[PATCH] TTY layer buffering revamp

The API and code have been through various bits of initial review by serial driver people but they definitely need to live somewhere for a while so the unconverted drivers can get knocked into shape, existing drivers that have been updated can be better tuned and bugs whacked out. This replaces the tty flip buffers with kmalloc objects in rings. In the normal situation for an IRQ driven serial port at typical speeds the behaviour is pretty much the same, two buffers end up allocated and the kernel cycles between them as before. When there are delays or at high speed we now behave far better as the buffer pool can grow a bit rather than lose characters. This also means that we can operate at higher speeds reliably. For drivers that receive characters in blocks (DMA based, USB and especially virtualisation) the layer allows a lot of driver specific code that works around the tty layer with private secondary queues to be removed. The IBM folks need this sort of layer, the smart serial port people do, the virtualisers do (because a virtualised tty typically operates at infinite speed rather than emulating 9600 baud). Finally many drivers had invalid and unsafe attempts to avoid buffer overflows by directly invoking tty methods extracted out of the innards of work queue structs. These are no longer needed and all go away. That fixes various random hangs with serial ports on overflow. The other change in here is to optimise the receive_room path that is used by some callers. It turns out that only one ldisc uses receive room except asa constant and it updates it far far less than the value is read. We thus make it a variable not a function call. I expect the code to contain bugs due to the size alone but I'll be watching and squashing them and feeding out new patches as it goes. Because the buffers now dynamically expand you should only run out of buffering when the kernel runs out of memory for real. That means a lot of the horrible hacks high performance drivers used to do just aren't needed any more. Description: tty_insert_flip_char is an old API and continues to work as before, as does tty_flip_buffer_push() [this is why many drivers dont need modification]. It does now also return the number of chars inserted There are also tty_buffer_request_room(tty, len) which asks for a buffer block of the length requested and returns the space found. This improves efficiency with hardware that knows how much to transfer. and tty_insert_flip_string_flags(tty, str, flags, len) to insert a string of characters and flags For a smart interface the usual code is len = tty_request_buffer_room(tty, amount_hardware_says); tty_insert_flip_string(tty, buffer_from_card, len); More description! At the moment tty buffers are attached directly to the tty. This is causing a lot of the problems related to tty layer locking, also problems at high speed and also with bursty data (such as occurs in virtualised environments) I'm working on ripping out the flip buffers and replacing them with a pool of dynamically allocated buffers. This allows both for old style "byte I/O" devices and also helps virtualisation and smart devices where large blocks of data suddenely materialise and need storing. So far so good. Lots of drivers reference tty->flip.*. Several of them also call directly and unsafely into function pointers it provides. This will all break. Most drivers can use tty_insert_flip_char which can be kept as an API but others need more. At the moment I've added the following interfaces, if people think more will be needed now is a good time to say int tty_buffer_request_room(tty, size) Try and ensure at least size bytes are available, returns actual room (may be zero). At the moment it just uses the flipbuf space but that will change. Repeated calls without characters being added are not cumulative. (ie if you call it with 1, 1, 1, and then 4 you'll have four characters of space. The other functions will also try and grow buffers in future but this will be a more efficient way when you know block sizes. int tty_insert_flip_char(tty, ch, flag) As before insert a character if there is room. Now returns 1 for success, 0 for failure. int tty_insert_flip_string(tty, str, len) Insert a block of non error characters. Returns the number inserted. int tty_prepare_flip_string(tty, strptr, len) Adjust the buffer to allow len characters to be added. Returns a buffer pointer in strptr and the length available. This allows for hardware that needs to use functions like insl or mencpy_fromio. Signed-off-by: Alan Cox <alan@redhat.com> Cc: Paul Fulghum <paulkf@microgate.com> Signed-off-by: Hirokazu Takata <takata@linux-m32r.org> Signed-off-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: Jeff Dike <jdike@addtoit.com> Signed-off-by: John Hawkes <hawkes@sgi.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
author: Alan Cox <alan@lxorguk.ukuu.org.uk> 2006-01-09 23:54:13 -0500
committer: Linus Torvalds <torvalds@g5.osdl.org> 2006-01-10 11:01:59 -0500
commit: 33f0f88f1c51ae5c2d593d26960c760ea154c2e2 (patch)
tree: f53a38cf49406863f079d74d0e8f91b276f7c1a9 /drivers
parent: 6ed80991a2dce4afc113be35089c564d62fa1f11 (diff)
101 files changed, 971 insertions, 1428 deletions
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 573ff6c1be5f..613673b12fa6 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -279,6 +279,7 @@ static int hci_uart_tty_open(struct tty_struct *tty)
        tty->disc_data = hu;
        hu->tty = tty;
+        tty->receive_room = 65536;
        spin_lock_init(&hu->rx_lock);
@@ -348,20 +349,6 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty)
                hci_uart_tx_wakeup(hu);
 }
-/* hci_uart_tty_room()
- * 
- *    Callback function from tty driver. Return the amount of 
- *    space left in the receiver's buffer to decide if remote
- *    transmitter is to be throttled.
- *
- * Arguments:        tty    pointer to associated tty instance data
- * Return Value:    number of bytes left in receive buffer
- */
-static int hci_uart_tty_room (struct tty_struct *tty)
-{
-        return 65536;
-}
 /* hci_uart_tty_receive()
 * 
 *     Called by tty low level driver when receive data is
@@ -544,7 +531,6 @@ static int __init hci_uart_init(void)
        hci_uart_ldisc.write            = hci_uart_tty_write;
        hci_uart_ldisc.ioctl            = hci_uart_tty_ioctl;
        hci_uart_ldisc.poll             = hci_uart_tty_poll;
-        hci_uart_ldisc.receive_room     = hci_uart_tty_room;
        hci_uart_ldisc.receive_buf      = hci_uart_tty_receive;
        hci_uart_ldisc.write_wakeup     = hci_uart_tty_wakeup;
        hci_uart_ldisc.owner            = THIS_MODULE;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 977a74e16efb..d6fcd0a36f9f 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -80,7 +80,7 @@ config SERIAL_NONSTANDARD
 config COMPUTONE
        tristate "Computone IntelliPort Plus serial support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD
        ---help---
          This driver supports the entire family of Intelliport II/Plus
          controllers with the exception of the MicroChannel controllers and
@@ -153,7 +153,7 @@ config DIGIEPCA
 config ESPSERIAL
        tristate "Hayes ESP serial port support"
-        depends on SERIAL_NONSTANDARD && ISA && BROKEN_ON_SMP && ISA_DMA_API
+        depends on SERIAL_NONSTANDARD && ISA && ISA_DMA_API
        help
          This is a driver which supports Hayes ESP serial ports.  Both single
          port cards and multiport cards are supported.  Make sure to read
@@ -166,7 +166,7 @@ config ESPSERIAL
 config MOXA_INTELLIO
        tristate "Moxa Intellio support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD
        help
          Say Y here if you have a Moxa Intellio multiport serial card.
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 10c81ecdace8..869518e4035f 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -265,8 +265,9 @@ static _INLINE_ void receive_chars(struct async_struct *info)
        int status;
        int serdatr;
        struct tty_struct *tty = info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        struct  async_icount *icount;
+        int oe = 0;
        icount = &info->state->icount;
@@ -282,15 +283,12 @@ static _INLINE_ void receive_chars(struct async_struct *info)
            status |= UART_LSR_OE;
        ch = serdatr & 0xff;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-          goto ignore_char;
-        *tty->flip.char_buf_ptr = ch;
        icount->rx++;
 #ifdef SERIAL_DEBUG_INTR
        printk("DR%02x:%02x...", ch, status);
 #endif
-        *tty->flip.flag_buf_ptr = 0;
+        flag = TTY_NORMAL;
        /*
         * We don't handle parity or frame errors - but I have left
@@ -319,7 +317,7 @@ static _INLINE_ void receive_chars(struct async_struct *info)
           * should be ignored.
           */
          if (status & info->ignore_status_mask)
-            goto ignore_char;
+            goto out;
          status &= info->read_status_mask;
@@ -327,33 +325,28 @@ static _INLINE_ void receive_chars(struct async_struct *info)
 #ifdef SERIAL_DEBUG_INTR
            printk("handling break....");
 #endif
-            *tty->flip.flag_buf_ptr = TTY_BREAK;
+            flag = TTY_BREAK;
            if (info->flags & ASYNC_SAK)
              do_SAK(tty);
          } else if (status & UART_LSR_PE)
-            *tty->flip.flag_buf_ptr = TTY_PARITY;
+            flag = TTY_PARITY;
          else if (status & UART_LSR_FE)
-            *tty->flip.flag_buf_ptr = TTY_FRAME;
+            flag = TTY_FRAME;
          if (status & UART_LSR_OE) {
            /*
             * Overrun is special, since it's
             * reported immediately, and doesn't
             * affect the current character
             */
-            if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+             oe = 1;
-              tty->flip.count++;
-              tty->flip.flag_buf_ptr++;
-              tty->flip.char_buf_ptr++;
-              *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-            }
          }
        }
-        tty->flip.flag_buf_ptr++;
+        tty_insert_flip_char(tty, ch, flag);
-        tty->flip.char_buf_ptr++;
+        if (oe == 1)
-        tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
- ignore_char:
        tty_flip_buffer_push(tty);
+out:
+        return;
 }
 static _INLINE_ void transmit_chars(struct async_struct *info)
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index c8e7daecad72..39c61a71176e 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -641,6 +641,7 @@ static char rcsid[] =
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/serial.h>
 #include <linux/major.h>
 #include <linux/string.h>
@@ -1086,7 +1087,7 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
  int had_work;
  int mdm_change;
  int mdm_status;
+  int len;
    if((cinfo = (struct cyclades_card *)dev_id) == 0){
 #ifdef CY_DEBUG_INTERRUPTS
        printk("cyy_interrupt: spurious interrupt %d\n\r", irq);
@@ -1163,63 +1164,43 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                                info->icount.rx++;
                                continue;
                            }
-                            if (tty->flip.count < TTY_FLIPBUF_SIZE){
+                            if (tty_buffer_request_room(tty, 1)) {
-                                tty->flip.count++;
                                if (data & info->read_status_mask){
                                    if(data & CyBREAK){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_BREAK);
-                                                            TTY_BREAK;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
                                        info->icount.rx++;
                                        if (info->flags & ASYNC_SAK){
                                            do_SAK(tty);
                                        }
                                    }else if(data & CyFRAME){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_FRAME);
-                                                            TTY_FRAME;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
                                        info->icount.rx++;
                                        info->idle_stats.frame_errs++;
                                    }else if(data & CyPARITY){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        /* Pieces of seven... */
-                                                            TTY_PARITY;
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_PARITY);
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
                                        info->icount.rx++;
                                        info->idle_stats.parity_errs++;
                                    }else if(data & CyOVERRUN){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                                                            TTY_OVERRUN;
-                                        *tty->flip.char_buf_ptr++ = 0;
                                        info->icount.rx++;
                                        /* If the flip buffer itself is
                                           overflowing, we still lose
                                           the next incoming character.
                                         */
-                                        if(tty->flip.count
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_FRAME);
-                                                   < TTY_FLIPBUF_SIZE){
+                                        info->icount.rx++;
-                                            tty->flip.count++;
-                                            *tty->flip.flag_buf_ptr++ =
-                                                             TTY_NORMAL;
-                                           *tty->flip.char_buf_ptr++ =
-                                            cy_readb(base_addr+(CyRDSR<<index));
-                                            info->icount.rx++;
-                                        }
                                        info->idle_stats.overruns++;
                                    /* These two conditions may imply */
                                    /* a normal read should be done. */
                                    /* }else if(data & CyTIMEOUT){ */
                                    /* }else if(data & CySPECHAR){ */
-                                    }else{
+                                    }else {
-                                        *tty->flip.flag_buf_ptr++ = 0;
+                                        tty_insert_flip_char(tty, 0, TTY_NORMAL);
-                                        *tty->flip.char_buf_ptr++ = 0;
+                                        info->icount.rx++;
-                                        info->icount.rx++;
                                    }
                                }else{
-                                    *tty->flip.flag_buf_ptr++ = 0;
+                                    tty_insert_flip_char(tty, 0, TTY_NORMAL);
-                                    *tty->flip.char_buf_ptr++ = 0;
                                    info->icount.rx++;
                                }
                            }else{
@@ -1240,14 +1221,10 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                               info->mon.char_max = char_count;
                            info->mon.char_last = char_count;
 #endif
-                            while(char_count--){
+                            len = tty_buffer_request_room(tty, char_count);
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE){
+                            while(len--){
-                                        break;
-                                }
-                                tty->flip.count++;
                                data = cy_readb(base_addr+(CyRDSR<<index));
-                                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
+                                tty_insert_flip_char(tty, data, TTY_NORMAL);
-                                *tty->flip.char_buf_ptr++ = data;
                                info->idle_stats.recv_bytes++;
                                info->icount.rx++;
 #ifdef CY_16Y_HACK
@@ -1256,7 +1233,7 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                            }
                             info->idle_stats.recv_idle = jiffies;
                        }
-                        schedule_delayed_work(&tty->flip.work, 1);
+                        schedule_delayed_work(&tty->buf.work, 1);
                    }
                    /* end of service */
                    cy_writeb(base_addr+(CyRIR<<index), (save_xir & 0x3f));
@@ -1551,6 +1528,7 @@ cyz_handle_rx(struct cyclades_port *info,
  struct cyclades_card *cinfo = &cy_card[info->card];
  struct tty_struct *tty = info->tty;
  volatile int char_count;
+  int len;
 #ifdef BLOCKMOVE
  int small_count;
 #else
@@ -1606,18 +1584,11 @@ cyz_handle_rx(struct cyclades_port *info,
                tty->flip.count += small_count;
            }
 #else
-            while(char_count--){
+            len = tty_buffer_request_room(tty, char_count);
-                if (tty->flip.count >= N_TTY_BUF_SIZE - tty->read_cnt)
+            while(len--){
-                    break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                    break;
                data = cy_readb(cinfo->base_addr + rx_bufaddr + new_rx_get);
                new_rx_get = (new_rx_get + 1) & (rx_bufsize - 1);
-                tty->flip.count++;
+                tty_insert_flip_char(tty, data, TTY_NORMAL);
-                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                *tty->flip.char_buf_ptr++ = data;
                info->idle_stats.recv_bytes++;
                info->icount.rx++;
            }
@@ -1635,7 +1606,7 @@ cyz_handle_rx(struct cyclades_port *info,
            }
 #endif
            info->idle_stats.recv_idle = jiffies;
-            schedule_delayed_work(&tty->flip.work, 1);
+            schedule_delayed_work(&tty->buf.work, 1);
        }
        /* Update rx_get */
        cy_writel(&buf_ctrl->rx_get, new_rx_get);
@@ -1763,23 +1734,17 @@ cyz_handle_cmd(struct cyclades_card *cinfo)
        switch(cmd) {
            case C_CM_PR_ERROR:
-                tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_PARITY);
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
-                *tty->flip.char_buf_ptr++ = 0;
                info->icount.rx++;
                special_count++;
                break;
            case C_CM_FR_ERROR:
-                tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_FRAME);
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
-                *tty->flip.char_buf_ptr++ = 0;
                info->icount.rx++;
                special_count++;
                break;
            case C_CM_RXBRK:
-                tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                *tty->flip.char_buf_ptr++ = 0;
                info->icount.rx++;
                special_count++;
                break;
@@ -1844,7 +1809,7 @@ cyz_handle_cmd(struct cyclades_card *cinfo)
        if(delta_count)
            cy_sched_event(info, Cy_EVENT_DELTA_WAKEUP);
        if(special_count)
-            schedule_delayed_work(&tty->flip.work, 1);
+            schedule_delayed_work(&tty->buf.work, 1);
    }
 }
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 407708a001e4..765c5c108bf4 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -1786,9 +1786,7 @@ static void doevent(int crd)
                if (tty)  { /* Begin if valid tty */
                        if (event & BREAK_IND)  { /* Begin if BREAK_IND */
                                /* A break has been indicated */
-                                tty->flip.count++;
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                *tty->flip.char_buf_ptr++ = 0;
                                tty_schedule_flip(tty); 
                        } else if (event & LOWTX_IND)  { /* Begin LOWTX_IND */
                                if (ch->statusflags & LOWWAIT) 
@@ -2124,7 +2122,6 @@ static void receive_data(struct channel *ch)
        int dataToRead, wrapgap, bytesAvailable;
        unsigned int tail, head;
        unsigned int wrapmask;
-        int rc;
        /* ---------------------------------------------------------------
                This routine is called by doint when a receive data event 
@@ -2162,16 +2159,15 @@ static void receive_data(struct channel *ch)
                return;
        }
-        if (tty->flip.count == TTY_FLIPBUF_SIZE) 
+        if (tty_buffer_request_room(tty, bytesAvailable + 1) == 0)
                return;
        if (readb(&bc->orun)) {
                writeb(0, &bc->orun);
                printk(KERN_WARNING "epca; overrun! DigiBoard device %s\n",tty->name);
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
        }
        rxwinon(ch);
-        rptr = tty->flip.char_buf_ptr;
-        rc = tty->flip.count;
        while (bytesAvailable > 0)  { /* Begin while there is data on the card */
                wrapgap = (head >= tail) ? head - tail : ch->rxbufsize - tail;
                /* ---------------------------------------------------------------
@@ -2183,8 +2179,7 @@ static void receive_data(struct channel *ch)
                /* --------------------------------------------------------------
                   Make sure we don't overflow the buffer
                ----------------------------------------------------------------- */
-                if ((rc + dataToRead) > TTY_FLIPBUF_SIZE)
+                dataToRead = tty_prepare_flip_string(tty, &rptr, dataToRead);
-                        dataToRead = TTY_FLIPBUF_SIZE - rc;
                if (dataToRead == 0)
                        break;
                /* ---------------------------------------------------------------
@@ -2192,13 +2187,9 @@ static void receive_data(struct channel *ch)
                        for translation if necessary.
                ------------------------------------------------------------------ */
                memcpy_fromio(rptr, ch->rxptr + tail, dataToRead);
-                rc   += dataToRead;
-                rptr += dataToRead;
                tail = (tail + dataToRead) & wrapmask;
                bytesAvailable -= dataToRead;
        } /* End while there is data on the card */
-        tty->flip.count = rc;
-        tty->flip.char_buf_ptr = rptr;
        globalwinon(ch);
        writew(tail, &bc->rout);
        /* Must be called with global data */
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
index 9f53d2fcc360..e469f641c728 100644
--- a/drivers/char/esp.c
+++ b/drivers/char/esp.c
@@ -345,26 +345,22 @@ static inline void receive_chars_pio(struct esp_struct *info, int num_bytes)
        for (i = 0; i < num_bytes; i++) {
                if (!(err_buf->data[i] & status_mask)) {
-                        *(tty->flip.char_buf_ptr++) = pio_buf->data[i];
+                        int flag = 0;
                        if (err_buf->data[i] & 0x04) {
-                                *(tty->flip.flag_buf_ptr++) = TTY_BREAK;
+                                flag = TTY_BREAK;
                                if (info->flags & ASYNC_SAK)
                                        do_SAK(tty);
                        }
                        else if (err_buf->data[i] & 0x02)
-                                *(tty->flip.flag_buf_ptr++) = TTY_FRAME;
+                                flag = TTY_FRAME;
                        else if (err_buf->data[i] & 0x01)
-                                *(tty->flip.flag_buf_ptr++) = TTY_PARITY;
+                                flag = TTY_PARITY;
-                        else
+                        tty_insert_flip_char(tty, pio_buf->data[i], flag);
-                                *(tty->flip.flag_buf_ptr++) = 0;
-                
-                        tty->flip.count++;
                }
        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        schedule_delayed_work(&tty->buf.work, 1);
        info->stat_flags &= ~ESP_STAT_RX_TIMEOUT;
        release_pio_buffer(pio_buf);
@@ -397,7 +393,6 @@ static inline void receive_chars_dma_done(struct esp_struct *info,
        int num_bytes;
        unsigned long flags;
        
-        
        flags=claim_dma_lock();
        disable_dma(dma);
        clear_dma_ff(dma);
@@ -408,38 +403,31 @@ static inline void receive_chars_dma_done(struct esp_struct *info,
        
        info->icount.rx += num_bytes;
-        memcpy(tty->flip.char_buf_ptr, dma_buffer, num_bytes);
-        tty->flip.char_buf_ptr += num_bytes;
-        tty->flip.count += num_bytes;
-        memset(tty->flip.flag_buf_ptr, 0, num_bytes);
-        tty->flip.flag_buf_ptr += num_bytes;
        if (num_bytes > 0) {
-                tty->flip.flag_buf_ptr--;
+                tty_insert_flip_string(tty, dma_buffer, num_bytes - 1);
                status &= (0x1c & info->read_status_mask);
+                
+                /* Is the status significant or do we throw the last byte ? */
+                if (!(status & info->ignore_status_mask)) {
+                        int statflag = 0;
-                if (status & info->ignore_status_mask) {
+                        if (status & 0x10) {
-                        tty->flip.count--;
+                                statflag = TTY_BREAK;
-                        tty->flip.char_buf_ptr--;
+                                (info->icount.brk)++;
-                        tty->flip.flag_buf_ptr--;
+                                if (info->flags & ASYNC_SAK)
-                } else if (status & 0x10) {
+                                        do_SAK(tty);
-                        *tty->flip.flag_buf_ptr = TTY_BREAK;
+                        } else if (status & 0x08) {
-                        (info->icount.brk)++;
+                                statflag = TTY_FRAME;
-                        if (info->flags & ASYNC_SAK)
+                                (info->icount.frame)++;
-                                do_SAK(tty);
+                        }
-                } else if (status & 0x08) {
+                        else if (status & 0x04) {
-                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                statflag = TTY_PARITY;
-                        (info->icount.frame)++;
+                                (info->icount.parity)++;
-                }
+                        }
-                else if (status & 0x04) {
+                        tty_insert_flip_char(tty, dma_buffer[num_bytes - 1], statflag);
-                        *tty->flip.flag_buf_ptr = TTY_PARITY;
-                        (info->icount.parity)++;
                }
+                schedule_delayed_work(&tty->buf.work, 1);
-                tty->flip.flag_buf_ptr++;
-                
-                schedule_delayed_work(&tty->flip.work, 1);
        }
        if (dma_bytes != num_bytes) {
@@ -693,8 +681,7 @@ static irqreturn_t rs_interrupt_single(int irq, void *dev_id,
                num_bytes = serial_in(info, UART_ESI_STAT1) << 8;
                num_bytes |= serial_in(info, UART_ESI_STAT2);
-                if (num_bytes > (TTY_FLIPBUF_SIZE - info->tty->flip.count))
+                num_bytes = tty_buffer_request_room(info->tty, num_bytes);
-                  num_bytes = TTY_FLIPBUF_SIZE - info->tty->flip.count;
                if (num_bytes) {
                        if (dma_bytes ||
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index f92177634677..1994a92d4733 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -597,9 +597,7 @@ static int hvc_poll(struct hvc_struct *hp)
        /* Read data if any */
        for (;;) {
-                int count = N_INBUF;
+                int count = tty_buffer_request_room(tty, N_INBUF);
-                if (count > (TTY_FLIPBUF_SIZE - tty->flip.count))
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
                /* If flip is full, just reschedule a later read */
                if (count == 0) {
@@ -635,7 +633,7 @@ static int hvc_poll(struct hvc_struct *hp)
                        tty_insert_flip_char(tty, buf[i], 0);
                }
-                if (tty->flip.count)
+                if (count)
                        tty_schedule_flip(tty);
                /*
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 53dc77c760fc..831eb4e8d9d3 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -456,12 +456,11 @@ static int hvcs_io(struct hvcs_struct *hvcsd)
        /* remove the read masks */
        hvcsd->todo_mask &= ~(HVCS_READ_MASK);
-        if ((tty->flip.count + HVCS_BUFF_LEN) < TTY_FLIPBUF_SIZE) {
+        if (tty_buffer_request_room(tty, HVCS_BUFF_LEN) >= HVCS_BUFF_LEN) {
                got = hvc_get_chars(unit_address,
                                &buf[0],
                                HVCS_BUFF_LEN);
-                for (i=0;got && i<got;i++)
+                tty_insert_flip_string(tty, buf, got);
-                        tty_insert_flip_char(tty, buf[i], TTY_NORMAL);
        }
        /* Give the TTY time to process the data we just sent. */
@@ -469,10 +468,9 @@ static int hvcs_io(struct hvcs_struct *hvcsd)
                hvcsd->todo_mask |= HVCS_QUICK_READ;
        spin_unlock_irqrestore(&hvcsd->lock, flags);
-        if (tty->flip.count) {
+        /* This is synch because tty->low_latency == 1 */
-                /* This is synch because tty->low_latency == 1 */
+        if(got)
                tty_flip_buffer_push(tty);
-        }
        if (!got) {
                /* Do this _after_ the flip_buffer_push */
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 1bbf507adda5..86033bed5d6c 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -115,6 +115,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/termios.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
@@ -773,6 +774,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
        unsigned short base, header, word_count, count;
        unsigned char channel;
        short byte_count;
+        unsigned char *rp;
        
        card = (struct isi_board *) dev_id;
@@ -903,14 +905,10 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                                break;
                                
                        case 1: /* Received Break !!!    */
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                                        break;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                *tty->flip.char_buf_ptr++ = 0;
-                                tty->flip.count++;
                                if (port->flags & ASYNC_SAK)
                                        do_SAK(tty);
-                                schedule_delayed_work(&tty->flip.work, 1);
+                                tty_flip_buffer_push(tty);
                                break;
                                
                        case 2: /* Statistics            */
@@ -923,23 +921,19 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                }        
        }
        else {                          /* Data   Packet */
-                count = min_t(unsigned short, byte_count, (TTY_FLIPBUF_SIZE - tty->flip.count));
+                count = tty_prepare_flip_string(tty, &rp, byte_count & ~1);
 #ifdef ISICOM_DEBUG
                printk(KERN_DEBUG "ISICOM: Intr: Can rx %d of %d bytes.\n", 
                                        count, byte_count);
 #endif                  
                word_count = count >> 1;
-                insw(base, tty->flip.char_buf_ptr, word_count);
+                insw(base, rp, word_count);
-                tty->flip.char_buf_ptr += (word_count << 1);            
                byte_count -= (word_count << 1);
                if (count & 0x0001) {
-                        *tty->flip.char_buf_ptr++ = (char)(inw(base) & 0xff);
+                        tty_insert_flip_char(tty,  inw(base) & 0xff, TTY_NORMAL);
                        byte_count -= 2;
                }       
-                memset(tty->flip.flag_buf_ptr, 0, count);
-                tty->flip.flag_buf_ptr += count;
-                tty->flip.count += count;
-                
                if (byte_count > 0) {
                        printk(KERN_DEBUG "ISICOM: Intr(0x%x:%d): Flip buffer overflow! dropping bytes...\n",
                                        base, channel+1);
@@ -948,7 +942,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                                byte_count -= 2;
                        }
                }
-                schedule_delayed_work(&tty->flip.work, 1);
+                tty_flip_buffer_push(tty);
        }
        if (card->isa == YES)
                ClearInterrupt(base);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 24435f8daa68..28c5a3193b81 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -2711,17 +2711,13 @@ static void stli_read(stlibrd_t *brdp, stliport_t *portp)
                stlen = size - tail;
        }
-        len = MIN(len, (TTY_FLIPBUF_SIZE - tty->flip.count));
+        len = tty_buffer_request_room(tty, len);
+        /* FIXME : iomap ? */
        shbuf = (volatile char *) EBRDGETMEMPTR(brdp, portp->rxoffset);
        while (len > 0) {
                stlen = MIN(len, stlen);
-                memcpy(tty->flip.char_buf_ptr, (char *) (shbuf + tail), stlen);
+                tty_insert_flip_string(tty, (char *)(shbuf + tail), stlen);
-                memset(tty->flip.flag_buf_ptr, 0, stlen);
-                tty->flip.char_buf_ptr += stlen;
-                tty->flip.flag_buf_ptr += stlen;
-                tty->flip.count += stlen;
                len -= stlen;
                tail += stlen;
                if (tail >= size) {
@@ -2906,16 +2902,12 @@ static int stli_hostcmd(stlibrd_t *brdp, stliport_t *portp)
                if ((nt.data & DT_RXBREAK) && (portp->rxmarkmsk & BRKINT)) {
                        if (tty != (struct tty_struct *) NULL) {
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                                        tty->flip.count++;
+                                if (portp->flags & ASYNC_SAK) {
-                                        *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                        do_SAK(tty);
-                                        *tty->flip.char_buf_ptr++ = 0;
+                                        EBRDENABLE(brdp);
-                                        if (portp->flags & ASYNC_SAK) {
-                                                do_SAK(tty);
-                                                EBRDENABLE(brdp);
-                                        }
-                                        tty_schedule_flip(tty);
                                }
+                                tty_schedule_flip(tty);
                        }
                }
@@ -4940,7 +4932,7 @@ static int stli_portcmdstats(stliport_t *portp)
        if (portp->tty != (struct tty_struct *) NULL) {
                if (portp->tty->driver_data == portp) {
                        stli_comstats.ttystate = portp->tty->flags;
-                        stli_comstats.rxbuffered = portp->tty->flip.count;
+                        stli_comstats.rxbuffered = -1 /*portp->tty->flip.count*/;
                        if (portp->tty->termios != (struct termios *) NULL) {
                                stli_comstats.cflags = portp->tty->termios->c_cflag;
                                stli_comstats.iflags = portp->tty->termios->c_iflag;
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 46a3a8ccd65f..5e3ef5522194 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -269,7 +269,7 @@ static int MoxaPortDCDChange(int);
 static int MoxaPortDCDON(int);
 static void MoxaPortFlushData(int, int);
 static int MoxaPortWriteData(int, unsigned char *, int);
-static int MoxaPortReadData(int, unsigned char *, int);
+static int MoxaPortReadData(int, struct tty_struct *tty);
 static int MoxaPortTxQueue(int);
 static int MoxaPortRxQueue(int);
 static int MoxaPortTxFree(int);
@@ -301,6 +301,8 @@ static struct tty_operations moxa_ops = {
        .tiocmset = moxa_tiocmset,
 };
+static spinlock_t moxa_lock = SPIN_LOCK_UNLOCKED;
 #ifdef CONFIG_PCI
 static int moxa_get_PCI_conf(struct pci_dev *p, int board_type, moxa_board_conf * board)
 {
@@ -645,10 +647,10 @@ static int moxa_write(struct tty_struct *tty,
        if (ch == NULL)
                return (0);
        port = ch->port;
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&moxa_lock, flags);
        len = MoxaPortWriteData(port, (unsigned char *) buf, count);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
        /*********************************************
        if ( !(ch->statusflags & LOWWAIT) &&
@@ -723,11 +725,10 @@ static void moxa_put_char(struct tty_struct *tty, unsigned char c)
        if (ch == NULL)
                return;
        port = ch->port;
-        save_flags(flags);
+        spin_lock_irqsave(&moxa_lock, flags);
-        cli();
        moxaXmitBuff[0] = c;
        MoxaPortWriteData(port, moxaXmitBuff, 1);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
        /************************************************
        if ( !(ch->statusflags & LOWWAIT) && (MoxaPortTxFree(port) <= 100) )
        *************************************************/
@@ -1030,12 +1031,12 @@ static int block_till_ready(struct tty_struct *tty, struct file *filp,
        printk("block_til_ready before block: ttys%d, count = %d\n",
               ch->line, ch->count);
 #endif
-        save_flags(flags);
+        spin_lock_irqsave(&moxa_lock, flags);
-        cli();
        if (!tty_hung_up_p(filp))
                ch->count--;
-        restore_flags(flags);
        ch->blocked_open++;
+        spin_unlock_irqrestore(&moxa_lock, flags);
        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
                if (tty_hung_up_p(filp) ||
@@ -1062,17 +1063,21 @@ static int block_till_ready(struct tty_struct *tty, struct file *filp,
        }
        set_current_state(TASK_RUNNING);
        remove_wait_queue(&ch->open_wait, &wait);
+        spin_lock_irqsave(&moxa_lock, flags);
        if (!tty_hung_up_p(filp))
                ch->count++;
        ch->blocked_open--;
+        spin_unlock_irqrestore(&moxa_lock, flags);
 #ifdef SERIAL_DEBUG_OPEN
        printk("block_til_ready after blocking: ttys%d, count = %d\n",
               ch->line, ch->count);
 #endif
        if (retval)
                return (retval);
+        /* FIXME: review to see if we need to use set_bit on these */
        ch->asyncflags |= ASYNC_NORMAL_ACTIVE;
-        return (0);
+        return 0;
 }
 static void setup_empty_event(struct tty_struct *tty)
@@ -1080,15 +1085,14 @@ static void setup_empty_event(struct tty_struct *tty)
        struct moxa_str *ch = tty->driver_data;
        unsigned long flags;
-        save_flags(flags);
+        spin_lock_irqsave(&moxa_lock, flags);
-        cli();
        ch->statusflags |= EMPTYWAIT;
        moxaEmptyTimer_on[ch->port] = 0;
        del_timer(&moxaEmptyTimer[ch->port]);
        moxaEmptyTimer[ch->port].expires = jiffies + HZ;
        moxaEmptyTimer_on[ch->port] = 1;
        add_timer(&moxaEmptyTimer[ch->port]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
 }
 static void check_xmit_empty(unsigned long data)
@@ -1135,8 +1139,6 @@ static void receive_data(struct moxa_str *ch)
 {
        struct tty_struct *tp;
        struct termios *ts;
-        int i, count, rc, space;
-        unsigned char *charptr, *flagptr;
        unsigned long flags;
        ts = NULL;
@@ -1150,24 +1152,10 @@ static void receive_data(struct moxa_str *ch)
                MoxaPortFlushData(ch->port, 0);
                return;
        }
-        space = TTY_FLIPBUF_SIZE - tp->flip.count;
+        spin_lock_irqsave(&moxa_lock, flags);
-        if (space <= 0)
+        MoxaPortReadData(ch->port, tp);
-                return;
+        spin_unlock_irqrestore(&moxa_lock, flags);
-        charptr = tp->flip.char_buf_ptr;
+        tty_schedule_flip(tp);
-        flagptr = tp->flip.flag_buf_ptr;
-        rc = tp->flip.count;
-        save_flags(flags);
-        cli();
-        count = MoxaPortReadData(ch->port, charptr, space);
-        restore_flags(flags);
-        for (i = 0; i < count; i++)
-                *flagptr++ = 0;
-        charptr += count;
-        rc += count;
-        tp->flip.count = rc;
-        tp->flip.char_buf_ptr = charptr;
-        tp->flip.flag_buf_ptr = flagptr;
-        tty_schedule_flip(ch->tty);
 }
 #define Magic_code      0x404
@@ -1774,7 +1762,7 @@ int MoxaPortsOfCard(int cardno)
 *      14. MoxaPortDCDON(int port);                                         *
 *      15. MoxaPortFlushData(int port, int mode);                           *
 *      16. MoxaPortWriteData(int port, unsigned char * buffer, int length); *
- *      17. MoxaPortReadData(int port, unsigned char * buffer, int length);  *
+ *      17. MoxaPortReadData(int port, struct tty_struct *tty);              *
 *      18. MoxaPortTxBufSize(int port);                                     *
 *      19. MoxaPortRxBufSize(int port);                                     *
 *      20. MoxaPortTxQueue(int port);                                       *
@@ -2003,10 +1991,9 @@ int MoxaPortsOfCard(int cardno)
 *
 *      Function 21:    Read data.
 *      Syntax:
- *      int  MoxaPortReadData(int port, unsigned char * buffer, int length);
+ *      int  MoxaPortReadData(int port, struct tty_struct *tty);
 *           int port           : port number (0 - 127)
- *           unsigned char * buffer     : pointer to read data buffer.
+ *           struct tty_struct *tty : tty for data
- *           int length         : read data buffer length
 *
 *           return:    0 - length      : real read data length
 *
@@ -2504,7 +2491,7 @@ int MoxaPortWriteData(int port, unsigned char * buffer, int len)
        return (total);
 }
-int MoxaPortReadData(int port, unsigned char * buffer, int space)
+int MoxaPortReadData(int port, struct tty_struct *tty)
 {
        register ushort head, pageofs;
        int i, count, cnt, len, total, remain;
@@ -2522,9 +2509,9 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
        count = (tail >= head) ? (tail - head)
            : (tail - head + rx_mask + 1);
        if (count == 0)
-                return (0);
+                return 0;
-        total = (space > count) ? count : space;
+        total = count;
        remain = count - total;
        moxaLog.rxcnt[port] += total;
        count = total;
@@ -2539,7 +2526,7 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
                        len = (count > len) ? len : count;
                        ofs = baseAddr + DynPage_addr + bufhead + head;
                        for (i = 0; i < len; i++)
-                                *buffer++ = readb(ofs + i);
+                                tty_insert_flip_char(tty, readb(ofs + i), TTY_NORMAL);
                        head = (head + len) & rx_mask;
                        count -= len;
                }
@@ -2556,7 +2543,7 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
                        writew(pageno, baseAddr + Control_reg);
                        ofs = baseAddr + DynPage_addr + pageofs;
                        for (i = 0; i < cnt; i++)
-                                *buffer++ = readb(ofs + i);
+                                tty_insert_flip_char(tty, readb(ofs + i), TTY_NORMAL);
                        if (count == 0) {
                                writew((head + len) & rx_mask, ofsAddr + RXrptr);
                                break;
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 51bb2a3cf8b3..ea725a9964e2 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1982,7 +1982,7 @@ static void mxser_receive_chars(struct mxser_struct *info, int *status)
        spin_lock_irqsave(&info->slock, flags);
-        recv_room = tty->ldisc.receive_room(tty);
+        recv_room = tty->receive_room;
        if ((recv_room == 0) && (!info->ldisc_stop_rx)) {
                //mxser_throttle(tty);
                mxser_stoprx(tty);
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index a133a62f3d55..70f487dd7b8d 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -212,7 +212,6 @@ static struct tty_ldisc n_hdlc_ldisc = {
        .ioctl          = n_hdlc_tty_ioctl,
        .poll           = n_hdlc_tty_poll,
        .receive_buf    = n_hdlc_tty_receive,
-        .receive_room   = n_hdlc_tty_room,
        .write_wakeup   = n_hdlc_tty_wakeup,
 };
@@ -337,6 +336,7 @@ static int n_hdlc_tty_open (struct tty_struct *tty)
                
        tty->disc_data = n_hdlc;
        n_hdlc->tty    = tty;
+        tty->receive_room = 65536;
        
 #if defined(TTY_NO_WRITE_SPLIT)
        /* change tty_io write() to not split large writes into 8K chunks */
@@ -478,22 +478,6 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty)
 }       /* end of n_hdlc_tty_wakeup() */
 /**
- * n_hdlc_tty_room - Return the amount of space left in the receiver's buffer
- * @tty - pointer to associated tty instance data
- *
- * Callback function from tty driver. Return the amount of space left in the
- * receiver's buffer to decide if remote transmitter is to be throttled.
- */
-static int n_hdlc_tty_room(struct tty_struct *tty)
-{
-        if (debuglevel >= DEBUG_LEVEL_INFO)     
-                printk("%s(%d)n_hdlc_tty_room() called\n",__FILE__,__LINE__);
-        /* always return a larger number to prevent */
-        /* throttling of remote transmitter. */
-        return 65536;
-}       /* end of n_hdlc_tty_root() */
-/**
 * n_hdlc_tty_receive - Called by tty driver when receive data is available
 * @tty - pointer to tty instance data
 * @data - pointer to received data
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 853c98cee64f..c48de09d68f0 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -147,7 +147,6 @@ static unsigned int r3964_poll(struct tty_struct * tty, struct file * file,
                      struct poll_table_struct  *wait);
 static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                              char *fp, int count);
-static int  r3964_receive_room(struct tty_struct *tty);
 static struct tty_ldisc tty_ldisc_N_R3964 = {
        .owner   = THIS_MODULE,
@@ -161,7 +160,6 @@ static struct tty_ldisc tty_ldisc_N_R3964 = {
        .set_termios = r3964_set_termios,
        .poll   = r3964_poll,            
        .receive_buf = r3964_receive_buf,
-        .receive_room = r3964_receive_room,
 };
@@ -1119,6 +1117,7 @@ static int r3964_open(struct tty_struct *tty)
   pInfo->nRetry = 0;
   
   tty->disc_data = pInfo;
+   tty->receive_room = 65536;
   init_timer(&pInfo->tmr);
   pInfo->tmr.data = (unsigned long)pInfo;
@@ -1405,12 +1404,5 @@ static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
    }
 }
-static int r3964_receive_room(struct tty_struct *tty)
-{
-   TRACE_L("receive_room");
-   return -1;
-}
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_LDISC(N_R3964);
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index c556f4d3ccd7..ccad7ae94541 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -78,7 +78,32 @@ static inline void free_buf(unsigned char *buf)
                free_page((unsigned long) buf);
 }
-static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
+/**
+ *      n_tty_set__room -       receive space
+ *      @tty: terminal
+ *
+ *      Called by the driver to find out how much data it is
+ *      permitted to feed to the line discipline without any being lost
+ *      and thus to manage flow control. Not serialized. Answers for the
+ *      "instant".
+ */
+static void n_tty_set_room(struct tty_struct *tty)
+{
+        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
+        /*
+         * If we are doing input canonicalization, and there are no
+         * pending newlines, let characters through without limit, so
+         * that erase characters will be handled.  Other excess
+         * characters will be beeped.
+         */
+        if (left <= 0)
+                left = tty->icanon && !tty->canon_data;
+        tty->receive_room = left;
+}
+static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
 {
        if (tty->read_cnt < N_TTY_BUF_SIZE) {
                tty->read_buf[tty->read_head] = c;
@@ -87,7 +112,7 @@ static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
        }
 }
-static inline void put_tty_queue(unsigned char c, struct tty_struct *tty)
+static void put_tty_queue(unsigned char c, struct tty_struct *tty)
 {
        unsigned long flags;
        /*
@@ -136,6 +161,7 @@ static void reset_buffer_flags(struct tty_struct *tty)
        spin_unlock_irqrestore(&tty->read_lock, flags);
        tty->canon_head = tty->canon_data = tty->erasing = 0;
        memset(&tty->read_flags, 0, sizeof tty->read_flags);
+        n_tty_set_room(tty);
        check_unthrottle(tty);
 }
@@ -838,30 +864,6 @@ send_signal:
        put_tty_queue(c, tty);
 }       
-/**
- *      n_tty_receive_room      -       receive space
- *      @tty: terminal
- *
- *      Called by the driver to find out how much data it is
- *      permitted to feed to the line discipline without any being lost
- *      and thus to manage flow control. Not serialized. Answers for the
- *      "instant".
- */
- 
-static int n_tty_receive_room(struct tty_struct *tty)
-{
-        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
-        /*
-         * If we are doing input canonicalization, and there are no
-         * pending newlines, let characters through without limit, so
-         * that erase characters will be handled.  Other excess
-         * characters will be beeped.
-         */
-        if (left <= 0)
-                left = tty->icanon && !tty->canon_data;
-        return left;
-}
 /**
 *      n_tty_write_wakeup      -       asynchronous I/O notifier
@@ -953,6 +955,8 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                        tty->driver->flush_chars(tty);
        }
+        n_tty_set_room(tty);
        if (!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) {
                kill_fasync(&tty->fasync, SIGIO, POLL_IN);
                if (waitqueue_active(&tty->read_wait))
@@ -964,7 +968,7 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
         * mode.  We don't want to throttle the driver if we're in
         * canonical mode and don't have a newline yet!
         */
-        if (n_tty_receive_room(tty) < TTY_THRESHOLD_THROTTLE) {
+        if (tty->receive_room < TTY_THRESHOLD_THROTTLE) {
                /* check TTY_THROTTLED first so it indicates our state */
                if (!test_and_set_bit(TTY_THROTTLED, &tty->flags) &&
                    tty->driver->throttle)
@@ -999,6 +1003,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
        if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
                tty->raw = 1;
                tty->real_raw = 1;
+                n_tty_set_room(tty);
                return;
        }
        if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
@@ -1051,6 +1056,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
                else
                        tty->real_raw = 0;
        }
+        n_tty_set_room(tty);
 }
 /**
@@ -1130,7 +1136,7 @@ static inline int input_available_p(struct tty_struct *tty, int amt)
 *
 */
 
-static inline int copy_from_read_buf(struct tty_struct *tty,
+static int copy_from_read_buf(struct tty_struct *tty,
                                      unsigned char __user **b,
                                      size_t *nr)
@@ -1308,6 +1314,7 @@ do_it_again:
                                retval = -ERESTARTSYS;
                                break;
                        }
+                        n_tty_set_room(tty);
                        clear_bit(TTY_DONT_FLIP, &tty->flags);
                        timeout = schedule_timeout(timeout);
                        set_bit(TTY_DONT_FLIP, &tty->flags);
@@ -1401,6 +1408,8 @@ do_it_again:
        } else if (test_and_clear_bit(TTY_PUSH, &tty->flags))
                 goto do_it_again;
+        n_tty_set_room(tty);
        return retval;
 }
@@ -1553,7 +1562,6 @@ struct tty_ldisc tty_ldisc_N_TTY = {
        normal_poll,            /* poll */
        NULL,                   /* hangup */
        n_tty_receive_buf,      /* receive_buf */
-        n_tty_receive_room,     /* receive_room */
        n_tty_write_wakeup      /* write_wakeup */
 };
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 9fb10c9fec88..8a8ca32822ba 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1007,8 +1007,9 @@ static void rx_ready_hdlc(MGSLPC_INFO *info, int eom)
 static void rx_ready_async(MGSLPC_INFO *info, int tcd)
 {
-        unsigned char data, status;
+        unsigned char data, status, flag;
        int fifo_count;
+        int work = 0;
        struct tty_struct *tty = info->tty;
        struct mgsl_icount *icount = &info->icount;
@@ -1023,20 +1024,16 @@ static void rx_ready_async(MGSLPC_INFO *info, int tcd)
                        fifo_count = 32;
        } else
                fifo_count = 32;
-        
+        tty_buffer_request_room(tty, fifo_count);
        /* Flush received async data to receive data buffer. */ 
        while (fifo_count) {
                data   = read_reg(info, CHA + RXFIFO);
                status = read_reg(info, CHA + RXFIFO);
                fifo_count -= 2;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-                        
-                *tty->flip.char_buf_ptr = data;
                icount->rx++;
-                
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = 0;
                // if no frameing/crc error then save data
                // BIT7:parity error
@@ -1055,26 +1052,23 @@ static void rx_ready_async(MGSLPC_INFO *info, int tcd)
                        status &= info->read_status_mask;
                        if (status & BIT7)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (status & BIT6)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
-                
+                work += tty_insert_flip_char(tty, data, flag);
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
        }
        issue_command(info, CHA, CMD_RXFIFO);
        if (debug_level >= DEBUG_LEVEL_ISR) {
-                printk("%s(%d):rx_ready_async count=%d\n",
+                printk("%s(%d):rx_ready_async",
-                        __FILE__,__LINE__,tty->flip.count);
+                        __FILE__,__LINE__);
                printk("%s(%d):rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                        __FILE__,__LINE__,icount->rx,icount->brk,
                        icount->parity,icount->frame,icount->overrun);
        }
                        
-        if (tty->flip.count)
+        if (work)
                tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 49f3997fd251..9b5a2c0e7008 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -111,7 +111,7 @@ static int pty_write(struct tty_struct * tty, const unsigned char *buf, int coun
        if (!to || tty->stopped)
                return 0;
-        c = to->ldisc.receive_room(to);
+        c = to->receive_room;
        if (c > count)
                c = count;
        to->ldisc.receive_buf(to, buf, NULL, c);
@@ -126,7 +126,7 @@ static int pty_write_room(struct tty_struct *tty)
        if (!to || tty->stopped)
                return 0;
-        return to->ldisc.receive_room(to);
+        return to->receive_room;
 }
 /*
diff --git a/drivers/char/rio/riointr.c b/drivers/char/rio/riointr.c
index e42e7b50bf6b..ddda9c14e059 100644
--- a/drivers/char/rio/riointr.c
+++ b/drivers/char/rio/riointr.c
@@ -38,6 +38,7 @@ static char *_riointr_c_sccs_ = "@(#)riointr.c	1.2";
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <asm/io.h>
 #include <asm/system.h>
 #include <asm/string.h>
@@ -560,6 +561,7 @@ struct Port *		PortP;
  struct PKT *PacketP;
  register uint DataCnt;
  uchar *       ptr;
+  unsigned char *buf;
  int copied =0;
  static int intCount, RxIntCnt;
@@ -657,8 +659,7 @@ struct Port *		PortP;
          ** and available space.
          */
                        
-          transCount = min_t(unsigned int, PacketP->len & PKT_LEN_MASK,
+          transCount = tty_buffer_request_room(TtyP, PacketP->len & PKT_LEN_MASK);
-                           TTY_FLIPBUF_SIZE - TtyP->flip.count);
          rio_dprintk (RIO_DEBUG_REC,  "port %d: Copy %d bytes\n", 
                                      PortP->PortNum, transCount);
          /*
@@ -678,9 +679,8 @@ struct Port *		PortP;
 #endif
          ptr = (uchar *) PacketP->data + PortP->RxDataStart;
-          rio_memcpy_fromio (TtyP->flip.char_buf_ptr, ptr, transCount);
+          tty_prepare_flip_string(TtyP, &buf, transCount);
-          memset(TtyP->flip.flag_buf_ptr, TTY_NORMAL, transCount);
+          rio_memcpy_fromio (buf, ptr, transCount);
 #ifdef STATS
          /*
          ** keep a count for statistical purposes
@@ -690,9 +690,6 @@ struct Port *		PortP;
          PortP->RxDataStart    += transCount;
          PacketP->len          -= transCount;
          copied += transCount;
-          TtyP->flip.count += transCount;
-          TtyP->flip.char_buf_ptr += transCount;
-          TtyP->flip.flag_buf_ptr += transCount;
 #ifdef ___DEBUG_IT___
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 5dae32521620..050e70ee5920 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -46,6 +46,7 @@
 #include <linux/major.h>
 #include <linux/init.h>
 #include <linux/delay.h>
+#include <linux/tty_flip.h>
 #include <asm/uaccess.h>
@@ -354,28 +355,17 @@ static inline void rc_receive_exc(struct riscom_board const * bp)
        struct riscom_port *port;
        struct tty_struct *tty;
        unsigned char status;
-        unsigned char ch;
+        unsigned char ch, flag;
        
        if (!(port = rc_get_port(bp, "Receive")))
                return;
        tty = port->tty;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)  {
-                printk(KERN_WARNING "rc%d: port %d: Working around flip "
-                                    "buffer overflow.\n",
-                       board_No(bp), port_No(port));
-                return;
-        }
        
 #ifdef RC_REPORT_OVERRUN        
        status = rc_in(bp, CD180_RCSR);
-        if (status & RCSR_OE)  {
+        if (status & RCSR_OE)
                port->overrun++;
-#if 0           
-                printk(KERN_ERR "rc%d: port %d: Overrun. Total %ld overruns\n", 
-                       board_No(bp), port_No(port), port->overrun);
-#endif          
-        }
        status &= port->mark_mask;
 #else   
        status = rc_in(bp, CD180_RCSR) & port->mark_mask;
@@ -393,25 +383,24 @@ static inline void rc_receive_exc(struct riscom_board const * bp)
        } else if (status & RCSR_BREAK)  {
                printk(KERN_INFO "rc%d: port %d: Handling break...\n",
                       board_No(bp), port_No(port));
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                flag = TTY_BREAK;
                if (port->flags & ASYNC_SAK)
                        do_SAK(tty);
                
        } else if (status & RCSR_PE) 
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                flag = TTY_PARITY;
        
        else if (status & RCSR_FE) 
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                flag = TTY_FRAME;
        
        else if (status & RCSR_OE)
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                flag = TTY_OVERRUN;
        
        else
-                *tty->flip.flag_buf_ptr++ = 0;
+                flag = TTY_NORMAL;
        
-        *tty->flip.char_buf_ptr++ = ch;
+        tty_insert_flip_char(tty, ch, flag);
-        tty->flip.count++;
+        tty_flip_buffer_push(tty);
-        schedule_delayed_work(&tty->flip.work, 1);
 }
 static inline void rc_receive(struct riscom_board const * bp)
@@ -432,17 +421,15 @@ static inline void rc_receive(struct riscom_board const * bp)
 #endif  
        
        while (count--)  {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)  {
+                if (tty_buffer_request_room(tty, 1) == 0)  {
                        printk(KERN_WARNING "rc%d: port %d: Working around "
                                            "flip buffer overflow.\n",
                               board_No(bp), port_No(port));
                        break;
                }
-                *tty->flip.char_buf_ptr++ = rc_in(bp, CD180_RDR);
+                tty_insert_flip_char(tty, rc_in(bp, CD180_RDR), TTY_NORMAL);
-                *tty->flip.flag_buf_ptr++ = 0;
-                tty->flip.count++;
        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        tty_flip_buffer_push(tty);
 }
 static inline void rc_transmit(struct riscom_board const * bp)
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index d3bc731fbb27..0949dcef0697 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -325,19 +325,16 @@ static void rp_do_receive(struct r_port *info,
 {
        unsigned int CharNStat;
        int ToRecv, wRecv, space = 0, count;
-        unsigned char *cbuf;
+        unsigned char *cbuf, *chead;
-        char *fbuf;
+        char *fbuf, *fhead;
        struct tty_ldisc *ld;
        ld = tty_ldisc_ref(tty);
        ToRecv = sGetRxCnt(cp);
-        if (ld)
+        space = tty->receive_room;
-                space = ld->receive_room(tty);
        if (space > 2 * TTY_FLIPBUF_SIZE)
                space = 2 * TTY_FLIPBUF_SIZE;
-        cbuf = tty->flip.char_buf;
-        fbuf = tty->flip.flag_buf;
        count = 0;
 #ifdef ROCKET_DEBUG_INTR
        printk(KERN_INFO "rp_do_receive(%d, %d)...", ToRecv, space);
@@ -350,9 +347,13 @@ static void rp_do_receive(struct r_port *info,
        if (ToRecv > space)
                ToRecv = space;
+        ToRecv = tty_prepare_flip_string_flags(tty, &chead, &fhead, ToRecv);
        if (ToRecv <= 0)
                goto done;
+        cbuf = chead;
+        fbuf = fhead;
        /*
         * if status indicates there are errored characters in the
         * FIFO, then enter status mode (a word in FIFO holds
@@ -399,7 +400,7 @@ static void rp_do_receive(struct r_port *info,
                        else if (CharNStat & STMRCVROVRH)
                                *fbuf++ = TTY_OVERRUN;
                        else
-                                *fbuf++ = 0;
+                                *fbuf++ = TTY_NORMAL;
                        *cbuf++ = CharNStat & 0xff;
                        count++;
                        ToRecv--;
@@ -426,13 +427,13 @@ static void rp_do_receive(struct r_port *info,
                        sInStrW(sGetTxRxDataIO(cp), (unsigned short *) cbuf, wRecv);
                if (ToRecv & 1)
                        cbuf[ToRecv - 1] = sInB(sGetTxRxDataIO(cp));
-                memset(fbuf, 0, ToRecv);
+                memset(fbuf, TTY_NORMAL, ToRecv);
                cbuf += ToRecv;
                fbuf += ToRecv;
                count += ToRecv;
        }
        /*  Push the data up to the tty layer */
-        ld->receive_buf(tty, tty->flip.char_buf, tty->flip.flag_buf, count);
+        ld->receive_buf(tty, cbuf, fbuf, count);
 done:
        tty_ldisc_deref(ld);
 }
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index 5b187c895c18..71093a9fc462 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -275,7 +275,8 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
 int paste_selection(struct tty_struct *tty)
 {
        struct vc_data *vc = (struct vc_data *)tty->driver_data;
-        int     pasted = 0, count;
+        int     pasted = 0;
+        unsigned int count;
        struct  tty_ldisc *ld;
        DECLARE_WAITQUEUE(wait, current);
@@ -293,7 +294,7 @@ int paste_selection(struct tty_struct *tty)
                        continue;
                }
                count = sel_buffer_lth - pasted;
-                count = min(count, tty->ldisc.receive_room(tty));
+                count = min(count, tty->receive_room);
                tty->ldisc.receive_buf(tty, sel_buffer + pasted, NULL, count);
                pasted += count;
        }
diff --git a/drivers/char/ser_a2232.c b/drivers/char/ser_a2232.c
index dda30e42ec79..80a5b840e22f 100644
--- a/drivers/char/ser_a2232.c
+++ b/drivers/char/ser_a2232.c
@@ -194,11 +194,6 @@ static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
 */
        struct tty_struct *tty = port->gs.tty;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                return;
-        tty->flip.count++;
 #if 0
        switch(err) {
        case TTY_BREAK:
@@ -212,8 +207,7 @@ static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
        }
 #endif
-        *tty->flip.flag_buf_ptr++ = err;
+        tty_insert_flip_char(tty, ch, err);
-        *tty->flip.char_buf_ptr++ = ch;
        tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index a580748b92a1..f36342ae8e7e 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -422,45 +422,35 @@ cd2401_rxerr_interrupt(int irq, void *dev_id, struct pt_regs *fp)
            base_addr[CyREOIR] = rfoc ? 0 : CyNOTRANS;
            return IRQ_HANDLED;
        }
-        if (tty->flip.count < TTY_FLIPBUF_SIZE){
+        if (tty_buffer_request_room(tty, 1) != 0){
-            tty->flip.count++;
            if (err & info->read_status_mask){
                if(err & CyBREAK){
-                    *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                    tty_insert_flip_char(tty, data, TTY_BREAK);
-                    *tty->flip.char_buf_ptr++ = data;
                    if (info->flags & ASYNC_SAK){
                        do_SAK(tty);
                    }
                }else if(err & CyFRAME){
-                    *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                    tty_insert_flip_char(tty, data, TTY_FRAME);
-                    *tty->flip.char_buf_ptr++ = data;
                }else if(err & CyPARITY){
-                    *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                    tty_insert_flip_char(tty, data, TTY_PARITY);
-                    *tty->flip.char_buf_ptr++ = data;
                }else if(err & CyOVERRUN){
-                    *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                    tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                    *tty->flip.char_buf_ptr++ = 0;
                    /*
                       If the flip buffer itself is
                       overflowing, we still loose
                       the next incoming character.
                     */
-                    if(tty->flip.count < TTY_FLIPBUF_SIZE){
+                    tty_insert_flip_char(tty, data, TTY_NORMAL);
-                        tty->flip.count++;
+                }
-                        *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                        *tty->flip.char_buf_ptr++ = data;
-                    }
                /* These two conditions may imply */
                /* a normal read should be done. */
                /* else if(data & CyTIMEOUT) */
                /* else if(data & CySPECHAR) */
                }else{
-                    *tty->flip.flag_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, 0, TTY_NORMAL);
-                    *tty->flip.char_buf_ptr++ = 0;
                }
            }else{
-                *tty->flip.flag_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, data, TTY_NORMAL);
-                *tty->flip.char_buf_ptr++ = 0;
            }
        }else{
            /* there was a software buffer overrun
@@ -692,12 +682,7 @@ cd2401_rx_interrupt(int irq, void *dev_id, struct pt_regs *fp)
 #endif
        while(char_count--){
            data = base_addr[CyRDR];
-            if (tty->flip.count >= TTY_FLIPBUF_SIZE){
+            tty_insert_flip_char(tty, data, TTY_NORMAL);
-                continue;
-            }
-            tty->flip.count++;
-            *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-            *tty->flip.char_buf_ptr++ = data;
 #ifdef CYCLOM_16Y_HACK
            udelay(10L);
 #endif
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 0bbfce43031c..0a574bdbce36 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -85,6 +85,7 @@
 #include <linux/interrupt.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/mm.h>
 #include <linux/serial.h>
 #include <linux/fcntl.h>
@@ -665,7 +666,7 @@ static inline void sx_receive_exc(struct specialix_board * bp)
        struct specialix_port *port;
        struct tty_struct *tty;
        unsigned char status;
-        unsigned char ch;
+        unsigned char ch, flag;
        func_enter();
@@ -676,8 +677,6 @@ static inline void sx_receive_exc(struct specialix_board * bp)
                return;
        }
        tty = port->tty;
-        dprintk (SX_DEBUG_RX, "port: %p count: %d BUFF_SIZE: %d\n",
-                 port,  tty->flip.count, TTY_FLIPBUF_SIZE);
        status = sx_in(bp, CD186x_RCSR);
@@ -691,7 +690,7 @@ static inline void sx_receive_exc(struct specialix_board * bp)
        /* This flip buffer check needs to be below the reading of the
           status register to reset the chip's IRQ.... */
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+        if (tty_buffer_request_room(tty, 1) == 0) {
                dprintk(SX_DEBUG_FIFO, "sx%d: port %d: Working around flip buffer overflow.\n",
                       board_No(bp), port_No(port));
                func_exit();
@@ -712,26 +711,24 @@ static inline void sx_receive_exc(struct specialix_board * bp)
        } else if (status & RCSR_BREAK) {
                dprintk(SX_DEBUG_RX, "sx%d: port %d: Handling break...\n",
                       board_No(bp), port_No(port));
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                flag = TTY_BREAK;
                if (port->flags & ASYNC_SAK)
                        do_SAK(tty);
        } else if (status & RCSR_PE)
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                flag = TTY_PARITY;
        else if (status & RCSR_FE)
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                flag = TTY_FRAME;
        else if (status & RCSR_OE)
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                flag = TTY_OVERRUN;
        else
-                *tty->flip.flag_buf_ptr++ = 0;
+                flag = TTY_NORMAL;
-        *tty->flip.char_buf_ptr++ = ch;
-        tty->flip.count++;
-        schedule_delayed_work(&tty->flip.work, 1);
+        if(tty_insert_flip_char(tty, ch, flag))
+                tty_flip_buffer_push(tty);
        func_exit();
 }
@@ -755,18 +752,11 @@ static inline void sx_receive(struct specialix_board * bp)
        dprintk (SX_DEBUG_RX, "port: %p: count: %d\n", port, count);
        port->hits[count > 8 ? 9 : count]++;
-        while (count--) {
+        tty_buffer_request_room(tty, count);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        printk(KERN_INFO "sx%d: port %d: Working around flip buffer overflow.\n",
-                               board_No(bp), port_No(port));
-                        break;
-                }
-                *tty->flip.char_buf_ptr++ = sx_in(bp, CD186x_RDR);
-                *tty->flip.flag_buf_ptr++ = 0;
-                tty->flip.count++;
-        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        while (count--)
+                tty_insert_flip_char(tty, sx_in(bp, CD186x_RDR), TTY_NORMAL);
+        tty_flip_buffer_push(tty);
        func_exit();
 }
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index acef2abf3f0d..0e20780d4a29 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -2901,7 +2901,8 @@ static int stl_getportstats(stlport_t *portp, comstats_t __user *cp)
        if (portp->tty != (struct tty_struct *) NULL) {
                if (portp->tty->driver_data == portp) {
                        portp->stats.ttystate = portp->tty->flags;
-                        portp->stats.rxbuffered = portp->tty->flip.count;
+                        /* No longer available as a statistic */
+                        portp->stats.rxbuffered = 1; /*portp->tty->flip.count; */
                        if (portp->tty->termios != (struct termios *) NULL) {
                                portp->stats.cflags = portp->tty->termios->c_cflag;
                                portp->stats.iflags = portp->tty->termios->c_iflag;
@@ -4045,9 +4046,7 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
        if ((ioack & ACK_TYPMASK) == ACK_TYPRXGOOD) {
                outb((RDCR + portp->uartaddr), ioaddr);
                len = inb(ioaddr + EREG_DATA);
-                if ((tty == (struct tty_struct *) NULL) ||
+                if (tty == NULL || (buflen = tty_buffer_request_room(tty, len)) == 0) {
-                    (tty->flip.char_buf_ptr == (char *) NULL) ||
-                    ((buflen = TTY_FLIPBUF_SIZE - tty->flip.count) == 0)) {
                        len = MIN(len, sizeof(stl_unwanted));
                        outb((RDSR + portp->uartaddr), ioaddr);
                        insb((ioaddr + EREG_DATA), &stl_unwanted[0], len);
@@ -4056,12 +4055,10 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                } else {
                        len = MIN(len, buflen);
                        if (len > 0) {
+                                unsigned char *ptr;
                                outb((RDSR + portp->uartaddr), ioaddr);
-                                insb((ioaddr + EREG_DATA), tty->flip.char_buf_ptr, len);
+                                tty_prepare_flip_string(tty, &ptr, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
+                                insb((ioaddr + EREG_DATA), ptr, len);
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.count += len;
                                tty_schedule_flip(tty);
                                portp->stats.rxtotal += len;
                        }
@@ -4085,8 +4082,7 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                                portp->stats.txxoff++;
                        goto stl_rxalldone;
                }
-                if ((tty != (struct tty_struct *) NULL) &&
+                if (tty != NULL && (portp->rxignoremsk & status) == 0) {
-                    ((portp->rxignoremsk & status) == 0)) {
                        if (portp->rxmarkmsk & status) {
                                if (status & ST_BREAK) {
                                        status = TTY_BREAK;
@@ -4106,14 +4102,8 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                        } else {
                                status = 0;
                        }
-                        if (tty->flip.char_buf_ptr != (char *) NULL) {
+                        tty_insert_flip_char(tty, ch, status);
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                        tty_schedule_flip(tty);
-                                        *tty->flip.flag_buf_ptr++ = status;
-                                        *tty->flip.char_buf_ptr++ = ch;
-                                        tty->flip.count++;
-                                }
-                                tty_schedule_flip(tty);
-                        }
                }
        } else {
                printk("STALLION: bad RX interrupt ack value=%x\n", ioack);
@@ -5012,9 +5002,7 @@ static void stl_sc26198rxisr(stlport_t *portp, unsigned int iack)
        len = inb(ioaddr + XP_DATA) + 1;
        if ((iack & IVR_TYPEMASK) == IVR_RXDATA) {
-                if ((tty == (struct tty_struct *) NULL) ||
+                if (tty == NULL || (buflen = tty_buffer_request_room(tty, len)) == 0) {
-                    (tty->flip.char_buf_ptr == (char *) NULL) ||
-                    ((buflen = TTY_FLIPBUF_SIZE - tty->flip.count) == 0)) {
                        len = MIN(len, sizeof(stl_unwanted));
                        outb(GRXFIFO, (ioaddr + XP_ADDR));
                        insb((ioaddr + XP_DATA), &stl_unwanted[0], len);
@@ -5023,12 +5011,10 @@ static void stl_sc26198rxisr(stlport_t *portp, unsigned int iack)
                } else {
                        len = MIN(len, buflen);
                        if (len > 0) {
+                                unsigned char *ptr;
                                outb(GRXFIFO, (ioaddr + XP_ADDR));
-                                insb((ioaddr + XP_DATA), tty->flip.char_buf_ptr, len);
+                                tty_prepare_flip_string(tty, &ptr, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
+                                insb((ioaddr + XP_DATA), ptr, len);
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.count += len;
                                tty_schedule_flip(tty);
                                portp->stats.rxtotal += len;
                        }
@@ -5096,14 +5082,8 @@ static inline void stl_sc26198rxbadch(stlport_t *portp, unsigned char status, ch
                        status = 0;
                }
-                if (tty->flip.char_buf_ptr != (char *) NULL) {
+                tty_insert_flip_char(tty, ch, status);
-                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                tty_schedule_flip(tty);
-                                *tty->flip.flag_buf_ptr++ = status;
-                                *tty->flip.char_buf_ptr++ = ch;
-                                tty->flip.count++;
-                        }
-                        tty_schedule_flip(tty);
-                }
                if (status == 0)
                        portp->stats.rxtotal++;
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 564f31778eb3..64bf89cb574f 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1085,6 +1085,7 @@ static inline void sx_receive_chars (struct sx_port *port)
        int rx_op;
        struct tty_struct *tty;
        int copied=0;
+        unsigned char *rp;
        func_enter2 ();
        tty = port->gs.tty;
@@ -1095,8 +1096,8 @@ static inline void sx_receive_chars (struct sx_port *port)
                sx_dprintk (SX_DEBUG_RECEIVE, "rxop=%d, c = %d.\n", rx_op, c); 
                /* Don't copy more bytes than there is room for in the buffer */
-                if (tty->flip.count + c > TTY_FLIPBUF_SIZE) 
-                        c = TTY_FLIPBUF_SIZE - tty->flip.count;
+                c = tty_prepare_flip_string(tty, &rp, c);
                sx_dprintk (SX_DEBUG_RECEIVE, "c = %d.\n", c); 
@@ -1111,14 +1112,8 @@ static inline void sx_receive_chars (struct sx_port *port)
                sx_dprintk (SX_DEBUG_RECEIVE , "Copying over %d chars. First is %d at %lx\n", c, 
                            read_sx_byte (port->board, CHAN_OFFSET(port,hi_rxbuf) + rx_op),
                            CHAN_OFFSET(port, hi_rxbuf)); 
-                memcpy_fromio (tty->flip.char_buf_ptr, 
+                memcpy_fromio (rp,
                               port->board->base + CHAN_OFFSET(port,hi_rxbuf) + rx_op, c);
-                memset(tty->flip.flag_buf_ptr, TTY_NORMAL, c);
-                /* Update the kernel buffer end */
-                tty->flip.count += c;
-                tty->flip.char_buf_ptr += c;
-                tty->flip.flag_buf_ptr += c;
                /* This one last. ( Not essential.)
                   It allows the card to start putting more data into the buffer! 
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index 789572fc002b..9f1b466c4f84 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1467,6 +1467,7 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
 {
        int Fifocount;
        u16 status;
+        int work = 0;
        unsigned char DataByte;
        struct tty_struct *tty = info->tty;
        struct  mgsl_icount *icount = &info->icount;
@@ -1487,6 +1488,8 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
        /* flush the receive FIFO */
        while( (Fifocount = (usc_InReg(info,RICR) >> 8)) ) {
+                int flag;
                /* read one byte from RxFIFO */
                outw( (inw(info->io_base + CCAR) & 0x0780) | (RDR+LSBONLY),
                      info->io_base + CCAR );
@@ -1498,13 +1501,9 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
                                RXSTATUS_OVERRUN + RXSTATUS_BREAK_RECEIVED) )
                        usc_UnlatchRxstatusBits(info,RXSTATUS_ALL);
                
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        continue;
-                        
-                *tty->flip.char_buf_ptr = DataByte;
                icount->rx++;
                
-                *tty->flip.flag_buf_ptr = 0;
+                flag = 0;
                if ( status & (RXSTATUS_FRAMING_ERROR + RXSTATUS_PARITY_ERROR +
                                RXSTATUS_OVERRUN + RXSTATUS_BREAK_RECEIVED) ) {
                        printk("rxerr=%04X\n",status);                                  
@@ -1530,41 +1529,31 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
                        status &= info->read_status_mask;
                
                        if (status & RXSTATUS_BREAK_RECEIVED) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                                if (info->flags & ASYNC_SAK)
                                        do_SAK(tty);
                        } else if (status & RXSTATUS_PARITY_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (status & RXSTATUS_FRAMING_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        if (status & RXSTATUS_OVERRUN) {
-                                /* Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                }
-                        }
                }       /* end of if (error) */
-                
+                tty_insert_flip_char(tty, DataByte, flag);
-                tty->flip.flag_buf_ptr++;
+                if (status & RXSTATUS_OVERRUN) {
-                tty->flip.char_buf_ptr++;
+                        /* Overrun is special, since it's
-                tty->flip.count++;
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        work += tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                }
        }
        if ( debug_level >= DEBUG_LEVEL_ISR ) {
-                printk("%s(%d):mgsl_isr_receive_data flip count=%d\n",
-                        __FILE__,__LINE__,tty->flip.count);
                printk("%s(%d):rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                        __FILE__,__LINE__,icount->rx,icount->brk,
                        icount->parity,icount->frame,icount->overrun);
        }
                        
-        if ( tty->flip.count )
+        if(work)
                tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 41759cd70a4f..79c81def4104 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -1749,6 +1749,9 @@ static void rx_async(struct slgt_info *info)
        unsigned char status;
        struct slgt_desc *bufs = info->rbufs;
        int i, count;
+        int chars = 0;
+        int stat;
+        unsigned char ch;
        start = end = info->rbuf_current;
@@ -1760,16 +1763,15 @@ static void rx_async(struct slgt_info *info)
                DBGDATA(info, p, count, "rx");
                for(i=0 ; i < count; i+=2, p+=2) {
-                        if (tty) {
+                        if (tty && chars) {
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                                tty_flip_buffer_push(tty);
-                                        tty_flip_buffer_push(tty);
+                                chars = 0;
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                        break;
-                                *tty->flip.char_buf_ptr = *p;
-                                *tty->flip.flag_buf_ptr = 0;
                        }
+                        ch = *p;
                        icount->rx++;
+                        stat = 0;
                        if ((status = *(p+1) & (BIT9 + BIT8))) {
                                if (status & BIT9)
                                        icount->parity++;
@@ -1778,17 +1780,14 @@ static void rx_async(struct slgt_info *info)
                                /* discard char if tty control flags say so */
                                if (status & info->ignore_status_mask)
                                        continue;
-                                if (tty) {
+                                if (status & BIT9)
-                                        if (status & BIT9)
+                                        stat = TTY_PARITY;
-                                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                else if (status & BIT8)
-                                        else if (status & BIT8)
+                                        stat = TTY_FRAME;
-                                                *tty->flip.flag_buf_ptr = TTY_FRAME;
-                                }
                        }
                        if (tty) {
-                                tty->flip.flag_buf_ptr++;
+                                tty_insert_flip_char(tty, ch, stat);
-                                tty->flip.char_buf_ptr++;
+                                chars++;
-                                tty->flip.count++;
                        }
                }
@@ -1811,7 +1810,7 @@ static void rx_async(struct slgt_info *info)
                        break;
        }
-        if (tty && tty->flip.count)
+        if (tty && chars)
                tty_flip_buffer_push(tty);
 }
@@ -2029,7 +2028,7 @@ static void isr_serial(struct slgt_info *info)
                        if (info->tty) {
                                if (!(status & info->ignore_status_mask)) {
                                        if (info->read_status_mask & MASK_BREAK) {
-                                                *info->tty->flip.flag_buf_ptr = TTY_BREAK;
+                                                tty_insert_flip_char(info->tty, 0, TTY_BREAK);
                                                if (info->flags & ASYNC_SAK)
                                                        do_SAK(info->tty);
                                        }
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index a9467e7d3747..960adb256fbb 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -2196,7 +2196,7 @@ void isr_rxint(SLMP_INFO * info)
                        if ( tty ) {
                                if (!(status & info->ignore_status_mask1)) {
                                        if (info->read_status_mask1 & BRKD) {
-                                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                                tty_insert_flip_char(tty, 0, TTY_BREAK);
                                                if (info->flags & ASYNC_SAK)
                                                        do_SAK(tty);
                                        }
@@ -2240,16 +2240,10 @@ void isr_rxrdy(SLMP_INFO * info)
        while((status = read_reg(info,CST0)) & BIT0)
        {
+                int flag = 0;
+                int over = 0;
                DataByte = read_reg(info,TRB);
-                if ( tty ) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                continue;
-                        *tty->flip.char_buf_ptr = DataByte;
-                        *tty->flip.flag_buf_ptr = 0;
-                }
                icount->rx++;
                if ( status & (PE + FRME + OVRN) ) {
@@ -2272,42 +2266,34 @@ void isr_rxrdy(SLMP_INFO * info)
                        if ( tty ) {
                                if (status & PE)
-                                        *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                else if (status & FRME)
-                                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                        flag = TTY_FRAME;
                                if (status & OVRN) {
                                        /* Overrun is special, since it's
                                         * reported immediately, and doesn't
                                         * affect the current character
                                         */
-                                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                                        over = 1;
-                                                tty->flip.count++;
-                                                tty->flip.flag_buf_ptr++;
-                                                tty->flip.char_buf_ptr++;
-                                                *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                        }
                                }
                        }
                }       /* end of if (error) */
                if ( tty ) {
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, DataByte, flag);
-                        tty->flip.char_buf_ptr++;
+                        if (over)
-                        tty->flip.count++;
+                                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                }
        }
        if ( debug_level >= DEBUG_LEVEL_ISR ) {
-                printk("%s(%d):%s isr_rxrdy() flip count=%d\n",
-                        __FILE__,__LINE__,info->device_name,
-                        tty ? tty->flip.count : 0);
                printk("%s(%d):%s rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                        __FILE__,__LINE__,info->device_name,
                        icount->rx,icount->brk,icount->parity,
                        icount->frame,icount->overrun);
        }
-        if ( tty && tty->flip.count )
+        if ( tty )
                tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 4b1eef51ec59..1eda82b31a61 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -166,9 +166,12 @@ static struct tty_struct *alloc_tty_struct(void)
        return tty;
 }
+static void tty_buffer_free_all(struct tty_struct *);
 static inline void free_tty_struct(struct tty_struct *tty)
 {
        kfree(tty->write_buf);
+        tty_buffer_free_all(tty);
        kfree(tty);
 }
@@ -231,6 +234,201 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
 }
 /*
+ * Tty buffer allocation management
+ */
+static void tty_buffer_free_all(struct tty_struct *tty)
+{
+        struct tty_buffer *thead;
+        while((thead = tty->buf.head) != NULL) {
+                tty->buf.head = thead->next;
+                kfree(thead);
+        }
+        while((thead = tty->buf.free) != NULL) {
+                tty->buf.free = thead->next;
+                kfree(thead);
+        }
+        tty->buf.tail = NULL;
+}
+static void tty_buffer_init(struct tty_struct *tty)
+{
+        tty->buf.head = NULL;
+        tty->buf.tail = NULL;
+        tty->buf.free = NULL;
+}
+static struct tty_buffer *tty_buffer_alloc(size_t size)
+{
+        struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
+        if(p == NULL)
+                return NULL;
+        p->used = 0;
+        p->size = size;
+        p->next = NULL;
+        p->char_buf_ptr = (char *)(p->data);
+        p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
+/*      printk("Flip create %p\n", p); */
+        return p;
+}
+/* Must be called with the tty_read lock held. This needs to acquire strategy
+   code to decide if we should kfree or relink a given expired buffer */
+static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
+{
+        /* Dumb strategy for now - should keep some stats */
+/*      printk("Flip dispose %p\n", b); */
+        if(b->size >= 512)
+                kfree(b);
+        else {
+                b->next = tty->buf.free;
+                tty->buf.free = b;
+        }
+}
+static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer **tbh = &tty->buf.free;
+        while((*tbh) != NULL) {
+                struct tty_buffer *t = *tbh;
+                if(t->size >= size) {
+                        *tbh = t->next;
+                        t->next = NULL;
+                        t->used = 0;
+                        /* DEBUG ONLY */
+                        memset(t->data, '*', size);
+/*                      printk("Flip recycle %p\n", t); */
+                        return t;
+                }
+                tbh = &((*tbh)->next);
+        }
+        /* Round the buffer size out */
+        size = (size + 0xFF) & ~ 0xFF;
+        return tty_buffer_alloc(size);
+        /* Should possibly check if this fails for the largest buffer we
+           have queued and recycle that ? */
+}
+int tty_buffer_request_room(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer *b = tty->buf.head, *n;
+        int left = 0;
+        /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
+           remove this conditional if its worth it. This would be invisible
+           to the callers */
+        if(b != NULL)
+                left = b->size - b->used;
+        if(left >= size)
+                return size;
+        /* This is the slow path - looking for new buffers to use */
+        n = tty_buffer_find(tty, size);
+        if(n == NULL)
+                return left;
+        n->next = b;
+        if(b != NULL)
+                b->next = n;
+        else
+                tty->buf.head = n;
+        tty->buf.tail = n;
+        return size;
+}
+EXPORT_SYMBOL_GPL(tty_buffer_request_room);
+int tty_insert_flip_string(struct tty_struct *tty, unsigned char *chars, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if(unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+/*              printk("Flip insert %d.\n", space); */
+        }
+        /* There is a small chance that we need to split the data over
+           several buffers. If this is the case we must loop */
+        while (unlikely(size > copied));
+        return copied;
+}
+EXPORT_SYMBOL_GPL(tty_insert_flip_string);
+int tty_insert_flip_string_flags(struct tty_struct *tty, unsigned char *chars, char *flags, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if(unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memcpy(tb->flag_buf_ptr + tb->used, flags, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+                flags += space;
+        }
+        /* There is a small chance that we need to split the data over
+           several buffers. If this is the case we must loop */
+        while (unlikely(size > copied));
+        return copied;
+}
+EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
+/*
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for normal characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ */
+int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        struct tty_buffer *tb = tty->buf.tail;
+        *chars = tb->char_buf_ptr + tb->used;
+        memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+        tb->used += space;
+        return space;
+}
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
+/*
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ */
+int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        struct tty_buffer *tb = tty->buf.tail;
+        *chars = tb->char_buf_ptr + tb->used;
+        *flags = tb->flag_buf_ptr + tb->used;
+        tb->used += space;
+        return space;
+}
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
+/*
 *      This is probably overkill for real world processors but
 *      they are not on hot paths so a little discipline won't do 
 *      any harm.
@@ -492,6 +690,17 @@ restart:
        if (ld == NULL)
                return -EINVAL;
+        /*
+         *      No more input please, we are switching. The new ldisc
+         *      will update this value in the ldisc open function
+         */
+        tty->receive_room = 0;
+        /*
+         *      Problem: What do we do if this blocks ?
+         */
        tty_wait_until_sent(tty, 0);
        if (tty->ldisc.num == ldisc) {
@@ -560,9 +769,9 @@ restart:
         *      we say so later on.
         */
-        work = cancel_delayed_work(&tty->flip.work);
+        work = cancel_delayed_work(&tty->buf.work);
        /*
-         * Wait for ->hangup_work and ->flip.work handlers to terminate
+         * Wait for ->hangup_work and ->buf.work handlers to terminate
         */
         
        flush_scheduled_work();
@@ -616,7 +825,7 @@ restart:
        /* Restart it in case no characters kick it off. Safe if
           already running */
        if (work)
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
        return retval;
 }
@@ -1721,10 +1930,10 @@ static void release_dev(struct file * filp)
         */
        clear_bit(TTY_LDISC, &tty->flags);
        clear_bit(TTY_DONT_FLIP, &tty->flags);
-        cancel_delayed_work(&tty->flip.work);
+        cancel_delayed_work(&tty->buf.work);
        /*
-         * Wait for ->hangup_work and ->flip.work handlers to terminate
+         * Wait for ->hangup_work and ->buf.work handlers to terminate
         */
         
        flush_scheduled_work();
@@ -2518,17 +2727,15 @@ EXPORT_SYMBOL(do_SAK);
 /*
 * This routine is called out of the software interrupt to flush data
- * from the flip buffer to the line discipline. 
+ * from the buffer chain to the line discipline.
 */
 
 static void flush_to_ldisc(void *private_)
 {
        struct tty_struct *tty = (struct tty_struct *) private_;
-        unsigned char   *cp;
-        char            *fp;
-        int             count;
        unsigned long   flags;
        struct tty_ldisc *disc;
+        struct tty_buffer *tbuf;
        disc = tty_ldisc_ref(tty);
        if (disc == NULL)       /*  !TTY_LDISC */
@@ -2538,28 +2745,22 @@ static void flush_to_ldisc(void *private_)
                /*
                 * Do it after the next timer tick:
                 */
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
                goto out;
        }
        spin_lock_irqsave(&tty->read_lock, flags);
-        if (tty->flip.buf_num) {
+        while((tbuf = tty->buf.head) != NULL) {
-                cp = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
+                tty->buf.head = tbuf->next;
-                fp = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
+                spin_unlock_irqrestore(&tty->read_lock, flags);
-                tty->flip.buf_num = 0;
+                /* printk("Process buffer %p for %d\n", tbuf, tbuf->used); */
-                tty->flip.char_buf_ptr = tty->flip.char_buf;
+                disc->receive_buf(tty, tbuf->char_buf_ptr,
-                tty->flip.flag_buf_ptr = tty->flip.flag_buf;
+                                       tbuf->flag_buf_ptr,
-        } else {
+                                       tbuf->used);
-                cp = tty->flip.char_buf;
+                spin_lock_irqsave(&tty->read_lock, flags);
-                fp = tty->flip.flag_buf;
+                tty_buffer_free(tty, tbuf);
-                tty->flip.buf_num = 1;
+        }
-                tty->flip.char_buf_ptr = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
+        tty->buf.tail = NULL;
-                tty->flip.flag_buf_ptr = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
-        }
-        count = tty->flip.count;
-        tty->flip.count = 0;
        spin_unlock_irqrestore(&tty->read_lock, flags);
-        disc->receive_buf(tty, cp, fp, count);
 out:
        tty_ldisc_deref(disc);
 }
@@ -2654,11 +2855,12 @@ void tty_flip_buffer_push(struct tty_struct *tty)
        if (tty->low_latency)
                flush_to_ldisc((void *) tty);
        else
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
 }
 EXPORT_SYMBOL(tty_flip_buffer_push);
 /*
 * This subroutine initializes a tty structure.
 */
@@ -2669,10 +2871,10 @@ static void initialize_tty_struct(struct tty_struct *tty)
        tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
        tty->pgrp = -1;
        tty->overrun_time = jiffies;
-        tty->flip.char_buf_ptr = tty->flip.char_buf;
+        tty->buf.head = tty->buf.tail = NULL;
-        tty->flip.flag_buf_ptr = tty->flip.flag_buf;
+        tty_buffer_init(tty);
-        INIT_WORK(&tty->flip.work, flush_to_ldisc, tty);
+        INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
-        init_MUTEX(&tty->flip.pty_sem);
+        init_MUTEX(&tty->buf.pty_sem);
        init_MUTEX(&tty->termios_sem);
        init_waitqueue_head(&tty->write_wait);
        init_waitqueue_head(&tty->read_wait);
diff --git a/drivers/char/viocons.c b/drivers/char/viocons.c
index 4d75c261f98a..cb82ebf4cb07 100644
--- a/drivers/char/viocons.c
+++ b/drivers/char/viocons.c
@@ -993,11 +993,10 @@ static void vioHandleData(struct HvLpEvent *event)
                 * Don't attempt to copy more data into the buffer than we
                 * have room for because it would fail without indication.
                 */
-                if ((tty->flip.count + 1) > TTY_FLIPBUF_SIZE) {
+                if(tty_insert_flip_char(tty, cevent->data[index], TTY_NORMAL) == 0) {
                        printk(VIOCONS_KERN_WARN "input buffer overflow!\n");
                        break;
                }
-                tty_insert_flip_char(tty, cevent->data[index], TTY_NORMAL);
        }
        /* if cevent->len == 0 then no data was added to the buffer and flip.count == 0 */
diff --git a/drivers/char/vme_scc.c b/drivers/char/vme_scc.c
index 33e71e23b212..d9325281e482 100644
--- a/drivers/char/vme_scc.c
+++ b/drivers/char/vme_scc.c
@@ -434,13 +434,7 @@ static irqreturn_t scc_rx_int(int irq, void *data, struct pt_regs *fp)
                SCCwrite_NB(COMMAND_REG, CR_HIGHEST_IUS_RESET);
                return IRQ_HANDLED;
        }
-        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+        tty_insert_flip_char(tty, ch, 0);
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = 0;
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
-        }
        /* Check if another character is already ready; in that case, the
         * spcond_int() function must be used, because this character may have an
@@ -487,13 +481,7 @@ static irqreturn_t scc_spcond_int(int irq, void *data, struct pt_regs *fp)
                else
                        err = 0;
-                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                tty_insert_flip_char(tty, ch, err);
-                        *tty->flip.char_buf_ptr = ch;
-                        *tty->flip.flag_buf_ptr = err;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
                /* ++TeSche: *All* errors have to be cleared manually,
                 * else the condition persists for the next chars
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 1bd88fca0542..54a680cc704d 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -96,6 +96,7 @@ static int serport_ldisc_open(struct tty_struct *tty)
        init_waitqueue_head(&serport->wait);
        tty->disc_data = serport;
+        tty->receive_room = 256;
        set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
        return 0;
@@ -140,17 +141,6 @@ out:
 }
 /*
- * serport_ldisc_room() reports how much room we do have for receiving data.
- * Although we in fact have infinite room, we need to specify some value
- * here, and 256 seems to be reasonable.
- */
-static int serport_ldisc_room(struct tty_struct *tty)
-{
-        return 256;
-}
-/*
 * serport_ldisc_read() just waits indefinitely if everything goes well.
 * However, when the serio driver closes the serio port, it finishes,
 * returning 0 characters.
@@ -237,7 +227,6 @@ static struct tty_ldisc serport_ldisc = {
        .read =         serport_ldisc_read,
        .ioctl =        serport_ldisc_ioctl,
        .receive_buf =  serport_ldisc_receive,
-        .receive_room = serport_ldisc_room,
        .write_wakeup = serport_ldisc_write_wakeup
 };
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 11ae0fddea04..623adbb0d13a 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -463,8 +463,7 @@ static int handle_recv_skb(struct capiminor *mp, struct sk_buff *skb)
 #endif
                goto bad;
        }
-        if (ld->receive_room &&
+        if (mp->tty->receive_room < datalen) {
-            ld->receive_room(mp->tty) < datalen) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                printk(KERN_DEBUG "capi: no room in tty\n");
 #endif
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 4643df097bfe..22759c01746a 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -857,6 +857,118 @@ isdn_readbchan(int di, int channel, u_char * buf, u_char * fp, int len, wait_que
        return count;
 }
+/*
+ * isdn_readbchan_tty() tries to get data from the read-queue.
+ * It MUST be called with interrupts off.
+ *
+ * Be aware that this is not an atomic operation when sleep != 0, even though
+ * interrupts are turned off! Well, like that we are currently only called
+ * on behalf of a read system call on raw device files (which are documented
+ * to be dangerous and for for debugging purpose only). The inode semaphore
+ * takes care that this is not called for the same minor device number while
+ * we are sleeping, but access is not serialized against simultaneous read()
+ * from the corresponding ttyI device. Can other ugly events, like changes
+ * of the mapping (di,ch)<->minor, happen during the sleep? --he
+ */
+int
+isdn_readbchan_tty(int di, int channel, struct tty_struct *tty, int cisco_hack)
+{
+        int count;
+        int count_pull;
+        int count_put;
+        int dflag;
+        struct sk_buff *skb;
+        char last = 0;
+        int len;
+        if (!dev->drv[di])
+                return 0;
+        if (skb_queue_empty(&dev->drv[di]->rpqueue[channel]))
+                        return 0;
+        len = tty_buffer_request_room(tty, dev->drv[di]->rcvcount[channel]);
+        if(len == 0)
+                return len;
+        count = 0;
+        while (len) {
+                if (!(skb = skb_peek(&dev->drv[di]->rpqueue[channel])))
+                        break;
+#ifdef CONFIG_ISDN_AUDIO
+                if (ISDN_AUDIO_SKB_LOCK(skb))
+                        break;
+                ISDN_AUDIO_SKB_LOCK(skb) = 1;
+                if ((ISDN_AUDIO_SKB_DLECOUNT(skb)) || (dev->drv[di]->DLEflag & (1 << channel))) {
+                        char *p = skb->data;
+                        unsigned long DLEmask = (1 << channel);
+                        dflag = 0;
+                        count_pull = count_put = 0;
+                        while ((count_pull < skb->len) && (len > 0)) {
+                                len--;
+                                if (dev->drv[di]->DLEflag & DLEmask) {
+                                        last = DLE;
+                                        dev->drv[di]->DLEflag &= ~DLEmask;
+                                } else {
+                                        last = *p;
+                                        if (last == DLE) {
+                                                dev->drv[di]->DLEflag |= DLEmask;
+                                                (ISDN_AUDIO_SKB_DLECOUNT(skb))--;
+                                        }
+                                        p++;
+                                        count_pull++;
+                                }
+                                count_put++;
+                        }
+                        if (count_pull >= skb->len)
+                                dflag = 1;
+                } else {
+#endif
+                        /* No DLE's in buff, so simply copy it */
+                        dflag = 1;
+                        if ((count_pull = skb->len) > len) {
+                                count_pull = len;
+                                dflag = 0;
+                        }
+                        count_put = count_pull;
+                        if(count_put > 1)
+                                tty_insert_flip_string(tty, skb->data, count_put - 1);
+                        last = skb->data[count_put] - 1;
+                        len -= count_put;
+#ifdef CONFIG_ISDN_AUDIO
+                }
+#endif
+                count += count_put;
+                if (dflag) {
+                        /* We got all the data in this buff.
+                         * Now we can dequeue it.
+                         */
+                        if(cisco_hack)
+                                tty_insert_flip_char(tty, last, 0xFF);
+                        else
+                                tty_insert_flip_char(tty, last, TTY_NORMAL);
+#ifdef CONFIG_ISDN_AUDIO
+                        ISDN_AUDIO_SKB_LOCK(skb) = 0;
+#endif
+                        skb = skb_dequeue(&dev->drv[di]->rpqueue[channel]);
+                        dev_kfree_skb(skb);
+                } else {
+                        tty_insert_flip_char(tty, last, TTY_NORMAL);
+                        /* Not yet emptied this buff, so it
+                         * must stay in the queue, for further calls
+                         * but we pull off the data we got until now.
+                         */
+                        skb_pull(skb, count_pull);
+#ifdef CONFIG_ISDN_AUDIO
+                        ISDN_AUDIO_SKB_LOCK(skb) = 0;
+#endif
+                }
+                dev->drv[di]->rcvcount[channel] -= count_put;
+        }
+        return count;
+}
 static __inline int
 isdn_minor2drv(int minor)
 {
diff --git a/drivers/isdn/i4l/isdn_common.h b/drivers/isdn/i4l/isdn_common.h
index e27e9c3a81ed..082735dbb412 100644
--- a/drivers/isdn/i4l/isdn_common.h
+++ b/drivers/isdn/i4l/isdn_common.h
@@ -37,6 +37,7 @@ extern void isdn_timer_ctrl(int tf, int onoff);
 extern void isdn_unexclusive_channel(int di, int ch);
 extern int  isdn_getnum(char **);
 extern int  isdn_readbchan(int, int, u_char *, u_char *, int, wait_queue_head_t *);
+extern int  isdn_readbchan_tty(int, int, struct tty_struct *, int);
 extern int  isdn_get_free_channel(int, int, int, int, int, char *);
 extern int  isdn_writebuf_skb_stub(int, int, int, struct sk_buff *);
 extern int  register_isdn(isdn_if * i);
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 8c404b4e2482..f190a99604f0 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -64,37 +64,42 @@ isdn_tty_try_read(modem_info * info, struct sk_buff *skb)
        int c;
        int len;
        struct tty_struct *tty;
+        char last;
        if (info->online) {
                if ((tty = info->tty)) {
                        if (info->mcr & UART_MCR_RTS) {
-                                c = TTY_FLIPBUF_SIZE - tty->flip.count;
                                len = skb->len
 #ifdef CONFIG_ISDN_AUDIO
                                        + ISDN_AUDIO_SKB_DLECOUNT(skb)
 #endif
                                        ;
+                                c = tty_buffer_request_room(tty, len);
                                if (c >= len) {
 #ifdef CONFIG_ISDN_AUDIO
-                                        if (ISDN_AUDIO_SKB_DLECOUNT(skb))
+                                        if (ISDN_AUDIO_SKB_DLECOUNT(skb)) {
-                                                while (skb->len--) {
+                                                int l = skb->len;
+                                                unsigned char *dp = skb->data;
+                                                while (--l) {
                                                        if (*skb->data == DLE)
                                                                tty_insert_flip_char(tty, DLE, 0);
-                                                        tty_insert_flip_char(tty, *skb->data++, 0);
+                                                        tty_insert_flip_char(tty, *dp++, 0);
+                                                }
+                                                last = *dp;
                                        } else {
 #endif
-                                                memcpy(tty->flip.char_buf_ptr,
+                                                if(len > 1)
-                                                       skb->data, len);
+                                                        tty_insert_flip_string(tty, skb->data, len - 1);
-                                                tty->flip.count += len;
+                                                last = skb->data[len - 1];
-                                                tty->flip.char_buf_ptr += len;
-                                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                                tty->flip.flag_buf_ptr += len;
 #ifdef CONFIG_ISDN_AUDIO
                                        }
 #endif
                                        if (info->emu.mdmreg[REG_CPPP] & BIT_CPPP)
-                                                tty->flip.flag_buf_ptr[len - 1] = 0xff;
+                                                tty_insert_flip_char(tty, last, 0xFF);
-                                        schedule_delayed_work(&tty->flip.work, 1);
+                                        else
+                                                tty_insert_flip_char(tty, last, TTY_NORMAL);
+                                        tty_flip_buffer_push(tty);
                                        kfree_skb(skb);
                                        return 1;
                                }
@@ -114,7 +119,6 @@ isdn_tty_readmodem(void)
        int resched = 0;
        int midx;
        int i;
-        int c;
        int r;
        struct tty_struct *tty;
        modem_info *info;
@@ -131,20 +135,13 @@ isdn_tty_readmodem(void)
 #endif
                                if ((tty = info->tty)) {
                                        if (info->mcr & UART_MCR_RTS) {
-                                                c = TTY_FLIPBUF_SIZE - tty->flip.count;
+                                                /* CISCO AsyncPPP Hack */
-                                                if (c > 0) {
+                                                if (!(info->emu.mdmreg[REG_CPPP] & BIT_CPPP))
-                                                        r = isdn_readbchan(info->isdn_driver, info->isdn_channel,
+                                                        r = isdn_readbchan_tty(info->isdn_driver, info->isdn_channel, tty, 0);
-                                                                           tty->flip.char_buf_ptr,
+                                                else
-                                                                           tty->flip.flag_buf_ptr, c, NULL);
+                                                        r = isdn_readbchan_tty(info->isdn_driver, info->isdn_channel, tty, 1);
-                                                        /* CISCO AsyncPPP Hack */
+                                                if (r)
-                                                        if (!(info->emu.mdmreg[REG_CPPP] & BIT_CPPP))
+                                                        tty_flip_buffer_push(tty);
-                                                                memset(tty->flip.flag_buf_ptr, 0, r);
-                                                        tty->flip.count += r;
-                                                        tty->flip.flag_buf_ptr += r;
-                                                        tty->flip.char_buf_ptr += r;
-                                                        if (r)
-                                                                schedule_delayed_work(&tty->flip.work, 1);
-                                                }
                                        } else
                                                r = 1;
                                } else
@@ -249,7 +246,7 @@ isdn_tty_rcv_skb(int i, int di, int channel, struct sk_buff *skb)
        }
 #endif
 #endif
-        /* Try to deliver directly via tty-flip-buf if queue is empty */
+        /* Try to deliver directly via tty-buf if queue is empty */
        spin_lock_irqsave(&info->readlock, flags);
        if (skb_queue_empty(&dev->drv[di]->rpqueue[channel]))
                if (isdn_tty_try_read(info, skb)) {
@@ -534,7 +531,7 @@ isdn_tty_senddown(modem_info * info)
 /* The next routine is called once from within timer-interrupt
 * triggered within isdn_tty_modem_ncarrier(). It calls
 * isdn_tty_modem_result() to stuff a "NO CARRIER" Message
- * into the tty's flip-buffer.
+ * into the tty's buffer.
 */
 static void
 isdn_tty_modem_do_ncarrier(unsigned long data)
@@ -2347,6 +2344,7 @@ isdn_tty_at_cout(char *msg, modem_info * info)
        u_long flags;
        struct sk_buff *skb = NULL;
        char *sp = NULL;
+        int l = strlen(msg);
        if (!msg) {
                printk(KERN_WARNING "isdn_tty: Null-Message in isdn_tty_at_cout\n");
@@ -2359,16 +2357,16 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                return;
        }
-        /* use queue instead of direct flip, if online and */
+        /* use queue instead of direct, if online and */
-        /* data is in queue or flip buffer is full */
+        /* data is in queue or buffer is full */
-        if ((info->online) && (((tty->flip.count + strlen(msg)) >= TTY_FLIPBUF_SIZE) ||
+        if ((info->online && tty_buffer_request_room(tty, l) < l) ||
-            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel])))) {
+            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {
-                skb = alloc_skb(strlen(msg), GFP_ATOMIC);
+                skb = alloc_skb(l, GFP_ATOMIC);
                if (!skb) {
                        spin_unlock_irqrestore(&info->readlock, flags);
                        return;
                }
-                sp = skb_put(skb, strlen(msg));
+                sp = skb_put(skb, l);
 #ifdef CONFIG_ISDN_AUDIO
                ISDN_AUDIO_SKB_DLECOUNT(skb) = 0;
                ISDN_AUDIO_SKB_LOCK(skb) = 0;
@@ -2392,9 +2390,8 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                if (skb) {
                        *sp++ = c;
                } else {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        if(tty_insert_flip_char(tty, c, TTY_NORMAL) == 0)
                                break;
-                        tty_insert_flip_char(tty, c, 0);
                }
        }
        if (skb) {
@@ -2402,12 +2399,12 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                dev->drv[info->isdn_driver]->rcvcount[info->isdn_channel] += skb->len;
                spin_unlock_irqrestore(&info->readlock, flags);
                /* Schedule dequeuing */
-                if ((dev->modempoll) && (info->rcvsched))
+                if (dev->modempoll && info->rcvsched)
                        isdn_timer_ctrl(ISDN_TIMER_MODEMREAD, 1);
        } else {
                spin_unlock_irqrestore(&info->readlock, flags);
-                schedule_delayed_work(&tty->flip.work, 1);
+                tty_flip_buffer_push(tty);
        }
 }
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 90999867a32c..102c1f0b90da 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -456,11 +456,6 @@ out:
 /* ----------------------------------------------------------------------- */
-static int sixpack_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Handle the 'receiver data ready' interrupt.
 * This function is called by the 'tty_io' module in the kernel when
@@ -671,6 +666,7 @@ static int sixpack_open(struct tty_struct *tty)
        /* Done.  We have linked the TTY line to a channel. */
        tty->disc_data = sp;
+        tty->receive_room = 65536;
        /* Now we're ready to register. */
        if (register_netdev(dev))
@@ -802,7 +798,6 @@ static struct tty_ldisc sp_ldisc = {
        .close          = sixpack_close,
        .ioctl          = sixpack_ioctl,
        .receive_buf    = sixpack_receive_buf,
-        .receive_room   = sixpack_receive_room,
        .write_wakeup   = sixpack_write_wakeup,
 };
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index f4424cf886c5..dc5e9d59deed 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -753,6 +753,7 @@ static int mkiss_open(struct tty_struct *tty)
        ax->tty = tty;
        tty->disc_data = ax;
+        tty->receive_room = 65535;
        if (tty->driver->flush_buffer)
                tty->driver->flush_buffer(tty);
@@ -940,11 +941,6 @@ static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                tty->driver->unthrottle(tty);
 }
-static int mkiss_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Called by the driver when there's room for more data.  If we have
 * more packets to send, we send them here.
@@ -983,7 +979,6 @@ static struct tty_ldisc ax_ldisc = {
        .close          = mkiss_close,
        .ioctl          = mkiss_ioctl,
        .receive_buf    = mkiss_receive_buf,
-        .receive_room   = mkiss_receive_room,
        .write_wakeup   = mkiss_write_wakeup
 };
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index b8d112348ba4..101750bf210f 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -289,22 +289,6 @@ static void irtty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 }
 /*
- * Function irtty_receive_room (tty)
- *
- *    Used by the TTY to find out how much data we can receive at a time
- * 
-*/
-static int irtty_receive_room(struct tty_struct *tty) 
-{
-        struct sirtty_cb *priv = tty->disc_data;
-        IRDA_ASSERT(priv != NULL, return 0;);
-        IRDA_ASSERT(priv->magic == IRTTY_MAGIC, return 0;);
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-/*
 * Function irtty_write_wakeup (tty)
 *
 *    Called by the driver when there's room for more data.  If we have
@@ -534,6 +518,7 @@ static int irtty_open(struct tty_struct *tty)
        dev->priv = priv;
        tty->disc_data = priv;
+        tty->receive_room = 65536;
        up(&irtty_sem);
@@ -605,7 +590,6 @@ static struct tty_ldisc irda_ldisc = {
        .ioctl          = irtty_ioctl,
        .poll           = NULL,
        .receive_buf    = irtty_receive_buf,
-        .receive_room   = irtty_receive_room,
        .write_wakeup   = irtty_write_wakeup,
        .owner          = THIS_MODULE,
 };
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 400f652282d7..aa6540b39466 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -189,7 +189,7 @@ ppp_asynctty_open(struct tty_struct *tty)
                goto out_free;
        tty->disc_data = ap;
+        tty->receive_room = 65536;
        return 0;
 out_free:
@@ -343,12 +343,6 @@ ppp_asynctty_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
        return 0;
 }
-static int
-ppp_asynctty_room(struct tty_struct *tty)
-{
-        return 65535;
-}
 /*
 * This can now be called from hard interrupt level as well
 * as soft interrupt level or mainline.
@@ -398,7 +392,6 @@ static struct tty_ldisc ppp_ldisc = {
        .write  = ppp_asynctty_write,
        .ioctl  = ppp_asynctty_ioctl,
        .poll   = ppp_asynctty_poll,
-        .receive_room = ppp_asynctty_room,
        .receive_buf = ppp_asynctty_receive,
        .write_wakeup = ppp_asynctty_wakeup,
 };
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index 4d51c0c8023d..33cb8254e79d 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -237,7 +237,7 @@ ppp_sync_open(struct tty_struct *tty)
                goto out_free;
        tty->disc_data = ap;
+        tty->receive_room = 65536;
        return 0;
 out_free:
@@ -384,12 +384,6 @@ ppp_sync_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
        return 0;
 }
-static int
-ppp_sync_room(struct tty_struct *tty)
-{
-        return 65535;
-}
 /*
 * This can now be called from hard interrupt level as well
 * as soft interrupt level or mainline.
@@ -439,7 +433,6 @@ static struct tty_ldisc ppp_sync_ldisc = {
        .write  = ppp_sync_write,
        .ioctl  = ppp_synctty_ioctl,
        .poll   = ppp_sync_poll,
-        .receive_room = ppp_sync_room,
        .receive_buf = ppp_sync_receive,
        .write_wakeup = ppp_sync_wakeup,
 };
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 404ea4297e32..b2e18d28850d 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -651,11 +651,6 @@ static void sl_setup(struct net_device *dev)
 ******************************************/
-static int slip_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Handle the 'receiver data ready' interrupt.
 * This function is called by the 'tty_io' module in the kernel when
@@ -869,10 +864,6 @@ static int slip_open(struct tty_struct *tty)
        sl->line = tty_devnum(tty);
        sl->pid = current->pid;
        
-        /* FIXME: already done before we were called - seems this can go */
-        if (tty->driver->flush_buffer)
-                tty->driver->flush_buffer(tty);
-                
        if (!test_bit(SLF_INUSE, &sl->flags)) {
                /* Perform the low-level SLIP initialization. */
                if ((err = sl_alloc_bufs(sl, SL_MTU)) != 0)
@@ -897,6 +888,7 @@ static int slip_open(struct tty_struct *tty)
        /* Done.  We have linked the TTY line to a channel. */
        rtnl_unlock();
+        tty->receive_room = 65536;      /* We don't flow control */
        return sl->dev->base_addr;
 err_free_bufs:
@@ -1329,7 +1321,6 @@ static struct tty_ldisc	sl_ldisc = {
        .close          = slip_close,
        .ioctl          = slip_ioctl,
        .receive_buf    = slip_receive_buf,
-        .receive_room   = slip_receive_room,
        .write_wakeup   = slip_write_wakeup,
 };
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 52f26b9c69d2..931cbdf6d791 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -689,7 +689,7 @@ static void cpc_tty_rx_work(void * data)
                                        }
                                }       
                                cpc_tty->buf_rx.first = cpc_tty->buf_rx.first->next;
-                                kfree(buf);
+                                kfree((void *)buf);
                                buf = cpc_tty->buf_rx.first;
                                flg_rx = 1;
                        }
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index bdf672c48182..9c3ccc669143 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -515,11 +515,6 @@ static int x25_asy_close(struct net_device *dev)
        return 0;
 }
-static int x25_asy_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Handle the 'receiver data ready' interrupt.
 * This function is called by the 'tty_io' module in the kernel when
@@ -573,6 +568,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
        sl->tty = tty;
        tty->disc_data = sl;
+        tty->receive_room = 65536;
        if (tty->driver->flush_buffer)  {
                tty->driver->flush_buffer(tty);
        }
@@ -779,7 +775,6 @@ static struct tty_ldisc x25_ldisc = {
        .close          = x25_asy_close_tty,
        .ioctl          = x25_asy_ioctl,
        .receive_buf    = x25_asy_receive_buf,
-        .receive_room   = x25_asy_receive_room,
        .write_wakeup   = x25_asy_write_wakeup,
 };
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index d25264ba0c0e..18baacfc5a2c 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -1675,11 +1675,6 @@ static int strip_rebuild_header(struct sk_buff *skb)
 /************************************************************************/
 /* Receiving routines                                                   */
-static int strip_receive_room(struct tty_struct *tty)
-{
-        return 0x10000;         /* We can handle an infinite amount of data. :-) */
-}
 /*
 * This function parses the response to the ATS300? command,
 * extracting the radio version and serial number.
@@ -2424,7 +2419,7 @@ static struct net_device_stats *strip_get_stats(struct net_device *dev)
 /*
 * Here's the order things happen:
 * When the user runs "slattach -p strip ..."
- *  1. The TTY module calls strip_open
+ *  1. The TTY module calls strip_open;;
 *  2. strip_open calls strip_alloc
 *  3.                  strip_alloc calls register_netdev
 *  4.                  register_netdev calls strip_dev_init
@@ -2652,6 +2647,8 @@ static int strip_open(struct tty_struct *tty)
        strip_info->tty = tty;
        tty->disc_data = strip_info;
+        tty->receive_room = 65536;
        if (tty->driver->flush_buffer)
                tty->driver->flush_buffer(tty);
@@ -2762,7 +2759,6 @@ static struct tty_ldisc strip_ldisc = {
        .close = strip_close,
        .ioctl = strip_ioctl,
        .receive_buf = strip_receive_buf,
-        .receive_room = strip_receive_room,
        .write_wakeup = strip_write_some_more,
 };
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 75419cf9d353..1f060914cfa4 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -16,6 +16,7 @@
 #include <linux/types.h>
 #include <linux/kdev_t.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/vt_kern.h>
 #include <linux/init.h>
 #include <linux/console.h>
@@ -432,8 +433,6 @@ raw3215_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                                if (count > slen)
                                        count = slen;
                        } else
-                        if (count >= TTY_FLIPBUF_SIZE - tty->flip.count)
-                                count = TTY_FLIPBUF_SIZE - tty->flip.count - 1;
                        EBCASC(raw->inbuf, count);
                        cchar = ctrlchar_handle(raw->inbuf, count, tty);
                        switch (cchar & CTRLCHAR_MASK) {
@@ -441,28 +440,20 @@ raw3215_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                                break;
                        case CTRLCHAR_CTRL:
-                                tty->flip.count++;
+                                tty_insert_flip_char(tty, cchar, TTY_NORMAL);
-                                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                                *tty->flip.char_buf_ptr++ = cchar;
                                tty_flip_buffer_push(raw->tty);
                                break;
                        case CTRLCHAR_NONE:
-                                memcpy(tty->flip.char_buf_ptr,
-                                       raw->inbuf, count);
                                if (count < 2 ||
-                                    (strncmp(raw->inbuf+count-2, "^n", 2) &&
+                                    (strncmp(raw->inbuf+count-2, "\252n", 2) &&
-                                    strncmp(raw->inbuf+count-2, "\252n", 2)) ) {
+                                     strncmp(raw->inbuf+count-2, "^n", 2)) ) {
-                                        /* don't add the auto \n */
+                                        /* add the auto \n */
-                                        tty->flip.char_buf_ptr[count] = '\n';
+                                        raw->inbuf[count] = '\n';
-                                        memset(tty->flip.flag_buf_ptr,
-                                               TTY_NORMAL, count + 1);
                                        count++;
                                } else
-                                        count-=2;
+                                        count -= 2;
-                                tty->flip.char_buf_ptr += count;
+                                tty_insert_flip_string(tty, raw->inbuf, count);
-                                tty->flip.flag_buf_ptr += count;
-                                tty->flip.count += count;
                                tty_flip_buffer_push(raw->tty);
                                break;
                        }
diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c
index a20d7c89341d..6cbf067f1a8f 100644
--- a/drivers/s390/char/sclp_tty.c
+++ b/drivers/s390/char/sclp_tty.c
@@ -13,6 +13,7 @@
 #include <linux/kmod.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
@@ -496,25 +497,19 @@ sclp_tty_input(unsigned char* buf, unsigned int count)
        case CTRLCHAR_SYSRQ:
                break;
        case CTRLCHAR_CTRL:
-                sclp_tty->flip.count++;
+                tty_insert_flip_char(sclp_tty, cchar, TTY_NORMAL);
-                *sclp_tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                *sclp_tty->flip.char_buf_ptr++ = cchar;
                tty_flip_buffer_push(sclp_tty);
                break;
        case CTRLCHAR_NONE:
                /* send (normal) input to line discipline */
-                memcpy(sclp_tty->flip.char_buf_ptr, buf, count);
                if (count < 2 ||
-                    (strncmp ((const char *) buf + count - 2, "^n", 2) &&
+                    (strncmp((const char *) buf + count - 2, "^n", 2) &&
-                     strncmp ((const char *) buf + count - 2, "\0252n", 2))) {
+                     strncmp((const char *) buf + count - 2, "\252n", 2))) {
-                        sclp_tty->flip.char_buf_ptr[count] = '\n';
+                        /* add the auto \n */
-                        count++;
+                        tty_insert_flip_string(sclp_tty, buf, count);
+                        tty_insert_flip_char(sclp_tty, '\n', TTY_NORMAL);
                } else
-                        count -= 2;
+                        tty_insert_flip_string(sclp_tty, buf, count - 2);
-                memset(sclp_tty->flip.flag_buf_ptr, TTY_NORMAL, count);
-                sclp_tty->flip.char_buf_ptr += count;
-                sclp_tty->flip.flag_buf_ptr += count;
-                sclp_tty->flip.count += count;
                tty_flip_buffer_push(sclp_tty);
                break;
        }
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 06bd85824d7b..9e02625c82cf 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
@@ -482,16 +483,7 @@ sclp_vt220_receiver_fn(struct evbuf_header *evbuf)
                /* Send input to line discipline */
                buffer++;
                count--;
-                /* Prevent buffer overrun by discarding input. Note that
+                tty_insert_flip_string(sclp_vt220_tty, buffer, count);
-                 * because buffer_push works asynchronously, we cannot wait
-                 * for the buffer to be emptied. */
-                if (count + sclp_vt220_tty->flip.count > TTY_FLIPBUF_SIZE)
-                        count = TTY_FLIPBUF_SIZE - sclp_vt220_tty->flip.count;
-                memcpy(sclp_vt220_tty->flip.char_buf_ptr, buffer, count);
-                memset(sclp_vt220_tty->flip.flag_buf_ptr, TTY_NORMAL, count);
-                sclp_vt220_tty->flip.char_buf_ptr += count;
-                sclp_vt220_tty->flip.flag_buf_ptr += count;
-                sclp_vt220_tty->flip.count += count;
                tty_flip_buffer_push(sclp_vt220_tty);
                break;
        }
diff --git a/drivers/s390/net/ctctty.c b/drivers/s390/net/ctctty.c
index 968f2c113efe..93d1725eb79b 100644
--- a/drivers/s390/net/ctctty.c
+++ b/drivers/s390/net/ctctty.c
@@ -25,6 +25,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/serial_reg.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -101,25 +102,17 @@ static spinlock_t ctc_tty_lock;
 static int
 ctc_tty_try_read(ctc_tty_info * info, struct sk_buff *skb)
 {
-        int c;
        int len;
        struct tty_struct *tty;
        DBF_TEXT(trace, 5, __FUNCTION__);
        if ((tty = info->tty)) {
                if (info->mcr & UART_MCR_RTS) {
-                        c = TTY_FLIPBUF_SIZE - tty->flip.count;
                        len = skb->len;
-                        if (c >= len) {
+                        tty_insert_flip_string(tty, skb->data, len);
-                                memcpy(tty->flip.char_buf_ptr, skb->data, len);
+                        tty_flip_buffer_push(tty);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
+                        kfree_skb(skb);
-                                tty->flip.count += len;
+                        return 1;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
-                                tty_flip_buffer_push(tty);
-                                kfree_skb(skb);
-                                return 1;
-                        }
                }
        }
        return 0;
@@ -138,19 +131,12 @@ ctc_tty_readmodem(ctc_tty_info *info)
        DBF_TEXT(trace, 5, __FUNCTION__);
        if ((tty = info->tty)) {
                if (info->mcr & UART_MCR_RTS) {
-                        int c = TTY_FLIPBUF_SIZE - tty->flip.count;
                        struct sk_buff *skb;
                        
-                        if ((c > 0) && (skb = skb_dequeue(&info->rx_queue))) {
+                        if ((skb = skb_dequeue(&info->rx_queue))) {
                                int len = skb->len;
-                                if (len > c)
+                                tty_insert_flip_string(tty, skb->data, len);
-                                        len = c;
-                                memcpy(tty->flip.char_buf_ptr, skb->data, len);
                                skb_pull(skb, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                tty->flip.count += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
                                tty_flip_buffer_push(tty);
                                if (skb->len > 0)
                                        skb_queue_head(&info->rx_queue, skb);
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index b5cf39468d18..221999bcf8fe 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -94,15 +94,6 @@ static irqreturn_t serial21285_rx_chars(int irq, void *dev_id, struct pt_regs *r
        status = *CSR_UARTFLG;
        while (!(status & 0x10) && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = *CSR_UARTDR;
                flag = TTY_NORMAL;
                port->icount.rx++;
diff --git a/drivers/serial/68328serial.c b/drivers/serial/68328serial.c
index 67e9afa000c1..4dd5c3f98167 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/serial/68328serial.c
@@ -294,7 +294,7 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
 {
        struct tty_struct *tty = info->tty;
        m68328_uart *uart = &uart_addr[info->line];
-        unsigned char ch;
+        unsigned char ch, flag;
        /*
         * This do { } while() loop will get ALL chars out of Rx FIFO 
@@ -332,26 +332,24 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
                /*
                 * Make sure that we do not overflow the buffer
                 */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                if (tty_request_buffer_room(tty, 1) == 0) {
                        schedule_work(&tty->flip.work);
                        return;
                }
+                flag = TTY_NORMAL;
                if(rx & URX_PARITY_ERROR) {
-                        *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                        flag = TTY_PARITY;
                        status_handle(info, rx);
                } else if(rx & URX_OVRUN) {
-                        *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        flag = TTY_OVERRUN;
                        status_handle(info, rx);
                } else if(rx & URX_FRAME_ERROR) {
-                        *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                        flag = TTY_FRAME;
                        status_handle(info, rx);
-                } else {
-                        *tty->flip.flag_buf_ptr++ = 0; /* XXX */
                }
-                *tty->flip.char_buf_ptr++ = ch;
+                tty_insert_flip_char(tty, ch, flag);
-                tty->flip.count++;
 #ifndef CONFIG_XCOPILOT_BUGS
        } while((rx = uart->urx.w) & URX_DATA_READY);
 #endif
diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
index 170c9d2a749c..60f5a5dc17f1 100644
--- a/drivers/serial/68360serial.c
+++ b/drivers/serial/68360serial.c
@@ -394,7 +394,7 @@ static void rs_360_start(struct tty_struct *tty)
 static _INLINE_ void receive_chars(ser_info_t *info)
 {
        struct tty_struct *tty = info->tty;
-        unsigned char ch, *cp;
+        unsigned char ch, flag, *cp;
        /*int   ignored = 0;*/
        int     i;
        ushort  status;
@@ -438,24 +438,15 @@ static _INLINE_ void receive_chars(ser_info_t *info)
                cp = (char *)bdp->buf;
                status = bdp->status;
-                /* Check to see if there is room in the tty buffer for
-                 * the characters in our BD buffer.  If not, we exit
-                 * now, leaving the BD with the characters.  We'll pick
-                 * them up again on the next receive interrupt (which could
-                 * be a timeout).
-                 */
-                if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE)
-                        break;
                while (i-- > 0) {
                        ch = *cp++;
-                        *tty->flip.char_buf_ptr = ch;
                        icount->rx++;
 #ifdef SERIAL_DEBUG_INTR
                        printk("DR%02x:%02x...", ch, status);
 #endif
-                        *tty->flip.flag_buf_ptr = 0;
+                        flag = TTY_NORMAL;
                        if (status & (BD_SC_BR | BD_SC_FR |
                                       BD_SC_PR | BD_SC_OV)) {
                                /*
@@ -490,30 +481,18 @@ static _INLINE_ void receive_chars(ser_info_t *info)
                                        if (info->flags & ASYNC_SAK)
                                                do_SAK(tty);
                                } else if (status & BD_SC_PR)
-                                        *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                else if (status & BD_SC_FR)
-                                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                        flag = TTY_FRAME;
-                                if (status & BD_SC_OV) {
-                                        /*
-                                         * Overrun is special, since it's
-                                         * reported immediately, and doesn't
-                                         * affect the current character
-                                         */
-                                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                                tty->flip.count++;
-                                                tty->flip.flag_buf_ptr++;
-                                                tty->flip.char_buf_ptr++;
-                                                *tty->flip.flag_buf_ptr =
-                                                                TTY_OVERRUN;
-                                        }
-                                }
                        }
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        tty_insert_flip_char(tty, ch, flag);
-                                break;
+                        if (status & BD_SC_OV)
+                                /*
-                        tty->flip.flag_buf_ptr++;
+                                 * Overrun is special, since it's
-                        tty->flip.char_buf_ptr++;
+                                 * reported immediately, and doesn't
-                        tty->flip.count++;
+                                 * affect the current character
+                                 */
+                                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                }
                /* This BD is ready to be used again.  Clear status.
@@ -541,12 +520,7 @@ static _INLINE_ void receive_break(ser_info_t *info)
        /* Check to see if there is room in the tty buffer for
         * the break.  If not, we exit now, losing the break.  FIXME
         */
-        if ((tty->flip.count + 1) >= TTY_FLIPBUF_SIZE)
+        tty_insert_flip_char(tty, 0, TTY_BREAK);
-                return;
-        *(tty->flip.flag_buf_ptr++) = TTY_BREAK;
-        *(tty->flip.char_buf_ptr++) = 0;
-        tty->flip.count++;
        schedule_work(&tty->flip.work);
 }
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index e8454611cb65..54e5cc0dd5f8 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1142,19 +1142,6 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
        char flag;
        do {
-                /* The following is not allowed by the tty layer and
-                   unsafe. It should be fixed ASAP */
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency) {
-                                spin_unlock(&up->port.lock);
-                                tty_flip_buffer_push(tty);
-                                spin_lock(&up->port.lock);
-                        }
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = serial_inp(up, UART_RX);
                flag = TTY_NORMAL;
                up->port.icount.rx++;
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 48f6e872314b..3490022e9fdc 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -154,15 +154,6 @@ pl010_rx_chars(struct uart_port *port)
        status = UART_GET_FR(port);
        while (UART_RX_DATA(status) && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts.
-                         */
-                }
                ch = UART_GET_CHAR(port);
                flag = TTY_NORMAL;
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 129670556162..034a029e356e 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -120,15 +120,6 @@ pl011_rx_chars(struct uart_amba_port *uap)
        status = readw(uap->port.membase + UART01x_FR);
        while ((status & UART01x_FR_RXFE) == 0 && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = readw(uap->port.membase + UART01x_DR) | UART_DUMMY_DR_RX;
                flag = TTY_NORMAL;
                uap->port.icount.rx++;
diff --git a/drivers/serial/au1x00_uart.c b/drivers/serial/au1x00_uart.c
index a274ebf256a1..ceb5d7f37bbd 100644
--- a/drivers/serial/au1x00_uart.c
+++ b/drivers/serial/au1x00_uart.c
@@ -241,18 +241,12 @@ static _INLINE_ void
 receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
 {
        struct tty_struct *tty = up->port.info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        int max_count = 256;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return; // if TTY_DONT_FLIP is set
-                }
                ch = serial_inp(up, UART_RX);
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -292,30 +286,23 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
 #endif
                        if (*status & UART_LSR_BI) {
                                DEBUG_INTR("handling break....");
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
+                if ((*status & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
+                if (*status & UART_LSR_OE)
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
                        /*
                         * Overrun is special, since it's reported
                         * immediately, and doesn't affect the current
                         * character.
                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
        ignore_char:
                *status = serial_inp(up, UART_LSR);
diff --git a/drivers/serial/clps711x.c b/drivers/serial/clps711x.c
index 87ef368384fb..8ef999481f93 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/serial/clps711x.c
@@ -104,8 +104,6 @@ static irqreturn_t clps711xuart_int_rx(int irq, void *dev_id, struct pt_regs *re
        while (!(status & SYSFLG_URXFE)) {
                ch = clps_readl(UARTDR(port));
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto ignore_char;
                port->icount.rx++;
                flg = TTY_NORMAL;
diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
index 4d8516d1bb71..a64ba26a94e8 100644
--- a/drivers/serial/dz.c
+++ b/drivers/serial/dz.c
@@ -216,8 +216,6 @@ static inline void dz_receive_chars(struct dz_port *dport)
                if (!tty)
                        break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
                icount->rx++;
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index eb31125c6a30..144a7a352b28 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -729,19 +729,20 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
        unsigned short int status;
        struct uart_icount *icount;
        unsigned long offset;
+        unsigned char flag;
        trace(icom_port, "RCV_COMPLETE", 0);
        rcv_buff = icom_port->next_rcv;
        status = cpu_to_le16(icom_port->statStg->rcv[rcv_buff].flags);
        while (status & SA_FL_RCV_DONE) {
+                int first = -1;
                trace(icom_port, "FID_STATUS", status);
                count = cpu_to_le16(icom_port->statStg->rcv[rcv_buff].leLength);
+                count = tty_buffer_request_room(tty, count);
                trace(icom_port, "RCV_COUNT", count);
-                if (count > (TTY_FLIPBUF_SIZE - tty->flip.count))
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
                trace(icom_port, "REAL_COUNT", count);
@@ -749,15 +750,10 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                        cpu_to_le32(icom_port->statStg->rcv[rcv_buff].leBuffer) -
                        icom_port->recv_buf_pci;
-                memcpy(tty->flip.char_buf_ptr,(unsigned char *)
+                /* Block copy all but the last byte as this may have status */
-                       ((unsigned long)icom_port->recv_buf + offset), count);
                if (count > 0) {
-                        tty->flip.count += count - 1;
+                        first = icom_port->recv_buf[offset];
-                        tty->flip.char_buf_ptr += count - 1;
+                        tty_insert_flip_string(tty, icom_port->recv_buf + offset, count - 1);
-                        memset(tty->flip.flag_buf_ptr, 0, count);
-                        tty->flip.flag_buf_ptr += count - 1;
                }
                icount = &icom_port->uart_port.icount;
@@ -765,12 +761,14 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                /* Break detect logic */
                if ((status & SA_FLAGS_FRAME_ERROR)
-                    && (tty->flip.char_buf_ptr[0] == 0x00)) {
+                    && first == 0) {
                        status &= ~SA_FLAGS_FRAME_ERROR;
                        status |= SA_FLAGS_BREAK_DET;
                        trace(icom_port, "BREAK_DET", 0);
                }
+                flag = TTY_NORMAL;
                if (status &
                    (SA_FLAGS_BREAK_DET | SA_FLAGS_PARITY_ERROR |
                     SA_FLAGS_FRAME_ERROR | SA_FLAGS_OVERRUN)) {
@@ -797,33 +795,26 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                        status &= icom_port->read_status_mask;
                        if (status & SA_FLAGS_BREAK_DET) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (status & SA_FLAGS_PARITY_ERROR) {
                                trace(icom_port, "PARITY_ERROR", 0);
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        } else if (status & SA_FLAGS_FRAME_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        if (status & SA_FLAGS_OVERRUN) {
-                                /*
-                                 * Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                }
-                        }
                }
-                tty->flip.flag_buf_ptr++;
+                tty_insert_flip_char(tty, *(icom_port->recv_buf + offset + count - 1), flag);
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
+                if (status & SA_FLAGS_OVERRUN)
-                ignore_char:
+                        /*
-                        icom_port->statStg->rcv[rcv_buff].flags = 0;
+                         * Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+ignore_char:
+                icom_port->statStg->rcv[rcv_buff].flags = 0;
                icom_port->statStg->rcv[rcv_buff].leLength = 0;
                icom_port->statStg->rcv[rcv_buff].WorkingLength =
                        (unsigned short int) cpu_to_le16(RCV_BUFF_SZ);
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 83c4c1216587..5c098be9346b 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -256,9 +256,6 @@ static irqreturn_t imx_rxint(int irq, void *dev_id, struct pt_regs *regs)
        error_return:
                tty_insert_flip_char(tty, rx, flg);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto out;
        ignore_char:
                rx = URXD0((u32)sport->port.membase);
        } while(rx & URXD_CHARRDY);
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 771676abee60..1d85533d46d2 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2327,19 +2327,13 @@ static void receive_chars(struct uart_port *the_port)
        spin_lock_irqsave(&the_port->lock, pflags);
        tty = info->tty;
-        if (request_count > TTY_FLIPBUF_SIZE - tty->flip.count)
+        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS - 2);
-                request_count = TTY_FLIPBUF_SIZE - tty->flip.count;
        if (request_count > 0) {
                icount = &the_port->icount;
                read_count = do_read(the_port, ch, request_count);
                if (read_count > 0) {
-                        flip = 1;
+                        tty_insert_flip_string(tty, ch, read_count);
-                        memcpy(tty->flip.char_buf_ptr, ch, read_count);
-                        memset(tty->flip.flag_buf_ptr, TTY_NORMAL, read_count);
-                        tty->flip.char_buf_ptr += read_count;
-                        tty->flip.flag_buf_ptr += read_count;
-                        tty->flip.count += read_count;
                        icount->rx += read_count;
                }
        }
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index ef132349f310..66f117d15065 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -259,13 +259,7 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
        struct tty_struct *tty = up->port.info->tty;    /* XXX info==NULL? */
        while (1) {
-                unsigned char ch, r1;
+                unsigned char ch, r1, flag;
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return;         /* XXX Ignores SysRq when we need it most. Fix. */
-                }
                r1 = read_zsreg(channel, R1);
                if (r1 & (PAR_ERR | Rx_OVR | CRC_ERR)) {
@@ -303,8 +297,7 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
                }
                /* A real serial line, record the character and status.  */
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (r1 & (BRK_ABRT | PAR_ERR | Rx_OVR | CRC_ERR)) {
                        if (r1 & BRK_ABRT) {
@@ -321,28 +314,21 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
                                up->port.icount.overrun++;
                        r1 &= up->port.read_status_mask;
                        if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto next_char;
                if (up->port.ignore_status_mask == 0xff ||
-                    (r1 & up->port.ignore_status_mask) == 0) {
+                    (r1 & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                if (r1 & Rx_OVR)
-                }
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
        next_char:
                ch = readb(&channel->control);
                ZSDELAY();
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index b0ecc7537ce5..b48066a64a7d 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -331,17 +331,12 @@ static _INLINE_ void receive_chars(struct uart_sio_port *up, int *status,
 {
        struct tty_struct *tty = up->port.info->tty;
        unsigned char ch;
+        unsigned char flag;
        int max_count = 256;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return; // if TTY_DONT_FLIP is set
-                }
                ch = sio_in(up, SIORXB);
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -380,30 +375,24 @@ static _INLINE_ void receive_chars(struct uart_sio_port *up, int *status,
                        if (*status & UART_LSR_BI) {
                                DEBUG_INTR("handling break....");
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
+                if ((*status & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                if (*status & UART_LSR_OE) {
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
                        /*
                         * Overrun is special, since it's reported
                         * immediately, and doesn't affect the current
                         * character.
                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
        ignore_char:
                *status = serial_in(up, UART_LSR);
diff --git a/drivers/serial/mcfserial.c b/drivers/serial/mcfserial.c
index 47f7404cb045..f2a51e61eec7 100644
--- a/drivers/serial/mcfserial.c
+++ b/drivers/serial/mcfserial.c
@@ -313,7 +313,7 @@ static inline void receive_chars(struct mcf_serial *info)
 {
        volatile unsigned char  *uartp;
        struct tty_struct       *tty = info->tty;
-        unsigned char           status, ch;
+        unsigned char           status, ch, flag;
        if (!tty)
                return;
@@ -321,10 +321,6 @@ static inline void receive_chars(struct mcf_serial *info)
        uartp = info->addr;
        while ((status = uartp[MCFUART_USR]) & MCFUART_USR_RXREADY) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
                ch = uartp[MCFUART_URB];
                info->stats.rx++;
@@ -335,29 +331,24 @@ static inline void receive_chars(struct mcf_serial *info)
                }
 #endif
-                tty->flip.count++;
+                flag = TTY_NORMAL;
                if (status & MCFUART_USR_RXERR) {
                        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETERR;
                        if (status & MCFUART_USR_RXBREAK) {
                                info->stats.rxbreak++;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (status & MCFUART_USR_RXPARITY) {
                                info->stats.rxparity++;
-                                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                                flag = TTY_PARITY;
                        } else if (status & MCFUART_USR_RXOVERRUN) {
                                info->stats.rxoverrun++;
-                                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                                flag = TTY_OVERRUN;
                        } else if (status & MCFUART_USR_RXFRAMING) {
                                info->stats.rxframing++;
-                                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        } else {
-                                /* This should never happen... */
-                                *tty->flip.flag_buf_ptr++ = 0;
                        }
-                } else {
-                        *tty->flip.flag_buf_ptr++ = 0;
                }
-                *tty->flip.char_buf_ptr++ = ch;
+                tty_insert_flip_char(tty, ch, flag);
        }
        schedule_work(&tty->flip.work);
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 1288d6203e94..61dd17d7bace 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -405,17 +405,13 @@ static inline int
 mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
 {
        struct tty_struct *tty = port->info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        unsigned short status;
        /* While we can read, do so ! */
        while ( (status = in_be16(&PSC(port)->mpc52xx_psc_status)) &
                MPC52xx_PSC_SR_RXRDY) {
-                /* If we are full, just stop reading */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-                
                /* Get the char */
                ch = in_8(&PSC(port)->mpc52xx_psc_buffer_8);
@@ -428,45 +424,35 @@ mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
 #endif
                /* Store it */
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = 0;
+                flag = TTY_NORMAL;
                port->icount.rx++;
        
                if ( status & (MPC52xx_PSC_SR_PE |
                               MPC52xx_PSC_SR_FE |
-                               MPC52xx_PSC_SR_RB |
+                               MPC52xx_PSC_SR_RB) ) {
-                               MPC52xx_PSC_SR_OE) ) {
                        
                        if (status & MPC52xx_PSC_SR_RB) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                                uart_handle_break(port);
                        } else if (status & MPC52xx_PSC_SR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (status & MPC52xx_PSC_SR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        if (status & MPC52xx_PSC_SR_OE) {
-                                /*
-                                 * Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < (TTY_FLIPBUF_SIZE-1)) {
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        tty->flip.count++;
-                                }
-                                *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        }
                        /* Clear error condition */
                        out_8(&PSC(port)->command,MPC52xx_PSC_RST_ERR_STAT);
                }
+                tty_insert_flip_char(tty, ch, flag);
-                tty->flip.char_buf_ptr++;
+                if (status & MPC52xx_PSC_SR_OE) {
-                tty->flip.flag_buf_ptr++;
+                        /*
-                tty->flip.count++;
+                         * Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                }
        }
        tty_flip_buffer_push(tty);
diff --git a/drivers/serial/mpsc.c b/drivers/serial/mpsc.c
index 8f83e4007ecd..0ca83ac31d07 100644
--- a/drivers/serial/mpsc.c
+++ b/drivers/serial/mpsc.c
@@ -769,12 +769,12 @@ mpsc_rx_intr(struct mpsc_port_info *pi, struct pt_regs *regs)
                bytes_in = be16_to_cpu(rxre->bytecnt);
                /* Following use of tty struct directly is deprecated */
-                if (unlikely((tty->flip.count + bytes_in) >= TTY_FLIPBUF_SIZE)){
+                if (unlikely(tty_buffer_request_room(tty, bytes_in) < bytes_in)) {
                        if (tty->low_latency)
                                tty_flip_buffer_push(tty);
                        /*
-                         * If this failed then we will throw awa the bytes
+                         * If this failed then we will throw away the bytes
-                         * but mst do so to clear interrupts.
+                         * but must do so to clear interrupts.
                         */
                }
diff --git a/drivers/serial/mux.c b/drivers/serial/mux.c
index 7633132a10aa..4e49168c3176 100644
--- a/drivers/serial/mux.c
+++ b/drivers/serial/mux.c
@@ -223,11 +223,6 @@ static void mux_read(struct uart_port *port)
                if (MUX_EOFIFO(data))
                        break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        continue;
-                *tty->flip.char_buf_ptr = data & 0xffu;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                port->icount.rx++;
                if (MUX_BREAK(data)) {
@@ -239,9 +234,7 @@ static void mux_read(struct uart_port *port)
                if (uart_handle_sysrq_char(port, data & 0xffu, NULL))
                        continue;
-                tty->flip.flag_buf_ptr++;
+                tty_insert_flip_char(tty, data & 0xFF, TTY_NORMAL);
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
        }
        
        if (start_count != port->icount.rx) {
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index ea24129eb6b9..f330d6c0e0df 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -210,10 +210,9 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                                            struct pt_regs *regs)
 {
        struct tty_struct *tty = NULL;
-        unsigned char ch, r1, drop, error;
+        unsigned char ch, r1, drop, error, flag;
        int loops = 0;
- retry:
        /* The interrupt can be enabled when the port isn't open, typically
         * that happens when using one port is open and the other closed (stale
         * interrupt) or when one port is used as a console.
@@ -246,20 +245,6 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                error = 0;
                drop = 0;
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        /* Have to drop the lock here */
-                        pmz_debug("pmz: flip overflow\n");
-                        spin_unlock(&uap->port.lock);
-                        tty->flip.work.func((void *)tty);
-                        spin_lock(&uap->port.lock);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                drop = 1;
-                        if (ZS_IS_ASLEEP(uap))
-                                return NULL;
-                        if (!ZS_IS_OPEN(uap))
-                                goto retry;
-                }
                r1 = read_zsreg(uap, R1);
                ch = read_zsdata(uap);
@@ -295,8 +280,7 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                if (drop)
                        goto next_char;
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                uap->port.icount.rx++;
                if (r1 & (PAR_ERR | Rx_OVR | CRC_ERR | BRK_ABRT)) {
@@ -316,26 +300,19 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                                uap->port.icount.overrun++;
                        r1 &= uap->port.read_status_mask;
                        if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uap->port.ignore_status_mask == 0xff ||
                    (r1 & uap->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
        next_char:
                /* We can get stuck in an infinite loop getting char 0 when the
                 * line is in a wrong HW state, we break that here.
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index cc998b99a19f..10535f00301f 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -107,14 +107,6 @@ receive_chars(struct uart_pxa_port *up, int *status, struct pt_regs *regs)
        int max_count = 256;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = serial_in(up, UART_RX);
                flag = TTY_NORMAL;
                up->port.icount.rx++;
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index fe83ce6fef52..eb4883efb7c6 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -323,16 +323,6 @@ s3c24xx_serial_rx_chars(int irq, void *dev_id, struct pt_regs *regs)
                if (s3c24xx_serial_rx_fifocnt(ourport, ufstat) == 0)
                        break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                uerstat = rd_regl(port, S3C2410_UERSTAT);
                ch = rd_regb(port, S3C2410_URXH);
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index 25a086458ab9..1bd93168f504 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -201,8 +201,6 @@ sa1100_rx_chars(struct sa1100_port *sport, struct pt_regs *regs)
        while (status & UTSR1_TO_SM(UTSR1_RNE)) {
                ch = UART_GET_CHAR(sport);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto ignore_char;
                sport->port.icount.rx++;
                flg = TTY_NORMAL;
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index d01dbe5da3b9..d4a1f0e798c1 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -148,15 +148,6 @@ lh7a40xuart_rx_chars (struct uart_port* port)
        unsigned int data, flag;/* Received data and status */
        while (!(UR (port, UART_R_STATUS) & nRxRdy) && --cbRxMax) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                data = UR (port, UART_R_DATA);
                flag = TTY_NORMAL;
                ++port->icount.rx;
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index 995d9dd9ddd5..fdd1f1915a42 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -303,17 +303,6 @@ receive_chars(struct uart_txx9_port *up, unsigned int *status, struct pt_regs *r
        char flag;
        do {
-                /* The following is not allowed by the tty layer and
-                   unsafe. It should be fixed ASAP */
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency) {
-                                spin_unlock(&up->port.lock);
-                                tty_flip_buffer_push(tty);
-                                spin_lock(&up->port.lock);
-                        }
-                        /* If this failed then we will throw away the
-                           bytes but must do so to clear interrupts */
-                }
                ch = sio_in(up, TXX9_SIRFIFO);
                flag = TTY_NORMAL;
                up->port.icount.rx++;
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 430754ebac8a..a9e070759628 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -482,6 +482,7 @@ static inline void sci_receive_chars(struct uart_port *port,
        struct tty_struct *tty = port->info->tty;
        int i, count, copied = 0;
        unsigned short status;
+        unsigned char flag;
        status = sci_in(port, SCxSR);
        if (!(status & SCxSR_RDxF(port)))
@@ -499,8 +500,7 @@ static inline void sci_receive_chars(struct uart_port *port,
 #endif
                /* Don't copy more bytes than there is room for in the buffer */
-                if (tty->flip.count + count > TTY_FLIPBUF_SIZE)
+                count = tty_buffer_request_room(tty, count);
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
                /* If for any reason we can't copy more data, we're done! */
                if (count == 0)
@@ -512,8 +512,7 @@ static inline void sci_receive_chars(struct uart_port *port,
                            || uart_handle_sysrq_char(port, c, regs)) {
                                count = 0;
                        } else {
-                            tty->flip.char_buf_ptr[0] = c;
+                            tty_insert_flip_char(tty, c, TTY_NORMAL);
-                            tty->flip.flag_buf_ptr[0] = TTY_NORMAL;
                        }
                } else {
                        for (i=0; i<count; i++) {
@@ -542,26 +541,21 @@ static inline void sci_receive_chars(struct uart_port *port,
                                }
                                /* Store data and status */
-                                tty->flip.char_buf_ptr[i] = c;
                                if (status&SCxSR_FER(port)) {
-                                        tty->flip.flag_buf_ptr[i] = TTY_FRAME;
+                                        flag = TTY_FRAME;
                                        pr_debug("sci: frame error\n");
                                } else if (status&SCxSR_PER(port)) {
-                                        tty->flip.flag_buf_ptr[i] = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                        pr_debug("sci: parity error\n");
-                                } else {
+                                } else
-                                        tty->flip.flag_buf_ptr[i] = TTY_NORMAL;
+                                        flag = TTY_NORMAL;
-                                }
+                                tty_insert_flip_char(tty, c, flag);
                        }
                }
                sci_in(port, SCxSR); /* dummy read */
                sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
-                /* Update the kernel buffer end */
-                tty->flip.count += count;
-                tty->flip.char_buf_ptr += count;
-                tty->flip.flag_buf_ptr += count;
                copied += count;
                port->icount.rx += count;
        }
@@ -608,48 +602,45 @@ static inline int sci_handle_errors(struct uart_port *port)
        unsigned short status = sci_in(port, SCxSR);
        struct tty_struct *tty = port->info->tty;
-        if (status&SCxSR_ORER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_ORER(port)) {
                /* overrun error */
-                copied++;
+                if(tty_insert_flip_char(tty, 0, TTY_OVERRUN))
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        copied++;
                pr_debug("sci: overrun error\n");
        }
-        if (status&SCxSR_FER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_FER(port)) {
                if (sci_rxd_in(port) == 0) {
                        /* Notify of BREAK */
                        struct sci_port * sci_port = (struct sci_port *)port;
-                       if(!sci_port->break_flag) {
+                        if(!sci_port->break_flag) {
-                                sci_port->break_flag = 1;
+                                sci_port->break_flag = 1;
-                               sci_schedule_break_timer((struct sci_port *)port);
+                                sci_schedule_break_timer((struct sci_port *)port);
                                /* Do sysrq handling. */
-                                if(uart_handle_break(port)) {
+                                if(uart_handle_break(port))
                                        return 0;
-                                }
                                pr_debug("sci: BREAK detected\n");
-                                copied++;
+                                if(tty_insert_flip_char(tty, 0, TTY_BREAK))
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                        copied++;
                       }
                }
                else {
                        /* frame error */
-                        copied++;
+                        if(tty_insert_flip_char(tty, 0, TTY_FRAME))
-                        *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                                copied++;
                        pr_debug("sci: frame error\n");
                }
        }
-        if (status&SCxSR_PER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_PER(port)) {
+                if(tty_insert_flip_char(tty, 0, TTY_PARITY))
+                        copied++;
                /* parity error */
-                copied++;
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
                pr_debug("sci: parity error\n");
        }
-        if (copied) {
+        if (copied)
-                tty->flip.count += copied;
                tty_flip_buffer_push(tty);
-        }
        return copied;
 }
@@ -661,15 +652,14 @@ static inline int sci_handle_breaks(struct uart_port *port)
        struct tty_struct *tty = port->info->tty;
        struct sci_port *s = &sci_ports[port->line];
-        if (!s->break_flag && status & SCxSR_BRK(port) &&
+        if (!s->break_flag && status & SCxSR_BRK(port))
-            tty->flip.count < TTY_FLIPBUF_SIZE) {
 #if defined(CONFIG_CPU_SH3)
                /* Debounce break */
                s->break_flag = 1;
 #endif
                /* Notify of BREAK */
-                copied++;
+                if(tty_insert_flip_char(tty, 0, TTY_BREAK))
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                        copied++;
                pr_debug("sci: BREAK detected\n");
        }
@@ -677,19 +667,15 @@ static inline int sci_handle_breaks(struct uart_port *port)
        /* XXX: Handle SCIF overrun error */
        if (port->type == PORT_SCIF && (sci_in(port, SCLSR) & SCIF_ORER) != 0) {
                sci_out(port, SCLSR, 0);
-                if(tty->flip.count<TTY_FLIPBUF_SIZE) {
+                if(tty_insert_flip_char(tty, 0, TTY_OVERRUN)) {
                        copied++;
-                        *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
                        pr_debug("sci: overrun error\n");
                }
        }
 #endif
-        if (copied) {
+        if (copied)
-                tty->flip.count += copied;
                tty_flip_buffer_push(tty);
-        }
        return copied;
 }
@@ -732,12 +718,9 @@ static irqreturn_t sci_er_interrupt(int irq, void *ptr, struct pt_regs *regs)
                        struct tty_struct *tty = port->info->tty;
                        sci_out(port, SCLSR, 0);
-                        if(tty->flip.count<TTY_FLIPBUF_SIZE) {
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        tty_flip_buffer_push(tty);
-                                tty->flip.count++;
+                        pr_debug("scif: overrun error\n");
-                                tty_flip_buffer_push(tty);
-                                pr_debug("scif: overrun error\n");
-                        }
                }
 #endif
                sci_rx_interrupt(irq, ptr, regs);
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 313f9df24a2d..5468e5a767e2 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -519,11 +519,7 @@ sn_receive_chars(struct sn_cons_port *port, struct pt_regs *regs,
                /* record the character to pass up to the tty layer */
                if (tty) {
-                        *tty->flip.char_buf_ptr = ch;
+                        if(tty_insert_flip_char(tty, ch, TTY_NORMAL) == 0)
-                        *tty->flip.flag_buf_ptr = TTY_NORMAL;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                        if (tty->flip.count == TTY_FLIPBUF_SIZE)
                                break;
                }
                port->sc_port.icount.rx++;
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index ba9381fd3f2d..7e773ff76c61 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -159,21 +159,14 @@ receive_chars(struct uart_sunsab_port *up,
                saw_console_brk = 1;
        for (i = 0; i < count; i++) {
-                unsigned char ch = buf[i];
+                unsigned char ch = buf[i], flag;
                if (tty == NULL) {
                        uart_handle_sysrq_char(&up->port, ch, regs);
                        continue;
                }
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
+                flag = TTY_NORMAL;
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return tty; // if TTY_DONT_FLIP is set
-                }
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(stat->sreg.isr0 & (SAB82532_ISR0_PERR |
@@ -209,34 +202,21 @@ receive_chars(struct uart_sunsab_port *up,
                        stat->sreg.isr1 &= ((up->port.read_status_mask >> 8) & 0xff);
                        if (stat->sreg.isr1 & SAB82532_ISR1_BRK) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (stat->sreg.isr0 & SAB82532_ISR0_PERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (stat->sreg.isr0 & SAB82532_ISR0_FERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        continue;
                if ((stat->sreg.isr0 & (up->port.ignore_status_mask & 0xff)) == 0 &&
-                    (stat->sreg.isr1 & ((up->port.ignore_status_mask >> 8) & 0xff)) == 0){
+                    (stat->sreg.isr1 & ((up->port.ignore_status_mask >> 8) & 0xff)) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
+                if (stat->sreg.isr0 & SAB82532_ISR0_RFO)
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
-                if ((stat->sreg.isr0 & SAB82532_ISR0_RFO) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
        }
        if (saw_console_brk)
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index f0738533f39a..9a3665b34d97 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -323,19 +323,13 @@ static _INLINE_ struct tty_struct *
 receive_chars(struct uart_sunsu_port *up, unsigned char *status, struct pt_regs *regs)
 {
        struct tty_struct *tty = up->port.info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        int max_count = 256;
        int saw_console_brk = 0;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return tty; // if TTY_DONT_FLIP is set
-                }
                ch = serial_inp(up, UART_RX);
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -377,31 +371,23 @@ receive_chars(struct uart_sunsu_port *up, unsigned char *status, struct pt_regs
                        }
                        if (*status & UART_LSR_BI) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
+                if ((*status & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
+                if (*status & UART_LSR_OE)
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
                        /*
                         * Overrun is special, since it's reported
                         * immediately, and doesn't affect the current
                         * character.
                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
+                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
        ignore_char:
                *status = serial_inp(up, UART_LSR);
        } while ((*status & UART_LSR_DR) && (max_count-- > 0));
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 7653d6cf05af..3c72484adea7 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -319,7 +319,7 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                       struct pt_regs *regs)
 {
        struct tty_struct *tty;
-        unsigned char ch, r1;
+        unsigned char ch, r1, flag;
        tty = NULL;
        if (up->port.info != NULL &&            /* Unopened serial console */
@@ -362,19 +362,8 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                        continue;
                }
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        /*
-                         * The 8250 bails out of the loop here,
-                         * but we need to read everything, or die.
-                         */
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                continue;
-                }
                /* A real serial line, record the character and status.  */
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (r1 & (BRK_ABRT | PAR_ERR | Rx_OVR | CRC_ERR)) {
                        if (r1 & BRK_ABRT) {
@@ -391,28 +380,21 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                                up->port.icount.overrun++;
                        r1 &= up->port.read_status_mask;
                        if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        continue;
                if (up->port.ignore_status_mask == 0xff ||
                    (r1 & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
        }
        return tty;
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index 865d4dea65df..0a28deeb098d 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -371,11 +371,6 @@ static inline void receive_chars(struct uart_port *port, uint8_t *status,
        lsr = *status;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                }
                ch = siu_read(port, UART_RX);
                port->icount.rx++;
                flag = TTY_NORMAL;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 248279e44c99..b9fd39fd1b5b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -335,14 +335,9 @@ next_buffer:
        dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d\n", buf, buf->size);
-        for (i = 0; i < buf->size && !acm->throttle; i++) {
+        tty_buffer_request_room(tty, buf->size);
-                /* if we insert more than TTY_FLIPBUF_SIZE characters,
+        if (!acm->throttle)
-                   we drop them. */
+                tty_insert_flip_string(tty, buf->base, buf->size);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                }
-                tty_insert_flip_char(tty, buf->base[i], 0);
-        }
        tty_flip_buffer_push(tty);
        spin_lock(&acm->throttle_lock);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 65e084a2c87e..2e6926b33455 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1271,6 +1271,7 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
        unsigned int len;
        struct gs_port *port;
        int ret;
+        struct tty_struct *tty;
        /* TEMPORARY -- only port 0 is supported right now */
        port = dev->dev_port[0];
@@ -1290,7 +1291,10 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
                goto exit;
        }
-        if (port->port_tty == NULL) {
+        tty = port->port_tty;
+        if (tty == NULL) {
                printk(KERN_ERR "gs_recv_packet: port=%d, NULL tty pointer\n",
                        port->port_num);
                ret = -EIO;
@@ -1304,20 +1308,13 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
                goto exit;
        }
-        len = (unsigned int)(TTY_FLIPBUF_SIZE - port->port_tty->flip.count);
+        len = tty_buffer_request_room(tty, size);
-        if (len < size)
+        if (len > 0) {
-                size = len;
+                tty_insert_flip_string(tty, packet, len);
-        if (size > 0) {
-                memcpy(port->port_tty->flip.char_buf_ptr, packet, size);
-                port->port_tty->flip.char_buf_ptr += size;
-                port->port_tty->flip.count += size;
                tty_flip_buffer_push(port->port_tty);
                wake_up_interruptible(&port->port_tty->read_wait);
        }
        ret = 0;
 exit:
        spin_unlock(&port->port_lock);
        return ret;
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 14f55fd26a64..be5dc80836c3 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -84,7 +84,7 @@ config USB_SERIAL_BELKIN
 config USB_SERIAL_WHITEHEAT
        tristate "USB ConnectTech WhiteHEAT Serial Driver"
-        depends on USB_SERIAL && BROKEN_ON_SMP
+        depends on USB_SERIAL
        help
          Say Y here if you want to use a ConnectTech WhiteHEAT 4 port
          USB to serial converter device.
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 6d18d4eaba35..2357b1d102d7 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -364,7 +364,6 @@ static void cyberjack_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
        short todo;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -381,14 +380,8 @@ static void cyberjack_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                return;
        }
        if (urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 4e9637eb6137..68067fe117a4 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -1263,12 +1263,10 @@ static void cypress_read_int_callback(struct urb *urb, struct pt_regs *regs)
        /* process read if there is data other than line status */
        if (tty && (bytes > i)) {
+                bytes = tty_buffer_request_room(tty, bytes);
                for (; i < bytes ; ++i) {
                        dbg("pushing byte number %d - %d - %c", i, data[i],
                                        data[i]);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
                        tty_insert_flip_char(tty, data[i], tty_flag);
                }
                tty_flip_buffer_push(port->tty);
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 8fc414bd5b24..b3f776a90c93 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -946,13 +946,10 @@ dbg( "digi_rx_unthrottle: TOP: port=%d", priv->dp_port_num );
        spin_lock_irqsave( &priv->dp_port_lock, flags );
        /* send any buffered chars from throttle time on to tty subsystem */
-        len = min(priv->dp_in_buf_len, TTY_FLIPBUF_SIZE - tty->flip.count );
+        len = tty_buffer_request_room(tty, priv->dp_in_buf_len);
        if( len > 0 ) {
-                memcpy( tty->flip.char_buf_ptr, priv->dp_in_buf, len );
+                tty_insert_flip_string_flags(tty, priv->dp_in_buf, priv->dp_in_flag_buf, len);
-                memcpy( tty->flip.flag_buf_ptr, priv->dp_in_flag_buf, len );
-                tty->flip.char_buf_ptr += len;
-                tty->flip.flag_buf_ptr += len;
-                tty->flip.count += len;
                tty_flip_buffer_push( tty );
        }
@@ -1827,6 +1824,7 @@ static int digi_read_inb_callback( struct urb *urb )
        int status = ((unsigned char *)urb->transfer_buffer)[2];
        unsigned char *data = ((unsigned char *)urb->transfer_buffer)+3;
        int flag,throttled;
+        int i;
        /* do not process callbacks on closed ports */
        /* but do continue the read chain */
@@ -1885,20 +1883,18 @@ static int digi_read_inb_callback( struct urb *urb )
                        }
                } else {
+                        len = tty_buffer_request_room(tty, len);
-                        len = min( len, TTY_FLIPBUF_SIZE - tty->flip.count );
                        if( len > 0 ) {
-                                memcpy( tty->flip.char_buf_ptr, data, len );
+                                /* Hot path */
-                                memset( tty->flip.flag_buf_ptr, flag, len );
+                                if(flag == TTY_NORMAL)
-                                tty->flip.char_buf_ptr += len;
+                                        tty_insert_flip_string(tty, data, len);
-                                tty->flip.flag_buf_ptr += len;
+                                else {
-                                tty->flip.count += len;
+                                        for(i = 0; i < len; i++)
+                                                tty_insert_flip_char(tty, data[i], flag);
+                                }
                                tty_flip_buffer_push( tty );
                        }
                }
        }
        spin_unlock( &priv->dp_port_lock );
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 79a766e9ca23..63f7c78a1152 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -344,7 +344,6 @@ static void empeg_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        struct usb_serial_port *port = (struct usb_serial_port *)urb->context;
        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -359,19 +358,8 @@ static void empeg_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* gb - 2000/11/13
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                         * If we insert too many characters we'll overflow the buffer.
-                         * This means we'll lose bytes - Decidedly bad.
-                         */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                                }
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
-                /* gb - 2000/11/13
-                 * Goes straight through instead of scheduling - if tty->low_latency is set.
-                 */
                tty_flip_buffer_push(tty);
                bytes_in += urb->actual_length;
        }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index eb863b3f2d79..10bc1bf23b35 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1610,24 +1610,11 @@ static void ftdi_process_read (void *param)
                        length = 0;
                }
-                /* have to make sure we don't overflow the buffer
-                   with tty_insert_flip_char's */
-                if (tty->flip.count+length > TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                        need_flip = 0;
-                        if (tty->flip.count != 0) {
-                                /* flip didn't work, this happens when ftdi_process_read() is
-                                 * called from ftdi_unthrottle, because TTY_DONT_FLIP is set */
-                                dbg("%s - flip buffer push failed", __FUNCTION__);
-                                break;
-                        }
-                }
                if (priv->rx_flags & THROTTLED) {
                        dbg("%s - throttled", __FUNCTION__);
                        break;
                }
-                if (tty->ldisc.receive_room(tty)-tty->flip.count < length) {
+                if (tty_buffer_request_room(tty, length) < length) {
                        /* break out & wait for throttling/unthrottling to happen */
                        dbg("%s - receive room low", __FUNCTION__);
                        break;
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 452efce72714..d6f55e9dccae 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -275,23 +275,14 @@ static void send_to_tty(struct usb_serial_port *port,
                        char *data, unsigned int actual_length)
 {
        struct tty_struct *tty = port->tty;
-        int i;
        if (tty && actual_length) {
                usb_serial_debug_data(debug, &port->dev, 
                                        __FUNCTION__, actual_length, data);
-                for (i = 0; i < actual_length ; ++i) {
+                tty_buffer_request_room(tty, actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters,
+                tty_insert_flip_string(tty, data, actual_length);
-                           we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless
-                           tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
 }
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 4ddac620fc0c..476cda107f4f 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -254,7 +254,6 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
        struct usb_serial *serial = port->serial;
        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -268,14 +267,8 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index faedbeb6ba49..3f29e6b0fd19 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -1965,20 +1965,14 @@ static void edge_tty_recv(struct device *dev, struct tty_struct *tty, unsigned c
        int cnt;
        do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                cnt = tty_buffer_request_room(tty, length);
-                        tty_flip_buffer_push(tty);
+                if (cnt < length) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n",
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n",
+                                        __FUNCTION__, length - cnt);
-                                        __FUNCTION__, length);
+                        if(cnt == 0)
-                                return;
+                                break;
-                        }
                }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
+                tty_insert_flip_string(tty, data, cnt);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
                data += cnt;
                length -= cnt;
        } while (length > 0);
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 2edf9cabad20..afc0f34b3a46 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1865,20 +1865,14 @@ static void edge_tty_recv(struct device *dev, struct tty_struct *tty, unsigned c
        int cnt;
        do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                cnt = tty_buffer_request_room(tty, length);
-                        tty_flip_buffer_push(tty);
+                if (cnt < length) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n",
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n",
+                                __FUNCTION__, length - cnt);
-                                        __FUNCTION__, length);
+                        if(cnt == 0)
-                                return;
+                                break;
-                        }
                }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
+                tty_insert_flip_string(tty, data, cnt);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
                data += cnt;
                length -= cnt;
        } while (length > 0);
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 06d07cea0b70..9a5c97989562 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -711,7 +711,7 @@ static void ipaq_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        struct usb_serial_port  *port = (struct usb_serial_port *)urb->context;
        struct tty_struct       *tty;
        unsigned char           *data = urb->transfer_buffer;
-        int                     i, result;
+        int                     result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -724,14 +724,8 @@ static void ipaq_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
                bytes_in += urb->actual_length;
        }
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index 2dd191f5fe76..e760a70242c1 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -166,7 +166,6 @@ static void ipw_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        struct usb_serial_port *port = urb->context;
        unsigned char *data = urb->transfer_buffer;
        struct tty_struct *tty;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -180,14 +179,8 @@ static void ipw_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 4e2f7dfb58b2..78335a5f7743 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -648,7 +648,6 @@ static void klsi_105_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                usb_serial_debug_data(debug, &port->dev, __FUNCTION__,
                                      urb->actual_length, data);
        } else {
-                int i;
                int bytes_sent = ((__u8 *) data)[0] +
                                 ((unsigned int) ((__u8 *) data)[1] << 8);
                tty = port->tty;
@@ -669,16 +668,8 @@ static void klsi_105_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                        bytes_sent = urb->actual_length - 2;
                }
-                for (i = 2; i < 2+bytes_sent; i++) {
+                tty_buffer_request_room(tty, bytes_sent);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters,
+                tty_insert_flip_string(tty, data + 2, bytes_sent);
-                         * we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless 
-                         * tty->low_latency is set */
-                        tty_insert_flip_char(tty, ((__u8*) data)[i], 0);
-                }
                tty_flip_buffer_push(tty);
                /* again lockless, but debug info only */
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index d9c21e275130..b8b213185d0f 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -365,7 +365,6 @@ static void kobil_close (struct usb_serial_port *port, struct file *filp)
 static void kobil_read_int_callback( struct urb *purb, struct pt_regs *regs)
 {
-        int i;
        int result;
        struct usb_serial_port *port = (struct usb_serial_port *) purb->context;
        struct tty_struct *tty;
@@ -397,14 +396,8 @@ static void kobil_read_int_callback( struct urb *purb, struct pt_regs *regs)
                */
                // END DEBUG
-                for (i = 0; i < purb->actual_length; ++i) {
+                tty_buffer_request_room(tty, purb->actual_length);
-                        // if we insert more than TTY_FLIPBUF_SIZE characters, we drop them.
+                tty_insert_flip_string(tty, data, purb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        // this doesn't actually push the data through unless tty->low_latency is set
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 3fd2405304fd..52bdf6fe46f2 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -321,7 +321,7 @@ static int option_write(struct usb_serial_port *port,
 static void option_indat_callback(struct urb *urb, struct pt_regs *regs)
 {
-        int i, err;
+        int err;
        int endpoint;
        struct usb_serial_port *port;
        struct tty_struct *tty;
@@ -338,11 +338,8 @@ static void option_indat_callback(struct urb *urb, struct pt_regs *regs)
        } else {
                tty = port->tty;
                if (urb->actual_length) {
-                        for (i = 0; i < urb->actual_length ; ++i) {
+                        tty_buffer_request_room(tty, urb->actual_length);
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        tty_insert_flip_string(tty, data, urb->actual_length);
-                                        tty_flip_buffer_push(tty);
-                                tty_insert_flip_char(tty, data[i], 0);
-                        }
                        tty_flip_buffer_push(tty);
                } else {
                        dbg("%s: empty read urb received", __FUNCTION__);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index f03721056190..9ffff1938239 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -924,16 +924,12 @@ static void pl2303_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
+                tty_buffer_request_room(tty, urb->actual_length + 1);
                /* overrun is special, not associated with a char */
                if (status & UART_OVERRUN_ERROR)
                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                for (i = 0; i < urb->actual_length; ++i)
-                for (i = 0; i < urb->actual_length; ++i) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
                        tty_insert_flip_char (tty, data[i], tty_flag);
-                }
                tty_flip_buffer_push (tty);
        }
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index abb830cb77bd..c18db3257073 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1280,24 +1280,18 @@ static void ti_recv(struct device *dev, struct tty_struct *tty,
        int cnt;
        do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                cnt = tty_buffer_request_room(tty, length);
-                        tty_flip_buffer_push(tty);
+                if (cnt < length) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n", __FUNCTION__, length - cnt);
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n", __FUNCTION__, length);
+                        if(cnt == 0)
-                                return;
+                                break;
-                        }
                }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
+                tty_insert_flip_string(tty, data, cnt);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
+                tty_flip_buffer_push(tty);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
                data += cnt;
                length -= cnt;
        } while (length > 0);
-        tty_flip_buffer_push(tty);
 }
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index 49b1fbe61f25..bce3d55affd8 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -488,7 +488,6 @@ static void visor_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        unsigned char *data = urb->transfer_buffer;
        struct tty_struct *tty;
        unsigned long flags;
-        int i;
        int throttled;
        int result;
@@ -503,14 +502,8 @@ static void visor_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
        spin_lock_irqsave(&priv->lock, flags);
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index a7c3c4734d83..557411c6e7c7 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -1434,7 +1434,9 @@ static void rx_data_softint(void *private)
                urb = wrap->urb;
                if (tty && urb->actual_length) {
-                        if (urb->actual_length > TTY_FLIPBUF_SIZE - tty->flip.count) {
+                        int len = tty_buffer_request_room(tty, urb->actual_length);
+                        /* This stuff can go away now I suspect */
+                        if (unlikely(len < urb->actual_length)) {
                                spin_lock_irqsave(&info->lock, flags);
                                list_add(tmp, &info->rx_urb_q);
                                spin_unlock_irqrestore(&info->lock, flags);
@@ -1442,11 +1444,8 @@ static void rx_data_softint(void *private)
                                schedule_work(&info->rx_work);
                                return;
                        }
+                        tty_insert_flip_string(tty, urb->transfer_buffer, len);
-                        memcpy(tty->flip.char_buf_ptr, urb->transfer_buffer, urb->actual_length);
+                        sent += len;
-                        tty->flip.char_buf_ptr += urb->actual_length;
-                        tty->flip.count += urb->actual_length;
-                        sent += urb->actual_length;
                }
                urb->dev = port->serial->dev;
author	Alan Cox <alan@lxorguk.ukuu.org.uk>	2006-01-09 23:54:13 -0500
committer	Linus Torvalds <torvalds@g5.osdl.org>	2006-01-10 11:01:59 -0500
commit	33f0f88f1c51ae5c2d593d26960c760ea154c2e2 (patch)
tree	f53a38cf49406863f079d74d0e8f91b276f7c1a9 /drivers
parent	6ed80991a2dce4afc113be35089c564d62fa1f11 (diff)