Enhance printf()

index a8c7619dcdde..8e0eef434eec 100644
@@ -71,4 +71,9 @@
 #  define __nolibc_static_assert(_t)
 #endif
 
+#ifndef _NOLIBC_OPTIMIZER_HIDE_VAR
+/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+#define _NOLIBC_OPTIMIZER_HIDE_VAR(var)	__asm__ ("" : "+r" (var))
+#endif
+
 #endif /* _NOLIBC_COMPILER_H */

index f184e108ed0a..186635656c15 100644
@@ -188,36 +188,91 @@ void *realloc(void *old_ptr, size_t new_size)
 	return ret;
 }
 
-/* Converts the unsigned long integer <in> to its hex representation into
+/* Converts the unsigned 64bit integer <in> to base <base> ascii into
  * buffer <buffer>, which must be long enough to store the number and the
- * trailing zero (17 bytes for "ffffffffffffffff" or 9 for "ffffffff"). The
- * buffer is filled from the first byte, and the number of characters emitted
- * (not counting the trailing zero) is returned. The function is constructed
- * in a way to optimize the code size and avoid any divide that could add a
- * dependency on large external functions.
+ * trailing zero. The buffer is filled from the first byte, and the number
+ * of characters emitted (not counting the trailing zero) is returned.
+ * The function uses 'multiply by reciprocal' for the divisions and
+ * requires the caller pass the correct reciprocal.
+ *
+ * Note that unlike __div64_const32() in asm-generic/div64.h there isn't
+ * an extra shift done (by ___p), the reciprocal has to be lower resulting
+ * in a slightly low quotient.
+ * Keep things simple by correcting for the error.
+ * This also saves calculating the 'low * low' product (e2 below) which is
+ * very unlikely to be significant.
+ *
+ * Some maths:
+ *	recip = p2 / base - e1;		// With e1 < base.
+ *	q = (recip * in - e2) / p2;	// With e2 < p2.
+ *        = base / in - (e1 * in + e2) / p2;
+ *        > base / in - (e1 * p2 + p2) / p2;
+ *        = base / in - ((e1 + 1) * p2) / p2;
+ *        > base / in - base;
+ * So the maximum error is less than 'base'.
+ * Hence the largest possible digit is '2 * base - 1'.
+ * For base 10 e1 is 6 and you can get digits of 15 (eg from 2**64-1).
+ * Error e1 is largest for a base that is a factor of 2**64+1, the smallest is 274177
+ * and converting 2**42-1 in base 274177 does generate a digit of 274177+274175.
+ * This all means only a single correction is needed rather than a loop.
+ *
+ * __int128 isn't used for mips because gcc prior to 10.0 will call
+ * __multi3 for MIPS64r6.
  */
-static __attribute__((unused))
-int utoh_r(unsigned long in, char *buffer)
+#define _NOLIBC_U64TOA_RECIP(base) ((base) & 1 ? ~0ull / (base) : (1ull << 63) / ((base) / 2))
+static __attribute__((unused, noinline))
+int _nolibc_u64toa_base(uint64_t in, char *buffer, unsigned int base, uint64_t recip)
 {
-	signed char pos = (~0UL > 0xfffffffful) ? 60 : 28;
-	int digits = 0;
-	int dig;
+	unsigned int digits = 0;
+	unsigned int dig;
+	uint64_t q;
+	char *p;
 
+	/* Generate least significant digit first */
 	do {
-		dig = in >> pos;
-		in -= (uint64_t)dig << pos;
-		pos -= 4;
-		if (dig || digits || pos < 0) {
-			if (dig > 9)
-				dig += 'a' - '0' - 10;
-			buffer[digits++] = '0' + dig;
+#if defined(__SIZEOF_INT128__) && !defined(__mips__)
+		q = ((unsigned __int128)in * recip) >> 64;
+#else
+		uint64_t p = (uint32_t)in * (recip >> 32);
+		q = (in >> 32) * (recip >> 32) + (p >> 32);
+		p = (uint32_t)p + (in >> 32) * (uint32_t)recip;
+		q += p >> 32;
+#endif
+		dig = in - q * base;
+		/* Correct for any rounding errors */
+		if (dig >= base) {
+			dig -= base;
+			q++;
 		}
-	} while (pos >= 0);
+		if (dig > 9)
+			dig += 'a' - '0' - 10;
+		buffer[digits++] = '0' + dig;
+	} while ((in = q));
 
 	buffer[digits] = 0;
+
+	/* Order reverse to result */
+	for (p = buffer + digits - 1; p > buffer; buffer++, p--) {
+		dig = *buffer;
+		*buffer = *p;
+		*p = dig;
+	}
+
 	return digits;
 }
 
+/* Converts the unsigned long integer <in> to its hex representation into
+ * buffer <buffer>, which must be long enough to store the number and the
+ * trailing zero (17 bytes for "ffffffffffffffff" or 9 for "ffffffff"). The
+ * buffer is filled from the first byte, and the number of characters emitted
+ * (not counting the trailing zero) is returned.
+ */
+static __inline__ __attribute__((unused))
+int utoh_r(unsigned long in, char *buffer)
+{
+	return _nolibc_u64toa_base(in, buffer, 16, _NOLIBC_U64TOA_RECIP(16));
+}
+
 /* converts unsigned long <in> to an hex string using the static itoa_buffer
  * and returns the pointer to that string.
  */

@@ -233,30 +288,11 @@ char *utoh(unsigned long in)
  * trailing zero (21 bytes for 18446744073709551615 in 64-bit, 11 for
  * 4294967295 in 32-bit). The buffer is filled from the first byte, and the
  * number of characters emitted (not counting the trailing zero) is returned.
- * The function is constructed in a way to optimize the code size and avoid
- * any divide that could add a dependency on large external functions.
  */
-static __attribute__((unused))
+static __inline__ __attribute__((unused))
 int utoa_r(unsigned long in, char *buffer)
 {
-	unsigned long lim;
-	int digits = 0;
-	int pos = (~0UL > 0xfffffffful) ? 19 : 9;
-	int dig;
-
-	do {
-		for (dig = 0, lim = 1; dig < pos; dig++)
-			lim *= 10;
-
-		if (digits || in >= lim || !pos) {
-			for (dig = 0; in >= lim; dig++)
-				in -= lim;
-			buffer[digits++] = '0' + dig;
-		}
-	} while (pos--);
-
-	buffer[digits] = 0;
-	return digits;
+	return _nolibc_u64toa_base(in, buffer, 10, _NOLIBC_U64TOA_RECIP(10));
 }
 
 /* Converts the signed long integer <in> to its string representation into

@@ -324,34 +360,12 @@ char *utoa(unsigned long in)
  * buffer <buffer>, which must be long enough to store the number and the
  * trailing zero (17 bytes for "ffffffffffffffff"). The buffer is filled from
  * the first byte, and the number of characters emitted (not counting the
- * trailing zero) is returned. The function is constructed in a way to optimize
- * the code size and avoid any divide that could add a dependency on large
- * external functions.
+ * trailing zero) is returned.
  */
-static __attribute__((unused))
+static __inline__ __attribute__((unused))
 int u64toh_r(uint64_t in, char *buffer)
 {
-	signed char pos = 60;
-	int digits = 0;
-	int dig;
-
-	do {
-		if (sizeof(long) >= 8) {
-			dig = (in >> pos) & 0xF;
-		} else {
-			/* 32-bit platforms: avoid a 64-bit shift */
-			uint32_t d = (pos >= 32) ? (in >> 32) : in;
-			dig = (d >> (pos & 31)) & 0xF;
-		}
-		if (dig > 9)
-			dig += 'a' - '0' - 10;
-		pos -= 4;
-		if (dig || digits || pos < 0)
-			buffer[digits++] = '0' + dig;
-	} while (pos >= 0);
-
-	buffer[digits] = 0;
-	return digits;
+	return _nolibc_u64toa_base(in, buffer, 16, _NOLIBC_U64TOA_RECIP(16));
 }
 
 /* converts uint64_t <in> to an hex string using the static itoa_buffer and

@@ -368,31 +382,12 @@ char *u64toh(uint64_t in)
  * buffer <buffer>, which must be long enough to store the number and the
  * trailing zero (21 bytes for 18446744073709551615). The buffer is filled from
  * the first byte, and the number of characters emitted (not counting the
- * trailing zero) is returned. The function is constructed in a way to optimize
- * the code size and avoid any divide that could add a dependency on large
- * external functions.
+ * trailing zero) is returned.
  */
-static __attribute__((unused))
+static __inline__ __attribute__((unused))
 int u64toa_r(uint64_t in, char *buffer)
 {
-	unsigned long long lim;
-	int digits = 0;
-	int pos = 19; /* start with the highest possible digit */
-	int dig;
-
-	do {
-		for (dig = 0, lim = 1; dig < pos; dig++)
-			lim *= 10;
-
-		if (digits || in >= lim || !pos) {
-			for (dig = 0; in >= lim; dig++)
-				in -= lim;
-			buffer[digits++] = '0' + dig;
-		}
-	} while (pos--);
-
-	buffer[digits] = 0;
-	return digits;
+	return _nolibc_u64toa_base(in, buffer, 10, _NOLIBC_U64TOA_RECIP(10));
 }
 
 /* Converts the signed 64-bit integer <in> to its string representation into

index 1b9d3b2e2491..0e8b3b9a86ef 100644
@@ -74,6 +74,20 @@ static const int is_nolibc =
 #endif
 ;
 
+#if !defined(NOLIBC)
+/* Some disabled tests may not compile. */
+
+/* strlcat() and strlcpy() may not be in the system headers. */
+#undef strlcat
+#undef strlcpy
+#define strlcat(d, s, l) 0
+#define strlcpy(d, s, l) 0
+
+/* readdir_r() is likely to be marked deprecated */
+#undef readdir_r
+#define readdir_r(dir, dirent, result) ((errno = EINVAL), -1)
+#endif
+
 /* definition of a series of tests */
 struct test {
 	const char *name;              /* test name */

@@ -1408,7 +1422,7 @@ int run_syscall(int min, int max)
 		CASE_TEST(fork);              EXPECT_SYSZR(1, test_fork(FORK_STANDARD)); break;
 		CASE_TEST(getdents64_root);   EXPECT_SYSNE(1, test_getdents64("/"), -1); break;
 		CASE_TEST(getdents64_null);   EXPECT_SYSER(1, test_getdents64("/dev/null"), -1, ENOTDIR); break;
-		CASE_TEST(directories);       EXPECT_SYSZR(proc, test_dirent()); break;
+		CASE_TEST(directories);       EXPECT_SYSZR(is_nolibc && proc, test_dirent()); break;
 		CASE_TEST(getrandom);         EXPECT_SYSZR(1, test_getrandom()); break;
 		CASE_TEST(gettimeofday_tv);   EXPECT_SYSZR(1, gettimeofday(&tv, NULL)); break;
 		CASE_TEST(gettimeofday_tv_tz);EXPECT_SYSZR(1, gettimeofday(&tv, &tz)); break;

index 0e8b3b9a86ef..029ed63e1ae4 100644
@@ -1660,33 +1660,70 @@ int run_stdlib(int min, int max)
 	return ret;
 }
 
-#define EXPECT_VFPRINTF(c, expected, fmt, ...)				\
-	ret += expect_vfprintf(llen, c, expected, fmt, ##__VA_ARGS__)
+#define EXPECT_VFPRINTF(cond, expected, fmt, ...)				\
+	ret += expect_vfprintf(llen, cond, expected, fmt, ##__VA_ARGS__)
 
-static int expect_vfprintf(int llen, int c, const char *expected, const char *fmt, ...)
+#define VFPRINTF_LEN 25
+
+static int expect_vfprintf(int llen, int cond, const char *expected, const char *fmt, ...)
 {
-	char buf[100];
+	ssize_t written, expected_len;
+	char buf[VFPRINTF_LEN + 80];
+	unsigned int cmp_len;
 	va_list args;
-	ssize_t w;
-	int ret;
 
+	if (!cond) {
+		result(llen, SKIPPED);
+		return 0;
+	}
+
+	/* Fill and terminate buffer to check for overlong/absent writes */
+	memset(buf, 0xa5, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = 0;
 
 	va_start(args, fmt);
-	/* Only allow writing 21 bytes, to test truncation */
-	w = vsnprintf(buf, 21, fmt, args);
+	/* Limit the buffer length to test truncation */
+	written = vsnprintf(buf, VFPRINTF_LEN + 1, fmt, args);
 	va_end(args);
 
-	if (w != c) {
-		llen += printf(" written(%d) != %d", (int)w, c);
+	llen += printf(" \"%s\"", buf);
+
+	/* If the expected output is long it will have been truncated. */
+	expected_len = strlen(expected);
+	if (expected_len > VFPRINTF_LEN) {
+		/* Indicate truncated in test output */
+		llen += printf("+");
+		cmp_len = VFPRINTF_LEN;
+	} else {
+		cmp_len = expected_len;
+	}
+
+	if (memcmp(expected, buf, cmp_len) || buf[cmp_len]) {
+		/* Copy and truncate until "%.*s" supported */
+		memcpy(buf, expected, cmp_len);
+		buf[cmp_len] = 0;
+		llen += printf(" should be \"%s\"", buf);
 		result(llen, FAIL);
 		return 1;
 	}
 
-	llen += printf(" \"%s\" = \"%s\"", expected, buf);
-	ret = strncmp(expected, buf, c);
+	if (written != expected_len) {
+		llen += printf(" written(%d) != %d", (int)written, (int)expected_len);
+		result(llen, FAIL);
+		return 1;
+	}
 
-	result(llen, ret ? FAIL : OK);
-	return ret;
+	/* Check for any overwrites after the actual data. */
+	while (++cmp_len < sizeof(buf) - 1) {
+		if ((unsigned char)buf[cmp_len] != 0xa5) {
+			llen += printf(" overwrote buf[%d] with 0x%x", cmp_len, buf[cmp_len]);
+			result(llen, FAIL);
+			return 1;
+		}
+	}
+
+	result(llen, OK);
+	return 0;
 }
 
 static int test_scanf(void)

@@ -1807,21 +1844,21 @@ static int run_printf(int min, int max)
 		 * test numbers.
 		 */
 		switch (test + __LINE__ + 1) {
-		CASE_TEST(empty);        EXPECT_VFPRINTF(0, "", ""); break;
-		CASE_TEST(simple);       EXPECT_VFPRINTF(3, "foo", "foo"); break;
-		CASE_TEST(string);       EXPECT_VFPRINTF(3, "foo", "%s", "foo"); break;
-		CASE_TEST(number);       EXPECT_VFPRINTF(4, "1234", "%d", 1234); break;
-		CASE_TEST(negnumber);    EXPECT_VFPRINTF(5, "-1234", "%d", -1234); break;
-		CASE_TEST(unsigned);     EXPECT_VFPRINTF(5, "12345", "%u", 12345); break;
+		CASE_TEST(empty);        EXPECT_VFPRINTF(1, "", ""); break;
+		CASE_TEST(simple);       EXPECT_VFPRINTF(1, "foo", "foo"); break;
+		CASE_TEST(string);       EXPECT_VFPRINTF(1, "foo", "%s", "foo"); break;
+		CASE_TEST(number);       EXPECT_VFPRINTF(1, "1234", "%d", 1234); break;
+		CASE_TEST(negnumber);    EXPECT_VFPRINTF(1, "-1234", "%d", -1234); break;
+		CASE_TEST(unsigned);     EXPECT_VFPRINTF(1, "12345", "%u", 12345); break;
 		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
 		CASE_TEST(hex);          EXPECT_VFPRINTF(1, "f", "%x", 0xf); break;
-		CASE_TEST(pointer);      EXPECT_VFPRINTF(3, "0x1", "%p", (void *) 0x1); break;
-		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF(20, "18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
-		CASE_TEST(intmax_t);     EXPECT_VFPRINTF(20, "-9223372036854775807", "%jd", 0x8000000000000001LL); break;
-		CASE_TEST(truncation);   EXPECT_VFPRINTF(25, "01234567890123456789", "%s", "0123456789012345678901234"); break;
-		CASE_TEST(string_width); EXPECT_VFPRINTF(10, "         1", "%10s", "1"); break;
-		CASE_TEST(number_width); EXPECT_VFPRINTF(10, "         1", "%10d", 1); break;
-		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(25, "                    ", "%25d", 1); break;
+		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
+		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF(1, "18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
+		CASE_TEST(intmax_t);     EXPECT_VFPRINTF(1, "-9223372036854775807", "%jd", 0x8000000000000001LL); break;
+		CASE_TEST(truncation);   EXPECT_VFPRINTF(1, "012345678901234567890123456789", "%s", "012345678901234567890123456789"); break;
+		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
+		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
+		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                             1", "%30d", 1); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
 		CASE_TEST(strerror);     EXPECT_ZR(1, test_strerror()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;

index 233318b0d0f0..2267f50d03b4 100644
@@ -373,11 +373,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 					outstr="(null)";
 			}
 			else if (c == 'm') {
-#ifdef NOLIBC_IGNORE_ERRNO
-				outstr = "unknown error";
-#else
 				outstr = strerror(errno);
-#endif /* NOLIBC_IGNORE_ERRNO */
 			}
 			else if (c == '%') {
 				/* queue it verbatim */

@@ -682,14 +678,31 @@ int setvbuf(FILE *stream __attribute__((unused)),
 	return 0;
 }
 
+static __attribute__((unused,))
+int strerror_r(int errnum, char *buf, size_t buflen __attribute__((unused)))
+{
+#ifdef NOLIBC_IGNORE_ERRNO
+	__builtin_memcpy(buf, "unknown error", 14);
+	return 13;
+#else
+	__builtin_memcpy(buf, "errno=", 6);
+	return 6 + i64toa_r(errnum, buf + 6);
+#endif
+}
+
 static __attribute__((unused))
-const char *strerror(int errno)
+const char *strerror(int errnum)
 {
-	static char buf[18] = "errno=";
+	static char buf[18];
+	char *b = buf;
+
+	/* Force gcc to use 'register offset' to access buf[]. */
+	_NOLIBC_OPTIMIZER_HIDE_VAR(b);
 
-	i64toa_r(errno, &buf[6]);
+	/* Use strerror_r() to avoid having the only .data in small programs. */
+	strerror_r(errnum, b, sizeof(buf));
 
-	return buf;
+	return b;
 }
 
 #endif /* _NOLIBC_STDIO_H */

index 029ed63e1ae4..61968fdfeec0 100644
@@ -1793,23 +1793,6 @@ static int test_scanf(void)
 	return 0;
 }
 
-int test_strerror(void)
-{
-	char buf[100];
-	ssize_t ret;
-
-	memset(buf, 'A', sizeof(buf));
-
-	errno = EINVAL;
-	ret = snprintf(buf, sizeof(buf), "%m");
-	if (is_nolibc) {
-		if (ret < 6 || memcmp(buf, "errno=", 6))
-			return 1;
-	}
-
-	return 0;
-}
-
 static int test_printf_error(void)
 {
 	int fd, ret, saved_errno;

@@ -1859,8 +1842,9 @@ static int run_printf(int min, int max)
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
 		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                             1", "%30d", 1); break;
+		CASE_TEST(errno);        EXPECT_VFPRINTF(is_nolibc, "22:errno=22", "%d:%m", errno=22); break;
+		CASE_TEST(errno-neg);    EXPECT_VFPRINTF(is_nolibc, "-22:   errno=-22", "%d:%12m", errno=-22); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
-		CASE_TEST(strerror);     EXPECT_ZR(1, test_strerror()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;
 		case __LINE__:
 			return ret; /* must be last */

index 2267f50d03b4..a271059cf67a 100644
@@ -301,16 +301,16 @@ typedef int (*__nolibc_printf_cb)(intptr_t state, const char *buf, size_t size);
 static __attribute__((unused, format(printf, 4, 0)))
 int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char *fmt, va_list args)
 {
-	char escape, lpref, c;
+	char escape, lpref, ch;
 	unsigned long long v;
 	unsigned int written, width;
 	size_t len, ofs, w;
-	char tmpbuf[21];
+	char outbuf[21];
 	const char *outstr;
 
 	written = ofs = escape = lpref = 0;
 	while (1) {
-		c = fmt[ofs++];
+		ch = fmt[ofs++];
 		width = 0;
 
 		if (escape) {

@@ -318,17 +318,17 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 			escape = 0;
 
 			/* width */
-			while (c >= '0' && c <= '9') {
+			while (ch >= '0' && ch <= '9') {
 				width *= 10;
-				width += c - '0';
+				width += ch - '0';
 
-				c = fmt[ofs++];
+				ch = fmt[ofs++];
 			}
 
-			if (c == 'c' || c == 'd' || c == 'u' || c == 'x' || c == 'p') {
-				char *out = tmpbuf;
+			if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
+				char *out = outbuf;
 
-				if (c == 'p')
+				if (ch == 'p')
 					v = va_arg(args, unsigned long);
 				else if (lpref) {
 					if (lpref > 1)

@@ -338,7 +338,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 				} else
 					v = va_arg(args, unsigned int);
 
-				if (c == 'd') {
+				if (ch == 'd') {
 					/* sign-extend the value */
 					if (lpref == 0)
 						v = (long long)(int)v;

@@ -346,7 +346,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 						v = (long long)(long)v;
 				}
 
-				switch (c) {
+				switch (ch) {
 				case 'c':
 					out[0] = v;
 					out[1] = 0;

@@ -365,26 +365,26 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 					u64toh_r(v, out);
 					break;
 				}
-				outstr = tmpbuf;
+				outstr = outbuf;
 			}
-			else if (c == 's') {
+			else if (ch == 's') {
 				outstr = va_arg(args, char *);
 				if (!outstr)
 					outstr="(null)";
 			}
-			else if (c == 'm') {
+			else if (ch == 'm') {
 				outstr = strerror(errno);
 			}
-			else if (c == '%') {
+			else if (ch == '%') {
 				/* queue it verbatim */
 				continue;
 			}
 			else {
 				/* modifiers or final 0 */
-				if (c == 'l') {
+				if (ch == 'l') {
 					/* long format prefix, maintain the escape */
 					lpref++;
-				} else if (c == 'j') {
+				} else if (ch == 'j') {
 					lpref = 2;
 				}
 				escape = 1;

@@ -395,7 +395,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 		}
 
 		/* not an escape sequence */
-		if (c == 0 || c == '%') {
+		if (ch == 0 || ch == '%') {
 			/* flush pending data on escape or end */
 			escape = 1;
 			lpref = 0;

@@ -416,7 +416,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 
 			written += len;
 		do_escape:
-			if (c == 0)
+			if (ch == 0)
 				break;
 			fmt += ofs;
 			ofs = 0;

index a271059cf67a..5c8f233336b9 100644
@@ -295,16 +295,25 @@ int fseek(FILE *stream, long offset, int whence)
  *  - %[l*]{d,u,c,x,p}
  *  - %s
  *  - unknown modifiers are ignored.
+ *
+ * Called by vfprintf() and snprintf() to do the actual formatting.
+ * The callers provide a callback function to save the formatted data.
+ * The callback function is called multiple times:
+ *  - for each group of literal characters in the format string.
+ *  - for field padding.
+ *  - for each conversion specifier.
+ *  - with (NULL, 0) at the end of the __nolibc_printf.
+ * If the callback returns non-zero __nolibc_printf() immediately returns -1.
  */
-typedef int (*__nolibc_printf_cb)(intptr_t state, const char *buf, size_t size);
+typedef int (*__nolibc_printf_cb)(void *state, const char *buf, size_t size);
 
-static __attribute__((unused, format(printf, 4, 0)))
-int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char *fmt, va_list args)
+static __attribute__((unused, format(printf, 3, 0)))
+int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list args)
 {
 	char escape, lpref, ch;
 	unsigned long long v;
 	unsigned int written, width;
-	size_t len, ofs, w;
+	size_t len, ofs;
 	char outbuf[21];
 	const char *outstr;
 

@@ -402,17 +411,13 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 			outstr = fmt;
 			len = ofs - 1;
 		flush_str:
-			if (n) {
-				w = len < n ? len : n;
-				n -= w;
-				while (width-- > w) {
-					if (cb(state, " ", 1) != 0)
-						return -1;
-					written += 1;
-				}
-				if (cb(state, outstr, w) != 0)
+			while (width-- > len) {
+				if (cb(state, " ", 1) != 0)
 					return -1;
+				written += 1;
 			}
+			if (cb(state, outstr, len) != 0)
+				return -1;
 
 			written += len;
 		do_escape:

@@ -425,18 +430,25 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 
 		/* literal char, just queue it */
 	}
+
+	/* Request a final '\0' be added to the snprintf() output.
+	 * This may be the only call of the cb() function.
+	 */
+	if (cb(state, NULL, 0) != 0)
+		return -1;
+
 	return written;
 }
 
-static int __nolibc_fprintf_cb(intptr_t state, const char *buf, size_t size)
+static int __nolibc_fprintf_cb(void *stream, const char *buf, size_t size)
 {
-	return _fwrite(buf, size, (FILE *)state);
+	return _fwrite(buf, size, stream);
 }
 
 static __attribute__((unused, format(printf, 2, 0)))
 int vfprintf(FILE *stream, const char *fmt, va_list args)
 {
-	return __nolibc_printf(__nolibc_fprintf_cb, (intptr_t)stream, SIZE_MAX, fmt, args);
+	return __nolibc_printf(__nolibc_fprintf_cb, stream, fmt, args);
 }
 
 static __attribute__((unused, format(printf, 1, 0)))

@@ -494,26 +506,52 @@ int dprintf(int fd, const char *fmt, ...)
 	return ret;
 }
 
-static int __nolibc_sprintf_cb(intptr_t _state, const char *buf, size_t size)
+struct __nolibc_sprintf_cb_state {
+	char *buf;
+	size_t space;
+};
+
+static int __nolibc_sprintf_cb(void *v_state, const char *buf, size_t size)
 {
-	char **state = (char **)_state;
+	struct __nolibc_sprintf_cb_state *state = v_state;
+	size_t space = state->space;
+	char *tgt;
+
+	/* Truncate the request to fit in the output buffer space.
+	 * The last byte is reserved for the terminating '\0'.
+	 * state->space can only be zero for snprintf(NULL, 0, fmt, args)
+	 * so this normally lets through calls with 'size == 0'.
+	 */
+	if (size >= space) {
+		if (space <= 1)
+			return 0;
+		size = space - 1;
+	}
+	tgt = state->buf;
+
+	/* __nolibc_printf() ends with cb(state, NULL, 0) to request the output
+	 * buffer be '\0' terminated.
+	 * That will be the only cb() call for, eg, snprintf(buf, sz, "").
+	 * Zero lengths can occur at other times (eg "%s" for an empty string).
+	 * Unconditionally write the '\0' byte to reduce code size, it is
+	 * normally overwritten by the data being output.
+	 * There is no point adding a '\0' after copied data - there is always
+	 * another call.
+	 */
+	*tgt = '\0';
+	state->space = space - size;
+	state->buf = tgt + size;
+	memcpy(tgt, buf, size);
 
-	memcpy(*state, buf, size);
-	*state += size;
 	return 0;
 }
 
 static __attribute__((unused, format(printf, 3, 0)))
 int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 {
-	char *state = buf;
-	int ret;
+	struct __nolibc_sprintf_cb_state state = { .buf = buf, .space = size };
 
-	ret = __nolibc_printf(__nolibc_sprintf_cb, (intptr_t)&state, size, fmt, args);
-	if (ret < 0)
-		return ret;
-	buf[(size_t)ret < size ? (size_t)ret : size - 1] = '\0';
-	return ret;
+	return __nolibc_printf(__nolibc_sprintf_cb, &state, fmt, args);
 }
 
 static __attribute__((unused, format(printf, 3, 4)))

index 5c8f233336b9..ea6c514c4b7a 100644
@@ -312,8 +312,8 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 {
 	char escape, lpref, ch;
 	unsigned long long v;
-	unsigned int written, width;
-	size_t len, ofs;
+	int written, width, len;
+	size_t ofs;
 	char outbuf[21];
 	const char *outstr;
 

@@ -411,10 +411,14 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			outstr = fmt;
 			len = ofs - 1;
 		flush_str:
-			while (width-- > len) {
-				if (cb(state, " ", 1) != 0)
+			width -= len;
+			while (width > 0) {
+				/* Output pad in 16 byte blocks with the small block first. */
+				int pad_len = ((width - 1) & 15) + 1;
+				width -= pad_len;
+				written += pad_len;
+				if (cb(state, "                ", pad_len) != 0)
 					return -1;
-				written += 1;
 			}
 			if (cb(state, outstr, len) != 0)
 				return -1;

index ea6c514c4b7a..52c4c4476102 100644
@@ -310,28 +310,52 @@ typedef int (*__nolibc_printf_cb)(void *state, const char *buf, size_t size);
 static __attribute__((unused, format(printf, 3, 0)))
 int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list args)
 {
-	char escape, lpref, ch;
+	char lpref, ch;
 	unsigned long long v;
 	int written, width, len;
-	size_t ofs;
 	char outbuf[21];
 	const char *outstr;
 
-	written = ofs = escape = lpref = 0;
+	written = 0;
 	while (1) {
-		ch = fmt[ofs++];
+		outstr = fmt;
+		ch = *fmt++;
+		if (!ch)
+			break;
+
 		width = 0;
+		if (ch != '%') {
+			while (*fmt && *fmt != '%')
+				fmt++;
+			/* Output characters from the format string. */
+			len = fmt - outstr;
+		} else {
+			/* we're in a format sequence */
 
-		if (escape) {
-			/* we're in an escape sequence, ofs == 1 */
-			escape = 0;
+			ch = *fmt++;
 
 			/* width */
 			while (ch >= '0' && ch <= '9') {
 				width *= 10;
 				width += ch - '0';
 
-				ch = fmt[ofs++];
+				ch = *fmt++;
+			}
+
+			/* Length modifiers */
+			if (ch == 'l') {
+				lpref = 1;
+				ch = *fmt++;
+				if (ch == 'l') {
+					lpref = 2;
+					ch = *fmt++;
+				}
+			} else if (ch == 'j') {
+				/* intmax_t is long long */
+				lpref = 2;
+				ch = *fmt++;
+			} else {
+				lpref = 0;
 			}
 
 			if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {

@@ -383,56 +407,34 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			}
 			else if (ch == 'm') {
 				outstr = strerror(errno);
-			}
-			else if (ch == '%') {
-				/* queue it verbatim */
-				continue;
-			}
-			else {
-				/* modifiers or final 0 */
-				if (ch == 'l') {
-					/* long format prefix, maintain the escape */
-					lpref++;
-				} else if (ch == 'j') {
-					lpref = 2;
+			} else {
+				if (ch != '%') {
+					/* Invalid format: back up to output the format characters */
+					fmt = outstr + 1;
+					/* and output a '%' now. */
 				}
-				escape = 1;
-				goto do_escape;
+				/* %% is documented as a 'conversion specifier'.
+				 * Any flags, precision or length modifier are ignored.
+				 */
+				width = 0;
+				outstr = "%";
 			}
 			len = strlen(outstr);
-			goto flush_str;
 		}
 
-		/* not an escape sequence */
-		if (ch == 0 || ch == '%') {
-			/* flush pending data on escape or end */
-			escape = 1;
-			lpref = 0;
-			outstr = fmt;
-			len = ofs - 1;
-		flush_str:
-			width -= len;
-			while (width > 0) {
-				/* Output pad in 16 byte blocks with the small block first. */
-				int pad_len = ((width - 1) & 15) + 1;
-				width -= pad_len;
-				written += pad_len;
-				if (cb(state, "                ", pad_len) != 0)
-					return -1;
-			}
-			if (cb(state, outstr, len) != 0)
-				return -1;
+		written += len;
 
-			written += len;
-		do_escape:
-			if (ch == 0)
-				break;
-			fmt += ofs;
-			ofs = 0;
-			continue;
+		width -= len;
+		while (width > 0) {
+			/* Output pad in 16 byte blocks with the small block first. */
+			int pad_len = ((width - 1) & 15) + 1;
+			width -= pad_len;
+			written += pad_len;
+			if (cb(state, "                ", pad_len) != 0)
+				return -1;
 		}
-
-		/* literal char, just queue it */
+		if (cb(state, outstr, len) != 0)
+			return -1;
 	}
 
 	/* Request a final '\0' be added to the snprintf() output.

index 52c4c4476102..ae96b7bebbfe 100644
@@ -329,99 +329,113 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				fmt++;
 			/* Output characters from the format string. */
 			len = fmt - outstr;
-		} else {
-			/* we're in a format sequence */
+			goto do_output;
+		}
 
-			ch = *fmt++;
+		/* we're in a format sequence */
 
-			/* width */
-			while (ch >= '0' && ch <= '9') {
-				width *= 10;
-				width += ch - '0';
+		ch = *fmt++;
 
-				ch = *fmt++;
-			}
+		/* width */
+		while (ch >= '0' && ch <= '9') {
+			width *= 10;
+			width += ch - '0';
+
+			ch = *fmt++;
+		}
 
-			/* Length modifiers */
+		/* Length modifiers */
+		if (ch == 'l') {
+			lpref = 1;
+			ch = *fmt++;
 			if (ch == 'l') {
-				lpref = 1;
-				ch = *fmt++;
-				if (ch == 'l') {
-					lpref = 2;
-					ch = *fmt++;
-				}
-			} else if (ch == 'j') {
-				/* intmax_t is long long */
 				lpref = 2;
 				ch = *fmt++;
-			} else {
-				lpref = 0;
 			}
+		} else if (ch == 'j') {
+			/* intmax_t is long long */
+			lpref = 2;
+			ch = *fmt++;
+		} else {
+			lpref = 0;
+		}
 
-			if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
-				char *out = outbuf;
+		if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
+			char *out = outbuf;
 
-				if (ch == 'p')
+			if (ch == 'p')
+				v = va_arg(args, unsigned long);
+			else if (lpref) {
+				if (lpref > 1)
+					v = va_arg(args, unsigned long long);
+				else
 					v = va_arg(args, unsigned long);
-				else if (lpref) {
-					if (lpref > 1)
-						v = va_arg(args, unsigned long long);
-					else
-						v = va_arg(args, unsigned long);
-				} else
-					v = va_arg(args, unsigned int);
-
-				if (ch == 'd') {
-					/* sign-extend the value */
-					if (lpref == 0)
-						v = (long long)(int)v;
-					else if (lpref == 1)
-						v = (long long)(long)v;
-				}
+			} else
+				v = va_arg(args, unsigned int);
 
-				switch (ch) {
-				case 'c':
-					out[0] = v;
-					out[1] = 0;
-					break;
-				case 'd':
-					i64toa_r(v, out);
-					break;
-				case 'u':
-					u64toa_r(v, out);
-					break;
-				case 'p':
-					*(out++) = '0';
-					*(out++) = 'x';
-					__nolibc_fallthrough;
-				default: /* 'x' and 'p' above */
-					u64toh_r(v, out);
-					break;
-				}
-				outstr = outbuf;
-			}
-			else if (ch == 's') {
-				outstr = va_arg(args, char *);
-				if (!outstr)
-					outstr="(null)";
+			if (ch == 'd') {
+				/* sign-extend the value */
+				if (lpref == 0)
+					v = (long long)(int)v;
+				else if (lpref == 1)
+					v = (long long)(long)v;
 			}
-			else if (ch == 'm') {
-				outstr = strerror(errno);
-			} else {
-				if (ch != '%') {
-					/* Invalid format: back up to output the format characters */
-					fmt = outstr + 1;
-					/* and output a '%' now. */
-				}
-				/* %% is documented as a 'conversion specifier'.
-				 * Any flags, precision or length modifier are ignored.
-				 */
-				width = 0;
-				outstr = "%";
+
+			switch (ch) {
+			case 'c':
+				out[0] = v;
+				out[1] = 0;
+				break;
+			case 'd':
+				i64toa_r(v, out);
+				break;
+			case 'u':
+				u64toa_r(v, out);
+				break;
+			case 'p':
+				*(out++) = '0';
+				*(out++) = 'x';
+				__nolibc_fallthrough;
+			default: /* 'x' and 'p' above */
+				u64toh_r(v, out);
+				break;
 			}
-			len = strlen(outstr);
+			outstr = outbuf;
+			goto do_strlen_output;
 		}
 
+		if (ch == 's') {
+			outstr = va_arg(args, char *);
+			if (!outstr)
+				outstr="(null)";
+			goto do_strlen_output;
+		}
+
+		if (ch == 'm') {
+			outstr = strerror(errno);
+			goto do_strlen_output;
+		}
+
+		if (ch != '%') {
+			/* Invalid format: back up to output the format characters */
+			fmt = outstr + 1;
+			/* and output a '%' now. */
+		}
+		/* %% is documented as a 'conversion specifier'.
+		 * Any flags, precision or length modifier are ignored.
+		 */
+		len = 1;
+		width = 0;
+		outstr = fmt - 1;
+		goto do_output;
+
+do_strlen_output:
+		/* Open coded strlen() (slightly smaller). */
+		for (len = 0;; len++)
+			if (!outstr[len])
+				break;
+
+do_output:
 		written += len;
 
 		width -= len;

index ae96b7bebbfe..6cb106367e3b 100644
@@ -291,10 +291,15 @@ int fseek(FILE *stream, long offset, int whence)
 }
 
 
-/* minimal printf(). It supports the following formats:
- *  - %[l*]{d,u,c,x,p}
- *  - %s
- *  - unknown modifiers are ignored.
+/* printf(). Supports most of the normal integer and string formats.
+ *  - %[#-+ 0][width][{l,t,z,ll,L,j,q}]{c,d,i,u,x,X,p,s,m,%}
+ *  - %% generates a single %
+ *  - %m outputs strerror(errno).
+ *  - %X outputs a..f the same as %x.
+ *  - The modifiers [#-+ 0] are currently ignored.
+ *  - No support for precision or variable widths.
+ *  - No support for floating point or wide characters.
+ *  - Invalid formats are copied to the output buffer.
  *
  * Called by vfprintf() and snprintf() to do the actual formatting.
  * The callers provide a callback function to save the formatted data.

@@ -305,15 +310,43 @@ int fseek(FILE *stream, long offset, int whence)
  *  - with (NULL, 0) at the end of the __nolibc_printf.
  * If the callback returns non-zero __nolibc_printf() immediately returns -1.
  */
+
 typedef int (*__nolibc_printf_cb)(void *state, const char *buf, size_t size);
 
+/* This code uses 'flag' variables that are indexed by the low 6 bits
+ * of characters to optimise checks for multiple characters.
+ *
+ * _NOLIBC_PF_FLAGS_CONTAIN(flags, 'a', 'b'. ...)
+ * returns non-zero if the bit for any of the specified characters is set.
+ *
+ * _NOLIBC_PF_CHAR_IS_ONE_OF(ch, 'a', 'b'. ...)
+ * returns the flag bit for ch if it is one of the specified characters.
+ * All the characters must be in the same 32 character block (non-alphabetic,
+ * upper case, or lower case) of the ASCII character set.
+ */
+#define _NOLIBC_PF_FLAG(ch) (1u << ((ch) & 0x1f))
+#define _NOLIBC_PF_FLAG_NZ(ch) ((ch) ? _NOLIBC_PF_FLAG(ch) : 0)
+#define _NOLIBC_PF_FLAG8(cmp_1, cmp_2, cmp_3, cmp_4, cmp_5, cmp_6, cmp_7, cmp_8, ...) \
+	(_NOLIBC_PF_FLAG_NZ(cmp_1) | _NOLIBC_PF_FLAG_NZ(cmp_2) | \
+	 _NOLIBC_PF_FLAG_NZ(cmp_3) | _NOLIBC_PF_FLAG_NZ(cmp_4) | \
+	 _NOLIBC_PF_FLAG_NZ(cmp_5) | _NOLIBC_PF_FLAG_NZ(cmp_6) | \
+	 _NOLIBC_PF_FLAG_NZ(cmp_7) | _NOLIBC_PF_FLAG_NZ(cmp_8))
+#define _NOLIBC_PF_FLAGS_CONTAIN(flags, ...) \
+	((flags) & _NOLIBC_PF_FLAG8(__VA_ARGS__, 0, 0, 0, 0, 0, 0, 0))
+#define _NOLIBC_PF_CHAR_IS_ONE_OF(ch, cmp_1, ...) \
+	((unsigned int)(ch) - (cmp_1 & 0xe0) > 0x1f ? 0 : \
+		_NOLIBC_PF_FLAGS_CONTAIN(_NOLIBC_PF_FLAG(ch), cmp_1, __VA_ARGS__))
+
 static __attribute__((unused, format(printf, 3, 0)))
 int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list args)
 {
-	char lpref, ch;
+	char ch;
 	unsigned long long v;
+	long long signed_v;
 	int written, width, len;
+	unsigned int flags, ch_flag;
 	char outbuf[21];
+	char *out;
 	const char *outstr;
 
 	written = 0;

@@ -324,6 +357,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			break;
 
 		width = 0;
+		flags = 0;
 		if (ch != '%') {
 			while (*fmt && *fmt != '%')
 				fmt++;

@@ -334,7 +368,14 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 
 		/* we're in a format sequence */
 
-		ch = *fmt++;
+		/* Conversion flag characters */
+		while (1) {
+			ch = *fmt++;
+			ch_flag = _NOLIBC_PF_CHAR_IS_ONE_OF(ch, ' ', '#', '+', '-', '0');
+			if (!ch_flag)
+				break;
+			flags |= ch_flag;
+		}
 
 		/* width */
 		while (ch >= '0' && ch <= '9') {

@@ -344,62 +385,82 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			ch = *fmt++;
 		}
 
-		/* Length modifiers */
-		if (ch == 'l') {
-			lpref = 1;
-			ch = *fmt++;
-			if (ch == 'l') {
-				lpref = 2;
-				ch = *fmt++;
+		/* Length modifier.
+		 * They miss the conversion flags characters " #+-0" so can go into flags.
+		 * Change both L and ll to q.
+		 */
+		if (ch == 'L')
+			ch = 'q';
+		ch_flag = _NOLIBC_PF_CHAR_IS_ONE_OF(ch, 'l', 't', 'z', 'j', 'q');
+		if (ch_flag != 0) {
+			if (ch == 'l' && fmt[0] == 'l') {
+				fmt++;
+				ch_flag = _NOLIBC_PF_FLAG('q');
 			}
-		} else if (ch == 'j') {
-			/* intmax_t is long long */
-			lpref = 2;
+			flags |= ch_flag;
 			ch = *fmt++;
-		} else {
-			lpref = 0;
 		}
 
-		if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
-			char *out = outbuf;
+		/* Conversion specifiers. */
 
-			if (ch == 'p')
+		/* Numeric and pointer conversion specifiers.
+		 *
+		 * Use an explicit bound check (rather than _NOLIBC_PF_CHAR_IS_ONE_OF())
+		 * so that 'X' can be allowed through.
+		 * 'X' gets treated and 'x' because _NOLIBC_PF_FLAG() returns the same
+		 * value for both.
+		 */
+		ch_flag = _NOLIBC_PF_FLAG(ch);
+		if (((ch >= 'a' && ch <= 'z') || ch == 'X') &&
+		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p')) {
+			/* 'long' is needed for pointer conversions and ltz lengths.
+			 * A single test can be used provided 'p' (the same bit as '0')
+			 * is masked from flags.
+			 */
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag | (flags & ~_NOLIBC_PF_FLAG('p')),
+						     'p', 'l', 't', 'z')) {
 				v = va_arg(args, unsigned long);
-			else if (lpref) {
-				if (lpref > 1)
-					v = va_arg(args, unsigned long long);
-				else
-					v = va_arg(args, unsigned long);
-			} else
+				signed_v = (long)v;
+			} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, 'j', 'q')) {
+				v = va_arg(args, unsigned long long);
+				signed_v = v;
+			} else {
 				v = va_arg(args, unsigned int);
+				signed_v = (int)v;
+			}
 
-			if (ch == 'd') {
-				/* sign-extend the value */
-				if (lpref == 0)
-					v = (long long)(int)v;
-				else if (lpref == 1)
-					v = (long long)(long)v;
+			if (ch == 'c') {
+				/* "%c" - single character. */
+				outbuf[0] = v;
+				len = 1;
+				outstr = outbuf;
+				goto do_output;
 			}
 
-			switch (ch) {
-			case 'c':
-				out[0] = v;
-				out[1] = 0;
-				break;
-			case 'd':
-				i64toa_r(v, out);
-				break;
-			case 'u':
+			out = outbuf;
+
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i')) {
+				/* "%d" and "%i" - signed decimal numbers. */
+				if (signed_v < 0) {
+					*out++ = '-';
+					v = -(signed_v + 1);
+					v++;
+				}
+			}
+
+			/* Convert the number to ascii in the required base. */
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
+				/* Base 10 */
 				u64toa_r(v, out);
-				break;
-			case 'p':
-				*(out++) = '0';
-				*(out++) = 'x';
-				__nolibc_fallthrough;
-			default: /* 'x' and 'p' above */
+			} else {
+				/* Base 16 */
+				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p')) {
+					*(out++) = '0';
+					*(out++) = 'x';
+				}
 				u64toh_r(v, out);
-				break;
 			}
+
 			outstr = outbuf;
 			goto do_strlen_output;
 		}

@@ -438,6 +499,9 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 do_output:
 		written += len;
 
+		/* Stop gcc back-merging this code into one of the conditionals above. */
+		_NOLIBC_OPTIMIZER_HIDE_VAR(len);
+
 		width -= len;
 		while (width > 0) {
 			/* Output pad in 16 byte blocks with the small block first. */

index 61968fdfeec0..498d3125eb24 100644
@@ -1833,11 +1833,19 @@ static int run_printf(int min, int max)
 		CASE_TEST(number);       EXPECT_VFPRINTF(1, "1234", "%d", 1234); break;
 		CASE_TEST(negnumber);    EXPECT_VFPRINTF(1, "-1234", "%d", -1234); break;
 		CASE_TEST(unsigned);     EXPECT_VFPRINTF(1, "12345", "%u", 12345); break;
+		CASE_TEST(signed_max);   EXPECT_VFPRINTF(1, "2147483647", "%i", ~0u >> 1); break;
+		CASE_TEST(signed_min);   EXPECT_VFPRINTF(1, "-2147483648", "%i", (~0u >> 1) + 1); break;
+		CASE_TEST(unsigned_max); EXPECT_VFPRINTF(1, "4294967295", "%u", ~0u); break;
 		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
-		CASE_TEST(hex);          EXPECT_VFPRINTF(1, "f", "%x", 0xf); break;
+		CASE_TEST(hex_nolibc);   EXPECT_VFPRINTF(is_nolibc, "|f|d|", "|%x|%X|", 0xf, 0xd); break;
+		CASE_TEST(hex_libc);     EXPECT_VFPRINTF(!is_nolibc, "|f|D|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
-		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF(1, "18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
-		CASE_TEST(intmax_t);     EXPECT_VFPRINTF(1, "-9223372036854775807", "%jd", 0x8000000000000001LL); break;
+		CASE_TEST(percent);      EXPECT_VFPRINTF(1, "a%d42%69%", "a%%d%d%%%d%%", 42, 69); break;
+		CASE_TEST(perc_qual);    EXPECT_VFPRINTF(1, "a%d2", "a%-14l%d%d", 2); break;
+		CASE_TEST(invalid);      EXPECT_VFPRINTF(1, "a%12yx3%y42%P", "a%12yx%d%y%d%P", 3, 42); break;
+		CASE_TEST(intmax_max);   EXPECT_VFPRINTF(1, "9223372036854775807", "%lld", ~0ULL >> 1); break;
+		CASE_TEST(intmax_min);   EXPECT_VFPRINTF(1, "-9223372036854775808", "%Li", (~0ULL >> 1) + 1); break;
+		CASE_TEST(uintmax_max);  EXPECT_VFPRINTF(1, "18446744073709551615", "%ju", ~0ULL); break;
 		CASE_TEST(truncation);   EXPECT_VFPRINTF(1, "012345678901234567890123456789", "%s", "012345678901234567890123456789"); break;
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;

index 6cb106367e3b..6dd27473ab7f 100644
@@ -412,13 +412,13 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		 */
 		ch_flag = _NOLIBC_PF_FLAG(ch);
 		if (((ch >= 'a' && ch <= 'z') || ch == 'X') &&
-		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p')) {
-			/* 'long' is needed for pointer conversions and ltz lengths.
+		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p', 's')) {
+			/* 'long' is needed for pointer/string conversions and ltz lengths.
 			 * A single test can be used provided 'p' (the same bit as '0')
 			 * is masked from flags.
 			 */
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag | (flags & ~_NOLIBC_PF_FLAG('p')),
-						     'p', 'l', 't', 'z')) {
+						     'p', 's', 'l', 't', 'z')) {
 				v = va_arg(args, unsigned long);
 				signed_v = (long)v;
 			} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, 'j', 'q')) {

@@ -437,6 +437,15 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				goto do_output;
 			}
 
+			if (ch == 's') {
+				/* "%s" - character string. */
+				outstr = (const char  *)(uintptr_t)v;
+				if (!outstr) {
+					outstr = "(null)";
+				}
+				goto do_strlen_output;
+			}
+
 			out = outbuf;
 
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i')) {

@@ -465,13 +474,6 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			goto do_strlen_output;
 		}
 
-		if (ch == 's') {
-			outstr = va_arg(args, char *);
-			if (!outstr)
-				outstr="(null)";
-			goto do_strlen_output;
-		}
-
 		if (ch == 'm') {
 			outstr = strerror(errno);
 			goto do_strlen_output;

index 6dd27473ab7f..c21abe085fa6 100644
@@ -296,7 +296,7 @@ int fseek(FILE *stream, long offset, int whence)
  *  - %% generates a single %
  *  - %m outputs strerror(errno).
  *  - %X outputs a..f the same as %x.
- *  - The modifiers [#-+ 0] are currently ignored.
+ *  - The modifiers [-0] are currently ignored.
  *  - No support for precision or variable widths.
  *  - No support for floating point or wide characters.
  *  - Invalid formats are copied to the output buffer.

@@ -345,9 +345,10 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 	long long signed_v;
 	int written, width, len;
 	unsigned int flags, ch_flag;
-	char outbuf[21];
+	char outbuf[2 + 22 + 1];
 	char *out;
 	const char *outstr;
+	unsigned int sign_prefix;
 
 	written = 0;
 	while (1) {

@@ -409,8 +410,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		 * so that 'X' can be allowed through.
 		 * 'X' gets treated and 'x' because _NOLIBC_PF_FLAG() returns the same
 		 * value for both.
+		 *
+		 * We need to check for "%p" or "%#x" later, merging here gives better code.
+		 * But '#' collides with 'c' so shift right.
 		 */
-		ch_flag = _NOLIBC_PF_FLAG(ch);
+		ch_flag = _NOLIBC_PF_FLAG(ch) | (flags & _NOLIBC_PF_FLAG('#')) >> 1;
 		if (((ch >= 'a' && ch <= 'z') || ch == 'X') &&
 		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p', 's')) {
 			/* 'long' is needed for pointer/string conversions and ltz lengths.

@@ -446,32 +450,64 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				goto do_strlen_output;
 			}
 
-			out = outbuf;
+			/* The 'sign_prefix' can be zero, one or two ("0x") characters. */
+			sign_prefix = 0;
 
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i')) {
 				/* "%d" and "%i" - signed decimal numbers. */
 				if (signed_v < 0) {
-					*out++ = '-';
+					sign_prefix = '-';
 					v = -(signed_v + 1);
 					v++;
+				} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, '+')) {
+					sign_prefix = '+';
+				} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, ' ')) {
+					sign_prefix = ' ';
 				}
 			}
 
-			/* Convert the number to ascii in the required base. */
-			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
-				/* Base 10 */
-				u64toa_r(v, out);
-			} else {
-				/* Base 16 */
+			/* The value is converted offset into the buffer so that
+			 * the sign/prefix can be added in front.
+			 * The longest digit string is 22 + 1 for octal conversions, the
+			 * space is reserved even though octal isn't currently supported.
+			 */
+			out = outbuf + 2;
+
+			if (v == 0) {
+				/* There are special rules for zero. */
 				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p')) {
-					*(out++) = '0';
-					*(out++) = 'x';
+					/* "%p" match glibc, precision is ignored */
+					outstr = "(nil)";
+					len = 5;
+					goto do_output;
+				}
+				/* All other formats (including "%#x") just output "0". */
+				out[0] = '0';
+				len = 1;
+			} else {
+				/* Convert the number to ascii in the required base. */
+				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
+					/* Base 10 */
+					len = u64toa_r(v, out);
+				} else {
+					/* Base 16 */
+					if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p', '#' - 1)) {
+						/* "%p" and "%#x" need "0x" prepending. */
+						sign_prefix = 'x' | '0' << 8;
+					}
+					len = u64toh_r(v, out);
 				}
-				u64toh_r(v, out);
 			}
 
-			outstr = outbuf;
-			goto do_strlen_output;
+			/* Add the 0, 1 or 2 ("0x") sign/prefix characters at the front. */
+			for (; sign_prefix; sign_prefix >>= 8) {
+				/* Force gcc to increment len inside the loop. */
+				_NOLIBC_OPTIMIZER_HIDE_VAR(len);
+				len++;
+				*--out = sign_prefix;
+			}
+			outstr = out;
+			goto do_output;
 		}
 
 		if (ch == 'm') {

index 498d3125eb24..f746711af777 100644
@@ -1832,6 +1832,7 @@ static int run_printf(int min, int max)
 		CASE_TEST(string);       EXPECT_VFPRINTF(1, "foo", "%s", "foo"); break;
 		CASE_TEST(number);       EXPECT_VFPRINTF(1, "1234", "%d", 1234); break;
 		CASE_TEST(negnumber);    EXPECT_VFPRINTF(1, "-1234", "%d", -1234); break;
+		CASE_TEST(num_sign);     EXPECT_VFPRINTF(1, "| 1|+2|+3|+4|5|", "|% d|%+d|% +d|%+ d|%#d|", 1, 2, 3, 4, 5); break;
 		CASE_TEST(unsigned);     EXPECT_VFPRINTF(1, "12345", "%u", 12345); break;
 		CASE_TEST(signed_max);   EXPECT_VFPRINTF(1, "2147483647", "%i", ~0u >> 1); break;
 		CASE_TEST(signed_min);   EXPECT_VFPRINTF(1, "-2147483648", "%i", (~0u >> 1) + 1); break;

@@ -1840,6 +1841,7 @@ static int run_printf(int min, int max)
 		CASE_TEST(hex_nolibc);   EXPECT_VFPRINTF(is_nolibc, "|f|d|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(hex_libc);     EXPECT_VFPRINTF(!is_nolibc, "|f|D|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
+		CASE_TEST(pointer_NULL); EXPECT_VFPRINTF(1, "(nil)", "%p", (void *)0); break;
 		CASE_TEST(percent);      EXPECT_VFPRINTF(1, "a%d42%69%", "a%%d%d%%%d%%", 42, 69); break;
 		CASE_TEST(perc_qual);    EXPECT_VFPRINTF(1, "a%d2", "a%-14l%d%d", 2); break;
 		CASE_TEST(invalid);      EXPECT_VFPRINTF(1, "a%12yx3%y42%P", "a%12yx%d%y%d%P", 3, 42); break;

@@ -1850,6 +1852,7 @@ static int run_printf(int min, int max)
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
 		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                             1", "%30d", 1); break;
+		CASE_TEST(hex_alt);      EXPECT_VFPRINTF(1, "|0x1|  0x2|    0|", "|%#x|%#5x|%#5x|", 1, 2, 0); break;
 		CASE_TEST(errno);        EXPECT_VFPRINTF(is_nolibc, "22:errno=22", "%d:%m", errno=22); break;
 		CASE_TEST(errno-neg);    EXPECT_VFPRINTF(is_nolibc, "-22:   errno=-22", "%d:%12m", errno=-22); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;

index c21abe085fa6..482e5b143c86 100644
@@ -540,7 +540,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		/* Stop gcc back-merging this code into one of the conditionals above. */
 		_NOLIBC_OPTIMIZER_HIDE_VAR(len);
 
+		/* Output the characters on the required side of any padding. */
 		width -= len;
+		flags = _NOLIBC_PF_FLAGS_CONTAIN(flags, '-');
+		if (flags && cb(state, outstr, len) != 0)
+			return -1;
 		while (width > 0) {
 			/* Output pad in 16 byte blocks with the small block first. */
 			int pad_len = ((width - 1) & 15) + 1;

@@ -549,7 +553,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			if (cb(state, "                ", pad_len) != 0)
 				return -1;
 		}
-		if (cb(state, outstr, len) != 0)
+		if (!flags && cb(state, outstr, len) != 0)
 			return -1;
 	}
 

index f746711af777..cc59c0116855 100644
@@ -1851,9 +1851,11 @@ static int run_printf(int min, int max)
 		CASE_TEST(truncation);   EXPECT_VFPRINTF(1, "012345678901234567890123456789", "%s", "012345678901234567890123456789"); break;
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
+		CASE_TEST(number_left);  EXPECT_VFPRINTF(1, "|-5      |", "|%-8d|", -5); break;
+		CASE_TEST(string_align); EXPECT_VFPRINTF(1, "|foo     |", "|%-8s|", "foo"); break;
 		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                             1", "%30d", 1); break;
 		CASE_TEST(hex_alt);      EXPECT_VFPRINTF(1, "|0x1|  0x2|    0|", "|%#x|%#5x|%#5x|", 1, 2, 0); break;
-		CASE_TEST(errno);        EXPECT_VFPRINTF(is_nolibc, "22:errno=22", "%d:%m", errno=22); break;
+		CASE_TEST(errno);        EXPECT_VFPRINTF(is_nolibc, "22:errno=22    ", "%d:%-12m", errno=22); break;
 		CASE_TEST(errno-neg);    EXPECT_VFPRINTF(is_nolibc, "-22:   errno=-22", "%d:%12m", errno=-22); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;

index 482e5b143c86..cc2870a6a7cb 100644
@@ -292,12 +292,10 @@ int fseek(FILE *stream, long offset, int whence)
 
 
 /* printf(). Supports most of the normal integer and string formats.
- *  - %[#-+ 0][width][{l,t,z,ll,L,j,q}]{c,d,i,u,x,X,p,s,m,%}
+ *  - %[#0-+ ][width|*[.precision|*}][{l,t,z,ll,L,j,q}]{c,d,i,u,x,X,p,s,m,%}
  *  - %% generates a single %
  *  - %m outputs strerror(errno).
  *  - %X outputs a..f the same as %x.
- *  - The modifiers [-0] are currently ignored.
- *  - No support for precision or variable widths.
  *  - No support for floating point or wide characters.
  *  - Invalid formats are copied to the output buffer.
  *

@@ -343,9 +341,9 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 	char ch;
 	unsigned long long v;
 	long long signed_v;
-	int written, width, len;
+	int written, width, precision, len;
 	unsigned int flags, ch_flag;
-	char outbuf[2 + 22 + 1];
+	char outbuf[2 + 31 + 22 + 1];
 	char *out;
 	const char *outstr;
 	unsigned int sign_prefix;

@@ -378,12 +376,24 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			flags |= ch_flag;
 		}
 
-		/* width */
-		while (ch >= '0' && ch <= '9') {
-			width *= 10;
-			width += ch - '0';
-
-			ch = *fmt++;
+		/* Width and precision */
+		for (;; ch = *fmt++) {
+			if (ch == '*') {
+				precision = va_arg(args, unsigned int);
+				ch = *fmt++;
+			} else {
+				for (precision = 0; ch >= '0' && ch <= '9'; ch = *fmt++)
+					precision = precision * 10 + (ch - '0');
+			}
+			if (_NOLIBC_PF_FLAGS_CONTAIN(flags, '.'))
+				break;
+			width = precision;
+			if (ch != '.') {
+				/* Default precision for strings */
+				precision = INT_MAX;
+				break;
+			}
+			flags |= _NOLIBC_PF_FLAG('.');
 		}
 
 		/* Length modifier.