diff --git a/config/Config-build.in b/config/Config-build.in
index 61a9265ad7..ac1e05d2ff 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -249,7 +249,6 @@ menu "Global build settings"
 
 	choice
 		prompt "User space Stack-Smashing Protection"
-		depends on USE_MUSL
 		default PKG_CC_STACKPROTECTOR_REGULAR
 		help
 		  Enable GCC Stack Smashing Protection (SSP) for userspace applications
@@ -257,18 +256,15 @@ menu "Global build settings"
 			bool "None"
 		config PKG_CC_STACKPROTECTOR_REGULAR
 			bool "Regular"
-			select GCC_LIBSSP if !USE_MUSL
 			depends on KERNEL_CC_STACKPROTECTOR_REGULAR
 		config PKG_CC_STACKPROTECTOR_STRONG
 			bool "Strong"
-			select GCC_LIBSSP if !USE_MUSL
 			depends on KERNEL_CC_STACKPROTECTOR_STRONG
 	endchoice
 
 	choice
 		prompt "Kernel space Stack-Smashing Protection"
 		default KERNEL_CC_STACKPROTECTOR_REGULAR
-		depends on USE_MUSL || !(x86_64 || i386)
 		help
 		  Enable GCC Stack-Smashing Protection (SSP) for the kernel
 		config KERNEL_CC_STACKPROTECTOR_NONE
diff --git a/include/package-defaults.mk b/include/package-defaults.mk
index 31e331b2d5..2fed72b1a4 100644
--- a/include/package-defaults.mk
+++ b/include/package-defaults.mk
@@ -5,7 +5,7 @@
 # See /LICENSE for more information.
 #
 
-PKG_DEFAULT_DEPENDS = +libc +GCC_LIBSSP:libssp +USE_GLIBC:librt +USE_GLIBC:libpthread
+PKG_DEFAULT_DEPENDS = +libc +USE_GLIBC:librt +USE_GLIBC:libpthread
 
 ifneq ($(PKG_NAME),toolchain)
   PKG_FIXUP_DEPENDS = $(if $(filter kmod-%,$(1)),$(2),$(PKG_DEFAULT_DEPENDS) $(filter-out $(PKG_DEFAULT_DEPENDS),$(2)))
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 5bf783d0e8..84fbcacdfc 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -12,7 +12,7 @@ include $(INCLUDE_DIR)/version.mk
 include $(INCLUDE_DIR)/feeds.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=222
+PKG_RELEASE:=223
 PKG_FLAGS:=nonshared
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
diff --git a/package/base-files/files/etc/init.d/gpio_switch b/package/base-files/files/etc/init.d/gpio_switch
index 6b2dcdce41..24d790b065 100755
--- a/package/base-files/files/etc/init.d/gpio_switch
+++ b/package/base-files/files/etc/init.d/gpio_switch
@@ -16,21 +16,39 @@ load_gpio_switch()
 	config_get name "$1" name
 	config_get value "$1" value 0
 
-	local gpio_path="/sys/class/gpio/gpio${gpio_pin}"
-	# export GPIO pin for access
-	[ -d "$gpio_path" ] || {
-		echo "$gpio_pin" >/sys/class/gpio/export
-		# we need to wait a bit until the GPIO appears
-		[ -d "$gpio_path" ] || sleep 1
+	[ -z "$gpio_pin" ] && {
+		echo >&2 "Skipping gpio_switch '$name' due to missing gpio_pin"
+		return 1
 	}
 
-	# direction attribute only exists if the kernel supports changing the
-	# direction of a GPIO
-	if [ -e "${gpio_path}/direction" ]; then
-		# set the pin to output with high or low pin value
-		{ [ "$value" = "0" ] && echo "low" || echo "high"; } >"$gpio_path/direction"
+	local gpio_path
+	if [ -n "$(echo "$gpio_pin" | grep -E "^[0-9]+$")" ]; then
+		gpio_path="/sys/class/gpio/gpio${gpio_pin}"
+
+		# export GPIO pin for access
+		[ -d "$gpio_path" ] || {
+			echo "$gpio_pin" >/sys/class/gpio/export
+			# we need to wait a bit until the GPIO appears
+			[ -d "$gpio_path" ] || sleep 1
+		}
+
+		# direction attribute only exists if the kernel supports changing the
+		# direction of a GPIO
+		if [ -e "${gpio_path}/direction" ]; then
+			# set the pin to output with high or low pin value
+			{ [ "$value" = "0" ] && echo "low" || echo "high"; } \
+				>"$gpio_path/direction"
+		else
+			{ [ "$value" = "0" ] && echo "0" || echo "1"; } \
+				>"$gpio_path/value"
+		fi
 	else
-		{ [ "$value" = "0" ] && echo "0" || echo "1"; } >"$gpio_path/value"
+		gpio_path="/sys/class/gpio/${gpio_pin}"
+
+		[ -d "$gpio_path" ] && {
+			{ [ "$value" = "0" ] && echo "0" || echo "1"; } \
+				>"$gpio_path/value"
+		}
 	fi
 }
 
diff --git a/package/base-files/files/lib/functions/uci-defaults.sh b/package/base-files/files/lib/functions/uci-defaults.sh
index e551e8fd57..12b900031d 100755
--- a/package/base-files/files/lib/functions/uci-defaults.sh
+++ b/package/base-files/files/lib/functions/uci-defaults.sh
@@ -573,7 +573,7 @@ ucidef_add_gpio_switch() {
 	json_select_object gpioswitch
 		json_select_object "$cfg"
 			json_add_string name "$name"
-			json_add_int pin "$pin"
+			json_add_string pin "$pin"
 			json_add_int default "$default"
 		json_select ..
 	json_select ..
diff --git a/package/kernel/mac80211/ath.mk b/package/kernel/mac80211/ath.mk
index 0c25d23bb2..7a57df568b 100644
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@@ -7,6 +7,7 @@ PKG_CONFIG_DEPENDS += \
 	CONFIG_PACKAGE_ATH_DFS \
 	CONFIG_PACKAGE_ATH_SPECTRAL \
 	CONFIG_PACKAGE_ATH_DYNACK \
+	CONFIG_ATH9K_HWRNG \
 	CONFIG_ATH9K_SUPPORT_PCOEM \
 	CONFIG_ATH9K_TX99 \
 	CONFIG_ATH10K_LEDS \
@@ -44,6 +45,7 @@ config-$(CONFIG_TARGET_ath79) += ATH9K_AHB
 config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
 config-$(CONFIG_PCI) += ATH9K_PCI
 config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD
+config-$(CONFIG_ATH9K_HWRNG) += ATH9K_HWRNG
 config-$(CONFIG_ATH9K_SUPPORT_PCOEM) += ATH9K_PCOEM
 config-$(CONFIG_ATH9K_TX99) += ATH9K_TX99
 config-$(CONFIG_ATH9K_UBNTHSR) += ATH9K_UBNTHSR
@@ -207,6 +209,12 @@ endef
 
 define KernelPackage/ath9k/config
 
+	config ATH9K_HWRNG
+		bool "Add wireless noise as source of randomness to kernel entropy pool"
+		depends on PACKAGE_kmod-ath9k
+		select PACKAGE_kmod-random-core
+		default n
+
 	config ATH9K_SUPPORT_PCOEM
 		bool "Support chips used in PC OEM cards"
 		depends on PACKAGE_kmod-ath9k
diff --git a/package/libs/toolchain/Makefile b/package/libs/toolchain/Makefile
index c13e9e4928..9851a5f1cd 100644
--- a/package/libs/toolchain/Makefile
+++ b/package/libs/toolchain/Makefile
@@ -83,33 +83,6 @@ define Package/libatomic/config
 	endmenu
 endef
 
-define Package/libssp
-$(call Package/gcc/Default)
-  DEPENDS+=@GCC_LIBSSP
-  TITLE:=GCC support library
-endef
-
-define Package/libssp/config
-	menu "Configuration"
-		depends on EXTERNAL_TOOLCHAIN && PACKAGE_libssp
-
-	config LIBSSP_ROOT_DIR
-		string
-		prompt "libssp shared library base directory"
-		depends on EXTERNAL_TOOLCHAIN && PACKAGE_libssp
-		default TOOLCHAIN_ROOT  if !NATIVE_TOOLCHAIN
-		default "/"  if NATIVE_TOOLCHAIN
-
-	config LIBSSP_FILE_SPEC
-		string
-		prompt "libssp shared library files (use wildcards)"
-		depends on EXTERNAL_TOOLCHAIN && PACKAGE_libssp
-		default "./lib/libssp.so.*"
-
-	endmenu
-endef
-
-
 define Package/libstdcpp
 $(call Package/gcc/Default)
   NAME:=libstdc++
@@ -519,11 +492,6 @@ ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
 	$(CP) $(TOOLCHAIN_DIR)/lib/libgfortran.so.* $(1)/usr/lib/
   endef
 
-  define Package/libssp/install
-	$(INSTALL_DIR) $(1)/lib
-	$(CP) $(TOOLCHAIN_DIR)/lib/libssp.so.* $(1)/lib/
-  endef
-
   define Package/libstdcpp/install
 	$(INSTALL_DIR) $(1)/usr/lib
 	$(CP) $(TOOLCHAIN_DIR)/lib/libstdc++.so.* $(1)/usr/lib/
@@ -646,6 +614,7 @@ ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
   define Package/ldd/install
 	$(INSTALL_DIR) $(1)/usr/bin/
 	$(CP) $(TOOLCHAIN_DIR)/bin/ldd $(1)/usr/bin/
+	sed -i 's,^#!.*,#!/bin/sh,' $(1)/usr/bin/ldd
   endef
 
   define Package/ldconfig/install
@@ -670,14 +639,6 @@ else
 	done
   endef
 
-  define Package/libssp/install
-	for file in $(call qstrip,$(CONFIG_LIBSSP_FILE_SPEC)); do \
-		$(INSTALL_DIR) $(1)/lib ; \
-		$(CP) $(call qstrip,$(CONFIG_LIBSSP_ROOT_DIR))/$$$$file $(1)/lib/ ; \
-	done ; \
-	exit 0
-  endef
-
   define Package/libstdcpp/install
 	for file in $(call qstrip,$(CONFIG_LIBSTDCPP_FILE_SPEC)); do \
 		$(INSTALL_DIR) $(1)/lib ; \
@@ -789,7 +750,6 @@ endif
 $(eval $(call BuildPackage,libc))
 $(eval $(call BuildPackage,libgcc))
 $(eval $(call BuildPackage,libatomic))
-$(eval $(call BuildPackage,libssp))
 $(eval $(call BuildPackage,libstdcpp))
 $(eval $(call BuildPackage,libasan))
 $(eval $(call BuildPackage,libtsan))
diff --git a/package/libs/uclient/Makefile b/package/libs/uclient/Makefile
index 92c1e1d1e0..9edb5a6ea0 100644
--- a/package/libs/uclient/Makefile
+++ b/package/libs/uclient/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uclient.git
-PKG_MIRROR_HASH:=8b71b02feb721ec0ed9cd7fe6761aa6a40216563a294d04243779ebe98891355
-PKG_SOURCE_DATE:=2020-02-15
-PKG_SOURCE_VERSION:=af585dbd1d444faafa370a73c1db43aece731f85
+PKG_MIRROR_HASH:=05962d4edbe7b856e017d974c3d7e34dfa5f905821ab7a3534acc5886af4e5c7
+PKG_SOURCE_DATE:=2020-06-17
+PKG_SOURCE_VERSION:=c66098611f16806a936a3a3f92113a16382fc4d9
 CMAKE_INSTALL:=1
 
 PKG_BUILD_DEPENDS:=ustream-ssl
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index d2d45ac971..f0a637e4b6 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -284,16 +284,16 @@
  ifdef CONFIG_CODE_COVERAGE
  CFLAGS += -O0 -fprofile-arcs -ftest-coverage
  LIBS += -lgcov
-@@ -887,6 +893,9 @@ OBJS += ../src/pae/ieee802_1x_secy_ops.o
- ifdef CONFIG_AP
- OBJS += ../src/ap/wpa_auth_kay.o
+@@ -956,6 +962,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+ CFLAGS += -DCONFIG_CTRL_IFACE_MIB
  endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
 +ifdef CONFIG_UBUS
 +OBJS += ../src/ap/ubus.o
 +endif
  endif
  
- ifdef CONFIG_IEEE8021X_EAPOL
+ CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
 @@ -6797,6 +6797,8 @@ struct wpa_supplicant * wpa_supplicant_a
diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile
index 5f102d967d..f1170bbd37 100644
--- a/package/network/services/openvpn/Makefile
+++ b/package/network/services/openvpn/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=openvpn
 
 PKG_VERSION:=2.4.9
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=\
 	https://build.openvpn.net/downloads/releases/ \
@@ -102,6 +102,7 @@ endef
 
 define Package/openvpn-$(BUILD_VARIANT)/conffiles
 /etc/config/openvpn
+/etc/openvpn.user
 endef
 
 define Package/openvpn-$(BUILD_VARIANT)/install
@@ -111,7 +112,9 @@ define Package/openvpn-$(BUILD_VARIANT)/install
 		$(1)/etc/init.d \
 		$(1)/etc/config \
 		$(1)/etc/openvpn \
-		$(1)/lib/upgrade/keep.d
+		$(1)/lib/upgrade/keep.d \
+		$(1)/usr/libexec \
+		$(1)/etc/hotplug.d/openvpn
 
 	$(INSTALL_BIN) \
 		$(PKG_INSTALL_DIR)/usr/sbin/openvpn \
@@ -120,6 +123,19 @@ define Package/openvpn-$(BUILD_VARIANT)/install
 	$(INSTALL_BIN) \
 		files/openvpn.init \
 		$(1)/etc/init.d/openvpn
+
+	$(INSTALL_BIN) \
+		files/usr/libexec/openvpn-hotplug \
+		$(1)/usr/libexec/openvpn-hotplug
+
+	$(INSTALL_DATA) \
+		files/etc/hotplug.d/openvpn/01-user \
+		$(1)/etc/hotplug.d/openvpn/01-user
+
+	$(INSTALL_DATA) \
+		files/etc/openvpn.user \
+		$(1)/etc/openvpn.user
+
 	$(INSTALL_DATA) \
 		files/openvpn.options \
 		$(1)/usr/share/openvpn/openvpn.options
diff --git a/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
new file mode 100644
index 0000000000..6d45f0b7c6
--- /dev/null
+++ b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+get_option() {
+	local variable="$1"
+	local option="$2"
+
+	local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
+	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
+	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
+	[ -n "$value" ] || return 1
+
+	export -n "$variable=$value"
+	return 0
+}
+
+[ -e "/etc/openvpn.user" ] && {
+	env -i ACTION="$ACTION" INSTANCE="$INSTANCE" \
+		/bin/sh \
+		/etc/openvpn.user \
+		$*
+}
+
+# Wrap user defined scripts on up/down events
+case "$ACTION" in
+	up|down)
+		if get_option command "$ACTION"; then
+			exec /bin/sh -c "$command $ACTION $INSTANCE $*"
+		fi
+	;;
+esac
+
+exit 0
diff --git a/package/network/services/openvpn/files/etc/openvpn.user b/package/network/services/openvpn/files/etc/openvpn.user
new file mode 100644
index 0000000000..a77566556a
--- /dev/null
+++ b/package/network/services/openvpn/files/etc/openvpn.user
@@ -0,0 +1,11 @@
+#!/bin/sh
+#
+# This file is interpreted as shell script.
+# Put your custom openvpn action here, they will
+# be executed with each opevnp event.
+#
+# $ACTION
+#      <down>    down action is generated after the TUN/TAP device is closed
+#      <up>      up action is generated after the TUN/TAP device is opened
+# $INSTANCE  Name of the openvpn instance which went up or down
+
diff --git a/package/network/services/openvpn/files/openvpn.init b/package/network/services/openvpn/files/openvpn.init
index a7d35d1a98..a560b89ff2 100644
--- a/package/network/services/openvpn/files/openvpn.init
+++ b/package/network/services/openvpn/files/openvpn.init
@@ -73,13 +73,17 @@ openvpn_add_instance() {
 	local name="$1"
 	local dir="$2"
 	local conf="$3"
+	local security="$4"
 
 	procd_open_instance "$name"
 	procd_set_param command "$PROG"	\
 		--syslog "openvpn($name)" \
 		--status "/var/run/openvpn.$name.status" \
 		--cd "$dir" \
-		--config "$conf"
+		--config "$conf" \
+		--up "/usr/libexec/openvpn-hotplug up $name" \
+		--down "/usr/libexec/openvpn-hotplug down $name" \
+		--script-security "${security:-2}"
 	procd_set_param file "$dir/$conf"
 	procd_set_param term_timeout 15
 	procd_set_param respawn
@@ -100,11 +104,14 @@ start_instance() {
 		return 1
 	}
 
+	local script_security
+	config_get script_security "$s" script_security
+
 	[ ! -d "/var/run" ] && mkdir -p "/var/run"
 
 	if [ ! -z "$config" ]; then
 		append UCI_STARTED "$config" "$LIST_SEP"
-		openvpn_add_instance "$s" "${config%/*}" "$config"
+		openvpn_add_instance "$s" "${config%/*}" "$config" "$script_security"
 		return
 	fi
 
@@ -115,7 +122,7 @@ start_instance() {
 	append_params "$s" $OPENVPN_PARAMS
 	append_list "$s" $OPENVPN_LIST
 
-	openvpn_add_instance "$s" "/var/etc" "openvpn-$s.conf"
+	openvpn_add_instance "$s" "/var/etc" "openvpn-$s.conf" "$script_security"
 }
 
 start_service() {
diff --git a/package/network/services/openvpn/files/openvpn.options b/package/network/services/openvpn/files/openvpn.options
index 2da563968c..5d7a387cd3 100644
--- a/package/network/services/openvpn/files/openvpn.options
+++ b/package/network/services/openvpn/files/openvpn.options
@@ -25,7 +25,6 @@ dev
 dev_node
 dev_type
 dh
-down
 ecdh_curve
 echo
 engine
@@ -103,7 +102,6 @@ route_metric
 route_pre_down
 route_up
 rport
-script_security
 secret
 server
 server_bridge
@@ -127,7 +125,6 @@ tran_window
 tun_mtu
 tun_mtu_extra
 txqueuelen
-up
 user
 verb
 verify_client_cert
diff --git a/package/network/services/openvpn/files/usr/libexec/openvpn-hotplug b/package/network/services/openvpn/files/usr/libexec/openvpn-hotplug
new file mode 100644
index 0000000000..9235fbacfe
--- /dev/null
+++ b/package/network/services/openvpn/files/usr/libexec/openvpn-hotplug
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+ACTION=$1
+shift
+INSTANCE=$1
+shift
+
+export ACTION=$ACTION
+export INSTANCE=$INSTANCE
+exec /sbin/hotplug-call openvpn "$@"
diff --git a/package/network/utils/comgt/files/ncm.sh b/package/network/utils/comgt/files/ncm.sh
index f5bed7d5e1..6545091c82 100644
--- a/package/network/utils/comgt/files/ncm.sh
+++ b/package/network/utils/comgt/files/ncm.sh
@@ -74,7 +74,7 @@ proto_ncm_setup() {
 	[ -n "$delay" ] && sleep "$delay"
 
 	manufacturer=$(gcom -d "$device" -s /etc/gcom/getcardinfo.gcom | awk 'NF && $0 !~ /AT\+CGMI/ { sub(/\+CGMI: /,""); print tolower($1); exit; }')
-	[ $? -ne 0 ] && {
+	[ $? -ne 0 -o -z "$manufacturer" ] && {
 		echo "Failed to get modem information"
 		proto_notify_error "$interface" GETINFO_FAILED
 		return 1
@@ -88,6 +88,7 @@ proto_ncm_setup() {
 		proto_set_available "$interface" 0
 		return 1
 	}
+
 	json_get_values initialize initialize
 	for i in $initialize; do
 		eval COMMAND="$i" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
@@ -119,22 +120,26 @@ proto_ncm_setup() {
 	[ -n "$mode" ] && {
 		json_select modes
 		json_get_var setmode "$mode"
-		echo "Setting mode"
-		eval COMMAND="$setmode" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
-			echo "Failed to set operating mode"
-			proto_notify_error "$interface" SETMODE_FAILED
-			return 1
+		[ -n "$setmode" ] && {
+			echo "Setting mode"
+			eval COMMAND="$setmode" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
+				echo "Failed to set operating mode"
+				proto_notify_error "$interface" SETMODE_FAILED
+				return 1
+			}
 		}
 		json_select ..
 	}
 
 	echo "Starting network $interface"
 	json_get_vars connect
-	echo "Connecting modem"
-	eval COMMAND="$connect" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
-		echo "Failed to connect"
-		proto_notify_error "$interface" CONNECT_FAILED
-		return 1
+	[ -n "$connect" ] && {
+		echo "Connecting modem"
+		eval COMMAND="$connect" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
+			echo "Failed to connect"
+			proto_notify_error "$interface" CONNECT_FAILED
+			return 1
+		}
 	}
 
 	json_get_vars finalize
@@ -182,7 +187,6 @@ proto_ncm_setup() {
 			return 1
 		}
 	}
-
 }
 
 proto_ncm_teardown() {
@@ -195,6 +199,20 @@ proto_ncm_teardown() {
 
 	[ -n "$ctl_device" ] && device=$ctl_device
 
+	[ -n "$device" ] || {
+		echo "No control device specified"
+		proto_notify_error "$interface" NO_DEVICE
+		proto_set_available "$interface" 0
+		return 1
+	}
+
+	device="$(readlink -f $device)"
+	[ -e "$device" ] || {
+		echo "Control device not valid"
+		proto_set_available "$interface" 0
+		return 1
+	}
+
 	[ -n "$profile" ] || profile=1
 
 	echo "Stopping network $interface"
@@ -202,6 +220,16 @@ proto_ncm_teardown() {
 	json_load "$(ubus call network.interface.$interface status)"
 	json_select data
 	json_get_vars manufacturer
+	[ $? -ne 0 -o -z "$manufacturer" ] && {
+		# Fallback to direct detect, for proper handle device replug.
+		manufacturer=$(gcom -d "$device" -s /etc/gcom/getcardinfo.gcom | awk 'NF && $0 !~ /AT\+CGMI/ { sub(/\+CGMI: /,""); print tolower($1); exit; }')
+		[ $? -ne 0 -o -z "$manufacturer" ] && {
+			echo "Failed to get modem information"
+			proto_notify_error "$interface" GETINFO_FAILED
+			return 1
+		}
+		json_add_string "manufacturer" "$manufacturer"
+	}
 
 	json_load "$(cat /etc/gcom/ncm.json)"
 	json_select "$manufacturer" || {
@@ -211,10 +239,12 @@ proto_ncm_teardown() {
 	}
 
 	json_get_vars disconnect
-	eval COMMAND="$disconnect" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
-		echo "Failed to disconnect"
-		proto_notify_error "$interface" DISCONNECT_FAILED
-		return 1
+	[ -n "$disconnect" ] && {
+		eval COMMAND="$disconnect" gcom -d "$device" -s /etc/gcom/runcommand.gcom || {
+			echo "Failed to disconnect"
+			proto_notify_error "$interface" DISCONNECT_FAILED
+			return 1
+		}
 	}
 
 	proto_init_update "*" 0
diff --git a/target/linux/ath79/config-4.19 b/target/linux/ath79/config-4.19
index 81fd017aba..92af6ba970 100644
--- a/target/linux/ath79/config-4.19
+++ b/target/linux/ath79/config-4.19
@@ -139,6 +139,7 @@ CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_GPIO=y
 CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_RB4XX_CPLD is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MIPS=y
diff --git a/target/linux/ath79/config-5.4 b/target/linux/ath79/config-5.4
index b458edce1e..449f42bba7 100644
--- a/target/linux/ath79/config-5.4
+++ b/target/linux/ath79/config-5.4
@@ -148,6 +148,7 @@ CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_GPIO=y
 CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_RB4XX_CPLD is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MIPS=y
diff --git a/target/linux/ath79/dts/ar9344_tplink_cpe.dtsi b/target/linux/ath79/dts/ar9344_tplink_cpe.dtsi
index 27a8d0aa13..9a6f0ea5ab 100644
--- a/target/linux/ath79/dts/ar9344_tplink_cpe.dtsi
+++ b/target/linux/ath79/dts/ar9344_tplink_cpe.dtsi
@@ -110,3 +110,7 @@
 
 	mtd-mac-address = <&info 0x8>;
 };
+
+&eth1 {
+	status = "okay";
+};
diff --git a/target/linux/ath79/dts/ar9344_tplink_cpe610-v1.dts b/target/linux/ath79/dts/ar9344_tplink_cpe610-v1.dts
index 54ea399b74..de41397072 100644
--- a/target/linux/ath79/dts/ar9344_tplink_cpe610-v1.dts
+++ b/target/linux/ath79/dts/ar9344_tplink_cpe610-v1.dts
@@ -30,7 +30,5 @@
 };
 
 &eth1 {
-	status = "okay";
-
 	compatible = "syscon", "simple-mfd";
 };
diff --git a/target/linux/ath79/dts/ar9344_tplink_cpe_1port.dtsi b/target/linux/ath79/dts/ar9344_tplink_cpe_1port.dtsi
index 057ba4572f..be29d944b2 100644
--- a/target/linux/ath79/dts/ar9344_tplink_cpe_1port.dtsi
+++ b/target/linux/ath79/dts/ar9344_tplink_cpe_1port.dtsi
@@ -41,7 +41,5 @@
 };
 
 &eth1 {
-	status = "okay";
-
 	compatible = "syscon", "simple-mfd";
 };
diff --git a/target/linux/ath79/dts/ar9344_tplink_cpe_2port.dtsi b/target/linux/ath79/dts/ar9344_tplink_cpe_2port.dtsi
index 8a1332c9c5..089114f21b 100644
--- a/target/linux/ath79/dts/ar9344_tplink_cpe_2port.dtsi
+++ b/target/linux/ath79/dts/ar9344_tplink_cpe_2port.dtsi
@@ -61,8 +61,6 @@
 };
 
 &eth1 {
-	status = "okay";
-
 	mtd-mac-address = <&info 0x8>;
 
 	gmac-config {
diff --git a/target/linux/lantiq/config-4.19 b/target/linux/lantiq/config-4.19
index 560e8474dc..3d603dbd68 100644
--- a/target/linux/lantiq/config-4.19
+++ b/target/linux/lantiq/config-4.19
@@ -110,7 +110,6 @@ CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
 CONFIG_HW_HAS_PCI=y
 CONFIG_HW_RANDOM=y
 CONFIG_HZ=250
-# CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 CONFIG_HZ_PERIODIC=y
 CONFIG_INITRAMFS_SOURCE=""
diff --git a/target/linux/lantiq/config-5.4 b/target/linux/lantiq/config-5.4
index 8d84f1cdac..6f3b193cc7 100644
--- a/target/linux/lantiq/config-5.4
+++ b/target/linux/lantiq/config-5.4
@@ -119,7 +119,6 @@ CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
 CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
 CONFIG_HW_RANDOM=y
 CONFIG_HZ=250
-# CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 CONFIG_HZ_PERIODIC=y
 CONFIG_INITRAMFS_SOURCE=""
diff --git a/toolchain/Config.in b/toolchain/Config.in
index 762f4e10d7..cb557d4ad3 100644
--- a/toolchain/Config.in
+++ b/toolchain/Config.in
@@ -284,7 +284,7 @@ config USE_MUSL
 	bool
 
 config SSP_SUPPORT
-	default y if USE_MUSL || GCC_LIBSSP
+	default y if !PKG_CC_STACKPROTECTOR_NONE
 	bool
 
 config USE_EXTERNAL_LIBC
diff --git a/toolchain/gcc/Config.in b/toolchain/gcc/Config.in
index 7d7f34210a..4b2ba7aaae 100644
--- a/toolchain/gcc/Config.in
+++ b/toolchain/gcc/Config.in
@@ -47,14 +47,6 @@ config GCC_DEFAULT_SSP
 	help
 	    Use gcc configure option --enable-default-ssp to turn on -fstack-protector-strong by default.
 
-config GCC_LIBSSP
-	bool
-	prompt "Build gcc libssp" if TOOLCHAINOPTS
-	depends on !USE_MUSL
-	default y if !USE_MUSL
-	help
-	    Enable Stack-Smashing Protection support
-
 config SJLJ_EXCEPTIONS
 	bool
 	prompt "Use setjump()/longjump() exceptions" if TOOLCHAINOPTS
diff --git a/toolchain/gcc/common.mk b/toolchain/gcc/common.mk
index 7fb30285aa..ec3ea8fff1 100644
--- a/toolchain/gcc/common.mk
+++ b/toolchain/gcc/common.mk
@@ -104,6 +104,7 @@ GCC_CONFIGURE:= \
 		--disable-multilib \
 		--disable-libmpx \
 		--disable-nls \
+		--disable-libssp \
 		$(GRAPHITE_CONFIGURE) \
 		--with-host-libstdcxx=-lstdc++ \
 		$(SOFT_FLOAT_CONFIG_OPTION) \
@@ -131,14 +132,6 @@ ifneq ($(CONFIG_GCC_DEFAULT_SSP),)
 		--enable-default-ssp
 endif
 
-ifneq ($(CONFIG_GCC_LIBSSP),)
-  GCC_CONFIGURE+= \
-		--enable-libssp
-else
-  GCC_CONFIGURE+= \
-		--disable-libssp
-endif
-
 ifneq ($(CONFIG_EXTRA_TARGET_ARCH),)
   GCC_CONFIGURE+= \
 		--enable-biarch \
diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk
index db4f0fcc0e..f0b95d3cc7 100644
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@@ -39,7 +39,6 @@ ifeq ($(ARCH),mips64)
   endif
 endif
 
-
 # -Os miscompiles w. 2.24 gcc5/gcc6
 # only -O2 tested by upstream changeset
 # "Optimize i386 syscall inlining for GCC 5"
@@ -61,6 +60,8 @@ GLIBC_CONFIGURE:= \
 		--without-cvs \
 		--enable-add-ons \
 		--$(if $(CONFIG_SOFT_FLOAT),without,with)-fp \
+		  $(if $(CONFIG_PKG_CC_STACKPROTECTOR_REGULAR),--enable-stack-protector=yes) \
+		  $(if $(CONFIG_PKG_CC_STACKPROTECTOR_STRONG),--enable-stack-protector=strong) \
 		--enable-kernel=4.14.0
 
 export libc_cv_ssp=no