diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index ea1e4ebf57..0ca4d739f3 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=196
+PKG_RELEASE:=209
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
@@ -43,6 +43,15 @@ define Package/base-files
   VERSION:=$(PKG_RELEASE)-$(REVISION)
 endef
 
+define Package/urandom-seed
+  SECTION:=base
+  CATEGORY:=Base system
+  DEPENDS:=+libc +ubox-getrandom
+  TITLE:=/etc/urandom.seed handling for OpenWrt
+  URL:=http://openwrt.org/
+  VERSION:=$(PKG_RELEASE)-$(REVISION)
+endef
+
 define Package/base-files/conffiles
 /etc/config/
 /etc/config/network
@@ -189,12 +198,14 @@ define Package/base-files/install
 
 	$(if $(CONFIG_INCLUDE_CONFIG), \
 		echo -e "# Build configuration for board $(BOARD)/$(SUBTARGET)/$(PROFILE)\n" >$(1)/etc/build.config; \
-		cat $(BIN_DIR)/config.seed >>$(1)/etc/build.config)
+		cat $(BIN_DIR)/config.buildinfo >>$(1)/etc/build.config)
 
 	$(if $(CONFIG_CLEAN_IPKG),, \
 		mkdir -p $(1)/etc/opkg; \
 		$(call FeedSourcesAppend,$(1)/etc/opkg/distfeeds.conf); \
 		$(VERSION_SED_SCRIPT) $(1)/etc/opkg/distfeeds.conf)
+	$(if $(CONFIG_IPK_FILES_CHECKSUMS), \
+		rm -f $(1)/sbin/pkg_check,)
 endef
 
 ifneq ($(DUMP),1)
diff --git a/package/base-files/files/bin/config_generate b/package/base-files/files/bin/config_generate
index df221cc26c..3ca035ca8b 100755
--- a/package/base-files/files/bin/config_generate
+++ b/package/base-files/files/bin/config_generate
@@ -213,7 +213,8 @@ generate_switch() {
 
 	json_select switch
 	json_select "$key"
-	json_get_vars enable reset blinkrate cpu_port
+	json_get_vars enable reset blinkrate cpu_port \
+		ar8xxx_mib_type ar8xxx_mib_poll_interval
 
 	uci -q batch <<-EOF
 		add network switch
@@ -221,6 +222,8 @@ generate_switch() {
 		set network.@switch[-1].reset='$reset'
 		set network.@switch[-1].enable_vlan='$enable'
 		set network.@switch[-1].blinkrate='$blinkrate'
+		set network.@switch[-1].ar8xxx_mib_type='$ar8xxx_mib_type'
+		set network.@switch[-1].ar8xxx_mib_poll_interval='$ar8xxx_mib_poll_interval'
 	EOF
 
 	generate_switch_vlans_ports "$1"
diff --git a/package/base-files/files/etc/diag.sh b/package/base-files/files/etc/diag.sh
old mode 100755
new mode 100644
diff --git a/package/base-files/files/etc/group b/package/base-files/files/etc/group
index e8e2adf4ac..5b06dc6db9 100644
--- a/package/base-files/files/etc/group
+++ b/package/base-files/files/etc/group
@@ -1,8 +1,8 @@
 root:x:0:
 daemon:x:1:
 adm:x:4:
-tty:x:5:
 mail:x:8:
+dialout:x:20:
 audio:x:29:
 www-data:x:33:
 ftp:x:55:
diff --git a/package/base-files/files/etc/hotplug.d/net/00-sysctl b/package/base-files/files/etc/hotplug.d/net/00-sysctl
old mode 100755
new mode 100644
diff --git a/package/base-files/files/etc/init.d/boot b/package/base-files/files/etc/init.d/boot
index 31f245ffc7..09b7f44c79 100755
--- a/package/base-files/files/etc/init.d/boot
+++ b/package/base-files/files/etc/init.d/boot
@@ -2,7 +2,7 @@
 # Copyright (C) 2006-2011 OpenWrt.org
 
 START=10
-STOP=98
+STOP=90
 
 uci_apply_defaults() {
 	. /lib/functions/system.sh
diff --git a/package/base-files/files/etc/init.d/system b/package/base-files/files/etc/init.d/system
index 531aa8cbc5..0e33c522b4 100755
--- a/package/base-files/files/etc/init.d/system
+++ b/package/base-files/files/etc/init.d/system
@@ -6,7 +6,7 @@ USE_PROCD=1
 
 validate_system_section()
 {
-	uci_validate_section system system "${1}" \
+	uci_load_validate system system "$1" "$2" \
 		'hostname:string:OpenWrt' \
 		'conloglevel:uinteger' \
 		'buffersize:uinteger' \
@@ -15,11 +15,7 @@ validate_system_section()
 }
 
 system_config() {
-	local cfg="$1"
-
-	local hostname conloglevel buffersize timezone zonename
-
-	validate_system_section "${1}" || {
+	[ "$2" = 0 ] || {
 		echo "validation failed"
 		return 1
 	}
@@ -31,12 +27,12 @@ system_config() {
 		ln -sf "/usr/share/zoneinfo/$zonename" /tmp/localtime && rm -f /tmp/TZ
 
 	# apply timezone to kernel
-	date -k
+	busybox date -k
 }
 
 reload_service() {
 	config_load system
-	config_foreach system_config system
+	config_foreach validate_system_section system system_config
 }
 
 service_triggers()
diff --git a/package/base-files/files/etc/init.d/umount b/package/base-files/files/etc/init.d/umount
index 349b2b3264..b764ae1582 100755
--- a/package/base-files/files/etc/init.d/umount
+++ b/package/base-files/files/etc/init.d/umount
@@ -1,7 +1,12 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2006 OpenWrt.org
 
-STOP=99
+STOP=90
+
+restart() {
+	:
+}
+
 stop() {
 	sync
 	/bin/umount -a -d -r
diff --git a/package/base-files/files/etc/init.d/urandom_seed b/package/base-files/files/etc/init.d/urandom_seed
deleted file mode 100755
index 17d9c13400..0000000000
--- a/package/base-files/files/etc/init.d/urandom_seed
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh /etc/rc.common
-
-START=99
-USE_PROCD=1
-
-start_service() {
-    procd_open_instance "urandom_seed"
-    procd_set_param command "/sbin/urandom_seed"
-    procd_set_param stdout 1
-    procd_set_param stderr 1
-    procd_close_instance
-}
diff --git a/package/base-files/files/etc/profile b/package/base-files/files/etc/profile
old mode 100755
new mode 100644
diff --git a/package/base-files/files/etc/rc.button/reboot b/package/base-files/files/etc/rc.button/reboot
new file mode 100755
index 0000000000..cd547e3329
--- /dev/null
+++ b/package/base-files/files/etc/rc.button/reboot
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+[ "${ACTION}" = "released" ] || exit 0
+
+if [ "$SEEN" -ge 5 ]
+then
+	echo "REBOOT" > /dev/console
+	sync
+	reboot
+fi
+
+return 0
diff --git a/package/base-files/files/etc/rc.common b/package/base-files/files/etc/rc.common
index d9773a0c5a..dbe26ec3bd 100755
--- a/package/base-files/files/etc/rc.common
+++ b/package/base-files/files/etc/rc.common
@@ -95,7 +95,9 @@ service_data() {
 }
 
 service_running() {
-	return 0
+	local service="${1:-$(basename $initscript)}"
+	local instance="${2:-*}"
+	procd_running "$service" "$instance" "$@"
 }
 
 ${INIT_TRACE:+set -x}
@@ -103,7 +105,11 @@ ${INIT_TRACE:+set -x}
 . "$initscript"
 
 [ -n "$USE_PROCD" ] && {
-	EXTRA_COMMANDS="${EXTRA_COMMANDS} running trace"
+	EXTRA_COMMANDS="${EXTRA_COMMANDS} running status trace"
+	EXTRA_HELP="\
+	running	Check if service is running
+	status	Service status
+${EXTRA_HELP}"
 
 	. $IPKG_INSTROOT/lib/functions/procd.sh
 	basescript=$(readlink "$initscript")
@@ -131,6 +137,9 @@ ${INIT_TRACE:+set -x}
 		procd_lock
 		stop_service "$@"
 		procd_kill "$(basename ${basescript:-$initscript})" "$1"
+		if eval "type service_stopped" 2>/dev/null >/dev/null; then
+			service_stopped
+		fi
 	}
 
 	reload() {
@@ -145,6 +154,14 @@ ${INIT_TRACE:+set -x}
 	running() {
 		service_running "$@"
 	}
+
+	status() {
+		if eval "type status_service" 2>/dev/null >/dev/null; then
+			status_service "$@"
+		else
+			_procd_status "$(basename ${basescript:-$initscript})" "$1"
+		fi
+	}
 }
 
 ALL_COMMANDS="start stop reload restart boot shutdown enable disable enabled depends ${EXTRA_COMMANDS}"
diff --git a/package/base-files/files/etc/rc.local b/package/base-files/files/etc/rc.local
old mode 100755
new mode 100644
diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf
index 46d079b36b..bc8c579695 100644
--- a/package/base-files/files/etc/sysctl.d/10-default.conf
+++ b/package/base-files/files/etc/sysctl.d/10-default.conf
@@ -8,6 +8,8 @@ fs.suid_dumpable=2
 fs.protected_hardlinks=1
 fs.protected_symlinks=1
 
+net.core.bpf_jit_enable=1
+
 net.ipv4.conf.default.arp_ignore=1
 net.ipv4.conf.all.arp_ignore=1
 net.ipv4.ip_forward=1
diff --git a/package/base-files/files/etc/uci-defaults/10_migrate-shadow b/package/base-files/files/etc/uci-defaults/10_migrate-shadow
old mode 100755
new mode 100644
index a354844fe4..481444f35e
--- a/package/base-files/files/etc/uci-defaults/10_migrate-shadow
+++ b/package/base-files/files/etc/uci-defaults/10_migrate-shadow
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 ppwd="$(sed -ne '/^root:/s/^root:\([^:]*\):.*$/\1/p' /etc/passwd)"
 spwd="$(sed -ne '/^root:/s/^root:\([^:]*\):.*$/\1/p' /etc/shadow)"
 
diff --git a/package/base-files/files/etc/uci-defaults/12_network-generate-ula b/package/base-files/files/etc/uci-defaults/12_network-generate-ula
old mode 100755
new mode 100644
index 8871427c60..19d7ed7f2e
--- a/package/base-files/files/etc/uci-defaults/12_network-generate-ula
+++ b/package/base-files/files/etc/uci-defaults/12_network-generate-ula
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 [ "$(uci -q get network.globals.ula_prefix)" != "auto" ] && exit 0
 
 r1=$(dd if=/dev/urandom bs=1 count=1 |hexdump -e '1/1 "%02x"')
diff --git a/package/base-files/files/etc/uci-defaults/13_fix_group_user b/package/base-files/files/etc/uci-defaults/13_fix-group-user
old mode 100755
new mode 100644
similarity index 94%
rename from package/base-files/files/etc/uci-defaults/13_fix_group_user
rename to package/base-files/files/etc/uci-defaults/13_fix-group-user
index e6dae2419f..bf9febdfe4
--- a/package/base-files/files/etc/uci-defaults/13_fix_group_user
+++ b/package/base-files/files/etc/uci-defaults/13_fix-group-user
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 . /lib/functions.sh
 
 for file in `grep -sl Require-User /usr/lib/opkg/info/*.control`; do
diff --git a/package/base-files/files/lib/functions.sh b/package/base-files/files/lib/functions.sh
index 50a7b40869..81176431d1 100755
--- a/package/base-files/files/lib/functions.sh
+++ b/package/base-files/files/lib/functions.sh
@@ -17,6 +17,22 @@ NO_EXPORT=1
 LOAD_STATE=1
 LIST_SEP=" "
 
+# xor multiple hex values of the same length
+xor() {
+	local val
+	local ret="0x$1"
+	local retlen=${#1}
+
+	shift
+	while [ -n "$1" ]; do
+		val="0x$1"
+		ret=$((ret ^ val))
+		shift
+	done
+
+	printf "%0${retlen}x" "$ret"
+}
+
 append() {
 	local var="$1"
 	local value="$2"
@@ -92,7 +108,7 @@ config_unset() {
 # config_get <section> <option>
 config_get() {
 	case "$3" in
-		"") eval echo "\${CONFIG_${1}_${2}:-\${4}}";;
+		"") eval echo "\"\${CONFIG_${1}_${2}:-\${4}}\"";;
 		*)  eval export ${NO_EXPORT:+-n} -- "${1}=\${CONFIG_${2}_${3}:-\${4}}";;
 	esac
 }
@@ -213,6 +229,7 @@ add_group_and_user() {
 default_postinst() {
 	local root="${IPKG_INSTROOT}"
 	local pkgname="$(basename ${1%.*})"
+	local filelist="/usr/lib/opkg/info/${pkgname}.list"
 	local ret=0
 
 	add_group_and_user "${pkgname}"
@@ -227,23 +244,29 @@ default_postinst() {
 		rm -fR $root/rootfs-overlay/
 	fi
 
-	if [ -z "$root" ] && grep -q -s "^/etc/modules.d/" "/usr/lib/opkg/info/${pkgname}.list"; then
-		kmodloader
-	fi
+	if [ -z "$root" ]; then
+		if grep -m1 -q -s "^/etc/modules.d/" "$filelist"; then
+			kmodloader
+		fi
 
-	if [ -z "$root" ] && grep -q -s "^/etc/uci-defaults/" "/usr/lib/opkg/info/${pkgname}.list"; then
-		. /lib/functions/system.sh
-		[ -d /tmp/.uci ] || mkdir -p /tmp/.uci
-		for i in $(grep -s "^/etc/uci-defaults/" "/usr/lib/opkg/info/${pkgname}.list"); do
-			( [ -f "$i" ] && cd "$(dirname $i)" && . "$i" ) && rm -f "$i"
-		done
-		uci commit
-	fi
+		if grep -m1 -q -s "^/etc/sysctl.d/" "$filelist"; then
+			/etc/init.d/sysctl restart
+		fi
 
-	[ -n "$root" ] || rm -f /tmp/luci-indexcache 2>/dev/null
+		if grep -m1 -q -s "^/etc/uci-defaults/" "$filelist"; then
+			. /lib/functions/system.sh
+			[ -d /tmp/.uci ] || mkdir -p /tmp/.uci
+			for i in $(grep -s "^/etc/uci-defaults/" "$filelist"); do
+				( [ -f "$i" ] && cd "$(dirname $i)" && . "$i" ) && rm -f "$i"
+			done
+			uci commit
+		fi
+
+		rm -f /tmp/luci-indexcache
+	fi
 
 	local shell="$(which bash)"
-	for i in $(grep -s "^/etc/init.d/" "$root/usr/lib/opkg/info/${pkgname}.list"); do
+	for i in $(grep -s "^/etc/init.d/" "$root$filelist"); do
 		if [ -n "$root" ]; then
 			${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" enable
 		else
diff --git a/package/base-files/files/lib/functions/caldata.sh b/package/base-files/files/lib/functions/caldata.sh
new file mode 100644
index 0000000000..1ff69ce1ae
--- /dev/null
+++ b/package/base-files/files/lib/functions/caldata.sh
@@ -0,0 +1,128 @@
+# Copyright (C) 2019 OpenWrt.org
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+
+caldata_die() {
+	echo "caldata: " "$*"
+	exit 1
+}
+
+caldata_extract() {
+	local part=$1
+	local offset=$(($2))
+	local count=$(($3))
+	local mtd
+
+	mtd=$(find_mtd_chardev $part)
+	[ -n "$mtd" ] || caldata_die "no mtd device found for partition $part"
+
+	dd if=$mtd of=/lib/firmware/$FIRMWARE iflag=skip_bytes bs=$count skip=$offset count=1 2>/dev/null || \
+		caldata_die "failed to extract calibration data from $mtd"
+}
+
+caldata_extract_ubi() {
+	local part=$1
+	local offset=$(($2))
+	local count=$(($3))
+	local ubidev
+	local ubi
+
+	. /lib/upgrade/nand.sh
+
+	ubidev=$(nand_find_ubi $CI_UBIPART)
+	ubi=$(nand_find_volume $ubidev $part)
+	[ -n "$ubi" ] || caldata_die "no UBI volume found for $part"
+
+	dd if=/dev/$ubi of=/lib/firmware/$FIRMWARE iflag=skip_bytes bs=$count skip=$offset count=1 2>/dev/null || \
+		caldata_die "failed to extract calibration data from $ubi"
+}
+
+caldata_extract_reverse() {
+	local part=$1
+	local offset=$2
+	local count=$(($3))
+	local mtd
+	local reversed
+	local caldata
+
+	mtd=$(find_mtd_chardev "$part")
+	reversed=$(hexdump -v -s $offset -n $count -e '/1 "%02x "' $mtd)
+
+	for byte in $reversed; do
+		caldata="\x${byte}${caldata}"
+	done
+
+	printf "%b" "$caldata" > /lib/firmware/$FIRMWARE
+}
+
+caldata_from_file() {
+	local source=$1
+	local offset=$(($2))
+	local count=$(($3))
+
+	dd if=$source of=/lib/firmware/$FIRMWARE iflag=skip_bytes bs=$count skip=$offset count=1 2>/dev/null || \
+		caldata_die "failed to extract calibration data from $source"
+}
+
+caldata_valid() {
+	local expected="$1"
+
+	magic=$(hexdump -v -n 2 -e '1/1 "%02x"' /lib/firmware/$FIRMWARE)
+	[[ "$magic" == "$expected" ]]
+	return $?
+}
+
+caldata_patch_chksum() {
+	local mac=$1
+	local mac_offset=$(($2))
+	local chksum_offset=$(($3))
+	local xor_mac
+	local xor_fw_mac
+	local xor_fw_chksum
+
+	xor_mac=${mac//:/}
+	xor_mac="${xor_mac:0:4} ${xor_mac:4:4} ${xor_mac:8:4}"
+
+	xor_fw_mac=$(hexdump -v -n 6 -s $mac_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
+	xor_fw_mac="${xor_fw_mac:0:4} ${xor_fw_mac:4:4} ${xor_fw_mac:8:4}"
+
+	xor_fw_chksum=$(hexdump -v -n 2 -s $chksum_offset -e '/1 "%02x"' /lib/firmware/$FIRMWARE)
+	xor_fw_chksum=$(xor $xor_fw_chksum $xor_fw_mac $xor_mac)
+
+	printf "%b" "\x${xor_fw_chksum:0:2}\x${xor_fw_chksum:2:2}" | \
+		dd of=/lib/firmware/$FIRMWARE conv=notrunc bs=1 seek=$chksum_offset count=2
+}
+
+caldata_patch_mac() {
+	local mac=$1
+	local mac_offset=$(($2))
+	local chksum_offset=$3
+
+	[ -z "$mac" -o -z "$mac_offset" ] && return
+
+	[ -n "$chksum_offset" ] && caldata_patch_chksum "$mac" "$mac_offset" "$chksum_offset"
+
+	macaddr_2bin $mac | dd of=/lib/firmware/$FIRMWARE conv=notrunc oflag=seek_bytes bs=6 seek=$mac_offset count=1 || \
+		caldata_die "failed to write MAC address to eeprom file"
+}
+
+ath9k_patch_mac() {
+	local mac=$1
+
+	caldata_patch_mac "$mac" 0x2
+}
+
+ath9k_patch_mac_crc() {
+	local mac=$1
+	local mac_offset=$2
+	local chksum_offset=$((mac_offset - 10))
+
+	caldata_patch_mac "$mac" "$mac_offset" "$chksum_offset"
+}
+
+ath10k_patch_mac() {
+	local mac=$1
+
+	caldata_patch_mac "$mac" 0x6 0x2
+}
diff --git a/package/base-files/files/lib/functions/leds.sh b/package/base-files/files/lib/functions/leds.sh
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/functions/migrations.sh b/package/base-files/files/lib/functions/migrations.sh
new file mode 100644
index 0000000000..b180a0242f
--- /dev/null
+++ b/package/base-files/files/lib/functions/migrations.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+migrate_led_sysfs() {
+	local cfg="$1"; shift
+	local tuples="$@"
+	local sysfs
+	local name
+
+	config_get sysfs ${cfg} sysfs
+	config_get name ${cfg} name
+
+	[ -z "${sysfs}" ] && return
+
+	for tuple in ${tuples}; do
+		local old=${tuple%=*}
+		local new=${tuple#*=}
+		local new_sysfs
+
+		new_sysfs=$(echo ${sysfs} | sed "s/${old}/${new}/")
+
+		[ "${new_sysfs}" = "${sysfs}" ] && continue
+
+		uci set system.${cfg}.sysfs="${new_sysfs}"
+
+		logger -t led-migration "sysfs option of LED \"${name}\" updated to ${new_sysfs}"
+	done;
+}
+
+migrate_leds() {
+	config_load system
+	config_foreach migrate_led_sysfs led "$@"
+}
+
+migrations_apply() {
+	local realm="$1"
+	[ -n "$(uci changes ${realm})" ] && uci -q commit ${realm}
+}
diff --git a/package/base-files/files/lib/functions/network.sh b/package/base-files/files/lib/functions/network.sh
old mode 100755
new mode 100644
index 4fdcb66302..6b946b9f80
--- a/package/base-files/files/lib/functions/network.sh
+++ b/package/base-files/files/lib/functions/network.sh
@@ -271,6 +271,11 @@ network_is_up()
 # 2: interface
 network_get_protocol() { __network_ifstatus "$1" "$2" ".proto"; }
 
+# determine the uptime of the given logical interface
+# 1: destination variable
+# 2: interface
+network_get_uptime() { __network_ifstatus "$1" "$2" ".uptime"; }
+
 # determine the metric of the given logical interface
 # 1: destination variable
 # 2: interface
diff --git a/package/base-files/files/lib/functions/preinit.sh b/package/base-files/files/lib/functions/preinit.sh
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/functions/service.sh b/package/base-files/files/lib/functions/service.sh
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/functions/system.sh b/package/base-files/files/lib/functions/system.sh
old mode 100755
new mode 100644
index 7ed62804a0..c4dc3cc3a9
--- a/package/base-files/files/lib/functions/system.sh
+++ b/package/base-files/files/lib/functions/system.sh
@@ -1,10 +1,12 @@
 # Copyright (C) 2006-2013 OpenWrt.org
 
+. /usr/share/libubox/jshn.sh
+
 get_mac_binary() {
 	local path="$1"
 	local offset="$2"
 
-	if [ -z "$path" ]; then
+	if ! [ -e "$path" ]; then
 		echo "get_mac_binary: file $path not found!" >&2
 		return
 	fi
@@ -12,6 +14,44 @@ get_mac_binary() {
 	hexdump -v -n 6 -s $offset -e '5/1 "%02x:" 1/1 "%02x"' $path 2>/dev/null
 }
 
+get_mac_label_dt() {
+	local basepath="/proc/device-tree"
+	local macdevice="$(cat "$basepath/aliases/label-mac-device" 2>/dev/null)"
+	local macaddr
+
+	[ -n "$macdevice" ] || return
+
+	macaddr=$(get_mac_binary "$basepath/$macdevice/mac-address" 0 2>/dev/null)
+	[ -n "$macaddr" ] || macaddr=$(get_mac_binary "$basepath/$macdevice/local-mac-address" 0 2>/dev/null)
+
+	echo $macaddr
+}
+
+get_mac_label_json() {
+	local cfg="/etc/board.json"
+	local macaddr
+
+	[ -s "$cfg" ] || return
+
+	json_init
+	json_load "$(cat $cfg)"
+	if json_is_a system object; then
+		json_select system
+			json_get_var macaddr label_macaddr
+		json_select ..
+	fi
+
+	echo $macaddr
+}
+
+get_mac_label() {
+	local macaddr=$(get_mac_label_dt)
+
+	[ -n "$macaddr" ] || macaddr=$(get_mac_label_json)
+
+	echo $macaddr
+}
+
 find_mtd_chardev() {
 	local INDEX=$(find_mtd_index "$1")
 	local PREFIX=/dev/mtd
@@ -40,7 +80,7 @@ mtd_get_mac_ascii() {
 
 mtd_get_mac_text() {
 	local mtdname=$1
-	local offset=$2
+	local offset=$(($2))
 	local part
 	local mac_dirty
 
@@ -79,12 +119,7 @@ mtd_get_mac_binary_ubi() {
 	local ubidev=$(nand_find_ubi $CI_UBIPART)
 	local part=$(nand_find_volume $ubidev $1)
 
-	if [ -z "$part" ]; then
-		echo "mtd_get_mac_binary: ubi volume $mtdname not found!" >&2
-		return
-	fi
-
-	hexdump -v -n 6 -s $offset -e '5/1 "%02x:" 1/1 "%02x"' /dev/$part 2>/dev/null
+	get_mac_binary "/dev/$part" "$offset"
 }
 
 mtd_get_part_size() {
@@ -109,6 +144,13 @@ macaddr_add() {
 	echo $oui:$nic
 }
 
+macaddr_geteui() {
+	local mac=$1
+	local sep=$2
+
+	echo ${mac:9:2}$sep${mac:12:2}$sep${mac:15:2}
+}
+
 macaddr_setbit_la() {
 	local mac=$1
 
diff --git a/package/base-files/files/lib/functions/uci-defaults.sh b/package/base-files/files/lib/functions/uci-defaults.sh
index 315df7b708..0d2dcd5241 100755
--- a/package/base-files/files/lib/functions/uci-defaults.sh
+++ b/package/base-files/files/lib/functions/uci-defaults.sh
@@ -182,6 +182,19 @@ _ucidef_finish_switch_roles() {
 	done
 }
 
+ucidef_set_ar8xxx_switch_mib() {
+	local name="$1"
+	local type="$2"
+	local interval="$3"
+
+	json_select_object switch
+		json_select_object "$name"
+			json_add_int ar8xxx_mib_type $type
+			json_add_int ar8xxx_mib_poll_interval $interval
+		json_select ..
+	json_select ..
+}
+
 ucidef_add_switch() {
 	local name="$1"; shift
 	local port num role device index need_tag prev_role
@@ -294,6 +307,14 @@ ucidef_set_interface_macaddr() {
 	ucidef_set_interface "$network" macaddr "$macaddr"
 }
 
+ucidef_set_label_macaddr() {
+	local macaddr="$1"
+
+	json_select_object system
+		json_add_string label_macaddr "$macaddr"
+	json_select ..
+}
+
 ucidef_add_atm_bridge() {
 	local vpi="$1"
 	local vci="$2"
@@ -463,6 +484,7 @@ _ucidef_set_led_timer() {
 
 	_ucidef_set_led_common "$1" "$2" "$3"
 
+	json_add_string type "$trigger_name"
 	json_add_string trigger "$trigger_name"
 	json_add_int delayon "$delayon"
 	json_add_int delayoff "$delayoff"
@@ -593,6 +615,5 @@ board_config_update() {
 }
 
 board_config_flush() {
-	json_dump -i > /tmp/.board.json
-	mv /tmp/.board.json ${CFG}
+	json_dump -i -o ${CFG}
 }
diff --git a/package/base-files/files/lib/preinit/02_default_set_state b/package/base-files/files/lib/preinit/02_default_set_state
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/02_sysinfo b/package/base-files/files/lib/preinit/02_sysinfo
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/10_indicate_failsafe b/package/base-files/files/lib/preinit/10_indicate_failsafe
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/10_indicate_preinit b/package/base-files/files/lib/preinit/10_indicate_preinit
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/30_failsafe_wait b/package/base-files/files/lib/preinit/30_failsafe_wait
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/40_run_failsafe_hook b/package/base-files/files/lib/preinit/40_run_failsafe_hook
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/50_indicate_regular_preinit b/package/base-files/files/lib/preinit/50_indicate_regular_preinit
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/70_initramfs_test b/package/base-files/files/lib/preinit/70_initramfs_test
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/80_mount_root b/package/base-files/files/lib/preinit/80_mount_root
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/81_urandom_seed b/package/base-files/files/lib/preinit/81_urandom_seed
deleted file mode 100755
index 26212c60b5..0000000000
--- a/package/base-files/files/lib/preinit/81_urandom_seed
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh
-
-log_urandom_seed() {
-    echo "urandom-seed: $1" > /dev/kmsg
-}
-
-_do_urandom_seed() {
-    [ -f "$1" ] || { log_urandom_seed "Seed file not found ($1)"; return; }
-    [ -O "$1" -a -G "$1" -a ! -x "$1" ] || { log_urandom_seed "Wrong owner / permissions for $1"; return; }
-
-    log_urandom_seed "Seeding with $1"
-    cat "$1" > /dev/urandom
-}
-
-do_urandom_seed() {
-    [ -c /dev/urandom ] || { log_urandom_seed "Something is wrong with /dev/urandom"; return; }
-
-    _do_urandom_seed "/etc/urandom.seed"
-
-    SEED="$(uci -q get system.@system[0].urandom_seed)"
-    [ "${SEED:0:1}" = "/" -a "$SEED" != "/etc/urandom.seed" ] && _do_urandom_seed "$SEED"
-}
-
-boot_hook_add preinit_main do_urandom_seed
diff --git a/package/base-files/files/lib/preinit/99_10_failsafe_login b/package/base-files/files/lib/preinit/99_10_failsafe_login
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/preinit/99_10_run_init b/package/base-files/files/lib/preinit/99_10_run_init
old mode 100755
new mode 100644
diff --git a/package/base-files/files/lib/upgrade/common.sh b/package/base-files/files/lib/upgrade/common.sh
old mode 100755
new mode 100644
index f43c7db3c1..a986cc0b5c
--- a/package/base-files/files/lib/upgrade/common.sh
+++ b/package/base-files/files/lib/upgrade/common.sh
@@ -2,6 +2,8 @@
 
 RAM_ROOT=/tmp/root
 
+export BACKUP_FILE=sysupgrade.tgz	# file extracted by preinit
+
 [ -x /usr/bin/ldd ] || ldd() { LD_TRACE_LOADED_OBJECTS=1 $*; }
 libs() { ldd $* 2>/dev/null | sed -r 's/(.* => )?(.*) .*/\2/'; }
 
@@ -101,53 +103,53 @@ get_magic_long() {
 }
 
 export_bootdevice() {
-	local cmdline uuid disk uevent line
+	local cmdline bootdisk rootpart uuid blockdev uevent line class
 	local MAJOR MINOR DEVNAME DEVTYPE
 
 	if read cmdline < /proc/cmdline; then
 		case "$cmdline" in
 			*block2mtd=*)
-				disk="${cmdline##*block2mtd=}"
-				disk="${disk%%,*}"
+				bootdisk="${cmdline##*block2mtd=}"
+				bootdisk="${bootdisk%%,*}"
 			;;
 			*root=*)
-				disk="${cmdline##*root=}"
-				disk="${disk%% *}"
+				rootpart="${cmdline##*root=}"
+				rootpart="${rootpart%% *}"
 			;;
 		esac
 
-		case "$disk" in
-			PARTUUID=[A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9]-[A-F0-9][A-F0-9][A-F0-9][A-F0-9]-[A-F0-9][A-F0-9][A-F0-9][A-F0-9]-[A-F0-9][A-F0-9][A-F0-9][A-F0-9]-[A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9][A-F0-9]0002)
-				uuid="${disk#PARTUUID=}"
-				uuid="${uuid%0002}0002"
-				for disk in $(find /dev -type b); do
-					set -- $(dd if=$disk bs=1 skip=$((2*512+256+128+16)) count=16 2>/dev/null | hexdump -v -e '4/1 "%02x"' | awk '{ \
-							for(i=1;i<9;i=i+2) first=substr($0,i,1) substr($0,i+1,1) first; \
-							for(i=9;i<13;i=i+2) second=substr($0,i,1) substr($0,i+1,1) second; \
-							for(i=13;i<16;i=i+2) third=substr($0,i,1) substr($0,i+1,1) third; \
-							fourth = substr($0,17,4); \
-							five = substr($0,21,12); \
-						} END { print toupper(first"-"second"-"third"-"fourth"-"five) }')
-					if [ "$1" = "$uuid" ]; then
-						uevent="/sys/class/block/${disk##*/}/uevent"
-						export SAVE_PARTITIONS=0
-						break
-					fi
-				done
+		case "$bootdisk" in
+			/dev/*)
+				uevent="/sys/class/block/${bootdisk##*/}/uevent"
 			;;
-			PARTUUID=[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-02)
-				uuid="${disk#PARTUUID=}"
-				uuid="${uuid%-02}"
-				for disk in $(find /dev -type b); do
-					set -- $(dd if=$disk bs=1 skip=440 count=4 2>/dev/null | hexdump -v -e '4/1 "%02x "')
+		esac
+
+		case "$rootpart" in
+			PARTUUID=[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]-[a-f0-9][a-f0-9])
+				uuid="${rootpart#PARTUUID=}"
+				uuid="${uuid%-[a-f0-9][a-f0-9]}"
+				for blockdev in $(find /dev -type b); do
+					set -- $(dd if=$blockdev bs=1 skip=440 count=4 2>/dev/null | hexdump -v -e '4/1 "%02x "')
 					if [ "$4$3$2$1" = "$uuid" ]; then
-						uevent="/sys/class/block/${disk##*/}/uevent"
+						uevent="/sys/class/block/${blockdev##*/}/uevent"
 						break
 					fi
 				done
 			;;
 			/dev/*)
-				uevent="/sys/class/block/${disk##*/}/uevent"
+				uevent="/sys/class/block/${rootpart##*/}/../uevent"
+			;;
+			0x[a-f0-9][a-f0-9][a-f0-9] | 0x[a-f0-9][a-f0-9][a-f0-9][a-f0-9] | \
+			[a-f0-9][a-f0-9][a-f0-9] | [a-f0-9][a-f0-9][a-f0-9][a-f0-9])
+				rootpart=0x${rootpart#0x}
+				for class in /sys/class/block/*; do
+					while read line; do
+						export -n "$line"
+					done < "$class/uevent"
+					if [ $((rootpart/256)) = $MAJOR -a $((rootpart%256)) = $MINOR ]; then
+						uevent="$class/../uevent"
+					fi
+				done
 			;;
 		esac
 
@@ -219,16 +221,6 @@ get_partitions() { # <device> <filename>
 	fi
 }
 
-jffs2_copy_config() {
-	if grep rootfs_data /proc/mtd >/dev/null; then
-		# squashfs+jffs2
-		mtd -e rootfs_data jffs2write "$CONF_TAR" rootfs_data
-	else
-		# jffs2
-		mtd jffs2write "$CONF_TAR" rootfs
-	fi
-}
-
 indicate_upgrade() {
 	. /etc/diag.sh
 	set_state upgrade
@@ -240,34 +232,10 @@ indicate_upgrade() {
 # $(2): (optional) pipe command to extract firmware, e.g. dd bs=n skip=m
 default_do_upgrade() {
 	sync
-	if [ "$SAVE_CONFIG" -eq 1 ]; then
-		get_image "$1" "$2" | mtd $MTD_CONFIG_ARGS -j "$CONF_TAR" write - "${PART_NAME:-image}"
+	if [ -n "$UPGRADE_BACKUP" ]; then
+		get_image "$1" "$2" | mtd $MTD_ARGS $MTD_CONFIG_ARGS -j "$UPGRADE_BACKUP" write - "${PART_NAME:-image}"
 	else
-		get_image "$1" "$2" | mtd write - "${PART_NAME:-image}"
+		get_image "$1" "$2" | mtd $MTD_ARGS write - "${PART_NAME:-image}"
 	fi
 	[ $? -ne 0 ] && exit 1
 }
-
-do_upgrade_stage2() {
-	v "Performing system upgrade..."
-	if [ -n "$do_upgrade" ]; then
-		eval "$do_upgrade"
-	elif type 'platform_do_upgrade' >/dev/null 2>/dev/null; then
-		platform_do_upgrade "$IMAGE"
-	else
-		default_do_upgrade "$IMAGE"
-	fi
-
-	if [ "$SAVE_CONFIG" -eq 1 ] && type 'platform_copy_config' >/dev/null 2>/dev/null; then
-		platform_copy_config
-	fi
-
-	v "Upgrade completed"
-	sleep 1
-
-	v "Rebooting system..."
-	umount -a
-	reboot -f
-	sleep 5
-	echo b 2>/dev/null >/proc/sysrq-trigger
-}
diff --git a/package/base-files/files/lib/upgrade/do_stage2 b/package/base-files/files/lib/upgrade/do_stage2
new file mode 100755
index 0000000000..0e32445743
--- /dev/null
+++ b/package/base-files/files/lib/upgrade/do_stage2
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+include /lib/upgrade
+
+v "Performing system upgrade..."
+if type 'platform_do_upgrade' >/dev/null 2>/dev/null; then
+	platform_do_upgrade "$IMAGE"
+else
+	default_do_upgrade "$IMAGE"
+fi
+
+if [ -n "$UPGRADE_BACKUP" ] && type 'platform_copy_config' >/dev/null 2>/dev/null; then
+	platform_copy_config
+fi
+
+v "Upgrade completed"
+sleep 1
+
+v "Rebooting system..."
+umount -a
+reboot -f
+sleep 5
+echo b 2>/dev/null >/proc/sysrq-trigger
diff --git a/package/base-files/files/lib/upgrade/fwtool.sh b/package/base-files/files/lib/upgrade/fwtool.sh
old mode 100755
new mode 100644
index 3f28fccd90..a0b3fb0a04
--- a/package/base-files/files/lib/upgrade/fwtool.sh
+++ b/package/base-files/files/lib/upgrade/fwtool.sh
@@ -9,7 +9,7 @@ fwtool_check_signature() {
 		fi
 	}
 
-	if ! fwtool -q -t -s /tmp/sysupgrade.ucert "$1"; then
+	if ! fwtool -q -s /tmp/sysupgrade.ucert "$1"; then
 		echo "Image signature not found"
 		[ "$REQUIRE_IMAGE_SIGNATURE" = 1 -a "$FORCE" != 1 ] && {
 			echo "Use sysupgrade -F to override this check when downgrading or flashing to vendor firmware"
@@ -18,7 +18,8 @@ fwtool_check_signature() {
 		return 0
 	fi
 
-	ucert -V -m "$1" -c "/tmp/sysupgrade.ucert" -P /etc/opkg/keys
+	fwtool -q -T -s /dev/null "$1" | \
+		ucert -V -m - -c "/tmp/sysupgrade.ucert" -P /etc/opkg/keys
 
 	return $?
 }
diff --git a/package/base-files/files/lib/upgrade/nand.sh b/package/base-files/files/lib/upgrade/nand.sh
old mode 100755
new mode 100644
index 99916a4e96..e7d7bf8d13
--- a/package/base-files/files/lib/upgrade/nand.sh
+++ b/package/base-files/files/lib/upgrade/nand.sh
@@ -109,7 +109,7 @@ nand_restore_config() {
 		rmdir /tmp/new_root
 		return 1
 	fi
-	mv "$1" "/tmp/new_root/sysupgrade.tgz"
+	mv "$1" "/tmp/new_root/$BACKUP_FILE"
 	umount /tmp/new_root
 	sync
 	rmdir /tmp/new_root
@@ -280,21 +280,8 @@ nand_upgrade_tar() {
 
 # Recognize type of passed file and start the upgrade process
 nand_do_upgrade() {
-	if [ -n "$IS_PRE_UPGRADE" ]; then
-		# Previously, nand_do_upgrade was called from the platform_pre_upgrade
-		# hook; this piece of code handles scripts that haven't been
-		# updated. All scripts should gradually move to call nand_do_upgrade
-		# from platform_do_upgrade instead.
-		export do_upgrade="nand_do_upgrade '$1'"
-		return
-	fi
-
 	local file_type=$(identify $1)
 
-	if type 'platform_nand_pre_upgrade' >/dev/null 2>/dev/null; then
-		platform_nand_pre_upgrade "$1"
-	fi
-
 	[ ! "$(find_mtd_index "$CI_UBIPART")" ] && CI_UBIPART="rootfs"
 
 	case "$file_type" in
diff --git a/package/base-files/files/lib/upgrade/stage2 b/package/base-files/files/lib/upgrade/stage2
index bdc12c7426..41a3b2aeb3 100755
--- a/package/base-files/files/lib/upgrade/stage2
+++ b/package/base-files/files/lib/upgrade/stage2
@@ -6,24 +6,13 @@
 export IMAGE="$1"
 COMMAND="$2"
 
-export ARGV="$IMAGE"
-export ARGC=1
-
-export SAVE_CONFIG=1
-export SAVE_PARTITIONS=1
-
 export INTERACTIVE=0
 export VERBOSE=1
 export CONFFILES=/tmp/sysupgrade.conffiles
-export CONF_TAR=/tmp/sysupgrade.tgz
 
 RAMFS_COPY_BIN=		# extra programs for temporary ramfs root
 RAMFS_COPY_DATA=	# extra data files
 
-
-[ -f "$CONF_TAR" ] || export SAVE_CONFIG=0
-[ -f /tmp/sysupgrade.always.overwrite.bootdisk.partmap ] && export SAVE_PARTITIONS=0
-
 include /lib/upgrade
 
 
@@ -59,7 +48,7 @@ switch_to_ramfs() {
 		local file="$(which "$binary" 2>/dev/null)"
 		[ -n "$file" ] && install_bin "$file"
 	done
-	install_file /etc/resolv.conf /lib/*.sh /lib/functions/*.sh /lib/upgrade/*.sh $RAMFS_COPY_DATA
+	install_file /etc/resolv.conf /lib/*.sh /lib/functions/*.sh /lib/upgrade/*.sh /lib/upgrade/do_stage2 /usr/share/libubox/jshn.sh $RAMFS_COPY_DATA
 
 	[ -L "/lib64" ] && ln -s /lib $RAM_ROOT/lib64
 
@@ -136,10 +125,7 @@ sleep 1
 
 
 if [ -n "$IMAGE" ] && type 'platform_pre_upgrade' >/dev/null 2>/dev/null; then
-	IS_PRE_UPGRADE=1 platform_pre_upgrade "$IMAGE"
-
-	# Needs to be unset again because of busybox weirdness ...
-	IS_PRE_UPGRADE=
+	platform_pre_upgrade "$IMAGE"
 fi
 
 if [ -n "$(rootfs_type)" ]; then
diff --git a/package/base-files/files/sbin/pkg_check b/package/base-files/files/sbin/pkg_check
new file mode 100755
index 0000000000..9968c9b78e
--- /dev/null
+++ b/package/base-files/files/sbin/pkg_check
@@ -0,0 +1,130 @@
+#!/bin/sh
+#
+# Package checksums checking script
+# (C) 2018 CZ.NIC, z.s.p.o.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+ERRFATAL="no"
+QUIET="yes"
+MISSING=""
+SUMMARY=""
+NL="
+"
+
+# Arguments parsing
+while expr "x$1" : "x-" > /dev/null; do
+	if [ "x$1" = "x-s" ]; then
+		ERRFATAL="yes"
+		shift
+	elif [ "x$1" = "x-v" ]; then
+		QUIET="	no"
+		shift
+	else
+		echo "Usage: $(basename $0) [-s] [-v] [pkg1 pkg2 ...]"
+		echo
+		echo "   -s   Stop on first change"
+		echo "   -v   Verbose"
+		if [ "x$1" = "x-h" ]; then
+			exit 0
+		else
+			echo
+			echo "ERROR: Unknown option '$1'"
+			exit 1
+		fi
+	fi
+done
+
+# Check all packages by default
+if [ -z "$1" ]; then
+	set $(cd /usr/lib/opkg/info/; for i in *.files-sha256sum; do basename $i .files-sha256sum; done)
+fi
+
+# Iterate over packages
+while [ "$1" ]; do
+	if [ \! -f "/usr/lib/opkg/info/$1.files-sha256sum" ]; then
+		if [ "$ERRFATAL" = no ]; then
+			echo " * No checksums for $1 - skipping"
+			echo
+		else
+			echo " * No checksums for $1 - exiting"
+			exit 1
+		fi
+		if [ -z "$MISSING" ]; then
+			MISSING="$1"
+		else
+			MISSING="$MISSING, $1"
+		fi
+		shift
+		continue
+	fi
+	[ $QUIET = yes ] || echo " * Checking package $1:"
+	ERR=""
+	CHECK="`sha256sum -c /usr/lib/opkg/info/$1.files-sha256sum 2> /dev/null`"
+
+	# Are the changed files config files?
+	if [ $? -ne 0 ] && [ "`cat "/usr/lib/opkg/info/$1.files-sha256sum"`" ]; then
+		NEWCHECK="`echo "$CHECK" | grep '^.*: OK$'`"
+		for i in `echo "$CHECK" | sed -n 's|^\(.*\): FAILED$|\1|p'`; do
+			if [ "`grep "^$i\$" "/usr/lib/opkg/info/$1.conffiles" 2> /dev/null`" ] || \
+			   [ "`echo "$i" | grep "^/etc/uci-defaults/"`" ]; then
+				NEWCHECK="${NEWCHECK}${NL}${i}: CONFIGURED"
+			else
+				NEWCHECK="${NEWCHECK}${NL}${i}: FAILED"
+				ERR="y"
+			fi
+		done
+		CHECK="$NEWCHECK"
+	fi
+
+	# Do we have changed files or not?
+	if [ -z "$ERR" ]; then
+		[ $QUIET = yes ] || [ -z "`cat "/usr/lib/opkg/info/$1.files-sha256sum"`" ] || echo "$CHECK" | sed 's|^|   - |'
+		[ $QUIET = yes ] || echo " * Package $1 is ok"
+		[ $QUIET = yes ] || echo
+	else
+		if [ $QUIET = yes ]; then
+			echo " * Changes found in package $1:"
+			echo "$CHECK" | sed -n 's|^\(.*:[[:blank:]]*FAILED\)$|   - \1|p'
+		else
+			echo "$CHECK" | sed 's|^|   - |'
+			echo " * Changes found in package $1!"
+		fi
+		if [ "$ERRFATAL" = yes ]; then
+			echo
+			echo "Exiting on first change found!"
+			exit 1
+		fi
+		for i in `echo "$CHECK" | sed -n 's|^\(.*\): FAILED$|\1|p'`; do
+			SUMMARY="${SUMMARY}${NL} - $1: $i"
+		done
+		echo
+	fi
+	shift
+done
+
+# If there are changed files, report them
+if [ "$SUMMARY" ]; then
+	echo "Some packages contain changed files!"
+	echo "Maybe something worth looking into?"
+	echo "Here is the list of packages and changed files:"
+	echo "$SUMMARY"
+fi
+if [ "$MISSING" ]; then
+	echo "Following packages are missing checksums: $MISSING"
+fi
+if [ "$MISSING" ] || [ "$SUMMARY" ]; then
+	exit 1
+fi
diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
index 3a5087a0c8..935d08048e 100755
--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@@ -2,8 +2,10 @@
 
 . /lib/functions.sh
 . /lib/functions/system.sh
+. /usr/share/libubox/jshn.sh
 
 # initialize defaults
+export MTD_ARGS=""
 export MTD_CONFIG_ARGS=""
 export INTERACTIVE=0
 export VERBOSE=1
@@ -190,9 +192,6 @@ add_overlayfiles() {
 	return 0
 }
 
-# hooks
-sysupgrade_image_check="fwtool_check_signature fwtool_check_image platform_check_image"
-
 if [ $SAVE_OVERLAY = 1 ]; then
 	[ ! -d /overlay/upper/etc ] && {
 		echo "Cannot find '/overlay/upper/etc', required for '-c'" >&2
@@ -249,7 +248,7 @@ do_save_conffiles() {
 
 	v "Saving config files..."
 	[ "$VERBOSE" -gt 1 ] && TAR_V="v" || TAR_V=""
-	tar c${TAR_V}zpf "$conf_tar" -T "$CONFFILES" 2>/dev/null
+	tar c${TAR_V}zf "$conf_tar" -T "$CONFFILES" 2>/dev/null
 	if [ "$?" -ne 0 ]; then
 		echo "Failed to create the configuration backup."
 		rm -f "$conf_tar"
@@ -315,20 +314,19 @@ case "$IMAGE" in
 		;;
 esac
 
-export ARGV="$IMAGE"
-export ARGC=1
-
-for check in $sysupgrade_image_check; do
-	( $check "$IMAGE" ) || {
-		if [ $FORCE -eq 1 ]; then
-			echo "Image check '$check' failed but --force given - will update anyway!" >&2
-			break
-		else
-			echo "Image check '$check' failed." >&2
-			exit 1
-		fi
-	}
-done
+json_load "$(/usr/libexec/validate_firmware_image "$IMAGE")" || {
+	echo "Failed to check image"
+	exit 1
+}
+json_get_var valid "valid"
+[ "$valid" -eq 0 ] && {
+	if [ $FORCE -eq 1 ]; then
+		echo "Image check failed but --force given - will update anyway!" >&2
+	else
+		echo "Image check failed." >&2
+		exit 1
+	fi
+}
 
 if [ -n "$CONF_IMAGE" ]; then
 	case "$(get_magic_word $CONF_IMAGE cat)" in
@@ -353,24 +351,27 @@ if [ $TEST -eq 1 ]; then
 	exit 0
 fi
 
-if [ $SAVE_PARTITIONS -eq 0 ]; then
-	touch /tmp/sysupgrade.always.overwrite.bootdisk.partmap
-else
-	rm -f /tmp/sysupgrade.always.overwrite.bootdisk.partmap
-fi
-
 install_bin /sbin/upgraded
 v "Commencing upgrade. Closing all shell sessions."
 
-COMMAND='. /lib/functions.sh; include /lib/upgrade; do_upgrade_stage2'
+COMMAND='/lib/upgrade/do_stage2'
 
 if [ -n "$FAILSAFE" ]; then
 	printf '%s\x00%s\x00%s' "$RAM_ROOT" "$IMAGE" "$COMMAND" >/tmp/sysupgrade
 	lock -u /tmp/.failsafe
 else
+	force_attr=""
+	[ $FORCE -eq 1 ] && force_attr="\"force\": true,"
+	backup_attr=""
+	[ $SAVE_CONFIG -eq 1 ] && backup_attr="\"backup\": $(json_string $CONF_TAR),"
 	ubus call system sysupgrade "{
 		\"prefix\": $(json_string "$RAM_ROOT"),
 		\"path\": $(json_string "$IMAGE"),
-		\"command\": $(json_string "$COMMAND")
+		$force_attr
+		$backup_attr
+		\"command\": $(json_string "$COMMAND"),
+		\"options\": {
+			\"save_partitions\": $SAVE_PARTITIONS
+		}
 	}"
 fi
diff --git a/package/base-files/files/sbin/urandom_seed b/package/base-files/files/sbin/urandom_seed
deleted file mode 100755
index 7043e8af4e..0000000000
--- a/package/base-files/files/sbin/urandom_seed
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-set -e
-
-trap '[ "$?" -eq 0 ] || echo "An error occured" >&2' EXIT
-
-save() {
-    touch "$1.tmp"
-    chown root:root "$1.tmp"
-    chmod 600 "$1.tmp"
-    getrandom 512 > "$1.tmp"
-    mv "$1.tmp" "$1"
-    echo "Seed saved ($1)"
-}
-
-SEED="$(uci -q get system.@system[0].urandom_seed || true)"
-[ "${SEED:0:1}" = "/" ] && save "$SEED"
-
-SEED=/etc/urandom.seed
-[ ! -f $SEED ] && save "$SEED"
-true
diff --git a/package/base-files/files/sbin/wifi b/package/base-files/files/sbin/wifi
index f7a10de215..a8b4451c60 100755
--- a/package/base-files/files/sbin/wifi
+++ b/package/base-files/files/sbin/wifi
@@ -6,7 +6,7 @@
 
 usage() {
 	cat <<EOF
-Usage: $0 [config|up|down|reload|status]
+Usage: $0 [config|up|down|reconf|reload|status]
 enables (default), disables or configures devices not yet configured.
 EOF
 	exit 1
@@ -130,6 +130,10 @@ wifi_updown() {
 		scan_wifi
 		cmd=up
 	}
+	[ reconf = "$1" ] && {
+		scan_wifi
+		cmd=reconf
+	}
 	ubus_wifi_cmd "$cmd" "$2"
 	_wifi_updown "$@"
 }
@@ -241,6 +245,7 @@ case "$1" in
 	reload) wifi_reload "$2";;
 	reload_legacy) wifi_reload_legacy "$2";;
 	--help|help) usage;;
+	reconf) ubus call network reload; wifi_updown "reconf" "$2";;
 	''|up) ubus call network reload; wifi_updown "enable" "$2";;
 	*) usage; exit 1;;
 esac
diff --git a/package/base-files/files/usr/lib/os-release b/package/base-files/files/usr/lib/os-release
index 121041256a..c39913d54f 100644
--- a/package/base-files/files/usr/lib/os-release
+++ b/package/base-files/files/usr/lib/os-release
@@ -8,11 +8,11 @@ HOME_URL="%u"
 BUG_URL="%b"
 SUPPORT_URL="%s"
 BUILD_ID="%R"
-LEDE_BOARD="%S"
-LEDE_ARCH="%A"
-LEDE_TAINTS="%t"
-LEDE_DEVICE_MANUFACTURER="%M"
-LEDE_DEVICE_MANUFACTURER_URL="%m"
-LEDE_DEVICE_PRODUCT="%P"
-LEDE_DEVICE_REVISION="%h"
-LEDE_RELEASE="%D %V %C"
+OPENWRT_BOARD="%S"
+OPENWRT_ARCH="%A"
+OPENWRT_TAINTS="%t"
+OPENWRT_DEVICE_MANUFACTURER="%M"
+OPENWRT_DEVICE_MANUFACTURER_URL="%m"
+OPENWRT_DEVICE_PRODUCT="%P"
+OPENWRT_DEVICE_REVISION="%h"
+OPENWRT_RELEASE="%D %V %C"
diff --git a/package/base-files/files/usr/libexec/validate_firmware_image b/package/base-files/files/usr/libexec/validate_firmware_image
new file mode 100755
index 0000000000..f85fb9e4b4
--- /dev/null
+++ b/package/base-files/files/usr/libexec/validate_firmware_image
@@ -0,0 +1,66 @@
+#!/bin/sh
+
+. /lib/functions.sh
+. /lib/functions/system.sh
+. /usr/share/libubox/jshn.sh
+
+include /lib/upgrade
+
+VALID=1
+FORCEABLE=1
+ALLOW_BACKUP=1
+
+# Mark image as invalid but still possible to install
+notify_firmware_invalid() {
+	VALID=0
+}
+
+# Mark image as broken (impossible to install)
+notify_firmware_broken() {
+	VALID=0
+	FORCEABLE=0
+}
+
+# Mark image as incompatible with preserving a backup
+notify_firmware_no_backup() {
+	ALLOW_BACKUP=0
+}
+
+# Add result of validation test
+notify_firmware_test_result() {
+	local old_ns
+
+	json_set_namespace validate_firmware_image old_ns
+	json_add_boolean "$1" "$2"
+	json_set_namespace $old_ns
+}
+
+err_to_bool() {
+	[ "$1" -ne 0 ] && echo 0 || echo 1
+}
+
+fwtool_check_signature "$1" >&2
+FWTOOL_SIGNATURE=$?
+[ "$FWTOOL_SIGNATURE" -ne 0 ] && notify_firmware_invalid
+
+fwtool_check_image "$1" >&2
+FWTOOL_DEVICE_MATCH=$?
+[ "$FWTOOL_DEVICE_MATCH" -ne 0 ] && notify_firmware_invalid
+
+json_set_namespace validate_firmware_image old_ns
+json_init
+	json_add_object "tests"
+		json_add_boolean fwtool_signature "$(err_to_bool $FWTOOL_SIGNATURE)"
+		json_add_boolean fwtool_device_match "$(err_to_bool $FWTOOL_DEVICE_MATCH)"
+
+		# Call platform_check_image() here so it can add its test
+		# results and still mark image properly.
+		json_set_namespace $old_ns
+		platform_check_image "$1" >&2 || notify_firmware_invalid
+		json_set_namespace validate_firmware_image old_ns
+	json_close_object
+	json_add_boolean valid "$VALID"
+	json_add_boolean forceable "$FORCEABLE"
+	json_add_boolean allow_backup "$ALLOW_BACKUP"
+json_dump -i
+json_set_namespace $old_ns
diff --git a/package/base-files/image-config.in b/package/base-files/image-config.in
index cf2cfd1d4e..3432db525a 100644
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@@ -183,7 +183,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.lede-project.org/snapshots"
+		default "http://downloads.openwrt.org/snapshots"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders: