pointless whitespace/comment fixes, no code changes
[oweals/busybox.git] / shell / hush.c
index ac348057835f784916ec3d1714f20e82c4bedeff..b6e49db99f9b5a13989359ac11af27966e24dcfe 100644 (file)
@@ -5,7 +5,8 @@
  * "small and simple is beautiful" philosophy, which
  * incidentally is a good match to today's BusyBox.
  *
- * Copyright (C) 2000,2001  Larry Doolittle  <larry@doolittle.boa.org>
+ * Copyright (C) 2000,2001  Larry Doolittle <larry@doolittle.boa.org>
+ * Copyright (C) 2008,2009  Denys Vlasenko <vda.linux@googlemail.com>
  *
  * Credits:
  *      The parser routines proper are all original material, first
@@ -20,8 +21,8 @@
  *      rewrites.
  *
  * Other credits:
- *      o_addchr() derived from similar w_addchar function in glibc-2.2.
- *      setup_redirect(), redirect_opt_num(), and big chunks of main()
+ *      o_addchr derived from similar w_addchar function in glibc-2.2.
+ *      parse_redirect, redirect_opt_num, and big chunks of main
  *      and many builtins derived from contributions by Erik Andersen.
  *      Miscellaneous bugfixes from Matt Kraai.
  *
  * POSIX syntax not implemented:
  *      aliases
  *      <(list) and >(list) Process Substitution
- *      Here Documents ( << word )
- *      Functions
  *      Tilde Expansion
- *      Parameter Expansion for substring processing ${var#word} ${var%word}
  *
- * Bash stuff maybe optional enable:
+ * Bash stuff (maybe optionally enable?):
  *      &> and >& redirection of stdout+stderr
  *      Brace expansion
  *      reserved words: [[ ]] function select
  *      substrings ${var:1:5}
  *
- * Major bugs:
- *      job handling woefully incomplete and buggy (improved --vda)
- * to-do:
- *      port selected bugfixes from post-0.49 busybox lash - done?
+ * TODOs:
+ *      grep for "TODO" and fix (some of them are easy)
  *      change { and } from special chars to reserved words
- *      builtins: return, trap, ulimit
- *      test magic exec with redirection only
+ *      builtins: return, ulimit
  *      follow IFS rules more precisely, including update semantics
  *      figure out what to do with backslash-newline
- *      propagate syntax errors, die on resource errors?
  *      continuation lines, both explicit and implicit - done?
+ *      SIGHUP handling
+ *      ^Z handling (and explain it in comments for mere humans)
+ *      separate job control from interactiveness
+ *      (testcase: booting with init=/bin/hush does not show prompt (2009-04))
  *
  * Licensed under the GPL v2 or later, see the file LICENSE in this tarball.
  */
-
 #include "busybox.h" /* for APPLET_IS_NOFORK/NOEXEC */
-//TODO: pull in some .h and find out whether we have SINGLE_APPLET_MAIN?
-//#include "applet_tables.h" doesn't work
 #include <glob.h>
 /* #include <dmalloc.h> */
 #if ENABLE_HUSH_CASE
-#include <fnmatch.h>
+# include <fnmatch.h>
 #endif
 #include "math.h"
+#include "match.h"
+#ifndef PIPE_BUF
+# define PIPE_BUF 4096           /* amount of buffering in a pipe */
+#endif
+
+
+/* Debug build knobs */
+#define LEAK_HUNTING 0
+#define BUILD_AS_NOMMU 0
+/* Enable/disable sanity checks. Ok to enable in production,
+ * only adds a bit of bloat. Set to >1 to get non-production level verbosity.
+ * Keeping 1 for now even in released versions.
+ */
+#define HUSH_DEBUG 1
+
 
-#ifdef WANT_TO_TEST_NOMMU
+#if BUILD_AS_NOMMU
 # undef BB_MMU
 # undef USE_FOR_NOMMU
 # undef USE_FOR_MMU
 # define USE_FOR_MMU(...)
 #endif
 
-#define HUSH_VER_STR "0.93"
-
 #if defined SINGLE_APPLET_MAIN
 /* STANDALONE does not make sense, and won't compile */
-#undef CONFIG_FEATURE_SH_STANDALONE
-#undef ENABLE_FEATURE_SH_STANDALONE
-#undef USE_FEATURE_SH_STANDALONE
-#define SKIP_FEATURE_SH_STANDALONE(...) __VA_ARGS__
-#define ENABLE_FEATURE_SH_STANDALONE 0
-#define USE_FEATURE_SH_STANDALONE(...)
-#define SKIP_FEATURE_SH_STANDALONE(...) __VA_ARGS__
+# undef CONFIG_FEATURE_SH_STANDALONE
+# undef ENABLE_FEATURE_SH_STANDALONE
+# undef USE_FEATURE_SH_STANDALONE
+# define SKIP_FEATURE_SH_STANDALONE(...) __VA_ARGS__
+# define ENABLE_FEATURE_SH_STANDALONE 0
+# define USE_FEATURE_SH_STANDALONE(...)
+# define SKIP_FEATURE_SH_STANDALONE(...) __VA_ARGS__
 #endif
 
 #if !ENABLE_HUSH_INTERACTIVE
-#undef ENABLE_FEATURE_EDITING
-#define ENABLE_FEATURE_EDITING 0
-#undef ENABLE_FEATURE_EDITING_FANCY_PROMPT
-#define ENABLE_FEATURE_EDITING_FANCY_PROMPT 0
+# undef ENABLE_FEATURE_EDITING
+# define ENABLE_FEATURE_EDITING 0
+# undef ENABLE_FEATURE_EDITING_FANCY_PROMPT
+# define ENABLE_FEATURE_EDITING_FANCY_PROMPT 0
 #endif
 
 /* Do we support ANY keywords? */
 #if ENABLE_HUSH_IF || ENABLE_HUSH_LOOPS || ENABLE_HUSH_CASE
-#define HAS_KEYWORDS 1
-#define IF_HAS_KEYWORDS(...) __VA_ARGS__
-#define IF_HAS_NO_KEYWORDS(...)
+# define HAS_KEYWORDS 1
+# define IF_HAS_KEYWORDS(...) __VA_ARGS__
+# define IF_HAS_NO_KEYWORDS(...)
 #else
-#define HAS_KEYWORDS 0
-#define IF_HAS_KEYWORDS(...)
-#define IF_HAS_NO_KEYWORDS(...) __VA_ARGS__
+# define HAS_KEYWORDS 0
+# define IF_HAS_KEYWORDS(...)
+# define IF_HAS_NO_KEYWORDS(...) __VA_ARGS__
 #endif
 
-/* Keep unconditionally on for now */
-#define HUSH_DEBUG 1
-/* In progress... */
-#define ENABLE_HUSH_FUNCTIONS 0
-
-
 /* If you comment out one of these below, it will be #defined later
  * to perform debug printfs to stderr: */
 #define debug_printf(...)        do {} while (0)
 #define debug_printf_subst(...)  do {} while (0)
 #define debug_printf_clean(...)  do {} while (0)
 
-#ifndef debug_printf
-#define debug_printf(...) fprintf(stderr, __VA_ARGS__)
-#endif
-
-#ifndef debug_printf_parse
-#define debug_printf_parse(...) fprintf(stderr, __VA_ARGS__)
-#endif
-
-#ifndef debug_printf_exec
-#define debug_printf_exec(...) fprintf(stderr, __VA_ARGS__)
-#endif
-
-#ifndef debug_printf_env
-#define debug_printf_env(...) fprintf(stderr, __VA_ARGS__)
-#endif
-
-#ifndef debug_printf_jobs
-#define debug_printf_jobs(...) fprintf(stderr, __VA_ARGS__)
-#define DEBUG_JOBS 1
-#else
-#define DEBUG_JOBS 0
-#endif
-
-#ifndef debug_printf_expand
-#define debug_printf_expand(...) fprintf(stderr, __VA_ARGS__)
-#define DEBUG_EXPAND 1
-#else
-#define DEBUG_EXPAND 0
-#endif
-
-#ifndef debug_printf_glob
-#define debug_printf_glob(...) fprintf(stderr, __VA_ARGS__)
-#define DEBUG_GLOB 1
-#else
-#define DEBUG_GLOB 0
-#endif
-
-#ifndef debug_printf_list
-#define debug_printf_list(...) fprintf(stderr, __VA_ARGS__)
-#endif
-
-#ifndef debug_printf_subst
-#define debug_printf_subst(...) fprintf(stderr, __VA_ARGS__)
-#endif
-
-#ifndef debug_printf_clean
-/* broken, of course, but OK for testing */
-static const char *indenter(int i)
-{
-       static const char blanks[] ALIGN1 =
-               "                                    ";
-       return &blanks[sizeof(blanks) - i - 1];
-}
-#define debug_printf_clean(...) fprintf(stderr, __VA_ARGS__)
-#define DEBUG_CLEAN 1
-#endif
-
-#if DEBUG_EXPAND
-static void debug_print_strings(const char *prefix, char **vv)
-{
-       fprintf(stderr, "%s:\n", prefix);
-       while (*vv)
-               fprintf(stderr, " '%s'\n", *vv++);
-}
-#else
-#define debug_print_strings(prefix, vv) ((void)0)
-#endif
-
-/*
- * Leak hunting. Use hush_leaktool.sh for post-processing.
- */
-#ifdef FOR_HUSH_LEAKTOOL
-static void *xxmalloc(int lineno, size_t size)
-{
-       void *ptr = xmalloc((size + 0xff) & ~0xff);
-       fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
-       return ptr;
-}
-static void *xxrealloc(int lineno, void *ptr, size_t size)
-{
-       ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
-       fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
-       return ptr;
-}
-static char *xxstrdup(int lineno, const char *str)
-{
-       char *ptr = xstrdup(str);
-       fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
-       return ptr;
-}
-static void xxfree(void *ptr)
-{
-       fdprintf(2, "free %p\n", ptr);
-       free(ptr);
-}
-#define xmalloc(s)     xxmalloc(__LINE__, s)
-#define xrealloc(p, s) xxrealloc(__LINE__, p, s)
-#define xstrdup(s)     xxstrdup(__LINE__, s)
-#define free(p)        xxfree(p)
-#endif
-
-
 #define ERR_PTR ((void*)(long)1)
 
-static const char hush_version_str[] ALIGN1 = "HUSH_VERSION="HUSH_VER_STR;
-
 #define JOB_STATUS_FORMAT "[%d] %-22s %.40s\n"
 
 #define SPECIAL_VAR_SYMBOL 3
 
-typedef enum redir_type {
-       REDIRECT_INPUT     = 1,
-       REDIRECT_OVERWRITE = 2,
-       REDIRECT_APPEND    = 3,
-       REDIRECT_HEREIS    = 4,
-       REDIRECT_IO        = 5
-} redir_type;
+static const char hush_version_str[] ALIGN1 = "HUSH_VERSION="BB_VER;
+
+/* This supports saving pointers malloced in vfork child,
+ * to be freed in the parent. One pointer is saved in
+ * G.argv_from_re_execing global var instead. TODO: unify.
+ */
+#if !BB_MMU
+typedef struct nommu_save_t {
+       char **new_env;
+       char **old_env;
+       char **argv;
+} nommu_save_t;
+#endif
 
 /* The descrip member of this structure is only used to make
  * debugging output pretty */
@@ -261,21 +165,16 @@ static const struct {
        signed char default_fd;
        char descrip[3];
 } redir_table[] = {
-       { 0,                         0, "()" },
+       { 0,                         0, "??" },
        { O_RDONLY,                  0, "<"  },
        { O_CREAT|O_TRUNC|O_WRONLY,  1, ">"  },
        { O_CREAT|O_APPEND|O_WRONLY, 1, ">>" },
-       { O_RDONLY,                 -1, "<<" },
-       { O_RDWR,                    1, "<>" }
+       { O_RDONLY,                  0, "<<" },
+       { O_CREAT|O_RDWR,            1, "<>" },
+/* Should not be needed. Bogus default_fd helps in debugging */
+/*     { O_RDONLY,                 77, "<<" }, */
 };
 
-typedef enum pipe_style {
-       PIPE_SEQ = 1,
-       PIPE_AND = 2,
-       PIPE_OR  = 3,
-       PIPE_BG  = 4,
-} pipe_style;
-
 typedef enum reserved_style {
        RES_NONE  = 0,
 #if ENABLE_HUSH_IF
@@ -314,7 +213,9 @@ typedef struct o_string {
         * (by prepending \ to *, ?, [, \) */
        smallint o_escape;
        smallint o_glob;
-       smallint nonnull;
+       /* At least some part of the string was inside '' or "",
+        * possibly empty one: word"", wo''rd etc. */
+       smallint o_quoted;
        smallint has_empty_slot;
        smallint o_assignment; /* 0:maybe, 1:yes, 2:no */
 } o_string;
@@ -348,39 +249,80 @@ typedef struct in_str {
 struct redir_struct {
        struct redir_struct *next;
        char *rd_filename;          /* filename */
-       int fd;                     /* file descriptor being redirected */
-       int dup;                    /* -1, or file descriptor being duplicated */
-       smallint /*enum redir_type*/ rd_type;
+       int rd_fd;                  /* fd to redirect */
+       /* fd to redirect to, or -3 if rd_fd is to be closed (n>&-) */
+       int rd_dup;
+       smallint rd_type;           /* (enum redir_type) */
+       /* note: for heredocs, rd_filename contains heredoc delimiter,
+        * and subsequently heredoc itself; and rd_dup is a bitmask:
+        * 1: do we need to trim leading tabs?
+        * 2: is heredoc quoted (<<'delim' syntax) ?
+        */
 };
+typedef enum redir_type {
+       REDIRECT_INVALID   = 0,
+       REDIRECT_INPUT     = 1,
+       REDIRECT_OVERWRITE = 2,
+       REDIRECT_APPEND    = 3,
+       REDIRECT_HEREDOC   = 4,
+       REDIRECT_IO        = 5,
+       REDIRECT_HEREDOC2  = 6, /* REDIRECT_HEREDOC after heredoc is loaded */
+
+       REDIRFD_CLOSE      = -3,
+       REDIRFD_SYNTAX_ERR = -2,
+       REDIRFD_TO_FILE    = -1,
+       /* otherwise, rd_fd is redirected to rd_dup */
+
+       HEREDOC_SKIPTABS = 1,
+       HEREDOC_QUOTED   = 2,
+} redir_type;
+
 
 struct command {
        pid_t pid;                  /* 0 if exited */
        int assignment_cnt;         /* how many argv[i] are assignments? */
        smallint is_stopped;        /* is the command currently running? */
        smallint grp_type;          /* GRP_xxx */
+#define GRP_NORMAL   0
+#define GRP_SUBSHELL 1
+#if ENABLE_HUSH_FUNCTIONS
+# define GRP_FUNCTION 2
+#endif
        struct pipe *group;         /* if non-NULL, this "command" is { list },
                                     * ( list ), or a compound statement */
 #if !BB_MMU
        char *group_as_string;
+#endif
+#if ENABLE_HUSH_FUNCTIONS
+       struct function *child_func;
+/* This field is used to prevent a bug here:
+ * while...do f1() {a;}; f1; f1 {b;}; f1; done
+ * When we execute "f1() {a;}" cmd, we create new function and clear
+ * cmd->group, cmd->group_as_string, cmd->argv[0].
+ * when we execute "f1 {b;}", we notice that f1 exists,
+ * and that it's "parent cmd" struct is still "alive",
+ * we put those fields back into cmd->xxx
+ * (struct function has ->parent_cmd ptr to facilitate that).
+ * When we loop back, we can execute "f1() {a;}" again and set f1 correctly.
+ * Without this trick, loop would execute a;b;b;b;...
+ * instead of correct sequence a;b;a;b;...
+ * When command is freed, it severs the link
+ * (sets ->child_func->parent_cmd to NULL).
+ */
 #endif
        char **argv;                /* command name and arguments */
-       struct redir_struct *redirects; /* I/O redirections */
-};
 /* argv vector may contain variable references (^Cvar^C, ^C0^C etc)
  * and on execution these are substituted with their values.
  * Substitution can make _several_ words out of one argv[n]!
  * Example: argv[0]=='.^C*^C.' here: echo .$*.
  * References of the form ^C`cmd arg^C are `cmd arg` substitutions.
  */
-#define GRP_NORMAL   0
-#define GRP_SUBSHELL 1
-#if ENABLE_HUSH_FUNCTIONS
-#define GRP_FUNCTION 2
-#endif
+       struct redir_struct *redirects; /* I/O redirections */
+};
 
 struct pipe {
        struct pipe *next;
-       int num_cmds;               /* total number of commands in job */
+       int num_cmds;               /* total number of commands in pipe */
        int alive_cmds;             /* number of commands running (not exited) */
        int stopped_cmds;           /* number of commands alive, but stopped */
 #if ENABLE_HUSH_JOB
@@ -393,6 +335,12 @@ struct pipe {
        IF_HAS_KEYWORDS(smallint pi_inverted;) /* "! cmd | cmd" */
        IF_HAS_KEYWORDS(smallint res_word;) /* needed for if, for, while, until... */
 };
+typedef enum pipe_style {
+       PIPE_SEQ = 1,
+       PIPE_AND = 2,
+       PIPE_OR  = 3,
+       PIPE_BG  = 4,
+} pipe_style;
 
 /* This holds pointers to the various results of parsing */
 struct parse_context {
@@ -447,6 +395,18 @@ enum {
        BC_CONTINUE = 2,
 };
 
+#if ENABLE_HUSH_FUNCTIONS
+struct function {
+       struct function *next;
+       char *name;
+       struct command *parent_cmd;
+       struct pipe *body;
+#if !BB_MMU
+       char *body_as_string;
+#endif
+};
+#endif
+
 
 /* "Globals" within this file */
 /* Sorted roughly by size (smaller offsets == smaller code) */
@@ -479,13 +439,18 @@ struct globals {
        smallint flag_break_continue;
 #endif
        smallint fake_mode;
+       smallint exiting; /* used to prevent EXIT trap recursion */
        /* These four support $?, $#, and $1 */
-       smalluint last_return_code;
-       /* is global_argv and global_argv[1..n] malloced? (note: not [0]) */
+       smalluint last_exitcode;
+       /* are global_argv and global_argv[1..n] malloced? (note: not [0]) */
        smalluint global_args_malloced;
        /* how many non-NULL argv's we have. NB: $# + 1 */
        int global_argc;
        char **global_argv;
+#if !BB_MMU
+       char *argv0_for_re_execing;
+       char **argv_from_re_execing;
+#endif
 #if ENABLE_HUSH_LOOPS
        unsigned depth_break_continue;
        unsigned depth_of_loop;
@@ -494,6 +459,9 @@ struct globals {
        const char *cwd;
        struct variable *top_var; /* = &G.shell_ver (set in main()) */
        struct variable shell_ver;
+#if ENABLE_HUSH_FUNCTIONS
+       struct function *top_func;
+#endif
        /* Signal and trap handling */
 //     unsigned count_SIGCHLD;
 //     unsigned handled_SIGCHLD;
@@ -502,6 +470,10 @@ struct globals {
        char **traps; /* char *traps[NSIG] */
        sigset_t blocked_set;
        sigset_t inherited_set;
+#if HUSH_DEBUG
+       unsigned long memleak_value;
+       int debug_indent;
+#endif
        char user_input_buf[ENABLE_FEATURE_EDITING ? BUFSIZ : 2];
 #if ENABLE_FEATURE_SH_STANDALONE
        struct nofork_save_area nofork_save;
@@ -533,14 +505,17 @@ static int builtin_jobs(char **argv);
 #if ENABLE_HUSH_HELP
 static int builtin_help(char **argv);
 #endif
+#if HUSH_DEBUG
+static int builtin_memleak(char **argv);
+#endif
 static int builtin_pwd(char **argv);
 static int builtin_read(char **argv);
-static int builtin_test(char **argv);
-static int builtin_trap(char **argv);
-static int builtin_true(char **argv);
 static int builtin_set(char **argv);
 static int builtin_shift(char **argv);
 static int builtin_source(char **argv);
+static int builtin_test(char **argv);
+static int builtin_trap(char **argv);
+static int builtin_true(char **argv);
 static int builtin_umask(char **argv);
 static int builtin_unset(char **argv);
 static int builtin_wait(char **argv);
@@ -595,6 +570,9 @@ static const struct built_in_command bltins[] = {
 #endif
 #if ENABLE_HUSH_JOB
        BLTIN("jobs"    , builtin_jobs    , "List active jobs"),
+#endif
+#if HUSH_DEBUG
+       BLTIN("memleak" , builtin_memleak , "Debug tool"),
 #endif
        BLTIN("pwd"     , builtin_pwd     , "Print current directory"),
        BLTIN("read"    , builtin_read    , "Input environment variable"),
@@ -610,28 +588,205 @@ static const struct built_in_command bltins[] = {
 };
 
 
-static void maybe_die(const char *notice, const char *msg)
+/* Debug printouts.
+ */
+#if HUSH_DEBUG
+/* prevent disasters with G.debug_indent < 0 */
+# define indent() fprintf(stderr, "%*s", (G.debug_indent * 2) & 0xff, "")
+# define debug_enter() (G.debug_indent++)
+# define debug_leave() (G.debug_indent--)
+#else
+# define indent()    ((void)0)
+# define debug_enter() ((void)0)
+# define debug_leave() ((void)0)
+#endif
+
+#ifndef debug_printf
+# define debug_printf(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#endif
+
+#ifndef debug_printf_parse
+# define debug_printf_parse(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#endif
+
+#ifndef debug_printf_exec
+#define debug_printf_exec(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#endif
+
+#ifndef debug_printf_env
+# define debug_printf_env(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#endif
+
+#ifndef debug_printf_jobs
+# define debug_printf_jobs(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define DEBUG_JOBS 1
+#else
+# define DEBUG_JOBS 0
+#endif
+
+#ifndef debug_printf_expand
+# define debug_printf_expand(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define DEBUG_EXPAND 1
+#else
+# define DEBUG_EXPAND 0
+#endif
+
+#ifndef debug_printf_glob
+# define debug_printf_glob(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define DEBUG_GLOB 1
+#else
+# define DEBUG_GLOB 0
+#endif
+
+#ifndef debug_printf_list
+# define debug_printf_list(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#endif
+
+#ifndef debug_printf_subst
+# define debug_printf_subst(...) (indent(), fprintf(stderr, __VA_ARGS__))
+#endif
+
+#ifndef debug_printf_clean
+# define debug_printf_clean(...) (indent(), fprintf(stderr, __VA_ARGS__))
+# define DEBUG_CLEAN 1
+#else
+# define DEBUG_CLEAN 0
+#endif
+
+#if DEBUG_EXPAND
+static void debug_print_strings(const char *prefix, char **vv)
 {
-       /* Was using fancy stuff:
-        * (G_interactive_fd ? bb_error_msg : bb_error_msg_and_die)(...params...)
-        * but it SEGVs. ?! Oh well... explicit temp ptr works around that */
-       void FAST_FUNC (*fp)(const char *s, ...) = bb_error_msg_and_die;
-#if ENABLE_HUSH_INTERACTIVE
-       if (G_interactive_fd)
-               fp = bb_error_msg;
+       indent();
+       fprintf(stderr, "%s:\n", prefix);
+       while (*vv)
+               fprintf(stderr, " '%s'\n", *vv++);
+}
+#else
+#define debug_print_strings(prefix, vv) ((void)0)
 #endif
-       fp(msg ? "%s: %s" : notice, notice, msg);
+
+
+/* Leak hunting. Use hush_leaktool.sh for post-processing.
+ */
+#if LEAK_HUNTING
+static void *xxmalloc(int lineno, size_t size)
+{
+       void *ptr = xmalloc((size + 0xff) & ~0xff);
+       fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
+       return ptr;
 }
-#if 1
-#define syntax(msg) maybe_die("syntax error", msg);
+static void *xxrealloc(int lineno, void *ptr, size_t size)
+{
+       ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
+       fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
+       return ptr;
+}
+static char *xxstrdup(int lineno, const char *str)
+{
+       char *ptr = xstrdup(str);
+       fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
+       return ptr;
+}
+static void xxfree(void *ptr)
+{
+       fdprintf(2, "free %p\n", ptr);
+       free(ptr);
+}
+#define xmalloc(s)     xxmalloc(__LINE__, s)
+#define xrealloc(p, s) xxrealloc(__LINE__, p, s)
+#define xstrdup(s)     xxstrdup(__LINE__, s)
+#define free(p)        xxfree(p)
+#endif
+
+
+/* Syntax and runtime errors. They always abort scripts.
+ * In interactive use they usually discard unparsed and/or unexecuted commands
+ * and return to the prompt.
+ * HUSH_DEBUG >= 2 prints line number in this file where it was detected.
+ */
+#if HUSH_DEBUG < 2
+# define die_if_script(lineno, fmt...)          die_if_script(fmt)
+# define syntax_error(lineno, msg)              syntax_error(msg)
+# define syntax_error_at(lineno, msg)           syntax_error_at(msg)
+# define syntax_error_unterm_ch(lineno, ch)     syntax_error_unterm_ch(ch)
+# define syntax_error_unterm_str(lineno, s)     syntax_error_unterm_str(s)
+# define syntax_error_unexpected_ch(lineno, ch) syntax_error_unexpected_ch(ch)
+#endif
+
+static void die_if_script(unsigned lineno, const char *fmt, ...)
+{
+       va_list p;
+
+#if HUSH_DEBUG >= 2
+       bb_error_msg("hush.c:%u", lineno);
+#endif
+       va_start(p, fmt);
+       bb_verror_msg(fmt, p, NULL);
+       va_end(p);
+       if (!G_interactive_fd)
+               xfunc_die();
+}
+
+static void syntax_error(unsigned lineno, const char *msg)
+{
+       if (msg)
+               die_if_script(lineno, "syntax error: %s", msg);
+       else
+               die_if_script(lineno, "syntax error", NULL);
+}
+
+static void syntax_error_at(unsigned lineno, const char *msg)
+{
+       die_if_script(lineno, "syntax error at '%s'", msg);
+}
+
+/* It so happens that all such cases are totally fatal
+ * even if shell is interactive: EOF while looking for closing
+ * delimiter. There is nowhere to read stuff from after that,
+ * it's EOF! The only choice is to terminate.
+ */
+static void syntax_error_unterm_ch(unsigned lineno, char ch) NORETURN;
+static void syntax_error_unterm_ch(unsigned lineno, char ch)
+{
+       char msg[2];
+       msg[0] = ch;
+       msg[1] = '\0';
+       die_if_script(lineno, "syntax error: unterminated %s", msg);
+       xfunc_die();
+}
+
+static void syntax_error_unterm_str(unsigned lineno, const char *s)
+{
+       die_if_script(lineno, "syntax error: unterminated %s", s);
+}
+
+static void syntax_error_unexpected_ch(unsigned lineno, char ch)
+{
+       char msg[2];
+       msg[0] = ch;
+       msg[1] = '\0';
+       die_if_script(lineno, "syntax error: unexpected %s", msg);
+}
+
+#if HUSH_DEBUG < 2
+# undef die_if_script
+# undef syntax_error
+# undef syntax_error_at
+# undef syntax_error_unterm_ch
+# undef syntax_error_unterm_str
+# undef syntax_error_unexpected_ch
 #else
-/* Debug -- trick gcc to expand __LINE__ and convert to string */
-#define __syntax(msg, line) maybe_die("syntax error hush.c:" # line, msg)
-#define _syntax(msg, line) __syntax(msg, line)
-#define syntax(msg) _syntax(msg, __LINE__)
+# define die_if_script(fmt...)          die_if_script(__LINE__, fmt)
+# define syntax_error(msg)              syntax_error(__LINE__, msg)
+# define syntax_error_at(msg)           syntax_error_at(__LINE__, msg)
+# define syntax_error_unterm_ch(ch)     syntax_error_unterm_ch(__LINE__, ch)
+# define syntax_error_unterm_str(s)     syntax_error_unterm_str(__LINE__, s)
+# define syntax_error_unexpected_ch(ch) syntax_error_unexpected_ch(__LINE__, ch)
 #endif
 
 
+/* Utility functions
+ */
 static int glob_needed(const char *s)
 {
        while (*s) {
@@ -644,14 +799,14 @@ static int glob_needed(const char *s)
        return 0;
 }
 
-static int is_assignment(const char *s)
+static int is_well_formed_var_name(const char *s, char terminator)
 {
        if (!s || !(isalpha(*s) || *s == '_'))
                return 0;
        s++;
        while (isalnum(*s) || *s == '_')
                s++;
-       return *s == '=';
+       return *s == terminator;
 }
 
 /* Replace each \x with x in place, return ptr past NUL. */
@@ -695,6 +850,16 @@ static char **add_strings_to_strings(char **strings, char **add, int need_to_dup
                v[count1 + i] = (need_to_dup ? xstrdup(add[i]) : add[i]);
        return v;
 }
+#if LEAK_HUNTING
+static char **xx_add_strings_to_strings(int lineno, char **strings, char **add, int need_to_dup)
+{
+       char **ptr = add_strings_to_strings(strings, add, need_to_dup);
+       fdprintf(2, "line %d: add_strings_to_strings %p\n", lineno, ptr);
+       return ptr;
+}
+#define add_strings_to_strings(strings, add, need_to_dup) \
+       xx_add_strings_to_strings(__LINE__, strings, add, need_to_dup)
+#endif
 
 static char **add_string_to_strings(char **strings, char *add)
 {
@@ -703,6 +868,16 @@ static char **add_string_to_strings(char **strings, char *add)
        v[1] = NULL;
        return add_strings_to_strings(strings, v, /*dup:*/ 0);
 }
+#if LEAK_HUNTING
+static char **xx_add_string_to_strings(int lineno, char **strings, char *add)
+{
+       char **ptr = add_string_to_strings(strings, add);
+       fdprintf(2, "line %d: add_string_to_strings %p\n", lineno, ptr);
+       return ptr;
+}
+#define add_string_to_strings(strings, add) \
+       xx_add_string_to_strings(__LINE__, strings, add)
+#endif
 
 static void putenv_all(char **strings)
 {
@@ -784,7 +959,7 @@ static void free_strings(char **strings)
  *
  * Trap handlers will execute even within trap handlers. (right?)
  *
- * User trap handlers are forgotten when subshell ("(cmd)") is entered. [TODO]
+ * User trap handlers are forgotten when subshell ("(cmd)") is entered.
  *
  * If job control is off, backgrounded commands ("cmd &")
  * have SIGINT, SIGQUIT set to SIG_IGN.
@@ -838,7 +1013,7 @@ static void free_strings(char **strings)
  *    set bit in blocked_set (even if 'cmd' is '')
  * after [v]fork, if we plan to be a shell:
  *    nothing for {} child shell (say, "true | { true; true; } | true")
- *    unset all traps if () shell. [TODO]
+ *    unset all traps if () shell.
  * after [v]fork, if we plan to exec:
  *    POSIX says pending signal mask is cleared in child - no need to clear it.
  *    Restore blocked signal set to one inherited by shell just prior to exec.
@@ -846,8 +1021,6 @@ static void free_strings(char **strings)
  * Note: as a result, we do not use signal handlers much. The only uses
  * are to count SIGCHLDs [disabled - bug somewhere, + bloat]
  * and to restore tty pgrp on signal-induced exit.
- *
- * TODO: check/fix wait builtin to be interruptible.
  */
 
 //static void SIGCHLD_handler(int sig UNUSED_PARAM)
@@ -855,36 +1028,6 @@ static void free_strings(char **strings)
 //     G.count_SIGCHLD++;
 //}
 
-/* called once at shell init */
-static void init_signal_mask(void)
-{
-       unsigned sig;
-       unsigned mask = (1 << SIGQUIT);
-       if (G_interactive_fd) {
-               mask = 0
-                       | (1 << SIGQUIT)
-                       | (1 << SIGTERM)
-                       | (1 << SIGHUP)
-#if ENABLE_HUSH_JOB
-                       | (1 << SIGTTIN) | (1 << SIGTTOU) | (1 << SIGTSTP)
-#endif
-                       | (1 << SIGINT)
-               ;
-       }
-       G.non_DFL_mask = mask;
-
-       sigprocmask(SIG_SETMASK, NULL, &G.blocked_set);
-       sig = 0;
-       while (mask) {
-               if (mask & 1)
-                       sigaddset(&G.blocked_set, sig);
-               mask >>= 1;
-               sig++;
-       }
-       sigdelset(&G.blocked_set, SIGCHLD);
-       sigprocmask(SIG_SETMASK, &G.blocked_set, &G.inherited_set);
-}
-
 static int check_and_run_traps(int sig)
 {
        static const struct timespec zero_timespec = { 0, 0 };
@@ -903,10 +1046,10 @@ static int check_and_run_traps(int sig)
                        if (G.traps[sig][0]) {
                                /* We have user-defined handler */
                                char *argv[] = { NULL, xstrdup(G.traps[sig]), NULL };
-                               save_rcode = G.last_return_code;
+                               save_rcode = G.last_exitcode;
                                builtin_eval(argv);
                                free(argv[1]);
-                               G.last_return_code = save_rcode;
+                               G.last_exitcode = save_rcode;
                        } /* else: "" trap, ignoring signal */
                        continue;
                }
@@ -922,7 +1065,8 @@ static int check_and_run_traps(int sig)
 //TODO
 //             case SIGHUP: ...
 //                     break;
-               default: /* SIGTERM, SIGQUIT, SIGTTIN, SIGTTOU, SIGTSTP */
+               default: /* ignored: */
+                       /* SIGTERM, SIGQUIT, SIGTTIN, SIGTTOU, SIGTSTP */
                        break;
                }
        }
@@ -931,6 +1075,11 @@ static int check_and_run_traps(int sig)
 
 #if ENABLE_HUSH_JOB
 
+/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
+#define disable_restore_tty_pgrp_on_exit() (die_sleep = 0)
+/* After [v]fork, in parent: restore tty pgrp on xfunc death */
+#define enable_restore_tty_pgrp_on_exit()  (die_sleep = -1)
+
 /* Restores tty foreground process group, and exits.
  * May be called as signal handler for fatal signal
  * (will faithfully resend signal to itself, producing correct exit state)
@@ -953,47 +1102,10 @@ static void sigexit(int sig)
 
        kill_myself_with_sig(sig); /* does not return */
 }
+#else
 
-/* helper */
-static void maybe_set_sighandler(int sig)
-{
-       void (*handler)(int);
-       /* non_DFL_mask'ed signals are, well, masked,
-        * no need to set handler for them.
-        */
-       if (!((G.non_DFL_mask >> sig) & 1)) {
-               handler = signal(sig, sigexit);
-               if (handler == SIG_IGN) /* oops... restore back to IGN! */
-                       signal(sig, handler);
-       }
-}
-/* Used only to set handler to restore pgrp on exit */
-static void set_fatal_signals_to_sigexit(void)
-{
-       if (HUSH_DEBUG) {
-               maybe_set_sighandler(SIGILL );
-               maybe_set_sighandler(SIGFPE );
-               maybe_set_sighandler(SIGBUS );
-               maybe_set_sighandler(SIGSEGV);
-               maybe_set_sighandler(SIGTRAP);
-       } /* else: hush is perfect. what SEGV? */
-
-       maybe_set_sighandler(SIGABRT);
-
-       /* bash 3.2 seems to handle these just like 'fatal' ones */
-       maybe_set_sighandler(SIGPIPE);
-       maybe_set_sighandler(SIGALRM);
-       maybe_set_sighandler(SIGHUP );
-
-       /* if we aren't interactive... but in this case
-        * we never want to restore pgrp on exit, and this fn is not called */
-       /*maybe_set_sighandler(SIGTERM);*/
-       /*maybe_set_sighandler(SIGINT );*/
-}
-
-#else /* !JOB */
-
-#define set_fatal_signals_to_sigexit(handler) ((void)0)
+#define disable_restore_tty_pgrp_on_exit() ((void)0)
+#define enable_restore_tty_pgrp_on_exit()  ((void)0)
 
 #endif
 
@@ -1001,8 +1113,13 @@ static void set_fatal_signals_to_sigexit(void)
 static void hush_exit(int exitcode) NORETURN;
 static void hush_exit(int exitcode)
 {
-       if (G.traps && G.traps[0] && G.traps[0][0]) {
-               char *argv[] = { NULL, xstrdup(G.traps[0]), NULL };
+       if (G.exiting <= 0 && G.traps && G.traps[0] && G.traps[0][0]) {
+               /* Prevent recursion:
+                * trap "echo Hi; exit" EXIT; exit
+                */
+               char *argv[] = { NULL, G.traps[0], NULL };
+               G.traps[0] = NULL;
+               G.exiting = 1;
                builtin_eval(argv);
                free(argv[1]);
        }
@@ -1055,13 +1172,18 @@ static const char *get_local_var_value(const char *src)
 
 /* str holds "NAME=VAL" and is expected to be malloced.
  * We take ownership of it.
- * flg_export is used by:
+ * flg_export:
  *  0: do not export
  *  1: export
  * -1: if NAME is set, leave export status alone
  *     if NAME is not set, do not export
+ * flg_read_only is set only when we handle -R var=val
  */
-static int set_local_var(char *str, int flg_export)
+#if BB_MMU
+#define set_local_var(str, flg_export, flg_read_only) \
+       set_local_var(str, flg_export)
+#endif
+static int set_local_var(char *str, int flg_export, int flg_read_only)
 {
        struct variable *cur;
        char *value;
@@ -1088,7 +1210,10 @@ static int set_local_var(char *str, int flg_export)
                /* We found an existing var with this name */
                *value = '\0';
                if (cur->flg_read_only) {
-                       bb_error_msg("%s: readonly variable", str);
+#if !BB_MMU
+                       if (!flg_read_only)
+#endif
+                               bb_error_msg("%s: readonly variable", str);
                        free(str);
                        return -1;
                }
@@ -1119,6 +1244,9 @@ static int set_local_var(char *str, int flg_export)
 
  set_str_and_exp:
        cur->varstr = str;
+#if !BB_MMU
+       cur->flg_read_only = flg_read_only;
+#endif
  exp:
        if (flg_export == 1)
                cur->flg_export = 1;
@@ -1182,7 +1310,7 @@ static void arith_set_local_var(const char *name, const char *val, int flags)
 {
        /* arith code doesnt malloc space, so do it for it */
        char *var = xasprintf("%s=%s", name, val);
-       set_local_var(var, flags);
+       set_local_var(var, flags, 0);
 }
 #endif
 
@@ -1286,6 +1414,7 @@ static int file_get(struct in_str *i)
                ch = *i->p++;
                if (i->eof_flag && !*i->p)
                        ch = EOF;
+               /* note: ch is never NUL */
        } else {
                /* need to double check i->file because we might be doing something
                 * more complicated by now, like sourcing or substituting. */
@@ -1299,9 +1428,9 @@ static int file_get(struct in_str *i)
                        goto take_cached;
                }
 #endif
-               ch = fgetc(i->file);
+               do ch = fgetc(i->file); while (ch == '\0');
        }
-       debug_printf("file_get: got '%c' %d\n", ch, ch);
+       debug_printf("file_get: got '%c' %d\n", ch, ch);
 #if ENABLE_HUSH_INTERACTIVE
        if (ch == '\n')
                i->promptme = 1;
@@ -1309,8 +1438,8 @@ static int file_get(struct in_str *i)
        return ch;
 }
 
-/* All the callers guarantee this routine will never be
- * used right after a newline, so prompting is not needed.
+/* All callers guarantee this routine will never
+ * be used right after a newline, so prompting is not needed.
  */
 static int file_peek(struct in_str *i)
 {
@@ -1319,13 +1448,14 @@ static int file_peek(struct in_str *i)
                if (i->eof_flag && !i->p[1])
                        return EOF;
                return *i->p;
+               /* note: ch is never NUL */
        }
-       ch = fgetc(i->file);
+       do ch = fgetc(i->file); while (ch == '\0');
        i->eof_flag = (ch == EOF);
        i->peek_buf[0] = ch;
        i->peek_buf[1] = '\0';
        i->p = i->peek_buf;
-       debug_printf("file_peek: got a '%c' %d\n", *i->p, *i->p);
+       debug_printf("file_peek: got '%c' %d\n", ch, ch);
        return ch;
 }
 
@@ -1359,10 +1489,10 @@ static void setup_string_in_str(struct in_str *i, const char *s)
  */
 #define B_CHUNK  (32 * sizeof(char*))
 
-static void o_reset(o_string *o)
+static void o_reset_to_empty_unquoted(o_string *o)
 {
        o->length = 0;
-       o->nonnull = 0;
+       o->o_quoted = 0;
        if (o->data)
                o->data[0] = '\0';
 }
@@ -1408,6 +1538,13 @@ static void o_addstr(o_string *o, const char *str)
 {
        o_addblock(o, str, strlen(str));
 }
+static void nommu_addchr(o_string *o, int ch)
+{
+       if (o)
+               o_addchr(o, ch);
+}
+#else
+#define nommu_addchr(o, str) ((void)0)
 #endif
 
 static void o_addstr_with_NUL(o_string *o, const char *str)
@@ -1509,9 +1646,12 @@ static void debug_print_list(const char *prefix, o_string *o, int n)
        char **list = (char**)o->data;
        int string_start = ((n + 0xf) & ~0xf) * sizeof(list[0]);
        int i = 0;
+
+       indent();
        fprintf(stderr, "%s: list:%p n:%d string_start:%d length:%d maxlen:%d\n",
                        prefix, list, n, string_start, o->length, o->maxlen);
        while (i < n) {
+               indent();
                fprintf(stderr, " list[%d]=%d '%s' %p\n", i, (int)list[i],
                                o->data + (int)list[i] + string_start,
                                o->data + (int)list[i] + string_start);
@@ -1519,6 +1659,7 @@ static void debug_print_list(const char *prefix, o_string *o, int n)
        }
        if (n) {
                const char *p = o->data + (int)list[n - 1] + string_start;
+               indent();
                fprintf(stderr, " total_sz:%ld\n", (long)((p + strlen(p) + 1) - o->data));
        }
 }
@@ -1662,10 +1803,10 @@ static int process_command_subs(o_string *dest, const char *s);
 #endif
 static char *expand_string_to_string(const char *str);
 #if BB_MMU
-#define parse_stream_dquoted(ctx, dest, input, dquote_end) \
+#define parse_stream_dquoted(as_string, dest, input, dquote_end) \
        parse_stream_dquoted(dest, input, dquote_end)
 #endif
-static int parse_stream_dquoted(struct parse_context *ctx,
+static int parse_stream_dquoted(o_string *as_string,
                o_string *dest,
                struct in_str *input,
                int dquote_end);
@@ -1704,6 +1845,39 @@ static int expand_on_ifs(o_string *output, int n, const char *str)
        return n;
 }
 
+/* Helper to expand $((...)) and heredoc body. These act as if
+ * they are in double quotes, with the exception that they are not :).
+ * Just the rules are similar: "expand only $var and `cmd`"
+ *
+ * Returns malloced string.
+ * As an optimization, we return NULL if expansion is not needed.
+ */
+static char *expand_pseudo_dquoted(const char *str)
+{
+       char *exp_str;
+       struct in_str input;
+       o_string dest = NULL_O_STRING;
+
+       if (strchr(str, '$') == NULL
+#if ENABLE_HUSH_TICK
+        && strchr(str, '`') == NULL
+#endif
+       ) {
+               return NULL;
+       }
+
+       /* We need to expand. Example:
+        * echo $(($a + `echo 1`)) $((1 + $((2)) ))
+        */
+       setup_string_in_str(&input, str);
+       parse_stream_dquoted(NULL, &dest, &input, EOF);
+       //bb_error_msg("'%s' -> '%s'", str, dest.data);
+       exp_str = expand_string_to_string(dest.data);
+       //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
+       o_free_unsafe(&dest);
+       return exp_str;
+}
+
 /* Expand all variable references in given string, adding words to list[]
  * at n, n+1,... positions. Return updated n (so that list[n] is next one
  * to be filled). This routine is extremely tricky: has to deal with
@@ -1718,8 +1892,9 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
        char first_ch, ored_ch;
        int i;
        const char *val;
-       char *p;
+       char *dyn_val, *p;
 
+       dyn_val = NULL;
        ored_ch = 0;
 
        debug_printf_expand("expand_vars_to_list: arg '%s'\n", arg);
@@ -1755,7 +1930,7 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
                        val = G.last_bg_pid ? utoa(G.last_bg_pid) : (char*)"";
                        break;
                case '?': /* exitcode */
-                       val = utoa(G.last_return_code);
+                       val = utoa(G.last_exitcode);
                        break;
                case '#': /* argc */
                        if (arg[1] != SPECIAL_VAR_SYMBOL)
@@ -1835,36 +2010,7 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
                        *p = '\0'; /* replace trailing <SPECIAL_VAR_SYMBOL> */
                        debug_printf_subst("ARITH '%s' first_ch %x\n", arg, first_ch);
 
-                       /* Optional: skip expansion if expr is simple ("a + 3", "i++" etc) */
-                       exp_str = arg;
-                       while (1) {
-                               unsigned char c = *exp_str++;
-                               if (c == '\0') {
-                                       exp_str = NULL;
-                                       goto skip_expand;
-                               }
-                               if (isdigit(c))
-                                       continue;
-                               if (strchr(" \t+-*/%_", c) != NULL)
-                                       continue;
-                               c |= 0x20; /* tolower */
-                               if (c >= 'a' && c <= 'z')
-                                       continue;
-                               break;
-                       }
-                       /* We need to expand. Example: "echo $(($a + 1)) $((1 + $((2)) ))" */
-                       {
-                               struct in_str input;
-                               o_string dest = NULL_O_STRING;
-
-                               setup_string_in_str(&input, arg);
-                               parse_stream_dquoted(NULL, &dest, &input, EOF);
-                               //bb_error_msg("'%s' -> '%s'", arg, dest.data);
-                               exp_str = expand_string_to_string(dest.data);
-                               //bb_error_msg("'%s' -> '%s'", dest.data, exp_str);
-                               o_free(&dest);
-                       }
- skip_expand:
+                       exp_str = expand_pseudo_dquoted(arg);
                        hooks.lookupvar = get_local_var_value;
                        hooks.setvar = arith_set_local_var;
                        hooks.endofname = endofname;
@@ -1872,12 +2018,19 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
                        free(exp_str);
 
                        if (errcode < 0) {
+                               const char *msg = "error in arithmetic";
                                switch (errcode) {
-                               case -3: maybe_die("arith", "exponent less than 0"); break;
-                               case -2: maybe_die("arith", "divide by zero"); break;
-                               case -5: maybe_die("arith", "expression recursion loop detected"); break;
-                               default: maybe_die("arith", "syntax error"); break;
+                               case -3:
+                                       msg = "exponent less than 0";
+                                       break;
+                               case -2:
+                                       msg = "divide by 0";
+                                       break;
+                               case -5:
+                                       msg = "expression recursion loop detected";
+                                       break;
                                }
+                               die_if_script(msg);
                        }
                        debug_printf_subst("ARITH RES '"arith_t_fmt"'\n", res);
                        sprintf(arith_buf, arith_t_fmt, res);
@@ -1887,9 +2040,14 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
 #endif
                default: /* <SPECIAL_VAR_SYMBOL>varname<SPECIAL_VAR_SYMBOL> */
                case_default: {
-                       bool exp_len = false, exp_null = false;
-                       char *var = arg, exp_save, exp_op, *exp_word;
+                       bool exp_len = false;
+                       bool exp_null = false;
+                       char *var = arg;
+                       char exp_save = exp_save; /* for compiler */
+                       char exp_op = exp_op; /* for compiler */
+                       char *exp_word = exp_word; /* for compiler */
                        size_t exp_off = 0;
+
                        *p = '\0';
                        arg[0] = first_ch & 0x7f;
 
@@ -1900,14 +2058,15 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
                                ++var;
                        } else {
                                /* maybe handle parameter expansion */
-                               exp_off = strcspn(var, ":-=+?");
+                               exp_off = strcspn(var, ":-=+?%#");
                                if (!var[exp_off])
                                        exp_off = 0;
                                if (exp_off) {
                                        exp_save = var[exp_off];
                                        exp_null = exp_save == ':';
                                        exp_word = var + exp_off;
-                                       if (exp_null) ++exp_word;
+                                       if (exp_null)
+                                               ++exp_word;
                                        exp_op = *exp_word++;
                                        var[exp_off] = '\0';
                                }
@@ -1929,29 +2088,56 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
                                val = utoa(val ? strlen(val) : 0);
                                debug_printf_expand("%s\n", val);
                        } else if (exp_off) {
-                               /* we need to do an expansion */
-                               int exp_test = (!val || (exp_null && !val[0]));
-                               if (exp_op == '+')
-                                       exp_test = !exp_test;
-                               debug_printf_expand("expand: op:%c (null:%s) test:%i\n", exp_op,
-                                       exp_null ? "true" : "false", exp_test);
-                               if (exp_test) {
-                                       if (exp_op == '?')
-                                               maybe_die(var, *exp_word ? exp_word : "parameter null or not set");
-                                       else
-                                               val = exp_word;
-
-                                       if (exp_op == '=') {
-                                               if (isdigit(var[0]) || var[0] == '#') {
-                                                       maybe_die(var, "special vars cannot assign in this way");
-                                                       val = NULL;
+                               if (exp_op == '%' || exp_op == '#') {
+                                       if (val) {
+                                               /* we need to do a pattern match */
+                                               bool zero;
+                                               char *loc;
+                                               scan_t scan = pick_scan(exp_op, *exp_word, &zero);
+                                               if (exp_op == *exp_word)        /* ## or %% */
+                                                       ++exp_word;
+                                               val = dyn_val = xstrdup(val);
+                                               loc = scan(dyn_val, exp_word, zero);
+                                               if (zero)
+                                                       val = loc;
+                                               else
+                                                       *loc = '\0';
+                                       }
+                               } else {
+                                       /* we need to do an expansion */
+                                       int exp_test = (!val || (exp_null && !val[0]));
+                                       if (exp_op == '+')
+                                               exp_test = !exp_test;
+                                       debug_printf_expand("expand: op:%c (null:%s) test:%i\n", exp_op,
+                                               exp_null ? "true" : "false", exp_test);
+                                       if (exp_test) {
+                                               if (exp_op == '?') {
+//TODO: how interactive bash aborts expansion mid-command?
+                                                       /* ${var?[error_msg_if_unset]} */
+                                                       /* ${var:?[error_msg_if_unset_or_null]} */
+                                                       /* mimic bash message */
+                                                       die_if_script("%s: %s",
+                                                               var,
+                                                               exp_word[0] ? exp_word : "parameter null or not set"
+                                                       );
                                                } else {
-                                                       char *new_var = xmalloc(strlen(var) + strlen(val) + 2);
-                                                       sprintf(new_var, "%s=%s", var, val);
-                                                       set_local_var(new_var, -1);
+                                                       val = exp_word;
+                                               }
+
+                                               if (exp_op == '=') {
+                                                       /* ${var=[word]} or ${var:=[word]} */
+                                                       if (isdigit(var[0]) || var[0] == '#') {
+                                                               /* mimic bash message */
+                                                               die_if_script("$%s: cannot assign in this way", var);
+                                                               val = NULL;
+                                                       } else {
+                                                               char *new_var = xasprintf("%s=%s", var, val);
+                                                               set_local_var(new_var, -1, 0);
+                                                       }
                                                }
                                        }
                                }
+
                                var[exp_off] = exp_save;
                        }
 
@@ -1977,6 +2163,8 @@ static int expand_vars_to_list(o_string *output, int n, char *arg, char or_mask)
                if (val) {
                        o_addQstr(output, val, strlen(val));
                }
+               free(dyn_val);
+               dyn_val = NULL;
                /* Do the check to avoid writing to a const string */
                if (*p != SPECIAL_VAR_SYMBOL)
                        *p = SPECIAL_VAR_SYMBOL;
@@ -2056,39 +2244,262 @@ static char *expand_string_to_string(const char *str)
        return (char*)list;
 }
 
-/* Used for "eval" builtin */
-static char* expand_strvec_to_string(char **argv)
+/* Used for "eval" builtin */
+static char* expand_strvec_to_string(char **argv)
+{
+       char **list;
+
+       list = expand_variables(argv, 0x80);
+       /* Convert all NULs to spaces */
+       if (list[0]) {
+               int n = 1;
+               while (list[n]) {
+                       if (HUSH_DEBUG)
+                               if (list[n-1] + strlen(list[n-1]) + 1 != list[n])
+                                       bb_error_msg_and_die("BUG in varexp3");
+                       list[n][-1] = ' '; /* TODO: or to G.ifs[0]? */
+                       n++;
+               }
+       }
+       overlapping_strcpy((char*)list, list[0]);
+       debug_printf_expand("strvec_to_string='%s'\n", (char*)list);
+       return (char*)list;
+}
+
+static char **expand_assignments(char **argv, int count)
+{
+       int i;
+       char **p = NULL;
+       /* Expand assignments into one string each */
+       for (i = 0; i < count; i++) {
+               p = add_string_to_strings(p, expand_string_to_string(argv[i]));
+       }
+       return p;
+}
+
+
+#if BB_MMU
+/* never called */
+void re_execute_shell(const char *s, char *argv0, char **argv);
+
+#define clean_up_after_re_execute() ((void)0)
+
+static void reset_traps_to_defaults(void)
+{
+       unsigned sig;
+       int dirty;
+
+       if (!G.traps)
+               return;
+       dirty = 0;
+       for (sig = 0; sig < NSIG; sig++) {
+               if (!G.traps[sig])
+                       continue;
+               free(G.traps[sig]);
+               G.traps[sig] = NULL;
+               /* There is no signal for 0 (EXIT) */
+               if (sig == 0)
+                       continue;
+               /* there was a trap handler, we are removing it
+                * (if sig has non-DFL handling,
+                * we don't need to do anything) */
+               if (sig < 32 && (G.non_DFL_mask & (1 << sig)))
+                       continue;
+               sigdelset(&G.blocked_set, sig);
+               dirty = 1;
+       }
+       if (dirty)
+               sigprocmask(SIG_SETMASK, &G.blocked_set, NULL);
+}
+
+#else /* !BB_MMU */
+
+static void re_execute_shell(const char *s, char *g_argv0, char **g_argv) NORETURN;
+static void re_execute_shell(const char *s, char *g_argv0, char **g_argv)
+{
+       char param_buf[sizeof("-$%x:%x:%x:%x") + sizeof(unsigned) * 4];
+       char *heredoc_argv[4];
+       struct variable *cur;
+#if ENABLE_HUSH_FUNCTIONS
+       struct function *funcp;
+#endif
+       char **argv, **pp;
+       unsigned cnt;
+
+       if (!g_argv0) { /* heredoc */
+               argv = heredoc_argv;
+               argv[0] = (char *) G.argv0_for_re_execing;
+               argv[1] = (char *) "-<";
+               argv[2] = (char *) s;
+               argv[3] = NULL;
+               pp = &argv[3]; /* used as pointer to empty environment */
+               goto do_exec;
+       }
+
+       sprintf(param_buf, "-$%x:%x:%x" USE_HUSH_LOOPS(":%x")
+                       , (unsigned) G.root_pid
+                       , (unsigned) G.last_bg_pid
+                       , (unsigned) G.last_exitcode
+                       USE_HUSH_LOOPS(, G.depth_of_loop)
+                       );
+       /* 1:hush 2:-$<pid>:<pid>:<exitcode>:<depth> <vars...> <funcs...>
+        * 3:-c 4:<cmd> 5:<arg0> <argN...> 6:NULL
+        */
+       cnt = 6;
+       for (cur = G.top_var; cur; cur = cur->next) {
+               if (!cur->flg_export || cur->flg_read_only)
+                       cnt += 2;
+       }
+#if ENABLE_HUSH_FUNCTIONS
+       for (funcp = G.top_func; funcp; funcp = funcp->next)
+               cnt += 3;
+#endif
+       pp = g_argv;
+       while (*pp++)
+               cnt++;
+       G.argv_from_re_execing = argv = pp = xzalloc(sizeof(argv[0]) * cnt);
+       *pp++ = (char *) G.argv0_for_re_execing;
+       *pp++ = param_buf;
+       for (cur = G.top_var; cur; cur = cur->next) {
+               if (cur->varstr == hush_version_str)
+                       continue;
+               if (cur->flg_read_only) {
+                       *pp++ = (char *) "-R";
+                       *pp++ = cur->varstr;
+               } else if (!cur->flg_export) {
+                       *pp++ = (char *) "-V";
+                       *pp++ = cur->varstr;
+               }
+       }
+#if ENABLE_HUSH_FUNCTIONS
+       for (funcp = G.top_func; funcp; funcp = funcp->next) {
+               *pp++ = (char *) "-F";
+               *pp++ = funcp->name;
+               *pp++ = funcp->body_as_string;
+       }
+#endif
+       /* We can pass activated traps here. Say, -Tnn:trap_string
+        *
+        * However, POSIX says that subshells reset signals with traps
+        * to SIG_DFL.
+        * I tested bash-3.2 and it not only does that with true subshells
+        * of the form ( list ), but with any forked children shells.
+        * I set trap "echo W" WINCH; and then tried:
+        *
+        * { echo 1; sleep 20; echo 2; } &
+        * while true; do echo 1; sleep 20; echo 2; break; done &
+        * true | { echo 1; sleep 20; echo 2; } | cat
+        *
+        * In all these cases sending SIGWINCH to the child shell
+        * did not run the trap. If I add trap "echo V" WINCH;
+        * _inside_ group (just before echo 1), it works.
+        *
+        * I conclude it means we don't need to pass active traps here.
+        * exec syscall below resets them to SIG_DFL for us.
+        */
+       *pp++ = (char *) "-c";
+       *pp++ = (char *) s;
+       *pp++ = g_argv0;
+       while (*g_argv)
+               *pp++ = *g_argv++;
+       /* *pp = NULL; - is already there */
+       pp = environ;
+
+ do_exec:
+       debug_printf_exec("re_execute_shell pid:%d cmd:'%s'\n", getpid(), s);
+       sigprocmask(SIG_SETMASK, &G.inherited_set, NULL);
+       execve(bb_busybox_exec_path, argv, pp);
+       /* Fallback. Useful for init=/bin/hush usage etc */
+       if (argv[0][0] == '/')
+               execve(argv[0], argv, pp);
+       xfunc_error_retval = 127;
+       bb_error_msg_and_die("can't re-execute the shell");
+}
+
+static void clean_up_after_re_execute(void)
 {
-       char **list;
-
-       list = expand_variables(argv, 0x80);
-       /* Convert all NULs to spaces */
-       if (list[0]) {
-               int n = 1;
-               while (list[n]) {
-                       if (HUSH_DEBUG)
-                               if (list[n-1] + strlen(list[n-1]) + 1 != list[n])
-                                       bb_error_msg_and_die("BUG in varexp3");
-                       list[n][-1] = ' '; /* TODO: or to G.ifs[0]? */
-                       n++;
-               }
+       char **pp = G.argv_from_re_execing;
+       if (pp) {
+               /* Must match re_execute_shell's allocations (if any) */
+               free(pp);
+               G.argv_from_re_execing = NULL;
        }
-       overlapping_strcpy((char*)list, list[0]);
-       debug_printf_expand("strvec_to_string='%s'\n", (char*)list);
-       return (char*)list;
 }
+#endif  /* !BB_MMU */
 
-static char **expand_assignments(char **argv, int count)
+
+static void setup_heredoc(struct redir_struct *redir)
 {
-       int i;
-       char **p = NULL;
-       /* Expand assignments into one string each */
-       for (i = 0; i < count; i++) {
-               p = add_string_to_strings(p, expand_string_to_string(argv[i]));
+       struct fd_pair pair;
+       pid_t pid;
+       int len, written;
+       /* the _body_ of heredoc (misleading field name) */
+       const char *heredoc = redir->rd_filename;
+       char *expanded;
+
+       expanded = NULL;
+       if (!(redir->rd_dup & HEREDOC_QUOTED)) {
+               expanded = expand_pseudo_dquoted(heredoc);
+               if (expanded)
+                       heredoc = expanded;
        }
-       return p;
-}
+       len = strlen(heredoc);
+
+       close(redir->rd_fd); /* often saves dup2+close in xmove_fd */
+       xpiped_pair(pair);
+       xmove_fd(pair.rd, redir->rd_fd);
+
+       /* Try writing without forking. Newer kernels have
+        * dynamically growing pipes. Must use non-blocking write! */
+       ndelay_on(pair.wr);
+       while (1) {
+               written = write(pair.wr, heredoc, len);
+               if (written <= 0)
+                       break;
+               len -= written;
+               if (len == 0) {
+                       close(pair.wr);
+                       free(expanded);
+                       return;
+               }
+               heredoc += written;
+       }
+       ndelay_off(pair.wr);
 
+       /* Okay, pipe buffer was not big enough */
+       /* Note: we must not create a stray child (bastard? :)
+        * for the unsuspecting parent process. Child creates a grandchild
+        * and exits before parent execs the process which consumes heredoc
+        * (that exec happens after we return from this function) */
+       pid = vfork();
+       if (pid < 0)
+               bb_perror_msg_and_die("vfork");
+       if (pid == 0) {
+               /* child */
+               pid = BB_MMU ? fork() : vfork();
+               if (pid < 0)
+                       bb_perror_msg_and_die(BB_MMU ? "fork" : "vfork");
+               if (pid != 0)
+                       _exit(0);
+               /* grandchild */
+               close(redir->rd_fd); /* read side of the pipe */
+#if BB_MMU
+               full_write(pair.wr, heredoc, len); /* may loop or block */
+               _exit(0);
+#else
+               /* Delegate blocking writes to another process */
+               disable_restore_tty_pgrp_on_exit();
+               xmove_fd(pair.wr, STDOUT_FILENO);
+               re_execute_shell(heredoc, NULL, NULL);
+#endif
+       }
+       /* parent */
+       enable_restore_tty_pgrp_on_exit();
+       clean_up_after_re_execute();
+       close(pair.wr);
+       free(expanded);
+       wait(NULL); /* wait till child has died */
+}
 
 /* squirrel != NULL means we squirrel away copies of stdin, stdout,
  * and stderr if they are redirected. */
@@ -2098,35 +2509,53 @@ static int setup_redirects(struct command *prog, int squirrel[])
        struct redir_struct *redir;
 
        for (redir = prog->redirects; redir; redir = redir->next) {
-               if (redir->dup == -1 && redir->rd_filename == NULL) {
-                       /* something went wrong in the parse.  Pretend it didn't happen */
+               if (redir->rd_type == REDIRECT_HEREDOC2) {
+                       /* rd_fd<<HERE case */
+                       if (squirrel && redir->rd_fd < 3) {
+                               squirrel[redir->rd_fd] = dup(redir->rd_fd);
+                       }
+                       /* for REDIRECT_HEREDOC2, rd_filename holds _contents_
+                        * of the heredoc */
+                       debug_printf_parse("set heredoc '%s'\n",
+                                       redir->rd_filename);
+                       setup_heredoc(redir);
                        continue;
                }
-               if (redir->dup == -1) {
+
+               if (redir->rd_dup == REDIRFD_TO_FILE) {
+                       /* rd_fd<*>file case (<*> is <,>,>>,<>) */
                        char *p;
+                       if (redir->rd_filename == NULL) {
+                               /* Something went wrong in the parse.
+                                * Pretend it didn't happen */
+                               bb_error_msg("bug in redirect parse");
+                               continue;
+                       }
                        mode = redir_table[redir->rd_type].mode;
-//TODO: check redir for names like '\\'
                        p = expand_string_to_string(redir->rd_filename);
                        openfd = open_or_warn(p, mode);
                        free(p);
                        if (openfd < 0) {
                        /* this could get lost if stderr has been redirected, but
-                          bash and ash both lose it as well (though zsh doesn't!) */
+                        * bash and ash both lose it as well (though zsh doesn't!) */
+//what the above comment tries to say?
                                return 1;
                        }
                } else {
-                       openfd = redir->dup;
+                       /* rd_fd<*>rd_dup or rd_fd<*>- cases */
+                       openfd = redir->rd_dup;
                }
 
-               if (openfd != redir->fd) {
-                       if (squirrel && redir->fd < 3) {
-                               squirrel[redir->fd] = dup(redir->fd);
+               if (openfd != redir->rd_fd) {
+                       if (squirrel && redir->rd_fd < 3) {
+                               squirrel[redir->rd_fd] = dup(redir->rd_fd);
                        }
-                       if (openfd == -3) {
-                               //close(openfd); // close(-3) ??!
+                       if (openfd == REDIRFD_CLOSE) {
+                               /* "n>-" means "close me" */
+                               close(redir->rd_fd);
                        } else {
-                               dup2(openfd, redir->fd);
-                               if (redir->dup == -1)
+                               xdup2(openfd, redir->rd_fd);
+                               if (redir->rd_dup == REDIRFD_TO_FILE)
                                        close(openfd);
                        }
                }
@@ -2147,14 +2576,10 @@ static void restore_redirects(int squirrel[])
 }
 
 
-#if !defined(DEBUG_CLEAN)
-#define free_pipe_list(head, indent) free_pipe_list(head)
-#define free_pipe(pi, indent)        free_pipe(pi)
-#endif
-static void free_pipe_list(struct pipe *head, int indent);
+static void free_pipe_list(struct pipe *head);
 
 /* Return code is the exit status of the pipe */
-static void free_pipe(struct pipe *pi, int indent)
+static void free_pipe(struct pipe *pi)
 {
        char **p;
        struct command *command;
@@ -2163,40 +2588,47 @@ static void free_pipe(struct pipe *pi, int indent)
 
        if (pi->stopped_cmds > 0) /* why? */
                return;
-       debug_printf_clean("%s run pipe: (pid %d)\n", indenter(indent), getpid());
+       debug_printf_clean("run pipe: (pid %d)\n", getpid());
        for (i = 0; i < pi->num_cmds; i++) {
                command = &pi->cmds[i];
-               debug_printf_clean("%s  command %d:\n", indenter(indent), i);
+               debug_printf_clean("  command %d:\n", i);
                if (command->argv) {
                        for (a = 0, p = command->argv; *p; a++, p++) {
-                               debug_printf_clean("%s   argv[%d] = %s\n", indenter(indent), a, *p);
+                               debug_printf_clean("   argv[%d] = %s\n", a, *p);
                        }
                        free_strings(command->argv);
                        command->argv = NULL;
                }
                /* not "else if": on syntax error, we may have both! */
                if (command->group) {
-                       debug_printf_clean("%s   begin group (grp_type:%d)\n", indenter(indent), command->grp_type);
-                       free_pipe_list(command->group, indent+3);
-                       debug_printf_clean("%s   end group\n", indenter(indent));
+                       debug_printf_clean("   begin group (grp_type:%d)\n",
+                                       command->grp_type);
+                       free_pipe_list(command->group);
+                       debug_printf_clean("   end group\n");
                        command->group = NULL;
                }
+               /* else is crucial here.
+                * If group != NULL, child_func is meaningless */
+#if ENABLE_HUSH_FUNCTIONS
+               else if (command->child_func) {
+                       debug_printf_exec("cmd %p releases child func at %p\n", command, command->child_func);
+                       command->child_func->parent_cmd = NULL;
+               }
+#endif
 #if !BB_MMU
                free(command->group_as_string);
                command->group_as_string = NULL;
 #endif
                for (r = command->redirects; r; r = rnext) {
-                       debug_printf_clean("%s   redirect %d%s", indenter(indent), r->fd, redir_table[r->rd_type].descrip);
-                       if (r->dup == -1) {
-                               /* guard against the case >$FOO, where foo is unset or blank */
-                               if (r->rd_filename) {
-                                       debug_printf_clean(" %s\n", r->rd_filename);
-                                       free(r->rd_filename);
-                                       r->rd_filename = NULL;
-                               }
-                       } else {
-                               debug_printf_clean("&%d\n", r->dup);
+                       debug_printf_clean("   redirect %d%s",
+                                       r->rd_fd, redir_table[r->rd_type].descrip);
+                       /* guard against the case >$FOO, where foo is unset or blank */
+                       if (r->rd_filename) {
+                               debug_printf_clean(" fname:'%s'\n", r->rd_filename);
+                               free(r->rd_filename);
+                               r->rd_filename = NULL;
                        }
+                       debug_printf_clean(" rd_dup:%d\n", r->rd_dup);
                        rnext = r->next;
                        free(r);
                }
@@ -2210,16 +2642,16 @@ static void free_pipe(struct pipe *pi, int indent)
 #endif
 }
 
-static void free_pipe_list(struct pipe *head, int indent)
+static void free_pipe_list(struct pipe *head)
 {
        struct pipe *pi, *next;
 
        for (pi = head; pi; pi = next) {
 #if HAS_KEYWORDS
-               debug_printf_clean("%s pipe reserved mode %d\n", indenter(indent), pi->res_word);
+               debug_printf_clean(" pipe reserved word %d\n", pi->res_word);
 #endif
-               free_pipe(pi, indent);
-               debug_printf_clean("%s pipe followup code %d\n", indenter(indent), pi->followup);
+               free_pipe(pi);
+               debug_printf_clean("pipe followup code %d\n", pi->followup);
                next = pi->next;
                /*pi->next = NULL;*/
                free(pi);
@@ -2227,20 +2659,171 @@ static void free_pipe_list(struct pipe *head, int indent)
 }
 
 
+static int run_list(struct pipe *pi);
+#if BB_MMU
+#define parse_stream(pstring, input, end_trigger) \
+       parse_stream(input, end_trigger)
+#endif
+static struct pipe *parse_stream(char **pstring,
+               struct in_str *input,
+               int end_trigger);
+static void parse_and_run_string(const char *s);
+
+
+static const struct built_in_command* find_builtin(const char *name)
+{
+       const struct built_in_command *x;
+       for (x = bltins; x != &bltins[ARRAY_SIZE(bltins)]; x++) {
+               if (strcmp(name, x->cmd) != 0)
+                       continue;
+               debug_printf_exec("found builtin '%s'\n", name);
+               return x;
+       }
+       return NULL;
+}
+
+#if ENABLE_HUSH_FUNCTIONS
+static const struct function *find_function(const char *name)
+{
+       const struct function *funcp = G.top_func;
+       while (funcp) {
+               if (strcmp(name, funcp->name) == 0) {
+                       break;
+               }
+               funcp = funcp->next;
+       }
+       debug_printf_exec("found function '%s'\n", name);
+       return funcp;
+}
+
+/* Note: takes ownership on name ptr */
+static struct function *new_function(char *name)
+{
+       struct function *funcp;
+       struct function **funcpp = &G.top_func;
+
+       while ((funcp = *funcpp) != NULL) {
+               struct command *cmd;
+
+               if (strcmp(funcp->name, name) != 0) {
+                       funcpp = &funcp->next;
+                       continue;
+               }
+
+               cmd = funcp->parent_cmd;
+               debug_printf_exec("func %p parent_cmd %p\n", funcp, cmd);
+               if (!cmd) {
+                       debug_printf_exec("freeing & replacing function '%s'\n", funcp->name);
+                       free(funcp->name);
+                       /* Note: if !funcp->body, do not free body_as_string!
+                        * This is a special case of "-F name body" function:
+                        * body_as_string was not malloced! */
+                       if (funcp->body) {
+                               free_pipe_list(funcp->body);
 #if !BB_MMU
-typedef struct nommu_save_t {
-       char **new_env;
-       char **old_env;
-       char **argv;
-} nommu_save_t;
-#else
+                               free(funcp->body_as_string);
+#endif
+                       }
+               } else {
+                       debug_printf_exec("reinserting in tree & replacing function '%s'\n", funcp->name);
+                       cmd->argv[0] = funcp->name;
+                       cmd->group = funcp->body;
+#if !BB_MMU
+                       cmd->group_as_string = funcp->body_as_string;
+#endif
+               }
+               goto skip;
+       }
+       debug_printf_exec("remembering new function '%s'\n", command->argv[0]);
+       funcp = *funcpp = xzalloc(sizeof(*funcp));
+       /*funcp->next = NULL;*/
+ skip:
+       funcp->name = name;
+       return funcp;
+}
+
+static void exec_function(const struct function *funcp, char **argv) NORETURN;
+static void exec_function(const struct function *funcp, char **argv)
+{
+# if BB_MMU
+       int n = 1;
+
+       argv[0] = G.global_argv[0];
+       G.global_argv = argv;
+       while (*++argv)
+               n++;
+       G.global_argc = n;
+       /* On MMU, funcp->body is always non-NULL */
+       n = run_list(funcp->body);
+       fflush(NULL);
+       _exit(n);
+# else
+       re_execute_shell(funcp->body_as_string, G.global_argv[0], argv + 1);
+# endif
+}
+
+static int run_function(const struct function *funcp, char **argv)
+{
+       int n;
+       char **pp;
+       char *sv_argv0;
+       smallint sv_g_malloced;
+       int sv_g_argc;
+       char **sv_g_argv;
+
+       sv_argv0 = argv[0];
+       sv_g_malloced = G.global_args_malloced;
+       sv_g_argc = G.global_argc;
+       sv_g_argv = G.global_argv;
+
+       pp = argv;
+       n = 1;
+       while (*++pp)
+               n++;
+
+       argv[0] = G.global_argv[0]; /* retain $0 */
+       G.global_args_malloced = 0;
+       G.global_argc = n;
+       G.global_argv = argv;
+
+       /* On MMU, funcp->body is always non-NULL */
+#if !BB_MMU
+       if (!funcp->body) {
+               /* Function defined by -F */
+               parse_and_run_string(funcp->body_as_string);
+               n = G.last_exitcode;
+       } else
+#endif
+       {
+               n = run_list(funcp->body);
+       }
+
+       if (G.global_args_malloced) {
+               /* function ran "set -- arg1 arg2 ..." */
+               pp = G.global_argv;
+               while (*++pp)
+                       free(*pp);
+               free(G.global_argv);
+       }
+
+       argv[0] = sv_argv0;
+       G.global_args_malloced = sv_g_malloced;
+       G.global_argc = sv_g_argc;
+       G.global_argv = sv_g_argv;
+
+       return n;
+}
+#endif
+
+
+#if BB_MMU
 #define pseudo_exec_argv(nommu_save, argv, assignment_cnt, argv_expanded) \
        pseudo_exec_argv(argv, assignment_cnt, argv_expanded)
 #define pseudo_exec(nommu_save, command, argv_expanded) \
        pseudo_exec(command, argv_expanded)
 #endif
 
-/* Called after [v]fork() in run_pipe(), or from builtin_exec().
+/* Called after [v]fork() in run_pipe, or from builtin_exec.
  * Never returns.
  * XXX no exit() here.  If you don't exec, use _exit instead.
  * The at_exit handlers apparently confuse the calling process,
@@ -2275,6 +2858,11 @@ static void pseudo_exec_argv(nommu_save_t *nommu_save,
 #endif
        }
 
+#if ENABLE_FEATURE_SH_STANDALONE || BB_MMU
+       if (strchr(argv[0], '/') != NULL)
+               goto skip;
+#endif
+
        /* On NOMMU, we must never block!
         * Example: { sleep 99999 | read line } & echo Ok
         * read builtin will block on read syscall, leaving parent blocked
@@ -2288,30 +2876,35 @@ static void pseudo_exec_argv(nommu_save_t *nommu_save,
         */
        {
                int rcode;
-               const struct built_in_command *x;
-               for (x = bltins; x != &bltins[ARRAY_SIZE(bltins)]; x++) {
-                       if (strcmp(argv[0], x->cmd) == 0) {
-                               debug_printf_exec("running builtin '%s'\n",
-                                               argv[0]);
-                               rcode = x->function(argv);
-                               fflush(NULL);
-                               _exit(rcode);
-                       }
+               const struct built_in_command *x = find_builtin(argv[0]);
+               if (x) {
+                       rcode = x->function(argv);
+                       fflush(NULL);
+                       _exit(rcode);
+               }
+       }
+#endif
+#if ENABLE_HUSH_FUNCTIONS
+       /* Check if the command matches any functions */
+       {
+               const struct function *funcp = find_function(argv[0]);
+               if (funcp) {
+                       exec_function(funcp, argv);
                }
        }
 #endif
 
 #if ENABLE_FEATURE_SH_STANDALONE
        /* Check if the command matches any busybox applets */
-       if (strchr(argv[0], '/') == NULL) {
+       {
                int a = find_applet_by_name(argv[0]);
                if (a >= 0) {
-#if BB_MMU /* see above why on NOMMU it is not allowed */
+# if BB_MMU /* see above why on NOMMU it is not allowed */
                        if (APPLET_IS_NOEXEC(a)) {
                                debug_printf_exec("running applet '%s'\n", argv[0]);
                                run_applet_no_and_exit(a, argv);
                        }
-#endif
+# endif
                        /* Re-exec ourselves */
                        debug_printf_exec("re-execing applet '%s'\n", argv[0]);
                        sigprocmask(SIG_SETMASK, &G.inherited_set, NULL);
@@ -2322,6 +2915,9 @@ static void pseudo_exec_argv(nommu_save_t *nommu_save,
        }
 #endif
 
+#if ENABLE_FEATURE_SH_STANDALONE || BB_MMU
+ skip:
+#endif
        debug_printf_exec("execing '%s'\n", argv[0]);
        sigprocmask(SIG_SETMASK, &G.inherited_set, NULL);
        execvp(argv[0], argv);
@@ -2329,9 +2925,7 @@ static void pseudo_exec_argv(nommu_save_t *nommu_save,
        _exit(EXIT_FAILURE);
 }
 
-static int run_list(struct pipe *pi);
-
-/* Called after [v]fork() in run_pipe()
+/* Called after [v]fork() in run_pipe
  */
 static void pseudo_exec(nommu_save_t *nommu_save,
                struct command *command,
@@ -2355,13 +2949,15 @@ static void pseudo_exec(nommu_save_t *nommu_save,
 #if BB_MMU
                int rcode;
                debug_printf_exec("pseudo_exec: run_list\n");
+               reset_traps_to_defaults();
                rcode = run_list(command->group);
                /* OK to leak memory by not calling free_pipe_list,
                 * since this process is about to exit */
                _exit(rcode);
 #else
-               bb_error_msg_and_die("NOMMU TODO: re-exec '%s'",
-                               command->group_as_string);
+               re_execute_shell(command->group_as_string,
+                               G.global_argv[0],
+                               G.global_argv + 1);
 #endif
        }
 
@@ -2467,7 +3063,7 @@ static void delete_finished_bg_job(struct pipe *pi)
 {
        remove_bg_job(pi);
        pi->stopped_cmds = 0;
-       free_pipe(pi, 0);
+       free_pipe(pi);
        free(pi);
 }
 #endif /* JOB */
@@ -2658,6 +3254,7 @@ static int run_pipe(struct pipe *pi)
        int rcode;
 
        debug_printf_exec("run_pipe start: members:%d\n", pi->num_cmds);
+       debug_enter();
 
        USE_HUSH_JOB(pi->pgrp = -1;)
        pi->stopped_cmds = 0;
@@ -2679,93 +3276,141 @@ static int run_pipe(struct pipe *pi)
        if (command->group) {
 #if ENABLE_HUSH_FUNCTIONS
                if (command->grp_type == GRP_FUNCTION) {
-                       /* func () { list } */
-                       bb_error_msg("here we ought to remember function definition, and go on");
+                       /* "executing" func () { list } */
+                       struct function *funcp;
+
+                       funcp = new_function(command->argv[0]);
+                       /* funcp->name is already set to argv[0] */
+                       funcp->body = command->group;
+#if !BB_MMU
+                       funcp->body_as_string = command->group_as_string;
+                       command->group_as_string = NULL;
+#endif
+                       command->group = NULL;
+                       command->argv[0] = NULL;
+                       debug_printf_exec("cmd %p has child func at %p\n", command, funcp);
+                       funcp->parent_cmd = command;
+                       command->child_func = funcp;
+
+                       debug_printf_exec("run_pipe: return EXIT_SUCCESS\n");
+                       debug_leave();
                        return EXIT_SUCCESS;
                }
 #endif
                /* { list } */
                debug_printf("non-subshell group\n");
-               setup_redirects(command, squirrel);
-               debug_printf_exec(": run_list\n");
-               rcode = run_list(command->group) & 0xff;
+               rcode = 1; /* exitcode if redir failed */
+               if (setup_redirects(command, squirrel) == 0) {
+                       debug_printf_exec(": run_list\n");
+                       rcode = run_list(command->group) & 0xff;
+               }
                restore_redirects(squirrel);
-               debug_printf_exec("run_pipe return %d\n", rcode);
                IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
+               debug_leave();
+               debug_printf_exec("run_pipe: return %d\n", rcode);
                return rcode;
        }
 
        argv = command->argv ? command->argv : (char **) &null_ptr;
        {
                const struct built_in_command *x;
+#if ENABLE_HUSH_FUNCTIONS
+               const struct function *funcp;
+#else
+               enum { funcp = 0 };
+#endif
                char **new_env = NULL;
                char **old_env = NULL;
 
                if (argv[command->assignment_cnt] == NULL) {
                        /* Assignments, but no command */
                        /* Ensure redirects take effect. Try "a=t >file" */
-                       setup_redirects(command, squirrel);
+                       rcode = setup_redirects(command, squirrel);
                        restore_redirects(squirrel);
                        /* Set shell variables */
                        while (*argv) {
                                p = expand_string_to_string(*argv);
                                debug_printf_exec("set shell var:'%s'->'%s'\n",
                                                *argv, p);
-                               set_local_var(p, 0);
+                               set_local_var(p, 0, 0);
                                argv++;
                        }
                        /* Do we need to flag set_local_var() errors?
                         * "assignment to readonly var" and "putenv error"
                         */
-                       return EXIT_SUCCESS;
+                       IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
+                       debug_leave();
+                       debug_printf_exec("run_pipe: return %d\n", rcode);
+                       return rcode;
                }
 
                /* Expand the rest into (possibly) many strings each */
                argv_expanded = expand_strvec_to_strvec(argv + command->assignment_cnt);
 
-               for (x = bltins; x != &bltins[ARRAY_SIZE(bltins)]; x++) {
-                       if (strcmp(argv_expanded[0], x->cmd) != 0)
-                               continue;
-                       if (x->function == builtin_exec && argv_expanded[1] == NULL) {
-                               debug_printf("exec with redirects only\n");
-                               setup_redirects(command, NULL);
-                               rcode = EXIT_SUCCESS;
-                               goto clean_up_and_ret1;
+               x = find_builtin(argv_expanded[0]);
+#if ENABLE_HUSH_FUNCTIONS
+               funcp = NULL;
+               if (!x)
+                       funcp = find_function(argv_expanded[0]);
+#endif
+               if (x || funcp) {
+                       if (!funcp) {
+                               if (x->function == builtin_exec && argv_expanded[1] == NULL) {
+                                       debug_printf("exec with redirects only\n");
+                                       rcode = setup_redirects(command, NULL);
+                                       goto clean_up_and_ret1;
+                               }
                        }
-                       debug_printf("builtin inline %s\n", argv_expanded[0]);
                        /* XXX setup_redirects acts on file descriptors, not FILEs.
                         * This is perfect for work that comes after exec().
                         * Is it really safe for inline use?  Experimentally,
                         * things seem to work with glibc. */
-                       setup_redirects(command, squirrel);
-                       new_env = expand_assignments(argv, command->assignment_cnt);
-                       old_env = putenv_all_and_save_old(new_env);
-                       debug_printf_exec(": builtin '%s' '%s'...\n",
-                                   x->cmd, argv_expanded[1]);
-                       rcode = x->function(argv_expanded) & 0xff;
+                       rcode = setup_redirects(command, squirrel);
+                       if (rcode == 0) {
+                               new_env = expand_assignments(argv, command->assignment_cnt);
+                               old_env = putenv_all_and_save_old(new_env);
+                               if (!funcp) {
+                                       debug_printf_exec(": builtin '%s' '%s'...\n",
+                                               x->cmd, argv_expanded[1]);
+                                       rcode = x->function(argv_expanded) & 0xff;
+                               }
+#if ENABLE_HUSH_FUNCTIONS
+                               else {
+                                       debug_printf_exec(": function '%s' '%s'...\n",
+                                               funcp->name, argv_expanded[1]);
+                                       rcode = run_function(funcp, argv_expanded) & 0xff;
+                               }
+#endif
+                       }
 #if ENABLE_FEATURE_SH_STANDALONE
  clean_up_and_ret:
 #endif
                        restore_redirects(squirrel);
                        free_strings_and_unsetenv(new_env, 1);
                        putenv_all(old_env);
-                       free(old_env); /* not free_strings()! */
+                       /* Free the pointers, but the strings themselves
+                        * are in environ now, don't use free_strings! */
+                       free(old_env);
  clean_up_and_ret1:
                        free(argv_expanded);
                        IF_HAS_KEYWORDS(if (pi->pi_inverted) rcode = !rcode;)
+                       debug_leave();
                        debug_printf_exec("run_pipe return %d\n", rcode);
                        return rcode;
                }
+
 #if ENABLE_FEATURE_SH_STANDALONE
                i = find_applet_by_name(argv_expanded[0]);
                if (i >= 0 && APPLET_IS_NOFORK(i)) {
-                       setup_redirects(command, squirrel);
-                       save_nofork_data(&G.nofork_save);
-                       new_env = expand_assignments(argv, command->assignment_cnt);
-                       old_env = putenv_all_and_save_old(new_env);
-                       debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
+                       rcode = setup_redirects(command, squirrel);
+                       if (rcode == 0) {
+                               save_nofork_data(&G.nofork_save);
+                               new_env = expand_assignments(argv, command->assignment_cnt);
+                               old_env = putenv_all_and_save_old(new_env);
+                               debug_printf_exec(": run_nofork_applet '%s' '%s'...\n",
                                        argv_expanded[0], argv_expanded[1]);
-                       rcode = run_nofork_applet_prime(&G.nofork_save, i, argv_expanded);
+                               rcode = run_nofork_applet_prime(&G.nofork_save, i, argv_expanded);
+                       }
                        goto clean_up_and_ret;
                }
 #endif
@@ -2805,7 +3450,7 @@ static int run_pipe(struct pipe *pi)
                command->pid = BB_MMU ? fork() : vfork();
                if (!command->pid) { /* child */
 #if ENABLE_HUSH_JOB
-                       die_sleep = 0; /* let nofork's xfuncs die */
+                       disable_restore_tty_pgrp_on_exit();
 
                        /* Every child adds itself to new process group
                         * with pgid == pid_of_first_child_in_pipe */
@@ -2827,7 +3472,8 @@ static int run_pipe(struct pipe *pi)
                                close(pipefds[0]); /* read end */
                        /* Like bash, explicit redirects override pipes,
                         * and the pipe fd is available for dup'ing. */
-                       setup_redirects(command, NULL);
+                       if (setup_redirects(command, NULL))
+                               _exit(1);
 
                        /* Restore default handlers just prior to exec */
                        /*signal(SIGCHLD, SIG_DFL); - so far we don't have any handlers */
@@ -2838,12 +3484,18 @@ static int run_pipe(struct pipe *pi)
                        pseudo_exec((nommu_save_t*) &nommu_save, command, argv_expanded);
                        /* pseudo_exec() does not return */
                }
-               /* parent */
+
+               /* parent or error */
+               enable_restore_tty_pgrp_on_exit();
 #if !BB_MMU
                /* Clean up after vforked child */
+               clean_up_after_re_execute();
                free(nommu_save.argv);
                free_strings_and_unsetenv(nommu_save.new_env, 1);
                putenv_all(nommu_save.old_env);
+               /* Free the pointers, but the strings themselves
+                * are in environ now, don't use free_strings! */
+               free(nommu_save.old_env);
 #endif
                free(argv_expanded);
                argv_expanded = NULL;
@@ -2868,10 +3520,12 @@ static int run_pipe(struct pipe *pi)
        }
 
        if (!pi->alive_cmds) {
+               debug_leave();
                debug_printf_exec("run_pipe return 1 (all forks failed, no children)\n");
                return 1;
        }
 
+       debug_leave();
        debug_printf_exec("run_pipe return -1 (%u children started)\n", pi->alive_cmds);
        return -1;
 }
@@ -2914,8 +3568,8 @@ static void debug_print_tree(struct pipe *pi, int lvl)
                [RES_SNTX ] = "SNTX" ,
        };
        static const char *const GRPTYPE[] = {
-               "()",
                "{}",
+               "()",
 #if ENABLE_HUSH_FUNCTIONS
                "func()",
 #endif
@@ -2932,7 +3586,7 @@ static void debug_print_tree(struct pipe *pi, int lvl)
                        struct command *command = &pi->cmds[prn];
                        char **argv = command->argv;
 
-                       fprintf(stderr, "%*s prog %d assignment_cnt:%d",
+                       fprintf(stderr, "%*s cmd %d assignment_cnt:%d",
                                        lvl*2, "", prn,
                                        command->assignment_cnt);
                        if (command->group) {
@@ -2969,17 +3623,20 @@ static int run_list(struct pipe *pi)
        char **for_lcur = NULL;
        char **for_list = NULL;
 #endif
-       smallint flag_skip = 1;
-       smalluint rcode = 0; /* probably just for compiler */
+       smallint last_followup;
+       smalluint rcode;
 #if ENABLE_HUSH_IF || ENABLE_HUSH_CASE
        smalluint cond_code = 0;
 #else
-       enum { cond_code = 0, };
+       enum { cond_code = 0 };
+#endif
+#if HAS_KEYWORDS
+       smallint rword; /* enum reserved_style */
+       smallint last_rword; /* ditto */
 #endif
-       /*enum reserved_style*/ smallint rword = RES_NONE;
-       /*enum reserved_style*/ smallint skip_more_for_this_rword = RES_XXXX;
 
        debug_printf_exec("run_list start lvl %d\n", G.run_list_level + 1);
+       debug_enter();
 
 #if ENABLE_HUSH_LOOPS
        /* Check syntax for "for" */
@@ -2988,7 +3645,8 @@ static int run_list(struct pipe *pi)
                        continue;
                /* current word is FOR or IN (BOLD in comments below) */
                if (cpipe->next == NULL) {
-                       syntax("malformed for");
+                       syntax_error("malformed for");
+                       debug_leave();
                        debug_printf_exec("run_list lvl %d return 1\n", G.run_list_level);
                        return 1;
                }
@@ -2999,7 +3657,8 @@ static int run_list(struct pipe *pi)
                if (cpipe->res_word == RES_IN /* "for v IN a b; not_do..."? */
                 || cpipe->next->res_word != RES_IN /* FOR v not_do_and_not_in..."? */
                ) {
-                       syntax("malformed for");
+                       syntax_error("malformed for");
+                       debug_leave();
                        debug_printf_exec("run_list lvl %d return 1\n", G.run_list_level);
                        return 1;
                }
@@ -3048,23 +3707,29 @@ static int run_list(struct pipe *pi)
 ////           /* ctrl-Z handler will store pid etc in pi */
 ////           G.toplevel_list = pi;
 ////           G.ctrl_z_flag = 0;
-////#if ENABLE_FEATURE_SH_STANDALONE
-////           G.nofork_save.saved = 0; /* in case we will run a nofork later */
-////#endif
+#if ENABLE_FEATURE_SH_STANDALONE
+               G.nofork_save.saved = 0; /* in case we will run a nofork later */
+#endif
 ////           signal_SA_RESTART_empty_mask(SIGTSTP, handler_ctrl_z);
 ////           signal(SIGINT, handler_ctrl_c);
        }
 #endif /* JOB */
 
+#if HAS_KEYWORDS
+       rword = RES_NONE;
+       last_rword = RES_XXXX;
+#endif
+       last_followup = PIPE_SEQ;
+       rcode = G.last_exitcode;
+
        /* Go through list of pipes, (maybe) executing them. */
        for (; pi; pi = USE_HUSH_LOOPS(rword == RES_DONE ? loop_top : ) pi->next) {
                if (G.flag_SIGINT)
                        break;
 
                IF_HAS_KEYWORDS(rword = pi->res_word;)
-               IF_HAS_NO_KEYWORDS(rword = RES_NONE;)
-               debug_printf_exec(": rword=%d cond_code=%d skip_more=%d\n",
-                               rword, cond_code, skip_more_for_this_rword);
+               debug_printf_exec(": rword=%d cond_code=%d last_rword=%d\n",
+                               rword, cond_code, last_rword);
 #if ENABLE_HUSH_LOOPS
                if ((rword == RES_WHILE || rword == RES_UNTIL || rword == RES_FOR)
                 && loop_top == NULL /* avoid bumping G.depth_of_loop twice */
@@ -3074,18 +3739,25 @@ static int run_list(struct pipe *pi)
                        G.depth_of_loop++;
                }
 #endif
-               if (rword == skip_more_for_this_rword && flag_skip) {
-                       if (pi->followup == PIPE_SEQ)
-                               flag_skip = 0;
-                       /* it is "<false> && CMD" or "<true> || CMD"
-                        * and we should not execute CMD */
-                       continue;
+               /* Still in the same "if...", "then..." or "do..." branch? */
+               if (IF_HAS_KEYWORDS(rword == last_rword &&) 1) {
+                       if ((rcode == 0 && last_followup == PIPE_OR)
+                        || (rcode != 0 && last_followup == PIPE_AND)
+                       ) {
+                               /* It is "<true> || CMD" or "<false> && CMD"
+                                * and we should not execute CMD */
+                               debug_printf_exec("skipped cmd because of || or &&\n");
+                               last_followup = pi->followup;
+                               continue;
+                       }
                }
-               flag_skip = 1;
-               skip_more_for_this_rword = RES_XXXX;
+               last_followup = pi->followup;
+               IF_HAS_KEYWORDS(last_rword = rword;)
 #if ENABLE_HUSH_IF
                if (cond_code) {
                        if (rword == RES_THEN) {
+                               /* if false; then ... fi has exitcode 0! */
+                               G.last_exitcode = rcode = EXIT_SUCCESS;
                                /* "if <false> THEN cmd": skip cmd */
                                continue;
                        }
@@ -3113,8 +3785,11 @@ static int run_list(struct pipe *pi)
                                vals = (char**)encoded_dollar_at_argv;
                                if (pi->next->res_word == RES_IN) {
                                        /* if no variable values after "in" we skip "for" */
-                                       if (!pi->next->cmds[0].argv)
+                                       if (!pi->next->cmds[0].argv) {
+                                               G.last_exitcode = rcode = EXIT_SUCCESS;
+                                               debug_printf_exec(": null FOR: exitcode EXIT_SUCCESS\n");
                                                break;
+                                       }
                                        vals = pi->next->cmds[0].argv;
                                } /* else: "for var; do..." -> assume "$@" list */
                                /* create list of variable values */
@@ -3134,8 +3809,8 @@ static int run_list(struct pipe *pi)
                                pi->cmds[0].argv[0] = for_varname;
                                break;
                        }
-                       /* insert next value from for_lcur */
-//TODO: does it need escaping?
+                       /* Insert next value from for_lcur */
+                       /* note: *for_lcur already has quotes removed, $var expanded, etc */
                        pi->cmds[0].argv[0] = xasprintf("%s=%s", for_varname, *for_lcur++);
                        pi->cmds[0].assignment_cnt = 1;
                }
@@ -3188,7 +3863,7 @@ static int run_list(struct pipe *pi)
 
                /* After analyzing all keywords and conditions, we decided
                 * to execute this pipe. NB: have to do checkjobs(NULL)
-                * after run_pipe() to collect any background children,
+                * after run_pipe to collect any background children,
                 * even if list execution is to be stopped. */
                debug_printf_exec(": run_pipe with %d members\n", pi->num_cmds);
                {
@@ -3198,14 +3873,16 @@ static int run_list(struct pipe *pi)
 #endif
                        rcode = r = run_pipe(pi); /* NB: rcode is a smallint */
                        if (r != -1) {
-                               /* we only ran a builtin: rcode is already known
+                               /* We only ran a builtin: rcode is already known
                                 * and we don't need to wait for anything. */
+                               G.last_exitcode = rcode;
+                               debug_printf_exec(": builtin/func exitcode %d\n", rcode);
                                check_and_run_traps(0);
 #if ENABLE_HUSH_LOOPS
-                               /* was it "break" or "continue"? */
+                               /* Was it "break" or "continue"? */
                                if (G.flag_break_continue) {
                                        smallint fbc = G.flag_break_continue;
-                                       /* we might fall into outer *loop*,
+                                       /* We might fall into outer *loop*,
                                         * don't want to break it too */
                                        if (loop_top) {
                                                G.depth_break_continue--;
@@ -3221,7 +3898,7 @@ static int run_list(struct pipe *pi)
                                }
 #endif
                        } else if (pi->followup == PIPE_BG) {
-                               /* what does bash do with attempts to background builtins? */
+                               /* What does bash do with attempts to background builtins? */
                                /* even bash 3.2 doesn't do that well with nested bg:
                                 * try "{ { sleep 10; echo DEEP; } & echo HERE; } &".
                                 * I'm NOT treating inner &'s as jobs */
@@ -3230,25 +3907,25 @@ static int run_list(struct pipe *pi)
                                if (G.run_list_level == 1)
                                        insert_bg_job(pi);
 #endif
-                               rcode = 0; /* EXIT_SUCCESS */
+                               G.last_exitcode = rcode = EXIT_SUCCESS;
+                               debug_printf_exec(": cmd&: exitcode EXIT_SUCCESS\n");
                        } else {
 #if ENABLE_HUSH_JOB
                                if (G.run_list_level == 1 && G_interactive_fd) {
-                                       /* waits for completion, then fg's main shell */
+                                       /* Waits for completion, then fg's main shell */
                                        rcode = checkjobs_and_fg_shell(pi);
+                                       debug_printf_exec(": checkjobs_and_fg_shell exitcode %d\n", rcode);
                                        check_and_run_traps(0);
-                                       debug_printf_exec(": checkjobs_and_fg_shell returned %d\n", rcode);
                                } else
 #endif
-                               { /* this one just waits for completion */
+                               { /* This one just waits for completion */
                                        rcode = checkjobs(pi);
+                                       debug_printf_exec(": checkjobs exitcode %d\n", rcode);
                                        check_and_run_traps(0);
-                                       debug_printf_exec(": checkjobs returned %d\n", rcode);
                                }
+                               G.last_exitcode = rcode;
                        }
                }
-               debug_printf_exec(": setting last_return_code=%d\n", rcode);
-               G.last_return_code = rcode;
 
                /* Analyze how result affects subsequent commands */
 #if ENABLE_HUSH_IF
@@ -3256,25 +3933,26 @@ static int run_list(struct pipe *pi)
                        cond_code = rcode;
 #endif
 #if ENABLE_HUSH_LOOPS
-               if (rword == RES_WHILE) {
-                       if (rcode) {
-                               rcode = 0; /* "while false; do...done" - exitcode 0 */
-                               goto check_jobs_and_break;
+               /* Beware of "while false; true; do ..."! */
+               if (pi->next && pi->next->res_word == RES_DO) {
+                       if (rword == RES_WHILE) {
+                               if (rcode) {
+                                       /* "while false; do...done" - exitcode 0 */
+                                       G.last_exitcode = rcode = EXIT_SUCCESS;
+                                       debug_printf_exec(": while expr is false: breaking (exitcode:EXIT_SUCCESS)\n");
+                                       goto check_jobs_and_break;
+                               }
                        }
-               }
-               if (rword == RES_UNTIL) {
-                       if (!rcode) {
+                       if (rword == RES_UNTIL) {
+                               if (!rcode) {
+                                       debug_printf_exec(": until expr is true: breaking\n");
  check_jobs_and_break:
-                               checkjobs(NULL);
-                               break;
+                                       checkjobs(NULL);
+                                       break;
+                               }
                        }
                }
 #endif
-               if ((rcode == 0 && pi->followup == PIPE_OR)
-                || (rcode != 0 && pi->followup == PIPE_AND)
-               ) {
-                       skip_more_for_this_rword = rword;
-               }
 
  check_jobs_and_continue:
                checkjobs(NULL);
@@ -3294,7 +3972,6 @@ static int run_list(struct pipe *pi)
 ////           signal(SIGINT, SIG_IGN);
 ////   }
 #endif
-       debug_printf_exec("run_list lvl %d return %d\n", G.run_list_level + 1, rcode);
 #if ENABLE_HUSH_LOOPS
        if (loop_top)
                G.depth_of_loop--;
@@ -3303,101 +3980,26 @@ static int run_list(struct pipe *pi)
 #if ENABLE_HUSH_CASE
        free(case_word);
 #endif
+       debug_leave();
+       debug_printf_exec("run_list lvl %d return %d\n", G.run_list_level + 1, rcode);
        return rcode;
 }
 
-/* Select which version we will use */
-static int run_and_free_list(struct pipe *pi)
-{
-       int rcode = 0;
-       debug_printf_exec("run_and_free_list entered\n");
-       if (!G.fake_mode) {
-               debug_printf_exec(": run_list with %d members\n", pi->num_cmds);
-               rcode = run_list(pi);
-       }
-       /* free_pipe_list has the side effect of clearing memory.
-        * In the long run that function can be merged with run_list,
-        * but doing that now would hobble the debugging effort. */
-       free_pipe_list(pi, /* indent: */ 0);
-       debug_printf_exec("run_and_free_list return %d\n", rcode);
-       return rcode;
-}
-
-
-/* Peek ahead in the in_str to find out if we have a "&n" construct,
- * as in "2>&1", that represents duplicating a file descriptor.
- * Return either -2 (syntax error), -1 (no &), or the number found.
- */
-static int redirect_dup_num(struct in_str *input)
-{
-       int ch, d = 0, ok = 0;
-       ch = i_peek(input);
-       if (ch != '&') return -1;
-
-       i_getch(input);  /* get the & */
-       ch = i_peek(input);
-       if (ch == '-') {
-               i_getch(input);
-               return -3;  /* "-" represents "close me" */
-       }
-       while (isdigit(ch)) {
-               d = d*10 + (ch-'0');
-               ok = 1;
-               i_getch(input);
-               ch = i_peek(input);
-       }
-       if (ok) return d;
-
-       bb_error_msg("ambiguous redirect");
-       return -2;
-}
-
-/* The src parameter allows us to peek forward to a possible &n syntax
- * for file descriptor duplication, e.g., "2>&1".
- * Return code is 0 normally, 1 if a syntax error is detected in src.
- * Resource errors (in xmalloc) cause the process to exit */
-static int setup_redirect(struct parse_context *ctx,
-               int fd,
-               redir_type style,
-               struct in_str *input)
-{
-       struct command *command = ctx->command;
-       struct redir_struct *redir;
-       struct redir_struct **redirp;
-       int dup_num;
-
-       /* Check for a '2>&1' type redirect */
-       dup_num = redirect_dup_num(input);
-       if (dup_num == -2)
-               return 1;  /* syntax error */
-
-       /* Create a new redir_struct and drop it onto the end of the linked list */
-       redirp = &command->redirects;
-       while ((redir = *redirp) != NULL) {
-               redirp = &(redir->next);
-       }
-       *redirp = redir = xzalloc(sizeof(*redir));
-       /* redir->next = NULL; */
-       /* redir->rd_filename = NULL; */
-       redir->rd_type = style;
-       redir->fd = (fd == -1) ? redir_table[style].default_fd : fd;
-
-       debug_printf("Redirect type %d%s\n", redir->fd, redir_table[style].descrip);
-
-       redir->dup = dup_num;
-       if (dup_num != -1) {
-               /* Erik had a check here that the file descriptor in question
-                * is legit; I postpone that to "run time"
-                * A "-" representation of "close me" shows up as a -3 here */
-               debug_printf("Duplicating redirect '%d>&%d'\n", redir->fd, redir->dup);
-       } else {
-               /* We do _not_ try to open the file that src points to,
-                * since we need to return and let src be expanded first.
-                * Set ctx->pending_redirect, so we know what to do at the
-                * end of the next parsed word. */
-               ctx->pending_redirect = redir;
+/* Select which version we will use */
+static int run_and_free_list(struct pipe *pi)
+{
+       int rcode = 0;
+       debug_printf_exec("run_and_free_list entered\n");
+       if (!G.fake_mode) {
+               debug_printf_exec(": run_list: 1st pipe with %d cmds\n", pi->num_cmds);
+               rcode = run_list(pi);
        }
-       return 0;
+       /* free_pipe_list has the side effect of clearing memory.
+        * In the long run that function can be merged with run_list,
+        * but doing that now would hobble the debugging effort. */
+       free_pipe_list(pi);
+       debug_printf_exec("run_and_free_list return %d\n", rcode);
+       return rcode;
 }
 
 
@@ -3425,10 +4027,12 @@ static int done_command(struct parse_context *ctx)
                 && command->redirects == NULL
                ) {
                        debug_printf_parse("done_command: skipping null cmd, num_cmds=%d\n", pi->num_cmds);
+                       memset(command, 0, sizeof(*command)); /* paranoia */
                        return pi->num_cmds;
                }
                pi->num_cmds++;
                debug_printf_parse("done_command: ++num_cmds=%d\n", pi->num_cmds);
+               //debug_print_tree(ctx->list_head, 20);
        } else {
                debug_printf_parse("done_command: initializing, num_cmds=%d\n", pi->num_cmds);
        }
@@ -3453,16 +4057,30 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
        /* Close previous command */
        not_null = done_command(ctx);
        ctx->pipe->followup = type;
-       IF_HAS_KEYWORDS(ctx->pipe->pi_inverted = ctx->ctx_inverted;)
-       IF_HAS_KEYWORDS(ctx->ctx_inverted = 0;)
-       IF_HAS_KEYWORDS(ctx->pipe->res_word = ctx->ctx_res_w;)
+#if HAS_KEYWORDS
+       ctx->pipe->pi_inverted = ctx->ctx_inverted;
+       ctx->ctx_inverted = 0;
+       ctx->pipe->res_word = ctx->ctx_res_w;
+#endif
 
        /* Without this check, even just <enter> on command line generates
         * tree of three NOPs (!). Which is harmless but annoying.
         * IOW: it is safe to do it unconditionally.
         * RES_NONE case is for "for a in; do ..." (empty IN set)
-        * to work, possibly other cases too. */
-       if (not_null IF_HAS_KEYWORDS(|| ctx->ctx_res_w != RES_NONE)) {
+        * and other cases to work. */
+       if (not_null
+#if ENABLE_HUSH_IF
+        || ctx->ctx_res_w == RES_FI
+#endif
+#if ENABLE_HUSH_LOOPS
+        || ctx->ctx_res_w == RES_DONE
+        || ctx->ctx_res_w == RES_FOR
+        || ctx->ctx_res_w == RES_IN
+#endif
+#if ENABLE_HUSH_CASE
+        || ctx->ctx_res_w == RES_ESAC
+#endif
+       ) {
                struct pipe *new_p;
                debug_printf_parse("done_pipe: adding new pipe: "
                                "not_null:%d ctx->ctx_res_w:%d\n",
@@ -3491,6 +4109,7 @@ static void done_pipe(struct parse_context *ctx, pipe_style type)
                 * ctx->command = &ctx->pipe->cmds[0];
                 */
                done_command(ctx);
+               //debug_print_tree(ctx->list_head, 10);
        }
        debug_printf_parse("done_pipe return\n");
 }
@@ -3506,7 +4125,6 @@ static void initialize_context(struct parse_context *ctx)
        done_command(ctx);
 }
 
-
 /* If a reserved word is found and processed, parse context is modified
  * and 1 is returned.
  */
@@ -3600,7 +4218,7 @@ static int reserved_word(o_string *word, struct parse_context *ctx)
 #endif
        if (r->flag == 0) { /* '!' */
                if (ctx->ctx_inverted) { /* bash doesn't accept '! ! true' */
-                       syntax("! ! command");
+                       syntax_error("! ! command");
                        IF_HAS_KEYWORDS(ctx->ctx_res_w = RES_SNTX;)
                }
                ctx->ctx_inverted = 1;
@@ -3614,7 +4232,7 @@ static int reserved_word(o_string *word, struct parse_context *ctx)
                initialize_context(ctx);
                ctx->stack = old;
        } else if (/*ctx->ctx_res_w == RES_NONE ||*/ !(ctx->old_flag & (1 << r->res))) {
-               syntax(word->data);
+               syntax_error_at(word->data);
                ctx->ctx_res_w = RES_SNTX;
                return 1;
        }
@@ -3651,42 +4269,67 @@ static int done_word(o_string *word, struct parse_context *ctx)
        struct command *command = ctx->command;
 
        debug_printf_parse("done_word entered: '%s' %p\n", word->data, command);
-       if (word->length == 0 && word->nonnull == 0) {
+       if (word->length == 0 && word->o_quoted == 0) {
                debug_printf_parse("done_word return 0: true null, ignored\n");
                return 0;
        }
-       /* If this word wasn't an assignment, next ones definitely
-        * can't be assignments. Even if they look like ones. */
-       if (word->o_assignment != DEFINITELY_ASSIGNMENT
-        && word->o_assignment != WORD_IS_KEYWORD
-       ) {
-               word->o_assignment = NOT_ASSIGNMENT;
-       } else {
-               if (word->o_assignment == DEFINITELY_ASSIGNMENT)
-                       command->assignment_cnt++;
-               word->o_assignment = MAYBE_ASSIGNMENT;
-       }
 
        if (ctx->pending_redirect) {
                /* We do not glob in e.g. >*.tmp case. bash seems to glob here
                 * only if run as "bash", not "sh" */
+               /* http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
+                * "2.7 Redirection
+                * ...the word that follows the redirection operator
+                * shall be subjected to tilde expansion, parameter expansion,
+                * command substitution, arithmetic expansion, and quote
+                * removal. Pathname expansion shall not be performed
+                * on the word by a non-interactive shell; an interactive
+                * shell may perform it, but shall do so only when
+                * the expansion would result in one word."
+                */
                ctx->pending_redirect->rd_filename = xstrdup(word->data);
-               word->o_assignment = NOT_ASSIGNMENT;
-               debug_printf("word stored in rd_filename: '%s'\n", word->data);
+               /* Cater for >\file case:
+                * >\a creates file a; >\\a, >"\a", >"\\a" create file \a
+                * Same with heredocs:
+                * for <<\H delim is H; <<\\H, <<"\H", <<"\\H" - \H
+                */
+               unbackslash(ctx->pending_redirect->rd_filename);
+               /* Is it <<"HEREDOC"? */
+               if (ctx->pending_redirect->rd_type == REDIRECT_HEREDOC
+                && word->o_quoted
+               ) {
+                       ctx->pending_redirect->rd_dup |= HEREDOC_QUOTED;
+               }
+               debug_printf_parse("word stored in rd_filename: '%s'\n", word->data);
+               ctx->pending_redirect = NULL;
        } else {
-               /* "{ echo foo; } echo bar" - bad */
-               /* NB: bash allows e.g.:
-                * if true; then { echo foo; } fi
-                * while if false; then false; fi do break; done
-                * TODO? */
+               /* If this word wasn't an assignment, next ones definitely
+                * can't be assignments. Even if they look like ones. */
+               if (word->o_assignment != DEFINITELY_ASSIGNMENT
+                && word->o_assignment != WORD_IS_KEYWORD
+               ) {
+                       word->o_assignment = NOT_ASSIGNMENT;
+               } else {
+                       if (word->o_assignment == DEFINITELY_ASSIGNMENT)
+                               command->assignment_cnt++;
+                       word->o_assignment = MAYBE_ASSIGNMENT;
+               }
+
                if (command->group) {
-                       syntax(word->data);
+                       /* "{ echo foo; } echo bar" - bad */
+                       /* NB: bash allows e.g.:
+                        * if true; then { echo foo; } fi
+                        * while if false; then false; fi do break; done
+                        * and disallows:
+                        * while if false; then false; fi; do; break; done
+                        * TODO? */
+                       syntax_error_at(word->data);
                        debug_printf_parse("done_word return 1: syntax error, "
                                        "groups and arglists don't mix\n");
                        return 1;
                }
 #if HAS_KEYWORDS
-#if ENABLE_HUSH_CASE
+# if ENABLE_HUSH_CASE
                if (ctx->ctx_dsemicolon
                 && strcmp(word->data, "esac") != 0 /* not "... pattern) cmd;; esac" */
                ) {
@@ -3694,23 +4337,23 @@ static int done_word(o_string *word, struct parse_context *ctx)
                        /* ctx->ctx_res_w = RES_MATCH; */
                        ctx->ctx_dsemicolon = 0;
                } else
-#endif
+# endif
                if (!command->argv /* if it's the first word... */
-#if ENABLE_HUSH_LOOPS
+# if ENABLE_HUSH_LOOPS
                 && ctx->ctx_res_w != RES_FOR /* ...not after FOR or IN */
                 && ctx->ctx_res_w != RES_IN
-#endif
+# endif
                ) {
                        debug_printf_parse(": checking '%s' for reserved-ness\n", word->data);
                        if (reserved_word(word, ctx)) {
-                               o_reset(word);
+                               o_reset_to_empty_unquoted(word);
                                debug_printf_parse("done_word return %d\n",
                                                (ctx->ctx_res_w == RES_SNTX));
                                return (ctx->ctx_res_w == RES_SNTX);
                        }
                }
 #endif
-               if (word->nonnull /* word had "xx" or 'xx' at least as part of it. */
+               if (word->o_quoted /* word had "xx" or 'xx' at least as part of it. */
                 /* optimization: and if it's ("" or '') or ($v... or `cmd`...): */
                 && (word->data[0] == '\0' || word->data[0] == SPECIAL_VAR_SYMBOL)
                 /* (otherwise it's known to be not empty and is already safe) */
@@ -3733,19 +4376,26 @@ static int done_word(o_string *word, struct parse_context *ctx)
                        }
                }
                command->argv = add_string_to_strings(command->argv, xstrdup(word->data));
+//SEGV, but good idea.
+//             command->argv = add_string_to_strings(command->argv, word->data);
+//             word->data = NULL;
+//             word->length = 0;
                debug_print_strings("word appended to argv", command->argv);
        }
 
-       o_reset(word);
-       ctx->pending_redirect = NULL;
-
 #if ENABLE_HUSH_LOOPS
-       /* Force FOR to have just one word (variable name) */
-       /* NB: basically, this makes hush see "for v in ..." syntax as if
-        * as it is "for v; in ...". FOR and IN become two pipe structs
-        * in parse tree. */
        if (ctx->ctx_res_w == RES_FOR) {
-//TODO: check that command->argv[0] is a valid variable name!
+               if (word->o_quoted
+                || !is_well_formed_var_name(command->argv[0], '\0')
+               ) {
+                       /* bash says just "not a valid identifier" */
+                       syntax_error("not a valid identifier in for");
+                       return 1;
+               }
+               /* Force FOR to have just one word (variable name) */
+               /* NB: basically, this makes hush see "for v in ..."
+                * syntax as if it is "for v; in ...". FOR and IN become
+                * two pipe structs in parse tree. */
                done_pipe(ctx, PIPE_SEQ);
        }
 #endif
@@ -3755,10 +4405,128 @@ static int done_word(o_string *word, struct parse_context *ctx)
                done_pipe(ctx, PIPE_SEQ);
        }
 #endif
+
+       o_reset_to_empty_unquoted(word);
+
        debug_printf_parse("done_word return 0\n");
        return 0;
 }
 
+
+/* Peek ahead in the input to find out if we have a "&n" construct,
+ * as in "2>&1", that represents duplicating a file descriptor.
+ * Return:
+ * REDIRFD_CLOSE if >&- "close fd" construct is seen,
+ * REDIRFD_SYNTAX_ERR if syntax error,
+ * REDIRFD_TO_FILE if no & was seen,
+ * or the number found.
+ */
+#if BB_MMU
+#define parse_redir_right_fd(as_string, input) \
+       parse_redir_right_fd(input)
+#endif
+static int parse_redir_right_fd(o_string *as_string, struct in_str *input)
+{
+       int ch, d, ok;
+
+       ch = i_peek(input);
+       if (ch != '&')
+               return REDIRFD_TO_FILE;
+
+       ch = i_getch(input);  /* get the & */
+       nommu_addchr(as_string, ch);
+       ch = i_peek(input);
+       if (ch == '-') {
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
+               return REDIRFD_CLOSE;
+       }
+       d = 0;
+       ok = 0;
+       while (ch != EOF && isdigit(ch)) {
+               d = d*10 + (ch-'0');
+               ok = 1;
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
+               ch = i_peek(input);
+       }
+       if (ok) return d;
+
+//TODO: this is the place to catch ">&file" bashism (redirect both fd 1 and 2)
+
+       bb_error_msg("ambiguous redirect");
+       return REDIRFD_SYNTAX_ERR;
+}
+
+/* Return code is 0 normal, 1 if a syntax error is detected
+ */
+static int parse_redirect(struct parse_context *ctx,
+               int fd,
+               redir_type style,
+               struct in_str *input)
+{
+       struct command *command = ctx->command;
+       struct redir_struct *redir;
+       struct redir_struct **redirp;
+       int dup_num;
+
+       dup_num = REDIRFD_TO_FILE;
+       if (style != REDIRECT_HEREDOC) {
+               /* Check for a '>&1' type redirect */
+               dup_num = parse_redir_right_fd(&ctx->as_string, input);
+               if (dup_num == REDIRFD_SYNTAX_ERR)
+                       return 1;
+       } else {
+               int ch = i_peek(input);
+               dup_num = (ch == '-'); /* HEREDOC_SKIPTABS bit is 1 */
+               if (dup_num) { /* <<-... */
+                       ch = i_getch(input);
+                       nommu_addchr(&ctx->as_string, ch);
+                       ch = i_peek(input);
+               }
+       }
+
+       if (style == REDIRECT_OVERWRITE && dup_num == REDIRFD_TO_FILE) {
+               int ch = i_peek(input);
+               if (ch == '|') {
+                       /* >|FILE redirect ("clobbering" >).
+                        * Since we do not support "set -o noclobber" yet,
+                        * >| and > are the same for now. Just eat |.
+                        */
+                       ch = i_getch(input);
+                       nommu_addchr(&ctx->as_string, ch);
+               }
+       }
+
+       /* Create a new redir_struct and append it to the linked list */
+       redirp = &command->redirects;
+       while ((redir = *redirp) != NULL) {
+               redirp = &(redir->next);
+       }
+       *redirp = redir = xzalloc(sizeof(*redir));
+       /* redir->next = NULL; */
+       /* redir->rd_filename = NULL; */
+       redir->rd_type = style;
+       redir->rd_fd = (fd == -1) ? redir_table[style].default_fd : fd;
+
+       debug_printf_parse("redirect type %d %s\n", redir->rd_fd,
+                               redir_table[style].descrip);
+
+       redir->rd_dup = dup_num;
+       if (style != REDIRECT_HEREDOC && dup_num != REDIRFD_TO_FILE) {
+               /* Erik had a check here that the file descriptor in question
+                * is legit; I postpone that to "run time"
+                * A "-" representation of "close me" shows up as a -3 here */
+               debug_printf_parse("duplicating redirect '%d>&%d'\n",
+                               redir->rd_fd, redir->rd_dup);
+       } else {
+               /* Set ctx->pending_redirect, so we know what to do at the
+                * end of the next parsed word. */
+               ctx->pending_redirect = redir;
+       }
+       return 0;
+}
+
 /* If a redirect is immediately preceded by a number, that number is
  * supposed to tell which file descriptor to redirect.  This routine
  * looks for such preceding numbers.  In an ideal world this routine
@@ -3767,33 +4535,122 @@ static int done_word(o_string *word, struct parse_context *ctx)
  *     echo 49>foo    # redirects fd 49 to file "foo", nothing passed to echo
  *     echo -2>foo    # redirects fd  1 to file "foo",    "-2" passed to echo
  *     echo 49x>foo   # redirects fd  1 to file "foo",   "49x" passed to echo
- * A -1 output from this program means no valid number was found, so the
- * caller should use the appropriate default for this redirection.
+ *
+ * http://www.opengroup.org/onlinepubs/009695399/utilities/xcu_chap02.html
+ * "2.7 Redirection
+ * ... If n is quoted, the number shall not be recognized as part of
+ * the redirection expression. For example:
+ * echo \2>a
+ * writes the character 2 into file a"
+ * We are getting it right by setting ->o_quoted on any \<char>
+ *
+ * A -1 return means no valid number was found,
+ * the caller should use the appropriate default for this redirection.
  */
 static int redirect_opt_num(o_string *o)
 {
        int num;
 
-       if (o->length == 0)
+       if (o->data == NULL)
                return -1;
-       for (num = 0; num < o->length; num++) {
-               if (!isdigit(o->data[num])) {
-                       return -1;
-               }
-       }
-       num = atoi(o->data);
-       o_reset(o);
+       num = bb_strtou(o->data, NULL, 10);
+       if (errno || num < 0)
+               return -1;
+       o_reset_to_empty_unquoted(o);
        return num;
 }
 
 #if BB_MMU
-#define parse_stream(pstring, input, end_trigger) \
-       parse_stream(input, end_trigger)
+#define fetch_till_str(as_string, input, word, skip_tabs) \
+       fetch_till_str(input, word, skip_tabs)
 #endif
-static struct pipe *parse_stream(char **pstring,
+static char *fetch_till_str(o_string *as_string,
                struct in_str *input,
-               int end_trigger);
-static void parse_and_run_string(const char *s);
+               const char *word,
+               int skip_tabs)
+{
+       o_string heredoc = NULL_O_STRING;
+       int past_EOL = 0;
+       int ch;
+
+       goto jump_in;
+       while (1) {
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
+               if (ch == '\n') {
+                       if (strcmp(heredoc.data + past_EOL, word) == 0) {
+                               heredoc.data[past_EOL] = '\0';
+                               debug_printf_parse("parsed heredoc '%s'\n", heredoc.data);
+                               return heredoc.data;
+                       }
+                       do {
+                               o_addchr(&heredoc, ch);
+                               past_EOL = heredoc.length;
+ jump_in:
+                               do {
+                                       ch = i_getch(input);
+                                       nommu_addchr(as_string, ch);
+                               } while (skip_tabs && ch == '\t');
+                       } while (ch == '\n');
+               }
+               if (ch == EOF) {
+                       o_free_unsafe(&heredoc);
+                       return NULL;
+               }
+               o_addchr(&heredoc, ch);
+               nommu_addchr(as_string, ch);
+       }
+}
+
+/* Look at entire parse tree for not-yet-loaded REDIRECT_HEREDOCs
+ * and load them all. There should be exactly heredoc_cnt of them.
+ */
+static int fetch_heredocs(int heredoc_cnt, struct parse_context *ctx, struct in_str *input)
+{
+       struct pipe *pi = ctx->list_head;
+
+       while (pi && heredoc_cnt) {
+               int i;
+               struct command *cmd = pi->cmds;
+
+               debug_printf_parse("fetch_heredocs: num_cmds:%d cmd argv0:'%s'\n",
+                               pi->num_cmds,
+                               cmd->argv ? cmd->argv[0] : "NONE");
+               for (i = 0; i < pi->num_cmds; i++) {
+                       struct redir_struct *redir = cmd->redirects;
+
+                       debug_printf_parse("fetch_heredocs: %d cmd argv0:'%s'\n",
+                                       i, cmd->argv ? cmd->argv[0] : "NONE");
+                       while (redir) {
+                               if (redir->rd_type == REDIRECT_HEREDOC) {
+                                       char *p;
+
+                                       redir->rd_type = REDIRECT_HEREDOC2;
+                                       /* redir->dup is (ab)used to indicate <<- */
+                                       p = fetch_till_str(&ctx->as_string, input,
+                                               redir->rd_filename, redir->rd_dup & HEREDOC_SKIPTABS);
+                                       if (!p) {
+                                               syntax_error("unexpected EOF in here document");
+                                               return 1;
+                                       }
+                                       free(redir->rd_filename);
+                                       redir->rd_filename = p;
+                                       heredoc_cnt--;
+                               }
+                               redir = redir->next;
+                       }
+                       cmd++;
+               }
+               pi = pi->next;
+       }
+#if 0
+       /* Should be 0. If it isn't, it's a parse error */
+       if (heredoc_cnt)
+               bb_error_msg_and_die("heredoc BUG 2");
+#endif
+       return 0;
+}
+
 
 #if ENABLE_HUSH_TICK
 static FILE *generate_stream_from_string(const char *s)
@@ -3807,6 +4664,7 @@ static FILE *generate_stream_from_string(const char *s)
                bb_perror_msg_and_die(BB_MMU ? "fork" : "vfork");
 
        if (pid == 0) { /* child */
+               disable_restore_tty_pgrp_on_exit();
                /* Process substitution is not considered to be usual
                 * 'command execution'.
                 * SUSv3 says ctrl-Z should be ignored, ctrl-C should not.
@@ -3816,28 +4674,29 @@ static FILE *generate_stream_from_string(const char *s)
                        + (1 << SIGTTIN)
                        + (1 << SIGTTOU)
                        , SIG_IGN);
-               if (ENABLE_HUSH_JOB)
-                       die_sleep = 0; /* let nofork's xfuncs die */
                close(channel[0]); /* NB: close _first_, then move fd! */
                xmove_fd(channel[1], 1);
                /* Prevent it from trying to handle ctrl-z etc */
                USE_HUSH_JOB(G.run_list_level = 1;)
 #if BB_MMU
+               reset_traps_to_defaults();
                parse_and_run_string(s);
-               _exit(G.last_return_code);
+               _exit(G.last_exitcode);
 #else
        /* We re-execute after vfork on NOMMU. This makes this script safe:
-        * yes "0123456789012345678901234567890" | dd bs=32 count=64k >TESTFILE
-        * huge=`cat TESTFILE` # was blocking here forever
+        * yes "0123456789012345678901234567890" | dd bs=32 count=64k >BIG
+        * huge=`cat BIG` # was blocking here forever
         * echo OK
         */
-//TODO: pass non-exported variables, traps, and functions
-               execl(bb_busybox_exec_path, "hush", "-c", s, NULL);
-               _exit(127);
+               re_execute_shell(s,
+                               G.global_argv[0],
+                               G.global_argv + 1);
 #endif
        }
 
        /* parent */
+       enable_restore_tty_pgrp_on_exit();
+       clean_up_after_re_execute();
        close(channel[1]);
        pf = fdopen(channel[0], "r");
        return pf;
@@ -3895,28 +4754,55 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
 
        debug_printf_parse("parse_group entered\n");
 #if ENABLE_HUSH_FUNCTIONS
-       if (ch == 'F') { /* function definition? */
-               bb_error_msg("aha '%s' is a function, parsing it...", dest->data);
-               //command->fname = dest->data;
+       if (ch == '(' && !dest->o_quoted) {
+               if (dest->length)
+                       done_word(dest, ctx);
+               if (!command->argv)
+                       goto skip; /* (... */
+               if (command->argv[1]) { /* word word ... (... */
+                       syntax_error_unexpected_ch('(');
+                       return 1;
+               }
+               /* it is "word(..." or "word (..." */
+               do
+                       ch = i_getch(input);
+               while (ch == ' ' || ch == '\t');
+               if (ch != ')') {
+                       syntax_error_unexpected_ch(ch);
+                       return 1;
+               }
+               nommu_addchr(&ctx->as_string, ch);
+               do
+                       ch = i_getch(input);
+               while (ch == ' ' || ch == '\t' || ch == '\n');
+               if (ch != '{') {
+                       syntax_error_unexpected_ch(ch);
+                       return 1;
+               }
+               nommu_addchr(&ctx->as_string, ch);
                command->grp_type = GRP_FUNCTION;
-//TODO: review every o_reset() location... do they handle all o_string fields correctly?
-               memset(dest, 0, sizeof(*dest));
+               goto skip;
        }
 #endif
-       if (command->argv /* word [word](... */
-        || dest->length /* word(... */
-        || dest->nonnull /* ""(... */
+       if (command->argv /* word [word]{... */
+        || dest->length /* word{... */
+        || dest->o_quoted /* ""{... */
        ) {
-               syntax(NULL);
+               syntax_error(NULL);
                debug_printf_parse("parse_group return 1: "
                        "syntax error, groups and arglists don't mix\n");
                return 1;
        }
+
+#if ENABLE_HUSH_FUNCTIONS
+ skip:
+#endif
        endch = '}';
        if (ch == '(') {
                endch = ')';
                command->grp_type = GRP_SUBSHELL;
        }
+
        {
 #if !BB_MMU
                char *as_string = NULL;
@@ -3931,7 +4817,7 @@ static int parse_group(o_string *dest, struct parse_context *ctx,
 #if !BB_MMU
                        free(as_string);
 #endif
-                       syntax(NULL);
+                       syntax_error(NULL);
                        debug_printf_parse("parse_group return 1: "
                                "parse_stream returned %p\n", pipe_list);
                        return 1;
@@ -3957,10 +4843,12 @@ static void add_till_single_quote(o_string *dest, struct in_str *input)
 {
        while (1) {
                int ch = i_getch(input);
-               if (ch == EOF)
-                       break;
+               if (ch == EOF) {
+                       syntax_error_unterm_ch('\'');
+                       /*xfunc_die(); - redundant */
+               }
                if (ch == '\'')
-                       break;
+                       return;
                o_addchr(dest, ch);
        }
 }
@@ -3969,14 +4857,16 @@ static void add_till_double_quote(o_string *dest, struct in_str *input)
 {
        while (1) {
                int ch = i_getch(input);
+               if (ch == EOF) {
+                       syntax_error_unterm_ch('"');
+                       /*xfunc_die(); - redundant */
+               }
                if (ch == '"')
-                       break;
+                       return;
                if (ch == '\\') {  /* \x. Copy both chars. */
                        o_addchr(dest, ch);
                        ch = i_getch(input);
                }
-               if (ch == EOF)
-                       break;
                o_addchr(dest, ch);
                if (ch == '`') {
                        add_till_backquote(dest, input);
@@ -4004,16 +4894,23 @@ static void add_till_backquote(o_string *dest, struct in_str *input)
 {
        while (1) {
                int ch = i_getch(input);
+               if (ch == EOF) {
+                       syntax_error_unterm_ch('`');
+                       /*xfunc_die(); - redundant */
+               }
                if (ch == '`')
-                       break;
-               if (ch == '\\') {  /* \x. Copy both chars unless it is \` */
+                       return;
+               if (ch == '\\') {
+                       /* \x. Copy both chars unless it is \` */
                        int ch2 = i_getch(input);
+                       if (ch2 == EOF) {
+                               syntax_error_unterm_ch('`');
+                               /*xfunc_die(); - redundant */
+                       }
                        if (ch2 != '`' && ch2 != '$' && ch2 != '\\')
                                o_addchr(dest, ch);
                        ch = ch2;
                }
-               if (ch == EOF)
-                       break;
                o_addchr(dest, ch);
        }
 }
@@ -4034,8 +4931,10 @@ static void add_till_closing_paren(o_string *dest, struct in_str *input, bool db
        int count = 0;
        while (1) {
                int ch = i_getch(input);
-               if (ch == EOF)
-                       break;
+               if (ch == EOF) {
+                       syntax_error_unterm_ch(')');
+                       /*xfunc_die(); - redundant */
+               }
                if (ch == '(')
                        count++;
                if (ch == ')') {
@@ -4059,10 +4958,13 @@ static void add_till_closing_paren(o_string *dest, struct in_str *input, bool db
                        o_addchr(dest, ch);
                        continue;
                }
-               if (ch == '\\') { /* \x. Copy verbatim. Important for  \(, \) */
+               if (ch == '\\') {
+                       /* \x. Copy verbatim. Important for  \(, \) */
                        ch = i_getch(input);
-                       if (ch == EOF)
-                               break;
+                       if (ch == EOF) {
+                               syntax_error_unterm_ch(')');
+                               /*xfunc_die(); - redundant */
+                       }
                        o_addchr(dest, ch);
                        continue;
                }
@@ -4071,7 +4973,13 @@ static void add_till_closing_paren(o_string *dest, struct in_str *input, bool db
 #endif /* ENABLE_HUSH_TICK || ENABLE_SH_MATH_SUPPORT */
 
 /* Return code: 0 for OK, 1 for syntax error */
-static int handle_dollar(o_string *dest, struct in_str *input)
+#if BB_MMU
+#define handle_dollar(as_string, dest, input) \
+       handle_dollar(dest, input)
+#endif
+static int handle_dollar(o_string *as_string,
+               o_string *dest,
+               struct in_str *input)
 {
        int expansion;
        int ch = i_peek(input);  /* first character after the $ */
@@ -4079,7 +4987,8 @@ static int handle_dollar(o_string *dest, struct in_str *input)
 
        debug_printf_parse("handle_dollar entered: ch='%c'\n", ch);
        if (isalpha(ch)) {
-               i_getch(input);
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
  make_var:
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
                while (1) {
@@ -4089,12 +4998,14 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                        ch = i_peek(input);
                        if (!isalnum(ch) && ch != '_')
                                break;
-                       i_getch(input);
+                       ch = i_getch(input);
+                       nommu_addchr(as_string, ch);
                }
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
        } else if (isdigit(ch)) {
  make_one_char_var:
-               i_getch(input);
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
                debug_printf_parse(": '%c'\n", ch);
                o_addchr(dest, ch | quote_mask);
@@ -4111,13 +5022,15 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                bool first_char, all_digits;
 
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-               i_getch(input);
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
                /* XXX maybe someone will try to escape the '}' */
                expansion = 0;
                first_char = true;
                all_digits = false;
                while (1) {
                        ch = i_getch(input);
+                       nommu_addchr(as_string, ch);
                        if (ch == '}')
                                break;
 
@@ -4149,7 +5062,6 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                                                break;
                                        }
                                        goto case_default;
-#if 0 /* not implemented yet :( */
                                case '#': /* remove prefix */
                                case '%': /* remove suffix */
                                        if (expansion == 0) {
@@ -4158,7 +5070,6 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                                                break;
                                        }
                                        goto case_default;
-#endif
                                case '-': /* default value */
                                case '=': /* assign default */
                                case '+': /* alternative */
@@ -4168,7 +5079,7 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                                        break;
                                default:
                                case_default:
-                                       syntax("unterminated ${name}");
+                                       syntax_error_unterm_str("${name}");
                                        debug_printf_parse("handle_dollar return 1: unterminated ${name}\n");
                                        return 1;
                                }
@@ -4182,30 +5093,55 @@ static int handle_dollar(o_string *dest, struct in_str *input)
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
                break;
        }
+#if (ENABLE_SH_MATH_SUPPORT || ENABLE_HUSH_TICK)
        case '(': {
-               i_getch(input);
-#if ENABLE_SH_MATH_SUPPORT
+# if !BB_MMU
+               int pos;
+# endif
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
+# if ENABLE_SH_MATH_SUPPORT
                if (i_peek(input) == '(') {
-                       i_getch(input);
+                       ch = i_getch(input);
+                       nommu_addchr(as_string, ch);
                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
                        o_addchr(dest, /*quote_mask |*/ '+');
+#  if !BB_MMU
+                       pos = dest->length;
+#  endif
                        add_till_closing_paren(dest, input, true);
+#  if !BB_MMU
+                       if (as_string) {
+                               o_addstr(as_string, dest->data + pos);
+                               o_addchr(as_string, ')');
+                               o_addchr(as_string, ')');
+                       }
+#  endif
                        o_addchr(dest, SPECIAL_VAR_SYMBOL);
                        break;
                }
-#endif
-#if ENABLE_HUSH_TICK
-               //int pos = dest->length;
+# endif
+# if ENABLE_HUSH_TICK
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
                o_addchr(dest, quote_mask | '`');
+#  if !BB_MMU
+               pos = dest->length;
+#  endif
                add_till_closing_paren(dest, input, false);
-               //debug_printf_subst("SUBST RES2 '%s'\n", dest->data + pos);
+#  if !BB_MMU
+               if (as_string) {
+                       o_addstr(as_string, dest->data + pos);
+                       o_addchr(as_string, '`');
+               }
+#  endif
                o_addchr(dest, SPECIAL_VAR_SYMBOL);
-#endif
+# endif
                break;
        }
+#endif
        case '_':
-               i_getch(input);
+               ch = i_getch(input);
+               nommu_addchr(as_string, ch);
                ch = i_peek(input);
                if (isalnum(ch)) { /* it's $_name or $_123 */
                        ch = '_';
@@ -4223,10 +5159,10 @@ static int handle_dollar(o_string *dest, struct in_str *input)
 }
 
 #if BB_MMU
-#define parse_stream_dquoted(ctx, dest, input, dquote_end) \
+#define parse_stream_dquoted(as_string, dest, input, dquote_end) \
        parse_stream_dquoted(dest, input, dquote_end)
 #endif
-static int parse_stream_dquoted(struct parse_context *ctx,
+static int parse_stream_dquoted(o_string *as_string,
                o_string *dest,
                struct in_str *input,
                int dquote_end)
@@ -4236,42 +5172,35 @@ static int parse_stream_dquoted(struct parse_context *ctx,
 
  again:
        ch = i_getch(input);
-#if !BB_MMU
-       if (ctx && ch != EOF)
-               o_addchr(&ctx->as_string, ch);
-#endif
+       if (ch != EOF)
+               nommu_addchr(as_string, ch);
        if (ch == dquote_end) { /* may be only '"' or EOF */
-               dest->nonnull = 1;
                if (dest->o_assignment == NOT_ASSIGNMENT)
                        dest->o_escape ^= 1;
                debug_printf_parse("parse_stream_dquoted return 0\n");
                return 0;
        }
+       /* note: can't move it above ch == dquote_end check! */
        if (ch == EOF) {
-               syntax("unterminated \"");
-               debug_printf_parse("parse_stream_dquoted return 1: unterminated \"\n");
-               return 1;
+               syntax_error_unterm_ch('"');
+               /*xfunc_die(); - redundant */
        }
        next = '\0';
        if (ch != '\n') {
                next = i_peek(input);
        }
-       debug_printf_parse(": ch=%c (%d) m=%d escape=%d\n",
-                                       ch, ch, m, dest->o_escape);
+       debug_printf_parse(": ch=%c (%d) escape=%d\n",
+                                       ch, ch, dest->o_escape);
        if (ch == '\\') {
                if (next == EOF) {
-                       syntax("\\<eof>");
-                       debug_printf_parse("parse_stream_dquoted return 1: \\<eof>\n");
-                       return 1;
+                       syntax_error("\\<eof>");
+                       xfunc_die();
                }
                /* bash:
                 * "The backslash retains its special meaning [in "..."]
                 * only when followed by one of the following characters:
                 * $, `, ", \, or <newline>.  A double quote may be quoted
                 * within double quotes by preceding it with a backslash.
-                * If enabled, history expansion will be performed unless
-                * an ! appearing in double quotes is escaped using
-                * a backslash. The backslash preceding the ! is not removed."
                 */
                if (strchr("$`\"\\", next) != NULL) {
                        o_addqchr(dest, i_getch(input));
@@ -4281,7 +5210,7 @@ static int parse_stream_dquoted(struct parse_context *ctx,
                goto again;
        }
        if (ch == '$') {
-               if (handle_dollar(dest, input) != 0) {
+               if (handle_dollar(as_string, dest, input) != 0) {
                        debug_printf_parse("parse_stream_dquoted return 1: "
                                        "handle_dollar returned non-0\n");
                        return 1;
@@ -4303,7 +5232,7 @@ static int parse_stream_dquoted(struct parse_context *ctx,
        if (ch == '='
         && (dest->o_assignment == MAYBE_ASSIGNMENT
            || dest->o_assignment == WORD_IS_KEYWORD)
-        && is_assignment(dest->data)
+        && is_well_formed_var_name(dest->data, '=')
        ) {
                dest->o_assignment = DEFINITELY_ASSIGNMENT;
        }
@@ -4325,6 +5254,7 @@ static struct pipe *parse_stream(char **pstring,
        struct parse_context ctx;
        o_string dest = NULL_O_STRING;
        int is_in_dquote;
+       int heredoc_cnt;
 
        /* Double-quote state is handled in the state variable is_in_dquote.
         * A single-quote triggers a bypass of the main loop until its mate is
@@ -4332,6 +5262,7 @@ static struct pipe *parse_stream(char **pstring,
         */
        debug_printf_parse("parse_stream entered, end_trigger='%c'\n",
                        end_trigger ? : 'X');
+       debug_enter();
 
        G.ifs = get_local_var_value("IFS");
        if (G.ifs == NULL)
@@ -4344,6 +5275,7 @@ static struct pipe *parse_stream(char **pstring,
        /* dest.o_assignment = MAYBE_ASSIGNMENT; - already is */
        initialize_context(&ctx);
        is_in_dquote = 0;
+       heredoc_cnt = 0;
        while (1) {
                const char *is_ifs;
                const char *is_special;
@@ -4353,7 +5285,8 @@ static struct pipe *parse_stream(char **pstring,
                redir_type redir_style;
 
                if (is_in_dquote) {
-                       if (parse_stream_dquoted(&ctx, &dest, input, '"')) {
+                       /* dest.o_quoted = 1; - already is (see below) */
+                       if (parse_stream_dquoted(&ctx.as_string, &dest, input, '"')) {
                                goto parse_error;
                        }
                        /* We reached closing '"' */
@@ -4364,21 +5297,26 @@ static struct pipe *parse_stream(char **pstring,
                                                ch, ch, dest.o_escape);
                if (ch == EOF) {
                        struct pipe *pi;
+
+                       if (heredoc_cnt) {
+                               syntax_error_unterm_str("here document");
+                               xfunc_die();
+                       }
                        if (done_word(&dest, &ctx)) {
-                               goto parse_error;
+                               xfunc_die();
                        }
                        o_free(&dest);
                        done_pipe(&ctx, PIPE_SEQ);
                        pi = ctx.list_head;
                        /* If we got nothing... */
-// TODO: test script consisting of just "&"
+                       /* (this makes bare "&" cmd a no-op.
+                        * bash says: "syntax error near unexpected token '&'") */
                        if (pi->num_cmds == 0
                            IF_HAS_KEYWORDS( && pi->res_word == RES_NONE)
                        ) {
-                               free_pipe_list(pi, 0);
+                               free_pipe_list(pi);
                                pi = NULL;
                        }
-                       debug_printf_parse("parse_stream return %p\n", pi);
 #if !BB_MMU
                        debug_printf_parse("as_string '%s'\n", ctx.as_string.data);
                        if (pstring)
@@ -4386,11 +5324,11 @@ static struct pipe *parse_stream(char **pstring,
                        else
                                o_free_unsafe(&ctx.as_string);
 #endif
+                       debug_leave();
+                       debug_printf_parse("parse_stream return %p\n", pi);
                        return pi;
                }
-#if !BB_MMU
-               o_addchr(&ctx.as_string, ch);
-#endif
+               nommu_addchr(&ctx.as_string, ch);
                is_ifs = strchr(G.ifs, ch);
                is_special = strchr("<>;&|(){}#'" /* special outside of "str" */
                                "\\$\"" USE_HUSH_TICK("`") /* always special */
@@ -4401,7 +5339,7 @@ static struct pipe *parse_stream(char **pstring,
                        if ((dest.o_assignment == MAYBE_ASSIGNMENT
                            || dest.o_assignment == WORD_IS_KEYWORD)
                         && ch == '='
-                        && is_assignment(dest.data)
+                        && is_well_formed_var_name(dest.data, '=')
                        ) {
                                dest.o_assignment = DEFINITELY_ASSIGNMENT;
                        }
@@ -4424,14 +5362,37 @@ static struct pipe *parse_stream(char **pstring,
 #endif
                                /* Treat newline as a command separator. */
                                done_pipe(&ctx, PIPE_SEQ);
+                               debug_printf_parse("heredoc_cnt:%d\n", heredoc_cnt);
+                               if (heredoc_cnt) {
+                                       if (fetch_heredocs(heredoc_cnt, &ctx, input)) {
+                                               goto parse_error;
+                                       }
+                                       heredoc_cnt = 0;
+                               }
                                dest.o_assignment = MAYBE_ASSIGNMENT;
                                ch = ';';
                                /* note: if (is_ifs) continue;
                                 * will still trigger for us */
                        }
                }
-               if (end_trigger && end_trigger == ch) {
+               if (end_trigger && end_trigger == ch
+                && (heredoc_cnt == 0 || end_trigger != ';')
+               ) {
 //TODO: disallow "{ cmd }" without semicolon
+                       if (heredoc_cnt) {
+                               /* This is technically valid:
+                                * { cat <<HERE; }; echo Ok
+                                * heredoc
+                                * heredoc
+                                * heredoc
+                                * HERE
+                                * but we don't support this.
+                                * We require heredoc to be in enclosing {}/(),
+                                * if any.
+                                */
+                               syntax_error_unterm_str("here document");
+                               goto parse_error;
+                       }
                        if (done_word(&dest, &ctx)) {
                                goto parse_error;
                        }
@@ -4441,9 +5402,6 @@ static struct pipe *parse_stream(char **pstring,
                        if (!HAS_KEYWORDS
                         IF_HAS_KEYWORDS(|| (ctx.ctx_res_w == RES_NONE && ctx.old_flag == 0))
                        ) {
-                               debug_printf_parse("parse_stream return %p: "
-                                               "end_trigger char found\n",
-                                               ctx.list_head);
                                o_free(&dest);
 #if !BB_MMU
                                debug_printf_parse("as_string '%s'\n", ctx.as_string.data);
@@ -4452,23 +5410,81 @@ static struct pipe *parse_stream(char **pstring,
                                else
                                        o_free_unsafe(&ctx.as_string);
 #endif
+                               debug_leave();
+                               debug_printf_parse("parse_stream return %p: "
+                                               "end_trigger char found\n",
+                                               ctx.list_head);
                                return ctx.list_head;
                        }
                }
-               if (is_ifs)
-                       continue;
+               if (is_ifs)
+                       continue;
+
+               next = '\0';
+               if (ch != '\n') {
+                       next = i_peek(input);
+               }
+
+               /* Catch <, > before deciding whether this word is
+                * an assignment. a=1 2>z b=2: b=2 is still assignment */
+               switch (ch) {
+               case '>':
+                       redir_fd = redirect_opt_num(&dest);
+                       if (done_word(&dest, &ctx)) {
+                               goto parse_error;
+                       }
+                       redir_style = REDIRECT_OVERWRITE;
+                       if (next == '>') {
+                               redir_style = REDIRECT_APPEND;
+                               ch = i_getch(input);
+                               nommu_addchr(&ctx.as_string, ch);
+                       }
+#if 0
+                       else if (next == '(') {
+                               syntax_error(">(process) not supported");
+                               goto parse_error;
+                       }
+#endif
+                       if (parse_redirect(&ctx, redir_fd, redir_style, input))
+                               goto parse_error;
+                       continue; /* back to top of while (1) */
+               case '<':
+                       redir_fd = redirect_opt_num(&dest);
+                       if (done_word(&dest, &ctx)) {
+                               goto parse_error;
+                       }
+                       redir_style = REDIRECT_INPUT;
+                       if (next == '<') {
+                               redir_style = REDIRECT_HEREDOC;
+                               heredoc_cnt++;
+                               debug_printf_parse("++heredoc_cnt=%d\n", heredoc_cnt);
+                               ch = i_getch(input);
+                               nommu_addchr(&ctx.as_string, ch);
+                       } else if (next == '>') {
+                               redir_style = REDIRECT_IO;
+                               ch = i_getch(input);
+                               nommu_addchr(&ctx.as_string, ch);
+                       }
+#if 0
+                       else if (next == '(') {
+                               syntax_error("<(process) not supported");
+                               goto parse_error;
+                       }
+#endif
+                       if (parse_redirect(&ctx, redir_fd, redir_style, input))
+                               goto parse_error;
+                       continue; /* back to top of while (1) */
+               }
 
-               if (dest.o_assignment == MAYBE_ASSIGNMENT) {
+               if (dest.o_assignment == MAYBE_ASSIGNMENT
+                /* check that we are not in word in "a=1 2>word b=1": */
+                && !ctx.pending_redirect
+               ) {
                        /* ch is a special char and thus this word
                         * cannot be an assignment */
                        dest.o_assignment = NOT_ASSIGNMENT;
                }
 
-               next = '\0';
-               if (ch != '\n') {
-                       next = i_peek(input);
-               }
-
                switch (ch) {
                case '#':
                        if (dest.length == 0) {
@@ -4477,34 +5493,42 @@ static struct pipe *parse_stream(char **pstring,
                                        if (ch == EOF || ch == '\n')
                                                break;
                                        i_getch(input);
+                                       /* note: we do not add it to &ctx.as_string */
                                }
+                               nommu_addchr(&ctx.as_string, '\n');
                        } else {
                                o_addQchr(&dest, ch);
                        }
                        break;
                case '\\':
                        if (next == EOF) {
-                               syntax("\\<eof>");
-                               goto parse_error;
+                               syntax_error("\\<eof>");
+                               xfunc_die();
                        }
                        o_addchr(&dest, '\\');
-                       o_addchr(&dest, i_getch(input));
+                       ch = i_getch(input);
+                       nommu_addchr(&ctx.as_string, ch);
+                       o_addchr(&dest, ch);
+                       /* Example: echo Hello \2>file
+                        * we need to know that word 2 is quoted */
+                       dest.o_quoted = 1;
                        break;
                case '$':
-                       if (handle_dollar(&dest, input) != 0) {
+                       if (handle_dollar(&ctx.as_string, &dest, input) != 0) {
                                debug_printf_parse("parse_stream parse error: "
                                        "handle_dollar returned non-0\n");
                                goto parse_error;
                        }
                        break;
                case '\'':
-                       dest.nonnull = 1;
+                       dest.o_quoted = 1;
                        while (1) {
                                ch = i_getch(input);
                                if (ch == EOF) {
-                                       syntax("unterminated '");
-                                       goto parse_error;
+                                       syntax_error_unterm_ch('\'');
+                                       /*xfunc_die(); - redundant */
                                }
+                               nommu_addchr(&ctx.as_string, ch);
                                if (ch == '\'')
                                        break;
                                if (dest.o_assignment == NOT_ASSIGNMENT)
@@ -4514,61 +5538,31 @@ static struct pipe *parse_stream(char **pstring,
                        }
                        break;
                case '"':
-                       dest.nonnull = 1;
+                       dest.o_quoted = 1;
                        is_in_dquote ^= 1; /* invert */
                        if (dest.o_assignment == NOT_ASSIGNMENT)
                                dest.o_escape ^= 1;
                        break;
 #if ENABLE_HUSH_TICK
                case '`': {
-                       //int pos = dest.length;
+#if !BB_MMU
+                       int pos;
+#endif
                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
                        o_addchr(&dest, '`');
+#if !BB_MMU
+                       pos = dest.length;
+#endif
                        add_till_backquote(&dest, input);
+#if !BB_MMU
+                       o_addstr(&ctx.as_string, dest.data + pos);
+                       o_addchr(&ctx.as_string, '`');
+#endif
                        o_addchr(&dest, SPECIAL_VAR_SYMBOL);
                        //debug_printf_subst("SUBST RES3 '%s'\n", dest.data + pos);
                        break;
                }
 #endif
-               case '>':
-                       redir_fd = redirect_opt_num(&dest);
-                       if (done_word(&dest, &ctx)) {
-                               goto parse_error;
-                       }
-                       redir_style = REDIRECT_OVERWRITE;
-                       if (next == '>') {
-                               redir_style = REDIRECT_APPEND;
-                               i_getch(input);
-                       }
-#if 0
-                       else if (next == '(') {
-                               syntax(">(process) not supported");
-                               goto parse_error;
-                       }
-#endif
-                       setup_redirect(&ctx, redir_fd, redir_style, input);
-                       break;
-               case '<':
-                       redir_fd = redirect_opt_num(&dest);
-                       if (done_word(&dest, &ctx)) {
-                               goto parse_error;
-                       }
-                       redir_style = REDIRECT_INPUT;
-                       if (next == '<') {
-                               redir_style = REDIRECT_HEREIS;
-                               i_getch(input);
-                       } else if (next == '>') {
-                               redir_style = REDIRECT_IO;
-                               i_getch(input);
-                       }
-#if 0
-                       else if (next == '(') {
-                               syntax("<(process) not supported");
-                               goto parse_error;
-                       }
-#endif
-                       setup_redirect(&ctx, redir_fd, redir_style, input);
-                       break;
                case ';':
 #if ENABLE_HUSH_CASE
  case_semi:
@@ -4584,7 +5578,8 @@ static struct pipe *parse_stream(char **pstring,
                                ch = i_peek(input);
                                if (ch != ';')
                                        break;
-                               i_getch(input);
+                               ch = i_getch(input);
+                               nommu_addchr(&ctx.as_string, ch);
                                if (ctx.ctx_res_w == RES_CASEI) {
                                        ctx.ctx_dsemicolon = 1;
                                        ctx.ctx_res_w = RES_MATCH;
@@ -4602,7 +5597,8 @@ static struct pipe *parse_stream(char **pstring,
                                goto parse_error;
                        }
                        if (next == '&') {
-                               i_getch(input);
+                               ch = i_getch(input);
+                               nommu_addchr(&ctx.as_string, ch);
                                done_pipe(&ctx, PIPE_AND);
                        } else {
                                done_pipe(&ctx, PIPE_BG);
@@ -4617,7 +5613,8 @@ static struct pipe *parse_stream(char **pstring,
                                break; /* we are in case's "word | word)" */
 #endif
                        if (next == '|') { /* || */
-                               i_getch(input);
+                               ch = i_getch(input);
+                               nommu_addchr(&ctx.as_string, ch);
                                done_pipe(&ctx, PIPE_OR);
                        } else {
                                /* we could pick up a file descriptor choice here
@@ -4632,31 +5629,10 @@ static struct pipe *parse_stream(char **pstring,
                        if (ctx.ctx_res_w == RES_MATCH
                         && ctx.command->argv == NULL /* not (word|(... */
                         && dest.length == 0 /* not word(... */
-                        && dest.nonnull == 0 /* not ""(... */
+                        && dest.o_quoted == 0 /* not ""(... */
                        ) {
                                continue;
                        }
-#endif
-#if ENABLE_HUSH_FUNCTIONS
-                       if (dest.length != 0 /* not just () but word() */
-                        && dest.nonnull == 0 /* not a"b"c() */
-                        && ctx.command->argv == NULL /* it's the first word */
-//TODO: "func ( ) {...}" - note spaces - is valid format too in bash
-                        && i_peek(input) == ')'
-                        && !match_reserved_word(&dest)
-                       ) {
-                               bb_error_msg("seems like a function definition");
-                               i_getch(input);
-                               do {
-//TODO: do it properly.
-                                       ch = i_getch(input);
-                               } while (ch == ' ' || ch == '\n');
-                               if (ch != '{') {
-                                       syntax("was expecting {");
-                                       goto parse_error;
-                               }
-                               ch = 'F'; /* magic value */
-                       }
 #endif
                case '{':
                        if (parse_group(&dest, &ctx, input, ch) != 0) {
@@ -4672,7 +5648,7 @@ static struct pipe *parse_stream(char **pstring,
                        /* proper use of this character is caught by end_trigger:
                         * if we see {, we call parse_group(..., end_trigger='}')
                         * and it will match } earlier (not here). */
-                       syntax("unexpected } or )");
+                       syntax_error_unexpected_ch(ch);
                        goto parse_error;
                default:
                        if (HUSH_DEBUG)
@@ -4691,6 +5667,9 @@ static struct pipe *parse_stream(char **pstring,
                 * while if false; then false; fi do break; done
                 * (bash accepts it)
                 * while if false; then false; fi; do break; fi
+                * Samples to catch leaks at execution:
+                * while if (true | {true;}); then echo ok; fi; do break; done
+                * while if (true | {true;}); then echo ok; fi; do (if echo ok; break; then :; fi) | cat; break; done
                 */
                pctx = &ctx;
                do {
@@ -4700,7 +5679,7 @@ static struct pipe *parse_stream(char **pstring,
                        debug_printf_clean("freeing list %p from ctx %p\n",
                                        pctx->list_head, pctx);
                        debug_print_tree(pctx->list_head, 0);
-                       free_pipe_list(pctx->list_head, 0);
+                       free_pipe_list(pctx->list_head);
                        debug_printf_clean("freed list %p\n", pctx->list_head);
 #if !BB_MMU
                        o_free_unsafe(&pctx->as_string);
@@ -4721,6 +5700,7 @@ static struct pipe *parse_stream(char **pstring,
                        if (pstring)
                                *pstring = NULL;
 #endif
+                       debug_leave();
                        return ERR_PTR;
                }
                /* Discard cached input, force prompt */
@@ -4764,31 +5744,82 @@ static void parse_and_run_file(FILE *f)
        parse_and_run_stream(&input, ';');
 }
 
-#if ENABLE_HUSH_JOB
-/* Make sure we have a controlling tty.  If we get started under a job
- * aware app (like bash for example), make sure we are now in charge so
- * we don't fight over who gets the foreground */
-static void setup_job_control(void)
+/* Called a few times only (or even once if "sh -c") */
+static void block_signals(int second_time)
 {
-       pid_t shell_pgrp;
+       unsigned sig;
+       unsigned mask;
 
-       shell_pgrp = getpgrp();
+       mask = (1 << SIGQUIT);
+       if (G_interactive_fd) {
+               mask = 0
+                       | (1 << SIGQUIT)
+                       | (1 << SIGTERM)
+//TODO                 | (1 << SIGHUP)
+#if ENABLE_HUSH_JOB
+                       | (1 << SIGTTIN) | (1 << SIGTTOU) | (1 << SIGTSTP)
+#endif
+                       | (1 << SIGINT)
+               ;
+       }
+       G.non_DFL_mask = mask;
 
-       /* If we were ran as 'hush &',
-        * sleep until we are in the foreground.  */
-       while (tcgetpgrp(G_interactive_fd) != shell_pgrp) {
-               /* Send TTIN to ourself (should stop us) */
-               kill(- shell_pgrp, SIGTTIN);
-               shell_pgrp = getpgrp();
+       if (!second_time)
+               sigprocmask(SIG_SETMASK, NULL, &G.blocked_set);
+       sig = 0;
+       while (mask) {
+               if (mask & 1)
+                       sigaddset(&G.blocked_set, sig);
+               mask >>= 1;
+               sig++;
        }
+       sigdelset(&G.blocked_set, SIGCHLD);
 
-       /* We _must_ restore tty pgrp on fatal signals */
-       set_fatal_signals_to_sigexit();
+       sigprocmask(SIG_SETMASK, &G.blocked_set,
+                       second_time ? NULL : &G.inherited_set);
+       /* POSIX allows shell to re-enable SIGCHLD
+        * even if it was SIG_IGN on entry */
+//     G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
+       if (!second_time)
+               signal(SIGCHLD, SIG_DFL); // SIGCHLD_handler);
+}
 
-       /* Put ourselves in our own process group.  */
-       bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
-       /* Grab control of the terminal.  */
-       tcsetpgrp(G_interactive_fd, getpid());
+#if ENABLE_HUSH_JOB
+/* helper */
+static void maybe_set_to_sigexit(int sig)
+{
+       void (*handler)(int);
+       /* non_DFL_mask'ed signals are, well, masked,
+        * no need to set handler for them.
+        */
+       if (!((G.non_DFL_mask >> sig) & 1)) {
+               handler = signal(sig, sigexit);
+               if (handler == SIG_IGN) /* oops... restore back to IGN! */
+                       signal(sig, handler);
+       }
+}
+/* Set handlers to restore tty pgrp and exit */
+static void set_fatal_handlers(void)
+{
+       /* We _must_ restore tty pgrp on fatal signals */
+       if (HUSH_DEBUG) {
+               maybe_set_to_sigexit(SIGILL );
+               maybe_set_to_sigexit(SIGFPE );
+               maybe_set_to_sigexit(SIGBUS );
+               maybe_set_to_sigexit(SIGSEGV);
+               maybe_set_to_sigexit(SIGTRAP);
+       } /* else: hush is perfect. what SEGV? */
+       maybe_set_to_sigexit(SIGABRT);
+       /* bash 3.2 seems to handle these just like 'fatal' ones */
+       maybe_set_to_sigexit(SIGPIPE);
+       maybe_set_to_sigexit(SIGALRM);
+//TODO: disable and move down when proper SIGHUP handling is added
+       maybe_set_to_sigexit(SIGHUP );
+       /* if we are interactive, [SIGHUP,] SIGTERM and SIGINT are masked.
+        * if we aren't interactive... but in this case
+        * we never want to restore pgrp on exit, and this fn is not called */
+       /*maybe_set_to_sigexit(SIGTERM);*/
+       /*maybe_set_to_sigexit(SIGINT );*/
 }
 #endif
 
@@ -4813,16 +5844,17 @@ int hush_main(int argc, char **argv)
                .flg_export = 1,
                .flg_read_only = 1,
        };
-
+       int signal_mask_is_inited = 0;
        int opt;
-       FILE *input;
        char **e;
        struct variable *cur_var;
 
        INIT_G();
-
-       G.root_pid = getpid();
-
+       if (EXIT_SUCCESS) /* if EXIT_SUCCESS == 0, is already done */
+               G.last_exitcode = EXIT_SUCCESS;
+#if !BB_MMU
+       G.argv0_for_re_execing = argv[0];
+#endif
        /* Deal with HUSH_VERSION */
        G.shell_ver = const_shell_ver; /* copying struct here */
        G.top_var = &G.shell_ver;
@@ -4845,11 +5877,9 @@ int hush_main(int argc, char **argv)
        }
        debug_printf_env("putenv '%s'\n", hush_version_str);
        putenv((char *)hush_version_str); /* reinstate HUSH_VERSION */
-
 #if ENABLE_FEATURE_EDITING
        G.line_input_state = new_line_input_t(FOR_SHELL);
 #endif
-       /* XXX what should these be while sourcing /etc/profile? */
        G.global_argc = argc;
        G.global_argv = argv;
        /* Initialize some more globals to non-zero values */
@@ -4860,24 +5890,38 @@ int hush_main(int argc, char **argv)
        G.PS2 = "> ";
 #endif
 
-       if (EXIT_SUCCESS) /* otherwise is already done */
-               G.last_return_code = EXIT_SUCCESS;
-
-       if (argv[0] && argv[0][0] == '-') {
-               debug_printf("sourcing /etc/profile\n");
-               input = fopen_for_read("/etc/profile");
-               if (input != NULL) {
-                       close_on_exec_on(fileno(input));
-                       parse_and_run_file(input);
-                       fclose(input);
-               }
+       if (setjmp(die_jmp)) {
+               /* xfunc has failed! die die die */
+               /* no EXIT traps, this is an escape hatch! */
+               G.exiting = 1;
+               hush_exit(xfunc_error_retval);
        }
-       input = stdin;
 
+       /* Shell is non-interactive at first. We need to call
+        * block_signals(0) if we are going to execute "sh <script>",
+        * "sh -c <cmds>" or login shell's /etc/profile and friends.
+        * If we later decide that we are interactive, we run block_signals(0)
+        * (or re-run block_signals(1) if we ran block_signals(0) before)
+        * in order to intercept (more) signals.
+        */
+
+       /* Parse options */
        /* http://www.opengroup.org/onlinepubs/9699919799/utilities/sh.html */
-       while ((opt = getopt(argc, argv, "c:xins")) > 0) {
+       while (1) {
+               opt = getopt(argc, argv, "c:xins"
+#if !BB_MMU
+                               "<:$:R:V:"
+# if ENABLE_HUSH_FUNCTIONS
+                               "F:"
+# endif
+#endif
+               );
+               if (opt <= 0)
+                       break;
                switch (opt) {
                case 'c':
+                       if (!G.root_pid)
+                               G.root_pid = getpid();
                        G.global_argv = argv + optind;
                        if (!argv[optind]) {
                                /* -c 'script' (no params): prevent empty $0 */
@@ -4885,6 +5929,7 @@ int hush_main(int argc, char **argv)
                                optind--;
                        } /* else -c 'script' PAR0 PAR1: $0 is PAR0 */
                        G.global_argc = argc - optind;
+                       block_signals(0); /* 0: called 1st time */
                        parse_and_run_string(optarg);
                        goto final_return;
                case 'i':
@@ -4896,6 +5941,36 @@ int hush_main(int argc, char **argv)
                        /* "-s" means "read from stdin", but this is how we always
                         * operate, so simply do nothing here. */
                        break;
+#if !BB_MMU
+               case '<': /* "big heredoc" support */
+                       full_write(STDOUT_FILENO, optarg, strlen(optarg));
+                       _exit(0);
+               case '$':
+                       G.root_pid = bb_strtou(optarg, &optarg, 16);
+                       optarg++;
+                       G.last_bg_pid = bb_strtou(optarg, &optarg, 16);
+                       optarg++;
+                       G.last_exitcode = bb_strtou(optarg, &optarg, 16);
+# if ENABLE_HUSH_LOOPS
+                       optarg++;
+                       G.depth_of_loop = bb_strtou(optarg, &optarg, 16);
+# endif
+                       break;
+               case 'R':
+               case 'V':
+                       set_local_var(xstrdup(optarg), 0, opt == 'R');
+                       break;
+# if ENABLE_HUSH_FUNCTIONS
+               case 'F': {
+                       struct function *funcp = new_function(optarg);
+                       /* funcp->name is already set to optarg */
+                       /* funcp->body is set to NULL. It's a special case. */
+                       funcp->body_as_string = argv[optind];
+                       optind++;
+                       break;
+               }
+# endif
+#endif
                case 'n':
                case 'x':
                        if (!set_mode('-', opt))
@@ -4909,22 +5984,75 @@ int hush_main(int argc, char **argv)
                        bb_show_usage();
 #endif
                }
+       } /* option parsing loop */
+
+       if (!G.root_pid)
+               G.root_pid = getpid();
+
+       /* If we are login shell... */
+       if (argv[0] && argv[0][0] == '-') {
+               FILE *input;
+               /* XXX what should argv be while sourcing /etc/profile? */
+               debug_printf("sourcing /etc/profile\n");
+               input = fopen_for_read("/etc/profile");
+               if (input != NULL) {
+                       close_on_exec_on(fileno(input));
+                       block_signals(0); /* 0: called 1st time */
+                       signal_mask_is_inited = 1;
+                       parse_and_run_file(input);
+                       fclose(input);
+               }
+               /* bash: after sourcing /etc/profile,
+                * tries to source (in the given order):
+                * ~/.bash_profile, ~/.bash_login, ~/.profile,
+                * stopping of first found. --noprofile turns this off.
+                * bash also sources ~/.bash_logout on exit.
+                * If called as sh, skips .bash_XXX files.
+                */
        }
-#if ENABLE_HUSH_JOB
+
+       if (argv[optind]) {
+               FILE *input;
+               /*
+                * "bash <script>" (which is never interactive (unless -i?))
+                * sources $BASH_ENV here (without scanning $PATH).
+                * If called as sh, does the same but with $ENV.
+                */
+               debug_printf("running script '%s'\n", argv[optind]);
+               G.global_argv = argv + optind;
+               G.global_argc = argc - optind;
+               input = xfopen_for_read(argv[optind]);
+               close_on_exec_on(fileno(input));
+               if (!signal_mask_is_inited)
+                       block_signals(0); /* 0: called 1st time */
+               parse_and_run_file(input);
+#if ENABLE_FEATURE_CLEAN_UP
+               fclose(input);
+#endif
+               goto final_return;
+       }
+
+       /* Up to here, shell was non-interactive. Now it may become one.
+        * NB: don't forget to (re)run block_signals(0/1) as needed.
+        */
+
        /* A shell is interactive if the '-i' flag was given, or if all of
         * the following conditions are met:
         *    no -c command
         *    no arguments remaining or the -s flag given
         *    standard input is a terminal
         *    standard output is a terminal
-        *    Refer to Posix.2, the description of the 'sh' utility. */
-       if (argv[optind] == NULL && input == stdin
-        && isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)
-       ) {
+        * Refer to Posix.2, the description of the 'sh' utility.
+        */
+#if ENABLE_HUSH_JOB
+       if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
                G.saved_tty_pgrp = tcgetpgrp(STDIN_FILENO);
-               debug_printf("saved_tty_pgrp=%d\n", G.saved_tty_pgrp);
+               debug_printf("saved_tty_pgrp:%d\n", G.saved_tty_pgrp);
+//TODO: "interactive" and "have job control" are two different things.
+//If tcgetpgrp fails here, "have job control" is false, but "interactive"
+//should stay on! Currently, we mix these into one.
                if (G.saved_tty_pgrp >= 0) {
-                       /* try to dup to high fd#, >= 255 */
+                       /* try to dup stdin to high fd#, >= 255 */
                        G_interactive_fd = fcntl(STDIN_FILENO, F_DUPFD, 255);
                        if (G_interactive_fd < 0) {
                                /* try to dup to any fd */
@@ -4933,29 +6061,48 @@ int hush_main(int argc, char **argv)
                                        /* give up */
                                        G_interactive_fd = 0;
                        }
-                       // TODO: track & disallow any attempts of user
-                       // to (inadvertently) close/redirect it
+// TODO: track & disallow any attempts of user
+// to (inadvertently) close/redirect it
                }
        }
-       init_signal_mask(); /* note: ensures SIGCHLD is not masked */
-       debug_printf("interactive_fd=%d\n", G_interactive_fd);
+       debug_printf("interactive_fd:%d\n", G_interactive_fd);
        if (G_interactive_fd) {
-               fcntl(G_interactive_fd, F_SETFD, FD_CLOEXEC);
-               /* Looks like they want an interactive shell */
-               setup_job_control();
+               pid_t shell_pgrp;
+
+               /* We are indeed interactive shell, and we will perform
+                * job control. Setting up for that. */
+
+               close_on_exec_on(G_interactive_fd);
+               /* If we were run as 'hush &', sleep until we are
+                * in the foreground (tty pgrp == our pgrp).
+                * If we get started under a job aware app (like bash),
+                * make sure we are now in charge so we don't fight over
+                * who gets the foreground */
+               while (1) {
+                       shell_pgrp = getpgrp();
+                       G.saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                       if (G.saved_tty_pgrp == shell_pgrp)
+                               break;
+                       /* send TTIN to ourself (should stop us) */
+                       kill(- shell_pgrp, SIGTTIN);
+               }
+               /* Block some signals */
+               block_signals(signal_mask_is_inited);
+               /* Set other signals to restore saved_tty_pgrp */
+               set_fatal_handlers();
+               /* Put ourselves in our own process group */
+               bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
+               /* Grab control of the terminal */
+               tcsetpgrp(G_interactive_fd, getpid());
                /* -1 is special - makes xfuncs longjmp, not exit
                 * (we reset die_sleep = 0 whereever we [v]fork) */
-               die_sleep = -1;
-               if (setjmp(die_jmp)) {
-                       /* xfunc has failed! die die die */
-                       hush_exit(xfunc_error_retval);
-               }
-       }
+               enable_restore_tty_pgrp_on_exit(); /* sets die_sleep = -1 */
+       } else if (!signal_mask_is_inited) {
+               block_signals(0); /* 0: called 1st time */
+       } /* else: block_signals(0) was done before */
 #elif ENABLE_HUSH_INTERACTIVE
-/* no job control compiled, only prompt/line editing */
-       if (argv[optind] == NULL && input == stdin
-        && isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)
-       ) {
+       /* No job control compiled in, only prompt/line editing */
+       if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
                G_interactive_fd = fcntl(STDIN_FILENO, F_DUPFD, 255);
                if (G_interactive_fd < 0) {
                        /* try to dup to any fd */
@@ -4964,41 +6111,33 @@ int hush_main(int argc, char **argv)
                                /* give up */
                                G_interactive_fd = 0;
                }
-               if (G_interactive_fd) {
-                       fcntl(G_interactive_fd, F_SETFD, FD_CLOEXEC);
-               }
        }
-       init_signal_mask(); /* note: ensures SIGCHLD is not masked */
+       if (G_interactive_fd) {
+               close_on_exec_on(G_interactive_fd);
+               block_signals(signal_mask_is_inited);
+       } else if (!signal_mask_is_inited) {
+               block_signals(0);
+       }
 #else
-       init_signal_mask();
+       /* We have interactiveness code disabled */
+       if (!signal_mask_is_inited) {
+               block_signals(0);
+       }
 #endif
-       /* POSIX allows shell to re-enable SIGCHLD
-        * even if it was SIG_IGN on entry */
-//     G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
-       signal(SIGCHLD, SIG_DFL); // SIGCHLD_handler);
+       /* bash:
+        * if interactive but not a login shell, sources ~/.bashrc
+        * (--norc turns this off, --rcfile <file> overrides)
+        */
 
-#if ENABLE_HUSH_INTERACTIVE && !ENABLE_FEATURE_SH_EXTRA_QUIET
-       if (G_interactive_fd) {
-               printf("\n\n%s hush - the humble shell v"HUSH_VER_STR"\n", bb_banner);
+       if (!ENABLE_FEATURE_SH_EXTRA_QUIET && G_interactive_fd) {
+               printf("\n\n%s hush - the humble shell\n", bb_banner);
                printf("Enter 'help' for a list of built-in commands.\n\n");
        }
-#endif
 
-       if (argv[optind] == NULL) {
-               parse_and_run_file(stdin);
-       } else {
-               debug_printf("\nrunning script '%s'\n", argv[optind]);
-               G.global_argv = argv + optind;
-               G.global_argc = argc - optind;
-               input = xfopen_for_read(argv[optind]);
-               fcntl(fileno(input), F_SETFD, FD_CLOEXEC);
-               parse_and_run_file(input);
-       }
+       parse_and_run_file(stdin);
 
  final_return:
-
 #if ENABLE_FEATURE_CLEAN_UP
-       fclose(input);
        if (G.cwd != bb_msg_unknown)
                free((char*)G.cwd);
        cur_var = G.top_var->next;
@@ -5010,7 +6149,7 @@ int hush_main(int argc, char **argv)
                free(tmp);
        }
 #endif
-       hush_exit(G.last_return_code);
+       hush_exit(G.last_exitcode);
 }
 
 
@@ -5036,9 +6175,10 @@ static int builtin_trap(char **argv)
        if (!G.traps)
                G.traps = xzalloc(sizeof(G.traps[0]) * NSIG);
 
-       if (!argv[1]) {
-               /* No args: print all trapped.  This isn't 100% correct as we should
-                * be escaping the cmd so that it can be pasted back in ...
+       argv++;
+       if (!*argv) {
+               /* No args: print all trapped. This isn't 100% correct as we
+                * should be escaping the cmd so that it can be pasted back in
                 */
                for (i = 0; i < NSIG; ++i)
                        if (G.traps[i])
@@ -5048,8 +6188,8 @@ static int builtin_trap(char **argv)
 
        new_cmd = NULL;
        i = 0;
-       /* if first arg is decimal: reset all specified */
-       sig = bb_strtou(*++argv, NULL, 10);
+       /* If first arg is decimal: reset all specified signals */
+       sig = bb_strtou(*argv, NULL, 10);
        if (errno == 0) {
                int ret;
  set_all:
@@ -5058,7 +6198,7 @@ static int builtin_trap(char **argv)
                        sig = get_signum(*argv++);
                        if (sig < 0 || sig >= NSIG) {
                                ret = EXIT_FAILURE;
-                               /* mimic bash message exactly */
+                               /* Mimic bash message exactly */
                                bb_perror_msg("trap: %s: invalid signal specification", argv[i]);
                                continue;
                        }
@@ -5076,7 +6216,7 @@ static int builtin_trap(char **argv)
                        if (new_cmd) {
                                sigaddset(&G.blocked_set, sig);
                        } else {
-                               /* there was a trap handler, we are removing it
+                               /* There was a trap handler, we are removing it
                                 * (if sig has non-DFL handling,
                                 * we don't need to do anything) */
                                if (sig < 32 && (G.non_DFL_mask & (1 << sig)))
@@ -5088,16 +6228,14 @@ static int builtin_trap(char **argv)
                return ret;
        }
 
-       /* first arg is "-": reset all specified to default */
-       /* first arg is "": ignore all specified */
-       /* everything else: execute first arg upon signal */
+       /* First arg is "-": reset all specified to default */
+       /* First arg is "": ignore all specified */
+       /* Everything else: execute first arg upon signal */
        if (!argv[1]) {
                bb_error_msg("trap: invalid arguments");
                return EXIT_FAILURE;
        }
-       if (LONE_DASH(*argv))
-               /* nothing! */;
-       else
+       if (NOT_LONE_DASH(*argv))
                new_cmd = *argv;
        argv++;
        goto set_all;
@@ -5132,31 +6270,32 @@ static int builtin_eval(char **argv)
 {
        int rcode = EXIT_SUCCESS;
 
-       if (argv[1]) {
-               char *str = expand_strvec_to_string(argv + 1);
+       if (*++argv) {
+               char *str = expand_strvec_to_string(argv);
                /* bash:
                 * eval "echo Hi; done" ("done" is syntax error):
                 * "echo Hi" will not execute too.
                 */
                parse_and_run_string(str);
                free(str);
-               rcode = G.last_return_code;
+               rcode = G.last_exitcode;
        }
        return rcode;
 }
 
 static int builtin_cd(char **argv)
 {
-       const char *newdir;
-       if (argv[1] == NULL) {
+       const char *newdir = argv[1];
+       if (newdir == NULL) {
                /* bash does nothing (exitcode 0) if HOME is ""; if it's unset,
-                * bash says "bash: cd: HOME not set" and does nothing (exitcode 1)
+                * bash says "bash: cd: HOME not set" and does nothing
+                * (exitcode 1)
                 */
                newdir = getenv("HOME") ? : "/";
-       } else
-               newdir = argv[1];
+       }
        if (chdir(newdir)) {
-               printf("cd: %s: %s\n", newdir, strerror(errno));
+               /* Mimic bash message exactly */
+               bb_perror_msg("cd: %s", newdir);
                return EXIT_FAILURE;
        }
        set_cwd();
@@ -5165,66 +6304,100 @@ static int builtin_cd(char **argv)
 
 static int builtin_exec(char **argv)
 {
-       if (argv[1] == NULL)
+       if (*++argv == NULL)
                return EXIT_SUCCESS; /* bash does this */
        {
 #if !BB_MMU
                nommu_save_t dummy;
 #endif
 // FIXME: if exec fails, bash does NOT exit! We do...
-               pseudo_exec_argv(&dummy, argv + 1, 0, NULL);
+               pseudo_exec_argv(&dummy, argv, 0, NULL);
                /* never returns */
        }
 }
 
 static int builtin_exit(char **argv)
 {
+       debug_printf_exec("%s()\n", __func__);
 // TODO: bash does it ONLY on top-level sh exit (+interacive only?)
        //puts("exit"); /* bash does it */
 // TODO: warn if we have background jobs: "There are stopped jobs"
 // On second consecutive 'exit', exit anyway.
-       if (argv[1] == NULL)
-               hush_exit(G.last_return_code);
+// perhaps use G.exiting = -1 as indicator "last cmd was exit"
+
+       /* note: EXIT trap is run by hush_exit */
+       if (*++argv == NULL)
+               hush_exit(G.last_exitcode);
        /* mimic bash: exit 123abc == exit 255 + error msg */
        xfunc_error_retval = 255;
        /* bash: exit -2 == exit 254, no error msg */
-       hush_exit(xatoi(argv[1]) & 0xff);
+       hush_exit(xatoi(*argv) & 0xff);
 }
 
 static int builtin_export(char **argv)
 {
-       const char *value;
-       char *name = argv[1];
-
-       if (name == NULL) {
-               // TODO:
-               // ash emits: export VAR='VAL'
-               // bash: declare -x VAR="VAL"
-               // (both also escape as needed (quotes, $, etc))
+       if (*++argv == NULL) {
                char **e = environ;
-               if (e)
-                       while (*e)
+               if (e) {
+                       while (*e) {
+#if 0
                                puts(*e++);
-               return EXIT_SUCCESS;
-       }
-
-       value = strchr(name, '=');
-       if (!value) {
-               /* They are exporting something without a =VALUE */
-               struct variable *var;
+#else
+                               /* ash emits: export VAR='VAL'
+                                * bash: declare -x VAR="VAL"
+                                * we follow ash example */
+                               const char *s = *e++;
+                               const char *p = strchr(s, '=');
 
-               var = get_local_var(name);
-               if (var) {
-                       var->flg_export = 1;
-                       debug_printf_env("%s: putenv '%s'\n", __func__, var->varstr);
-                       putenv(var->varstr);
+                               if (!p) /* wtf? take next variable */
+                                       continue;
+                               /* export var= */
+                               printf("export %.*s", (int)(p - s) + 1, s);
+                               s = p + 1;
+                               while (*s) {
+                                       if (*s != '\'') {
+                                               p = strchrnul(s, '\'');
+                                               /* print 'xxxx' */
+                                               printf("'%.*s'", (int)(p - s), s);
+                                               if (*p == '\0')
+                                                       break;
+                                               s = p;
+                                       }
+                                       /* s points to '; print ''...'''" */
+                                       putchar('"');
+                                       do putchar('\''); while (*++s == '\'');
+                                       putchar('"');
+                               }
+                               putchar('\n');
+#endif
+                       }
+                       fflush(stdout);
                }
-               /* bash does not return an error when trying to export
-                * an undefined variable.  Do likewise. */
                return EXIT_SUCCESS;
        }
 
-       set_local_var(xstrdup(name), 1);
+       do {
+               const char *value;
+               char *name = *argv;
+
+               value = strchr(name, '=');
+               if (!value) {
+                       /* They are exporting something without a =VALUE */
+                       struct variable *var;
+
+                       var = get_local_var(name);
+                       if (var) {
+                               var->flg_export = 1;
+                               debug_printf_env("%s: putenv '%s'\n", __func__, var->varstr);
+                               putenv(var->varstr);
+                       }
+                       /* bash does not return an error when trying to export
+                        * an undefined variable.  Do likewise. */
+                       continue;
+               }
+               set_local_var(xstrdup(name), 1, 0);
+       } while (*++argv);
+
        return EXIT_SUCCESS;
 }
 
@@ -5325,6 +6498,36 @@ static int builtin_jobs(char **argv UNUSED_PARAM)
 }
 #endif
 
+#if HUSH_DEBUG
+static int builtin_memleak(char **argv UNUSED_PARAM)
+{
+       void *p;
+       unsigned long l;
+
+       /* Crude attempt to find where "free memory" starts,
+        * sans fragmentation. */
+       p = malloc(240);
+       l = (unsigned long)p;
+       free(p);
+       p = malloc(3400);
+       if (l < (unsigned long)p) l = (unsigned long)p;
+       free(p);
+
+       if (!G.memleak_value)
+               G.memleak_value = l;
+       
+       l -= G.memleak_value;
+       if ((long)l < 0)
+               l = 0;
+       l /= 1024;
+       if (l > 127)
+               l = 127;
+
+       /* Exitcode is "how many kilobytes we leaked since 1st call" */
+       return l;
+}
+#endif
+
 static int builtin_pwd(char **argv UNUSED_PARAM)
 {
        puts(set_cwd());
@@ -5334,10 +6537,23 @@ static int builtin_pwd(char **argv UNUSED_PARAM)
 static int builtin_read(char **argv)
 {
        char *string;
-       const char *name = argv[1] ? argv[1] : "REPLY";
+       const char *name = "REPLY";
+
+       if (argv[1]) {
+               name = argv[1];
+               /* bash (3.2.33(1)) bug: "read 0abcd" will execute,
+                * and _after_ that_ it will complain */
+               if (!is_well_formed_var_name(name, '\0')) {
+                       /* Mimic bash message */
+                       bb_error_msg("read: '%s': not a valid identifier", name);
+                       return 1;
+               }
+       }
+
+//TODO: bash unbackslashes input, splits words and puts them in argv[i]
 
        string = xmalloc_reads(STDIN_FILENO, xasprintf("%s=", name), NULL);
-       return set_local_var(string, 0);
+       return set_local_var(string, 0, 0);
 }
 
 /* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#set
@@ -5379,19 +6595,14 @@ static int builtin_set(char **argv)
                        ++argv;
                        goto set_argv;
                }
-
-               if (arg[0] == '+' || arg[0] == '-') {
-                       for (n = 1; arg[n]; ++n)
-                               if (set_mode(arg[0], arg[n]))
-                                       goto error;
-                       continue;
-               }
-
-               break;
+               if (arg[0] != '+' && arg[0] != '-')
+                       break;
+               for (n = 1; arg[n]; ++n)
+                       if (set_mode(arg[0], arg[n]))
+                               goto error;
        } while ((arg = *++argv) != NULL);
        /* Now argv[0] is 1st argument */
 
-       /* Only reset global_argv if we didn't process anything */
        if (arg == NULL)
                return EXIT_SUCCESS;
  set_argv:
@@ -5449,24 +6660,25 @@ static int builtin_source(char **argv)
 {
        FILE *input;
 
-       if (argv[1] == NULL)
+       if (*++argv == NULL)
                return EXIT_FAILURE;
 
        /* XXX search through $PATH is missing */
-       input = fopen_for_read(argv[1]);
+       input = fopen_or_warn(*argv, "r");
        if (!input) {
-               bb_error_msg("can't open '%s'", argv[1]);
+               /* bb_perror_msg("%s", *argv); - done by fopen_or_warn */
                return EXIT_FAILURE;
        }
        close_on_exec_on(fileno(input));
 
        /* Now run the file */
+//TODO:
        /* XXX argv and argc are broken; need to save old G.global_argv
         * (pointer only is OK!) on this stack frame,
         * set G.global_argv=argv+1, recurse, and restore. */
        parse_and_run_file(input);
        fclose(input);
-       return G.last_return_code;
+       return G.last_exitcode;
 }
 
 static int builtin_umask(char **argv)
@@ -5474,12 +6686,18 @@ static int builtin_umask(char **argv)
        mode_t new_umask;
        const char *arg = argv[1];
        if (arg) {
+//TODO: umask may take chmod-like symbolic masks
                new_umask = bb_strtou(arg, NULL, 8);
-               if (errno)
+               if (errno) {
+                       //Message? bash examples:
+                       //bash: umask: 'q': invalid symbolic mode operator
+                       //bash: umask: 999: octal number out of range
                        return EXIT_FAILURE;
+               }
        } else {
                new_umask = umask(0);
                printf("%.3o\n", (unsigned) new_umask);
+               /* fall through and restore new_umask which we set to 0 */
        }
        umask(new_umask);
        return EXIT_SUCCESS;
@@ -5488,35 +6706,43 @@ static int builtin_umask(char **argv)
 /* http://www.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#unset */
 static int builtin_unset(char **argv)
 {
-       size_t i;
        int ret;
-       bool var = true;
+       char var;
 
-       if (!argv[1])
+       if (!*++argv)
                return EXIT_SUCCESS;
 
-       i = 0;
-       if (argv[1][0] == '-') {
-               switch (argv[1][1]) {
-               case 'v': break;
-               case 'f': if (ENABLE_HUSH_FUNCTIONS) { var = false; break; }
+       var = 'v';
+       if (argv[0][0] == '-') {
+               switch (argv[0][1]) {
+               case 'v':
+               case 'f':
+                       var = argv[0][1];
+                       break;
                default:
-                       bb_error_msg("unset: %s: invalid option", argv[1]);
+                       bb_error_msg("unset: %s: invalid option", *argv);
                        return EXIT_FAILURE;
                }
-               ++i;
+//TODO: disallow "unset -vf ..." too
+               argv++;
        }
 
        ret = EXIT_SUCCESS;
-       while (argv[++i]) {
-               if (var) {
-                       if (unset_local_var(argv[i]))
+       while (*argv) {
+               if (var == 'v') {
+                       if (unset_local_var(*argv)) {
+                               /* unset <nonexistent_var> doesn't fail.
+                                * Error is when one tries to unset RO var.
+                                * Message was printed by unset_local_var. */
                                ret = EXIT_FAILURE;
+                       }
                }
-#if ENABLE_HUSH_FUNCTIONS
-               else
-                       unset_local_func(argv[i]);
-#endif
+//#if ENABLE_HUSH_FUNCTIONS
+//             else {
+//                     unset_local_func(*argv);
+//             }
+//#endif
+               argv++;
        }
        return ret;
 }