Enhance printf()

index a8c7619dcdde..f03f84cfadce 100644
@@ -71,4 +71,7 @@
 #  define __nolibc_static_assert(_t)
 #endif
 
+/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+#define _NOLIBC_OPTIMIZER_HIDE_VAR(var)	__asm__ ("" : "+r" (var))
+
 #endif /* _NOLIBC_COMPILER_H */

index 77d7669cdb80..a4df72d9a2d3 100644
@@ -295,16 +295,25 @@ int fseek(FILE *stream, long offset, int whence)
  *  - %[l*]{d,u,c,x,p}
  *  - %s
  *  - unknown modifiers are ignored.
+ *
+ * Called by vfprintf() and snprintf() to do the actual formatting.
+ * The callers provide a callback function to save the formatted data.
+ * The callback function is called multiple times:
+ *  - for each group of literal characters in the format string.
+ *  - for field padding.
+ *  - for each conversion specifier.
+ *  - with (NULL, 0) at the end of the __nolibc_printf.
+ * If the callback returns non-zero __nolibc_printf() immediately returns -1.
  */
-typedef int (*__nolibc_printf_cb)(intptr_t state, const char *buf, size_t size);
+typedef int (*__nolibc_printf_cb)(void *state, const char *buf, size_t size);
 
-static __attribute__((unused, format(printf, 4, 0)))
-int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char *fmt, va_list args)
+static __attribute__((unused, format(printf, 3, 0)))
+int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list args)
 {
 	char escape, lpref, ch;
 	unsigned long long v;
 	unsigned int written, width;
-	size_t len, ofs, w;
+	size_t len, ofs;
 	char outbuf[21];
 	const char *outstr;
 

@@ -406,17 +415,13 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 			outstr = fmt;
 			len = ofs - 1;
 		flush_str:
-			if (n) {
-				w = len < n ? len : n;
-				n -= w;
-				while (width-- > w) {
-					if (cb(state, " ", 1) != 0)
-						return -1;
-					written += 1;
-				}
-				if (cb(state, outstr, w) != 0)
+			while (width-- > len) {
+				if (cb(state, " ", 1) != 0)
 					return -1;
+				written += 1;
 			}
+			if (cb(state, outstr, len) != 0)
+				return -1;
 
 			written += len;
 		do_escape:

@@ -429,18 +434,25 @@ int __nolibc_printf(__nolibc_printf_cb cb, intptr_t state, size_t n, const char
 
 		/* literal char, just queue it */
 	}
+
+	/* Request a final '\0' be added to the snprintf() output.
+	 * This may be the only call of the cb() function.
+	 */
+	if (cb(state, NULL, 0) != 0)
+		return -1;
+
 	return written;
 }
 
-static int __nolibc_fprintf_cb(intptr_t state, const char *buf, size_t size)
+static int __nolibc_fprintf_cb(void *stream, const char *buf, size_t size)
 {
-	return _fwrite(buf, size, (FILE *)state);
+	return _fwrite(buf, size, stream);
 }
 
 static __attribute__((unused, format(printf, 2, 0)))
 int vfprintf(FILE *stream, const char *fmt, va_list args)
 {
-	return __nolibc_printf(__nolibc_fprintf_cb, (intptr_t)stream, SIZE_MAX, fmt, args);
+	return __nolibc_printf(__nolibc_fprintf_cb, stream, fmt, args);
 }
 
 static __attribute__((unused, format(printf, 1, 0)))

@@ -498,26 +510,54 @@ int dprintf(int fd, const char *fmt, ...)
 	return ret;
 }
 
-static int __nolibc_sprintf_cb(intptr_t _state, const char *buf, size_t size)
+struct __nolibc_sprintf_cb_state {
+	char *buf;
+	size_t space;
+};
+
+static int __nolibc_sprintf_cb(void *v_state, const char *buf, size_t size)
 {
-	char **state = (char **)_state;
+	struct __nolibc_sprintf_cb_state *state = v_state;
+	size_t space = state->space;
+	char *tgt;
+
+	/* Truncate the request to fit in the output buffer space.
+	 * The last byte is reserved for the terminating '\0'.
+	 * state->space can only be zero for snprintf(NULL, 0, fmt, args)
+	 * so this normally lets through calls with 'size == 0'.
+	 */
+	if (size >= space) {
+		if (space <= 1)
+			return 0;
+		size = space - 1;
+	}
+	tgt = state->buf;
+
+	/* __nolibc_printf() ends with cb(state, NULL, 0) to request the output
+	 * buffer be '\0' terminated.
+	 * That will be the only cb() call for, eg, snprintf(buf, sz, "").
+	 * Zero lengths can occur at other times (eg "%s" for an empty string).
+	 * Unconditionally write the '\0' byte to reduce code size, it is
+	 * normally overwritten by the data being output.
+	 * There is no point adding a '\0' after copied data - there is always
+	 * another call.
+	 */
+	*tgt = '\0';
+	if (size) {
+		state->space = space - size;
+		state->buf = tgt + size;
+		memcpy(tgt, buf, size);
+	}
 
-	memcpy(*state, buf, size);
-	*state += size;
 	return 0;
 }
 
 static __attribute__((unused, format(printf, 3, 0)))
 int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 {
-	char *state = buf;
-	int ret;
+	struct __nolibc_sprintf_cb_state state = { .buf = buf, .space = size };
 
-	ret = __nolibc_printf(__nolibc_sprintf_cb, (intptr_t)&state, size, fmt, args);
-	if (ret < 0)
-		return ret;
-	buf[(size_t)ret < size ? (size_t)ret : size - 1] = '\0';
-	return ret;
+	return __nolibc_printf(__nolibc_sprintf_cb, &state, fmt, args);
 }
 
 static __attribute__((unused, format(printf, 3, 4)))

index 0e8b3b9a86ef..9787e493523c 100644
@@ -1683,7 +1683,7 @@ static int expect_vfprintf(int llen, int c, const char *expected, const char *fm
 	}
 
 	llen += printf(" \"%s\" = \"%s\"", expected, buf);
-	ret = strncmp(expected, buf, c);
+	ret = strncmp(expected, buf, c) != 0;
 
 	result(llen, ret ? FAIL : OK);
 	return ret;

index 9787e493523c..f4813764d56e 100644
@@ -1668,25 +1668,27 @@ static int expect_vfprintf(int llen, int c, const char *expected, const char *fm
 	char buf[100];
 	va_list args;
 	ssize_t w;
-	int ret;
-
 
 	va_start(args, fmt);
 	/* Only allow writing 21 bytes, to test truncation */
 	w = vsnprintf(buf, 21, fmt, args);
 	va_end(args);
 
+	llen += printf(" \"%s\"", buf);
+	if (strncmp(expected, buf, c)) {
+		llen += printf(" should be \"%s\"", expected);
+		result(llen, FAIL);
+		return 1;
+	}
+
 	if (w != c) {
 		llen += printf(" written(%d) != %d", (int)w, c);
 		result(llen, FAIL);
 		return 1;
 	}
 
-	llen += printf(" \"%s\" = \"%s\"", expected, buf);
-	ret = strncmp(expected, buf, c) != 0;
-
-	result(llen, ret ? FAIL : OK);
-	return ret;
+	result(llen, OK);
+	return 0;
 }
 
 static int test_scanf(void)

index f4813764d56e..dc60ac0d1a05 100644
@@ -1660,29 +1660,44 @@ int run_stdlib(int min, int max)
 	return ret;
 }
 
-#define EXPECT_VFPRINTF(c, expected, fmt, ...)				\
-	ret += expect_vfprintf(llen, c, expected, fmt, ##__VA_ARGS__)
+#define EXPECT_VFPRINTF(expected, fmt, ...)				\
+	ret += expect_vfprintf(llen, expected, fmt, ##__VA_ARGS__)
 
-static int expect_vfprintf(int llen, int c, const char *expected, const char *fmt, ...)
+#define VFPRINTF_LEN 20
+static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)
 {
-	char buf[100];
+	char buf[VFPRINTF_LEN + 80];
+	unsigned int cmp_len;
 	va_list args;
-	ssize_t w;
+	ssize_t w, expected_len;
 
 	va_start(args, fmt);
-	/* Only allow writing 21 bytes, to test truncation */
-	w = vsnprintf(buf, 21, fmt, args);
+	/* Limit buffer length to test truncation */
+	w = vsnprintf(buf, VFPRINTF_LEN + 1, fmt, args);
 	va_end(args);
 
 	llen += printf(" \"%s\"", buf);
-	if (strncmp(expected, buf, c)) {
-		llen += printf(" should be \"%s\"", expected);
+
+	expected_len = strlen(expected);
+	if (expected_len > VFPRINTF_LEN) {
+		/* Indicate truncated in test output */
+		llen += printf("+");
+		cmp_len = VFPRINTF_LEN;
+	} else {
+		cmp_len = expected_len;
+	}
+
+	if (memcmp(expected, buf, cmp_len) || buf[cmp_len]) {
+		/* Copy and truncate until "%.*s" supported */
+		memcpy(buf, expected, cmp_len);
+		buf[cmp_len] = 0;
+		llen += printf(" should be \"%s\"", buf);
 		result(llen, FAIL);
 		return 1;
 	}
 
-	if (w != c) {
-		llen += printf(" written(%d) != %d", (int)w, c);
+	if (w != expected_len) {
+		llen += printf(" written(%d) != %d", (int)w, (int)expected_len);
 		result(llen, FAIL);
 		return 1;
 	}

@@ -1809,21 +1824,21 @@ static int run_printf(int min, int max)
 		 * test numbers.
 		 */
 		switch (test + __LINE__ + 1) {
-		CASE_TEST(empty);        EXPECT_VFPRINTF(0, "", ""); break;
-		CASE_TEST(simple);       EXPECT_VFPRINTF(3, "foo", "foo"); break;
-		CASE_TEST(string);       EXPECT_VFPRINTF(3, "foo", "%s", "foo"); break;
-		CASE_TEST(number);       EXPECT_VFPRINTF(4, "1234", "%d", 1234); break;
-		CASE_TEST(negnumber);    EXPECT_VFPRINTF(5, "-1234", "%d", -1234); break;
-		CASE_TEST(unsigned);     EXPECT_VFPRINTF(5, "12345", "%u", 12345); break;
-		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
-		CASE_TEST(hex);          EXPECT_VFPRINTF(1, "f", "%x", 0xf); break;
-		CASE_TEST(pointer);      EXPECT_VFPRINTF(3, "0x1", "%p", (void *) 0x1); break;
-		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF(20, "18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
-		CASE_TEST(intmax_t);     EXPECT_VFPRINTF(20, "-9223372036854775807", "%jd", 0x8000000000000001LL); break;
-		CASE_TEST(truncation);   EXPECT_VFPRINTF(25, "01234567890123456789", "%s", "0123456789012345678901234"); break;
-		CASE_TEST(string_width); EXPECT_VFPRINTF(10, "         1", "%10s", "1"); break;
-		CASE_TEST(number_width); EXPECT_VFPRINTF(10, "         1", "%10d", 1); break;
-		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(25, "                    ", "%25d", 1); break;
+		CASE_TEST(empty);        EXPECT_VFPRINTF("", ""); break;
+		CASE_TEST(simple);       EXPECT_VFPRINTF("foo", "foo"); break;
+		CASE_TEST(string);       EXPECT_VFPRINTF("foo", "%s", "foo"); break;
+		CASE_TEST(number);       EXPECT_VFPRINTF("1234", "%d", 1234); break;
+		CASE_TEST(negnumber);    EXPECT_VFPRINTF("-1234", "%d", -1234); break;
+		CASE_TEST(unsigned);     EXPECT_VFPRINTF("12345", "%u", 12345); break;
+		CASE_TEST(char);         EXPECT_VFPRINTF("c", "%c", 'c'); break;
+		CASE_TEST(hex);          EXPECT_VFPRINTF("f", "%x", 0xf); break;
+		CASE_TEST(pointer);      EXPECT_VFPRINTF("0x1", "%p", (void *) 0x1); break;
+		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF("18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
+		CASE_TEST(intmax_t);     EXPECT_VFPRINTF("-9223372036854775807", "%jd", 0x8000000000000001LL); break;
+		CASE_TEST(truncation);   EXPECT_VFPRINTF("0123456789012345678901234", "%s", "0123456789012345678901234"); break;
+		CASE_TEST(string_width); EXPECT_VFPRINTF("         1", "%10s", "1"); break;
+		CASE_TEST(number_width); EXPECT_VFPRINTF("         1", "%10d", 1); break;
+		CASE_TEST(width_trunc);  EXPECT_VFPRINTF("                        1", "%25d", 1); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
 		CASE_TEST(strerror);     EXPECT_ZR(1, test_strerror()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;

index dc60ac0d1a05..420f2d25e8cf 100644
@@ -1671,6 +1671,10 @@ static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)
 	va_list args;
 	ssize_t w, expected_len;
 
+	/* Fill and terminate buf[] to check for overlong/absent writes */
+	memset(buf, 0xa5, sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = 0;
+
 	va_start(args, fmt);
 	/* Limit buffer length to test truncation */
 	w = vsnprintf(buf, VFPRINTF_LEN + 1, fmt, args);

@@ -1702,6 +1706,15 @@ static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)
 		return 1;
 	}
 
+	/* Check for any overwrites after the actual data. */
+	while (++cmp_len < sizeof(buf) - 1) {
+		if ((unsigned char)buf[cmp_len] != 0xa5) {
+			llen += printf(" overwrote buf[%d] with 0x%x", cmp_len, buf[cmp_len]);
+			result(llen, FAIL);
+			return 1;
+		}
+	}
+
 	result(llen, OK);
 	return 0;
 }

index 420f2d25e8cf..51390b709af1 100644
@@ -1660,8 +1660,8 @@ int run_stdlib(int min, int max)
 	return ret;
 }
 
-#define EXPECT_VFPRINTF(expected, fmt, ...)				\
-	ret += expect_vfprintf(llen, expected, fmt, ##__VA_ARGS__)
+#define EXPECT_VFPRINTF(cond, expected, fmt, ...)				\
+	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_vfprintf(llen, expected, fmt, ##__VA_ARGS__); } while (0)
 
 #define VFPRINTF_LEN 20
 static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)

@@ -1837,21 +1837,21 @@ static int run_printf(int min, int max)
 		 * test numbers.
 		 */
 		switch (test + __LINE__ + 1) {
-		CASE_TEST(empty);        EXPECT_VFPRINTF("", ""); break;
-		CASE_TEST(simple);       EXPECT_VFPRINTF("foo", "foo"); break;
-		CASE_TEST(string);       EXPECT_VFPRINTF("foo", "%s", "foo"); break;
-		CASE_TEST(number);       EXPECT_VFPRINTF("1234", "%d", 1234); break;
-		CASE_TEST(negnumber);    EXPECT_VFPRINTF("-1234", "%d", -1234); break;
-		CASE_TEST(unsigned);     EXPECT_VFPRINTF("12345", "%u", 12345); break;
-		CASE_TEST(char);         EXPECT_VFPRINTF("c", "%c", 'c'); break;
-		CASE_TEST(hex);          EXPECT_VFPRINTF("f", "%x", 0xf); break;
-		CASE_TEST(pointer);      EXPECT_VFPRINTF("0x1", "%p", (void *) 0x1); break;
-		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF("18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
-		CASE_TEST(intmax_t);     EXPECT_VFPRINTF("-9223372036854775807", "%jd", 0x8000000000000001LL); break;
-		CASE_TEST(truncation);   EXPECT_VFPRINTF("0123456789012345678901234", "%s", "0123456789012345678901234"); break;
-		CASE_TEST(string_width); EXPECT_VFPRINTF("         1", "%10s", "1"); break;
-		CASE_TEST(number_width); EXPECT_VFPRINTF("         1", "%10d", 1); break;
-		CASE_TEST(width_trunc);  EXPECT_VFPRINTF("                        1", "%25d", 1); break;
+		CASE_TEST(empty);        EXPECT_VFPRINTF(1, "", ""); break;
+		CASE_TEST(simple);       EXPECT_VFPRINTF(1, "foo", "foo"); break;
+		CASE_TEST(string);       EXPECT_VFPRINTF(1, "foo", "%s", "foo"); break;
+		CASE_TEST(number);       EXPECT_VFPRINTF(1, "1234", "%d", 1234); break;
+		CASE_TEST(negnumber);    EXPECT_VFPRINTF(1, "-1234", "%d", -1234); break;
+		CASE_TEST(unsigned);     EXPECT_VFPRINTF(1, "12345", "%u", 12345); break;
+		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
+		CASE_TEST(hex);          EXPECT_VFPRINTF(1, "f", "%x", 0xf); break;
+		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
+		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF(1, "18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
+		CASE_TEST(intmax_t);     EXPECT_VFPRINTF(1, "-9223372036854775807", "%jd", 0x8000000000000001LL); break;
+		CASE_TEST(truncation);   EXPECT_VFPRINTF(1, "0123456789012345678901234", "%s", "0123456789012345678901234"); break;
+		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
+		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
+		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                        1", "%25d", 1); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
 		CASE_TEST(strerror);     EXPECT_ZR(1, test_strerror()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;

index 51390b709af1..9ebebe4ff253 100644
@@ -1669,7 +1669,7 @@ static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)
 	char buf[VFPRINTF_LEN + 80];
 	unsigned int cmp_len;
 	va_list args;
-	ssize_t w, expected_len;
+	ssize_t written, expected_len;
 
 	/* Fill and terminate buf[] to check for overlong/absent writes */
 	memset(buf, 0xa5, sizeof(buf) - 1);

@@ -1677,7 +1677,7 @@ static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)
 
 	va_start(args, fmt);
 	/* Limit buffer length to test truncation */
-	w = vsnprintf(buf, VFPRINTF_LEN + 1, fmt, args);
+	written = vsnprintf(buf, VFPRINTF_LEN + 1, fmt, args);
 	va_end(args);
 
 	llen += printf(" \"%s\"", buf);

@@ -1700,8 +1700,8 @@ static int expect_vfprintf(int llen, const char *expected, const char *fmt, ...)
 		return 1;
 	}
 
-	if (w != expected_len) {
-		llen += printf(" written(%d) != %d", (int)w, (int)expected_len);
+	if (written != expected_len) {
+		llen += printf(" written(%d) != %d", (int)written, (int)expected_len);
 		result(llen, FAIL);
 		return 1;
 	}

index a4df72d9a2d3..03fcd0229f90 100644
@@ -722,14 +722,26 @@ int setvbuf(FILE *stream __attribute__((unused)),
 	return 0;
 }
 
+static __attribute__((unused,))
+int strerror_r(int errnum, char *buf, size_t buflen __attribute__((unused)))
+{
+	__builtin_memcpy(buf, "errno=", 6);
+	return 6 + i64toa_r(errnum, buf + 6);
+}
+
 static __attribute__((unused))
 const char *strerror(int errno)
 {
-	static char buf[18] = "errno=";
+	static char buf[18];
+	char *b = buf;
+
+	/* Force gcc to use 'register offset' to access buf[]. */
+	_NOLIBC_OPTIMIZER_HIDE_VAR(b);
 
-	i64toa_r(errno, &buf[6]);
+	/* Use strerror_r() to avoid having the only .data in small programs. */
+	strerror_r(errno, b, sizeof(buf));
 
-	return buf;
+	return b;
 }
 
 #endif /* _NOLIBC_STDIO_H */

index 9ebebe4ff253..638f18fc5123 100644
@@ -1786,23 +1786,6 @@ static int test_scanf(void)
 	return 0;
 }
 
-int test_strerror(void)
-{
-	char buf[100];
-	ssize_t ret;
-
-	memset(buf, 'A', sizeof(buf));
-
-	errno = EINVAL;
-	ret = snprintf(buf, sizeof(buf), "%m");
-	if (is_nolibc) {
-		if (ret < 6 || memcmp(buf, "errno=", 6))
-			return 1;
-	}
-
-	return 0;
-}
-
 static int test_printf_error(void)
 {
 	int fd, ret, saved_errno;

@@ -1852,8 +1835,9 @@ static int run_printf(int min, int max)
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
 		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                        1", "%25d", 1); break;
+		CASE_TEST(errno);        errno = 22; EXPECT_VFPRINTF(is_nolibc, "errno=22", "%m"); break;
+		CASE_TEST(errno-neg);    errno = -22; EXPECT_VFPRINTF(is_nolibc, "   errno=-22", "%12m"); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
-		CASE_TEST(strerror);     EXPECT_ZR(1, test_strerror()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;
 		case __LINE__:
 			return ret; /* must be last */

index 03fcd0229f90..a567b9a5c31e 100644
@@ -730,7 +730,7 @@ int strerror_r(int errnum, char *buf, size_t buflen __attribute__((unused)))
 }
 
 static __attribute__((unused))
-const char *strerror(int errno)
+const char *strerror(int errnum)
 {
 	static char buf[18];
 	char *b = buf;

@@ -739,7 +739,7 @@ const char *strerror(int errno)
 	_NOLIBC_OPTIMIZER_HIDE_VAR(b);
 
 	/* Use strerror_r() to avoid having the only .data in small programs. */
-	strerror_r(errno, b, sizeof(buf));
+	strerror_r(errnum, b, sizeof(buf));
 
 	return b;
 }

index a567b9a5c31e..5368b710c3cb 100644
@@ -312,8 +312,8 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 {
 	char escape, lpref, ch;
 	unsigned long long v;
-	unsigned int written, width;
-	size_t len, ofs;
+	int written, width, len;
+	size_t ofs;
 	char outbuf[21];
 	const char *outstr;
 

@@ -415,10 +415,14 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			outstr = fmt;
 			len = ofs - 1;
 		flush_str:
-			while (width-- > len) {
-				if (cb(state, " ", 1) != 0)
+			width -= len;
+			while (width > 0) {
+				/* Output pad in 16 byte blocks with the small block first. */
+				int pad_len = ((width - 1) & 15) + 1;
+				width -= pad_len;
+				written += pad_len;
+				if (cb(state, "                ", pad_len) != 0)
 					return -1;
-				written += 1;
 			}
 			if (cb(state, outstr, len) != 0)
 				return -1;

index 5368b710c3cb..e0b7ff537b14 100644
@@ -310,28 +310,52 @@ typedef int (*__nolibc_printf_cb)(void *state, const char *buf, size_t size);
 static __attribute__((unused, format(printf, 3, 0)))
 int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list args)
 {
-	char escape, lpref, ch;
+	char lpref, ch;
 	unsigned long long v;
 	int written, width, len;
-	size_t ofs;
 	char outbuf[21];
 	const char *outstr;
 
-	written = ofs = escape = lpref = 0;
+	written = 0;
 	while (1) {
-		ch = fmt[ofs++];
+		outstr = fmt;
+		ch = *fmt++;
+		if (!ch)
+			break;
+
 		width = 0;
+		if (ch != '%') {
+			while (*fmt && *fmt != '%')
+				fmt++;
+			/* Output characters from the format string. */
+			len = fmt - outstr;
+		} else {
+			/* we're in a format sequence */
 
-		if (escape) {
-			/* we're in an escape sequence, ofs == 1 */
-			escape = 0;
+			ch = *fmt++;
 
 			/* width */
 			while (ch >= '0' && ch <= '9') {
 				width *= 10;
 				width += ch - '0';
 
-				ch = fmt[ofs++];
+				ch = *fmt++;
+			}
+
+			/* Length modifiers */
+			if (ch == 'l') {
+				lpref = 1;
+				ch = *fmt++;
+				if (ch == 'l') {
+					lpref = 2;
+					ch = *fmt++;
+				}
+			} else if (ch == 'j') {
+				/* intmax_t is long long */
+				lpref = 2;
+				ch = *fmt++;
+			} else {
+				lpref = 0;
 			}
 
 			if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {

@@ -387,56 +411,34 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 #else
 				outstr = strerror(errno);
 #endif /* NOLIBC_IGNORE_ERRNO */
-			}
-			else if (ch == '%') {
-				/* queue it verbatim */
-				continue;
-			}
-			else {
-				/* modifiers or final 0 */
-				if (ch == 'l') {
-					/* long format prefix, maintain the escape */
-					lpref++;
-				} else if (ch == 'j') {
-					lpref = 2;
+			} else {
+				if (ch != '%') {
+					/* Invalid format: back up to output the format characters */
+					fmt = outstr + 1;
+					/* and output a '%' now. */
 				}
-				escape = 1;
-				goto do_escape;
+				/* %% is documented as a 'conversion specifier'.
+				 * Any flags, precision or length modifier are ignored.
+				 */
+				width = 0;
+				outstr = "%";
 			}
 			len = strlen(outstr);
-			goto flush_str;
 		}
 
-		/* not an escape sequence */
-		if (ch == 0 || ch == '%') {
-			/* flush pending data on escape or end */
-			escape = 1;
-			lpref = 0;
-			outstr = fmt;
-			len = ofs - 1;
-		flush_str:
-			width -= len;
-			while (width > 0) {
-				/* Output pad in 16 byte blocks with the small block first. */
-				int pad_len = ((width - 1) & 15) + 1;
-				width -= pad_len;
-				written += pad_len;
-				if (cb(state, "                ", pad_len) != 0)
-					return -1;
-			}
-			if (cb(state, outstr, len) != 0)
-				return -1;
+		written += len;
 
-			written += len;
-		do_escape:
-			if (ch == 0)
-				break;
-			fmt += ofs;
-			ofs = 0;
-			continue;
+		width -= len;
+		while (width > 0) {
+			/* Output pad in 16 byte blocks with the small block first. */
+			int pad_len = ((width - 1) & 15) + 1;
+			width -= pad_len;
+			written += pad_len;
+			if (cb(state, "                ", pad_len) != 0)
+				return -1;
 		}
-
-		/* literal char, just queue it */
+		if (cb(state, outstr, len) != 0)
+			return -1;
 	}
 
 	/* Request a final '\0' be added to the snprintf() output.

index e0b7ff537b14..13fe6c4d7f58 100644
@@ -329,103 +329,117 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				fmt++;
 			/* Output characters from the format string. */
 			len = fmt - outstr;
-		} else {
-			/* we're in a format sequence */
+			goto do_output;
+		}
 
-			ch = *fmt++;
+		/* we're in a format sequence */
 
-			/* width */
-			while (ch >= '0' && ch <= '9') {
-				width *= 10;
-				width += ch - '0';
+		ch = *fmt++;
 
-				ch = *fmt++;
-			}
+		/* width */
+		while (ch >= '0' && ch <= '9') {
+			width *= 10;
+			width += ch - '0';
+
+			ch = *fmt++;
+		}
 
-			/* Length modifiers */
+		/* Length modifiers */
+		if (ch == 'l') {
+			lpref = 1;
+			ch = *fmt++;
 			if (ch == 'l') {
-				lpref = 1;
-				ch = *fmt++;
-				if (ch == 'l') {
-					lpref = 2;
-					ch = *fmt++;
-				}
-			} else if (ch == 'j') {
-				/* intmax_t is long long */
 				lpref = 2;
 				ch = *fmt++;
-			} else {
-				lpref = 0;
 			}
+		} else if (ch == 'j') {
+			/* intmax_t is long long */
+			lpref = 2;
+			ch = *fmt++;
+		} else {
+			lpref = 0;
+		}
 
-			if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
-				char *out = outbuf;
+		if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
+			char *out = outbuf;
 
-				if (ch == 'p')
+			if (ch == 'p')
+				v = va_arg(args, unsigned long);
+			else if (lpref) {
+				if (lpref > 1)
+					v = va_arg(args, unsigned long long);
+				else
 					v = va_arg(args, unsigned long);
-				else if (lpref) {
-					if (lpref > 1)
-						v = va_arg(args, unsigned long long);
-					else
-						v = va_arg(args, unsigned long);
-				} else
-					v = va_arg(args, unsigned int);
-
-				if (ch == 'd') {
-					/* sign-extend the value */
-					if (lpref == 0)
-						v = (long long)(int)v;
-					else if (lpref == 1)
-						v = (long long)(long)v;
-				}
+			} else
+				v = va_arg(args, unsigned int);
 
-				switch (ch) {
-				case 'c':
-					out[0] = v;
-					out[1] = 0;
-					break;
-				case 'd':
-					i64toa_r(v, out);
-					break;
-				case 'u':
-					u64toa_r(v, out);
-					break;
-				case 'p':
-					*(out++) = '0';
-					*(out++) = 'x';
-					__nolibc_fallthrough;
-				default: /* 'x' and 'p' above */
-					u64toh_r(v, out);
-					break;
-				}
-				outstr = outbuf;
+			if (ch == 'd') {
+				/* sign-extend the value */
+				if (lpref == 0)
+					v = (long long)(int)v;
+				else if (lpref == 1)
+					v = (long long)(long)v;
 			}
-			else if (ch == 's') {
-				outstr = va_arg(args, char *);
-				if (!outstr)
-					outstr="(null)";
+
+			switch (ch) {
+			case 'c':
+				out[0] = v;
+				out[1] = 0;
+				break;
+			case 'd':
+				i64toa_r(v, out);
+				break;
+			case 'u':
+				u64toa_r(v, out);
+				break;
+			case 'p':
+				*(out++) = '0';
+				*(out++) = 'x';
+				__nolibc_fallthrough;
+			default: /* 'x' and 'p' above */
+				u64toh_r(v, out);
+				break;
 			}
-			else if (ch == 'm') {
+			outstr = outbuf;
+			goto do_strlen_output;
+		}
+
+		if (ch == 's') {
+			outstr = va_arg(args, char *);
+			if (!outstr)
+				outstr="(null)";
+			goto do_strlen_output;
+		}
+
+		if (ch == 'm') {
 #ifdef NOLIBC_IGNORE_ERRNO
-				outstr = "unknown error";
+			outstr = "unknown error";
 #else
-				outstr = strerror(errno);
+			outstr = strerror(errno);
 #endif /* NOLIBC_IGNORE_ERRNO */
-			} else {
-				if (ch != '%') {
-					/* Invalid format: back up to output the format characters */
-					fmt = outstr + 1;
-					/* and output a '%' now. */
-				}
-				/* %% is documented as a 'conversion specifier'.
-				 * Any flags, precision or length modifier are ignored.
-				 */
-				width = 0;
-				outstr = "%";
-			}
-			len = strlen(outstr);
+			goto do_strlen_output;
 		}
 
+		if (ch != '%') {
+			/* Invalid format: back up to output the format characters */
+			fmt = outstr + 1;
+			/* and output a '%' now. */
+		}
+		/* %% is documented as a 'conversion specifier'.
+		 * Any flags, precision or length modifier are ignored.
+		 */
+		len = 1;
+		width = 0;
+		outstr = fmt - 1;
+		goto do_output;
+
+do_strlen_output:
+		/* Open coded strlen() (slightly smaller). */
+		for (len = 0;; len++)
+			if (!outstr[len])
+				break;
+
+do_output:
 		written += len;
 
 		width -= len;

index 13fe6c4d7f58..ea1288d87eea 100644
@@ -291,10 +291,14 @@ int fseek(FILE *stream, long offset, int whence)
 }
 
 
-/* minimal printf(). It supports the following formats:
- *  - %[l*]{d,u,c,x,p}
- *  - %s
- *  - unknown modifiers are ignored.
+/* printf(). Supports the following integer and string formats.
+ *  - %[#-+ 0][width][{l,ll,j}]{c,d,u,x,p,s,m,%}
+ *  - %% generates a single %
+ *  - %m outputs strerror(errno).
+ *  - The modifiers [#-+ 0] are currently ignored.
+ *  - No support for precision or variable widths.
+ *  - No support for floating point or wide characters.
+ *  - Invalid formats are copied to the output buffer.
  *
  * Called by vfprintf() and snprintf() to do the actual formatting.
  * The callers provide a callback function to save the formatted data.

@@ -305,15 +309,43 @@ int fseek(FILE *stream, long offset, int whence)
  *  - with (NULL, 0) at the end of the __nolibc_printf.
  * If the callback returns non-zero __nolibc_printf() immediately returns -1.
  */
+
 typedef int (*__nolibc_printf_cb)(void *state, const char *buf, size_t size);
 
+/* This code uses 'flag' variables that are indexed by the low 6 bits
+ * of characters to optimise checks for multiple characters.
+ *
+ * _NOLIBC_PF_FLAGS_CONTAIN(flags, 'a', 'b'. ...)
+ * returns non-zero if the bit for any of the specified characters is set.
+ *
+ * _NOLIBC_PF_CHAR_IS_ONE_OF(ch, 'a', 'b'. ...)
+ * returns the flag bit for ch if it is one of the specified characters.
+ * All the characters must be in the same 32 character block (non-alphabetic,
+ * upper case, or lower case) of the ASCII character set.
+ */
+#define _NOLIBC_PF_FLAG(ch) (1u << ((ch) & 0x1f))
+#define _NOLIBC_PF_FLAG_NZ(ch) ((ch) ? _NOLIBC_PF_FLAG(ch) : 0)
+#define _NOLIBC_PF_FLAG8(cmp_1, cmp_2, cmp_3, cmp_4, cmp_5, cmp_6, cmp_7, cmp_8, ...) \
+	(_NOLIBC_PF_FLAG_NZ(cmp_1) | _NOLIBC_PF_FLAG_NZ(cmp_2) | \
+	 _NOLIBC_PF_FLAG_NZ(cmp_3) | _NOLIBC_PF_FLAG_NZ(cmp_4) | \
+	 _NOLIBC_PF_FLAG_NZ(cmp_5) | _NOLIBC_PF_FLAG_NZ(cmp_6) | \
+	 _NOLIBC_PF_FLAG_NZ(cmp_7) | _NOLIBC_PF_FLAG_NZ(cmp_8))
+#define _NOLIBC_PF_FLAGS_CONTAIN(flags, ...) \
+	((flags) & _NOLIBC_PF_FLAG8(__VA_ARGS__, 0, 0, 0, 0, 0, 0, 0))
+#define _NOLIBC_PF_CHAR_IS_ONE_OF(ch, cmp_1, ...) \
+	((unsigned int)(ch) - (cmp_1 & 0xe0) > 0x1f ? 0 : \
+		_NOLIBC_PF_FLAGS_CONTAIN(_NOLIBC_PF_FLAG(ch), cmp_1, __VA_ARGS__))
+
 static __attribute__((unused, format(printf, 3, 0)))
 int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list args)
 {
-	char lpref, ch;
+	char ch;
 	unsigned long long v;
+	long long signed_v;
 	int written, width, len;
+	unsigned int flags, ch_flag;
 	char outbuf[21];
+	char *out;
 	const char *outstr;
 
 	written = 0;

@@ -324,6 +356,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			break;
 
 		width = 0;
+		flags = 0;
 		if (ch != '%') {
 			while (*fmt && *fmt != '%')
 				fmt++;

@@ -334,7 +367,14 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 
 		/* we're in a format sequence */
 
-		ch = *fmt++;
+		/* Conversion flag characters */
+		while (1) {
+			ch = *fmt++;
+			ch_flag = _NOLIBC_PF_CHAR_IS_ONE_OF(ch, ' ', '#', '+', '-', '0');
+			if (!ch_flag)
+				break;
+			flags |= ch_flag;
+		}
 
 		/* width */
 		while (ch >= '0' && ch <= '9') {

@@ -344,62 +384,78 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			ch = *fmt++;
 		}
 
-		/* Length modifiers */
-		if (ch == 'l') {
-			lpref = 1;
-			ch = *fmt++;
-			if (ch == 'l') {
-				lpref = 2;
-				ch = *fmt++;
+		/* Length modifier.
+		 * They miss the conversion flags characters " #+-0" so can go into flags.
+		 * Change ll to j (both always 64bits).
+		 */
+		ch_flag = _NOLIBC_PF_CHAR_IS_ONE_OF(ch, 'l', 'j');
+		if (ch_flag != 0) {
+			if (ch == 'l' && fmt[0] == 'l') {
+				fmt++;
+				ch_flag = _NOLIBC_PF_FLAG('j');
 			}
-		} else if (ch == 'j') {
-			/* intmax_t is long long */
-			lpref = 2;
+			flags |= ch_flag;
 			ch = *fmt++;
-		} else {
-			lpref = 0;
 		}
 
-		if (ch == 'c' || ch == 'd' || ch == 'u' || ch == 'x' || ch == 'p') {
-			char *out = outbuf;
+		/* Conversion specifiers. */
 
-			if (ch == 'p')
+		/* Numeric and pointer conversion specifiers.
+		 *
+		 * Use an explicit bound check (rather than _NOLIBC_PF_CHAR_IS_ONE_OF())
+		 * so ch_flag can be used later.
+		 */
+		ch_flag = _NOLIBC_PF_FLAG(ch);
+		if ((ch >= 'a' && ch <= 'z') &&
+		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'u', 'x', 'p')) {
+			/* 'long' is needed for pointer conversions and ltz lengths.
+			 * A single test can be used provided 'p' (the same bit as '0')
+			 * is masked from flags.
+			 */
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag | (flags & ~_NOLIBC_PF_FLAG('p')),
+						     'p', 'l')) {
 				v = va_arg(args, unsigned long);
-			else if (lpref) {
-				if (lpref > 1)
-					v = va_arg(args, unsigned long long);
-				else
-					v = va_arg(args, unsigned long);
-			} else
+				signed_v = (long)v;
+			} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, 'j')) {
+				v = va_arg(args, unsigned long long);
+				signed_v = v;
+			} else {
 				v = va_arg(args, unsigned int);
+				signed_v = (int)v;
+			}
 
-			if (ch == 'd') {
-				/* sign-extend the value */
-				if (lpref == 0)
-					v = (long long)(int)v;
-				else if (lpref == 1)
-					v = (long long)(long)v;
+			if (ch == 'c') {
+				/* "%c" - single character. */
+				outbuf[0] = v;
+				len = 1;
+				outstr = outbuf;
+				goto do_output;
 			}
 
-			switch (ch) {
-			case 'c':
-				out[0] = v;
-				out[1] = 0;
-				break;
-			case 'd':
-				i64toa_r(v, out);
-				break;
-			case 'u':
+			out = outbuf;
+
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd')) {
+				/* "%d" and "%i" - signed decimal numbers. */
+				if (signed_v < 0) {
+					*out++ = '-';
+					v = -(signed_v + 1);
+					v++;
+				}
+			}
+
+			/* Convert the number to ascii in the required base. */
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'u')) {
+				/* Base 10 */
 				u64toa_r(v, out);
-				break;
-			case 'p':
-				*(out++) = '0';
-				*(out++) = 'x';
-				__nolibc_fallthrough;
-			default: /* 'x' and 'p' above */
+			} else {
+				/* Base 16 */
+				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p')) {
+					*(out++) = '0';
+					*(out++) = 'x';
+				}
 				u64toh_r(v, out);
-				break;
 			}
+
 			outstr = outbuf;
 			goto do_strlen_output;
 		}

@@ -442,6 +498,9 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 do_output:
 		written += len;
 
+		/* Stop gcc back-merging this code into one of the conditionals above. */
+		_NOLIBC_OPTIMIZER_HIDE_VAR(len);
+
 		width -= len;
 		while (width > 0) {
 			/* Output pad in 16 byte blocks with the small block first. */

index ea1288d87eea..4c7626dbd63f 100644
@@ -291,10 +291,11 @@ int fseek(FILE *stream, long offset, int whence)
 }
 
 
-/* printf(). Supports the following integer and string formats.
- *  - %[#-+ 0][width][{l,ll,j}]{c,d,u,x,p,s,m,%}
+/* printf(). Supports most of the normal integer and string formats.
+ *  - %[#-+ 0][width][{l,t,z,ll,L,j,q}]{c,d,i,u,x,X,p,s,m,%}
  *  - %% generates a single %
  *  - %m outputs strerror(errno).
+ *  - %X outputs a..f the same as %x.
  *  - The modifiers [#-+ 0] are currently ignored.
  *  - No support for precision or variable widths.
  *  - No support for floating point or wide characters.

@@ -386,9 +387,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 
 		/* Length modifier.
 		 * They miss the conversion flags characters " #+-0" so can go into flags.
-		 * Change ll to j (both always 64bits).
+		 * Change both L and ll to j (all alwys 64bit).
 		 */
-		ch_flag = _NOLIBC_PF_CHAR_IS_ONE_OF(ch, 'l', 'j');
+		if (ch == 'L')
+			ch = 'j';
+		ch_flag = _NOLIBC_PF_CHAR_IS_ONE_OF(ch, 'l', 't', 'z', 'j', 'q');
 		if (ch_flag != 0) {
 			if (ch == 'l' && fmt[0] == 'l') {
 				fmt++;

@@ -403,20 +406,22 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		/* Numeric and pointer conversion specifiers.
 		 *
 		 * Use an explicit bound check (rather than _NOLIBC_PF_CHAR_IS_ONE_OF())
-		 * so ch_flag can be used later.
+		 * so that 'X' can be allowed through.
+		 * 'X' gets treated and 'x' because _NOLIBC_PF_FLAG() returns the same
+		 * value for both.
 		 */
 		ch_flag = _NOLIBC_PF_FLAG(ch);
-		if ((ch >= 'a' && ch <= 'z') &&
-		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'u', 'x', 'p')) {
+		if (((ch >= 'a' && ch <= 'z') || ch == 'X') &&
+		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p')) {
 			/* 'long' is needed for pointer conversions and ltz lengths.
 			 * A single test can be used provided 'p' (the same bit as '0')
 			 * is masked from flags.
 			 */
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag | (flags & ~_NOLIBC_PF_FLAG('p')),
-						     'p', 'l')) {
+						     'p', 'l', 't', 'z')) {
 				v = va_arg(args, unsigned long);
 				signed_v = (long)v;
-			} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, 'j')) {
+			} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, 'j', 'q')) {
 				v = va_arg(args, unsigned long long);
 				signed_v = v;
 			} else {

@@ -434,7 +439,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 
 			out = outbuf;
 
-			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd')) {
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i')) {
 				/* "%d" and "%i" - signed decimal numbers. */
 				if (signed_v < 0) {
 					*out++ = '-';

@@ -444,7 +449,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			}
 
 			/* Convert the number to ascii in the required base. */
-			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'u')) {
+			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
 				/* Base 10 */
 				u64toa_r(v, out);
 			} else {

index 638f18fc5123..a140c54e4d72 100644
@@ -1826,11 +1826,19 @@ static int run_printf(int min, int max)
 		CASE_TEST(number);       EXPECT_VFPRINTF(1, "1234", "%d", 1234); break;
 		CASE_TEST(negnumber);    EXPECT_VFPRINTF(1, "-1234", "%d", -1234); break;
 		CASE_TEST(unsigned);     EXPECT_VFPRINTF(1, "12345", "%u", 12345); break;
+		CASE_TEST(signed_max);   EXPECT_VFPRINTF(1, "2147483647", "%i", ~0u >> 1); break;
+		CASE_TEST(signed_min);   EXPECT_VFPRINTF(1, "-2147483648", "%i", (~0u >> 1) + 1); break;
+		CASE_TEST(unsigned_max); EXPECT_VFPRINTF(1, "4294967295", "%u", ~0u); break;
 		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
-		CASE_TEST(hex);          EXPECT_VFPRINTF(1, "f", "%x", 0xf); break;
+		CASE_TEST(hex_nolibc);   EXPECT_VFPRINTF(is_nolibc, "|f|d|", "|%x|%X|", 0xf, 0xd); break;
+		CASE_TEST(hex_libc);     EXPECT_VFPRINTF(!is_nolibc, "|f|D|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
-		CASE_TEST(uintmax_t);    EXPECT_VFPRINTF(1, "18446744073709551615", "%ju", 0xffffffffffffffffULL); break;
-		CASE_TEST(intmax_t);     EXPECT_VFPRINTF(1, "-9223372036854775807", "%jd", 0x8000000000000001LL); break;
+		CASE_TEST(percent);      EXPECT_VFPRINTF(1, "a%d42%69%", "a%%d%d%%%d%%", 42, 69); break;
+		CASE_TEST(perc_qual);    EXPECT_VFPRINTF(1, "a%d2", "a%-14l%d%d", 2); break;
+		CASE_TEST(invalid);      EXPECT_VFPRINTF(1, "a%12yx3%y42%P", "a%12yx%d%y%d%P", 3, 42); break;
+		CASE_TEST(intmax_max);   EXPECT_VFPRINTF(1, "9223372036854775807", "%lld", ~0ULL >> 1); break;
+		CASE_TEST(intmax_min);   EXPECT_VFPRINTF(1, "-9223372036854775808", "%Li", (~0ULL >> 1) + 1); break;
+		CASE_TEST(uintmax_max);  EXPECT_VFPRINTF(1, "18446744073709551615", "%ju", ~0ULL); break;
 		CASE_TEST(truncation);   EXPECT_VFPRINTF(1, "0123456789012345678901234", "%s", "0123456789012345678901234"); break;
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;

index 4c7626dbd63f..484432ca87d5 100644
@@ -412,13 +412,13 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		 */
 		ch_flag = _NOLIBC_PF_FLAG(ch);
 		if (((ch >= 'a' && ch <= 'z') || ch == 'X') &&
-		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p')) {
-			/* 'long' is needed for pointer conversions and ltz lengths.
+		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p', 's')) {
+			/* 'long' is needed for pointer/string conversions and ltz lengths.
 			 * A single test can be used provided 'p' (the same bit as '0')
 			 * is masked from flags.
 			 */
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag | (flags & ~_NOLIBC_PF_FLAG('p')),
-						     'p', 'l', 't', 'z')) {
+						     'p', 's', 'l', 't', 'z')) {
 				v = va_arg(args, unsigned long);
 				signed_v = (long)v;
 			} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, 'j', 'q')) {

@@ -437,6 +437,15 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				goto do_output;
 			}
 
+			if (ch == 's') {
+				/* "%s" - character string. */
+				outstr = (const char  *)(uintptr_t)v;
+				if (!outstr) {
+					outstr = "(null)";
+				}
+				goto do_strlen_output;
+			}
+
 			out = outbuf;
 
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i')) {

@@ -465,13 +474,6 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			goto do_strlen_output;
 		}
 
-		if (ch == 's') {
-			outstr = va_arg(args, char *);
-			if (!outstr)
-				outstr="(null)";
-			goto do_strlen_output;
-		}
-
 		if (ch == 'm') {
 #ifdef NOLIBC_IGNORE_ERRNO
 			outstr = "unknown error";

index 484432ca87d5..fb310b7d023f 100644
@@ -345,9 +345,10 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 	long long signed_v;
 	int written, width, len;
 	unsigned int flags, ch_flag;
-	char outbuf[21];
+	char outbuf[2 + 22 + 1];
 	char *out;
 	const char *outstr;
+	unsigned int sign_prefix;
 
 	written = 0;
 	while (1) {

@@ -446,32 +447,47 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				goto do_strlen_output;
 			}
 
-			out = outbuf;
+			/* The 'sign_prefix' can be zero, one or two ("0x") characters. */
+			sign_prefix = 0;
 
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i')) {
 				/* "%d" and "%i" - signed decimal numbers. */
 				if (signed_v < 0) {
-					*out++ = '-';
+					sign_prefix = '-';
 					v = -(signed_v + 1);
 					v++;
 				}
 			}
 
+			/* The value is converted offset into the buffer so that
+			 * the sign/prefix can be added in front.
+			 * The longest digit string is 22 + 1 for octal conversions, the
+			 * space is reserved even though octal isn't currently supported.
+			 */
+			out = outbuf + 2;
+
 			/* Convert the number to ascii in the required base. */
 			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
 				/* Base 10 */
-				u64toa_r(v, out);
+				len = u64toa_r(v, out);
 			} else {
 				/* Base 16 */
 				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p')) {
-					*(out++) = '0';
-					*(out++) = 'x';
+					/* "%p" needs "0x" prepending. */
+					sign_prefix = 'x' | '0' << 8;
 				}
-				u64toh_r(v, out);
+				len = u64toh_r(v, out);
 			}
 
-			outstr = outbuf;
-			goto do_strlen_output;
+			/* Add the 0, 1 or 2 ("0x") sign/prefix characters at the front. */
+			for (; sign_prefix; sign_prefix >>= 8) {
+				/* Force gcc to increment len inside the loop. */
+				_NOLIBC_OPTIMIZER_HIDE_VAR(len);
+				len++;
+				*--out = sign_prefix;
+			}
+			outstr = out;
+			goto do_output;
 		}
 
 		if (ch == 'm') {

index fb310b7d023f..5d75e8530ce2 100644
@@ -296,7 +296,7 @@ int fseek(FILE *stream, long offset, int whence)
  *  - %% generates a single %
  *  - %m outputs strerror(errno).
  *  - %X outputs a..f the same as %x.
- *  - The modifiers [#-+ 0] are currently ignored.
+ *  - The modifiers [#-0] are currently ignored.
  *  - No support for precision or variable widths.
  *  - No support for floating point or wide characters.
  *  - Invalid formats are copied to the output buffer.

@@ -456,6 +456,10 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 					sign_prefix = '-';
 					v = -(signed_v + 1);
 					v++;
+				} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, '+')) {
+					sign_prefix = '+';
+				} else if (_NOLIBC_PF_FLAGS_CONTAIN(flags, ' ')) {
+					sign_prefix = ' ';
 				}
 			}
 

index 5d75e8530ce2..ef8e7069d5cf 100644
@@ -296,7 +296,7 @@ int fseek(FILE *stream, long offset, int whence)
  *  - %% generates a single %
  *  - %m outputs strerror(errno).
  *  - %X outputs a..f the same as %x.
- *  - The modifiers [#-0] are currently ignored.
+ *  - The modifiers [-0] are currently ignored.
  *  - No support for precision or variable widths.
  *  - No support for floating point or wide characters.
  *  - Invalid formats are copied to the output buffer.

@@ -410,8 +410,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		 * so that 'X' can be allowed through.
 		 * 'X' gets treated and 'x' because _NOLIBC_PF_FLAG() returns the same
 		 * value for both.
+		 *
+		 * We need to check for "%p" or "%#x" later, merging here gives better code.
+		 * But '#' collides with 'c' so shift right.
 		 */
-		ch_flag = _NOLIBC_PF_FLAG(ch);
+		ch_flag = _NOLIBC_PF_FLAG(ch) | (flags & _NOLIBC_PF_FLAG('#')) >> 1;
 		if (((ch >= 'a' && ch <= 'z') || ch == 'X') &&
 		    _NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'c', 'd', 'i', 'u', 'x', 'p', 's')) {
 			/* 'long' is needed for pointer/string conversions and ltz lengths.

@@ -470,17 +473,30 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			 */
 			out = outbuf + 2;
 
-			/* Convert the number to ascii in the required base. */
-			if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
-				/* Base 10 */
-				len = u64toa_r(v, out);
-			} else {
-				/* Base 16 */
+			if (v == 0) {
+				/* There are special rules for zero. */
 				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p')) {
-					/* "%p" needs "0x" prepending. */
-					sign_prefix = 'x' | '0' << 8;
+					/* "%p" match glibc, precision is ignored */
+					outstr = "(nil)";
+					len = 5;
+					goto do_output;
+				}
+				/* All other formats (including "%#x") just output "0". */
+				out[0] = '0';
+				len = 1;
+			} else {
+				/* Convert the number to ascii in the required base. */
+				if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'd', 'i', 'u')) {
+					/* Base 10 */
+					len = u64toa_r(v, out);
+				} else {
+					/* Base 16 */
+					if (_NOLIBC_PF_FLAGS_CONTAIN(ch_flag, 'p', '#' - 1)) {
+						/* "%p" and "%#x" need "0x" prepending. */
+						sign_prefix = 'x' | '0' << 8;
+					}
+					len = u64toh_r(v, out);
 				}
-				len = u64toh_r(v, out);
 			}
 
 			/* Add the 0, 1 or 2 ("0x") sign/prefix characters at the front. */

index a140c54e4d72..4267c69ec37c 100644
@@ -1825,6 +1825,7 @@ static int run_printf(int min, int max)
 		CASE_TEST(string);       EXPECT_VFPRINTF(1, "foo", "%s", "foo"); break;
 		CASE_TEST(number);       EXPECT_VFPRINTF(1, "1234", "%d", 1234); break;
 		CASE_TEST(negnumber);    EXPECT_VFPRINTF(1, "-1234", "%d", -1234); break;
+		CASE_TEST(num_sign);     EXPECT_VFPRINTF(1, "| 1|+2|+3|+4|5|", "|% d|%+d|% +d|%+ d|%#d|", 1, 2, 3, 4, 5); break;
 		CASE_TEST(unsigned);     EXPECT_VFPRINTF(1, "12345", "%u", 12345); break;
 		CASE_TEST(signed_max);   EXPECT_VFPRINTF(1, "2147483647", "%i", ~0u >> 1); break;
 		CASE_TEST(signed_min);   EXPECT_VFPRINTF(1, "-2147483648", "%i", (~0u >> 1) + 1); break;

@@ -1832,7 +1833,9 @@ static int run_printf(int min, int max)
 		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
 		CASE_TEST(hex_nolibc);   EXPECT_VFPRINTF(is_nolibc, "|f|d|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(hex_libc);     EXPECT_VFPRINTF(!is_nolibc, "|f|D|", "|%x|%X|", 0xf, 0xd); break;
+		CASE_TEST(hex_alt);      EXPECT_VFPRINTF(1, "|0x1|  0x2|    0|", "|%#x|%#5x|%#5x|", 1, 2, 0); break;
 		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
+		CASE_TEST(pointer_NULL); EXPECT_VFPRINTF(1, "(nil)", "%p", (void *)0); break;
 		CASE_TEST(percent);      EXPECT_VFPRINTF(1, "a%d42%69%", "a%%d%d%%%d%%", 42, 69); break;
 		CASE_TEST(perc_qual);    EXPECT_VFPRINTF(1, "a%d2", "a%-14l%d%d", 2); break;
 		CASE_TEST(invalid);      EXPECT_VFPRINTF(1, "a%12yx3%y42%P", "a%12yx%d%y%d%P", 3, 42); break;

index ef8e7069d5cf..695676b44151 100644
@@ -544,7 +544,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		/* Stop gcc back-merging this code into one of the conditionals above. */
 		_NOLIBC_OPTIMIZER_HIDE_VAR(len);
 
+		/* Output the characters on the required side of any padding. */
 		width -= len;
+		flags = _NOLIBC_PF_FLAGS_CONTAIN(flags, '-');
+		if (flags && cb(state, outstr, len) != 0)
+			return -1;
 		while (width > 0) {
 			/* Output pad in 16 byte blocks with the small block first. */
 			int pad_len = ((width - 1) & 15) + 1;

@@ -553,7 +557,7 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			if (cb(state, "                ", pad_len) != 0)
 				return -1;
 		}
-		if (cb(state, outstr, len) != 0)
+		if (!flags && cb(state, outstr, len) != 0)
 			return -1;
 	}
 

index 4267c69ec37c..89ded1dd7318 100644
@@ -1845,9 +1845,11 @@ static int run_printf(int min, int max)
 		CASE_TEST(truncation);   EXPECT_VFPRINTF(1, "0123456789012345678901234", "%s", "0123456789012345678901234"); break;
 		CASE_TEST(string_width); EXPECT_VFPRINTF(1, "         1", "%10s", "1"); break;
 		CASE_TEST(number_width); EXPECT_VFPRINTF(1, "         1", "%10d", 1); break;
+		CASE_TEST(number_left);  EXPECT_VFPRINTF(1, "|-5      |", "|%-8d|", -5); break;
+		CASE_TEST(string_align); EXPECT_VFPRINTF(1, "|foo     |", "|%-8s|", "foo"); break;
 		CASE_TEST(width_trunc);  EXPECT_VFPRINTF(1, "                        1", "%25d", 1); break;
 		CASE_TEST(errno);        errno = 22; EXPECT_VFPRINTF(is_nolibc, "errno=22", "%m"); break;
-		CASE_TEST(errno-neg);    errno = -22; EXPECT_VFPRINTF(is_nolibc, "   errno=-22", "%12m"); break;
+		CASE_TEST(errno-neg);    errno = -22; EXPECT_VFPRINTF(is_nolibc, "errno=-22   ", "%-12m"); break;
 		CASE_TEST(scanf);        EXPECT_ZR(1, test_scanf()); break;
 		CASE_TEST(printf_error); EXPECT_ZR(1, test_printf_error()); break;
 		case __LINE__:

index 695676b44151..08011345275a 100644
@@ -292,12 +292,10 @@ int fseek(FILE *stream, long offset, int whence)
 
 
 /* printf(). Supports most of the normal integer and string formats.
- *  - %[#-+ 0][width][{l,t,z,ll,L,j,q}]{c,d,i,u,x,X,p,s,m,%}
+ *  - %[#0-+ ][width|*[.precision|*}][{l,t,z,ll,L,j,q}]{c,d,i,u,x,X,p,s,m,%}
  *  - %% generates a single %
  *  - %m outputs strerror(errno).
  *  - %X outputs a..f the same as %x.
- *  - The modifiers [-0] are currently ignored.
- *  - No support for precision or variable widths.
  *  - No support for floating point or wide characters.
  *  - Invalid formats are copied to the output buffer.
  *

@@ -343,9 +341,9 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 	char ch;
 	unsigned long long v;
 	long long signed_v;
-	int written, width, len;
+	int written, width, precision, len;
 	unsigned int flags, ch_flag;
-	char outbuf[2 + 22 + 1];
+	char outbuf[2 + 31 + 22 + 1];
 	char *out;
 	const char *outstr;
 	unsigned int sign_prefix;

@@ -378,12 +376,24 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			flags |= ch_flag;
 		}
 
-		/* width */
-		while (ch >= '0' && ch <= '9') {
-			width *= 10;
-			width += ch - '0';
-
-			ch = *fmt++;
+		/* Width and precision */
+		for (;; ch = *fmt++) {
+			if (ch == '*') {
+				precision = va_arg(args, unsigned int);
+				ch = *fmt++;
+			} else {
+				for (precision = 0; ch >= '0' && ch <= '9'; ch = *fmt++)
+					precision = precision * 10 + (ch - '0');
+			}
+			if (_NOLIBC_PF_FLAGS_CONTAIN(flags, '.'))
+				break;
+			width = precision;
+			if (ch != '.') {
+				/* Default precision for strings */
+				precision = INT_MAX;
+				break;
+			}
+			flags |= _NOLIBC_PF_FLAG('.');
 		}
 
 		/* Length modifier.

@@ -446,6 +456,9 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				outstr = (const char  *)(uintptr_t)v;
 				if (!outstr) {
 					outstr = "(null)";
+					/* Match glibc, nothing output if precision too small */
+					len = precision >= 6 ? 6 : 0;
+					goto do_output;
 				}
 				goto do_strlen_output;
 			}

@@ -467,11 +480,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 			}
 
 			/* The value is converted offset into the buffer so that
-			 * the sign/prefix can be added in front.
+			 * 31 zero pad characters and the sign/prefix can be added in front.
 			 * The longest digit string is 22 + 1 for octal conversions, the
 			 * space is reserved even though octal isn't currently supported.
 			 */
-			out = outbuf + 2;
+			out = outbuf + 2 + 31;
 
 			if (v == 0) {
 				/* There are special rules for zero. */

@@ -481,6 +494,11 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 					len = 5;
 					goto do_output;
 				}
+				if (!precision) {
+					/* Explicit %nn.0d, no digits output */
+					len = 0;
+					goto prepend_sign;
+				}
 				/* All other formats (including "%#x") just output "0". */
 				out[0] = '0';
 				len = 1;

@@ -499,6 +517,35 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 				}
 			}
 
+			/* Add zero padding */
+			if (_NOLIBC_PF_FLAGS_CONTAIN(flags, '0', '.')) {
+				if (!_NOLIBC_PF_FLAGS_CONTAIN(flags, '.')) {
+					if (_NOLIBC_PF_FLAGS_CONTAIN(flags, '-'))
+						/* Left justify overrides zero pad */
+						goto prepend_sign;
+					/* eg "%05d", Zero pad to field width less sign.
+					 * Note that precision can end up negative so all
+					 * the variables have to be 'signed int'.
+					 */
+					precision = width;
+					if (sign_prefix) {
+						precision--;
+						if (sign_prefix >= 256)
+							precision--;
+					}
+				}
+				if (precision > 31)
+					/* Don't run off the start of outbuf[], arbitrary limit
+					 * longer than the longest number field. */
+					precision = 31;
+				for (; len < precision; len++) {
+					/* Stop gcc generating horrid code and memset(). */
+					_NOLIBC_OPTIMIZER_HIDE_VAR(len);
+					*--out = '0';
+				}
+			}
+
+prepend_sign:
 			/* Add the 0, 1 or 2 ("0x") sign/prefix characters at the front. */
 			for (; sign_prefix; sign_prefix >>= 8) {
 				/* Force gcc to increment len inside the loop. */

@@ -533,8 +580,8 @@ int __nolibc_printf(__nolibc_printf_cb cb, void *state, const char *fmt, va_list
 		goto do_output;
 
 do_strlen_output:
-		/* Open coded strlen() (slightly smaller). */
-		for (len = 0;; len++)
+		/* Open coded strnlen() (slightly smaller). */
+		for (len = 0; len < precision; len++)
 			if (!outstr[len])
 				break;
 

index 89ded1dd7318..7398827fa08b 100644
@@ -1830,12 +1830,15 @@ static int run_printf(int min, int max)
 		CASE_TEST(signed_max);   EXPECT_VFPRINTF(1, "2147483647", "%i", ~0u >> 1); break;
 		CASE_TEST(signed_min);   EXPECT_VFPRINTF(1, "-2147483648", "%i", (~0u >> 1) + 1); break;
 		CASE_TEST(unsigned_max); EXPECT_VFPRINTF(1, "4294967295", "%u", ~0u); break;
-		CASE_TEST(char);         EXPECT_VFPRINTF(1, "c", "%c", 'c'); break;
+		CASE_TEST(char);         EXPECT_VFPRINTF(1, "|c|d|   e|", "|%c|%.0c|%4c|", 'c', 'd', 'e'); break;
 		CASE_TEST(hex_nolibc);   EXPECT_VFPRINTF(is_nolibc, "|f|d|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(hex_libc);     EXPECT_VFPRINTF(!is_nolibc, "|f|D|", "|%x|%X|", 0xf, 0xd); break;
 		CASE_TEST(hex_alt);      EXPECT_VFPRINTF(1, "|0x1|  0x2|    0|", "|%#x|%#5x|%#5x|", 1, 2, 0); break;
+		CASE_TEST(hex_alt_prec); EXPECT_VFPRINTF(1, "| 0x02|0x03| 0x123|", "|%#5.2x|%#04x|%#6.2x|", 2, 3, 0x123); break;
+		CASE_TEST(hex_0_alt);    EXPECT_VFPRINTF(1, "|0|0000|   00|", "|%#x|%#04x|%#5.2x|", 0, 0, 0); break;
 		CASE_TEST(pointer);      EXPECT_VFPRINTF(1, "0x1", "%p", (void *) 0x1); break;
-		CASE_TEST(pointer_NULL); EXPECT_VFPRINTF(1, "(nil)", "%p", (void *)0); break;
+		CASE_TEST(pointer_NULL); EXPECT_VFPRINTF(1, "|(nil)|(nil)|", "|%p|%.4p|", (void *)0, (void *)0); break;
+		CASE_TEST(string_NULL);  EXPECT_VFPRINTF(1, "|(null)||(null)|", "|%s|%.5s|%.6s|", (void *)0, (void *)0, (void *)0); break;
 		CASE_TEST(percent);      EXPECT_VFPRINTF(1, "a%d42%69%", "a%%d%d%%%d%%", 42, 69); break;
 		CASE_TEST(perc_qual);    EXPECT_VFPRINTF(1, "a%d2", "a%-14l%d%d", 2); break;
 		CASE_TEST(invalid);      EXPECT_VFPRINTF(1, "a%12yx3%y42%P", "a%12yx%d%y%d%P", 3, 42); break;