diff --git a/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9999-flow-offload-add-mtkhnat-flow-accounting.patch b/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9999-flow-offload-add-mtkhnat-flow-accounting.patch
new file mode 100644
index 0000000..1a5c255
--- /dev/null
+++ b/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9999-flow-offload-add-mtkhnat-flow-accounting.patch
@@ -0,0 +1,432 @@
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 4f53794..dc5d050 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -3944,7 +3944,8 @@ static int mtk_probe(struct platform_device *pdev)
+ 		for (i = 0; i < eth->ppe_num; i++) {
+ 			eth->ppe[i] = mtk_ppe_init(eth,
+ 						   eth->base + MTK_ETH_PPE_BASE + i * 0x400,
+-						   2, eth->soc->hash_way, i);
++						   2, eth->soc->hash_way, i,
++						   eth->soc->has_accounting);
+ 			if (!eth->ppe[i]) {
+ 				err = -ENOMEM;
+ 				goto err_free_dev;
+@@ -4057,6 +4058,7 @@ static const struct mtk_soc_data mt2701_data = {
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
+ 	.has_sram = false,
++	.has_accounting = false,
+ 	.hash_way = 2,
+ 	.offload_version = 2,
+ 	.txrx = {
+@@ -4073,6 +4075,7 @@ static const struct mtk_soc_data mt7621_data = {
+ 	.required_clks = MT7621_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_sram = false,
++	.has_accounting = false,
+ 	.hash_way = 2,
+ 	.offload_version = 2,
+ 	.txrx = {
+@@ -4090,6 +4093,7 @@ static const struct mtk_soc_data mt7622_data = {
+ 	.required_clks = MT7622_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_sram = false,
++	.has_accounting = true,
+ 	.hash_way = 2,
+ 	.offload_version = 2,
+ 	.txrx = {
+@@ -4106,6 +4110,7 @@ static const struct mtk_soc_data mt7623_data = {
+ 	.required_clks = MT7623_CLKS_BITMAP,
+ 	.required_pctl = true,
+ 	.has_sram = false,
++	.has_accounting = false,
+ 	.hash_way = 2,
+ 	.offload_version = 2,
+ 	.txrx = {
+@@ -4123,6 +4128,7 @@ static const struct mtk_soc_data mt7629_data = {
+ 	.required_clks = MT7629_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_sram = false,
++	.has_accounting = true,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+@@ -4138,6 +4144,7 @@ static const struct mtk_soc_data mt7986_data = {
+ 	.required_clks = MT7986_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_sram = true,
++	.has_accounting = true,
+ 	.hash_way = 4,
+ 	.offload_version = 2,
+ 	.txrx = {
+@@ -4155,6 +4162,7 @@ static const struct mtk_soc_data mt7981_data = {
+ 	.required_clks = MT7981_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_sram = true,
++	.has_accounting = true,
+ 	.hash_way = 4,
+ 	.offload_version = 2,
+ 	.txrx = {
+@@ -4171,6 +4179,7 @@ static const struct mtk_soc_data rt5350_data = {
+ 	.required_clks = MT7628_CLKS_BITMAP,
+ 	.required_pctl = false,
+ 	.has_sram = false,
++	.has_accounting = false,
+ 	.txrx = {
+ 		.txd_size = sizeof(struct mtk_tx_dma),
+ 		.rxd_size = sizeof(struct mtk_rx_dma),
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+index f659633..5e16fa8 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+@@ -1213,6 +1213,7 @@ struct mtk_soc_data {
+ 	u8		offload_version;
+ 	netdev_features_t hw_features;
+ 	bool		has_sram;
++	bool		has_accounting;
+ 	struct {
+ 		u32	txd_size;
+ 		u32	rxd_size;
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.c b/drivers/net/ethernet/mediatek/mtk_ppe.c
+index 918aa22..8c036cd 100755
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -74,6 +74,46 @@ static int mtk_ppe_wait_busy(struct mtk_ppe *ppe)
+ 	return ret;
+ }
+ 
++static int mtk_ppe_mib_wait_busy(struct mtk_ppe *ppe)
++{
++	int ret;
++	u32 val;
++
++	ret = readl_poll_timeout(ppe->base + MTK_PPE_MIB_SER_CR, val,
++				 !(val & MTK_PPE_MIB_SER_CR_ST),
++				 20, MTK_PPE_WAIT_TIMEOUT_US);
++
++	if (ret)
++		dev_err(ppe->dev, "MIB table busy");
++
++	return ret;
++}
++
++int mtk_mib_entry_read(struct mtk_ppe *ppe, u16 index, u64 *bytes, u64 *packets)
++{
++	u32 val, cnt_r0, cnt_r1, cnt_r2;
++	u32 byte_cnt_low, byte_cnt_high, pkt_cnt_low, pkt_cnt_high;
++
++	val = FIELD_PREP(MTK_PPE_MIB_SER_CR_ADDR, index) | MTK_PPE_MIB_SER_CR_ST;
++	ppe_w32(ppe, MTK_PPE_MIB_SER_CR, val);
++
++	if (mtk_ppe_mib_wait_busy(ppe))
++		return -ETIMEDOUT;
++
++	cnt_r0 = readl(ppe->base + MTK_PPE_MIB_SER_R0);
++	cnt_r1 = readl(ppe->base + MTK_PPE_MIB_SER_R1);
++	cnt_r2 = readl(ppe->base + MTK_PPE_MIB_SER_R2);
++
++	byte_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R0_BYTE_CNT_LOW, cnt_r0);
++	byte_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH, cnt_r1);
++	pkt_cnt_low = FIELD_GET(MTK_PPE_MIB_SER_R1_PKT_CNT_LOW, cnt_r1);
++	pkt_cnt_high = FIELD_GET(MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH, cnt_r2);
++	*bytes = ((u64)byte_cnt_high << 32) | byte_cnt_low;
++	*packets = (pkt_cnt_high << 16) | pkt_cnt_low;
++
++	return 0;
++}
++
+ static void mtk_ppe_cache_clear(struct mtk_ppe *ppe)
+ {
+ 	ppe_set(ppe, MTK_PPE_CACHE_CTL, MTK_PPE_CACHE_CTL_CLEAR);
+@@ -412,6 +452,14 @@ __mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ 							      MTK_FOE_STATE_INVALID);
+ 		dma_wmb();
++
++		if (ppe->accounting) {
++			struct mtk_foe_accounting *acct;
++
++			acct = ppe->acct_table + entry->hash * sizeof(*acct);
++			acct->packets = 0;
++			acct->bytes = 0;
++		}
+	}
+ 	entry->hash = 0xffff;
+ 
+ 	if (entry->type != MTK_FLOW_TYPE_L2_SUBFLOW)
+@@ -513,6 +560,16 @@ __mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_foe_entry *entry,
+ 	wmb();
+ 	hwe->ib1 = entry->ib1;
+ 
++	if (ppe->accounting) {
++		int type;
++
++		type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
++		if (type >= MTK_PPE_PKT_TYPE_IPV4_DSLITE)
++			hwe->ipv6.ib2 |= MTK_FOE_IB2_MIB_CNT;
++		else
++			hwe->ipv4.ib2 |= MTK_FOE_IB2_MIB_CNT;
++	}
++
+ 	dma_wmb();
+ 
+ 	mtk_ppe_cache_clear(ppe);
+@@ -618,8 +675,6 @@ void __mtk_ppe_check_skb(struct mtk_ppe *ppe, struct sk_buff *skb, u16 hash)
+ 		}
+ 
+ 		if (found || !mtk_flow_entry_match(entry, hwe)) {
+-			if (entry->hash != 0xffff)
+-				entry->hash = 0xffff;
+ 			continue;
+ 		}
+ 
+@@ -676,12 +731,40 @@ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)
+ 	return __mtk_foe_entry_idle_time(ppe, entry->data.ib1);
+ }
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int version, int way, int id)
++struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index, struct mtk_foe_accounting *diff)
++{
++	struct mtk_foe_accounting *acct;
++	int size = sizeof(struct mtk_foe_accounting);
++	u64 bytes, packets;
++
++	if (!ppe->accounting)
++		return NULL;
++
++	if (mtk_mib_entry_read(ppe, index, &bytes, &packets))
++		return NULL;
++
++	acct = ppe->acct_table + index * size;
++
++	acct->bytes += bytes;
++	acct->packets += packets;
++
++	if (diff) {
++		diff->bytes = bytes;
++		diff->packets = packets;
++	}
++
++	return acct;
++}
++
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int version, int way, int id,
++			     int accounting)
+ {
+ 	struct device *dev = eth->dev;
+ 	struct mtk_foe_entry *foe;
++	struct mtk_mib_entry *mib;
+ 	struct mtk_ppe *ppe;
+ 	struct hlist_head *flow;
++	struct mtk_foe_accounting *acct;
+ 
+ 	ppe = devm_kzalloc(dev, sizeof(*ppe), GFP_KERNEL);
+ 	if (!ppe)
+@@ -698,6 +781,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int versio
+ 	ppe->version = version;
+ 	ppe->way = way;
+ 	ppe->id = id;
++	ppe->accounting = accounting;
+ 
+ 	foe = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*foe),
+ 				  &ppe->foe_phys, GFP_KERNEL);
+@@ -713,6 +797,24 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int versio
+ 
+ 	ppe->foe_flow = flow;
+ 
++	if (accounting) {
++		mib = dmam_alloc_coherent(ppe->dev, MTK_PPE_ENTRIES * sizeof(*mib),
++				  &ppe->mib_phys, GFP_KERNEL);
++		if (!foe)
++			return NULL;
++
++		memset(mib, 0, MTK_PPE_ENTRIES * sizeof(*mib));
++
++		ppe->mib_table = mib;
++
++		acct = devm_kzalloc(dev, MTK_PPE_ENTRIES * sizeof(*acct),
++				    GFP_KERNEL);
++		if (!acct)
++			return NULL;
++
++		ppe->acct_table = acct;
++	}
++
+ 	return ppe;
+ }
+ 
+@@ -811,6 +949,13 @@ int mtk_ppe_start(struct mtk_ppe *ppe)
+ 	ppe_w32(ppe, MTK_PPE_DEFAULT_CPU_PORT1, 0xcb777);
+ 	ppe_w32(ppe, MTK_PPE_SBW_CTRL, 0x7f);
+ 
++	if (ppe->accounting && ppe->mib_phys) {
++		ppe_w32(ppe, MTK_PPE_MIB_TB_BASE, ppe->mib_phys);
++		ppe_m32(ppe, MTK_PPE_MIB_CFG, MTK_PPE_MIB_CFG_EN, MTK_PPE_MIB_CFG_EN);
++		ppe_m32(ppe, MTK_PPE_MIB_CFG, MTK_PPE_MIB_CFG_RD_CLR, MTK_PPE_MIB_CFG_RD_CLR);
++		ppe_m32(ppe, MTK_PPE_MIB_CACHE_CTL, MTK_PPE_MIB_CACHE_CTL_EN, MTK_PPE_MIB_CFG_RD_CLR);
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe.h b/drivers/net/ethernet/mediatek/mtk_ppe.h
+index 3d6928c..8076e5d 100644
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.h
+@@ -270,6 +270,20 @@ struct mtk_flow_entry {
+ 	unsigned long cookie;
+ };
+ 
++struct mtk_mib_entry {
++	u32	byt_cnt_l;
++	u16	byt_cnt_h;
++	u32	pkt_cnt_l;
++	u8	pkt_cnt_h;
++	u8	_rsv0;
++	u32	_rsv1;
++} __packed;
++
++struct mtk_foe_accounting {
++	u64	bytes;
++	u64	packets;
++};
++
+ struct mtk_ppe {
+ 	struct mtk_eth *eth;
+ 	struct device *dev;
+@@ -277,10 +291,14 @@ struct mtk_ppe {
+ 	int version;
+ 	int id;
+ 	int way;
++	int accounting;
+ 
+ 	struct mtk_foe_entry *foe_table;
+ 	dma_addr_t foe_phys;
+ 
++	struct mtk_mib_entry *mib_table;
++	dma_addr_t mib_phys;
++
+ 	u16 foe_check_time[MTK_PPE_ENTRIES];
+ 	struct hlist_head *foe_flow;
+ 
+@@ -289,7 +307,8 @@ struct mtk_ppe {
+ 	void *acct_table;
+ };
+ 
+-struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int version, int way, int id);
++struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, int version, int way, int id,
++			     int accounting);
+ int mtk_ppe_start(struct mtk_ppe *ppe);
+ int mtk_ppe_stop(struct mtk_ppe *ppe);
+ 
+@@ -340,5 +359,6 @@ int mtk_foe_entry_set_wdma(struct mtk_foe_entry *entry, int wdma_idx, int txq,
+ int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ void mtk_foe_entry_clear(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
+ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
++struct mtk_foe_accounting *mtk_foe_entry_get_mib(struct mtk_ppe *ppe, u32 index, struct mtk_foe_accounting *diff);
+ 
+ #endif
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+index f4ebe59..d713e2e 100644
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c
+@@ -81,6 +81,7 @@ mtk_ppe_debugfs_foe_show(struct seq_file *m, struct mtk_ppe *ppe, bool bind)
+ 		struct mtk_foe_entry *entry = &ppe->foe_table[i];
+ 		struct mtk_foe_mac_info *l2;
+ 		struct mtk_flow_addr_info ai = {};
++		struct mtk_foe_accounting *acct;
+ 		unsigned char h_source[ETH_ALEN];
+ 		unsigned char h_dest[ETH_ALEN];
+ 		int type, state;
+@@ -94,6 +95,8 @@ mtk_ppe_debugfs_foe_show(struct seq_file *m, struct mtk_ppe *ppe, bool bind)
+ 		if (bind && state != MTK_FOE_STATE_BIND)
+ 			continue;
+ 
++		acct = mtk_foe_entry_get_mib(ppe, i, NULL);
++
+ 		type = FIELD_GET(MTK_FOE_IB1_PACKET_TYPE, entry->ib1);
+ 		seq_printf(m, "%05x %s %7s", i,
+ 			   mtk_foe_entry_state_str(state),
+@@ -154,9 +157,12 @@ mtk_ppe_debugfs_foe_show(struct seq_file *m, struct mtk_ppe *ppe, bool bind)
+ 		*((__be16 *)&h_dest[4]) = htons(l2->dest_mac_lo);
+ 
+ 		seq_printf(m, " eth=%pM->%pM etype=%04x"
+-			      " vlan=%d,%d ib1=%08x ib2=%08x\n",
++			      " vlan=%d,%d ib1=%08x ib2=%08x"
++			      " packets=%lld bytes=%lld\n",
+ 			   h_source, h_dest, ntohs(l2->etype),
+-			   l2->vlan1, l2->vlan2, entry->ib1, ib2);
++			   l2->vlan1, l2->vlan2, entry->ib1, ib2,
++			   acct->packets, acct->bytes
++			   );
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+index 2f7d76d..f258539 100755
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -504,6 +504,7 @@ static int
+ mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
+ {
+ 	struct mtk_flow_entry *entry;
++	struct mtk_foe_accounting diff;
+ 	u32 idle;
+ 	int i;
+ 
+@@ -516,6 +517,12 @@ mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
+ 	idle = mtk_foe_entry_idle_time(eth->ppe[i], entry);
+ 	f->stats.lastused = jiffies - idle * HZ;
+ 
++	if (entry->hash != 0xFFFF) {
++		mtk_foe_entry_get_mib(eth->ppe[i], entry->hash, &diff);
++		f->stats.pkts += diff.packets;
++		f->stats.bytes += diff.bytes;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+index d319f18..9eb7a0d 100644
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_regs.h
+@@ -145,6 +146,20 @@ enum {
+ 
+ #define MTK_PPE_MIB_TB_BASE			0x338
+ 
++#define MTK_PPE_MIB_SER_CR			0x33C
++#define MTK_PPE_MIB_SER_CR_ST			BIT(16)
++#define MTK_PPE_MIB_SER_CR_ADDR			GENMASK(13, 0)
++
++#define MTK_PPE_MIB_SER_R0			0x340
++#define MTK_PPE_MIB_SER_R0_BYTE_CNT_LOW		GENMASK(31, 0)
++
++#define MTK_PPE_MIB_SER_R1			0x344
++#define MTK_PPE_MIB_SER_R1_PKT_CNT_LOW		GENMASK(31, 16)
++#define MTK_PPE_MIB_SER_R1_BYTE_CNT_HIGH	GENMASK(15, 0)
++
++#define MTK_PPE_MIB_SER_R2			0x348
++#define MTK_PPE_MIB_SER_R2_PKT_CNT_HIGH		GENMASK(23, 0)
++
+ #define MTK_PPE_MIB_CACHE_CTL			0x350
+ #define MTK_PPE_MIB_CACHE_CTL_EN		BIT(0)
+ #define MTK_PPE_MIB_CACHE_CTL_FLUSH		BIT(2)
+diff --git a/net/netfilter/xt_FLOWOFFLOAD.c b/net/netfilter/xt_FLOWOFFLOAD.c
+index 8547f4a..c175e4d 100644
+--- a/net/netfilter/xt_FLOWOFFLOAD.c
++++ b/net/netfilter/xt_FLOWOFFLOAD.c
+@@ -700,12 +781,12 @@ static int __init xt_flowoffload_tg_init(void)
+ 	if (ret)
+ 		goto cleanup;
+ 
+-	flowtable[1].ft.flags = NF_FLOWTABLE_HW_OFFLOAD;
++	flowtable[1].ft.flags = NF_FLOWTABLE_HW_OFFLOAD | NF_FLOWTABLE_COUNTER;
+ 
+ 	ret = xt_register_target(&offload_tg_reg);
+ 	if (ret)
+ 		goto cleanup2;
+ 
+ 	return 0;
+ 
+ cleanup2: