--- zzzz-none-000/linux-4.19.183/net/bridge/br_forward.c	2021-03-24 10:07:39.000000000 +0000
+++ bcm63-7530ax-756/linux-4.19.183/net/bridge/br_forward.c	2023-06-28 08:54:21.000000000 +0000
@@ -20,6 +20,11 @@
 #include <linux/if_vlan.h>
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
+#if defined(CONFIG_BCM_KF_BLOG) && defined(CONFIG_BLOG)
+#include <linux/blog.h>
+#endif
+
+#include <avm/pa/avm_pa.h>
 
 /* Don't forward packets to originating port or forwarding disabled */
 static inline int should_deliver(const struct net_bridge_port *p,
@@ -29,8 +34,14 @@
 
 	vg = nbp_vlan_group_rcu(p);
 	return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
+#if defined(CONFIG_BCM_KF_BR_HOOKS)
+		br_allowed_egress(vg, skb) && (p->state == BR_STATE_FORWARDING || bcm_hook_br_should_deliver(skb, p->state)) &&
+		/* The RUNNER cannot flood to a WAN port so we allow flood to it */
+		(nbp_switchdev_allowed_egress(p, skb) || is_netdev_wan(p->dev)) &&
+#else
 		br_allowed_egress(vg, skb) && p->state == BR_STATE_FORWARDING &&
 		nbp_switchdev_allowed_egress(p, skb) &&
+#endif
 		!br_skb_isolated(p, skb);
 }
 
@@ -119,6 +130,9 @@
 			 struct sk_buff *skb, bool local_orig)
 {
 	struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+#if defined(CONFIG_BCM_KF_BLOG) && defined(CONFIG_BLOG)
+	struct sk_buff *orig_skb = skb;
+#endif
 
 	skb = skb_clone(skb, GFP_ATOMIC);
 	if (!skb) {
@@ -126,6 +140,9 @@
 		return -ENOMEM;
 	}
 
+#if defined(CONFIG_BCM_KF_BLOG) && defined(CONFIG_BLOG)
+	blog_clone(orig_skb, blog_ptr(skb));
+#endif
 	__br_forward(prev, skb, local_orig);
 	return 0;
 }
@@ -197,6 +214,20 @@
 	struct net_bridge_port *prev = NULL;
 	struct net_bridge_port *p;
 
+	if (!local_orig && !br_flood_rl(br, skb, skb->dev))
+		goto out;
+
+#if defined(CONFIG_BCM_KF_BLOG) && defined(CONFIG_BLOG)
+	Blog_t * blog_p = blog_ptr(skb);
+
+	if (blog_p && !blog_p->rx.multicast)
+	{
+		blog_skip(skb, blog_skip_reason_br_flood);
+	}
+#endif
+
+	avm_pa_do_not_accelerate(skb);
+
 	list_for_each_entry_rcu(p, &br->port_list, list) {
 		/* Do not flood unicast traffic to ports that turn it off, nor
 		 * other traffic if flood off, except for traffic we originate