In D46045#1049664, @kib wrote:

In D46045#1049663, @np wrote:

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):

#define ipseclog(x) do { if (V_ipsec_debug) log x; } while (0)
/* for openbsd compatibility */
#ifdef IPSEC_DEBUG
#define IPSEC_DEBUG_DECLARE(x) x
#define DPRINTF(x) do { if (V_ipsec_debug) printf x; } while (0)
#else
#define IPSEC_DEBUG_DECLARE(x)
#define DPRINTF(x)
#endif

I would say yes. I remember trying to use existing debug, but it did not mixed well: it was too verbose in parts we do not needed.

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):

Incorporate feedback from jhb.

I went over all of this and related revisions recently. The high level comments are here and the rest will go next to the code they apply to.

{F86253090} I uploaded an attachment with all the changes I had to make to get this working. Please incorporate it into this revision.

This PF change looks correct but there needs to be matching change in the VF driver that reads the VLAN settings and acts on it.