sha1_begin_hmac BCRYPT_HMAC_SHA1_ALG_HANDLE
+# define sha256_begin_hmac BCRYPT_HMAC_SHA256_ALG_HANDLE
+#else
+# define sha1_begin_hmac sha1_begin
+# define sha256_begin_hmac sha256_begin
+# define hmac_uninit(...) ((void)0)
+#endif
+
 /* Tested to work correctly with all int types (IIRC :]) */
 #define MAXINT(T) (T)( \
         ((T)-1) > 0 \
@@ -899,7 +919,36 @@ struct hostent *xgethostbyname(const char *name) FAST_FUNC;
 // Also mount.c and inetd.c are using gethostbyname(),
 // + inet_common.c has additional IPv4-only stuff
 
+#if defined CONFIG_FEATURE_TLS_SCHANNEL
+typedef struct tls_state {
+        int ofd;
+        int ifd;
+
+    // handles
+    CredHandle cred_handle;
+    CtxtHandle ctx_handle;
 
+    // buffers
+    char in_buffer[16384 + 256]; // input buffer (to read from server)
+    unsigned long in_buffer_size; // amount of data currently in input buffer
+
+    char *out_buffer; // output buffer (for decrypted data), this is essentially the same as input buffer as data is decrypted in place
+    unsigned long out_buffer_size; // amount of data currently in output buffer
+    unsigned long out_buffer_used; // amount of extra data currently in output buffer
+
+    // data
+    char *hostname;
+    SecPkgContext_StreamSizes stream_sizes;
+
+        // booleans
+
+        // context initialized
+    int initialized;
+
+        // closed by remote peer
+        int closed;
+} tls_state_t;
+#else
 struct tls_aes {
         uint32_t key[60];
         unsigned rounds;
@@ -956,12 +1005,14 @@ typedef struct tls_state {
         struct tls_aes aes_decrypt;
         uint8_t H[16]; //used by AES_GCM
 } tls_state_t;
+#endif
 
 static inline tls_state_t *new_tls_state(void)
 {
         tls_state_t *tls = xzalloc(sizeof(*tls));
         return tls;
 }
+
 void tls_handshake(tls_state_t *tls, const char *sni) FAST_FUNC;
 #define TLSLOOP_EXIT_ON_LOCAL_EOF (1 << 0)
 void tls_run_copy_loop(tls_state_t *tls, unsigned flags) FAST_FUNC;
@@ -1173,6 +1224,32 @@ char *bin2hex(char *dst, const char *src, int count) FAST_FUNC;
 /* Reverse */
 char* hex2bin(char *dst, const char *src, int count) FAST_FUNC;
 
+/* Returns strlen as a bonus */
+//size_t replace_char(char *s, char what, char with) FAST_FUNC;
+static inline size_t replace_char(char *str, char from, char to)
+{
+        char *p = str;
+        while (*p) {
+                if (*p == from)
+                        *p = to;
+                p++;
+        }
+        return p - str;
+}
+
+extern const char c_escape_conv_str00[];
+#define c_escape_conv_str07 (c_escape_conv_str00+3)
+
+void FAST_FUNC xorbuf_3(void *dst, const void *src1, const void *src2, unsigned count);
+void FAST_FUNC xorbuf(void* buf, const void* mask, unsigned count);
+void FAST_FUNC xorbuf16_aligned_long(void* buf, const void* mask);
+void FAST_FUNC xorbuf64_3_aligned64(void *dst, const void *src1, const void *src2);
+#if BB_UNALIGNED_MEMACCESS_OK
+# define xorbuf16(buf,mask) xorbuf16_aligned_long(buf,mask)
+#else
+void FAST_FUNC xorbuf16(void* buf, const void* mask);
+#endif
+
 /* Generate a UUID */
 void generate_uuid(uint8_t *buf) FAST_FUNC;
 
@@ -1887,18 +1964,25 @@ extern char *pw_encrypt(const char *clear, const char *salt, int cleanup) FAST_F
 extern int obscure(const char *old, const char *newval, const struct passwd *pwdp) FAST_FUNC;
 /*
  * rnd is additional random input. New one is returned.
- * Useful if you call crypt_make_salt many times in a row:
- * rnd = crypt_make_salt(buf1, 4, 0);
- * rnd = crypt_make_salt(buf2, 4, rnd);
- * rnd = crypt_make_salt(buf3, 4, rnd);
+ * Useful if you call crypt_make_rand64encoded many times in a row:
+ * rnd = crypt_make_rand64encoded(buf1, 4, 0);
+ * rnd = crypt_make_rand64encoded(buf2, 4, rnd);
+ * rnd = crypt_make_rand64encoded(buf3, 4, rnd);
  * (otherwise we risk having same salt generated)
  */
-extern int crypt_make_salt(char *p, int cnt /*, int rnd*/) FAST_FUNC;
-/* "$N$" + sha_salt_16_bytes + NUL */
-#define MAX_PW_SALT_LEN (3 + 16 + 1)
+extern int crypt_make_rand64encoded(char *p, int cnt /*, int rnd*/) FAST_FUNC;
+/* Size of char salt[] to hold randomly-generated salt string
+ * sha256/512:
+ * "$5$" ["rounds=999999999$"] "<sha_salt_16_chars><NUL>"
+ * "$6$" ["rounds=999999999$"] "<sha_salt_16_chars><NUL>"
+ * #define MAX_PW_SALT_LEN (3 + sizeof("rounds=999999999$")-1 + 16 + 1)
+ * yescrypt:
+ * "$y$" <up to 8 params of up to 6 chars each> "$" <up to 86 chars salt><NUL>
+ * (86 chars are ascii64-encoded 64 binary bytes)
+ */
+#define MAX_PW_SALT_LEN (3 + 8*6 + 1 + 86 + 1)
 extern char* crypt_make_pw_salt(char p[MAX_PW_SALT_LEN], const char *algo) FAST_FUNC;
 
-
 /* Returns number of lines changed, or -1 on error */
 #if !(ENABLE_FEATURE_ADDUSER_TO_GROUP || ENABLE_FEATURE_DEL_USER_FROM_GROUP)
 #define update_passwd(filename, username, data, member) \
@@ -2041,6 +2125,10 @@ int64_t windows_read_key(int fd, char *buffer, int timeout) FAST_FUNC;
 int64_t safe_read_key(int fd, char *buffer, int timeout) FAST_FUNC;
 void read_key_ungets(char *buffer, const char *str, unsigned len) FAST_FUNC;
 
+int check_got_signal_and_poll(struct pollfd pfd[1], int timeout) FAST_FUNC;
+#if ENABLE_PLATFORM_MINGW32
+# define check_got_signal_and_poll(p, t) poll(p, 1, t)
+#endif
 
 #if ENABLE_FEATURE_EDITING
 /* It's NOT just ENABLEd or disabled. It's a number: */
@@ -2087,7 +2175,7 @@ typedef struct line_input_t {
 # if MAX_HISTORY
         int cnt_history;
         int cur_history;
-        int max_history; /* must never be <= 0 */
+        int max_history; /* must never be < 0 */
 #  if ENABLE_FEATURE_EDITING_SAVEHISTORY
         /* meaning of this field depends on FEATURE_EDITING_SAVE_ON_EXIT:
          * if !FEATURE_EDITING_SAVE_ON_EXIT: "how many lines are
@@ -2153,33 +2241,6 @@ enum { COMM_LEN = 16 };
 # endif
 #endif
 
-struct smaprec {
-        unsigned long mapped_rw;
-        unsigned long mapped_ro;
-        unsigned long shared_clean;
-        unsigned long shared_dirty;
-        unsigned long private_clean;
-        unsigned long private_dirty;
-        unsigned long stack;
-        unsigned long smap_pss, smap_swap;
-        unsigned long smap_size;
-        // For mixed 32/64 userspace, 32-bit pmap still needs
-        // 64-bit field here to correctly show 64-bit processes:
-        unsigned long long smap_start;
-        // (strictly speaking, other fields need to be wider too,
-        // but they are in kbytes, not bytes, and they hold sizes,
-        // not start addresses, sizes tend to be less than 4 terabytes)
-        char smap_mode[5];
-        char *smap_name;
-};
-
-#if !ENABLE_PMAP
-#define procps_read_smaps(pid, total, cb, data) \
-        procps_read_smaps(pid, total)
-#endif
-int FAST_FUNC procps_read_smaps(pid_t pid, struct smaprec *total,
-                void (*cb)(struct smaprec *, void *), void *data);
-
 typedef struct procps_status_t {
 #if !ENABLE_PLATFORM_MINGW32
         DIR *dir;
@@ -2215,7 +2276,13 @@ typedef struct procps_status_t {
 #endif
         unsigned tty_major,tty_minor;
 #if ENABLE_FEATURE_TOPMEM
-        struct smaprec smaps;
+        unsigned long mapped_rw;
+        unsigned long mapped_ro;
+        unsigned long shared_clean;
+        unsigned long shared_dirty;
+        unsigned long private_clean;
+        unsigned long private_dirty;
+        unsigned long stack;
 #endif
         char state[4];
         /* basename of executable in exec(2), read from /proc/N/stat
@@ -2264,11 +2331,15 @@ void free_procps_scan(procps_status_t* sp) FAST_FUNC;
 procps_status_t* procps_scan(procps_status_t* sp, int flags) FAST_FUNC;
 /* Format cmdline (up to col chars) into char buf[size] */
 /* Puts [comm] if cmdline is empty (-> process is a kernel thread) */
-void read_cmdline(char *buf, int size, unsigned pid, const char *comm) FAST_FUNC;
+int read_cmdline(char *buf, int size, unsigned pid, const char *comm) FAST_FUNC;
 pid_t *find_pid_by_name(const char* procName) FAST_FUNC;
 pid_t *pidlist_reverse(pid_t *pidList) FAST_FUNC;
 int starts_with_cpu(const char *str) FAST_FUNC;
 unsigned get_cpu_count(void) FAST_FUNC;
+/* Some internals reused by pmap: */
+unsigned long FAST_FUNC fast_strtoul_10(char **endptr);
+unsigned long long FAST_FUNC fast_strtoull_16(char **endptr);
+char* FAST_FUNC skip_fields(char *str, int count);
 
 
 /* Use strict=1 if you process input from untrusted source:
@@ -2294,6 +2365,22 @@ char *decode_base64(char *dst, const char **pp_src) FAST_FUNC;
 char *decode_base32(char *dst, const char **pp_src) FAST_FUNC;
 void read_base64(FILE *src_stream, FILE *dst_stream, int flags) FAST_FUNC;
 
+int FAST_FUNC i2a64(int i);
+int FAST_FUNC a2i64(char c);
+char* FAST_FUNC num2str64_lsb_first(char *s, unsigned v, int n);
+
+enum {
+        /* how many bytes XYZ_end() fills */
+        MD5_OUTSIZE    = 16,
+        SHA1_OUTSIZE   = 20,
+        SHA256_OUTSIZE = 32,
+        SHA384_OUTSIZE = 48,
+        SHA512_OUTSIZE = 64,
+        //SHA3-224_OUTSIZE = 28,
+        /* size of input block */
+        SHA2_INSIZE     = 64,
+};
+
 #if defined CONFIG_FEATURE_USE_CNG_API
 struct bcrypt_hash_ctx_t {
         void *handle;
@@ -2303,6 +2390,7 @@ struct bcrypt_hash_ctx_t {
 typedef struct bcrypt_hash_ctx_t md5_ctx_t;
 typedef struct bcrypt_hash_ctx_t sha1_ctx_t;
 typedef struct bcrypt_hash_ctx_t sha256_ctx_t;
+typedef struct bcrypt_hash_ctx_t sha384_ctx_t;
 typedef struct bcrypt_hash_ctx_t sha512_ctx_t;
 typedef struct sha3_ctx_t {
         uint64_t state[25];
@@ -2312,16 +2400,19 @@ typedef struct sha3_ctx_t {
 void md5_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
 void sha1_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
 void sha256_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
+void sha384_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
 void sha512_begin(struct bcrypt_hash_ctx_t *ctx) FAST_FUNC;
 void generic_hash(struct bcrypt_hash_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
 unsigned generic_end(struct bcrypt_hash_ctx_t *ctx, void *resbuf) FAST_FUNC;
 # define md5_hash generic_hash
 # define sha1_hash generic_hash
 # define sha256_hash generic_hash
+# define sha384_hash generic_hash
 # define sha512_hash generic_hash
 # define md5_end generic_end
 # define sha1_end generic_end
 # define sha256_end generic_end
+# define sha384_end generic_end
 # define sha512_end generic_end
 #else
 typedef struct md5_ctx_t {
@@ -2337,6 +2428,7 @@ typedef struct sha512_ctx_t {
         uint64_t hash[8];
         uint8_t wbuffer[128]; /* always correctly aligned for uint64_t */
 } sha512_ctx_t;
+typedef struct sha512_ctx_t sha384_ctx_t;
 typedef struct sha3_ctx_t {
         uint64_t state[25];
         unsigned bytes_queued;
@@ -2354,10 +2446,14 @@ void sha256_begin(sha256_ctx_t *ctx) FAST_FUNC;
 void sha512_begin(sha512_ctx_t *ctx) FAST_FUNC;
 void sha512_hash(sha512_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
 unsigned sha512_end(sha512_ctx_t *ctx, void *resbuf) FAST_FUNC;
+void sha384_begin(sha384_ctx_t *ctx) FAST_FUNC;
+#define sha384_hash sha512_hash
+unsigned sha384_end(sha384_ctx_t *ctx, void *resbuf) FAST_FUNC;
 #endif
 void sha3_begin(sha3_ctx_t *ctx) FAST_FUNC;
 void sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len) FAST_FUNC;
 unsigned sha3_end(sha3_ctx_t *ctx, void *resbuf) FAST_FUNC;
+void FAST_FUNC sha256_block(const void *in, size_t len, uint8_t hash[32]);
 /* TLS benefits from knowing that sha1 and sha256 share these. Give them "agnostic" names too */
 #if defined CONFIG_FEATURE_USE_CNG_API
 typedef struct bcrypt_hash_ctx_t md5sha_ctx_t;
@@ -2368,13 +2464,51 @@ typedef struct md5_ctx_t md5sha_ctx_t;
 #define md5sha_hash md5_hash
 #define sha_end sha1_end
 #endif
-enum {
-        MD5_OUTSIZE    = 16,
-        SHA1_OUTSIZE   = 20,
-        SHA256_OUTSIZE = 32,
-        SHA512_OUTSIZE = 64,
-        SHA3_OUTSIZE   = 28,
-};
+
+/* RFC 2104 HMAC (hash-based message authentication code) */
+#if !ENABLE_FEATURE_USE_CNG_API
+typedef struct hmac_ctx {
+        md5sha_ctx_t hashed_key_xor_ipad;
+        md5sha_ctx_t hashed_key_xor_opad;
+} hmac_ctx_t;
+#else
+typedef struct bcrypt_hash_ctx_t hmac_ctx_t;
+#endif
+#define HMAC_ONLY_SHA256 (!ENABLE_FEATURE_TLS_SHA1)
+typedef void md5sha_begin_func(md5sha_ctx_t *ctx) FAST_FUNC;
+#if !ENABLE_FEATURE_USE_CNG_API
+#if HMAC_ONLY_SHA256
+#define hmac_begin(ctx,key,key_size,begin) \
+        hmac_begin(ctx,key,key_size)
+#endif
+void FAST_FUNC hmac_begin(hmac_ctx_t *ctx, const uint8_t *key, unsigned key_size, md5sha_begin_func *begin);
+static ALWAYS_INLINE void hmac_hash(hmac_ctx_t *ctx, const void *in, size_t len)
+{
+        md5sha_hash(&ctx->hashed_key_xor_ipad, in, len);
+}
+#else
+# if HMAC_ONLY_SHA256
+#  define hmac_begin(pre,key,key_size,begin) \
+        _hmac_begin(pre, key, key_size, sha256_begin_hmac)
+# else
+#  define hmac_begin _hmac_begin
+# endif
+void _hmac_begin(hmac_ctx_t *pre, uint8_t *key, unsigned key_size,
+        BCRYPT_ALG_HANDLE alg_handle);
+void hmac_uninit(hmac_ctx_t *pre);
+#endif
+unsigned FAST_FUNC hmac_end(hmac_ctx_t *ctx, uint8_t *out);
+#if HMAC_ONLY_SHA256
+#define hmac_block(key,key_size,begin,in,sz,out) \
+        hmac_block(key,key_size,in,sz,out)
+#endif
+unsigned FAST_FUNC hmac_block(const uint8_t *key, unsigned key_size,
+                md5sha_begin_func *begin,
+                const void *in, unsigned sz,
+                uint8_t *out);
+/* HMAC helpers for TLS: */
+void FAST_FUNC hmac_hash_v(hmac_ctx_t *ctx, va_list va);
+unsigned hmac_peek_hash(hmac_ctx_t *ctx, uint8_t *out, ...);
 
 extern uint32_t *global_crc32_table;
 uint32_t *crc32_filltable(uint32_t *tbl256, int endian) FAST_FUNC;
@@ -2510,31 +2644,10 @@ extern struct globals *BB_GLOBAL_CONST ptr_to_globals;
 #define barrier() asm volatile ("":::"memory")
 
 #if defined(__clang_major__) && __clang_major__ >= 9
-/* Clang/llvm drops assignment to "constant" storage. Silently.
- * Needs serious convincing to not eliminate the store.
- */
-static ALWAYS_INLINE void* not_const_pp(const void *p)
-{
-        void *pp;
-        asm volatile (
-                "# forget that p points to const"
-                : /*outputs*/ "=r" (pp)
-                : /*inputs*/ "0" (p)
-        );
-        return pp;
-}
-# if !ENABLE_PLATFORM_MINGW32
-# define ASSIGN_CONST_PTR(pptr, v) do { \
-        *(void**)not_const_pp(pptr) = (void*)(v); \
-        barrier(); \
-} while (0)
-#else
-/* On Windows it seems necessary for this to be a function too. */
-void ASSIGN_CONST_PTR(const void *pptr, const void *ptr) FAST_FUNC;
-#endif
-/* XZALLOC_CONST_PTR() is an out-of-line function to prevent
- * clang from reading pointer before it is assigned.
+/* {ASSIGN,XZALLOC}_CONST_PTR() are out-of-line functions
+ * to prevent clang from reading pointer before it is assigned.
  */
+void ASSIGN_CONST_PTR(const void *pptr, void *v) FAST_FUNC;
 void XZALLOC_CONST_PTR(const void *pptr, size_t size) FAST_FUNC;
 #else
 # define ASSIGN_CONST_PTR(pptr, v) do { \
diff --git a/include/platform.h b/include/platform.h
index 5795a0cf3..0b88f990b 100644
--- a/include/platform.h
+++ b/include/platform.h
@@ -208,7 +208,7 @@
 #elif defined(BYTE_ORDER) && BYTE_ORDER == LITTLE_ENDIAN
 # define BB_BIG_ENDIAN 0
 # define BB_LITTLE_ENDIAN 1
-#elif defined(__386__)
+#elif defined(__i386__)
 # define BB_BIG_ENDIAN 0
 # define BB_LITTLE_ENDIAN 1
 #else
diff --git a/include/usage.src.h b/include/usage.src.h
index 5d2038834..0881337f8 100644
--- a/include/usage.src.h
+++ b/include/usage.src.h
@@ -17,11 +17,11 @@
 #define scripted_trivial_usage NOUSAGE_STR
 #define scripted_full_usage ""
 
-#if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_SHA
-# define CRYPT_METHODS_HELP_STR "des,md5,sha256/512" \
+#if !ENABLE_USE_BB_CRYPT
+# define CRYPT_METHODS_HELP_STR "des,md5,sha256/512,yescrypt" \
         " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
 #else
-# define CRYPT_METHODS_HELP_STR "des,md5" \
+# define CRYPT_METHODS_HELP_STR "des,md5"IF_USE_BB_CRYPT_SHA(",sha256/512")IF_USE_BB_CRYPT_YES(",yescrypt") \
         " (default "CONFIG_FEATURE_DEFAULT_PASSWD_ALGO")"
 #endif
 
diff --git a/init/bootchartd.c b/init/bootchartd.c
index 0929890a3..a5447c6ad 100644
--- a/init/bootchartd.c
+++ b/init/bootchartd.c
@@ -133,7 +133,7 @@ static void dump_file(FILE *fp, const char *filename)
 static int dump_procs(FILE *fp, int look_for_login_process)
 {
         struct dirent *entry;
-        DIR *dir = opendir("/proc");
+        DIR *dir = xopendir("/proc");
         int found_login_process = 0;
 
         fputs(G.jiffy_line, fp);
diff --git a/init/init.c b/init/init.c
index 797e0a0eb..294be9952 100644
--- a/init/init.c
+++ b/init/init.c
@@ -1201,7 +1201,7 @@ int init_main(int argc UNUSED_PARAM, char **argv)
                         int status;
                         struct init_action *a;
 
-                        wpid = waitpid(-1, &status, WNOHANG);
+                        wpid = wait_any_nohang(&status);
                         if (wpid <= 0)
                                 break;
 
diff --git a/libbb/Config.src b/libbb/Config.src
index ed6521c33..eff327c2a 100644
--- a/libbb/Config.src
+++ b/libbb/Config.src
@@ -192,8 +192,8 @@ config FEATURE_EDITING_VI
 config FEATURE_EDITING_HISTORY
         int "History size"
         # Don't allow way too big values here, code uses fixed "char *history[N]" struct member
-        range 0 9999
-        default 255
+        range 0 2000
+        default 200
         depends on FEATURE_EDITING
         help
         Specify command history size (0 - disable).
diff --git a/libbb/bitops.c b/libbb/bitops.c
new file mode 100644
index 000000000..467e1a2d9
--- /dev/null
+++ b/libbb/bitops.c
@@ -0,0 +1,128 @@
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-y += bitops.o
+
+#include "libbb.h"
+
+void FAST_FUNC xorbuf_3(void *dst, const void *src1, const void *src2, unsigned count)
+{
+        uint8_t *d = dst;
+        const uint8_t *s1 = src1;
+        const uint8_t *s2 = src2;
+#if BB_UNALIGNED_MEMACCESS_OK
+        while (count >= sizeof(long)) {
+                *(long*)d = *(long*)s1 ^ *(long*)s2;
+                count -= sizeof(long);
+                d += sizeof(long);
+                s1 += sizeof(long);
+                s2 += sizeof(long);
+        }
+#endif
+        while (count--)
+                *d++ = *s1++ ^ *s2++;
+}
+
+void FAST_FUNC xorbuf(void *dst, const void *src, unsigned count)
+{
+        xorbuf_3(dst, dst, src, count);
+}
+
+void FAST_FUNC xorbuf16_aligned_long(void *dst, const void *src)
+{
+#if defined(__SSE__) /* any x86_64 has it */
+        asm volatile(
+"\n             movups  (%0),%%xmm0"
+"\n             movups  (%1),%%xmm1"   // can't just xorps(%1),%%xmm0:
+"\n             xorps   %%xmm1,%%xmm0" // SSE requires 16-byte alignment
+"\n             movups  %%xmm0,(%0)"
+"\n"
+                : "=r" (dst), "=r" (src)
+                : "0" (dst), "1" (src)
+                : "xmm0", "xmm1", "memory"
+        );
+#else
+        unsigned long *d = dst;
+        const unsigned long *s = src;
+        d[0] ^= s[0];
+# if LONG_MAX <= 0x7fffffffffffffff
+        d[1] ^= s[1];
+#  if LONG_MAX == 0x7fffffff
+        d[2] ^= s[2];
+        d[3] ^= s[3];
+#  endif
+# endif
+#endif
+}
+// The above can be inlined in libbb.h, in a way where compiler
+// is even free to use better addressing modes than (%reg), and
+// to keep the result in a register
+// (to not store it to memory after each XOR):
+//#if defined(__SSE__)
+//#include <xmmintrin.h>
+//^^^ or just: typedef float __m128_u attribute((__vector_size__(16),__may_alias__,__aligned__(1)));
+//static ALWAYS_INLINE void xorbuf16_aligned_long(void *dst, const void *src)
+//{
+//      __m128_u xmm0, xmm1;
+//      asm volatile(
+//"\n           xorps   %1,%0"
+//              : "=x" (xmm0), "=x" (xmm1)
+//              : "0" (*(__m128_u*)dst), "1" (*(__m128_u*)src)
+//      );
+//      *(__m128_u*)dst = xmm0; // this store may be optimized out!
+//}
+//#endif
+// but I don't trust gcc optimizer enough to not generate some monstrosity.
+// See GMULT() function in TLS code as an example.
+
+void FAST_FUNC xorbuf64_3_aligned64(void *dst, const void *src1, const void *src2)
+{
+#if defined(__SSE__) /* any x86_64 has it */
+        asm volatile(
+"\n             movups  0*16(%1),%%xmm0"
+"\n             movups  0*16(%2),%%xmm1" // can't just xorps(%2),%%xmm0:
+"\n             xorps   %%xmm1,%%xmm0"   // SSE requires 16-byte alignment, we have only 8-byte
+"\n             movups  %%xmm0,0*16(%0)"
+"\n             movups  1*16(%1),%%xmm0"
+"\n             movups  1*16(%2),%%xmm1"
+"\n             xorps   %%xmm1,%%xmm0"
+"\n             movups  %%xmm0,1*16(%0)"
+"\n             movups  2*16(%1),%%xmm0"
+"\n             movups  2*16(%2),%%xmm1"
+"\n             xorps   %%xmm1,%%xmm0"
+"\n             movups  %%xmm0,2*16(%0)"
+"\n             movups  3*16(%1),%%xmm0"
+"\n             movups  3*16(%2),%%xmm1"
+"\n             xorps   %%xmm1,%%xmm0"
+"\n             movups  %%xmm0,3*16(%0)"
+"\n"
+                : "=r" (dst), "=r" (src1), "=r" (src2)
+                : "0" (dst), "1" (src1), "2" (src2)
+                : "xmm0", "xmm1", "memory"
+        );
+#else
+        long *d = dst;
+        const long *s1 = src1;
+        const long *s2 = src2;
+        unsigned count = 64 / sizeof(long);
+        do {
+                *d++ = *s1++ ^ *s2++;
+        } while (--count != 0);
+#endif
+}
+
+#if !BB_UNALIGNED_MEMACCESS_OK
+void FAST_FUNC xorbuf16(void *dst, const void *src)
+{
+#define p_aligned(a) (((uintptr_t)(a) & (sizeof(long)-1)) == 0)
+        if (p_aligned(src) && p_aligned(dst)) {
+                xorbuf16_aligned_long(dst, src);
+                return;
+        }
+        xorbuf_3(dst, dst, src, 16);
+}
+#endif
diff --git a/libbb/c_escape.c b/libbb/c_escape.c
new file mode 100644
index 000000000..6c109f2e0
--- /dev/null
+++ b/libbb/c_escape.c
@@ -0,0 +1,20 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-y += c_escape.o
+
+#include "libbb.h"
+
+const char c_escape_conv_str00[] ALIGN1 =
+        "\\""0""\0" // [0]:00
+        "\\""a""\0" // [1]:07
+        "\\""b""\0" // [2]:08
+        "\\""t""\0" // [3]:09
+        "\\""n""\0" // [4]:0a
+        "\\""v""\0" // [5]:0b
+        "\\""f""\0" // [6]:0c
+        "\\""r"     // [7]:0d
+        ;
diff --git a/libbb/concat_path_file.c b/libbb/concat_path_file.c
index 3afb0e3a4..96fcd4a1d 100644
--- a/libbb/concat_path_file.c
+++ b/libbb/concat_path_file.c
@@ -17,6 +17,7 @@
 
 char* FAST_FUNC concat_path_file(const char *path, const char *filename)
 {
+#if 0
         char *lc;
 
         if (!path)
@@ -31,4 +32,78 @@ char* FAST_FUNC concat_path_file(const char *path, const char *filename)
                 filename++;
 #endif
         return xasprintf("%s%s%s", path, (lc==NULL ? "/" : ""), filename);
+#else
+/* ^^^^^^^^^^^ timing of xasprintf-based code above:
+ * real 7.074s
+ * user 0.156s <<<
+ * sys  6.394s
+ *      "rm -rf" of a Linux kernel tree from tmpfs (run time still dominated by in-kernel work, though)
+ * real 6.989s
+ * user 0.055s <<< 3 times less CPU used
+ * sys  6.450s
+ * vvvvvvvvvvv timing of open-coded malloc+memcpy code below (+59 bytes):
+ */
+        char *buf, *p;
+        size_t n1, n2, n3;
+
+        while (*filename == '/')
+                filename++;
+
+        if (!path || !path[0])
+                return xstrdup(filename);
+
+        n1 = strlen(path);
+        n2 = (path[n1 - 1] != '/'); /* 1: "path has no trailing slash" */
+        n3 = strlen(filename) + 1;
+
+        buf = xmalloc(n1 + n2 + n3);
+        p = mempcpy(buf, path, n1);
+        if (n2)
+                *p++ = '/';
+        memcpy(p, filename, n3);
+        return buf;
+#endif
 }
+
+/* If second component comes from struct dirent,
+ * it's possible to eliminate one strlen() by using name length
+ * provided by kernel in struct dirent. See below.
+ * However, the win seems to be insignificant.
+ */
+
+#if 0
+
+/* Extract d_namlen from struct dirent */
+static size_t get_d_namlen(const struct dirent *de)
+{
+#if defined(_DIRENT_HAVE_D_NAMLEN)
+        return de->d_namlen;
+#elif defined(_DIRENT_HAVE_D_RECLEN)
+        const size_t prefix_sz = offsetof(struct dirent, d_name);
+        return de->d_reclen - prefix_sz;
+#else
+        return strlen(de->d_name);
+#endif
+}
+
+char* FAST_FUNC concat_path_dirent(const char *path, const struct dirent *de)
+{
+        char *buf, *p;
+        size_t n1, n2, n3;
+
+        if (!path || !path[0])
+                return xstrdup(de->d_name);
+
+        n1 = strlen(path);
+        n2 = (path[n1 - 1] != '/');
+        n3 = get_d_namlen(de) + 1;
+
+        buf = xmalloc(n1 + n2 + n3);
+        p = mempcpy(buf, path, n1);
+        if (n2)
+                *p++ = '/';
+        memcpy(p, de->d_name, n3);
+        return buf;
+}
+
+#endif
diff --git a/libbb/const_hack.c b/libbb/const_hack.c
index 75163fede..1d175481b 100644
--- a/libbb/const_hack.c
+++ b/libbb/const_hack.c
@@ -9,18 +9,27 @@
 #include "libbb.h"
 
 #if defined(__clang_major__) && __clang_major__ >= 9
-void FAST_FUNC XZALLOC_CONST_PTR(const void *pptr, size_t size)
+/* Clang/llvm drops assignment to "constant" storage. Silently.
+ * Needs serious convincing to not eliminate the store.
+ */
+static ALWAYS_INLINE void* not_const_pp(const void *p)
 {
-        ASSIGN_CONST_PTR(pptr, xzalloc(size));
+        void *pp;
+        asm volatile (
+                "# forget that p points to const"
+                : /*outputs*/ "=r" (pp)
+                : /*inputs*/ "0" (p)
+        );
+        return pp;
 }
-
-# if ENABLE_PLATFORM_MINGW32
-void FAST_FUNC ASSIGN_CONST_PTR(const void *pptr, const void *v)
+void FAST_FUNC ASSIGN_CONST_PTR(const void *pptr, void *v)
+{
+        *(void**)not_const_pp(pptr) = v;
+        barrier();
+}
+void FAST_FUNC XZALLOC_CONST_PTR(const void *pptr, size_t size)
 {
-        do {
-                *(void**)not_const_pp(pptr) = (void*)(v);
-                barrier();
-        } while (0);
+        *(void**)not_const_pp(pptr) = xzalloc(size);
+        barrier();
 }
-# endif
 #endif
diff --git a/libbb/dump.c b/libbb/dump.c
index aa57eca8c..3dc53d55f 100644
--- a/libbb/dump.c
+++ b/libbb/dump.c
@@ -514,37 +514,52 @@ static void bpad(PR *pr)
                 continue;
 }
 
-static const char conv_str[] ALIGN1 =
-        "\0"  "\\""0""\0"
-        "\007""\\""a""\0"
-        "\b"  "\\""b""\0"
-        "\f"  "\\""f""\0"
-        "\n"  "\\""n""\0"
-        "\r"  "\\""r""\0"
-        "\t"  "\\""t""\0"
-        "\v"  "\\""v""\0"
-        ;
-
 static void conv_c(PR *pr, unsigned char *p)
 {
-        const char *str = conv_str;
-
-        do {
-                if (*p == *str) {
-                        ++str;
-                        goto strpr; /* map e.g. '\n' to "\\n" */
-                }
-                str += 4;
-        } while (*str);
+        const char *str;
+        unsigned char ch;
+
+        ch = *p;
+        if (ch == 0 || (ch -= 6, (signed char)ch > 0 && ch <= 7)) {
+                /* map chars 0,7..13 to "\0","\{a,b,t,n,v,f,r}" */
+                str = c_escape_conv_str00 + 3 * ch;
+                goto strpr;
+        }
 
         if (isprint_asciionly(*p)) {
                 *pr->cchar = 'c';
                 printf(pr->fmt, *p);
         } else {
+#if defined(__i386__) || defined(__x86_64__)
+                /* Abuse partial register operations */
+                uint32_t buf;
+                unsigned n = *p;
+                asm (           //00000000 00000000 00000000 aabbbccc
+"\n             shll $10,%%eax" //00000000 000000aa bbbccc00 00000000
+"\n             shrw $5,%%ax"   //00000000 000000aa 00000bbb ccc00000
+"\n             shrb $5,%%al"   //00000000 000000aa 00000bbb 00000ccc
+"\n             shll $8,%%eax"  //000000aa 00000bbb 00000ccc 00000000
+"\n             bswapl %%eax"   //00000000 00000ccc 00000bbb 000000aa
+"\n             addl $0x303030,%%eax"
+"\n"            : "=a" (n)
+                : "0" (n)
+                );
+                buf = n;
+                str = (void*)&buf;
+#elif 1
                 char buf[4];
                 /* gcc-8.0.1 needs lots of casts to shut up */
                 sprintf(buf, "%03o", (unsigned)(uint8_t)*p);
                 str = buf;
+#else // use faster version? +20 bytes of code relative to sprintf() method
+                char buf[4];
+                buf[3] = '\0';
+                ch = *p;
+                buf[2] = '0' + (ch & 7); ch >>= 3;
+                buf[1] = '0' + (ch & 7); ch >>= 3;
+                buf[0] = '0' + ch;
+                str = buf;
+#endif
  strpr:
                 *pr->cchar = 's';
                 printf(pr->fmt, str);
@@ -703,15 +718,21 @@ static NOINLINE void display(priv_dumper_t* dumper)
                                                         conv_u(pr, bp);
                                                         break;
                                                 case F_UINT: {
+                                                        union {
+                                                                uint16_t uval16;
+                                                                uint32_t uval32;
+                                                        } u;
                                                         unsigned value = (unsigned char)*bp;
                                                         switch (pr->bcnt) {
                                                         case 1:
                                                                 break;
                                                         case 2:
-                                                                move_from_unaligned16(value, bp);
+                                                                move_from_unaligned16(u.uval16, bp);
+                                                                value = u.uval16;
                                                                 break;
                                                         case 4:
-                                                                move_from_unaligned32(value, bp);
+                                                                move_from_unaligned32(u.uval32, bp);
+                                                                value = u.uval32;
                                                                 break;
                                                         /* case 8: no users yet */
                                                         }
diff --git a/libbb/getopt32.c b/libbb/getopt32.c
index 76d29d5eb..9247588d9 100644
--- a/libbb/getopt32.c
+++ b/libbb/getopt32.c
@@ -530,6 +530,7 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
          * "fake" short options, like this one:
          * wget $'-\203' "Test: test" http://kernel.org/
          * (supposed to act as --header, but doesn't) */
+ next_opt:
 #if ENABLE_LONG_OPTS
         while ((c = getopt_long(argc, argv, applet_opts,
                         long_options, NULL)) != -1) {
@@ -544,8 +545,16 @@ vgetopt32(char **argv, const char *applet_opts, const char *applet_long_options,
                          * but we construct long opts so that flag
                          * is always NULL (see above) */
                         if (on_off->opt_char == '\0' /* && c != '\0' */) {
-                                /* c is probably '?' - "bad option" */
-                                goto error;
+                                /* We reached the end of complementary[] and did not find -c */
+                                if (c == '?') /* getopt says: "bad option, or option has no required argument" */
+                                        goto error;
+                                /* if there were options beyond 32 bits (example: ls),
+                                 * they got no complementary[] slot, and no result bit.
+                                 * IOW: they must be "accept but ignore" options.
+                                 * For them, we end up here.
+                                 */
+                                //bb_error_msg("ignored option '%c', skipping", c);
+                                goto next_opt;
                         }
                 }
                 if (flags & on_off->incongruously)
diff --git a/libbb/hash_hmac.c b/libbb/hash_hmac.c
new file mode 100644
index 000000000..b3138029f
--- /dev/null
+++ b/libbb/hash_hmac.c
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2025 Denys Vlasenko
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_TLS) += hash_hmac.o
+//kbuild:lib-$(CONFIG_USE_BB_CRYPT_YES) += hash_hmac.o
+
+#include "libbb.h"
+
+// RFC 2104:
+// HMAC(key, text) based on a hash H (say, sha256) is:
+// ipad = [0x36 x INSIZE]
+// opad = [0x5c x INSIZE]
+// HMAC(key, text) = H((key XOR opad) + H((key XOR ipad) + text))
+//
+// H(key XOR opad) and H(key XOR ipad) can be precomputed
+// if we often need HMAC hmac with the same key.
+//
+// text is often given in disjoint pieces.
+#if !ENABLE_FEATURE_USE_CNG_API
+void FAST_FUNC hmac_begin(hmac_ctx_t *ctx, const uint8_t *key, unsigned key_size, md5sha_begin_func *begin)
+{
+#if HMAC_ONLY_SHA256
+#define begin sha256_begin
+#endif
+        uint8_t key_xor_ipad[SHA2_INSIZE];
+        uint8_t key_xor_opad[SHA2_INSIZE];
+        unsigned i;
+
+        // "The authentication key can be of any length up to INSIZE, the
+        // block length of the hash function.  Applications that use keys longer
+        // than INSIZE bytes will first hash the key using H and then use the
+        // resultant OUTSIZE byte string as the actual key to HMAC."
+        if (key_size > SHA2_INSIZE) {
+                uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
+                /* use ctx->hashed_key_xor_ipad as scratch ctx */
+                begin(&ctx->hashed_key_xor_ipad);
+                md5sha_hash(&ctx->hashed_key_xor_ipad, key, key_size);
+                key_size = sha_end(&ctx->hashed_key_xor_ipad, tempkey);
+                key = tempkey;
+        }
+
+        for (i = 0; i < key_size; i++) {
+                key_xor_ipad[i] = key[i] ^ 0x36;
+                key_xor_opad[i] = key[i] ^ 0x5c;
+        }
+        for (; i < SHA2_INSIZE; i++) {
+                key_xor_ipad[i] = 0x36;
+                key_xor_opad[i] = 0x5c;
+        }
+
+        begin(&ctx->hashed_key_xor_ipad);
+        begin(&ctx->hashed_key_xor_opad);
+        md5sha_hash(&ctx->hashed_key_xor_ipad, key_xor_ipad, SHA2_INSIZE);
+        md5sha_hash(&ctx->hashed_key_xor_opad, key_xor_opad, SHA2_INSIZE);
+}
+#undef begin
+
+unsigned FAST_FUNC hmac_end(hmac_ctx_t *ctx, uint8_t *out)
+{
+        unsigned len = sha_end(&ctx->hashed_key_xor_ipad, out);
+        /* out = H((key XOR opad) + out) */
+        md5sha_hash(&ctx->hashed_key_xor_opad, out, len);
+        return sha_end(&ctx->hashed_key_xor_opad, out);
+}
+
+unsigned FAST_FUNC hmac_block(const uint8_t *key, unsigned key_size, md5sha_begin_func *begin, const void *in, unsigned sz, uint8_t *out)
+{
+        hmac_ctx_t ctx;
+        hmac_begin(&ctx, key, key_size, begin);
+        hmac_hash(&ctx, in, sz);
+        return hmac_end(&ctx, out);
+}
+
+/* TLS helpers */
+
+void FAST_FUNC hmac_hash_v(
+                hmac_ctx_t *ctx,
+                va_list va)
+{
+        uint8_t *in;
+
+        /* ctx->hashed_key_xor_ipad contains unclosed "H((key XOR ipad) +" state */
+        /* ctx->hashed_key_xor_opad contains unclosed "H((key XOR opad) +" state */
+
+        /* calculate out = H((key XOR ipad) + text) */
+        while ((in = va_arg(va, uint8_t*)) != NULL) {
+                unsigned size = va_arg(va, unsigned);
+                md5sha_hash(&ctx->hashed_key_xor_ipad, in, size);
+        }
+}
+#else
+void _hmac_begin(hmac_ctx_t *ctx, uint8_t *key, unsigned key_size,
+                                        BCRYPT_ALG_HANDLE alg_handle) {
+        DWORD hash_object_length = 0;
+        ULONG _unused;
+        NTSTATUS status;
+
+        status = BCryptGetProperty(alg_handle, BCRYPT_OBJECT_LENGTH,
+                                (PUCHAR)&hash_object_length, sizeof(DWORD), &_unused, 0);
+        mingw_die_if_error(status, "BCryptGetProperty");
+        status = BCryptGetProperty(alg_handle, BCRYPT_HASH_LENGTH,
+                                (PUCHAR)&ctx->output_size, sizeof(DWORD), &_unused, 0);
+        mingw_die_if_error(status, "BCryptGetProperty");
+
+        ctx->hash_obj = xmalloc(hash_object_length);
+
+        status = BCryptCreateHash(alg_handle, &ctx->handle, ctx->hash_obj,
+                                hash_object_length, key, key_size, BCRYPT_HASH_REUSABLE_FLAG);
+        mingw_die_if_error(status, "BCryptCreateHash");
+}
+
+unsigned FAST_FUNC hmac_end(hmac_ctx_t *ctx, uint8_t *out)
+{
+        NTSTATUS status;
+
+        status = BCryptFinishHash(ctx->handle, out, ctx->output_size, 0);
+        mingw_die_if_error(status, "BCryptFinishHash");
+
+        return ctx->output_size;
+}
+
+void FAST_FUNC hmac_hash_v(hmac_ctx_t *ctx, va_list va)
+{
+        uint8_t *in;
+
+        while ((in = va_arg(va, uint8_t*)) != NULL) {
+                unsigned size = va_arg(va, unsigned);
+                BCryptHashData(ctx->handle, in, size, 0);
+        }
+}
+
+void hmac_uninit(hmac_ctx_t *ctx) {
+        BCryptDestroyHash(ctx->handle);
+        free(ctx->hash_obj);
+}
+#endif
+
+/* Using HMAC state, make a copy of it (IOW: without affecting this state!)
+ * hash in the list of (ptr,size) blocks, and finish the HMAC to out[] buffer.
+ * This function is useful for TLS PRF.
+ */
+unsigned hmac_peek_hash(hmac_ctx_t *ctx, uint8_t *out, ...)
+{
+        hmac_ctx_t tmpctx = *ctx; /* struct copy */
+        va_list va;
+
+        va_start(va, out);
+        hmac_hash_v(&tmpctx, va);
+        va_end(va);
+
+        return hmac_end(&tmpctx, out);
+}
diff --git a/libbb/hash_md5_sha.c b/libbb/hash_md5_sha.c
index 22dd890bf..fd56d831b 100644
--- a/libbb/hash_md5_sha.c
+++ b/libbb/hash_md5_sha.c
@@ -11,7 +11,7 @@
 #define STR1(s) #s
 #define STR(s) STR1(s)
 
-#define NEED_SHA512 (ENABLE_SHA512SUM || ENABLE_USE_BB_CRYPT_SHA)
+#define NEED_SHA512 (ENABLE_SHA512SUM || ENABLE_SHA384SUM || ENABLE_USE_BB_CRYPT_SHA)
 
 #if ENABLE_FEATURE_USE_CNG_API
 # include <windows.h>
@@ -21,6 +21,7 @@
 # define BCRYPT_MD5_ALG_HANDLE    ((BCRYPT_ALG_HANDLE) 0x00000021)
 # define BCRYPT_SHA1_ALG_HANDLE   ((BCRYPT_ALG_HANDLE) 0x00000031)
 # define BCRYPT_SHA256_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x00000041)
+# define BCRYPT_SHA384_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x00000051)
 # define BCRYPT_SHA512_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x00000061)
 
 /* Initialize structure containing state of computation.
@@ -61,9 +62,18 @@ void FAST_FUNC sha256_begin(sha256_ctx_t *ctx)
         generic_init(ctx, BCRYPT_SHA256_ALG_HANDLE);
 }
 
-#if NEED_SHA512
+#if ENABLE_SHA384SUM
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.3)  */
+void FAST_FUNC sha384_begin(sha384_ctx_t *ctx)
+{
+        generic_init(ctx, BCRYPT_SHA384_ALG_HANDLE);
+}
+#endif /* ENABLE_SHA384SUM */
+
+#if NEED_SHA512
+/* Initialize structure containing state of computation.
+   (FIPS 180-2:5.3.4)  */
 void FAST_FUNC sha512_begin(sha512_ctx_t *ctx)
 {
         generic_init(ctx, BCRYPT_SHA512_ALG_HANDLE);
@@ -1109,7 +1119,7 @@ static const sha_K_int sha_K[] ALIGN8 = {
         K(0x84c87814a1f0ab72ULL), K(0x8cc702081a6439ecULL),
         K(0x90befffa23631e28ULL), K(0xa4506cebde82bde9ULL),
         K(0xbef9a3f7b2c67915ULL), K(0xc67178f2e372532bULL),
-#if NEED_SHA512  /* [64]+ are used for sha512 only */
+#if NEED_SHA512  /* [64]+ are used for sha384 and sha512 only */
         K(0xca273eceea26619cULL), K(0xd186b8c721c0c207ULL),
         K(0xeada7dd6cde0eb1eULL), K(0xf57d4f7fee6ed178ULL),
         K(0x06f067aa72176fbaULL), K(0x0a637dc5a2c898a6ULL),
@@ -1306,11 +1316,20 @@ static const uint32_t init512_lo[] ALIGN4 = {
         0x137e2179,
 };
 #endif /* NEED_SHA512 */
-
-// Note: SHA-384 is identical to SHA-512, except that initial hash values are
-// 0xcbbb9d5dc1059ed8, 0x629a292a367cd507, 0x9159015a3070dd17, 0x152fecd8f70e5939,
-// 0x67332667ffc00b31, 0x8eb44a8768581511, 0xdb0c2e0d64f98fa7, 0x47b5481dbefa4fa4,
-// and the output is constructed by omitting last two 64-bit words of it.
+#if ENABLE_SHA384SUM
+static const uint64_t init384[] ALIGN8 = {
+        0,
+        0,
+        0xcbbb9d5dc1059ed8,
+        0x629a292a367cd507,
+        0x9159015a3070dd17,
+        0x152fecd8f70e5939,
+        0x67332667ffc00b31,
+        0x8eb44a8768581511,
+        0xdb0c2e0d64f98fa7,
+        0x47b5481dbefa4fa4,
+};
+#endif
 
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.2)  */
@@ -1332,9 +1351,19 @@ void FAST_FUNC sha256_begin(sha256_ctx_t *ctx)
 #endif
 }
 
-#if NEED_SHA512
+#if ENABLE_SHA384SUM
 /* Initialize structure containing state of computation.
    (FIPS 180-2:5.3.3)  */
+void FAST_FUNC sha384_begin(sha512_ctx_t *ctx)
+{
+        memcpy(&ctx->total64, init384, sizeof(init384));
+        /*ctx->total64[0] = ctx->total64[1] = 0; - already done */
+}
+#endif
+
+#if NEED_SHA512
+/* Initialize structure containing state of computation.
+   (FIPS 180-2:5.3.4)  */
 void FAST_FUNC sha512_begin(sha512_ctx_t *ctx)
 {
         int i;
@@ -1409,7 +1438,7 @@ unsigned FAST_FUNC sha1_end(sha1_ctx_t *ctx, void *resbuf)
 }
 
 #if NEED_SHA512
-unsigned FAST_FUNC sha512_end(sha512_ctx_t *ctx, void *resbuf)
+static unsigned FAST_FUNC sha512384_end(sha512_ctx_t *ctx, void *resbuf, unsigned outsize)
 {
         unsigned bufpos = ctx->total64[0] & 127;
 
@@ -1440,12 +1469,22 @@ unsigned FAST_FUNC sha512_end(sha512_ctx_t *ctx, void *resbuf)
                 for (i = 0; i < ARRAY_SIZE(ctx->hash); ++i)
                         ctx->hash[i] = SWAP_BE64(ctx->hash[i]);
         }
-        memcpy(resbuf, ctx->hash, sizeof(ctx->hash));
-        return sizeof(ctx->hash);
+        memcpy(resbuf, ctx->hash, outsize);
+        return outsize;
+}
+unsigned FAST_FUNC sha512_end(sha384_ctx_t *ctx, void *resbuf)
+{
+        return sha512384_end(ctx, resbuf, SHA512_OUTSIZE);
 }
 #endif /* NEED_SHA512 */
-#endif /* !ENABLE_FEATURE_USE_CNG_API */
 
+#if ENABLE_SHA384SUM
+unsigned FAST_FUNC sha384_end(sha384_ctx_t *ctx, void *resbuf)
+{
+        return sha512384_end(ctx, resbuf, SHA384_OUTSIZE);
+}
+#endif
+#endif /* !ENABLE_FEATURE_USE_CNG_API */
 
 /*
  * The Keccak sponge function, designed by Guido Bertoni, Joan Daemen,
@@ -1982,6 +2021,8 @@ void FAST_FUNC sha3_hash(sha3_ctx_t *ctx, const void *buffer, size_t len)
 
 unsigned FAST_FUNC sha3_end(sha3_ctx_t *ctx, void *resbuf)
 {
+        unsigned hash_len;
+
         /* Padding */
         uint8_t *buf = (uint8_t*)ctx->state;
         /*
@@ -2004,6 +2045,7 @@ unsigned FAST_FUNC sha3_end(sha3_ctx_t *ctx, void *resbuf)
         sha3_process_block72(ctx->state);
 
         /* Output */
-        memcpy(resbuf, ctx->state, 64);
-        return 64;
+        hash_len = (1600/8 - ctx->input_block_bytes) / 2;
+        memcpy(resbuf, ctx->state, hash_len);
+        return hash_len;
 }
diff --git a/libbb/hash_sha256_block.c b/libbb/hash_sha256_block.c
new file mode 100644
index 000000000..3c4366321
--- /dev/null
+++ b/libbb/hash_sha256_block.c
@@ -0,0 +1,19 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 Denys Vlasenko
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+//kbuild:lib-y += hash_sha256_block.o
+#include "libbb.h"
+
+void FAST_FUNC
+sha256_block(const void *in, size_t len, uint8_t hash[32])
+{
+        sha256_ctx_t ctx;
+        sha256_begin(&ctx);
+        sha256_hash(&ctx, in, len);
+        sha256_end(&ctx, hash);
+}
diff --git a/libbb/hash_sha256_hwaccel_x86-32.S b/libbb/hash_sha256_hwaccel_x86-32.S
index a0e4a571a..8d84055e8 100644
--- a/libbb/hash_sha256_hwaccel_x86-32.S
+++ b/libbb/hash_sha256_hwaccel_x86-32.S
@@ -34,21 +34,21 @@
 #define MSG             %xmm0
 #define STATE0          %xmm1
 #define STATE1          %xmm2
-#define MSGTMP0         %xmm3
-#define MSGTMP1         %xmm4
-#define MSGTMP2         %xmm5
-#define MSGTMP3         %xmm6
+#define MSG0            %xmm3
+#define MSG1            %xmm4
+#define MSG2            %xmm5
+#define MSG3            %xmm6
 
 #define XMMTMP          %xmm7
 
-#define SHUF(a,b,c,d) $(a+(b<<2)+(c<<4)+(d<<6))
+#define SHUF(a,b,c,d) $((a)+((b)<<2)+((c)<<4)+((d)<<6))
 
         .balign 8       # allow decoders to fetch at least 2 first insns
 sha256_process_block64_shaNI:
 
-        movu128         76+0*16(%eax), XMMTMP /* ABCD (little-endian dword order) */
+        movu128         76+0*16(%eax), XMMTMP /* ABCD (shown least-significant-dword-first) */
         movu128         76+1*16(%eax), STATE1 /* EFGH */
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         mova128         STATE1, STATE0
         /* ---          -------------- ABCD -- EFGH */
         shufps          SHUF(1,0,1,0), XMMTMP, STATE0 /* FEBA */
@@ -58,190 +58,208 @@ sha256_process_block64_shaNI:
         mova128         PSHUFFLE_BSWAP32_FLIP_MASK, XMMTMP
         movl            $K256+8*16, SHA256CONSTANTS
 
+// sha256rnds2 instruction uses only lower 64 bits of MSG.
+// The code below needs to move upper 64 bits to lower 64 bits
+// for the second sha256rnds2 invocation
+// (what remains in upper bits does not matter).
+// There are several ways to do it:
+// movhlps    MSG, MSG                // abcd -> cdcd (3 bytes of code)
+// shuf128_32 SHUF(2,3,n,n), MSG, MSG // abcd -> cdXX (4 bytes)
+// punpckhqdq MSG, MSG                // abcd -> cdcd (4 bytes)
+// unpckhpd   MSG, MSG                // abcd -> cdcd (4 bytes)
+// psrldq     $8, MSG                 // abcd -> cd00 (5 bytes)
+// palignr    $8, MSG, MSG            // abcd -> cdab (6 bytes, SSSE3 insn)
+#define MOVE_UPPER64_DOWN(reg) movhlps reg, reg
+//#define MOVE_UPPER64_DOWN(reg) shuf128_32 SHUF(2,3,0,0), reg, reg
+//#define MOVE_UPPER64_DOWN(reg) punpckhqdq reg, reg
+//#define MOVE_UPPER64_DOWN(reg) unpckhpd reg, reg
+//#define MOVE_UPPER64_DOWN(reg) psrldq $8, reg
+//#define MOVE_UPPER64_DOWN(reg) palignr $8, reg, reg
+
         /* Rounds 0-3 */
         movu128         0*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP0
+        mova128         MSG, MSG0
                 paddd           0*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 4-7 */
         movu128         1*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP1
+        mova128         MSG, MSG1
                 paddd           1*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 8-11 */
         movu128         2*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP2
+        mova128         MSG, MSG2
                 paddd           2*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 12-15 */
         movu128         3*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
 /* ...to here */
-        mova128         MSG, MSGTMP3
+        mova128         MSG, MSG3
                 paddd           3*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 16-19 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           4*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 20-23 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           5*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 24-27 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           6*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 28-31 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           7*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 32-35 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           8*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 36-39 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           9*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 40-43 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           10*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 44-47 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           11*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 48-51 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           12*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 52-55 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           13*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 56-59 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           14*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 60-63 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           15*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Write hash values back in the correct order */
         mova128         STATE0, XMMTMP
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         /* ---          -------------- HGDC -- FEBA */
         shufps          SHUF(3,2,3,2), STATE1, STATE0 /* ABCD */
         shufps          SHUF(1,0,1,0), STATE1, XMMTMP /* EFGH */
diff --git a/libbb/hash_sha256_hwaccel_x86-64.S b/libbb/hash_sha256_hwaccel_x86-64.S
index 172c2eae2..ee3abbd1f 100644
--- a/libbb/hash_sha256_hwaccel_x86-64.S
+++ b/libbb/hash_sha256_hwaccel_x86-64.S
@@ -34,24 +34,24 @@
 #define MSG             %xmm0
 #define STATE0          %xmm1
 #define STATE1          %xmm2
-#define MSGTMP0         %xmm3
-#define MSGTMP1         %xmm4
-#define MSGTMP2         %xmm5
-#define MSGTMP3         %xmm6
+#define MSG0            %xmm3
+#define MSG1            %xmm4
+#define MSG2            %xmm5
+#define MSG3            %xmm6
 
 #define XMMTMP          %xmm7
 
 #define SAVE0           %xmm8
 #define SAVE1           %xmm9
 
-#define SHUF(a,b,c,d) $(a+(b<<2)+(c<<4)+(d<<6))
+#define SHUF(a,b,c,d) $((a)+((b)<<2)+((c)<<4)+((d)<<6))
 
         .balign 8       # allow decoders to fetch at least 2 first insns
 sha256_process_block64_shaNI:
 
-        movu128         80+0*16(%rdi), XMMTMP /* ABCD (little-endian dword order) */
+        movu128         80+0*16(%rdi), XMMTMP /* ABCD (shown least-significant-dword-first) */
         movu128         80+1*16(%rdi), STATE1 /* EFGH */
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         mova128         STATE1, STATE0
         /* ---          -------------- ABCD -- EFGH */
         shufps          SHUF(1,0,1,0), XMMTMP, STATE0 /* FEBA */
@@ -65,185 +65,203 @@ sha256_process_block64_shaNI:
         mova128         STATE0, SAVE0
         mova128         STATE1, SAVE1
 
+// sha256rnds2 instruction uses only lower 64 bits of MSG.
+// The code below needs to move upper 64 bits to lower 64 bits
+// for the second sha256rnds2 invocation
+// (what remains in upper bits does not matter).
+// There are several ways to do it:
+// movhlps    MSG, MSG                // abcd -> cdcd (3 bytes of code)
+// shuf128_32 SHUF(2,3,n,n), MSG, MSG // abcd -> cdXX (4 bytes)
+// punpckhqdq MSG, MSG                // abcd -> cdcd (4 bytes)
+// unpckhpd   MSG, MSG                // abcd -> cdcd (4 bytes)
+// psrldq     $8, MSG                 // abcd -> cd00 (5 bytes)
+// palignr    $8, MSG, MSG            // abcd -> cdab (6 bytes, SSSE3 insn)
+#define MOVE_UPPER64_DOWN(reg) movhlps reg, reg
+//#define MOVE_UPPER64_DOWN(reg) shuf128_32 SHUF(2,3,0,0), reg, reg
+//#define MOVE_UPPER64_DOWN(reg) punpckhqdq reg, reg
+//#define MOVE_UPPER64_DOWN(reg) unpckhpd reg, reg
+//#define MOVE_UPPER64_DOWN(reg) psrldq $8, reg
+//#define MOVE_UPPER64_DOWN(reg) palignr $8, reg, reg
+
         /* Rounds 0-3 */
         movu128         0*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP0
+        mova128         MSG, MSG0
                 paddd           0*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 4-7 */
         movu128         1*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP1
+        mova128         MSG, MSG1
                 paddd           1*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 8-11 */
         movu128         2*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
-        mova128         MSG, MSGTMP2
+        mova128         MSG, MSG2
                 paddd           2*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 12-15 */
         movu128         3*16(DATA_PTR), MSG
         pshufb          XMMTMP, MSG
 /* ...to here */
-        mova128         MSG, MSGTMP3
+        mova128         MSG, MSG3
                 paddd           3*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 16-19 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           4*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 20-23 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           5*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 24-27 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           6*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 28-31 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           7*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 32-35 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           8*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 36-39 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           9*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP1, MSGTMP0
+        sha256msg1      MSG1, MSG0
 
         /* Rounds 40-43 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           10*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP2, MSGTMP1
+        sha256msg1      MSG2, MSG1
 
         /* Rounds 44-47 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           11*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP3, XMMTMP
-        palignr         $4, MSGTMP2, XMMTMP
-        paddd           XMMTMP, MSGTMP0
-        sha256msg2      MSGTMP3, MSGTMP0
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG3, XMMTMP
+        palignr         $4, MSG2, XMMTMP
+        paddd           XMMTMP, MSG0
+        sha256msg2      MSG3, MSG0
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP3, MSGTMP2
+        sha256msg1      MSG3, MSG2
 
         /* Rounds 48-51 */
-        mova128         MSGTMP0, MSG
+        mova128         MSG0, MSG
                 paddd           12*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP0, XMMTMP
-        palignr         $4, MSGTMP3, XMMTMP
-        paddd           XMMTMP, MSGTMP1
-        sha256msg2      MSGTMP0, MSGTMP1
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG0, XMMTMP
+        palignr         $4, MSG3, XMMTMP
+        paddd           XMMTMP, MSG1
+        sha256msg2      MSG0, MSG1
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
-        sha256msg1      MSGTMP0, MSGTMP3
+        sha256msg1      MSG0, MSG3
 
         /* Rounds 52-55 */
-        mova128         MSGTMP1, MSG
+        mova128         MSG1, MSG
                 paddd           13*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP1, XMMTMP
-        palignr         $4, MSGTMP0, XMMTMP
-        paddd           XMMTMP, MSGTMP2
-        sha256msg2      MSGTMP1, MSGTMP2
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG1, XMMTMP
+        palignr         $4, MSG0, XMMTMP
+        paddd           XMMTMP, MSG2
+        sha256msg2      MSG1, MSG2
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 56-59 */
-        mova128         MSGTMP2, MSG
+        mova128         MSG2, MSG
                 paddd           14*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-        mova128         MSGTMP2, XMMTMP
-        palignr         $4, MSGTMP1, XMMTMP
-        paddd           XMMTMP, MSGTMP3
-        sha256msg2      MSGTMP2, MSGTMP3
-                shuf128_32      $0x0E, MSG, MSG
+        mova128         MSG2, XMMTMP
+        palignr         $4, MSG1, XMMTMP
+        paddd           XMMTMP, MSG3
+        sha256msg2      MSG2, MSG3
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Rounds 60-63 */
-        mova128         MSGTMP3, MSG
+        mova128         MSG3, MSG
                 paddd           15*16-8*16(SHA256CONSTANTS), MSG
                 sha256rnds2     MSG, STATE0, STATE1
-                shuf128_32      $0x0E, MSG, MSG
+                MOVE_UPPER64_DOWN(MSG)
                 sha256rnds2     MSG, STATE1, STATE0
 
         /* Add current hash values with previously saved */
@@ -252,7 +270,7 @@ sha256_process_block64_shaNI:
 
         /* Write hash values back in the correct order */
         mova128         STATE0, XMMTMP
-/* shufps takes dwords 0,1 from *2nd* operand, and dwords 2,3 from 1st one */
+/* shufps: dwords 0,1 of the result are selected from *2nd* operand, and dwords 2,3 from 1st operand */
         /* ---          -------------- HGDC -- FEBA */
         shufps          SHUF(3,2,3,2), STATE1, STATE0 /* ABCD */
         shufps          SHUF(1,0,1,0), STATE1, XMMTMP /* EFGH */
diff --git a/libbb/lineedit.c b/libbb/lineedit.c
index 8e2b37853..77207a427 100644
--- a/libbb/lineedit.c
+++ b/libbb/lineedit.c
@@ -457,7 +457,7 @@ static void put_cur_glyph_and_inc_cursor(void)
                  * have automargin (IOW: it is moving cursor to next line
                  * by itself (which is wrong for VT-10x terminals)),
                  * this will break things: there will be one extra empty line */
-                puts("\r"); /* + implicit '\n' */
+                fputs("\r\n", stderr);
 #else
                 /* VT-10x terminals don't wrap cursor to next line when last char
                  * on the line is printed - cursor stays "over" this char.
@@ -1302,9 +1302,10 @@ static void showfiles(void)
                         );
                 }
                 if (ENABLE_UNICODE_SUPPORT)
-                        puts(printable_string(matches[n]));
+                        fputs(printable_string(matches[n]), stderr);
                 else
-                        puts(matches[n]);
+                        fputs(matches[n], stderr);
+                bb_putchar_stderr('\n');
         }
 }
 
@@ -1595,8 +1596,8 @@ unsigned FAST_FUNC size_from_HISTFILESIZE(const char *hp)
 # endif
         if (hp) {
                 size = atoi(hp);
-                if (size <= 0)
-                        return 1;
+                if (size < 0)
+                        return 0;
                 if (size > MAX_HISTORY)
                         return MAX_HISTORY;
         }
@@ -1690,18 +1691,21 @@ static void load_history(line_input_t *st_parm)
         /* NB: do not trash old history if file can't be opened */
 
         fp = fopen_for_read(st_parm->hist_file);
-        if (fp) {
-                /* clean up old history */
-                for (idx = st_parm->cnt_history; idx > 0;) {
-                        idx--;
-                        free(st_parm->history[idx]);
-                        st_parm->history[idx] = NULL;
-                }
+        if (!fp)
+                return;
+
+        /* clean up old history */
+        for (idx = st_parm->cnt_history; idx > 0;) {
+                idx--;
+                free(st_parm->history[idx]);
+                st_parm->history[idx] = NULL;
+        }
 
-                /* fill temp_h[], retaining only last MAX_HISTORY lines */
-                memset(temp_h, 0, sizeof(temp_h));
-                idx = 0;
-                st_parm->cnt_history_in_file = 0;
+        /* fill temp_h[], retaining only last max_history lines */
+        memset(temp_h, 0, sizeof(temp_h));
+        idx = 0;
+        st_parm->cnt_history_in_file = 0;
+        if (st_parm->max_history != 0) {
                 while ((line = xmalloc_fgetline(fp)) != NULL) {
                         if (line[0] == '\0') {
                                 free(line);
@@ -1714,34 +1718,34 @@ static void load_history(line_input_t *st_parm)
                         if (idx == st_parm->max_history)
                                 idx = 0;
                 }
-                fclose(fp);
-
-                /* find first non-NULL temp_h[], if any */
-                if (st_parm->cnt_history_in_file) {
-                        while (temp_h[idx] == NULL) {
-                                idx++;
-                                if (idx == st_parm->max_history)
-                                        idx = 0;
-                        }
-                }
+        }
+        fclose(fp);
 
-                /* copy temp_h[] to st_parm->history[] */
-                for (i = 0; i < st_parm->max_history;) {
-                        line = temp_h[idx];
-                        if (!line)
-                                break;
+        /* find first non-NULL temp_h[], if any */
+        if (st_parm->cnt_history_in_file != 0) {
+                while (temp_h[idx] == NULL) {
                         idx++;
                         if (idx == st_parm->max_history)
                                 idx = 0;
-                        line_len = strlen(line);
-                        if (line_len >= MAX_LINELEN)
-                                line[MAX_LINELEN-1] = '\0';
-                        st_parm->history[i++] = line;
                 }
-                st_parm->cnt_history = i;
-                if (ENABLE_FEATURE_EDITING_SAVE_ON_EXIT)
-                        st_parm->cnt_history_in_file = i;
         }
+
+        /* copy temp_h[] to st_parm->history[] */
+        for (i = 0; i < st_parm->max_history;) {
+                line = temp_h[idx];
+                if (!line)
+                        break;
+                idx++;
+                if (idx == st_parm->max_history)
+                        idx = 0;
+                line_len = strlen(line);
+                if (line_len >= MAX_LINELEN)
+                        line[MAX_LINELEN-1] = '\0';
+                st_parm->history[i++] = line;
+        }
+        st_parm->cnt_history = i;
+        if (ENABLE_FEATURE_EDITING_SAVE_ON_EXIT)
+                st_parm->cnt_history_in_file = i;
 }
 
 #  if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
@@ -1749,17 +1753,27 @@ void FAST_FUNC save_history(line_input_t *st)
 {
         FILE *fp;
 
-        if (!st || !st->hist_file)
+        /* bash compat: HISTFILE="" disables history saving */
+        if (!st || !st->hist_file || !st->hist_file[0])
                 return;
         if (st->cnt_history <= st->cnt_history_in_file)
-                return;
+                return; /* no new entries were added */
+        /* note: if st->max_history is 0, we do not abort: we truncate the history to 0 lines */
 
-        fp = fopen(st->hist_file, "a");
+        fp = fopen(st->hist_file, (st->max_history == 0 ? "w" : "a"));
         if (fp) {
                 int i, fd;
                 char *new_name;
                 line_input_t *st_temp;
 
+                /* max_history==0 needs special-casing in general code,
+                 * just handle it in a simpler way: */
+                if (st->max_history == 0) {
+                        /* fopen("w") already truncated it */
+                        fclose(fp);
+                        return;
+                }
+
                 for (i = st->cnt_history_in_file; i < st->cnt_history; i++)
                         fprintf(fp, "%s\n", st->history[i]);
                 fclose(fp);
@@ -1769,6 +1783,8 @@ void FAST_FUNC save_history(line_input_t *st)
                 st_temp = new_line_input_t(st->flags);
                 st_temp->hist_file = st->hist_file;
                 st_temp->max_history = st->max_history;
+                /* load no more than max_history last lines */
+                /* (in unlikely case that file disappeared, st_temp gets empty history) */
                 load_history(st_temp);
 
                 /* write out temp file and replace hist_file atomically */
@@ -1792,13 +1808,13 @@ static void save_history(char *str)
         int fd;
         int len, len2;
 
-        if (!state->hist_file)
+        /* bash compat: HISTFILE="" disables history saving */
+        if (!state->hist_file || !state->hist_file[0])
                 return;
 
         fd = open(state->hist_file, O_WRONLY | O_CREAT | O_APPEND, 0600);
         if (fd < 0)
                 return;
-        xlseek(fd, 0, SEEK_END); /* paranoia */
         len = strlen(str);
         str[len] = '\n'; /* we (try to) do atomic write */
         len2 = full_write(fd, str, len + 1);
@@ -1853,13 +1869,10 @@ static void remember_in_history(char *str)
         if (str[0] == '\0')
                 return;
         i = state->cnt_history;
-        /* Don't save dupes */
-        if (i && strcmp(state->history[i-1], str) == 0)
+        /* Don't save dups */
+        if (i != 0 && strcmp(state->history[i-1], str) == 0)
                 return;
 
-        free(state->history[state->max_history]); /* redundant, paranoia */
-        state->history[state->max_history] = NULL; /* redundant, paranoia */
-
         /* If history[] is full, remove the oldest command */
         /* we need to keep history[state->max_history] empty, hence >=, not > */
         if (i >= state->max_history) {
@@ -1872,7 +1885,7 @@ static void remember_in_history(char *str)
                         state->cnt_history_in_file--;
 # endif
         }
-        /* i <= state->max_history-1 */
+        /* i < state->max_history */
         state->history[i++] = xstrdup(str);
         /* i <= state->max_history */
         state->cur_history = i;
@@ -2388,7 +2401,6 @@ static int lineedit_read_key(char *read_key_buffer, int timeout)
                                 errno = EINTR;
                                 return -1;
                         }
-//FIXME: still races here with signals, but small window to poll() inside read_key
                         IF_FEATURE_EDITING_WINCH(S.ok_to_redraw = 1;)
                         /* errno = 0; - read_key does this itself */
                         ic = read_key(STDIN_FILENO, read_key_buffer, timeout);
diff --git a/libbb/poll_with_signals.c b/libbb/poll_with_signals.c
new file mode 100644
index 000000000..d3c005418
--- /dev/null
+++ b/libbb/poll_with_signals.c
@@ -0,0 +1,48 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_PLATFORM_POSIX) += poll_with_signals.o
+
+#include "libbb.h"
+
+/* Shells, for example, need their line input and "read" builtin
+ * to be interruptible, and the naive handling of it a-la:
+ *      if (bb_got_signal) {
+ *              errno = EINTR;
+ *              return -1;
+ *      }
+ *      poll(pfd, 1, -1); // signal here would set EINTR
+ * is racy.
+ * This is a bit heavy-handed, but safe wrt races:
+ */
+int FAST_FUNC check_got_signal_and_poll(struct pollfd pfd[1], int timeout)
+{
+        int n;
+        struct timespec tv;
+        sigset_t orig_mask;
+
+        if (bb_got_signal) /* optimization */
+                goto eintr;
+
+        if (timeout >= 0) {
+                tv.tv_sec = timeout / 1000;
+                tv.tv_nsec = (timeout % 1000) * 1000000;
+        }
+        /* test bb_got_signal, then poll(), atomically wrt signals */
+        sigfillset(&orig_mask);
+        sigprocmask2(SIG_BLOCK, &orig_mask);
+        if (bb_got_signal) {
+                sigprocmask2(SIG_SETMASK, &orig_mask);
+ eintr:
+                errno = EINTR; /* inform the caller that we got a signal */
+                return -1;
+        }
+        n = ppoll(pfd, 1, timeout >= 0 ? &tv : NULL, &orig_mask);
+        sigprocmask2(SIG_SETMASK, &orig_mask);
+        return n;
+}
diff --git a/libbb/procps.c b/libbb/procps.c
index 8c9cac125..c751100bc 100644
--- a/libbb/procps.c
+++ b/libbb/procps.c
@@ -110,7 +110,7 @@ void FAST_FUNC free_procps_scan(procps_status_t* sp)
 }
 
 #if ENABLE_FEATURE_TOPMEM || ENABLE_PMAP
-static unsigned long long fast_strtoull_16(char **endptr)
+unsigned long long FAST_FUNC fast_strtoull_16(char **endptr)
 {
         unsigned char c;
         char *str = *endptr;
@@ -131,7 +131,7 @@ static unsigned long long fast_strtoull_16(char **endptr)
 
 #if ENABLE_FEATURE_FAST_TOP || ENABLE_FEATURE_TOPMEM || ENABLE_PMAP
 /* We cut a lot of corners here for speed */
-static unsigned long fast_strtoul_10(char **endptr)
+unsigned long FAST_FUNC fast_strtoul_10(char **endptr)
 {
         unsigned char c;
         char *str = *endptr;
@@ -144,6 +144,24 @@ static unsigned long fast_strtoul_10(char **endptr)
         *endptr = str + 1; /* We skip trailing space! */
         return n;
 }
+# if LONG_MAX < LLONG_MAX
+/* For VSZ, which can be very large */
+static unsigned long long fast_strtoull_10(char **endptr)
+{
+        unsigned char c;
+        char *str = *endptr;
+        unsigned long long n = *str - '0';
+
+        /* Need to stop on both ' ' and '\n' */
+        while ((c = *++str) > ' ')
+                n = n*10 + (c - '0');
+
+        *endptr = str + 1; /* We skip trailing space! */
+        return n;
+}
+# else
+#  define fast_strtoull_10(endptr) fast_strtoul_10(endptr)
+# endif
 
 # if ENABLE_FEATURE_FAST_TOP
 static long fast_strtol_10(char **endptr)
@@ -156,7 +174,7 @@ static long fast_strtol_10(char **endptr)
 }
 # endif
 
-static char *skip_fields(char *str, int count)
+char* FAST_FUNC skip_fields(char *str, int count)
 {
         do {
                 while (*str++ != ' ')
@@ -167,35 +185,25 @@ static char *skip_fields(char *str, int count)
 }
 #endif
 
-#if ENABLE_FEATURE_TOPMEM || ENABLE_PMAP
-static char* skip_whitespace_if_prefixed_with(char *buf, const char *prefix)
+#if ENABLE_FEATURE_TOPMEM
+static NOINLINE void procps_read_smaps(pid_t pid, procps_status_t *sp)
 {
-        char *tp = is_prefixed_with(buf, prefix);
-        if (tp) {
-                tp = skip_whitespace(tp);
-        }
-        return tp;
-}
+        // There is A LOT of /proc/PID/smaps data on a big system.
+        // Optimize this for speed, makes "top -m" faster.
+//TODO large speedup:
+//read /proc/PID/smaps_rollup (cumulative stats of all mappings, much faster)
+//and  /proc/PID/maps         to get mapped_ro and mapped_rw (IOW: VSZ,VSZRW)
 
-int FAST_FUNC procps_read_smaps(pid_t pid, struct smaprec *total,
-                void (*cb)(struct smaprec *, void *), void *data)
-{
         FILE *file;
-        struct smaprec currec;
         char filename[sizeof("/proc/%u/smaps") + sizeof(int)*3];
         char buf[PROCPS_BUFSIZE];
-#if !ENABLE_PMAP
-        void (*cb)(struct smaprec *, void *) = NULL;
-        void *data = NULL;
-#endif
 
         sprintf(filename, "/proc/%u/smaps", (int)pid);
 
         file = fopen_for_read(filename);
         if (!file)
-                return 1;
+                return;
 
-        memset(&currec, 0, sizeof(currec));
         while (fgets(buf, PROCPS_BUFSIZE, file)) {
                 // Each mapping datum has this form:
                 // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
@@ -203,80 +211,53 @@ int FAST_FUNC procps_read_smaps(pid_t pid, struct smaprec *total,
                 // Rss:                 nnn kB
                 // .....
 
-                char *tp, *p;
+                char *tp;
 
+                if (buf[0] == 'S' || buf[0] == 'P') {
 #define SCAN(S, X) \
-                if ((tp = skip_whitespace_if_prefixed_with(buf, S)) != NULL) { \
-                        total->X += currec.X = fast_strtoul_10(&tp); \
-                        continue;                                    \
-                }
-                if (cb) {
-                        SCAN("Pss:"  , smap_pss     );
-                        SCAN("Swap:" , smap_swap    );
-                }
-                SCAN("Private_Dirty:", private_dirty);
-                SCAN("Private_Clean:", private_clean);
-                SCAN("Shared_Dirty:" , shared_dirty );
-                SCAN("Shared_Clean:" , shared_clean );
+                        if (memcmp(buf, S, sizeof(S)-1) == 0) { \
+                                tp = skip_whitespace(buf + sizeof(S)-1); \
+                                sp->X += fast_strtoul_10(&tp); \
+                                continue; \
+                        }
+                        SCAN("Private_Dirty:", private_dirty)
+                        SCAN("Private_Clean:", private_clean)
+                        SCAN("Shared_Dirty:" , shared_dirty )
+                        SCAN("Shared_Clean:" , shared_clean )
 #undef SCAN
+                }
                 tp = strchr(buf, '-');
                 if (tp) {
                         // We reached next mapping - the line of this form:
                         // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
 
-                        if (cb) {
-                                /* If we have a previous record, there's nothing more
-                                 * for it, call the callback and clear currec
-                                 */
-                                if (currec.smap_size)
-                                        cb(&currec, data);
-                                free(currec.smap_name);
-                        }
-                        memset(&currec, 0, sizeof(currec));
+                        char *rwx;
+                        unsigned long sz;
 
                         *tp = ' ';
                         tp = buf;
-                        currec.smap_start = fast_strtoull_16(&tp);
-                        currec.smap_size = (fast_strtoull_16(&tp) - currec.smap_start) >> 10;
-
-                        strncpy(currec.smap_mode, tp, sizeof(currec.smap_mode)-1);
-
+                        sz = fast_strtoull_16(&tp); // start
+                        sz = (fast_strtoull_16(&tp) - sz) >> 10; // end - start
+                        // tp -> "rw-s" string
+                        rwx = tp;
                         // skipping "rw-s FILEOFS M:m INODE "
                         tp = skip_whitespace(skip_fields(tp, 4));
-                        // filter out /dev/something (something != zero)
-                        if (!is_prefixed_with(tp, "/dev/") || strcmp(tp, "/dev/zero\n") == 0) {
-                                if (currec.smap_mode[1] == 'w') {
-                                        currec.mapped_rw = currec.smap_size;
-                                        total->mapped_rw += currec.smap_size;
-                                } else if (currec.smap_mode[1] == '-') {
-                                        currec.mapped_ro = currec.smap_size;
-                                        total->mapped_ro += currec.smap_size;
-                                }
+                        // if not a device memory mapped...
+                        if (memcmp(tp, "/dev/", 5) != 0    // not "/dev/something"
+                         || strcmp(tp + 5, "zero\n") == 0  // or is "/dev/zero" (which isn't a device)
+                        ) {
+                                if (rwx[1] == 'w')
+                                        sp->mapped_rw += sz;
+                                else if (rwx[0] == 'r' || rwx[2] == 'x')
+                                        sp->mapped_ro += sz;
+                                // else: seen "---p" mappings (mmap guard gaps?),
+                                // do NOT account these as VSZ, they aren't really
                         }
-
                         if (strcmp(tp, "[stack]\n") == 0)
-                                total->stack += currec.smap_size;
-                        if (cb) {
-                                p = skip_non_whitespace(tp);
-                                if (p == tp) {
-                                        currec.smap_name = xstrdup("  [ anon ]");
-                                } else {
-                                        *p = '\0';
-                                        currec.smap_name = xstrdup(tp);
-                                }
-                        }
-                        total->smap_size += currec.smap_size;
+                                sp->stack += sz;
                 }
         }
         fclose(file);
-
-        if (cb) {
-                if (currec.smap_size)
-                        cb(&currec, data);
-                free(currec.smap_name);
-        }
-
-        return 0;
 }
 #endif
 
@@ -371,7 +352,8 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
                         char *cp, *comm1;
                         int tty;
 #if !ENABLE_FEATURE_FAST_TOP
-                        unsigned long vsz, rss;
+                        unsigned long long vsz;
+                        unsigned long rss;
 #endif
                         /* see proc(5) for some details on this */
                         strcpy(filename_tail, "stat");
@@ -397,7 +379,7 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
                                 "%ld "                 /* nice */
                                 "%*s %*s "             /* timeout, it_real_value */
                                 "%lu "                 /* start_time */
-                                "%lu "                 /* vsize */
+                                "%llu "                /* vsize - can be very large */
                                 "%lu "                 /* rss */
 # if ENABLE_FEATURE_TOP_SMP_PROCESS
                                 "%*s %*s %*s %*s %*s %*s " /*rss_rlim, start_code, end_code, start_stack, kstk_esp, kstk_eip */
@@ -450,7 +432,7 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
                         cp = skip_fields(cp, 2); /* timeout, it_real_value */
                         sp->start_time = fast_strtoul_10(&cp);
                         /* vsz is in bytes and we want kb */
-                        sp->vsz = fast_strtoul_10(&cp) >> 10;
+                        sp->vsz = fast_strtoull_10(&cp) >> 10;
                         /* vsz is in bytes but rss is in *PAGES*! Can you believe that? */
                         sp->rss = fast_strtoul_10(&cp) << sp->shift_pages_to_kb;
 # if ENABLE_FEATURE_TOP_SMP_PROCESS
@@ -484,7 +466,7 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
 
 #if ENABLE_FEATURE_TOPMEM
                 if (flags & PSSCAN_SMAPS)
-                        procps_read_smaps(pid, &sp->smaps, NULL, NULL);
+                        procps_read_smaps(pid, sp);
 #endif /* TOPMEM */
 #if ENABLE_FEATURE_PS_ADDITIONAL_COLUMNS
                 if (flags & PSSCAN_RUIDGID) {
@@ -567,36 +549,45 @@ procps_status_t* FAST_FUNC procps_scan(procps_status_t* sp, int flags)
         return sp;
 }
 
-void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
+int FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
 {
         int sz;
         char filename[sizeof("/proc/%u/cmdline") + sizeof(int)*3];
 
         sprintf(filename, "/proc/%u/cmdline", pid);
         sz = open_read_close(filename, buf, col - 1);
+        if (sz < 0)
+                return sz;
         if (sz > 0) {
-                const char *base;
+                const char *program_basename;
                 int comm_len;
 
                 buf[sz] = '\0';
                 while (--sz >= 0 && buf[sz] == '\0')
                         continue;
-                /* Prevent basename("process foo/bar") = "bar" */
-                strchrnul(buf, ' ')[0] = '\0';
-                base = bb_basename(buf); /* before we replace argv0's NUL with space */
+
+                /* Find "program" in "[-][/PATH/TO/]program" */
+                strchrnul(buf, ' ')[0] = '\0'; /* prevent basename("program foo/bar") = "bar" */
+                program_basename = bb_basename(buf[0] == '-' ? buf + 1 : buf);
+                /* ^^^ note: must do it *before* replacing argv0's NUL with space */
+
+                /* Prevent stuff like this:
+                 *  echo 'sleep 999; exit' >`printf '\ec'`; sh ?c
+                 * messing up top and ps output (or worse).
+                 * This also replaces NULs with spaces, converting
+                 * list of NUL-strings into one string.
+                 */
                 while (sz >= 0) {
                         if ((unsigned char)(buf[sz]) < ' ')
                                 buf[sz] = ' ';
                         sz--;
                 }
-                if (base[0] == '-') /* "-sh" (login shell)? */
-                        base++;
 
                 /* If comm differs from argv0, prepend "{comm} ".
                  * It allows to see thread names set by prctl(PR_SET_NAME).
                  */
                 if (!comm)
-                        return;
+                        return 0;
                 comm_len = strlen(comm);
                 /* Why compare up to comm_len, not COMM_LEN-1?
                  * Well, some processes rewrite argv, and use _spaces_ there
@@ -604,19 +595,20 @@ void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
                  * I prefer to still treat argv0 "process foo bar"
                  * as 'equal' to comm "process".
                  */
-                if (strncmp(base, comm, comm_len) != 0) {
+                if (strncmp(program_basename, comm, comm_len) != 0) {
                         comm_len += 3;
                         if (col > comm_len)
                                 memmove(buf + comm_len, buf, col - comm_len);
                         snprintf(buf, col, "{%s}", comm);
                         if (col <= comm_len)
-                                return;
+                                return 0;
                         buf[comm_len - 1] = ' ';
                         buf[col - 1] = '\0';
                 }
         } else {
                 snprintf(buf, col, "[%s]", comm ? comm : "?");
         }
+        return 0;
 }
 
 #endif  /* ENABLE_PLATFORM_MINGW32 */
diff --git a/libbb/pw_ascii64.c b/libbb/pw_ascii64.c
new file mode 100644
index 000000000..3993932ca
--- /dev/null
+++ b/libbb/pw_ascii64.c
@@ -0,0 +1,91 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 1999-2004 by Erik Andersen <andersen@codepoet.org>
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+
+/* Returns >=64 for invalid chars */
+int FAST_FUNC a2i64(char c)
+{
+        unsigned char ch = c;
+        if (ch >= 'a')
+                /* "a..z" to 38..63 */
+                /* anything after "z": positive int >= 64 */
+                return (ch - 'a' + 38);
+
+        if (ch > 'Z')
+                /* after "Z" but before "a": positive byte >= 64 */
+                return ch;
+
+        if (ch >= 'A')
+                /* "A..Z" to 12..37 */
+                return (ch - 'A' + 12);
+
+        if (ch > '9')
+                return 64;
+
+        /* "./0123456789" to 0,1,2..11 */
+        /* anything before "." becomes positive byte >= 64 */
+        return (unsigned char)(ch - '.');
+}
+
+/* 0..63 ->
+ * "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+ */
+int FAST_FUNC i2a64(int i)
+{
+        i &= 0x3f;
+
+        i += '.';
+        /* the above maps 0..11 to "./0123456789":
+         * ACSII codes of "./" are ('0'-2) and ('0'-1) */
+
+        if (i > '9')
+                i += ('A' - '9' - 1);
+        if (i > 'Z')
+                i += ('a' - 'Z' - 1);
+        return i;
+}
+
+char* FAST_FUNC
+num2str64_lsb_first(char *s, unsigned v, int n)
+{
+        while (--n >= 0) {
+                *s++ = i2a64(v);
+                v >>= 6;
+        }
+        return s;
+}
+
+static void
+num2str64_4chars_msb_first(char *s, unsigned v)
+{
+        *s++ = i2a64(v >> 18); /* bits 23..18 */
+        *s++ = i2a64(v >> 12); /* bits 17..12 */
+        *s++ = i2a64(v >> 6); /* bits 11..6 */
+        *s   = i2a64(v); /* bits 5..0 */
+}
+
+int FAST_FUNC crypt_make_rand64encoded(char *p, int cnt /*, int x */)
+{
+        /* was: x += ... */
+        unsigned x = getpid() + monotonic_us();
+        do {
+                /* x = (x*1664525 + 1013904223) % 2^32 generator is lame
+                 * (low-order bit is not "random", etc...),
+                 * but for our purposes it is good enough */
+                x = x*1664525 + 1013904223;
+                /* BTW, Park and Miller's "minimal standard generator" is
+                 * x = x*16807 % ((2^31)-1)
+                 * It has no problem with visibly alternating lowest bit
+                 * but is also weak in cryptographic sense + needs div,
+                 * which needs more code (and slower) on many CPUs */
+                *p++ = i2a64(x >> 16);
+                *p++ = i2a64(x >> 22);
+        } while (--cnt);
+        *p = '\0';
+        return x;
+}
diff --git a/libbb/pw_encrypt.c b/libbb/pw_encrypt.c
index 3463fd95b..93653de9f 100644
--- a/libbb/pw_encrypt.c
+++ b/libbb/pw_encrypt.c
@@ -13,48 +13,11 @@
 #endif
 #include "libbb.h"
 
-/* static const uint8_t ascii64[] ALIGN1 =
- * "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
- */
-
-static int i64c(int i)
-{
-        i &= 0x3f;
-        if (i == 0)
-                return '.';
-        if (i == 1)
-                return '/';
-        if (i < 12)
-                return ('0' - 2 + i);
-        if (i < 38)
-                return ('A' - 12 + i);
-        return ('a' - 38 + i);
-}
-
-int FAST_FUNC crypt_make_salt(char *p, int cnt /*, int x */)
-{
-        /* was: x += ... */
-        unsigned x = getpid() + monotonic_us();
-        do {
-                /* x = (x*1664525 + 1013904223) % 2^32 generator is lame
-                 * (low-order bit is not "random", etc...),
-                 * but for our purposes it is good enough */
-                x = x*1664525 + 1013904223;
-                /* BTW, Park and Miller's "minimal standard generator" is
-                 * x = x*16807 % ((2^31)-1)
-                 * It has no problem with visibly alternating lowest bit
-                 * but is also weak in cryptographic sense + needs div,
-                 * which needs more code (and slower) on many CPUs */
-                *p++ = i64c(x >> 16);
-                *p++ = i64c(x >> 22);
-        } while (--cnt);
-        *p = '\0';
-        return x;
-}
+#include "pw_ascii64.c"
 
 char* FAST_FUNC crypt_make_pw_salt(char salt[MAX_PW_SALT_LEN], const char *algo)
 {
-        int len = 2/2;
+        int len = 2 / 2;
         char *salt_ptr = salt;
 
         /* Standard chpasswd uses uppercase algos ("MD5", not "md5").
@@ -67,28 +30,61 @@ char* FAST_FUNC crypt_make_pw_salt(char salt[MAX_PW_SALT_LEN], const char *algo)
                 *salt_ptr++ = '$';
 #if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_SHA
                 if ((algo[0]|0x20) == 's') { /* sha */
-                        salt[1] = '5' + (strcasecmp(algo, "sha512") == 0);
-                        len = 16/2;
+                        salt[1] = '5' + (strncasecmp(algo, "sha512", 6) == 0);
+                        len = 16 / 2;
+                }
+#endif
+#if !ENABLE_USE_BB_CRYPT || ENABLE_USE_BB_CRYPT_YES
+                if ((algo[0]|0x20) == 'y') { /* yescrypt */
+                        int rnd;
+                        salt[1] = 'y';
+// The "j9T$" below is the default "yescrypt parameters" encoded by yescrypt_encode_params_r():
+//shadow-4.17.4/src/passwd.c
+//      salt = crypt_make_salt(NULL, NULL);
+//shadow-4.17.4/lib/salt.c
+//const char *crypt_make_salt(const char *meth, void *arg)
+//      if (streq(method, "YESCRYPT")) {
+//              MAGNUM(result, 'y');
+//              salt_len = YESCRYPT_SALT_SIZE; // 24
+//              rounds = YESCRYPT_get_salt_cost(arg);  // always Y_COST_DEFAULT == 5 for NULL arg
+//              YESCRYPT_salt_cost_to_buf(result, rounds); // always "j9T$"
+//      char *retval = crypt_gensalt(result, rounds, NULL, 0);
+//libxcrypt-4.4.38/lib/crypt-yescrypt.c
+//void gensalt_yescrypt_rn (unsigned long count,
+//                     const uint8_t *rbytes, size_t nrbytes,
+//                     uint8_t *output, size_t o_size)
+//  yescrypt_params_t params = {
+//    .flags = YESCRYPT_DEFAULTS,
+//    .p = 1,
+//  };
+//  if (count < 3) ... else
+//      params.r = 32;                  // N in 4KiB
+//      params.N = 1ULL << (count + 7); // 3 -> 1024, 4 -> 2048, ... 11 -> 262144
+//  yescrypt_encode_params_r(&params, rbytes, nrbytes, outbuf, o_size) // always "$y$j9T$<random>"
+                        len = 22 / 2;
+                        salt_ptr = stpcpy(salt_ptr, "j9T$");
+                        /* append 2*len random chars */
+                        rnd = crypt_make_rand64encoded(salt_ptr, len);
+                        /* fix up last char: it must be in 0..3 range (encoded as one of "./01").
+                         * IOW: salt_ptr[20..21] encode 16th random byte, must not be > 0xff.
+                         * Without this, we can generate salts which are rejected
+                         * by implementations with more strict salt length check.
+                         */
+                        salt_ptr[21] = i2a64(rnd & 3);
+                        /* For "mkpasswd -m yescrypt PASS j9T$<salt>" use case,
+                         * "j9T$" is considered part of salt,
+                         * need to return pointer to 'j'. Without -4,
+                         * we'd end up using "j9T$j9T$<salt>" as salt.
+                         */
+                        return salt_ptr - 4;
                 }
 #endif
         }
-        crypt_make_salt(salt_ptr, len);
+        crypt_make_rand64encoded(salt_ptr, len); /* appends 2*len random chars */
         return salt_ptr;
 }
 
 #if ENABLE_USE_BB_CRYPT
-
-static char*
-to64(char *s, unsigned v, int n)
-{
-        while (--n >= 0) {
-                /* *s++ = ascii64[v & 0x3f]; */
-                *s++ = i64c(v);
-                v >>= 6;
-        }
-        return s;
-}
-
 /*
  * DES and MD5 crypt implementations are taken from uclibc.
  * They were modified to not use static buffers.
@@ -99,6 +95,9 @@ to64(char *s, unsigned v, int n)
 #if ENABLE_USE_BB_CRYPT_SHA
 #include "pw_encrypt_sha.c"
 #endif
+#if ENABLE_USE_BB_CRYPT_YES
+#include "pw_encrypt_yes.c"
+#endif
 
 /* Other advanced crypt ids (TODO?): */
 /* $2$ or $2a$: Blowfish */
@@ -109,7 +108,7 @@ static struct des_ctx *des_ctx;
 /* my_crypt returns malloc'ed data */
 static char *my_crypt(const char *key, const char *salt)
 {
-        /* MD5 or SHA? */
+        /* "$x$...." string? */
         if (salt[0] == '$' && salt[1] && salt[2] == '$') {
                 if (salt[1] == '1')
                         return md5_crypt(xzalloc(MD5_OUT_BUFSIZE), (unsigned char*)key, (unsigned char*)salt);
@@ -117,6 +116,10 @@ static char *my_crypt(const char *key, const char *salt)
                 if (salt[1] == '5' || salt[1] == '6')
                         return sha_crypt((char*)key, (char*)salt);
 #endif
+#if ENABLE_USE_BB_CRYPT_YES
+                if (salt[1] == 'y')
+                        return yes_crypt(key, salt);
+#endif
         }
 
         if (!des_cctx)
diff --git a/libbb/pw_encrypt_des.c b/libbb/pw_encrypt_des.c
index fe8237cfe..ca8aa9bcc 100644
--- a/libbb/pw_encrypt_des.c
+++ b/libbb/pw_encrypt_des.c
@@ -186,39 +186,9 @@ static const uint8_t pbox[32] ALIGN1 = {
          2,  8, 24, 14, 32, 27,  3,  9, 19, 13, 30,  6, 22, 11,  4, 25
 };
 
-static const uint32_t bits32[32] ALIGN4 = {
-        0x80000000, 0x40000000, 0x20000000, 0x10000000,
-        0x08000000, 0x04000000, 0x02000000, 0x01000000,
-        0x00800000, 0x00400000, 0x00200000, 0x00100000,
-        0x00080000, 0x00040000, 0x00020000, 0x00010000,
-        0x00008000, 0x00004000, 0x00002000, 0x00001000,
-        0x00000800, 0x00000400, 0x00000200, 0x00000100,
-        0x00000080, 0x00000040, 0x00000020, 0x00000010,
-        0x00000008, 0x00000004, 0x00000002, 0x00000001
-};
-
 static const uint8_t bits8[8] ALIGN1 = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
 
 
-static int
-ascii_to_bin(char ch)
-{
-        if (ch > 'z')
-                return 0;
-        if (ch >= 'a')
-                return (ch - 'a' + 38);
-        if (ch > 'Z')
-                return 0;
-        if (ch >= 'A')
-                return (ch - 'A' + 12);
-        if (ch > '9')
-                return 0;
-        if (ch >= '.')
-                return (ch - '.');
-        return 0;
-}
-
-
 /* Static stuff that stays resident and doesn't change after
  * being initialized, and therefore doesn't need to be made
  * reentrant. */
@@ -354,11 +324,18 @@ des_init(struct des_ctx *ctx, const struct const_des_ctx *cctx)
         int i, j, b, k, inbit, obit;
         uint32_t p;
         const uint32_t *bits28, *bits24;
+        uint32_t bits32[32];
 
         if (!ctx)
                 ctx = xmalloc(sizeof(*ctx));
         const_ctx = cctx;
 
+        p = 0x80000000U;
+        for (i = 0; p; i++) {
+                bits32[i] = p;
+                p >>= 1;
+        }
+
 #if USE_REPETITIVE_SPEEDUP
         old_rawkey0 = old_rawkey1 = 0;
         old_salt = 0;
@@ -694,21 +671,6 @@ do_des(struct des_ctx *ctx, /*uint32_t l_in, uint32_t r_in,*/ uint32_t *l_out, u
 
 #define DES_OUT_BUFSIZE 21
 
-static void
-to64_msb_first(char *s, unsigned v)
-{
-#if 0
-        *s++ = ascii64[(v >> 18) & 0x3f]; /* bits 23..18 */
-        *s++ = ascii64[(v >> 12) & 0x3f]; /* bits 17..12 */
-        *s++ = ascii64[(v >> 6) & 0x3f]; /* bits 11..6 */
-        *s   = ascii64[v & 0x3f]; /* bits 5..0 */
-#endif
-        *s++ = i64c(v >> 18); /* bits 23..18 */
-        *s++ = i64c(v >> 12); /* bits 17..12 */
-        *s++ = i64c(v >> 6); /* bits 11..6 */
-        *s   = i64c(v); /* bits 5..0 */
-}
-
 static char *
 NOINLINE
 des_crypt(struct des_ctx *ctx, char output[DES_OUT_BUFSIZE],
@@ -740,44 +702,28 @@ des_crypt(struct des_ctx *ctx, char output[DES_OUT_BUFSIZE],
          */
         output[0] = salt_str[0];
         output[1] = salt_str[1];
-        salt = (ascii_to_bin(salt_str[1]) << 6)
-             |  ascii_to_bin(salt_str[0]);
+
+        salt = a2i64(salt_str[0]);
+        if (salt >= 64)
+                return NULL; /* bad salt char */
+        salt |= (a2i64(salt_str[1]) << 6);
+        if (salt >= (64 << 6))
+                return NULL; /* bad salt char */
         setup_salt(ctx, salt); /* set ctx->saltbits for do_des() */
 
         /* Do it. */
         do_des(ctx, /*0, 0,*/ &r0, &r1, 25 /* count */);
 
         /* Now encode the result. */
-#if 0
-{
-        uint32_t l = (r0 >> 8);
-        q = (uint8_t *)output + 2;
-        *q++ = ascii64[(l >> 18) & 0x3f]; /* bits 31..26 of r0 */
-        *q++ = ascii64[(l >> 12) & 0x3f]; /* bits 25..20 of r0 */
-        *q++ = ascii64[(l >> 6) & 0x3f]; /* bits 19..14 of r0 */
-        *q++ = ascii64[l & 0x3f]; /* bits 13..8 of r0 */
-        l = ((r0 << 16) | (r1 >> 16));
-        *q++ = ascii64[(l >> 18) & 0x3f]; /* bits 7..2 of r0 */
-        *q++ = ascii64[(l >> 12) & 0x3f]; /* bits 1..2 of r0 and 31..28 of r1 */
-        *q++ = ascii64[(l >> 6) & 0x3f]; /* bits 27..22 of r1 */
-        *q++ = ascii64[l & 0x3f]; /* bits 21..16 of r1 */
-        l = r1 << 2;
-        *q++ = ascii64[(l >> 12) & 0x3f]; /* bits 15..10 of r1 */
-        *q++ = ascii64[(l >> 6) & 0x3f]; /* bits 9..4 of r1 */
-        *q++ = ascii64[l & 0x3f]; /* bits 3..0 of r1 + 00 */
-        *q = 0;
-}
-#else
         /* Each call takes low-order 24 bits and stores 4 chars */
         /* bits 31..8 of r0 */
-        to64_msb_first(output + 2, (r0 >> 8));
+        num2str64_4chars_msb_first(output + 2, (r0 >> 8));
         /* bits 7..0 of r0 and 31..16 of r1 */
-        to64_msb_first(output + 6, (r0 << 16) | (r1 >> 16));
+        num2str64_4chars_msb_first(output + 6, (r0 << 16) | (r1 >> 16));
         /* bits 15..0 of r1 and two zero bits (plus extra zero byte) */
-        to64_msb_first(output + 10, (r1 << 8));
+        num2str64_4chars_msb_first(output + 10, (r1 << 8));
         /* extra zero byte is encoded as '.', fixing it */
         output[13] = '\0';
-#endif
 
         return output;
 }
diff --git a/libbb/pw_encrypt_md5.c b/libbb/pw_encrypt_md5.c
index 1e52ecaea..92d039f96 100644
--- a/libbb/pw_encrypt_md5.c
+++ b/libbb/pw_encrypt_md5.c
@@ -149,9 +149,9 @@ md5_crypt(char result[MD5_OUT_BUFSIZE], const unsigned char *pw, const unsigned
         final[16] = final[5];
         for (i = 0; i < 5; i++) {
                 unsigned l = (final[i] << 16) | (final[i+6] << 8) | final[i+12];
-                p = to64(p, l, 4);
+                p = num2str64_lsb_first(p, l, 4);
         }
-        p = to64(p, final[11], 2);
+        p = num2str64_lsb_first(p, final[11], 2);
         *p = '\0';
 
         /* Don't leave anything around in vm they could use. */
diff --git a/libbb/pw_encrypt_sha.c b/libbb/pw_encrypt_sha.c
index 5457d7ab6..695a5c07f 100644
--- a/libbb/pw_encrypt_sha.c
+++ b/libbb/pw_encrypt_sha.c
@@ -84,8 +84,7 @@ sha_crypt(/*const*/ char *key_data, /*const*/ char *salt_data)
            as a scratch space later. */
         salt_data = xstrndup(salt_data, salt_len);
         /* add "salt$" to result */
-        strcpy(resptr, salt_data);
-        resptr += salt_len;
+        resptr = stpcpy(resptr, salt_data);
         *resptr++ = '$';
         /* key data doesn't need much processing */
         key_len = strlen(key_data);
@@ -198,7 +197,7 @@ sha_crypt(/*const*/ char *key_data, /*const*/ char *salt_data)
 #define b64_from_24bit(B2, B1, B0, N) \
 do { \
         unsigned w = ((B2) << 16) | ((B1) << 8) | (B0); \
-        resptr = to64(resptr, w, N); \
+        resptr = num2str64_lsb_first(resptr, w, N); \
 } while (0)
         if (_32or64 == 32) { /* sha256 */
                 unsigned i = 0;
diff --git a/libbb/pw_encrypt_yes.c b/libbb/pw_encrypt_yes.c
new file mode 100644
index 000000000..50bd06418
--- /dev/null
+++ b/libbb/pw_encrypt_yes.c
@@ -0,0 +1,24 @@
+/*
+ * Utility routines.
+ *
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+#include "yescrypt/alg-yescrypt.h"
+
+static char *
+yes_crypt(const char *passwd, const char *salt_data)
+{
+        /* prefix, '$', hash, NUL */
+        char buf[YESCRYPT_PREFIX_LEN + 1 + YESCRYPT_HASH_LEN + 1];
+        char *retval;
+
+        retval = yescrypt_r(
+                        (const uint8_t *)passwd, strlen(passwd),
+                        (const uint8_t *)salt_data,
+                        buf, sizeof(buf));
+        /* The returned value is either buf[], or NULL on error */
+
+        return xstrdup(retval);
+}
diff --git a/libbb/read_key.c b/libbb/read_key.c
index 54886cc9c..2414105ee 100644
--- a/libbb/read_key.c
+++ b/libbb/read_key.c
@@ -11,7 +11,7 @@
 
 int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
 {
-        struct pollfd pfd;
+        struct pollfd pfd[1];
         const char *seq;
         int n;
 
@@ -117,8 +117,8 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
                 return windows_read_key(fd, buffer, timeout);
 #endif
 
-        pfd.fd = fd;
-        pfd.events = POLLIN;
+        pfd->fd = fd;
+        pfd->events = POLLIN;
 
         buffer++; /* saved chars counter is in buffer[-1] now */
 
@@ -126,12 +126,16 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
         errno = 0;
         n = (unsigned char)buffer[-1];
         if (n == 0) {
-                /* If no data, wait for input.
-                 * If requested, wait TIMEOUT ms. TIMEOUT = -1 is useful
-                 * if fd can be in non-blocking mode.
-                 */
+                /* No data. Wait for input. */
+
+                /* timeout == -2 means "do not poll". Else: */
                 if (timeout >= -1) {
-                        n = poll(&pfd, 1, timeout);
+                        /* We must poll even if timeout == -1:
+                         * we want to be interrupted if signal arrives,
+                         * regardless of SA_RESTART-ness of that signal!
+                         */
+                        /* test bb_got_signal, then poll(), atomically wrt signals */
+                        n = check_got_signal_and_poll(pfd, timeout);
                         if (n < 0 && errno == EINTR)
                                 return n;
                         if (n == 0) {
@@ -140,6 +144,7 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
                                 return -1;
                         }
                 }
+
                 /* It is tempting to read more than one byte here,
                  * but it breaks pasting. Example: at shell prompt,
                  * user presses "c","a","t" and then pastes "\nline\n".
@@ -178,7 +183,7 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
                                  * so if we block for long it's not really an escape sequence.
                                  * Timeout is needed to reconnect escape sequences
                                  * split up by transmission over a serial console. */
-                                if (safe_poll(&pfd, 1, 50) == 0) {
+                                if (safe_poll(pfd, 1, 50) == 0) {
                                         /* No more data!
                                          * Array is sorted from shortest to longest,
                                          * we can't match anything later in array -
@@ -227,7 +232,7 @@ int64_t FAST_FUNC read_key(int fd, char *buffer, int timeout)
          * n = bytes read. Try to read more until we time out.
          */
         while (n < KEYCODE_BUFFER_SIZE-1) { /* 1 for count byte at buffer[-1] */
-                if (safe_poll(&pfd, 1, 50) == 0) {
+                if (safe_poll(pfd, 1, 50) == 0) {
                         /* No more data! */
                         break;
                 }
diff --git a/libbb/replace.c b/libbb/replace.c
index 6183d3e6f..bc26b04cc 100644
--- a/libbb/replace.c
+++ b/libbb/replace.c
@@ -46,3 +46,17 @@ char* FAST_FUNC xmalloc_substitute_string(const char *src, int count, const char
         //dbg_msg("subst9:'%s'", buf);
         return buf;
 }
+
+#if 0 /* inlined in libbb.h */
+/* Returns strlen as a bonus */
+size_t FAST_FUNC replace_char(char *str, char from, char to)
+{
+        char *p = str;
+        while (*p) {
+                if (*p == from)
+                        *p = to;
+                p++;
+        }
+        return p - str;
+}
+#endif
diff --git a/libbb/yescrypt/Kbuild.src b/libbb/yescrypt/Kbuild.src
new file mode 100644
index 000000000..a61211a29
--- /dev/null
+++ b/libbb/yescrypt/Kbuild.src
@@ -0,0 +1,9 @@
+# Makefile for busybox
+#
+# Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+#
+# Licensed under GPLv2, see file LICENSE in this source tree.
+
+lib-y:=
+
+INSERT
diff --git a/libbb/yescrypt/PARAMETERS b/libbb/yescrypt/PARAMETERS
new file mode 100644
index 000000000..d9f5d24e6
--- /dev/null
+++ b/libbb/yescrypt/PARAMETERS
@@ -0,0 +1,196 @@
+        Optimal yescrypt configuration.
+
+yescrypt is very flexible, but configuring it optimally is complicated.
+Here are some guidelines to simplify near-optimal configuration.  We
+start by listing the parameters and their typical values, and then give
+currently recommended parameter sets by use case.
+
+
+        Parameters and their typical values.
+
+Set flags (yescrypt flavor) to YESCRYPT_DEFAULTS to use the currently
+recommended flavor.  (Other flags values exist for compatibility and for
+specialized cases where you think you know what you're doing.)
+
+Set N (block count) based on target memory usage and running time, as
+well as on the value of r (block size in 128 byte units).  N must be a
+power of two.
+
+Set r (block size) to 8 (so that N is in KiB, which is convenient) or to
+another small value (if more optimal or for fine-tuning of the total
+size and/or running time).  Reasonable values for r are from 8 to 96.
+
+Set p (parallelism) to 1 meaning no thread-level parallelism within one
+computation of yescrypt.  (Use of thread-level parallelism within
+yescrypt makes sense for ROM initialization and for key derivation at
+high memory usage, but usually not for password hashing where
+parallelism is available through concurrent authentication attempts.
+Don't use p > 1 unnecessarily.)
+
+Set t (time) to 0 to use the optimal running time for a given memory
+usage.  This will allow you to maximize the memory usage (the value of
+N*r) while staying within your running time constraints.  (Non-zero t
+makes sense in specialized cases where you can't afford higher memory
+usage but can afford more time.)
+
+Set g (upgrades) to 0 because there have been no hash upgrades yet.
+
+Set NROM (block count of ROM) to 0 unless you use a ROM (see below).
+NROM must be a power of two.
+
+
+        Password hashing for user authentication, no ROM.
+
+Small and fast (memory usage 2 MiB, performance like bcrypt cost 2^5 -
+latency 2-3 ms and throughput 10,000+ per second on a 16-core server):
+
+flags = YESCRYPT_DEFAULTS, N = 2048, r = 8, p = 1, t = 0, g = 0, NROM = 0
+
+Large and slow (memory usage 16 MiB, performance like bcrypt cost 2^8 -
+latency 10-30 ms and throughput 1000+ per second on a 16-core server):
+
+flags = YESCRYPT_DEFAULTS, N = 4096, r = 32, p = 1, t = 0, g = 0, NROM = 0
+
+Of course, even heavier and slower settings are possible, if affordable.
+Simply double the value of N as many times as needed.  Since N must be a
+power of two, you may use r (in the range of 8 to 32) or/and t (in the
+range of 0 to 2) for fine-tuning the running time, but first bring N to
+the maximum you can afford.  If this feels too complicated, just use one
+of the two parameter sets given above (preferably the second) as-is.
+
+
+        Password hashing for user authentication, with ROM.
+
+It's similar to the above, except that you need to adjust r, set NROM,
+and initialize the ROM.
+
+First decide on a ROM size, such as making it a large portion of your
+dedicated authentication servers' RAM sizes.  Since NROM (block count)
+must be a power of two, you might need to choose r (block size) based on
+how your desired ROM size corresponds to a power of two.  Also tuning
+for performance on current hardware, you'll likely end up with r in the
+range from slightly below 16 to 32.  For example, to use 15/16 of a
+server's 256 GiB RAM as ROM (thus, making it 240 GiB), you could use
+r=15 or r=30.  To use 23/24 of a server's 384 GiB RAM as ROM (thus,
+making it 368 GiB), you'd use r=23.  Then set NROM to your desired ROM
+size in KiB divided by 128*r.  Note that these examples might (or might
+not) be too extreme, leaving little memory for the rest of the system.
+You could as well opt for 7/8 with r=14 or 11/12 with r=11 or r=22.
+
+Note that higher r may make placing of ROM in e.g. NVMe flash memory
+instead of in RAM more reasonable (or less unreasonable) than it would
+have been with a lower r.  If this is a concern as it relates to
+possible attacks and you do not intend to ever do it defensively, you
+might want to keep r lower (e.g., prefer r=15 over r=30 in the example
+above, even if 30 performs slightly faster).
+
+Your adjustments to r, if you deviate from powers of two, will also
+result in weirder memory usage per hash.  Like 1.75 MiB at r=14 instead
+of 2 MiB at r=8 that you would have used without a ROM.  That's OK.
+
+For ROM initialization, which you do with yescrypt_init_shared(), use
+the same r and NROM that you'd later use for password hashing, choose p
+based on your servers' physical and/or logical CPU count (maybe
+considering eventual upgrades as you won't be able to change this later,
+but without going unnecessarily high - e.g., p=28, p=56, or p=112 make
+sense on servers that currently have 28 physical / 56 logical CPUs), and
+set the rest of the parameters to:
+
+flags = YESCRYPT_DEFAULTS, N = 0, t = 0, g = 0
+
+N is set to 0 because it isn't relevant during ROM initialization (you
+can use different values of N for hashing passwords with the same ROM).
+
+To keep the ROM in e.g. SysV shared memory and reuse it across your
+authentication service restarts, you'd need to allocate the memory and
+set the flags to "YESCRYPT_DEFAULTS | YESCRYPT_SHARED_PREALLOCATED".
+
+For actual password hashing, you'd use your chosen values for N, r,
+NROM, and set the rest of the parameters to:
+
+flags = YESCRYPT_DEFAULTS, p = 1, t = 0, g = 0
+
+Note that although you'd use a large p for ROM initialization, you
+should use p=1 for actual password hashing like you would without a ROM.
+
+Do not forget to pass the ROM into the actual password hashing (and keep
+r and NROM set accordingly).
+
+Since N must be a power of two and r is dependent on ROM size, you may
+use t (in the range of 0 to 2) for fine-tuning the running time, but
+first bring N to the maximum you can afford.
+
+If this feels too complicated, or even if it doesn't, please consider
+engaging Openwall for your yescrypt deployment.  We'd be happy to help.
+
+
+        Password-based key derivation.
+
+(Or rather passphrase-based.)
+
+Use settings similar to those for password hashing without a ROM, but
+adjusted for higher memory usage and running time, and optionally with
+thread-level parallelism.
+
+Small and fast (memory usage 128 MiB, running time under 100 ms on a
+fast desktop):
+
+flags = YESCRYPT_DEFAULTS, N = 32768, r = 32, p = 1, t = 0, g = 0, NROM = 0
+
+Large and fast (memory usage 1 GiB, running time under 200 ms on a fast
+quad-core desktop not including memory allocation overhead, under 250 ms
+with the overhead included), but requires build with OpenMP support (or
+otherwise will run as slow as yet be weaker than its p=1 alternative):
+
+flags = YESCRYPT_DEFAULTS, N = 262144, r = 32, p = 4, t = 0, g = 0, NROM = 0
+
+Large and slower (memory usage 1 GiB, running time under 300 ms on a
+fast quad-core desktop not including memory allocation overhead, under
+350 ms with the overhead included), also requires build with OpenMP
+support (or otherwise will run slower than the p=1 alternative below):
+
+flags = YESCRYPT_DEFAULTS, N = 262144, r = 32, p = 4, t = 2, g = 0, NROM = 0
+
+Large and slow (memory usage 1 GiB, running time under 600 ms on a fast
+desktop not including memory allocation overhead, under 650 ms with the
+overhead included):
+
+flags = YESCRYPT_DEFAULTS, N = 262144, r = 32, p = 1, t = 0, g = 0, NROM = 0
+
+Just like with password hashing, even heavier and slower settings are
+possible, if affordable, and you achieve them by adjusting N, r, t in
+the same way and in the same preferred ranges (please see the section on
+password hashing without a ROM, above).  Unlike with password hashing,
+it makes some sense to go above t=2 if you expect that your users might
+not be able to afford more memory but can afford more time.  However,
+increasing the memory usage provides better protection, and we don't
+recommend forcing your users to wait for more than 1 second as they
+could as well type more characters in that time.  If this feels too
+complicated, just use one of the above parameter sets as-is.
+
+
+        Amortization of memory allocation overhead.
+
+It takes a significant fraction of yescrypt's total running time to
+allocate memory from the operating system, especially considering that
+the kernel zeroizes the memory before handing it over to your program.
+
+Unless you naturally need to compute yescrypt just once per process, you
+may achieve greater efficiency by fully using advanced yescrypt APIs
+that let you preserve and reuse the memory allocation across yescrypt
+invocations.  This is done by reusing the structure pointed to by the
+"yescrypt_local_t *local" argument of yescrypt_r() or yescrypt_kdf()
+without calling yescrypt_free_local() inbetween the repeated invocations
+of yescrypt.
+
+
+        YESCRYPT_DEFAULTS macro.
+
+Please note that the value of the YESCRYPT_DEFAULTS macro might change
+later, so if you use the macro like it's recommended here then for
+results reproducible across versions you might need to store its value
+somewhere along with the hashes or the encrypted data.
+
+If you use yescrypt's standard hash string encoding, then yescrypt
+already encodes and decodes this value for you, so you don't need to
+worry about this.
diff --git a/libbb/yescrypt/README b/libbb/yescrypt/README
new file mode 100644
index 000000000..c1011c56a
--- /dev/null
+++ b/libbb/yescrypt/README
@@ -0,0 +1,4 @@
+The yescrypt code in this directory is adapted from libxcrypt-4.4.38
+with minimal edits, hopefully making it easier to track
+backports by resetting the tree to the commit which created this file,
+then comparing changes in upstream libxcrypt to the tree.
diff --git a/libbb/yescrypt/alg-sha256.c b/libbb/yescrypt/alg-sha256.c
new file mode 100644
index 000000000..dc748c968
--- /dev/null
+++ b/libbb/yescrypt/alg-sha256.c
@@ -0,0 +1,91 @@
+/*-
+ * Copyright 2005-2016 Colin Percival
+ * Copyright 2016-2018,2021 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/**
+ * PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
+ * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
+ * write the output to buf.  The value dkLen must be at most 32 * (2^32 - 1).
+ */
+static void
+PBKDF2_SHA256(const uint8_t *passwd, size_t passwdlen,
+                const uint8_t *salt, size_t saltlen,
+                uint64_t c, uint8_t *buf, size_t dkLen)
+{
+        hmac_ctx_t Phctx, PShctx;
+        uint32_t i;
+
+        /* Compute HMAC state after processing P. */
+        hmac_begin(&Phctx, passwd, passwdlen, sha256_begin);
+
+        /* Compute HMAC state after processing P and S. */
+        PShctx = Phctx;
+        hmac_hash(&PShctx, salt, saltlen);
+
+        /* Iterate through the blocks. */
+        for (i = 0; dkLen != 0; ) {
+                long U[32 / sizeof(long)];
+                long T[32 / sizeof(long)];
+// Do not make these ^^ uint64_t[]. Keep them long[].
+// Even though the XORing loop below is optimized out,
+// gcc is not smart enough to realize that 64-bit alignment of the stack
+// is no longer useful, and generates ~50 more bytes of code on i386...
+                uint32_t ivec;
+                size_t clen;
+                int k;
+
+                /* Generate INT(i). */
+                i++;
+                ivec = SWAP_BE32(i);
+
+                /* Compute U_1 = PRF(P, S || INT(i)). */
+                hmac_peek_hash(&PShctx, (void*)T, &ivec, 4, NULL);
+//TODO: the above is a vararg function, might incur some ABI pain
+//does libbb need a non-vararg version with just one (buf,len)?
+
+                if (c > 1) {
+//in yescrypt, c is always 1, so this if() branch is optimized out
+                        uint64_t j;
+                        /* T_i = U_1 ... */
+                        memcpy(U, T, 32);
+                        for (j = 2; j <= c; j++) {
+                                /* Compute U_j. */
+                                hmac_peek_hash(&Phctx, (void*)U, U, 32, NULL);
+                                /* ... xor U_j ... */
+                                for (k = 0; k < 32 / sizeof(long); k++)
+                                        T[k] ^= U[k];
+                                //TODO: xorbuf32_aligned_long(T, U);
+                        }
+                }
+
+                /* Copy as many bytes as necessary into buf. */
+                clen = dkLen;
+                if (clen > 32)
+                        clen = 32;
+                buf = mempcpy(buf, T, clen);
+                dkLen -= clen;
+        }
+}
diff --git a/libbb/yescrypt/alg-yescrypt-common.c b/libbb/yescrypt/alg-yescrypt-common.c
new file mode 100644
index 000000000..c51823787
--- /dev/null
+++ b/libbb/yescrypt/alg-yescrypt-common.c
@@ -0,0 +1,408 @@
+/*-
+ * Copyright 2013-2018 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#if RESTRICTED_PARAMS
+
+#define decode64_uint32(dst, src, min) \
+({ \
+        uint32_t d32 = a2i64(*(src)); \
+        if (d32 > 47) \
+                goto fail; \
+        *(dst) = d32 + (min); \
+        ++src; \
+})
+#define test_decode64_uint32() ((void)0)
+#define FULL_PARAMS(...)
+
+#else
+
+#define FULL_PARAMS(...) __VA_ARGS__
+
+/* Not inlining:
+ * de/encode64 functions are only used to read
+ * yescrypt_params_t field, and convert salt to binary -
+ * both of these are negligible compared to main hashing operation
+ */
+static NOINLINE const uint8_t *decode64_uint32(
+                uint32_t *dst,
+                const uint8_t *src, uint32_t val)
+{
+        uint32_t start = 0, end = 47, bits = 0;
+        uint32_t c;
+
+        if (!src) /* previous decode failed already? */
+                goto fail;
+
+        c = a2i64(*src++);
+        if (c > 63)
+                goto fail;
+
+// The encoding of number N:
+// start = 0 end = 47
+// If N < 48, it is encoded verbatim, else
+// N -= 48
+// start = end+1 = 48
+// end += (64-end)/2 = 55
+// If N < (end+1-start)<<6 = 8<<6, it is encoded as 48+(N>>6)|low6bits (that is, 48...55|<6bit>), else
+// N -= 8<<6
+// start = end+1 = 56
+// end += (64-end)/2 = 59
+// If N < (end+1-start)<<2*6 = 4<<12, it is encoded as 56+(N>>2*6)|low12bits (that is, 56...59|<6bit>|<6bit>), else
+// ...same for 60..61|<6bit>|<6bit>|<6bit>
+// .......same for 62|<6bit>|<6bit>|<6bit>|<6bit>
+// .......same for 63|<6bit>|<6bit>|<6bit>|<6bit>|<6bit>
+        dbg_dec64("c:%d val:0x%08x", (int)c, (unsigned)val);
+        while (c > end) {
+                dbg_dec64("c:%d > end:%d", (int)c, (int)end);
+                val += (end + 1 - start) << bits;
+                dbg_dec64("val+=0x%08x", (int)((end + 1 - start) << bits));
+                dbg_dec64(" val:0x%08x", (unsigned)val);
+                start = end + 1;
+                end += (64 - end) / 2;
+                bits += 6;
+                dbg_dec64("start=%d", (int)start);
+                dbg_dec64("end=%d", (int)end);
+                dbg_dec64("bits=%d", (int)bits);
+        }
+
+        val += (c - start) << bits;
+        dbg_dec64("final val+=0x%08x", (int)((c - start) << bits));
+        dbg_dec64("       val:0x%08x", (unsigned)val);
+
+        while (bits != 0) {
+                c = a2i64(*src++);
+                if (c > 63)
+                        goto fail;
+                bits -= 6;
+                val += c << bits;
+                dbg_dec64("low bits val+=0x%08x", (int)(c << bits));
+                dbg_dec64("          val:0x%08x", (unsigned)val);
+        }
+ ret:
+        *dst = val;
+        return src;
+ fail:
+        val = 0;
+        src = NULL;
+        goto ret;
+}
+
+#if TEST_DECODE64
+static void test_decode64_uint32(void)
+{
+        const uint8_t *src, *end;
+        uint32_t u32;
+        int a = 48;
+        int b = 8<<6;  // 0x0200
+        int c = 4<<12; // 0x04000
+        int d = 2<<18; // 0x080000
+        int e = 1<<24; // 0x1000000
+
+        src = (void*)"wzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x0003ffff+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 4) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+        src = (void*)"xzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x0007ffff+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 4) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+        // Note how the last representable "x---" encoding, 0x7ffff, is exactly d-1!
+        // And if we now increment it, we get:
+        src = (void*)"y....";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x00000000+d+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 5) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+        src = (void*)"yzzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x00ffffff+d+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 5) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+
+        src = (void*)"zzzzzz";
+        end = decode64_uint32(&u32, src, 0);
+        if (u32 != 0x3fffffff+e+d+c+b+a) bb_error_msg_and_die("Incorrect decode '%s':0x%08x", src, (unsigned)u32);
+        if (end != src + 6) bb_error_msg_and_die("Incorrect decode '%s': %p end:%p", src, src, end);
+
+        bb_error_msg("test_decode64_uint32() OK");
+}
+#else
+# define test_decode64_uint32() ((void)0)
+#endif
+
+#endif /* !RESTRICTED_PARAMS */
+
+#if 1
+static const uint8_t *decode64(
+                uint8_t *dst, size_t *dstlen,
+                const uint8_t *src)
+{
+        unsigned dstpos = 0;
+
+        dbg_dec64("src:'%s'", src);
+        for (;;) {
+                uint32_t c, value = 0;
+                int bits = 0;
+                while (*src != '\0' && *src != '$') {
+                        c = a2i64(*src);
+                        if (c > 63) { /* bad ascii64 char, stop decoding at it */
+                                break;
+                        }
+                        src++;
+                        value |= c << bits;
+                        bits += 6;
+                        if (bits == 24) /* got 4 chars */
+                                goto store;
+                }
+                /* we read entire src, or met a non-ascii64 char (such as "$") */
+                if (bits == 0)
+                        break;
+                /* else: we got last, partial bit block - store it */
+ store:
+                dbg_dec64(" storing bits:%d dstpos:%u v:%08x", bits, dstpos, (int)SWAP_BE32(value)); //BE to see lsb first
+                for (;;) {
+                        if ((*src == '\0' || *src == '$')
+                         && value == 0 && bits < 8
+                        ) {
+                                /* Example: mkpasswd PWD '$y$j9T$123':
+                                 * the "123" is bits:18 value:03,51,00
+                                 * is considered to be 2 bytes, not 3!
+                                 *
+                                 * '$y$j9T$zzz' in upstream fails outright (3rd byte isn't zero).
+                                 * IOW: for upstream, validity of salt depends on VALUE,
+                                 * not just size of salt. Which is a bug.
+                                 * The '$y$j9T$zzz.' salt is the same
+                                 * (it adds 6 zero msbits) but upstream works with it,
+                                 * thus '$y$j9T$zzz' should work too and give the same result.
+                                 */
+                                goto end;
+                        }
+                        if (dstpos >= *dstlen) {
+                                dbg_dec64(" ERR: bits:%d dstpos:%u dst[] is too small", bits, dstpos);
+                                goto fail;
+                        }
+                        *dst++ = value;
+                        dstpos++;
+                        value >>= 8;
+                        bits -= 8;
+                        if (bits <= 0) /* can get negative, if we e.g. had 6 bits */
+                                break;
+                }
+                if (*src == '\0' || *src == '$')
+                        break;
+        }
+ end:
+        *dstlen = dstpos;
+        dbg_dec64("dec64: OK, dst[%d]", (int)dstpos);
+        return src;
+ fail:
+        /* *dstlen = 0; - not needed, caller detects error by seeing NULL */
+        return NULL;
+}
+#else
+/* Buggy (and larger) original code */
+static const uint8_t *decode64(
+                uint8_t *dst, size_t *dstlen,
+                const uint8_t *src, size_t srclen)
+{
+        size_t dstpos = 0;
+
+        while (dstpos <= *dstlen && srclen) {
+                uint32_t value = 0, bits = 0;
+                while (srclen--) {
+                        uint32_t c = a2i64(*src);
+                        if (c > 63) {
+                                srclen = 0;
+                                break;
+                        }
+                        src++;
+                        value |= c << bits;
+                        bits += 6;
+                        if (bits >= 24)
+                                break;
+                }
+                if (!bits)
+                        break;
+                if (bits < 12) /* must have at least one full byte */
+                        goto fail;
+                dbg_dec64(" storing bits:%d v:%08x", (int)bits, (int)SWAP_BE32(value)); //BE to see lsb first
+                while (dstpos++ < *dstlen) {
+                        *dst++ = value;
+                        value >>= 8;
+                        bits -= 8;
+                        if (bits < 8) { /* 2 or 4 */
+                                if (value) /* must be 0 */
+                                        goto fail;
+                                bits = 0;
+                                break;
+                        }
+                }
+                if (bits)
+                        goto fail;
+        }
+
+        if (!srclen && dstpos <= *dstlen) {
+                *dstlen = dstpos;
+                dbg_dec64("dec64: OK, dst[%d]", (int)dstpos);
+                return src;
+        }
+ fail:
+        /* *dstlen = 0; - not needed, caller detects error by seeing NULL */
+        return NULL;
+}
+#endif
+
+static char *encode64(
+                char *dst, size_t dstlen,
+                const uint8_t *src, size_t srclen)
+{
+        while (srclen) {
+                uint32_t value = 0, b = 0;
+                do {
+                        value |= (uint32_t)(*src++ << b);
+                        b += 8;
+                        srclen--;
+                } while (srclen && b < 24);
+
+                b >>= 3; /* number of bits to number of bytes */
+                b++; /* 1, 2 or 3 bytes will become 2, 3 or 4 ascii64 chars */
+                dstlen -= b;
+                if ((ssize_t)dstlen <= 0)
+                        return NULL;
+                dst = num2str64_lsb_first(dst, value, b);
+        }
+        *dst = '\0';
+        return dst;
+}
+
+char *yescrypt_r(
+                const uint8_t *passwd, size_t passwdlen,
+                const uint8_t *setting,
+                char *buf, size_t buflen)
+{
+        struct {
+                yescrypt_ctx_t yctx[1];
+                unsigned char hashbin32[32];
+        } u;
+#define yctx      u.yctx
+#define hashbin32 u.hashbin32
+        char *dst;
+        const uint8_t *src, *saltend;
+        size_t need, prefixlen;
+        uint32_t u32;
+
+        test_decode64_uint32();
+
+        memset(yctx, 0, sizeof(yctx));
+        FULL_PARAMS(yctx->param.p = 1;)
+
+        /* we assume setting starts with "$y$" (caller must ensure this) */
+        src = setting + 3;
+
+        src = decode64_uint32(&yctx->param.flags, src, 0);
+        /* "j9T" returns: 0x2f */
+        //if (!src)
+        //      goto fail;
+
+        if (yctx->param.flags < YESCRYPT_RW) {
+                dbg("yctx->param.flags=0x%x", (unsigned)yctx->param.flags);
+                goto fail; // bbox: we don't support scrypt - only yescrypt
+        } else if (yctx->param.flags <= YESCRYPT_RW + (YESCRYPT_RW_FLAVOR_MASK >> 2)) {
+                /* "j9T" sets flags to 0xb6 */
+                yctx->param.flags = YESCRYPT_RW + ((yctx->param.flags - YESCRYPT_RW) << 2);
+                dbg("yctx->param.flags=0x%x", (unsigned)yctx->param.flags);
+                dbg(" YESCRYPT_RW:%u", !!(yctx->param.flags & YESCRYPT_RW));
+                dbg((yctx->param.flags & YESCRYPT_RW_FLAVOR_MASK) ==
+                       (YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K)
+                    ? " YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K"
+                    : " flags are not standard"
+                );
+        } else {
+                goto fail;
+        }
+
+        src = decode64_uint32(&u32, src, 1);
+        if (/*!src ||*/ u32 > 63)
+                goto fail;
+        yctx->param.N = (uint64_t)1 << u32;
+        /* "j9T" sets to 4096 (1<<12) */
+        dbg("yctx->param.N=%llu (1<<%u)", (unsigned long long)yctx->param.N, (unsigned)u32);
+
+        src = decode64_uint32(&yctx->param.r, src, 1);
+        /* "j9T" sets to 32 */
+        dbg("yctx->param.r=%u", yctx->param.r);
+
+        if (!src)
+                goto fail;
+        if (*src != '$') {
+#if RESTRICTED_PARAMS
+                goto fail;
+#else
+                src = decode64_uint32(&u32, src, 1);
+                dbg("yescrypt has extended params:0x%x", (unsigned)u32);
+                if (u32 & 1)
+                        src = decode64_uint32(&yctx->param.p, src, 2);
+                if (u32 & 2)
+                        src = decode64_uint32(&yctx->param.t, src, 1);
+                if (u32 & 4)
+                        src = decode64_uint32(&yctx->param.g, src, 1);
+                if (u32 & 8) {
+                        src = decode64_uint32(&u32, src, 1);
+                        if (/*!src ||*/ u32 > 63)
+                                goto fail;
+                        yctx->param.NROM = (uint64_t)1 << u32;
+                }
+                if (!src)
+                        goto fail;
+                if (*src != '$')
+                        goto fail;
+#endif
+        }
+
+        yctx->saltlen = sizeof(yctx->salt);
+        src++; /* now points to salt */
+        saltend = decode64(yctx->salt, &yctx->saltlen, src);
+        if (!saltend || (*saltend != '\0' && *saltend != '$'))
+                goto fail; /* salt[] is too small, or bad char during decode */
+        dbg_dec64("salt is %d ascii64 chars -> %d bytes (in binary)", (int)(saltend - src), (int)yctx->saltlen);
+
+        prefixlen = saltend - setting;
+        need = prefixlen + 1 + YESCRYPT_HASH_LEN + 1;
+        if (need > buflen /*overflow is quite unlikely: || need < prefixlen*/)
+                goto fail;
+
+        if (yescrypt_kdf32(yctx, passwd, passwdlen, hashbin32)) {
+                dbg("error in yescrypt_kdf32");
+                goto fail;
+        }
+
+        dst = mempcpy(buf, setting, prefixlen);
+        *dst++ = '$';
+        dst = encode64(dst, buflen - (dst - buf), hashbin32, sizeof(hashbin32));
+        if (!dst)
+                goto fail;
+ ret:
+        free_region(yctx->local);
+        explicit_bzero(&u, sizeof(u));
+        return buf;
+ fail:
+        buf = NULL;
+        goto ret;
+#undef yctx
+#undef hashbin32
+}
diff --git a/libbb/yescrypt/alg-yescrypt-kdf.c b/libbb/yescrypt/alg-yescrypt-kdf.c
new file mode 100644
index 000000000..a9a1bd591
--- /dev/null
+++ b/libbb/yescrypt/alg-yescrypt-kdf.c
@@ -0,0 +1,1212 @@
+/*-
+ * Copyright 2009 Colin Percival
+ * Copyright 2012-2018 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * This file was originally written by Colin Percival as part of the Tarsnap
+ * online backup system.
+ */
+
+#if __STDC_VERSION__ >= 199901L
+/* Have restrict */
+#elif defined(__GNUC__)
+#define restrict __restrict
+#else
+#define restrict
+#endif
+
+#ifdef __GNUC__
+#define unlikely(exp) __builtin_expect(exp, 0)
+#else
+#define unlikely(exp) (exp)
+#endif
+
+typedef union {
+        uint32_t w[16];
+        uint64_t d[8];
+} salsa20_blk_t;
+
+static void salsa20_simd_shuffle(
+                const salsa20_blk_t *Bin,
+                salsa20_blk_t *Bout)
+{
+#define COMBINE(out, in1, in2) \
+do { \
+        Bout->d[out] = Bin->w[in1 * 2] | ((uint64_t)Bin->w[in2 * 2 + 1] << 32); \
+} while (0)
+        COMBINE(0, 0, 2);
+        COMBINE(1, 5, 7);
+        COMBINE(2, 2, 4);
+        COMBINE(3, 7, 1);
+        COMBINE(4, 4, 6);
+        COMBINE(5, 1, 3);
+        COMBINE(6, 6, 0);
+        COMBINE(7, 3, 5);
+#undef COMBINE
+}
+
+static void salsa20_simd_unshuffle(
+                const salsa20_blk_t *Bin,
+                salsa20_blk_t *Bout)
+{
+#define UNCOMBINE(out, in1, in2) \
+do { \
+        Bout->w[out * 2] = Bin->d[in1]; \
+        Bout->w[out * 2 + 1] = Bin->d[in2] >> 32; \
+} while (0)
+        UNCOMBINE(0, 0, 6);
+        UNCOMBINE(1, 5, 3);
+        UNCOMBINE(2, 2, 0);
+        UNCOMBINE(3, 7, 5);
+        UNCOMBINE(4, 4, 2);
+        UNCOMBINE(5, 1, 7);
+        UNCOMBINE(6, 6, 4);
+        UNCOMBINE(7, 3, 1);
+#undef UNCOMBINE
+}
+
+#define DECL_X \
+        salsa20_blk_t X
+#define DECL_Y \
+        salsa20_blk_t Y
+
+#if KDF_UNROLL_COPY
+#define COPY(out, in) \
+do { \
+        (out).d[0] = (in).d[0]; \
+        (out).d[1] = (in).d[1]; \
+        (out).d[2] = (in).d[2]; \
+        (out).d[3] = (in).d[3]; \
+        (out).d[4] = (in).d[4]; \
+        (out).d[5] = (in).d[5]; \
+        (out).d[6] = (in).d[6]; \
+        (out).d[7] = (in).d[7]; \
+} while (0)
+#else
+#define COPY(out, in) \
+do { \
+        memcpy((out).d, (in).d, sizeof((in).d)); \
+} while (0)
+#endif
+
+#define READ_X(in)   COPY(X, in)
+#define WRITE_X(out) COPY(out, X)
+
+/**
+ * salsa20(B):
+ * Apply the Salsa20 core to the provided block.
+ */
+static void salsa20(salsa20_blk_t *restrict B,
+                salsa20_blk_t *restrict Bout,
+                uint32_t doublerounds)
+{
+        salsa20_blk_t X;
+#define x X.w
+
+        salsa20_simd_unshuffle(B, &X);
+
+        do {
+#define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))
+                /* Operate on columns */
+#if KDF_UNROLL_SALSA20
+                x[ 4] ^= R(x[ 0]+x[12], 7); // x[j] ^= R(x[k]+x[l], CONST)
+                x[ 8] ^= R(x[ 4]+x[ 0], 9);
+                x[12] ^= R(x[ 8]+x[ 4],13);
+                x[ 0] ^= R(x[12]+x[ 8],18);
+
+                x[ 9] ^= R(x[ 5]+x[ 1], 7);
+                x[13] ^= R(x[ 9]+x[ 5], 9);
+                x[ 1] ^= R(x[13]+x[ 9],13);
+                x[ 5] ^= R(x[ 1]+x[13],18);
+
+                x[14] ^= R(x[10]+x[ 6], 7);
+                x[ 2] ^= R(x[14]+x[10], 9);
+                x[ 6] ^= R(x[ 2]+x[14],13);
+                x[10] ^= R(x[ 6]+x[ 2],18);
+
+                x[ 3] ^= R(x[15]+x[11], 7);
+                x[ 7] ^= R(x[ 3]+x[15], 9);
+                x[11] ^= R(x[ 7]+x[ 3],13);
+                x[15] ^= R(x[11]+x[ 7],18);
+#else
+                {
+                        unsigned j, k, l;
+                        j = 4; k = 0; l = 12;
+                        for (;;) {
+                                uint32_t t;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t, 7); }); l = k; k = j; j = (j+4) & 0xf;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t, 9); }); l = k; k = j; j = (j+4) & 0xf;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t,13); }); l = k; k = j; j = (j+4) & 0xf;
+                                x[j] ^= ({ t = x[k] + x[l]; R(t,18); });
+                                if (j == 15) break;
+                                l = j + 1; k = j + 5; j = (j+9) & 0xf;
+                        }
+                }
+#endif
+                /* Operate on rows */
+#if KDF_UNROLL_SALSA20
+// i=0 n=0
+                x[ 1] ^= R(x[ 0]+x[ 3], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[ 2] ^= R(x[ 1]+x[ 0], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[ 3] ^= R(x[ 2]+x[ 1],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[ 0] ^= R(x[ 3]+x[ 2],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+// i=4 n=1                                          ^^^j^^^       ^^^k^^^       ^^^l^^^
+                x[ 6] ^= R(x[ 5]+x[ 4], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[ 7] ^= R(x[ 6]+x[ 5], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[ 4] ^= R(x[ 7]+x[ 6],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[ 5] ^= R(x[ 4]+x[ 7],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+// i=8 n=2
+                x[11] ^= R(x[10]+x[ 9], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[ 8] ^= R(x[11]+x[10], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[ 9] ^= R(x[ 8]+x[11],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[10] ^= R(x[ 9]+x[ 8],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+// i=12 n=3
+                x[12] ^= R(x[15]+x[14], 7); // [i + (n+1)&3] [i + (n+0)&3] [i + (n+3)&3]
+                x[13] ^= R(x[12]+x[15], 9); // [i + (n+2)&3] [i + (n+1)&3] [i + (n+0)&3]
+                x[14] ^= R(x[13]+x[12],13); // [i + (n+3)&3] [i + (n+2)&3] [i + (n+1)&3]
+                x[15] ^= R(x[14]+x[13],18); // [i + (n+0)&3] [i + (n+3)&3] [i + (n+2)&3]
+#else
+                {
+                        unsigned j, k, l;
+                        uint32_t *xrow;
+                        j = 1; k = 0; l = 3;
+                        xrow = &x[0];
+                        for (;;) {
+                                uint32_t t;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t, 7); }); l = k; k = j; j = (j+1) & 3;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t, 9); }); l = k; k = j; j = (j+1) & 3;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t,13); }); l = k; k = j; j = (j+1) & 3;
+                                xrow[j] ^= ({ t = xrow[k] + xrow[l]; R(t,18); });
+                                if (j == 3) break;
+                                l = j; k = j + 1; j = (j+2) & 3;
+                                xrow += 4;
+                        }
+                }
+#endif
+
+#undef R
+        } while (--doublerounds);
+#undef x
+
+        {
+                uint32_t i;
+                salsa20_simd_shuffle(&X, Bout);
+                for (i = 0; i < 16; i++) {
+                        // bbox: note: was unrolled x4
+                        B->w[i] = Bout->w[i] += B->w[i];
+                }
+        }
+#if 0
+        /* Too expensive */
+        explicit_bzero(&X, sizeof(X));
+#endif
+}
+
+/**
+ * Apply the Salsa20/2 core to the block provided in X.
+ */
+#define SALSA20_2(out) \
+        salsa20(&X, &out, 1)
+
+#if 0
+#define XOR(out, in1, in2) \
+do { \
+        (out).d[0] = (in1).d[0] ^ (in2).d[0]; \
+        (out).d[1] = (in1).d[1] ^ (in2).d[1]; \
+        (out).d[2] = (in1).d[2] ^ (in2).d[2]; \
+        (out).d[3] = (in1).d[3] ^ (in2).d[3]; \
+        (out).d[4] = (in1).d[4] ^ (in2).d[4]; \
+        (out).d[5] = (in1).d[5] ^ (in2).d[5]; \
+        (out).d[6] = (in1).d[6] ^ (in2).d[6]; \
+        (out).d[7] = (in1).d[7] ^ (in2).d[7]; \
+} while (0)
+#else
+#define XOR(out, in1, in2) \
+do { \
+        xorbuf64_3_aligned64(&(out).d, &(in1).d, &(in2).d); \
+} while (0)
+#endif
+
+#define XOR_X(in)         XOR(X, X, in)
+#define XOR_X_2(in1, in2) XOR(X, in1, in2)
+#define XOR_X_WRITE_XOR_Y_2(out, in) \
+do { \
+        XOR(Y, out, in); \
+        COPY(out, Y); \
+        XOR(X, X, Y); \
+} while (0)
+
+/**
+ * Apply the Salsa20/8 core to the block provided in X ^ in.
+ */
+#define SALSA20_8_XOR_MEM(in, out) \
+do { \
+        XOR_X(in); \
+        salsa20(&X, &out, 4); \
+} while (0)
+
+#define INTEGERIFY ((uint32_t)X.d[0])
+
+/**
+ * blockmix_salsa8(Bin, Bout, r):
+ * Compute Bout = BlockMix_{salsa20/8, r}(Bin).  The input Bin must be 128r
+ * bytes in length; the output Bout must also be the same size.
+ */
+static void blockmix_salsa8(
+                const salsa20_blk_t *restrict Bin,
+                salsa20_blk_t *restrict Bout,
+                size_t r)
+{
+        size_t i;
+        DECL_X;
+
+        READ_X(Bin[r * 2 - 1]);
+        for (i = 0; i < r; i++) {
+                SALSA20_8_XOR_MEM(Bin[i * 2], Bout[i]);
+                SALSA20_8_XOR_MEM(Bin[i * 2 + 1], Bout[r + i]);
+        }
+}
+
+static uint32_t blockmix_salsa8_xor(
+                const salsa20_blk_t *restrict Bin1,
+                const salsa20_blk_t *restrict Bin2,
+                salsa20_blk_t *restrict Bout,
+                size_t r)
+{
+        size_t i;
+        DECL_X;
+
+        XOR_X_2(Bin1[r * 2 - 1], Bin2[r * 2 - 1]);
+        for (i = 0; i < r; i++) {
+                XOR_X(Bin1[i * 2]);
+                SALSA20_8_XOR_MEM(Bin2[i * 2], Bout[i]);
+                XOR_X(Bin1[i * 2 + 1]);
+                SALSA20_8_XOR_MEM(Bin2[i * 2 + 1], Bout[r + i]);
+        }
+
+        return INTEGERIFY;
+}
+
+/* This is tunable */
+#define Swidth 8
+
+/* Not tunable in this implementation, hard-coded in a few places */
+#define PWXsimple 2
+#define PWXgather 4
+
+/* Derived values.  Not tunable except via Swidth above. */
+#define PWXbytes (PWXgather * PWXsimple * 8)
+#define Sbytes   (3 * (1 << Swidth) * PWXsimple * 8)
+#define Smask    (((1 << Swidth) - 1) * PWXsimple * 8)
+#define Smask2   (((uint64_t)Smask << 32) | Smask)
+
+#define DECL_SMASK2REG       do {} while (0)
+#define FORCE_REGALLOC_3     do {} while (0)
+#define MAYBE_MEMORY_BARRIER do {} while (0)
+
+#define PWXFORM_SIMD(x0, x1) \
+do { \
+        uint64_t x = x0 & Smask2; \
+        uint64_t *p0 = (uint64_t *)(S0 + (uint32_t)x); \
+        uint64_t *p1 = (uint64_t *)(S1 + (x >> 32)); \
+        x0 = ((x0 >> 32) * (uint32_t)x0 + p0[0]) ^ p1[0]; \
+        x1 = ((x1 >> 32) * (uint32_t)x1 + p0[1]) ^ p1[1]; \
+} while (0)
+
+#if KDF_UNROLL_PWXFORM_ROUND
+#define PWXFORM_ROUND \
+do { \
+        PWXFORM_SIMD(X.d[0], X.d[1]); \
+        PWXFORM_SIMD(X.d[2], X.d[3]); \
+        PWXFORM_SIMD(X.d[4], X.d[5]); \
+        PWXFORM_SIMD(X.d[6], X.d[7]); \
+} while (0)
+#else
+#define PWXFORM_ROUND \
+do { \
+        for (int pwxi=0; pwxi<8; pwxi+=2) \
+                PWXFORM_SIMD(X.d[pwxi], X.d[pwxi + 1]); \
+} while (0)
+#endif
+
+/*
+ * This offset helps address the 256-byte write block via the single-byte
+ * displacements encodable in x86(-64) instructions.  It is needed because the
+ * displacements are signed.  Without it, we'd get 4-byte displacements for
+ * half of the writes.  Setting it to 0x80 instead of 0x7c would avoid needing
+ * a displacement for one of the writes, but then the LEA instruction would
+ * need a 4-byte displacement.
+ */
+#define PWXFORM_WRITE_OFFSET 0x7c
+
+#define PWXFORM_WRITE \
+do { \
+        WRITE_X(*(salsa20_blk_t *)(Sw - PWXFORM_WRITE_OFFSET)); \
+        Sw += 64; \
+} while (0)
+
+#if KDF_UNROLL_PWXFORM
+#define PWXFORM \
+do { \
+        uint8_t *Sw = S2 + w + PWXFORM_WRITE_OFFSET; \
+        FORCE_REGALLOC_3; \
+        MAYBE_MEMORY_BARRIER; \
+        PWXFORM_ROUND; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; PWXFORM_WRITE; \
+        PWXFORM_ROUND; \
+        w = (w + 64 * 4) & Smask2; \
+        { \
+                uint8_t *Stmp = S2; \
+                S2 = S1; \
+                S1 = S0; \
+                S0 = Stmp; \
+        } \
+} while (0)
+#else
+#define PWXFORM \
+do { \
+        uint8_t *Sw = S2 + w + PWXFORM_WRITE_OFFSET; \
+        FORCE_REGALLOC_3; \
+        MAYBE_MEMORY_BARRIER; \
+        PWXFORM_ROUND; \
+        for (int pwxj=0; pwxj<4; pwxj++) {\
+                PWXFORM_ROUND; PWXFORM_WRITE; \
+        } \
+        PWXFORM_ROUND; \
+        w = (w + 64 * 4) & Smask2; \
+        { \
+                uint8_t *Stmp = S2; \
+                S2 = S1; \
+                S1 = S0; \
+                S0 = Stmp; \
+        } \
+} while (0)
+#endif
+
+typedef struct {
+        uint8_t *S0, *S1, *S2;
+        size_t w;
+} pwxform_ctx_t;
+
+#define Salloc (Sbytes + ((sizeof(pwxform_ctx_t) + 63) & ~63U))
+
+/**
+ * blockmix_pwxform(Bin, Bout, r, S):
+ * Compute Bout = BlockMix_pwxform{salsa20/2, r, S}(Bin).  The input Bin must
+ * be 128r bytes in length; the output Bout must also be the same size.
+ */
+static void blockmix(
+                const salsa20_blk_t *restrict Bin,
+                salsa20_blk_t *restrict Bout,
+                size_t r,
+                pwxform_ctx_t *restrict ctx)
+{
+        uint8_t *S0 = ctx->S0, *S1 = ctx->S1, *S2 = ctx->S2;
+        size_t w = ctx->w;
+        size_t i;
+        DECL_X;
+
+        /* Convert count of 128-byte blocks to max index of 64-byte block */
+        r = r * 2 - 1;
+
+        READ_X(Bin[r]);
+
+        DECL_SMASK2REG;
+
+        i = 0;
+        for (;;) {
+                XOR_X(Bin[i]);
+                PWXFORM;
+                if (unlikely(i >= r))
+                        break;
+                WRITE_X(Bout[i]);
+                i++;
+        }
+
+        ctx->S0 = S0;
+        ctx->S1 = S1;
+        ctx->S2 = S2;
+        ctx->w = w;
+
+        SALSA20_2(Bout[i]);
+}
+
+static uint32_t blockmix_xor(
+                const salsa20_blk_t *Bin1,
+                const salsa20_blk_t *restrict Bin2,
+                salsa20_blk_t *Bout,
+                size_t r,
+                pwxform_ctx_t *restrict ctx)
+{
+        uint8_t *S0 = ctx->S0, *S1 = ctx->S1, *S2 = ctx->S2;
+        size_t w = ctx->w;
+        size_t i;
+        DECL_X;
+
+        /* Convert count of 128-byte blocks to max index of 64-byte block */
+        r = r * 2 - 1;
+
+        XOR_X_2(Bin1[r], Bin2[r]);
+
+        DECL_SMASK2REG;
+
+        i = 0;
+        r--;
+        for (;;) {
+                XOR_X(Bin1[i]);
+                XOR_X(Bin2[i]);
+                PWXFORM;
+                if (unlikely(i > r))
+                        break;
+                WRITE_X(Bout[i]);
+                i++;
+        }
+
+        ctx->S0 = S0;
+        ctx->S1 = S1;
+        ctx->S2 = S2;
+        ctx->w = w;
+
+        SALSA20_2(Bout[i]);
+
+        return INTEGERIFY;
+}
+
+static uint32_t blockmix_xor_save(
+                salsa20_blk_t *restrict Bin1out,
+                salsa20_blk_t *restrict Bin2,
+                size_t r,
+                pwxform_ctx_t *restrict ctx)
+{
+        uint8_t *S0 = ctx->S0, *S1 = ctx->S1, *S2 = ctx->S2;
+        size_t w = ctx->w;
+        size_t i;
+        DECL_X;
+        DECL_Y;
+
+        /* Convert count of 128-byte blocks to max index of 64-byte block */
+        r = r * 2 - 1;
+
+        XOR_X_2(Bin1out[r], Bin2[r]);
+
+        DECL_SMASK2REG;
+
+        i = 0;
+        r--;
+        for (;;) {
+                XOR_X_WRITE_XOR_Y_2(Bin2[i], Bin1out[i]);
+                PWXFORM;
+                if (unlikely(i > r))
+                        break;
+                WRITE_X(Bin1out[i]);
+                i++;
+        }
+
+        ctx->S0 = S0;
+        ctx->S1 = S1;
+        ctx->S2 = S2;
+        ctx->w = w;
+
+        SALSA20_2(Bin1out[i]);
+
+        return INTEGERIFY;
+}
+
+/**
+ * integerify(B, r):
+ * Return the result of parsing B_{2r-1} as a little-endian integer.
+ */
+static inline uint32_t integerify(const salsa20_blk_t *B, size_t r)
+{
+/*
+ * Our 64-bit words are in host byte order, which is why we don't just read
+ * w[0] here (would be wrong on big-endian).  Also, our 32-bit words are
+ * SIMD-shuffled (so the next 32 bits would be part of d[6]), but currently
+ * this does not matter as we only care about the least significant 32 bits.
+ */
+        return (uint32_t)B[2 * r - 1].d[0];
+}
+
+/**
+ * smix1(B, r, N, flags, V, NROM, VROM, XY, ctx):
+ * Compute first loop of B = SMix_r(B, N).  The input B must be 128r bytes in
+ * length; the temporary storage V must be 128rN bytes in length; the temporary
+ * storage XY must be 128r+64 bytes in length.  N must be even and at least 4.
+ * The array V must be aligned to a multiple of 64 bytes, and arrays B and XY
+ * to a multiple of at least 16 bytes.
+ */
+#if DISABLE_NROM_CODE
+#define smix1(B,r,N,flags,V,NROM,VROM,XY,ctx) \
+        smix1(B,r,N,flags,V,XY,ctx)
+#endif
+static void smix1(uint8_t *B, size_t r, uint32_t N,
+                uint32_t flags,
+                salsa20_blk_t *V,
+                uint32_t NROM, const salsa20_blk_t *VROM,
+                salsa20_blk_t *XY,
+                pwxform_ctx_t *ctx)
+{
+#if DISABLE_NROM_CODE
+        uint32_t NROM = 0;
+        const salsa20_blk_t *VROM = NULL;
+#endif
+        size_t s = 2 * r;
+        salsa20_blk_t *X = V, *Y = &V[s];
+        uint32_t i, j;
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = (salsa20_blk_t *)&B[i * 64];
+                salsa20_blk_t *tmp = Y;
+                salsa20_blk_t *dst = &X[i];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_shuffle(tmp, dst);
+        }
+
+        if (VROM) {
+                uint32_t n;
+                const salsa20_blk_t *V_j;
+
+                V_j = &VROM[(NROM - 1) * s];
+                j = blockmix_xor(X, V_j, Y, r, ctx) & (NROM - 1);
+                V_j = &VROM[j * s];
+                X = Y + s;
+                j = blockmix_xor(Y, V_j, X, r, ctx);
+
+                for (n = 2; n < N; n <<= 1) {
+                        uint32_t m = (n < N / 2) ? n : (N - 1 - n);
+                        for (i = 1; i < m; i += 2) {
+                                j &= n - 1;
+                                j += i - 1;
+                                V_j = &V[j * s];
+                                Y = X + s;
+                                j = blockmix_xor(X, V_j, Y, r, ctx) & (NROM - 1);
+                                V_j = &VROM[j * s];
+                                X = Y + s;
+                                j = blockmix_xor(Y, V_j, X, r, ctx);
+                        }
+                }
+                n >>= 1;
+
+                j &= n - 1;
+                j += N - 2 - n;
+                V_j = &V[j * s];
+                Y = X + s;
+                j = blockmix_xor(X, V_j, Y, r, ctx) & (NROM - 1);
+                V_j = &VROM[j * s];
+                blockmix_xor(Y, V_j, XY, r, ctx);
+        } else if (flags & YESCRYPT_RW) {
+//can't use flags___YESCRYPT_RW, smix1() may be called with flags = 0
+                uint32_t n;
+                salsa20_blk_t *V_j;
+
+                blockmix(X, Y, r, ctx);
+                X = Y + s;
+                blockmix(Y, X, r, ctx);
+                j = integerify(X, r);
+
+                for (n = 2; n < N; n <<= 1) {
+                        uint32_t m = (n < N / 2) ? n : (N - 1 - n);
+                        for (i = 1; i < m; i += 2) {
+                                Y = X + s;
+                                j &= n - 1;
+                                j += i - 1;
+                                V_j = &V[j * s];
+                                j = blockmix_xor(X, V_j, Y, r, ctx);
+                                j &= n - 1;
+                                j += i;
+                                V_j = &V[j * s];
+                                X = Y + s;
+                                j = blockmix_xor(Y, V_j, X, r, ctx);
+                        }
+                }
+                n >>= 1;
+
+                j &= n - 1;
+                j += N - 2 - n;
+                V_j = &V[j * s];
+                Y = X + s;
+                j = blockmix_xor(X, V_j, Y, r, ctx);
+                j &= n - 1;
+                j += N - 1 - n;
+                V_j = &V[j * s];
+                blockmix_xor(Y, V_j, XY, r, ctx);
+        } else {
+                N -= 2;
+                do {
+                        blockmix_salsa8(X, Y, r);
+                        X = Y + s;
+                        blockmix_salsa8(Y, X, r);
+                        Y = X + s;
+                } while ((N -= 2));
+
+                blockmix_salsa8(X, Y, r);
+                blockmix_salsa8(Y, XY, r);
+        }
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = &XY[i];
+                salsa20_blk_t *tmp = &XY[s];
+                salsa20_blk_t *dst = (salsa20_blk_t *)&B[i * 64];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_unshuffle(tmp, dst);
+        }
+}
+
+/**
+ * smix2(B, r, N, Nloop, flags, V, NROM, VROM, XY, ctx):
+ * Compute second loop of B = SMix_r(B, N).  The input B must be 128r bytes in
+ * length; the temporary storage V must be 128rN bytes in length; the temporary
+ * storage XY must be 256r bytes in length.  N must be a power of 2 and at
+ * least 2.  Nloop must be even.  The array V must be aligned to a multiple of
+ * 64 bytes, and arrays B and XY to a multiple of at least 16 bytes.
+ */
+#if DISABLE_NROM_CODE
+#define smix2(B,r,N,Nloop,flags,V,NROM,VROM,XY,ctx) \
+        smix2(B,r,N,Nloop,flags,V,XY,ctx)
+#endif
+static void smix2(uint8_t *B, size_t r, uint32_t N, uint64_t Nloop,
+                uint32_t flags,
+                salsa20_blk_t *V,
+                uint32_t NROM, const salsa20_blk_t *VROM,
+                salsa20_blk_t *XY,
+                pwxform_ctx_t *ctx)
+{
+#if DISABLE_NROM_CODE
+        uint32_t NROM = 0;
+        const salsa20_blk_t *VROM = NULL;
+#endif
+        size_t s = 2 * r;
+        salsa20_blk_t *X = XY, *Y = &XY[s];
+        uint32_t i, j;
+
+        if (Nloop == 0)
+                return;
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = (salsa20_blk_t *)&B[i * 64];
+                salsa20_blk_t *tmp = Y;
+                salsa20_blk_t *dst = &X[i];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_shuffle(tmp, dst);
+        }
+
+        j = integerify(X, r) & (N - 1);
+
+/*
+ * Normally, VROM implies YESCRYPT_RW, but we check for these separately
+ * because our SMix resets YESCRYPT_RW for the smix2() calls operating on the
+ * entire V when p > 1.
+ */
+//and this is why bbox can't use flags___YESCRYPT_RW in this function
+        if (VROM && (flags & YESCRYPT_RW)) {
+                do {
+                        salsa20_blk_t *V_j = &V[j * s];
+                        const salsa20_blk_t *VROM_j;
+                        j = blockmix_xor_save(X, V_j, r, ctx) & (NROM - 1);
+                        VROM_j = &VROM[j * s];
+                        j = blockmix_xor(X, VROM_j, X, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else if (VROM) {
+                do {
+                        const salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (NROM - 1);
+                        V_j = &VROM[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else if (flags & YESCRYPT_RW) {
+                do {
+                        salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_xor_save(X, V_j, r, ctx) & (N - 1);
+                        V_j = &V[j * s];
+                        j = blockmix_xor_save(X, V_j, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else if (ctx) {
+                do {
+                        const salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (N - 1);
+                        V_j = &V[j * s];
+                        j = blockmix_xor(X, V_j, X, r, ctx) & (N - 1);
+                } while (Nloop -= 2);
+        } else {
+                do {
+                        const salsa20_blk_t *V_j = &V[j * s];
+                        j = blockmix_salsa8_xor(X, V_j, Y, r) & (N - 1);
+                        V_j = &V[j * s];
+                        j = blockmix_salsa8_xor(Y, V_j, X, r) & (N - 1);
+                } while (Nloop -= 2);
+        }
+
+        for (i = 0; i < 2 * r; i++) {
+                const salsa20_blk_t *src = &X[i];
+                salsa20_blk_t *tmp = Y;
+                salsa20_blk_t *dst = (salsa20_blk_t *)&B[i * 64];
+                size_t k;
+                for (k = 0; k < 16; k++)
+                        tmp->w[k] = SWAP_LE32(src->w[k]);
+                salsa20_simd_unshuffle(tmp, dst);
+        }
+}
+
+/**
+ * p2floor(x):
+ * Largest power of 2 not greater than argument.
+ */
+static uint64_t p2floor(uint64_t x)
+{
+        uint64_t y;
+        while ((y = x & (x - 1)))
+                x = y;
+        return x;
+}
+
+/**
+ * smix(B, r, N, p, t, flags, V, NROM, VROM, XY, S, passwd):
+ * Compute B = SMix_r(B, N).  The input B must be 128rp bytes in length; the
+ * temporary storage V must be 128rN bytes in length; the temporary storage
+ * XY must be 256r or 256rp bytes in length (the larger size is required with
+ * OpenMP-enabled builds).  N must be a power of 2 and at least 4.  The array V
+ * must be aligned to a multiple of 64 bytes, and arrays B and XY to a multiple
+ * of at least 16 bytes (aligning them to 64 bytes as well saves cache lines
+ * and helps avoid false sharing in OpenMP-enabled builds when p > 1, but it
+ * might also result in cache bank conflicts).
+ */
+#if DISABLE_NROM_CODE
+#define smix(B,r,N,p,t,flags,V,NROM,VROM,XY,S,passwd) \
+        smix(B,r,N,p,t,flags,V,XY,S,passwd)
+#endif
+static void smix(uint8_t *B, size_t r, uint32_t N, uint32_t p, uint32_t t,
+                uint32_t flags,
+                salsa20_blk_t *V,
+                uint32_t NROM, const salsa20_blk_t *VROM,
+                salsa20_blk_t *XY,
+                uint8_t *S, uint8_t *passwd)
+{
+        size_t s = 2 * r;
+        uint32_t Nchunk;
+        uint64_t Nloop_all, Nloop_rw;
+        uint32_t i;
+
+        Nchunk = N / p;
+        Nloop_all = Nchunk;
+        if (flags___YESCRYPT_RW) {
+                if (t <= 1) {
+                        if (t)
+                                Nloop_all *= 2; /* 2/3 */
+                        Nloop_all = (Nloop_all + 2) / 3; /* 1/3, round up */
+                } else {
+                        Nloop_all *= t - 1;
+                }
+        } else if (t) {
+                if (t == 1)
+                        Nloop_all += (Nloop_all + 1) / 2; /* 1.5, round up */
+                Nloop_all *= t;
+        }
+
+        Nloop_rw = 0;
+        if (flags___YESCRYPT_RW)
+                Nloop_rw = Nloop_all / p;
+
+        Nchunk &= ~(uint32_t)1; /* round down to even */
+        Nloop_all++; Nloop_all &= ~(uint64_t)1; /* round up to even */
+        Nloop_rw++; Nloop_rw &= ~(uint64_t)1; /* round up to even */
+
+        for (i = 0; i < p; i++) {
+                uint32_t Vchunk = i * Nchunk;
+                uint32_t Np = (i < p - 1) ? Nchunk : (N - Vchunk);
+                uint8_t *Bp = &B[128 * r * i];
+                salsa20_blk_t *Vp = &V[Vchunk * s];
+                salsa20_blk_t *XYp = XY;
+                pwxform_ctx_t *ctx_i = NULL;
+                if (flags___YESCRYPT_RW) {
+                        uint8_t *Si = S + i * Salloc;
+                        smix1(Bp, 1, Sbytes / 128, 0 /* no flags */,
+                                (salsa20_blk_t *)Si, 0, NULL, XYp, NULL);
+                        ctx_i = (pwxform_ctx_t *)(Si + Sbytes);
+                        ctx_i->S2 = Si;
+                        ctx_i->S1 = Si + Sbytes / 3;
+                        ctx_i->S0 = Si + Sbytes / 3 * 2;
+                        ctx_i->w = 0;
+                        if (i == 0)
+                                hmac_block(
+                                        /* key,len: */ Bp + (128 * r - 64), 64,
+                                        /* hash fn: */ sha256_begin,
+                                        /* in,len: */  passwd, 32,
+                                        /* outbuf: */  passwd
+                                );
+                }
+                smix1(Bp, r, Np, flags, Vp, NROM, VROM, XYp, ctx_i);
+                smix2(Bp, r, p2floor(Np), Nloop_rw, flags, Vp,
+                        NROM, VROM, XYp, ctx_i);
+        }
+
+        if (Nloop_all > Nloop_rw) {
+                for (i = 0; i < p; i++) {
+                        uint8_t *Bp = &B[128 * r * i];
+                        salsa20_blk_t *XYp = XY;
+                        pwxform_ctx_t *ctx_i = NULL;
+                        if (flags___YESCRYPT_RW) {
+                                uint8_t *Si = S + i * Salloc;
+                                ctx_i = (pwxform_ctx_t *)(Si + Sbytes);
+                        }
+                        smix2(Bp, r, N, Nloop_all - Nloop_rw,
+                                flags & (uint32_t)~YESCRYPT_RW,
+                                V, NROM, VROM, XYp, ctx_i);
+                }
+        }
+}
+
+/* Allocator code */
+
+static void alloc_region(yescrypt_region_t *region, size_t size)
+{
+        uint8_t *base;
+        int flags =
+# ifdef MAP_NOCORE /* huh? */
+                MAP_NOCORE |
+# endif
+                MAP_ANON | MAP_PRIVATE;
+
+        base = mmap(NULL, size, PROT_READ | PROT_WRITE, flags, -1, 0);
+        if (base == MAP_FAILED)
+                bb_die_memory_exhausted();
+
+#if defined(MADV_HUGEPAGE)
+        /* Reduces mkpasswd qweRTY123@-+ '$y$jHT$123'
+         * (which allocates 4 Gbytes)
+         * run time from 10.543s to 5.635s
+         * Seen on linux-5.18.0.
+         */
+        madvise(base, size, MADV_HUGEPAGE);
+#endif
+        //region->base = base;
+        //region->base_size = size;
+        region->aligned = base;
+        region->aligned_size = size;
+}
+
+static void free_region(yescrypt_region_t *region)
+{
+        if (region->aligned)
+                munmap(region->aligned, region->aligned_size);
+        //region->base = NULL;
+        //region->base_size = 0;
+        region->aligned = NULL;
+        region->aligned_size = 0;
+}
+/**
+ * yescrypt_kdf_body(shared, local, passwd, passwdlen, salt, saltlen,
+ *     flags, N, r, p, t, NROM, buf, buflen):
+ * Compute scrypt(passwd[0 .. passwdlen - 1], salt[0 .. saltlen - 1], N, r,
+ * p, buflen), or a revision of scrypt as requested by flags and shared, and
+ * write the result into buf.
+ *
+ * shared and flags may request special modes as described in yescrypt.h.
+ *
+ * local is the thread-local data structure, allowing to preserve and reuse a
+ * memory allocation across calls, thereby reducing its overhead.
+ *
+ * t controls computation time while not affecting peak memory usage.
+ *
+ * Return 0 on success; or -1 on error.
+ *
+ * This optimized implementation currently limits N to the range from 4 to
+ * 2^31, but other implementations might not.
+ */
+static int yescrypt_kdf32_body(
+                yescrypt_ctx_t *yctx,
+                const uint8_t *passwd, size_t passwdlen,
+                uint32_t flags, uint64_t N, uint32_t t,
+                uint8_t *buf32)
+{
+#if !DISABLE_NROM_CODE
+        const salsa20_blk_t *VROM;
+#endif
+        size_t B_size, V_size, XY_size, need;
+        uint8_t *B, *S;
+        salsa20_blk_t *V, *XY;
+        struct {
+                uint8_t sha256[32];
+                uint8_t dk[32];
+        } u;
+#define sha256 u.sha256
+#define dk     u.dk
+        uint8_t *dkp = buf32;
+        uint32_t r, p;
+
+        /* Sanity-check parameters */
+        switch (flags___YESCRYPT_MODE_MASK) {
+        case 0: /* classic scrypt - can't have anything non-standard */
+                if (flags || t || YCTX_param_NROM)
+                        goto out_EINVAL;
+                break;
+        case YESCRYPT_WORM:
+                if (flags != YESCRYPT_WORM || YCTX_param_NROM)
+                        goto out_EINVAL;
+                break;
+        case YESCRYPT_RW:
+                if (flags != (flags & YESCRYPT_KNOWN_FLAGS))
+                        goto out_EINVAL;
+#if PWXsimple == 2 && PWXgather == 4 && Sbytes == 12288
+                if ((flags & YESCRYPT_RW_FLAVOR_MASK) ==
+                    (YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 |
+                    YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K))
+                        break;
+#else
+#error "Unsupported pwxform settings"
+#endif
+                /* FALLTHRU */
+        default:
+                goto out_EINVAL;
+        }
+
+        r = YCTX_param_r;
+        p = YCTX_param_p;
+        if ((uint64_t)r * (uint64_t)p >= 1 << 30) {
+                dbg("r * n >= 2^30");
+                goto out_EINVAL;
+        }
+        if (N > UINT32_MAX) {
+                dbg("N > 0x%lx", (long)UINT32_MAX);
+                goto out_EINVAL;
+        }
+        if (N <= 3
+         || r < 1
+         || p < 1
+        ) {
+                dbg("bad N, r or p");
+                goto out_EINVAL;
+        }
+        if (r > SIZE_MAX / 256 / p
+         || N > SIZE_MAX / 128 / r
+        ) {
+                /* 32-bit testcase: mkpasswd qweRTY123@-+ '$y$jHT$123'
+                 * (works on 64-bit, needs buffer > 4Gbytes)
+                 */
+                dbg("r > SIZE_MAX / 256 / p? %c", "NY"[r > SIZE_MAX / 256 / p]);
+                dbg("N > SIZE_MAX / 128 / r? %c", "NY"[N > SIZE_MAX / 128 / r]);
+                goto out_EINVAL;
+        }
+        if (flags___YESCRYPT_RW) {
+                /* p cannot be greater than SIZE_MAX/Salloc on 64-bit systems,
+                   but it can on 32-bit systems.  */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+                if (N / p <= 3 || p > SIZE_MAX / Salloc) {
+                        dbg("bad p:%ld", (long)p);
+                        goto out_EINVAL;
+                }
+#pragma GCC diagnostic pop
+        }
+
+#if !DISABLE_NROM_CODE
+        VROM = NULL;
+        if (YCTX_param_NROM)
+                goto out_EINVAL;
+#endif
+
+        /* Allocate memory */
+        V = NULL;
+        V_size = (size_t)128 * r * N;
+        need = V_size;
+        B_size = (size_t)128 * r * p;
+        need += B_size;
+        if (need < B_size) {
+                dbg("integer overflow at += B_size(%lu)", (long)B_size);
+                goto out_EINVAL;
+        }
+        XY_size = (size_t)256 * r;
+        need += XY_size;
+        if (need < XY_size) {
+                dbg("integer overflow at += XY_size(%lu)", (long)XY_size);
+                goto out_EINVAL;
+        }
+        if (flags___YESCRYPT_RW) {
+                size_t S_size = (size_t)Salloc * p;
+                need += S_size;
+                if (need < S_size) {
+                        dbg("integer overflow at += S_size(%lu)", (long)S_size);
+                        goto out_EINVAL;
+                }
+        }
+        if (yctx->local->aligned_size < need) {
+                free_region(yctx->local);
+                alloc_region(yctx->local, need);
+                dbg("allocated local:%lu 0x%lx", (long)need, (long)need);
+                /* standard "j9T" params allocate 16Mbytes here */
+        }
+        if (flags & YESCRYPT_ALLOC_ONLY)
+                return -3; /* expected "failure" */
+        B = (uint8_t *)yctx->local->aligned;
+        V = (salsa20_blk_t *)((uint8_t *)B + B_size);
+        XY = (salsa20_blk_t *)((uint8_t *)V + V_size);
+        S = NULL;
+        if (flags___YESCRYPT_RW)
+                S = (uint8_t *)XY + XY_size;
+
+        if (flags) {
+                hmac_block(
+                        /* key,len: */ (const void*)"yescrypt-prehash", (flags & YESCRYPT_PREHASH) ? 16 : 8,
+                        /* hash fn: */ sha256_begin,
+                        /* in,len: */  passwd, passwdlen,
+                        /* outbuf: */  sha256
+                );
+                passwd = sha256;
+                passwdlen = sizeof(sha256);
+        }
+
+        PBKDF2_SHA256(passwd, passwdlen, yctx->salt, yctx->saltlen, 1, B, B_size);
+
+        if (flags)
+                memcpy(sha256, B, sizeof(sha256));
+
+        if (p == 1 || (flags___YESCRYPT_RW)) {
+                smix(B, r, N, p, t, flags, V, YCTX_param_NROM, VROM, XY, S, sha256);
+        } else {
+                uint32_t i;
+                for (i = 0; i < p; i++) {
+                        smix(&B[(size_t)128 * r * i], r, N, 1, t, flags, V,
+                                YCTX_param_NROM, VROM, XY, NULL, NULL);
+                }
+        }
+
+        dkp = buf32;
+        if (flags && /*buflen:*/32 < sizeof(dk)) {
+                PBKDF2_SHA256(passwd, passwdlen, B, B_size, 1, dk, sizeof(dk));
+                dkp = dk;
+        }
+
+        PBKDF2_SHA256(passwd, passwdlen, B, B_size, 1, buf32, /*buflen:*/32);
+
+        /*
+         * Except when computing classic scrypt, allow all computation so far
+         * to be performed on the client.  The final steps below match those of
+         * SCRAM (RFC 5802), so that an extension of SCRAM (with the steps so
+         * far in place of SCRAM's use of PBKDF2 and with SHA-256 in place of
+         * SCRAM's use of SHA-1) would be usable with yescrypt hashes.
+         */
+        if (flags && !(flags & YESCRYPT_PREHASH)) {
+                /* Compute ClientKey */
+                hmac_block(
+                        /* key,len: */ dkp, sizeof(dk),
+                        /* hash fn: */ sha256_begin,
+                        /* in,len: */  "Client Key", 10,
+                        /* outbuf: */  sha256
+                );
+                /* Compute StoredKey */
+                {
+                        size_t clen = /*buflen:*/32;
+                        if (clen > sizeof(dk))
+                                clen = sizeof(dk);
+                        if (sizeof(dk) != 32) { /* not true, optimize it out */
+                                sha256_block(sha256, sizeof(sha256), dk);
+                                memcpy(buf32, dk, clen);
+                        } else {
+                                sha256_block(sha256, sizeof(sha256), buf32);
+                        }
+                }
+        }
+
+        explicit_bzero(&u, sizeof(u));
+
+        /* Success! */
+        return 0;
+
+ out_EINVAL:
+        //bbox does not need this: errno = EINVAL;
+        return -1;
+#undef sha256
+#undef dk
+}
+
+/**
+ * yescrypt_kdf(shared, local, passwd, passwdlen, salt, saltlen, params,
+ *     buf, buflen):
+ * Compute scrypt or its revision as requested by the parameters.  The inputs
+ * to this function are the same as those for yescrypt_kdf_body() above, with
+ * the addition of g, which controls hash upgrades (0 for no upgrades so far).
+ */
+static
+int yescrypt_kdf32(
+                yescrypt_ctx_t *yctx,
+                const uint8_t *passwd, size_t passwdlen,
+                uint8_t *buf32)
+{
+        uint32_t flags = YCTX_param_flags;
+        uint64_t N = YCTX_param_N;
+        uint32_t r = YCTX_param_r;
+        uint32_t p = YCTX_param_p;
+        uint32_t t = YCTX_param_t;
+        uint32_t g = YCTX_param_g;
+        uint8_t dk32[32];
+        int retval;
+
+        /* Support for hash upgrades has been temporarily removed */
+        if (g) {
+                //bbox does not need this: errno = EINVAL;
+                return -1;
+        }
+
+        if ((flags___YESCRYPT_RW)
+         && p >= 1
+         && N / p >= 0x100
+         && N / p * r >= 0x20000
+        ) {
+                if (yescrypt_kdf32_body(yctx,
+                    passwd, passwdlen,
+                    flags | YESCRYPT_ALLOC_ONLY, N, t,
+                    buf32) != -3
+                ) {
+                        dbg("yescrypt_kdf32_body: not -3");
+                        return -1;
+                }
+                retval = yescrypt_kdf32_body(yctx,
+                                passwd, passwdlen,
+                                flags | YESCRYPT_PREHASH, N >> 6, 0,
+                                dk32);
+                if (retval) {
+                        dbg("yescrypt_kdf32_body(PREHASH):%d", retval);
+                        return retval;
+                }
+                passwd = dk32;
+                passwdlen = sizeof(dk32);
+        }
+
+        retval = yescrypt_kdf32_body(yctx,
+                        passwd, passwdlen,
+                        flags, N, t, buf32);
+
+        explicit_bzero(dk32, sizeof(dk32));
+
+        dbg("yescrypt_kdf32_body:%d", retval);
+        return retval;
+}
diff --git a/libbb/yescrypt/alg-yescrypt.h b/libbb/yescrypt/alg-yescrypt.h
new file mode 100644
index 000000000..b69843f5d
--- /dev/null
+++ b/libbb/yescrypt/alg-yescrypt.h
@@ -0,0 +1,247 @@
+/*-
+ * Copyright 2009 Colin Percival
+ * Copyright 2013-2018 Alexander Peslyak
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * This file was originally written by Colin Percival as part of the Tarsnap
+ * online backup system.
+ */
+
+// busybox debug and size-reduction configuration
+
+#ifdef YESCRYPT_INTERNAL
+# if 1
+#  define dbg(...) ((void)0)
+# else
+#  define dbg(...) bb_error_msg(__VA_ARGS__)
+# endif
+# if 1
+#  define dbg_dec64(...) ((void)0)
+# else
+#  define dbg_dec64(...) bb_error_msg(__VA_ARGS__)
+# endif
+# define TEST_DECODE64  0
+#endif
+
+// Only accept one-char parameters in salt, and only first three?
+// Almost any reasonable yescrypt hashes in /etc/shadow should
+// only ever use "jXY" parameters which set N and r.
+// Fancy multi-byte-encoded wide integers are not needed for that.
+#define RESTRICTED_PARAMS  1
+// Note: if you enable the above, please also enable
+// YCTX_param_p, YCTX_param_t, YCTX_param_g, YCTX_param_NROM
+// optimizations, and DISABLE_NROM_CODE.
+
+#define DISABLE_NROM_CODE  1
+
+// How much we save by forcing "standard" value by commenting the next line:
+//  160 bytes
+//#define YCTX_param_flags           yctx->param.flags
+//  260 bytes
+//#define flags___YESCRYPT_RW        (flags & YESCRYPT_RW)
+//  140 bytes
+//#define flags___YESCRYPT_MODE_MASK (flags & YESCRYPT_MODE_MASK)
+// ^^^^ forcing the above since the code already requires (checks for) this
+//   50 bytes
+#define YCTX_param_N     yctx->param.N
+// -100 bytes (negative!!!)
+#define YCTX_param_r     yctx->param.r
+//  400 bytes
+//#define YCTX_param_p     yctx->param.p
+//  130 bytes
+//#define YCTX_param_t     yctx->param.t
+//    2 bytes
+//#define YCTX_param_g     yctx->param.g
+//    1 bytes
+// ^^^^ this looks wrong, compiler should be able to constant-propagate the fact that NROM code is dead
+//#define YCTX_param_NROM  yctx->param.NROM
+
+#ifndef YCTX_param_flags
+#define YCTX_param_flags (YESCRYPT_RW | YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | YESCRYPT_SBOX_12K)
+#endif
+#ifndef flags___YESCRYPT_RW
+#define flags___YESCRYPT_RW ((void)flags, YESCRYPT_RW)
+#endif
+#ifndef flags___YESCRYPT_MODE_MASK
+#define flags___YESCRYPT_MODE_MASK ((void)flags, YESCRYPT_RW)
+#endif
+// standard ("j9T") values:
+#ifndef YCTX_param_N
+#define YCTX_param_N     4096
+#endif
+#ifndef YCTX_param_r
+#define YCTX_param_r     32
+#endif
+#ifndef YCTX_param_p
+#define YCTX_param_p     1
+#endif
+#ifndef YCTX_param_t
+#define YCTX_param_t     0
+#endif
+#ifndef YCTX_param_g
+#define YCTX_param_g     0
+#endif
+#ifndef YCTX_param_NROM
+#define YCTX_param_NROM  0
+#endif
+
+// "Faster/smaller code" knobs:
+// -941 bytes:
+#define KDF_UNROLL_COPY 0
+// -5324 bytes if 0:
+#define KDF_UNROLL_PWXFORM_ROUND 0
+// -4864 bytes if 0:
+#define KDF_UNROLL_PWXFORM 0
+// if both this ^^^^^^^^^^ and PWXFORM_ROUND set to 0: -7666 bytes
+// -464 bytes:
+#define KDF_UNROLL_SALSA20 0
+
+/**
+ * Type and possible values for the flags argument of yescrypt_kdf(),
+ * yescrypt_encode_params_r(), yescrypt_encode_params().  Most of these may be
+ * OR'ed together, except that YESCRYPT_WORM stands on its own.
+ * Please refer to the description of yescrypt_kdf() below for the meaning of
+ * these flags.
+ */
+/* yescrypt flags:
+ * bits pos: 7654321076543210
+ *                    ss  r w
+ *                sbox  gg y
+ */
+/* Public */
+#define YESCRYPT_WORM                   1
+#define YESCRYPT_RW                     0x002
+#define YESCRYPT_ROUNDS_3               0x000 //r=0
+#define YESCRYPT_ROUNDS_6               0x004 //r=1
+#define YESCRYPT_GATHER_1               0x000 //gg=00
+#define YESCRYPT_GATHER_2               0x008 //gg=01
+#define YESCRYPT_GATHER_4               0x010 //gg=10
+#define YESCRYPT_GATHER_8               0x018 //gg=11
+#define YESCRYPT_SIMPLE_1               0x000 //ss=00
+#define YESCRYPT_SIMPLE_2               0x020 //ss=01
+#define YESCRYPT_SIMPLE_4               0x040 //ss=10
+#define YESCRYPT_SIMPLE_8               0x060 //ss=11
+#define YESCRYPT_SBOX_6K                0x000 //sbox=0000
+#define YESCRYPT_SBOX_12K               0x080 //sbox=0001
+#define YESCRYPT_SBOX_24K               0x100 //sbox=0010
+#define YESCRYPT_SBOX_48K               0x180 //sbox=0011
+#define YESCRYPT_SBOX_96K               0x200 //sbox=0100
+#define YESCRYPT_SBOX_192K              0x280 //sbox=0101
+#define YESCRYPT_SBOX_384K              0x300 //sbox=0110
+#define YESCRYPT_SBOX_768K              0x380 //sbox=0111
+
+#ifdef YESCRYPT_INTERNAL
+/* Private */
+#define YESCRYPT_MODE_MASK              0x003
+#define YESCRYPT_RW_FLAVOR_MASK         0x3fc
+#define YESCRYPT_ALLOC_ONLY             0x08000000
+#define YESCRYPT_PREHASH                0x10000000
+#endif
+
+#define YESCRYPT_RW_DEFAULTS \
+        (YESCRYPT_RW | \
+        YESCRYPT_ROUNDS_6 | YESCRYPT_GATHER_4 | YESCRYPT_SIMPLE_2 | \
+        YESCRYPT_SBOX_12K)
+
+#define YESCRYPT_DEFAULTS YESCRYPT_RW_DEFAULTS
+
+#ifdef YESCRYPT_INTERNAL
+#define YESCRYPT_KNOWN_FLAGS \
+        (YESCRYPT_MODE_MASK | YESCRYPT_RW_FLAVOR_MASK | \
+        YESCRYPT_ALLOC_ONLY | YESCRYPT_PREHASH)
+#endif
+
+/* How many chars base-64 encoded bytes require? */
+#define YESCRYPT_BYTES2CHARS(bytes) ((((bytes) * 8) + 5) / 6)
+/* The /etc/passwd-style hash is "<prefix>$<hash><NUL>" */
+/*
+ * "$y$", up to 8 params of up to 6 chars each, '$', salt
+ * Alternatively, but that's smaller:
+ * "$7$", 3 params encoded as 1+5+5 chars, salt
+ */
+#define YESCRYPT_PREFIX_LEN (3 + 8 * 6 + 1 + YESCRYPT_BYTES2CHARS(32))
+
+#define YESCRYPT_HASH_SIZE 32
+#define YESCRYPT_HASH_LEN  YESCRYPT_BYTES2CHARS(YESCRYPT_HASH_SIZE)
+
+/**
+ * Internal type used by the memory allocator.  Please do not use it directly.
+ * Use yescrypt_shared_t and yescrypt_local_t as appropriate instead, since
+ * they might differ from each other in a future version.
+ */
+typedef struct {
+//      void *base;
+        void *aligned;
+//      size_t base_size;
+        size_t aligned_size;
+} yescrypt_region_t;
+
+/**
+ * yescrypt parameters combined into one struct.  N, r, p are the same as in
+ * classic scrypt, except that the meaning of p changes when YESCRYPT_RW is
+ * set.  flags, t, g, NROM are special to yescrypt.
+ */
+typedef struct {
+        uint32_t flags;
+        uint32_t r;
+        uint64_t N;
+#if !RESTRICTED_PARAMS
+        uint32_t p, t, g;
+        uint64_t NROM;
+#endif
+} yescrypt_params_t;
+
+typedef struct {
+        yescrypt_params_t param;
+
+        /* salt in binary form */
+        /* stored here to cut down on the amount of function paramaters */
+        unsigned char salt[64];
+        size_t saltlen;
+
+        /* used by the memory allocator */
+        //yescrypt_region_t shared[1];
+        yescrypt_region_t local[1];
+} yescrypt_ctx_t;
+
+/**
+ * yescrypt_r(shared, local, passwd, passwdlen, setting, key, buf, buflen):
+ * Compute and encode an scrypt or enhanced scrypt hash of passwd given the
+ * parameters and salt value encoded in setting.  If shared is not NULL, a ROM
+ * is used and YESCRYPT_RW is required.  Otherwise, whether to compute classic
+ * scrypt, YESCRYPT_WORM (a slight deviation from classic scrypt), or
+ * YESCRYPT_RW (time-memory tradeoff discouraging modification) is determined
+ * by the setting string.  shared (if not NULL) and local must be initialized
+ * as described above for yescrypt_kdf().  buf must be large enough (as
+ * indicated by buflen) to hold the encoded hash string.
+ *
+ * Return the encoded hash string on success; or NULL on error.
+ *
+ * MT-safe as long as local and buf are local to the thread.
+ */
+extern char *yescrypt_r(
+            const uint8_t *passwd, size_t passwdlen,
+            const uint8_t *setting,
+            char *buf, size_t buflen
+);
diff --git a/libbb/yescrypt/y.c b/libbb/yescrypt/y.c
new file mode 100644
index 000000000..d5ab8903f
--- /dev/null
+++ b/libbb/yescrypt/y.c
@@ -0,0 +1,16 @@
+/*
+ * The compilation unit for yescrypt-related code.
+ *
+ * Copyright (C) 2025 by Denys Vlasenko <vda.linux@googlemail.com>
+ *
+ * Licensed under GPLv2, see file LICENSE in this source tree.
+ */
+//kbuild:lib-$(CONFIG_USE_BB_CRYPT_YES) += y.o
+
+#include "libbb.h"
+
+#define YESCRYPT_INTERNAL
+#include "alg-yescrypt.h"
+#include "alg-sha256.c"
+#include "alg-yescrypt-kdf.c"
+#include "alg-yescrypt-common.c"
diff --git a/loginutils/Config.src b/loginutils/Config.src
index cbb09646b..a7812bd32 100644
--- a/loginutils/Config.src
+++ b/loginutils/Config.src
@@ -91,6 +91,17 @@ config USE_BB_CRYPT_SHA
         With this option off, login will fail password check for any
         user which has password encrypted with these algorithms.
 
+config USE_BB_CRYPT_YES
+        bool "Enable yescrypt functions"
+        default y
+        depends on USE_BB_CRYPT
+        help
+        Enable this if you have passwords starting with "$y$" or
+        in your /etc/passwd or /etc/shadow files. These passwords
+        are hashed using yescrypt algorithms.
+        With this option off, login will fail password check for any
+        user which has password encrypted with these algorithms.
+
 INSERT
 
 endmenu
diff --git a/loginutils/chpasswd.c b/loginutils/chpasswd.c
index 65530b614..353f19961 100644
--- a/loginutils/chpasswd.c
+++ b/loginutils/chpasswd.c
@@ -17,7 +17,7 @@
 //config:       default "des"
 //config:       depends on PASSWD || CRYPTPW || CHPASSWD
 //config:       help
-//config:       Possible choices are "d[es]", "m[d5]", "s[ha256]" or "sha512".
+//config:       Possible choices: "d[es]", "m[d5]", "s[ha256]", "sha512", "yescrypt"
 
 //applet:IF_CHPASSWD(APPLET(chpasswd, BB_DIR_USR_SBIN, BB_SUID_DROP))
 
diff --git a/loginutils/cryptpw.c b/loginutils/cryptpw.c
index 1c338540f..666deff0b 100644
--- a/loginutils/cryptpw.c
+++ b/loginutils/cryptpw.c
@@ -84,8 +84,7 @@ to cryptpw. -a option (alias for -m) came from cryptpw.
 int cryptpw_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int cryptpw_main(int argc UNUSED_PARAM, char **argv)
 {
-        /* Supports: cryptpw -m sha256 PASS 'rounds=999999999$SALT' */
-        char salt[MAX_PW_SALT_LEN + sizeof("rounds=999999999$")];
+        char salt[MAX_PW_SALT_LEN];
         char *salt_ptr;
         char *password;
         const char *opt_m, *opt_S;
@@ -100,7 +99,7 @@ int cryptpw_main(int argc UNUSED_PARAM, char **argv)
         ;
 #endif
         fd = STDIN_FILENO;
-        opt_m = CONFIG_FEATURE_DEFAULT_PASSWD_ALGO;
+        opt_m = NULL;
         opt_S = NULL;
         /* at most two non-option arguments; -P NUM */
         getopt32long(argv, "^" "sP:+S:m:a:" "\0" "?2",
@@ -114,10 +113,34 @@ int cryptpw_main(int argc UNUSED_PARAM, char **argv)
         if (argv[0] && !opt_S)
                 opt_S = argv[1];
 
-        salt_ptr = crypt_make_pw_salt(salt, opt_m);
-        if (opt_S)
-                /* put user's data after the "$N$" prefix */
-                safe_strncpy(salt_ptr, opt_S, sizeof(salt) - (sizeof("$N$")-1));
+        if (opt_S && !opt_S[0]) {
+                /* mkpasswd 5.6.2 compat: SALT of ""
+                 * is treated as not specified
+                 * (both forms: -S "" and argv[1] of "")
+                 */
+                opt_S = NULL;
+        }
+
+        if (opt_m) {
+                /* "cryptpw -m ALGO PASSWORD [SALT]" */
+                /* generate "$x$" algo prefix + random salt */
+                salt_ptr = crypt_make_pw_salt(salt, opt_m);
+                if (opt_S) {
+                        /* "cryptpw -m ALGO PASSWORD SALT" */
+                        /* put SALT data after the "$x$" prefix */
+                        safe_strncpy(salt_ptr, opt_S, sizeof(salt) - (sizeof("$N$")-1));
+                }
+        } else {
+                if (!opt_S) {
+                        /* "cryptpw PASSWORD" */
+                        /* generate random salt with default algo */
+                        crypt_make_pw_salt(salt, CONFIG_FEATURE_DEFAULT_PASSWD_ALGO);
+                } else {
+                        /* "cryptpw PASSWORD '$x$SALT'" */
+                        /* use given salt; algo will be detected by pw_encrypt() */
+                        safe_strncpy(salt, opt_S, sizeof(salt));
+                }
+        }
 
         xmove_fd(fd, STDIN_FILENO);
 
diff --git a/loginutils/sulogin.c b/loginutils/sulogin.c
index 9c927ed79..984889915 100644
--- a/loginutils/sulogin.c
+++ b/loginutils/sulogin.c
@@ -79,7 +79,7 @@ int sulogin_main(int argc UNUSED_PARAM, char **argv)
                         break;
                 }
                 pause_after_failed_login();
-                bb_simple_info_msg("Login incorrect");
+                bb_simple_error_msg("Login incorrect");
         }
 
         /* util-linux 2.36.1 compat: no message */
@@ -119,9 +119,12 @@ int sulogin_main(int argc UNUSED_PARAM, char **argv)
         }
 
         /*
-         * Note: login does this (should we do it too?):
+         * Note: login does this. util-linux's sulogin does NOT.
+         * But it's rather unpleasant to have non-functioning ^C in a shell,
+         * and surprisingly, there is no easy way to remove SIG_IGN from ^C
+         * in the shell. So, we are doing it:
          */
-        /*signal(SIGINT, SIG_DFL);*/
+        signal(SIGINT, SIG_DFL);
 
         /* Exec shell with no additional parameters. Never returns. */
         exec_shell(shell, /* -p? then shell is login:*/(opts & 1), NULL);
diff --git a/miscutils/crond.c b/miscutils/crond.c
index b3762d327..6a384fdfb 100644
--- a/miscutils/crond.c
+++ b/miscutils/crond.c
@@ -177,7 +177,7 @@ static void crondlog(unsigned level, const char *msg, va_list va)
 {
         if (level >= G.log_level) {
                 /*
-                 * We are called only for info meesages.
+                 * We are called only for info messages.
                  * Warnings/errors use plain bb_[p]error_msg's, which
                  * need not touch syslog_level
                  * (they are ok with LOG_ERR default).
@@ -989,7 +989,7 @@ static int check_completions(void)
                         if (line->cl_pid <= 0)
                                 continue;
 
-                        r = waitpid(line->cl_pid, NULL, WNOHANG);
+                        r = safe_waitpid(line->cl_pid, NULL, WNOHANG);
                         if (r < 0 || r == line->cl_pid) {
                                 process_finished_job(file->cf_username, line);
                                 if (line->cl_pid == 0) {
@@ -1001,6 +1001,14 @@ static int check_completions(void)
                         /* else: r == 0: "process is still running" */
                         file->cf_has_running = 1;
                 }
+
+                /* Reap any other children we don't actively track.
+                 * Reportedly, some people run crond as init process!
+                 * Thus, we need to reap orphans, like init does.
+                 */
+                while (wait_any_nohang(NULL) > 0)
+                        continue;
+
 //FIXME: if !file->cf_has_running && file->deleted: delete it!
 //otherwise deleted entries will stay forever, right?
                 num_still_running += file->cf_has_running;
diff --git a/miscutils/less.c b/miscutils/less.c
index 467c76e2a..5a8fc5a74 100644
--- a/miscutils/less.c
+++ b/miscutils/less.c
@@ -1178,7 +1178,7 @@ static int64_t getch_nowait(void)
 
         /* We have kbd_fd in O_NONBLOCK mode, read inside safe_read_key()
          * would not block even if there is no input available */
-        key64 = safe_read_key(kbd_fd, kbd_input, /*timeout off:*/ -2);
+        key64 = safe_read_key(kbd_fd, kbd_input, /*do not poll:*/ -2);
         if ((int)key64 == -1) {
                 if (errno == EAGAIN) {
                         /* No keyboard input available. Since poll() did return,
diff --git a/modutils/modprobe-small.c b/modutils/modprobe-small.c
index 77e42e3fb..31a215a29 100644
--- a/modutils/modprobe-small.c
+++ b/modutils/modprobe-small.c
@@ -186,15 +186,6 @@ static char* find_keyword(char *ptr, size_t len, const char *word)
         return NULL;
 }
 
-static void replace(char *s, char what, char with)
-{
-        while (*s) {
-                if (what == *s)
-                        *s = with;
-                ++s;
-        }
-}
-
 static char *filename2modname(const char *filename, char *modname)
 {
         int i;
@@ -230,7 +221,7 @@ static char* str_2_list(const char *str)
         dst[len] = '\0';
         memcpy(dst, str, len);
 //TODO: protect against 2+ spaces: "word  word"
-        replace(dst, ' ', '\0');
+        replace_char(dst, ' ', '\0');
         return dst;
 }
 
@@ -369,14 +360,14 @@ static int parse_module(module_info *info, const char *pathname)
         }
         bksp(); /* remove last ' ' */
         info->aliases = copy_stringbuf();
-        replace(info->aliases, '-', '_');
+        replace_char(info->aliases, '-', '_');
 
         /* "dependency1 depandency2" */
         reset_stringbuf();
         ptr = find_keyword(module_image, len, "depends=");
         if (ptr && *ptr) {
-                replace(ptr, ',', ' ');
-                replace(ptr, '-', '_');
+                replace_char(ptr, ',', ' ');
+                replace_char(ptr, '-', '_');
                 dbg2_error_msg("dep:'%s'", ptr);
                 append(ptr);
         }
@@ -707,7 +698,7 @@ static int process_module(char *name, const char *cmdline_options)
 
         dbg1_error_msg("process_module('%s','%s')", name, cmdline_options);
 
-        replace(name, '-', '_');
+        replace_char(name, '-', '_');
 
         dbg1_error_msg("already_loaded:%d is_remove:%d", already_loaded(name), is_remove);
 
@@ -735,7 +726,7 @@ static int process_module(char *name, const char *cmdline_options)
                 char *opt_filename = xasprintf("/etc/modules/%s", name);
                 options = xmalloc_open_read_close(opt_filename, NULL);
                 if (options)
-                        replace(options, '\n', ' ');
+                        replace_char(options, '\n', ' ');
 #if ENABLE_FEATURE_CMDLINE_MODULE_OPTIONS
                 if (cmdline_options) {
                         /* NB: cmdline_options always have one leading ' '
diff --git a/modutils/modprobe.c b/modutils/modprobe.c
index 543f53e99..f890abe53 100644
--- a/modutils/modprobe.c
+++ b/modutils/modprobe.c
@@ -579,7 +579,7 @@ int modprobe_main(int argc UNUSED_PARAM, char **argv)
                 parser_t *p = config_open2(CONFIG_DEFAULT_DEPMOD_FILE, xfopen_for_read);
 
                 for (i = 0; argv[i]; i++)
-                        replace(argv[i], '-', '_');
+                        replace_char(argv[i], '-', '_');
 
                 while (config_read(p, tokens, 2, 1, "# \t", PARSE_NORMAL)) {
                         colon = last_char_is(tokens[0], ':');
diff --git a/modutils/modutils.c b/modutils/modutils.c
index cbff20961..862f71f57 100644
--- a/modutils/modutils.c
+++ b/modutils/modutils.c
@@ -69,15 +69,6 @@ void FAST_FUNC moddb_free(module_db *db)
         }
 }
 
-void FAST_FUNC replace(char *s, char what, char with)
-{
-        while (*s) {
-                if (what == *s)
-                        *s = with;
-                ++s;
-        }
-}
-
 int FAST_FUNC string_to_llist(char *string, llist_t **llist, const char *delim)
 {
         char *tok;
diff --git a/modutils/modutils.h b/modutils/modutils.h
index 4a702e97c..9b05116d1 100644
--- a/modutils/modutils.h
+++ b/modutils/modutils.h
@@ -47,7 +47,6 @@ module_entry *moddb_get(module_db *db, const char *s) FAST_FUNC;
 module_entry *moddb_get_or_create(module_db *db, const char *s) FAST_FUNC;
 void moddb_free(module_db *db) FAST_FUNC;
 
-void replace(char *s, char what, char with) FAST_FUNC;
 int string_to_llist(char *string, llist_t **llist, const char *delim) FAST_FUNC;
 char *filename2modname(const char *filename, char *modname) FAST_FUNC;
 #if ENABLE_FEATURE_CMDLINE_MODULE_OPTIONS
diff --git a/networking/Config.src b/networking/Config.src
index 0942645c3..aa0806a18 100644
--- a/networking/Config.src
+++ b/networking/Config.src
@@ -72,9 +72,28 @@ config FEATURE_HWIB
         help
         Support for printing infiniband addresses in network applets.
 
+choice
+        prompt "TLS implementation"
+        default FEATURE_TLS_INTERNAL
+
+config FEATURE_TLS_INTERNAL
+        bool "Internal"
+        depends on TLS
+        help
+        Use the BusyBox default internal TLS implementation.
+
+config FEATURE_TLS_SCHANNEL
+        bool "Schannel SSP"
+        depends on TLS && PLATFORM_MINGW32
+        help
+        Use the Schannel SSP to provide TLS support.
+        Reduces code size and enables certificate checking.
+
+endchoice
+
 config FEATURE_TLS_SHA1
         bool "In TLS code, support ciphers which use deprecated SHA1"
-        depends on TLS
+        depends on FEATURE_TLS_INTERNAL
         default n
         help
         Selecting this option increases interoperability with very old
@@ -83,6 +102,15 @@ config FEATURE_TLS_SHA1
         Most TLS servers support SHA256 today (2018), since SHA1 is
         considered possibly insecure (although not yet definitely broken).
 
+config FEATURE_TLS_SCHANNEL_1_3
+        bool "Enable TLS 1.3 support for Schannel"
+        depends on FEATURE_TLS_SCHANNEL
+        default n
+        help
+        Enable TLS 1.3 support for Schannel.
+        This only works on Windows 11/Server 2022
+        and up.
+
 INSERT
 
 source networking/udhcp/Config.in
diff --git a/networking/ftpd.c b/networking/ftpd.c
index 0d6a289c7..c3125410e 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -190,54 +190,39 @@ struct globals {
 } while (0)
 
 
+/* escape_text("pfx:", str, (0xff << 8) + '\r')
+ * Duplicate 0xff, append \r ^^^^^^^^^^^^^^^^^^
+ */
 static char *
 escape_text(const char *prepend, const char *str, unsigned escapee)
 {
-        unsigned retlen, remainlen, chunklen;
-        char *ret, *found;
+        char *ret, *p;
         char append;
 
         append = (char)escapee;
         escapee >>= 8;
 
-        remainlen = strlen(str);
-        retlen = strlen(prepend);
-        ret = xmalloc(retlen + remainlen * 2 + 1 + 1);
-        strcpy(ret, prepend);
+        ret = xmalloc(strlen(prepend) + strlen(str) * 2 + 1 + 1);
+        p = stpcpy(ret, prepend);
 
         for (;;) {
-                found = strchrnul(str, escapee);
-                chunklen = found - str + 1;
+                char *found = strchrnul(str, escapee);
 
-                /* Copy chunk up to and including escapee (or NUL) to ret */
-                memcpy(ret + retlen, str, chunklen);
-                retlen += chunklen;
+                /* Copy up to and including escapee (or NUL) */
+                p = mempcpy(p, str, found - str + 1);
 
                 if (*found == '\0') {
                         /* It wasn't escapee, it was NUL! */
-                        ret[retlen - 1] = append; /* replace NUL */
-                        ret[retlen] = '\0'; /* add NUL */
                         break;
                 }
-                ret[retlen++] = escapee; /* duplicate escapee */
                 str = found + 1;
+                *p++ = escapee; /* duplicate escapee */
         }
+        p[-1] = append; /* replace NUL */
+        *p = '\0'; /* add NUL */
         return ret;
 }
 
-/* Returns strlen as a bonus */
-static unsigned
-replace_char(char *str, char from, char to)
-{
-        char *p = str;
-        while (*p) {
-                if (*p == from)
-                        *p = to;
-                p++;
-        }
-        return p - str;
-}
-
 static void
 verbose_log(const char *str)
 {
diff --git a/networking/hostname.c b/networking/hostname.c
index 36cb70866..101b89e77 100644
--- a/networking/hostname.c
+++ b/networking/hostname.c
@@ -25,8 +25,8 @@
 //applet:IF_DNSDOMAINNAME(APPLET_NOEXEC(dnsdomainname, hostname, BB_DIR_BIN, BB_SUID_DROP, dnsdomainname))
 //applet:IF_HOSTNAME(     APPLET_NOEXEC(hostname,      hostname, BB_DIR_BIN, BB_SUID_DROP, hostname     ))
 
-//kbuild: lib-$(CONFIG_HOSTNAME) += hostname.o
-//kbuild: lib-$(CONFIG_DNSDOMAINNAME) += hostname.o
+//kbuild:lib-$(CONFIG_HOSTNAME) += hostname.o
+//kbuild:lib-$(CONFIG_DNSDOMAINNAME) += hostname.o
 
 //usage:#define hostname_trivial_usage
 //usage:       "[-sidf] [HOSTNAME | -F FILE]"
diff --git a/networking/httpd.c b/networking/httpd.c
index 1dae602ee..50595104c 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -3074,7 +3074,7 @@ int httpd_main(int argc UNUSED_PARAM, char **argv)
                 salt[0] = '$';
                 salt[1] = '1';
                 salt[2] = '$';
-                crypt_make_salt(salt + 3, 4);
+                crypt_make_rand64encoded(salt + 3, 8 / 2); /* 8 chars */
                 puts(pw_encrypt(pass, salt, /*cleanup:*/ 0));
                 return 0;
         }
diff --git a/networking/libiproute/iproute.c b/networking/libiproute/iproute.c
index cd77f642f..a30f070eb 100644
--- a/networking/libiproute/iproute.c
+++ b/networking/libiproute/iproute.c
@@ -302,24 +302,22 @@ static int FAST_FUNC print_route(const struct sockaddr_nl *who UNUSED_PARAM,
                 printf("notify ");
         }
 
-        if (r->rtm_family == AF_INET6) {
-                struct rta_cacheinfo *ci = NULL;
-                if (tb[RTA_CACHEINFO]) {
-                        ci = RTA_DATA(tb[RTA_CACHEINFO]);
-                }
-                if ((r->rtm_flags & RTM_F_CLONED) || (ci && ci->rta_expires)) {
+        if (r->rtm_family == AF_INET || r->rtm_family == AF_INET6) {
+                if (r->rtm_family == AF_INET) {
                         if (r->rtm_flags & RTM_F_CLONED) {
                                 printf("%c    cache ", _SL_);
+                                /* upstream: print_cache_flags() prints more here */
                         }
+                }
+                if (tb[RTA_CACHEINFO]) {
+                        struct rta_cacheinfo *ci = RTA_DATA(tb[RTA_CACHEINFO]);
                         if (ci->rta_expires) {
                                 printf(" expires %dsec", ci->rta_expires / get_hz());
                         }
                         if (ci->rta_error != 0) {
                                 printf(" error %d", ci->rta_error);
                         }
-                } else if (ci) {
-                        if (ci->rta_error != 0)
-                                printf(" error %d", ci->rta_error);
+                        /* upstream: print_rta_cacheinfo() prints more here */
                 }
         }
         if (tb[RTA_IIF] && G_filter.iif == 0) {
diff --git a/networking/ntpd.c b/networking/ntpd.c
index dcbdb8e60..dd0a9c91f 100644
--- a/networking/ntpd.c
+++ b/networking/ntpd.c
@@ -205,7 +205,7 @@
 #define MINDISP         0.01    /* minimum dispersion (sec) */
 #define MAXDISP         16      /* maximum dispersion (sec) */
 #define MAXSTRAT        16      /* maximum stratum (infinity metric) */
-#define MAXDIST         1       /* distance threshold (sec) */
+#define MAXDIST         3       /* distance threshold (sec): do not use peers who are farther away */
 #define MIN_SELECTED    1       /* minimum intersection survivors */
 #define MIN_CLUSTERED   3       /* minimum cluster survivors */
 
@@ -1057,7 +1057,7 @@ step_time(double offset)
         }
         tval = tvn.tv_sec;
         strftime_YYYYMMDDHHMMSS(buf, sizeof(buf), &tval);
-        bb_info_msg("setting time to %s.%06u (offset %+fs)", buf, (unsigned)tvn.tv_usec, offset);
+        bb_error_msg("setting time to %s.%06u (offset %+fs)", buf, (unsigned)tvn.tv_usec, offset);
         //maybe? G.FREQHOLD_cnt = 0;
 
         /* Correct various fields which contain time-relative values: */
@@ -1976,7 +1976,7 @@ recv_and_process_peer_pkt(peer_t *p)
 
         p->reachable_bits |= 1;
         if ((MAX_VERBOSE && G.verbose) || (option_mask32 & OPT_w)) {
-                bb_info_msg("reply from %s: offset:%+f delay:%f status:0x%02x strat:%d refid:0x%08x rootdelay:%f reach:0x%02x",
+                bb_error_msg("reply from %s: offset:%+f delay:%f status:0x%02x strat:%d refid:0x%08x rootdelay:%f reach:0x%02x",
                         p->p_dotted,
                         offset,
                         p->p_raw_delay,
diff --git a/networking/telnetd.c b/networking/telnetd.c
index bfeea1400..a5a783047 100644
--- a/networking/telnetd.c
+++ b/networking/telnetd.c
@@ -104,8 +104,8 @@
 //usage:#define telnetd_full_usage "\n\n"
 //usage:       "Handle incoming telnet connections"
 //usage:        IF_NOT_FEATURE_TELNETD_STANDALONE(" via inetd") "\n"
-//usage:     "\n        -l LOGIN        Exec LOGIN on connect"
-//usage:     "\n        -f ISSUE_FILE   Display ISSUE_FILE instead of /etc/issue"
+//usage:     "\n        -l LOGIN        Exec LOGIN on connect (default /bin/login)"
+//usage:     "\n        -f ISSUE_FILE   Display ISSUE_FILE instead of /etc/issue.net"
 //usage:     "\n        -K              Close connection as soon as login exits"
 //usage:     "\n                        (normally wait until all programs close slave pty)"
 //usage:        IF_FEATURE_TELNETD_STANDALONE(
diff --git a/networking/tftp.c b/networking/tftp.c
index f5b4367ca..b698a9288 100644
--- a/networking/tftp.c
+++ b/networking/tftp.c
@@ -250,7 +250,7 @@ static int tftp_blksize_check(const char *blksize_str, int maxsize)
                 return -1;
         }
 # if ENABLE_TFTP_DEBUG
-        bb_info_msg("using blksize %u", blksize);
+        bb_error_msg("using blksize %u", blksize);
 # endif
         return blksize;
 }
diff --git a/networking/tls.c b/networking/tls.c
index 736bce323..a28e87295 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -10,27 +10,19 @@
 //Config.src also defines FEATURE_TLS_SHA1 option
 
 //kbuild:lib-$(CONFIG_TLS) += tls.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm_montgomery_reduce.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm_mul_comba.o
-//kbuild:lib-$(CONFIG_TLS) += tls_pstm_sqr_comba.o
-//kbuild:lib-$(CONFIG_TLS) += tls_aes.o
-//kbuild:lib-$(CONFIG_TLS) += tls_aesgcm.o
-//kbuild:lib-$(CONFIG_TLS) += tls_rsa.o
-//kbuild:lib-$(CONFIG_TLS) += tls_fe.o
-//kbuild:lib-$(CONFIG_TLS) += tls_sp_c32.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm_montgomery_reduce.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm_mul_comba.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_pstm_sqr_comba.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_aes.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_aesgcm.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_rsa.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_fe.o
+//kbuild:lib-$(CONFIG_FEATURE_TLS_INTERNAL) += tls_sp_c32.o
 
 #include "tls.h"
 
-#if ENABLE_FEATURE_USE_CNG_API
-# include <windows.h>
-# include <bcrypt.h>
-
-// these work on Windows >= 10
-# define BCRYPT_HMAC_SHA1_ALG_HANDLE   ((BCRYPT_ALG_HANDLE) 0x000000a1)
-# define BCRYPT_HMAC_SHA256_ALG_HANDLE ((BCRYPT_ALG_HANDLE) 0x000000b1)
-#endif
-
+#if !ENABLE_FEATURE_TLS_SCHANNEL
 // Usually enabled. You can disable some of them to force only
 // specific ciphers to be advertized to server.
 // (this would not exclude code to handle disabled ciphers, no code size win)
@@ -197,8 +189,6 @@
 #define TLS_MAX_OUTBUF          (1 << 14)
 
 enum {
-        SHA_INSIZE     = 64,
-
         AES128_KEYSIZE = 16,
         AES256_KEYSIZE = 32,
 
@@ -344,34 +334,6 @@ void FAST_FUNC tls_get_random(void *buf, unsigned len)
                 xfunc_die();
 }
 
-static void xorbuf3(void *dst, const void *src1, const void *src2, unsigned count)
-{
-        uint8_t *d = dst;
-        const uint8_t *s1 = src1;
-        const uint8_t* s2 = src2;
-        while (count--)
-                *d++ = *s1++ ^ *s2++;
-}
-
-void FAST_FUNC xorbuf(void *dst, const void *src, unsigned count)
-{
-        xorbuf3(dst, dst, src, count);
-}
-
-void FAST_FUNC xorbuf_aligned_AES_BLOCK_SIZE(void *dst, const void *src)
-{
-        unsigned long *d = dst;
-        const unsigned long *s = src;
-        d[0] ^= s[0];
-#if ULONG_MAX <= 0xffffffffffffffff
-        d[1] ^= s[1];
- #if ULONG_MAX == 0xffffffff
-        d[2] ^= s[2];
-        d[3] ^= s[3];
- #endif
-#endif
-}
-
 #if !TLS_DEBUG_HASH
 # define hash_handshake(tls, fmt, buffer, len) \
          hash_handshake(tls, buffer, len)
@@ -402,191 +364,6 @@ static void hash_handshake(tls_state_t *tls, const char *fmt, const void *buffer
 # define TLS_MAC_SIZE(tls) (tls)->MAC_size
 #endif
 
-// RFC 2104:
-// HMAC(key, text) based on a hash H (say, sha256) is:
-// ipad = [0x36 x INSIZE]
-// opad = [0x5c x INSIZE]
-// HMAC(key, text) = H((key XOR opad) + H((key XOR ipad) + text))
-//
-// H(key XOR opad) and H(key XOR ipad) can be precomputed
-// if we often need HMAC hmac with the same key.
-//
-// text is often given in disjoint pieces.
-#if !ENABLE_FEATURE_USE_CNG_API
-typedef struct hmac_precomputed {
-        md5sha_ctx_t hashed_key_xor_ipad;
-        md5sha_ctx_t hashed_key_xor_opad;
-} hmac_precomputed_t;
-
-typedef void md5sha_begin_func(md5sha_ctx_t *ctx) FAST_FUNC;
-
-#define sha1_begin_hmac sha1_begin
-#define sha256_begin_hmac sha256_begin
-#define hmac_uninit(...) ((void)0)
-
-#if !ENABLE_FEATURE_TLS_SHA1
-#define hmac_begin(pre,key,key_size,begin) \
-        hmac_begin(pre,key,key_size)
-#define begin sha256_begin
-#endif
-
-static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size, md5sha_begin_func *begin)
-{
-        uint8_t key_xor_ipad[SHA_INSIZE];
-        uint8_t key_xor_opad[SHA_INSIZE];
-//      uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
-        unsigned i;
-
-        // "The authentication key can be of any length up to INSIZE, the
-        // block length of the hash function.  Applications that use keys longer
-        // than INSIZE bytes will first hash the key using H and then use the
-        // resultant OUTSIZE byte string as the actual key to HMAC."
-        if (key_size > SHA_INSIZE) {
-                bb_simple_error_msg_and_die("HMAC key>64"); //does not happen (yet?)
-//              md5sha_ctx_t ctx;
-//              begin(&ctx);
-//              md5sha_hash(&ctx, key, key_size);
-//              key_size = sha_end(&ctx, tempkey);
-//              //key = tempkey; - right? RIGHT? why does it work without this?
-//              // because SHA_INSIZE is 64, but hmac() is always called with
-//              // key_size = tls->MAC_size = SHA1/256_OUTSIZE (20 or 32),
-//              // and prf_hmac_sha256() -> hmac_sha256() key sizes are:
-//              // - RSA_PREMASTER_SIZE is 48
-//              // - CURVE25519_KEYSIZE is 32
-//              // - master_secret[] is 48
-        }
-
-        for (i = 0; i < key_size; i++) {
-                key_xor_ipad[i] = key[i] ^ 0x36;
-                key_xor_opad[i] = key[i] ^ 0x5c;
-        }
-        for (; i < SHA_INSIZE; i++) {
-                key_xor_ipad[i] = 0x36;
-                key_xor_opad[i] = 0x5c;
-        }
-
-        begin(&pre->hashed_key_xor_ipad);
-        begin(&pre->hashed_key_xor_opad);
-        md5sha_hash(&pre->hashed_key_xor_ipad, key_xor_ipad, SHA_INSIZE);
-        md5sha_hash(&pre->hashed_key_xor_opad, key_xor_opad, SHA_INSIZE);
-}
-#undef begin
-
-static unsigned hmac_sha_precomputed_v(
-                hmac_precomputed_t *pre,
-                uint8_t *out,
-                va_list va)
-{
-        uint8_t *text;
-        unsigned len;
-
-        /* pre->hashed_key_xor_ipad contains unclosed "H((key XOR ipad) +" state */
-        /* pre->hashed_key_xor_opad contains unclosed "H((key XOR opad) +" state */
-
-        /* calculate out = H((key XOR ipad) + text) */
-        while ((text = va_arg(va, uint8_t*)) != NULL) {
-                unsigned text_size = va_arg(va, unsigned);
-                md5sha_hash(&pre->hashed_key_xor_ipad, text, text_size);
-        }
-        len = sha_end(&pre->hashed_key_xor_ipad, out);
-
-        /* out = H((key XOR opad) + out) */
-        md5sha_hash(&pre->hashed_key_xor_opad, out, len);
-        return sha_end(&pre->hashed_key_xor_opad, out);
-}
-#else
-#define sha1_begin_hmac BCRYPT_HMAC_SHA1_ALG_HANDLE
-#define sha256_begin_hmac BCRYPT_HMAC_SHA256_ALG_HANDLE
-
-#if !ENABLE_FEATURE_TLS_SHA1
-#define hmac_begin(pre,key,key_size,begin) _hmac_begin(pre, key, key_size, sha256_begin_hmac)
-#else
-#define hmac_begin _hmac_begin
-#endif
-
-typedef struct bcrypt_hash_ctx_t hmac_precomputed_t;
-
-static void _hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size, BCRYPT_ALG_HANDLE alg_handle) {
-        DWORD hash_object_length = 0;
-        ULONG _unused;
-        NTSTATUS status;
-
-        status = BCryptGetProperty(alg_handle, BCRYPT_OBJECT_LENGTH, (PUCHAR)&hash_object_length, sizeof(DWORD), &_unused, 0);
-        mingw_die_if_error(status, "BCryptGetProperty");
-        status = BCryptGetProperty(alg_handle, BCRYPT_HASH_LENGTH, (PUCHAR)&pre->output_size, sizeof(DWORD), &_unused, 0);
-        mingw_die_if_error(status, "BCryptGetProperty");
-
-
-        pre->hash_obj = xmalloc(hash_object_length);
-
-        status = BCryptCreateHash(alg_handle, &pre->handle, pre->hash_obj, hash_object_length, key, key_size, BCRYPT_HASH_REUSABLE_FLAG);
-        mingw_die_if_error(status, "BCryptCreateHash");
-}
-
-static unsigned hmac_sha_precomputed_v(
-                hmac_precomputed_t *pre,
-                uint8_t *out,
-                va_list va)
-{
-        uint8_t *text;
-        NTSTATUS status;
-
-        while ((text = va_arg(va, uint8_t*)) != NULL) {
-                unsigned text_size = va_arg(va, unsigned);
-                /*status = */ BCryptHashData(pre->handle, text, text_size, 0);
-                //mingw_die_if_error(status, "BCryptHashData");
-        }
-
-        status = BCryptFinishHash(pre->handle, out, pre->output_size, 0);
-        mingw_die_if_error(status, "BCryptFinishHash");
-
-        return pre->output_size;
-}
-
-static void hmac_uninit(hmac_precomputed_t *pre) {
-        BCryptDestroyHash(pre->handle);
-        free(pre->hash_obj);
-}
-
-#endif
-
-static unsigned hmac_sha_precomputed(hmac_precomputed_t *pre_init, uint8_t *out, ...)
-{
-        hmac_precomputed_t pre;
-        va_list va;
-        unsigned len;
-
-        va_start(va, out);
-        pre = *pre_init; /* struct copy */
-        len = hmac_sha_precomputed_v(&pre, out, va);
-        va_end(va);
-        return len;
-}
-
-#if !ENABLE_FEATURE_TLS_SHA1
-#define hmac(tls,out,key,key_size,...) \
-        hmac(out,key,key_size, __VA_ARGS__)
-#endif
-static unsigned hmac(tls_state_t *tls, uint8_t *out, uint8_t *key, unsigned key_size, ...)
-{
-        hmac_precomputed_t pre;
-        va_list va;
-        unsigned len;
-
-        va_start(va, key_size);
-
-        hmac_begin(&pre, key, key_size,
-                        (ENABLE_FEATURE_TLS_SHA1 && tls->MAC_size == SHA1_OUTSIZE)
-                                ? sha1_begin_hmac
-                                : sha256_begin_hmac
-        );
-        len = hmac_sha_precomputed_v(&pre, out, va);
-
-        va_end(va);
-        hmac_uninit(&pre);
-        return len;
-}
-
 // RFC 5246:
 // 5.  HMAC and the Pseudorandom Function
 //...
@@ -631,7 +408,7 @@ static void prf_hmac_sha256(/*tls_state_t *tls,*/
                 const char *label,
                 uint8_t *seed, unsigned seed_size)
 {
-        hmac_precomputed_t pre;
+        hmac_ctx_t ctx;
         uint8_t a[TLS_MAX_MAC_SIZE];
         uint8_t *out_p = outbuf;
         unsigned label_size = strlen(label);
@@ -641,29 +418,28 @@ static void prf_hmac_sha256(/*tls_state_t *tls,*/
 #define SEED   label, label_size, seed, seed_size
 #define A      a, MAC_size
 
-        hmac_begin(&pre, secret, secret_size, sha256_begin_hmac);
+        hmac_begin(&ctx, secret, secret_size, sha256_begin_hmac);
 
         /* A(1) = HMAC_hash(secret, seed) */
-        hmac_sha_precomputed(&pre, a, SEED, NULL);
+        hmac_peek_hash(&ctx, a, SEED, NULL);
 
         for (;;) {
                 /* HMAC_hash(secret, A(1) + seed) */
                 if (outbuf_size <= MAC_size) {
                         /* Last, possibly incomplete, block */
                         /* (use a[] as temp buffer) */
-                        hmac_sha_precomputed(&pre, a, A, SEED, NULL);
+                        hmac_peek_hash(&ctx, a, A, SEED, NULL);
                         memcpy(out_p, a, outbuf_size);
+                        hmac_uninit(&ctx);
                         return;
                 }
                 /* Not last block. Store directly to result buffer */
-                hmac_sha_precomputed(&pre, out_p, A, SEED, NULL);
+                hmac_peek_hash(&ctx, out_p, A, SEED, NULL);
                 out_p += MAC_size;
                 outbuf_size -= MAC_size;
                 /* A(2) = HMAC_hash(secret, A(1)) */
-                hmac_sha_precomputed(&pre, a, A, NULL);
+                hmac_peek_hash(&ctx, a, A, NULL);
         }
-
-        hmac_uninit(&pre);
 #undef A
 #undef SECRET
 #undef SEED
@@ -729,6 +505,32 @@ static void *tls_get_zeroed_outbuf(tls_state_t *tls, int len)
         return record;
 }
 
+/* Calculate the HMAC over the list of blocks */
+#if !ENABLE_FEATURE_TLS_SHA1
+#define hmac_blocks(tls,out,key,key_size,...) \
+        hmac_blocks(out,key,key_size, __VA_ARGS__)
+#endif
+static unsigned hmac_blocks(tls_state_t *tls, uint8_t *out, uint8_t *key, unsigned key_size, ...)
+{
+        hmac_ctx_t ctx;
+        va_list va;
+        unsigned len;
+
+        hmac_begin(&ctx, key, key_size,
+                        (ENABLE_FEATURE_TLS_SHA1 && tls->MAC_size == SHA1_OUTSIZE)
+                                ? sha1_begin_hmac
+                                : sha256_begin_hmac
+        );
+
+        va_start(va, key_size);
+        hmac_hash_v(&ctx, va);
+        va_end(va);
+
+        len = hmac_end(&ctx, out);
+        hmac_uninit(&ctx);
+        return len;
+}
+
 static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, unsigned type)
 {
         uint8_t *buf = tls->outbuf + OUTBUF_PFX;
@@ -750,7 +552,7 @@ static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, un
         xhdr->len16_lo = size & 0xff;
 
         /* Calculate MAC signature */
-        hmac(tls, buf + size, /* result */
+        hmac_blocks(tls, buf + size, /* result */
                 tls->client_write_MAC_key, TLS_MAC_SIZE(tls),
                 &tls->write_seq64_be, sizeof(tls->write_seq64_be),
                 xhdr, RECHDR_LEN,
@@ -939,8 +741,13 @@ static void xwrite_encrypted_aesgcm(tls_state_t *tls, unsigned size, unsigned ty
                 cnt++;
                 COUNTER(nonce) = htonl(cnt); /* yes, first cnt here is 2 (!) */
                 aes_encrypt_one_block(&tls->aes_encrypt, nonce, scratch);
-                n = remaining > AES_BLOCK_SIZE ? AES_BLOCK_SIZE : remaining;
-                xorbuf(buf, scratch, n);
+                if (remaining >= AES_BLOCK_SIZE) {
+                        n = AES_BLOCK_SIZE;
+                        xorbuf_AES_BLOCK_SIZE(buf, scratch);
+                } else {
+                        n = remaining;
+                        xorbuf(buf, scratch, n);
+                }
                 buf += n;
                 remaining -= n;
         }
@@ -1098,7 +905,7 @@ static void tls_aesgcm_decrypt(tls_state_t *tls, uint8_t *buf, int size)
                 COUNTER(nonce) = htonl(cnt); /* yes, first cnt here is 2 (!) */
                 aes_encrypt_one_block(&tls->aes_decrypt, nonce, scratch);
                 n = remaining > AES_BLOCK_SIZE ? AES_BLOCK_SIZE : remaining;
-                xorbuf3(buf, scratch, buf + 8, n);
+                xorbuf_3(buf, scratch, buf + 8, n);
                 buf += n;
                 remaining -= n;
         }
@@ -2555,3 +2362,475 @@ void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags)
                 }
         }
 }
+#else
+
+#if ENABLE_FEATURE_TLS_SCHANNEL_1_3
+#include <subauth.h>
+#endif
+
+#define SCHANNEL_USE_BLACKLISTS
+
+#include <security.h>
+#include <schannel.h>
+
+
+#define BB_SCHANNEL_ISC_FLAGS                                                                                             \
+    (ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_REPLAY_DETECT |                   \
+     ISC_REQ_SEQUENCE_DETECT | ISC_REQ_STREAM | ISC_REQ_USE_SUPPLIED_CREDS)
+
+static char *hresult_to_error_string(HRESULT result) {
+        char *output = NULL;
+
+        FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM
+                                   | FORMAT_MESSAGE_IGNORE_INSERTS |
+                                   FORMAT_MESSAGE_MAX_WIDTH_MASK, NULL, result,
+                                   MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+                                   (char *) &output, 0, NULL);
+        return output;
+}
+
+static void init_sec_buffer(SecBuffer *buffer, void *pvBuffer, unsigned long cbBuffer, unsigned long BufferType) {
+    buffer->BufferType = BufferType;
+    buffer->cbBuffer = cbBuffer;
+    buffer->pvBuffer = pvBuffer;
+}
+
+static void init_sec_buffer_empty(SecBuffer *buffer, unsigned long BufferType) {
+    init_sec_buffer(buffer, NULL, 0, BufferType);
+}
+
+static void init_sec_buffer_desc(SecBufferDesc *desc, SecBuffer *buffers, unsigned long buffer_count) {
+    desc->ulVersion = SECBUFFER_VERSION;
+    desc->cBuffers = buffer_count;
+    desc->pBuffers = buffers;
+}
+
+static ssize_t tls_read(struct tls_state *state, char *buf, ssize_t len) {
+        ssize_t amount_read = 0;
+
+        if (state->closed) {
+                return 0;
+        }
+
+        while (len > 0) {
+                if (state->out_buffer && (state->out_buffer_size > 0)) {
+                        unsigned long copy_amount =
+                                min(len, (ssize_t) state->out_buffer_size);
+                        memcpy(buf, state->out_buffer, copy_amount);
+
+                        amount_read += copy_amount;
+                        buf += copy_amount;
+                        len -= copy_amount;
+
+                        if (copy_amount == state->out_buffer_size) {
+                                // We've used all the decrypted data
+                                // Move extra data to the front
+                                memmove(state->in_buffer,
+                                                state->in_buffer + state->out_buffer_used,
+                                                state->in_buffer_size - state->out_buffer_used);
+                                state->in_buffer_size -= state->out_buffer_used;
+
+                                state->out_buffer = NULL;
+                                state->out_buffer_used = 0;
+                                state->out_buffer_size = 0;
+                        } else {
+                                state->out_buffer_size -= copy_amount;
+                                state->out_buffer += copy_amount;
+                        }
+                } else {
+                        SECURITY_STATUS status;
+                        int received;
+
+            SecBuffer buffers[4];
+            SecBufferDesc desc;
+            
+            init_sec_buffer(&buffers[0], state->in_buffer, state->in_buffer_size, SECBUFFER_DATA);
+            init_sec_buffer_empty(&buffers[1], SECBUFFER_EMPTY);
+            init_sec_buffer_empty(&buffers[2], SECBUFFER_EMPTY);
+            init_sec_buffer_empty(&buffers[3], SECBUFFER_EMPTY);
+
+            init_sec_buffer_desc(&desc, buffers, _countof(buffers));
+
+                        status = DecryptMessage(&state->ctx_handle, &desc, 0, NULL);
+
+                        switch (status) {
+                        case SEC_E_OK:{
+                                state->out_buffer = buffers[1].pvBuffer;
+                                state->out_buffer_size = buffers[1].cbBuffer;
+
+                                state->out_buffer_used = state->in_buffer_size;
+                                if (buffers[3].BufferType == SECBUFFER_EXTRA) {
+                                        state->out_buffer_used -= buffers[3].cbBuffer;
+                                }
+
+                                continue;
+                        }
+                        case SEC_I_CONTEXT_EXPIRED:{
+                                state->closed = 1;
+                                goto Success;
+                        }
+                        case SEC_I_RENEGOTIATE:{
+                                // Renegotiate the TLS connection.
+                                // Microsoft repurposed this flag
+                                // for TLS 1.3 support.
+                                int i;
+                                DWORD flags = BB_SCHANNEL_ISC_FLAGS;
+
+                SecBuffer in_buffers[2];
+                SecBuffer out_buffers[2];
+
+                SecBufferDesc in_desc;
+                SecBufferDesc out_desc;
+
+                                for (i = 0; i < 4; i++) {
+                                        if (buffers[i].BufferType == SECBUFFER_EXTRA)
+                                                break;
+                                }
+                                
+                init_sec_buffer(&in_buffers[0], buffers[i].pvBuffer, buffers[i].cbBuffer, SECBUFFER_TOKEN);
+                init_sec_buffer_empty(&in_buffers[1], SECBUFFER_EMPTY);
+
+                init_sec_buffer_empty(&out_buffers[0], SECBUFFER_TOKEN);
+                init_sec_buffer_empty(&out_buffers[1], SECBUFFER_ALERT);
+
+                init_sec_buffer_desc(&in_desc, in_buffers, _countof(in_buffers));
+                init_sec_buffer_desc(&out_desc, out_buffers, _countof(out_buffers));
+
+                                status = InitializeSecurityContext(&state->cred_handle,
+                                                                                                   state->initialized ?
+                                                                                                   &state->ctx_handle : NULL,
+                                                                                                   state->initialized ? NULL :
+                                                                                                   state->hostname, flags, 0,
+                                                                                                   0,
+                                                                                                   state->initialized ?
+                                                                                                   &in_desc : NULL, 0,
+                                                                                                   &state->ctx_handle,
+                                                                                                   &out_desc, &flags, 0);
+
+                                if (status != SEC_E_OK) {
+                                        bb_error_msg_and_die("schannel: renegotiate failed: (0x%08lx): %s",
+                                                 status, hresult_to_error_string(status));
+                                }
+
+                                if (in_buffers[1].BufferType == SECBUFFER_EXTRA) {
+                                        memmove(state->in_buffer,
+                                                        state->in_buffer + (state->in_buffer_size -
+                                                                                                in_buffers[1].cbBuffer),
+                                                        in_buffers[1].cbBuffer);
+                                }
+
+                                state->out_buffer_used =
+                                        state->in_buffer_size - in_buffers[1].cbBuffer;
+                                state->in_buffer_size = in_buffers[1].cbBuffer;
+
+                                continue;
+                        }
+                        case SEC_E_INCOMPLETE_MESSAGE:{
+                                break;
+                        }
+                        default:{
+                                bb_error_msg_and_die("schannel: DecryptMessage failed: (0x%08lx): %s", status,
+                                         hresult_to_error_string(status));
+                        }
+                        }
+
+                        received =
+                                safe_read(state->ifd,
+                                                  state->in_buffer + state->in_buffer_size,
+                                                  sizeof(state->in_buffer) - state->in_buffer_size);
+                        if (received == 0) {
+                                state->closed = 1;
+                                goto Success;
+                        } else if (received < 0) {
+                                bb_error_msg_and_die("schannel: read() failed");
+                        }
+
+                        state->in_buffer_size += received;
+                }
+        }
+
+  Success:
+        return amount_read;
+}
+
+static void tls_write(struct tls_state *state, char *buf, size_t len) {
+        if (state->closed) {
+                bb_error_msg_and_die("schannel: attempted to write to a closed connection");
+        }
+
+        while (len > 0) {
+                unsigned long copy_amount =
+                        min(len, (size_t) state->stream_sizes.cbMaximumMessage);
+                char *write_buffer = _alloca(sizeof(state->in_buffer));
+
+                SECURITY_STATUS status;
+
+        SecBuffer buffers[4];
+        SecBufferDesc desc;
+
+        init_sec_buffer(&buffers[0], write_buffer, state->stream_sizes.cbHeader, SECBUFFER_STREAM_HEADER);
+        init_sec_buffer(&buffers[1], write_buffer + state->stream_sizes.cbHeader, copy_amount, SECBUFFER_DATA);
+        init_sec_buffer(&buffers[2], write_buffer + state->stream_sizes.cbHeader + copy_amount, state->stream_sizes.cbTrailer, SECBUFFER_STREAM_TRAILER);
+        init_sec_buffer_empty(&buffers[3], SECBUFFER_EMPTY);
+
+        init_sec_buffer_desc(&desc, buffers, _countof(buffers));
+
+        memcpy(buffers[1].pvBuffer,  buf, copy_amount);
+
+                status = EncryptMessage(&state->ctx_handle, 0, &desc, 0);
+                if (status != SEC_E_OK) {
+                        bb_error_msg_and_die("schannel: EncryptMessage failed: (0x%08lx): %s", status,
+                                 hresult_to_error_string(status));
+                }
+
+                xwrite(state->ofd, write_buffer,
+                           buffers[0].cbBuffer + buffers[1].cbBuffer +
+                           buffers[2].cbBuffer);
+
+                len -= copy_amount;
+        }
+}
+
+static void tls_disconnect(tls_state_t * state) {
+        SECURITY_STATUS status;
+        DWORD token = SCHANNEL_SHUTDOWN;
+        DWORD flags = BB_SCHANNEL_ISC_FLAGS;
+
+        SecBuffer buf_token;
+
+        SecBufferDesc buf_token_desc;
+
+        SecBuffer in_buffers[2];
+        SecBuffer out_buffers[2];
+
+        SecBufferDesc in_desc;
+        SecBufferDesc out_desc;
+
+    init_sec_buffer(&buf_token, &token, sizeof(token), SECBUFFER_TOKEN);
+    init_sec_buffer_desc(&buf_token_desc, &buf_token, 1);
+
+        ApplyControlToken(&state->ctx_handle, &buf_token_desc);
+
+        // attempt to send any final data
+    init_sec_buffer(&in_buffers[0], state->in_buffer, state->in_buffer_size, SECBUFFER_TOKEN);
+    init_sec_buffer_empty(&in_buffers[1], SECBUFFER_EMPTY);
+
+    init_sec_buffer_empty(&out_buffers[0], SECBUFFER_TOKEN);
+    init_sec_buffer_empty(&out_buffers[1], SECBUFFER_ALERT);
+
+    init_sec_buffer_desc(&in_desc, in_buffers, _countof(in_buffers));
+    init_sec_buffer_desc(&out_desc, out_buffers, _countof(out_buffers));
+
+        status = InitializeSecurityContext(&state->cred_handle,
+                                                                           state->
+                                                                           initialized ? &state->ctx_handle :
+                                                                           NULL,
+                                                                           state->
+                                                                           initialized ? NULL : state->hostname,
+                                                                           flags, 0, 0,
+                                                                           state->initialized ? &in_desc : NULL,
+                                                                           0,
+                                                                           &state->ctx_handle, &out_desc, &flags,
+                                                                           0);
+
+        if ((status == SEC_E_OK) || (status == SEC_I_CONTEXT_EXPIRED)) {
+                // send the final shutdown message
+                write(state->ofd, out_buffers[0].pvBuffer, out_buffers[0].cbBuffer);
+                FreeContextBuffer(out_buffers[0].pvBuffer);
+        }
+
+        DeleteSecurityContext(&state->ctx_handle);
+        FreeCredentialsHandle(&state->cred_handle);
+        free(state->hostname);
+}
+
+
+void FAST_FUNC tls_handshake(tls_state_t * state, const char *hostname) {
+        SECURITY_STATUS status;
+        int received;
+
+#if ENABLE_FEATURE_TLS_SCHANNEL_1_3
+        SCH_CREDENTIALS credential = {.dwVersion = SCH_CREDENTIALS_VERSION,
+                .dwCredFormat = 0,
+                .cCreds = 0,
+                .paCred = NULL,
+                .hRootStore = NULL,
+                .cMappers = 0,
+                .aphMappers = NULL,
+                .dwSessionLifespan = 0,
+                .dwFlags =
+                        SCH_CRED_AUTO_CRED_VALIDATION | SCH_CRED_NO_DEFAULT_CREDS |
+                        SCH_USE_STRONG_CRYPTO,
+                .cTlsParameters = 0,
+                .pTlsParameters = NULL
+        };
+#else
+        SCHANNEL_CRED credential = {.dwVersion = SCHANNEL_CRED_VERSION,
+                .cCreds = 0,
+                .paCred = NULL,
+                .hRootStore = NULL,
+                .cMappers = 0,
+                .aphMappers = NULL,
+                .cSupportedAlgs = 0,
+                .palgSupportedAlgs = NULL,
+                .grbitEnabledProtocols =
+                        SP_PROT_TLS1_0_CLIENT | SP_PROT_TLS1_1_CLIENT |
+                        SP_PROT_TLS1_2_CLIENT,
+                .dwMinimumCipherStrength = 0,
+                .dwMaximumCipherStrength = 0,
+                .dwSessionLifespan = 0,
+                .dwFlags =
+                        SCH_CRED_AUTO_CRED_VALIDATION | SCH_CRED_NO_DEFAULT_CREDS |
+                        SCH_USE_STRONG_CRYPTO,
+                .dwCredFormat = 0
+        };
+#endif
+
+        if ((status = AcquireCredentialsHandleA(NULL, (SEC_CHAR *) UNISP_NAME_A,
+                                                                                        SECPKG_CRED_OUTBOUND, NULL,
+                                                                                        &credential,
+                                                                                        NULL, NULL, &state->cred_handle,
+                                                                                        NULL)) != SEC_E_OK) {
+                bb_error_msg_and_die("schannel: AcquireCredentialsHandleA failed: (0x%08lx): %s",
+                         status, hresult_to_error_string(status));
+        }
+
+        state->in_buffer_size = 0;
+        state->out_buffer_size = 0;
+        state->out_buffer_used = 0;
+
+        state->out_buffer = NULL;
+
+        state->hostname = strdup(hostname);
+
+        state->initialized = 0;
+        state->closed = 0;
+
+        while (1) {
+                DWORD flags = BB_SCHANNEL_ISC_FLAGS;
+
+                SecBuffer in_buffers[2];
+                SecBuffer out_buffers[2];
+
+                SecBufferDesc in_desc;
+                SecBufferDesc out_desc;
+
+                init_sec_buffer(&in_buffers[0], state->in_buffer, state->in_buffer_size, SECBUFFER_TOKEN);
+                init_sec_buffer_empty(&in_buffers[1], SECBUFFER_EMPTY);
+
+                init_sec_buffer_empty(&out_buffers[0], SECBUFFER_TOKEN);
+                init_sec_buffer_empty(&out_buffers[1], SECBUFFER_ALERT);
+
+                init_sec_buffer_desc(&in_desc, in_buffers, _countof(in_buffers));
+                init_sec_buffer_desc(&out_desc, out_buffers, _countof(out_buffers));
+
+                status = InitializeSecurityContext(&state->cred_handle,
+                                                                                   state->
+                                                                                   initialized ? &state->ctx_handle :
+                                                                                   NULL,
+                                                                                   state->
+                                                                                   initialized ? NULL :
+                                                                                   state->hostname, flags, 0, 0,
+                                                                                   state->initialized ? &in_desc :
+                                                                                   NULL, 0,
+                                                                                   &state->ctx_handle, &out_desc,
+                                                                                   &flags, 0);
+
+                state->initialized = 1;
+
+                if (in_buffers[1].BufferType == SECBUFFER_EXTRA) {
+                        memmove(state->in_buffer,
+                                        state->in_buffer + (state->in_buffer_size -
+                                                                                in_buffers[1].cbBuffer),
+                                        in_buffers[1].cbBuffer);
+                        state->in_buffer_size = in_buffers[1].cbBuffer;
+                } else if (status != SEC_E_INCOMPLETE_MESSAGE) {
+                        state->in_buffer_size = 0;
+                }
+
+                switch (status) {
+                case SEC_E_OK:{
+                        if (out_buffers[0].cbBuffer > 0) {
+                                xwrite(state->ofd, out_buffers[0].pvBuffer,
+                                           out_buffers[0].cbBuffer);
+                                FreeContextBuffer(out_buffers[0].pvBuffer);
+                        }
+                        goto Success;
+                }
+                case SEC_I_CONTINUE_NEEDED:{
+                        xwrite(state->ofd, out_buffers[0].pvBuffer,
+                                   out_buffers[0].cbBuffer);
+                        FreeContextBuffer(out_buffers[0].pvBuffer);
+                        break;
+                }
+                case SEC_I_INCOMPLETE_CREDENTIALS:{
+                        // we don't support this
+                        bb_error_msg_and_die("schannel: client certificates not supported");
+                }
+                case SEC_E_INCOMPLETE_MESSAGE:{
+                        break;
+                }
+                default:{
+                        bb_error_msg_and_die("schannel: handshake failed: (0x%08lx): %s",
+                                                                 status, hresult_to_error_string(status));
+                }
+                }
+
+                received =
+                        safe_read(state->ifd, state->in_buffer + state->in_buffer_size,
+                                          sizeof(state->in_buffer) - state->in_buffer_size);
+                if (received <= 0) {
+                        bb_error_msg_and_die("schannel: handshake read() failed");
+                }
+                state->in_buffer_size += received;
+        }
+
+  Success:
+        QueryContextAttributes(&state->ctx_handle, SECPKG_ATTR_STREAM_SIZES,
+                                                   &state->stream_sizes);
+
+        //SecPkgContext_ConnectionInfo info;
+        //QueryContextAttributes(&state->ctx_handle, SECPKG_ATTR_CONNECTION_INFO,
+        //                                         &info);
+    //
+        //fprintf(stderr, "TLS 1.%d\n", (((uint32_t)(8 * sizeof(unsigned long long) - __builtin_clzll((info.dwProtocol)) - 1)) - 7)/2);
+}
+
+void FAST_FUNC tls_run_copy_loop(tls_state_t * tls, unsigned flags) {
+        char buffer[65536];
+
+        struct pollfd pfds[2];
+
+        pfds[0].fd = STDIN_FILENO;
+        pfds[0].events = POLLIN;
+        pfds[1].fd = tls->ifd;
+        pfds[1].events = POLLIN;
+
+        for (;;) {
+                int nread;
+
+                if (safe_poll(pfds, 2, -1) < 0)
+                        bb_simple_perror_msg_and_die("poll");
+
+                if (pfds[0].revents) {
+                        nread = safe_read(STDIN_FILENO, buffer, sizeof(buffer));
+                        if (nread < 1) {
+                                pfds[0].fd = -1;
+                                tls_disconnect(tls);
+                                if (flags & TLSLOOP_EXIT_ON_LOCAL_EOF)
+                                        break;
+                        } else {
+                                tls_write(tls, buffer, nread);
+                        }
+                }
+                if (pfds[1].revents) {
+                        nread = tls_read(tls, buffer, sizeof(buffer));
+                        if (nread < 1) {
+                                tls_disconnect(tls);
+                                break;
+                        }
+                        xwrite(STDOUT_FILENO, buffer, nread);
+                }
+        }
+}
+#endif
diff --git a/networking/tls.h b/networking/tls.h
index 0173b87b2..eee5a7617 100644
--- a/networking/tls.h
+++ b/networking/tls.h
@@ -11,6 +11,7 @@
 #include "libbb.h"
 
 
+#if !ENABLE_FEATURE_TLS_SCHANNEL
 /* Config tweaks */
 #define HAVE_NATIVE_INT64
 #undef  USE_1024_KEY_SPEED_OPTIMIZATIONS
@@ -82,10 +83,9 @@ typedef  int16_t  int16;
 
 void tls_get_random(void *buf, unsigned len) FAST_FUNC;
 
-void xorbuf(void* buf, const void* mask, unsigned count) FAST_FUNC;
-
 #define ALIGNED_long ALIGNED(sizeof(long))
-void xorbuf_aligned_AES_BLOCK_SIZE(void* buf, const void* mask) FAST_FUNC;
+#define xorbuf_aligned_AES_BLOCK_SIZE(dst,src) xorbuf16_aligned_long(dst,src)
+#define xorbuf_AES_BLOCK_SIZE(dst,src)         xorbuf16(dst,src)
 
 #define matrixCryptoGetPrngData(buf, len, userPtr) (tls_get_random(buf, len), PS_SUCCESS)
 
@@ -120,3 +120,4 @@ void curve_P256_compute_pubkey_and_premaster(
 void curve_P256_compute_pubkey_and_premaster_NEW(
                 uint8_t *pubkey2x32, uint8_t *premaster32,
                 const uint8_t *peerkey2x32) FAST_FUNC;
+#endif
diff --git a/networking/tls_aesgcm.c b/networking/tls_aesgcm.c
index 5ddcdd2ad..9c2381a57 100644
--- a/networking/tls_aesgcm.c
+++ b/networking/tls_aesgcm.c
@@ -167,10 +167,7 @@ void FAST_FUNC aesgcm_GHASH(byte* h,
         blocks = cSz / AES_BLOCK_SIZE;
         partial = cSz % AES_BLOCK_SIZE;
         while (blocks--) {
-            if (BB_UNALIGNED_MEMACCESS_OK) // c is not guaranteed to be aligned
-                xorbuf_aligned_AES_BLOCK_SIZE(x, c);
-            else
-                xorbuf(x, c, AES_BLOCK_SIZE);
+            xorbuf_AES_BLOCK_SIZE(x, c);
             GMULT(x, h);
             c += AES_BLOCK_SIZE;
         }
diff --git a/procps/pmap.c b/procps/pmap.c
index 49f7688d9..3069856a4 100644
--- a/procps/pmap.c
+++ b/procps/pmap.c
@@ -29,10 +29,14 @@
 
 #if ULLONG_MAX == 0xffffffff
 # define TABS "\t"
+# define SIZEWIDTHx "7"
+# define SIZEWIDTH  "9"
 # define AFMTLL "8"
 # define DASHES ""
 #else
 # define TABS "\t\t"
+# define SIZEWIDTHx "15"
+# define SIZEWIDTH  "17"
 # define AFMTLL "16"
 # define DASHES "--------"
 #endif
@@ -42,49 +46,145 @@ enum {
         OPT_q = 1 << 1,
 };
 
-static void print_smaprec(struct smaprec *currec, void *data)
-{
-        unsigned opt = (uintptr_t)data;
+struct smaprec {
+        // For mixed 32/64 userspace, 32-bit pmap still needs
+        // 64-bit field here to correctly show 64-bit processes:
+        unsigned long long smap_start;
+        // Make size wider too:
+        // I've seen 1203765248 kb large "---p" mapping in a browser,
+        // this cuts close to 4 terabytes.
+        unsigned long long smap_size;
+        // (strictly speaking, other fields need to be wider too,
+        // but they are in kbytes, not bytes, and they hold sizes,
+        // not start addresses, sizes tend to be less than 4 terabytes)
+        unsigned long private_dirty;
+        unsigned long smap_pss, smap_swap;
+        char smap_mode[5];
+        char *smap_name;
+};
 
+// How long the filenames and command lines we want to handle?
+#define PMAP_BUFSZ 4096
+
+static void print_smaprec(struct smaprec *currec)
+{
         printf("%0" AFMTLL "llx ", currec->smap_start);
 
-        if (opt & OPT_x)
-                printf("%7lu %7lu %7lu %7lu ",
+        if (option_mask32 & OPT_x)
+                printf("%7llu %7lu %7lu %7lu ",
                         currec->smap_size,
                         currec->smap_pss,
                         currec->private_dirty,
                         currec->smap_swap);
         else
-                printf("%7luK", currec->smap_size);
+                printf("%7lluK", currec->smap_size);
 
-        printf(" %.4s  %s\n", currec->smap_mode, currec->smap_name);
+        printf(" %.4s  %s\n", currec->smap_mode, currec->smap_name ? : "  [ anon ]");
+}
+
+/* libbb's procps_read_smaps() looks somewhat similar,
+ * but the collected information is sufficiently different
+ * that merging them into one function is not a good idea
+ * (unless you feel masochistic today).
+ */
+static int read_smaps(pid_t pid, char buf[PMAP_BUFSZ], struct smaprec *total)
+{
+        FILE *file;
+        struct smaprec currec;
+        char filename[sizeof("/proc/%u/smaps") + sizeof(int)*3];
+
+        sprintf(filename, "/proc/%u/smaps", (int)pid);
+
+        file = fopen_for_read(filename);
+        if (!file)
+                return 1;
+
+        memset(&currec, 0, sizeof(currec));
+        while (fgets(buf, PMAP_BUFSZ, file)) {
+                // Each mapping datum has this form:
+                // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
+                // Size:                nnn kB
+                // Rss:                 nnn kB
+                // .....
+
+                char *tp, *p;
+
+                if (buf[0] == 'S' || buf[0] == 'P') {
+#define SCAN(S, X) \
+                        if (memcmp(buf, S, sizeof(S)-1) == 0) { \
+                                tp = skip_whitespace(buf + sizeof(S)-1); \
+                                total->X += currec.X = fast_strtoul_10(&tp); \
+                                continue; \
+                        }
+                        SCAN("Pss:"          , smap_pss     );
+                        SCAN("Swap:"         , smap_swap    );
+                        SCAN("Private_Dirty:", private_dirty);
+#undef SCAN
+                }
+                tp = strchr(buf, '-');
+                if (tp) {
+                        // We reached next mapping - the line of this form:
+                        // f7d29000-f7d39000 rw-s FILEOFS M:m INODE FILENAME
+
+                        // If we have a previous record, there's nothing more
+                        // for it, print and clear currec
+                        if (currec.smap_size)
+                                print_smaprec(&currec);
+                        free(currec.smap_name);
+                        memset(&currec, 0, sizeof(currec));
+
+                        *tp = ' ';
+                        tp = buf;
+                        currec.smap_start = fast_strtoull_16(&tp);
+                        currec.smap_size = (fast_strtoull_16(&tp) - currec.smap_start) >> 10;
+                        strncpy(currec.smap_mode, tp, sizeof(currec.smap_mode)-1);
+
+                        // skipping "rw-s FILEOFS M:m INODE "
+                        tp = skip_fields(tp, 4);
+                        tp = skip_whitespace(tp); // there may be many spaces, can't just "tp++"
+                        p = strchrnul(tp, '\n');
+                        if (p != tp) {
+                                currec.smap_name = xstrndup(tp, p - tp);
+                        }
+                        total->smap_size += currec.smap_size;
+                }
+        } // while (got line)
+        fclose(file);
+
+        if (currec.smap_size)
+                print_smaprec(&currec);
+        free(currec.smap_name);
+
+        return 0;
 }
 
 static int procps_get_maps(pid_t pid, unsigned opt)
 {
         struct smaprec total;
         int ret;
-        char buf[256];
+        char buf[PMAP_BUFSZ];
+
+        ret = read_cmdline(buf, sizeof(buf), pid, NULL);
+        if (ret < 0)
+                return ret;
 
-        read_cmdline(buf, sizeof(buf), pid, NULL);
         printf("%u: %s\n", (int)pid, buf);
 
         if (!(opt & OPT_q) && (opt & OPT_x))
                 puts("Address" TABS "  Kbytes     PSS   Dirty    Swap  Mode  Mapping");
 
         memset(&total, 0, sizeof(total));
-
-        ret = procps_read_smaps(pid, &total, print_smaprec, (void*)(uintptr_t)opt);
+        ret = read_smaps(pid, buf, &total);
         if (ret)
                 return ret;
 
         if (!(opt & OPT_q)) {
                 if (opt & OPT_x)
                         printf("--------" DASHES "  ------  ------  ------  ------\n"
-                                "total" TABS " %7lu %7lu %7lu %7lu\n",
+                                "total kB %"SIZEWIDTHx"llu %7lu %7lu %7lu\n",
                                 total.smap_size, total.smap_pss, total.private_dirty, total.smap_swap);
                 else
-                        printf("mapped: %luK\n", total.smap_size);
+                        printf(" total %"SIZEWIDTH"lluK\n", total.smap_size);
         }
 
         return 0;
diff --git a/procps/top.c b/procps/top.c
index 09d31c673..96b3e2d4e 100644
--- a/procps/top.c
+++ b/procps/top.c
@@ -117,10 +117,15 @@
 
 #include "libbb.h"
 
-#define ESC "\033"
+#define ESC     "\033"
+#define HOME    ESC"[H"
+#define CLREOS  ESC"[J"
+#define CLREOL  ESC"[K"
+#define REVERSE ESC"[7m"
+#define NORMAL  ESC"[m"
 
 typedef struct top_status_t {
-        unsigned long vsz;
+        unsigned long memsize;
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
         unsigned long ticks;
         unsigned pcpu; /* delta of ticks */
@@ -161,13 +166,16 @@ struct globals {
         top_status_t *top;
         int ntop;
         smallint inverted;
+        smallint not_first_line;
 #if ENABLE_FEATURE_TOPMEM
         smallint sort_field;
 #endif
 #if ENABLE_FEATURE_TOP_SMP_CPU
         smallint smp_cpu_info; /* one/many cpu info lines? */
 #endif
-        unsigned lines;  /* screen height */
+        int lines_remaining;
+        unsigned lines;     /* screen height */
+        unsigned scr_width; /* width, clamped <= LINE_BUF_SIZE-2 */
 #if ENABLE_FEATURE_TOP_INTERACTIVE
         struct termios initial_settings;
         int scroll_ofs;
@@ -212,7 +220,6 @@ struct globals {
 #define cpu_prev_jif     (G.cpu_prev_jif      )
 #define num_cpus         (G.num_cpus          )
 #define total_pcpu       (G.total_pcpu        )
-#define line_buf         (G.line_buf          )
 #define INIT_G() do { \
         SET_PTR_TO_GLOBALS(xzalloc(sizeof(G))); \
         BUILD_BUG_ON(LINE_BUF_SIZE <= 80); \
@@ -241,8 +248,8 @@ static int pid_sort(top_status_t *P, top_status_t *Q)
 static int mem_sort(top_status_t *P, top_status_t *Q)
 {
         /* We want to avoid unsigned->signed and truncation errors */
-        if (Q->vsz < P->vsz) return -1;
-        return Q->vsz != P->vsz; /* 0 if ==, 1 if > */
+        if (Q->memsize < P->memsize) return -1;
+        return Q->memsize != P->memsize; /* 0 if ==, 1 if > */
 }
 
 
@@ -283,9 +290,9 @@ static NOINLINE int read_cpu_jiffy(FILE *fp, jiffy_counts_t *p_jif)
 #endif
         int ret;
 
-        if (!fgets(line_buf, LINE_BUF_SIZE, fp) || line_buf[0] != 'c' /* not "cpu" */)
+        if (!fgets(G.line_buf, LINE_BUF_SIZE, fp) || G.line_buf[0] != 'c' /* not "cpu" */)
                 return 0;
-        ret = sscanf(line_buf, fmt,
+        ret = sscanf(G.line_buf, fmt,
                         &p_jif->usr, &p_jif->nic, &p_jif->sys, &p_jif->idle,
                         &p_jif->iowait, &p_jif->irq, &p_jif->softirq,
                         &p_jif->steal);
@@ -362,7 +369,7 @@ static void do_stats(void)
 
         get_jiffy_counts();
         total_pcpu = 0;
-        /* total_vsz = 0; */
+        /* total_memsize = 0; */
         new_hist = xmalloc(sizeof(new_hist[0]) * ntop);
         /*
          * Make a pass through the data to get stats.
@@ -394,7 +401,7 @@ static void do_stats(void)
                         i = (i+1) % prev_hist_count;
                         /* hist_iterations++; */
                 } while (i != last_i);
-                /* total_vsz += cur->vsz; */
+                /* total_memsize += cur->memsize; */
         }
 
         /*
@@ -407,6 +414,38 @@ static void do_stats(void)
 
 #endif /* FEATURE_TOP_CPU_USAGE_PERCENTAGE */
 
+static void print_line_buf(void)
+{
+        const char *fmt;
+
+        G.lines_remaining--;
+        fmt = OPT_BATCH_MODE ? "\n""%.*s" : "\n""%.*s"CLREOL;
+        if (!G.not_first_line) {
+                G.not_first_line = 1;
+                /* Go to top */
+                fmt = OPT_BATCH_MODE ? "%.*s" : HOME"%.*s"CLREOL;
+        }
+        printf(fmt, G.scr_width - 1, G.line_buf);
+}
+
+static void print_line_bold(void)
+{
+        G.lines_remaining--;
+//we never print first line in bold
+//      if (!G.not_first_line) {
+//              printf(OPT_BATCH_MODE ? "%.*s" : HOME"%.*s"CLREOL, G.scr_width - 1, G.line_buf);
+//              G.not_first_line = 1;
+//      } else {
+                printf(OPT_BATCH_MODE ? "\n""%.*s" : "\n"REVERSE"%.*s"NORMAL CLREOL, G.scr_width - 1, G.line_buf);
+//      }
+}
+
+static void print_end(void)
+{
+        fputs_stdout(OPT_BATCH_MODE ? "\n" : CLREOS"\r");
+        G.not_first_line = 0; /* next print will be "first line" (will clear the screen) */
+}
+
 #if ENABLE_FEATURE_TOP_CPU_GLOBAL_PERCENTS && ENABLE_FEATURE_TOP_DECIMALS
 /* formats 7 char string (8 with terminating NUL) */
 static char *fmt_100percent_8(char pbuf[8], unsigned value, unsigned total)
@@ -433,7 +472,7 @@ static char *fmt_100percent_8(char pbuf[8], unsigned value, unsigned total)
 #endif
 
 #if ENABLE_FEATURE_TOP_CPU_GLOBAL_PERCENTS
-static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
+static void display_cpus(void)
 {
         /*
          * xxx% = (cur_jif.xxx - prev_jif.xxx) / (cur_jif.total - prev_jif.total) * 100%
@@ -469,8 +508,8 @@ static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
 # else
         /* Loop thru CPU(s) */
         n_cpu_lines = smp_cpu_info ? num_cpus : 1;
-        if (n_cpu_lines > *lines_rem_p)
-                n_cpu_lines = *lines_rem_p;
+        if (n_cpu_lines > G.lines_remaining)
+                n_cpu_lines = G.lines_remaining;
 
         for (i = 0; i < n_cpu_lines; i++) {
                 p_jif = &cpu_jif[i];
@@ -488,7 +527,7 @@ static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
                         CALC_STAT(softirq);
                         /*CALC_STAT(steal);*/
 
-                        snprintf(scrbuf, scr_width,
+                        sprintf(G.line_buf,
                                 /* Barely fits in 79 chars when in "decimals" mode. */
 # if ENABLE_FEATURE_TOP_SMP_CPU
                                 "CPU%s:"FMT"usr"FMT"sys"FMT"nic"FMT"idle"FMT"io"FMT"irq"FMT"sirq",
@@ -501,16 +540,15 @@ static void display_cpus(int scr_width, char *scrbuf, int *lines_rem_p)
                                 /*, SHOW_STAT(steal) - what is this 'steal' thing? */
                                 /* I doubt anyone wants to know it */
                         );
-                        puts(scrbuf);
+                        print_line_buf();
                 }
         }
 # undef SHOW_STAT
 # undef CALC_STAT
 # undef FMT
-        *lines_rem_p -= i;
 }
 #else  /* !ENABLE_FEATURE_TOP_CPU_GLOBAL_PERCENTS */
-# define display_cpus(scr_width, scrbuf, lines_rem) ((void)0)
+# define display_cpus() ((void)0)
 #endif
 
 enum {
@@ -564,52 +602,55 @@ static void parse_meminfo(unsigned long meminfo[MI_MAX])
         fclose(f);
 }
 
-static unsigned long display_header(int scr_width, int *lines_rem_p)
+static void cmdline_to_line_buf_and_print(unsigned offset, unsigned pid, const char *comm)
+{
+        int width = G.scr_width - offset;
+        if (width > 1) /* wider than to fit just the NUL? */
+                read_cmdline(G.line_buf + offset, width, pid, comm);
+//TODO: read_cmdline() sanitizes control chars, but not chars above 0x7e
+        print_line_buf();
+}
+
+static unsigned long display_header(void)
 {
-        char scrbuf[100]; /* [80] was a bit too low on 8Gb ram box */
         char *buf;
         unsigned long meminfo[MI_MAX];
 
         parse_meminfo(meminfo);
 
         /* Output memory info */
-        if (scr_width > (int)sizeof(scrbuf))
-                scr_width = sizeof(scrbuf);
-        snprintf(scrbuf, scr_width,
+        sprintf(G.line_buf,
                 "Mem: %luK used, %luK free, %luK shrd, %luK buff, %luK cached",
                 meminfo[MI_MEMTOTAL] - meminfo[MI_MEMFREE],
                 meminfo[MI_MEMFREE],
                 meminfo[MI_MEMSHARED] + meminfo[MI_SHMEM],
                 meminfo[MI_BUFFERS],
                 meminfo[MI_CACHED]);
-        /* Go to top & clear to the end of screen */
-        printf(OPT_BATCH_MODE ? "%s\n" : ESC"[H" ESC"[J" "%s\n", scrbuf);
-        (*lines_rem_p)--;
+        print_line_buf();
 
         /* Display CPU time split as percentage of total time.
          * This displays either a cumulative line or one line per CPU.
          */
-        display_cpus(scr_width, scrbuf, lines_rem_p);
+        display_cpus();
 
         /* Read load average as a string */
-        buf = stpcpy(scrbuf, "Load average: ");
-        open_read_close("loadavg", buf, sizeof(scrbuf) - sizeof("Load average: "));
-        scrbuf[scr_width - 1] = '\0';
+        buf = stpcpy(G.line_buf, "Load average: ");
+        open_read_close("loadavg", buf, sizeof(G.line_buf) - sizeof("Load average: "));
+        G.line_buf[sizeof(G.line_buf) - 1] = '\0'; /* paranoia */
         strchrnul(buf, '\n')[0] = '\0';
-        puts(scrbuf);
-        (*lines_rem_p)--;
+        print_line_buf();
 
         return meminfo[MI_MEMTOTAL];
 }
 
-static NOINLINE void display_process_list(int lines_rem, int scr_width)
+static NOINLINE void display_process_list(void)
 {
         enum {
                 BITS_PER_INT = sizeof(int) * 8
         };
 
         top_status_t *s;
-        unsigned long total_memory = display_header(scr_width, &lines_rem); /* or use total_vsz? */
+        unsigned long total_memory = display_header();
         /* xxx_shift and xxx_scale variables allow us to replace
          * expensive divides with multiply and shift */
         unsigned pmem_shift, pmem_scale, pmem_half;
@@ -621,7 +662,7 @@ static NOINLINE void display_process_list(int lines_rem, int scr_width)
 
 #if ENABLE_FEATURE_TOP_DECIMALS
 # define UPSCALE 1000
-typedef struct { unsigned quot, rem; } bb_div_t;
+        typedef struct { unsigned quot, rem; } bb_div_t;
 /* Used to have "div_t name = div((val), 10)" here
  * (IOW: intended to use libc-compatible way to divide and use
  * both result and remainder, but musl does not inline div()...)
@@ -629,28 +670,34 @@ typedef struct { unsigned quot, rem; } bb_div_t;
  */
 # define CALC_STAT(name, val) bb_div_t name = { (val) / 10, (val) % 10 }
 # define SHOW_STAT(name) name.quot, '0'+name.rem
+# define SANITIZE(name)  if (name.quot > 99) name.quot = 99, name.rem = (unsigned char)('+' - '0')
 # define FMT "%3u.%c"
 #else
 # define UPSCALE 100
 # define CALC_STAT(name, val) unsigned name = (val)
+# define SANITIZE(name)  if (name > 99) name = 99
 # define SHOW_STAT(name) name
 # define FMT "%4u%%"
 #endif
 
-        /* what info of the processes is shown */
-        printf(OPT_BATCH_MODE ? "%.*s" : ESC"[7m" "%.*s" ESC"[m", scr_width,
-                "  PID  PPID USER     STAT   VSZ %VSZ"
+        strcpy(G.line_buf, "  PID  PPID USER     STAT   RSS %RSS"
                 IF_FEATURE_TOP_SMP_PROCESS(" CPU")
                 IF_FEATURE_TOP_CPU_USAGE_PERCENTAGE(" %CPU")
                 " COMMAND");
-        lines_rem--;
-
-        /*
-         * %VSZ = s->vsz/MemTotal
+        print_line_bold();
+
+        /* %RSS = s->memsize / MemTotal * 100%
+         * Calculate this with multiply and shift. Example:
+         * shift = 12
+         * scale = 100 * 0x1000 / total_memory
+         * percent_mem = (size_mem * scale) >> shift
+         *            ~= (size_mem >> shift) * scale
+         *            ~= (size_mem >> shift) * 100 * (1 << shift) / total_memory
+         *            ~= size_mem * 100 / total_memory
          */
         pmem_shift = BITS_PER_INT-11;
         pmem_scale = UPSCALE*(1U<<(BITS_PER_INT-11)) / total_memory;
-        /* s->vsz is in kb. we want (s->vsz * pmem_scale) to never overflow */
+        /* s->memsize is in kb. we want (s->memsize * pmem_scale) to never overflow */
         while (pmem_scale >= 512) {
                 pmem_scale /= 4;
                 pmem_shift -= 2;
@@ -689,25 +736,29 @@ typedef struct { unsigned quot, rem; } bb_div_t;
         pcpu_half = (1U << pcpu_shift) / (ENABLE_FEATURE_TOP_DECIMALS ? 20 : 2);
         /* printf(" pmem_scale=%u pcpu_scale=%u ", pmem_scale, pcpu_scale); */
 #endif
+        if (G.lines_remaining > ntop - G_scroll_ofs)
+                G.lines_remaining = ntop - G_scroll_ofs;
 
         /* Ok, all preliminary data is ready, go through the list */
-        scr_width += 2; /* account for leading '\n' and trailing NUL */
-        if (lines_rem > ntop - G_scroll_ofs)
-                lines_rem = ntop - G_scroll_ofs;
         s = top + G_scroll_ofs;
-        while (--lines_rem >= 0) {
+        while (G.lines_remaining > 0) {
                 int n;
                 char *ppu;
                 char ppubuf[sizeof(int)*3 * 2 + 12];
-                char vsz_str_buf[8];
+                char memsize_str_buf[8];
                 unsigned col;
 
-                CALC_STAT(pmem, (s->vsz*pmem_scale + pmem_half) >> pmem_shift);
+                CALC_STAT(pmem, (s->memsize*pmem_scale + pmem_half) >> pmem_shift);
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
                 CALC_STAT(pcpu, (s->pcpu*pcpu_scale + pcpu_half) >> pcpu_shift);
 #endif
+                /* VSZ can be much larger than total memory
+                 * (seen values close to 2Tbyte), don't try to display
+                 * "uses 12345.6% of MemTotal" (won't fit the column)
+                 */
+                SANITIZE(pmem);
 
-                smart_ulltoa5(s->vsz, vsz_str_buf, " mgtpezy");
+                smart_ulltoa5(s->memsize, memsize_str_buf, " mgtpezy");
                 /* PID PPID USER STAT VSZ %VSZ [%CPU] COMMAND */
                 n = sprintf(ppubuf, "%5u %5u %-8.8s", s->pid, s->ppid, get_cached_username(s->uid));
                 ppu = ppubuf;
@@ -736,27 +787,23 @@ typedef struct { unsigned quot, rem; } bb_div_t;
                         ppu[6+6+8] = '\0'; /* truncate USER */
                 }
  shortened:
-                col = snprintf(line_buf, scr_width,
-                                "\n" "%s %s  %.5s" FMT
+                col = sprintf(G.line_buf,
+                                "%s %s  %.5s" FMT
                                 IF_FEATURE_TOP_SMP_PROCESS(" %3d")
                                 IF_FEATURE_TOP_CPU_USAGE_PERCENTAGE(FMT)
                                 " ",
                                 ppu,
-                                s->state, vsz_str_buf,
+                                s->state, memsize_str_buf,
                                 SHOW_STAT(pmem)
                                 IF_FEATURE_TOP_SMP_PROCESS(, s->last_seen_on_cpu)
                                 IF_FEATURE_TOP_CPU_USAGE_PERCENTAGE(, SHOW_STAT(pcpu))
                 );
-                if ((int)(scr_width - col) > 1)
-                        read_cmdline(line_buf + col, scr_width - col, s->pid, s->comm);
-                fputs_stdout(line_buf);
+                cmdline_to_line_buf_and_print(col, s->pid, s->comm);
                 /* printf(" %d/%d %lld/%lld", s->pcpu, total_pcpu,
                         cur_jif.busy - prev_jif.busy, cur_jif.total - prev_jif.total); */
                 s++;
         }
         /* printf(" %d", hist_iterations); */
-        bb_putchar(OPT_BATCH_MODE ? '\n' : '\r');
-        fflush_all();
 }
 #undef UPSCALE
 #undef SHOW_STAT
@@ -828,36 +875,34 @@ static int topmem_sort(char *a, char *b)
 }
 
 /* display header info (meminfo / loadavg) */
-static void display_topmem_header(int scr_width, int *lines_rem_p)
+static void display_topmem_header(void)
 {
         unsigned long meminfo[MI_MAX];
 
         parse_meminfo(meminfo);
 
-        snprintf(line_buf, LINE_BUF_SIZE,
+        sprintf(G.line_buf,
                 "Mem total:%lu anon:%lu map:%lu free:%lu",
                 meminfo[MI_MEMTOTAL],
                 meminfo[MI_ANONPAGES],
                 meminfo[MI_MAPPED],
                 meminfo[MI_MEMFREE]);
-        printf(OPT_BATCH_MODE ? "%.*s\n" : ESC"[H" ESC"[J" "%.*s\n", scr_width, line_buf);
+        print_line_buf();
 
-        snprintf(line_buf, LINE_BUF_SIZE,
+        sprintf(G.line_buf,
                 " slab:%lu buf:%lu cache:%lu dirty:%lu write:%lu",
                 meminfo[MI_SLAB],
                 meminfo[MI_BUFFERS],
                 meminfo[MI_CACHED],
                 meminfo[MI_DIRTY],
                 meminfo[MI_WRITEBACK]);
-        printf("%.*s\n", scr_width, line_buf);
+        print_line_buf();
 
-        snprintf(line_buf, LINE_BUF_SIZE,
+        sprintf(G.line_buf,
                 "Swap total:%lu free:%lu", // TODO: % used?
                 meminfo[MI_SWAPTOTAL],
                 meminfo[MI_SWAPFREE]);
-        printf("%.*s\n", scr_width, line_buf);
-
-        (*lines_rem_p) -= 3;
+        print_line_buf();
 }
 
 /* see http://en.wikipedia.org/wiki/Tera */
@@ -870,75 +915,57 @@ static void ulltoa4_and_space(unsigned long long ul, char buf[5])
         smart_ulltoa4(ul, buf, " mgtpezy")[0] = ' ';
 }
 
-static NOINLINE void display_topmem_process_list(int lines_rem, int scr_width)
+static NOINLINE void display_topmem_process_list(void)
 {
-#define HDR_STR "  PID   VSZ VSZRW   RSS (SHR) DIRTY (SHR) STACK"
-#define MIN_WIDTH sizeof(HDR_STR)
         const topmem_status_t *s = topmem + G_scroll_ofs;
         char *cp, ch;
 
-        display_topmem_header(scr_width, &lines_rem);
+        display_topmem_header();
 
-        strcpy(line_buf, HDR_STR " COMMAND");
+        strcpy(G.line_buf, "  PID   VSZ VSZRW   RSS (SHR) DIRTY (SHR) STACK COMMAND");
         /* Mark the ^FIELD^ we sort by */
-        cp = &line_buf[5 + sort_field * 6];
+        cp = &G.line_buf[5 + sort_field * 6];
         ch = "^_"[inverted];
         cp[6] = ch;
         do *cp++ = ch; while (*cp == ' ');
+        print_line_bold();
 
-        printf(OPT_BATCH_MODE ? "%.*s" : ESC"[7m" "%.*s" ESC"[m", scr_width, line_buf);
-        lines_rem--;
-
-        if (lines_rem > ntop - G_scroll_ofs)
-                lines_rem = ntop - G_scroll_ofs;
-        while (--lines_rem >= 0) {
+        if (G.lines_remaining > ntop - G_scroll_ofs)
+                G.lines_remaining = ntop - G_scroll_ofs;
+        while (G.lines_remaining > 0) {
                 /* PID VSZ VSZRW RSS (SHR) DIRTY (SHR) COMMAND */
-                int n = sprintf(line_buf, "%5u ", s->pid);
+                int n = sprintf(G.line_buf, "%5u ", s->pid);
                 if (n > 7) {
                         /* PID is 7 chars long (up to 4194304) */
-                        ulltoa4_and_space(s->vsz  , &line_buf[8]);
-                        ulltoa4_and_space(s->vszrw, &line_buf[8+5]);
+                        ulltoa4_and_space(s->vsz  , &G.line_buf[8]);
+                        ulltoa4_and_space(s->vszrw, &G.line_buf[8+5]);
                         /* the next field (RSS) starts at 8+10 = 3*6 */
                 } else {
                         if (n == 7) /* PID is 6 chars long */
-                                ulltoa4_and_space(s->vsz, &line_buf[7]);
+                                ulltoa4_and_space(s->vsz, &G.line_buf[7]);
                                 /* the next field (VSZRW) starts at 7+5 = 2*6 */
                         else /* PID is 5 chars or less */
-                                ulltoa5_and_space(s->vsz, &line_buf[6]);
-                        ulltoa5_and_space(s->vszrw, &line_buf[2*6]);
-                }
-                ulltoa5_and_space(s->rss     , &line_buf[3*6]);
-                ulltoa5_and_space(s->rss_sh  , &line_buf[4*6]);
-                ulltoa5_and_space(s->dirty   , &line_buf[5*6]);
-                ulltoa5_and_space(s->dirty_sh, &line_buf[6*6]);
-                ulltoa5_and_space(s->stack   , &line_buf[7*6]);
-                line_buf[8*6] = '\0';
-                if (scr_width > (int)MIN_WIDTH) {
-                        read_cmdline(&line_buf[8*6], scr_width - MIN_WIDTH, s->pid, s->comm);
+                                ulltoa5_and_space(s->vsz, &G.line_buf[6]);
+                        ulltoa5_and_space(s->vszrw, &G.line_buf[2*6]);
                 }
-                printf("\n""%.*s", scr_width, line_buf);
+                ulltoa5_and_space(s->rss     , &G.line_buf[3*6]);
+                ulltoa5_and_space(s->rss_sh  , &G.line_buf[4*6]);
+                ulltoa5_and_space(s->dirty   , &G.line_buf[5*6]);
+                ulltoa5_and_space(s->dirty_sh, &G.line_buf[6*6]);
+                ulltoa5_and_space(s->stack   , &G.line_buf[7*6]);
+                G.line_buf[8*6] = '\0';
+                cmdline_to_line_buf_and_print(8*6, s->pid, s->comm);
                 s++;
         }
-        bb_putchar(OPT_BATCH_MODE ? '\n' : '\r');
-        fflush_all();
-#undef HDR_STR
-#undef MIN_WIDTH
 }
 
-#else
-void display_topmem_process_list(int lines_rem, int scr_width);
-int topmem_sort(char *a, char *b);
-#endif /* TOPMEM */
-
-/*
- * end TOPMEM support
- */
+#endif /* end TOPMEM support */
 
 enum {
         TOP_MASK = 0
                 | PSSCAN_PID
                 | PSSCAN_PPID
-                | PSSCAN_VSZ
+                | PSSCAN_RSS
                 | PSSCAN_STIME
                 | PSSCAN_UTIME
                 | PSSCAN_STATE
@@ -950,7 +977,7 @@ enum {
                 | PSSCAN_SMAPS
                 | PSSCAN_COMM,
         EXIT_MASK = 0,
-        NO_RESCAN_MASK = (unsigned)-1,
+        ONLY_REDRAW = (unsigned)-1,
 };
 
 #if ENABLE_FEATURE_TOP_INTERACTIVE
@@ -963,15 +990,22 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
         }
 
         while (1) {
-                int32_t c;
+                int32_t c, cc;
 
                 c = safe_read_key(STDIN_FILENO, G.kbd_input, interval * 1000);
-                if (c == -1 && errno != EAGAIN) {
-                        /* error/EOF */
-                        option_mask32 |= OPT_EOF;
+                if (c == -1) {
+                        if (errno != EAGAIN)
+                                /* error/EOF */
+                                option_mask32 |= OPT_EOF;
+                        /* else: timeout - rescan and refresh */
                         break;
                 }
                 interval = 0;
+                /* "continue" statements below return to do one additional
+                 * quick attempt to read a key. This prevents
+                 * long sequence of e.g. "nnnnnnnnnnnnnnnnnnnnnnnnnn"
+                 * to cause lots of rescans.
+                 */
 
                 if (c == initial_settings.c_cc[VINTR])
                         return EXIT_MASK;
@@ -1005,9 +1039,10 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
                                 G_scroll_ofs = ntop - 1;
                         if (G_scroll_ofs < 0)
                                 G_scroll_ofs = 0;
-                        return NO_RESCAN_MASK;
+                        return ONLY_REDRAW;
                 }
 
+                cc = c;
                 c |= 0x20; /* lowercase */
                 if (c == 'q')
                         return EXIT_MASK;
@@ -1055,9 +1090,17 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
                         continue;
                 }
 #  if ENABLE_FEATURE_TOPMEM
+                if (cc == 'S') {
+                        if (--sort_field < 0)
+                                sort_field = NUM_SORT_FIELD - 1;
+                        if (--sort_field < 0)
+                                sort_field = NUM_SORT_FIELD - 1;
+                }
                 if (c == 's') {
-                        scan_mask = TOPMEM_MASK;
                         sort_field = (sort_field + 1) % NUM_SORT_FIELD;
+                        if (scan_mask == TOPMEM_MASK)
+                                return ONLY_REDRAW;
+                        scan_mask = TOPMEM_MASK;
                         free(prev_hist);
                         prev_hist = NULL;
                         prev_hist_count = 0;
@@ -1066,7 +1109,7 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
 #  endif
                 if (c == 'r') {
                         inverted ^= 1;
-                        continue;
+                        return ONLY_REDRAW;
                 }
 #  if ENABLE_FEATURE_TOP_SMP_CPU
                 /* procps-2.0.18 uses 'C', 3.2.7 uses '1' */
@@ -1088,8 +1131,8 @@ static unsigned handle_input(unsigned scan_mask, duration_t interval)
                 }
 #  endif
 # endif
-                break; /* unknown key -> force refresh */
-        }
+                /* Unknown key. Eat remaining buffered input (if any) */
+        } /* while (1) */
 
         return scan_mask;
 }
@@ -1155,7 +1198,7 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 {
         duration_t interval;
         int iterations;
-        unsigned col;
+        unsigned opt;
         char *str_interval, *str_iterations;
         unsigned scan_mask = TOP_MASK;
 
@@ -1172,13 +1215,13 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 
         /* all args are options; -n NUM */
         make_all_argv_opts(argv); /* options can be specified w/o dash */
-        col = getopt32(argv, "d:n:bHm", &str_interval, &str_iterations);
+        opt = getopt32(argv, "d:n:bHm", &str_interval, &str_iterations);
         /* NB: -m and -H are accepted even if not configured */
 #if ENABLE_FEATURE_TOPMEM
-        if (col & OPT_m) /* -m (busybox specific) */
+        if (opt & OPT_m) /* -m (busybox specific) */
                 scan_mask = TOPMEM_MASK;
 #endif
-        if (col & OPT_d) {
+        if (opt & OPT_d) {
                 /* work around for "-d 1" -> "-d -1" done by make_all_argv_opts() */
                 if (str_interval[0] == '-')
                         str_interval++;
@@ -1187,18 +1230,17 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                 if (interval > INT_MAX / 1000)
                         interval = INT_MAX / 1000;
         }
-        if (col & OPT_n) {
+        if (opt & OPT_n) {
                 if (str_iterations[0] == '-')
                         str_iterations++;
                 iterations = xatou(str_iterations);
         }
 #if ENABLE_FEATURE_SHOW_THREADS
-        if (col & OPT_H) {
+        if (opt & OPT_H) {
                 scan_mask |= PSSCAN_TASKS;
         }
 #endif
 
-        /* change to /proc */
         xchdir("/proc");
 
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
@@ -1226,23 +1268,22 @@ int top_main(int argc UNUSED_PARAM, char **argv)
 #endif
 
         while (scan_mask != EXIT_MASK) {
-                IF_FEATURE_TOP_INTERACTIVE(unsigned new_mask;)
+                IF_FEATURE_TOP_INTERACTIVE(unsigned new_mask = scan_mask;)
                 procps_status_t *p = NULL;
 
-                if (OPT_BATCH_MODE) {
-                        G.lines = INT_MAX;
-                        col = LINE_BUF_SIZE - 2; /* +2 bytes for '\n', NUL */
-                } else {
+                G.lines = INT_MAX;
+                G.scr_width = LINE_BUF_SIZE - 2; /* +2 bytes for '\n', NUL */
+                if (!OPT_BATCH_MODE) {
                         G.lines = 24; /* default */
-                        col = 79;
+                        G.scr_width = 80;
                         /* We output to stdout, we need size of stdout (not stdin)! */
-                        get_terminal_width_height(STDOUT_FILENO, &col, &G.lines);
-                        if (G.lines < 5 || col < 10) {
+                        get_terminal_width_height(STDOUT_FILENO, &G.scr_width, &G.lines);
+                        if (G.lines < 5 || G.scr_width < 10) {
                                 sleep_for_duration(interval);
                                 continue;
                         }
-                        if (col > LINE_BUF_SIZE - 2)
-                                col = LINE_BUF_SIZE - 2;
+                        if (G.scr_width > LINE_BUF_SIZE - 2)
+                                G.scr_width = LINE_BUF_SIZE - 2;
                 }
 
                 /* read process IDs & status for all the processes */
@@ -1255,7 +1296,7 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                                 top = xrealloc_vector(top, 6, ntop++);
                                 top[n].pid = p->pid;
                                 top[n].ppid = p->ppid;
-                                top[n].vsz = p->vsz;
+                                top[n].memsize = p->rss;
 #if ENABLE_FEATURE_TOP_CPU_USAGE_PERCENTAGE
                                 top[n].ticks = p->stime + p->utime;
 #endif
@@ -1268,20 +1309,20 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                         }
 #if ENABLE_FEATURE_TOPMEM
                         else { /* TOPMEM */
-                                if (!(p->smaps.mapped_ro | p->smaps.mapped_rw))
+                                if (!(p->mapped_ro | p->mapped_rw))
                                         continue; /* kernel threads are ignored */
                                 n = ntop;
                                 /* No bug here - top and topmem are the same */
                                 top = xrealloc_vector(topmem, 6, ntop++);
                                 strcpy(topmem[n].comm, p->comm);
                                 topmem[n].pid      = p->pid;
-                                topmem[n].vsz      = p->smaps.mapped_rw + p->smaps.mapped_ro;
-                                topmem[n].vszrw    = p->smaps.mapped_rw;
-                                topmem[n].rss_sh   = p->smaps.shared_clean + p->smaps.shared_dirty;
-                                topmem[n].rss      = p->smaps.private_clean + p->smaps.private_dirty + topmem[n].rss_sh;
-                                topmem[n].dirty    = p->smaps.private_dirty + p->smaps.shared_dirty;
-                                topmem[n].dirty_sh = p->smaps.shared_dirty;
-                                topmem[n].stack    = p->smaps.stack;
+                                topmem[n].vsz      = p->mapped_rw + p->mapped_ro;
+                                topmem[n].vszrw    = p->mapped_rw;
+                                topmem[n].rss_sh   = p->shared_clean + p->shared_dirty;
+                                topmem[n].rss      = p->private_clean + p->private_dirty + topmem[n].rss_sh;
+                                topmem[n].dirty    = p->private_dirty + p->shared_dirty;
+                                topmem[n].dirty_sh = p->shared_dirty;
+                                topmem[n].stack    = p->stack;
                         }
 #endif
                 } /* end of "while we read /proc" */
@@ -1310,30 +1351,40 @@ int top_main(int argc UNUSED_PARAM, char **argv)
                         qsort(topmem, ntop, sizeof(topmem_status_t), (void*)topmem_sort);
                 }
 #endif
- IF_FEATURE_TOP_INTERACTIVE(display:)
+ IF_FEATURE_TOP_INTERACTIVE(redraw:)
+                G.lines_remaining = G.lines;
                 IF_FEATURE_TOPMEM(if (scan_mask != TOPMEM_MASK)) {
-                        display_process_list(G.lines, col);
+                        display_process_list();
                 }
 #if ENABLE_FEATURE_TOPMEM
                 else { /* TOPMEM */
-                        display_topmem_process_list(G.lines, col);
+                        display_topmem_process_list();
                 }
 #endif
+                print_end();
+                fflush_all();
                 if (iterations >= 0 && !--iterations)
                         break;
 #if !ENABLE_FEATURE_TOP_INTERACTIVE
                 clearmems();
                 sleep_for_duration(interval);
 #else
-                new_mask = handle_input(scan_mask, interval);
-                if (new_mask == NO_RESCAN_MASK)
-                        goto display;
+                new_mask = handle_input(scan_mask,
+                        /* After "redraw with no rescan", have one
+                         * key timeout shorter that normal
+                         * (IOW: rescan sooner):
+                         */
+                        (new_mask == ONLY_REDRAW ? 1 : interval)
+                );
+                if (new_mask == ONLY_REDRAW)
+                        goto redraw;
                 scan_mask = new_mask;
                 clearmems();
 #endif
         } /* end of "while (not Q)" */
 
-        bb_putchar('\n');
+        if (!OPT_BATCH_MODE)
+                bb_putchar('\n');
 #if ENABLE_FEATURE_TOP_INTERACTIVE
         reset_term();
 #endif
diff --git a/shell/Config.src b/shell/Config.src
index 5efbf9995..5b3fe08f3 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -166,9 +166,10 @@ config FEATURE_SH_HISTFILESIZE
         default y
         depends on SHELL_ASH || SHELL_HUSH
         help
-        This option makes busybox shells to use $HISTFILESIZE variable
-        to set shell history size. Note that its max value is capped
-        by "History size" setting in library tuning section.
+        This option makes busybox shells to use $HISTSIZE and
+        $HISTFILESIZE variables to set shell history size.
+        Note that its max value is capped by "History size" setting
+        in library tuning section.
 
 config FEATURE_SH_EMBEDDED_SCRIPTS
         bool "Embed scripts in the binary"
diff --git a/shell/ash.c b/shell/ash.c
index 99fbf6053..605215e41 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -461,7 +461,7 @@ static void forkshell_print(FILE *fp0, struct forkshell *fs, const char **notes)
 
 /* ============ Shell options */
 
-/* If you add/change options hare, update --help text too */
+/* If you add/change options here, update --help text too */
 static const char *const optletters_optnames[] ALIGN_PTR = {
         "e"   "errexit",
         "f"   "noglob",
@@ -1822,7 +1822,6 @@ struct stackmark {
         size_t stacknleft;
 };
 
-
 struct globals_memstack {
         struct stack_block *g_stackp; // = &stackbase;
         char *g_stacknxt; // = stackbase.space;
@@ -1845,7 +1844,6 @@ extern struct globals_memstack *BB_GLOBAL_CONST ash_ptr_to_globals_memstack;
         sstrend = stackbase.space + MINSIZE; \
 } while (0)
 
-
 #define stackblock()     ((void *)g_stacknxt)
 #define stackblocksize() g_stacknleft
 
@@ -2362,7 +2360,6 @@ struct localvar {
 # define VIMPORT        0x400   /* variable was imported from environment */
 #endif
 
-
 /* Need to be before varinit_data[] */
 #if ENABLE_LOCALE_SUPPORT
 static void FAST_FUNC
@@ -3582,7 +3579,6 @@ pwdcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 
 /* ============ ... */
 
-
 #define IBUFSIZ (ENABLE_FEATURE_EDITING ? CONFIG_FEATURE_EDITING_MAX_LEN : 1024)
 
 /* Syntax classes */
@@ -3989,13 +3985,11 @@ struct alias {
         int flag;
 };
 
-
 static struct alias **atab; // [ATABSIZE];
 #define INIT_G_alias() do { \
         atab = xzalloc(ATABSIZE * sizeof(atab[0])); \
 } while (0)
 
-
 static struct alias **
 __lookupalias(const char *name)
 {
@@ -4177,7 +4171,6 @@ unaliascmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 
 #endif /* ASH_ALIAS */
 
-
 /* Mode argument to forkshell.  Don't change FORK_FG or FORK_BG. */
 #define FORK_FG    0
 #define FORK_BG    1
@@ -4275,7 +4268,7 @@ signal_handler(int signo)
                         return;
         }
 #if ENABLE_FEATURE_EDITING
-        bb_got_signal = signo; /* for read_line_input: "we got a signal" */
+        bb_got_signal = signo; /* for read_line_input / read builtin: "we got a signal" */
 #endif
         gotsig[signo - 1] = 1;
         pending_sig = signo;
@@ -6194,7 +6187,6 @@ stoppedjobs(void)
 }
 #endif
 
-
 /*
  * Code for dealing with input/output redirection.
  */
@@ -9904,7 +9896,6 @@ commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 }
 #endif
 
-
 /*static int funcblocksize;     // size of structures in function */
 /*static int funcstringsize;    // size of strings in node */
 static void *funcblock;         /* block to allocate function from */
@@ -11920,7 +11911,6 @@ goodname(const char *p)
         return endofname(p)[0] == '\0';
 }
 
-
 /*
  * Search for a command.  This is called before we fork so that the
  * location of the command will be available in the parent as well as
@@ -14773,7 +14763,6 @@ parseheredoc(void)
         }
 }
 
-
 static const char *
 expandstr(const char *ps, int syntax_type)
 {
@@ -15403,7 +15392,6 @@ find_command(char *name, struct cmdentry *entry, int act, const char *path)
         entry->u = cmdp->param;
 }
 
-
 /*
  * The trap builtin.
  */
@@ -15821,6 +15809,11 @@ readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                 if (pending_sig == 0)
                         goto again;
         }
+
+        if ((uintptr_t)r == 2) /* -t SEC timeout? */
+                /* bash: "The exit status is greater than 128 if the timeout is exceeded." */
+                /* The actual value observed with bash 5.2.15: */
+                return 128 + SIGALRM;
 #else /* ENABLE_PLATFORM_MINGW32 */
         if ((uintptr_t)r == 2) {
                 /* Timeout, return 128 + SIGALRM */
@@ -15973,8 +15966,25 @@ exitshell(void)
         char *p;
 
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
-        save_history(line_input_state); /* may be NULL */
+        if (line_input_state) {
+                const char *hp;
+# if ENABLE_FEATURE_SH_HISTFILESIZE
+// in bash:
+// HISTFILESIZE controls the on-disk history file size (in lines, 0=no history):
+// "When this variable is assigned a value, the history file is truncated, if necessary"
+// but we do it only at exit, not on assignment:
+                /* Use HISTFILESIZE to limit file size */
+                hp = lookupvar("HISTFILESIZE");
+                if (hp)
+                        line_input_state->max_history = size_from_HISTFILESIZE(hp);
+# endif
+                /* HISTFILE: "If unset, the command history is not saved when a shell exits." */
+                hp = lookupvar("HISTFILE");
+                line_input_state->hist_file = hp;
+                save_history(line_input_state); /* no-op if hist_file is NULL or "" */
+        }
 #endif
+
         savestatus = exitstatus;
         TRACE(("pid %d, exitshell(%d)\n", getpid(), savestatus));
         if (setjmp(loc.loc))
@@ -16148,7 +16158,6 @@ init(void)
         }
 }
 
-
 //usage:#define ash_trivial_usage
 //usage:        "[-il] [-|+Cabefmnuvx] [-|+o OPT]... [-c 'SCRIPT' [ARG0 ARGS] | FILE ARGS | -s ARGS]"
 ////////        comes from ^^^^^^^^^^optletters
@@ -16478,7 +16487,12 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                         if (hp)
                                 line_input_state->hist_file = xstrdup(hp);
 # if ENABLE_FEATURE_SH_HISTFILESIZE
-                        hp = lookupvar("HISTFILESIZE");
+                        hp = lookupvar("HISTSIZE");
+                        /* Using HISTFILESIZE above to limit max_history would be WRONG:
+                         * users may set HISTFILESIZE=0 in their profile scripts
+                         * to prevent _saving_ of history files, but still want to have
+                         * non-zero history limit for in-memory list.
+                         */
                         line_input_state->max_history = size_from_HISTFILESIZE(hp);
 # endif
                 }
diff --git a/shell/ash_test/ash-read/read_ifs2.right b/shell/ash_test/ash-read/read_ifs2.right
new file mode 100644
index 000000000..797137dae
--- /dev/null
+++ b/shell/ash_test/ash-read/read_ifs2.right
@@ -0,0 +1,9 @@
+|X|Y:Z:|
+|X|Y:Z|
+|X|Y|
+|X|Y|
+|X||
+|X||
+|||
+Whitespace should be trimmed too:
+|X|Y|
diff --git a/shell/ash_test/ash-read/read_ifs2.tests b/shell/ash_test/ash-read/read_ifs2.tests
new file mode 100755
index 000000000..f01a68978
--- /dev/null
+++ b/shell/ash_test/ash-read/read_ifs2.tests
@@ -0,0 +1,9 @@
+echo "X:Y:Z:" | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y:Z"  | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y:"   | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y"    | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:"     | (IFS=": " read x y; echo "|$x|$y|")
+echo "X"      | (IFS=": " read x y; echo "|$x|$y|")
+echo ""       | (IFS=": " read x y; echo "|$x|$y|")
+echo Whitespace should be trimmed too:
+echo "X:Y  : " | (IFS=": " read x y; echo "|$x|$y|")
diff --git a/shell/ash_test/ash-read/read_t.right b/shell/ash_test/ash-read/read_t.right
index 04126cbe6..3eedae275 100644
--- a/shell/ash_test/ash-read/read_t.right
+++ b/shell/ash_test/ash-read/read_t.right
@@ -1,4 +1,4 @@
-><
-><
->test<
->test<
+>te:142<
+>:142<
+>test:0<
+>test:0<
diff --git a/shell/ash_test/ash-read/read_t.tests b/shell/ash_test/ash-read/read_t.tests
index d65f1aeaa..9fbeec517 100755
--- a/shell/ash_test/ash-read/read_t.tests
+++ b/shell/ash_test/ash-read/read_t.tests
@@ -1,10 +1,10 @@
-# bash 3.2 outputs:
+# bash 5.2 outputs:
 
-# ><
-{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply<")
-# ><
-{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply<")
-# >test<
-{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply<")
-# >test<
-{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply<")
+# >te:142<
+{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply:$?<")
+# >:142<
+{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply:$?<")
+# >test:0<
+{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply:$?<")
+# >test:0<
+{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply:$?<")
diff --git a/shell/ash_test/printenv.c b/shell/ash_test/printenv.c
index c86308d3b..f0f41984d 100644
--- a/shell/ash_test/printenv.c
+++ b/shell/ash_test/printenv.c
@@ -31,9 +31,7 @@
 extern char **environ;
 
 int
-main (argc, argv)
-     int argc;
-     char **argv;
+main (int argc, char **argv)
 {
   register char **envp, *eval;
   int len;
diff --git a/shell/ash_test/recho.c b/shell/ash_test/recho.c
index 42a5feafd..7e96b14cc 100644
--- a/shell/ash_test/recho.c
+++ b/shell/ash_test/recho.c
@@ -27,7 +27,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-void strprint();
+void strprint(char *);
 
 int main(int argc, char **argv)
 {
diff --git a/shell/hush.c b/shell/hush.c
index 4a97293cc..09ab6ebc0 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -392,6 +392,8 @@
 
 /* Build knobs */
 #define LEAK_HUNTING 0
+#define LEAK_PRINTF(...) fdprintf(__VA_ARGS__)
+//#define LEAK_PRINTF(...) do { if (ptr_to_globals && G.root_pid == getpid()) fdprintf(__VA_ARGS__); } while (0)
 #define BUILD_AS_NOMMU 0
 /* Enable/disable sanity checks. Ok to enable in production,
  * only adds a bit of bloat. Set to >1 to get non-production level verbosity.
@@ -930,6 +932,12 @@ struct globals {
 # define G_flag_return_in_progress 0
 #endif
         smallint exiting; /* used to prevent EXIT trap recursion */
+#if !BB_MMU
+        smallint reexeced_on_NOMMU;
+# define G_reexeced_on_NOMMU (G.reexeced_on_NOMMU)
+#else
+# define G_reexeced_on_NOMMU 0
+#endif
         /* These support $? */
         smalluint last_exitcode;
         smalluint expand_exitcode;
@@ -1352,30 +1360,67 @@ static void debug_print_strings(const char *prefix, char **vv)
 static void *xxmalloc(int lineno, size_t size)
 {
         void *ptr = xmalloc((size + 0xff) & ~0xff);
-        fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
+        LEAK_PRINTF(2, "line %d: malloc %p\n", lineno, ptr);
+        return ptr;
+}
+static void *xxzalloc(int lineno, size_t size)
+{
+        void *ptr = xzalloc((size + 0xff) & ~0xff);
+        LEAK_PRINTF(2, "line %d: zalloc %p\n", lineno, ptr);
         return ptr;
 }
 static void *xxrealloc(int lineno, void *ptr, size_t size)
 {
+        char *p = ptr;
         ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
-        fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
+        if (p != ptr)
+                LEAK_PRINTF(2, "line %d: realloc %p\n", lineno, ptr);
+        return ptr;
+}
+static void *xxrealloc_getcwd_or_warn(int lineno, char *ptr)
+{
+        char *p = ptr;
+        ptr = xrealloc_getcwd_or_warn(ptr);
+        if (p != ptr)
+                LEAK_PRINTF(2, "line %d: xrealloc_getcwd_or_warn %p\n", lineno, ptr);
         return ptr;
 }
 static char *xxstrdup(int lineno, const char *str)
 {
         char *ptr = xstrdup(str);
-        fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
+        LEAK_PRINTF(2, "line %d: strdup %p\n", lineno, ptr);
+        return ptr;
+}
+static char *xxstrndup(int lineno, const char *str, size_t n)
+{
+        char *ptr = xstrndup(str, n);
+        LEAK_PRINTF(2, "line %d: strndup %p\n", lineno, ptr);
+        return ptr;
+}
+static char *xxasprintf(int lineno, const char *f, ...)
+{
+        char *ptr;
+        va_list args;
+        va_start(args, f);
+        if (vasprintf(&ptr, f, args) < 0)
+                bb_die_memory_exhausted();
+        va_end(args);
+        LEAK_PRINTF(2, "line %d: xasprintf %p\n", lineno, ptr);
         return ptr;
 }
 static void xxfree(void *ptr)
 {
-        fdprintf(2, "free %p\n", ptr);
+        LEAK_PRINTF(2, "free %p\n", ptr);
         free(ptr);
 }
-# define xmalloc(s)     xxmalloc(__LINE__, s)
-# define xrealloc(p, s) xxrealloc(__LINE__, p, s)
-# define xstrdup(s)     xxstrdup(__LINE__, s)
-# define free(p)        xxfree(p)
+# define xmalloc(s)        xxmalloc(__LINE__, s)
+# define xzalloc(s)        xxzalloc(__LINE__, s)
+# define xrealloc(p, s)    xxrealloc(__LINE__, p, s)
+# define xrealloc_getcwd_or_warn(p) xxrealloc_getcwd_or_warn(__LINE__, p)
+# define xstrdup(s)        xxstrdup(__LINE__, s)
+# define xstrndup(s, n)    xxstrndup(__LINE__, s, n)
+# define xasprintf(f, ...) xxasprintf(__LINE__, f, __VA_ARGS__)
+# define free(p)           xxfree(p)
 #endif
 
 /*
@@ -1929,7 +1974,7 @@ static void restore_G_args(save_arg_t *sv, char **argv)
  * "trap - SIGxxx":
  *    if sig is in special_sig_mask, set handler back to:
  *        record_pending_signo, or to IGN if it's a tty stop signal
- *    if sig is in fatal_sig_mask, set handler back to sigexit.
+ *    if sig is in fatal_sig_mask, set handler back to restore_ttypgrp_and_killsig_or__exit.
  *    else: set handler back to SIG_DFL
  * "trap 'cmd' SIGxxx":
  *    set handler to record_pending_signo.
@@ -1973,7 +2018,7 @@ static void record_pending_signo(int sig)
          || (G_traps && G_traps[SIGCHLD] && G_traps[SIGCHLD][0])
          /* ^^^ if SIGCHLD, interrupt line reading only if it has a trap */
         ) {
-                bb_got_signal = sig; /* for read_line_input: "we got a signal" */
+                bb_got_signal = sig; /* for read_line_input / read builtin: "we got a signal" */
         }
 #endif
 #if ENABLE_HUSH_FAST
@@ -2002,19 +2047,6 @@ static sighandler_t install_sighandler(int sig, sighandler_t handler)
         return old_sa.sa_handler;
 }
 
-static void hush_exit(int exitcode) NORETURN;
-
-static void restore_ttypgrp_and__exit(void) NORETURN;
-static void restore_ttypgrp_and__exit(void)
-{
-        /* xfunc has failed! die die die */
-        /* no EXIT traps, this is an escape hatch! */
-        G.exiting = 1;
-        hush_exit(xfunc_error_retval);
-}
-
-#if ENABLE_HUSH_JOB
-
 /* Needed only on some libc:
  * It was observed that on exit(), fgetc'ed buffered data
  * gets "unwound" via lseek(fd, -NUM, SEEK_CUR).
@@ -2028,26 +2060,20 @@ static void restore_ttypgrp_and__exit(void)
  * and in `cmd` handling.
  * If set as die_func(), this makes xfunc_die() exit via _exit(), not exit():
  */
-static void fflush_and__exit(void) NORETURN;
-static void fflush_and__exit(void)
+static NORETURN void fflush_and__exit(void)
 {
         fflush_all();
         _exit(xfunc_error_retval);
 }
 
-/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
-# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
-/* After [v]fork, in parent: restore tty pgrp on xfunc death */
-# define enable_restore_tty_pgrp_on_exit()  (die_func = restore_ttypgrp_and__exit)
-
+#if ENABLE_HUSH_JOB
 /* Restores tty foreground process group, and exits.
  * May be called as signal handler for fatal signal
  * (will resend signal to itself, producing correct exit state)
  * or called directly with -EXITCODE.
  * We also call it if xfunc is exiting.
  */
-static void sigexit(int sig) NORETURN;
-static void sigexit(int sig)
+static NORETURN void restore_ttypgrp_and_killsig_or__exit(int sig)
 {
         /* Careful: we can end up here after [v]fork. Do not restore
          * tty pgrp then, only top-level shell process does that */
@@ -2065,6 +2091,19 @@ static void sigexit(int sig)
 
         kill_myself_with_sig(sig); /* does not return */
 }
+
+static NORETURN void fflush_restore_ttypgrp_and__exit(void)
+{
+        /* xfunc has failed! die die die */
+        fflush_all();
+        restore_ttypgrp_and_killsig_or__exit(- xfunc_error_retval);
+}
+
+/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
+# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
+/* After [v]fork, in parent: restore tty pgrp on xfunc death */
+# define enable_restore_tty_pgrp_on_exit()  (die_func = fflush_restore_ttypgrp_and__exit)
+
 #else
 
 # define disable_restore_tty_pgrp_on_exit() ((void)0)
@@ -2081,7 +2120,7 @@ static sighandler_t pick_sighandler(unsigned sig)
 #if ENABLE_HUSH_JOB
                 /* is sig fatal? */
                 if (G_fatal_sig_mask & sigmask)
-                        handler = sigexit;
+                        handler = restore_ttypgrp_and_killsig_or__exit;
                 else
 #endif
                 /* sig has special handling? */
@@ -2099,11 +2138,33 @@ static sighandler_t pick_sighandler(unsigned sig)
         return handler;
 }
 
-/* Restores tty foreground process group, and exits. */
-static void hush_exit(int exitcode)
+static const char* FAST_FUNC get_local_var_value(const char *name);
+
+/* Self-explanatory.
+ * Restores tty foreground process group too.
+ */
+static NORETURN void save_history_run_exit_trap_and_exit(int exitcode)
 {
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
-        save_history(G.line_input_state); /* may be NULL */
+        if (G.line_input_state
+         && getpid() == G.root_pid /* exits in subshells do not save history */
+        ) {
+                const char *hp;
+# if ENABLE_FEATURE_SH_HISTFILESIZE
+// in bash:
+// HISTFILESIZE controls the on-disk history file size (in lines, 0=no history):
+// "When this variable is assigned a value, the history file is truncated, if necessary"
+// but we do it only at exit, not on every assignment:
+                /* Use HISTFILESIZE to limit file size */
+                hp = get_local_var_value("HISTFILESIZE");
+                if (hp)
+                        G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
+# endif
+                /* HISTFILE: "If unset, the command history is not saved when a shell exits." */
+                hp = get_local_var_value("HISTFILE");
+                G.line_input_state->hist_file = hp;
+                save_history(G.line_input_state); /* no-op if hist_file is NULL or "" */
+        }
 #endif
 
         fflush_all();
@@ -2137,7 +2198,7 @@ static void hush_exit(int exitcode)
 
         fflush_all();
 #if ENABLE_HUSH_JOB
-        sigexit(- (exitcode & 0xff));
+        restore_ttypgrp_and_killsig_or__exit(- (exitcode & 0xff));
 #else
         _exit(exitcode);
 #endif
@@ -2222,7 +2283,7 @@ static int check_and_run_traps(void)
                                 }
                         }
                         /* this restores tty pgrp, then kills us with SIGHUP */
-                        sigexit(SIGHUP);
+                        restore_ttypgrp_and_killsig_or__exit(SIGHUP);
                 }
 #endif
 #if ENABLE_HUSH_FAST
@@ -4607,6 +4668,11 @@ static int fetch_heredocs(o_string *as_string, struct pipe *pi, int heredoc_cnt,
 
                                         redir->rd_type = REDIRECT_HEREDOC2;
                                         /* redir->rd_dup is (ab)used to indicate <<- */
+                                        if (!redir->rd_filename) {
+                                                /* examples: "echo <<", "echo <<<", "echo <<>" */
+                                                syntax_error("missing here document terminator");
+                                                return -1;
+                                        }
                                         p = fetch_till_str(as_string, input,
                                                         redir->rd_filename, redir->rd_dup);
                                         if (!p) {
@@ -7366,11 +7432,6 @@ static void switch_off_special_sigs(unsigned mask)
 }
 
 #if BB_MMU
-/* never called */
-void re_execute_shell(char ***to_free, const char *s,
-                char *g_argv0, char **g_argv,
-                char **builtin_argv) NORETURN;
-
 static void reset_traps_to_defaults(void)
 {
         /* This function is always called in a child shell
@@ -7420,10 +7481,8 @@ static void reset_traps_to_defaults(void)
 
 #else /* !BB_MMU */
 
-static void re_execute_shell(char ***to_free, const char *s,
-                char *g_argv0, char **g_argv,
-                char **builtin_argv) NORETURN;
-static void re_execute_shell(char ***to_free, const char *s,
+static NORETURN void re_execute_shell(
+                char * *volatile * to_free, const char *s,
                 char *g_argv0, char **g_argv,
                 char **builtin_argv)
 {
@@ -7653,7 +7712,13 @@ static int generate_stream_from_string(const char *s, pid_t *pid_p)
         pid_t pid;
         int channel[2];
 # if !BB_MMU
-        char **to_free = NULL;
+        /* _volatile_ pointer to "char*".
+         * Or else compiler can peek from inside re_execute_shell()
+         * and see that this pointer is a local var (i.e. not globally visible),
+         * and decide to optimize out the store to it. Yes,
+         * it was seen in the wild.
+         */
+        char * *volatile to_free = NULL;
 # endif
 
         xpipe(channel);
@@ -7800,7 +7865,7 @@ static void setup_heredoc(struct redir_struct *redir)
         const char *heredoc = redir->rd_filename;
         char *expanded;
 #if !BB_MMU
-        char **to_free;
+        char * *volatile to_free;
 #endif
 
         expanded = NULL;
@@ -8275,7 +8340,7 @@ static const struct built_in_command *find_builtin(const char *name)
         return find_builtin_helper(name, bltins2, &bltins2[ARRAY_SIZE(bltins2)]);
 }
 
-#if ENABLE_HUSH_JOB && ENABLE_FEATURE_TAB_COMPLETION
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_TAB_COMPLETION
 static const char * FAST_FUNC hush_command_name(int i)
 {
         if (/*i >= 0 && */ i < ARRAY_SIZE(bltins1)) {
@@ -8441,10 +8506,8 @@ static void unset_func(const char *name)
 #define exec_function(to_free, funcp, argv) \
         exec_function(funcp, argv)
 # endif
-static void exec_function(char ***to_free,
-                const struct function *funcp,
-                char **argv) NORETURN;
-static void exec_function(char ***to_free,
+static NORETURN void exec_function(
+                char * *volatile *to_free,
                 const struct function *funcp,
                 char **argv)
 {
@@ -8540,10 +8603,8 @@ static int run_function(const struct function *funcp, char **argv)
 #define exec_builtin(to_free, x, argv) \
         exec_builtin(to_free, argv)
 #endif
-static void exec_builtin(char ***to_free,
-                const struct built_in_command *x,
-                char **argv) NORETURN;
-static void exec_builtin(char ***to_free,
+static NORETURN void exec_builtin(
+                char * *volatile *to_free,
                 const struct built_in_command *x,
                 char **argv)
 {
@@ -8566,8 +8627,7 @@ static void exec_builtin(char ***to_free,
 #endif
 }
 
-static void execvp_or_die(char **argv) NORETURN;
-static void execvp_or_die(char **argv)
+static NORETURN void execvp_or_die(char **argv)
 {
         int e;
         debug_printf_exec("execing '%s'\n", argv[0]);
@@ -8688,10 +8748,8 @@ static void if_command_vV_print_and_exit(char opt_vV, char *cmd, const char *exp
  * The at_exit handlers apparently confuse the calling process,
  * in particular stdin handling. Not sure why? -- because of vfork! (vda)
  */
-static void pseudo_exec_argv(nommu_save_t *nommu_save,
-                char **argv, int assignment_cnt,
-                char **argv_expanded) NORETURN;
-static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
+static NORETURN NOINLINE void pseudo_exec_argv(
+                volatile nommu_save_t *nommu_save,
                 char **argv, int assignment_cnt,
                 char **argv_expanded)
 {
@@ -8717,7 +8775,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 #if BB_MMU
         G.shadowed_vars_pp = NULL; /* "don't save, free them instead" */
 #else
-        G.shadowed_vars_pp = &nommu_save->old_vars;
+        /* cast away volatility */
+        G.shadowed_vars_pp = (struct variable **)&nommu_save->old_vars;
         G.var_nest_level++;
 #endif
         set_vars_and_save_old(new_env);
@@ -8844,10 +8903,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 
 /* Called after [v]fork() in run_pipe
  */
-static void pseudo_exec(nommu_save_t *nommu_save,
-                struct command *command,
-                char **argv_expanded) NORETURN;
-static void pseudo_exec(nommu_save_t *nommu_save,
+static NORETURN void pseudo_exec(
+                volatile nommu_save_t *nommu_save,
                 struct command *command,
                 char **argv_expanded)
 {
@@ -9732,8 +9789,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
 
                         /* Stores to nommu_save list of env vars putenv'ed
                          * (NOMMU, on MMU we don't need that) */
-                        /* cast away volatility... */
-                        pseudo_exec((nommu_save_t*) &nommu_save, command, argv_expanded);
+                        pseudo_exec(&nommu_save, command, argv_expanded);
                         /* pseudo_exec() does not return */
                 }
 
@@ -10121,7 +10177,7 @@ static int run_list(struct pipe *pi)
                 if (rcode != 0 && G.o_opt[OPT_O_ERREXIT]) {
                         debug_printf_exec("ERREXIT:1 errexit_depth:%d\n", G.errexit_depth);
                         if (G.errexit_depth == 0)
-                                hush_exit(rcode);
+                                save_history_run_exit_trap_and_exit(rcode);
                 }
                 G.errexit_depth = sv_errexit_depth;
 
@@ -10195,6 +10251,53 @@ static int run_and_free_list(struct pipe *pi)
 /*
  * Initialization and main
  */
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING
+static void init_line_editing(void)
+{
+        G.line_input_state = new_line_input_t(FOR_SHELL);
+# if ENABLE_FEATURE_TAB_COMPLETION
+        G.line_input_state->get_exe_name = hush_command_name;
+# endif
+# if EDITING_HAS_sh_get_var
+        G.line_input_state->sh_get_var = get_local_var_value;
+# endif
+# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
+        {
+                const char *hp = get_local_var_value("HISTFILE");
+                if (!hp) {
+                        hp = get_local_var_value("HOME");
+                        if (hp) {
+                                hp = concat_path_file(hp, ".hush_history");
+                                /* Make HISTFILE set on exit (else history won't be saved) */
+                                set_local_var_from_halves("HISTFILE", hp);
+                        }
+                } else {
+                        hp = xstrdup(hp);
+                }
+                if (hp) {
+                        G.line_input_state->hist_file = hp;
+                }
+#  if ENABLE_FEATURE_SH_HISTFILESIZE
+                hp = get_local_var_value("HISTSIZE");
+                /* Using HISTFILESIZE above to limit max_history would be WRONG:
+                 * users may set HISTFILESIZE=0 in their profile scripts
+                 * to prevent _saving_ of history files, but still want to have
+                 * non-zero history limit for in-memory list.
+                 */
+// in bash, runtime history size is controlled by HISTSIZE (0=no history),
+// HISTFILESIZE controls on-disk history file size (in lines, 0=no history):
+                G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
+// HISTFILESIZE: "The shell sets the default value to the value of HISTSIZE after reading any startup files."
+// HISTSIZE: "The shell sets the default value to 500 after reading any startup files."
+// (meaning: if the value wasn't set after startup files, the default value is set as described above)
+#  endif
+        }
+# endif
+}
+#else
+# define init_line_editing() ((void)0)
+#endif
+
 static void install_sighandlers(unsigned mask)
 {
         sighandler_t old_handler;
@@ -10333,7 +10436,6 @@ static int set_mode(int state, char mode, const char *o_opt)
 int hush_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int hush_main(int argc, char **argv)
 {
-        pid_t cached_getpid;
         enum {
                 OPT_login = (1 << 0),
         };
@@ -10346,6 +10448,11 @@ int hush_main(int argc, char **argv)
         struct variable *shell_ver;
 
         INIT_G();
+#if ENABLE_HUSH_JOB
+        die_func = fflush_restore_ttypgrp_and__exit;
+#else
+        die_func = fflush_and__exit;
+#endif
         if (EXIT_SUCCESS != 0) /* if EXIT_SUCCESS == 0, it is already done */
                 G.last_exitcode = EXIT_SUCCESS;
 #if !BB_MMU
@@ -10361,9 +10468,6 @@ int hush_main(int argc, char **argv)
                 _exit(0);
         }
         G.argv0_for_re_execing = argv[0];
-        if (G.argv0_for_re_execing[0] == '-')
-                /* reexeced hush should never be a login shell */
-                G.argv0_for_re_execing++;
 #endif
 #if ENABLE_HUSH_TRAP
 # if ENABLE_HUSH_FUNCTIONS
@@ -10376,9 +10480,8 @@ int hush_main(int argc, char **argv)
         G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
 #endif
 
-        cached_getpid = getpid();   /* for tcsetpgrp() during init */
-        G.root_pid = cached_getpid; /* for $PID  (NOMMU can override via -$HEXPID:HEXPPID:...) */
-        G.root_ppid = getppid();    /* for $PPID (NOMMU can override) */
+        G.root_pid = getpid();   /* for $PID  (NOMMU can override via -$HEXPID:HEXPPID:...) */
+        G.root_ppid = getppid(); /* for $PPID (NOMMU can override) */
 
         /* Deal with HUSH_VERSION */
         debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
@@ -10427,7 +10530,7 @@ int hush_main(int argc, char **argv)
         if (!get_local_var_value("PATH"))
                 set_local_var_from_halves("PATH", bb_default_root_path);
 
-        /* PS1/PS2 are set later, if we determine that we are interactive */
+        /* PS1/PS2/HISTFILE are set later, if we determine that we are interactive */
 
         /* bash also exports SHLVL and _,
          * and sets (but doesn't export) the following variables:
@@ -10449,7 +10552,6 @@ int hush_main(int argc, char **argv)
          * BASH_SOURCE=()
          * DIRSTACK=()
          * PIPESTATUS=([0]="0")
-         * HISTFILE=/<xxx>/.bash_history
          * HISTFILESIZE=500
          * HISTSIZE=500
          * MAILCHECK=60
@@ -10462,27 +10564,24 @@ int hush_main(int argc, char **argv)
          * PS4='+ '
          */
 
+        /* Shell is non-interactive at first. We need to call
+         * install_special_sighandlers() if we are going to execute "sh <script>",
+         * "sh -c <cmds>" or login shell's /etc/profile and friends.
+         * If we later decide that we are interactive, we run
+         * install_special_sighandlers() in order to intercept more signals.
+         */
+        install_special_sighandlers();
+
 #if NUM_SCRIPTS > 0
         if (argc < 0) {
                 char *script = get_script_content(-argc - 1);
                 G.global_argv = argv;
                 G.global_argc = string_array_len(argv);
-                //install_special_sighandlers(); - needed?
                 parse_and_run_string(script);
                 goto final_return;
         }
 #endif
 
-        /* Initialize some more globals to non-zero values */
-        die_func = restore_ttypgrp_and__exit;
-
-        /* Shell is non-interactive at first. We need to call
-         * install_special_sighandlers() if we are going to execute "sh <script>",
-         * "sh -c <cmds>" or login shell's /etc/profile and friends.
-         * If we later decide that we are interactive, we run install_special_sighandlers()
-         * in order to intercept (more) signals.
-         */
-
         /* Parse options */
         /* http://www.opengroup.org/onlinepubs/9699919799/utilities/sh.html */
         flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
@@ -10546,6 +10645,7 @@ int hush_main(int argc, char **argv)
                 case '$': {
                         unsigned long long empty_trap_mask;
 
+                        G.reexeced_on_NOMMU = 1;
                         G.root_pid = bb_strtou(optarg, &optarg, 16);
                         optarg++;
                         G.root_ppid = bb_strtou(optarg, &optarg, 16);
@@ -10559,7 +10659,6 @@ int hush_main(int argc, char **argv)
                         empty_trap_mask = bb_strtoull(optarg, &optarg, 16);
                         if (empty_trap_mask != 0) {
                                 IF_HUSH_TRAP(int sig;)
-                                install_special_sighandlers();
 # if ENABLE_HUSH_TRAP
                                 G_traps = xzalloc(sizeof(G_traps[0]) * NSIG);
                                 for (sig = 1; sig < NSIG; sig++) {
@@ -10625,7 +10724,9 @@ int hush_main(int argc, char **argv)
         G.global_argv[0] = argv[0];
 
         /* If we are login shell... */
-        if (flags & OPT_login) {
+        if (!G_reexeced_on_NOMMU /* reexeced hush should never be a login shell */
+         && (flags & OPT_login)
+        ) {
                 const char *hp = NULL;
                 HFILE *input;
 
@@ -10633,7 +10734,6 @@ int hush_main(int argc, char **argv)
                 input = hfopen("/etc/profile");
  run_profile:
                 if (input != NULL) {
-                        install_special_sighandlers();
                         parse_and_run_file(input);
                         hfclose(input);
                 }
@@ -10670,8 +10770,6 @@ int hush_main(int argc, char **argv)
                  */
                 char *script;
 
-                install_special_sighandlers();
-
                 G.global_argc--;
                 G.global_argv++;
 #if !BB_MMU
@@ -10722,7 +10820,6 @@ int hush_main(int argc, char **argv)
                         bb_simple_perror_msg_and_die(G.global_argv[0]);
                 }
                 xfunc_error_retval = 1;
-                install_special_sighandlers();
                 parse_and_run_file(input);
 #if ENABLE_FEATURE_CLEAN_UP
                 hfclose(input);
@@ -10738,126 +10835,86 @@ int hush_main(int argc, char **argv)
 
         /* A shell is interactive if the '-i' flag was given,
          * or if all of the following conditions are met:
-         *    no -c command
-         *    no arguments remaining or the -s flag given
+         *    not -c 'CMD'
+         *    not running a script (no arguments remaining, or -s flag given)
          *    standard input is a terminal
          *    standard output is a terminal
          * Refer to Posix.2, the description of the 'sh' utility.
          */
-#if ENABLE_HUSH_JOB
-        if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
-                G_saved_tty_pgrp = tcgetpgrp(STDIN_FILENO);
-                debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
-                if (G_saved_tty_pgrp < 0)
-                        G_saved_tty_pgrp = 0;
-
-                /* try to dup stdin to high fd#, >= 255 */
+#if ENABLE_HUSH_INTERACTIVE
+        if (!G_reexeced_on_NOMMU
+         && isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)
+        ) {
+                /* Try to dup stdin to high fd#, >= 255 */
                 G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
                 if (G_interactive_fd < 0) {
-                        /* try to dup to any fd */
+                        /* Try to dup to any fd */
                         G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
-                        if (G_interactive_fd < 0) {
-                                /* give up */
+                        if (G_interactive_fd < 0)
+                                /* Give up */
                                 G_interactive_fd = 0;
-                                G_saved_tty_pgrp = 0;
-                        }
                 }
-        }
-        debug_printf("interactive_fd:%d\n", G_interactive_fd);
-        if (G_interactive_fd) {
-                if (G_saved_tty_pgrp) {
-                        /* If we were run as 'hush &', sleep until we are
-                         * in the foreground (tty pgrp == our pgrp).
-                         * If we get started under a job aware app (like bash),
-                         * make sure we are now in charge so we don't fight over
-                         * who gets the foreground */
-                        while (1) {
-                                pid_t shell_pgrp = getpgrp();
-                                G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
-                                if (G_saved_tty_pgrp == shell_pgrp)
-                                        break;
-                                /* send TTIN to ourself (should stop us) */
-                                kill(- shell_pgrp, SIGTTIN);
+                debug_printf("interactive_fd:%d\n", G_interactive_fd);
+                if (G_interactive_fd) {
+// TODO? bash:
+// if interactive but not a login shell, sources ~/.bashrc
+// (--norc turns this off, --rcfile <file> overrides)
+# if ENABLE_HUSH_JOB
+                        /* Can we do job control? */
+                        G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                        debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
+                        if (G_saved_tty_pgrp < 0)
+                                G_saved_tty_pgrp = 0; /* no */
+                        if (G_saved_tty_pgrp) {
+                                /* If we were run as 'hush &', sleep until we are
+                                 * in the foreground (tty pgrp == our pgrp).
+                                 * If we get started under a job aware app (like bash),
+                                 * make sure we are now in charge so we don't fight over
+                                 * who gets the foreground */
+                                while (1) {
+                                        pid_t shell_pgrp = getpgrp();
+                                        if (G_saved_tty_pgrp == shell_pgrp) {
+/* Often both pgrps here are set to our pid - but not always!
+ * Example: sh -c 'echo $$; hush; echo FIN'
+ * Here, the parent shell is not interactive, so it does NOT set up
+ * a separate process group for its children, and we (hush) initially
+ * run in parent's process group (until we set up our own a few lines down).
+ */
+                                                //bb_error_msg("process groups tty:%d hush:%d", G_saved_tty_pgrp, shell_pgrp);
+                                                break;
+                                        }
+                                        /* Send TTIN to ourself (should stop us) */
+                                        kill(- shell_pgrp, SIGTTIN);
+                                        G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                                }
                         }
-                }
-
-                /* Install more signal handlers */
-                install_special_sighandlers();
-
-                if (G_saved_tty_pgrp) {
-                        /* Set other signals to restore saved_tty_pgrp */
-                        install_fatal_sighandlers();
-                        /* Put ourselves in our own process group
-                         * (bash, too, does this only if ctty is available) */
-                        bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
-                        /* Grab control of the terminal */
-                        tcsetpgrp(G_interactive_fd, cached_getpid);
-                }
-                enable_restore_tty_pgrp_on_exit();
-
-# if ENABLE_FEATURE_EDITING
-                G.line_input_state = new_line_input_t(FOR_SHELL);
-#  if ENABLE_FEATURE_TAB_COMPLETION
-                G.line_input_state->get_exe_name = hush_command_name;
-#  endif
-#  if EDITING_HAS_sh_get_var
-                G.line_input_state->sh_get_var = get_local_var_value;
-#  endif
 # endif
-# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
-                {
-                        const char *hp = get_local_var_value("HISTFILE");
-                        if (!hp) {
-                                hp = get_local_var_value("HOME");
-                                if (hp)
-                                        hp = concat_path_file(hp, ".hush_history");
-                        } else {
-                                hp = xstrdup(hp);
-                        }
-                        if (hp) {
-                                G.line_input_state->hist_file = hp;
-                                //set_local_var(xasprintf("HISTFILE=%s", ...));
+                        /* Install more signal handlers */
+                        install_special_sighandlers();
+# if ENABLE_HUSH_JOB
+                        if (G_saved_tty_pgrp) {
+                                /* Set fatal signals to restore saved_tty_pgrp */
+                                install_fatal_sighandlers();
+                                /* (The if() is an optimization: can avoid two redundant syscalls) */
+                                if (G_saved_tty_pgrp != G.root_pid) {
+                                        /* Put ourselves in our own process group
+                                         * (bash, too, does this only if ctty is available) */
+                                        bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
+                                        /* Grab control of the terminal */
+                                        tcsetpgrp(G_interactive_fd, G.root_pid);
+                                }
                         }
-#  if ENABLE_FEATURE_SH_HISTFILESIZE
-                        hp = get_local_var_value("HISTFILESIZE");
-                        G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
-#  endif
-                }
 # endif
-        } else {
-                install_special_sighandlers();
-        }
-#elif ENABLE_HUSH_INTERACTIVE
-        /* No job control compiled in, only prompt/line editing */
-        if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
-                G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
-                if (G_interactive_fd < 0) {
-                        /* try to dup to any fd */
-                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
-                        if (G_interactive_fd < 0)
-                                /* give up */
-                                G_interactive_fd = 0;
-                }
-        }
-        install_special_sighandlers();
-#else
-        /* We have interactiveness code disabled */
-        install_special_sighandlers();
-#endif
-        /* bash:
-         * if interactive but not a login shell, sources ~/.bashrc
-         * (--norc turns this off, --rcfile <file> overrides)
-         */
+# if ENABLE_FEATURE_EDITING_FANCY_PROMPT
+                        /* Set (but not export) PS1/2 unless already set */
+                        if (!get_local_var_value("PS1"))
+                                set_local_var_from_halves("PS1", "\\w \\$ ");
+                        if (!get_local_var_value("PS2"))
+                                set_local_var_from_halves("PS2", "> ");
+# endif
+                        init_line_editing();
 
-        if (G_interactive_fd) {
-#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
-                /* Set (but not export) PS1/2 unless already set */
-                if (!get_local_var_value("PS1"))
-                        set_local_var_from_halves("PS1", "\\w \\$ ");
-                if (!get_local_var_value("PS2"))
-                        set_local_var_from_halves("PS2", "> ");
-#endif
-                if (!ENABLE_FEATURE_SH_EXTRA_QUIET) {
+# if !ENABLE_FEATURE_SH_EXTRA_QUIET
                         /* note: ash and hush share this string */
                         printf("\n\n%s %s\n"
                                 IF_HUSH_HELP("Enter 'help' for a list of built-in commands.\n")
@@ -10865,13 +10922,15 @@ int hush_main(int argc, char **argv)
                                 bb_banner,
                                 "hush - the humble shell"
                         );
-                }
-        }
+# endif
+                } /* if become interactive */
+        } /* if on tty */
+#endif /* if INTERACTIVE is allowed by build config */
 
         parse_and_run_file(hfopen(NULL)); /* stdin */
 
  final_return:
-        hush_exit(G.last_exitcode);
+        save_history_run_exit_trap_and_exit(G.last_exitcode);
 }
 
 /*
@@ -11057,19 +11116,19 @@ static int FAST_FUNC builtin_exit(char **argv)
          * TODO: we can use G.exiting = -1 as indicator "last cmd was exit"
          */
 
-        /* note: EXIT trap is run by hush_exit */
+        /* note: EXIT trap is run by save_history_run_exit_trap_and_exit */
         argv = skip_dash_dash(argv);
         if (argv[0] == NULL) {
 #if ENABLE_HUSH_TRAP
                 if (G.pre_trap_exitcode >= 0) /* "exit" in trap uses $? from before the trap */
-                        hush_exit(G.pre_trap_exitcode);
+                        save_history_run_exit_trap_and_exit(G.pre_trap_exitcode);
 #endif
-                hush_exit(G.last_exitcode);
+                save_history_run_exit_trap_and_exit(G.last_exitcode);
         }
         /* mimic bash: exit 123abc == exit 255 + error msg */
         xfunc_error_retval = 255;
         /* bash: exit -2 == exit 254, no error msg */
-        hush_exit(xatoi(argv[0]) & 0xff);
+        save_history_run_exit_trap_and_exit(xatoi(argv[0]) & 0xff);
 }
 
 #if ENABLE_HUSH_TYPE
@@ -11175,6 +11234,11 @@ static int FAST_FUNC builtin_read(char **argv)
                         goto again;
         }
 
+        if ((uintptr_t)r == 2) /* -t SEC timeout? */
+                /* bash: "The exit status is greater than 128 if the timeout is exceeded." */
+                /* The actual value observed with bash 5.2.15: */
+                return 128 + SIGALRM;
+
         if ((uintptr_t)r > 1) {
                 bb_simple_error_msg(r);
                 r = (char*)(uintptr_t)1;
diff --git a/shell/hush_leaktool.sh b/shell/hush_leaktool.sh
index ca35ec144..3edd3df61 100755
--- a/shell/hush_leaktool.sh
+++ b/shell/hush_leaktool.sh
@@ -7,7 +7,7 @@ freelist=`grep 'free 0x' "$output" | cut -d' ' -f2 | sort | uniq | xargs`
 
 grep -v free "$output" >"$output.leaked"
 
-i=8
+i=16
 list=
 for freed in $freelist; do
     list="$list -e $freed"
@@ -15,7 +15,7 @@ for freed in $freelist; do
     echo Dropping $list
     grep -F -v $list <"$output.leaked" >"$output.temp"
     mv "$output.temp" "$output.leaked"
-    i=8
+    i=16
     list=
 done
 if test "$list"; then
@@ -23,3 +23,17 @@ if test "$list"; then
     grep -F -v $list <"$output.leaked" >"$output.temp"
     mv "$output.temp" "$output.leaked"
 fi
+
+# All remaining allocations are on addresses which were never freed.
+# * Sort them by line, grouping together allocations which allocated the same address.
+#       A leaky allocation will give many different addresses (because it's never freed,
+#       the address can not be reused).
+# * Remove the address (field #4).
+# * Count the allocations per every unique source line and alloc type.
+# * Show largest counts on top.
+cat output.leaked \
+        | sort -u \
+        | cut -d' ' -f1-3 \
+        | uniq -c \
+        | sort -rn \
+>output.leaked.counted_uniq_alloc_address
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right
new file mode 100644
index 000000000..7af73557a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right
@@ -0,0 +1 @@
+hush: syntax error: missing here document terminator
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests
new file mode 100755
index 000000000..33ccde26b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests
@@ -0,0 +1,2 @@
+echo <<
+echo Done:
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right
new file mode 100644
index 000000000..7af73557a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right
@@ -0,0 +1 @@
+hush: syntax error: missing here document terminator
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests
new file mode 100755
index 000000000..fcda11045
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests
@@ -0,0 +1,2 @@
+echo << >
+echo Done:
diff --git a/shell/hush_test/hush-misc/sig_exitcode.tests b/shell/hush_test/hush-misc/sig_exitcode.tests
index 7879dc854..67b4500f4 100755
--- a/shell/hush_test/hush-misc/sig_exitcode.tests
+++ b/shell/hush_test/hush-misc/sig_exitcode.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 exec 2>&1
 
 $THIS_SH -c 'kill -9 $$'
diff --git a/shell/hush_test/hush-misc/wait1.tests b/shell/hush_test/hush-misc/wait1.tests
index f9cf6d48c..54120319b 100755
--- a/shell/hush_test/hush-misc/wait1.tests
+++ b/shell/hush_test/hush-misc/wait1.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 2 & sleep 1 & wait $!
 echo $?
 jobs
diff --git a/shell/hush_test/hush-misc/wait2.tests b/shell/hush_test/hush-misc/wait2.tests
index be20f95a5..60f382c9f 100755
--- a/shell/hush_test/hush-misc/wait2.tests
+++ b/shell/hush_test/hush-misc/wait2.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 3 & sleep 2 & sleep 1
 wait $!
 echo $?
diff --git a/shell/hush_test/hush-misc/wait3.tests b/shell/hush_test/hush-misc/wait3.tests
index ac541c3fc..aceed1126 100755
--- a/shell/hush_test/hush-misc/wait3.tests
+++ b/shell/hush_test/hush-misc/wait3.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 2 & (sleep 1;exit 3) & wait $!
 echo $?
 jobs
diff --git a/shell/hush_test/hush-misc/wait4.tests b/shell/hush_test/hush-misc/wait4.tests
index cc34059ac..c979a38b6 100755
--- a/shell/hush_test/hush-misc/wait4.tests
+++ b/shell/hush_test/hush-misc/wait4.tests
@@ -1,2 +1,5 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 1 | (sleep 1;exit 3) & wait %1
 echo Three:$?
diff --git a/shell/hush_test/hush-misc/wait5.tests b/shell/hush_test/hush-misc/wait5.tests
index 1b4762d89..e0ac8c251 100755
--- a/shell/hush_test/hush-misc/wait5.tests
+++ b/shell/hush_test/hush-misc/wait5.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 sleep 0 | (sleep 0;exit 3) &
 sleep 1
 echo Zero:$?
diff --git a/shell/hush_test/hush-misc/wait6.tests b/shell/hush_test/hush-misc/wait6.tests
index c23713199..c09002ab0 100755
--- a/shell/hush_test/hush-misc/wait6.tests
+++ b/shell/hush_test/hush-misc/wait6.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 # In bash, "wait $!" extracts correct exitcode even if bg task has already exited
 # It prints 0, then 3:
 (sleep 0; exit 3) & sleep 1
diff --git a/shell/hush_test/hush-read/read_t.right b/shell/hush_test/hush-read/read_t.right
index 04126cbe6..3eedae275 100644
--- a/shell/hush_test/hush-read/read_t.right
+++ b/shell/hush_test/hush-read/read_t.right
@@ -1,4 +1,4 @@
-><
-><
->test<
->test<
+>te:142<
+>:142<
+>test:0<
+>test:0<
diff --git a/shell/hush_test/hush-read/read_t.tests b/shell/hush_test/hush-read/read_t.tests
index d65f1aeaa..9fbeec517 100755
--- a/shell/hush_test/hush-read/read_t.tests
+++ b/shell/hush_test/hush-read/read_t.tests
@@ -1,10 +1,10 @@
-# bash 3.2 outputs:
+# bash 5.2 outputs:
 
-# ><
-{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply<")
-# ><
-{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply<")
-# >test<
-{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply<")
-# >test<
-{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply<")
+# >te:142<
+{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply:$?<")
+# >:142<
+{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply:$?<")
+# >test:0<
+{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply:$?<")
+# >test:0<
+{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply:$?<")
diff --git a/shell/hush_test/hush-signals/catch.tests b/shell/hush_test/hush-signals/catch.tests
index d2a21d17e..4b1a08e8f 100755
--- a/shell/hush_test/hush-signals/catch.tests
+++ b/shell/hush_test/hush-signals/catch.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test ("User defined signal 2" text not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 # avoid ugly warnings about signals not being caught
 trap ":" USR1 USR2
 
diff --git a/shell/hush_test/hush-signals/signal1.tests b/shell/hush_test/hush-signals/signal1.tests
index 61943467a..c83fa1254 100755
--- a/shell/hush_test/hush-signals/signal1.tests
+++ b/shell/hush_test/hush-signals/signal1.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 trap "echo got signal" USR1
 
 for try in 1 2 3 4 5; do
diff --git a/shell/hush_test/hush-signals/signal8.tests b/shell/hush_test/hush-signals/signal8.tests
index 731af7477..cd5790164 100755
--- a/shell/hush_test/hush-signals/signal8.tests
+++ b/shell/hush_test/hush-signals/signal8.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 "$THIS_SH" -c '
 exit_func() {
     echo "Removing traps"
diff --git a/shell/hush_test/hush-signals/signal_read2.tests b/shell/hush_test/hush-signals/signal_read2.tests
index eab5b9b5b..11accd5ab 100755
--- a/shell/hush_test/hush-signals/signal_read2.tests
+++ b/shell/hush_test/hush-signals/signal_read2.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test ("Hangup" not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 $THIS_SH -c '
 (sleep 1; kill -HUP $$) &
 while true; do
diff --git a/shell/hush_test/hush-signals/subshell.tests b/shell/hush_test/hush-signals/subshell.tests
index d877f2b82..856c922d3 100755
--- a/shell/hush_test/hush-signals/subshell.tests
+++ b/shell/hush_test/hush-signals/subshell.tests
@@ -1,5 +1,8 @@
 # Non-empty traps should be reset in subshell
 
+# If job control is disabled, skip the test ("Terminated" text not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
+
 # HUP is special in interactive shells
 trap '' HUP
 # QUIT is always special
diff --git a/shell/hush_test/run-all b/shell/hush_test/run-all
index 7345fee43..ff29ca0b1 100755
--- a/shell/hush_test/run-all
+++ b/shell/hush_test/run-all
@@ -67,9 +67,12 @@ do_test()
 #               echo Running test: "$x"
                 echo -n "$1/$x:"
                 (
-                        "$THIS_SH" "./$x" 2>&1 | \
-                                grep -va "^hush: using fallback suid method$" >"$name.xx"
+                        "$THIS_SH" "./$x" >"$name.xx" 2>&1
                         r=$?
+                        # filter !FEATURE_SUID_CONFIG_QUIET message
+                        sed -i \
+                                -e "/^hush: using fallback suid method$/d" \
+                                "$name.xx"
                         # filter C library differences
                         sed -i \
                                 -e "/: invalid option /s:'::g" \
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 2702ef98a..657f0df8f 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -55,7 +55,7 @@ const char* FAST_FUNC
 shell_builtin_read(struct builtin_read_params *params)
 {
         struct pollfd pfd[1];
-#define fd (pfd[0].fd) /* -u FD */
+#define fd (pfd->fd) /* -u FD */
         unsigned err;
         unsigned end_ms; /* -t TIMEOUT */
         int nchars; /* -n NUM */
@@ -144,7 +144,7 @@ shell_builtin_read(struct builtin_read_params *params)
                  * bash seems to ignore -p PROMPT for this use case.
                  */
                 int r;
-                pfd[0].events = POLLIN;
+                pfd->events = POLLIN;
                 r = poll(pfd, 1, /*timeout:*/ 0);
                 /* Return 0 only if poll returns 1 ("one fd ready"), else return 1: */
                 return (const char *)(uintptr_t)(r <= 0);
@@ -209,13 +209,8 @@ shell_builtin_read(struct builtin_read_params *params)
                          * 32-bit unix time wrapped (year 2038+).
                          */
                         if (timeout <= 0) { /* already late? */
-#if ENABLE_PLATFORM_MINGW32
                                 retval = (const char *)(uintptr_t)2;
                                 break;
-#else
-                                retval = (const char *)(uintptr_t)1;
-                                goto ret;
-#endif
                         }
                 }
 
@@ -224,8 +219,8 @@ shell_builtin_read(struct builtin_read_params *params)
                  * regardless of SA_RESTART-ness of that signal!
                  */
                 errno = 0;
-                pfd[0].events = POLLIN;
-//TODO race with a signal arriving just before the poll!
+                pfd->events = POLLIN;
+
 #if ENABLE_PLATFORM_MINGW32
                 /* Don't poll if timeout is -1, it hurts performance.  The
                  * caution above about interrupts isn't relevant on Windows
@@ -233,15 +228,14 @@ shell_builtin_read(struct builtin_read_params *params)
                  */
                 if (timeout >= 0)
 #endif
-                if (poll(pfd, 1, timeout) <= 0) {
-                        /* timed out, or EINTR */
+                /* test bb_got_signal, then poll(), atomically wrt signals */
+                if (check_got_signal_and_poll(pfd, timeout) <= 0) {
+                        /* timed out, or some error */
                         err = errno;
-#if ENABLE_PLATFORM_MINGW32
-                        if (!err) {
+                        if (!err) { /* timed out */
                                 retval = (const char *)(uintptr_t)2;
                                 break;
                         }
-#endif
                         retval = (const char *)(uintptr_t)1;
                         goto ret;
                 }
diff --git a/testsuite/cryptpw.tests b/testsuite/cryptpw.tests
index 0dd91fe15..83bfde521 100755
--- a/testsuite/cryptpw.tests
+++ b/testsuite/cryptpw.tests
@@ -22,21 +22,93 @@ testing "cryptpw des zz" \
 #SKIP=
 
 optional USE_BB_CRYPT_SHA
-testing "cryptpw sha256" \
-        "cryptpw -m sha256 QWErty '123456789012345678901234567890'" \
-        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' "" ""
+# Note: mkpasswd-5.6.2 won't accept "-m sha256", wants "-m sha256crypt"
+testing 'cryptpw sha256' \
+        'cryptpw -m sha256 QWErty 1234567890123456' \
+        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' \
+        '' ''
+# mkpasswd-5.6.2 does not allow overlong salts, we truncate (at 16 chars for sha256)
+testing 'cryptpw sha256 overlong' \
+        'cryptpw -m sha256 QWErty 123456789012345678901234567890' \
+        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' \
+        '' ''
+testing 'cryptpw sha256 implicit' \
+        'cryptpw QWErty \$5\$1234567890123456' \
+        '$5$1234567890123456$5DxfOCmU4vRhtzfsbdK.6wSGMwwVbac7ZkWwusb8Si7\n' \
+        '' ''
+testing 'cryptpw sha256 rounds=99999' \
+        'cryptpw -m sha256 QWErty rounds=99999\$123456789012345678901234567890' \
+        '$5$rounds=99999$1234567890123456$aYellycJGZM6AKyVzaQsSrDBdTixubtMnM6J.MN0xM8\n' \
+        '' ''
+testing 'cryptpw sha256 rounds=99999 implicit' \
+        'cryptpw QWErty \$5\$rounds=99999\$123456789012345678901234567890' \
+        '$5$rounds=99999$1234567890123456$aYellycJGZM6AKyVzaQsSrDBdTixubtMnM6J.MN0xM8\n' \
+        '' ''
 
-testing "cryptpw sha256 rounds=99999" \
-        "cryptpw -m sha256 QWErty 'rounds=99999\$123456789012345678901234567890'" \
-        '$5$rounds=99999$1234567890123456$aYellycJGZM6AKyVzaQsSrDBdTixubtMnM6J.MN0xM8\n' "" ""
-
-testing "cryptpw sha512" \
-        "cryptpw -m sha512 QWErty '123456789012345678901234567890'" \
-        '$6$1234567890123456$KB7QqxFyqmJSWyQYcCuGeFukgz1bPQoipWZf7.9L7z3k8UNTXa6UikbKcUGDc2ANn7DOGmDaroxDgpK16w/RE0\n' "" ""
+testing 'cryptpw sha512' \
+        'cryptpw -m sha512 QWErty 123456789012345678901234567890' \
+        '$6$1234567890123456$KB7QqxFyqmJSWyQYcCuGeFukgz1bPQoipWZf7.9L7z3k8UNTXa6UikbKcUGDc2ANn7DOGmDaroxDgpK16w/RE0\n' \
+        '' ''
+testing 'cryptpw sha512crypt' \
+        'cryptpw -m sha512crypt QWErty 123456789012345678901234567890' \
+        '$6$1234567890123456$KB7QqxFyqmJSWyQYcCuGeFukgz1bPQoipWZf7.9L7z3k8UNTXa6UikbKcUGDc2ANn7DOGmDaroxDgpK16w/RE0\n' \
+        '' ''
+testing 'cryptpw sha512 rounds=99999' \
+        'cryptpw -m sha512 QWErty rounds=99999\$123456789012345678901234567890' \
+        '$6$rounds=99999$1234567890123456$BfF6gD6ZjUmwawH5QaAglYAxtU./yvsz0fcQ464l49aMI2DZW3j5ri28CrxK7riPWNpLuUpfaIdY751SBYKUH.\n' \
+        '' ''
+SKIP=
 
-testing "cryptpw sha512 rounds=99999" \
-        "cryptpw -m sha512 QWErty 'rounds=99999\$123456789012345678901234567890'" \
-        '$6$rounds=99999$1234567890123456$BfF6gD6ZjUmwawH5QaAglYAxtU./yvsz0fcQ464l49aMI2DZW3j5ri28CrxK7riPWNpLuUpfaIdY751SBYKUH.\n' "" ""
+optional USE_BB_CRYPT_YES
+testing 'cryptpw yescrypt' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$123456789012345678901234' \
+        '$y$j9T$123456789012345678901234$AKxw5OX/T4jD.v./IW.5tE/j7izNjw06fg3OvH1LsN9\n' \
+        '' ''
+testing 'cryptpw yescrypt with non-standard N=2048 instead of 4096 (j8T instead of j9T)' \
+        'cryptpw -m yescrypt qweRTY123@-+ j8T\$123456789012345678901234' \
+        '$y$j8T$123456789012345678901234$JQUUfopCxlfZNE8f.THJwbOkhy.XtB3GIjo9HUVioWB\n' \
+        '' ''
+# mkpasswd-5.6.2 allows short salts for yescrypt
+# ...but there is a catch. Not all of them.
+# The "partial" (not fitting in whole bytes) ascii64-encoded salt
+# is a special case. For example, "$zzz" would not even work in upstream.
+testing 'cryptpw yescrypt with empty salt' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$' \
+        '$y$j9T$$hpeksL94GXNRwnA00L3c8WFy0khFAUbCpBSak.N3Bp.\n' \
+        '' ''
+testing 'cryptpw yescrypt with 3-char salt' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$123' \
+        '$y$j9T$123$A34DMIGUbUIo3bjx66Wtk2IFoREMIw6d49it25KQh2D\n' \
+        '' ''
+# "." is not allowed in mkpasswd-5.6.2
+# ....................................
+# ".." is decoded into one zero byte (not two)
+testing 'cryptpw yescrypt with 2-char salt ".."' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$..' \
+        '$y$j9T$..$yVHeOayxOGg6cHL3.dg10u7T.qSgySfLN3uhSVSLNn/\n' \
+        '' ''
+# "..." is decoded into two zero bytes (not three, not one)
+testing 'cryptpw yescrypt with 3-char salt "..."' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$...' \
+        '$y$j9T$...$xHvJ5USZ7hFyXYbOijtEOMfZRS23cWIxu2eIBXRymA5\n' \
+        '' ''
+# "...." is decoded into three zero bytes (no surprises here)
+testing 'cryptpw yescrypt with 4-char salt "...."' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$....' \
+        '$y$j9T$....$wOnauYL2/NEtr6YQi9pi8AtV7L57sEbVOAnWJIcP9q2\n' \
+        '' ''
+# 84 chars = 21 4-char blocks which decode into 21*3 = 63 bytes.
+# The last byte of the maximum allowed salt size has to come from an incomplete
+# char block. E.g. "z/" encodes byte 0x7f. "z1" is 0xff.
+# Anything larger (e.g. "z2") is an error (it encodes 0x13f).
+testing 'cryptpw yescrypt with 86-char salt (max size)' \
+        'cryptpw -m yescrypt qweRTY123@-+ j9T\$123456789012345678901234567890123456789012345678901234567890123456789012345678901234z/' \
+        '$y$j9T$123456789012345678901234567890123456789012345678901234567890123456789012345678901234z/$Exxe8IoPXiddFsqj7iqCanRf8FyquAoB0/uceLmLjG.\n' \
+        '' ''
+testing 'cryptpw yescrypt implicit' \
+        'cryptpw qweRTY123@-+ \$y\$j9T\$123456789012345678901234' \
+        '$y$j9T$123456789012345678901234$AKxw5OX/T4jD.v./IW.5tE/j7izNjw06fg3OvH1LsN9\n' \
+        '' ''
 SKIP=
 
 exit $FAILCOUNT
diff --git a/testsuite/hexdump.tests b/testsuite/hexdump.tests
index 517ec508b..d2c0a5dc8 100755
--- a/testsuite/hexdump.tests
+++ b/testsuite/hexdump.tests
@@ -5,6 +5,17 @@
 
 . ./testing.sh
 
+input=\
+"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
+"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
+"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
+"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
+"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+
+little_endian=false
+{ printf '\0\1' | hexdump -d | grep -q 256; } && little_endian=true
+readonly little_endian
+
 # testing "description" "command" "result" "infile" "stdin"
 testing 'hexdump -C with four NULs' \
         'hexdump -C' \
@@ -43,12 +54,17 @@ testing "hexdump -e %3_u" \
   80  81  82  83  84  85  86  87  88  89  8a  8b  8c  8d  8e  8f
   f0  f1  f2  f3  f4  f5  f6  f7  f8  f9  fa  fb  fc  fd  fe  ff
 " \
-        "" \
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
-"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
-"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
-"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
-"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"\
+        "" "$input"
+
+testing "hexdump -e %3_c" \
+        "hexdump -e '16/1 \" %3_c\" \"\n\"'" \
+'  \\0 001 002 003 004 005 006  \\a  \\b  \\t  \\n  \\v  \\f  \\r 016 017
+ 020 021 022 023 024 025 026 027 030 031 032 033 034 035 036 037
+   p   q   r   s   t   u   v   w   x   y   z   {   |   }   ~ 177
+ 200 201 202 203 204 205 206 207 210 211 212 213 214 215 216 217
+ 360 361 362 363 364 365 366 367 370 371 372 373 374 375 376 377
+' \
+        "" "$input"
 
 testing "hexdump -e /1 %d" \
         "hexdump -e '16/1 \" %4d\" \"\n\"'" \
@@ -59,33 +75,74 @@ testing "hexdump -e /1 %d" \
  -128 -127 -126 -125 -124 -123 -122 -121 -120 -119 -118 -117 -116 -115 -114 -113
   -16  -15  -14  -13  -12  -11  -10   -9   -8   -7   -6   -5   -4   -3   -2   -1
 " \
-        "" \
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
-"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
-"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
-"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
-"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"\
+        "" "$input"
 
-testing "hexdump -e /2 %d" \
-        "hexdump -e '8/2 \" %6d\" \"\n\"'" \
-        "\
+$little_endian || SKIP=1
+testing "hexdump -e /2 %d (little endian)" \
+        "hexdump -e '8/2 \" %6d\" \"\n\"'" \
+        "\
     256    770   1284   1798   2312   2826   3340   3854
    4368   4882   5396   5910   6424   6938   7452   7966
   29040  29554  30068  30582  31096  31610  32124  32638
  -32384 -31870 -31356 -30842 -30328 -29814 -29300 -28786
   -3600  -3086  -2572  -2058  -1544  -1030   -516     -2
 " \
-        "" \
-"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"\
-"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"\
-"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"\
-"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"\
-"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"\
+        "" "$input"
+SKIP=
+
+$little_endian && SKIP=1
+testing "hexdump -e /2 %d (big endian)" \
+        "hexdump -e '8/2 \" %6d\" \"\n\"'" \
+        "\
+      1    515   1029   1543   2057   2571   3085   3599
+   4113   4627   5141   5655   6169   6683   7197   7711
+  28785  29299  29813  30327  30841  31355  31869  32383
+ -32639 -32125 -31611 -31097 -30583 -30069 -29555 -29041
+  -3855  -3341  -2827  -2313  -1799  -1285   -771   -257
+" \
+        "" "$input"
+SKIP=
 
-testing "hexdump -n4 -e '\"%u\"'" \
+$little_endian || SKIP=1
+testing "hexdump -e /2 %x (little endian)" \
+        "hexdump -e '8/2 \" %6x\" \"\n\"'" \
+        "\
+    100    302    504    706    908    b0a    d0c    f0e
+   1110   1312   1514   1716   1918   1b1a   1d1c   1f1e
+   7170   7372   7574   7776   7978   7b7a   7d7c   7f7e
+   8180   8382   8584   8786   8988   8b8a   8d8c   8f8e
+   f1f0   f3f2   f5f4   f7f6   f9f8   fbfa   fdfc   fffe
+" \
+        "" "$input"
+SKIP=
+
+$little_endian && SKIP=1
+testing "hexdump -e /2 %x (big endian)" \
+        "hexdump -e '8/2 \" %6x\" \"\n\"'" \
+        "\
+      1    203    405    607    809    a0b    c0d    e0f
+   1011   1213   1415   1617   1819   1a1b   1c1d   1e1f
+   7071   7273   7475   7677   7879   7a7b   7c7d   7e7f
+   8081   8283   8485   8687   8889   8a8b   8c8d   8e8f
+   f0f1   f2f3   f4f5   f6f7   f8f9   fafb   fcfd   feff
+" \
+        "" "$input"
+SKIP=
+
+$little_endian || SKIP=1
+testing "hexdump -n4 -e '\"%u\"' (little endian)" \
         "hexdump -n4 -e '\"%u\"'" \
         "12345678" \
         "" \
         "\x4e\x61\xbc\x00AAAA"
+SKIP=
+
+$little_endian && SKIP=1
+testing "hexdump -n4 -e '\"%u\"' (big endian)" \
+        "hexdump -n4 -e '\"%u\"'" \
+        "1315027968" \
+        "" \
+        "\x4e\x61\xbc\x00AAAA"
+SKIP=
 
 exit $FAILCOUNT
diff --git a/testsuite/ls.tests b/testsuite/ls.tests
index 9309d366b..a95911034 100755
--- a/testsuite/ls.tests
+++ b/testsuite/ls.tests
@@ -19,7 +19,7 @@ test x"$CONFIG_UNICODE_SUPPORT" = x"y" \
 && test x"$CONFIG_LAST_SUPPORTED_WCHAR" = x"767" \
 && test x"$CONFIG_FEATURE_LS_SORTFILES" = x"y" \
 && testing "ls unicode test with codepoints limited to 767" \
-"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1 ls.testdir" \
+"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1q ls.testdir" \
 '0001_1__Some_correct_UTF-8_text___________________________________________|
 0002_2__Boundary_condition_test_cases_____________________________________|
 0003_2.1__First_possible_sequence_of_a_certain_length_____________________|
@@ -138,7 +138,7 @@ test x"$CONFIG_UNICODE_SUPPORT" = x"y" \
 && test x"$CONFIG_SUBST_WCHAR" = x"63" \
 && test x"$CONFIG_LAST_SUPPORTED_WCHAR" = x"0" \
 && testing "ls unicode test with unlimited codepoints" \
-"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1 ls.testdir" \
+"(cd ls.testdir && sh ../ls.mk_uni_tests) && ls -1q ls.testdir" \
 '0001_1__Some_correct_UTF-8_text___________________________________________|
 0002_2__Boundary_condition_test_cases_____________________________________|
 0003_2.1__First_possible_sequence_of_a_certain_length_____________________|
@@ -262,6 +262,28 @@ test x"$CONFIG_FEATURE_LS_SORTFILES" = x"y" \
 "A\nB\nA\nB\nA\nB\n" \
 "" ""
 
+rm -rf ls.testdir 2>/dev/null
+mkdir ls.testdir || exit 1
+touch "`printf "ls.testdir/\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f_\x7f\x80\xfe\xff_\x22_\x27_\x5c"`"
+
+sq="'"
+
+# testing "test name" "command" "expected result" "file input" "stdin"
+testing "ls -q" \
+'ls -q ls.testdir' \
+'???????????????????????????????_????_"_'$sq'_\\''\n' \
+"" ""
+
+testing "ls -Q" \
+'ls -Q ls.testdir' \
+'"\\001\\002\\003\\004\\005\\006\\a\\b\\t\\n\\v\\f\\r\\016\\017\\020\\021\\022\\023\\024\\025\\026\\027\\030\\031\\032\\033\\034\\035\\036\\037_\\177\\200\\376\\377_\\"_'$sq'_\\\\"\n' \
+"" ""
+
+testing "ls -qQ" \
+'ls -qQ ls.testdir' \
+'"\\001\\002\\003\\004\\005\\006\\a\\b\\t\\n\\v\\f\\r\\016\\017\\020\\021\\022\\023\\024\\025\\026\\027\\030\\031\\032\\033\\034\\035\\036\\037_\\177\\200\\376\\377_\\"_'$sq'_\\\\"\n' \
+"" ""
+
 # Clean up
 rm -rf ls.testdir 2>/dev/null
 
diff --git a/testsuite/md5sum.tests b/testsuite/md5sum.tests
index cca26dc64..a6d2b7ffb 100755
--- a/testsuite/md5sum.tests
+++ b/testsuite/md5sum.tests
@@ -9,6 +9,7 @@
 # efe30c482e0b687e0cca0612f42ca29b
 # d41337e834377140ae7f98460d71d908598ef04f
 # 8e1d3ed57ebc130f0f72508446559eeae06451ae6d61b1e8ce46370cfb8963c3
+# c01420bb6613d4bd00396a82033e59e81486cbb045ae0dd2b4c3332e581b3ce09fb1946d6e283acec685778ff205d485
 # fe413e0f177324d1353893ca0772ceba83fd41512ba63895a0eebb703ef9feac2fb4e92b2cb430b3bda41b46b0cb4ea8307190a5cc795157cfb680a9cd635d0f
 
 if ! test "$1"; then
@@ -31,9 +32,9 @@ text=`yes "$text" | head -c 9999`
 result=`(
 n=0
 while test $n -le 999; do
-        echo "$text" | head -c $n | "$sum"
+        echo "$text" | head -c $n | $sum
         n=$(($n+1))
-done | "$sum"
+done | $sum
 )`
 if test x"$result" != x"$expected  -"; then
         echo "FAIL: $sum (r:$result exp:$expected)"
@@ -44,7 +45,7 @@ fi
 
 # GNU compat: -c EMPTY must fail (exitcode 1)!
 >EMPTY
-if "$sum" -c EMPTY 2>/dev/null; then
+if $sum -c EMPTY 2>/dev/null; then
         echo "FAIL: $sum -c EMPTY"
         : $((FAILCOUNT++))
 else
diff --git a/testsuite/od.tests b/testsuite/od.tests
index 4f245a7e8..c863bf2e8 100755
--- a/testsuite/od.tests
+++ b/testsuite/od.tests
@@ -61,7 +61,8 @@ testing "od -a (DESKTOP)" \
 "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
 SKIP=
 
-testing "od -B" \
+$little_endian || SKIP=1
+testing "od -B (little-endian)" \
         "od -B" \
 "\
 0000000 001001 005003 041101 177103
@@ -70,6 +71,16 @@ testing "od -B" \
         "" "$input"
 SKIP=
 
+$little_endian && SKIP=1
+testing "od -B (big-endian)" \
+        "od -B" \
+"\
+0000000 000402 001412 040502 041776
+0000010
+" \
+       "" "$input"
+SKIP=
+
 $little_endian || SKIP=1
 testing "od -o (little-endian)" \
         "od -o" \
diff --git a/testsuite/sha384sum.tests b/testsuite/sha384sum.tests
new file mode 100755
index 000000000..f1449d195
--- /dev/null
+++ b/testsuite/sha384sum.tests
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+. ./md5sum.tests sha384sum c01420bb6613d4bd00396a82033e59e81486cbb045ae0dd2b4c3332e581b3ce09fb1946d6e283acec685778ff205d485
diff --git a/testsuite/sha3sum.tests b/testsuite/sha3sum.tests
index 2cd8e3bf2..631141735 100755
--- a/testsuite/sha3sum.tests
+++ b/testsuite/sha3sum.tests
@@ -1,3 +1,7 @@
 #!/bin/sh
 
-. ./md5sum.tests sha3sum 11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9
+   (. ./md5sum.tests sha3sum         11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9) \
+&& (. ./md5sum.tests "sha3sum -a224" 11659f09370139f8ef384f4a6260947fafa6e4fcd87a1ef3f35410e9) \
+&& (. ./md5sum.tests "sha3sum -a256" 6f69c8d36a9a579a943d878dab38c179d2a9dde12b244aa8840002c0f3d5bb73) \
+&& (. ./md5sum.tests "sha3sum -a384" 303913449042257996a869e0378323193b4f58d90eea801b12186a3d65640bd3403d3404c63527424ec43dff842c0cd0) \
+&& (. ./md5sum.tests "sha3sum -a512" e14814dccc2fef967af74eb6710885b35dfe660a362c0609b642404987d24a13dac66ad037e6affa5c42631110231655fcf4c972b1457ac49fb83af8113fc51f)
diff --git a/testsuite/tr.tests b/testsuite/tr.tests
index 5cca299ac..96f88ccf3 100755
--- a/testsuite/tr.tests
+++ b/testsuite/tr.tests
@@ -15,6 +15,10 @@ testing "tr understands 0-9A-F" \
         "tr -cd '[0-9A-F]'" \
         "19AF" "" "19AFH\n"
 
+testing "tr does not treat [p\\-r] as a range" \
+        "tr '[p\-r]' '+'" \
+        "o+q+s+" "" "opqrs-"
+
 optional FEATURE_TR_CLASSES
 testing "tr understands [:xdigit:]" \
         "tr -cd '[:xdigit:]'" \
diff --git a/util-linux/lspci.c b/util-linux/lspci.c
index b38b46be3..25be23a01 100644
--- a/util-linux/lspci.c
+++ b/util-linux/lspci.c
@@ -47,7 +47,7 @@ static int FAST_FUNC fileAction(struct recursive_state *state UNUSED_PARAM,
         int pci_class = 0, pci_vid = 0, pci_did = 0;
         int pci_subsys_vid = 0, pci_subsys_did = 0;
 
-        char *uevent_filename = concat_path_file(fileName, "/uevent");
+        char *uevent_filename = concat_path_file(fileName, "uevent");
         parser = config_open2(uevent_filename, fopen_for_read);
         free(uevent_filename);
 
diff --git a/util-linux/lsusb.c b/util-linux/lsusb.c
index 0a9e505f4..f7d0de32d 100644
--- a/util-linux/lsusb.c
+++ b/util-linux/lsusb.c
@@ -50,7 +50,7 @@ static int FAST_FUNC fileAction(struct recursive_state *state UNUSED_PARAM,
         char *tokens[4];
         char *busnum = NULL, *devnum = NULL;
         int product_vid = 0, product_did = 0;
-        char *uevent_filename = concat_path_file(fileName, "/uevent");
+        char *uevent_filename = concat_path_file(fileName, "uevent");
 
         parser = config_open2(uevent_filename, fopen_for_read);
         free(uevent_filename);
diff --git a/win32/ioctl.c b/win32/ioctl.c
index dcb96e783..d0ed68d61 100644
--- a/win32/ioctl.c
+++ b/win32/ioctl.c
@@ -1,4 +1,5 @@
 #include "libbb.h"
+#include "lazyload.h"
 
 #if ENABLE_STTY || ENABLE_TTYSIZE
 static int mingw_get_terminal_width_height(struct winsize *win)
@@ -28,6 +29,15 @@ static int mingw_get_terminal_width_height(struct winsize *win)
 static int mingw_set_terminal_width_height(struct winsize *win)
 {
         BOOL ret;
+        DECLARE_PROC_ADDR(BOOL, GetConsoleScreenBufferInfoEx, HANDLE,
+                                PCONSOLE_SCREEN_BUFFER_INFOEX);
+        DECLARE_PROC_ADDR(BOOL, SetConsoleScreenBufferInfoEx, HANDLE,
+                                PCONSOLE_SCREEN_BUFFER_INFOEX);
+
+        if (!INIT_PROC_ADDR(kernel32.dll, GetConsoleScreenBufferInfoEx))
+                return -1;
+        if (!INIT_PROC_ADDR(kernel32.dll, SetConsoleScreenBufferInfoEx))
+                return -1;
 
         for (int fd = STDOUT_FILENO; fd <= STDERR_FILENO; ++fd) {
                 CONSOLE_SCREEN_BUFFER_INFOEX sbi;
diff --git a/win32/process.c b/win32/process.c
index 33f45ee42..0d120936e 100644
--- a/win32/process.c
+++ b/win32/process.c
@@ -795,7 +795,7 @@ UNUSED_PARAM
         return sp;
 }
 
-void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
+int FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
 {
         const char *str, *cmdline;
 
@@ -807,6 +807,7 @@ void FAST_FUNC read_cmdline(char *buf, int col, unsigned pid, const char *comm)
         else
                 cmdline = comm;
         safe_strncpy(buf, cmdline, col);
+        return 0;
 }
 
 /**
diff --git a/win32/winansi.c b/win32/winansi.c
index 9736f0568..427c71f11 100644
--- a/win32/winansi.c
+++ b/win32/winansi.c
@@ -1182,7 +1182,7 @@ char *winansi_fgets(char *s, int size, FILE *stream)
 /* Ensure that isatty(fd) returns 0 for the NUL device */
 int mingw_isatty(int fd)
 {
-        int result = _isatty(fd);
+        int result = _isatty(fd) != 0;
 
         if (result) {
                 HANDLE handle = (HANDLE) _get_osfhandle(fd);