Changeset 2725 in MondoRescue for branches/2.2.9/mindi-busybox/shell/ash.c

Timestamp:

Feb 25, 2011, 9:26:54 PM (13 years ago)

Author:

Bruno Cornec

Message:

• Update mindi-busybox to 1.18.3 to avoid problems with the tar command which is now failing on recent versions with busybox 1.7.3

File:

• branches/2.2.9/mindi-busybox/shell/ash.c (modified) (496 diffs)

branches/2.2.9/mindi-busybox/shell/ash.c

@@ -2 +2 @@
 /*
  * ash shell port for busybox
+ *
+ * This code is derived from software contributed to Berkeley by
+ * Kenneth Almquist.
+ *
+ * Original BSD copyright notice is retained at the end of this file.
  *
  * Copyright (c) 1989, 1991, 1993, 1994
@@ -9 +14 @@
  * was re-ported from NetBSD and debianized.
  *
- *
- * This code is derived from software contributed to Berkeley by
- * Kenneth Almquist.
- *
- * Licensed under the GPL v2 or later, see the file LICENSE in this tarball.
- *
- * Original BSD copyright notice is retained at the end of this file.
- */
-
-/*
- * rewrite arith.y to micro stack based cryptic algorithm by
- * Copyright (c) 2001 Aaron Lehmann <aaronl@vitelus.com>
- *
- * Modified by Paul Mundt <lethal@linux-sh.org> (c) 2004 to support
- * dynamic variables.
- *
- * Modified by Vladimir Oleynik <dzo@simtreas.ru> (c) 2001-2005 to be
- * used in busybox and size optimizations,
- * rewrote arith (see notes to this), added locale support,
- * rewrote dynamic variables.
- *
- */
-
-/*
- * The follow should be set to reflect the type of system you have:
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+
+/*
+ * The following should be set to reflect the type of system you have:
  *      JOBS -> 1 if you have Berkeley job control, 0 otherwise.
  *      define SYSV if you are running under System V.
@@ -43 +28 @@
  */
 #define DEBUG 0
-#define IFS_BROKEN
+/* Tweak debug output verbosity here */
+#define DEBUG_TIME 0
+#define DEBUG_PID 1
+#define DEBUG_SIG 1
+
 #define PROFILE 0
-#if ENABLE_ASH_JOB_CONTROL
-#define JOBS 1
-#else
-#define JOBS 0
-#endif
-
-#if DEBUG
-#define _GNU_SOURCE
-#endif
-#include "busybox.h" /* for struct bb_applet */
+
+#define JOBS ENABLE_ASH_JOB_CONTROL
+
+#include "busybox.h" /* for applet_names */
 #include <paths.h>
 #include <setjmp.h>
 #include <fnmatch.h>
-#if JOBS || ENABLE_ASH_READ_NCHARS
-#include <termios.h>
-#endif
-extern char **environ;
-
-#if defined(__uClinux__)
-#error "Do not even bother, ash will not run on uClinux"
-#endif
-
-
-/* ============ Misc helpers */
-
-#define xbarrier() do { __asm__ __volatile__ ("": : :"memory"); } while (0)
-
-/* C99 say: "char" declaration may be signed or unsigned default */
-#define signed_char2int(sc) ((int)((signed char)sc))
+#include <sys/times.h>
+
+#include "shell_common.h"
+#if ENABLE_SH_MATH_SUPPORT
+# include "math.h"
+#endif
+#if ENABLE_ASH_RANDOM_SUPPORT
+# include "random.h"
+#else
+# define CLEAR_RANDOM_T(rnd) ((void)0)
+#endif
+
+#include "NUM_APPLETS.h"
+#if NUM_APPLETS == 1
+/* STANDALONE does not make sense, and won't compile */
+# undef CONFIG_FEATURE_SH_STANDALONE
+# undef ENABLE_FEATURE_SH_STANDALONE
+# undef IF_FEATURE_SH_STANDALONE
+# undef IF_NOT_FEATURE_SH_STANDALONE
+# define ENABLE_FEATURE_SH_STANDALONE 0
+# define IF_FEATURE_SH_STANDALONE(...)
+# define IF_NOT_FEATURE_SH_STANDALONE(...) __VA_ARGS__
+#endif
+
+#ifndef PIPE_BUF
+# define PIPE_BUF 4096           /* amount of buffering in a pipe */
+#endif
+
+#if !BB_MMU
+# error "Do not even bother, ash will not run on NOMMU machine"
+#endif
+
+//applet:IF_ASH(APPLET(ash, _BB_DIR_BIN, _BB_SUID_DROP))
+//applet:IF_FEATURE_SH_IS_ASH(APPLET_ODDNAME(sh, ash, _BB_DIR_BIN, _BB_SUID_DROP, sh))
+//applet:IF_FEATURE_BASH_IS_ASH(APPLET_ODDNAME(bash, ash, _BB_DIR_BIN, _BB_SUID_DROP, bash))
+
+//kbuild:lib-$(CONFIG_ASH) += ash.o ash_ptr_hack.o shell_common.o
+//kbuild:lib-$(CONFIG_ASH_RANDOM_SUPPORT) += random.o
+
+//config:config ASH
+//config:   bool "ash"
+//config:   default y
+//config:   depends on !NOMMU
+//config:   help
+//config:     Tha 'ash' shell adds about 60k in the default configuration and is
+//config:     the most complete and most pedantically correct shell included with
+//config:     busybox. This shell is actually a derivative of the Debian 'dash'
+//config:     shell (by Herbert Xu), which was created by porting the 'ash' shell
+//config:     (written by Kenneth Almquist) from NetBSD.
+//config:
+//config:config ASH_BASH_COMPAT
+//config:   bool "bash-compatible extensions"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable bash-compatible extensions.
+//config:
+//config:config ASH_JOB_CONTROL
+//config:   bool "Job control"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable job control in the ash shell.
+//config:
+//config:config ASH_ALIAS
+//config:   bool "alias support"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable alias support in the ash shell.
+//config:
+//config:config ASH_GETOPTS
+//config:   bool "Builtin getopt to parse positional parameters"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable getopts builtin in the ash shell.
+//config:
+//config:config ASH_BUILTIN_ECHO
+//config:   bool "Builtin version of 'echo'"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable support for echo, builtin to ash.
+//config:
+//config:config ASH_BUILTIN_PRINTF
+//config:   bool "Builtin version of 'printf'"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable support for printf, builtin to ash.
+//config:
+//config:config ASH_BUILTIN_TEST
+//config:   bool "Builtin version of 'test'"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable support for test, builtin to ash.
+//config:
+//config:config ASH_CMDCMD
+//config:   bool "'command' command to override shell builtins"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable support for the ash 'command' builtin, which allows
+//config:     you to run the specified command with the specified arguments,
+//config:     even when there is an ash builtin command with the same name.
+//config:
+//config:config ASH_MAIL
+//config:   bool "Check for new mail on interactive shells"
+//config:   default n
+//config:   depends on ASH
+//config:   help
+//config:     Enable "check for new mail" in the ash shell.
+//config:
+//config:config ASH_OPTIMIZE_FOR_SIZE
+//config:   bool "Optimize for size instead of speed"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Compile ash for reduced size at the price of speed.
+//config:
+//config:config ASH_RANDOM_SUPPORT
+//config:   bool "Pseudorandom generator and $RANDOM variable"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     Enable pseudorandom generator and dynamic variable "$RANDOM".
+//config:     Each read of "$RANDOM" will generate a new pseudorandom value.
+//config:     You can reset the generator by using a specified start value.
+//config:     After "unset RANDOM" the generator will switch off and this
+//config:     variable will no longer have special treatment.
+//config:
+//config:config ASH_EXPAND_PRMT
+//config:   bool "Expand prompt string"
+//config:   default y
+//config:   depends on ASH
+//config:   help
+//config:     "PS#" may contain volatile content, such as backquote commands.
+//config:     This option recreates the prompt string from the environment
+//config:     variable each time it is displayed.
+//config:
+
+//usage:#define ash_trivial_usage NOUSAGE_STR
+//usage:#define ash_full_usage ""
+//usage:#define sh_trivial_usage NOUSAGE_STR
+//usage:#define sh_full_usage ""
+//usage:#define bash_trivial_usage NOUSAGE_STR
+//usage:#define bash_full_usage ""
+
+
+/* ============ Hash table sizes. Configurable. */
+
+#define VTABSIZE 39
+#define ATABSIZE 39
+#define CMDTABLESIZE 31         /* should be prime */
 
 
@@ -93 +216 @@
     "u"   "nounset",
     "\0"  "vi"
+#if ENABLE_ASH_BASH_COMPAT
+    ,"\0"  "pipefail"
+#endif
 #if DEBUG
     ,"\0"  "nolog"
@@ -99 +225 @@
 };
 
-#define optletters(n) optletters_optnames[(n)][0]
-#define optnames(n) (&optletters_optnames[(n)][1])
+#define optletters(n)  optletters_optnames[n][0]
+#define optnames(n)   (optletters_optnames[n] + 1)
 
 enum { NOPTS = ARRAY_SIZE(optletters_optnames) };
 
-static char optlist[NOPTS] ALIGN1;
-
+
+/* ============ Misc data */
+
+#define msg_illnum "Illegal number: %s"
+
+/*
+ * We enclose jmp_buf in a structure so that we can declare pointers to
+ * jump locations.  The global variable handler contains the location to
+ * jump to when an exception occurs, and the global variable exception_type
+ * contains a code identifying the exception.  To implement nested
+ * exception handlers, the user should save the value of handler on entry
+ * to an inner scope, set handler to point to a jmploc structure for the
+ * inner scope, and restore handler on exit from the scope.
+ */
+struct jmploc {
+    jmp_buf loc;
+};
+
+struct globals_misc {
+    /* pid of main shell */
+    int rootpid;
+    /* shell level: 0 for the main shell, 1 for its children, and so on */
+    int shlvl;
+#define rootshell (!shlvl)
+    char *minusc;  /* argument to -c option */
+
+    char *curdir; // = nullstr;     /* current working directory */
+    char *physdir; // = nullstr;    /* physical working directory */
+
+    char *arg0; /* value of $0 */
+
+    struct jmploc *exception_handler;
+
+    volatile int suppress_int; /* counter */
+    volatile /*sig_atomic_t*/ smallint pending_int; /* 1 = got SIGINT */
+    /* last pending signal */
+    volatile /*sig_atomic_t*/ smallint pending_sig;
+    smallint exception_type; /* kind of exception (0..5) */
+    /* exceptions */
+#define EXINT 0         /* SIGINT received */
+#define EXERROR 1       /* a generic error */
+#define EXSHELLPROC 2   /* execute a shell procedure */
+#define EXEXEC 3        /* command execution failed */
+#define EXEXIT 4        /* exit the shell */
+#define EXSIG 5         /* trapped signal in wait(1) */
+
+    smallint isloginsh;
+    char nullstr[1];        /* zero length string */
+
+    char optlist[NOPTS];
 #define eflag optlist[0]
 #define fflag optlist[1]
@@ -120 +294 @@
 #define uflag optlist[12]
 #define viflag optlist[13]
+#if ENABLE_ASH_BASH_COMPAT
+# define pipefail optlist[14]
+#else
+# define pipefail 0
+#endif
 #if DEBUG
-#define nolog optlist[14]
-#define debug optlist[15]
-#endif
-
-
-/* ============ Misc data */
-
-static char nullstr[1] ALIGN1;  /* zero length string */
-static const char homestr[] ALIGN1 = "HOME";
-static const char snlfmt[] ALIGN1 = "%s\n";
-static const char illnum[] ALIGN1 = "Illegal number: %s";
-
-static char *minusc;  /* argument to -c option */
-
-/* pid of main shell */
-static int rootpid;
-/* shell level: 0 for the main shell, 1 for its children, and so on */
-static int shlvl;
-#define rootshell (!shlvl)
-/* trap handler commands */
-static char *trap[NSIG];
-static smallint isloginsh;
-/* current value of signal */
-static char sigmode[NSIG - 1];
-/* indicates specified signal received */
-static char gotsig[NSIG - 1];
-static char *arg0; /* value of $0 */
+# define nolog optlist[14 + ENABLE_ASH_BASH_COMPAT]
+# define debug optlist[15 + ENABLE_ASH_BASH_COMPAT]
+#endif
+
+    /* trap handler commands */
+    /*
+     * Sigmode records the current value of the signal handlers for the various
+     * modes.  A value of zero means that the current handler is not known.
+     * S_HARD_IGN indicates that the signal was ignored on entry to the shell.
+     */
+    char sigmode[NSIG - 1];
+#define S_DFL      1            /* default signal handling (SIG_DFL) */
+#define S_CATCH    2            /* signal is caught */
+#define S_IGN      3            /* signal is ignored (SIG_IGN) */
+#define S_HARD_IGN 4            /* signal is ignored permenantly */
+
+    /* indicates specified signal received */
+    uint8_t gotsig[NSIG - 1]; /* offset by 1: "signal" 0 is meaningless */
+    uint8_t may_have_traps; /* 0: definitely no traps are set, 1: some traps may be set */
+    char *trap[NSIG];
+    char **trap_ptr;        /* used only by "trap hack" */
+
+    /* Rarely referenced stuff */
+#if ENABLE_ASH_RANDOM_SUPPORT
+    random_t random_gen;
+#endif
+    pid_t backgndpid;        /* pid of last background process */
+    smallint job_warning;    /* user was warned about stopped jobs (can be 2, 1 or 0). */
+};
+extern struct globals_misc *const ash_ptr_to_globals_misc;
+#define G_misc (*ash_ptr_to_globals_misc)
+#define rootpid     (G_misc.rootpid    )
+#define shlvl       (G_misc.shlvl      )
+#define minusc      (G_misc.minusc     )
+#define curdir      (G_misc.curdir     )
+#define physdir     (G_misc.physdir    )
+#define arg0        (G_misc.arg0       )
+#define exception_handler (G_misc.exception_handler)
+#define exception_type    (G_misc.exception_type   )
+#define suppress_int      (G_misc.suppress_int     )
+#define pending_int       (G_misc.pending_int      )
+#define pending_sig       (G_misc.pending_sig      )
+#define isloginsh   (G_misc.isloginsh  )
+#define nullstr     (G_misc.nullstr    )
+#define optlist     (G_misc.optlist    )
+#define sigmode     (G_misc.sigmode    )
+#define gotsig      (G_misc.gotsig     )
+#define may_have_traps    (G_misc.may_have_traps   )
+#define trap        (G_misc.trap       )
+#define trap_ptr    (G_misc.trap_ptr   )
+#define random_gen  (G_misc.random_gen )
+#define backgndpid  (G_misc.backgndpid )
+#define job_warning (G_misc.job_warning)
+#define INIT_G_misc() do { \
+    (*(struct globals_misc**)&ash_ptr_to_globals_misc) = xzalloc(sizeof(G_misc)); \
+    barrier(); \
+    curdir = nullstr; \
+    physdir = nullstr; \
+    trap_ptr = trap; \
+} while (0)
+
+
+/* ============ DEBUG */
+#if DEBUG
+static void trace_printf(const char *fmt, ...);
+static void trace_vprintf(const char *fmt, va_list va);
+# define TRACE(param)    trace_printf param
+# define TRACEV(param)   trace_vprintf param
+# define close(fd) do { \
+    int dfd = (fd); \
+    if (close(dfd) < 0) \
+        bb_error_msg("bug on %d: closing %d(0x%x)", \
+            __LINE__, dfd, dfd); \
+} while (0)
+#else
+# define TRACE(param)
+# define TRACEV(param)
+#endif
+
+
+/* ============ Utility functions */
+#define xbarrier() do { __asm__ __volatile__ ("": : :"memory"); } while (0)
+
+static int isdigit_str9(const char *str)
+{
+    int maxlen = 9 + 1; /* max 9 digits: 999999999 */
+    while (--maxlen && isdigit(*str))
+        str++;
+    return (*str == '\0');
+}
+
+static const char *var_end(const char *var)
+{
+    while (*var)
+        if (*var++ == '=')
+            break;
+    return var;
+}
 
 
 /* ============ Interrupts / exceptions */
-
-/*
- * We enclose jmp_buf in a structure so that we can declare pointers to
- * jump locations.  The global variable handler contains the location to
- * jump to when an exception occurs, and the global variable exception
- * contains a code identifying the exception.  To implement nested
- * exception handlers, the user should save the value of handler on entry
- * to an inner scope, set handler to point to a jmploc structure for the
- * inner scope, and restore handler on exit from the scope.
- */
-struct jmploc {
-    jmp_buf loc;
-};
-static struct jmploc *exception_handler;
-static int exception;
-/* exceptions */
-#define EXINT 0         /* SIGINT received */
-#define EXERROR 1       /* a generic error */
-#define EXSHELLPROC 2   /* execute a shell procedure */
-#define EXEXEC 3        /* command execution failed */
-#define EXEXIT 4        /* exit the shell */
-#define EXSIG 5         /* trapped signal in wait(1) */
-static volatile int suppressint;
-static volatile sig_atomic_t intpending;
-/* do we generate EXSIG events */
-static int exsig;
-/* last pending signal */
-static volatile sig_atomic_t pendingsig;
-
-/*
- * Sigmode records the current value of the signal handlers for the various
- * modes.  A value of zero means that the current handler is not known.
- * S_HARD_IGN indicates that the signal was ignored on entry to the shell,
- */
-
-#define S_DFL 1                 /* default signal handling (SIG_DFL) */
-#define S_CATCH 2               /* signal is caught */
-#define S_IGN 3                 /* signal is ignored (SIG_IGN) */
-#define S_HARD_IGN 4            /* signal is ignored permenantly */
-#define S_RESET 5               /* temporary - to reset a hard ignored sig */
-
 /*
  * These macros allow the user to suspend the handling of interrupt signals
- * over a period of time.  This is similar to SIGHOLD to or sigblock, but
+ * over a period of time.  This is similar to SIGHOLD or to sigblock, but
  * much more efficient and portable.  (But hacking the kernel is so much
  * more fun than worrying about efficiency and portability. :-))
  */
-#define INT_OFF \
-    do { \
-        suppressint++; \
-        xbarrier(); \
-    } while (0)
+#define INT_OFF do { \
+    suppress_int++; \
+    xbarrier(); \
+} while (0)
 
 /*
  * Called to raise an exception.  Since C doesn't include exceptions, we
  * just do a longjmp to the exception handler.  The type of exception is
- * stored in the global variable "exception".
- */
-static void raise_exception(int) ATTRIBUTE_NORETURN;
+ * stored in the global variable "exception_type".
+ */
+static void raise_exception(int) NORETURN;
 static void
 raise_exception(int e)
@@ -218 +426 @@
 #endif
     INT_OFF;
-    exception = e;
+    exception_type = e;
     longjmp(exception_handler->loc, 1);
 }
+#if DEBUG
+#define raise_exception(e) do { \
+    TRACE(("raising exception %d on line %d\n", (e), __LINE__)); \
+    raise_exception(e); \
+} while (0)
+#endif
 
 /*
@@ -229 +443 @@
  * defensive programming.)
  */
-static void raise_interrupt(void) ATTRIBUTE_NORETURN;
+static void raise_interrupt(void) NORETURN;
 static void
 raise_interrupt(void)
 {
-    int i;
-    sigset_t mask;
-
-    intpending = 0;
-    /* Signal is not automatically re-enabled after it is raised,
-     * do it ourself */
-    sigemptyset(&mask);
-    sigprocmask(SIG_SETMASK, &mask, 0);
-    /* pendingsig = 0; - now done in onsig() */
-
-    i = EXSIG;
+    int ex_type;
+
+    pending_int = 0;
+    /* Signal is not automatically unmasked after it is raised,
+     * do it ourself - unmask all signals */
+    sigprocmask_allsigs(SIG_UNBLOCK);
+    /* pending_sig = 0; - now done in signal_handler() */
+
+    ex_type = EXSIG;
     if (gotsig[SIGINT - 1] && !trap[SIGINT]) {
         if (!(rootshell && iflag)) {
+            /* Kill ourself with SIGINT */
             signal(SIGINT, SIG_DFL);
             raise(SIGINT);
         }
-        i = EXINT;
-    }
-    raise_exception(i);
+        ex_type = EXINT;
+    }
+    raise_exception(ex_type);
     /* NOTREACHED */
 }
-
-#if ENABLE_ASH_OPTIMIZE_FOR_SIZE
-static void
+#if DEBUG
+#define raise_interrupt() do { \
+    TRACE(("raising interrupt on line %d\n", __LINE__)); \
+    raise_interrupt(); \
+} while (0)
+#endif
+
+static IF_ASH_OPTIMIZE_FOR_SIZE(inline) void
 int_on(void)
 {
-    if (--suppressint == 0 && intpending) {
+    xbarrier();
+    if (--suppress_int == 0 && pending_int) {
         raise_interrupt();
     }
 }
 #define INT_ON int_on()
-static void
+static IF_ASH_OPTIMIZE_FOR_SIZE(inline) void
 force_int_on(void)
 {
-    suppressint = 0;
-    if (intpending)
+    xbarrier();
+    suppress_int = 0;
+    if (pending_int)
         raise_interrupt();
 }
 #define FORCE_INT_ON force_int_on()
-#else
-#define INT_ON \
-    do { \
-        xbarrier(); \
-        if (--suppressint == 0 && intpending) \
-            raise_interrupt(); \
-    } while (0)
-#define FORCE_INT_ON \
-    do { \
-        xbarrier(); \
-        suppressint = 0; \
-        if (intpending) \
-            raise_interrupt(); \
-    } while (0)
-#endif /* ASH_OPTIMIZE_FOR_SIZE */
-
-#define SAVE_INT(v) ((v) = suppressint)
-
-#define RESTORE_INT(v) \
-    do { \
-        xbarrier(); \
-        suppressint = (v); \
-        if (suppressint == 0 && intpending) \
-            raise_interrupt(); \
-    } while (0)
-
-#define EXSIGON \
-    do { \
-        exsig++; \
-        xbarrier(); \
-        if (pendingsig) \
-            raise_exception(EXSIG); \
-    } while (0)
-/* EXSIG is turned off by evalbltin(). */
-
-/*
- * Ignore a signal. Only one usage site - in forkchild()
- */
-static void
-ignoresig(int signo)
-{
-    if (sigmode[signo - 1] != S_IGN && sigmode[signo - 1] != S_HARD_IGN) {
-        signal(signo, SIG_IGN);
-    }
-    sigmode[signo - 1] = S_HARD_IGN;
-}
-
-/*
- * Signal handler. Only one usage site - in setsignal()
- */
-static void
-onsig(int signo)
-{
-    gotsig[signo - 1] = 1;
-    pendingsig = signo;
-
-    if (exsig || (signo == SIGINT && !trap[SIGINT])) {
-        if (!suppressint) {
-            pendingsig = 0;
-            raise_interrupt();
-        }
-        intpending = 1;
-    }
-}
+
+#define SAVE_INT(v) ((v) = suppress_int)
+
+#define RESTORE_INT(v) do { \
+    xbarrier(); \
+    suppress_int = (v); \
+    if (suppress_int == 0 && pending_int) \
+        raise_interrupt(); \
+} while (0)
 
 
@@ -352 +517 @@
 {
     INT_OFF;
-    fflush(stdout);
-    fflush(stderr);
-    INT_ON;
-}
-
-static void
-flush_stderr(void)
-{
-    INT_OFF;
-    fflush(stderr);
+    fflush_all();
     INT_ON;
 }
@@ -414 +570 @@
 {
     outstr(p, stderr);
-    flush_stderr();
+    flush_stdout_stderr();
 }
 
@@ -421 +577 @@
 
 /* control characters in argument strings */
-#define CTLESC '\201'           /* escape next character */
-#define CTLVAR '\202'           /* variable defn */
-#define CTLENDVAR '\203'
-#define CTLBACKQ '\204'
+#define CTL_FIRST CTLESC
+#define CTLESC       ((unsigned char)'\201')    /* escape next character */
+#define CTLVAR       ((unsigned char)'\202')    /* variable defn */
+#define CTLENDVAR    ((unsigned char)'\203')
+#define CTLBACKQ     ((unsigned char)'\204')
 #define CTLQUOTE 01             /* ored with CTLBACKQ code if in quotes */
 /*      CTLBACKQ | CTLQUOTE == '\205' */
-#define CTLARI  '\206'          /* arithmetic expression */
-#define CTLENDARI '\207'
-#define CTLQUOTEMARK '\210'
+#define CTLARI       ((unsigned char)'\206')    /* arithmetic expression */
+#define CTLENDARI    ((unsigned char)'\207')
+#define CTLQUOTEMARK ((unsigned char)'\210')
+#define CTL_LAST CTLQUOTEMARK
 
 /* variable substitution byte (follows CTLVAR) */
@@ -437 +595 @@
 
 /* values of VSTYPE field */
-#define VSNORMAL        0x1             /* normal variable:  $var or ${var} */
-#define VSMINUS         0x2             /* ${var-text} */
-#define VSPLUS          0x3             /* ${var+text} */
-#define VSQUESTION      0x4             /* ${var?message} */
-#define VSASSIGN        0x5             /* ${var=text} */
-#define VSTRIMRIGHT     0x6             /* ${var%pattern} */
-#define VSTRIMRIGHTMAX  0x7             /* ${var%%pattern} */
-#define VSTRIMLEFT      0x8             /* ${var#pattern} */
-#define VSTRIMLEFTMAX   0x9             /* ${var##pattern} */
-#define VSLENGTH        0xa             /* ${#var} */
+#define VSNORMAL        0x1     /* normal variable:  $var or ${var} */
+#define VSMINUS         0x2     /* ${var-text} */
+#define VSPLUS          0x3     /* ${var+text} */
+#define VSQUESTION      0x4     /* ${var?message} */
+#define VSASSIGN        0x5     /* ${var=text} */
+#define VSTRIMRIGHT     0x6     /* ${var%pattern} */
+#define VSTRIMRIGHTMAX  0x7     /* ${var%%pattern} */
+#define VSTRIMLEFT      0x8     /* ${var#pattern} */
+#define VSTRIMLEFTMAX   0x9     /* ${var##pattern} */
+#define VSLENGTH        0xa     /* ${#var} */
+#if ENABLE_ASH_BASH_COMPAT
+#define VSSUBSTR        0xc     /* ${var:position:length} */
+#define VSREPLACE       0xd     /* ${var/pattern/replacement} */
+#define VSREPLACEALL    0xe     /* ${var//pattern/replacement} */
+#endif
 
 static const char dolatstr[] ALIGN1 = {
@@ -452 +615 @@
 };
 
-#define NCMD 0
-#define NPIPE 1
-#define NREDIR 2
-#define NBACKGND 3
+#define NCMD      0
+#define NPIPE     1
+#define NREDIR    2
+#define NBACKGND  3
 #define NSUBSHELL 4
-#define NAND 5
-#define NOR 6
-#define NSEMI 7
-#define NIF 8
-#define NWHILE 9
-#define NUNTIL 10
-#define NFOR 11
-#define NCASE 12
-#define NCLIST 13
-#define NDEFUN 14
-#define NARG 15
-#define NTO 16
-#define NCLOBBER 17
-#define NFROM 18
-#define NFROMTO 19
-#define NAPPEND 20
-#define NTOFD 21
-#define NFROMFD 22
-#define NHERE 23
-#define NXHERE 24
-#define NNOT 25
+#define NAND      5
+#define NOR       6
+#define NSEMI     7
+#define NIF       8
+#define NWHILE    9
+#define NUNTIL   10
+#define NFOR     11
+#define NCASE    12
+#define NCLIST   13
+#define NDEFUN   14
+#define NARG     15
+#define NTO      16
+#if ENABLE_ASH_BASH_COMPAT
+#define NTO2     17
+#endif
+#define NCLOBBER 18
+#define NFROM    19
+#define NFROMTO  20
+#define NAPPEND  21
+#define NTOFD    22
+#define NFROMFD  23
+#define NHERE    24
+#define NXHERE   25
+#define NNOT     26
+#define N_NUMBER 27
 
 union node;
 
 struct ncmd {
-    int type;
+    smallint type; /* Nxxxx */
     union node *assign;
     union node *args;
@@ -489 +656 @@
 
 struct npipe {
-    int type;
-    int backgnd;
+    smallint type;
+    smallint pipe_backgnd;
     struct nodelist *cmdlist;
 };
 
 struct nredir {
-    int type;
+    smallint type;
     union node *n;
     union node *redirect;
@@ -501 +668 @@
 
 struct nbinary {
-    int type;
+    smallint type;
     union node *ch1;
     union node *ch2;
@@ -507 +674 @@
 
 struct nif {
-    int type;
+    smallint type;
     union node *test;
     union node *ifpart;
@@ -514 +681 @@
 
 struct nfor {
-    int type;
+    smallint type;
     union node *args;
     union node *body;
@@ -521 +688 @@
 
 struct ncase {
-    int type;
+    smallint type;
     union node *expr;
     union node *cases;
@@ -527 +694 @@
 
 struct nclist {
-    int type;
+    smallint type;
     union node *next;
     union node *pattern;
@@ -534 +701 @@
 
 struct narg {
-    int type;
+    smallint type;
     union node *next;
     char *text;
@@ -540 +707 @@
 };
 
+/* nfile and ndup layout must match!
+ * NTOFD (>&fdnum) uses ndup structure, but we may discover mid-flight
+ * that it is actually NTO2 (>&file), and change its type.
+ */
 struct nfile {
-    int type;
+    smallint type;
     union node *next;
     int fd;
+    int _unused_dupfd;
     union node *fname;
     char *expfname;
@@ -549 +721 @@
 
 struct ndup {
-    int type;
+    smallint type;
     union node *next;
     int fd;
     int dupfd;
     union node *vname;
+    char *_unused_expfname;
 };
 
 struct nhere {
-    int type;
+    smallint type;
     union node *next;
     int fd;
@@ -564 +737 @@
 
 struct nnot {
-    int type;
+    smallint type;
     union node *com;
 };
 
 union node {
-    int type;
+    smallint type;
     struct ncmd ncmd;
     struct npipe npipe;
@@ -585 +758 @@
 };
 
+/*
+ * NODE_EOF is returned by parsecmd when it encounters an end of file.
+ * It must be distinct from NULL.
+ */
+#define NODE_EOF ((union node *) -1L)
+
 struct nodelist {
     struct nodelist *next;
@@ -619 +798 @@
     if (debug != 1)
         return;
+    if (DEBUG_TIME)
+        fprintf(tracefile, "%u ", (int) time(NULL));
+    if (DEBUG_PID)
+        fprintf(tracefile, "[%u] ", (int) getpid());
+    if (DEBUG_SIG)
+        fprintf(tracefile, "pending s:%d i:%d(supp:%d) ", pending_sig, pending_int, suppress_int);
     va_start(va, fmt);
     vfprintf(tracefile, fmt, va);
@@ -629 +814 @@
     if (debug != 1)
         return;
+    if (DEBUG_TIME)
+        fprintf(tracefile, "%u ", (int) time(NULL));
+    if (DEBUG_PID)
+        fprintf(tracefile, "[%u] ", (int) getpid());
+    if (DEBUG_SIG)
+        fprintf(tracefile, "pending s:%d i:%d(supp:%d) ", pending_sig, pending_int, suppress_int);
     vfprintf(tracefile, fmt, va);
 }
@@ -650 +841 @@
     putc('"', tracefile);
     for (p = s; *p; p++) {
-        switch (*p) {
-        case '\n':  c = 'n';  goto backslash;
-        case '\t':  c = 't';  goto backslash;
-        case '\r':  c = 'r';  goto backslash;
-        case '"':  c = '"';  goto backslash;
-        case '\\':  c = '\\';  goto backslash;
-        case CTLESC:  c = 'e';  goto backslash;
-        case CTLVAR:  c = 'v';  goto backslash;
-        case CTLVAR+CTLQUOTE:  c = 'V'; goto backslash;
-        case CTLBACKQ:  c = 'q';  goto backslash;
-        case CTLBACKQ+CTLQUOTE:  c = 'Q'; goto backslash;
+        switch ((unsigned char)*p) {
+        case '\n': c = 'n'; goto backslash;
+        case '\t': c = 't'; goto backslash;
+        case '\r': c = 'r'; goto backslash;
+        case '\"': c = '\"'; goto backslash;
+        case '\\': c = '\\'; goto backslash;
+        case CTLESC: c = 'e'; goto backslash;
+        case CTLVAR: c = 'v'; goto backslash;
+        case CTLVAR+CTLQUOTE: c = 'V'; goto backslash;
+        case CTLBACKQ: c = 'q'; goto backslash;
+        case CTLBACKQ+CTLQUOTE: c = 'Q'; goto backslash;
  backslash:
             putc('\\', tracefile);
@@ -670 +861 @@
             else {
                 putc('\\', tracefile);
-                putc(*p >> 6 & 03, tracefile);
-                putc(*p >> 3 & 07, tracefile);
+                putc((*p >> 6) & 03, tracefile);
+                putc((*p >> 3) & 07, tracefile);
                 putc(*p & 07, tracefile);
             }
@@ -755 +946 @@
     char *p;
     struct nodelist *bqlist;
-    int subtype;
+    unsigned char subtype;
 
     if (arg->type != NARG) {
@@ -763 +954 @@
     bqlist = arg->narg.backquote;
     for (p = arg->narg.text; *p; p++) {
-        switch (*p) {
+        switch ((unsigned char)*p) {
         case CTLESC:
-            putc(*++p, fp);
+            p++;
+            putc(*p, fp);
             break;
         case CTLVAR:
@@ -774 +966 @@
                 putc('#', fp);
 
-            while (*p != '=')
-                putc(*p++, fp);
+            while (*p != '=') {
+                putc(*p, fp);
+                p++;
+            }
 
             if (subtype & VSNUL)
@@ -856 +1050 @@
         case NCLOBBER: s = ">|"; dftfd = 1; break;
         case NAPPEND:  s = ">>"; dftfd = 1; break;
+#if ENABLE_ASH_BASH_COMPAT
+        case NTO2:
+#endif
         case NTOFD:    s = ">&"; dftfd = 1; break;
-        case NFROM:    s = "<";  break;
+        case NFROM:    s = "<"; break;
         case NFROMFD:  s = "<&"; break;
         case NFROMTO:  s = "<>"; break;
@@ -884 +1081 @@
 
     indent(ind, pfx, fp);
+
+    if (n == NODE_EOF) {
+        fputs("<EOF>", fp);
+        return;
+    }
+
     switch (n->type) {
     case NSEMI:
@@ -906 +1109 @@
     case NPIPE:
         for (lp = n->npipe.cmdlist; lp; lp = lp->next) {
-            shcmd(lp->n, fp);
+            shtree(lp->n, 0, NULL, fp);
             if (lp->next)
                 fputs(" | ", fp);
         }
-        if (n->npipe.backgnd)
+        if (n->npipe.pipe_backgnd)
             fputs(" &", fp);
         if (ind >= 0)
@@ -927 +1130 @@
 {
     trace_puts("showtree called\n");
-    shtree(n, 1, NULL, stdout);
-}
-
-#define TRACE(param)    trace_printf param
-#define TRACEV(param)   trace_vprintf param
-
-#else
-
-#define TRACE(param)
-#define TRACEV(param)
+    shtree(n, 1, NULL, stderr);
+}
 
 #endif /* DEBUG */
@@ -951 +1146 @@
 };
 
-#if ENABLE_ASH_ALIAS
 struct alias;
-#endif
 
 struct strpush {
     struct strpush *prev;   /* preceding string on stack */
-    char *prevstring;
-    int prevnleft;
+    char *prev_string;
+    int prev_left_in_line;
 #if ENABLE_ASH_ALIAS
     struct alias *ap;       /* if push was associated with an alias */
@@ -968 +1161 @@
     struct parsefile *prev; /* preceding file on stack */
     int linno;              /* current line */
-    int fd;                 /* file descriptor (or -1 if string) */
-    int nleft;              /* number of chars left in this line */
-    int lleft;              /* number of chars left in this buffer */
-    char *nextc;            /* next char in buffer */
+    int pf_fd;              /* file descriptor (or -1 if string) */
+    int left_in_line;       /* number of chars left in this line */
+    int left_in_buffer;     /* number of chars left in this buffer past the line */
+    char *next_to_pgetc;    /* next char in buffer */
     char *buf;              /* input buffer */
     struct strpush *strpush; /* for pushing strings at this level */
@@ -977 +1170 @@
 };
 
-static struct parsefile basepf;         /* top level input file */
-static struct parsefile *parsefile = &basepf;  /* current input file */
+static struct parsefile basepf;        /* top level input file */
+static struct parsefile *g_parsefile = &basepf;  /* current input file */
 static int startlinno;                 /* line # where last token started */
 static char *commandname;              /* currently executing command */
 static struct strlist *cmdenviron;     /* environment for builtin command */
-static int exitstatus;                 /* exit status of last command */
+static uint8_t exitstatus;             /* exit status of last command */
 
 
@@ -994 +1187 @@
         if (strcmp(arg0, commandname))
             fprintf(stderr, "%s: ", commandname);
-        if (!iflag || parsefile->fd)
+        if (!iflag || g_parsefile->pf_fd > 0)
             fprintf(stderr, "line %d: ", startlinno);
     }
@@ -1006 +1199 @@
  * formatting.  It then raises the error exception.
  */
-static void ash_vmsg_and_raise(int, const char *, va_list) ATTRIBUTE_NORETURN;
+static void ash_vmsg_and_raise(int, const char *, va_list) NORETURN;
 static void
 ash_vmsg_and_raise(int cond, const char *msg, va_list ap)
@@ -1026 +1219 @@
 }
 
-static void ash_msg_and_raise_error(const char *, ...) ATTRIBUTE_NORETURN;
+static void ash_msg_and_raise_error(const char *, ...) NORETURN;
 static void
 ash_msg_and_raise_error(const char *msg, ...)
@@ -1038 +1231 @@
 }
 
-static void ash_msg_and_raise(int, const char *, ...) ATTRIBUTE_NORETURN;
+static void raise_error_syntax(const char *) NORETURN;
+static void
+raise_error_syntax(const char *msg)
+{
+    ash_msg_and_raise_error("syntax error: %s", msg);
+    /* NOTREACHED */
+}
+
+static void ash_msg_and_raise(int, const char *, ...) NORETURN;
 static void
 ash_msg_and_raise(int cond, const char *msg, ...)
@@ -1079 +1280 @@
 
 /* ============ Memory allocation */
+
+#if 0
+/* I consider these wrappers nearly useless:
+ * ok, they return you to nearest exception handler, but
+ * how much memory do you leak in the process, making
+ * memory starvation worse?
+ */
+static void *
+ckrealloc(void * p, size_t nbytes)
+{
+    p = realloc(p, nbytes);
+    if (!p)
+        ash_msg_and_raise_error(bb_msg_memory_exhausted);
+    return p;
+}
+
+static void *
+ckmalloc(size_t nbytes)
+{
+    return ckrealloc(NULL, nbytes);
+}
+
+static void *
+ckzalloc(size_t nbytes)
+{
+    return memset(ckmalloc(nbytes), 0, nbytes);
+}
+
+static char *
+ckstrdup(const char *s)
+{
+    char *p = strdup(s);
+    if (!p)
+        ash_msg_and_raise_error(bb_msg_memory_exhausted);
+    return p;
+}
+#else
+/* Using bbox equivalents. They exit if out of memory */
+# define ckrealloc xrealloc
+# define ckmalloc  xmalloc
+# define ckzalloc  xzalloc
+# define ckstrdup  xstrdup
+#endif
 
 /*
@@ -1089 +1333 @@
      * in some way.  The following macro will get this right
      * on many machines.  */
-    SHELL_SIZE = sizeof(union {int i; char *cp; double d; }) - 1,
+    SHELL_SIZE = sizeof(union { int i; char *cp; double d; }) - 1,
     /* Minimum size of a block */
-    MINSIZE  = SHELL_ALIGN(504),
+    MINSIZE = SHELL_ALIGN(504),
 };
 
@@ -1106 +1350 @@
 };
 
-static struct stack_block stackbase;
-static struct stack_block *stackp = &stackbase;
-static struct stackmark *markp;
-static char *stacknxt = stackbase.space;
-static size_t stacknleft = MINSIZE;
-static char *sstrend = stackbase.space + MINSIZE;
-static int herefd = -1;
-
-#define stackblock() ((void *)stacknxt)
-#define stackblocksize() stacknleft
-
-static void *
-ckrealloc(void * p, size_t nbytes)
-{
-    p = realloc(p, nbytes);
-    if (!p)
-        ash_msg_and_raise_error(bb_msg_memory_exhausted);
-    return p;
-}
-
-static void *
-ckmalloc(size_t nbytes)
-{
-    return ckrealloc(NULL, nbytes);
-}
-
-/*
- * Make a copy of a string in safe storage.
- */
-static char *
-ckstrdup(const char *s)
-{
-    char *p = strdup(s);
-    if (!p)
-        ash_msg_and_raise_error(bb_msg_memory_exhausted);
-    return p;
-}
+
+struct globals_memstack {
+    struct stack_block *g_stackp; // = &stackbase;
+    struct stackmark *markp;
+    char *g_stacknxt; // = stackbase.space;
+    char *sstrend; // = stackbase.space + MINSIZE;
+    size_t g_stacknleft; // = MINSIZE;
+    int    herefd; // = -1;
+    struct stack_block stackbase;
+};
+extern struct globals_memstack *const ash_ptr_to_globals_memstack;
+#define G_memstack (*ash_ptr_to_globals_memstack)
+#define g_stackp     (G_memstack.g_stackp    )
+#define markp        (G_memstack.markp       )
+#define g_stacknxt   (G_memstack.g_stacknxt  )
+#define sstrend      (G_memstack.sstrend     )
+#define g_stacknleft (G_memstack.g_stacknleft)
+#define herefd       (G_memstack.herefd      )
+#define stackbase    (G_memstack.stackbase   )
+#define INIT_G_memstack() do { \
+    (*(struct globals_memstack**)&ash_ptr_to_globals_memstack) = xzalloc(sizeof(G_memstack)); \
+    barrier(); \
+    g_stackp = &stackbase; \
+    g_stacknxt = stackbase.space; \
+    g_stacknleft = MINSIZE; \
+    sstrend = stackbase.space + MINSIZE; \
+    herefd = -1; \
+} while (0)
+
+
+#define stackblock()     ((void *)g_stacknxt)
+#define stackblocksize() g_stacknleft
 
 /*
@@ -1159 +1398 @@
 
     aligned = SHELL_ALIGN(nbytes);
-    if (aligned > stacknleft) {
+    if (aligned > g_stacknleft) {
         size_t len;
         size_t blocksize;
@@ -1172 +1411 @@
         INT_OFF;
         sp = ckmalloc(len);
-        sp->prev = stackp;
-        stacknxt = sp->space;
-        stacknleft = blocksize;
-        sstrend = stacknxt + blocksize;
-        stackp = sp;
+        sp->prev = g_stackp;
+        g_stacknxt = sp->space;
+        g_stacknleft = blocksize;
+        sstrend = g_stacknxt + blocksize;
+        g_stackp = sp;
         INT_ON;
     }
-    p = stacknxt;
-    stacknxt += aligned;
-    stacknleft -= aligned;
+    p = g_stacknxt;
+    g_stacknxt += aligned;
+    g_stacknleft -= aligned;
     return p;
+}
+
+static void *
+stzalloc(size_t nbytes)
+{
+    return memset(stalloc(nbytes), 0, nbytes);
 }
 
@@ -1189 +1434 @@
 {
 #if DEBUG
-    if (!p || (stacknxt < (char *)p) || ((char *)p < stackp->space)) {
-        write(2, "stunalloc\n", 10);
+    if (!p || (g_stacknxt < (char *)p) || ((char *)p < g_stackp->space)) {
+        write(STDERR_FILENO, "stunalloc\n", 10);
         abort();
     }
 #endif
-    stacknleft += stacknxt - (char *)p;
-    stacknxt = p;
+    g_stacknleft += g_stacknxt - (char *)p;
+    g_stacknxt = p;
 }
 
@@ -1211 +1456 @@
 setstackmark(struct stackmark *mark)
 {
-    mark->stackp = stackp;
-    mark->stacknxt = stacknxt;
-    mark->stacknleft = stacknleft;
+    mark->stackp = g_stackp;
+    mark->stacknxt = g_stacknxt;
+    mark->stacknleft = g_stacknleft;
     mark->marknext = markp;
     markp = mark;
@@ -1228 +1473 @@
     INT_OFF;
     markp = mark->marknext;
-    while (stackp != mark->stackp) {
-        sp = stackp;
-        stackp = sp->prev;
+    while (g_stackp != mark->stackp) {
+        sp = g_stackp;
+        g_stackp = sp->prev;
         free(sp);
     }
-    stacknxt = mark->stacknxt;
-    stacknleft = mark->stacknleft;
+    g_stacknxt = mark->stacknxt;
+    g_stacknleft = mark->stacknleft;
     sstrend = mark->stacknxt + mark->stacknleft;
     INT_ON;
@@ -1253 +1498 @@
     size_t newlen;
 
-    newlen = stacknleft * 2;
-    if (newlen < stacknleft)
+    newlen = g_stacknleft * 2;
+    if (newlen < g_stacknleft)
         ash_msg_and_raise_error(bb_msg_memory_exhausted);
     if (newlen < 128)
         newlen += 128;
 
-    if (stacknxt == stackp->space && stackp != &stackbase) {
+    if (g_stacknxt == g_stackp->space && g_stackp != &stackbase) {
         struct stack_block *oldstackp;
         struct stackmark *xmark;
@@ -1267 +1512 @@
 
         INT_OFF;
-        oldstackp = stackp;
-        sp = stackp;
+        oldstackp = g_stackp;
+        sp = g_stackp;
         prevstackp = sp->prev;
         grosslen = newlen + sizeof(struct stack_block) - MINSIZE;
         sp = ckrealloc(sp, grosslen);
         sp->prev = prevstackp;
-        stackp = sp;
-        stacknxt = sp->space;
-        stacknleft = newlen;
+        g_stackp = sp;
+        g_stacknxt = sp->space;
+        g_stacknleft = newlen;
         sstrend = sp->space + newlen;
 
@@ -1284 +1529 @@
         xmark = markp;
         while (xmark != NULL && xmark->stackp == oldstackp) {
-            xmark->stackp = stackp;
-            xmark->stacknxt = stacknxt;
-            xmark->stacknleft = stacknleft;
+            xmark->stackp = g_stackp;
+            xmark->stacknxt = g_stacknxt;
+            xmark->stacknleft = g_stacknleft;
             xmark = xmark->marknext;
         }
         INT_ON;
     } else {
-        char *oldspace = stacknxt;
-        int oldlen = stacknleft;
+        char *oldspace = g_stacknxt;
+        size_t oldlen = g_stacknleft;
         char *p = stalloc(newlen);
 
         /* free the space we just allocated */
-        stacknxt = memcpy(p, oldspace, oldlen);
-        stacknleft += newlen;
+        g_stacknxt = memcpy(p, oldspace, oldlen);
+        g_stacknleft += newlen;
     }
 }
@@ -1305 +1550 @@
 {
     len = SHELL_ALIGN(len);
-    stacknxt += len;
-    stacknleft -= len;
+    g_stacknxt += len;
+    g_stacknleft -= len;
 }
 
@@ -1335 +1580 @@
     }
     growstackblock();
-    return stackblock() + len;
+    return (char *)stackblock() + len;
 }
 
@@ -1344 +1589 @@
 makestrspace(size_t newlen, char *p)
 {
-    size_t len = p - stacknxt;
+    size_t len = p - g_stacknxt;
     size_t size = stackblocksize();
 
@@ -1356 +1601 @@
         growstackblock();
     }
-    return stackblock() + len;
+    return (char *)stackblock() + len;
 }
 
@@ -1363 +1608 @@
 {
     p = makestrspace(n, p);
-    p = memcpy(p, s, n) + n;
+    p = (char *)memcpy(p, s, n) + n;
     return p;
 }
@@ -1384 +1629 @@
 #define STARTSTACKSTR(p)        ((p) = stackblock())
 #define STPUTC(c, p)            ((p) = _STPUTC((c), (p)))
-#define CHECKSTRSPACE(n, p) \
-    do { \
-        char *q = (p); \
-        size_t l = (n); \
-        size_t m = sstrend - q; \
-        if (l > m) \
-            (p) = makestrspace(l, q); \
-    } while (0)
-#define USTPUTC(c, p)           (*p++ = (c))
-#define STACKSTRNUL(p) \
-    do { \
-        if ((p) == sstrend) \
-            p = growstackstr(); \
-        *p = '\0'; \
-    } while (0)
-#define STUNPUTC(p)             (--p)
-#define STTOPC(p)               (p[-1])
-#define STADJUST(amount, p)     (p += (amount))
+#define CHECKSTRSPACE(n, p) do { \
+    char *q = (p); \
+    size_t l = (n); \
+    size_t m = sstrend - q; \
+    if (l > m) \
+        (p) = makestrspace(l, q); \
+} while (0)
+#define USTPUTC(c, p)           (*(p)++ = (c))
+#define STACKSTRNUL(p) do { \
+    if ((p) == sstrend) \
+        (p) = growstackstr(); \
+    *(p) = '\0'; \
+} while (0)
+#define STUNPUTC(p)             (--(p))
+#define STTOPC(p)               ((p)[-1])
+#define STADJUST(amount, p)     ((p) += (amount))
 
 #define grabstackstr(p)         stalloc((char *)(p) - (char *)stackblock())
-#define ungrabstackstr(s, p)    stunalloc((s))
+#define ungrabstackstr(s, p)    stunalloc(s)
 #define stackstrend()           ((void *)sstrend)
 
@@ -1418 +1661 @@
     while (*pfx) {
         if (*pfx++ != *string++)
-            return 0;
+            return NULL;
     }
     return (char *) string;
@@ -1444 +1687 @@
 {
     if (!is_number(s))
-        ash_msg_and_raise_error(illnum, s);
+        ash_msg_and_raise_error(msg_illnum, s);
     return atoi(s);
 }
@@ -1468 +1711 @@
 
         *q++ = '\'';
-        q = memcpy(q, s, len) + len;
+        q = (char *)memcpy(q, s, len) + len;
         *q++ = '\'';
         s += len;
@@ -1474 +1717 @@
         STADJUST(q - p, p);
 
-        len = strspn(s, "'");
-        if (!len)
+        if (*s != '\'')
             break;
+        len = 0;
+        do len++; while (*++s == '\'');
 
         q = p = makestrspace(len + 3, p);
 
         *q++ = '"';
-        q = memcpy(q, s, len) + len;
+        q = (char *)memcpy(q, s - len, len) + len;
         *q++ = '"';
-        s += len;
 
         STADJUST(q - p, p);
     } while (*s);
 
-    USTPUTC(0, p);
+    USTPUTC('\0', p);
 
     return stackblock();
@@ -1501 +1744 @@
 
 /*
- * XXX - should get rid of.  have all builtins use getopt(3).  the
- * library getopt must have the BSD extension static variable "optreset"
- * otherwise it can't be used within the shell safely.
+ * XXX - should get rid of. Have all builtins use getopt(3).
+ * The library getopt must have the BSD extension static variable
+ * "optreset", otherwise it can't be used within the shell safely.
  *
- * Standard option processing (a la getopt) for builtin routines.  The
- * only argument that is passed to nextopt is the option string; the
- * other arguments are unnecessary.  It return the character, or '\0' on
- * end of input.
+ * Standard option processing (a la getopt) for builtin routines.
+ * The only argument that is passed to nextopt is the option string;
+ * the other arguments are unnecessary. It returns the character,
+ * or '\0' on end of input.
  */
 static int
@@ -1519 +1762 @@
     p = optptr;
     if (p == NULL || *p == '\0') {
+        /* We ate entire "-param", take next one */
         p = *argptr;
-        if (p == NULL || *p != '-' || *++p == '\0')
+        if (p == NULL)
+            return '\0';
+        if (*p != '-')
+            return '\0';
+        if (*++p == '\0') /* just "-" ? */
             return '\0';
         argptr++;
-        if (LONE_DASH(p))        /* check for "--" */
+        if (LONE_DASH(p)) /* "--" ? */
             return '\0';
-    }
+        /* p => next "-param" */
+    }
+    /* p => some option char in the middle of a "-param" */
     c = *p++;
-    for (q = optstring; *q != c; ) {
+    for (q = optstring; *q != c;) {
         if (*q == '\0')
             ash_msg_and_raise_error("illegal option -%c", c);
@@ -1534 +1784 @@
     }
     if (*++q == ':') {
-        if (*p == '\0' && (p = *argptr++) == NULL)
-            ash_msg_and_raise_error("no arg for -%c option", c);
+        if (*p == '\0') {
+            p = *argptr++;
+            if (p == NULL)
+                ash_msg_and_raise_error("no arg for -%c option", c);
+        }
         optionarg = p;
         p = NULL;
@@ -1544 +1797 @@
 
 
-/* ============ Math support definitions */
-
-#if ENABLE_ASH_MATH_SUPPORT_64
-typedef int64_t arith_t;
-#define arith_t_type long long
-#else
-typedef long arith_t;
-#define arith_t_type long
-#endif
-
-#if ENABLE_ASH_MATH_SUPPORT
-static arith_t dash_arith(const char *);
-static arith_t arith(const char *expr, int *perrcode);
-#endif
-
-#if ENABLE_ASH_RANDOM_SUPPORT
-static unsigned long rseed;
-#ifndef DYNAMIC_VAR
-#define DYNAMIC_VAR
-#endif
-#endif
-
-
 /* ============ Shell variables */
+
+/*
+ * The parsefile structure pointed to by the global variable parsefile
+ * contains information about the current file being read.
+ */
+struct shparam {
+    int nparam;             /* # of positional parameters (without $0) */
+#if ENABLE_ASH_GETOPTS
+    int optind;             /* next parameter to be processed by getopts */
+    int optoff;             /* used by getopts */
+#endif
+    unsigned char malloced; /* if parameter list dynamically allocated */
+    char **p;               /* parameter list */
+};
+
+/*
+ * Free the list of positional parameters.
+ */
+static void
+freeparam(volatile struct shparam *param)
+{
+    if (param->malloced) {
+        char **ap, **ap1;
+        ap = ap1 = param->p;
+        while (*ap)
+            free(*ap++);
+        free(ap1);
+    }
+}
+
+#if ENABLE_ASH_GETOPTS
+static void FAST_FUNC getoptsreset(const char *value);
+#endif
+
+struct var {
+    struct var *next;               /* next entry in hash list */
+    int flags;                      /* flags are defined above */
+    const char *var_text;           /* name=value */
+    void (*var_func)(const char *) FAST_FUNC; /* function to be called when  */
+                    /* the variable gets set/unset */
+};
+
+struct localvar {
+    struct localvar *next;          /* next local variable in list */
+    struct var *vp;                 /* the variable that was made local */
+    int flags;                      /* saved flags */
+    const char *text;               /* saved text */
+};
 
 /* flags */
@@ -1579 +1857 @@
 #define VNOSET          0x80    /* do not set variable - just readonly test */
 #define VNOSAVE         0x100   /* when text is on the heap before setvareq */
-#ifdef DYNAMIC_VAR
+#if ENABLE_ASH_RANDOM_SUPPORT
 # define VDYNAMIC       0x200   /* dynamic variable */
 #else
@@ -1585 +1863 @@
 #endif
 
-#ifdef IFS_BROKEN
-static const char defifsvar[] ALIGN1 = "IFS= \t\n";
-#define defifs (defifsvar + 4)
-#else
-static const char defifs[] ALIGN1 = " \t\n";
-#endif
-
-struct shparam {
-    int nparam;             /* # of positional parameters (without $0) */
-    unsigned char malloc;   /* if parameter list dynamically allocated */
-    char **p;               /* parameter list */
-#if ENABLE_ASH_GETOPTS
-    int optind;             /* next parameter to be processed by getopts */
-    int optoff;             /* used by getopts */
-#endif
-};
-
-static struct shparam shellparam;      /* $@ current positional parameters */
-
-/*
- * Free the list of positional parameters.
- */
-static void
-freeparam(volatile struct shparam *param)
-{
-    char **ap;
-
-    if (param->malloc) {
-        for (ap = param->p; *ap; ap++)
-            free(*ap);
-        free(param->p);
-    }
-}
-
-#if ENABLE_ASH_GETOPTS
-static void
-getoptsreset(const char *value)
-{
-    shellparam.optind = number(value);
-    shellparam.optoff = -1;
-}
-#endif
-
-struct var {
-    struct var *next;               /* next entry in hash list */
-    int flags;                      /* flags are defined above */
-    const char *text;               /* name=value */
-    void (*func)(const char *);     /* function to be called when  */
-                    /* the variable gets set/unset */
-};
-
-struct localvar {
-    struct localvar *next;          /* next local variable in list */
-    struct var *vp;                 /* the variable that was made local */
-    int flags;                      /* saved flags */
-    const char *text;               /* saved text */
-};
-
-/* Forward decls for varinit[] */
+
+/* Need to be before varinit_data[] */
 #if ENABLE_LOCALE_SUPPORT
-static void
+static void FAST_FUNC
 change_lc_all(const char *value)
 {
@@ -1651 +1872 @@
         setlocale(LC_ALL, value);
 }
-static void
+static void FAST_FUNC
 change_lc_ctype(const char *value)
 {
@@ -1660 +1881 @@
 #if ENABLE_ASH_MAIL
 static void chkmail(void);
-static void changemail(const char *);
-#endif
-static void changepath(const char *);
+static void changemail(const char *) FAST_FUNC;
+#endif
+static void changepath(const char *) FAST_FUNC;
 #if ENABLE_ASH_RANDOM_SUPPORT
-static void change_random(const char *);
-#endif
-
-static struct var varinit[] = {
-#ifdef IFS_BROKEN
-    { NULL, VSTRFIXED|VTEXTFIXED,           defifsvar,      NULL },
+static void change_random(const char *) FAST_FUNC;
+#endif
+
+static const struct {
+    int flags;
+    const char *var_text;
+    void (*var_func)(const char *) FAST_FUNC;
+} varinit_data[] = {
+    { VSTRFIXED|VTEXTFIXED       , defifsvar   , NULL            },
+#if ENABLE_ASH_MAIL
+    { VSTRFIXED|VTEXTFIXED|VUNSET, "MAIL"      , changemail      },
+    { VSTRFIXED|VTEXTFIXED|VUNSET, "MAILPATH"  , changemail      },
+#endif
+    { VSTRFIXED|VTEXTFIXED       , bb_PATH_root_path, changepath },
+    { VSTRFIXED|VTEXTFIXED       , "PS1=$ "    , NULL            },
+    { VSTRFIXED|VTEXTFIXED       , "PS2=> "    , NULL            },
+    { VSTRFIXED|VTEXTFIXED       , "PS4=+ "    , NULL            },
+#if ENABLE_ASH_GETOPTS
+    { VSTRFIXED|VTEXTFIXED       , "OPTIND=1"  , getoptsreset    },
+#endif
+#if ENABLE_ASH_RANDOM_SUPPORT
+    { VSTRFIXED|VTEXTFIXED|VUNSET|VDYNAMIC, "RANDOM", change_random },
+#endif
+#if ENABLE_LOCALE_SUPPORT
+    { VSTRFIXED|VTEXTFIXED|VUNSET, "LC_ALL"    , change_lc_all   },
+    { VSTRFIXED|VTEXTFIXED|VUNSET, "LC_CTYPE"  , change_lc_ctype },
+#endif
+#if ENABLE_FEATURE_EDITING_SAVEHISTORY
+    { VSTRFIXED|VTEXTFIXED|VUNSET, "HISTFILE"  , NULL            },
+#endif
+};
+
+struct redirtab;
+
+struct globals_var {
+    struct shparam shellparam;      /* $@ current positional parameters */
+    struct redirtab *redirlist;
+    int g_nullredirs;
+    int preverrout_fd;   /* save fd2 before print debug if xflag is set. */
+    struct var *vartab[VTABSIZE];
+    struct var varinit[ARRAY_SIZE(varinit_data)];
+};
+extern struct globals_var *const ash_ptr_to_globals_var;
+#define G_var (*ash_ptr_to_globals_var)
+#define shellparam    (G_var.shellparam   )
+//#define redirlist     (G_var.redirlist    )
+#define g_nullredirs  (G_var.g_nullredirs )
+#define preverrout_fd (G_var.preverrout_fd)
+#define vartab        (G_var.vartab       )
+#define varinit       (G_var.varinit      )
+#define INIT_G_var() do { \
+    unsigned i; \
+    (*(struct globals_var**)&ash_ptr_to_globals_var) = xzalloc(sizeof(G_var)); \
+    barrier(); \
+    for (i = 0; i < ARRAY_SIZE(varinit_data); i++) { \
+        varinit[i].flags    = varinit_data[i].flags; \
+        varinit[i].var_text = varinit_data[i].var_text; \
+        varinit[i].var_func = varinit_data[i].var_func; \
+    } \
+} while (0)
+
+#define vifs      varinit[0]
+#if ENABLE_ASH_MAIL
+# define vmail    (&vifs)[1]
+# define vmpath   (&vmail)[1]
+# define vpath    (&vmpath)[1]
 #else
-    { NULL, VSTRFIXED|VTEXTFIXED|VUNSET,    "IFS\0",        NULL },
-#endif
-#if ENABLE_ASH_MAIL
-    { NULL, VSTRFIXED|VTEXTFIXED|VUNSET,    "MAIL\0",       changemail },
-    { NULL, VSTRFIXED|VTEXTFIXED|VUNSET,    "MAILPATH\0",   changemail },
-#endif
-    { NULL, VSTRFIXED|VTEXTFIXED,           bb_PATH_root_path, changepath },
-    { NULL, VSTRFIXED|VTEXTFIXED,           "PS1=$ ",       NULL },
-    { NULL, VSTRFIXED|VTEXTFIXED,           "PS2=> ",       NULL },
-    { NULL, VSTRFIXED|VTEXTFIXED,           "PS4=+ ",       NULL },
+# define vpath    (&vifs)[1]
+#endif
+#define vps1      (&vpath)[1]
+#define vps2      (&vps1)[1]
+#define vps4      (&vps2)[1]
 #if ENABLE_ASH_GETOPTS
-    { NULL, VSTRFIXED|VTEXTFIXED,           "OPTIND=1",     getoptsreset },
-#endif
-#if ENABLE_ASH_RANDOM_SUPPORT
-    { NULL, VSTRFIXED|VTEXTFIXED|VUNSET|VDYNAMIC, "RANDOM\0", change_random },
-#endif
-#if ENABLE_LOCALE_SUPPORT
-    { NULL, VSTRFIXED | VTEXTFIXED | VUNSET, "LC_ALL\0",    change_lc_all },
-    { NULL, VSTRFIXED | VTEXTFIXED | VUNSET, "LC_CTYPE\0",  change_lc_ctype },
-#endif
-#if ENABLE_FEATURE_EDITING_SAVEHISTORY
-    { NULL, VSTRFIXED | VTEXTFIXED | VUNSET, "HISTFILE\0",  NULL },
-#endif
-};
-
-#define vifs varinit[0]
-#if ENABLE_ASH_MAIL
-#define vmail (&vifs)[1]
-#define vmpath (&vmail)[1]
+# define voptind  (&vps4)[1]
+# if ENABLE_ASH_RANDOM_SUPPORT
+#  define vrandom (&voptind)[1]
+# endif
 #else
-#define vmpath vifs
-#endif
-#define vpath (&vmpath)[1]
-#define vps1 (&vpath)[1]
-#define vps2 (&vps1)[1]
-#define vps4 (&vps2)[1]
-#define voptind (&vps4)[1]
-#if ENABLE_ASH_GETOPTS
-#define vrandom (&voptind)[1]
-#else
-#define vrandom (&vps4)[1]
+# if ENABLE_ASH_RANDOM_SUPPORT
+#  define vrandom (&vps4)[1]
+# endif
 #endif
 
@@ -1719 +1973 @@
  * for unset variables.
  */
-#define ifsval()        (vifs.text + 4)
+#define ifsval()        (vifs.var_text + 4)
 #define ifsset()        ((vifs.flags & VUNSET) == 0)
-#define mailval()       (vmail.text + 5)
-#define mpathval()      (vmpath.text + 9)
-#define pathval()       (vpath.text + 5)
-#define ps1val()        (vps1.text + 4)
-#define ps2val()        (vps2.text + 4)
-#define ps4val()        (vps4.text + 4)
-#define optindval()     (voptind.text + 7)
-
-#define mpathset()      ((vmpath.flags & VUNSET) == 0)
-
-/*
- * The parsefile structure pointed to by the global variable parsefile
- * contains information about the current file being read.
- */
-struct redirtab {
-    struct redirtab *next;
-    int renamed[10];
-    int nullredirs;
-};
-
-static struct redirtab *redirlist;
-static int nullredirs;
-static int preverrout_fd;   /* save fd2 before print debug if xflag is set. */
-
-#define VTABSIZE 39
-
-static struct var *vartab[VTABSIZE];
-
+#if ENABLE_ASH_MAIL
+# define mailval()      (vmail.var_text + 5)
+# define mpathval()     (vmpath.var_text + 9)
+# define mpathset()     ((vmpath.flags & VUNSET) == 0)
+#endif
+#define pathval()       (vpath.var_text + 5)
+#define ps1val()        (vps1.var_text + 4)
+#define ps2val()        (vps2.var_text + 4)
+#define ps4val()        (vps4.var_text + 4)
+#if ENABLE_ASH_GETOPTS
+# define optindval()    (voptind.var_text + 7)
+#endif
+
+#if ENABLE_ASH_GETOPTS
+static void FAST_FUNC
+getoptsreset(const char *value)
+{
+    shellparam.optind = number(value);
+    shellparam.optoff = -1;
+}
+#endif
+
+/* math.h has these, otherwise define our private copies */
+#if !ENABLE_SH_MATH_SUPPORT
 #define is_name(c)      ((c) == '_' || isalpha((unsigned char)(c)))
 #define is_in_name(c)   ((c) == '_' || isalnum((unsigned char)(c)))
-
-/*
- * Return of a legal variable name (a letter or underscore followed by zero or
- * more letters, underscores, and digits).
- */
-static char *
+/*
+ * Return the pointer to the first char which is not part of a legal variable name
+ * (a letter or underscore followed by letters, underscores, and digits).
+ */
+static const char*
 endofname(const char *name)
 {
-    char *p;
-
-    p = (char *) name;
-    if (!is_name(*p))
-        return p;
-    while (*++p) {
-        if (!is_in_name(*p))
+    if (!is_name(*name))
+        return name;
+    while (*++name) {
+        if (!is_in_name(*name))
             break;
     }
-    return p;
-}
+    return name;
+}
+#endif
 
 /*
@@ -1795 +2042 @@
 }
 
-static int
-varequal(const char *a, const char *b)
-{
-    return !varcmp(a, b);
-}
-
 /*
  * Find the appropriate entry in the hash table from the name.
@@ -1835 +2076 @@
      */
 #if ENABLE_FEATURE_EDITING && ENABLE_FEATURE_EDITING_FANCY_PROMPT
-    vps1.text = "PS1=\\w \\$ ";
+    vps1.var_text = "PS1=\\w \\$ ";
 #else
     if (!geteuid())
-        vps1.text = "PS1=# ";
+        vps1.var_text = "PS1=# ";
 #endif
     vp = varinit;
     end = vp + ARRAY_SIZE(varinit);
     do {
-        vpp = hashvar(vp->text);
+        vpp = hashvar(vp->var_text);
         vp->next = *vpp;
         *vpp = vp;
@@ -1853 +2094 @@
 {
     for (; *vpp; vpp = &(*vpp)->next) {
-        if (varequal((*vpp)->text, name)) {
+        if (varcmp((*vpp)->var_text, name) == 0) {
             break;
         }
@@ -1863 +2104 @@
  * Find the value of a variable.  Returns NULL if not set.
  */
-static char *
+static const char* FAST_FUNC
 lookupvar(const char *name)
 {
@@ -1870 +2111 @@
     v = *findvar(hashvar(name), name);
     if (v) {
-#ifdef DYNAMIC_VAR
+#if ENABLE_ASH_RANDOM_SUPPORT
     /*
      * Dynamic variables are implemented roughly the same way they are
@@ -1877 +2118 @@
      * lookup will no longer happen at that point. -- PFM.
      */
-        if ((v->flags & VDYNAMIC))
-            (*v->func)(NULL);
+        if (v->flags & VDYNAMIC)
+            v->var_func(NULL);
 #endif
         if (!(v->flags & VUNSET))
-            return strchrnul(v->text, '=') + 1;
+            return var_end(v->var_text);
     }
     return NULL;
@@ -1889 +2130 @@
  * Search the environment of a builtin command.
  */
-static char *
+static const char *
 bltinlookup(const char *name)
 {
@@ -1895 +2136 @@
 
     for (sp = cmdenviron; sp; sp = sp->next) {
-        if (varequal(sp->text, name))
-            return strchrnul(sp->text, '=') + 1;
+        if (varcmp(sp->text, name) == 0)
+            return var_end(sp->text);
     }
     return lookupvar(name);
@@ -1922 +2163 @@
             if (flags & VNOSAVE)
                 free(s);
-            n = vp->text;
+            n = vp->var_text;
             ash_msg_and_raise_error("%.*s: is read only", strchrnul(n, '=') - n, n);
         }
@@ -1929 +2170 @@
             return;
 
-        if (vp->func && (flags & VNOFUNC) == 0)
-            (*vp->func)(strchrnul(s, '=') + 1);
-
-        if ((vp->flags & (VTEXTFIXED|VSTACK)) == 0)
-            free((char*)vp->text);
+        if (vp->var_func && !(flags & VNOFUNC))
+            vp->var_func(var_end(s));
+
+        if (!(vp->flags & (VTEXTFIXED|VSTACK)))
+            free((char*)vp->var_text);
 
         flags |= vp->flags & ~(VTEXTFIXED|VSTACK|VNOSAVE|VUNSET);
     } else {
+        /* variable s is not found */
         if (flags & VNOSET)
             return;
-        /* not found */
-        vp = ckmalloc(sizeof(*vp));
+        vp = ckzalloc(sizeof(*vp));
         vp->next = *vpp;
-        vp->func = NULL;
+        /*vp->func = NULL; - ckzalloc did it */
         *vpp = vp;
     }
     if (!(flags & (VTEXTFIXED|VSTACK|VNOSAVE)))
         s = ckstrdup(s);
-    vp->text = s;
+    vp->var_text = s;
     vp->flags = flags;
 }
@@ -1958 +2199 @@
 setvar(const char *name, const char *val, int flags)
 {
-    char *p, *q;
+    const char *q;
+    char *p;
+    char *nameeq;
     size_t namelen;
-    char *nameeq;
     size_t vallen;
 
@@ -1974 +2216 @@
         vallen = strlen(val);
     }
+
     INT_OFF;
     nameeq = ckmalloc(namelen + vallen + 2);
@@ -1984 +2227 @@
     setvareq(nameeq, flags | VNOSAVE);
     INT_ON;
+}
+
+static void FAST_FUNC
+setvar2(const char *name, const char *val)
+{
+    setvar(name, val, 0);
 }
 
@@ -2031 +2280 @@
         if (flags & VREADONLY)
             goto out;
-#ifdef DYNAMIC_VAR
+#if ENABLE_ASH_RANDOM_SUPPORT
         vp->flags &= ~VDYNAMIC;
 #endif
@@ -2039 +2288 @@
             INT_OFF;
             if ((flags & (VTEXTFIXED|VSTACK)) == 0)
-                free((char*)vp->text);
+                free((char*)vp->var_text);
             *vpp = vp->next;
             free(vp);
@@ -2091 +2340 @@
                 if (ep == stackstrend())
                     ep = growstackstr();
-                *ep++ = (char *) vp->text;
+                *ep++ = (char*)vp->var_text;
             }
         }
@@ -2107 +2356 @@
  *
  * The variable path (passed by reference) should be set to the start
- * of the path before the first call; padvance will update
- * this value as it proceeds.  Successive calls to padvance will return
+ * of the path before the first call; path_advance will update
+ * this value as it proceeds.  Successive calls to path_advance will return
  * the possible path expansions in sequence.  If an option (indicated by
  * a percent sign) appears in the path entry then the global variable
@@ -2114 +2363 @@
  * NULL.
  */
-static const char *pathopt;     /* set by padvance */
+static const char *pathopt;     /* set by path_advance */
 
 static char *
-padvance(const char **path, const char *name)
+path_advance(const char **path, const char *name)
 {
     const char *p;
@@ -2127 +2376 @@
         return NULL;
     start = *path;
-    for (p = start; *p && *p != ':' && *p != '%'; p++);
+    for (p = start; *p && *p != ':' && *p != '%'; p++)
+        continue;
     len = p - start + strlen(name) + 2;     /* "2" is for '/' and '\0' */
     while (stackblocksize() < len)
@@ -2141 +2391 @@
     if (*p == '%') {
         pathopt = ++p;
-        while (*p && *p != ':') p++;
+        while (*p && *p != ':')
+            p++;
     }
     if (*p == ':')
@@ -2153 +2404 @@
 /* ============ Prompt */
 
-static int doprompt;                   /* if set, prompt the user */
-static int needprompt;                 /* true if interactive and at start of line */
+static smallint doprompt;                   /* if set, prompt the user */
+static smallint needprompt;                 /* true if interactive and at start of line */
 
 #if ENABLE_FEATURE_EDITING
@@ -2185 +2436 @@
 
 static void
-setprompt(int whichprompt)
+setprompt_if(smallint do_set, int whichprompt)
 {
     const char *prompt;
-#if ENABLE_ASH_EXPAND_PRMT
-    struct stackmark smark;
-#endif
+    IF_ASH_EXPAND_PRMT(struct stackmark smark;)
+
+    if (!do_set)
+        return;
 
     needprompt = 0;
@@ -2220 +2472 @@
 #define CD_PRINT 2
 
-static int docd(const char *, int);
-
-static char *curdir = nullstr;          /* current working directory */
-static char *physdir = nullstr;         /* physical working directory */
-
 static int
 cdopt(void)
@@ -2232 +2479 @@
 
     j = 'L';
-    while ((i = nextopt("LP"))) {
+    while ((i = nextopt("LP")) != '\0') {
         if (i != j) {
             flags ^= CD_PHYSICAL;
@@ -2262 +2509 @@
     }
     new = makestrspace(strlen(dir) + 2, new);
-    lim = stackblock() + 1;
+    lim = (char *)stackblock() + 1;
     if (*dir != '/') {
         if (new[-1] != '/')
@@ -2311 +2558 @@
 getpwd(void)
 {
-    char *dir = getcwd(0, 0);
+    char *dir = getcwd(NULL, 0); /* huh, using glibc extension? */
     return dir ? dir : nullstr;
 }
@@ -2355 +2602 @@
 docd(const char *dest, int flags)
 {
-    const char *dir = 0;
+    const char *dir = NULL;
     int err;
 
@@ -2376 +2623 @@
 }
 
-static int
-cdcmd(int argc, char **argv)
+static int FAST_FUNC
+cdcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     const char *dest;
@@ -2389 +2636 @@
     dest = *argptr;
     if (!dest)
-        dest = bltinlookup(homestr);
+        dest = bltinlookup("HOME");
     else if (LONE_DASH(dest)) {
         dest = bltinlookup("OLDPWD");
@@ -2422 +2669 @@
     do {
         c = *path;
-        p = padvance(&path, dest);
+        p = path_advance(&path, dest);
         if (stat(p, &statb) >= 0 && S_ISDIR(statb.st_mode)) {
             if (c && c != ':')
@@ -2436 +2683 @@
  out:
     if (flags & CD_PRINT)
-        out1fmt(snlfmt, curdir);
+        out1fmt("%s\n", curdir);
     return 0;
 }
 
-static int
-pwdcmd(int argc, char **argv)
+static int FAST_FUNC
+pwdcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     int flags;
@@ -2452 +2699 @@
         dir = physdir;
     }
-    out1fmt(snlfmt, dir);
+    out1fmt("%s\n", dir);
     return 0;
 }
@@ -2459 +2706 @@
 /* ============ ... */
 
-#define IBUFSIZ (BUFSIZ + 1)
-#define basebuf bb_common_bufsiz1       /* buffer for top level input file */
+
+#define IBUFSIZ (ENABLE_FEATURE_EDITING ? CONFIG_FEATURE_EDITING_MAX_LEN : 1024)
 
 /* Syntax classes */
-#define CWORD 0                 /* character is nothing special */
-#define CNL 1                   /* newline character */
-#define CBACK 2                 /* a backslash character */
-#define CSQUOTE 3               /* single quote */
-#define CDQUOTE 4               /* double quote */
+#define CWORD     0             /* character is nothing special */
+#define CNL       1             /* newline character */
+#define CBACK     2             /* a backslash character */
+#define CSQUOTE   3             /* single quote */
+#define CDQUOTE   4             /* double quote */
 #define CENDQUOTE 5             /* a terminating quote */
-#define CBQUOTE 6               /* backwards single quote */
-#define CVAR 7                  /* a dollar sign */
-#define CENDVAR 8               /* a '}' character */
-#define CLP 9                   /* a left paren in arithmetic */
-#define CRP 10                  /* a right paren in arithmetic */
+#define CBQUOTE   6             /* backwards single quote */
+#define CVAR      7             /* a dollar sign */
+#define CENDVAR   8             /* a '}' character */
+#define CLP       9             /* a left paren in arithmetic */
+#define CRP      10             /* a right paren in arithmetic */
 #define CENDFILE 11             /* end of file */
-#define CCTL 12                 /* like CWORD, except it must be escaped */
-#define CSPCL 13                /* these terminate a word */
-#define CIGN 14                 /* character should be ignored */
-
+#define CCTL     12             /* like CWORD, except it must be escaped */
+#define CSPCL    13             /* these terminate a word */
+#define CIGN     14             /* character should be ignored */
+
+#define PEOF     256
 #if ENABLE_ASH_ALIAS
-#define SYNBASE 130
-#define PEOF -130
-#define PEOA -129
-#define PEOA_OR_PEOF PEOA
+# define PEOA    257
+#endif
+
+#define USE_SIT_FUNCTION ENABLE_ASH_OPTIMIZE_FOR_SIZE
+
+#if ENABLE_SH_MATH_SUPPORT
+# define SIT_ITEM(a,b,c,d) (a | (b << 4) | (c << 8) | (d << 12))
 #else
-#define SYNBASE 129
-#define PEOF -129
-#define PEOA_OR_PEOF PEOF
-#endif
-
-/* number syntax index */
+# define SIT_ITEM(a,b,c,d) (a | (b << 4) | (c << 8))
+#endif
+static const uint16_t S_I_T[] = {
+#if ENABLE_ASH_ALIAS
+    SIT_ITEM(CSPCL   , CIGN     , CIGN , CIGN   ),    /* 0, PEOA */
+#endif
+    SIT_ITEM(CSPCL   , CWORD    , CWORD, CWORD  ),    /* 1, ' ' */
+    SIT_ITEM(CNL     , CNL      , CNL  , CNL    ),    /* 2, \n */
+    SIT_ITEM(CWORD   , CCTL     , CCTL , CWORD  ),    /* 3, !*-/:=?[]~ */
+    SIT_ITEM(CDQUOTE , CENDQUOTE, CWORD, CWORD  ),    /* 4, '"' */
+    SIT_ITEM(CVAR    , CVAR     , CWORD, CVAR   ),    /* 5, $ */
+    SIT_ITEM(CSQUOTE , CWORD    , CENDQUOTE, CWORD),  /* 6, "'" */
+    SIT_ITEM(CSPCL   , CWORD    , CWORD, CLP    ),    /* 7, ( */
+    SIT_ITEM(CSPCL   , CWORD    , CWORD, CRP    ),    /* 8, ) */
+    SIT_ITEM(CBACK   , CBACK    , CCTL , CBACK  ),    /* 9, \ */
+    SIT_ITEM(CBQUOTE , CBQUOTE  , CWORD, CBQUOTE),    /* 10, ` */
+    SIT_ITEM(CENDVAR , CENDVAR  , CWORD, CENDVAR),    /* 11, } */
+#if !USE_SIT_FUNCTION
+    SIT_ITEM(CENDFILE, CENDFILE , CENDFILE, CENDFILE),/* 12, PEOF */
+    SIT_ITEM(CWORD   , CWORD    , CWORD, CWORD  ),    /* 13, 0-9A-Za-z */
+    SIT_ITEM(CCTL    , CCTL     , CCTL , CCTL   )     /* 14, CTLESC ... */
+#endif
+#undef SIT_ITEM
+};
+/* Constants below must match table above */
+enum {
+#if ENABLE_ASH_ALIAS
+    CSPCL_CIGN_CIGN_CIGN               , /*  0 */
+#endif
+    CSPCL_CWORD_CWORD_CWORD            , /*  1 */
+    CNL_CNL_CNL_CNL                    , /*  2 */
+    CWORD_CCTL_CCTL_CWORD              , /*  3 */
+    CDQUOTE_CENDQUOTE_CWORD_CWORD      , /*  4 */
+    CVAR_CVAR_CWORD_CVAR               , /*  5 */
+    CSQUOTE_CWORD_CENDQUOTE_CWORD      , /*  6 */
+    CSPCL_CWORD_CWORD_CLP              , /*  7 */
+    CSPCL_CWORD_CWORD_CRP              , /*  8 */
+    CBACK_CBACK_CCTL_CBACK             , /*  9 */
+    CBQUOTE_CBQUOTE_CWORD_CBQUOTE      , /* 10 */
+    CENDVAR_CENDVAR_CWORD_CENDVAR      , /* 11 */
+    CENDFILE_CENDFILE_CENDFILE_CENDFILE, /* 12 */
+    CWORD_CWORD_CWORD_CWORD            , /* 13 */
+    CCTL_CCTL_CCTL_CCTL                , /* 14 */
+};
+
+/* c in SIT(c, syntax) must be an *unsigned char* or PEOA or PEOF,
+ * caller must ensure proper cast on it if c is *char_ptr!
+ */
+/* Values for syntax param */
 #define BASESYNTAX 0    /* not in quotes */
 #define DQSYNTAX   1    /* in double quotes */
 #define SQSYNTAX   2    /* in single quotes */
 #define ARISYNTAX  3    /* in arithmetic */
-
-#if ENABLE_ASH_OPTIMIZE_FOR_SIZE
-#define USE_SIT_FUNCTION
-#endif
-
-#if ENABLE_ASH_MATH_SUPPORT
-static const char S_I_T[][4] = {
-#if ENABLE_ASH_ALIAS
-    { CSPCL, CIGN, CIGN, CIGN },            /* 0, PEOA */
-#endif
-    { CSPCL, CWORD, CWORD, CWORD },         /* 1, ' ' */
-    { CNL, CNL, CNL, CNL },                 /* 2, \n */
-    { CWORD, CCTL, CCTL, CWORD },           /* 3, !*-/:=?[]~ */
-    { CDQUOTE, CENDQUOTE, CWORD, CWORD },   /* 4, '"' */
-    { CVAR, CVAR, CWORD, CVAR },            /* 5, $ */
-    { CSQUOTE, CWORD, CENDQUOTE, CWORD },   /* 6, "'" */
-    { CSPCL, CWORD, CWORD, CLP },           /* 7, ( */
-    { CSPCL, CWORD, CWORD, CRP },           /* 8, ) */
-    { CBACK, CBACK, CCTL, CBACK },          /* 9, \ */
-    { CBQUOTE, CBQUOTE, CWORD, CBQUOTE },   /* 10, ` */
-    { CENDVAR, CENDVAR, CWORD, CENDVAR },   /* 11, } */
-#ifndef USE_SIT_FUNCTION
-    { CENDFILE, CENDFILE, CENDFILE, CENDFILE }, /* 12, PEOF */
-    { CWORD, CWORD, CWORD, CWORD },         /* 13, 0-9A-Za-z */
-    { CCTL, CCTL, CCTL, CCTL }              /* 14, CTLESC ... */
-#endif
-};
-#else
-static const char S_I_T[][3] = {
-#if ENABLE_ASH_ALIAS
-    { CSPCL, CIGN, CIGN },                  /* 0, PEOA */
-#endif
-    { CSPCL, CWORD, CWORD },                /* 1, ' ' */
-    { CNL, CNL, CNL },                      /* 2, \n */
-    { CWORD, CCTL, CCTL },                  /* 3, !*-/:=?[]~ */
-    { CDQUOTE, CENDQUOTE, CWORD },          /* 4, '"' */
-    { CVAR, CVAR, CWORD },                  /* 5, $ */
-    { CSQUOTE, CWORD, CENDQUOTE },          /* 6, "'" */
-    { CSPCL, CWORD, CWORD },                /* 7, ( */
-    { CSPCL, CWORD, CWORD },                /* 8, ) */
-    { CBACK, CBACK, CCTL },                 /* 9, \ */
-    { CBQUOTE, CBQUOTE, CWORD },            /* 10, ` */
-    { CENDVAR, CENDVAR, CWORD },            /* 11, } */
-#ifndef USE_SIT_FUNCTION
-    { CENDFILE, CENDFILE, CENDFILE },       /* 12, PEOF */
-    { CWORD, CWORD, CWORD },                /* 13, 0-9A-Za-z */
-    { CCTL, CCTL, CCTL }                    /* 14, CTLESC ... */
-#endif
-};
-#endif /* ASH_MATH_SUPPORT */
-
-#ifdef USE_SIT_FUNCTION
+#define PSSYNTAX   4    /* prompt. never passed to SIT() */
+
+#if USE_SIT_FUNCTION
 
 static int
@@ -2552 +2797 @@
 {
     static const char spec_symbls[] ALIGN1 = "\t\n !\"$&'()*-/:;<=>?[\\]`|}~";
-#if ENABLE_ASH_ALIAS
-    static const char syntax_index_table[] ALIGN1 = {
+# if ENABLE_ASH_ALIAS
+    static const uint8_t syntax_index_table[] ALIGN1 = {
         1, 2, 1, 3, 4, 5, 1, 6,         /* "\t\n !\"$&'" */
         7, 8, 3, 3, 3, 3, 1, 1,         /* "()*-/:;<" */
@@ -2559 +2804 @@
         11, 3                           /* "}~" */
     };
-#else
-    static const char syntax_index_table[] ALIGN1 = {
+# else
+    static const uint8_t syntax_index_table[] ALIGN1 = {
         0, 1, 0, 2, 3, 4, 0, 5,         /* "\t\n !\"$&'" */
         6, 7, 2, 2, 2, 2, 0, 0,         /* "()*-/:;<" */
@@ -2566 +2811 @@
         10, 2                           /* "}~" */
     };
-#endif
+# endif
     const char *s;
     int indx;
 
-    if (c == PEOF)          /* 2^8+2 */
+    if (c == PEOF)
         return CENDFILE;
-#if ENABLE_ASH_ALIAS
-    if (c == PEOA)          /* 2^8+1 */
+# if ENABLE_ASH_ALIAS
+    if (c == PEOA)
         indx = 0;
     else
-#endif
-#define U_C(c) ((unsigned char)(c))
-
-    if ((unsigned char)c >= (unsigned char)(CTLESC)
-     && (unsigned char)c <= (unsigned char)(CTLQUOTEMARK)
-    ) {
-        return CCTL;
-    } else {
-        s = strchr(spec_symbls, c);
-        if (s == NULL || *s == '\0')
+# endif
+    {
+        /* Cast is purely for paranoia here,
+         * just in case someone passed signed char to us */
+        if ((unsigned char)c >= CTL_FIRST
+         && (unsigned char)c <= CTL_LAST
+        ) {
+            return CCTL;
+        }
+        s = strchrnul(spec_symbls, c);
+        if (*s == '\0')
             return CWORD;
-        indx = syntax_index_table[(s - spec_symbls)];
-    }
-    return S_I_T[indx][syntax];
+        indx = syntax_index_table[s - spec_symbls];
+    }
+    return (S_I_T[indx] >> (syntax*4)) & 0xf;
 }
 
 #else   /* !USE_SIT_FUNCTION */
 
-#if ENABLE_ASH_ALIAS
-#define CSPCL_CIGN_CIGN_CIGN                     0
-#define CSPCL_CWORD_CWORD_CWORD                  1
-#define CNL_CNL_CNL_CNL                          2
-#define CWORD_CCTL_CCTL_CWORD                    3
-#define CDQUOTE_CENDQUOTE_CWORD_CWORD            4
-#define CVAR_CVAR_CWORD_CVAR                     5
-#define CSQUOTE_CWORD_CENDQUOTE_CWORD            6
-#define CSPCL_CWORD_CWORD_CLP                    7
-#define CSPCL_CWORD_CWORD_CRP                    8
-#define CBACK_CBACK_CCTL_CBACK                   9
-#define CBQUOTE_CBQUOTE_CWORD_CBQUOTE           10
-#define CENDVAR_CENDVAR_CWORD_CENDVAR           11
-#define CENDFILE_CENDFILE_CENDFILE_CENDFILE     12
-#define CWORD_CWORD_CWORD_CWORD                 13
-#define CCTL_CCTL_CCTL_CCTL                     14
-#else
-#define CSPCL_CWORD_CWORD_CWORD                  0
-#define CNL_CNL_CNL_CNL                          1
-#define CWORD_CCTL_CCTL_CWORD                    2
-#define CDQUOTE_CENDQUOTE_CWORD_CWORD            3
-#define CVAR_CVAR_CWORD_CVAR                     4
-#define CSQUOTE_CWORD_CENDQUOTE_CWORD            5
-#define CSPCL_CWORD_CWORD_CLP                    6
-#define CSPCL_CWORD_CWORD_CRP                    7
-#define CBACK_CBACK_CCTL_CBACK                   8
-#define CBQUOTE_CBQUOTE_CWORD_CBQUOTE            9
-#define CENDVAR_CENDVAR_CWORD_CENDVAR           10
-#define CENDFILE_CENDFILE_CENDFILE_CENDFILE     11
-#define CWORD_CWORD_CWORD_CWORD                 12
-#define CCTL_CCTL_CCTL_CCTL                     13
-#endif
-
-static const char syntax_index_table[258] = {
+static const uint8_t syntax_index_table[] = {
     /* BASESYNTAX_DQSYNTAX_SQSYNTAX_ARISYNTAX */
-    /*   0  PEOF */      CENDFILE_CENDFILE_CENDFILE_CENDFILE,
-#if ENABLE_ASH_ALIAS
-    /*   1  PEOA */      CSPCL_CIGN_CIGN_CIGN,
-#endif
-    /*   2  -128 0x80 */ CWORD_CWORD_CWORD_CWORD,
-    /*   3  -127 CTLESC       */ CCTL_CCTL_CCTL_CCTL,
-    /*   4  -126 CTLVAR       */ CCTL_CCTL_CCTL_CCTL,
-    /*   5  -125 CTLENDVAR    */ CCTL_CCTL_CCTL_CCTL,
-    /*   6  -124 CTLBACKQ     */ CCTL_CCTL_CCTL_CCTL,
-    /*   7  -123 CTLQUOTE     */ CCTL_CCTL_CCTL_CCTL,
-    /*   8  -122 CTLARI       */ CCTL_CCTL_CCTL_CCTL,
-    /*   9  -121 CTLENDARI    */ CCTL_CCTL_CCTL_CCTL,
-    /*  10  -120 CTLQUOTEMARK */ CCTL_CCTL_CCTL_CCTL,
-    /*  11  -119      */ CWORD_CWORD_CWORD_CWORD,
-    /*  12  -118      */ CWORD_CWORD_CWORD_CWORD,
-    /*  13  -117      */ CWORD_CWORD_CWORD_CWORD,
-    /*  14  -116      */ CWORD_CWORD_CWORD_CWORD,
-    /*  15  -115      */ CWORD_CWORD_CWORD_CWORD,
-    /*  16  -114      */ CWORD_CWORD_CWORD_CWORD,
-    /*  17  -113      */ CWORD_CWORD_CWORD_CWORD,
-    /*  18  -112      */ CWORD_CWORD_CWORD_CWORD,
-    /*  19  -111      */ CWORD_CWORD_CWORD_CWORD,
-    /*  20  -110      */ CWORD_CWORD_CWORD_CWORD,
-    /*  21  -109      */ CWORD_CWORD_CWORD_CWORD,
-    /*  22  -108      */ CWORD_CWORD_CWORD_CWORD,
-    /*  23  -107      */ CWORD_CWORD_CWORD_CWORD,
-    /*  24  -106      */ CWORD_CWORD_CWORD_CWORD,
-    /*  25  -105      */ CWORD_CWORD_CWORD_CWORD,
-    /*  26  -104      */ CWORD_CWORD_CWORD_CWORD,
-    /*  27  -103      */ CWORD_CWORD_CWORD_CWORD,
-    /*  28  -102      */ CWORD_CWORD_CWORD_CWORD,
-    /*  29  -101      */ CWORD_CWORD_CWORD_CWORD,
-    /*  30  -100      */ CWORD_CWORD_CWORD_CWORD,
-    /*  31   -99      */ CWORD_CWORD_CWORD_CWORD,
-    /*  32   -98      */ CWORD_CWORD_CWORD_CWORD,
-    /*  33   -97      */ CWORD_CWORD_CWORD_CWORD,
-    /*  34   -96      */ CWORD_CWORD_CWORD_CWORD,
-    /*  35   -95      */ CWORD_CWORD_CWORD_CWORD,
-    /*  36   -94      */ CWORD_CWORD_CWORD_CWORD,
-    /*  37   -93      */ CWORD_CWORD_CWORD_CWORD,
-    /*  38   -92      */ CWORD_CWORD_CWORD_CWORD,
-    /*  39   -91      */ CWORD_CWORD_CWORD_CWORD,
-    /*  40   -90      */ CWORD_CWORD_CWORD_CWORD,
-    /*  41   -89      */ CWORD_CWORD_CWORD_CWORD,
-    /*  42   -88      */ CWORD_CWORD_CWORD_CWORD,
-    /*  43   -87      */ CWORD_CWORD_CWORD_CWORD,
-    /*  44   -86      */ CWORD_CWORD_CWORD_CWORD,
-    /*  45   -85      */ CWORD_CWORD_CWORD_CWORD,
-    /*  46   -84      */ CWORD_CWORD_CWORD_CWORD,
-    /*  47   -83      */ CWORD_CWORD_CWORD_CWORD,
-    /*  48   -82      */ CWORD_CWORD_CWORD_CWORD,
-    /*  49   -81      */ CWORD_CWORD_CWORD_CWORD,
-    /*  50   -80      */ CWORD_CWORD_CWORD_CWORD,
-    /*  51   -79      */ CWORD_CWORD_CWORD_CWORD,
-    /*  52   -78      */ CWORD_CWORD_CWORD_CWORD,
-    /*  53   -77      */ CWORD_CWORD_CWORD_CWORD,
-    /*  54   -76      */ CWORD_CWORD_CWORD_CWORD,
-    /*  55   -75      */ CWORD_CWORD_CWORD_CWORD,
-    /*  56   -74      */ CWORD_CWORD_CWORD_CWORD,
-    /*  57   -73      */ CWORD_CWORD_CWORD_CWORD,
-    /*  58   -72      */ CWORD_CWORD_CWORD_CWORD,
-    /*  59   -71      */ CWORD_CWORD_CWORD_CWORD,
-    /*  60   -70      */ CWORD_CWORD_CWORD_CWORD,
-    /*  61   -69      */ CWORD_CWORD_CWORD_CWORD,
-    /*  62   -68      */ CWORD_CWORD_CWORD_CWORD,
-    /*  63   -67      */ CWORD_CWORD_CWORD_CWORD,
-    /*  64   -66      */ CWORD_CWORD_CWORD_CWORD,
-    /*  65   -65      */ CWORD_CWORD_CWORD_CWORD,
-    /*  66   -64      */ CWORD_CWORD_CWORD_CWORD,
-    /*  67   -63      */ CWORD_CWORD_CWORD_CWORD,
-    /*  68   -62      */ CWORD_CWORD_CWORD_CWORD,
-    /*  69   -61      */ CWORD_CWORD_CWORD_CWORD,
-    /*  70   -60      */ CWORD_CWORD_CWORD_CWORD,
-    /*  71   -59      */ CWORD_CWORD_CWORD_CWORD,
-    /*  72   -58      */ CWORD_CWORD_CWORD_CWORD,
-    /*  73   -57      */ CWORD_CWORD_CWORD_CWORD,
-    /*  74   -56      */ CWORD_CWORD_CWORD_CWORD,
-    /*  75   -55      */ CWORD_CWORD_CWORD_CWORD,
-    /*  76   -54      */ CWORD_CWORD_CWORD_CWORD,
-    /*  77   -53      */ CWORD_CWORD_CWORD_CWORD,
-    /*  78   -52      */ CWORD_CWORD_CWORD_CWORD,
-    /*  79   -51      */ CWORD_CWORD_CWORD_CWORD,
-    /*  80   -50      */ CWORD_CWORD_CWORD_CWORD,
-    /*  81   -49      */ CWORD_CWORD_CWORD_CWORD,
-    /*  82   -48      */ CWORD_CWORD_CWORD_CWORD,
-    /*  83   -47      */ CWORD_CWORD_CWORD_CWORD,
-    /*  84   -46      */ CWORD_CWORD_CWORD_CWORD,
-    /*  85   -45      */ CWORD_CWORD_CWORD_CWORD,
-    /*  86   -44      */ CWORD_CWORD_CWORD_CWORD,
-    /*  87   -43      */ CWORD_CWORD_CWORD_CWORD,
-    /*  88   -42      */ CWORD_CWORD_CWORD_CWORD,
-    /*  89   -41      */ CWORD_CWORD_CWORD_CWORD,
-    /*  90   -40      */ CWORD_CWORD_CWORD_CWORD,
-    /*  91   -39      */ CWORD_CWORD_CWORD_CWORD,
-    /*  92   -38      */ CWORD_CWORD_CWORD_CWORD,
-    /*  93   -37      */ CWORD_CWORD_CWORD_CWORD,
-    /*  94   -36      */ CWORD_CWORD_CWORD_CWORD,
-    /*  95   -35      */ CWORD_CWORD_CWORD_CWORD,
-    /*  96   -34      */ CWORD_CWORD_CWORD_CWORD,
-    /*  97   -33      */ CWORD_CWORD_CWORD_CWORD,
-    /*  98   -32      */ CWORD_CWORD_CWORD_CWORD,
-    /*  99   -31      */ CWORD_CWORD_CWORD_CWORD,
-    /* 100   -30      */ CWORD_CWORD_CWORD_CWORD,
-    /* 101   -29      */ CWORD_CWORD_CWORD_CWORD,
-    /* 102   -28      */ CWORD_CWORD_CWORD_CWORD,
-    /* 103   -27      */ CWORD_CWORD_CWORD_CWORD,
-    /* 104   -26      */ CWORD_CWORD_CWORD_CWORD,
-    /* 105   -25      */ CWORD_CWORD_CWORD_CWORD,
-    /* 106   -24      */ CWORD_CWORD_CWORD_CWORD,
-    /* 107   -23      */ CWORD_CWORD_CWORD_CWORD,
-    /* 108   -22      */ CWORD_CWORD_CWORD_CWORD,
-    /* 109   -21      */ CWORD_CWORD_CWORD_CWORD,
-    /* 110   -20      */ CWORD_CWORD_CWORD_CWORD,
-    /* 111   -19      */ CWORD_CWORD_CWORD_CWORD,
-    /* 112   -18      */ CWORD_CWORD_CWORD_CWORD,
-    /* 113   -17      */ CWORD_CWORD_CWORD_CWORD,
-    /* 114   -16      */ CWORD_CWORD_CWORD_CWORD,
-    /* 115   -15      */ CWORD_CWORD_CWORD_CWORD,
-    /* 116   -14      */ CWORD_CWORD_CWORD_CWORD,
-    /* 117   -13      */ CWORD_CWORD_CWORD_CWORD,
-    /* 118   -12      */ CWORD_CWORD_CWORD_CWORD,
-    /* 119   -11      */ CWORD_CWORD_CWORD_CWORD,
-    /* 120   -10      */ CWORD_CWORD_CWORD_CWORD,
-    /* 121    -9      */ CWORD_CWORD_CWORD_CWORD,
-    /* 122    -8      */ CWORD_CWORD_CWORD_CWORD,
-    /* 123    -7      */ CWORD_CWORD_CWORD_CWORD,
-    /* 124    -6      */ CWORD_CWORD_CWORD_CWORD,
-    /* 125    -5      */ CWORD_CWORD_CWORD_CWORD,
-    /* 126    -4      */ CWORD_CWORD_CWORD_CWORD,
-    /* 127    -3      */ CWORD_CWORD_CWORD_CWORD,
-    /* 128    -2      */ CWORD_CWORD_CWORD_CWORD,
-    /* 129    -1      */ CWORD_CWORD_CWORD_CWORD,
-    /* 130     0      */ CWORD_CWORD_CWORD_CWORD,
-    /* 131     1      */ CWORD_CWORD_CWORD_CWORD,
-    /* 132     2      */ CWORD_CWORD_CWORD_CWORD,
-    /* 133     3      */ CWORD_CWORD_CWORD_CWORD,
-    /* 134     4      */ CWORD_CWORD_CWORD_CWORD,
-    /* 135     5      */ CWORD_CWORD_CWORD_CWORD,
-    /* 136     6      */ CWORD_CWORD_CWORD_CWORD,
-    /* 137     7      */ CWORD_CWORD_CWORD_CWORD,
-    /* 138     8      */ CWORD_CWORD_CWORD_CWORD,
-    /* 139     9 "\t" */ CSPCL_CWORD_CWORD_CWORD,
-    /* 140    10 "\n" */ CNL_CNL_CNL_CNL,
-    /* 141    11      */ CWORD_CWORD_CWORD_CWORD,
-    /* 142    12      */ CWORD_CWORD_CWORD_CWORD,
-    /* 143    13      */ CWORD_CWORD_CWORD_CWORD,
-    /* 144    14      */ CWORD_CWORD_CWORD_CWORD,
-    /* 145    15      */ CWORD_CWORD_CWORD_CWORD,
-    /* 146    16      */ CWORD_CWORD_CWORD_CWORD,
-    /* 147    17      */ CWORD_CWORD_CWORD_CWORD,
-    /* 148    18      */ CWORD_CWORD_CWORD_CWORD,
-    /* 149    19      */ CWORD_CWORD_CWORD_CWORD,
-    /* 150    20      */ CWORD_CWORD_CWORD_CWORD,
-    /* 151    21      */ CWORD_CWORD_CWORD_CWORD,
-    /* 152    22      */ CWORD_CWORD_CWORD_CWORD,
-    /* 153    23      */ CWORD_CWORD_CWORD_CWORD,
-    /* 154    24      */ CWORD_CWORD_CWORD_CWORD,
-    /* 155    25      */ CWORD_CWORD_CWORD_CWORD,
-    /* 156    26      */ CWORD_CWORD_CWORD_CWORD,
-    /* 157    27      */ CWORD_CWORD_CWORD_CWORD,
-    /* 158    28      */ CWORD_CWORD_CWORD_CWORD,
-    /* 159    29      */ CWORD_CWORD_CWORD_CWORD,
-    /* 160    30      */ CWORD_CWORD_CWORD_CWORD,
-    /* 161    31      */ CWORD_CWORD_CWORD_CWORD,
-    /* 162    32  " " */ CSPCL_CWORD_CWORD_CWORD,
-    /* 163    33  "!" */ CWORD_CCTL_CCTL_CWORD,
-    /* 164    34  """ */ CDQUOTE_CENDQUOTE_CWORD_CWORD,
-    /* 165    35  "#" */ CWORD_CWORD_CWORD_CWORD,
-    /* 166    36  "$" */ CVAR_CVAR_CWORD_CVAR,
-    /* 167    37  "%" */ CWORD_CWORD_CWORD_CWORD,
-    /* 168    38  "&" */ CSPCL_CWORD_CWORD_CWORD,
-    /* 169    39  "'" */ CSQUOTE_CWORD_CENDQUOTE_CWORD,
-    /* 170    40  "(" */ CSPCL_CWORD_CWORD_CLP,
-    /* 171    41  ")" */ CSPCL_CWORD_CWORD_CRP,
-    /* 172    42  "*" */ CWORD_CCTL_CCTL_CWORD,
-    /* 173    43  "+" */ CWORD_CWORD_CWORD_CWORD,
-    /* 174    44  "," */ CWORD_CWORD_CWORD_CWORD,
-    /* 175    45  "-" */ CWORD_CCTL_CCTL_CWORD,
-    /* 176    46  "." */ CWORD_CWORD_CWORD_CWORD,
-    /* 177    47  "/" */ CWORD_CCTL_CCTL_CWORD,
-    /* 178    48  "0" */ CWORD_CWORD_CWORD_CWORD,
-    /* 179    49  "1" */ CWORD_CWORD_CWORD_CWORD,
-    /* 180    50  "2" */ CWORD_CWORD_CWORD_CWORD,
-    /* 181    51  "3" */ CWORD_CWORD_CWORD_CWORD,
-    /* 182    52  "4" */ CWORD_CWORD_CWORD_CWORD,
-    /* 183    53  "5" */ CWORD_CWORD_CWORD_CWORD,
-    /* 184    54  "6" */ CWORD_CWORD_CWORD_CWORD,
-    /* 185    55  "7" */ CWORD_CWORD_CWORD_CWORD,
-    /* 186    56  "8" */ CWORD_CWORD_CWORD_CWORD,
-    /* 187    57  "9" */ CWORD_CWORD_CWORD_CWORD,
-    /* 188    58  ":" */ CWORD_CCTL_CCTL_CWORD,
-    /* 189    59  ";" */ CSPCL_CWORD_CWORD_CWORD,
-    /* 190    60  "<" */ CSPCL_CWORD_CWORD_CWORD,
-    /* 191    61  "=" */ CWORD_CCTL_CCTL_CWORD,
-    /* 192    62  ">" */ CSPCL_CWORD_CWORD_CWORD,
-    /* 193    63  "?" */ CWORD_CCTL_CCTL_CWORD,
-    /* 194    64  "@" */ CWORD_CWORD_CWORD_CWORD,
-    /* 195    65  "A" */ CWORD_CWORD_CWORD_CWORD,
-    /* 196    66  "B" */ CWORD_CWORD_CWORD_CWORD,
-    /* 197    67  "C" */ CWORD_CWORD_CWORD_CWORD,
-    /* 198    68  "D" */ CWORD_CWORD_CWORD_CWORD,
-    /* 199    69  "E" */ CWORD_CWORD_CWORD_CWORD,
-    /* 200    70  "F" */ CWORD_CWORD_CWORD_CWORD,
-    /* 201    71  "G" */ CWORD_CWORD_CWORD_CWORD,
-    /* 202    72  "H" */ CWORD_CWORD_CWORD_CWORD,
-    /* 203    73  "I" */ CWORD_CWORD_CWORD_CWORD,
-    /* 204    74  "J" */ CWORD_CWORD_CWORD_CWORD,
-    /* 205    75  "K" */ CWORD_CWORD_CWORD_CWORD,
-    /* 206    76  "L" */ CWORD_CWORD_CWORD_CWORD,
-    /* 207    77  "M" */ CWORD_CWORD_CWORD_CWORD,
-    /* 208    78  "N" */ CWORD_CWORD_CWORD_CWORD,
-    /* 209    79  "O" */ CWORD_CWORD_CWORD_CWORD,
-    /* 210    80  "P" */ CWORD_CWORD_CWORD_CWORD,
-    /* 211    81  "Q" */ CWORD_CWORD_CWORD_CWORD,
-    /* 212    82  "R" */ CWORD_CWORD_CWORD_CWORD,
-    /* 213    83  "S" */ CWORD_CWORD_CWORD_CWORD,
-    /* 214    84  "T" */ CWORD_CWORD_CWORD_CWORD,
-    /* 215    85  "U" */ CWORD_CWORD_CWORD_CWORD,
-    /* 216    86  "V" */ CWORD_CWORD_CWORD_CWORD,
-    /* 217    87  "W" */ CWORD_CWORD_CWORD_CWORD,
-    /* 218    88  "X" */ CWORD_CWORD_CWORD_CWORD,
-    /* 219    89  "Y" */ CWORD_CWORD_CWORD_CWORD,
-    /* 220    90  "Z" */ CWORD_CWORD_CWORD_CWORD,
-    /* 221    91  "[" */ CWORD_CCTL_CCTL_CWORD,
-    /* 222    92  "\" */ CBACK_CBACK_CCTL_CBACK,
-    /* 223    93  "]" */ CWORD_CCTL_CCTL_CWORD,
-    /* 224    94  "^" */ CWORD_CWORD_CWORD_CWORD,
-    /* 225    95  "_" */ CWORD_CWORD_CWORD_CWORD,
-    /* 226    96  "`" */ CBQUOTE_CBQUOTE_CWORD_CBQUOTE,
-    /* 227    97  "a" */ CWORD_CWORD_CWORD_CWORD,
-    /* 228    98  "b" */ CWORD_CWORD_CWORD_CWORD,
-    /* 229    99  "c" */ CWORD_CWORD_CWORD_CWORD,
-    /* 230   100  "d" */ CWORD_CWORD_CWORD_CWORD,
-    /* 231   101  "e" */ CWORD_CWORD_CWORD_CWORD,
-    /* 232   102  "f" */ CWORD_CWORD_CWORD_CWORD,
-    /* 233   103  "g" */ CWORD_CWORD_CWORD_CWORD,
-    /* 234   104  "h" */ CWORD_CWORD_CWORD_CWORD,
-    /* 235   105  "i" */ CWORD_CWORD_CWORD_CWORD,
-    /* 236   106  "j" */ CWORD_CWORD_CWORD_CWORD,
-    /* 237   107  "k" */ CWORD_CWORD_CWORD_CWORD,
-    /* 238   108  "l" */ CWORD_CWORD_CWORD_CWORD,
-    /* 239   109  "m" */ CWORD_CWORD_CWORD_CWORD,
-    /* 240   110  "n" */ CWORD_CWORD_CWORD_CWORD,
-    /* 241   111  "o" */ CWORD_CWORD_CWORD_CWORD,
-    /* 242   112  "p" */ CWORD_CWORD_CWORD_CWORD,
-    /* 243   113  "q" */ CWORD_CWORD_CWORD_CWORD,
-    /* 244   114  "r" */ CWORD_CWORD_CWORD_CWORD,
-    /* 245   115  "s" */ CWORD_CWORD_CWORD_CWORD,
-    /* 246   116  "t" */ CWORD_CWORD_CWORD_CWORD,
-    /* 247   117  "u" */ CWORD_CWORD_CWORD_CWORD,
-    /* 248   118  "v" */ CWORD_CWORD_CWORD_CWORD,
-    /* 249   119  "w" */ CWORD_CWORD_CWORD_CWORD,
-    /* 250   120  "x" */ CWORD_CWORD_CWORD_CWORD,
-    /* 251   121  "y" */ CWORD_CWORD_CWORD_CWORD,
-    /* 252   122  "z" */ CWORD_CWORD_CWORD_CWORD,
-    /* 253   123  "{" */ CWORD_CWORD_CWORD_CWORD,
-    /* 254   124  "|" */ CSPCL_CWORD_CWORD_CWORD,
-    /* 255   125  "}" */ CENDVAR_CENDVAR_CWORD_CENDVAR,
-    /* 256   126  "~" */ CWORD_CCTL_CCTL_CWORD,
-    /* 257   127      */ CWORD_CWORD_CWORD_CWORD,
+    /*   0      */ CWORD_CWORD_CWORD_CWORD,
+    /*   1      */ CWORD_CWORD_CWORD_CWORD,
+    /*   2      */ CWORD_CWORD_CWORD_CWORD,
+    /*   3      */ CWORD_CWORD_CWORD_CWORD,
+    /*   4      */ CWORD_CWORD_CWORD_CWORD,
+    /*   5      */ CWORD_CWORD_CWORD_CWORD,
+    /*   6      */ CWORD_CWORD_CWORD_CWORD,
+    /*   7      */ CWORD_CWORD_CWORD_CWORD,
+    /*   8      */ CWORD_CWORD_CWORD_CWORD,
+    /*   9 "\t" */ CSPCL_CWORD_CWORD_CWORD,
+    /*  10 "\n" */ CNL_CNL_CNL_CNL,
+    /*  11      */ CWORD_CWORD_CWORD_CWORD,
+    /*  12      */ CWORD_CWORD_CWORD_CWORD,
+    /*  13      */ CWORD_CWORD_CWORD_CWORD,
+    /*  14      */ CWORD_CWORD_CWORD_CWORD,
+    /*  15      */ CWORD_CWORD_CWORD_CWORD,
+    /*  16      */ CWORD_CWORD_CWORD_CWORD,
+    /*  17      */ CWORD_CWORD_CWORD_CWORD,
+    /*  18      */ CWORD_CWORD_CWORD_CWORD,
+    /*  19      */ CWORD_CWORD_CWORD_CWORD,
+    /*  20      */ CWORD_CWORD_CWORD_CWORD,
+    /*  21      */ CWORD_CWORD_CWORD_CWORD,
+    /*  22      */ CWORD_CWORD_CWORD_CWORD,
+    /*  23      */ CWORD_CWORD_CWORD_CWORD,
+    /*  24      */ CWORD_CWORD_CWORD_CWORD,
+    /*  25      */ CWORD_CWORD_CWORD_CWORD,
+    /*  26      */ CWORD_CWORD_CWORD_CWORD,
+    /*  27      */ CWORD_CWORD_CWORD_CWORD,
+    /*  28      */ CWORD_CWORD_CWORD_CWORD,
+    /*  29      */ CWORD_CWORD_CWORD_CWORD,
+    /*  30      */ CWORD_CWORD_CWORD_CWORD,
+    /*  31      */ CWORD_CWORD_CWORD_CWORD,
+    /*  32  " " */ CSPCL_CWORD_CWORD_CWORD,
+    /*  33  "!" */ CWORD_CCTL_CCTL_CWORD,
+    /*  34  """ */ CDQUOTE_CENDQUOTE_CWORD_CWORD,
+    /*  35  "#" */ CWORD_CWORD_CWORD_CWORD,
+    /*  36  "$" */ CVAR_CVAR_CWORD_CVAR,
+    /*  37  "%" */ CWORD_CWORD_CWORD_CWORD,
+    /*  38  "&" */ CSPCL_CWORD_CWORD_CWORD,
+    /*  39  "'" */ CSQUOTE_CWORD_CENDQUOTE_CWORD,
+    /*  40  "(" */ CSPCL_CWORD_CWORD_CLP,
+    /*  41  ")" */ CSPCL_CWORD_CWORD_CRP,
+    /*  42  "*" */ CWORD_CCTL_CCTL_CWORD,
+    /*  43  "+" */ CWORD_CWORD_CWORD_CWORD,
+    /*  44  "," */ CWORD_CWORD_CWORD_CWORD,
+    /*  45  "-" */ CWORD_CCTL_CCTL_CWORD,
+    /*  46  "." */ CWORD_CWORD_CWORD_CWORD,
+    /*  47  "/" */ CWORD_CCTL_CCTL_CWORD,
+    /*  48  "0" */ CWORD_CWORD_CWORD_CWORD,
+    /*  49  "1" */ CWORD_CWORD_CWORD_CWORD,
+    /*  50  "2" */ CWORD_CWORD_CWORD_CWORD,
+    /*  51  "3" */ CWORD_CWORD_CWORD_CWORD,
+    /*  52  "4" */ CWORD_CWORD_CWORD_CWORD,
+    /*  53  "5" */ CWORD_CWORD_CWORD_CWORD,
+    /*  54  "6" */ CWORD_CWORD_CWORD_CWORD,
+    /*  55  "7" */ CWORD_CWORD_CWORD_CWORD,
+    /*  56  "8" */ CWORD_CWORD_CWORD_CWORD,
+    /*  57  "9" */ CWORD_CWORD_CWORD_CWORD,
+    /*  58  ":" */ CWORD_CCTL_CCTL_CWORD,
+    /*  59  ";" */ CSPCL_CWORD_CWORD_CWORD,
+    /*  60  "<" */ CSPCL_CWORD_CWORD_CWORD,
+    /*  61  "=" */ CWORD_CCTL_CCTL_CWORD,
+    /*  62  ">" */ CSPCL_CWORD_CWORD_CWORD,
+    /*  63  "?" */ CWORD_CCTL_CCTL_CWORD,
+    /*  64  "@" */ CWORD_CWORD_CWORD_CWORD,
+    /*  65  "A" */ CWORD_CWORD_CWORD_CWORD,
+    /*  66  "B" */ CWORD_CWORD_CWORD_CWORD,
+    /*  67  "C" */ CWORD_CWORD_CWORD_CWORD,
+    /*  68  "D" */ CWORD_CWORD_CWORD_CWORD,
+    /*  69  "E" */ CWORD_CWORD_CWORD_CWORD,
+    /*  70  "F" */ CWORD_CWORD_CWORD_CWORD,
+    /*  71  "G" */ CWORD_CWORD_CWORD_CWORD,
+    /*  72  "H" */ CWORD_CWORD_CWORD_CWORD,
+    /*  73  "I" */ CWORD_CWORD_CWORD_CWORD,
+    /*  74  "J" */ CWORD_CWORD_CWORD_CWORD,
+    /*  75  "K" */ CWORD_CWORD_CWORD_CWORD,
+    /*  76  "L" */ CWORD_CWORD_CWORD_CWORD,
+    /*  77  "M" */ CWORD_CWORD_CWORD_CWORD,
+    /*  78  "N" */ CWORD_CWORD_CWORD_CWORD,
+    /*  79  "O" */ CWORD_CWORD_CWORD_CWORD,
+    /*  80  "P" */ CWORD_CWORD_CWORD_CWORD,
+    /*  81  "Q" */ CWORD_CWORD_CWORD_CWORD,
+    /*  82  "R" */ CWORD_CWORD_CWORD_CWORD,
+    /*  83  "S" */ CWORD_CWORD_CWORD_CWORD,
+    /*  84  "T" */ CWORD_CWORD_CWORD_CWORD,
+    /*  85  "U" */ CWORD_CWORD_CWORD_CWORD,
+    /*  86  "V" */ CWORD_CWORD_CWORD_CWORD,
+    /*  87  "W" */ CWORD_CWORD_CWORD_CWORD,
+    /*  88  "X" */ CWORD_CWORD_CWORD_CWORD,
+    /*  89  "Y" */ CWORD_CWORD_CWORD_CWORD,
+    /*  90  "Z" */ CWORD_CWORD_CWORD_CWORD,
+    /*  91  "[" */ CWORD_CCTL_CCTL_CWORD,
+    /*  92  "\" */ CBACK_CBACK_CCTL_CBACK,
+    /*  93  "]" */ CWORD_CCTL_CCTL_CWORD,
+    /*  94  "^" */ CWORD_CWORD_CWORD_CWORD,
+    /*  95  "_" */ CWORD_CWORD_CWORD_CWORD,
+    /*  96  "`" */ CBQUOTE_CBQUOTE_CWORD_CBQUOTE,
+    /*  97  "a" */ CWORD_CWORD_CWORD_CWORD,
+    /*  98  "b" */ CWORD_CWORD_CWORD_CWORD,
+    /*  99  "c" */ CWORD_CWORD_CWORD_CWORD,
+    /* 100  "d" */ CWORD_CWORD_CWORD_CWORD,
+    /* 101  "e" */ CWORD_CWORD_CWORD_CWORD,
+    /* 102  "f" */ CWORD_CWORD_CWORD_CWORD,
+    /* 103  "g" */ CWORD_CWORD_CWORD_CWORD,
+    /* 104  "h" */ CWORD_CWORD_CWORD_CWORD,
+    /* 105  "i" */ CWORD_CWORD_CWORD_CWORD,
+    /* 106  "j" */ CWORD_CWORD_CWORD_CWORD,
+    /* 107  "k" */ CWORD_CWORD_CWORD_CWORD,
+    /* 108  "l" */ CWORD_CWORD_CWORD_CWORD,
+    /* 109  "m" */ CWORD_CWORD_CWORD_CWORD,
+    /* 110  "n" */ CWORD_CWORD_CWORD_CWORD,
+    /* 111  "o" */ CWORD_CWORD_CWORD_CWORD,
+    /* 112  "p" */ CWORD_CWORD_CWORD_CWORD,
+    /* 113  "q" */ CWORD_CWORD_CWORD_CWORD,
+    /* 114  "r" */ CWORD_CWORD_CWORD_CWORD,
+    /* 115  "s" */ CWORD_CWORD_CWORD_CWORD,
+    /* 116  "t" */ CWORD_CWORD_CWORD_CWORD,
+    /* 117  "u" */ CWORD_CWORD_CWORD_CWORD,
+    /* 118  "v" */ CWORD_CWORD_CWORD_CWORD,
+    /* 119  "w" */ CWORD_CWORD_CWORD_CWORD,
+    /* 120  "x" */ CWORD_CWORD_CWORD_CWORD,
+    /* 121  "y" */ CWORD_CWORD_CWORD_CWORD,
+    /* 122  "z" */ CWORD_CWORD_CWORD_CWORD,
+    /* 123  "{" */ CWORD_CWORD_CWORD_CWORD,
+    /* 124  "|" */ CSPCL_CWORD_CWORD_CWORD,
+    /* 125  "}" */ CENDVAR_CENDVAR_CWORD_CENDVAR,
+    /* 126  "~" */ CWORD_CCTL_CCTL_CWORD,
+    /* 127  del */ CWORD_CWORD_CWORD_CWORD,
+    /* 128 0x80 */ CWORD_CWORD_CWORD_CWORD,
+    /* 129 CTLESC       */ CCTL_CCTL_CCTL_CCTL,
+    /* 130 CTLVAR       */ CCTL_CCTL_CCTL_CCTL,
+    /* 131 CTLENDVAR    */ CCTL_CCTL_CCTL_CCTL,
+    /* 132 CTLBACKQ     */ CCTL_CCTL_CCTL_CCTL,
+    /* 133 CTLQUOTE     */ CCTL_CCTL_CCTL_CCTL,
+    /* 134 CTLARI       */ CCTL_CCTL_CCTL_CCTL,
+    /* 135 CTLENDARI    */ CCTL_CCTL_CCTL_CCTL,
+    /* 136 CTLQUOTEMARK */ CCTL_CCTL_CCTL_CCTL,
+    /* 137      */ CWORD_CWORD_CWORD_CWORD,
+    /* 138      */ CWORD_CWORD_CWORD_CWORD,
+    /* 139      */ CWORD_CWORD_CWORD_CWORD,
+    /* 140      */ CWORD_CWORD_CWORD_CWORD,
+    /* 141      */ CWORD_CWORD_CWORD_CWORD,
+    /* 142      */ CWORD_CWORD_CWORD_CWORD,
+    /* 143      */ CWORD_CWORD_CWORD_CWORD,
+    /* 144      */ CWORD_CWORD_CWORD_CWORD,
+    /* 145      */ CWORD_CWORD_CWORD_CWORD,
+    /* 146      */ CWORD_CWORD_CWORD_CWORD,
+    /* 147      */ CWORD_CWORD_CWORD_CWORD,
+    /* 148      */ CWORD_CWORD_CWORD_CWORD,
+    /* 149      */ CWORD_CWORD_CWORD_CWORD,
+    /* 150      */ CWORD_CWORD_CWORD_CWORD,
+    /* 151      */ CWORD_CWORD_CWORD_CWORD,
+    /* 152      */ CWORD_CWORD_CWORD_CWORD,
+    /* 153      */ CWORD_CWORD_CWORD_CWORD,
+    /* 154      */ CWORD_CWORD_CWORD_CWORD,
+    /* 155      */ CWORD_CWORD_CWORD_CWORD,
+    /* 156      */ CWORD_CWORD_CWORD_CWORD,
+    /* 157      */ CWORD_CWORD_CWORD_CWORD,
+    /* 158      */ CWORD_CWORD_CWORD_CWORD,
+    /* 159      */ CWORD_CWORD_CWORD_CWORD,
+    /* 160      */ CWORD_CWORD_CWORD_CWORD,
+    /* 161      */ CWORD_CWORD_CWORD_CWORD,
+    /* 162      */ CWORD_CWORD_CWORD_CWORD,
+    /* 163      */ CWORD_CWORD_CWORD_CWORD,
+    /* 164      */ CWORD_CWORD_CWORD_CWORD,
+    /* 165      */ CWORD_CWORD_CWORD_CWORD,
+    /* 166      */ CWORD_CWORD_CWORD_CWORD,
+    /* 167      */ CWORD_CWORD_CWORD_CWORD,
+    /* 168      */ CWORD_CWORD_CWORD_CWORD,
+    /* 169      */ CWORD_CWORD_CWORD_CWORD,
+    /* 170      */ CWORD_CWORD_CWORD_CWORD,
+    /* 171      */ CWORD_CWORD_CWORD_CWORD,
+    /* 172      */ CWORD_CWORD_CWORD_CWORD,
+    /* 173      */ CWORD_CWORD_CWORD_CWORD,
+    /* 174      */ CWORD_CWORD_CWORD_CWORD,
+    /* 175      */ CWORD_CWORD_CWORD_CWORD,
+    /* 176      */ CWORD_CWORD_CWORD_CWORD,
+    /* 177      */ CWORD_CWORD_CWORD_CWORD,
+    /* 178      */ CWORD_CWORD_CWORD_CWORD,
+    /* 179      */ CWORD_CWORD_CWORD_CWORD,
+    /* 180      */ CWORD_CWORD_CWORD_CWORD,
+    /* 181      */ CWORD_CWORD_CWORD_CWORD,
+    /* 182      */ CWORD_CWORD_CWORD_CWORD,
+    /* 183      */ CWORD_CWORD_CWORD_CWORD,
+    /* 184      */ CWORD_CWORD_CWORD_CWORD,
+    /* 185      */ CWORD_CWORD_CWORD_CWORD,
+    /* 186      */ CWORD_CWORD_CWORD_CWORD,
+    /* 187      */ CWORD_CWORD_CWORD_CWORD,
+    /* 188      */ CWORD_CWORD_CWORD_CWORD,
+    /* 189      */ CWORD_CWORD_CWORD_CWORD,
+    /* 190      */ CWORD_CWORD_CWORD_CWORD,
+    /* 191      */ CWORD_CWORD_CWORD_CWORD,
+    /* 192      */ CWORD_CWORD_CWORD_CWORD,
+    /* 193      */ CWORD_CWORD_CWORD_CWORD,
+    /* 194      */ CWORD_CWORD_CWORD_CWORD,
+    /* 195      */ CWORD_CWORD_CWORD_CWORD,
+    /* 196      */ CWORD_CWORD_CWORD_CWORD,
+    /* 197      */ CWORD_CWORD_CWORD_CWORD,
+    /* 198      */ CWORD_CWORD_CWORD_CWORD,
+    /* 199      */ CWORD_CWORD_CWORD_CWORD,
+    /* 200      */ CWORD_CWORD_CWORD_CWORD,
+    /* 201      */ CWORD_CWORD_CWORD_CWORD,
+    /* 202      */ CWORD_CWORD_CWORD_CWORD,
+    /* 203      */ CWORD_CWORD_CWORD_CWORD,
+    /* 204      */ CWORD_CWORD_CWORD_CWORD,
+    /* 205      */ CWORD_CWORD_CWORD_CWORD,
+    /* 206      */ CWORD_CWORD_CWORD_CWORD,
+    /* 207      */ CWORD_CWORD_CWORD_CWORD,
+    /* 208      */ CWORD_CWORD_CWORD_CWORD,
+    /* 209      */ CWORD_CWORD_CWORD_CWORD,
+    /* 210      */ CWORD_CWORD_CWORD_CWORD,
+    /* 211      */ CWORD_CWORD_CWORD_CWORD,
+    /* 212      */ CWORD_CWORD_CWORD_CWORD,
+    /* 213      */ CWORD_CWORD_CWORD_CWORD,
+    /* 214      */ CWORD_CWORD_CWORD_CWORD,
+    /* 215      */ CWORD_CWORD_CWORD_CWORD,
+    /* 216      */ CWORD_CWORD_CWORD_CWORD,
+    /* 217      */ CWORD_CWORD_CWORD_CWORD,
+    /* 218      */ CWORD_CWORD_CWORD_CWORD,
+    /* 219      */ CWORD_CWORD_CWORD_CWORD,
+    /* 220      */ CWORD_CWORD_CWORD_CWORD,
+    /* 221      */ CWORD_CWORD_CWORD_CWORD,
+    /* 222      */ CWORD_CWORD_CWORD_CWORD,
+    /* 223      */ CWORD_CWORD_CWORD_CWORD,
+    /* 224      */ CWORD_CWORD_CWORD_CWORD,
+    /* 225      */ CWORD_CWORD_CWORD_CWORD,
+    /* 226      */ CWORD_CWORD_CWORD_CWORD,
+    /* 227      */ CWORD_CWORD_CWORD_CWORD,
+    /* 228      */ CWORD_CWORD_CWORD_CWORD,
+    /* 229      */ CWORD_CWORD_CWORD_CWORD,
+    /* 230      */ CWORD_CWORD_CWORD_CWORD,
+    /* 231      */ CWORD_CWORD_CWORD_CWORD,
+    /* 232      */ CWORD_CWORD_CWORD_CWORD,
+    /* 233      */ CWORD_CWORD_CWORD_CWORD,
+    /* 234      */ CWORD_CWORD_CWORD_CWORD,
+    /* 235      */ CWORD_CWORD_CWORD_CWORD,
+    /* 236      */ CWORD_CWORD_CWORD_CWORD,
+    /* 237      */ CWORD_CWORD_CWORD_CWORD,
+    /* 238      */ CWORD_CWORD_CWORD_CWORD,
+    /* 239      */ CWORD_CWORD_CWORD_CWORD,
+    /* 230      */ CWORD_CWORD_CWORD_CWORD,
+    /* 241      */ CWORD_CWORD_CWORD_CWORD,
+    /* 242      */ CWORD_CWORD_CWORD_CWORD,
+    /* 243      */ CWORD_CWORD_CWORD_CWORD,
+    /* 244      */ CWORD_CWORD_CWORD_CWORD,
+    /* 245      */ CWORD_CWORD_CWORD_CWORD,
+    /* 246      */ CWORD_CWORD_CWORD_CWORD,
+    /* 247      */ CWORD_CWORD_CWORD_CWORD,
+    /* 248      */ CWORD_CWORD_CWORD_CWORD,
+    /* 249      */ CWORD_CWORD_CWORD_CWORD,
+    /* 250      */ CWORD_CWORD_CWORD_CWORD,
+    /* 251      */ CWORD_CWORD_CWORD_CWORD,
+    /* 252      */ CWORD_CWORD_CWORD_CWORD,
+    /* 253      */ CWORD_CWORD_CWORD_CWORD,
+    /* 254      */ CWORD_CWORD_CWORD_CWORD,
+    /* 255      */ CWORD_CWORD_CWORD_CWORD,
+    /* PEOF */     CENDFILE_CENDFILE_CENDFILE_CENDFILE,
+# if ENABLE_ASH_ALIAS
+    /* PEOA */     CSPCL_CIGN_CIGN_CIGN,
+# endif
 };
 
-#define SIT(c, syntax) (S_I_T[(int)syntax_index_table[((int)c)+SYNBASE]][syntax])
-
-#endif  /* USE_SIT_FUNCTION */
+# define SIT(c, syntax) ((S_I_T[syntax_index_table[c]] >> ((syntax)*4)) & 0xf)
+
+#endif  /* !USE_SIT_FUNCTION */
 
 
@@ -2902 +3115 @@
 #define ALIASINUSE 1
 #define ALIASDEAD  2
-
-#define ATABSIZE 39
 
 struct alias {
@@ -2912 +3123 @@
 };
 
-static struct alias *atab[ATABSIZE];
+
+static struct alias **atab; // [ATABSIZE];
+#define INIT_G_alias() do { \
+    atab = xzalloc(ATABSIZE * sizeof(atab[0])); \
+} while (0)
+
 
 static struct alias **
@@ -2983 +3199 @@
     } else {
         /* not found */
-        ap = ckmalloc(sizeof(struct alias));
+        ap = ckzalloc(sizeof(struct alias));
         ap->name = ckstrdup(name);
         ap->val = ckstrdup(val);
-        ap->flag = 0;
-        ap->next = 0;
+        /*ap->flag = 0; - ckzalloc did it */
+        /*ap->next = NULL;*/
         *app = ap;
     }
@@ -3038 +3254 @@
  * TODO - sort output
  */
-static int
-aliascmd(int argc, char **argv)
+static int FAST_FUNC
+aliascmd(int argc UNUSED_PARAM, char **argv)
 {
     char *n, *v;
@@ -3045 +3261 @@
     struct alias *ap;
 
-    if (argc == 1) {
+    if (!argv[1]) {
         int i;
 
-        for (i = 0; i < ATABSIZE; i++)
+        for (i = 0; i < ATABSIZE; i++) {
             for (ap = atab[i]; ap; ap = ap->next) {
                 printalias(ap);
             }
+        }
         return 0;
     }
@@ -3072 +3289 @@
 }
 
-static int
-unaliascmd(int argc, char **argv)
+static int FAST_FUNC
+unaliascmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     int i;
@@ -3099 +3316 @@
 
 /* Mode argument to forkshell.  Don't change FORK_FG or FORK_BG. */
-#define FORK_FG 0
-#define FORK_BG 1
+#define FORK_FG    0
+#define FORK_BG    1
 #define FORK_NOJOB 2
 
 /* mode flags for showjob(s) */
-#define SHOW_PGID       0x01    /* only show pgid - for jobs -p */
-#define SHOW_PID        0x04    /* include process pid */
-#define SHOW_CHANGED    0x08    /* only jobs whose state has changed */
+#define SHOW_ONLY_PGID  0x01    /* show only pgid (jobs -p) */
+#define SHOW_PIDS       0x02    /* show individual pids, not just one line per job */
+#define SHOW_CHANGED    0x04    /* only jobs whose state has changed */
 
 /*
@@ -3114 +3331 @@
  * array of pids.
  */
-
 struct procstat {
-    pid_t   pid;            /* process id */
-    int     status;         /* last process status from wait() */
-    char    *cmd;           /* text of command being run */
+    pid_t   ps_pid;         /* process id */
+    int     ps_status;      /* last process status from wait() */
+    char    *ps_cmd;        /* text of command being run */
 };
 
@@ -3143 +3359 @@
 };
 
-static pid_t backgndpid;        /* pid of last background process */
-static smallint job_warning;    /* user was warned about stopped jobs (can be 2, 1 or 0). */
-
-static struct job *makejob(union node *, int);
+static struct job *makejob(/*union node *,*/ int);
 static int forkshell(struct job *, union node *, int);
 static int waitforjob(struct job *);
 
 #if !JOBS
-enum { jobctl = 0 };
+enum { doing_jobctl = 0 };
 #define setjobctl(on) do {} while (0)
 #else
-static smallint jobctl;              /* true if doing job control */
+static smallint doing_jobctl; //references:8
 static void setjobctl(int);
 #endif
+
+/*
+ * Ignore a signal.
+ */
+static void
+ignoresig(int signo)
+{
+    /* Avoid unnecessary system calls. Is it already SIG_IGNed? */
+    if (sigmode[signo - 1] != S_IGN && sigmode[signo - 1] != S_HARD_IGN) {
+        /* No, need to do it */
+        signal(signo, SIG_IGN);
+    }
+    sigmode[signo - 1] = S_HARD_IGN;
+}
+
+/*
+ * Only one usage site - in setsignal()
+ */
+static void
+signal_handler(int signo)
+{
+    gotsig[signo - 1] = 1;
+
+    if (signo == SIGINT && !trap[SIGINT]) {
+        if (!suppress_int) {
+            pending_sig = 0;
+            raise_interrupt(); /* does not return */
+        }
+        pending_int = 1;
+    } else {
+        pending_sig = signo;
+    }
+}
 
 /*
@@ -3165 +3411 @@
 setsignal(int signo)
 {
-    int action;
-    char *t, tsig;
+    char *t;
+    char cur_act, new_act;
     struct sigaction act;
 
     t = trap[signo];
-    if (t == NULL)
-        action = S_DFL;
-    else if (*t != '\0')
-        action = S_CATCH;
-    else
-        action = S_IGN;
-    if (rootshell && action == S_DFL) {
+    new_act = S_DFL;
+    if (t != NULL) { /* trap for this sig is set */
+        new_act = S_CATCH;
+        if (t[0] == '\0') /* trap is "": ignore this sig */
+            new_act = S_IGN;
+    }
+
+    if (rootshell && new_act == S_DFL) {
         switch (signo) {
         case SIGINT:
             if (iflag || minusc || sflag == 0)
-                action = S_CATCH;
+                new_act = S_CATCH;
             break;
         case SIGQUIT:
@@ -3187 +3434 @@
                 break;
 #endif
-            /* FALLTHROUGH */
+            /* man bash:
+             * "In all cases, bash ignores SIGQUIT. Non-builtin
+             * commands run by bash have signal handlers
+             * set to the values inherited by the shell
+             * from its parent". */
+            new_act = S_IGN;
+            break;
         case SIGTERM:
             if (iflag)
-                action = S_IGN;
+                new_act = S_IGN;
             break;
 #if JOBS
@@ -3196 +3449 @@
         case SIGTTOU:
             if (mflag)
-                action = S_IGN;
+                new_act = S_IGN;
             break;
 #endif
         }
     }
+//TODO: if !rootshell, we reset SIGQUIT to DFL,
+//whereas we have to restore it to what shell got on entry
+//from the parent. See comment above
 
     t = &sigmode[signo - 1];
-    tsig = *t;
-    if (tsig == 0) {
-        /*
-         * current setting unknown
-         */
-        if (sigaction(signo, 0, &act) == -1) {
-            /*
-             * Pretend it worked; maybe we should give a warning
-             * here, but other shells don't. We don't alter
-             * sigmode, so that we retry every time.
-             */
+    cur_act = *t;
+    if (cur_act == 0) {
+        /* current setting is not yet known */
+        if (sigaction(signo, NULL, &act)) {
+            /* pretend it worked; maybe we should give a warning,
+             * but other shells don't. We don't alter sigmode,
+             * so we retry every time.
+             * btw, in Linux it never fails. --vda */
             return;
         }
         if (act.sa_handler == SIG_IGN) {
+            cur_act = S_HARD_IGN;
             if (mflag
              && (signo == SIGTSTP || signo == SIGTTIN || signo == SIGTTOU)
             ) {
-                tsig = S_IGN;   /* don't hard ignore these */
-            } else
-                tsig = S_HARD_IGN;
-        } else {
-            tsig = S_RESET; /* force to be set */
-        }
-    }
-    if (tsig == S_HARD_IGN || tsig == action)
+                cur_act = S_IGN;   /* don't hard ignore these */
+            }
+        }
+    }
+    if (cur_act == S_HARD_IGN || cur_act == new_act)
         return;
-    switch (action) {
+
+    act.sa_handler = SIG_DFL;
+    switch (new_act) {
     case S_CATCH:
-        act.sa_handler = onsig;
+        act.sa_handler = signal_handler;
+        act.sa_flags = 0; /* matters only if !DFL and !IGN */
+        sigfillset(&act.sa_mask); /* ditto */
         break;
     case S_IGN:
         act.sa_handler = SIG_IGN;
         break;
-    default:
-        act.sa_handler = SIG_DFL;
-    }
-    *t = action;
-    act.sa_flags = 0;
-    sigfillset(&act.sa_mask);
-    sigaction(signo, &act, 0);
+    }
+    sigaction_set(signo, &act);
+
+    *t = new_act;
 }
 
@@ -3251 +3503 @@
 
 /* mode flags for dowait */
-#define DOWAIT_NORMAL 0
-#define DOWAIT_BLOCK 1
+#define DOWAIT_NONBLOCK WNOHANG
+#define DOWAIT_BLOCK    0
 
 #if JOBS
 /* pgrp of shell on invocation */
-static int initialpgrp;
-static int ttyfd = -1;
+static int initialpgrp; //references:2
+static int ttyfd = -1; //5
 #endif
 /* array of jobs */
-static struct job *jobtab;
+static struct job *jobtab; //5
 /* size of array */
-static unsigned njobs;
+static unsigned njobs; //4
 /* current job */
-static struct job *curjob;
+static struct job *curjob; //lots
 /* number of presumed living untracked jobs */
-static int jobless;
+static int jobless; //4
 
 static void
@@ -3327 +3579 @@
  * Convert a job name to a job structure.
  */
+#if !JOBS
+#define getjob(name, getctl) getjob(name)
+#endif
 static struct job *
 getjob(const char *name, int getctl)
@@ -3332 +3587 @@
     struct job *jp;
     struct job *found;
-    const char *err_msg = "No such job: %s";
+    const char *err_msg = "%s: no such job";
     unsigned num;
     int c;
@@ -3383 +3638 @@
     }
 
-    found = 0;
-    while (1) {
-        if (!jp)
-            goto err;
-        if (match(jp->ps[0].cmd, p)) {
+    found = NULL;
+    while (jp) {
+        if (match(jp->ps[0].ps_cmd, p)) {
             if (found)
                 goto err;
@@ -3395 +3648 @@
         jp = jp->prev_job;
     }
+    if (!found)
+        goto err;
+    jp = found;
 
  gotit:
@@ -3418 +3674 @@
     INT_OFF;
     for (i = jp->nprocs, ps = jp->ps; --i >= 0; ps++) {
-        if (ps->cmd != nullstr)
-            free(ps->cmd);
+        if (ps->ps_cmd != nullstr)
+            free(ps->ps_cmd);
     }
     if (jp->ps != &jp->ps0)
@@ -3433 +3689 @@
 {
     if (tcsetpgrp(fd, pgrp))
-        ash_msg_and_raise_error("cannot set tty process group (%m)");
+        ash_msg_and_raise_error("can't set tty process group (%m)");
 }
 
@@ -3451 +3707 @@
     int pgrp;
 
-    if (on == jobctl || rootshell == 0)
+    if (on == doing_jobctl || rootshell == 0)
         return;
     if (on) {
@@ -3461 +3717 @@
      * Obviously, a workaround for bugs when someone
      * failed to provide a controlling tty to bash! :) */
-            fd += 3;
-            while (!isatty(fd) && --fd >= 0)
-                ;
+            fd = 2;
+            while (!isatty(fd))
+                if (--fd < 0)
+                    goto out;
         }
         fd = fcntl(fd, F_DUPFD, 10);
-        close(ofd);
+        if (ofd >= 0)
+            close(ofd);
         if (fd < 0)
             goto out;
-        fcntl(fd, F_SETFD, FD_CLOEXEC);
+        /* fd is a tty at this point */
+        close_on_exec_on(fd);
         do { /* while we are in the background */
             pgrp = tcgetpgrp(fd);
@@ -3495 +3754 @@
         pgrp = initialpgrp;
         /* was xtcsetpgrp, but this can make exiting ash
-         * with pty already deleted loop forever */
+         * loop forever if pty is already deleted */
         tcsetpgrp(fd, pgrp);
         setpgid(0, pgrp);
@@ -3502 +3761 @@
         setsignal(SIGTTIN);
  close:
-        close(fd);
+        if (fd >= 0)
+            close(fd);
         fd = -1;
     }
     ttyfd = fd;
-    jobctl = on;
-}
-
-static int
+    doing_jobctl = on;
+}
+
+static int FAST_FUNC
 killcmd(int argc, char **argv)
 {
+    int i = 1;
     if (argv[1] && strcmp(argv[1], "-l") != 0) {
-        int i = 1;
         do {
             if (argv[i][0] == '%') {
                 struct job *jp = getjob(argv[i], 0);
-                unsigned pid = jp->ps[0].pid;
+                unsigned pid = jp->ps[0].ps_pid;
                 /* Enough space for ' -NNN<nul>' */
                 argv[i] = alloca(sizeof(int)*3 + 3);
@@ -3531 +3791 @@
 
 static void
-showpipe(struct job *jp, FILE *out)
-{
-    struct procstat *sp;
-    struct procstat *spend;
-
-    spend = jp->ps + jp->nprocs;
-    for (sp = jp->ps + 1; sp < spend; sp++)
-        fprintf(out, " | %s", sp->cmd);
-    outcslow('\n', out);
+showpipe(struct job *jp /*, FILE *out*/)
+{
+    struct procstat *ps;
+    struct procstat *psend;
+
+    psend = jp->ps + jp->nprocs;
+    for (ps = jp->ps + 1; ps < psend; ps++)
+        printf(" | %s", ps->ps_cmd);
+    outcslow('\n', stdout);
     flush_stdout_stderr();
 }
@@ -3556 +3816 @@
         goto out;
     jp->state = JOBRUNNING;
-    pgid = jp->ps->pid;
+    pgid = jp->ps[0].ps_pid;
     if (mode == FORK_FG)
         xtcsetpgrp(ttyfd, pgid);
@@ -3563 +3823 @@
     i = jp->nprocs;
     do {
-        if (WIFSTOPPED(ps->status)) {
-            ps->status = -1;
+        if (WIFSTOPPED(ps->ps_status)) {
+            ps->ps_status = -1;
         }
         ps++;
@@ -3574 +3834 @@
 }
 
-static int
-fg_bgcmd(int argc, char **argv)
+static int FAST_FUNC
+fg_bgcmd(int argc UNUSED_PARAM, char **argv)
 {
     struct job *jp;
-    FILE *out;
     int mode;
     int retval;
@@ -3585 +3844 @@
     nextopt(nullstr);
     argv = argptr;
-    out = stdout;
     do {
         jp = getjob(*argv, 1);
         if (mode == FORK_BG) {
             set_curjob(jp, CUR_RUNNING);
-            fprintf(out, "[%d] ", jobno(jp));
-        }
-        outstr(jp->ps->cmd, out);
-        showpipe(jp, out);
+            printf("[%d] ", jobno(jp));
+        }
+        out1str(jp->ps[0].ps_cmd);
+        showpipe(jp /*, stdout*/);
         retval = restartjob(jp, mode);
     } while (*argv && *++argv);
@@ -3638 +3896 @@
 }
 
-/*
- * Do a wait system call.  If job control is compiled in, we accept
- * stopped processes.  If block is zero, we return a value of zero
- * rather than blocking.
- *
- * System V doesn't have a non-blocking wait system call.  It does
- * have a SIGCLD signal that is sent to a process when one of it's
- * children dies.  The obvious way to use SIGCLD would be to install
- * a handler for SIGCLD which simply bumped a counter when a SIGCLD
- * was received, and have waitproc bump another counter when it got
- * the status of a process.  Waitproc would then know that a wait
- * system call would not block if the two counters were different.
- * This approach doesn't work because if a process has children that
- * have not been waited for, System V will send it a SIGCLD when it
- * installs a signal handler for SIGCLD.  What this means is that when
- * a child exits, the shell will be sent SIGCLD signals continuously
- * until is runs out of stack space, unless it does a wait call before
- * restoring the signal handler.  The code below takes advantage of
- * this (mis)feature by installing a signal handler for SIGCLD and
- * then checking to see whether it was called.  If there are any
- * children to be waited for, it will be.
- *
- * If neither SYSV nor BSD is defined, we don't implement nonblocking
- * waits at all.  In this case, the user will not be informed when
- * a background process until the next time she runs a real program
- * (as opposed to running a builtin command or just typing return),
- * and the jobs command may give out of date information.
- */
 static int
-waitproc(int block, int *status)
-{
-    int flags = 0;
-
-#if JOBS
-    if (jobctl)
-        flags |= WUNTRACED;
-#endif
-    if (block == 0)
-        flags |= WNOHANG;
-    return wait3(status, flags, (struct rusage *)NULL);
-}
-
-/*
- * Wait for a process to terminate.
- */
-static int
-dowait(int block, struct job *job)
+dowait(int wait_flags, struct job *job)
 {
     int pid;
@@ -3692 +3905 @@
     int state;
 
-    TRACE(("dowait(%d) called\n", block));
-    pid = waitproc(block, &status);
-    TRACE(("wait returns pid %d, status=%d\n", pid, status));
+    TRACE(("dowait(0x%x) called\n", wait_flags));
+
+    /* Do a wait system call. If job control is compiled in, we accept
+     * stopped processes. wait_flags may have WNOHANG, preventing blocking.
+     * NB: _not_ safe_waitpid, we need to detect EINTR */
+    if (doing_jobctl)
+        wait_flags |= WUNTRACED;
+    pid = waitpid(-1, &status, wait_flags);
+    TRACE(("wait returns pid=%d, status=0x%x, errno=%d(%s)\n",
+                pid, status, errno, strerror(errno)));
     if (pid <= 0)
         return pid;
+
     INT_OFF;
     thisjob = NULL;
     for (jp = curjob; jp; jp = jp->prev_job) {
-        struct procstat *sp;
-        struct procstat *spend;
+        struct procstat *ps;
+        struct procstat *psend;
         if (jp->state == JOBDONE)
             continue;
         state = JOBDONE;
-        spend = jp->ps + jp->nprocs;
-        sp = jp->ps;
+        ps = jp->ps;
+        psend = ps + jp->nprocs;
         do {
-            if (sp->pid == pid) {
+            if (ps->ps_pid == pid) {
                 TRACE(("Job %d: changing status of proc %d "
                     "from 0x%x to 0x%x\n",
-                    jobno(jp), pid, sp->status, status));
-                sp->status = status;
+                    jobno(jp), pid, ps->ps_status, status));
+                ps->ps_status = status;
                 thisjob = jp;
             }
-            if (sp->status == -1)
+            if (ps->ps_status == -1)
                 state = JOBRUNNING;
 #if JOBS
             if (state == JOBRUNNING)
                 continue;
-            if (WIFSTOPPED(sp->status)) {
-                jp->stopstatus = sp->status;
+            if (WIFSTOPPED(ps->ps_status)) {
+                jp->stopstatus = ps->ps_status;
                 state = JOBSTOPPED;
             }
 #endif
-        } while (++sp < spend);
+        } while (++ps < psend);
         if (thisjob)
             goto gotjob;
@@ -3732 +3953 @@
     if (!WIFSTOPPED(status))
 #endif
-
         jobless--;
     goto out;
@@ -3762 +3982 @@
         if (len) {
             s[len] = '\n';
-            s[len + 1] = 0;
+            s[len + 1] = '\0';
             out2str(s);
         }
     }
+    return pid;
+}
+
+static int
+blocking_wait_with_raise_on_sig(void)
+{
+    pid_t pid = dowait(DOWAIT_BLOCK, NULL);
+    if (pid <= 0 && pending_sig)
+        raise_exception(EXSIG);
     return pid;
 }
@@ -3781 +4010 @@
     ps = jp->ps;
 
-    if (mode & SHOW_PGID) {
+    if (mode & SHOW_ONLY_PGID) { /* jobs -p */
         /* just output process (group) id of pipeline */
-        fprintf(out, "%d\n", ps->pid);
+        fprintf(out, "%d\n", ps->ps_pid);
         return;
     }
@@ -3791 +4020 @@
 
     if (jp == curjob)
-        s[col - 2] = '+';
+        s[col - 3] = '+';
     else if (curjob && jp == curjob->prev_job)
-        s[col - 2] = '-';
-
-    if (mode & SHOW_PID)
-        col += fmtstr(s + col, 16, "%d ", ps->pid);
+        s[col - 3] = '-';
+
+    if (mode & SHOW_PIDS)
+        col += fmtstr(s + col, 16, "%d ", ps->ps_pid);
 
     psend = ps + jp->nprocs;
@@ -3804 +4033 @@
         col += sizeof("Running") - 1;
     } else {
-        int status = psend[-1].status;
+        int status = psend[-1].ps_status;
         if (jp->state == JOBSTOPPED)
             status = jp->stopstatus;
         col += sprint_status(s + col, status, 0);
     }
-
+    /* By now, "[JOBID]*  [maybe PID] STATUS" is printed */
+
+    /* This loop either prints "<cmd1> | <cmd2> | <cmd3>" line
+     * or prints several "PID             | <cmdN>" lines,
+     * depending on SHOW_PIDS bit.
+     * We do not print status of individual processes
+     * between PID and <cmdN>. bash does it, but not very well:
+     * first line shows overall job status, not process status,
+     * making it impossible to know 1st process status.
+     */
     goto start;
-
     do {
         /* for each process */
-        col = fmtstr(s, 48, " |\n%*c%d ", indent_col, ' ', ps->pid) - 3;
+        s[0] = '\0';
+        col = 33;
+        if (mode & SHOW_PIDS)
+            col = fmtstr(s, 48, "\n%*c%d ", indent_col, ' ', ps->ps_pid) - 1;
  start:
-        fprintf(out, "%s%*c%s",
-            s, 33 - col >= 0 ? 33 - col : 0, ' ', ps->cmd
+        fprintf(out, "%s%*c%s%s",
+                s,
+                33 - col >= 0 ? 33 - col : 0, ' ',
+                ps == jp->ps ? "" : "| ",
+                ps->ps_cmd
         );
-        if (!(mode & SHOW_PID)) {
-            showpipe(jp, out);
-            break;
-        }
-        if (++ps == psend) {
-            outcslow('\n', out);
-            break;
-        }
-    } while (1);
+    } while (++ps != psend);
+    outcslow('\n', out);
 
     jp->changed = 0;
@@ -3846 +4082 @@
     struct job *jp;
 
-    TRACE(("showjobs(%x) called\n", mode));
-
-    /* If not even one one job changed, there is nothing to do */
-    while (dowait(DOWAIT_NORMAL, NULL) > 0)
+    TRACE(("showjobs(0x%x) called\n", mode));
+
+    /* Handle all finished jobs */
+    while (dowait(DOWAIT_NONBLOCK, NULL) > 0)
         continue;
 
@@ -3859 +4095 @@
 }
 
-static int
-jobscmd(int argc, char **argv)
+static int FAST_FUNC
+jobscmd(int argc UNUSED_PARAM, char **argv)
 {
     int mode, m;
 
     mode = 0;
-    while ((m = nextopt("lp"))) {
+    while ((m = nextopt("lp")) != '\0') {
         if (m == 'l')
-            mode = SHOW_PID;
+            mode |= SHOW_PIDS;
         else
-            mode = SHOW_PGID;
+            mode |= SHOW_ONLY_PGID;
     }
 
@@ -3875 +4111 @@
     if (*argv) {
         do
-            showjob(stdout, getjob(*argv,0), mode);
+            showjob(stdout, getjob(*argv, 0), mode);
         while (*++argv);
-    } else
+    } else {
         showjobs(stdout, mode);
+    }
 
     return 0;
@@ -3884 +4121 @@
 #endif /* JOBS */
 
+/* Called only on finished or stopped jobs (no members are running) */
 static int
 getstatus(struct job *job)
@@ -3889 +4127 @@
     int status;
     int retval;
-
-    status = job->ps[job->nprocs - 1].status;
+    struct procstat *ps;
+
+    /* Fetch last member's status */
+    ps = job->ps + job->nprocs - 1;
+    status = ps->ps_status;
+    if (pipefail) {
+        /* "set -o pipefail" mode: use last _nonzero_ status */
+        while (status == 0 && --ps >= job->ps)
+            status = ps->ps_status;
+    }
+
     retval = WEXITSTATUS(status);
     if (!WIFEXITED(status)) {
@@ -3907 +4154 @@
         retval += 128;
     }
-    TRACE(("getstatus: job %d, nproc %d, status %x, retval %x\n",
+    TRACE(("getstatus: job %d, nproc %d, status 0x%x, retval 0x%x\n",
         jobno(job), job->nprocs, status, retval));
     return retval;
 }
 
-static int
-waitcmd(int argc, char **argv)
+static int FAST_FUNC
+waitcmd(int argc UNUSED_PARAM, char **argv)
 {
     struct job *job;
@@ -3919 +4166 @@
     struct job *jp;
 
-    EXSIGON;
+    if (pending_sig)
+        raise_exception(EXSIG);
 
     nextopt(nullstr);
@@ -3930 +4178 @@
             jp = curjob;
             while (1) {
-                if (!jp) {
-                    /* no running procs */
-                    goto out;
-                }
+                if (!jp) /* no running procs */
+                    goto ret;
                 if (jp->state == JOBRUNNING)
                     break;
@@ -3939 +4185 @@
                 jp = jp->prev_job;
             }
-            dowait(DOWAIT_BLOCK, 0);
+            blocking_wait_with_raise_on_sig();
+    /* man bash:
+     * "When bash is waiting for an asynchronous command via
+     * the wait builtin, the reception of a signal for which a trap
+     * has been set will cause the wait builtin to return immediately
+     * with an exit status greater than 128, immediately after which
+     * the trap is executed."
+     *
+     * blocking_wait_with_raise_on_sig raises signal handlers
+     * if it gets no pid (pid < 0). However,
+     * if child sends us a signal *and immediately exits*,
+     * blocking_wait_with_raise_on_sig gets pid > 0
+     * and does not handle pending_sig. Check this case: */
+            if (pending_sig)
+                raise_exception(EXSIG);
         }
     }
@@ -3948 +4208 @@
             pid_t pid = number(*argv);
             job = curjob;
-            goto start;
-            do {
-                if (job->ps[job->nprocs - 1].pid == pid)
+            while (1) {
+                if (!job)
+                    goto repeat;
+                if (job->ps[job->nprocs - 1].ps_pid == pid)
                     break;
                 job = job->prev_job;
- start:
-                if (!job)
-                    goto repeat;
-            } while (1);
+            }
         } else
             job = getjob(*argv, 0);
         /* loop until process terminated or stopped */
         while (job->state == JOBRUNNING)
-            dowait(DOWAIT_BLOCK, 0);
+            blocking_wait_with_raise_on_sig();
         job->waited = 1;
         retval = getstatus(job);
- repeat:
-        ;
+ repeat: ;
     } while (*++argv);
 
- out:
+ ret:
     return retval;
 }
@@ -4020 +4277 @@
  */
 static struct job *
-makejob(union node *node, int nprocs)
+makejob(/*union node *node,*/ int nprocs)
 {
     int i;
@@ -4035 +4292 @@
             continue;
 #if JOBS
-        if (jobctl)
+        if (doing_jobctl)
             continue;
 #endif
@@ -4045 +4302 @@
     /* jp->jobctl is a bitfield.
      * "jp->jobctl |= jobctl" likely to give awful code */
-    if (jobctl)
+    if (doing_jobctl)
         jp->jobctl = 1;
 #endif
@@ -4055 +4312 @@
         jp->ps = ckmalloc(nprocs * sizeof(struct procstat));
     }
-    TRACE(("makejob(0x%lx, %d) returns %%%d\n", (long)node, nprocs,
+    TRACE(("makejob(%d) returns %%%d\n", nprocs,
                 jobno(jp)));
     return jp;
@@ -4070 +4327 @@
 cmdputs(const char *s)
 {
-    const char *p, *str;
-    char c, cc[2] = " ";
-    char *nextc;
-    int subtype = 0;
-    int quoted = 0;
-    static const char vstype[VSTYPE + 1][4] = {
+    static const char vstype[VSTYPE + 1][3] = {
         "", "}", "-", "+", "?", "=",
         "%", "%%", "#", "##"
+        IF_ASH_BASH_COMPAT(, ":", "/", "//")
     };
 
+    const char *p, *str;
+    char cc[2];
+    char *nextc;
+    unsigned char c;
+    unsigned char subtype = 0;
+    int quoted = 0;
+
+    cc[1] = '\0';
     nextc = makestrspace((strlen(s) + 1) * 8, cmdnextc);
     p = s;
-    while ((c = *p++) != 0) {
-        str = 0;
+    while ((c = *p++) != '\0') {
+        str = NULL;
         switch (c) {
         case CTLESC:
@@ -4110 +4371 @@
             str = "\"$(...)\"";
             goto dostr;
-#if ENABLE_ASH_MATH_SUPPORT
+#if ENABLE_SH_MATH_SUPPORT
         case CTLARI:
             str = "$((";
@@ -4150 +4411 @@
             continue;
  dostr:
-        while ((c = *str++)) {
+        while ((c = *str++) != '\0') {
             USTPUTC(c, nextc);
         }
-    }
+    } /* while *p++ not NUL */
+
     if (quoted & 1) {
         USTPUTC('"', nextc);
@@ -4182 +4444 @@
     struct nodelist *lp;
     const char *p;
-    char s[2];
 
     if (!n)
@@ -4228 +4489 @@
         cmdtxt(n->nif.test);
         cmdputs("; then ");
-        n = n->nif.ifpart;
         if (n->nif.elsepart) {
-            cmdtxt(n);
+            cmdtxt(n->nif.ifpart);
             cmdputs("; else ");
             n = n->nif.elsepart;
+        } else {
+            n = n->nif.ifpart;
         }
         p = "; fi";
@@ -4302 +4564 @@
         p = ">>";
         goto redir;
+#if ENABLE_ASH_BASH_COMPAT
+    case NTO2:
+#endif
     case NTOFD:
         p = ">&";
@@ -4314 +4579 @@
         p = "<>";
  redir:
-        s[0] = n->nfile.fd + '0';
-        s[1] = '\0';
-        cmdputs(s);
+        cmdputs(utoa(n->nfile.fd));
         cmdputs(p);
         if (n->type == NTOFD || n->type == NFROMFD) {
-            s[0] = n->ndup.dupfd + '0';
-            p = s;
-            goto dotail2;
+            cmdputs(utoa(n->ndup.dupfd));
+            break;
         }
         n = n->nfile.fname;
@@ -4367 +4629 @@
 
     for (tp = trap; tp < &trap[NSIG]; tp++) {
-        if (*tp && **tp) {      /* trap not NULL or SIG_IGN */
+        if (*tp && **tp) {      /* trap not NULL or "" (SIG_IGN) */
             INT_OFF;
-            free(*tp);
+            if (trap_ptr == trap)
+                free(*tp);
+            /* else: it "belongs" to trap_ptr vector, don't free */
             *tp = NULL;
-            if (tp != &trap[0])
+            if ((tp - trap) != 0)
                 setsignal(tp - trap);
             INT_ON;
         }
     }
+    may_have_traps = 0;
 }
 
@@ -4382 +4647 @@
 
 /* Called after fork(), in child */
-static void
+static NOINLINE void
 forkchild(struct job *jp, union node *n, int mode)
 {
@@ -4391 +4656 @@
     shlvl++;
 
+    /* man bash: "Non-builtin commands run by bash have signal handlers
+     * set to the values inherited by the shell from its parent".
+     * Do we do it correctly? */
+
     closescript();
+
+    if (mode == FORK_NOJOB          /* is it `xxx` ? */
+     && n && n->type == NCMD        /* is it single cmd? */
+    /* && n->ncmd.args->type == NARG - always true? */
+     && n->ncmd.args && strcmp(n->ncmd.args->narg.text, "trap") == 0
+     && n->ncmd.args->narg.next == NULL /* "trap" with no arguments */
+    /* && n->ncmd.args->narg.backquote == NULL - do we need to check this? */
+    ) {
+        TRACE(("Trap hack\n"));
+        /* Awful hack for `trap` or $(trap).
+         *
+         * http://www.opengroup.org/onlinepubs/009695399/utilities/trap.html
+         * contains an example where "trap" is executed in a subshell:
+         *
+         * save_traps=$(trap)
+         * ...
+         * eval "$save_traps"
+         *
+         * Standard does not say that "trap" in subshell shall print
+         * parent shell's traps. It only says that its output
+         * must have suitable form, but then, in the above example
+         * (which is not supposed to be normative), it implies that.
+         *
+         * bash (and probably other shell) does implement it
+         * (traps are reset to defaults, but "trap" still shows them),
+         * but as a result, "trap" logic is hopelessly messed up:
+         *
+         * # trap
+         * trap -- 'echo Ho' SIGWINCH  <--- we have a handler
+         * # (trap)        <--- trap is in subshell - no output (correct, traps are reset)
+         * # true | trap   <--- trap is in subshell - no output (ditto)
+         * # echo `true | trap`    <--- in subshell - output (but traps are reset!)
+         * trap -- 'echo Ho' SIGWINCH
+         * # echo `(trap)`         <--- in subshell in subshell - output
+         * trap -- 'echo Ho' SIGWINCH
+         * # echo `true | (trap)`  <--- in subshell in subshell in subshell - output!
+         * trap -- 'echo Ho' SIGWINCH
+         *
+         * The rules when to forget and when to not forget traps
+         * get really complex and nonsensical.
+         *
+         * Our solution: ONLY bare $(trap) or `trap` is special.
+         */
+        /* Save trap handler strings for trap builtin to print */
+        trap_ptr = memcpy(xmalloc(sizeof(trap)), trap, sizeof(trap));
+        /* Fall through into clearing traps */
+    }
     clear_traps();
 #if JOBS
     /* do job control only in root shell */
-    jobctl = 0;
+    doing_jobctl = 0;
     if (mode != FORK_NOJOB && jp->jobctl && !oldlvl) {
         pid_t pgrp;
@@ -4402 +4718 @@
             pgrp = getpid();
         else
-            pgrp = jp->ps[0].pid;
-        /* This can fail because we are doing it in the parent also */
-        (void)setpgid(0, pgrp);
+            pgrp = jp->ps[0].ps_pid;
+        /* this can fail because we are doing it in the parent also */
+        setpgid(0, pgrp);
         if (mode == FORK_FG)
             xtcsetpgrp(ttyfd, pgrp);
@@ -4412 +4728 @@
 #endif
     if (mode == FORK_BG) {
+        /* man bash: "When job control is not in effect,
+         * asynchronous commands ignore SIGINT and SIGQUIT" */
         ignoresig(SIGINT);
         ignoresig(SIGQUIT);
@@ -4417 +4735 @@
             close(0);
             if (open(bb_dev_null, O_RDONLY) != 0)
-                ash_msg_and_raise_error("can't open %s", bb_dev_null);
-        }
-    }
-    if (!oldlvl && iflag) {
-        setsignal(SIGINT);
+                ash_msg_and_raise_error("can't open '%s'", bb_dev_null);
+        }
+    }
+    if (!oldlvl) {
+        if (iflag) { /* why if iflag only? */
+            setsignal(SIGINT);
+            setsignal(SIGTERM);
+        }
+        /* man bash:
+         * "In all cases, bash ignores SIGQUIT. Non-builtin
+         * commands run by bash have signal handlers
+         * set to the values inherited by the shell
+         * from its parent".
+         * Take care of the second rule: */
         setsignal(SIGQUIT);
-        setsignal(SIGTERM);
-    }
+    }
+#if JOBS
+    if (n && n->type == NCMD
+     && n->ncmd.args && strcmp(n->ncmd.args->narg.text, "jobs") == 0
+    ) {
+        TRACE(("Job hack\n"));
+        /* "jobs": we do not want to clear job list for it,
+         * instead we remove only _its_ own_ job from job list.
+         * This makes "jobs .... | cat" more useful.
+         */
+        freejob(curjob);
+        return;
+    }
+#endif
     for (jp = curjob; jp; jp = jp->prev_job)
         freejob(jp);
@@ -4431 +4770 @@
 
 /* Called after fork(), in parent */
+#if !JOBS
+#define forkparent(jp, n, mode, pid) forkparent(jp, mode, pid)
+#endif
 static void
 forkparent(struct job *jp, union node *n, int mode, pid_t pid)
@@ -4436 +4778 @@
     TRACE(("In parent shell: child = %d\n", pid));
     if (!jp) {
-        while (jobless && dowait(DOWAIT_NORMAL, 0) > 0);
+        while (jobless && dowait(DOWAIT_NONBLOCK, NULL) > 0)
+            continue;
         jobless++;
         return;
@@ -4447 +4790 @@
             pgrp = pid;
         else
-            pgrp = jp->ps[0].pid;
+            pgrp = jp->ps[0].ps_pid;
         /* This can fail because we are doing it in the child also */
         setpgid(pid, pgrp);
@@ -4458 +4801 @@
     if (jp) {
         struct procstat *ps = &jp->ps[jp->nprocs++];
-        ps->pid = pid;
-        ps->status = -1;
-        ps->cmd = nullstr;
+        ps->ps_pid = pid;
+        ps->ps_status = -1;
+        ps->ps_cmd = nullstr;
 #if JOBS
-        if (jobctl && n)
-            ps->cmd = commandtext(n);
+        if (doing_jobctl && n)
+            ps->ps_cmd = commandtext(n);
 #endif
     }
@@ -4479 +4822 @@
         if (jp)
             freejob(jp);
-        ash_msg_and_raise_error("cannot fork");
-    }
-    if (pid == 0)
+        ash_msg_and_raise_error("can't fork");
+    }
+    if (pid == 0) {
+        CLEAR_RANDOM_T(&random_gen); /* or else $RANDOM repeats in child */
         forkchild(jp, n, mode);
-    else
+    } else {
         forkparent(jp, n, mode, pid);
+    }
     return pid;
 }
@@ -4491 +4836 @@
  * Wait for job to finish.
  *
- * Under job control we have the problem that while a child process is
- * running interrupts generated by the user are sent to the child but not
- * to the shell.  This means that an infinite loop started by an inter-
- * active user may be hard to kill.  With job control turned off, an
- * interactive user may place an interactive program inside a loop.  If
- * the interactive program catches interrupts, the user doesn't want
+ * Under job control we have the problem that while a child process
+ * is running interrupts generated by the user are sent to the child
+ * but not to the shell.  This means that an infinite loop started by
+ * an interactive user may be hard to kill.  With job control turned off,
+ * an interactive user may place an interactive program inside a loop.
+ * If the interactive program catches interrupts, the user doesn't want
  * these interrupts to also abort the loop.  The approach we take here
  * is to have the shell ignore interrupt signals while waiting for a
@@ -4514 +4859 @@
 
     TRACE(("waitforjob(%%%d) called\n", jobno(jp)));
+
+    INT_OFF;
     while (jp->state == JOBRUNNING) {
+        /* In non-interactive shells, we _can_ get
+         * a keyboard signal here and be EINTRed,
+         * but we just loop back, waiting for command to complete.
+         *
+         * man bash:
+         * "If bash is waiting for a command to complete and receives
+         * a signal for which a trap has been set, the trap
+         * will not be executed until the command completes."
+         *
+         * Reality is that even if trap is not set, bash
+         * will not act on the signal until command completes.
+         * Try this. sleep5intoff.c:
+         * #include <signal.h>
+         * #include <unistd.h>
+         * int main() {
+         *         sigset_t set;
+         *         sigemptyset(&set);
+         *         sigaddset(&set, SIGINT);
+         *         sigaddset(&set, SIGQUIT);
+         *         sigprocmask(SIG_BLOCK, &set, NULL);
+         *         sleep(5);
+         *         return 0;
+         * }
+         * $ bash -c './sleep5intoff; echo hi'
+         * ^C^C^C^C <--- pressing ^C once a second
+         * $ _
+         * $ bash -c './sleep5intoff; echo hi'
+         * ^\^\^\^\hi <--- pressing ^\ (SIGQUIT)
+         * $ _
+         */
         dowait(DOWAIT_BLOCK, jp);
     }
+    INT_ON;
+
     st = getstatus(jp);
 #if JOBS
@@ -4529 +4908 @@
          * occurred, and if so interrupt ourselves.  Yuck.  - mycroft
          */
-        if (jp->sigint)
-            raise(SIGINT);
+        if (jp->sigint) /* TODO: do the same with all signals */
+            raise(SIGINT); /* ... by raise(jp->sig) instead? */
     }
     if (jp->state == JOBDONE)
@@ -4567 +4946 @@
 
 #define EMPTY -2                /* marks an unused slot in redirtab */
-#ifndef PIPE_BUF
-# define PIPESIZE 4096          /* amount of buffering in a pipe */
-#else
-# define PIPESIZE PIPE_BUF
-#endif
+#define CLOSED -3               /* marks a slot of previously-closed fd */
 
 /*
@@ -4621 +4996 @@
      * replaced, return the file descriptor.
      */
-    if (fstat(fd, &finfo2) == 0 && !S_ISREG(finfo2.st_mode)
-     && finfo.st_dev == finfo2.st_dev && finfo.st_ino == finfo2.st_ino)
+    if (fstat(fd, &finfo2) == 0
+     && !S_ISREG(finfo2.st_mode)
+     && finfo.st_dev == finfo2.st_dev
+     && finfo.st_ino == finfo2.st_ino
+    ) {
         return fd;
+    }
 
     /* The file has been replaced.  badness. */
@@ -4648 +5027 @@
     if (redir->type == NHERE) {
         len = strlen(redir->nhere.doc->narg.text);
-        if (len <= PIPESIZE) {
+        if (len <= PIPE_BUF) {
             full_write(pip[1], redir->nhere.doc->narg.text, len);
             goto out;
@@ -4654 +5033 @@
     }
     if (forkshell((struct job *)NULL, (union node *)NULL, FORK_NOJOB) == 0) {
+        /* child */
         close(pip[0]);
-        signal(SIGINT, SIG_IGN);
-        signal(SIGQUIT, SIG_IGN);
-        signal(SIGHUP, SIG_IGN);
-#ifdef SIGTSTP
-        signal(SIGTSTP, SIG_IGN);
-#endif
+        ignoresig(SIGINT);  //signal(SIGINT, SIG_IGN);
+        ignoresig(SIGQUIT); //signal(SIGQUIT, SIG_IGN);
+        ignoresig(SIGHUP);  //signal(SIGHUP, SIG_IGN);
+        ignoresig(SIGTSTP); //signal(SIGTSTP, SIG_IGN);
         signal(SIGPIPE, SIG_DFL);
         if (redir->type == NHERE)
             full_write(pip[1], redir->nhere.doc->narg.text, len);
-        else
+        else /* NXHERE */
             expandhere(redir->nhere.doc, pip[1]);
-        _exit(0);
+        _exit(EXIT_SUCCESS);
     }
  out:
@@ -4688 +5066 @@
     case NFROMTO:
         fname = redir->nfile.expfname;
-        f = open(fname, O_RDWR|O_CREAT|O_TRUNC, 0666);
+        f = open(fname, O_RDWR|O_CREAT, 0666);
         if (f < 0)
             goto ecreate;
         break;
     case NTO:
+#if ENABLE_ASH_BASH_COMPAT
+    case NTO2:
+#endif
         /* Take care of noclobber mode. */
         if (Cflag) {
@@ -4719 +5100 @@
 #endif
         /* Fall through to eliminate warning. */
-    case NTOFD:
-    case NFROMFD:
-        f = -1;
-        break;
+/* Our single caller does this itself */
+//  case NTOFD:
+//  case NFROMFD:
+//      f = -1;
+//      break;
     case NHERE:
     case NXHERE:
@@ -4731 +5113 @@
     return f;
  ecreate:
-    ash_msg_and_raise_error("cannot create %s: %s", fname, errmsg(errno, "nonexistent directory"));
+    ash_msg_and_raise_error("can't create %s: %s", fname, errmsg(errno, "nonexistent directory"));
  eopen:
-    ash_msg_and_raise_error("cannot open %s: %s", fname, errmsg(errno, "no such file"));
+    ash_msg_and_raise_error("can't open %s: %s", fname, errmsg(errno, "no such file"));
 }
 
@@ -4741 +5123 @@
  * file descriptors left.
  */
+/* 0x800..00: bit to set in "to" to request dup2 instead of fcntl(F_DUPFD).
+ * old code was doing close(to) prior to copyfd() to achieve the same */
+enum {
+    COPYFD_EXACT   = (int)~(INT_MAX),
+    COPYFD_RESTORE = (int)((unsigned)COPYFD_EXACT >> 1),
+};
 static int
 copyfd(int from, int to)
@@ -4746 +5134 @@
     int newfd;
 
-    newfd = fcntl(from, F_DUPFD, to);
+    if (to & COPYFD_EXACT) {
+        to &= ~COPYFD_EXACT;
+        /*if (from != to)*/
+            newfd = dup2(from, to);
+    } else {
+        newfd = fcntl(from, F_DUPFD, to);
+    }
     if (newfd < 0) {
         if (errno == EMFILE)
             return EMPTY;
+        /* Happens when source fd is not open: try "echo >&99" */
         ash_msg_and_raise_error("%d: %m", from);
     }
@@ -4755 +5150 @@
 }
 
-static void
-dupredirect(union node *redir, int f)
-{
-    int fd = redir->nfile.fd;
-
-    if (redir->nfile.type == NTOFD || redir->nfile.type == NFROMFD) {
-        if (redir->ndup.dupfd >= 0) {   /* if not ">&-" */
-            copyfd(redir->ndup.dupfd, fd);
-        }
-        return;
-    }
-
-    if (f != fd) {
-        copyfd(f, fd);
-        close(f);
-    }
+/* Struct def and variable are moved down to the first usage site */
+struct two_fd_t {
+    int orig, copy;
+};
+struct redirtab {
+    struct redirtab *next;
+    int nullredirs;
+    int pair_count;
+    struct two_fd_t two_fd[];
+};
+#define redirlist (G_var.redirlist)
+
+static int need_to_remember(struct redirtab *rp, int fd)
+{
+    int i;
+
+    if (!rp) /* remembering was not requested */
+        return 0;
+
+    for (i = 0; i < rp->pair_count; i++) {
+        if (rp->two_fd[i].orig == fd) {
+            /* already remembered */
+            return 0;
+        }
+    }
+    return 1;
+}
+
+/* "hidden" fd is a fd used to read scripts, or a copy of such */
+static int is_hidden_fd(struct redirtab *rp, int fd)
+{
+    int i;
+    struct parsefile *pf;
+
+    if (fd == -1)
+        return 0;
+    /* Check open scripts' fds */
+    pf = g_parsefile;
+    while (pf) {
+        /* We skip pf_fd == 0 case because of the following case:
+         * $ ash  # running ash interactively
+         * $ . ./script.sh
+         * and in script.sh: "exec 9>&0".
+         * Even though top-level pf_fd _is_ 0,
+         * it's still ok to use it: "read" builtin uses it,
+         * why should we cripple "exec" builtin?
+         */
+        if (pf->pf_fd > 0 && fd == pf->pf_fd) {
+            return 1;
+        }
+        pf = pf->prev;
+    }
+
+    if (!rp)
+        return 0;
+    /* Check saved fds of redirects */
+    fd |= COPYFD_RESTORE;
+    for (i = 0; i < rp->pair_count; i++) {
+        if (rp->two_fd[i].copy == fd) {
+            return 1;
+        }
+    }
+    return 0;
 }
 
@@ -4776 +5218 @@
  * Process a list of redirection commands.  If the REDIR_PUSH flag is set,
  * old file descriptors are stashed away so that the redirection can be
- * undone by calling popredir.  If the REDIR_BACKQ flag is set, then the
- * standard output, and the standard error if it becomes a duplicate of
- * stdout, is saved in memory.
+ * undone by calling popredir.
  */
 /* flags passed to redirect */
@@ -4786 +5226 @@
 redirect(union node *redir, int flags)
 {
-    union node *n;
     struct redirtab *sv;
+    int sv_pos;
     int i;
     int fd;
     int newfd;
-    int *p;
-    nullredirs++;
+    int copied_fd2 = -1;
+
+    g_nullredirs++;
     if (!redir) {
         return;
     }
+
     sv = NULL;
+    sv_pos = 0;
     INT_OFF;
     if (flags & REDIR_PUSH) {
-        struct redirtab *q;
-        q = ckmalloc(sizeof(struct redirtab));
-        q->next = redirlist;
-        redirlist = q;
-        q->nullredirs = nullredirs - 1;
-        for (i = 0; i < 10; i++)
-            q->renamed[i] = EMPTY;
-        nullredirs = 0;
-        sv = q;
-    }
-    n = redir;
+        union node *tmp = redir;
+        do {
+            sv_pos++;
+#if ENABLE_ASH_BASH_COMPAT
+            if (tmp->nfile.type == NTO2)
+                sv_pos++;
+#endif
+            tmp = tmp->nfile.next;
+        } while (tmp);
+        sv = ckmalloc(sizeof(*sv) + sv_pos * sizeof(sv->two_fd[0]));
+        sv->next = redirlist;
+        sv->pair_count = sv_pos;
+        redirlist = sv;
+        sv->nullredirs = g_nullredirs - 1;
+        g_nullredirs = 0;
+        while (sv_pos > 0) {
+            sv_pos--;
+            sv->two_fd[sv_pos].orig = sv->two_fd[sv_pos].copy = EMPTY;
+        }
+    }
+
     do {
-        fd = n->nfile.fd;
-        if ((n->nfile.type == NTOFD || n->nfile.type == NFROMFD)
-         && n->ndup.dupfd == fd)
-            continue; /* redirect from/to same file descriptor */
-
-        newfd = openredirect(n);
-        if (fd == newfd)
-            continue;
-        if (sv && *(p = &sv->renamed[fd]) == EMPTY) {
-            i = fcntl(fd, F_DUPFD, 10);
-
+        int right_fd = -1;
+        fd = redir->nfile.fd;
+        if (redir->nfile.type == NTOFD || redir->nfile.type == NFROMFD) {
+            right_fd = redir->ndup.dupfd;
+            //bb_error_msg("doing %d > %d", fd, right_fd);
+            /* redirect from/to same file descriptor? */
+            if (right_fd == fd)
+                continue;
+            /* "echo >&10" and 10 is a fd opened to a sh script? */
+            if (is_hidden_fd(sv, right_fd)) {
+                errno = EBADF; /* as if it is closed */
+                ash_msg_and_raise_error("%d: %m", right_fd);
+            }
+            newfd = -1;
+        } else {
+            newfd = openredirect(redir); /* always >= 0 */
+            if (fd == newfd) {
+                /* Descriptor wasn't open before redirect.
+                 * Mark it for close in the future */
+                if (need_to_remember(sv, fd)) {
+                    goto remember_to_close;
+                }
+                continue;
+            }
+        }
+#if ENABLE_ASH_BASH_COMPAT
+ redirect_more:
+#endif
+        if (need_to_remember(sv, fd)) {
+            /* Copy old descriptor */
+            /* Careful to not accidentally "save"
+             * to the same fd as right side fd in N>&M */
+            int minfd = right_fd < 10 ? 10 : right_fd + 1;
+            i = fcntl(fd, F_DUPFD, minfd);
+/* You'd expect copy to be CLOEXECed. Currently these extra "saved" fds
+ * are closed in popredir() in the child, preventing them from leaking
+ * into child. (popredir() also cleans up the mess in case of failures)
+ */
             if (i == -1) {
                 i = errno;
                 if (i != EBADF) {
-                    close(newfd);
+                    /* Strange error (e.g. "too many files" EMFILE?) */
+                    if (newfd >= 0)
+                        close(newfd);
                     errno = i;
                     ash_msg_and_raise_error("%d: %m", fd);
                     /* NOTREACHED */
                 }
+                /* EBADF: it is not open - good, remember to close it */
+ remember_to_close:
+                i = CLOSED;
+            } else { /* fd is open, save its copy */
+                /* "exec fd>&-" should not close fds
+                 * which point to script file(s).
+                 * Force them to be restored afterwards */
+                if (is_hidden_fd(sv, fd))
+                    i |= COPYFD_RESTORE;
+            }
+            if (fd == 2)
+                copied_fd2 = i;
+            sv->two_fd[sv_pos].orig = fd;
+            sv->two_fd[sv_pos].copy = i;
+            sv_pos++;
+        }
+        if (newfd < 0) {
+            /* NTOFD/NFROMFD: copy redir->ndup.dupfd to fd */
+            if (redir->ndup.dupfd < 0) { /* "fd>&-" */
+                /* Don't want to trigger debugging */
+                if (fd != -1)
+                    close(fd);
             } else {
-                *p = i;
-                close(fd);
+                copyfd(redir->ndup.dupfd, fd | COPYFD_EXACT);
             }
-        } else {
-            close(fd);
-        }
-        dupredirect(n, newfd);
-    } while ((n = n->nfile.next));
+        } else if (fd != newfd) { /* move newfd to fd */
+            copyfd(newfd, fd | COPYFD_EXACT);
+#if ENABLE_ASH_BASH_COMPAT
+            if (!(redir->nfile.type == NTO2 && fd == 2))
+#endif
+                close(newfd);
+        }
+#if ENABLE_ASH_BASH_COMPAT
+        if (redir->nfile.type == NTO2 && fd == 1) {
+            /* We already redirected it to fd 1, now copy it to 2 */
+            newfd = 1;
+            fd = 2;
+            goto redirect_more;
+        }
+#endif
+    } while ((redir = redir->nfile.next) != NULL);
+
     INT_ON;
-    if (flags & REDIR_SAVEFD2 && sv && sv->renamed[2] >= 0)
-        preverrout_fd = sv->renamed[2];
+    if ((flags & REDIR_SAVEFD2) && copied_fd2 >= 0)
+        preverrout_fd = copied_fd2;
 }
 
@@ -4848 +5363 @@
  */
 static void
-popredir(int drop)
+popredir(int drop, int restore)
 {
     struct redirtab *rp;
     int i;
 
-    if (--nullredirs >= 0)
+    if (--g_nullredirs >= 0)
         return;
     INT_OFF;
     rp = redirlist;
-    for (i = 0; i < 10; i++) {
-        if (rp->renamed[i] != EMPTY) {
-            if (!drop) {
-                close(i);
-                copyfd(rp->renamed[i], i);
+    for (i = 0; i < rp->pair_count; i++) {
+        int fd = rp->two_fd[i].orig;
+        int copy = rp->two_fd[i].copy;
+        if (copy == CLOSED) {
+            if (!drop)
+                close(fd);
+            continue;
+        }
+        if (copy != EMPTY) {
+            if (!drop || (restore && (copy & COPYFD_RESTORE))) {
+                copy &= ~COPYFD_RESTORE;
+                /*close(fd);*/
+                copyfd(copy, fd | COPYFD_EXACT);
             }
-            close(rp->renamed[i]);
+            close(copy & ~COPYFD_RESTORE);
         }
     }
     redirlist = rp->next;
-    nullredirs = rp->nullredirs;
+    g_nullredirs = rp->nullredirs;
     free(rp);
     INT_ON;
@@ -4883 +5406 @@
 {
     for (;;) {
-        nullredirs = 0;
+        g_nullredirs = 0;
         if (!redirlist)
             break;
-        popredir(drop);
+        popredir(drop, /*restore:*/ 0);
     }
 }
@@ -4899 +5422 @@
 
     SAVE_INT(saveint);
-    err = setjmp(jmploc.loc) * 2;
+    /* "echo 9>/dev/null; echo >&9; echo result: $?" - result should be 1, not 2! */
+    err = setjmp(jmploc.loc); // huh?? was = setjmp(jmploc.loc) * 2;
     if (!err) {
         exception_handler = &jmploc;
@@ -4905 +5429 @@
     }
     exception_handler = savehandler;
-    if (err && exception != EXERROR)
+    if (err && exception_type != EXERROR)
         longjmp(exception_handler->loc, 1);
     RESTORE_INT(saveint);
@@ -4916 +5440 @@
  * We have to deal with backquotes, shell variables, and file metacharacters.
  */
+
+#if ENABLE_SH_MATH_SUPPORT
+static arith_t
+ash_arith(const char *s)
+{
+    arith_state_t math_state;
+    arith_t result;
+
+    math_state.lookupvar = lookupvar;
+    math_state.setvar    = setvar2;
+    //math_state.endofname = endofname;
+
+    INT_OFF;
+    result = arith(&math_state, s);
+    if (math_state.errmsg)
+        ash_msg_and_raise_error(math_state.errmsg);
+    INT_ON;
+
+    return result;
+}
+#endif
 
 /*
@@ -4930 +5475 @@
 #define EXP_QWORD       0x100   /* expand word in quoted parameter expansion */
 /*
- * _rmescape() flags
+ * rmescape() flags
  */
 #define RMESCAPE_ALLOC  0x1     /* Allocate a new string */
@@ -4968 +5513 @@
  * Our own itoa().
  */
+#if !ENABLE_SH_MATH_SUPPORT
+/* cvtnum() is used even if math support is off (to prepare $? values and such) */
+typedef long arith_t;
+# define ARITH_FMT "%ld"
+#endif
 static int
 cvtnum(arith_t num)
@@ -4974 +5524 @@
 
     expdest = makestrspace(32, expdest);
-#if ENABLE_ASH_MATH_SUPPORT_64
-    len = fmtstr(expdest, 32, "%lld", (long long) num);
-#else
-    len = fmtstr(expdest, 32, "%ld", num);
-#endif
+    len = fmtstr(expdest, 32, ARITH_FMT, num);
     STADJUST(len, expdest);
     return len;
@@ -4988 +5534 @@
     size_t esc = 0;
 
-    while (p > start && *--p == CTLESC) {
+    while (p > start && (unsigned char)*--p == CTLESC) {
         esc++;
     }
@@ -4998 +5544 @@
  */
 static char *
-_rmescapes(char *str, int flag)
+rmescapes(char *str, int flag)
 {
     static const char qchars[] ALIGN1 = { CTLESC, CTLQUOTEMARK, '\0' };
@@ -5004 +5550 @@
     char *p, *q, *r;
     unsigned inquotes;
-    int notescaped;
-    int globbing;
+    unsigned protect_against_glob;
+    unsigned globbing;
 
     p = strpbrk(str, qchars);
-    if (!p) {
+    if (!p)
         return str;
-    }
+
     q = p;
     r = str;
@@ -5018 +5564 @@
 
         if (flag & RMESCAPE_GROW) {
+            int strloc = str - (char *)stackblock();
             r = makestrspace(fulllen, expdest);
+            /* p and str may be invalidated by makestrspace */
+            str = (char *)stackblock() + strloc;
+            p = str + len;
         } else if (flag & RMESCAPE_HEAP) {
             r = ckmalloc(fulllen);
@@ -5026 +5576 @@
         q = r;
         if (len > 0) {
-            q = memcpy(q, str, len) + len;
-        }
-    }
+            q = (char *)memcpy(q, str, len) + len;
+        }
+    }
+
     inquotes = (flag & RMESCAPE_QUOTED) ^ RMESCAPE_QUOTED;
     globbing = flag & RMESCAPE_GLOB;
-    notescaped = globbing;
+    protect_against_glob = globbing;
     while (*p) {
-        if (*p == CTLQUOTEMARK) {
+        if ((unsigned char)*p == CTLQUOTEMARK) {
+// TODO: if no RMESCAPE_QUOTED in flags, inquotes never becomes 0
+// (alternates between RMESCAPE_QUOTED and ~RMESCAPE_QUOTED). Is it ok?
+// Note: both inquotes and protect_against_glob only affect whether
+// CTLESC,<ch> gets converted to <ch> or to \<ch>
             inquotes = ~inquotes;
             p++;
-            notescaped = globbing;
+            protect_against_glob = globbing;
             continue;
         }
         if (*p == '\\') {
             /* naked back slash */
-            notescaped = 0;
+            protect_against_glob = 0;
             goto copy;
         }
-        if (*p == CTLESC) {
+        if ((unsigned char)*p == CTLESC) {
             p++;
-            if (notescaped && inquotes && *p != '/') {
+            if (protect_against_glob && inquotes && *p != '/') {
                 *q++ = '\\';
             }
         }
-        notescaped = globbing;
+        protect_against_glob = globbing;
  copy:
         *q++ = *p++;
@@ -5061 +5616 @@
     return r;
 }
-#define rmescapes(p) _rmescapes((p), 0)
-
 #define pmatch(a, b) !fnmatch((a), (b), 0)
 
@@ -5077 +5630 @@
         flag |= RMESCAPE_QUOTED;
     }
-    return _rmescapes((char *)pattern, flag);
+    return rmescapes((char *)pattern, flag);
 }
 
@@ -5088 +5641 @@
     char *q = expdest;
 
-    q = makestrspace(len * 2, q);
+    q = makestrspace(quotes ? len * 2 : len, q);
 
     while (len--) {
-        int c = signed_char2int(*p++);
-        if (!c)
+        unsigned char c = *p++;
+        if (c == '\0')
             continue;
-        if (quotes && (SIT(c, syntax) == CCTL || SIT(c, syntax) == CBACK))
-            USTPUTC(CTLESC, q);
+        if (quotes) {
+            int n = SIT(c, syntax);
+            if (n == CCTL || n == CBACK)
+                USTPUTC(CTLESC, q);
+        }
         USTPUTC(c, q);
     }
@@ -5121 +5677 @@
     } else {
         INT_OFF;
-        ifsp = ckmalloc(sizeof(*ifsp));
-        ifsp->next = NULL;
+        ifsp = ckzalloc(sizeof(*ifsp));
+        /*ifsp->next = NULL; - ckzalloc did it */
         ifslastp->next = ifsp;
         INT_ON;
@@ -5139 +5695 @@
 
     if (ifsfirst.endoff > endoff) {
-        while (ifsfirst.next != NULL) {
+        while (ifsfirst.next) {
             struct ifsregion *ifsp;
             INT_OFF;
@@ -5147 +5703 @@
             INT_ON;
         }
-        if (ifsfirst.begoff > endoff)
+        if (ifsfirst.begoff > endoff) {
             ifslastp = NULL;
-        else {
+        } else {
             ifslastp = &ifsfirst;
             ifsfirst.endoff = endoff;
@@ -5158 +5714 @@
     ifslastp = &ifsfirst;
     while (ifslastp->next && ifslastp->next->begoff < endoff)
-        ifslastp=ifslastp->next;
-    while (ifslastp->next != NULL) {
+        ifslastp = ifslastp->next;
+    while (ifslastp->next) {
         struct ifsregion *ifsp;
         INT_OFF;
@@ -5172 +5728 @@
 
 static char *
-exptilde(char *startp, char *p, int flag)
-{
-    char c;
+exptilde(char *startp, char *p, int flags)
+{
+    unsigned char c;
     char *name;
     struct passwd *pw;
     const char *home;
-    int quotes = flag & (EXP_FULL | EXP_CASE);
+    int quotes = flags & (EXP_FULL | EXP_CASE | EXP_REDIR);
     int startloc;
 
@@ -5190 +5746 @@
             return startp;
         case ':':
-            if (flag & EXP_VARTILDE)
+            if (flags & EXP_VARTILDE)
                 goto done;
             break;
@@ -5201 +5757 @@
     *p = '\0';
     if (*name == '\0') {
-        home = lookupvar(homestr);
+        home = lookupvar("HOME");
     } else {
         pw = getpwnam(name);
@@ -5228 +5784 @@
 struct backcmd {                /* result of evalbackcmd */
     int fd;                 /* file descriptor to read from */
+    int nleft;              /* number of chars in buffer */
     char *buf;              /* buffer */
-    int nleft;              /* number of chars in buffer */
     struct job *jp;         /* job structure for command */
 };
 
 /* These forward decls are needed to use "eval" code for backticks handling: */
-static int back_exitstatus; /* exit status of backquoted command */
+static uint8_t back_exitstatus; /* exit status of backquoted command */
 #define EV_EXIT 01              /* exit after evaluating tree */
 static void evaltree(union node *, int);
 
-static void
+static void FAST_FUNC
 evalbackcmd(union node *n, struct backcmd *result)
 {
@@ -5247 +5803 @@
     result->nleft = 0;
     result->jp = NULL;
-    if (n == NULL) {
+    if (n == NULL)
         goto out;
-    }
 
     saveherefd = herefd;
@@ -5260 +5815 @@
         if (pipe(pip) < 0)
             ash_msg_and_raise_error("pipe call failed");
-        jp = makejob(n, 1);
+        jp = makejob(/*n,*/ 1);
         if (forkshell(jp, n, FORK_NOJOB) == 0) {
             FORCE_INT_ON;
             close(pip[0]);
             if (pip[1] != 1) {
-                close(1);
-                copyfd(pip[1], 1);
+                /*close(1);*/
+                copyfd(pip[1], 1 | COPYFD_EXACT);
                 close(pip[1]);
             }
@@ -5295 +5850 @@
     char *dest;
     int startloc;
-    int syntax = quoted? DQSYNTAX : BASESYNTAX;
+    int syntax = quoted ? DQSYNTAX : BASESYNTAX;
     struct stackmark smark;
 
@@ -5315 +5870 @@
         if (in.fd < 0)
             break;
-        i = safe_read(in.fd, buf, sizeof(buf));
+        i = nonblock_safe_read(in.fd, buf, sizeof(buf));
         TRACE(("expbackq: read returns %d\n", i));
         if (i <= 0)
@@ -5322 +5877 @@
     }
 
-    if (in.buf)
-        free(in.buf);
+    free(in.buf);
     if (in.fd >= 0) {
         close(in.fd);
@@ -5338 +5892 @@
     if (quoted == 0)
         recordregion(startloc, dest - (char *)stackblock(), 0);
-    TRACE(("evalbackq: size=%d: \"%.*s\"\n",
-        (dest - (char *)stackblock()) - startloc,
-        (dest - (char *)stackblock()) - startloc,
+    TRACE(("evalbackq: size:%d:'%.*s'\n",
+        (int)((dest - (char *)stackblock()) - startloc),
+        (int)((dest - (char *)stackblock()) - startloc),
         stackblock() + startloc));
 }
 
-#if ENABLE_ASH_MATH_SUPPORT
+#if ENABLE_SH_MATH_SUPPORT
 /*
  * Expand arithmetic expression.  Backup to start of expression,
@@ -5357 +5911 @@
     int len;
 
-    /*      ifsfree(); */
+    /* ifsfree(); */
 
     /*
@@ -5371 +5925 @@
         int esc;
 
-        while (*p != CTLARI) {
+        while ((unsigned char)*p != CTLARI) {
             p--;
 #if DEBUG
@@ -5397 +5951 @@
 
     if (quotes)
-        rmescapes(p + 2);
-
-    len = cvtnum(dash_arith(p + 2));
+        rmescapes(p + 2, 0);
+
+    len = cvtnum(ash_arith(p + 2));
 
     if (flag != '"')
@@ -5407 +5961 @@
 
 /* argstr needs it */
-static char *evalvar(char *p, int flag);
+static char *evalvar(char *p, int flags, struct strlist *var_str_list);
 
 /*
@@ -5413 +5967 @@
  * characters to allow for further processing.  Otherwise treat
  * $@ like $* since no splitting will be performed.
+ *
+ * var_str_list (can be NULL) is a list of "VAR=val" strings which take precedence
+ * over shell varables. Needed for "A=a B=$A; echo $B" case - we use it
+ * for correct expansion of "B=$A" word.
  */
 static void
-argstr(char *p, int flag)
+argstr(char *p, int flags, struct strlist *var_str_list)
 {
     static const char spclchars[] ALIGN1 = {
@@ -5426 +5984 @@
         CTLBACKQ,
         CTLBACKQ | CTLQUOTE,
-#if ENABLE_ASH_MATH_SUPPORT
+#if ENABLE_SH_MATH_SUPPORT
         CTLENDARI,
 #endif
-        0
+        '\0'
     };
     const char *reject = spclchars;
-    int c;
-    int quotes = flag & (EXP_FULL | EXP_CASE);      /* do CTLESC */
-    int breakall = flag & EXP_WORD;
+    int quotes = flags & (EXP_FULL | EXP_CASE | EXP_REDIR); /* do CTLESC */
+    int breakall = flags & EXP_WORD;
     int inquotes;
     size_t length;
     int startloc;
 
-    if (!(flag & EXP_VARTILDE)) {
+    if (!(flags & EXP_VARTILDE)) {
         reject += 2;
-    } else if (flag & EXP_VARTILDE2) {
+    } else if (flags & EXP_VARTILDE2) {
         reject++;
     }
     inquotes = 0;
     length = 0;
-    if (flag & EXP_TILDE) {
+    if (flags & EXP_TILDE) {
         char *q;
 
-        flag &= ~EXP_TILDE;
+        flags &= ~EXP_TILDE;
  tilde:
         q = p;
-        if (*q == CTLESC && (flag & EXP_QWORD))
+        if ((unsigned char)*q == CTLESC && (flags & EXP_QWORD))
             q++;
         if (*q == '~')
-            p = exptilde(p, q, flag);
+            p = exptilde(p, q, flags);
     }
  start:
     startloc = expdest - (char *)stackblock();
     for (;;) {
+        unsigned char c;
+
         length += strcspn(p + length, reject);
         c = p[length];
-        if (c && (!(c & 0x80)
-#if ENABLE_ASH_MATH_SUPPORT
-                    || c == CTLENDARI
-#endif
-           )) {
-            /* c == '=' || c == ':' || c == CTLENDARI */
-            length++;
+        if (c) {
+            if (!(c & 0x80)
+            IF_SH_MATH_SUPPORT(|| c == CTLENDARI)
+            ) {
+                /* c == '=' || c == ':' || c == CTLENDARI */
+                length++;
+            }
         }
         if (length > 0) {
@@ -5486 +6045 @@
             goto breakloop;
         case '=':
-            if (flag & EXP_VARTILDE2) {
+            if (flags & EXP_VARTILDE2) {
                 p--;
                 continue;
             }
-            flag |= EXP_VARTILDE2;
+            flags |= EXP_VARTILDE2;
             reject++;
             /* fall through */
@@ -5509 +6068 @@
         case CTLQUOTEMARK:
             /* "$@" syntax adherence hack */
-            if (
-                !inquotes &&
-                !memcmp(p, dolatstr, 4) &&
-                (p[4] == CTLQUOTEMARK || (
-                    p[4] == CTLENDVAR &&
-                    p[5] == CTLQUOTEMARK
-                ))
+            if (!inquotes
+             && memcmp(p, dolatstr, 4) == 0
+             && (  p[4] == (char)CTLQUOTEMARK
+                || (p[4] == (char)CTLENDVAR && p[5] == (char)CTLQUOTEMARK)
+                )
             ) {
-                p = evalvar(p + 1, flag) + 1;
+                p = evalvar(p + 1, flags, /* var_str_list: */ NULL) + 1;
                 goto start;
             }
@@ -5533 +6090 @@
             goto addquote;
         case CTLVAR:
-            p = evalvar(p, flag);
+            p = evalvar(p, flags, var_str_list);
             goto start;
         case CTLBACKQ:
-            c = 0;
+            c = '\0';
         case CTLBACKQ|CTLQUOTE:
             expbackq(argbackq->n, c, quotes);
             argbackq = argbackq->next;
             goto start;
-#if ENABLE_ASH_MATH_SUPPORT
+#if ENABLE_SH_MATH_SUPPORT
         case CTLENDARI:
             p--;
@@ -5549 +6106 @@
         }
     }
- breakloop:
-    ;
+ breakloop: ;
 }
 
 static char *
-scanleft(char *startp, char *rmesc, char *rmescend, char *str, int quotes,
-    int zero)
-{
-    char *loc;
-    char *loc2;
+scanleft(char *startp, char *rmesc, char *rmescend UNUSED_PARAM,
+        char *pattern, int quotes, int zero)
+{
+    char *loc, *loc2;
     char c;
 
@@ -5566 +6121 @@
         int match;
         const char *s = loc2;
+
         c = *loc2;
         if (zero) {
@@ -5571 +6127 @@
             s = rmesc;
         }
-        match = pmatch(str, s);
+        match = pmatch(pattern, s);
+
         *loc2 = c;
         if (match)
             return loc;
-        if (quotes && *loc == CTLESC)
+        if (quotes && (unsigned char)*loc == CTLESC)
             loc++;
         loc++;
         loc2++;
     } while (c);
-    return 0;
+    return NULL;
 }
 
 static char *
-scanright(char *startp, char *rmesc, char *rmescend, char *str, int quotes,
-    int zero)
-{
+scanright(char *startp, char *rmesc, char *rmescend,
+        char *pattern, int quotes, int match_at_start)
+{
+#if !ENABLE_ASH_OPTIMIZE_FOR_SIZE
+    int try2optimize = match_at_start;
+#endif
     int esc = 0;
     char *loc;
     char *loc2;
 
-    for (loc = str - 1, loc2 = rmescend; loc >= startp; loc2--) {
+    /* If we called by "${v/pattern/repl}" or "${v//pattern/repl}":
+     * startp="escaped_value_of_v" rmesc="raw_value_of_v"
+     * rmescend=""(ptr to NUL in rmesc) pattern="pattern" quotes=match_at_start=1
+     * Logic:
+     * loc starts at NUL at the end of startp, loc2 starts at the end of rmesc,
+     * and on each iteration they go back two/one char until they reach the beginning.
+     * We try to find a match in "raw_value_of_v", "raw_value_of_", "raw_value_of" etc.
+     */
+    /* TODO: document in what other circumstances we are called. */
+
+    for (loc = pattern - 1, loc2 = rmescend; loc >= startp; loc2--) {
         int match;
         char c = *loc2;
         const char *s = loc2;
-        if (zero) {
+        if (match_at_start) {
             *loc2 = '\0';
             s = rmesc;
         }
-        match = pmatch(str, s);
+        match = pmatch(pattern, s);
+        //bb_error_msg("pmatch(pattern:'%s',s:'%s'):%d", pattern, s, match);
         *loc2 = c;
         if (match)
             return loc;
+#if !ENABLE_ASH_OPTIMIZE_FOR_SIZE
+        if (try2optimize) {
+            /* Maybe we can optimize this:
+             * if pattern ends with unescaped *, we can avoid checking
+             * shorter strings: if "foo*" doesnt match "raw_value_of_v",
+             * it wont match truncated "raw_value_of_" strings too.
+             */
+            unsigned plen = strlen(pattern);
+            /* Does it end with "*"? */
+            if (plen != 0 && pattern[--plen] == '*') {
+                /* "xxxx*" is not escaped */
+                /* "xxx\*" is escaped */
+                /* "xx\\*" is not escaped */
+                /* "x\\\*" is escaped */
+                int slashes = 0;
+                while (plen != 0 && pattern[--plen] == '\\')
+                    slashes++;
+                if (!(slashes & 1))
+                    break; /* ends with unescaped "*" */
+            }
+            try2optimize = 0;
+        }
+#endif
         loc--;
         if (quotes) {
@@ -5614 +6208 @@
         }
     }
-    return 0;
-}
-
-static void varunset(const char *, const char *, const char *, int) ATTRIBUTE_NORETURN;
+    return NULL;
+}
+
+static void varunset(const char *, const char *, const char *, int) NORETURN;
 static void
 varunset(const char *end, const char *var, const char *umsg, int varflags)
@@ -5627 +6221 @@
     msg = "parameter not set";
     if (umsg) {
-        if (*end == CTLENDVAR) {
+        if ((unsigned char)*end == CTLENDVAR) {
             if (varflags & VSNUL)
                 tail = " or null";
-        } else
+        } else {
             msg = umsg;
-    }
-    ash_msg_and_raise_error("%.*s: %s%s", end - var - 1, var, msg, tail);
-}
+        }
+    }
+    ash_msg_and_raise_error("%.*s: %s%s", (int)(end - var - 1), var, msg, tail);
+}
+
+#if ENABLE_ASH_BASH_COMPAT
+static char *
+parse_sub_pattern(char *arg, int varflags)
+{
+    char *idx, *repl = NULL;
+    unsigned char c;
+
+    //char *org_arg = arg;
+    //bb_error_msg("arg:'%s' varflags:%x", arg, varflags);
+    idx = arg;
+    while (1) {
+        c = *arg;
+        if (!c)
+            break;
+        if (c == '/') {
+            /* Only the first '/' seen is our separator */
+            if (!repl) {
+                repl = idx + 1;
+                c = '\0';
+            }
+        }
+        *idx++ = c;
+        arg++;
+        /*
+         * Example: v='ab\c'; echo ${v/\\b/_\\_\z_}
+         * The result is a_\_z_c (not a\_\_z_c)!
+         *
+         * Enable debug prints in this function and you'll see:
+         * ash: arg:'\\b/_\\_z_' varflags:d
+         * ash: pattern:'\\b' repl:'_\_z_'
+         * That is, \\b is interpreted as \\b, but \\_ as \_!
+         * IOW: search pattern and replace string treat backslashes
+         * differently! That is the reason why we check repl below:
+         */
+        if (c == '\\' && *arg == '\\' && repl && !(varflags & VSQUOTE))
+            arg++; /* skip both '\', not just first one */
+    }
+    *idx = c; /* NUL */
+    //bb_error_msg("pattern:'%s' repl:'%s'", org_arg, repl);
+
+    return repl;
+}
+#endif /* ENABLE_ASH_BASH_COMPAT */
 
 static const char *
-subevalvar(char *p, char *str, int strloc, int subtype, int startloc, int varflags, int quotes)
-{
+subevalvar(char *p, char *varname, int strloc, int subtype,
+        int startloc, int varflags, int quotes, struct strlist *var_str_list)
+{
+    struct nodelist *saveargbackq = argbackq;
     char *startp;
     char *loc;
+    char *rmesc, *rmescend;
+    char *str;
+    IF_ASH_BASH_COMPAT(const char *repl = NULL;)
+    IF_ASH_BASH_COMPAT(int pos, len, orig_len;)
     int saveherefd = herefd;
-    struct nodelist *saveargbackq = argbackq;
-    int amount;
-    char *rmesc, *rmescend;
+    int amount, workloc, resetloc;
     int zero;
-    char *(*scan)(char *, char *, char *, char *, int , int);
+    char *(*scan)(char*, char*, char*, char*, int, int);
+
+    //bb_error_msg("subevalvar(p:'%s',varname:'%s',strloc:%d,subtype:%d,startloc:%d,varflags:%x,quotes:%d)",
+    //      p, varname, strloc, subtype, startloc, varflags, quotes);
 
     herefd = -1;
-    argstr(p, subtype != VSASSIGN && subtype != VSQUESTION ? EXP_CASE : 0);
+    argstr(p, (subtype != VSASSIGN && subtype != VSQUESTION) ? EXP_CASE : 0,
+            var_str_list);
     STPUTC('\0', expdest);
     herefd = saveherefd;
     argbackq = saveargbackq;
-    startp = stackblock() + startloc;
+    startp = (char *)stackblock() + startloc;
 
     switch (subtype) {
     case VSASSIGN:
-        setvar(str, startp, 0);
+        setvar(varname, startp, 0);
         amount = startp - expdest;
         STADJUST(amount, expdest);
@@ -5663 +6310 @@
 
     case VSQUESTION:
-        varunset(p, str, startp, varflags);
+        varunset(p, varname, startp, varflags);
         /* NOTREACHED */
-    }
+
+#if ENABLE_ASH_BASH_COMPAT
+    case VSSUBSTR:
+        loc = str = stackblock() + strloc;
+        /* Read POS in ${var:POS:LEN} */
+        pos = atoi(loc); /* number(loc) errors out on "1:4" */
+        len = str - startp - 1;
+
+        /* *loc != '\0', guaranteed by parser */
+        if (quotes) {
+            char *ptr;
+
+            /* Adjust the length by the number of escapes */
+            for (ptr = startp; ptr < (str - 1); ptr++) {
+                if ((unsigned char)*ptr == CTLESC) {
+                    len--;
+                    ptr++;
+                }
+            }
+        }
+        orig_len = len;
+
+        if (*loc++ == ':') {
+            /* ${var::LEN} */
+            len = number(loc);
+        } else {
+            /* Skip POS in ${var:POS:LEN} */
+            len = orig_len;
+            while (*loc && *loc != ':') {
+                /* TODO?
+                 * bash complains on: var=qwe; echo ${var:1a:123}
+                if (!isdigit(*loc))
+                    ash_msg_and_raise_error(msg_illnum, str);
+                 */
+                loc++;
+            }
+            if (*loc++ == ':') {
+                len = number(loc);
+            }
+        }
+        if (pos >= orig_len) {
+            pos = 0;
+            len = 0;
+        }
+        if (len > (orig_len - pos))
+            len = orig_len - pos;
+
+        for (str = startp; pos; str++, pos--) {
+            if (quotes && (unsigned char)*str == CTLESC)
+                str++;
+        }
+        for (loc = startp; len; len--) {
+            if (quotes && (unsigned char)*str == CTLESC)
+                *loc++ = *str++;
+            *loc++ = *str++;
+        }
+        *loc = '\0';
+        amount = loc - expdest;
+        STADJUST(amount, expdest);
+        return loc;
+#endif
+    }
+
+    resetloc = expdest - (char *)stackblock();
+
+    /* We'll comeback here if we grow the stack while handling
+     * a VSREPLACE or VSREPLACEALL, since our pointers into the
+     * stack will need rebasing, and we'll need to remove our work
+     * areas each time
+     */
+ IF_ASH_BASH_COMPAT(restart:)
+
+    amount = expdest - ((char *)stackblock() + resetloc);
+    STADJUST(-amount, expdest);
+    startp = (char *)stackblock() + startloc;
+
+    rmesc = startp;
+    rmescend = (char *)stackblock() + strloc;
+    if (quotes) {
+        rmesc = rmescapes(startp, RMESCAPE_ALLOC | RMESCAPE_GROW);
+        if (rmesc != startp) {
+            rmescend = expdest;
+            startp = (char *)stackblock() + startloc;
+        }
+    }
+    rmescend--;
+    str = (char *)stackblock() + strloc;
+    preglob(str, varflags & VSQUOTE, 0);
+    workloc = expdest - (char *)stackblock();
+
+#if ENABLE_ASH_BASH_COMPAT
+    if (subtype == VSREPLACE || subtype == VSREPLACEALL) {
+        char *idx, *end;
+
+        if (!repl) {
+            repl = parse_sub_pattern(str, varflags);
+            //bb_error_msg("repl:'%s'", repl);
+            if (!repl)
+                repl = nullstr;
+        }
+
+        /* If there's no pattern to match, return the expansion unmolested */
+        if (str[0] == '\0')
+            return NULL;
+
+        len = 0;
+        idx = startp;
+        end = str - 1;
+        while (idx < end) {
+ try_to_match:
+            loc = scanright(idx, rmesc, rmescend, str, quotes, 1);
+            //bb_error_msg("scanright('%s'):'%s'", str, loc);
+            if (!loc) {
+                /* No match, advance */
+                char *restart_detect = stackblock();
+ skip_matching:
+                STPUTC(*idx, expdest);
+                if (quotes && (unsigned char)*idx == CTLESC) {
+                    idx++;
+                    len++;
+                    STPUTC(*idx, expdest);
+                }
+                if (stackblock() != restart_detect)
+                    goto restart;
+                idx++;
+                len++;
+                rmesc++;
+                /* continue; - prone to quadratic behavior, smarter code: */
+                if (idx >= end)
+                    break;
+                if (str[0] == '*') {
+                    /* Pattern is "*foo". If "*foo" does not match "long_string",
+                     * it would never match "ong_string" etc, no point in trying.
+                     */
+                    goto skip_matching;
+                }
+                goto try_to_match;
+            }
+
+            if (subtype == VSREPLACEALL) {
+                while (idx < loc) {
+                    if (quotes && (unsigned char)*idx == CTLESC)
+                        idx++;
+                    idx++;
+                    rmesc++;
+                }
+            } else {
+                idx = loc;
+            }
+
+            //bb_error_msg("repl:'%s'", repl);
+            for (loc = (char*)repl; *loc; loc++) {
+                char *restart_detect = stackblock();
+                if (quotes && *loc == '\\') {
+                    STPUTC(CTLESC, expdest);
+                    len++;
+                }
+                STPUTC(*loc, expdest);
+                if (stackblock() != restart_detect)
+                    goto restart;
+                len++;
+            }
+
+            if (subtype == VSREPLACE) {
+                //bb_error_msg("tail:'%s', quotes:%x", idx, quotes);
+                while (*idx) {
+                    char *restart_detect = stackblock();
+                    STPUTC(*idx, expdest);
+                    if (stackblock() != restart_detect)
+                        goto restart;
+                    len++;
+                    idx++;
+                }
+                break;
+            }
+        }
+
+        /* We've put the replaced text into a buffer at workloc, now
+         * move it to the right place and adjust the stack.
+         */
+        STPUTC('\0', expdest);
+        startp = (char *)stackblock() + startloc;
+        memmove(startp, (char *)stackblock() + workloc, len + 1);
+        //bb_error_msg("startp:'%s'", startp);
+        amount = expdest - (startp + len);
+        STADJUST(-amount, expdest);
+        return startp;
+    }
+#endif /* ENABLE_ASH_BASH_COMPAT */
 
     subtype -= VSTRIMRIGHT;
 #if DEBUG
-    if (subtype < 0 || subtype > 3)
+    if (subtype < 0 || subtype > 7)
         abort();
 #endif
-
-    rmesc = startp;
-    rmescend = stackblock() + strloc;
-    if (quotes) {
-        rmesc = _rmescapes(startp, RMESCAPE_ALLOC | RMESCAPE_GROW);
-        if (rmesc != startp) {
-            rmescend = expdest;
-            startp = stackblock() + startloc;
-        }
-    }
-    rmescend--;
-    str = stackblock() + strloc;
-    preglob(str, varflags & VSQUOTE, 0);
-
-    /* zero = subtype == VSTRIMLEFT || subtype == VSTRIMLEFTMAX */
+    /* zero = (subtype == VSTRIMLEFT || subtype == VSTRIMLEFTMAX) */
     zero = subtype >> 1;
     /* VSTRIMLEFT/VSTRIMRIGHTMAX -> scanleft */
@@ -5706 +6527 @@
 /*
  * Add the value of a specialized variable to the stack string.
- */
-static ssize_t
-varvalue(char *name, int varflags, int flags)
-{
+ * name parameter (examples):
+ * ash -c 'echo $1'      name:'1='
+ * ash -c 'echo $qwe'    name:'qwe='
+ * ash -c 'echo $$'      name:'$='
+ * ash -c 'echo ${$}'    name:'$='
+ * ash -c 'echo ${$##q}' name:'$=q'
+ * ash -c 'echo ${#$}'   name:'$='
+ * note: examples with bad shell syntax:
+ * ash -c 'echo ${#$1}'  name:'$=1'
+ * ash -c 'echo ${#1#}'  name:'1=#'
+ */
+static NOINLINE ssize_t
+varvalue(char *name, int varflags, int flags, struct strlist *var_str_list)
+{
+    const char *p;
     int num;
-    char *p;
     int i;
-    int sep = 0;
     int sepq = 0;
     ssize_t len = 0;
-    char **ap;
-    int syntax;
+    int subtype = varflags & VSTYPE;
+    int quotes = flags & (EXP_FULL | EXP_CASE | EXP_REDIR);
     int quoted = varflags & VSQUOTE;
-    int subtype = varflags & VSTYPE;
-    int quotes = flags & (EXP_FULL | EXP_CASE);
-
-    if (quoted && (flags & EXP_FULL))
-        sep = 1 << CHAR_BIT;
-
-    syntax = quoted ? DQSYNTAX : BASESYNTAX;
+    int syntax = quoted ? DQSYNTAX : BASESYNTAX;
+
     switch (*name) {
     case '$':
@@ -5742 +6567 @@
  numvar:
         len = cvtnum(num);
-        break;
+        goto check_1char_name;
     case '-':
-        p = makestrspace(NOPTS, expdest);
+        expdest = makestrspace(NOPTS, expdest);
         for (i = NOPTS - 1; i >= 0; i--) {
             if (optlist[i]) {
-                USTPUTC(optletters(i), p);
+                USTPUTC(optletters(i), expdest);
                 len++;
             }
         }
-        expdest = p;
+ check_1char_name:
+#if 0
+        /* handles cases similar to ${#$1} */
+        if (name[2] != '\0')
+            raise_error_syntax("bad substitution");
+#endif
         break;
-    case '@':
-        if (sep)
+    case '@': {
+        char **ap;
+        int sep;
+
+        if (quoted && (flags & EXP_FULL)) {
+            /* note: this is not meant as PEOF value */
+            sep = 1 << CHAR_BIT;
             goto param;
+        }
         /* fall through */
     case '*':
-        sep = ifsset() ? signed_char2int(ifsval()[0]) : ' ';
-        if (quotes && (SIT(sep, syntax) == CCTL || SIT(sep, syntax) == CBACK))
+        sep = ifsset() ? (unsigned char)(ifsval()[0]) : ' ';
+        i = SIT(sep, syntax);
+        if (quotes && (i == CCTL || i == CBACK))
             sepq = 1;
  param:
@@ -5765 +6602 @@
         if (!ap)
             return -1;
-        while ((p = *ap++)) {
+        while ((p = *ap++) != NULL) {
             size_t partlen;
 
@@ -5784 +6621 @@
                 if (sepq)
                     STPUTC(CTLESC, q);
+                /* note: may put NUL despite sep != 0
+                 * (see sep = 1 << CHAR_BIT above) */
                 STPUTC(sep, q);
                 expdest = q;
@@ -5789 +6628 @@
         }
         return len;
+    } /* case '@' and '*' */
     case '0':
     case '1':
@@ -5799 +6639 @@
     case '8':
     case '9':
-        num = atoi(name);
+        num = atoi(name); /* number(name) fails on ${N#str} etc */
         if (num < 0 || num > shellparam.nparam)
             return -1;
@@ -5805 +6645 @@
         goto value;
     default:
+        /* NB: name has form "VAR=..." */
+
+        /* "A=a B=$A" case: var_str_list is a list of "A=a" strings
+         * which should be considered before we check variables. */
+        if (var_str_list) {
+            unsigned name_len = (strchrnul(name, '=') - name) + 1;
+            p = NULL;
+            do {
+                char *str, *eq;
+                str = var_str_list->text;
+                eq = strchr(str, '=');
+                if (!eq) /* stop at first non-assignment */
+                    break;
+                eq++;
+                if (name_len == (unsigned)(eq - str)
+                 && strncmp(str, name, name_len) == 0
+                ) {
+                    p = eq;
+                    /* goto value; - WRONG! */
+                    /* think "A=1 A=2 B=$A" */
+                }
+                var_str_list = var_str_list->next;
+            } while (var_str_list);
+            if (p)
+                goto value;
+        }
         p = lookupvar(name);
  value:
@@ -5826 +6692 @@
  */
 static char *
-evalvar(char *p, int flag)
-{
-    int subtype;
-    int varflags;
+evalvar(char *p, int flags, struct strlist *var_str_list)
+{
+    char varflags;
+    char subtype;
+    char quoted;
+    char easy;
     char *var;
     int patloc;
-    int c;
     int startloc;
     ssize_t varlen;
-    int easy;
-    int quotes;
-    int quoted;
-
-    quotes = flag & (EXP_FULL | EXP_CASE);
-    varflags = *p++;
+
+    varflags = (unsigned char) *p++;
     subtype = varflags & VSTYPE;
     quoted = varflags & VSQUOTE;
@@ -5846 +6709 @@
     easy = (!quoted || (*var == '@' && shellparam.nparam));
     startloc = expdest - (char *)stackblock();
-    p = strchr(p, '=') + 1;
+    p = strchr(p, '=') + 1; //TODO: use var_end(p)?
 
  again:
-    varlen = varvalue(var, varflags, flag);
+    varlen = varvalue(var, varflags, flags, var_str_list);
     if (varflags & VSNUL)
         varlen--;
@@ -5862 +6725 @@
         if (varlen < 0) {
             argstr(
-                p, flag | EXP_TILDE |
-                    (quoted ?  EXP_QWORD : EXP_WORD)
+                p,
+                flags | (quoted ? EXP_TILDE|EXP_QWORD : EXP_TILDE|EXP_WORD),
+                var_str_list
             );
             goto end;
@@ -5874 +6738 @@
     if (subtype == VSASSIGN || subtype == VSQUESTION) {
         if (varlen < 0) {
-            if (subevalvar(p, var, 0, subtype, startloc, varflags, 0)) {
+            if (subevalvar(p, var, /* strloc: */ 0,
+                    subtype, startloc, varflags,
+                    /* quotes: */ 0,
+                    var_str_list)
+            ) {
                 varflags &= ~VSNUL;
                 /*
@@ -5899 +6767 @@
 
     if (subtype == VSNORMAL) {
-        if (!easy)
-            goto end;
- record:
-        recordregion(startloc, expdest - (char *)stackblock(), quoted);
+        if (easy)
+            goto record;
         goto end;
     }
@@ -5912 +6778 @@
     case VSTRIMRIGHT:
     case VSTRIMRIGHTMAX:
+#if ENABLE_ASH_BASH_COMPAT
+    case VSSUBSTR:
+    case VSREPLACE:
+    case VSREPLACEALL:
+#endif
         break;
     default:
@@ -5925 +6796 @@
         STPUTC('\0', expdest);
         patloc = expdest - (char *)stackblock();
-        if (subevalvar(p, NULL, patloc, subtype,
-                startloc, varflags, quotes) == 0) {
+        if (NULL == subevalvar(p, /* varname: */ NULL, patloc, subtype,
+                startloc, varflags,
+//TODO: | EXP_REDIR too? All other such places do it too
+                /* quotes: */ flags & (EXP_FULL | EXP_CASE),
+                var_str_list)
+        ) {
             int amount = expdest - (
                 (char *)stackblock() + patloc - 1
@@ -5934 +6809 @@
         /* Remove any recorded regions beyond start of variable */
         removerecordregions(startloc);
-        goto record;
+ record:
+        recordregion(startloc, expdest - (char *)stackblock(), quoted);
     }
 
@@ -5941 +6817 @@
         int nesting = 1;
         for (;;) {
-            c = *p++;
+            unsigned char c = *p++;
             if (c == CTLESC)
                 p++;
@@ -5989 +6865 @@
             while (p < string + ifsp->endoff) {
                 q = p;
-                if (*p == CTLESC)
+                if ((unsigned char)*p == CTLESC)
                     p++;
                 if (!strchr(ifs, *p)) {
@@ -6004 +6880 @@
                 }
                 *q = '\0';
-                sp = stalloc(sizeof(*sp));
+                sp = stzalloc(sizeof(*sp));
                 sp->text = start;
                 *arglist->lastp = sp;
@@ -6015 +6891 @@
                         }
                         q = p;
-                        if (*p == CTLESC)
+                        if ((unsigned char)*p == CTLESC)
                             p++;
-                        if (strchr(ifs, *p) == NULL ) {
+                        if (strchr(ifs, *p) == NULL) {
                             p = q;
                             break;
-                        } else if (strchr(defifs, *p) == NULL) {
+                        }
+                        if (strchr(defifs, *p) == NULL) {
                             if (ifsspc) {
                                 p++;
@@ -6044 +6921 @@
 
  add:
-    sp = stalloc(sizeof(*sp));
+    sp = stzalloc(sizeof(*sp));
     sp->text = start;
     *arglist->lastp = sp;
@@ -6076 +6953 @@
     struct strlist *sp;
 
-    sp = stalloc(sizeof(*sp));
+    sp = stzalloc(sizeof(*sp));
     sp->text = ststrdup(name);
     *exparg.lastp = sp;
@@ -6082 +6959 @@
 }
 
-static char *expdir;
-
 /*
  * Do metacharacter (i.e. *, ?, [...]) expansion.
  */
 static void
-expmeta(char *enddir, char *name)
+expmeta(char *expdir, char *enddir, char *name)
 {
     char *p;
@@ -6176 +7051 @@
     if (*p == '.')
         matchdot++;
-    while (! intpending && (dp = readdir(dirp)) != NULL) {
-        if (dp->d_name[0] == '.' && ! matchdot)
+    while (!pending_int && (dp = readdir(dirp)) != NULL) {
+        if (dp->d_name[0] == '.' && !matchdot)
             continue;
         if (pmatch(start, dp->d_name)) {
@@ -6187 +7062 @@
                     continue;
                 p[-1] = '/';
-                expmeta(p, endname);
+                expmeta(expdir, p, endname);
             }
         }
     }
     closedir(dirp);
-    if (! atend)
+    if (!atend)
         endname[-1] = '/';
 }
@@ -6208 +7083 @@
     half = len >> 1;
     p = list;
-    for (n = half; --n >= 0; ) {
+    for (n = half; --n >= 0;) {
         q = p;
         p = p->next;
@@ -6261 +7136 @@
 
 static void
-expandmeta(struct strlist *str, int flag)
+expandmeta(struct strlist *str /*, int flag*/)
 {
     static const char metachars[] ALIGN1 = {
@@ -6269 +7144 @@
 
     while (str) {
+        char *expdir;
         struct strlist **savelastp;
         struct strlist *sp;
@@ -6285 +7161 @@
             expdir = ckmalloc(i < 2048 ? 2048 : i); /* XXX */
         }
-
-        expmeta(expdir, p);
+        expmeta(expdir, expdir, p);
         free(expdir);
         if (p != str->text)
@@ -6297 +7172 @@
  nometa:
             *exparg.lastp = str;
-            rmescapes(str->text);
+            rmescapes(str->text, 0);
             exparg.lastp = &str->next;
         } else {
@@ -6326 +7201 @@
     ifsfirst.next = NULL;
     ifslastp = NULL;
-    argstr(arg->narg.text, flag);
+    argstr(arg->narg.text, flag,
+            /* var_str_list: */ arglist ? arglist->list : NULL);
     p = _STPUTC('\0', expdest);
     expdest = p - 1;
@@ -6341 +7217 @@
         *exparg.lastp = NULL;
         exparg.lastp = &exparg.list;
-        expandmeta(exparg.list, flag);
+        expandmeta(exparg.list /*, flag*/);
     } else {
         if (flag & EXP_REDIR) /*XXX - for now, just remove escapes */
-            rmescapes(p);
-        sp = stalloc(sizeof(*sp));
+            rmescapes(p, 0);
+        sp = stzalloc(sizeof(*sp));
         sp->text = p;
         *exparg.lastp = sp;
@@ -6392 +7268 @@
     STARTSTACKSTR(expdest);
     ifslastp = NULL;
-    argstr(pattern->narg.text, EXP_TILDE | EXP_CASE);
+    argstr(pattern->narg.text, EXP_TILDE | EXP_CASE,
+            /* var_str_list: */ NULL);
     STACKSTRNUL(expdest);
     result = patmatch(stackblock(), val);
@@ -6404 +7281 @@
 struct builtincmd {
     const char *name;
-    int (*builtin)(int, char **);
+    int (*builtin)(int, char **) FAST_FUNC;
     /* unsigned flags; */
 };
 #define IS_BUILTIN_SPECIAL(b) ((b)->name[0] & 1)
+/* "regular" builtins always take precedence over commands,
+ * regardless of PATH=....%builtin... position */
 #define IS_BUILTIN_REGULAR(b) ((b)->name[0] & 2)
-#define IS_BUILTIN_ASSIGN(b) ((b)->name[0] & 4)
+#define IS_BUILTIN_ASSIGN(b)  ((b)->name[0] & 4)
 
 struct cmdentry {
-    int cmdtype;
+    smallint cmdtype;       /* CMDxxx */
     union param {
         int index;
+        /* index >= 0 for commands without path (slashes) */
+        /* (TODO: what exactly does the value mean? PATH position?) */
+        /* index == -1 for commands with slashes */
+        /* index == (-2 - applet_no) for NOFORK applets */
         const struct builtincmd *cmd;
         struct funcnode *func;
@@ -6446 +7329 @@
  */
 
-#define CMDTABLESIZE 31         /* should be prime */
-#define ARB 1                   /* actual size determined at run time */
-
 struct tblentry {
     struct tblentry *next;  /* next entry in hash chain */
     union param param;      /* definition of builtin function */
-    short cmdtype;          /* index identifying command */
+    smallint cmdtype;       /* CMDxxx */
     char rehash;            /* if set, cd done since entry created */
-    char cmdname[ARB];      /* name of command */
+    char cmdname[1];        /* name of command */
 };
 
-static struct tblentry *cmdtable[CMDTABLESIZE];
-static int builtinloc = -1;             /* index in path of %builtin, or -1 */
+static struct tblentry **cmdtable;
+#define INIT_G_cmdtable() do { \
+    cmdtable = xzalloc(CMDTABLESIZE * sizeof(cmdtable[0])); \
+} while (0)
+
+static int builtinloc = -1;     /* index in path of %builtin, or -1 */
+
 
 static void
-tryexec(char *cmd, char **argv, char **envp)
+tryexec(IF_FEATURE_SH_STANDALONE(int applet_no,) char *cmd, char **argv, char **envp)
 {
     int repeated = 0;
 
 #if ENABLE_FEATURE_SH_STANDALONE
-    if (strchr(cmd, '/') == NULL) {
-        const struct bb_applet *a;
-
-        a = find_applet_by_name(cmd);
-        if (a) {
-            if (a->noexec) {
-                current_applet = a;
-                run_current_applet_and_exit(argv);
-            }
-            /* re-exec ourselves with the new arguments */
-            execve(bb_busybox_exec_path, argv, envp);
-            /* If they called chroot or otherwise made the binary no longer
-             * executable, fall through */
-        }
+    if (applet_no >= 0) {
+        if (APPLET_IS_NOEXEC(applet_no)) {
+            clearenv();
+            while (*envp)
+                putenv(*envp++);
+            run_applet_no_and_exit(applet_no, argv);
+        }
+        /* re-exec ourselves with the new arguments */
+        execve(bb_busybox_exec_path, argv, envp);
+        /* If they called chroot or otherwise made the binary no longer
+         * executable, fall through */
     }
 #endif
@@ -6491 +7373 @@
     execve(cmd, argv, envp);
 #endif
-    if (repeated++) {
+    if (repeated) {
         free(argv);
-    } else if (errno == ENOEXEC) {
+        return;
+    }
+    if (errno == ENOEXEC) {
         char **ap;
         char **new;
 
         for (ap = argv; *ap; ap++)
-            ;
-        ap = new = ckmalloc((ap - argv + 2) * sizeof(char *));
+            continue;
+        ap = new = ckmalloc((ap - argv + 2) * sizeof(ap[0]));
         ap[1] = cmd;
         ap[0] = cmd = (char *)DEFAULT_SHELL;
         ap += 2;
         argv++;
-        while ((*ap++ = *argv++))
-            ;
+        while ((*ap++ = *argv++) != NULL)
+            continue;
         argv = new;
+        repeated++;
         goto repeat;
     }
@@ -6515 +7400 @@
  * have to change the find_command routine as well.
  */
-#define environment() listvars(VEXPORT, VUNSET, 0)
-static void shellexec(char **, const char *, int) ATTRIBUTE_NORETURN;
+static void shellexec(char **, const char *, int) NORETURN;
 static void
 shellexec(char **argv, const char *path, int idx)
@@ -6524 +7408 @@
     char **envp;
     int exerrno;
-
-    clearredir(1);
-    envp = environment();
-    if (strchr(argv[0], '/')
 #if ENABLE_FEATURE_SH_STANDALONE
-     || find_applet_by_name(argv[0])
+    int applet_no = -1;
+#endif
+
+    clearredir(/*drop:*/ 1);
+    envp = listvars(VEXPORT, VUNSET, /*end:*/ NULL);
+    if (strchr(argv[0], '/') != NULL
+#if ENABLE_FEATURE_SH_STANDALONE
+     || (applet_no = find_applet_by_name(argv[0])) >= 0
 #endif
     ) {
-        tryexec(argv[0], argv, envp);
+        tryexec(IF_FEATURE_SH_STANDALONE(applet_no,) argv[0], argv, envp);
         e = errno;
     } else {
         e = ENOENT;
-        while ((cmdname = padvance(&path, argv[0])) != NULL) {
+        while ((cmdname = path_advance(&path, argv[0])) != NULL) {
             if (--idx < 0 && pathopt == NULL) {
-                tryexec(cmdname, argv, envp);
+                tryexec(IF_FEATURE_SH_STANDALONE(-1,) cmdname, argv, envp);
                 if (errno != ENOENT && errno != ENOTDIR)
                     e = errno;
@@ -6559 +7446 @@
     }
     exitstatus = exerrno;
-    TRACE(("shellexec failed for %s, errno %d, suppressint %d\n",
-        argv[0], e, suppressint ));
+    TRACE(("shellexec failed for %s, errno %d, suppress_int %d\n",
+        argv[0], e, suppress_int));
     ash_msg_and_raise(EXEXEC, "%s: %s", argv[0], errmsg(e, "not found"));
     /* NOTREACHED */
@@ -6575 +7462 @@
     path = pathval();
     do {
-        name = padvance(&path, cmdp->cmdname);
+        name = path_advance(&path, cmdp->cmdname);
         stunalloc(name);
     } while (--idx >= 0);
@@ -6642 +7529 @@
     }
     if (add && cmdp == NULL) {
-        cmdp = *pp = ckmalloc(sizeof(struct tblentry) - ARB
-                    + strlen(name) + 1);
-        cmdp->next = NULL;
+        cmdp = *pp = ckzalloc(sizeof(struct tblentry)
+                + strlen(name)
+                /* + 1 - already done because
+                 * tblentry::cmdname is char[1] */);
+        /*cmdp->next = NULL; - ckzalloc did it */
         cmdp->cmdtype = CMDUNKNOWN;
         strcpy(cmdp->cmdname, name);
@@ -6687 +7576 @@
 }
 
-static int
-hashcmd(int argc, char **argv)
+static int FAST_FUNC
+hashcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     struct tblentry **pp;
@@ -6696 +7585 @@
     char *name;
 
-    while ((c = nextopt("r")) != '\0') {
+    if (nextopt("r") != '\0') {
         clearcmdentry(0);
         return 0;
     }
+
     if (*argptr == NULL) {
         for (pp = cmdtable; pp < &cmdtable[CMDTABLESIZE]; pp++) {
@@ -6709 +7599 @@
         return 0;
     }
+
     c = 0;
     while ((name = *argptr) != NULL) {
@@ -6714 +7605 @@
         if (cmdp != NULL
          && (cmdp->cmdtype == CMDNORMAL
-             || (cmdp->cmdtype == CMDBUILTIN && builtinloc >= 0)))
+             || (cmdp->cmdtype == CMDBUILTIN && builtinloc >= 0))
+        ) {
             delete_cmd_entry();
+        }
         find_command(name, &entry, DO_ERR, pathval());
         if (entry.cmdtype == CMDUNKNOWN)
@@ -6736 +7629 @@
     for (pp = cmdtable; pp < &cmdtable[CMDTABLESIZE]; pp++) {
         for (cmdp = *pp; cmdp; cmdp = cmdp->next) {
-            if (cmdp->cmdtype == CMDNORMAL || (
-                cmdp->cmdtype == CMDBUILTIN &&
-                !(IS_BUILTIN_REGULAR(cmdp->param.cmd)) &&
-                builtinloc > 0
-            ))
+            if (cmdp->cmdtype == CMDNORMAL
+             || (cmdp->cmdtype == CMDBUILTIN
+                 && !IS_BUILTIN_REGULAR(cmdp->param.cmd)
+                 && builtinloc > 0)
+            ) {
                 cmdp->rehash = 1;
+            }
         }
     }
@@ -6752 +7646 @@
  * Called with interrupts off.
  */
-static void
-changepath(const char *newval)
-{
-    const char *old, *new;
+static void FAST_FUNC
+changepath(const char *new)
+{
+    const char *old;
+    int firstchange;
     int idx;
-    int firstchange;
     int idx_bltin;
 
     old = pathval();
-    new = newval;
     firstchange = 9999;     /* assume no change */
     idx = 0;
@@ -6769 +7662 @@
             firstchange = idx;
             if ((*old == '\0' && *new == ':')
-             || (*old == ':' && *new == '\0'))
+             || (*old == ':' && *new == '\0')
+            ) {
                 firstchange++;
+            }
             old = new;      /* ignore subsequent differences */
         }
@@ -6777 +7672 @@
         if (*new == '%' && idx_bltin < 0 && prefix(new + 1, "builtin"))
             idx_bltin = idx;
-        if (*new == ':') {
+        if (*new == ':')
             idx++;
-        }
-        new++, old++;
+        new++;
+        old++;
     }
     if (builtinloc < 0 && idx_bltin >= 0)
@@ -6819 +7714 @@
 #define TBEGIN 27
 #define TEND 28
+typedef smallint token_id_t;
 
 /* first char is indicating which tokens mark the end of a list */
@@ -6855 +7751 @@
 };
 
-static const char *
-tokname(int tok)
-{
-    static char buf[16];
-
-//try this:
-//if (tok < TSEMI) return tokname_array[tok] + 1;
-//sprintf(buf, "\"%s\"", tokname_array[tok] + 1);
-//return buf;
-
-    if (tok >= TSEMI)
-        buf[0] = '"';
-    sprintf(buf + (tok >= TSEMI), "%s%c",
-            tokname_array[tok] + 1, (tok >= TSEMI ? '"' : 0));
-    return buf;
-}
-
 /* Wrapper around strcmp for qsort/bsearch/... */
 static int
@@ -6937 +7816 @@
         int j = entry.u.index;
         char *p;
-        if (j == -1) {
+        if (j < 0) {
             p = command;
         } else {
             do {
-                p = padvance(&path, command);
+                p = path_advance(&path, command);
                 stunalloc(p);
             } while (--j >= 0);
@@ -6981 +7860 @@
     }
  out:
-    outstr("\n", stdout);
+    out1str("\n");
     return 0;
 }
 
-static int
-typecmd(int argc, char **argv)
+static int FAST_FUNC
+typecmd(int argc UNUSED_PARAM, char **argv)
 {
     int i = 1;
@@ -6997 +7876 @@
         verbose = 0;
     }
-    while (i < argc) {
+    while (argv[i]) {
         err |= describe_command(argv[i++], verbose);
     }
@@ -7004 +7883 @@
 
 #if ENABLE_ASH_CMDCMD
-static int
-commandcmd(int argc, char **argv)
+static int FAST_FUNC
+commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     int c;
@@ -7022 +7901 @@
             abort();
 #endif
-    if (verify)
+    /* Mimic bash: just "command -v" doesn't complain, it's a nop */
+    if (verify && (*argptr != NULL)) {
         return describe_command(*argptr, verify - VERIFY_BRIEF);
+    }
 
     return 0;
@@ -7032 +7913 @@
 /* ============ eval.c */
 
-static int funcblocksize;          /* size of structures in function */
-static int funcstringsize;         /* size of strings in node */
-static void *funcblock;            /* block to allocate function from */
-static char *funcstring;           /* block to allocate strings from */
+static int funcblocksize;       /* size of structures in function */
+static int funcstringsize;      /* size of strings in node */
+static void *funcblock;         /* block to allocate function from */
+static char *funcstring;        /* block to allocate strings from */
 
 /* flags in argument to evaltree */
-#define EV_EXIT 01              /* exit after evaluating tree */
-#define EV_TESTED 02            /* exit status is checked; ignore -e flag */
+#define EV_EXIT    01           /* exit after evaluating tree */
+#define EV_TESTED  02           /* exit status is checked; ignore -e flag */
 #define EV_BACKCMD 04           /* command executing within back quotes */
 
-static const short nodesize[26] = {
-    SHELL_ALIGN(sizeof(struct ncmd)),
-    SHELL_ALIGN(sizeof(struct npipe)),
-    SHELL_ALIGN(sizeof(struct nredir)),
-    SHELL_ALIGN(sizeof(struct nredir)),
-    SHELL_ALIGN(sizeof(struct nredir)),
-    SHELL_ALIGN(sizeof(struct nbinary)),
-    SHELL_ALIGN(sizeof(struct nbinary)),
-    SHELL_ALIGN(sizeof(struct nbinary)),
-    SHELL_ALIGN(sizeof(struct nif)),
-    SHELL_ALIGN(sizeof(struct nbinary)),
-    SHELL_ALIGN(sizeof(struct nbinary)),
-    SHELL_ALIGN(sizeof(struct nfor)),
-    SHELL_ALIGN(sizeof(struct ncase)),
-    SHELL_ALIGN(sizeof(struct nclist)),
-    SHELL_ALIGN(sizeof(struct narg)),
-    SHELL_ALIGN(sizeof(struct narg)),
-    SHELL_ALIGN(sizeof(struct nfile)),
-    SHELL_ALIGN(sizeof(struct nfile)),
-    SHELL_ALIGN(sizeof(struct nfile)),
-    SHELL_ALIGN(sizeof(struct nfile)),
-    SHELL_ALIGN(sizeof(struct nfile)),
-    SHELL_ALIGN(sizeof(struct ndup)),
-    SHELL_ALIGN(sizeof(struct ndup)),
-    SHELL_ALIGN(sizeof(struct nhere)),
-    SHELL_ALIGN(sizeof(struct nhere)),
-    SHELL_ALIGN(sizeof(struct nnot)),
+static const uint8_t nodesize[N_NUMBER] = {
+    [NCMD     ] = SHELL_ALIGN(sizeof(struct ncmd)),
+    [NPIPE    ] = SHELL_ALIGN(sizeof(struct npipe)),
+    [NREDIR   ] = SHELL_ALIGN(sizeof(struct nredir)),
+    [NBACKGND ] = SHELL_ALIGN(sizeof(struct nredir)),
+    [NSUBSHELL] = SHELL_ALIGN(sizeof(struct nredir)),
+    [NAND     ] = SHELL_ALIGN(sizeof(struct nbinary)),
+    [NOR      ] = SHELL_ALIGN(sizeof(struct nbinary)),
+    [NSEMI    ] = SHELL_ALIGN(sizeof(struct nbinary)),
+    [NIF      ] = SHELL_ALIGN(sizeof(struct nif)),
+    [NWHILE   ] = SHELL_ALIGN(sizeof(struct nbinary)),
+    [NUNTIL   ] = SHELL_ALIGN(sizeof(struct nbinary)),
+    [NFOR     ] = SHELL_ALIGN(sizeof(struct nfor)),
+    [NCASE    ] = SHELL_ALIGN(sizeof(struct ncase)),
+    [NCLIST   ] = SHELL_ALIGN(sizeof(struct nclist)),
+    [NDEFUN   ] = SHELL_ALIGN(sizeof(struct narg)),
+    [NARG     ] = SHELL_ALIGN(sizeof(struct narg)),
+    [NTO      ] = SHELL_ALIGN(sizeof(struct nfile)),
+#if ENABLE_ASH_BASH_COMPAT
+    [NTO2     ] = SHELL_ALIGN(sizeof(struct nfile)),
+#endif
+    [NCLOBBER ] = SHELL_ALIGN(sizeof(struct nfile)),
+    [NFROM    ] = SHELL_ALIGN(sizeof(struct nfile)),
+    [NFROMTO  ] = SHELL_ALIGN(sizeof(struct nfile)),
+    [NAPPEND  ] = SHELL_ALIGN(sizeof(struct nfile)),
+    [NTOFD    ] = SHELL_ALIGN(sizeof(struct ndup)),
+    [NFROMFD  ] = SHELL_ALIGN(sizeof(struct ndup)),
+    [NHERE    ] = SHELL_ALIGN(sizeof(struct nhere)),
+    [NXHERE   ] = SHELL_ALIGN(sizeof(struct nhere)),
+    [NNOT     ] = SHELL_ALIGN(sizeof(struct nnot)),
 };
 
@@ -7138 +8022 @@
         break;
     case NTO:
+#if ENABLE_ASH_BASH_COMPAT
+    case NTO2:
+#endif
     case NCLOBBER:
     case NFROM:
@@ -7209 +8096 @@
     case NPIPE:
         new->npipe.cmdlist = copynodelist(n->npipe.cmdlist);
-        new->npipe.backgnd = n->npipe.backgnd;
+        new->npipe.pipe_backgnd = n->npipe.pipe_backgnd;
         break;
     case NREDIR:
@@ -7251 +8138 @@
         break;
     case NTO:
+#if ENABLE_ASH_BASH_COMPAT
+    case NTO2:
+#endif
     case NCLOBBER:
     case NFROM:
@@ -7316 +8206 @@
 }
 
-static int evalskip;            /* set if we are skipping commands */
-/* reasons for skipping commands (see comment on breakcmd routine) */
+/* Reasons for skipping commands (see comment on breakcmd routine) */
 #define SKIPBREAK      (1 << 0)
 #define SKIPCONT       (1 << 1)
@@ -7323 +8212 @@
 #define SKIPFILE       (1 << 3)
 #define SKIPEVAL       (1 << 4)
+static smallint evalskip;       /* set to SKIPxxx if we are skipping commands */
 static int skipcount;           /* number of levels to skip */
 static int funcnest;            /* depth of function calls */
-
-/* forward decl way out to parsing code - dotrap needs it */
+static int loopnest;            /* current loop nesting level */
+
+/* Forward decl way out to parsing code - dotrap needs it */
 static int evalstring(char *s, int mask);
 
-/*
- * Called to execute a trap.  Perhaps we should avoid entering new trap
- * handlers while we are executing a trap handler.
+/* Called to execute a trap.
+ * Single callsite - at the end of evaltree().
+ * If we return non-zero, evaltree raises EXEXIT exception.
+ *
+ * Perhaps we should avoid entering new trap handlers
+ * while we are executing a trap handler. [is it a TODO?]
  */
 static int
 dotrap(void)
 {
-    char *p;
-    char *q;
-    int i;
-    int savestatus;
-    int skip = 0;
+    uint8_t *g;
+    int sig;
+    uint8_t savestatus;
 
     savestatus = exitstatus;
-    pendingsig = 0;
+    pending_sig = 0;
     xbarrier();
 
-    for (i = 0, q = gotsig; i < NSIG - 1; i++, q++) {
-        if (!*q)
+    TRACE(("dotrap entered\n"));
+    for (sig = 1, g = gotsig; sig < NSIG; sig++, g++) {
+        int want_exexit;
+        char *t;
+
+        if (*g == 0)
             continue;
-        *q = '\0';
-
-        p = trap[i + 1];
-        if (!p)
+        t = trap[sig];
+        /* non-trapped SIGINT is handled separately by raise_interrupt,
+         * don't upset it by resetting gotsig[SIGINT-1] */
+        if (sig == SIGINT && !t)
             continue;
-        skip = evalstring(p, SKIPEVAL);
+
+        TRACE(("sig %d is active, will run handler '%s'\n", sig, t));
+        *g = 0;
+        if (!t)
+            continue;
+        want_exexit = evalstring(t, SKIPEVAL);
         exitstatus = savestatus;
-        if (skip)
-            break;
-    }
-
-    return skip;
+        if (want_exexit) {
+            TRACE(("dotrap returns %d\n", want_exexit));
+            return want_exexit;
+        }
+    }
+
+    TRACE(("dotrap returns 0\n"));
+    return 0;
 }
 
@@ -7381 +8285 @@
 evaltree(union node *n, int flags)
 {
+    struct jmploc *volatile savehandler = exception_handler;
+    struct jmploc jmploc;
     int checkexit = 0;
     void (*evalfn)(union node *, int);
-    unsigned isor;
     int status;
+    int int_level;
+
+    SAVE_INT(int_level);
+
     if (n == NULL) {
         TRACE(("evaltree(NULL) called\n"));
-        goto out;
-    }
-    TRACE(("pid %d, evaltree(%p: %d, %d) called\n",
-            getpid(), n, n->type, flags));
+        goto out1;
+    }
+    TRACE(("evaltree(%p: %d, %d) called\n", n, n->type, flags));
+
+    exception_handler = &jmploc;
+    {
+        int err = setjmp(jmploc.loc);
+        if (err) {
+            /* if it was a signal, check for trap handlers */
+            if (exception_type == EXSIG) {
+                TRACE(("exception %d (EXSIG) in evaltree, err=%d\n",
+                        exception_type, err));
+                goto out;
+            }
+            /* continue on the way out */
+            TRACE(("exception %d in evaltree, propagating err=%d\n",
+                    exception_type, err));
+            exception_handler = savehandler;
+            longjmp(exception_handler->loc, err);
+        }
+    }
+
     switch (n->type) {
     default:
 #if DEBUG
         out1fmt("Node type = %d\n", n->type);
-        fflush(stdout);
+        fflush_all();
         break;
 #endif
@@ -7409 +8336 @@
             status = exitstatus;
         }
-        popredir(0);
+        popredir(/*drop:*/ 0, /*restore:*/ 0 /* not sure */);
         goto setstatus;
     case NCMD:
@@ -7436 +8363 @@
     case NAND:
     case NOR:
-    case NSEMI:
+    case NSEMI: {
+
 #if NAND + 1 != NOR
 #error NAND + 1 != NOR
@@ -7443 +8371 @@
 #error NOR + 1 != NSEMI
 #endif
-        isor = n->type - NAND;
+        unsigned is_or = n->type - NAND;
         evaltree(
             n->nbinary.ch1,
-            (flags | ((isor >> 1) - 1)) & EV_TESTED
+            (flags | ((is_or >> 1) - 1)) & EV_TESTED
         );
-        if (!exitstatus == isor)
+        if (!exitstatus == is_or)
             break;
         if (!evalskip) {
@@ -7459 +8387 @@
         }
         break;
+    }
     case NIF:
         evaltree(n->nif.test, EV_TESTED);
@@ -7466 +8395 @@
             n = n->nif.ifpart;
             goto evaln;
-        } else if (n->nif.elsepart) {
+        }
+        if (n->nif.elsepart) {
             n = n->nif.elsepart;
             goto evaln;
@@ -7479 +8409 @@
         break;
     }
+
  out:
-    if ((checkexit & exitstatus))
+    exception_handler = savehandler;
+
+ out1:
+    /* Order of checks below is important:
+     * signal handlers trigger before exit caused by "set -e".
+     */
+    if (pending_sig && dotrap())
+        goto exexit;
+    if (checkexit & exitstatus)
         evalskip |= SKIPEVAL;
-    else if (pendingsig && dotrap())
-        goto exexit;
 
     if (flags & EV_EXIT) {
@@ -7489 +8426 @@
         raise_exception(EXEXIT);
     }
+
+    RESTORE_INT(int_level);
+    TRACE(("leaving evaltree (no interrupts)\n"));
 }
 
@@ -7495 +8435 @@
 #endif
 void evaltreenr(union node *, int) __attribute__ ((alias("evaltree"),__noreturn__));
-
-static int loopnest;            /* current loop nesting level */
 
 static void
@@ -7543 +8481 @@
 
     setstackmark(&smark);
+    arglist.list = NULL;
     arglist.lastp = &arglist.list;
     for (argp = n->nfor.args; argp; argp = argp->narg.next) {
@@ -7582 +8521 @@
 
     setstackmark(&smark);
+    arglist.list = NULL;
     arglist.lastp = &arglist.list;
     expandarg(n->ncase.expr, &arglist, EXP_TILDE);
@@ -7610 +8550 @@
 
     expredir(n->nredir.redirect);
-    if (!backgnd && flags & EV_EXIT && !trap[0])
+    if (!backgnd && (flags & EV_EXIT) && !may_have_traps)
         goto nofork;
     INT_OFF;
-    jp = makejob(n, 1);
+    jp = makejob(/*n,*/ 1);
     if (forkshell(jp, n, backgnd) == 0) {
+        /* child */
         INT_ON;
         flags |= EV_EXIT;
         if (backgnd)
-            flags &=~ EV_TESTED;
+            flags &= ~EV_TESTED;
  nofork:
         redirect(n->nredir.redirect, 0);
@@ -7625 +8566 @@
     }
     status = 0;
-    if (! backgnd)
+    if (!backgnd)
         status = waitforjob(jp);
     exitstatus = status;
@@ -7643 +8584 @@
         struct arglist fn;
 
-        memset(&fn, 0, sizeof(fn));
+        fn.list = NULL;
         fn.lastp = &fn.list;
         switch (redir->type) {
@@ -7649 +8590 @@
         case NFROM:
         case NTO:
+#if ENABLE_ASH_BASH_COMPAT
+        case NTO2:
+#endif
         case NCLOBBER:
         case NAPPEND:
             expandarg(redir->nfile.fname, &fn, EXP_TILDE | EXP_REDIR);
+#if ENABLE_ASH_BASH_COMPAT
+ store_expfname:
+#endif
             redir->nfile.expfname = fn.list->text;
             break;
         case NFROMFD:
-        case NTOFD:
+        case NTOFD: /* >& */
             if (redir->ndup.vname) {
                 expandarg(redir->ndup.vname, &fn, EXP_FULL | EXP_TILDE);
                 if (fn.list == NULL)
                     ash_msg_and_raise_error("redir error");
+#if ENABLE_ASH_BASH_COMPAT
+//FIXME: we used expandarg with different args!
+                if (!isdigit_str9(fn.list->text)) {
+                    /* >&file, not >&fd */
+                    if (redir->nfile.fd != 1) /* 123>&file - BAD */
+                        ash_msg_and_raise_error("redir error");
+                    redir->type = NTO2;
+                    goto store_expfname;
+                }
+#endif
                 fixredir(redir, fn.list->text, 1);
             }
@@ -7688 +8645 @@
     flags |= EV_EXIT;
     INT_OFF;
-    jp = makejob(n, pipelen);
+    jp = makejob(/*n,*/ pipelen);
     prevfd = -1;
     for (lp = n->npipe.cmdlist; lp; lp = lp->next) {
@@ -7699 +8656 @@
             }
         }
-        if (forkshell(jp, lp->n, n->npipe.backgnd) == 0) {
+        if (forkshell(jp, lp->n, n->npipe.pipe_backgnd) == 0) {
             INT_ON;
             if (pip[1] >= 0) {
@@ -7718 +8675 @@
             close(prevfd);
         prevfd = pip[0];
-        close(pip[1]);
-    }
-    if (n->npipe.backgnd == 0) {
+        /* Don't want to trigger debugging */
+        if (pip[1] != -1)
+            close(pip[1]);
+    }
+    if (n->npipe.pipe_backgnd == 0) {
         exitstatus = waitforjob(jp);
         TRACE(("evalpipe:  job done exit status %d\n", exitstatus));
@@ -7733 +8692 @@
 setinteractive(int on)
 {
-    static int is_interactive;
+    static smallint is_interactive;
 
     if (++on == is_interactive)
@@ -7747 +8706 @@
 
         if (!did_banner) {
-            out1fmt(
-                "\n\n"
-                "%s built-in shell (ash)\n"
+            /* note: ash and hush share this string */
+            out1fmt("\n\n%s %s\n"
                 "Enter 'help' for a list of built-in commands."
                 "\n\n",
-                bb_banner);
+                bb_banner,
+                "built-in shell (ash)"
+            );
             did_banner = 1;
         }
@@ -7758 +8718 @@
 #endif
 }
-
-#if ENABLE_FEATURE_EDITING_VI
-#define setvimode(on) do { \
-    if (on) line_input_state->flags |= VI_MODE; \
-    else line_input_state->flags &= ~VI_MODE; \
-} while (0)
-#else
-#define setvimode(on) viflag = 0   /* forcibly keep the option off */
-#endif
 
 static void
@@ -7776 +8727 @@
     setinteractive(iflag);
     setjobctl(mflag);
-    setvimode(viflag);
+#if ENABLE_FEATURE_EDITING_VI
+    if (viflag)
+        line_input_state->flags |= VI_MODE;
+    else
+        line_input_state->flags &= ~VI_MODE;
+#else
+    viflag = 0; /* forcibly keep the option off */
+#endif
 }
 
@@ -7794 +8752 @@
         localvars = lvp->next;
         vp = lvp->vp;
-        TRACE(("poplocalvar %s", vp ? vp->text : "-"));
+        TRACE(("poplocalvar %s\n", vp ? vp->var_text : "-"));
         if (vp == NULL) {       /* $- saved */
             memcpy(optlist, lvp->text, sizeof(optlist));
@@ -7800 +8758 @@
             optschanged();
         } else if ((lvp->flags & (VUNSET|VSTRFIXED)) == VUNSET) {
-            unsetvar(vp->text);
+            unsetvar(vp->var_text);
         } else {
-            if (vp->func)
-                (*vp->func)(strchrnul(lvp->text, '=') + 1);
+            if (vp->var_func)
+                vp->var_func(var_end(lvp->text));
             if ((vp->flags & (VTEXTFIXED|VSTACK)) == 0)
-                free((char*)vp->text);
+                free((char*)vp->var_text);
             vp->flags = lvp->flags;
-            vp->text = lvp->text;
+            vp->var_text = lvp->text;
         }
         free(lvp);
@@ -7832 +8790 @@
     exception_handler = &jmploc;
     localvars = NULL;
-    shellparam.malloc = 0;
+    shellparam.malloced = 0;
     func->count++;
     funcnest++;
@@ -7843 +8801 @@
 #endif
     evaltree(&func->n, flags & EV_TESTED);
-funcdone:
+ funcdone:
     INT_OFF;
     funcnest--;
@@ -7906 +8864 @@
 
     INT_OFF;
-    lvp = ckmalloc(sizeof(struct localvar));
+    lvp = ckzalloc(sizeof(struct localvar));
     if (LONE_DASH(name)) {
         char *p;
@@ -7926 +8884 @@
             lvp->flags = VUNSET;
         } else {
-            lvp->text = vp->text;
+            lvp->text = vp->var_text;
             lvp->flags = vp->flags;
             vp->flags |= VSTRFIXED|VTEXTFIXED;
@@ -7942 +8900 @@
  * The "local" command.
  */
-static int
-localcmd(int argc, char **argv)
+static int FAST_FUNC
+localcmd(int argc UNUSED_PARAM, char **argv)
 {
     char *name;
@@ -7954 +8912 @@
 }
 
-static int
-falsecmd(int argc, char **argv)
+static int FAST_FUNC
+falsecmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     return 1;
 }
 
-static int
-truecmd(int argc, char **argv)
+static int FAST_FUNC
+truecmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     return 0;
 }
 
-static int
-execcmd(int argc, char **argv)
-{
-    if (argc > 1) {
+static int FAST_FUNC
+execcmd(int argc UNUSED_PARAM, char **argv)
+{
+    if (argv[1]) {
         iflag = 0;              /* exit on error */
         mflag = 0;
@@ -7981 +8939 @@
  * The return command.
  */
-static int
-returncmd(int argc, char **argv)
+static int FAST_FUNC
+returncmd(int argc UNUSED_PARAM, char **argv)
 {
     /*
@@ -7993 +8951 @@
 
 /* Forward declarations for builtintab[] */
-static int breakcmd(int, char **);
-static int dotcmd(int, char **);
-static int evalcmd(int, char **);
-#if ENABLE_ASH_BUILTIN_ECHO
-static int echocmd(int, char **);
-#endif
-#if ENABLE_ASH_BUILTIN_TEST
-static int testcmd(int, char **);
-#endif
-static int exitcmd(int, char **);
-static int exportcmd(int, char **);
+static int breakcmd(int, char **) FAST_FUNC;
+static int dotcmd(int, char **) FAST_FUNC;
+static int evalcmd(int, char **) FAST_FUNC;
+static int exitcmd(int, char **) FAST_FUNC;
+static int exportcmd(int, char **) FAST_FUNC;
 #if ENABLE_ASH_GETOPTS
-static int getoptscmd(int, char **);
+static int getoptscmd(int, char **) FAST_FUNC;
 #endif
 #if !ENABLE_FEATURE_SH_EXTRA_QUIET
-static int helpcmd(int argc, char **argv);
-#endif
-#if ENABLE_ASH_MATH_SUPPORT
-static int letcmd(int, char **);
-#endif
-static int readcmd(int, char **);
-static int setcmd(int, char **);
-static int shiftcmd(int, char **);
-static int timescmd(int, char **);
-static int trapcmd(int, char **);
-static int umaskcmd(int, char **);
-static int unsetcmd(int, char **);
-static int ulimitcmd(int, char **);
+static int helpcmd(int, char **) FAST_FUNC;
+#endif
+#if ENABLE_SH_MATH_SUPPORT
+static int letcmd(int, char **) FAST_FUNC;
+#endif
+static int readcmd(int, char **) FAST_FUNC;
+static int setcmd(int, char **) FAST_FUNC;
+static int shiftcmd(int, char **) FAST_FUNC;
+static int timescmd(int, char **) FAST_FUNC;
+static int trapcmd(int, char **) FAST_FUNC;
+static int umaskcmd(int, char **) FAST_FUNC;
+static int unsetcmd(int, char **) FAST_FUNC;
+static int ulimitcmd(int, char **) FAST_FUNC;
 
 #define BUILTIN_NOSPEC          "0"
@@ -8031 +8983 @@
 #define BUILTIN_SPEC_REG_ASSG   "7"
 
-/* make sure to keep these in proper order since it is searched via bsearch() */
+/* Stubs for calling non-FAST_FUNC's */
+#if ENABLE_ASH_BUILTIN_ECHO
+static int FAST_FUNC echocmd(int argc, char **argv)   { return echo_main(argc, argv); }
+#endif
+#if ENABLE_ASH_BUILTIN_PRINTF
+static int FAST_FUNC printfcmd(int argc, char **argv) { return printf_main(argc, argv); }
+#endif
+#if ENABLE_ASH_BUILTIN_TEST
+static int FAST_FUNC testcmd(int argc, char **argv)   { return test_main(argc, argv); }
+#endif
+
+/* Keep these in proper order since it is searched via bsearch() */
 static const struct builtincmd builtintab[] = {
-    { BUILTIN_SPEC_REG      ".", dotcmd },
-    { BUILTIN_SPEC_REG      ":", truecmd },
+    { BUILTIN_SPEC_REG      "."       , dotcmd     },
+    { BUILTIN_SPEC_REG      ":"       , truecmd    },
 #if ENABLE_ASH_BUILTIN_TEST
-    { BUILTIN_REGULAR   "[", testcmd },
-    { BUILTIN_REGULAR   "[[", testcmd },
+    { BUILTIN_REGULAR       "["       , testcmd    },
+#if ENABLE_ASH_BASH_COMPAT
+    { BUILTIN_REGULAR       "[["      , testcmd    },
+#endif
 #endif
 #if ENABLE_ASH_ALIAS
-    { BUILTIN_REG_ASSG      "alias", aliascmd },
+    { BUILTIN_REG_ASSG      "alias"   , aliascmd   },
 #endif
 #if JOBS
-    { BUILTIN_REGULAR       "bg", fg_bgcmd },
-#endif
-    { BUILTIN_SPEC_REG      "break", breakcmd },
-    { BUILTIN_REGULAR       "cd", cdcmd },
-    { BUILTIN_NOSPEC        "chdir", cdcmd },
+    { BUILTIN_REGULAR       "bg"      , fg_bgcmd   },
+#endif
+    { BUILTIN_SPEC_REG      "break"   , breakcmd   },
+    { BUILTIN_REGULAR       "cd"      , cdcmd      },
+    { BUILTIN_NOSPEC        "chdir"   , cdcmd      },
 #if ENABLE_ASH_CMDCMD
-    { BUILTIN_REGULAR       "command", commandcmd },
-#endif
-    { BUILTIN_SPEC_REG      "continue", breakcmd },
+    { BUILTIN_REGULAR       "command" , commandcmd },
+#endif
+    { BUILTIN_SPEC_REG      "continue", breakcmd   },
 #if ENABLE_ASH_BUILTIN_ECHO
-    { BUILTIN_REGULAR       "echo", echocmd },
-#endif
-    { BUILTIN_SPEC_REG      "eval", evalcmd },
-    { BUILTIN_SPEC_REG      "exec", execcmd },
-    { BUILTIN_SPEC_REG      "exit", exitcmd },
-    { BUILTIN_SPEC_REG_ASSG "export", exportcmd },
-    { BUILTIN_REGULAR       "false", falsecmd },
+    { BUILTIN_REGULAR       "echo"    , echocmd    },
+#endif
+    { BUILTIN_SPEC_REG      "eval"    , evalcmd    },
+    { BUILTIN_SPEC_REG      "exec"    , execcmd    },
+    { BUILTIN_SPEC_REG      "exit"    , exitcmd    },
+    { BUILTIN_SPEC_REG_ASSG "export"  , exportcmd  },
+    { BUILTIN_REGULAR       "false"   , falsecmd   },
 #if JOBS
-    { BUILTIN_REGULAR       "fg", fg_bgcmd },
+    { BUILTIN_REGULAR       "fg"      , fg_bgcmd   },
 #endif
 #if ENABLE_ASH_GETOPTS
-    { BUILTIN_REGULAR       "getopts", getoptscmd },
-#endif
-    { BUILTIN_NOSPEC        "hash", hashcmd },
+    { BUILTIN_REGULAR       "getopts" , getoptscmd },
+#endif
+    { BUILTIN_NOSPEC        "hash"    , hashcmd    },
 #if !ENABLE_FEATURE_SH_EXTRA_QUIET
-    { BUILTIN_NOSPEC        "help", helpcmd },
+    { BUILTIN_NOSPEC        "help"    , helpcmd    },
 #endif
 #if JOBS
-    { BUILTIN_REGULAR       "jobs", jobscmd },
-    { BUILTIN_REGULAR       "kill", killcmd },
-#endif
-#if ENABLE_ASH_MATH_SUPPORT
-    { BUILTIN_NOSPEC        "let", letcmd },
-#endif
-    { BUILTIN_ASSIGN        "local", localcmd },
-    { BUILTIN_NOSPEC        "pwd", pwdcmd },
-    { BUILTIN_REGULAR       "read", readcmd },
-    { BUILTIN_SPEC_REG_ASSG "readonly", exportcmd },
-    { BUILTIN_SPEC_REG      "return", returncmd },
-    { BUILTIN_SPEC_REG      "set", setcmd },
-    { BUILTIN_SPEC_REG      "shift", shiftcmd },
-    { BUILTIN_SPEC_REG      "source", dotcmd },
+    { BUILTIN_REGULAR       "jobs"    , jobscmd    },
+    { BUILTIN_REGULAR       "kill"    , killcmd    },
+#endif
+#if ENABLE_SH_MATH_SUPPORT
+    { BUILTIN_NOSPEC        "let"     , letcmd     },
+#endif
+    { BUILTIN_ASSIGN        "local"   , localcmd   },
+#if ENABLE_ASH_BUILTIN_PRINTF
+    { BUILTIN_REGULAR       "printf"  , printfcmd  },
+#endif
+    { BUILTIN_NOSPEC        "pwd"     , pwdcmd     },
+    { BUILTIN_REGULAR       "read"    , readcmd    },
+    { BUILTIN_SPEC_REG_ASSG "readonly", exportcmd  },
+    { BUILTIN_SPEC_REG      "return"  , returncmd  },
+    { BUILTIN_SPEC_REG      "set"     , setcmd     },
+    { BUILTIN_SPEC_REG      "shift"   , shiftcmd   },
+#if ENABLE_ASH_BASH_COMPAT
+    { BUILTIN_SPEC_REG      "source"  , dotcmd     },
+#endif
 #if ENABLE_ASH_BUILTIN_TEST
-    { BUILTIN_REGULAR   "test", testcmd },
-#endif
-    { BUILTIN_SPEC_REG      "times", timescmd },
-    { BUILTIN_SPEC_REG      "trap", trapcmd },
-    { BUILTIN_REGULAR       "true", truecmd },
-    { BUILTIN_NOSPEC        "type", typecmd },
-    { BUILTIN_NOSPEC        "ulimit", ulimitcmd },
-    { BUILTIN_REGULAR       "umask", umaskcmd },
+    { BUILTIN_REGULAR       "test"    , testcmd    },
+#endif
+    { BUILTIN_SPEC_REG      "times"   , timescmd   },
+    { BUILTIN_SPEC_REG      "trap"    , trapcmd    },
+    { BUILTIN_REGULAR       "true"    , truecmd    },
+    { BUILTIN_NOSPEC        "type"    , typecmd    },
+    { BUILTIN_NOSPEC        "ulimit"  , ulimitcmd  },
+    { BUILTIN_REGULAR       "umask"   , umaskcmd   },
 #if ENABLE_ASH_ALIAS
-    { BUILTIN_REGULAR       "unalias", unaliascmd },
-#endif
-    { BUILTIN_SPEC_REG      "unset", unsetcmd },
-    { BUILTIN_REGULAR       "wait", waitcmd },
+    { BUILTIN_REGULAR       "unalias" , unaliascmd },
+#endif
+    { BUILTIN_SPEC_REG      "unset"   , unsetcmd   },
+    { BUILTIN_REGULAR       "wait"    , waitcmd    },
 };
 
-
-#define COMMANDCMD (builtintab + 5 + \
-    2 * ENABLE_ASH_BUILTIN_TEST + \
-    ENABLE_ASH_ALIAS + \
-    ENABLE_ASH_JOB_CONTROL)
-#define EXECCMD (builtintab + 7 + \
-    2 * ENABLE_ASH_BUILTIN_TEST + \
-    ENABLE_ASH_ALIAS + \
-    ENABLE_ASH_JOB_CONTROL + \
-    ENABLE_ASH_CMDCMD + \
-    ENABLE_ASH_BUILTIN_ECHO)
+/* Should match the above table! */
+#define COMMANDCMD (builtintab + \
+    2 + \
+    1 * ENABLE_ASH_BUILTIN_TEST + \
+    1 * ENABLE_ASH_BUILTIN_TEST * ENABLE_ASH_BASH_COMPAT + \
+    1 * ENABLE_ASH_ALIAS + \
+    1 * ENABLE_ASH_JOB_CONTROL + \
+    3)
+#define EXECCMD (builtintab + \
+    2 + \
+    1 * ENABLE_ASH_BUILTIN_TEST + \
+    1 * ENABLE_ASH_BUILTIN_TEST * ENABLE_ASH_BASH_COMPAT + \
+    1 * ENABLE_ASH_ALIAS + \
+    1 * ENABLE_ASH_JOB_CONTROL + \
+    3 + \
+    1 * ENABLE_ASH_CMDCMD + \
+    1 + \
+    ENABLE_ASH_BUILTIN_ECHO + \
+    1)
 
 /*
@@ -8131 +9109 @@
  * Execute a simple command.
  */
-static int back_exitstatus; /* exit status of backquoted command */
 static int
 isassignment(const char *p)
@@ -8140 +9117 @@
     return *q == '=';
 }
-static int
-bltincmd(int argc, char **argv)
+static int FAST_FUNC
+bltincmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     /* Preserve exitstatus of a previous possible redirection
@@ -8150 +9127 @@
 evalcommand(union node *cmd, int flags)
 {
-    static const struct builtincmd bltin = {
-        "\0\0", bltincmd
+    static const struct builtincmd null_bltin = {
+        "\0\0", bltincmd /* why three NULs? */
     };
     struct stackmark smark;
@@ -8165 +9142 @@
     const char *path;
     int spclbltin;
-    int cmd_is_exec;
     int status;
     char **nargv;
     struct builtincmd *bcmd;
-    int pseudovarflag = 0;
+    smallint cmd_is_exec;
+    smallint pseudovarflag = 0;
 
     /* First expand the arguments. */
@@ -8177 +9154 @@
 
     cmdentry.cmdtype = CMDBUILTIN;
-    cmdentry.u.cmd = &bltin;
+    cmdentry.u.cmd = &null_bltin;
     varlist.lastp = &varlist.list;
     *varlist.lastp = NULL;
@@ -8217 +9194 @@
     status = redirectsafe(cmd->ncmd.redirect, REDIR_PUSH | REDIR_SAVEFD2);
 
-    path = vpath.text;
+    path = vpath.var_text;
     for (argp = cmd->ncmd.assign; argp; argp = argp->narg.next) {
         struct strlist **spp;
@@ -8230 +9207 @@
          */
         p = (*spp)->text;
-        if (varequal(p, path))
+        if (varcmp(p, path) == 0)
             path = p;
     }
@@ -8237 +9214 @@
     if (xflag) {
         int n;
-        const char *p = " %s";
-
-        p++;
-        dprintf(preverrout_fd, p, expandstr(ps4val()));
-
+        const char *p = " %s" + 1;
+
+        fdprintf(preverrout_fd, p, expandstr(ps4val()));
         sp = varlist.list;
         for (n = 0; n < 2; n++) {
             while (sp) {
-                dprintf(preverrout_fd, p, sp->text);
+                fdprintf(preverrout_fd, p, sp->text);
                 sp = sp->next;
-                if (*p == '%') {
-                    p--;
-                }
+                p = " %s";
             }
             sp = arglist.list;
         }
-        full_write(preverrout_fd, "\n", 1);
+        safe_write(preverrout_fd, "\n", 1);
     }
 
@@ -8269 +9242 @@
             find_command(argv[0], &cmdentry, cmd_flag, path);
             if (cmdentry.cmdtype == CMDUNKNOWN) {
+                flush_stdout_stderr();
                 status = 127;
-                flush_stderr();
                 goto bail;
             }
@@ -8280 +9253 @@
                 spclbltin = IS_BUILTIN_SPECIAL(cmdentry.u.cmd);
             if (cmdentry.u.cmd == EXECCMD)
-                cmd_is_exec++;
+                cmd_is_exec = 1;
 #if ENABLE_ASH_CMDCMD
             if (cmdentry.u.cmd == COMMANDCMD) {
@@ -8307 +9280 @@
     /* Execute the command. */
     switch (cmdentry.cmdtype) {
-    default:
-        /* Fork off a child process if necessary. */
-        if (!(flags & EV_EXIT) || trap[0]) {
+    default: {
+
+#if ENABLE_FEATURE_SH_NOFORK
+/* (1) BUG: if variables are set, we need to fork, or save/restore them
+ *     around run_nofork_applet() call.
+ * (2) Should this check also be done in forkshell()?
+ *     (perhaps it should, so that "VAR=VAL nofork" at least avoids exec...)
+ */
+        /* find_command() encodes applet_no as (-2 - applet_no) */
+        int applet_no = (- cmdentry.u.index - 2);
+        if (applet_no >= 0 && APPLET_IS_NOFORK(applet_no)) {
+            listsetvar(varlist.list, VEXPORT|VSTACK);
+            /* run <applet>_main() */
+            exitstatus = run_nofork_applet(applet_no, argv);
+            break;
+        }
+#endif
+        /* Can we avoid forking off? For example, very last command
+         * in a script or a subshell does not need forking,
+         * we can just exec it.
+         */
+        if (!(flags & EV_EXIT) || may_have_traps) {
+            /* No, forking off a child is necessary */
             INT_OFF;
-            jp = makejob(cmd, 1);
+            jp = makejob(/*cmd,*/ 1);
             if (forkshell(jp, cmd, FORK_FG) != 0) {
+                /* parent */
                 exitstatus = waitforjob(jp);
                 INT_ON;
+                TRACE(("forked child exited with %d\n", exitstatus));
                 break;
             }
+            /* child */
             FORCE_INT_ON;
+            /* fall through to exec'ing external program */
         }
         listsetvar(varlist.list, VEXPORT|VSTACK);
         shellexec(argv, path, cmdentry.u.index);
         /* NOTREACHED */
-
+    } /* default */
     case CMDBUILTIN:
         cmdenviron = varlist.list;
@@ -8335 +9332 @@
             listsetvar(list, i);
         }
+        /* Tight loop with builtins only:
+         * "while kill -0 $child; do true; done"
+         * will never exit even if $child died, unless we do this
+         * to reap the zombie and make kill detect that it's gone: */
+        dowait(DOWAIT_NONBLOCK, NULL);
+
         if (evalbltin(cmdentry.u.cmd, argc, argv)) {
             int exit_status;
-            int i, j;
-
-            i = exception;
+            int i = exception_type;
             if (i == EXEXIT)
                 goto raise;
-
             exit_status = 2;
-            j = 0;
             if (i == EXINT)
-                j = SIGINT;
+                exit_status = 128 + SIGINT;
             if (i == EXSIG)
-                j = pendingsig;
-            if (j)
-                exit_status = j + 128;
+                exit_status = 128 + pending_sig;
             exitstatus = exit_status;
-
             if (i == EXINT || spclbltin > 0) {
  raise:
@@ -8363 +9359 @@
     case CMDFUNCTION:
         listsetvar(varlist.list, 0);
+        /* See above for the rationale */
+        dowait(DOWAIT_NONBLOCK, NULL);
         if (evalfun(cmdentry.u.func, argc, argv, flags))
             goto raise;
         break;
-    }
+
+    } /* switch */
 
  out:
-    popredir(cmd_is_exec);
-    if (lastarg)
+    popredir(/*drop:*/ cmd_is_exec, /*restore:*/ cmd_is_exec);
+    if (lastarg) {
         /* dsl: I think this is intended to be used to support
          * '_' in 'vi' command mode during line editing...
@@ -8376 +9375 @@
          */
         setvar("_", lastarg, 0);
+    }
     popstackmark(&smark);
 }
@@ -8402 +9402 @@
     clearerr(stdout);
     commandname = savecmdname;
-    exsig = 0;
     exception_handler = savehandler;
 
@@ -8411 +9410 @@
 goodname(const char *p)
 {
-    return !*endofname(p);
+    return endofname(p)[0] == '\0';
 }
 
@@ -8447 +9446 @@
  * in the standard shell so we don't make it one here.
  */
-static int
-breakcmd(int argc, char **argv)
-{
-    int n = argc > 1 ? number(argv[1]) : 1;
+static int FAST_FUNC
+breakcmd(int argc UNUSED_PARAM, char **argv)
+{
+    int n = argv[1] ? number(argv[1]) : 1;
 
     if (n <= 0)
-        ash_msg_and_raise_error(illnum, argv[1]);
+        ash_msg_and_raise_error(msg_illnum, argv[1]);
     if (n > loopnest)
         n = loopnest;
@@ -8469 +9468 @@
  */
 
-#define EOF_NLEFT -99           /* value of parsenleft when EOF pushed back */
-
 enum {
     INPUT_PUSH_FILE = 1,
@@ -8476 +9473 @@
 };
 
-/*
- * NEOF is returned by parsecmd when it encounters an end of file.  It
- * must be distinct from NULL, so we use the address of a variable that
- * happens to be handy.
- */
-static int plinno = 1;                  /* input line number */
-/* number of characters left in input buffer */
-static int parsenleft;                  /* copy of parsefile->nleft */
-static int parselleft;                  /* copy of parsefile->lleft */
-/* next character in input buffer */
-static char *parsenextc;                /* copy of parsefile->nextc */
-
-static int checkkwd;
+static smallint checkkwd;
 /* values of checkkwd variable */
 #define CHKALIAS        0x1
@@ -8494 +9479 @@
 #define CHKNL           0x4
 
+/*
+ * Push a string back onto the input at this current parsefile level.
+ * We handle aliases this way.
+ */
+#if !ENABLE_ASH_ALIAS
+#define pushstring(s, ap) pushstring(s)
+#endif
+static void
+pushstring(char *s, struct alias *ap)
+{
+    struct strpush *sp;
+    int len;
+
+    len = strlen(s);
+    INT_OFF;
+    if (g_parsefile->strpush) {
+        sp = ckzalloc(sizeof(*sp));
+        sp->prev = g_parsefile->strpush;
+    } else {
+        sp = &(g_parsefile->basestrpush);
+    }
+    g_parsefile->strpush = sp;
+    sp->prev_string = g_parsefile->next_to_pgetc;
+    sp->prev_left_in_line = g_parsefile->left_in_line;
+#if ENABLE_ASH_ALIAS
+    sp->ap = ap;
+    if (ap) {
+        ap->flag |= ALIASINUSE;
+        sp->string = s;
+    }
+#endif
+    g_parsefile->next_to_pgetc = s;
+    g_parsefile->left_in_line = len;
+    INT_ON;
+}
+
 static void
 popstring(void)
 {
-    struct strpush *sp = parsefile->strpush;
+    struct strpush *sp = g_parsefile->strpush;
 
     INT_OFF;
 #if ENABLE_ASH_ALIAS
     if (sp->ap) {
-        if (parsenextc[-1] == ' ' || parsenextc[-1] == '\t') {
+        if (g_parsefile->next_to_pgetc[-1] == ' '
+         || g_parsefile->next_to_pgetc[-1] == '\t'
+        ) {
             checkkwd |= CHKALIAS;
         }
@@ -8514 +9537 @@
     }
 #endif
-    parsenextc = sp->prevstring;
-    parsenleft = sp->prevnleft;
-/*dprintf("*** calling popstring: restoring to '%s'\n", parsenextc);*/
-    parsefile->strpush = sp->prev;
-    if (sp != &(parsefile->basestrpush))
+    g_parsefile->next_to_pgetc = sp->prev_string;
+    g_parsefile->left_in_line = sp->prev_left_in_line;
+    g_parsefile->strpush = sp->prev;
+    if (sp != &(g_parsefile->basestrpush))
         free(sp);
     INT_ON;
 }
 
+//FIXME: BASH_COMPAT with "...&" does TWO pungetc():
+//it peeks whether it is &>, and then pushes back both chars.
+//This function needs to save last *next_to_pgetc to buf[0]
+//to make two pungetc() reliable. Currently,
+// pgetc (out of buf: does preadfd), pgetc, pungetc, pungetc won't work...
 static int
 preadfd(void)
 {
     int nr;
-    char *buf =  parsefile->buf;
-    parsenextc = buf;
-
+    char *buf = g_parsefile->buf;
+
+    g_parsefile->next_to_pgetc = buf;
+#if ENABLE_FEATURE_EDITING
  retry:
-#if ENABLE_FEATURE_EDITING
-    if (!iflag || parsefile->fd)
-        nr = safe_read(parsefile->fd, buf, BUFSIZ - 1);
+    if (!iflag || g_parsefile->pf_fd != STDIN_FILENO)
+        nr = nonblock_safe_read(g_parsefile->pf_fd, buf, IBUFSIZ - 1);
     else {
 #if ENABLE_FEATURE_TAB_COMPLETION
         line_input_state->path_lookup = pathval();
 #endif
-        nr = read_line_input(cmdedit_prompt, buf, BUFSIZ, line_input_state);
+        nr = read_line_input(cmdedit_prompt, buf, IBUFSIZ, line_input_state);
         if (nr == 0) {
             /* Ctrl+C pressed */
@@ -8550 +9577 @@
         }
         if (nr < 0 && errno == 0) {
-            /* Ctrl+D presend */
+            /* Ctrl+D pressed */
             nr = 0;
         }
     }
 #else
-    nr = safe_read(parsefile->fd, buf, BUFSIZ - 1);
-#endif
-
+    nr = nonblock_safe_read(g_parsefile->pf_fd, buf, IBUFSIZ - 1);
+#endif
+
+#if 0
+/* nonblock_safe_read() handles this problem */
     if (nr < 0) {
         if (parsefile->fd == 0 && errno == EWOULDBLOCK) {
             int flags = fcntl(0, F_GETFL);
-            if (flags >= 0 && flags & O_NONBLOCK) {
-                flags &=~ O_NONBLOCK;
+            if (flags >= 0 && (flags & O_NONBLOCK)) {
+                flags &= ~O_NONBLOCK;
                 if (fcntl(0, F_SETFL, flags) >= 0) {
                     out2str("sh: turning off NDELAY mode\n");
@@ -8570 +9599 @@
         }
     }
+#endif
     return nr;
 }
@@ -8577 +9607 @@
  *
  * 1) If a string was pushed back on the input, pop it;
- * 2) If an EOF was pushed back (parsenleft == EOF_NLEFT) or we are reading
- *    from a string so we can't refill the buffer, return EOF.
- * 3) If the is more stuff in this buffer, use it else call read to fill it.
+ * 2) If an EOF was pushed back (g_parsefile->left_in_line < -BIGNUM)
+ *    or we are reading from a string so we can't refill the buffer,
+ *    return EOF.
+ * 3) If there is more stuff in this buffer, use it else call read to fill it.
  * 4) Process input up to the next newline, deleting nul characters.
  */
+//#define pgetc_debug(...) bb_error_msg(__VA_ARGS__)
+#define pgetc_debug(...) ((void)0)
 static int
 preadbuffer(void)
@@ -8587 +9620 @@
     char *q;
     int more;
-    char savec;
-
-    while (parsefile->strpush) {
+
+    while (g_parsefile->strpush) {
 #if ENABLE_ASH_ALIAS
-        if (parsenleft == -1 && parsefile->strpush->ap &&
-            parsenextc[-1] != ' ' && parsenextc[-1] != '\t') {
+        if (g_parsefile->left_in_line == -1
+         && g_parsefile->strpush->ap
+         && g_parsefile->next_to_pgetc[-1] != ' '
+         && g_parsefile->next_to_pgetc[-1] != '\t'
+        ) {
+            pgetc_debug("preadbuffer PEOA");
             return PEOA;
         }
 #endif
         popstring();
-        if (--parsenleft >= 0)
-            return signed_char2int(*parsenextc++);
-    }
-    if (parsenleft == EOF_NLEFT || parsefile->buf == NULL)
+        /* try "pgetc" now: */
+        pgetc_debug("preadbuffer internal pgetc at %d:%p'%s'",
+                g_parsefile->left_in_line,
+                g_parsefile->next_to_pgetc,
+                g_parsefile->next_to_pgetc);
+        if (--g_parsefile->left_in_line >= 0)
+            return (unsigned char)(*g_parsefile->next_to_pgetc++);
+    }
+    /* on both branches above g_parsefile->left_in_line < 0.
+     * "pgetc" needs refilling.
+     */
+
+    /* -90 is our -BIGNUM. Below we use -99 to mark "EOF on read",
+     * pungetc() may increment it a few times.
+     * Assuming it won't increment it to less than -90.
+     */
+    if (g_parsefile->left_in_line < -90 || g_parsefile->buf == NULL) {
+        pgetc_debug("preadbuffer PEOF1");
+        /* even in failure keep left_in_line and next_to_pgetc
+         * in lock step, for correct multi-layer pungetc.
+         * left_in_line was decremented before preadbuffer(),
+         * must inc next_to_pgetc: */
+        g_parsefile->next_to_pgetc++;
         return PEOF;
-    flush_stdout_stderr();
-
-    more = parselleft;
+    }
+
+    more = g_parsefile->left_in_buffer;
     if (more <= 0) {
+        flush_stdout_stderr();
  again:
         more = preadfd();
         if (more <= 0) {
-            parselleft = parsenleft = EOF_NLEFT;
+            /* don't try reading again */
+            g_parsefile->left_in_line = -99;
+            pgetc_debug("preadbuffer PEOF2");
+            g_parsefile->next_to_pgetc++;
             return PEOF;
         }
     }
 
-    q = parsenextc;
-
-    /* delete nul characters */
+    /* Find out where's the end of line.
+     * Set g_parsefile->left_in_line
+     * and g_parsefile->left_in_buffer acordingly.
+     * NUL chars are deleted.
+     */
+    q = g_parsefile->next_to_pgetc;
     for (;;) {
-        int c;
+        char c;
 
         more--;
+
         c = *q;
-
-        if (!c)
+        if (c == '\0') {
             memmove(q, q + 1, more);
-        else {
+        } else {
             q++;
             if (c == '\n') {
-                parsenleft = q - parsenextc - 1;
+                g_parsefile->left_in_line = q - g_parsefile->next_to_pgetc - 1;
                 break;
             }
@@ -8634 +9696 @@
 
         if (more <= 0) {
-            parsenleft = q - parsenextc - 1;
-            if (parsenleft < 0)
+            g_parsefile->left_in_line = q - g_parsefile->next_to_pgetc - 1;
+            if (g_parsefile->left_in_line < 0)
                 goto again;
             break;
         }
     }
-    parselleft = more;
-
-    savec = *q;
-    *q = '\0';
+    g_parsefile->left_in_buffer = more;
 
     if (vflag) {
-        out2str(parsenextc);
-    }
-
-    *q = savec;
-
-    return signed_char2int(*parsenextc++);
-}
-
-#define pgetc_as_macro() (--parsenleft >= 0? signed_char2int(*parsenextc++) : preadbuffer())
+        char save = *q;
+        *q = '\0';
+        out2str(g_parsefile->next_to_pgetc);
+        *q = save;
+    }
+
+    pgetc_debug("preadbuffer at %d:%p'%s'",
+            g_parsefile->left_in_line,
+            g_parsefile->next_to_pgetc,
+            g_parsefile->next_to_pgetc);
+    return (unsigned char)*g_parsefile->next_to_pgetc++;
+}
+
+#define pgetc_as_macro() \
+    (--g_parsefile->left_in_line >= 0 \
+    ? (unsigned char)*g_parsefile->next_to_pgetc++ \
+    : preadbuffer() \
+    )
+
 static int
 pgetc(void)
 {
+    pgetc_debug("pgetc_fast at %d:%p'%s'",
+            g_parsefile->left_in_line,
+            g_parsefile->next_to_pgetc,
+            g_parsefile->next_to_pgetc);
     return pgetc_as_macro();
 }
 
 #if ENABLE_ASH_OPTIMIZE_FOR_SIZE
-#define pgetc_macro() pgetc()
+# define pgetc_fast() pgetc()
 #else
-#define pgetc_macro() pgetc_as_macro()
-#endif
-
-/*
- * Same as pgetc(), but ignores PEOA.
- */
+# define pgetc_fast() pgetc_as_macro()
+#endif
+
 #if ENABLE_ASH_ALIAS
 static int
-pgetc2(void)
+pgetc_without_PEOA(void)
 {
     int c;
-
     do {
-        c = pgetc_macro();
+        pgetc_debug("pgetc_fast at %d:%p'%s'",
+                g_parsefile->left_in_line,
+                g_parsefile->next_to_pgetc,
+                g_parsefile->next_to_pgetc);
+        c = pgetc_fast();
     } while (c == PEOA);
     return c;
 }
 #else
-static int
-pgetc2(void)
-{
-    return pgetc_macro();
-}
+# define pgetc_without_PEOA() pgetc()
 #endif
 
@@ -8700 +9769 @@
 
     while (--nleft > 0) {
-        c = pgetc2();
+        c = pgetc_without_PEOA();
         if (c == PEOF) {
             if (p == line)
@@ -8721 +9790 @@
 pungetc(void)
 {
-    parsenleft++;
-    parsenextc--;
-}
-
-/*
- * Push a string back onto the input at this current parsefile level.
- * We handle aliases this way.
- */
-static void
-pushstring(char *s, void *ap)
-{
-    struct strpush *sp;
-    size_t len;
-
-    len = strlen(s);
-    INT_OFF;
-/*dprintf("*** calling pushstring: %s, %d\n", s, len);*/
-    if (parsefile->strpush) {
-        sp = ckmalloc(sizeof(struct strpush));
-        sp->prev = parsefile->strpush;
-        parsefile->strpush = sp;
-    } else
-        sp = parsefile->strpush = &(parsefile->basestrpush);
-    sp->prevstring = parsenextc;
-    sp->prevnleft = parsenleft;
-#if ENABLE_ASH_ALIAS
-    sp->ap = (struct alias *)ap;
-    if (ap) {
-        ((struct alias *)ap)->flag |= ALIASINUSE;
-        sp->string = s;
-    }
-#endif
-    parsenextc = s;
-    parsenleft = len;
-    INT_ON;
+    g_parsefile->left_in_line++;
+    g_parsefile->next_to_pgetc--;
+    pgetc_debug("pushed back to %d:%p'%s'",
+            g_parsefile->left_in_line,
+            g_parsefile->next_to_pgetc,
+            g_parsefile->next_to_pgetc);
 }
 
@@ -8767 +9807 @@
     struct parsefile *pf;
 
-    parsefile->nleft = parsenleft;
-    parsefile->lleft = parselleft;
-    parsefile->nextc = parsenextc;
-    parsefile->linno = plinno;
-    pf = ckmalloc(sizeof(*pf));
-    pf->prev = parsefile;
-    pf->fd = -1;
-    pf->strpush = NULL;
-    pf->basestrpush.prev = NULL;
-    parsefile = pf;
+    pf = ckzalloc(sizeof(*pf));
+    pf->prev = g_parsefile;
+    pf->pf_fd = -1;
+    /*pf->strpush = NULL; - ckzalloc did it */
+    /*pf->basestrpush.prev = NULL;*/
+    g_parsefile = pf;
 }
 
@@ -8782 +9818 @@
 popfile(void)
 {
-    struct parsefile *pf = parsefile;
+    struct parsefile *pf = g_parsefile;
 
     INT_OFF;
-    if (pf->fd >= 0)
-        close(pf->fd);
-    if (pf->buf)
-        free(pf->buf);
+    if (pf->pf_fd >= 0)
+        close(pf->pf_fd);
+    free(pf->buf);
     while (pf->strpush)
         popstring();
-    parsefile = pf->prev;
+    g_parsefile = pf->prev;
     free(pf);
-    parsenleft = parsefile->nleft;
-    parselleft = parsefile->lleft;
-    parsenextc = parsefile->nextc;
-    plinno = parsefile->linno;
     INT_ON;
 }
@@ -8806 +9837 @@
 popallfiles(void)
 {
-    while (parsefile != &basepf)
+    while (g_parsefile != &basepf)
         popfile();
 }
@@ -8818 +9849 @@
 {
     popallfiles();
-    if (parsefile->fd > 0) {
-        close(parsefile->fd);
-        parsefile->fd = 0;
+    if (g_parsefile->pf_fd > 0) {
+        close(g_parsefile->pf_fd);
+        g_parsefile->pf_fd = 0;
     }
 }
@@ -8831 +9862 @@
 setinputfd(int fd, int push)
 {
-    fcntl(fd, F_SETFD, FD_CLOEXEC);
+    close_on_exec_on(fd);
     if (push) {
         pushfile();
-        parsefile->buf = 0;
-    }
-    parsefile->fd = fd;
-    if (parsefile->buf == NULL)
-        parsefile->buf = ckmalloc(IBUFSIZ);
-    parselleft = parsenleft = 0;
-    plinno = 1;
+        g_parsefile->buf = NULL;
+    }
+    g_parsefile->pf_fd = fd;
+    if (g_parsefile->buf == NULL)
+        g_parsefile->buf = ckmalloc(IBUFSIZ);
+    g_parsefile->left_in_buffer = 0;
+    g_parsefile->left_in_line = 0;
+    g_parsefile->linno = 1;
 }
 
@@ -8858 +9890 @@
         if (flags & INPUT_NOFILE_OK)
             goto out;
-        ash_msg_and_raise_error("can't open %s", fname);
+        ash_msg_and_raise_error("can't open '%s'", fname);
     }
     if (fd < 10) {
@@ -8881 +9913 @@
     INT_OFF;
     pushfile();
-    parsenextc = string;
-    parsenleft = strlen(string);
-    parsefile->buf = NULL;
-    plinno = 1;
+    g_parsefile->next_to_pgetc = string;
+    g_parsefile->left_in_line = strlen(string);
+    g_parsefile->buf = NULL;
+    g_parsefile->linno = 1;
     INT_ON;
 }
@@ -8901 +9933 @@
 static time_t mailtime[MAXMBOXES];
 /* Set if MAIL or MAILPATH is changed. */
-static int mail_var_path_changed;
+static smallint mail_var_path_changed;
 
 /*
@@ -8922 +9954 @@
     mpath = mpathset() ? mpathval() : mailval();
     for (mtp = mailtime; mtp < mailtime + MAXMBOXES; mtp++) {
-        p = padvance(&mpath, nullstr);
+        p = path_advance(&mpath, nullstr);
         if (p == NULL)
             break;
         if (*p == '\0')
             continue;
-        for (q = p; *q; q++);
+        for (q = p; *q; q++)
+            continue;
 #if DEBUG
         if (q[-1] != '/')
@@ -8939 +9972 @@
         if (!mail_var_path_changed && statb.st_mtime != *mtp) {
             fprintf(
-                stderr, snlfmt,
+                stderr, "%s\n",
                 pathopt ? pathopt : "you have mail"
             );
@@ -8949 +9982 @@
 }
 
-static void
-changemail(const char *val)
-{
-    mail_var_path_changed++;
+static void FAST_FUNC
+changemail(const char *val UNUSED_PARAM)
+{
+    mail_var_path_changed = 1;
 }
 
@@ -8970 +10003 @@
     int nparam;
 
-    for (nparam = 0; argv[nparam]; nparam++);
+    for (nparam = 0; argv[nparam]; nparam++)
+        continue;
     ap = newparam = ckmalloc((nparam + 1) * sizeof(*ap));
     while (*argv) {
@@ -8977 +10011 @@
     *ap = NULL;
     freeparam(&shellparam);
-    shellparam.malloc = 1;
+    shellparam.malloced = 1;
     shellparam.nparam = nparam;
     shellparam.p = newparam;
@@ -8989 +10023 @@
  * Process shell options.  The global variable argptr contains a pointer
  * to the argument list; we advance it past the options.
- */
-static void
-minus_o(char *name, int val)
+ *
+ * SUSv3 section 2.8.1 "Consequences of Shell Errors" says:
+ * For a non-interactive shell, an error condition encountered
+ * by a special built-in ... shall cause the shell to write a diagnostic message
+ * to standard error and exit as shown in the following table:
+ * Error                                           Special Built-In
+ * ...
+ * Utility syntax error (option or operand error)  Shall exit
+ * ...
+ * However, in bug 1142 (http://busybox.net/bugs/view.php?id=1142)
+ * we see that bash does not do that (set "finishes" with error code 1 instead,
+ * and shell continues), and people rely on this behavior!
+ * Testcase:
+ * set -o barfoo 2>/dev/null
+ * echo $?
+ *
+ * Oh well. Let's mimic that.
+ */
+static int
+plus_minus_o(char *name, int val)
 {
     int i;
@@ -8999 +10050 @@
             if (strcmp(name, optnames(i)) == 0) {
                 optlist[i] = val;
-                return;
+                return 0;
             }
         }
-        ash_msg_and_raise_error("illegal option -o %s", name);
-    }
-    out1str("Current option settings\n");
-    for (i = 0; i < NOPTS; i++)
-        out1fmt("%-16s%s\n", optnames(i),
-                optlist[i] ? "on" : "off");
+        ash_msg("illegal option %co %s", val ? '-' : '+', name);
+        return 1;
+    }
+    for (i = 0; i < NOPTS; i++) {
+        if (val) {
+            out1fmt("%-16s%s\n", optnames(i), optlist[i] ? "on" : "off");
+        } else {
+            out1fmt("set %co %s\n", optlist[i] ? '-' : '+', optnames(i));
+        }
+    }
+    return 0;
 }
 static void
@@ -9020 +10076 @@
         }
     }
-    ash_msg_and_raise_error("illegal option -%c", flag);
+    ash_msg_and_raise_error("illegal option %c%c", val ? '-' : '+', flag);
     /* NOTREACHED */
 }
-static void
+static int
 options(int cmdline)
 {
@@ -9058 +10114 @@
                 minusc = p;     /* command is after shell args */
             } else if (c == 'o') {
-                minus_o(*argptr, val);
+                if (plus_minus_o(*argptr, val)) {
+                    /* it already printed err message */
+                    return 1; /* error */
+                }
                 if (*argptr)
                     argptr++;
@@ -9073 +10132 @@
         }
     }
+    return 0;
 }
 
@@ -9078 +10138 @@
  * The shift builtin command.
  */
-static int
-shiftcmd(int argc, char **argv)
+static int FAST_FUNC
+shiftcmd(int argc UNUSED_PARAM, char **argv)
 {
     int n;
@@ -9085 +10145 @@
 
     n = 1;
-    if (argc > 1)
+    if (argv[1])
         n = number(argv[1]);
     if (n > shellparam.nparam)
-        ash_msg_and_raise_error("can't shift that many");
+        n = 0; /* bash compat, was = shellparam.nparam; */
     INT_OFF;
     shellparam.nparam -= n;
     for (ap1 = shellparam.p; --n >= 0; ap1++) {
-        if (shellparam.malloc)
+        if (shellparam.malloced)
             free(*ap1);
     }
     ap2 = shellparam.p;
-    while ((*ap2++ = *ap1++) != NULL);
+    while ((*ap2++ = *ap1++) != NULL)
+        continue;
 #if ENABLE_ASH_GETOPTS
     shellparam.optind = 1;
@@ -9139 +10200 @@
  * The set command builtin.
  */
-static int
-setcmd(int argc, char **argv)
-{
-    if (argc == 1)
+static int FAST_FUNC
+setcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
+{
+    int retval;
+
+    if (!argv[1])
         return showvars(nullstr, 0, VUNSET);
     INT_OFF;
-    options(0);
-    optschanged();
-    if (*argptr != NULL) {
-        setparam(argptr);
+    retval = 1;
+    if (!options(0)) { /* if no parse error... */
+        retval = 0;
+        optschanged();
+        if (*argptr != NULL) {
+            setparam(argptr);
+        }
     }
     INT_ON;
-    return 0;
+    return retval;
 }
 
 #if ENABLE_ASH_RANDOM_SUPPORT
-/* Roughly copied from bash.. */
-static void
+static void FAST_FUNC
 change_random(const char *value)
 {
+    uint32_t t;
+
     if (value == NULL) {
         /* "get", generate */
-        char buf[16];
-
-        rseed = rseed * 1103515245 + 12345;
-        sprintf(buf, "%d", (unsigned int)((rseed & 32767)));
+        t = next_random(&random_gen);
         /* set without recursion */
-        setvar(vrandom.text, buf, VNOFUNC);
+        setvar(vrandom.var_text, utoa(t), VNOFUNC);
         vrandom.flags &= ~VNOFUNC;
     } else {
         /* set/reset */
-        rseed = strtoul(value, (char **)NULL, 10);
+        t = strtoul(value, NULL, 10);
+        INIT_RANDOM_T(&random_gen, (t ? t : 1), t);
     }
 }
@@ -9190 +10255 @@
     optnext = optfirst + *param_optind - 1;
 
-    if (*param_optind <= 1 || *optoff < 0 || strlen(optnext[-1]) < *optoff)
+    if (*param_optind <= 1 || *optoff < 0 || (int)strlen(optnext[-1]) < *optoff)
         p = NULL;
     else
@@ -9209 +10274 @@
 
     c = *p++;
-    for (q = optstr; *q != c; ) {
+    for (q = optstr; *q != c;) {
         if (*q == '\0') {
             if (optstr[0] == ':') {
@@ -9270 +10335 @@
  * then it's the first time getopts has been called.
  */
-static int
+static int FAST_FUNC
 getoptscmd(int argc, char **argv)
 {
@@ -9299 +10364 @@
 /* ============ Shell parser */
 
-static int tokpushback;                /* last token pushed back */
-#define NEOF ((union node *)&tokpushback)
-static int parsebackquote;             /* nonzero if we are inside backquotes */
-static int lasttoken;                  /* last token read */
+struct heredoc {
+    struct heredoc *next;   /* next here document in list */
+    union node *here;       /* redirection node */
+    char *eofmark;          /* string indicating end of input */
+    smallint striptabs;     /* if set, strip leading tabs */
+};
+
+static smallint tokpushback;           /* last token pushed back */
+static smallint parsebackquote;        /* nonzero if we are inside backquotes */
+static smallint quoteflag;             /* set if (part of) last token was quoted */
+static token_id_t lasttoken;           /* last token read (integer id Txxx) */
+static struct heredoc *heredoclist;    /* list of here documents to read */
 static char *wordtext;                 /* text of last word returned by readtoken */
 static struct nodelist *backquotelist;
 static union node *redirnode;
 static struct heredoc *heredoc;
-static int quoteflag;                  /* set if (part of) last token was quoted */
-
-static void raise_error_syntax(const char *) ATTRIBUTE_NORETURN;
-static void
-raise_error_syntax(const char *msg)
-{
-    ash_msg_and_raise_error("syntax error: %s", msg);
-    /* NOTREACHED */
-}
-
-/*
+
+static const char *
+tokname(char *buf, int tok)
+{
+    if (tok < TSEMI)
+        return tokname_array[tok] + 1;
+    sprintf(buf, "\"%s\"", tokname_array[tok] + 1);
+    return buf;
+}
+
+/* raise_error_unexpected_syntax:
  * Called when an unexpected token is read during the parse.  The argument
  * is the token that is expected, or -1 if more than one type of token can
  * occur at this point.
  */
-static void raise_error_unexpected_syntax(int) ATTRIBUTE_NORETURN;
+static void raise_error_unexpected_syntax(int) NORETURN;
 static void
 raise_error_unexpected_syntax(int token)
 {
     char msg[64];
+    char buf[16];
     int l;
 
-    l = sprintf(msg, "%s unexpected", tokname(lasttoken));
+    l = sprintf(msg, "unexpected %s", tokname(buf, lasttoken));
     if (token >= 0)
-        sprintf(msg + l, " (expecting %s)", tokname(token));
+        sprintf(msg + l, " (expecting %s)", tokname(buf, token));
     raise_error_syntax(msg);
     /* NOTREACHED */
@@ -9337 +10411 @@
 
 #define EOFMARKLEN 79
-
-struct heredoc {
-    struct heredoc *next;   /* next here document in list */
-    union node *here;               /* redirection node */
-    char *eofmark;          /* string indicating end of input */
-    int striptabs;          /* if set, strip leading tabs */
-};
-
-static struct heredoc *heredoclist;    /* list of here documents to read */
 
 /* parsing is heavily cross-recursive, need these forward decls */
@@ -9370 +10435 @@
         if (tok == TBACKGND) {
             if (n2->type == NPIPE) {
-                n2->npipe.backgnd = 1;
+                n2->npipe.pipe_backgnd = 1;
             } else {
                 if (n2->type != NREDIR) {
-                    n3 = stalloc(sizeof(struct nredir));
+                    n3 = stzalloc(sizeof(struct nredir));
                     n3->nredir.n = n2;
-                    n3->nredir.redirect = NULL;
+                    /*n3->nredir.redirect = NULL; - stzalloc did it */
                     n2 = n3;
                 }
@@ -9384 +10449 @@
             n1 = n2;
         } else {
-            n3 = stalloc(sizeof(struct nbinary));
+            n3 = stzalloc(sizeof(struct nbinary));
             n3->type = NSEMI;
             n3->nbinary.ch1 = n1;
@@ -9401 +10466 @@
                     return n1;
             } else {
-                tokpushback++;
+                tokpushback = 1;
             }
             checkkwd = CHKNL | CHKKWD | CHKALIAS;
@@ -9416 +10481 @@
             if (nlflag == 1)
                 raise_error_unexpected_syntax(-1);
-            tokpushback++;
+            tokpushback = 1;
             return n1;
         }
@@ -9436 +10501 @@
             t = NOR;
         } else {
-            tokpushback++;
+            tokpushback = 1;
             return n1;
         }
         checkkwd = CHKNL | CHKKWD | CHKALIAS;
         n2 = pipeline();
-        n3 = stalloc(sizeof(struct nbinary));
+        n3 = stzalloc(sizeof(struct nbinary));
         n3->type = t;
         n3->nbinary.ch1 = n1;
@@ -9462 +10527 @@
         checkkwd = CHKKWD | CHKALIAS;
     } else
-        tokpushback++;
+        tokpushback = 1;
     n1 = parse_command();
     if (readtoken() == TPIPE) {
-        pipenode = stalloc(sizeof(struct npipe));
+        pipenode = stzalloc(sizeof(struct npipe));
         pipenode->type = NPIPE;
-        pipenode->npipe.backgnd = 0;
-        lp = stalloc(sizeof(struct nodelist));
+        /*pipenode->npipe.pipe_backgnd = 0; - stzalloc did it */
+        lp = stzalloc(sizeof(struct nodelist));
         pipenode->npipe.cmdlist = lp;
         lp->n = n1;
         do {
             prev = lp;
-            lp = stalloc(sizeof(struct nodelist));
+            lp = stzalloc(sizeof(struct nodelist));
             checkkwd = CHKNL | CHKKWD | CHKALIAS;
             lp->n = parse_command();
@@ -9481 +10546 @@
         n1 = pipenode;
     }
-    tokpushback++;
+    tokpushback = 1;
     if (negate) {
-        n2 = stalloc(sizeof(struct nnot));
+        n2 = stzalloc(sizeof(struct nnot));
         n2->type = NNOT;
         n2->nnot.com = n1;
@@ -9496 +10561 @@
     union node *n;
 
-    n = stalloc(sizeof(struct narg));
+    n = stzalloc(sizeof(struct narg));
     n->type = NARG;
-    n->narg.next = NULL;
+    /*n->narg.next = NULL; - stzalloc did it */
     n->narg.text = wordtext;
     n->narg.backquote = backquotelist;
@@ -9507 +10572 @@
 fixredir(union node *n, const char *text, int err)
 {
+    int fd;
+
     TRACE(("Fix redir %s %d\n", text, err));
     if (!err)
         n->ndup.vname = NULL;
 
-    if (isdigit(text[0]) && text[1] == '\0')
-        n->ndup.dupfd = text[0] - '0';
+    fd = bb_strtou(text, NULL, 10);
+    if (!errno && fd >= 0)
+        n->ndup.dupfd = fd;
     else if (LONE_DASH(text))
         n->ndup.dupfd = -1;
     else {
         if (err)
-            raise_error_syntax("Bad fd number");
+            raise_error_syntax("bad fd number");
         n->ndup.vname = makename();
     }
@@ -9527 +10595 @@
  */
 static int
-noexpand(char *text)
-{
-    char *p;
-    char c;
-
-    p = text;
-    while ((c = *p++) != '\0') {
+noexpand(const char *text)
+{
+    unsigned char c;
+
+    while ((c = *text++) != '\0') {
         if (c == CTLQUOTEMARK)
             continue;
         if (c == CTLESC)
-            p++;
+            text++;
         else if (SIT(c, BASESYNTAX) == CCTL)
             return 0;
@@ -9560 +10626 @@
         TRACE(("Here document %d\n", n->type));
         if (!noexpand(wordtext) || (i = strlen(wordtext)) == 0 || i > EOFMARKLEN)
-            raise_error_syntax("Illegal eof marker for << redirection");
-        rmescapes(wordtext);
+            raise_error_syntax("illegal eof marker for << redirection");
+        rmescapes(wordtext, 0);
         here->eofmark = wordtext;
         here->next = NULL;
@@ -9567 +10633 @@
             heredoclist = here;
         else {
-            for (p = heredoclist; p->next; p = p->next);
+            for (p = heredoclist; p->next; p = p->next)
+                continue;
             p->next = here;
         }
@@ -9585 +10652 @@
     union node **rpp, *redir;
     int savecheckkwd;
+#if ENABLE_ASH_BASH_COMPAT
+    smallint double_brackets_flag = 0;
+#endif
 
     args = NULL;
@@ -9595 +10665 @@
     savecheckkwd = CHKALIAS;
     for (;;) {
+        int t;
         checkkwd = savecheckkwd;
-        switch (readtoken()) {
+        t = readtoken();
+        switch (t) {
+#if ENABLE_ASH_BASH_COMPAT
+        case TAND: /* "&&" */
+        case TOR: /* "||" */
+            if (!double_brackets_flag) {
+                tokpushback = 1;
+                goto out;
+            }
+            wordtext = (char *) (t == TAND ? "-a" : "-o");
+#endif
         case TWORD:
-            n = stalloc(sizeof(struct narg));
+            n = stzalloc(sizeof(struct narg));
             n->type = NARG;
+            /*n->narg.next = NULL; - stzalloc did it */
             n->narg.text = wordtext;
+#if ENABLE_ASH_BASH_COMPAT
+            if (strcmp("[[", wordtext) == 0)
+                double_brackets_flag = 1;
+            else if (strcmp("]]", wordtext) == 0)
+                double_brackets_flag = 0;
+#endif
             n->narg.backquote = backquotelist;
             if (savecheckkwd && isassignment(wordtext)) {
@@ -9630 +10718 @@
                  || ((bcmd = find_builtin(name)) && IS_BUILTIN_SPECIAL(bcmd))
                 ) {
-                    raise_error_syntax("Bad function name");
+                    raise_error_syntax("bad function name");
                 }
                 n->type = NDEFUN;
@@ -9639 +10727 @@
             /* fall through */
         default:
-            tokpushback++;
+            tokpushback = 1;
             goto out;
         }
@@ -9647 +10735 @@
     *vpp = NULL;
     *rpp = NULL;
-    n = stalloc(sizeof(struct ncmd));
+    n = stzalloc(sizeof(struct ncmd));
     n->type = NCMD;
     n->ncmd.args = args;
@@ -9673 +10761 @@
         /* NOTREACHED */
     case TIF:
-        n1 = stalloc(sizeof(struct nif));
+        n1 = stzalloc(sizeof(struct nif));
         n1->type = NIF;
         n1->nif.test = list(0);
@@ -9681 +10769 @@
         n2 = n1;
         while (readtoken() == TELIF) {
-            n2->nif.elsepart = stalloc(sizeof(struct nif));
+            n2->nif.elsepart = stzalloc(sizeof(struct nif));
             n2 = n2->nif.elsepart;
             n2->type = NIF;
@@ -9693 +10781 @@
         else {
             n2->nif.elsepart = NULL;
-            tokpushback++;
+            tokpushback = 1;
         }
         t = TFI;
@@ -9700 +10788 @@
     case TUNTIL: {
         int got;
-        n1 = stalloc(sizeof(struct nbinary));
+        n1 = stzalloc(sizeof(struct nbinary));
         n1->type = (lasttoken == TWHILE) ? NWHILE : NUNTIL;
         n1->nbinary.ch1 = list(0);
         got = readtoken();
         if (got != TDO) {
-            TRACE(("expecting DO got %s %s\n", tokname(got),
+            TRACE(("expecting DO got '%s' %s\n", tokname_array[got] + 1,
                     got == TWORD ? wordtext : ""));
             raise_error_unexpected_syntax(TDO);
@@ -9714 +10802 @@
     }
     case TFOR:
-        if (readtoken() != TWORD || quoteflag || ! goodname(wordtext))
-            raise_error_syntax("Bad for loop variable");
-        n1 = stalloc(sizeof(struct nfor));
+        if (readtoken() != TWORD || quoteflag || !goodname(wordtext))
+            raise_error_syntax("bad for loop variable");
+        n1 = stzalloc(sizeof(struct nfor));
         n1->type = NFOR;
         n1->nfor.var = wordtext;
@@ -9723 +10811 @@
             app = &ap;
             while (readtoken() == TWORD) {
-                n2 = stalloc(sizeof(struct narg));
+                n2 = stzalloc(sizeof(struct narg));
                 n2->type = NARG;
+                /*n2->narg.next = NULL; - stzalloc did it */
                 n2->narg.text = wordtext;
                 n2->narg.backquote = backquotelist;
@@ -9735 +10824 @@
                 raise_error_unexpected_syntax(-1);
         } else {
-            n2 = stalloc(sizeof(struct narg));
+            n2 = stzalloc(sizeof(struct narg));
             n2->type = NARG;
+            /*n2->narg.next = NULL; - stzalloc did it */
             n2->narg.text = (char *)dolatstr;
-            n2->narg.backquote = NULL;
-            n2->narg.next = NULL;
+            /*n2->narg.backquote = NULL;*/
             n1->nfor.args = n2;
             /*
@@ -9746 +10835 @@
              */
             if (lasttoken != TNL && lasttoken != TSEMI)
-                tokpushback++;
+                tokpushback = 1;
         }
         checkkwd = CHKNL | CHKKWD | CHKALIAS;
@@ -9755 +10844 @@
         break;
     case TCASE:
-        n1 = stalloc(sizeof(struct ncase));
+        n1 = stzalloc(sizeof(struct ncase));
         n1->type = NCASE;
         if (readtoken() != TWORD)
             raise_error_unexpected_syntax(TWORD);
-        n1->ncase.expr = n2 = stalloc(sizeof(struct narg));
+        n1->ncase.expr = n2 = stzalloc(sizeof(struct narg));
         n2->type = NARG;
+        /*n2->narg.next = NULL; - stzalloc did it */
         n2->narg.text = wordtext;
         n2->narg.backquote = backquotelist;
-        n2->narg.next = NULL;
         do {
             checkkwd = CHKKWD | CHKALIAS;
@@ -9776 +10865 @@
             if (lasttoken == TLP)
                 readtoken();
-            *cpp = cp = stalloc(sizeof(struct nclist));
+            *cpp = cp = stzalloc(sizeof(struct nclist));
             cp->type = NCLIST;
             app = &cp->nclist.pattern;
             for (;;) {
-                *app = ap = stalloc(sizeof(struct narg));
+                *app = ap = stzalloc(sizeof(struct narg));
                 ap->type = NARG;
+                /*ap->narg.next = NULL; - stzalloc did it */
                 ap->narg.text = wordtext;
                 ap->narg.backquote = backquotelist;
@@ -9789 +10879 @@
                 readtoken();
             }
-            ap->narg.next = NULL;
+            //ap->narg.next = NULL;
             if (lasttoken != TRP)
                 raise_error_unexpected_syntax(TRP);
@@ -9807 +10897 @@
         goto redir;
     case TLP:
-        n1 = stalloc(sizeof(struct nredir));
+        n1 = stzalloc(sizeof(struct nredir));
         n1->type = NSUBSHELL;
         n1->nredir.n = list(0);
-        n1->nredir.redirect = NULL;
+        /*n1->nredir.redirect = NULL; - stzalloc did it */
         t = TRP;
         break;
@@ -9819 +10909 @@
     case TWORD:
     case TREDIR:
-        tokpushback++;
+        tokpushback = 1;
         return simplecmd();
     }
@@ -9835 +10925 @@
         parsefname();
     }
-    tokpushback++;
+    tokpushback = 1;
     *rpp = NULL;
     if (redir) {
         if (n1->type != NSUBSHELL) {
-            n2 = stalloc(sizeof(struct nredir));
+            n2 = stzalloc(sizeof(struct nredir));
             n2->type = NREDIR;
             n2->nredir.n = n1;
@@ -9849 +10939 @@
 }
 
+#if ENABLE_ASH_BASH_COMPAT
+static int decode_dollar_squote(void)
+{
+    static const char C_escapes[] ALIGN1 = "nrbtfav""x\\01234567";
+    int c, cnt;
+    char *p;
+    char buf[4];
+
+    c = pgetc();
+    p = strchr(C_escapes, c);
+    if (p) {
+        buf[0] = c;
+        p = buf;
+        cnt = 3;
+        if ((unsigned char)(c - '0') <= 7) { /* \ooo */
+            do {
+                c = pgetc();
+                *++p = c;
+            } while ((unsigned char)(c - '0') <= 7 && --cnt);
+            pungetc();
+        } else if (c == 'x') { /* \xHH */
+            do {
+                c = pgetc();
+                *++p = c;
+            } while (isxdigit(c) && --cnt);
+            pungetc();
+            if (cnt == 3) { /* \x but next char is "bad" */
+                c = 'x';
+                goto unrecognized;
+            }
+        } else { /* simple seq like \\ or \t */
+            p++;
+        }
+        *p = '\0';
+        p = buf;
+        c = bb_process_escape_sequence((void*)&p);
+    } else { /* unrecognized "\z": print both chars unless ' or " */
+        if (c != '\'' && c != '"') {
+ unrecognized:
+            c |= 0x100; /* "please encode \, then me" */
+        }
+    }
+    return c;
+}
+#endif
+
 /*
  * If eofmark is NULL, read a word or a redirection symbol.  If eofmark
  * is not NULL, read a here document.  In the latter case, eofmark is the
  * word which marks the end of the document and striptabs is true if
- * leading tabs should be stripped from the document.  The argument firstc
+ * leading tabs should be stripped from the document.  The argument c
  * is the first character of the input token or document.
  *
@@ -9860 +10996 @@
  * will run code that appears at the end of readtoken1.
  */
-
-static int parsebackquote;             /* nonzero if we are inside backquotes */
-
 #define CHECKEND()      {goto checkend; checkend_return:;}
 #define PARSEREDIR()    {goto parseredir; parseredir_return:;}
@@ -9869 +11002 @@
 #define PARSEBACKQNEW() {oldstyle = 0; goto parsebackq; parsebackq_newreturn:;}
 #define PARSEARITH()    {goto parsearith; parsearith_return:;}
-
 static int
-readtoken1(int firstc, int syntax, char *eofmark, int striptabs)
-{
-    int c = firstc;
+readtoken1(int c, int syntax, char *eofmark, int striptabs)
+{
+    /* NB: syntax parameter fits into smallint */
+    /* c parameter is an unsigned char or PEOF or PEOA */
     char *out;
     int len;
     char line[EOFMARKLEN + 1];
-    struct nodelist *bqlist = 0;
-    int quotef = 0;
-    int dblquote = 0;
-    int varnest = 0;    /* levels of variables expansion */
-    int arinest = 0;    /* levels of arithmetic expansion */
-    int parenlevel = 0; /* levels of parens in arithmetic */
-    int dqvarnest = 0;  /* levels of variables expansion within double quotes */
-    int oldstyle = 0;
-    int prevsyntax = 0; /* syntax before arithmetic */
+    struct nodelist *bqlist;
+    smallint quotef;
+    smallint dblquote;
+    smallint oldstyle;
+    smallint prevsyntax; /* syntax before arithmetic */
+#if ENABLE_ASH_EXPAND_PRMT
+    smallint pssyntax;   /* we are expanding a prompt string */
+#endif
+    int varnest;         /* levels of variables expansion */
+    int arinest;         /* levels of arithmetic expansion */
+    int parenlevel;      /* levels of parens in arithmetic */
+    int dqvarnest;       /* levels of variables expansion within double quotes */
+
+    IF_ASH_BASH_COMPAT(smallint bash_dollar_squote = 0;)
+
 #if __GNUC__
     /* Avoid longjmp clobbering */
@@ -9899 +11038 @@
     (void) &syntax;
 #endif
-
-    startlinno = plinno;
-    dblquote = 0;
-    if (syntax == DQSYNTAX)
-        dblquote = 1;
+    startlinno = g_parsefile->linno;
+    bqlist = NULL;
     quotef = 0;
-    bqlist = NULL;
+    prevsyntax = 0;
+#if ENABLE_ASH_EXPAND_PRMT
+    pssyntax = (syntax == PSSYNTAX);
+    if (pssyntax)
+        syntax = DQSYNTAX;
+#endif
+    dblquote = (syntax == DQSYNTAX);
     varnest = 0;
     arinest = 0;
@@ -9912 +11054 @@
 
     STARTSTACKSTR(out);
-    loop: { /* for each line, until end of word */
-        CHECKEND();     /* set c to PEOF if at end of here document */
-        for (;;) {      /* until end of line or end of word */
-            CHECKSTRSPACE(4, out);  /* permit 4 calls to USTPUTC */
-            switch (SIT(c, syntax)) {
-            case CNL:       /* '\n' */
-                if (syntax == BASESYNTAX)
-                    goto endword;   /* exit outer loop */
-                USTPUTC(c, out);
-                plinno++;
-                if (doprompt)
-                    setprompt(2);
-                c = pgetc();
-                goto loop;              /* continue outer loop */
-            case CWORD:
-                USTPUTC(c, out);
-                break;
-            case CCTL:
-                if (eofmark == NULL || dblquote)
+ loop:
+    /* For each line, until end of word */
+    CHECKEND();     /* set c to PEOF if at end of here document */
+    for (;;) {      /* until end of line or end of word */
+        CHECKSTRSPACE(4, out);  /* permit 4 calls to USTPUTC */
+        switch (SIT(c, syntax)) {
+        case CNL:       /* '\n' */
+            if (syntax == BASESYNTAX)
+                goto endword;   /* exit outer loop */
+            USTPUTC(c, out);
+            g_parsefile->linno++;
+            setprompt_if(doprompt, 2);
+            c = pgetc();
+            goto loop;              /* continue outer loop */
+        case CWORD:
+            USTPUTC(c, out);
+            break;
+        case CCTL:
+            if (eofmark == NULL || dblquote)
+                USTPUTC(CTLESC, out);
+#if ENABLE_ASH_BASH_COMPAT
+            if (c == '\\' && bash_dollar_squote) {
+                c = decode_dollar_squote();
+                if (c & 0x100) {
+                    USTPUTC('\\', out);
+                    c = (unsigned char)c;
+                }
+            }
+#endif
+            USTPUTC(c, out);
+            break;
+        case CBACK:     /* backslash */
+            c = pgetc_without_PEOA();
+            if (c == PEOF) {
+                USTPUTC(CTLESC, out);
+                USTPUTC('\\', out);
+                pungetc();
+            } else if (c == '\n') {
+                setprompt_if(doprompt, 2);
+            } else {
+#if ENABLE_ASH_EXPAND_PRMT
+                if (c == '$' && pssyntax) {
+                    USTPUTC(CTLESC, out);
+                    USTPUTC('\\', out);
+                }
+#endif
+                /* Backslash is retained if we are in "str" and next char isn't special */
+                if (dblquote
+                 && c != '\\'
+                 && c != '`'
+                 && c != '$'
+                 && (c != '"' || eofmark != NULL)
+                ) {
+                    USTPUTC(CTLESC, out);
+                    USTPUTC('\\', out);
+                }
+                if (SIT(c, SQSYNTAX) == CCTL)
                     USTPUTC(CTLESC, out);
                 USTPUTC(c, out);
-                break;
-            case CBACK:     /* backslash */
-                c = pgetc2();
-                if (c == PEOF) {
-                    USTPUTC(CTLESC, out);
-                    USTPUTC('\\', out);
+                quotef = 1;
+            }
+            break;
+        case CSQUOTE:
+            syntax = SQSYNTAX;
+ quotemark:
+            if (eofmark == NULL) {
+                USTPUTC(CTLQUOTEMARK, out);
+            }
+            break;
+        case CDQUOTE:
+            syntax = DQSYNTAX;
+            dblquote = 1;
+            goto quotemark;
+        case CENDQUOTE:
+            IF_ASH_BASH_COMPAT(bash_dollar_squote = 0;)
+            if (eofmark != NULL && arinest == 0
+             && varnest == 0
+            ) {
+                USTPUTC(c, out);
+            } else {
+                if (dqvarnest == 0) {
+                    syntax = BASESYNTAX;
+                    dblquote = 0;
+                }
+                quotef = 1;
+                goto quotemark;
+            }
+            break;
+        case CVAR:      /* '$' */
+            PARSESUB();             /* parse substitution */
+            break;
+        case CENDVAR:   /* '}' */
+            if (varnest > 0) {
+                varnest--;
+                if (dqvarnest > 0) {
+                    dqvarnest--;
+                }
+                c = CTLENDVAR;
+            }
+            USTPUTC(c, out);
+            break;
+#if ENABLE_SH_MATH_SUPPORT
+        case CLP:       /* '(' in arithmetic */
+            parenlevel++;
+            USTPUTC(c, out);
+            break;
+        case CRP:       /* ')' in arithmetic */
+            if (parenlevel > 0) {
+                parenlevel--;
+            } else {
+                if (pgetc() == ')') {
+                    if (--arinest == 0) {
+                        syntax = prevsyntax;
+                        dblquote = (syntax == DQSYNTAX);
+                        c = CTLENDARI;
+                    }
+                } else {
+                    /*
+                     * unbalanced parens
+                     * (don't 2nd guess - no error)
+                     */
                     pungetc();
-                } else if (c == '\n') {
-                    if (doprompt)
-                        setprompt(2);
-                } else {
-                    if (dblquote &&
-                        c != '\\' && c != '`' &&
-                        c != '$' && (
-                            c != '"' ||
-                            eofmark != NULL)
-                    ) {
-                        USTPUTC(CTLESC, out);
-                        USTPUTC('\\', out);
-                    }
-                    if (SIT(c, SQSYNTAX) == CCTL)
-                        USTPUTC(CTLESC, out);
-                    USTPUTC(c, out);
-                    quotef++;
                 }
-                break;
-            case CSQUOTE:
-                syntax = SQSYNTAX;
- quotemark:
-                if (eofmark == NULL) {
-                    USTPUTC(CTLQUOTEMARK, out);
+            }
+            USTPUTC(c, out);
+            break;
+#endif
+        case CBQUOTE:   /* '`' */
+            PARSEBACKQOLD();
+            break;
+        case CENDFILE:
+            goto endword;           /* exit outer loop */
+        case CIGN:
+            break;
+        default:
+            if (varnest == 0) {
+#if ENABLE_ASH_BASH_COMPAT
+                if (c == '&') {
+                    if (pgetc() == '>')
+                        c = 0x100 + '>'; /* flag &> */
+                    pungetc();
                 }
-                break;
-            case CDQUOTE:
-                syntax = DQSYNTAX;
-                dblquote = 1;
-                goto quotemark;
-            case CENDQUOTE:
-                if (eofmark != NULL && arinest == 0
-                 && varnest == 0
-                ) {
-                    USTPUTC(c, out);
-                } else {
-                    if (dqvarnest == 0) {
-                        syntax = BASESYNTAX;
-                        dblquote = 0;
-                    }
-                    quotef++;
-                    goto quotemark;
-                }
-                break;
-            case CVAR:      /* '$' */
-                PARSESUB();             /* parse substitution */
-                break;
-            case CENDVAR:   /* '}' */
-                if (varnest > 0) {
-                    varnest--;
-                    if (dqvarnest > 0) {
-                        dqvarnest--;
-                    }
-                    USTPUTC(CTLENDVAR, out);
-                } else {
-                    USTPUTC(c, out);
-                }
-                break;
-#if ENABLE_ASH_MATH_SUPPORT
-            case CLP:       /* '(' in arithmetic */
-                parenlevel++;
+#endif
+                goto endword;   /* exit outer loop */
+            }
+            IF_ASH_ALIAS(if (c != PEOA))
                 USTPUTC(c, out);
-                break;
-            case CRP:       /* ')' in arithmetic */
-                if (parenlevel > 0) {
-                    USTPUTC(c, out);
-                    --parenlevel;
-                } else {
-                    if (pgetc() == ')') {
-                        if (--arinest == 0) {
-                            USTPUTC(CTLENDARI, out);
-                            syntax = prevsyntax;
-                            if (syntax == DQSYNTAX)
-                                dblquote = 1;
-                            else
-                                dblquote = 0;
-                        } else
-                            USTPUTC(')', out);
-                    } else {
-                        /*
-                         * unbalanced parens
-                         *  (don't 2nd guess - no error)
-                         */
-                        pungetc();
-                        USTPUTC(')', out);
-                    }
-                }
-                break;
-#endif
-            case CBQUOTE:   /* '`' */
-                PARSEBACKQOLD();
-                break;
-            case CENDFILE:
-                goto endword;           /* exit outer loop */
-            case CIGN:
-                break;
-            default:
-                if (varnest == 0)
-                    goto endword;   /* exit outer loop */
-#if ENABLE_ASH_ALIAS
-                if (c != PEOA)
-#endif
-                    USTPUTC(c, out);
-
-            }
-            c = pgetc_macro();
-        }
-    }
+        }
+        c = pgetc_fast();
+    } /* for (;;) */
  endword:
-#if ENABLE_ASH_MATH_SUPPORT
+
+#if ENABLE_SH_MATH_SUPPORT
     if (syntax == ARISYNTAX)
-        raise_error_syntax("Missing '))'");
+        raise_error_syntax("missing '))'");
 #endif
     if (syntax != BASESYNTAX && !parsebackquote && eofmark == NULL)
-        raise_error_syntax("Unterminated quoted string");
+        raise_error_syntax("unterminated quoted string");
     if (varnest != 0) {
-        startlinno = plinno;
+        startlinno = g_parsefile->linno;
         /* { */
-        raise_error_syntax("Missing '}'");
+        raise_error_syntax("missing '}'");
     }
     USTPUTC('\0', out);
@@ -10064 +11221 @@
     out = stackblock();
     if (eofmark == NULL) {
-        if ((c == '>' || c == '<')
+        if ((c == '>' || c == '<' IF_ASH_BASH_COMPAT( || c == 0x100 + '>'))
          && quotef == 0
-         && len <= 2
-         && (*out == '\0' || isdigit(*out))) {
-            PARSEREDIR();
-            return lasttoken = TREDIR;
-        } else {
-            pungetc();
-        }
+        ) {
+            if (isdigit_str9(out)) {
+                PARSEREDIR(); /* passed as params: out, c */
+                lasttoken = TREDIR;
+                return lasttoken;
+            }
+            /* else: non-number X seen, interpret it
+             * as "NNNX>file" = "NNNX >file" */
+        }
+        pungetc();
     }
     quoteflag = quotef;
@@ -10090 +11250 @@
     if (eofmark) {
 #if ENABLE_ASH_ALIAS
-        if (c == PEOA) {
-            c = pgetc2();
-        }
+        if (c == PEOA)
+            c = pgetc_without_PEOA();
 #endif
         if (striptabs) {
             while (c == '\t') {
-                c = pgetc2();
+                c = pgetc_without_PEOA();
             }
         }
@@ -10104 +11263 @@
 
                 p = line;
-                for (q = eofmark + 1; *q && *p == *q; p++, q++);
+                for (q = eofmark + 1; *q && *p == *q; p++, q++)
+                    continue;
                 if (*p == '\n' && *q == '\0') {
                     c = PEOF;
-                    plinno++;
+                    g_parsefile->linno++;
                     needprompt = doprompt;
                 } else {
@@ -10124 +11284 @@
  */
 parseredir: {
-    char fd = *out;
+    /* out is already checked to be a valid number or "" */
+    int fd = (*out == '\0' ? -1 : atoi(out));
     union node *np;
 
-    np = stalloc(sizeof(struct nfile));
+    np = stzalloc(sizeof(struct nfile));
     if (c == '>') {
         np->nfile.fd = 1;
@@ -10137 +11298 @@
         else if (c == '&')
             np->type = NTOFD;
+            /* it also can be NTO2 (>&file), but we can't figure it out yet */
         else {
             np->type = NTO;
             pungetc();
         }
-    } else {        /* c == '<' */
-        np->nfile.fd = 0;
+    }
+#if ENABLE_ASH_BASH_COMPAT
+    else if (c == 0x100 + '>') { /* this flags &> redirection */
+        np->nfile.fd = 1;
+        pgetc(); /* this is '>', no need to check */
+        np->type = NTO2;
+    }
+#endif
+    else { /* c == '<' */
+        /*np->nfile.fd = 0; - stzalloc did it */
         c = pgetc();
         switch (c) {
         case '<':
             if (sizeof(struct nfile) != sizeof(struct nhere)) {
-                np = stalloc(sizeof(struct nhere));
-                np->nfile.fd = 0;
+                np = stzalloc(sizeof(struct nhere));
+                /*np->nfile.fd = 0; - stzalloc did it */
             }
             np->type = NHERE;
-            heredoc = stalloc(sizeof(struct heredoc));
+            heredoc = stzalloc(sizeof(struct heredoc));
             heredoc->here = np;
             c = pgetc();
@@ -10157 +11327 @@
                 heredoc->striptabs = 1;
             } else {
-                heredoc->striptabs = 0;
+                /*heredoc->striptabs = 0; - stzalloc did it */
                 pungetc();
             }
@@ -10176 +11346 @@
         }
     }
-    if (fd != '\0')
-        np->nfile.fd = fd - '0';
+    if (fd >= 0)
+        np->nfile.fd = fd;
     redirnode = np;
     goto parseredir_return;
@@ -10190 +11360 @@
  * (assuming ascii char codes, as the original implementation did) */
 #define is_special(c) \
-    ((((unsigned int)c) - 33 < 32) \
-            && ((0xc1ff920dUL >> (((unsigned int)c) - 33)) & 1))
+    (((unsigned)(c) - 33 < 32) \
+            && ((0xc1ff920dU >> ((unsigned)(c) - 33)) & 1))
 parsesub: {
-    int subtype;
+    unsigned char subtype;
     int typeloc;
     int flags;
-    char *p;
-    static const char types[] ALIGN1 = "}-+?=";
 
     c = pgetc();
-    if (
-        c <= PEOA_OR_PEOF  ||
-        (c != '(' && c != '{' && !is_name(c) && !is_special(c))
+    if (c > 255 /* PEOA or PEOF */
+     || (c != '(' && c != '{' && !is_name(c) && !is_special(c))
     ) {
-        USTPUTC('$', out);
+#if ENABLE_ASH_BASH_COMPAT
+        if (c == '\'')
+            bash_dollar_squote = 1;
+        else
+#endif
+            USTPUTC('$', out);
         pungetc();
-    } else if (c == '(') {  /* $(command) or $((arith)) */
+    } else if (c == '(') {
+        /* $(command) or $((arith)) */
         if (pgetc() == '(') {
-#if ENABLE_ASH_MATH_SUPPORT
+#if ENABLE_SH_MATH_SUPPORT
             PARSEARITH();
 #else
-            raise_error_syntax("We unsupport $((arith))");
+            raise_error_syntax("you disabled math support for $((arith)) syntax");
 #endif
         } else {
@@ -10218 +11391 @@
         }
     } else {
+        /* $VAR, $<specialchar>, ${...}, or PEOA/PEOF */
         USTPUTC(CTLVAR, out);
         typeloc = out - (char *)stackblock();
@@ -10227 +11401 @@
                 c = pgetc();
                 if (c == '}')
-                    c = '#';
+                    c = '#'; /* ${#} - same as $# */
                 else
-                    subtype = VSLENGTH;
-            } else
+                    subtype = VSLENGTH; /* ${#VAR} */
+            } else {
                 subtype = 0;
-        }
-        if (c > PEOA_OR_PEOF && is_name(c)) {
+            }
+        }
+        if (c <= 255 /* not PEOA or PEOF */ && is_name(c)) {
+            /* $[{[#]]NAME[}] */
             do {
                 STPUTC(c, out);
                 c = pgetc();
-            } while (c > PEOA_OR_PEOF && is_in_name(c));
+            } while (c <= 255 /* not PEOA or PEOF */ && is_in_name(c));
         } else if (isdigit(c)) {
+            /* $[{[#]]NUM[}] */
             do {
                 STPUTC(c, out);
@@ -10244 +11421 @@
             } while (isdigit(c));
         } else if (is_special(c)) {
+            /* $[{[#]]<specialchar>[}] */
             USTPUTC(c, out);
             c = pgetc();
-        } else
- badsub:        raise_error_syntax("Bad substitution");
+        } else {
+ badsub:
+            raise_error_syntax("bad substitution");
+        }
+        if (c != '}' && subtype == VSLENGTH) {
+            /* ${#VAR didn't end with } */
+            goto badsub;
+        }
 
         STPUTC('=', out);
         flags = 0;
         if (subtype == 0) {
+            /* ${VAR...} but not $VAR or ${#VAR} */
+            /* c == first char after VAR */
             switch (c) {
             case ':':
+                c = pgetc();
+#if ENABLE_ASH_BASH_COMPAT
+                if (c == ':' || c == '$' || isdigit(c)) {
+//TODO: support more general format ${v:EXPR:EXPR},
+// where EXPR follows $(()) rules
+                    subtype = VSSUBSTR;
+                    pungetc();
+                    break; /* "goto do_pungetc" is bigger (!) */
+                }
+#endif
                 flags = VSNUL;
-                c = pgetc();
                 /*FALLTHROUGH*/
-            default:
-                p = strchr(types, c);
+            default: {
+                static const char types[] ALIGN1 = "}-+?=";
+                const char *p = strchr(types, c);
                 if (p == NULL)
                     goto badsub;
                 subtype = p - types + VSNORMAL;
                 break;
+            }
             case '%':
-            case '#':
-                {
-                    int cc = c;
-                    subtype = c == '#' ? VSTRIMLEFT :
-                                         VSTRIMRIGHT;
-                    c = pgetc();
-                    if (c == cc)
-                        subtype++;
-                    else
-                        pungetc();
-                    break;
-                }
+            case '#': {
+                int cc = c;
+                subtype = (c == '#' ? VSTRIMLEFT : VSTRIMRIGHT);
+                c = pgetc();
+                if (c != cc)
+                    goto do_pungetc;
+                subtype++;
+                break;
+            }
+#if ENABLE_ASH_BASH_COMPAT
+            case '/':
+                /* ${v/[/]pattern/repl} */
+//TODO: encode pattern and repl separately.
+// Currently ${v/$var_with_slash/repl} is horribly broken
+                subtype = VSREPLACE;
+                c = pgetc();
+                if (c != '/')
+                    goto do_pungetc;
+                subtype++; /* VSREPLACEALL */
+                break;
+#endif
             }
         } else {
+ do_pungetc:
             pungetc();
         }
         if (dblquote || arinest)
             flags |= VSQUOTE;
-        *((char *)stackblock() + typeloc) = subtype | flags;
+        ((unsigned char *)stackblock())[typeloc] = subtype | flags;
         if (subtype != VSNORMAL) {
             varnest++;
@@ -10301 +11508 @@
 parsebackq: {
     struct nodelist **nlpp;
-    int savepbq;
+    smallint savepbq;
     union node *n;
     char *volatile str;
@@ -10307 +11514 @@
     struct jmploc *volatile savehandler;
     size_t savelen;
-    int saveprompt = 0;
+    smallint saveprompt = 0;
+
 #ifdef __GNUC__
     (void) &saveprompt;
 #endif
-
     savepbq = parsebackquote;
     if (setjmp(jmploc.loc)) {
-        if (str)
-            free(str);
+        free(str);
         parsebackquote = 0;
         exception_handler = savehandler;
@@ -10335 +11541 @@
            reread it as input, interpreting it normally.  */
         char *pout;
-        int pc;
         size_t psavelen;
         char *pstr;
 
-
         STARTSTACKSTR(pout);
         for (;;) {
-            if (needprompt) {
-                setprompt(2);
-            }
+            int pc;
+
+            setprompt_if(needprompt, 2);
             pc = pgetc();
             switch (pc) {
@@ -10353 +11557 @@
                 pc = pgetc();
                 if (pc == '\n') {
-                    plinno++;
-                    if (doprompt)
-                        setprompt(2);
+                    g_parsefile->linno++;
+                    setprompt_if(doprompt, 2);
                     /*
                      * If eating a newline, avoid putting
@@ -10365 +11568 @@
                 }
                 if (pc != '\\' && pc != '`' && pc != '$'
-                 && (!dblquote || pc != '"'))
+                 && (!dblquote || pc != '"')
+                ) {
                     STPUTC('\\', pout);
-                if (pc > PEOA_OR_PEOF) {
+                }
+                if (pc <= 255 /* not PEOA or PEOF */) {
                     break;
                 }
@@ -10373 +11578 @@
 
             case PEOF:
-#if ENABLE_ASH_ALIAS
-            case PEOA:
-#endif
-                startlinno = plinno;
+            IF_ASH_ALIAS(case PEOA:)
+                startlinno = g_parsefile->linno;
                 raise_error_syntax("EOF in backquote substitution");
 
             case '\n':
-                plinno++;
+                g_parsefile->linno++;
                 needprompt = doprompt;
                 break;
@@ -10400 +11603 @@
     while (*nlpp)
         nlpp = &(*nlpp)->next;
-    *nlpp = stalloc(sizeof(**nlpp));
-    (*nlpp)->next = NULL;
+    *nlpp = stzalloc(sizeof(**nlpp));
+    /* (*nlpp)->next = NULL; - stzalloc did it */
     parsebackquote = oldstyle;
 
@@ -10447 +11650 @@
 }
 
-#if ENABLE_ASH_MATH_SUPPORT
+#if ENABLE_SH_MATH_SUPPORT
 /*
  * Parse an arithmetic expansion (indicate start of one and set state)
@@ -10494 +11697 @@
 /* singles must be first! */
 static const char xxreadtoken_chars[7] ALIGN1 = {
-    '\n', '(', ')', '&', '|', ';', 0
+    '\n', '(', ')', /* singles */
+    '&', '|', ';',  /* doubles */
+    0
 };
+
+#define xxreadtoken_singles 3
+#define xxreadtoken_doubles 3
 
 static const char xxreadtoken_tokens[] ALIGN1 = {
@@ -10504 +11712 @@
 };
 
-#define xxreadtoken_doubles \
-    (sizeof(xxreadtoken_tokens) - sizeof(xxreadtoken_chars))
-#define xxreadtoken_singles \
-    (sizeof(xxreadtoken_chars) - xxreadtoken_doubles - 1)
-
 static int
 xxreadtoken(void)
@@ -10518 +11721 @@
         return lasttoken;
     }
-    if (needprompt) {
-        setprompt(2);
-    }
-    startlinno = plinno;
+    setprompt_if(needprompt, 2);
+    startlinno = g_parsefile->linno;
     for (;;) {                      /* until token or start of word found */
-        c = pgetc_macro();
-
-        if ((c != ' ') && (c != '\t')
-#if ENABLE_ASH_ALIAS
-         && (c != PEOA)
-#endif
-        ) {
-            if (c == '#') {
-                while ((c = pgetc()) != '\n' && c != PEOF);
+        c = pgetc_fast();
+        if (c == ' ' || c == '\t' IF_ASH_ALIAS( || c == PEOA))
+            continue;
+
+        if (c == '#') {
+            while ((c = pgetc()) != '\n' && c != PEOF)
+                continue;
+            pungetc();
+        } else if (c == '\\') {
+            if (pgetc() != '\n') {
                 pungetc();
-            } else if (c == '\\') {
-                if (pgetc() != '\n') {
-                    pungetc();
-                    goto READTOKEN1;
+                break; /* return readtoken1(...) */
+            }
+            startlinno = ++g_parsefile->linno;
+            setprompt_if(doprompt, 2);
+        } else {
+            const char *p;
+
+            p = xxreadtoken_chars + sizeof(xxreadtoken_chars) - 1;
+            if (c != PEOF) {
+                if (c == '\n') {
+                    g_parsefile->linno++;
+                    needprompt = doprompt;
                 }
-                startlinno = ++plinno;
-                if (doprompt)
-                    setprompt(2);
-            } else {
-                const char *p
-                    = xxreadtoken_chars + sizeof(xxreadtoken_chars) - 1;
-
-                if (c != PEOF) {
-                    if (c == '\n') {
-                        plinno++;
-                        needprompt = doprompt;
-                    }
-
-                    p = strchr(xxreadtoken_chars, c);
-                    if (p == NULL) {
- READTOKEN1:
-                        return readtoken1(c, BASESYNTAX, (char *) NULL, 0);
-                    }
-
-                    if (p - xxreadtoken_chars >= xxreadtoken_singles) {
-                        if (pgetc() == *p) {    /* double occurrence? */
-                            p += xxreadtoken_doubles + 1;
-                        } else {
-                            pungetc();
-                        }
+
+                p = strchr(xxreadtoken_chars, c);
+                if (p == NULL)
+                    break; /* return readtoken1(...) */
+
+                if ((int)(p - xxreadtoken_chars) >= xxreadtoken_singles) {
+                    int cc = pgetc();
+                    if (cc == c) {    /* double occurrence? */
+                        p += xxreadtoken_doubles + 1;
+                    } else {
+                        pungetc();
+#if ENABLE_ASH_BASH_COMPAT
+                        if (c == '&' && cc == '>') /* &> */
+                            break; /* return readtoken1(...) */
+#endif
                     }
                 }
-                return lasttoken = xxreadtoken_tokens[p - xxreadtoken_chars];
             }
-        }
-    } /* for */
-}
-#else
+            lasttoken = xxreadtoken_tokens[p - xxreadtoken_chars];
+            return lasttoken;
+        }
+    } /* for (;;) */
+
+    return readtoken1(c, BASESYNTAX, (char *) NULL, 0);
+}
+#else /* old xxreadtoken */
 #define RETURN(token)   return lasttoken = token
 static int
@@ -10581 +11784 @@
         return lasttoken;
     }
-    if (needprompt) {
-        setprompt(2);
-    }
-    startlinno = plinno;
+    setprompt_if(needprompt, 2);
+    startlinno = g_parsefile->linno;
     for (;;) {      /* until token or start of word found */
-        c = pgetc_macro();
+        c = pgetc_fast();
         switch (c) {
         case ' ': case '\t':
-#if ENABLE_ASH_ALIAS
-        case PEOA:
-#endif
+        IF_ASH_ALIAS(case PEOA:)
             continue;
         case '#':
-            while ((c = pgetc()) != '\n' && c != PEOF);
+            while ((c = pgetc()) != '\n' && c != PEOF)
+                continue;
             pungetc();
             continue;
         case '\\':
             if (pgetc() == '\n') {
-                startlinno = ++plinno;
-                if (doprompt)
-                    setprompt(2);
+                startlinno = ++g_parsefile->linno;
+                setprompt_if(doprompt, 2);
                 continue;
             }
@@ -10607 +11806 @@
             goto breakloop;
         case '\n':
-            plinno++;
+            g_parsefile->linno++;
             needprompt = doprompt;
             RETURN(TNL);
@@ -10639 +11838 @@
 #undef RETURN
 }
-#endif /* NEW_xxreadtoken */
+#endif /* old xxreadtoken */
 
 static int
@@ -10646 +11845 @@
     int t;
 #if DEBUG
-    int alreadyseen = tokpushback;
+    smallint alreadyseen = tokpushback;
 #endif
 
@@ -10678 +11877 @@
         if (pp) {
             lasttoken = t = pp - tokname_array;
-            TRACE(("keyword %s recognized\n", tokname(t)));
+            TRACE(("keyword '%s' recognized\n", tokname_array[t] + 1));
             goto out;
         }
@@ -10699 +11898 @@
 #if DEBUG
     if (!alreadyseen)
-        TRACE(("token %s %s\n", tokname(t), t == TWORD ? wordtext : ""));
+        TRACE(("token '%s' %s\n", tokname_array[t] + 1, t == TWORD ? wordtext : ""));
     else
-        TRACE(("reread token %s %s\n", tokname(t), t == TWORD ? wordtext : ""));
+        TRACE(("reread token '%s' %s\n", tokname_array[t] + 1, t == TWORD ? wordtext : ""));
 #endif
     return t;
@@ -10712 +11911 @@
 
     t = readtoken();
-    tokpushback++;
+    tokpushback = 1;
     return tokname_array[t][0];
 }
 
 /*
- * Read and parse a command.  Returns NEOF on end of file.  (NULL is a
- * valid parse tree indicating a blank line.)
+ * Read and parse a command.  Returns NODE_EOF on end of file.
+ * (NULL is a valid parse tree indicating a blank line.)
  */
 static union node *
@@ -10727 +11926 @@
     tokpushback = 0;
     doprompt = interact;
-    if (doprompt)
-        setprompt(doprompt);
+    setprompt_if(doprompt, doprompt);
     needprompt = 0;
     t = readtoken();
     if (t == TEOF)
-        return NEOF;
+        return NODE_EOF;
     if (t == TNL)
         return NULL;
-    tokpushback++;
+    tokpushback = 1;
     return list(1);
 }
@@ -10749 +11947 @@
 
     here = heredoclist;
-    heredoclist = 0;
+    heredoclist = NULL;
 
     while (here) {
-        if (needprompt) {
-            setprompt(2);
-        }
-        readtoken1(pgetc(), here->here->type == NHERE? SQSYNTAX : DQSYNTAX,
+        setprompt_if(needprompt, 2);
+        readtoken1(pgetc(), here->here->type == NHERE ? SQSYNTAX : DQSYNTAX,
                 here->eofmark, here->striptabs);
-        n = stalloc(sizeof(struct narg));
+        n = stzalloc(sizeof(struct narg));
         n->narg.type = NARG;
-        n->narg.next = NULL;
+        /*n->narg.next = NULL; - stzalloc did it */
         n->narg.text = wordtext;
         n->narg.backquote = backquotelist;
@@ -10777 +11973 @@
     union node n;
 
-    /* XXX Fix (char *) cast. */
+    /* XXX Fix (char *) cast. It _is_ a bug. ps is variable's value,
+     * and token processing _can_ alter it (delete NULs etc). */
     setinputstring((char *)ps);
-    readtoken1(pgetc(), DQSYNTAX, nullstr, 0);
+    readtoken1(pgetc(), PSSYNTAX, nullstr, 0);
     popfile();
 
@@ -10806 +12003 @@
 
     skip = 0;
-    while ((n = parsecmd(0)) != NEOF) {
+    while ((n = parsecmd(0)) != NODE_EOF) {
         evaltree(n, 0);
         popstackmark(&smark);
@@ -10823 +12020 @@
  * The eval command.
  */
-static int
-evalcmd(int argc, char **argv)
+static int FAST_FUNC
+evalcmd(int argc UNUSED_PARAM, char **argv)
 {
     char *p;
     char *concat;
-    char **ap;
-
-    if (argc > 1) {
+
+    if (argv[1]) {
         p = argv[1];
-        if (argc > 2) {
+        argv += 2;
+        if (argv[0]) {
             STARTSTACKSTR(concat);
-            ap = argv + 2;
             for (;;) {
                 concat = stack_putstr(p, concat);
-                p = *ap++;
+                p = *argv++;
                 if (p == NULL)
                     break;
@@ -10846 +12042 @@
         }
         evalstring(p, ~SKIPEVAL);
-
     }
     return exitstatus;
@@ -10852 +12047 @@
 
 /*
- * Read and execute commands.  "Top" is nonzero for the top level command
- * loop; it turns on prompting if the shell is interactive.
+ * Read and execute commands.
+ * "Top" is nonzero for the top level command loop;
+ * it turns on prompting if the shell is interactive.
  */
 static int
@@ -10869 +12065 @@
         setstackmark(&smark);
 #if JOBS
-        if (jobctl)
+        if (doing_jobctl)
             showjobs(stderr, SHOW_CHANGED);
 #endif
@@ -10880 +12076 @@
         }
         n = parsecmd(inter);
-        /* showtree(n); DEBUG */
-        if (n == NEOF) {
+#if DEBUG
+        if (DEBUG > 2 && debug && (n != NODE_EOF))
+            showtree(n);
+#endif
+        if (n == NODE_EOF) {
             if (!top || numeof >= 50)
                 break;
@@ -10922 +12121 @@
         return name;
 
-    while ((fullname = padvance(&path, name)) != NULL) {
+    /* IIRC standards do not say whether . is to be searched.
+     * And it is even smaller this way, making it unconditional for now:
+     */
+    if (1) { /* ENABLE_ASH_BASH_COMPAT */
+        fullname = name;
+        goto try_cur_dir;
+    }
+
+    while ((fullname = path_advance(&path, name)) != NULL) {
+ try_cur_dir:
         if ((stat(fullname, &statb) == 0) && S_ISREG(statb.st_mode)) {
             /*
@@ -10930 +12138 @@
             return fullname;
         }
-        stunalloc(fullname);
+        if (fullname != name)
+            stunalloc(fullname);
     }
 
@@ -10938 +12147 @@
 }
 
-static int
+static int FAST_FUNC
 dotcmd(int argc, char **argv)
 {
+    char *fullname;
     struct strlist *sp;
     volatile struct shparam saveparam;
-    int status = 0;
 
     for (sp = cmdenviron; sp; sp = sp->next)
         setvareq(ckstrdup(sp->text), VSTRFIXED | VTEXTFIXED);
 
-    if (argc >= 2) {        /* That's what SVR2 does */
-        char *fullname;
-
-        fullname = find_dot_file(argv[1]);
-
-        if (argc > 2) {
-            saveparam = shellparam;
-            shellparam.malloc = 0;
-            shellparam.nparam = argc - 2;
-            shellparam.p = argv + 2;
-        };
-
-        setinputfile(fullname, INPUT_PUSH_FILE);
-        commandname = fullname;
-        cmdloop(0);
-        popfile();
-
-        if (argc > 2) {
-            freeparam(&shellparam);
-            shellparam = saveparam;
-        };
-        status = exitstatus;
-    }
-    return status;
-}
-
-static int
-exitcmd(int argc, char **argv)
+    if (!argv[1]) {
+        /* bash says: "bash: .: filename argument required" */
+        return 2; /* bash compat */
+    }
+
+    /* "false; . empty_file; echo $?" should print 0, not 1: */
+    exitstatus = 0;
+
+    fullname = find_dot_file(argv[1]);
+
+    argv += 2;
+    argc -= 2;
+    if (argc) { /* argc > 0, argv[0] != NULL */
+        saveparam = shellparam;
+        shellparam.malloced = 0;
+        shellparam.nparam = argc;
+        shellparam.p = argv;
+    };
+
+    setinputfile(fullname, INPUT_PUSH_FILE);
+    commandname = fullname;
+    cmdloop(0);
+    popfile();
+
+    if (argc) {
+        freeparam(&shellparam);
+        shellparam = saveparam;
+    };
+
+    return exitstatus;
+}
+
+static int FAST_FUNC
+exitcmd(int argc UNUSED_PARAM, char **argv)
 {
     if (stoppedjobs())
         return 0;
-    if (argc > 1)
+    if (argv[1])
         exitstatus = number(argv[1]);
     raise_exception(EXEXIT);
     /* NOTREACHED */
 }
-
-#if ENABLE_ASH_BUILTIN_ECHO
-static int
-echocmd(int argc, char **argv)
-{
-    return bb_echo(argv);
-}
-#endif
-
-#if ENABLE_ASH_BUILTIN_TEST
-static int
-testcmd(int argc, char **argv)
-{
-    return test_main(argc, argv);
-}
-#endif
 
 /*
@@ -11099 +12298 @@
 
 #if ENABLE_FEATURE_SH_STANDALONE
-    if (find_applet_by_name(name)) {
-        entry->cmdtype = CMDNORMAL;
-        entry->u.index = -1;
-        return;
+    {
+        int applet_no = find_applet_by_name(name);
+        if (applet_no >= 0) {
+            entry->cmdtype = CMDNORMAL;
+            entry->u.index = -2 - applet_no;
+            return;
+        }
     }
 #endif
@@ -11118 +12320 @@
     idx = -1;
  loop:
-    while ((fullname = padvance(&path, name)) != NULL) {
+    while ((fullname = path_advance(&path, name)) != NULL) {
         stunalloc(fullname);
         /* NB: code below will still use fullname
@@ -11128 +12330 @@
                     goto builtin_success;
                 continue;
-            } else if (!(act & DO_NOFUNC)
-             && prefix(pathopt, "func")) {
-                /* handled below */
-            } else {
-                /* ignore unimplemented options */
+            }
+            if ((act & DO_NOFUNC)
+             || !prefix(pathopt, "func")
+            ) {     /* ignore unimplemented options */
                 continue;
             }
@@ -11212 +12413 @@
  * The trap builtin.
  */
-static int
-trapcmd(int argc, char **argv)
+static int FAST_FUNC
+trapcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     char *action;
     char **ap;
-    int signo;
+    int signo, exitcode;
 
     nextopt(nullstr);
@@ -11223 +12424 @@
     if (!*ap) {
         for (signo = 0; signo < NSIG; signo++) {
-            if (trap[signo] != NULL) {
-                const char *sn;
-
-                sn = get_signame(signo);
+            char *tr = trap_ptr[signo];
+            if (tr) {
+                /* note: bash adds "SIG", but only if invoked
+                 * as "bash". If called as "sh", or if set -o posix,
+                 * then it prints short signal names.
+                 * We are printing short names: */
                 out1fmt("trap -- %s %s\n",
-                    single_quote(trap[signo]), sn);
+                        single_quote(tr),
+                        get_signame(signo));
+        /* trap_ptr != trap only if we are in special-cased `trap` code.
+         * In this case, we will exit very soon, no need to free(). */
+                /* if (trap_ptr != trap && tp[0]) */
+                /*  free(tr); */
             }
         }
+        /*
+        if (trap_ptr != trap) {
+            free(trap_ptr);
+            trap_ptr = trap;
+        }
+        */
         return 0;
     }
-    if (!ap[1])
-        action = NULL;
-    else
+
+    action = NULL;
+    if (ap[1])
         action = *ap++;
+    exitcode = 0;
     while (*ap) {
         signo = get_signum(*ap);
-        if (signo < 0)
-            ash_msg_and_raise_error("%s: bad trap", *ap);
+        if (signo < 0) {
+            /* Mimic bash message exactly */
+            ash_msg("%s: invalid signal specification", *ap);
+            exitcode = 1;
+            goto next;
+        }
         INT_OFF;
         if (action) {
@@ -11248 +12467 @@
                 action = ckstrdup(action);
         }
-        if (trap[signo])
-            free(trap[signo]);
+        free(trap[signo]);
+        if (action)
+            may_have_traps = 1;
         trap[signo] = action;
         if (signo != 0)
             setsignal(signo);
         INT_ON;
+ next:
         ap++;
     }
-    return 0;
+    return exitcode;
 }
 
@@ -11266 +12487 @@
  * Lists available builtins
  */
-static int
-helpcmd(int argc, char **argv)
-{
-    int col, i;
-
-    out1fmt("\nBuilt-in commands:\n-------------------\n");
+static int FAST_FUNC
+helpcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
+{
+    unsigned col;
+    unsigned i;
+
+    out1fmt(
+        "Built-in commands:\n"
+        "------------------\n");
     for (col = 0, i = 0; i < ARRAY_SIZE(builtintab); i++) {
         col += out1fmt("%c%s", ((col == 0) ? '\t' : ' '),
@@ -11281 +12505 @@
     }
 #if ENABLE_FEATURE_SH_STANDALONE
-    for (i = 0; i < NUM_APPLETS; i++) {
-        col += out1fmt("%c%s", ((col == 0) ? '\t' : ' '), applets[i].name);
-        if (col > 60) {
-            out1fmt("\n");
-            col = 0;
+    {
+        const char *a = applet_names;
+        while (*a) {
+            col += out1fmt("%c%s", ((col == 0) ? '\t' : ' '), a);
+            if (col > 60) {
+                out1fmt("\n");
+                col = 0;
+            }
+            a += strlen(a) + 1;
         }
     }
@@ -11297 +12525 @@
  * The export and readonly commands.
  */
-static int
-exportcmd(int argc, char **argv)
+static int FAST_FUNC
+exportcmd(int argc UNUSED_PARAM, char **argv)
 {
     struct var *vp;
@@ -11304 +12532 @@
     const char *p;
     char **aptr;
-    int flag = argv[0][0] == 'r'? VREADONLY : VEXPORT;
+    int flag = argv[0][0] == 'r' ? VREADONLY : VEXPORT;
 
     if (nextopt("p") != 'p') {
@@ -11339 +12567 @@
 
     cmdp = cmdlookup(name, 0);
-    if (cmdp!= NULL && cmdp->cmdtype == CMDFUNCTION)
+    if (cmdp != NULL && cmdp->cmdtype == CMDFUNCTION)
         delete_cmd_entry();
 }
@@ -11348 +12576 @@
  * with the same name.
  */
-static int
-unsetcmd(int argc, char **argv)
+static int FAST_FUNC
+unsetcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 {
     char **ap;
@@ -11356 +12584 @@
     int ret = 0;
 
-    while ((i = nextopt("vf")) != '\0') {
+    while ((i = nextopt("vf")) != 0) {
         flag = i;
     }
@@ -11372 +12600 @@
     return ret & 1;
 }
-
-
-/*      setmode.c      */
-
-#include <sys/times.h>
 
 static const unsigned char timescmd_str[] ALIGN1 = {
@@ -11385 +12608 @@
     0
 };
-
-static int
-timescmd(int ac, char **av)
-{
-    long clk_tck, s, t;
+static int FAST_FUNC
+timescmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
+{
+    unsigned long clk_tck, s, t;
     const unsigned char *p;
     struct tms buf;
@@ -11400 +12622 @@
         t = *(clock_t *)(((char *) &buf) + p[1]);
         s = t / clk_tck;
-        out1fmt("%ldm%ld.%.3lds%c",
-            s/60, s%60,
-            ((t - s * clk_tck) * 1000) / clk_tck,
+        t = t % clk_tck;
+        out1fmt("%lum%lu.%03lus%c",
+            s / 60, s % 60,
+            (t * 1000) / clk_tck,
             p[0]);
-    } while (*(p += 2));
+        p += 2;
+    } while (*p);
 
     return 0;
 }
 
-#if ENABLE_ASH_MATH_SUPPORT
-static arith_t
-dash_arith(const char *s)
-{
-    arith_t result;
-    int errcode = 0;
-
-    INT_OFF;
-    result = arith(s, &errcode);
-    if (errcode < 0) {
-        if (errcode == -3)
-            ash_msg_and_raise_error("exponent less than 0");
-        if (errcode == -2)
-            ash_msg_and_raise_error("divide by zero");
-        if (errcode == -5)
-            ash_msg_and_raise_error("expression recursion loop detected");
-        raise_error_syntax(s);
-    }
-    INT_ON;
-
-    return result;
-}
-
-/*
- *  The let builtin. partial stolen from GNU Bash, the Bourne Again SHell.
- *  Copyright (C) 1987, 1989, 1991 Free Software Foundation, Inc.
+#if ENABLE_SH_MATH_SUPPORT
+/*
+ * The let builtin. Partially stolen from GNU Bash, the Bourne Again SHell.
+ * Copyright (C) 1987, 1989, 1991 Free Software Foundation, Inc.
  *
- *  Copyright (C) 2003 Vladimir Oleynik <dzo@simtreas.ru>
- */
-static int
-letcmd(int argc, char **argv)
-{
-    char **ap;
-    arith_t i = 0;
-
-    ap = argv + 1;
-    if (!*ap)
+ * Copyright (C) 2003 Vladimir Oleynik <dzo@simtreas.ru>
+ */
+static int FAST_FUNC
+letcmd(int argc UNUSED_PARAM, char **argv)
+{
+    arith_t i;
+
+    argv++;
+    if (!*argv)
         ash_msg_and_raise_error("expression expected");
-    for (ap = argv + 1; *ap; ap++) {
-        i = dash_arith(*ap);
-    }
+    do {
+        i = ash_arith(*argv);
+    } while (*++argv);
 
     return !i;
 }
-#endif /* ASH_MATH_SUPPORT */
-
-
-/* ============ miscbltin.c
- *
- * Miscellaneous builtins.
- */
-
-#undef rflag
-
-#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ < 1
-typedef enum __rlimit_resource rlim_t;
-#endif
-
-/*
- * The read builtin.  The -e option causes backslashes to escape the
- * following character.
- *
+#endif
+
+/*
+ * The read builtin. Options:
+ *      -r              Do not interpret '\' specially
+ *      -s              Turn off echo (tty only)
+ *      -n NCHARS       Read NCHARS max
+ *      -p PROMPT       Display PROMPT on stderr (if input is from tty)
+ *      -t SECONDS      Timeout after SECONDS (tty or pipe only)
+ *      -u FD           Read from given FD instead of fd 0
  * This uses unbuffered input, which may be avoidable in some cases.
- */
-static int
-readcmd(int argc, char **argv)
-{
-    char **ap;
-    int backslash;
-    char c;
-    int rflag;
-    char *prompt;
-    const char *ifs;
-    char *p;
-    int startword;
-    int status;
+ * TODO: bash also has:
+ *      -a ARRAY        Read into array[0],[1],etc
+ *      -d DELIM        End on DELIM char, not newline
+ *      -e              Use line editing (tty only)
+ */
+static int FAST_FUNC
+readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
+{
+    char *opt_n = NULL;
+    char *opt_p = NULL;
+    char *opt_t = NULL;
+    char *opt_u = NULL;
+    int read_flags = 0;
+    const char *r;
     int i;
-#if ENABLE_ASH_READ_NCHARS
-    int nch_flag = 0;
-    int nchars = 0;
-    int silent = 0;
-    struct termios tty, old_tty;
-#endif
-#if ENABLE_ASH_READ_TIMEOUT
-    fd_set set;
-    struct timeval ts;
-
-    ts.tv_sec = ts.tv_usec = 0;
-#endif
-
-    rflag = 0;
-    prompt = NULL;
-#if ENABLE_ASH_READ_NCHARS && ENABLE_ASH_READ_TIMEOUT
-    while ((i = nextopt("p:rt:n:s")) != '\0')
-#elif ENABLE_ASH_READ_NCHARS
-    while ((i = nextopt("p:rn:s")) != '\0')
-#elif ENABLE_ASH_READ_TIMEOUT
-    while ((i = nextopt("p:rt:")) != '\0')
-#else
-    while ((i = nextopt("p:r")) != '\0')
-#endif
-    {
+
+    while ((i = nextopt("p:u:rt:n:s")) != '\0') {
         switch (i) {
         case 'p':
-            prompt = optionarg;
+            opt_p = optionarg;
             break;
-#if ENABLE_ASH_READ_NCHARS
         case 'n':
-            nchars = strtol(optionarg, &p, 10);
-            if (*p)
-                ash_msg_and_raise_error("invalid count");
-            nch_flag = (nchars > 0);
+            opt_n = optionarg;
             break;
         case 's':
-            silent = 1;
+            read_flags |= BUILTIN_READ_SILENT;
             break;
-#endif
-#if ENABLE_ASH_READ_TIMEOUT
         case 't':
-            ts.tv_sec = strtol(optionarg, &p, 10);
-            ts.tv_usec = 0;
-            if (*p == '.') {
-                char *p2;
-                if (*++p) {
-                    int scale;
-                    ts.tv_usec = strtol(p, &p2, 10);
-                    if (*p2)
-                        ash_msg_and_raise_error("invalid timeout");
-                    scale = p2 - p;
-                    /* normalize to usec */
-                    if (scale > 6)
-                        ash_msg_and_raise_error("invalid timeout");
-                    while (scale++ < 6)
-                        ts.tv_usec *= 10;
-                }
-            } else if (*p) {
-                ash_msg_and_raise_error("invalid timeout");
-            }
-            if ( ! ts.tv_sec && ! ts.tv_usec)
-                ash_msg_and_raise_error("invalid timeout");
+            opt_t = optionarg;
             break;
-#endif
         case 'r':
-            rflag = 1;
+            read_flags |= BUILTIN_READ_RAW;
+            break;
+        case 'u':
+            opt_u = optionarg;
             break;
         default:
@@ -11558 +12705 @@
         }
     }
-    if (prompt && isatty(0)) {
-        out2str(prompt);
-    }
-    ap = argptr;
-    if (*ap == NULL)
-        ash_msg_and_raise_error("arg count");
-    ifs = bltinlookup("IFS");
-    if (ifs == NULL)
-        ifs = defifs;
-#if ENABLE_ASH_READ_NCHARS
-    if (nch_flag || silent) {
-        tcgetattr(0, &tty);
-        old_tty = tty;
-        if (nch_flag) {
-            tty.c_lflag &= ~ICANON;
-            tty.c_cc[VMIN] = nchars;
-        }
-        if (silent) {
-            tty.c_lflag &= ~(ECHO|ECHOK|ECHONL);
-
-        }
-        tcsetattr(0, TCSANOW, &tty);
-    }
-#endif
-#if ENABLE_ASH_READ_TIMEOUT
-    if (ts.tv_sec || ts.tv_usec) {
-        FD_ZERO(&set);
-        FD_SET(0, &set);
-
-        i = select(FD_SETSIZE, &set, NULL, NULL, &ts);
-        if (!i) {
-#if ENABLE_ASH_READ_NCHARS
-            if (nch_flag)
-                tcsetattr(0, TCSANOW, &old_tty);
-#endif
-            return 1;
-        }
-    }
-#endif
-    status = 0;
-    startword = 1;
-    backslash = 0;
-    STARTSTACKSTR(p);
-#if ENABLE_ASH_READ_NCHARS
-    while (!nch_flag || nchars--)
-#else
-    for (;;)
-#endif
-    {
-        if (read(0, &c, 1) != 1) {
-            status = 1;
-            break;
-        }
-        if (c == '\0')
-            continue;
-        if (backslash) {
-            backslash = 0;
-            if (c != '\n')
-                goto put;
-            continue;
-        }
-        if (!rflag && c == '\\') {
-            backslash++;
-            continue;
-        }
-        if (c == '\n')
-            break;
-        if (startword && *ifs == ' ' && strchr(ifs, c)) {
-            continue;
-        }
-        startword = 0;
-        if (ap[1] != NULL && strchr(ifs, c) != NULL) {
-            STACKSTRNUL(p);
-            setvar(*ap, stackblock(), 0);
-            ap++;
-            startword = 1;
-            STARTSTACKSTR(p);
-        } else {
- put:
-            STPUTC(c, p);
-        }
-    }
-#if ENABLE_ASH_READ_NCHARS
-    if (nch_flag || silent)
-        tcsetattr(0, TCSANOW, &old_tty);
-#endif
-
-    STACKSTRNUL(p);
-    /* Remove trailing blanks */
-    while ((char *)stackblock() <= --p && strchr(ifs, *p) != NULL)
-        *p = '\0';
-    setvar(*ap, stackblock(), 0);
-    while (*++ap != NULL)
-        setvar(*ap, nullstr, 0);
-    return status;
-}
-
-static int
-umaskcmd(int argc, char **argv)
+
+    r = shell_builtin_read(setvar2,
+        argptr,
+        bltinlookup("IFS"), /* can be NULL */
+        read_flags,
+        opt_n,
+        opt_p,
+        opt_t,
+        opt_u
+    );
+
+    if ((uintptr_t)r > 1)
+        ash_msg_and_raise_error(r);
+
+    return (uintptr_t)r;
+}
+
+static int FAST_FUNC
+umaskcmd(int argc UNUSED_PARAM, char **argv)
 {
     static const char permuser[3] ALIGN1 = "ugo";
@@ -11665 +12732 @@
         S_IROTH, S_IWOTH, S_IXOTH
     };
+
+    /* TODO: use bb_parse_mode() instead */
 
     char *ap;
@@ -11708 +12777 @@
             do {
                 if (*ap >= '8' || *ap < '0')
-                    ash_msg_and_raise_error(illnum, argv[1]);
+                    ash_msg_and_raise_error(msg_illnum, argv[1]);
                 mask = (mask << 3) + (*ap - '0');
             } while (*++ap != '\0');
@@ -11723 +12792 @@
 }
 
-/*
- * ulimit builtin
- *
- * This code, originally by Doug Gwyn, Doug Kingston, Eric Gisin, and
- * Michael Rendell was ripped from pdksh 5.0.8 and hacked for use with
- * ash by J.T. Conklin.
- *
- * Public domain.
- */
-
-struct limits {
-    const char *name;
-    int     cmd;
-    int     factor; /* multiply by to get rlim_{cur,max} values */
-    char    option;
-};
-
-static const struct limits limits[] = {
-#ifdef RLIMIT_CPU
-    { "time(seconds)",              RLIMIT_CPU,        1, 't' },
-#endif
-#ifdef RLIMIT_FSIZE
-    { "file(blocks)",               RLIMIT_FSIZE,    512, 'f' },
-#endif
-#ifdef RLIMIT_DATA
-    { "data(kbytes)",               RLIMIT_DATA,    1024, 'd' },
-#endif
-#ifdef RLIMIT_STACK
-    { "stack(kbytes)",              RLIMIT_STACK,   1024, 's' },
-#endif
-#ifdef  RLIMIT_CORE
-    { "coredump(blocks)",           RLIMIT_CORE,     512, 'c' },
-#endif
-#ifdef RLIMIT_RSS
-    { "memory(kbytes)",             RLIMIT_RSS,     1024, 'm' },
-#endif
-#ifdef RLIMIT_MEMLOCK
-    { "locked memory(kbytes)",      RLIMIT_MEMLOCK, 1024, 'l' },
-#endif
-#ifdef RLIMIT_NPROC
-    { "process",                    RLIMIT_NPROC,      1, 'p' },
-#endif
-#ifdef RLIMIT_NOFILE
-    { "nofiles",                    RLIMIT_NOFILE,     1, 'n' },
-#endif
-#ifdef RLIMIT_AS
-    { "vmemory(kbytes)",            RLIMIT_AS,      1024, 'v' },
-#endif
-#ifdef RLIMIT_LOCKS
-    { "locks",                      RLIMIT_LOCKS,      1, 'w' },
-#endif
-    { NULL,                         0,                 0,  '\0' }
-};
-
-enum limtype { SOFT = 0x1, HARD = 0x2 };
-
-static void
-printlim(enum limtype how, const struct rlimit *limit,
-            const struct limits *l)
-{
-    rlim_t val;
-
-    val = limit->rlim_max;
-    if (how & SOFT)
-        val = limit->rlim_cur;
-
-    if (val == RLIM_INFINITY)
-        out1fmt("unlimited\n");
-    else {
-        val /= l->factor;
-        out1fmt("%lld\n", (long long) val);
-    }
-}
-
-static int
-ulimitcmd(int argc, char **argv)
-{
-    int c;
-    rlim_t val = 0;
-    enum limtype how = SOFT | HARD;
-    const struct limits *l;
-    int set, all = 0;
-    int optc, what;
-    struct rlimit limit;
-
-    what = 'f';
-    while ((optc = nextopt("HSa"
-#ifdef RLIMIT_CPU
-                "t"
-#endif
-#ifdef RLIMIT_FSIZE
-                "f"
-#endif
-#ifdef RLIMIT_DATA
-                "d"
-#endif
-#ifdef RLIMIT_STACK
-                "s"
-#endif
-#ifdef RLIMIT_CORE
-                "c"
-#endif
-#ifdef RLIMIT_RSS
-                "m"
-#endif
-#ifdef RLIMIT_MEMLOCK
-                "l"
-#endif
-#ifdef RLIMIT_NPROC
-                "p"
-#endif
-#ifdef RLIMIT_NOFILE
-                "n"
-#endif
-#ifdef RLIMIT_AS
-                "v"
-#endif
-#ifdef RLIMIT_LOCKS
-                "w"
-#endif
-                    )) != '\0')
-        switch (optc) {
-        case 'H':
-            how = HARD;
-            break;
-        case 'S':
-            how = SOFT;
-            break;
-        case 'a':
-            all = 1;
-            break;
-        default:
-            what = optc;
-        }
-
-    for (l = limits; l->option != what; l++)
-        ;
-
-    set = *argptr ? 1 : 0;
-    if (set) {
-        char *p = *argptr;
-
-        if (all || argptr[1])
-            ash_msg_and_raise_error("too many arguments");
-        if (strncmp(p, "unlimited\n", 9) == 0)
-            val = RLIM_INFINITY;
-        else {
-            val = (rlim_t) 0;
-
-            while ((c = *p++) >= '0' && c <= '9') {
-                val = (val * 10) + (long)(c - '0');
-                if (val < (rlim_t) 0)
-                    break;
-            }
-            if (c)
-                ash_msg_and_raise_error("bad number");
-            val *= l->factor;
-        }
-    }
-    if (all) {
-        for (l = limits; l->name; l++) {
-            getrlimit(l->cmd, &limit);
-            out1fmt("%-20s ", l->name);
-            printlim(how, &limit, l);
-        }
-        return 0;
-    }
-
-    getrlimit(l->cmd, &limit);
-    if (set) {
-        if (how & HARD)
-            limit.rlim_max = val;
-        if (how & SOFT)
-            limit.rlim_cur = val;
-        if (setrlimit(l->cmd, &limit) < 0)
-            ash_msg_and_raise_error("error setting limit (%m)");
-    } else {
-        printlim(how, &limit, l);
-    }
-    return 0;
-}
-
-
-/* ============ Math support */
-
-#if ENABLE_ASH_MATH_SUPPORT
-
-/* Copyright (c) 2001 Aaron Lehmann <aaronl@vitelus.com>
-
-   Permission is hereby granted, free of charge, to any person obtaining
-   a copy of this software and associated documentation files (the
-   "Software"), to deal in the Software without restriction, including
-   without limitation the rights to use, copy, modify, merge, publish,
-   distribute, sublicense, and/or sell copies of the Software, and to
-   permit persons to whom the Software is furnished to do so, subject to
-   the following conditions:
-
-   The above copyright notice and this permission notice shall be
-   included in all copies or substantial portions of the Software.
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-   IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-   CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-   TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-/* This is my infix parser/evaluator. It is optimized for size, intended
- * as a replacement for yacc-based parsers. However, it may well be faster
- * than a comparable parser written in yacc. The supported operators are
- * listed in #defines below. Parens, order of operations, and error handling
- * are supported. This code is thread safe. The exact expression format should
- * be that which POSIX specifies for shells. */
-
-/* The code uses a simple two-stack algorithm. See
- * http://www.onthenet.com.au/~grahamis/int2008/week02/lect02.html
- * for a detailed explanation of the infix-to-postfix algorithm on which
- * this is based (this code differs in that it applies operators immediately
- * to the stack instead of adding them to a queue to end up with an
- * expression). */
-
-/* To use the routine, call it with an expression string and error return
- * pointer */
-
-/*
- * Aug 24, 2001              Manuel Novoa III
- *
- * Reduced the generated code size by about 30% (i386) and fixed several bugs.
- *
- * 1) In arith_apply():
- *    a) Cached values of *numptr and &(numptr[-1]).
- *    b) Removed redundant test for zero denominator.
- *
- * 2) In arith():
- *    a) Eliminated redundant code for processing operator tokens by moving
- *       to a table-based implementation.  Also folded handling of parens
- *       into the table.
- *    b) Combined all 3 loops which called arith_apply to reduce generated
- *       code size at the cost of speed.
- *
- * 3) The following expressions were treated as valid by the original code:
- *       1()  ,    0!  ,    1 ( *3 )   .
- *    These bugs have been fixed by internally enclosing the expression in
- *    parens and then checking that all binary ops and right parens are
- *    preceded by a valid expression (NUM_TOKEN).
- *
- * Note: It may be desirable to replace Aaron's test for whitespace with
- * ctype's isspace() if it is used by another busybox applet or if additional
- * whitespace chars should be considered.  Look below the "#include"s for a
- * precompiler test.
- */
-
-/*
- * Aug 26, 2001              Manuel Novoa III
- *
- * Return 0 for null expressions.  Pointed out by Vladimir Oleynik.
- *
- * Merge in Aaron's comments previously posted to the busybox list,
- * modified slightly to take account of my changes to the code.
- *
- */
-
-/*
- *  (C) 2003 Vladimir Oleynik <dzo@simtreas.ru>
- *
- * - allow access to variable,
- *   used recursive find value indirection (c=2*2; a="c"; $((a+=2)) produce 6)
- * - realize assign syntax (VAR=expr, +=, *= etc)
- * - realize exponentiation (** operator)
- * - realize comma separated - expr, expr
- * - realise ++expr --expr expr++ expr--
- * - realise expr ? expr : expr (but, second expr calculate always)
- * - allow hexadecimal and octal numbers
- * - was restored loses XOR operator
- * - remove one goto label, added three ;-)
- * - protect $((num num)) as true zero expr (Manuel`s error)
- * - always use special isspace(), see comment from bash ;-)
- */
-
-#define arith_isspace(arithval) \
-    (arithval == ' ' || arithval == '\n' || arithval == '\t')
-
-typedef unsigned char operator;
-
-/* An operator's token id is a bit of a bitfield. The lower 5 bits are the
- * precedence, and 3 high bits are an ID unique across operators of that
- * precedence. The ID portion is so that multiple operators can have the
- * same precedence, ensuring that the leftmost one is evaluated first.
- * Consider * and /. */
-
-#define tok_decl(prec,id) (((id)<<5)|(prec))
-#define PREC(op) ((op) & 0x1F)
-
-#define TOK_LPAREN tok_decl(0,0)
-
-#define TOK_COMMA tok_decl(1,0)
-
-#define TOK_ASSIGN tok_decl(2,0)
-#define TOK_AND_ASSIGN tok_decl(2,1)
-#define TOK_OR_ASSIGN tok_decl(2,2)
-#define TOK_XOR_ASSIGN tok_decl(2,3)
-#define TOK_PLUS_ASSIGN tok_decl(2,4)
-#define TOK_MINUS_ASSIGN tok_decl(2,5)
-#define TOK_LSHIFT_ASSIGN tok_decl(2,6)
-#define TOK_RSHIFT_ASSIGN tok_decl(2,7)
-
-#define TOK_MUL_ASSIGN tok_decl(3,0)
-#define TOK_DIV_ASSIGN tok_decl(3,1)
-#define TOK_REM_ASSIGN tok_decl(3,2)
-
-/* all assign is right associativity and precedence eq, but (7+3)<<5 > 256 */
-#define convert_prec_is_assing(prec) do { if (prec == 3) prec = 2; } while (0)
-
-/* conditional is right associativity too */
-#define TOK_CONDITIONAL tok_decl(4,0)
-#define TOK_CONDITIONAL_SEP tok_decl(4,1)
-
-#define TOK_OR tok_decl(5,0)
-
-#define TOK_AND tok_decl(6,0)
-
-#define TOK_BOR tok_decl(7,0)
-
-#define TOK_BXOR tok_decl(8,0)
-
-#define TOK_BAND tok_decl(9,0)
-
-#define TOK_EQ tok_decl(10,0)
-#define TOK_NE tok_decl(10,1)
-
-#define TOK_LT tok_decl(11,0)
-#define TOK_GT tok_decl(11,1)
-#define TOK_GE tok_decl(11,2)
-#define TOK_LE tok_decl(11,3)
-
-#define TOK_LSHIFT tok_decl(12,0)
-#define TOK_RSHIFT tok_decl(12,1)
-
-#define TOK_ADD tok_decl(13,0)
-#define TOK_SUB tok_decl(13,1)
-
-#define TOK_MUL tok_decl(14,0)
-#define TOK_DIV tok_decl(14,1)
-#define TOK_REM tok_decl(14,2)
-
-/* exponent is right associativity */
-#define TOK_EXPONENT tok_decl(15,1)
-
-/* For now unary operators. */
-#define UNARYPREC 16
-#define TOK_BNOT tok_decl(UNARYPREC,0)
-#define TOK_NOT tok_decl(UNARYPREC,1)
-
-#define TOK_UMINUS tok_decl(UNARYPREC+1,0)
-#define TOK_UPLUS tok_decl(UNARYPREC+1,1)
-
-#define PREC_PRE (UNARYPREC+2)
-
-#define TOK_PRE_INC tok_decl(PREC_PRE, 0)
-#define TOK_PRE_DEC tok_decl(PREC_PRE, 1)
-
-#define PREC_POST (UNARYPREC+3)
-
-#define TOK_POST_INC tok_decl(PREC_POST, 0)
-#define TOK_POST_DEC tok_decl(PREC_POST, 1)
-
-#define SPEC_PREC (UNARYPREC+4)
-
-#define TOK_NUM tok_decl(SPEC_PREC, 0)
-#define TOK_RPAREN tok_decl(SPEC_PREC, 1)
-
-#define NUMPTR (*numstackptr)
-
-static int
-tok_have_assign(operator op)
-{
-    operator prec = PREC(op);
-
-    convert_prec_is_assing(prec);
-    return (prec == PREC(TOK_ASSIGN) ||
-            prec == PREC_PRE || prec == PREC_POST);
-}
-
-static int
-is_right_associativity(operator prec)
-{
-    return (prec == PREC(TOK_ASSIGN) || prec == PREC(TOK_EXPONENT)
-            || prec == PREC(TOK_CONDITIONAL));
-}
-
-typedef struct ARITCH_VAR_NUM {
-    arith_t val;
-    arith_t contidional_second_val;
-    char contidional_second_val_initialized;
-    char *var;      /* if NULL then is regular number,
-               else is variable name */
-} v_n_t;
-
-typedef struct CHK_VAR_RECURSIVE_LOOPED {
-    const char *var;
-    struct CHK_VAR_RECURSIVE_LOOPED *next;
-} chk_var_recursive_looped_t;
-
-static chk_var_recursive_looped_t *prev_chk_var_recursive;
-
-static int
-arith_lookup_val(v_n_t *t)
-{
-    if (t->var) {
-        const char * p = lookupvar(t->var);
-
-        if (p) {
-            int errcode;
-
-            /* recursive try as expression */
-            chk_var_recursive_looped_t *cur;
-            chk_var_recursive_looped_t cur_save;
-
-            for (cur = prev_chk_var_recursive; cur; cur = cur->next) {
-                if (strcmp(cur->var, t->var) == 0) {
-                    /* expression recursion loop detected */
-                    return -5;
-                }
-            }
-            /* save current lookuped var name */
-            cur = prev_chk_var_recursive;
-            cur_save.var = t->var;
-            cur_save.next = cur;
-            prev_chk_var_recursive = &cur_save;
-
-            t->val = arith (p, &errcode);
-            /* restore previous ptr after recursiving */
-            prev_chk_var_recursive = cur;
-            return errcode;
-        }
-        /* allow undefined var as 0 */
-        t->val = 0;
-    }
-    return 0;
-}
-
-/* "applying" a token means performing it on the top elements on the integer
- * stack. For a unary operator it will only change the top element, but a
- * binary operator will pop two arguments and push a result */
-static int
-arith_apply(operator op, v_n_t *numstack, v_n_t **numstackptr)
-{
-    v_n_t *numptr_m1;
-    arith_t numptr_val, rez;
-    int ret_arith_lookup_val;
-
-    /* There is no operator that can work without arguments */
-    if (NUMPTR == numstack) goto err;
-    numptr_m1 = NUMPTR - 1;
-
-    /* check operand is var with noninteger value */
-    ret_arith_lookup_val = arith_lookup_val(numptr_m1);
-    if (ret_arith_lookup_val)
-        return ret_arith_lookup_val;
-
-    rez = numptr_m1->val;
-    if (op == TOK_UMINUS)
-        rez *= -1;
-    else if (op == TOK_NOT)
-        rez = !rez;
-    else if (op == TOK_BNOT)
-        rez = ~rez;
-    else if (op == TOK_POST_INC || op == TOK_PRE_INC)
-        rez++;
-    else if (op == TOK_POST_DEC || op == TOK_PRE_DEC)
-        rez--;
-    else if (op != TOK_UPLUS) {
-        /* Binary operators */
-
-        /* check and binary operators need two arguments */
-        if (numptr_m1 == numstack) goto err;
-
-        /* ... and they pop one */
-        --NUMPTR;
-        numptr_val = rez;
-        if (op == TOK_CONDITIONAL) {
-            if (! numptr_m1->contidional_second_val_initialized) {
-                /* protect $((expr1 ? expr2)) without ": expr" */
-                goto err;
-            }
-            rez = numptr_m1->contidional_second_val;
-        } else if (numptr_m1->contidional_second_val_initialized) {
-            /* protect $((expr1 : expr2)) without "expr ? " */
-            goto err;
-        }
-        numptr_m1 = NUMPTR - 1;
-        if (op != TOK_ASSIGN) {
-            /* check operand is var with noninteger value for not '=' */
-            ret_arith_lookup_val = arith_lookup_val(numptr_m1);
-            if (ret_arith_lookup_val)
-                return ret_arith_lookup_val;
-        }
-        if (op == TOK_CONDITIONAL) {
-            numptr_m1->contidional_second_val = rez;
-        }
-        rez = numptr_m1->val;
-        if (op == TOK_BOR || op == TOK_OR_ASSIGN)
-            rez |= numptr_val;
-        else if (op == TOK_OR)
-            rez = numptr_val || rez;
-        else if (op == TOK_BAND || op == TOK_AND_ASSIGN)
-            rez &= numptr_val;
-        else if (op == TOK_BXOR || op == TOK_XOR_ASSIGN)
-            rez ^= numptr_val;
-        else if (op == TOK_AND)
-            rez = rez && numptr_val;
-        else if (op == TOK_EQ)
-            rez = (rez == numptr_val);
-        else if (op == TOK_NE)
-            rez = (rez != numptr_val);
-        else if (op == TOK_GE)
-            rez = (rez >= numptr_val);
-        else if (op == TOK_RSHIFT || op == TOK_RSHIFT_ASSIGN)
-            rez >>= numptr_val;
-        else if (op == TOK_LSHIFT || op == TOK_LSHIFT_ASSIGN)
-            rez <<= numptr_val;
-        else if (op == TOK_GT)
-            rez = (rez > numptr_val);
-        else if (op == TOK_LT)
-            rez = (rez < numptr_val);
-        else if (op == TOK_LE)
-            rez = (rez <= numptr_val);
-        else if (op == TOK_MUL || op == TOK_MUL_ASSIGN)
-            rez *= numptr_val;
-        else if (op == TOK_ADD || op == TOK_PLUS_ASSIGN)
-            rez += numptr_val;
-        else if (op == TOK_SUB || op == TOK_MINUS_ASSIGN)
-            rez -= numptr_val;
-        else if (op == TOK_ASSIGN || op == TOK_COMMA)
-            rez = numptr_val;
-        else if (op == TOK_CONDITIONAL_SEP) {
-            if (numptr_m1 == numstack) {
-                /* protect $((expr : expr)) without "expr ? " */
-                goto err;
-            }
-            numptr_m1->contidional_second_val_initialized = op;
-            numptr_m1->contidional_second_val = numptr_val;
-        } else if (op == TOK_CONDITIONAL) {
-            rez = rez ?
-                numptr_val : numptr_m1->contidional_second_val;
-        } else if (op == TOK_EXPONENT) {
-            if (numptr_val < 0)
-                return -3;      /* exponent less than 0 */
-            else {
-                arith_t c = 1;
-
-                if (numptr_val)
-                    while (numptr_val--)
-                        c *= rez;
-                rez = c;
-            }
-        } else if (numptr_val==0)          /* zero divisor check */
-            return -2;
-        else if (op == TOK_DIV || op == TOK_DIV_ASSIGN)
-            rez /= numptr_val;
-        else if (op == TOK_REM || op == TOK_REM_ASSIGN)
-            rez %= numptr_val;
-    }
-    if (tok_have_assign(op)) {
-        char buf[sizeof(arith_t_type)*3 + 2];
-
-        if (numptr_m1->var == NULL) {
-            /* Hmm, 1=2 ? */
-            goto err;
-        }
-        /* save to shell variable */
-#if ENABLE_ASH_MATH_SUPPORT_64
-        snprintf(buf, sizeof(buf), "%lld", (arith_t_type) rez);
-#else
-        snprintf(buf, sizeof(buf), "%ld", (arith_t_type) rez);
-#endif
-        setvar(numptr_m1->var, buf, 0);
-        /* after saving, make previous value for v++ or v-- */
-        if (op == TOK_POST_INC)
-            rez--;
-        else if (op == TOK_POST_DEC)
-            rez++;
-    }
-    numptr_m1->val = rez;
-    /* protect geting var value, is number now */
-    numptr_m1->var = NULL;
-    return 0;
- err:
-    return -1;
-}
-
-/* longest must be first */
-static const char op_tokens[] ALIGN1 = {
-    '<','<','=',0, TOK_LSHIFT_ASSIGN,
-    '>','>','=',0, TOK_RSHIFT_ASSIGN,
-    '<','<',    0, TOK_LSHIFT,
-    '>','>',    0, TOK_RSHIFT,
-    '|','|',    0, TOK_OR,
-    '&','&',    0, TOK_AND,
-    '!','=',    0, TOK_NE,
-    '<','=',    0, TOK_LE,
-    '>','=',    0, TOK_GE,
-    '=','=',    0, TOK_EQ,
-    '|','=',    0, TOK_OR_ASSIGN,
-    '&','=',    0, TOK_AND_ASSIGN,
-    '*','=',    0, TOK_MUL_ASSIGN,
-    '/','=',    0, TOK_DIV_ASSIGN,
-    '%','=',    0, TOK_REM_ASSIGN,
-    '+','=',    0, TOK_PLUS_ASSIGN,
-    '-','=',    0, TOK_MINUS_ASSIGN,
-    '-','-',    0, TOK_POST_DEC,
-    '^','=',    0, TOK_XOR_ASSIGN,
-    '+','+',    0, TOK_POST_INC,
-    '*','*',    0, TOK_EXPONENT,
-    '!',        0, TOK_NOT,
-    '<',        0, TOK_LT,
-    '>',        0, TOK_GT,
-    '=',        0, TOK_ASSIGN,
-    '|',        0, TOK_BOR,
-    '&',        0, TOK_BAND,
-    '*',        0, TOK_MUL,
-    '/',        0, TOK_DIV,
-    '%',        0, TOK_REM,
-    '+',        0, TOK_ADD,
-    '-',        0, TOK_SUB,
-    '^',        0, TOK_BXOR,
-    /* uniq */
-    '~',        0, TOK_BNOT,
-    ',',        0, TOK_COMMA,
-    '?',        0, TOK_CONDITIONAL,
-    ':',        0, TOK_CONDITIONAL_SEP,
-    ')',        0, TOK_RPAREN,
-    '(',        0, TOK_LPAREN,
-    0
-};
-/* ptr to ")" */
-#define endexpression &op_tokens[sizeof(op_tokens)-7]
-
-static arith_t
-arith(const char *expr, int *perrcode)
-{
-    char arithval; /* Current character under analysis */
-    operator lasttok, op;
-    operator prec;
-
-    const char *p = endexpression;
-    int errcode;
-
-    size_t datasizes = strlen(expr) + 2;
-
-    /* Stack of integers */
-    /* The proof that there can be no more than strlen(startbuf)/2+1 integers
-     * in any given correct or incorrect expression is left as an exercise to
-     * the reader. */
-    v_n_t *numstack = alloca(((datasizes)/2)*sizeof(v_n_t)),
-                *numstackptr = numstack;
-    /* Stack of operator tokens */
-    operator *stack = alloca((datasizes) * sizeof(operator)),
-                *stackptr = stack;
-
-    *stackptr++ = lasttok = TOK_LPAREN;     /* start off with a left paren */
-    *perrcode = errcode = 0;
-
-    while (1) {
-        arithval = *expr;
-        if (arithval == 0) {
-            if (p == endexpression) {
-                /* Null expression. */
-                return 0;
-            }
-
-            /* This is only reached after all tokens have been extracted from the
-             * input stream. If there are still tokens on the operator stack, they
-             * are to be applied in order. At the end, there should be a final
-             * result on the integer stack */
-
-            if (expr != endexpression + 1) {
-                /* If we haven't done so already, */
-                /* append a closing right paren */
-                expr = endexpression;
-                /* and let the loop process it. */
-                continue;
-            }
-            /* At this point, we're done with the expression. */
-            if (numstackptr != numstack+1) {
-                /* ... but if there isn't, it's bad */
- err:
-                return (*perrcode = -1);
-            }
-            if (numstack->var) {
-                /* expression is $((var)) only, lookup now */
-                errcode = arith_lookup_val(numstack);
-            }
- ret:
-            *perrcode = errcode;
-            return numstack->val;
-        }
-
-        /* Continue processing the expression. */
-        if (arith_isspace(arithval)) {
-            /* Skip whitespace */
-            goto prologue;
-        }
-        p = endofname(expr);
-        if (p != expr) {
-            size_t var_name_size = (p-expr) + 1;  /* trailing zero */
-
-            numstackptr->var = alloca(var_name_size);
-            safe_strncpy(numstackptr->var, expr, var_name_size);
-            expr = p;
- num:
-            numstackptr->contidional_second_val_initialized = 0;
-            numstackptr++;
-            lasttok = TOK_NUM;
-            continue;
-        }
-        if (isdigit(arithval)) {
-            numstackptr->var = NULL;
-#if ENABLE_ASH_MATH_SUPPORT_64
-            numstackptr->val = strtoll(expr, (char **) &expr, 0);
-#else
-            numstackptr->val = strtol(expr, (char **) &expr, 0);
-#endif
-            goto num;
-        }
-        for (p = op_tokens; ; p++) {
-            const char *o;
-
-            if (*p == 0) {
-                /* strange operator not found */
-                goto err;
-            }
-            for (o = expr; *p && *o == *p; p++)
-                o++;
-            if (! *p) {
-                /* found */
-                expr = o - 1;
-                break;
-            }
-            /* skip tail uncompared token */
-            while (*p)
-                p++;
-            /* skip zero delim */
-            p++;
-        }
-        op = p[1];
-
-        /* post grammar: a++ reduce to num */
-        if (lasttok == TOK_POST_INC || lasttok == TOK_POST_DEC)
-            lasttok = TOK_NUM;
-
-        /* Plus and minus are binary (not unary) _only_ if the last
-         * token was as number, or a right paren (which pretends to be
-         * a number, since it evaluates to one). Think about it.
-         * It makes sense. */
-        if (lasttok != TOK_NUM) {
-            switch (op) {
-            case TOK_ADD:
-                op = TOK_UPLUS;
-                break;
-            case TOK_SUB:
-                op = TOK_UMINUS;
-                break;
-            case TOK_POST_INC:
-                op = TOK_PRE_INC;
-                break;
-            case TOK_POST_DEC:
-                op = TOK_PRE_DEC;
-                break;
-            }
-        }
-        /* We don't want a unary operator to cause recursive descent on the
-         * stack, because there can be many in a row and it could cause an
-         * operator to be evaluated before its argument is pushed onto the
-         * integer stack. */
-        /* But for binary operators, "apply" everything on the operator
-         * stack until we find an operator with a lesser priority than the
-         * one we have just extracted. */
-        /* Left paren is given the lowest priority so it will never be
-         * "applied" in this way.
-         * if associativity is right and priority eq, applied also skip
-         */
-        prec = PREC(op);
-        if ((prec > 0 && prec < UNARYPREC) || prec == SPEC_PREC) {
-            /* not left paren or unary */
-            if (lasttok != TOK_NUM) {
-                /* binary op must be preceded by a num */
-                goto err;
-            }
-            while (stackptr != stack) {
-                if (op == TOK_RPAREN) {
-                    /* The algorithm employed here is simple: while we don't
-                     * hit an open paren nor the bottom of the stack, pop
-                     * tokens and apply them */
-                    if (stackptr[-1] == TOK_LPAREN) {
-                        --stackptr;
-                        /* Any operator directly after a */
-                        lasttok = TOK_NUM;
-                        /* close paren should consider itself binary */
-                        goto prologue;
-                    }
-                } else {
-                    operator prev_prec = PREC(stackptr[-1]);
-
-                    convert_prec_is_assing(prec);
-                    convert_prec_is_assing(prev_prec);
-                    if (prev_prec < prec)
-                        break;
-                    /* check right assoc */
-                    if (prev_prec == prec && is_right_associativity(prec))
-                        break;
-                }
-                errcode = arith_apply(*--stackptr, numstack, &numstackptr);
-                if (errcode) goto ret;
-            }
-            if (op == TOK_RPAREN) {
-                goto err;
-            }
-        }
-
-        /* Push this operator to the stack and remember it. */
-        *stackptr++ = lasttok = op;
- prologue:
-        ++expr;
-    } /* while */
-}
-#endif /* ASH_MATH_SUPPORT */
-
+static int FAST_FUNC
+ulimitcmd(int argc UNUSED_PARAM, char **argv)
+{
+    return shell_builtin_ulimit(argv);
+}
 
 /* ============ main() and helpers */
@@ -12559 +12803 @@
  * Called to exit the shell.
  */
-static void exitshell(void) ATTRIBUTE_NORETURN;
+static void exitshell(void) NORETURN;
 static void
 exitshell(void)
@@ -12570 +12814 @@
     TRACE(("pid %d, exitshell(%d)\n", getpid(), status));
     if (setjmp(loc.loc)) {
-        if (exception == EXEXIT)
+        if (exception_type == EXEXIT)
 /* dash bug: it just does _exit(exitstatus) here
  * but we have to do setjobctl(0) first!
@@ -12583 +12827 @@
         trap[0] = NULL;
         evalstring(p, 0);
+        free(p);
     }
     flush_stdout_stderr();
@@ -12595 +12840 @@
 {
     /* from input.c: */
-    basepf.nextc = basepf.buf = basebuf;
+    /* we will never free this */
+    basepf.next_to_pgetc = basepf.buf = ckmalloc(IBUFSIZ);
 
     /* from trap.c: */
     signal(SIGCHLD, SIG_DFL);
+    /* bash re-enables SIGHUP which is SIG_IGNed on entry.
+     * Try: "trap '' HUP; bash; echo RET" and type "kill -HUP $$"
+     */
+    signal(SIGHUP, SIG_DFL);
 
     /* from var.c: */
     {
         char **envp;
-        char ppid[sizeof(int)*3 + 1];
         const char *p;
         struct stat st1, st2;
@@ -12614 +12863 @@
         }
 
-        snprintf(ppid, sizeof(ppid), "%u", (unsigned) getppid());
-        setvar("PPID", ppid, 0);
+        setvar("PPID", utoa(getppid()), 0);
 
         p = lookupvar("PWD");
@@ -12630 +12878 @@
  */
 static void
-procargs(int argc, char **argv)
+procargs(char **argv)
 {
     int i;
@@ -12638 +12886 @@
     xargv = argv;
     arg0 = xargv[0];
-    if (argc > 0)
+    /* if (xargv[0]) - mmm, this is always true! */
         xargv++;
     for (i = 0; i < NOPTS; i++)
         optlist[i] = 2;
     argptr = xargv;
-    options(1);
+    if (options(1)) {
+        /* it already printed err message */
+        raise_exception(EXERROR);
+    }
     xargv = argptr;
     xminusc = minusc;
@@ -12678 +12929 @@
     shellparam.optoff = -1;
 #endif
-    /* assert(shellparam.malloc == 0 && shellparam.nparam == 0); */
+    /* assert(shellparam.malloced == 0 && shellparam.nparam == 0); */
     while (*xargv) {
         shellparam.nparam++;
@@ -12713 +12964 @@
     loopnest = 0;
     /* from input.c: */
-    parselleft = parsenleft = 0;      /* clear input buffer */
+    g_parsefile->left_in_buffer = 0;
+    g_parsefile->left_in_line = 0;      /* clear input buffer */
     popallfiles();
     /* from parser.c: */
@@ -12719 +12971 @@
     checkkwd = 0;
     /* from redir.c: */
-    clearredir(0);
+    clearredir(/*drop:*/ 0);
 }
 
@@ -12734 +12986 @@
  * is used to figure out how far we had gotten.
  */
-int ash_main(int argc, char **argv);
-int ash_main(int argc, char **argv)
-{
-    char *shinit;
-    volatile int state;
+int ash_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
+int ash_main(int argc UNUSED_PARAM, char **argv)
+{
+    const char *shinit;
+    volatile smallint state;
     struct jmploc jmploc;
     struct stackmark smark;
 
+    /* Initialize global data */
+    INIT_G_misc();
+    INIT_G_memstack();
+    INIT_G_var();
+#if ENABLE_ASH_ALIAS
+    INIT_G_alias();
+#endif
+    INIT_G_cmdtable();
+
 #if PROFILE
     monitor(4, etext, profile_buf, sizeof(profile_buf), 50);
@@ -12751 +13012 @@
     state = 0;
     if (setjmp(jmploc.loc)) {
-        int e;
-        int s;
+        smallint e;
+        smallint s;
 
         reset();
 
-        e = exception;
+        e = exception_type;
         if (e == EXERROR)
             exitstatus = 2;
         s = state;
-        if (e == EXEXIT || s == 0 || iflag == 0 || shlvl)
+        if (e == EXEXIT || s == 0 || iflag == 0 || shlvl) {
             exitshell();
-
+        }
         if (e == EXINT) {
             outcslow('\n', stderr);
         }
+
         popstackmark(&smark);
         FORCE_INT_ON; /* enable interrupts */
@@ -12779 +13041 @@
 #if DEBUG
     opentrace();
-    trace_puts("Shell args: ");
+    TRACE(("Shell args: "));
     trace_puts_args(argv);
 #endif
     rootpid = getpid();
 
-#if ENABLE_ASH_RANDOM_SUPPORT
-    rseed = rootpid + time(NULL);
-#endif
     init();
     setstackmark(&smark);
-    procargs(argc, argv);
+    procargs(argv);
+
 #if ENABLE_FEATURE_EDITING_SAVEHISTORY
     if (iflag) {
@@ -12804 +13064 @@
     }
 #endif
-    if (argv[0] && argv[0][0] == '-')
+    if (/* argv[0] && */ argv[0][0] == '-')
         isloginsh = 1;
     if (isloginsh) {
@@ -12828 +13088 @@
  state3:
     state = 4;
-    if (minusc)
+    if (minusc) {
+        /* evalstring pushes parsefile stack.
+         * Ensure we don't falsely claim that 0 (stdin)
+         * is one of stacked source fds.
+         * Testcase: ash -c 'exec 1>&0' must not complain. */
+        // if (!sflag) g_parsefile->pf_fd = -1;
+        // ^^ not necessary since now we special-case fd 0
+        // in is_hidden_fd() to not be considered "hidden fd"
         evalstring(minusc, 0);
+    }
 
     if (sflag || minusc == NULL) {
-#if ENABLE_FEATURE_EDITING_SAVEHISTORY
-        if ( iflag ) {
+#if defined MAX_HISTORY && MAX_HISTORY > 0 && ENABLE_FEATURE_EDITING_SAVEHISTORY
+        if (iflag) {
             const char *hp = lookupvar("HISTFILE");
-
-            if (hp != NULL)
+            if (hp)
                 line_input_state->hist_file = hp;
         }
@@ -12852 +13119 @@
     }
 #endif
+    TRACE(("End of main reached\n"));
     exitshell();
     /* NOTREACHED */
 }
-
-#if DEBUG
-const char *applet_name = "debug stuff usage";
-int main(int argc, char **argv)
-{
-    return ash_main(argc, argv);
-}
-#endif