Index: sys/netpfil/pf/if_pfsync.c
===================================================================
--- sys/netpfil/pf/if_pfsync.c
+++ sys/netpfil/pf/if_pfsync.c
@@ -79,6 +79,7 @@
 #include <sys/mutex.h>
 #include <sys/priv.h>
 #include <sys/protosw.h>
+#include <sys/sdt.h>
 #include <sys/socket.h>
 #include <sys/sockio.h>
 #include <sys/sysctl.h>
@@ -103,6 +104,34 @@
 #include <netinet/tcp_fsm.h>
 #include <netinet/tcp_seq.h>
 
+SDT_PROVIDER_DEFINE(pf);
+
+SDT_PROBE_DEFINE(pf, pfsync, sendout, entry);
+SDT_PROBE_DEFINE2(pf, pfsync, sendout, queue,
+               "int",
+               "int");
+SDT_PROBE_DEFINE(pf, pfsync, sendout, return);
+SDT_PROBE_DEFINE(pf, pfsync, pfsyncintr, entry);
+SDT_PROBE_DEFINE1(pf, pfsync, pfsyncintr, output,
+		"struct mbuf *");
+SDT_PROBE_DEFINE1(pf, pfsync, pfsyncintr, error,
+		"int");
+SDT_PROBE_DEFINE(pf, pfsync, pfsyncintr, return);
+
+SDT_PROBE_DEFINE(pf, pfsync, input, entry);
+SDT_PROBE_DEFINE1(pf, pfsync, input, action,
+		"int");
+SDT_PROBE_DEFINE(pf, pfsync, input, return);
+
+SDT_PROBE_DEFINE1(pf, pfsync, msg, enqueue,
+		"int");
+SDT_PROBE_DEFINE0(pf, pfsync, msg, queue_full);
+
+SDT_PROBE_DEFINE1(pf, pfsync, msg, process,
+		"int");
+SDT_PROBE_DEFINE(pf, pfsync, pfsync_msg_intr, entry);
+SDT_PROBE_DEFINE(pf, pfsync, pfsync_msg_intr, return);
+
 #define PFSYNC_MINPKT ( \
 	sizeof(struct ip) + \
 	sizeof(struct pfsync_header) + \
@@ -376,6 +405,8 @@
 	KASSERT(msg, ("msg == NULL"));
 	PFSYNC_LOCK_ASSERT(sc);
 
+	SDT_PROBE1(pf, pfsync, msg, process, msg->type);
+
 	/* The state may have expired by the time we get here.
 	 * Deleting doesn't need the key, so that's safe to do. */
 	if (st->timeout >= PFTM_MAX && msg->type != PFSYNC_MSG_DELETE) {
@@ -421,6 +452,8 @@
 	struct pfsync_softc *sc = (struct pfsync_softc*)arg;
 	struct pfsync_msg *msg;
 
+	SDT_PROBE0(pf, pfsync, pfsync_msg_intr, entry);
+
 	CURVNET_SET(sc->sc_ifp->if_vnet);
 	PFSYNC_LOCK(sc);
 
@@ -436,6 +469,8 @@
 	pfsyncintr(sc);
 
 	CURVNET_RESTORE();
+
+	SDT_PROBE0(pf, pfsync, pfsync_msg_intr, return);
 }
 
 static bool
@@ -443,11 +478,14 @@
 {
 	KASSERT(msg->type != 0, ("msg type not set"));
 
+	SDT_PROBE1(pf, pfsync, msg, enqueue, msg->type);
+
 	/* Ensure we don't lose the state before we can process it. */
 	pf_ref_state(msg->st);
 
 	if (! ck_ring_enqueue_mpmc(sc->sc_msgs, sc->sc_msgs_buffer, msg)) {
 		pf_release_state(msg->st);
+		SDT_PROBE0(pf, pfsync, msg, queue_full);
 		return (false);
 	}
 
@@ -786,6 +824,8 @@
 
 	PF_RULES_RLOCK_TRACKER;
 
+	SDT_PROBE0(pf, pfsync, input, entry);
+
 	*mp = NULL;
 	V_pfsyncstats.pfsyncs_ipackets++;
 
@@ -859,6 +899,8 @@
 			goto done;
 		}
 
+		SDT_PROBE1(pf, pfsync, input, action, subh.action);
+
 		count = ntohs(subh.count);
 		V_pfsyncstats.pfsyncs_iacts[subh.action] += count;
 		rv = (*pfsync_acts[subh.action])(&pkt, m, offset, count);
@@ -872,6 +914,8 @@
 	PF_RULES_RUNLOCK();
 
 done:
+	SDT_PROBE0(pf, pfsync, input, return);
+
 	m_freem(m);
 	return (IPPROTO_DONE);
 }
@@ -1741,6 +1785,8 @@
 	    ("%s: sc_len %zu", __func__, sc->sc_len));
 	PFSYNC_LOCK_ASSERT(sc);
 
+	SDT_PROBE0(pf, pfsync, sendout, entry);
+
 	if (ifp->if_bpf == NULL && sc->sc_sync_if == NULL) {
 		pfsync_drop(sc);
 		return;
@@ -1801,6 +1847,8 @@
 		subh->action = pfsync_qs[q].action;
 		subh->count = htons(count);
 		V_pfsyncstats.pfsyncs_oacts[pfsync_qs[q].action] += count;
+
+		SDT_PROBE2(pf, pfsync, sendout, queue, q, count);
 	}
 
 	if (!TAILQ_EMPTY(&sc->sc_upd_req_list)) {
@@ -1867,6 +1915,8 @@
 	}
 	if (schedswi)
 		swi_sched(V_pfsync_swi_cookie, 0);
+
+	SDT_PROBE0(pf, pfsync, sendout, return);
 }
 
 static int
@@ -2464,6 +2514,8 @@
 
 	CURVNET_SET(sc->sc_ifp->if_vnet);
 
+	SDT_PROBE0(pf, pfsync, pfsyncintr, entry);
+
 	PFSYNC_LOCK(sc);
 	if ((sc->sc_flags & PFSYNCF_PUSH) && sc->sc_len > PFSYNC_MINPKT) {
 		pfsync_sendout(0);
@@ -2477,6 +2529,8 @@
 		n = m->m_nextpkt;
 		m->m_nextpkt = NULL;
 
+		SDT_PROBE1(pf, pfsync, pfsyncintr, output, m);
+
 		/*
 		 * We distinguish between a deferral packet and our
 		 * own pfsync packet based on M_SKIP_FIREWALL
@@ -2495,8 +2549,12 @@
 			V_pfsyncstats.pfsyncs_opackets++;
 		else
 			V_pfsyncstats.pfsyncs_oerrors++;
+
+		SDT_PROBE1(pf, pfsync, pfsyncintr, error, ret);
 	}
 	CURVNET_RESTORE();
+
+	SDT_PROBE0(pf, pfsync, pfsyncintr, return);
 }
 
 static int