From 83c388046af63997d741eee25ce856f942044c2d Mon Sep 17 00:00:00 2001
From: Peter Avalos <pavalos@dragonflybsd.org>
Date: Wed, 2 Mar 2011 19:34:00 -1000
Subject: [PATCH] Remove insque()/remque() from kernel code.

This transitions everything over to using the appropriate macros from
<sys/queue.h>.
---
 sys/netinet/ip_input.c        | 77 +++++++++++++++++++----------------
 sys/netinet/ip_var.h          |  2 +-
 sys/netproto/ipx/ipx_input.c  | 14 +++----
 sys/netproto/ipx/ipx_pcb.c    | 19 +++++----
 sys/netproto/ipx/ipx_pcb.h    | 10 ++---
 sys/netproto/ipx/ipx_usrreq.c |  4 +-
 sys/netproto/ipx/ipx_var.h    |  2 +-
 sys/netproto/ipx/spx.h        |  5 +--
 sys/netproto/ipx/spx_usrreq.c | 61 ++++++++++-----------------
 sys/sys/queue.h               | 46 ---------------------
 10 files changed, 90 insertions(+), 150 deletions(-)

diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 632dfff301..630c1b670a 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -264,7 +264,7 @@ SYSCTL_STRUCT(_net_inet_ip, IPCTL_STATS, stats, CTLFLAG_RW,
 #define	IPREASS_HASH(x,y)						\
     (((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK)
 
-static struct ipq ipq[IPREASS_NHASH];
+static TAILQ_HEAD(ipqhead, ipq) ipq[IPREASS_NHASH];
 
 #ifdef IPCTL_DEFMTU
 SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW,
@@ -313,7 +313,7 @@ static struct malloc_pipe ipq_mpipe;
 
 static void		save_rte(struct mbuf *, u_char *, struct in_addr);
 static int		ip_dooptions(struct mbuf *m, int, struct sockaddr_in *);
-static void		ip_freef(struct ipq *);
+static void		ip_freef(struct ipqhead *, struct ipq *);
 static void		ip_input_handler(netmsg_t);
 
 /*
@@ -361,7 +361,7 @@ ip_init(void)
 	}
 
 	for (i = 0; i < IPREASS_NHASH; i++)
-		ipq[i].next = ipq[i].prev = &ipq[i];
+		TAILQ_INIT(&ipq[i]);
 
 	maxnipq = nmbclusters / 32;
 	maxfragsperpacket = 16;
@@ -978,6 +978,7 @@ ip_reass(struct mbuf *m)
 	struct mbuf *p = NULL, *q, *nq;
 	struct mbuf *n;
 	struct ipq *fp = NULL;
+	struct ipqhead *head;
 	int hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 	int i, next;
 	u_short sum;
@@ -995,7 +996,8 @@ ip_reass(struct mbuf *m)
 	 * Look for queue of fragments of this datagram.
 	 */
 	lwkt_gettoken(&ipq_token);
-	for (fp = ipq[sum].next; fp != &ipq[sum]; fp = fp->next) {
+	head = &ipq[sum];
+	TAILQ_FOREACH(fp, head, ipq_list) {
 		if (ip->ip_id == fp->ipq_id &&
 		    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
 		    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
@@ -1015,19 +1017,23 @@ ip_reass(struct mbuf *m)
 		 * drop something from the tail of the current queue
 		 * before proceeding further
 		 */
-		if (ipq[sum].prev == &ipq[sum]) {   /* gak */
+		struct ipq *q = TAILQ_LAST(head, ipqhead);
+		if (q == NULL) {
+			/*
+			 * The current queue is empty,
+			 * so drop from one of the others.
+			 */
 			for (i = 0; i < IPREASS_NHASH; i++) {
-				if (ipq[i].prev != &ipq[i]) {
-					ipstat.ips_fragtimeout +=
-					    ipq[i].prev->ipq_nfrags;
-					ip_freef(ipq[i].prev);
+				struct ipq *r = TAILQ_LAST(&ipq[i], ipqhead);
+				if (r) {
+					ipstat.ips_fragtimeout += r->ipq_nfrags;
+					ip_freef(&ipq[i], r);
 					break;
 				}
 			}
 		} else {
-			ipstat.ips_fragtimeout +=
-			    ipq[sum].prev->ipq_nfrags;
-			ip_freef(ipq[sum].prev);
+			ipstat.ips_fragtimeout += q->ipq_nfrags;
+			ip_freef(head, q);
 		}
 	}
 found:
@@ -1078,7 +1084,7 @@ found:
 	if (fp == NULL) {
 		if ((fp = mpipe_alloc_nowait(&ipq_mpipe)) == NULL)
 			goto dropfrag;
-		insque(fp, &ipq[sum]);
+		TAILQ_INSERT_HEAD(head, fp, ipq_list);
 		nipq++;
 		fp->ipq_nfrags = 1;
 		fp->ipq_ttl = IPFRAGTTL;
@@ -1167,7 +1173,7 @@ inserted:
 		if (GETIP(q)->ip_off != next) {
 			if (fp->ipq_nfrags > maxfragsperpacket) {
 				ipstat.ips_fragdropped += fp->ipq_nfrags;
-				ip_freef(fp);
+				ip_freef(head, fp);
 			}
 			goto done;
 		}
@@ -1177,7 +1183,7 @@ inserted:
 	if (p->m_flags & M_FRAG) {
 		if (fp->ipq_nfrags > maxfragsperpacket) {
 			ipstat.ips_fragdropped += fp->ipq_nfrags;
-			ip_freef(fp);
+			ip_freef(head, fp);
 		}
 		goto done;
 	}
@@ -1190,7 +1196,7 @@ inserted:
 	if (next + (IP_VHL_HL(ip->ip_vhl) << 2) > IP_MAXPACKET) {
 		ipstat.ips_toolong++;
 		ipstat.ips_fragdropped += fp->ipq_nfrags;
-		ip_freef(fp);
+		ip_freef(head, fp);
 		goto done;
 	}
 
@@ -1230,7 +1236,7 @@ inserted:
 	ip->ip_len = next;
 	ip->ip_src = fp->ipq_src;
 	ip->ip_dst = fp->ipq_dst;
-	remque(fp);
+	TAILQ_REMOVE(head, fp, ipq_list);
 	nipq--;
 	mpipe_free(&ipq_mpipe, fp);
 	m->m_len += (IP_VHL_HL(ip->ip_vhl) << 2);
@@ -1277,14 +1283,14 @@ done:
  * Called with ipq_token held.
  */
 static void
-ip_freef(struct ipq *fp)
+ip_freef(struct ipqhead *fhp, struct ipq *fp)
 {
 	struct mbuf *q;
 
 	/*
 	 * Remove first to protect against blocking
 	 */
-	remque(fp);
+	TAILQ_REMOVE(fhp, fp, ipq_list);
 
 	/*
 	 * Clean out at our leisure
@@ -1307,20 +1313,17 @@ ip_freef(struct ipq *fp)
 void
 ip_slowtimo(void)
 {
-	struct ipq *fp;
+	struct ipq *fp, *fp_temp;
+	struct ipqhead *head;
 	int i;
 
 	lwkt_gettoken(&ipq_token);
 	for (i = 0; i < IPREASS_NHASH; i++) {
-		fp = ipq[i].next;
-		if (fp == NULL)
-			continue;
-		while (fp != &ipq[i]) {
-			--fp->ipq_ttl;
-			fp = fp->next;
-			if (fp->prev->ipq_ttl == 0) {
-				ipstat.ips_fragtimeout += fp->prev->ipq_nfrags;
-				ip_freef(fp->prev);
+		head = &ipq[i];
+		TAILQ_FOREACH_MUTABLE(fp, head, ipq_list, fp_temp) {
+			if (--fp->ipq_ttl == 0) {
+				ipstat.ips_fragtimeout += fp->ipq_nfrags;
+				ip_freef(head, fp);
 			}
 		}
 	}
@@ -1331,11 +1334,11 @@ ip_slowtimo(void)
 	 */
 	if (maxnipq >= 0 && nipq > maxnipq) {
 		for (i = 0; i < IPREASS_NHASH; i++) {
-			while (nipq > maxnipq &&
-				(ipq[i].next != &ipq[i])) {
+			head = &ipq[i];
+			while (nipq > maxnipq && !TAILQ_EMPTY(head)) {
 				ipstat.ips_fragdropped +=
-				    ipq[i].next->ipq_nfrags;
-				ip_freef(ipq[i].next);
+				    TAILQ_FIRST(head)->ipq_nfrags;
+				ip_freef(head, TAILQ_FIRST(head));
 			}
 		}
 	}
@@ -1349,13 +1352,15 @@ ip_slowtimo(void)
 void
 ip_drain(void)
 {
+	struct ipqhead *head;
 	int i;
 
 	lwkt_gettoken(&ipq_token);
 	for (i = 0; i < IPREASS_NHASH; i++) {
-		while (ipq[i].next != &ipq[i]) {
-			ipstat.ips_fragdropped += ipq[i].next->ipq_nfrags;
-			ip_freef(ipq[i].next);
+		head = &ipq[i];
+		while (!TAILQ_EMPTY(head)) {
+			ipstat.ips_fragdropped += TAILQ_FIRST(head)->ipq_nfrags;
+			ip_freef(head, TAILQ_FIRST(head));
 		}
 	}
 	lwkt_reltoken(&ipq_token);
diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
index b5a0e140be..e68e4c827b 100644
--- a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -77,7 +77,7 @@ struct ipovly {
  * be reclaimed if memory becomes tight.
  */
 struct ipq {
-	struct	ipq *next,*prev;	/* to other reass headers */
+	TAILQ_ENTRY(ipq) ipq_list;	/* to other reass headers */
 	u_char	ipq_ttl;		/* time for reass q to live */
 	u_char	ipq_p;			/* protocol of this fragment */
 	u_short	ipq_id;			/* sequence id for reassembly */
diff --git a/sys/netproto/ipx/ipx_input.c b/sys/netproto/ipx/ipx_input.c
index 831cdbb634..9f52d8768c 100644
--- a/sys/netproto/ipx/ipx_input.c
+++ b/sys/netproto/ipx/ipx_input.c
@@ -87,8 +87,8 @@ struct	sockaddr_ipx ipx_netmask, ipx_hostmask;
 
 static	u_short allones[] = {-1, -1, -1};
 
-struct	ipxpcb ipxpcb;
-struct	ipxpcb ipxrawpcb;
+struct	ipxpcbhead ipxpcb_list;
+struct	ipxpcbhead ipxrawpcb_list;
 
 long	ipx_pexseq;
 
@@ -108,8 +108,8 @@ ipx_init(void)
 	ipx_broadhost = *(union ipx_host *)allones;
 
 	read_random(&ipx_pexseq, sizeof ipx_pexseq);
-	ipxpcb.ipxp_next = ipxpcb.ipxp_prev = &ipxpcb;
-	ipxrawpcb.ipxp_next = ipxrawpcb.ipxp_prev = &ipxrawpcb;
+	LIST_INIT(&ipxpcb_list);
+	LIST_INIT(&ipxrawpcb_list);
 
 	ipx_netmask.sipx_len = 6;
 	ipx_netmask.sipx_addr.x_net = ipx_broadnet;
@@ -153,8 +153,7 @@ ipxintr(netmsg_t msg)
 	/*
 	 * Give any raw listeners a crack at the packet
 	 */
-	for (ipxp = ipxrawpcb.ipxp_next; ipxp != &ipxrawpcb;
-	     ipxp = ipxp->ipxp_next) {
+	LIST_FOREACH(ipxp, &ipxrawpcb_list, ipxp_list) {
 		struct mbuf *m1 = m_copy(m, 0, (int)M_COPYALL);
 		if (m1 != NULL)
 			ipx_input(m1, ipxp);
@@ -469,8 +468,7 @@ ipx_watch_output(struct mbuf *m, struct ifnet *ifp)
 	/*
 	 * Give any raw listeners a crack at the packet
 	 */
-	for (ipxp = ipxrawpcb.ipxp_next; ipxp != &ipxrawpcb;
-	     ipxp = ipxp->ipxp_next) {
+	LIST_FOREACH(ipxp, &ipxrawpcb_list, ipxp_list) {
 		struct mbuf *m0 = m_copy(m, 0, (int)M_COPYALL);
 		if (m0 != NULL) {
 			struct ipx *ipx;
diff --git a/sys/netproto/ipx/ipx_pcb.c b/sys/netproto/ipx/ipx_pcb.c
index f1bc2d5782..d7fcfd8b5e 100644
--- a/sys/netproto/ipx/ipx_pcb.c
+++ b/sys/netproto/ipx/ipx_pcb.c
@@ -55,9 +55,10 @@
 #include "ipx_var.h"
 
 static struct	ipx_addr zeroipx_addr;
+static uint16_t	ipxpcb_lport_cache;
 
 int
-ipx_pcballoc(struct socket *so, struct ipxpcb *head)
+ipx_pcballoc(struct socket *so, struct ipxpcbhead *head)
 {
 	struct ipxpcb *ipxp;
 
@@ -68,7 +69,7 @@ ipx_pcballoc(struct socket *so, struct ipxpcb *head)
 	ipxp->ipxp_socket = so;
 	if (ipxcksum)
 		ipxp->ipxp_flags |= IPXP_CHECKSUM;
-	insque(ipxp, head);
+	LIST_INSERT_HEAD(head, ipxp, ipxp_list);
 	so->so_pcb = (caddr_t)ipxp;
 	return (0);
 }
@@ -107,11 +108,11 @@ ipx_pcbbind(struct ipxpcb *ipxp, struct sockaddr *nam, struct thread *td)
 noname:
 	if (lport == 0)
 		do {
-			ipxpcb.ipxp_lport++;
-			if ((ipxpcb.ipxp_lport < IPXPORT_RESERVED) ||
-			    (ipxpcb.ipxp_lport >= IPXPORT_WELLKNOWN))
-				ipxpcb.ipxp_lport = IPXPORT_RESERVED;
-			lport = htons(ipxpcb.ipxp_lport);
+			ipxpcb_lport_cache++;
+			if ((ipxpcb_lport_cache < IPXPORT_RESERVED) ||
+			    (ipxpcb_lport_cache >= IPXPORT_WELLKNOWN))
+				ipxpcb_lport_cache = IPXPORT_RESERVED;
+			lport = htons(ipxpcb_lport_cache);
 		} while (ipx_pcblookup(&zeroipx_addr, lport, 0));
 	ipxp->ipxp_lport = lport;
 	return (0);
@@ -266,7 +267,7 @@ ipx_pcbdetach(struct ipxpcb *ipxp)
 
 	if (ipxp->ipxp_route.ro_rt != NULL)
 		rtfree(ipxp->ipxp_route.ro_rt);
-	remque(ipxp);
+	LIST_REMOVE(ipxp, ipxp_list);
 	FREE(ipxp, M_PCB);
 }
 
@@ -304,7 +305,7 @@ ipx_pcblookup(struct ipx_addr *faddr, int lport, int wildp)
 	u_short fport;
 
 	fport = faddr->x_port;
-	for (ipxp = (&ipxpcb)->ipxp_next; ipxp != (&ipxpcb); ipxp = ipxp->ipxp_next) {
+	LIST_FOREACH(ipxp, &ipxpcb_list, ipxp_list) {
 		if (ipxp->ipxp_lport != lport)
 			continue;
 		wildcard = 0;
diff --git a/sys/netproto/ipx/ipx_pcb.h b/sys/netproto/ipx/ipx_pcb.h
index a7bd2eea02..0db1e11e8b 100644
--- a/sys/netproto/ipx/ipx_pcb.h
+++ b/sys/netproto/ipx/ipx_pcb.h
@@ -44,9 +44,7 @@
  * IPX protocol interface control block.
  */
 struct ipxpcb {
-	struct	ipxpcb *ipxp_next;	/* doubly linked list */
-	struct	ipxpcb *ipxp_prev;
-	struct	ipxpcb *ipxp_head;
+	LIST_ENTRY(ipxpcb) ipxp_list;
 	struct	socket *ipxp_socket;	/* back pointer to socket */
 	struct	ipx_addr ipxp_faddr;	/* destination address */
 	struct	ipx_addr ipxp_laddr;	/* socket's address */
@@ -80,9 +78,11 @@ struct ipxpcb {
 #define	IPXRCVQ		40960
 
 #ifdef _KERNEL
-extern struct ipxpcb ipxpcb;			/* head of list */
+LIST_HEAD(ipxpcbhead, ipxpcb);
+extern struct ipxpcbhead ipxpcb_list;
+extern struct ipxpcbhead ipxrawpcb_list;
 
-int	ipx_pcballoc (struct socket *so, struct ipxpcb *head);
+int	ipx_pcballoc (struct socket *so, struct ipxpcbhead *head);
 int	ipx_pcbbind (struct ipxpcb *ipxp, struct sockaddr *nam,
 			 struct thread *td);
 int	ipx_pcbconnect (struct ipxpcb *ipxp, struct sockaddr *nam,
diff --git a/sys/netproto/ipx/ipx_usrreq.c b/sys/netproto/ipx/ipx_usrreq.c
index bb45e7e135..48a151da61 100644
--- a/sys/netproto/ipx/ipx_usrreq.c
+++ b/sys/netproto/ipx/ipx_usrreq.c
@@ -478,7 +478,7 @@ ipx_attach(netmsg_t msg)
 	if (ipxp != NULL) {
 		error = EINVAL;
 	} else {
-		error = ipx_pcballoc(so, &ipxpcb);
+		error = ipx_pcballoc(so, &ipxpcb_list);
 		if (error == 0) {
 			error = soreserve(so, ipxsendspace, ipxrecvspace,
 					  ai->sb_rlimit);
@@ -655,7 +655,7 @@ ripx_attach(netmsg_t msg)
 	error = priv_check_cred(ai->p_ucred, PRIV_ROOT, NULL_CRED_OKAY);
 	if (error)
 		goto out;
-	error = ipx_pcballoc(so, &ipxrawpcb);
+	error = ipx_pcballoc(so, &ipxrawpcb_list);
 	if (error)
 		goto out;
 	error = soreserve(so, ipxsendspace, ipxrecvspace, ai->sb_rlimit);
diff --git a/sys/netproto/ipx/ipx_var.h b/sys/netproto/ipx/ipx_var.h
index f87ffc20b3..95e20a1e25 100644
--- a/sys/netproto/ipx/ipx_var.h
+++ b/sys/netproto/ipx/ipx_var.h
@@ -67,7 +67,6 @@ SYSCTL_DECL(_net_ipx_ipx);
 extern int ipxcksum;
 extern long ipx_pexseq;
 extern struct ipxstat ipxstat;
-extern struct ipxpcb ipxrawpcb;
 extern struct pr_usrreqs ipx_usrreqs;
 extern struct pr_usrreqs ripx_usrreqs;
 extern struct sockaddr_ipx ipx_netmask;
@@ -80,6 +79,7 @@ extern union ipx_host ipx_broadhost;
 
 struct ifnet;
 struct ipx_addr;
+struct ipxpcb;
 struct mbuf;
 struct thread;
 struct route;
diff --git a/sys/netproto/ipx/spx.h b/sys/netproto/ipx/spx.h
index f3b926c635..9cd5a8061c 100644
--- a/sys/netproto/ipx/spx.h
+++ b/sys/netproto/ipx/spx.h
@@ -67,8 +67,7 @@ struct spx {
 	struct spxhdr 	si_s;
 };
 struct spx_q {
-	struct spx_q	*si_next;
-	struct spx_q	*si_prev;
+	LIST_ENTRY(spx_q)	sq_entry;
 	struct mbuf	*si_mbuf;
 };
 #define SI(x)   mtod((x)->si_mbuf, struct spx *)
@@ -91,7 +90,7 @@ struct spx_q {
  * SPX control block, one per connection
  */
 struct spxpcb {
-	struct	spx_q	s_q;		/* queue for out-of-order receipt */
+	LIST_HEAD(, spx_q)	s_q;	/* queue for out-of-order receipt */
 	struct	ipxpcb	*s_ipxpcb;	/* backpointer to internet pcb */
 	u_char	s_state;
 	u_char	s_flags;
diff --git a/sys/netproto/ipx/spx_usrreq.c b/sys/netproto/ipx/spx_usrreq.c
index ce57bbd265..89c2eb559e 100644
--- a/sys/netproto/ipx/spx_usrreq.c
+++ b/sys/netproto/ipx/spx_usrreq.c
@@ -368,8 +368,7 @@ static int spxrexmtthresh = 3;
 static int
 spx_reass(struct spxpcb *cb, struct spx *si, struct mbuf *si_m)
 {
-	struct spx_q *q;
-	struct spx_q *nq;
+	struct spx_q *q, *nq, *q_temp;
 	struct mbuf *m;
 	struct socket *so = cb->s_ipxpcb->ipxp_socket;
 	char packetp = cb->s_flags & SF_HI;
@@ -557,7 +556,7 @@ update_window:
 	 * Loop through all packets queued up to insert in
 	 * appropriate sequence.
 	 */
-	for (q = cb->s_q.si_next; q != &cb->s_q; q = q->si_next) {
+	LIST_FOREACH(q, &cb->s_q, sq_entry) {
 		if (si->si_seq == SI(q)->si_seq) {
 			spxstat.spxs_rcvduppack++;
 			return (1);
@@ -572,7 +571,10 @@ update_window:
 		m_freem(si_m);
 		return (0);
 	}
-	insque(nq, q->si_prev);
+	if (q == NULL)
+		LIST_INSERT_HEAD(&cb->s_q, nq, sq_entry);
+	else
+		LIST_INSERT_BEFORE(q, nq, sq_entry);
 	nq->si_mbuf = si_m;
 	/*
 	 * If this packet is urgent, inform process
@@ -589,7 +591,7 @@ present:
 	 * number, and present all acknowledged data to user;
 	 * If in packet interface mode, show packet headers.
 	 */
-	for (q = cb->s_q.si_next; q != &cb->s_q; q = q->si_next) {
+	LIST_FOREACH_MUTABLE(q, &cb->s_q, sq_entry, q_temp) {
 		  if (SI(q)->si_seq == cb->s_ack) {
 			cb->s_ack++;
 			m = q->si_mbuf;
@@ -600,10 +602,8 @@ present:
 				else
 					sosetstate(so, SS_RCVATMARK);
 			}
-			nq = q;
-			q = q->si_prev;
-			remque(nq);
-			kfree(nq, M_SPX_Q);
+			LIST_REMOVE(q, sq_entry);
+			kfree(q, M_SPX_Q);
 			wakeup = 1;
 			spxstat.spxs_rcvpack++;
 #ifdef SF_NEWCALL
@@ -1309,7 +1309,7 @@ spx_attach_oncpu(struct socket *so, int proto, struct pru_attach_info *ai)
 		error = EISCONN;
 		goto spx_attach_end;
 	}
-	error = ipx_pcballoc(so, &ipxpcb);
+	error = ipx_pcballoc(so, &ipxpcb_list);
 	if (error)
 		goto spx_attach_end;
 	if (so->so_snd.ssb_hiwat == 0 || so->so_rcv.ssb_hiwat == 0) {
@@ -1334,7 +1334,7 @@ spx_attach_oncpu(struct socket *so, int proto, struct pru_attach_info *ai)
 	cb->s_state = TCPS_LISTEN;
 	cb->s_smax = -1;
 	cb->s_swl1 = -1;
-	cb->s_q.si_next = cb->s_q.si_prev = &cb->s_q;
+	LIST_INIT(&cb->s_q);
 	cb->s_ipxpcb = ipxp;
 	cb->s_mtu = 576 - sizeof(struct spx);
 	cb->s_cwnd = ssb_space(ssb) * CUNIT / cb->s_mtu;
@@ -1658,19 +1658,14 @@ static struct spxpcb *
 spx_close(struct spxpcb *cb)
 {
 	struct spx_q *q;
-	struct spx_q *oq;
 	struct ipxpcb *ipxp = cb->s_ipxpcb;
 	struct socket *so = ipxp->ipxp_socket;
-	struct mbuf *m;
 
-	q = cb->s_q.si_next;
-	while (q != &(cb->s_q)) {
-		oq = q;
-		q = q->si_next;
-		m = oq->si_mbuf;
-		remque(oq);
-		m_freem(m);
-		kfree(oq, M_SPX_Q);
+	while (!LIST_EMPTY(&cb->s_q)) {
+		q = LIST_FIRST(&cb->s_q);
+		LIST_REMOVE(q, sq_entry);
+		m_freem(q->si_mbuf);
+		kfree(q, M_SPX_Q);
 	}
 	m_free(cb->s_ipx_m);
 	FREE(cb, M_PCB);
@@ -1732,9 +1727,7 @@ spx_fasttimo(void)
 	struct spxpcb *cb;
 
 	crit_enter();
-	ipxp = ipxpcb.ipxp_next;
-	if (ipxp != NULL) {
-	    for (; ipxp != &ipxpcb; ipxp = ipxp->ipxp_next) {
+	LIST_FOREACH(ipxp, &ipxpcb_list, ipxp_list) {
 		if ((cb = (struct spxpcb *)ipxp->ipxp_pcb) != NULL &&
 		    (cb->s_flags & SF_DELACK)) {
 			cb->s_flags &= ~SF_DELACK;
@@ -1742,7 +1735,6 @@ spx_fasttimo(void)
 			spxstat.spxs_delack++;
 			spx_output(cb, NULL);
 		}
-	    }
 	}
 	crit_exit();
 }
@@ -1755,7 +1747,7 @@ spx_fasttimo(void)
 void
 spx_slowtimo(void)
 {
-	struct ipxpcb *ip, *ipnxt;
+	struct ipxpcb *ip, *ip_temp;
 	struct spxpcb *cb;
 	int i;
 
@@ -1763,28 +1755,19 @@ spx_slowtimo(void)
 	 * Search through tcb's and update active timers.
 	 */
 	crit_enter();
-	ip = ipxpcb.ipxp_next;
-	if (ip == NULL) {
-		crit_exit();
-		return;
-	}
-	while (ip != &ipxpcb) {
+	LIST_FOREACH_MUTABLE(ip, &ipxpcb_list, ipxp_list, ip_temp) {
 		cb = ipxtospxpcb(ip);
-		ipnxt = ip->ipxp_next;
 		if (cb == NULL)
-			goto tpgone;
+			continue;
 		for (i = 0; i < SPXT_NTIMERS; i++) {
 			if (cb->s_timer[i] && --cb->s_timer[i] == 0) {
-				spx_timers(cb, i);
-				if (ipnxt->ipxp_prev != ip)
-					goto tpgone;
+				if (spx_timers(cb, i) == NULL)
+					continue;
 			}
 		}
 		cb->s_idle++;
 		if (cb->s_rtt)
 			cb->s_rtt++;
-tpgone:
-		ip = ipnxt;
 	}
 	spx_iss += SPX_ISSINCR/PR_SLOWHZ;		/* increment iss */
 	crit_exit();
diff --git a/sys/sys/queue.h b/sys/sys/queue.h
index c7171fe479..2d89ceb2fb 100644
--- a/sys/sys/queue.h
+++ b/sys/sys/queue.h
@@ -581,50 +581,4 @@ struct {								\
 	QMD_TRACE_ELEM(&(elm)->field);					\
 } while (0)
 
-
-#ifdef _KERNEL
-
-/*
- * XXX insque() and remque() are an old way of handling certain queues.
- * They bogusly assumes that all queue heads look alike.
- */
-
-struct quehead {
-	struct quehead *qh_link;
-	struct quehead *qh_rlink;
-};
-
-#ifdef __GNUC__
-
-static __inline void
-insque(void *a, void *b)
-{
-	struct quehead *element = (struct quehead *)a,
-		 *head = (struct quehead *)b;
-
-	element->qh_link = head->qh_link;
-	element->qh_rlink = head;
-	head->qh_link = element;
-	element->qh_link->qh_rlink = element;
-}
-
-static __inline void
-remque(void *a)
-{
-	struct quehead *element = (struct quehead *)a;
-
-	element->qh_link->qh_rlink = element->qh_rlink;
-	element->qh_rlink->qh_link = element->qh_link;
-	element->qh_rlink = 0;
-}
-
-#else /* !__GNUC__ */
-
-void	insque(void *a, void *b);
-void	remque(void *a);
-
-#endif /* __GNUC__ */
-
-#endif /* _KERNEL */
-
 #endif /* !_SYS_QUEUE_H_ */
-- 
2.41.0