diff --git a/target/linux/mediatek/patches-5.4/999-4500-mtk-ppp-offload-support.patch b/target/linux/mediatek/patches-5.4/999-4500-mtk-ppp-offload-support.patch
new file mode 100644
index 0000000..1409f9f
--- /dev/null
+++ b/target/linux/mediatek/patches-5.4/999-4500-mtk-ppp-offload-support.patch
@@ -0,0 +1,65 @@
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -296,6 +296,9 @@ static void unit_put(struct idr *p, int
+ static void *unit_find(struct idr *p, int n);
+ static void ppp_setup(struct net_device *dev);
+ 
++struct sock *ppp_netdev_get_sock(struct net_device *dev);
++EXPORT_SYMBOL(ppp_netdev_get_sock);
++
+ static const struct net_device_ops ppp_netdev_ops;
+ 
+ static struct class *ppp_class;
+@@ -1660,6 +1663,40 @@ ppp_send_frame(struct ppp *ppp, struct s
+ 	++ppp->dev->stats.tx_errors;
+ }
+ 
++struct sock *ppp_netdev_get_sock(struct net_device *dev)
++{
++	struct list_head *list;
++	struct channel *pch;
++	struct ppp *ppp;
++	struct sock *sk;
++
++	if (!dev)
++		return ERR_PTR(-EINVAL);
++
++	ppp = netdev_priv(dev);
++
++	list = &ppp->channels;
++	if (list_empty(list))
++		 /* nowhere to send the packet */
++		return ERR_PTR(-EINVAL);
++
++	if (ppp->flags & SC_MULTILINK)
++		/* not doing multilink: send it down the first channel */
++		return ERR_PTR(-EPERM);
++
++	list = list->next;
++	pch = list_entry(list, struct channel, clist);
++
++	spin_lock(&pch->downl);
++	if (pch->chan)
++		sk = (struct sock *)pch->chan->private;
++	else
++		sk = ERR_PTR(-EINVAL);
++	spin_unlock(&pch->downl);
++
++	return sk;
++}
++
+ /*
+  * Try to send the frame in xmit_pending.
+  * The caller should have the xmit path locked.
+--- a/include/linux/ppp_channel.h
++++ b/include/linux/ppp_channel.h
+@@ -75,6 +75,9 @@ extern int ppp_unit_number(struct ppp_ch
+ /* Get the device name associated with a channel, or NULL if none */
+ extern char *ppp_dev_name(struct ppp_channel *);
+ 
++/* Get the socket structure of a given ppp netdev */
++extern struct sock *ppp_netdev_get_sock(struct net_device *dev);
++
+ /*
+  * SMP locking notes:
+  * The channel code must ensure that when it calls ppp_unregister_channel,
diff --git a/target/linux/mediatek/patches-5.4/999-4500-mtk-l2tp-offload-support.patch b/target/linux/mediatek/patches-5.4/999-4501-mtk-l2tp-offload-support.patch
similarity index 100%
rename from target/linux/mediatek/patches-5.4/999-4500-mtk-l2tp-offload-support.patch
rename to target/linux/mediatek/patches-5.4/999-4501-mtk-l2tp-offload-support.patch
diff --git a/target/linux/mediatek/patches-5.4/999-4501-mtk-pptp-offload-support.patch b/target/linux/mediatek/patches-5.4/999-4501-mtk-pptp-offload-support.patch
new file mode 100644
index 0000000..ec218e1
--- /dev/null
+++ b/target/linux/mediatek/patches-5.4/999-4501-mtk-pptp-offload-support.patch
@@ -0,0 +1,100 @@
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -33,6 +33,7 @@
+ #include <net/route.h>
+ #include <net/gre.h>
+ #include <net/pptp.h>
++#include <net/netfilter/nf_flow_table.h>
+ 
+ #include <linux/uaccess.h>
+ 
+@@ -40,6 +41,9 @@
+ 
+ #define MAX_CALLID 65535
+ 
++int (*mtk_pptp_seq_next)(u16 call_id, u32 *val) = NULL;
++EXPORT_SYMBOL(mtk_pptp_seq_next);
++
+ static DECLARE_BITMAP(callid_bitmap, MAX_CALLID + 1);
+ static struct pppox_sock __rcu **callid_sock;
+ 
+@@ -128,6 +132,26 @@ static void del_chan(struct pppox_sock *
+ 	spin_unlock(&chan_lock);
+ }
+ 
++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
++static int pptp_flow_offload_check(struct ppp_channel *chan,
++				   struct flow_offload_hw_path *path)
++{
++	struct sock *sk = (struct sock *)chan->private;
++	struct pppox_sock *po = pppox_sk(sk);
++
++	if (path->flags & FLOW_OFFLOAD_PATH_TNL)
++		return -EEXIST;
++
++	if (sk_pppox(po)->sk_state & PPPOX_DEAD)
++		return -EINVAL;
++
++	path->flags |= FLOW_OFFLOAD_PATH_TNL;
++	path->tnl_type = FLOW_OFFLOAD_TNL_PPTP;
++
++	return 0;
++}
++#endif /* IS_ENABLED(CONFIG_NF_FLOW_TABLE) */
++
+ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ {
+ 	struct sock *sk = (struct sock *) chan->private;
+@@ -140,6 +164,7 @@ static int pptp_xmit(struct ppp_channel
+ 	int islcp;
+ 	int len;
+ 	unsigned char *data;
++	u32 seq_sent_hw;
+ 	__u32 seq_recv;
+ 
+ 
+@@ -204,7 +229,14 @@ static int pptp_xmit(struct ppp_channel
+ 	hdr->gre_hd.protocol = GRE_PROTO_PPP;
+ 	hdr->call_id = htons(opt->dst_addr.call_id);
+ 
+-	hdr->seq = htonl(++opt->seq_sent);
++	if (mtk_pptp_seq_next && !mtk_pptp_seq_next(opt->dst_addr.call_id,
++						    &seq_sent_hw)) {
++		opt->seq_sent = seq_sent_hw;
++		hdr->seq = htonl(opt->seq_sent);
++	} else {
++		hdr->seq = htonl(++opt->seq_sent);
++	}
++
+ 	if (opt->ack_sent != seq_recv)	{
+ 		/* send ack with this message */
+ 		hdr->gre_hd.flags |= GRE_ACK;
+@@ -598,6 +630,9 @@ static int pptp_ppp_ioctl(struct ppp_cha
+ static const struct ppp_channel_ops pptp_chan_ops = {
+ 	.start_xmit = pptp_xmit,
+ 	.ioctl      = pptp_ppp_ioctl,
++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
++	.flow_offload_check = pptp_flow_offload_check,
++#endif /* IS_ENABLED(CONFIG_NF_FLOW_TABLE) */
+ };
+ 
+ static struct proto pptp_sk_proto __read_mostly = {
+--- a/include/net/pptp.h
++++ b/include/net/pptp.h
+@@ -2,6 +2,8 @@
+ #ifndef _NET_PPTP_H
+ #define _NET_PPTP_H
+ 
++#include <net/gre.h>
++
+ #define PPP_LCP_ECHOREQ 0x09
+ #define PPP_LCP_ECHOREP 0x0A
+ #define SC_RCV_BITS     (SC_RCV_B7_1|SC_RCV_B7_0|SC_RCV_ODDP|SC_RCV_EVNP)
+@@ -20,5 +22,7 @@ struct pptp_gre_header {
+ 	__be32 ack;
+ } __packed;
+ 
++/* symbol exported from linux kernel driver/net/ppp/pptp.c */
++extern int (*mtk_pptp_seq_next)(uint16_t call_id, uint32_t *val);
+ 
+ #endif