107 files changed, 1005 insertions, 1465 deletions

diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index cd13b91b9ff6..ab0d0b170816 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -186,9 +186,6 @@ static void tty_receive_char(struct tty_struct *tty, char ch)
                 }
         }
 
-        if((tty->flip.flag_buf_ptr == NULL) ||
-           (tty->flip.char_buf_ptr == NULL))
-                return;
         tty_insert_flip_char(tty, ch, TTY_NORMAL);
 }
 
@@ -653,8 +650,7 @@ void chan_interrupt(struct list_head *chans, struct work_struct *task,
                 chan = list_entry(ele, struct chan, list);
                 if(!chan->input || (chan->ops->read == NULL)) continue;
                 do {
-                        if((tty != NULL) &&
-                           (tty->flip.count >= TTY_FLIPBUF_SIZE)){
+                        if (tty && !tty_buffer_request_room(tty, 1)) {
                                 schedule_delayed_work(task, 1);
                                 goto out;
                         }
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 573ff6c1be5f..613673b12fa6 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -279,6 +279,7 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
         tty->disc_data = hu;
         hu->tty = tty;
+        tty->receive_room = 65536;
 
         spin_lock_init(&hu->rx_lock);
 
@@ -348,20 +349,6 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty)
                 hci_uart_tx_wakeup(hu);
 }
 
-/* hci_uart_tty_room()
- * 
- *    Callback function from tty driver. Return the amount of 
- *    space left in the receiver's buffer to decide if remote
- *    transmitter is to be throttled.
- *
- * Arguments:        tty    pointer to associated tty instance data
- * Return Value:    number of bytes left in receive buffer
- */
-static int hci_uart_tty_room (struct tty_struct *tty)
-{
-        return 65536;
-}
-
 /* hci_uart_tty_receive()
  * 
  *     Called by tty low level driver when receive data is
@@ -544,7 +531,6 @@ static int __init hci_uart_init(void)
         hci_uart_ldisc.write            = hci_uart_tty_write;
         hci_uart_ldisc.ioctl            = hci_uart_tty_ioctl;
         hci_uart_ldisc.poll             = hci_uart_tty_poll;
-        hci_uart_ldisc.receive_room     = hci_uart_tty_room;
         hci_uart_ldisc.receive_buf      = hci_uart_tty_receive;
         hci_uart_ldisc.write_wakeup     = hci_uart_tty_wakeup;
         hci_uart_ldisc.owner            = THIS_MODULE;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 977a74e16efb..d6fcd0a36f9f 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -80,7 +80,7 @@ config SERIAL_NONSTANDARD
 
 config COMPUTONE
         tristate "Computone IntelliPort Plus serial support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD
         ---help---
           This driver supports the entire family of Intelliport II/Plus
           controllers with the exception of the MicroChannel controllers and
@@ -153,7 +153,7 @@ config DIGIEPCA
 
 config ESPSERIAL
         tristate "Hayes ESP serial port support"
-        depends on SERIAL_NONSTANDARD && ISA && BROKEN_ON_SMP && ISA_DMA_API
+        depends on SERIAL_NONSTANDARD && ISA && ISA_DMA_API
         help
           This is a driver which supports Hayes ESP serial ports.  Both single
           port cards and multiport cards are supported.  Make sure to read
@@ -166,7 +166,7 @@ config ESPSERIAL
 
 config MOXA_INTELLIO
         tristate "Moxa Intellio support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD
         help
           Say Y here if you have a Moxa Intellio multiport serial card.
 
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 10c81ecdace8..869518e4035f 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -265,8 +265,9 @@ static _INLINE_ void receive_chars(struct async_struct *info)
         int status;
         int serdatr;
         struct tty_struct *tty = info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
         struct  async_icount *icount;
+        int oe = 0;
 
         icount = &info->state->icount;
 
@@ -282,15 +283,12 @@ static _INLINE_ void receive_chars(struct async_struct *info)
             status |= UART_LSR_OE;
 
         ch = serdatr & 0xff;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-          goto ignore_char;
-        *tty->flip.char_buf_ptr = ch;
         icount->rx++;
 
 #ifdef SERIAL_DEBUG_INTR
         printk("DR%02x:%02x...", ch, status);
 #endif
-        *tty->flip.flag_buf_ptr = 0;
+        flag = TTY_NORMAL;
 
         /*
          * We don't handle parity or frame errors - but I have left
@@ -319,7 +317,7 @@ static _INLINE_ void receive_chars(struct async_struct *info)
            * should be ignored.
            */
           if (status & info->ignore_status_mask)
-            goto ignore_char;
+            goto out;
 
           status &= info->read_status_mask;
 
@@ -327,33 +325,28 @@ static _INLINE_ void receive_chars(struct async_struct *info)
 #ifdef SERIAL_DEBUG_INTR
             printk("handling break....");
 #endif
-            *tty->flip.flag_buf_ptr = TTY_BREAK;
+            flag = TTY_BREAK;
             if (info->flags & ASYNC_SAK)
               do_SAK(tty);
           } else if (status & UART_LSR_PE)
-            *tty->flip.flag_buf_ptr = TTY_PARITY;
+            flag = TTY_PARITY;
           else if (status & UART_LSR_FE)
-            *tty->flip.flag_buf_ptr = TTY_FRAME;
+            flag = TTY_FRAME;
           if (status & UART_LSR_OE) {
             /*
              * Overrun is special, since it's
              * reported immediately, and doesn't
              * affect the current character
              */
-            if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-              tty->flip.count++;
-              tty->flip.flag_buf_ptr++;
-              tty->flip.char_buf_ptr++;
-              *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-            }
+             oe = 1;
           }
         }
-        tty->flip.flag_buf_ptr++;
-        tty->flip.char_buf_ptr++;
-        tty->flip.count++;
- ignore_char:
-
+        tty_insert_flip_char(tty, ch, flag);
+        if (oe == 1)
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         tty_flip_buffer_push(tty);
+out:
+        return;
 }
 
 static _INLINE_ void transmit_chars(struct async_struct *info)
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index c8e7daecad72..39c61a71176e 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -641,6 +641,7 @@ static char rcsid[] =
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/serial.h>
 #include <linux/major.h>
 #include <linux/string.h>
@@ -1086,7 +1087,7 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
   int had_work;
   int mdm_change;
   int mdm_status;
-
+  int len;
     if((cinfo = (struct cyclades_card *)dev_id) == 0){
 #ifdef CY_DEBUG_INTERRUPTS
         printk("cyy_interrupt: spurious interrupt %d\n\r", irq);
@@ -1163,63 +1164,43 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                                 info->icount.rx++;
                                 continue;
                             }
-                            if (tty->flip.count < TTY_FLIPBUF_SIZE){
-                                tty->flip.count++;
+                            if (tty_buffer_request_room(tty, 1)) {
                                 if (data & info->read_status_mask){
                                     if(data & CyBREAK){
-                                        *tty->flip.flag_buf_ptr++ =
-                                                            TTY_BREAK;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_BREAK);
                                         info->icount.rx++;
                                         if (info->flags & ASYNC_SAK){
                                             do_SAK(tty);
                                         }
                                     }else if(data & CyFRAME){
-                                        *tty->flip.flag_buf_ptr++ =
-                                                            TTY_FRAME;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_FRAME);
                                         info->icount.rx++;
                                         info->idle_stats.frame_errs++;
                                     }else if(data & CyPARITY){
-                                        *tty->flip.flag_buf_ptr++ =
-                                                            TTY_PARITY;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
+                                        /* Pieces of seven... */
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_PARITY);
                                         info->icount.rx++;
                                         info->idle_stats.parity_errs++;
                                     }else if(data & CyOVERRUN){
-                                        *tty->flip.flag_buf_ptr++ =
-                                                            TTY_OVERRUN;
-                                        *tty->flip.char_buf_ptr++ = 0;
+                                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                                         info->icount.rx++;
                                         /* If the flip buffer itself is
                                            overflowing, we still lose
                                            the next incoming character.
                                          */
-                                        if(tty->flip.count
-                                                   < TTY_FLIPBUF_SIZE){
-                                            tty->flip.count++;
-                                            *tty->flip.flag_buf_ptr++ =
-                                                             TTY_NORMAL;
-                                           *tty->flip.char_buf_ptr++ =
-                                            cy_readb(base_addr+(CyRDSR<<index));
-                                            info->icount.rx++;
-                                        }
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_FRAME);
+                                        info->icount.rx++;
                                         info->idle_stats.overruns++;
                                     /* These two conditions may imply */
                                     /* a normal read should be done. */
                                     /* }else if(data & CyTIMEOUT){ */
                                     /* }else if(data & CySPECHAR){ */
-                                    }else{
-                                        *tty->flip.flag_buf_ptr++ = 0;
-                                        *tty->flip.char_buf_ptr++ = 0;
-                                        info->icount.rx++;
+                                    }else {
+                                        tty_insert_flip_char(tty, 0, TTY_NORMAL);
+                                        info->icount.rx++;
                                     }
                                 }else{
-                                    *tty->flip.flag_buf_ptr++ = 0;
-                                    *tty->flip.char_buf_ptr++ = 0;
+                                    tty_insert_flip_char(tty, 0, TTY_NORMAL);
                                     info->icount.rx++;
                                 }
                             }else{
@@ -1240,14 +1221,10 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                                info->mon.char_max = char_count;
                             info->mon.char_last = char_count;
 #endif
-                            while(char_count--){
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE){
-                                        break;
-                                }
-                                tty->flip.count++;
+                            len = tty_buffer_request_room(tty, char_count);
+                            while(len--){
                                 data = cy_readb(base_addr+(CyRDSR<<index));
-                                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                                *tty->flip.char_buf_ptr++ = data;
+                                tty_insert_flip_char(tty, data, TTY_NORMAL);
                                 info->idle_stats.recv_bytes++;
                                 info->icount.rx++;
 #ifdef CY_16Y_HACK
@@ -1256,7 +1233,7 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                             }
                              info->idle_stats.recv_idle = jiffies;
                         }
-                        schedule_delayed_work(&tty->flip.work, 1);
+                        schedule_delayed_work(&tty->buf.work, 1);
                     }
                     /* end of service */
                     cy_writeb(base_addr+(CyRIR<<index), (save_xir & 0x3f));
@@ -1551,6 +1528,7 @@ cyz_handle_rx(struct cyclades_port *info,
   struct cyclades_card *cinfo = &cy_card[info->card];
   struct tty_struct *tty = info->tty;
   volatile int char_count;
+  int len;
 #ifdef BLOCKMOVE
   int small_count;
 #else
@@ -1606,18 +1584,11 @@ cyz_handle_rx(struct cyclades_port *info,
                 tty->flip.count += small_count;
             }
 #else
-            while(char_count--){
-                if (tty->flip.count >= N_TTY_BUF_SIZE - tty->read_cnt)
-                    break;
-
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                    break;
-
+            len = tty_buffer_request_room(tty, char_count);
+            while(len--){
                 data = cy_readb(cinfo->base_addr + rx_bufaddr + new_rx_get);
                 new_rx_get = (new_rx_get + 1) & (rx_bufsize - 1);
-                tty->flip.count++;
-                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                *tty->flip.char_buf_ptr++ = data;
+                tty_insert_flip_char(tty, data, TTY_NORMAL);
                 info->idle_stats.recv_bytes++;
                 info->icount.rx++;
             }
@@ -1635,7 +1606,7 @@ cyz_handle_rx(struct cyclades_port *info,
             }
 #endif
             info->idle_stats.recv_idle = jiffies;
-            schedule_delayed_work(&tty->flip.work, 1);
+            schedule_delayed_work(&tty->buf.work, 1);
         }
         /* Update rx_get */
         cy_writel(&buf_ctrl->rx_get, new_rx_get);
@@ -1763,23 +1734,17 @@ cyz_handle_cmd(struct cyclades_card *cinfo)
 
         switch(cmd) {
             case C_CM_PR_ERROR:
-                tty->flip.count++;
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
-                *tty->flip.char_buf_ptr++ = 0;
+                tty_insert_flip_char(tty, 0, TTY_PARITY);
                 info->icount.rx++;
                 special_count++;
                 break;
             case C_CM_FR_ERROR:
-                tty->flip.count++;
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
-                *tty->flip.char_buf_ptr++ = 0;
+                tty_insert_flip_char(tty, 0, TTY_FRAME);
                 info->icount.rx++;
                 special_count++;
                 break;
             case C_CM_RXBRK:
-                tty->flip.count++;
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                *tty->flip.char_buf_ptr++ = 0;
+                tty_insert_flip_char(tty, 0, TTY_BREAK);
                 info->icount.rx++;
                 special_count++;
                 break;
@@ -1844,7 +1809,7 @@ cyz_handle_cmd(struct cyclades_card *cinfo)
         if(delta_count)
             cy_sched_event(info, Cy_EVENT_DELTA_WAKEUP);
         if(special_count)
-            schedule_delayed_work(&tty->flip.work, 1);
+            schedule_delayed_work(&tty->buf.work, 1);
     }
 }
 
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 407708a001e4..765c5c108bf4 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -1786,9 +1786,7 @@ static void doevent(int crd)
                 if (tty)  { /* Begin if valid tty */
                         if (event & BREAK_IND)  { /* Begin if BREAK_IND */
                                 /* A break has been indicated */
-                                tty->flip.count++;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                *tty->flip.char_buf_ptr++ = 0;
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
                                 tty_schedule_flip(tty); 
                         } else if (event & LOWTX_IND)  { /* Begin LOWTX_IND */
                                 if (ch->statusflags & LOWWAIT) 
@@ -2124,7 +2122,6 @@ static void receive_data(struct channel *ch)
         int dataToRead, wrapgap, bytesAvailable;
         unsigned int tail, head;
         unsigned int wrapmask;
-        int rc;
 
         /* ---------------------------------------------------------------
                 This routine is called by doint when a receive data event 
@@ -2162,16 +2159,15 @@ static void receive_data(struct channel *ch)
                 return;
         }
 
-        if (tty->flip.count == TTY_FLIPBUF_SIZE) 
+        if (tty_buffer_request_room(tty, bytesAvailable + 1) == 0)
                 return;
 
         if (readb(&bc->orun)) {
                 writeb(0, &bc->orun);
                 printk(KERN_WARNING "epca; overrun! DigiBoard device %s\n",tty->name);
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         }
         rxwinon(ch);
-        rptr = tty->flip.char_buf_ptr;
-        rc = tty->flip.count;
         while (bytesAvailable > 0)  { /* Begin while there is data on the card */
                 wrapgap = (head >= tail) ? head - tail : ch->rxbufsize - tail;
                 /* ---------------------------------------------------------------
@@ -2183,8 +2179,7 @@ static void receive_data(struct channel *ch)
                 /* --------------------------------------------------------------
                    Make sure we don't overflow the buffer
                 ----------------------------------------------------------------- */
-                if ((rc + dataToRead) > TTY_FLIPBUF_SIZE)
-                        dataToRead = TTY_FLIPBUF_SIZE - rc;
+                dataToRead = tty_prepare_flip_string(tty, &rptr, dataToRead);
                 if (dataToRead == 0)
                         break;
                 /* ---------------------------------------------------------------
@@ -2192,13 +2187,9 @@ static void receive_data(struct channel *ch)
                         for translation if necessary.
                 ------------------------------------------------------------------ */
                 memcpy_fromio(rptr, ch->rxptr + tail, dataToRead);
-                rc   += dataToRead;
-                rptr += dataToRead;
                 tail = (tail + dataToRead) & wrapmask;
                 bytesAvailable -= dataToRead;
         } /* End while there is data on the card */
-        tty->flip.count = rc;
-        tty->flip.char_buf_ptr = rptr;
         globalwinon(ch);
         writew(tail, &bc->rout);
         /* Must be called with global data */
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
index 9f53d2fcc360..e469f641c728 100644
--- a/drivers/char/esp.c
+++ b/drivers/char/esp.c
@@ -345,26 +345,22 @@ static inline void receive_chars_pio(struct esp_struct *info, int num_bytes)
 
         for (i = 0; i < num_bytes; i++) {
                 if (!(err_buf->data[i] & status_mask)) {
-                        *(tty->flip.char_buf_ptr++) = pio_buf->data[i];
+                        int flag = 0;
 
                         if (err_buf->data[i] & 0x04) {
-                                *(tty->flip.flag_buf_ptr++) = TTY_BREAK;
-
+                                flag = TTY_BREAK;
                                 if (info->flags & ASYNC_SAK)
                                         do_SAK(tty);
                         }
                         else if (err_buf->data[i] & 0x02)
-                                *(tty->flip.flag_buf_ptr++) = TTY_FRAME;
+                                flag = TTY_FRAME;
                         else if (err_buf->data[i] & 0x01)
-                                *(tty->flip.flag_buf_ptr++) = TTY_PARITY;
-                        else
-                                *(tty->flip.flag_buf_ptr++) = 0;
-                
-                        tty->flip.count++;
+                                flag = TTY_PARITY;
+                        tty_insert_flip_char(tty, pio_buf->data[i], flag);
                 }
         }
 
-        schedule_delayed_work(&tty->flip.work, 1);
+        schedule_delayed_work(&tty->buf.work, 1);
 
         info->stat_flags &= ~ESP_STAT_RX_TIMEOUT;
         release_pio_buffer(pio_buf);
@@ -397,7 +393,6 @@ static inline void receive_chars_dma_done(struct esp_struct *info,
         int num_bytes;
         unsigned long flags;
         
-        
         flags=claim_dma_lock();
         disable_dma(dma);
         clear_dma_ff(dma);
@@ -408,38 +403,31 @@ static inline void receive_chars_dma_done(struct esp_struct *info,
         
         info->icount.rx += num_bytes;
 
-        memcpy(tty->flip.char_buf_ptr, dma_buffer, num_bytes);
-        tty->flip.char_buf_ptr += num_bytes;
-        tty->flip.count += num_bytes;
-        memset(tty->flip.flag_buf_ptr, 0, num_bytes);
-        tty->flip.flag_buf_ptr += num_bytes;
-
         if (num_bytes > 0) {
-                tty->flip.flag_buf_ptr--;
+                tty_insert_flip_string(tty, dma_buffer, num_bytes - 1);
 
                 status &= (0x1c & info->read_status_mask);
+                
+                /* Is the status significant or do we throw the last byte ? */
+                if (!(status & info->ignore_status_mask)) {
+                        int statflag = 0;
 
-                if (status & info->ignore_status_mask) {
-                        tty->flip.count--;
-                        tty->flip.char_buf_ptr--;
-                        tty->flip.flag_buf_ptr--;
-                } else if (status & 0x10) {
-                        *tty->flip.flag_buf_ptr = TTY_BREAK;
-                        (info->icount.brk)++;
-                        if (info->flags & ASYNC_SAK)
-                                do_SAK(tty);
-                } else if (status & 0x08) {
-                        *tty->flip.flag_buf_ptr = TTY_FRAME;
-                        (info->icount.frame)++;
-                }
-                else if (status & 0x04) {
-                        *tty->flip.flag_buf_ptr = TTY_PARITY;
-                        (info->icount.parity)++;
+                        if (status & 0x10) {
+                                statflag = TTY_BREAK;
+                                (info->icount.brk)++;
+                                if (info->flags & ASYNC_SAK)
+                                        do_SAK(tty);
+                        } else if (status & 0x08) {
+                                statflag = TTY_FRAME;
+                                (info->icount.frame)++;
+                        }
+                        else if (status & 0x04) {
+                                statflag = TTY_PARITY;
+                                (info->icount.parity)++;
+                        }
+                        tty_insert_flip_char(tty, dma_buffer[num_bytes - 1], statflag);
                 }
-
-                tty->flip.flag_buf_ptr++;
-                
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
         }
 
         if (dma_bytes != num_bytes) {
@@ -693,8 +681,7 @@ static irqreturn_t rs_interrupt_single(int irq, void *dev_id,
                 num_bytes = serial_in(info, UART_ESI_STAT1) << 8;
                 num_bytes |= serial_in(info, UART_ESI_STAT2);
 
-                if (num_bytes > (TTY_FLIPBUF_SIZE - info->tty->flip.count))
-                  num_bytes = TTY_FLIPBUF_SIZE - info->tty->flip.count;
+                num_bytes = tty_buffer_request_room(info->tty, num_bytes);
 
                 if (num_bytes) {
                         if (dma_bytes ||
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index f92177634677..1994a92d4733 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -597,9 +597,7 @@ static int hvc_poll(struct hvc_struct *hp)
 
         /* Read data if any */
         for (;;) {
-                int count = N_INBUF;
-                if (count > (TTY_FLIPBUF_SIZE - tty->flip.count))
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
+                int count = tty_buffer_request_room(tty, N_INBUF);
 
                 /* If flip is full, just reschedule a later read */
                 if (count == 0) {
@@ -635,7 +633,7 @@ static int hvc_poll(struct hvc_struct *hp)
                         tty_insert_flip_char(tty, buf[i], 0);
                 }
 
-                if (tty->flip.count)
+                if (count)
                         tty_schedule_flip(tty);
 
                 /*
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 53dc77c760fc..831eb4e8d9d3 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -456,12 +456,11 @@ static int hvcs_io(struct hvcs_struct *hvcsd)
         /* remove the read masks */
         hvcsd->todo_mask &= ~(HVCS_READ_MASK);
 
-        if ((tty->flip.count + HVCS_BUFF_LEN) < TTY_FLIPBUF_SIZE) {
+        if (tty_buffer_request_room(tty, HVCS_BUFF_LEN) >= HVCS_BUFF_LEN) {
                 got = hvc_get_chars(unit_address,
                                 &buf[0],
                                 HVCS_BUFF_LEN);
-                for (i=0;got && i<got;i++)
-                        tty_insert_flip_char(tty, buf[i], TTY_NORMAL);
+                tty_insert_flip_string(tty, buf, got);
         }
 
         /* Give the TTY time to process the data we just sent. */
@@ -469,10 +468,9 @@ static int hvcs_io(struct hvcs_struct *hvcsd)
                 hvcsd->todo_mask |= HVCS_QUICK_READ;
 
         spin_unlock_irqrestore(&hvcsd->lock, flags);
-        if (tty->flip.count) {
-                /* This is synch because tty->low_latency == 1 */
+        /* This is synch because tty->low_latency == 1 */
+        if(got)
                 tty_flip_buffer_push(tty);
-        }
 
         if (!got) {
                 /* Do this _after_ the flip_buffer_push */
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 1bbf507adda5..86033bed5d6c 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -115,6 +115,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/termios.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
@@ -773,6 +774,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
         unsigned short base, header, word_count, count;
         unsigned char channel;
         short byte_count;
+        unsigned char *rp;
         
         card = (struct isi_board *) dev_id;
 
@@ -903,14 +905,10 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                                 break;
                                 
                         case 1: /* Received Break !!!    */
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                        break;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                *tty->flip.char_buf_ptr++ = 0;
-                                tty->flip.count++;
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
                                 if (port->flags & ASYNC_SAK)
                                         do_SAK(tty);
-                                schedule_delayed_work(&tty->flip.work, 1);
+                                tty_flip_buffer_push(tty);
                                 break;
                                 
                         case 2: /* Statistics            */
@@ -923,23 +921,19 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                 }        
         }
         else {                          /* Data   Packet */
-                count = min_t(unsigned short, byte_count, (TTY_FLIPBUF_SIZE - tty->flip.count));
+
+                count = tty_prepare_flip_string(tty, &rp, byte_count & ~1);
 #ifdef ISICOM_DEBUG
                 printk(KERN_DEBUG "ISICOM: Intr: Can rx %d of %d bytes.\n", 
                                         count, byte_count);
 #endif                  
                 word_count = count >> 1;
-                insw(base, tty->flip.char_buf_ptr, word_count);
-                tty->flip.char_buf_ptr += (word_count << 1);            
+                insw(base, rp, word_count);
                 byte_count -= (word_count << 1);
                 if (count & 0x0001) {
-                        *tty->flip.char_buf_ptr++ = (char)(inw(base) & 0xff);
+                        tty_insert_flip_char(tty,  inw(base) & 0xff, TTY_NORMAL);
                         byte_count -= 2;
                 }       
-                memset(tty->flip.flag_buf_ptr, 0, count);
-                tty->flip.flag_buf_ptr += count;
-                tty->flip.count += count;
-                
                 if (byte_count > 0) {
                         printk(KERN_DEBUG "ISICOM: Intr(0x%x:%d): Flip buffer overflow! dropping bytes...\n",
                                         base, channel+1);
@@ -948,7 +942,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                                 byte_count -= 2;
                         }
                 }
-                schedule_delayed_work(&tty->flip.work, 1);
+                tty_flip_buffer_push(tty);
         }
         if (card->isa == YES)
                 ClearInterrupt(base);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 24435f8daa68..28c5a3193b81 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -2711,17 +2711,13 @@ static void stli_read(stlibrd_t *brdp, stliport_t *portp)
                 stlen = size - tail;
         }
 
-        len = MIN(len, (TTY_FLIPBUF_SIZE - tty->flip.count));
+        len = tty_buffer_request_room(tty, len);
+        /* FIXME : iomap ? */
         shbuf = (volatile char *) EBRDGETMEMPTR(brdp, portp->rxoffset);
 
         while (len > 0) {
                 stlen = MIN(len, stlen);
-                memcpy(tty->flip.char_buf_ptr, (char *) (shbuf + tail), stlen);
-                memset(tty->flip.flag_buf_ptr, 0, stlen);
-                tty->flip.char_buf_ptr += stlen;
-                tty->flip.flag_buf_ptr += stlen;
-                tty->flip.count += stlen;
-
+                tty_insert_flip_string(tty, (char *)(shbuf + tail), stlen);
                 len -= stlen;
                 tail += stlen;
                 if (tail >= size) {
@@ -2906,16 +2902,12 @@ static int stli_hostcmd(stlibrd_t *brdp, stliport_t *portp)
 
                 if ((nt.data & DT_RXBREAK) && (portp->rxmarkmsk & BRKINT)) {
                         if (tty != (struct tty_struct *) NULL) {
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                        *tty->flip.char_buf_ptr++ = 0;
-                                        if (portp->flags & ASYNC_SAK) {
-                                                do_SAK(tty);
-                                                EBRDENABLE(brdp);
-                                        }
-                                        tty_schedule_flip(tty);
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
+                                if (portp->flags & ASYNC_SAK) {
+                                        do_SAK(tty);
+                                        EBRDENABLE(brdp);
                                 }
+                                tty_schedule_flip(tty);
                         }
                 }
 
@@ -4940,7 +4932,7 @@ static int stli_portcmdstats(stliport_t *portp)
         if (portp->tty != (struct tty_struct *) NULL) {
                 if (portp->tty->driver_data == portp) {
                         stli_comstats.ttystate = portp->tty->flags;
-                        stli_comstats.rxbuffered = portp->tty->flip.count;
+                        stli_comstats.rxbuffered = -1 /*portp->tty->flip.count*/;
                         if (portp->tty->termios != (struct termios *) NULL) {
                                 stli_comstats.cflags = portp->tty->termios->c_cflag;
                                 stli_comstats.iflags = portp->tty->termios->c_iflag;
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 46a3a8ccd65f..5e3ef5522194 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -269,7 +269,7 @@ static int MoxaPortDCDChange(int);
 static int MoxaPortDCDON(int);
 static void MoxaPortFlushData(int, int);
 static int MoxaPortWriteData(int, unsigned char *, int);
-static int MoxaPortReadData(int, unsigned char *, int);
+static int MoxaPortReadData(int, struct tty_struct *tty);
 static int MoxaPortTxQueue(int);
 static int MoxaPortRxQueue(int);
 static int MoxaPortTxFree(int);
@@ -301,6 +301,8 @@ static struct tty_operations moxa_ops = {
         .tiocmset = moxa_tiocmset,
 };
 
+static spinlock_t moxa_lock = SPIN_LOCK_UNLOCKED;
+
 #ifdef CONFIG_PCI
 static int moxa_get_PCI_conf(struct pci_dev *p, int board_type, moxa_board_conf * board)
 {
@@ -645,10 +647,10 @@ static int moxa_write(struct tty_struct *tty,
         if (ch == NULL)
                 return (0);
         port = ch->port;
-        save_flags(flags);
-        cli();
+
+        spin_lock_irqsave(&moxa_lock, flags);
         len = MoxaPortWriteData(port, (unsigned char *) buf, count);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
 
         /*********************************************
         if ( !(ch->statusflags & LOWWAIT) &&
@@ -723,11 +725,10 @@ static void moxa_put_char(struct tty_struct *tty, unsigned char c)
         if (ch == NULL)
                 return;
         port = ch->port;
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&moxa_lock, flags);
         moxaXmitBuff[0] = c;
         MoxaPortWriteData(port, moxaXmitBuff, 1);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
         /************************************************
         if ( !(ch->statusflags & LOWWAIT) && (MoxaPortTxFree(port) <= 100) )
         *************************************************/
@@ -1030,12 +1031,12 @@ static int block_till_ready(struct tty_struct *tty, struct file *filp,
         printk("block_til_ready before block: ttys%d, count = %d\n",
                ch->line, ch->count);
 #endif
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&moxa_lock, flags);
         if (!tty_hung_up_p(filp))
                 ch->count--;
-        restore_flags(flags);
         ch->blocked_open++;
+        spin_unlock_irqrestore(&moxa_lock, flags);
+
         while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (tty_hung_up_p(filp) ||
@@ -1062,17 +1063,21 @@ static int block_till_ready(struct tty_struct *tty, struct file *filp,
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&ch->open_wait, &wait);
+
+        spin_lock_irqsave(&moxa_lock, flags);
         if (!tty_hung_up_p(filp))
                 ch->count++;
         ch->blocked_open--;
+        spin_unlock_irqrestore(&moxa_lock, flags);
 #ifdef SERIAL_DEBUG_OPEN
         printk("block_til_ready after blocking: ttys%d, count = %d\n",
                ch->line, ch->count);
 #endif
         if (retval)
                 return (retval);
+        /* FIXME: review to see if we need to use set_bit on these */
         ch->asyncflags |= ASYNC_NORMAL_ACTIVE;
-        return (0);
+        return 0;
 }
 
 static void setup_empty_event(struct tty_struct *tty)
@@ -1080,15 +1085,14 @@ static void setup_empty_event(struct tty_struct *tty)
         struct moxa_str *ch = tty->driver_data;
         unsigned long flags;
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&moxa_lock, flags);
         ch->statusflags |= EMPTYWAIT;
         moxaEmptyTimer_on[ch->port] = 0;
         del_timer(&moxaEmptyTimer[ch->port]);
         moxaEmptyTimer[ch->port].expires = jiffies + HZ;
         moxaEmptyTimer_on[ch->port] = 1;
         add_timer(&moxaEmptyTimer[ch->port]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
 }
 
 static void check_xmit_empty(unsigned long data)
@@ -1135,8 +1139,6 @@ static void receive_data(struct moxa_str *ch)
 {
         struct tty_struct *tp;
         struct termios *ts;
-        int i, count, rc, space;
-        unsigned char *charptr, *flagptr;
         unsigned long flags;
 
         ts = NULL;
@@ -1150,24 +1152,10 @@ static void receive_data(struct moxa_str *ch)
                 MoxaPortFlushData(ch->port, 0);
                 return;
         }
-        space = TTY_FLIPBUF_SIZE - tp->flip.count;
-        if (space <= 0)
-                return;
-        charptr = tp->flip.char_buf_ptr;
-        flagptr = tp->flip.flag_buf_ptr;
-        rc = tp->flip.count;
-        save_flags(flags);
-        cli();
-        count = MoxaPortReadData(ch->port, charptr, space);
-        restore_flags(flags);
-        for (i = 0; i < count; i++)
-                *flagptr++ = 0;
-        charptr += count;
-        rc += count;
-        tp->flip.count = rc;
-        tp->flip.char_buf_ptr = charptr;
-        tp->flip.flag_buf_ptr = flagptr;
-        tty_schedule_flip(ch->tty);
+        spin_lock_irqsave(&moxa_lock, flags);
+        MoxaPortReadData(ch->port, tp);
+        spin_unlock_irqrestore(&moxa_lock, flags);
+        tty_schedule_flip(tp);
 }
 
 #define Magic_code      0x404
@@ -1774,7 +1762,7 @@ int MoxaPortsOfCard(int cardno)
  *      14. MoxaPortDCDON(int port);                                         *
  *      15. MoxaPortFlushData(int port, int mode);                           *
  *      16. MoxaPortWriteData(int port, unsigned char * buffer, int length); *
- *      17. MoxaPortReadData(int port, unsigned char * buffer, int length);  *
+ *      17. MoxaPortReadData(int port, struct tty_struct *tty);              *
  *      18. MoxaPortTxBufSize(int port);                                     *
  *      19. MoxaPortRxBufSize(int port);                                     *
  *      20. MoxaPortTxQueue(int port);                                       *
@@ -2003,10 +1991,9 @@ int MoxaPortsOfCard(int cardno)
  *
  *      Function 21:    Read data.
  *      Syntax:
- *      int  MoxaPortReadData(int port, unsigned char * buffer, int length);
+ *      int  MoxaPortReadData(int port, struct tty_struct *tty);
  *           int port           : port number (0 - 127)
- *           unsigned char * buffer     : pointer to read data buffer.
- *           int length         : read data buffer length
+ *           struct tty_struct *tty : tty for data
  *
  *           return:    0 - length      : real read data length
  *
@@ -2504,7 +2491,7 @@ int MoxaPortWriteData(int port, unsigned char * buffer, int len)
         return (total);
 }
 
-int MoxaPortReadData(int port, unsigned char * buffer, int space)
+int MoxaPortReadData(int port, struct tty_struct *tty)
 {
         register ushort head, pageofs;
         int i, count, cnt, len, total, remain;
@@ -2522,9 +2509,9 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
         count = (tail >= head) ? (tail - head)
             : (tail - head + rx_mask + 1);
         if (count == 0)
-                return (0);
+                return 0;
 
-        total = (space > count) ? count : space;
+        total = count;
         remain = count - total;
         moxaLog.rxcnt[port] += total;
         count = total;
@@ -2539,7 +2526,7 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
                         len = (count > len) ? len : count;
                         ofs = baseAddr + DynPage_addr + bufhead + head;
                         for (i = 0; i < len; i++)
-                                *buffer++ = readb(ofs + i);
+                                tty_insert_flip_char(tty, readb(ofs + i), TTY_NORMAL);
                         head = (head + len) & rx_mask;
                         count -= len;
                 }
@@ -2556,7 +2543,7 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
                         writew(pageno, baseAddr + Control_reg);
                         ofs = baseAddr + DynPage_addr + pageofs;
                         for (i = 0; i < cnt; i++)
-                                *buffer++ = readb(ofs + i);
+                                tty_insert_flip_char(tty, readb(ofs + i), TTY_NORMAL);
                         if (count == 0) {
                                 writew((head + len) & rx_mask, ofsAddr + RXrptr);
                                 break;
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 51bb2a3cf8b3..ea725a9964e2 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1982,7 +1982,7 @@ static void mxser_receive_chars(struct mxser_struct *info, int *status)
 
         spin_lock_irqsave(&info->slock, flags);
 
-        recv_room = tty->ldisc.receive_room(tty);
+        recv_room = tty->receive_room;
         if ((recv_room == 0) && (!info->ldisc_stop_rx)) {
                 //mxser_throttle(tty);
                 mxser_stoprx(tty);
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index a133a62f3d55..70f487dd7b8d 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -212,7 +212,6 @@ static struct tty_ldisc n_hdlc_ldisc = {
         .ioctl          = n_hdlc_tty_ioctl,
         .poll           = n_hdlc_tty_poll,
         .receive_buf    = n_hdlc_tty_receive,
-        .receive_room   = n_hdlc_tty_room,
         .write_wakeup   = n_hdlc_tty_wakeup,
 };
 
@@ -337,6 +336,7 @@ static int n_hdlc_tty_open (struct tty_struct *tty)
                 
         tty->disc_data = n_hdlc;
         n_hdlc->tty    = tty;
+        tty->receive_room = 65536;
         
 #if defined(TTY_NO_WRITE_SPLIT)
         /* change tty_io write() to not split large writes into 8K chunks */
@@ -478,22 +478,6 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty)
 }       /* end of n_hdlc_tty_wakeup() */
 
 /**
- * n_hdlc_tty_room - Return the amount of space left in the receiver's buffer
- * @tty - pointer to associated tty instance data
- *
- * Callback function from tty driver. Return the amount of space left in the
- * receiver's buffer to decide if remote transmitter is to be throttled.
- */
-static int n_hdlc_tty_room(struct tty_struct *tty)
-{
-        if (debuglevel >= DEBUG_LEVEL_INFO)     
-                printk("%s(%d)n_hdlc_tty_room() called\n",__FILE__,__LINE__);
-        /* always return a larger number to prevent */
-        /* throttling of remote transmitter. */
-        return 65536;
-}       /* end of n_hdlc_tty_root() */
-
-/**
  * n_hdlc_tty_receive - Called by tty driver when receive data is available
  * @tty - pointer to tty instance data
  * @data - pointer to received data
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 853c98cee64f..c48de09d68f0 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -147,7 +147,6 @@ static unsigned int r3964_poll(struct tty_struct * tty, struct file * file,
                       struct poll_table_struct  *wait);
 static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                               char *fp, int count);
-static int  r3964_receive_room(struct tty_struct *tty);
 
 static struct tty_ldisc tty_ldisc_N_R3964 = {
         .owner   = THIS_MODULE,
@@ -161,7 +160,6 @@ static struct tty_ldisc tty_ldisc_N_R3964 = {
         .set_termios = r3964_set_termios,
         .poll   = r3964_poll,            
         .receive_buf = r3964_receive_buf,
-        .receive_room = r3964_receive_room,
 };
 
 
@@ -1119,6 +1117,7 @@ static int r3964_open(struct tty_struct *tty)
    pInfo->nRetry = 0;
    
    tty->disc_data = pInfo;
+   tty->receive_room = 65536;
 
    init_timer(&pInfo->tmr);
    pInfo->tmr.data = (unsigned long)pInfo;
@@ -1405,12 +1404,5 @@ static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
     }
 }
 
-static int r3964_receive_room(struct tty_struct *tty)
-{
-   TRACE_L("receive_room");
-   return -1;
-}
-
-
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_LDISC(N_R3964);
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index c556f4d3ccd7..ccad7ae94541 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -78,7 +78,32 @@ static inline void free_buf(unsigned char *buf)
                 free_page((unsigned long) buf);
 }
 
-static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
+/**
+ *      n_tty_set__room -       receive space
+ *      @tty: terminal
+ *
+ *      Called by the driver to find out how much data it is
+ *      permitted to feed to the line discipline without any being lost
+ *      and thus to manage flow control. Not serialized. Answers for the
+ *      "instant".
+ */
+
+static void n_tty_set_room(struct tty_struct *tty)
+{
+        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
+
+        /*
+         * If we are doing input canonicalization, and there are no
+         * pending newlines, let characters through without limit, so
+         * that erase characters will be handled.  Other excess
+         * characters will be beeped.
+         */
+        if (left <= 0)
+                left = tty->icanon && !tty->canon_data;
+        tty->receive_room = left;
+}
+
+static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
 {
         if (tty->read_cnt < N_TTY_BUF_SIZE) {
                 tty->read_buf[tty->read_head] = c;
@@ -87,7 +112,7 @@ static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
         }
 }
 
-static inline void put_tty_queue(unsigned char c, struct tty_struct *tty)
+static void put_tty_queue(unsigned char c, struct tty_struct *tty)
 {
         unsigned long flags;
         /*
@@ -136,6 +161,7 @@ static void reset_buffer_flags(struct tty_struct *tty)
         spin_unlock_irqrestore(&tty->read_lock, flags);
         tty->canon_head = tty->canon_data = tty->erasing = 0;
         memset(&tty->read_flags, 0, sizeof tty->read_flags);
+        n_tty_set_room(tty);
         check_unthrottle(tty);
 }
 
@@ -838,30 +864,6 @@ send_signal:
         put_tty_queue(c, tty);
 }       
 
-/**
- *      n_tty_receive_room      -       receive space
- *      @tty: terminal
- *
- *      Called by the driver to find out how much data it is
- *      permitted to feed to the line discipline without any being lost
- *      and thus to manage flow control. Not serialized. Answers for the
- *      "instant".
- */
- 
-static int n_tty_receive_room(struct tty_struct *tty)
-{
-        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
-
-        /*
-         * If we are doing input canonicalization, and there are no
-         * pending newlines, let characters through without limit, so
-         * that erase characters will be handled.  Other excess
-         * characters will be beeped.
-         */
-        if (left <= 0)
-                left = tty->icanon && !tty->canon_data;
-        return left;
-}
 
 /**
  *      n_tty_write_wakeup      -       asynchronous I/O notifier
@@ -953,6 +955,8 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                         tty->driver->flush_chars(tty);
         }
 
+        n_tty_set_room(tty);
+
         if (!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) {
                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
                 if (waitqueue_active(&tty->read_wait))
@@ -964,7 +968,7 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
          * mode.  We don't want to throttle the driver if we're in
          * canonical mode and don't have a newline yet!
          */
-        if (n_tty_receive_room(tty) < TTY_THRESHOLD_THROTTLE) {
+        if (tty->receive_room < TTY_THRESHOLD_THROTTLE) {
                 /* check TTY_THROTTLED first so it indicates our state */
                 if (!test_and_set_bit(TTY_THROTTLED, &tty->flags) &&
                     tty->driver->throttle)
@@ -999,6 +1003,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
         if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
                 tty->raw = 1;
                 tty->real_raw = 1;
+                n_tty_set_room(tty);
                 return;
         }
         if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
@@ -1051,6 +1056,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
                 else
                         tty->real_raw = 0;
         }
+        n_tty_set_room(tty);
 }
 
 /**
@@ -1130,7 +1136,7 @@ static inline int input_available_p(struct tty_struct *tty, int amt)
  *
  */
  
-static inline int copy_from_read_buf(struct tty_struct *tty,
+static int copy_from_read_buf(struct tty_struct *tty,
                                       unsigned char __user **b,
                                       size_t *nr)
 
@@ -1308,6 +1314,7 @@ do_it_again:
                                 retval = -ERESTARTSYS;
                                 break;
                         }
+                        n_tty_set_room(tty);
                         clear_bit(TTY_DONT_FLIP, &tty->flags);
                         timeout = schedule_timeout(timeout);
                         set_bit(TTY_DONT_FLIP, &tty->flags);
@@ -1401,6 +1408,8 @@ do_it_again:
         } else if (test_and_clear_bit(TTY_PUSH, &tty->flags))
                  goto do_it_again;
 
+        n_tty_set_room(tty);
+
         return retval;
 }
 
@@ -1553,7 +1562,6 @@ struct tty_ldisc tty_ldisc_N_TTY = {
         normal_poll,            /* poll */
         NULL,                   /* hangup */
         n_tty_receive_buf,      /* receive_buf */
-        n_tty_receive_room,     /* receive_room */
         n_tty_write_wakeup      /* write_wakeup */
 };
 
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 9fb10c9fec88..8a8ca32822ba 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1007,8 +1007,9 @@ static void rx_ready_hdlc(MGSLPC_INFO *info, int eom)
 
 static void rx_ready_async(MGSLPC_INFO *info, int tcd)
 {
-        unsigned char data, status;
+        unsigned char data, status, flag;
         int fifo_count;
+        int work = 0;
         struct tty_struct *tty = info->tty;
         struct mgsl_icount *icount = &info->icount;
 
@@ -1023,20 +1024,16 @@ static void rx_ready_async(MGSLPC_INFO *info, int tcd)
                         fifo_count = 32;
         } else
                 fifo_count = 32;
-        
+
+        tty_buffer_request_room(tty, fifo_count);
         /* Flush received async data to receive data buffer. */ 
         while (fifo_count) {
                 data   = read_reg(info, CHA + RXFIFO);
                 status = read_reg(info, CHA + RXFIFO);
                 fifo_count -= 2;
 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-                        
-                *tty->flip.char_buf_ptr = data;
                 icount->rx++;
-                
-                *tty->flip.flag_buf_ptr = 0;
+                flag = TTY_NORMAL;
 
                 // if no frameing/crc error then save data
                 // BIT7:parity error
@@ -1055,26 +1052,23 @@ static void rx_ready_async(MGSLPC_INFO *info, int tcd)
                         status &= info->read_status_mask;
 
                         if (status & BIT7)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (status & BIT6)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
-                
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
+                work += tty_insert_flip_char(tty, data, flag);
         }
         issue_command(info, CHA, CMD_RXFIFO);
 
         if (debug_level >= DEBUG_LEVEL_ISR) {
-                printk("%s(%d):rx_ready_async count=%d\n",
-                        __FILE__,__LINE__,tty->flip.count);
+                printk("%s(%d):rx_ready_async",
+                        __FILE__,__LINE__);
                 printk("%s(%d):rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                         __FILE__,__LINE__,icount->rx,icount->brk,
                         icount->parity,icount->frame,icount->overrun);
         }
                         
-        if (tty->flip.count)
+        if (work)
                 tty_flip_buffer_push(tty);
 }
 
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 49f3997fd251..9b5a2c0e7008 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -111,7 +111,7 @@ static int pty_write(struct tty_struct * tty, const unsigned char *buf, int coun
         if (!to || tty->stopped)
                 return 0;
 
-        c = to->ldisc.receive_room(to);
+        c = to->receive_room;
         if (c > count)
                 c = count;
         to->ldisc.receive_buf(to, buf, NULL, c);
@@ -126,7 +126,7 @@ static int pty_write_room(struct tty_struct *tty)
         if (!to || tty->stopped)
                 return 0;
 
-        return to->ldisc.receive_room(to);
+        return to->receive_room;
 }
 
 /*
diff --git a/drivers/char/rio/riointr.c b/drivers/char/rio/riointr.c
index e42e7b50bf6b..ddda9c14e059 100644
--- a/drivers/char/rio/riointr.c
+++ b/drivers/char/rio/riointr.c
@@ -38,6 +38,7 @@ static char *_riointr_c_sccs_ = "@(#)riointr.c	1.2";
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <asm/io.h>
 #include <asm/system.h>
 #include <asm/string.h>
@@ -560,6 +561,7 @@ struct Port *		PortP;
   struct PKT *PacketP;
   register uint DataCnt;
   uchar *       ptr;
+  unsigned char *buf;
   int copied =0;
 
   static int intCount, RxIntCnt;
@@ -657,8 +659,7 @@ struct Port *		PortP;
           ** and available space.
           */
                         
-          transCount = min_t(unsigned int, PacketP->len & PKT_LEN_MASK,
-                           TTY_FLIPBUF_SIZE - TtyP->flip.count);
+          transCount = tty_buffer_request_room(TtyP, PacketP->len & PKT_LEN_MASK);
           rio_dprintk (RIO_DEBUG_REC,  "port %d: Copy %d bytes\n", 
                                       PortP->PortNum, transCount);
           /*
@@ -678,9 +679,8 @@ struct Port *		PortP;
 #endif
           ptr = (uchar *) PacketP->data + PortP->RxDataStart;
 
-          rio_memcpy_fromio (TtyP->flip.char_buf_ptr, ptr, transCount);
-          memset(TtyP->flip.flag_buf_ptr, TTY_NORMAL, transCount);
-
+          tty_prepare_flip_string(TtyP, &buf, transCount);
+          rio_memcpy_fromio (buf, ptr, transCount);
 #ifdef STATS
           /*
           ** keep a count for statistical purposes
@@ -690,9 +690,6 @@ struct Port *		PortP;
           PortP->RxDataStart    += transCount;
           PacketP->len          -= transCount;
           copied += transCount;
-          TtyP->flip.count += transCount;
-          TtyP->flip.char_buf_ptr += transCount;
-          TtyP->flip.flag_buf_ptr += transCount;
 
 
 #ifdef ___DEBUG_IT___
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 5dae32521620..050e70ee5920 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -46,6 +46,7 @@
 #include <linux/major.h>
 #include <linux/init.h>
 #include <linux/delay.h>
+#include <linux/tty_flip.h>
 
 #include <asm/uaccess.h>
 
@@ -354,28 +355,17 @@ static inline void rc_receive_exc(struct riscom_board const * bp)
         struct riscom_port *port;
         struct tty_struct *tty;
         unsigned char status;
-        unsigned char ch;
+        unsigned char ch, flag;
         
         if (!(port = rc_get_port(bp, "Receive")))
                 return;
 
         tty = port->tty;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)  {
-                printk(KERN_WARNING "rc%d: port %d: Working around flip "
-                                    "buffer overflow.\n",
-                       board_No(bp), port_No(port));
-                return;
-        }
         
 #ifdef RC_REPORT_OVERRUN        
         status = rc_in(bp, CD180_RCSR);
-        if (status & RCSR_OE)  {
+        if (status & RCSR_OE)
                 port->overrun++;
-#if 0           
-                printk(KERN_ERR "rc%d: port %d: Overrun. Total %ld overruns\n", 
-                       board_No(bp), port_No(port), port->overrun);
-#endif          
-        }
         status &= port->mark_mask;
 #else   
         status = rc_in(bp, CD180_RCSR) & port->mark_mask;
@@ -393,25 +383,24 @@ static inline void rc_receive_exc(struct riscom_board const * bp)
         } else if (status & RCSR_BREAK)  {
                 printk(KERN_INFO "rc%d: port %d: Handling break...\n",
                        board_No(bp), port_No(port));
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                flag = TTY_BREAK;
                 if (port->flags & ASYNC_SAK)
                         do_SAK(tty);
                 
         } else if (status & RCSR_PE) 
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                flag = TTY_PARITY;
         
         else if (status & RCSR_FE) 
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                flag = TTY_FRAME;
         
         else if (status & RCSR_OE)
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                flag = TTY_OVERRUN;
         
         else
-                *tty->flip.flag_buf_ptr++ = 0;
+                flag = TTY_NORMAL;
         
-        *tty->flip.char_buf_ptr++ = ch;
-        tty->flip.count++;
-        schedule_delayed_work(&tty->flip.work, 1);
+        tty_insert_flip_char(tty, ch, flag);
+        tty_flip_buffer_push(tty);
 }
 
 static inline void rc_receive(struct riscom_board const * bp)
@@ -432,17 +421,15 @@ static inline void rc_receive(struct riscom_board const * bp)
 #endif  
         
         while (count--)  {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)  {
+                if (tty_buffer_request_room(tty, 1) == 0)  {
                         printk(KERN_WARNING "rc%d: port %d: Working around "
                                             "flip buffer overflow.\n",
                                board_No(bp), port_No(port));
                         break;
                 }
-                *tty->flip.char_buf_ptr++ = rc_in(bp, CD180_RDR);
-                *tty->flip.flag_buf_ptr++ = 0;
-                tty->flip.count++;
+                tty_insert_flip_char(tty, rc_in(bp, CD180_RDR), TTY_NORMAL);
         }
-        schedule_delayed_work(&tty->flip.work, 1);
+        tty_flip_buffer_push(tty);
 }
 
 static inline void rc_transmit(struct riscom_board const * bp)
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index d3bc731fbb27..0949dcef0697 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -325,19 +325,16 @@ static void rp_do_receive(struct r_port *info,
 {
         unsigned int CharNStat;
         int ToRecv, wRecv, space = 0, count;
-        unsigned char *cbuf;
-        char *fbuf;
+        unsigned char *cbuf, *chead;
+        char *fbuf, *fhead;
         struct tty_ldisc *ld;
 
         ld = tty_ldisc_ref(tty);
 
         ToRecv = sGetRxCnt(cp);
-        if (ld)
-                space = ld->receive_room(tty);
+        space = tty->receive_room;
         if (space > 2 * TTY_FLIPBUF_SIZE)
                 space = 2 * TTY_FLIPBUF_SIZE;
-        cbuf = tty->flip.char_buf;
-        fbuf = tty->flip.flag_buf;
         count = 0;
 #ifdef ROCKET_DEBUG_INTR
         printk(KERN_INFO "rp_do_receive(%d, %d)...", ToRecv, space);
@@ -350,9 +347,13 @@ static void rp_do_receive(struct r_port *info,
         if (ToRecv > space)
                 ToRecv = space;
 
+        ToRecv = tty_prepare_flip_string_flags(tty, &chead, &fhead, ToRecv);
         if (ToRecv <= 0)
                 goto done;
 
+        cbuf = chead;
+        fbuf = fhead;
+
         /*
          * if status indicates there are errored characters in the
          * FIFO, then enter status mode (a word in FIFO holds
@@ -399,7 +400,7 @@ static void rp_do_receive(struct r_port *info,
                         else if (CharNStat & STMRCVROVRH)
                                 *fbuf++ = TTY_OVERRUN;
                         else
-                                *fbuf++ = 0;
+                                *fbuf++ = TTY_NORMAL;
                         *cbuf++ = CharNStat & 0xff;
                         count++;
                         ToRecv--;
@@ -426,13 +427,13 @@ static void rp_do_receive(struct r_port *info,
                         sInStrW(sGetTxRxDataIO(cp), (unsigned short *) cbuf, wRecv);
                 if (ToRecv & 1)
                         cbuf[ToRecv - 1] = sInB(sGetTxRxDataIO(cp));
-                memset(fbuf, 0, ToRecv);
+                memset(fbuf, TTY_NORMAL, ToRecv);
                 cbuf += ToRecv;
                 fbuf += ToRecv;
                 count += ToRecv;
         }
         /*  Push the data up to the tty layer */
-        ld->receive_buf(tty, tty->flip.char_buf, tty->flip.flag_buf, count);
+        ld->receive_buf(tty, cbuf, fbuf, count);
 done:
         tty_ldisc_deref(ld);
 }
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index 5b187c895c18..71093a9fc462 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -275,7 +275,8 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
 int paste_selection(struct tty_struct *tty)
 {
         struct vc_data *vc = (struct vc_data *)tty->driver_data;
-        int     pasted = 0, count;
+        int     pasted = 0;
+        unsigned int count;
         struct  tty_ldisc *ld;
         DECLARE_WAITQUEUE(wait, current);
 
@@ -293,7 +294,7 @@ int paste_selection(struct tty_struct *tty)
                         continue;
                 }
                 count = sel_buffer_lth - pasted;
-                count = min(count, tty->ldisc.receive_room(tty));
+                count = min(count, tty->receive_room);
                 tty->ldisc.receive_buf(tty, sel_buffer + pasted, NULL, count);
                 pasted += count;
         }
diff --git a/drivers/char/ser_a2232.c b/drivers/char/ser_a2232.c
index dda30e42ec79..80a5b840e22f 100644
--- a/drivers/char/ser_a2232.c
+++ b/drivers/char/ser_a2232.c
@@ -194,11 +194,6 @@ static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
 */
         struct tty_struct *tty = port->gs.tty;
 
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                return;
-
-        tty->flip.count++;
-
 #if 0
         switch(err) {
         case TTY_BREAK:
@@ -212,8 +207,7 @@ static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
         }
 #endif
 
-        *tty->flip.flag_buf_ptr++ = err;
-        *tty->flip.char_buf_ptr++ = ch;
+        tty_insert_flip_char(tty, ch, err);
         tty_flip_buffer_push(tty);
 }
 
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index a580748b92a1..f36342ae8e7e 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -422,45 +422,35 @@ cd2401_rxerr_interrupt(int irq, void *dev_id, struct pt_regs *fp)
             base_addr[CyREOIR] = rfoc ? 0 : CyNOTRANS;
             return IRQ_HANDLED;
         }
-        if (tty->flip.count < TTY_FLIPBUF_SIZE){
-            tty->flip.count++;
+        if (tty_buffer_request_room(tty, 1) != 0){
             if (err & info->read_status_mask){
                 if(err & CyBREAK){
-                    *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                    *tty->flip.char_buf_ptr++ = data;
+                    tty_insert_flip_char(tty, data, TTY_BREAK);
                     if (info->flags & ASYNC_SAK){
                         do_SAK(tty);
                     }
                 }else if(err & CyFRAME){
-                    *tty->flip.flag_buf_ptr++ = TTY_FRAME;
-                    *tty->flip.char_buf_ptr++ = data;
+                    tty_insert_flip_char(tty, data, TTY_FRAME);
                 }else if(err & CyPARITY){
-                    *tty->flip.flag_buf_ptr++ = TTY_PARITY;
-                    *tty->flip.char_buf_ptr++ = data;
+                    tty_insert_flip_char(tty, data, TTY_PARITY);
                 }else if(err & CyOVERRUN){
-                    *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
-                    *tty->flip.char_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                     /*
                        If the flip buffer itself is
                        overflowing, we still loose
                        the next incoming character.
                      */
-                    if(tty->flip.count < TTY_FLIPBUF_SIZE){
-                        tty->flip.count++;
-                        *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                        *tty->flip.char_buf_ptr++ = data;
-                    }
+                    tty_insert_flip_char(tty, data, TTY_NORMAL);
+                }
                 /* These two conditions may imply */
                 /* a normal read should be done. */
                 /* else if(data & CyTIMEOUT) */
                 /* else if(data & CySPECHAR) */
                 }else{
-                    *tty->flip.flag_buf_ptr++ = 0;
-                    *tty->flip.char_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, 0, TTY_NORMAL);
                 }
             }else{
-                *tty->flip.flag_buf_ptr++ = 0;
-                *tty->flip.char_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, data, TTY_NORMAL);
             }
         }else{
             /* there was a software buffer overrun
@@ -692,12 +682,7 @@ cd2401_rx_interrupt(int irq, void *dev_id, struct pt_regs *fp)
 #endif
         while(char_count--){
             data = base_addr[CyRDR];
-            if (tty->flip.count >= TTY_FLIPBUF_SIZE){
-                continue;
-            }
-            tty->flip.count++;
-            *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-            *tty->flip.char_buf_ptr++ = data;
+            tty_insert_flip_char(tty, data, TTY_NORMAL);
 #ifdef CYCLOM_16Y_HACK
             udelay(10L);
 #endif
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 0bbfce43031c..0a574bdbce36 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -85,6 +85,7 @@
 #include <linux/interrupt.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/mm.h>
 #include <linux/serial.h>
 #include <linux/fcntl.h>
@@ -665,7 +666,7 @@ static inline void sx_receive_exc(struct specialix_board * bp)
         struct specialix_port *port;
         struct tty_struct *tty;
         unsigned char status;
-        unsigned char ch;
+        unsigned char ch, flag;
 
         func_enter();
 
@@ -676,8 +677,6 @@ static inline void sx_receive_exc(struct specialix_board * bp)
                 return;
         }
         tty = port->tty;
-        dprintk (SX_DEBUG_RX, "port: %p count: %d BUFF_SIZE: %d\n",
-                 port,  tty->flip.count, TTY_FLIPBUF_SIZE);
 
         status = sx_in(bp, CD186x_RCSR);
 
@@ -691,7 +690,7 @@ static inline void sx_receive_exc(struct specialix_board * bp)
 
         /* This flip buffer check needs to be below the reading of the
            status register to reset the chip's IRQ.... */
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+        if (tty_buffer_request_room(tty, 1) == 0) {
                 dprintk(SX_DEBUG_FIFO, "sx%d: port %d: Working around flip buffer overflow.\n",
                        board_No(bp), port_No(port));
                 func_exit();
@@ -712,26 +711,24 @@ static inline void sx_receive_exc(struct specialix_board * bp)
         } else if (status & RCSR_BREAK) {
                 dprintk(SX_DEBUG_RX, "sx%d: port %d: Handling break...\n",
                        board_No(bp), port_No(port));
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                flag = TTY_BREAK;
                 if (port->flags & ASYNC_SAK)
                         do_SAK(tty);
 
         } else if (status & RCSR_PE)
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                flag = TTY_PARITY;
 
         else if (status & RCSR_FE)
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                flag = TTY_FRAME;
 
         else if (status & RCSR_OE)
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                flag = TTY_OVERRUN;
 
         else
-                *tty->flip.flag_buf_ptr++ = 0;
-
-        *tty->flip.char_buf_ptr++ = ch;
-        tty->flip.count++;
-        schedule_delayed_work(&tty->flip.work, 1);
+                flag = TTY_NORMAL;
 
+        if(tty_insert_flip_char(tty, ch, flag))
+                tty_flip_buffer_push(tty);
         func_exit();
 }
 
@@ -755,18 +752,11 @@ static inline void sx_receive(struct specialix_board * bp)
         dprintk (SX_DEBUG_RX, "port: %p: count: %d\n", port, count);
         port->hits[count > 8 ? 9 : count]++;
 
-        while (count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        printk(KERN_INFO "sx%d: port %d: Working around flip buffer overflow.\n",
-                               board_No(bp), port_No(port));
-                        break;
-                }
-                *tty->flip.char_buf_ptr++ = sx_in(bp, CD186x_RDR);
-                *tty->flip.flag_buf_ptr++ = 0;
-                tty->flip.count++;
-        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        tty_buffer_request_room(tty, count);
 
+        while (count--)
+                tty_insert_flip_char(tty, sx_in(bp, CD186x_RDR), TTY_NORMAL);
+        tty_flip_buffer_push(tty);
         func_exit();
 }
 
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index acef2abf3f0d..0e20780d4a29 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -2901,7 +2901,8 @@ static int stl_getportstats(stlport_t *portp, comstats_t __user *cp)
         if (portp->tty != (struct tty_struct *) NULL) {
                 if (portp->tty->driver_data == portp) {
                         portp->stats.ttystate = portp->tty->flags;
-                        portp->stats.rxbuffered = portp->tty->flip.count;
+                        /* No longer available as a statistic */
+                        portp->stats.rxbuffered = 1; /*portp->tty->flip.count; */
                         if (portp->tty->termios != (struct termios *) NULL) {
                                 portp->stats.cflags = portp->tty->termios->c_cflag;
                                 portp->stats.iflags = portp->tty->termios->c_iflag;
@@ -4045,9 +4046,7 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
         if ((ioack & ACK_TYPMASK) == ACK_TYPRXGOOD) {
                 outb((RDCR + portp->uartaddr), ioaddr);
                 len = inb(ioaddr + EREG_DATA);
-                if ((tty == (struct tty_struct *) NULL) ||
-                    (tty->flip.char_buf_ptr == (char *) NULL) ||
-                    ((buflen = TTY_FLIPBUF_SIZE - tty->flip.count) == 0)) {
+                if (tty == NULL || (buflen = tty_buffer_request_room(tty, len)) == 0) {
                         len = MIN(len, sizeof(stl_unwanted));
                         outb((RDSR + portp->uartaddr), ioaddr);
                         insb((ioaddr + EREG_DATA), &stl_unwanted[0], len);
@@ -4056,12 +4055,10 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                 } else {
                         len = MIN(len, buflen);
                         if (len > 0) {
+                                unsigned char *ptr;
                                 outb((RDSR + portp->uartaddr), ioaddr);
-                                insb((ioaddr + EREG_DATA), tty->flip.char_buf_ptr, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.count += len;
+                                tty_prepare_flip_string(tty, &ptr, len);
+                                insb((ioaddr + EREG_DATA), ptr, len);
                                 tty_schedule_flip(tty);
                                 portp->stats.rxtotal += len;
                         }
@@ -4085,8 +4082,7 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                                 portp->stats.txxoff++;
                         goto stl_rxalldone;
                 }
-                if ((tty != (struct tty_struct *) NULL) &&
-                    ((portp->rxignoremsk & status) == 0)) {
+                if (tty != NULL && (portp->rxignoremsk & status) == 0) {
                         if (portp->rxmarkmsk & status) {
                                 if (status & ST_BREAK) {
                                         status = TTY_BREAK;
@@ -4106,14 +4102,8 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                         } else {
                                 status = 0;
                         }
-                        if (tty->flip.char_buf_ptr != (char *) NULL) {
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        *tty->flip.flag_buf_ptr++ = status;
-                                        *tty->flip.char_buf_ptr++ = ch;
-                                        tty->flip.count++;
-                                }
-                                tty_schedule_flip(tty);
-                        }
+                        tty_insert_flip_char(tty, ch, status);
+                        tty_schedule_flip(tty);
                 }
         } else {
                 printk("STALLION: bad RX interrupt ack value=%x\n", ioack);
@@ -5012,9 +5002,7 @@ static void stl_sc26198rxisr(stlport_t *portp, unsigned int iack)
         len = inb(ioaddr + XP_DATA) + 1;
 
         if ((iack & IVR_TYPEMASK) == IVR_RXDATA) {
-                if ((tty == (struct tty_struct *) NULL) ||
-                    (tty->flip.char_buf_ptr == (char *) NULL) ||
-                    ((buflen = TTY_FLIPBUF_SIZE - tty->flip.count) == 0)) {
+                if (tty == NULL || (buflen = tty_buffer_request_room(tty, len)) == 0) {
                         len = MIN(len, sizeof(stl_unwanted));
                         outb(GRXFIFO, (ioaddr + XP_ADDR));
                         insb((ioaddr + XP_DATA), &stl_unwanted[0], len);
@@ -5023,12 +5011,10 @@ static void stl_sc26198rxisr(stlport_t *portp, unsigned int iack)
                 } else {
                         len = MIN(len, buflen);
                         if (len > 0) {
+                                unsigned char *ptr;
                                 outb(GRXFIFO, (ioaddr + XP_ADDR));
-                                insb((ioaddr + XP_DATA), tty->flip.char_buf_ptr, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.count += len;
+                                tty_prepare_flip_string(tty, &ptr, len);
+                                insb((ioaddr + XP_DATA), ptr, len);
                                 tty_schedule_flip(tty);
                                 portp->stats.rxtotal += len;
                         }
@@ -5096,14 +5082,8 @@ static inline void stl_sc26198rxbadch(stlport_t *portp, unsigned char status, ch
                         status = 0;
                 }
 
-                if (tty->flip.char_buf_ptr != (char *) NULL) {
-                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                *tty->flip.flag_buf_ptr++ = status;
-                                *tty->flip.char_buf_ptr++ = ch;
-                                tty->flip.count++;
-                        }
-                        tty_schedule_flip(tty);
-                }
+                tty_insert_flip_char(tty, ch, status);
+                tty_schedule_flip(tty);
 
                 if (status == 0)
                         portp->stats.rxtotal++;
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 564f31778eb3..64bf89cb574f 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1085,6 +1085,7 @@ static inline void sx_receive_chars (struct sx_port *port)
         int rx_op;
         struct tty_struct *tty;
         int copied=0;
+        unsigned char *rp;
 
         func_enter2 ();
         tty = port->gs.tty;
@@ -1095,8 +1096,8 @@ static inline void sx_receive_chars (struct sx_port *port)
                 sx_dprintk (SX_DEBUG_RECEIVE, "rxop=%d, c = %d.\n", rx_op, c); 
 
                 /* Don't copy more bytes than there is room for in the buffer */
-                if (tty->flip.count + c > TTY_FLIPBUF_SIZE) 
-                        c = TTY_FLIPBUF_SIZE - tty->flip.count;
+
+                c = tty_prepare_flip_string(tty, &rp, c);
 
                 sx_dprintk (SX_DEBUG_RECEIVE, "c = %d.\n", c); 
 
@@ -1111,14 +1112,8 @@ static inline void sx_receive_chars (struct sx_port *port)
                 sx_dprintk (SX_DEBUG_RECEIVE , "Copying over %d chars. First is %d at %lx\n", c, 
                             read_sx_byte (port->board, CHAN_OFFSET(port,hi_rxbuf) + rx_op),
                             CHAN_OFFSET(port, hi_rxbuf)); 
-                memcpy_fromio (tty->flip.char_buf_ptr, 
+                memcpy_fromio (rp,
                                port->board->base + CHAN_OFFSET(port,hi_rxbuf) + rx_op, c);
-                memset(tty->flip.flag_buf_ptr, TTY_NORMAL, c);
-
-                /* Update the kernel buffer end */
-                tty->flip.count += c;
-                tty->flip.char_buf_ptr += c;
-                tty->flip.flag_buf_ptr += c;
 
                 /* This one last. ( Not essential.)
                    It allows the card to start putting more data into the buffer! 
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index 789572fc002b..9f1b466c4f84 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1467,6 +1467,7 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
 {
         int Fifocount;
         u16 status;
+        int work = 0;
         unsigned char DataByte;
         struct tty_struct *tty = info->tty;
         struct  mgsl_icount *icount = &info->icount;
@@ -1487,6 +1488,8 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
         /* flush the receive FIFO */
 
         while( (Fifocount = (usc_InReg(info,RICR) >> 8)) ) {
+                int flag;
+
                 /* read one byte from RxFIFO */
                 outw( (inw(info->io_base + CCAR) & 0x0780) | (RDR+LSBONLY),
                       info->io_base + CCAR );
@@ -1498,13 +1501,9 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
                                 RXSTATUS_OVERRUN + RXSTATUS_BREAK_RECEIVED) )
                         usc_UnlatchRxstatusBits(info,RXSTATUS_ALL);
                 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        continue;
-                        
-                *tty->flip.char_buf_ptr = DataByte;
                 icount->rx++;
                 
-                *tty->flip.flag_buf_ptr = 0;
+                flag = 0;
                 if ( status & (RXSTATUS_FRAMING_ERROR + RXSTATUS_PARITY_ERROR +
                                 RXSTATUS_OVERRUN + RXSTATUS_BREAK_RECEIVED) ) {
                         printk("rxerr=%04X\n",status);                                  
@@ -1530,41 +1529,31 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
                         status &= info->read_status_mask;
                 
                         if (status & RXSTATUS_BREAK_RECEIVED) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                                 if (info->flags & ASYNC_SAK)
                                         do_SAK(tty);
                         } else if (status & RXSTATUS_PARITY_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (status & RXSTATUS_FRAMING_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
-                        if (status & RXSTATUS_OVERRUN) {
-                                /* Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                }
-                        }
+                                flag = TTY_FRAME;
                 }       /* end of if (error) */
-                
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
+                tty_insert_flip_char(tty, DataByte, flag);
+                if (status & RXSTATUS_OVERRUN) {
+                        /* Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        work += tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                }
         }
 
         if ( debug_level >= DEBUG_LEVEL_ISR ) {
-                printk("%s(%d):mgsl_isr_receive_data flip count=%d\n",
-                        __FILE__,__LINE__,tty->flip.count);
                 printk("%s(%d):rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                         __FILE__,__LINE__,icount->rx,icount->brk,
                         icount->parity,icount->frame,icount->overrun);
         }
                         
-        if ( tty->flip.count )
+        if(work)
                 tty_flip_buffer_push(tty);
 }
 
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 41759cd70a4f..79c81def4104 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -1749,6 +1749,9 @@ static void rx_async(struct slgt_info *info)
         unsigned char status;
         struct slgt_desc *bufs = info->rbufs;
         int i, count;
+        int chars = 0;
+        int stat;
+        unsigned char ch;
 
         start = end = info->rbuf_current;
 
@@ -1760,16 +1763,15 @@ static void rx_async(struct slgt_info *info)
                 DBGDATA(info, p, count, "rx");
 
                 for(i=0 ; i < count; i+=2, p+=2) {
-                        if (tty) {
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                        tty_flip_buffer_push(tty);
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                        break;
-                                *tty->flip.char_buf_ptr = *p;
-                                *tty->flip.flag_buf_ptr = 0;
+                        if (tty && chars) {
+                                tty_flip_buffer_push(tty);
+                                chars = 0;
                         }
+                        ch = *p;
                         icount->rx++;
 
+                        stat = 0;
+
                         if ((status = *(p+1) & (BIT9 + BIT8))) {
                                 if (status & BIT9)
                                         icount->parity++;
@@ -1778,17 +1780,14 @@ static void rx_async(struct slgt_info *info)
                                 /* discard char if tty control flags say so */
                                 if (status & info->ignore_status_mask)
                                         continue;
-                                if (tty) {
-                                        if (status & BIT9)
-                                                *tty->flip.flag_buf_ptr = TTY_PARITY;
-                                        else if (status & BIT8)
-                                                *tty->flip.flag_buf_ptr = TTY_FRAME;
-                                }
+                                if (status & BIT9)
+                                        stat = TTY_PARITY;
+                                else if (status & BIT8)
+                                        stat = TTY_FRAME;
                         }
                         if (tty) {
-                                tty->flip.flag_buf_ptr++;
-                                tty->flip.char_buf_ptr++;
-                                tty->flip.count++;
+                                tty_insert_flip_char(tty, ch, stat);
+                                chars++;
                         }
                 }
 
@@ -1811,7 +1810,7 @@ static void rx_async(struct slgt_info *info)
                         break;
         }
 
-        if (tty && tty->flip.count)
+        if (tty && chars)
                 tty_flip_buffer_push(tty);
 }
 
@@ -2029,7 +2028,7 @@ static void isr_serial(struct slgt_info *info)
                         if (info->tty) {
                                 if (!(status & info->ignore_status_mask)) {
                                         if (info->read_status_mask & MASK_BREAK) {
-                                                *info->tty->flip.flag_buf_ptr = TTY_BREAK;
+                                                tty_insert_flip_char(info->tty, 0, TTY_BREAK);
                                                 if (info->flags & ASYNC_SAK)
                                                         do_SAK(info->tty);
                                         }
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index a9467e7d3747..960adb256fbb 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -2196,7 +2196,7 @@ void isr_rxint(SLMP_INFO * info)
                         if ( tty ) {
                                 if (!(status & info->ignore_status_mask1)) {
                                         if (info->read_status_mask1 & BRKD) {
-                                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                                tty_insert_flip_char(tty, 0, TTY_BREAK);
                                                 if (info->flags & ASYNC_SAK)
                                                         do_SAK(tty);
                                         }
@@ -2240,16 +2240,10 @@ void isr_rxrdy(SLMP_INFO * info)
 
         while((status = read_reg(info,CST0)) & BIT0)
         {
+                int flag = 0;
+                int over = 0;
                 DataByte = read_reg(info,TRB);
 
-                if ( tty ) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                continue;
-
-                        *tty->flip.char_buf_ptr = DataByte;
-                        *tty->flip.flag_buf_ptr = 0;
-                }
-
                 icount->rx++;
 
                 if ( status & (PE + FRME + OVRN) ) {
@@ -2272,42 +2266,34 @@ void isr_rxrdy(SLMP_INFO * info)
 
                         if ( tty ) {
                                 if (status & PE)
-                                        *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                 else if (status & FRME)
-                                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                        flag = TTY_FRAME;
                                 if (status & OVRN) {
                                         /* Overrun is special, since it's
                                          * reported immediately, and doesn't
                                          * affect the current character
                                          */
-                                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                                tty->flip.count++;
-                                                tty->flip.flag_buf_ptr++;
-                                                tty->flip.char_buf_ptr++;
-                                                *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                        }
+                                        over = 1;
                                 }
                         }
                 }       /* end of if (error) */
 
                 if ( tty ) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, DataByte, flag);
+                        if (over)
+                                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                 }
         }
 
         if ( debug_level >= DEBUG_LEVEL_ISR ) {
-                printk("%s(%d):%s isr_rxrdy() flip count=%d\n",
-                        __FILE__,__LINE__,info->device_name,
-                        tty ? tty->flip.count : 0);
                 printk("%s(%d):%s rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                         __FILE__,__LINE__,info->device_name,
                         icount->rx,icount->brk,icount->parity,
                         icount->frame,icount->overrun);
         }
 
-        if ( tty && tty->flip.count )
+        if ( tty )
                 tty_flip_buffer_push(tty);
 }
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 4b1eef51ec59..1eda82b31a61 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -166,9 +166,12 @@ static struct tty_struct *alloc_tty_struct(void)
         return tty;
 }
 
+static void tty_buffer_free_all(struct tty_struct *);
+
 static inline void free_tty_struct(struct tty_struct *tty)
 {
         kfree(tty->write_buf);
+        tty_buffer_free_all(tty);
         kfree(tty);
 }
 
@@ -231,6 +234,201 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
 }
 
 /*
+ * Tty buffer allocation management
+ */
+
+static void tty_buffer_free_all(struct tty_struct *tty)
+{
+        struct tty_buffer *thead;
+        while((thead = tty->buf.head) != NULL) {
+                tty->buf.head = thead->next;
+                kfree(thead);
+        }
+        while((thead = tty->buf.free) != NULL) {
+                tty->buf.free = thead->next;
+                kfree(thead);
+        }
+        tty->buf.tail = NULL;
+}
+
+static void tty_buffer_init(struct tty_struct *tty)
+{
+        tty->buf.head = NULL;
+        tty->buf.tail = NULL;
+        tty->buf.free = NULL;
+}
+
+static struct tty_buffer *tty_buffer_alloc(size_t size)
+{
+        struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
+        if(p == NULL)
+                return NULL;
+        p->used = 0;
+        p->size = size;
+        p->next = NULL;
+        p->char_buf_ptr = (char *)(p->data);
+        p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
+/*      printk("Flip create %p\n", p); */
+        return p;
+}
+
+/* Must be called with the tty_read lock held. This needs to acquire strategy
+   code to decide if we should kfree or relink a given expired buffer */
+
+static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
+{
+        /* Dumb strategy for now - should keep some stats */
+/*      printk("Flip dispose %p\n", b); */
+        if(b->size >= 512)
+                kfree(b);
+        else {
+                b->next = tty->buf.free;
+                tty->buf.free = b;
+        }
+}
+
+static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer **tbh = &tty->buf.free;
+        while((*tbh) != NULL) {
+                struct tty_buffer *t = *tbh;
+                if(t->size >= size) {
+                        *tbh = t->next;
+                        t->next = NULL;
+                        t->used = 0;
+                        /* DEBUG ONLY */
+                        memset(t->data, '*', size);
+/*                      printk("Flip recycle %p\n", t); */
+                        return t;
+                }
+                tbh = &((*tbh)->next);
+        }
+        /* Round the buffer size out */
+        size = (size + 0xFF) & ~ 0xFF;
+        return tty_buffer_alloc(size);
+        /* Should possibly check if this fails for the largest buffer we
+           have queued and recycle that ? */
+}
+
+int tty_buffer_request_room(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer *b = tty->buf.head, *n;
+        int left = 0;
+
+        /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
+           remove this conditional if its worth it. This would be invisible
+           to the callers */
+        if(b != NULL)
+                left = b->size - b->used;
+        if(left >= size)
+                return size;
+        /* This is the slow path - looking for new buffers to use */
+        n = tty_buffer_find(tty, size);
+        if(n == NULL)
+                return left;
+        n->next = b;
+        if(b != NULL)
+                b->next = n;
+        else
+                tty->buf.head = n;
+        tty->buf.tail = n;
+        return size;
+}
+
+EXPORT_SYMBOL_GPL(tty_buffer_request_room);
+
+int tty_insert_flip_string(struct tty_struct *tty, unsigned char *chars, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if(unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+/*              printk("Flip insert %d.\n", space); */
+        }
+        /* There is a small chance that we need to split the data over
+           several buffers. If this is the case we must loop */
+        while (unlikely(size > copied));
+        return copied;
+}
+
+EXPORT_SYMBOL_GPL(tty_insert_flip_string);
+
+int tty_insert_flip_string_flags(struct tty_struct *tty, unsigned char *chars, char *flags, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if(unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memcpy(tb->flag_buf_ptr + tb->used, flags, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+                flags += space;
+        }
+        /* There is a small chance that we need to split the data over
+           several buffers. If this is the case we must loop */
+        while (unlikely(size > copied));
+        return copied;
+}
+
+EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
+
+
+/*
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for normal characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ */
+
+int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        struct tty_buffer *tb = tty->buf.tail;
+        *chars = tb->char_buf_ptr + tb->used;
+        memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+        tb->used += space;
+        return space;
+}
+
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
+
+/*
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ */
+
+int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        struct tty_buffer *tb = tty->buf.tail;
+        *chars = tb->char_buf_ptr + tb->used;
+        *flags = tb->flag_buf_ptr + tb->used;
+        tb->used += space;
+        return space;
+}
+
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
+
+
+
+/*
  *      This is probably overkill for real world processors but
  *      they are not on hot paths so a little discipline won't do 
  *      any harm.
@@ -492,6 +690,17 @@ restart:
         if (ld == NULL)
                 return -EINVAL;
 
+        /*
+         *      No more input please, we are switching. The new ldisc
+         *      will update this value in the ldisc open function
+         */
+
+        tty->receive_room = 0;
+
+        /*
+         *      Problem: What do we do if this blocks ?
+         */
+
         tty_wait_until_sent(tty, 0);
 
         if (tty->ldisc.num == ldisc) {
@@ -560,9 +769,9 @@ restart:
          *      we say so later on.
          */
 
-        work = cancel_delayed_work(&tty->flip.work);
+        work = cancel_delayed_work(&tty->buf.work);
         /*
-         * Wait for ->hangup_work and ->flip.work handlers to terminate
+         * Wait for ->hangup_work and ->buf.work handlers to terminate
          */
          
         flush_scheduled_work();
@@ -616,7 +825,7 @@ restart:
         /* Restart it in case no characters kick it off. Safe if
            already running */
         if (work)
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
         return retval;
 }
 
@@ -1721,10 +1930,10 @@ static void release_dev(struct file * filp)
          */
         clear_bit(TTY_LDISC, &tty->flags);
         clear_bit(TTY_DONT_FLIP, &tty->flags);
-        cancel_delayed_work(&tty->flip.work);
+        cancel_delayed_work(&tty->buf.work);
 
         /*
-         * Wait for ->hangup_work and ->flip.work handlers to terminate
+         * Wait for ->hangup_work and ->buf.work handlers to terminate
          */
          
         flush_scheduled_work();
@@ -2518,17 +2727,15 @@ EXPORT_SYMBOL(do_SAK);
 
 /*
  * This routine is called out of the software interrupt to flush data
- * from the flip buffer to the line discipline. 
+ * from the buffer chain to the line discipline.
  */
  
 static void flush_to_ldisc(void *private_)
 {
         struct tty_struct *tty = (struct tty_struct *) private_;
-        unsigned char   *cp;
-        char            *fp;
-        int             count;
         unsigned long   flags;
         struct tty_ldisc *disc;
+        struct tty_buffer *tbuf;
 
         disc = tty_ldisc_ref(tty);
         if (disc == NULL)       /*  !TTY_LDISC */
@@ -2538,28 +2745,22 @@ static void flush_to_ldisc(void *private_)
                 /*
                  * Do it after the next timer tick:
                  */
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
                 goto out;
         }
         spin_lock_irqsave(&tty->read_lock, flags);
-        if (tty->flip.buf_num) {
-                cp = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
-                fp = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
-                tty->flip.buf_num = 0;
-                tty->flip.char_buf_ptr = tty->flip.char_buf;
-                tty->flip.flag_buf_ptr = tty->flip.flag_buf;
-        } else {
-                cp = tty->flip.char_buf;
-                fp = tty->flip.flag_buf;
-                tty->flip.buf_num = 1;
-                tty->flip.char_buf_ptr = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
-                tty->flip.flag_buf_ptr = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
-        }
-        count = tty->flip.count;
-        tty->flip.count = 0;
+        while((tbuf = tty->buf.head) != NULL) {
+                tty->buf.head = tbuf->next;
+                spin_unlock_irqrestore(&tty->read_lock, flags);
+                /* printk("Process buffer %p for %d\n", tbuf, tbuf->used); */
+                disc->receive_buf(tty, tbuf->char_buf_ptr,
+                                       tbuf->flag_buf_ptr,
+                                       tbuf->used);
+                spin_lock_irqsave(&tty->read_lock, flags);
+                tty_buffer_free(tty, tbuf);
+        }
+        tty->buf.tail = NULL;
         spin_unlock_irqrestore(&tty->read_lock, flags);
-
-        disc->receive_buf(tty, cp, fp, count);
 out:
         tty_ldisc_deref(disc);
 }
@@ -2654,11 +2855,12 @@ void tty_flip_buffer_push(struct tty_struct *tty)
         if (tty->low_latency)
                 flush_to_ldisc((void *) tty);
         else
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
 }
 
 EXPORT_SYMBOL(tty_flip_buffer_push);
 
+
 /*
  * This subroutine initializes a tty structure.
  */
@@ -2669,10 +2871,10 @@ static void initialize_tty_struct(struct tty_struct *tty)
         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
         tty->pgrp = -1;
         tty->overrun_time = jiffies;
-        tty->flip.char_buf_ptr = tty->flip.char_buf;
-        tty->flip.flag_buf_ptr = tty->flip.flag_buf;
-        INIT_WORK(&tty->flip.work, flush_to_ldisc, tty);
-        init_MUTEX(&tty->flip.pty_sem);
+        tty->buf.head = tty->buf.tail = NULL;
+        tty_buffer_init(tty);
+        INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
+        init_MUTEX(&tty->buf.pty_sem);
         init_MUTEX(&tty->termios_sem);
         init_waitqueue_head(&tty->write_wait);
         init_waitqueue_head(&tty->read_wait);
diff --git a/drivers/char/viocons.c b/drivers/char/viocons.c
index 4d75c261f98a..cb82ebf4cb07 100644
--- a/drivers/char/viocons.c
+++ b/drivers/char/viocons.c
@@ -993,11 +993,10 @@ static void vioHandleData(struct HvLpEvent *event)
                  * Don't attempt to copy more data into the buffer than we
                  * have room for because it would fail without indication.
                  */
-                if ((tty->flip.count + 1) > TTY_FLIPBUF_SIZE) {
+                if(tty_insert_flip_char(tty, cevent->data[index], TTY_NORMAL) == 0) {
                         printk(VIOCONS_KERN_WARN "input buffer overflow!\n");
                         break;
                 }
-                tty_insert_flip_char(tty, cevent->data[index], TTY_NORMAL);
         }
 
         /* if cevent->len == 0 then no data was added to the buffer and flip.count == 0 */
diff --git a/drivers/char/vme_scc.c b/drivers/char/vme_scc.c
index 33e71e23b212..d9325281e482 100644
--- a/drivers/char/vme_scc.c
+++ b/drivers/char/vme_scc.c
@@ -434,13 +434,7 @@ static irqreturn_t scc_rx_int(int irq, void *data, struct pt_regs *fp)
                 SCCwrite_NB(COMMAND_REG, CR_HIGHEST_IUS_RESET);
                 return IRQ_HANDLED;
         }
-        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = 0;
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
-        }
+        tty_insert_flip_char(tty, ch, 0);
 
         /* Check if another character is already ready; in that case, the
          * spcond_int() function must be used, because this character may have an
@@ -487,13 +481,7 @@ static irqreturn_t scc_spcond_int(int irq, void *data, struct pt_regs *fp)
                 else
                         err = 0;
 
-                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.char_buf_ptr = ch;
-                        *tty->flip.flag_buf_ptr = err;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
+                tty_insert_flip_char(tty, ch, err);
 
                 /* ++TeSche: *All* errors have to be cleared manually,
                  * else the condition persists for the next chars
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 1bd88fca0542..54a680cc704d 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -96,6 +96,7 @@ static int serport_ldisc_open(struct tty_struct *tty)
         init_waitqueue_head(&serport->wait);
 
         tty->disc_data = serport;
+        tty->receive_room = 256;
         set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
 
         return 0;
@@ -140,17 +141,6 @@ out:
 }
 
 /*
- * serport_ldisc_room() reports how much room we do have for receiving data.
- * Although we in fact have infinite room, we need to specify some value
- * here, and 256 seems to be reasonable.
- */
-
-static int serport_ldisc_room(struct tty_struct *tty)
-{
-        return 256;
-}
-
-/*
  * serport_ldisc_read() just waits indefinitely if everything goes well.
  * However, when the serio driver closes the serio port, it finishes,
  * returning 0 characters.
@@ -237,7 +227,6 @@ static struct tty_ldisc serport_ldisc = {
         .read =         serport_ldisc_read,
         .ioctl =        serport_ldisc_ioctl,
         .receive_buf =  serport_ldisc_receive,
-        .receive_room = serport_ldisc_room,
         .write_wakeup = serport_ldisc_write_wakeup
 };
 
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 11ae0fddea04..623adbb0d13a 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -463,8 +463,7 @@ static int handle_recv_skb(struct capiminor *mp, struct sk_buff *skb)
 #endif
                 goto bad;
         }
-        if (ld->receive_room &&
-            ld->receive_room(mp->tty) < datalen) {
+        if (mp->tty->receive_room < datalen) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                 printk(KERN_DEBUG "capi: no room in tty\n");
 #endif
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 4643df097bfe..22759c01746a 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -857,6 +857,118 @@ isdn_readbchan(int di, int channel, u_char * buf, u_char * fp, int len, wait_que
         return count;
 }
 
+/*
+ * isdn_readbchan_tty() tries to get data from the read-queue.
+ * It MUST be called with interrupts off.
+ *
+ * Be aware that this is not an atomic operation when sleep != 0, even though
+ * interrupts are turned off! Well, like that we are currently only called
+ * on behalf of a read system call on raw device files (which are documented
+ * to be dangerous and for for debugging purpose only). The inode semaphore
+ * takes care that this is not called for the same minor device number while
+ * we are sleeping, but access is not serialized against simultaneous read()
+ * from the corresponding ttyI device. Can other ugly events, like changes
+ * of the mapping (di,ch)<->minor, happen during the sleep? --he
+ */
+int
+isdn_readbchan_tty(int di, int channel, struct tty_struct *tty, int cisco_hack)
+{
+        int count;
+        int count_pull;
+        int count_put;
+        int dflag;
+        struct sk_buff *skb;
+        char last = 0;
+        int len;
+
+        if (!dev->drv[di])
+                return 0;
+        if (skb_queue_empty(&dev->drv[di]->rpqueue[channel]))
+                        return 0;
+
+        len = tty_buffer_request_room(tty, dev->drv[di]->rcvcount[channel]);
+        if(len == 0)
+                return len;
+
+        count = 0;
+        while (len) {
+                if (!(skb = skb_peek(&dev->drv[di]->rpqueue[channel])))
+                        break;
+#ifdef CONFIG_ISDN_AUDIO
+                if (ISDN_AUDIO_SKB_LOCK(skb))
+                        break;
+                ISDN_AUDIO_SKB_LOCK(skb) = 1;
+                if ((ISDN_AUDIO_SKB_DLECOUNT(skb)) || (dev->drv[di]->DLEflag & (1 << channel))) {
+                        char *p = skb->data;
+                        unsigned long DLEmask = (1 << channel);
+
+                        dflag = 0;
+                        count_pull = count_put = 0;
+                        while ((count_pull < skb->len) && (len > 0)) {
+                                len--;
+                                if (dev->drv[di]->DLEflag & DLEmask) {
+                                        last = DLE;
+                                        dev->drv[di]->DLEflag &= ~DLEmask;
+                                } else {
+                                        last = *p;
+                                        if (last == DLE) {
+                                                dev->drv[di]->DLEflag |= DLEmask;
+                                                (ISDN_AUDIO_SKB_DLECOUNT(skb))--;
+                                        }
+                                        p++;
+                                        count_pull++;
+                                }
+                                count_put++;
+                        }
+                        if (count_pull >= skb->len)
+                                dflag = 1;
+                } else {
+#endif
+                        /* No DLE's in buff, so simply copy it */
+                        dflag = 1;
+                        if ((count_pull = skb->len) > len) {
+                                count_pull = len;
+                                dflag = 0;
+                        }
+                        count_put = count_pull;
+                        if(count_put > 1)
+                                tty_insert_flip_string(tty, skb->data, count_put - 1);
+                        last = skb->data[count_put] - 1;
+                        len -= count_put;
+#ifdef CONFIG_ISDN_AUDIO
+                }
+#endif
+                count += count_put;
+                if (dflag) {
+                        /* We got all the data in this buff.
+                         * Now we can dequeue it.
+                         */
+                        if(cisco_hack)
+                                tty_insert_flip_char(tty, last, 0xFF);
+                        else
+                                tty_insert_flip_char(tty, last, TTY_NORMAL);
+#ifdef CONFIG_ISDN_AUDIO
+                        ISDN_AUDIO_SKB_LOCK(skb) = 0;
+#endif
+                        skb = skb_dequeue(&dev->drv[di]->rpqueue[channel]);
+                        dev_kfree_skb(skb);
+                } else {
+                        tty_insert_flip_char(tty, last, TTY_NORMAL);
+                        /* Not yet emptied this buff, so it
+                         * must stay in the queue, for further calls
+                         * but we pull off the data we got until now.
+                         */
+                        skb_pull(skb, count_pull);
+#ifdef CONFIG_ISDN_AUDIO
+                        ISDN_AUDIO_SKB_LOCK(skb) = 0;
+#endif
+                }
+                dev->drv[di]->rcvcount[channel] -= count_put;
+        }
+        return count;
+}
+
+
 static __inline int
 isdn_minor2drv(int minor)
 {
diff --git a/drivers/isdn/i4l/isdn_common.h b/drivers/isdn/i4l/isdn_common.h
index e27e9c3a81ed..082735dbb412 100644
--- a/drivers/isdn/i4l/isdn_common.h
+++ b/drivers/isdn/i4l/isdn_common.h
@@ -37,6 +37,7 @@ extern void isdn_timer_ctrl(int tf, int onoff);
 extern void isdn_unexclusive_channel(int di, int ch);
 extern int  isdn_getnum(char **);
 extern int  isdn_readbchan(int, int, u_char *, u_char *, int, wait_queue_head_t *);
+extern int  isdn_readbchan_tty(int, int, struct tty_struct *, int);
 extern int  isdn_get_free_channel(int, int, int, int, int, char *);
 extern int  isdn_writebuf_skb_stub(int, int, int, struct sk_buff *);
 extern int  register_isdn(isdn_if * i);
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 8c404b4e2482..f190a99604f0 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -64,37 +64,42 @@ isdn_tty_try_read(modem_info * info, struct sk_buff *skb)
         int c;
         int len;
         struct tty_struct *tty;
+        char last;
 
         if (info->online) {
                 if ((tty = info->tty)) {
                         if (info->mcr & UART_MCR_RTS) {
-                                c = TTY_FLIPBUF_SIZE - tty->flip.count;
                                 len = skb->len
 #ifdef CONFIG_ISDN_AUDIO
                                         + ISDN_AUDIO_SKB_DLECOUNT(skb)
 #endif
                                         ;
+
+                                c = tty_buffer_request_room(tty, len);
                                 if (c >= len) {
 #ifdef CONFIG_ISDN_AUDIO
-                                        if (ISDN_AUDIO_SKB_DLECOUNT(skb))
-                                                while (skb->len--) {
+                                        if (ISDN_AUDIO_SKB_DLECOUNT(skb)) {
+                                                int l = skb->len;
+                                                unsigned char *dp = skb->data;
+                                                while (--l) {
                                                         if (*skb->data == DLE)
                                                                 tty_insert_flip_char(tty, DLE, 0);
-                                                        tty_insert_flip_char(tty, *skb->data++, 0);
+                                                        tty_insert_flip_char(tty, *dp++, 0);
+                                                }
+                                                last = *dp;
                                         } else {
 #endif
-                                                memcpy(tty->flip.char_buf_ptr,
-                                                       skb->data, len);
-                                                tty->flip.count += len;
-                                                tty->flip.char_buf_ptr += len;
-                                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                                tty->flip.flag_buf_ptr += len;
+                                                if(len > 1)
+                                                        tty_insert_flip_string(tty, skb->data, len - 1);
+                                                last = skb->data[len - 1];
 #ifdef CONFIG_ISDN_AUDIO
                                         }
 #endif
                                         if (info->emu.mdmreg[REG_CPPP] & BIT_CPPP)
-                                                tty->flip.flag_buf_ptr[len - 1] = 0xff;
-                                        schedule_delayed_work(&tty->flip.work, 1);
+                                                tty_insert_flip_char(tty, last, 0xFF);
+                                        else
+                                                tty_insert_flip_char(tty, last, TTY_NORMAL);
+                                        tty_flip_buffer_push(tty);
                                         kfree_skb(skb);
                                         return 1;
                                 }
@@ -114,7 +119,6 @@ isdn_tty_readmodem(void)
         int resched = 0;
         int midx;
         int i;
-        int c;
         int r;
         struct tty_struct *tty;
         modem_info *info;
@@ -131,20 +135,13 @@ isdn_tty_readmodem(void)
 #endif
                                 if ((tty = info->tty)) {
                                         if (info->mcr & UART_MCR_RTS) {
-                                                c = TTY_FLIPBUF_SIZE - tty->flip.count;
-                                                if (c > 0) {
-                                                        r = isdn_readbchan(info->isdn_driver, info->isdn_channel,
-                                                                           tty->flip.char_buf_ptr,
-                                                                           tty->flip.flag_buf_ptr, c, NULL);
-                                                        /* CISCO AsyncPPP Hack */
-                                                        if (!(info->emu.mdmreg[REG_CPPP] & BIT_CPPP))
-                                                                memset(tty->flip.flag_buf_ptr, 0, r);
-                                                        tty->flip.count += r;
-                                                        tty->flip.flag_buf_ptr += r;
-                                                        tty->flip.char_buf_ptr += r;
-                                                        if (r)
-                                                                schedule_delayed_work(&tty->flip.work, 1);
-                                                }
+                                                /* CISCO AsyncPPP Hack */
+                                                if (!(info->emu.mdmreg[REG_CPPP] & BIT_CPPP))
+                                                        r = isdn_readbchan_tty(info->isdn_driver, info->isdn_channel, tty, 0);
+                                                else
+                                                        r = isdn_readbchan_tty(info->isdn_driver, info->isdn_channel, tty, 1);
+                                                if (r)
+                                                        tty_flip_buffer_push(tty);
                                         } else
                                                 r = 1;
                                 } else
@@ -249,7 +246,7 @@ isdn_tty_rcv_skb(int i, int di, int channel, struct sk_buff *skb)
         }
 #endif
 #endif
-        /* Try to deliver directly via tty-flip-buf if queue is empty */
+        /* Try to deliver directly via tty-buf if queue is empty */
         spin_lock_irqsave(&info->readlock, flags);
         if (skb_queue_empty(&dev->drv[di]->rpqueue[channel]))
                 if (isdn_tty_try_read(info, skb)) {
@@ -534,7 +531,7 @@ isdn_tty_senddown(modem_info * info)
 /* The next routine is called once from within timer-interrupt
  * triggered within isdn_tty_modem_ncarrier(). It calls
  * isdn_tty_modem_result() to stuff a "NO CARRIER" Message
- * into the tty's flip-buffer.
+ * into the tty's buffer.
  */
 static void
 isdn_tty_modem_do_ncarrier(unsigned long data)
@@ -2347,6 +2344,7 @@ isdn_tty_at_cout(char *msg, modem_info * info)
         u_long flags;
         struct sk_buff *skb = NULL;
         char *sp = NULL;
+        int l = strlen(msg);
 
         if (!msg) {
                 printk(KERN_WARNING "isdn_tty: Null-Message in isdn_tty_at_cout\n");
@@ -2359,16 +2357,16 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                 return;
         }
 
-        /* use queue instead of direct flip, if online and */
-        /* data is in queue or flip buffer is full */
-        if ((info->online) && (((tty->flip.count + strlen(msg)) >= TTY_FLIPBUF_SIZE) ||
-            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel])))) {
-                skb = alloc_skb(strlen(msg), GFP_ATOMIC);
+        /* use queue instead of direct, if online and */
+        /* data is in queue or buffer is full */
+        if ((info->online && tty_buffer_request_room(tty, l) < l) ||
+            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {
+                skb = alloc_skb(l, GFP_ATOMIC);
                 if (!skb) {
                         spin_unlock_irqrestore(&info->readlock, flags);
                         return;
                 }
-                sp = skb_put(skb, strlen(msg));
+                sp = skb_put(skb, l);
 #ifdef CONFIG_ISDN_AUDIO
                 ISDN_AUDIO_SKB_DLECOUNT(skb) = 0;
                 ISDN_AUDIO_SKB_LOCK(skb) = 0;
@@ -2392,9 +2390,8 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                 if (skb) {
                         *sp++ = c;
                 } else {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        if(tty_insert_flip_char(tty, c, TTY_NORMAL) == 0)
                                 break;
-                        tty_insert_flip_char(tty, c, 0);
                 }
         }
         if (skb) {
@@ -2402,12 +2399,12 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                 dev->drv[info->isdn_driver]->rcvcount[info->isdn_channel] += skb->len;
                 spin_unlock_irqrestore(&info->readlock, flags);
                 /* Schedule dequeuing */
-                if ((dev->modempoll) && (info->rcvsched))
+                if (dev->modempoll && info->rcvsched)
                         isdn_timer_ctrl(ISDN_TIMER_MODEMREAD, 1);
 
         } else {
                 spin_unlock_irqrestore(&info->readlock, flags);
-                schedule_delayed_work(&tty->flip.work, 1);
+                tty_flip_buffer_push(tty);
         }
 }
 
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 90999867a32c..102c1f0b90da 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -456,11 +456,6 @@ out:
 
 /* ----------------------------------------------------------------------- */
 
-static int sixpack_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-
 /*
  * Handle the 'receiver data ready' interrupt.
  * This function is called by the 'tty_io' module in the kernel when
@@ -671,6 +666,7 @@ static int sixpack_open(struct tty_struct *tty)
 
         /* Done.  We have linked the TTY line to a channel. */
         tty->disc_data = sp;
+        tty->receive_room = 65536;
 
         /* Now we're ready to register. */
         if (register_netdev(dev))
@@ -802,7 +798,6 @@ static struct tty_ldisc sp_ldisc = {
         .close          = sixpack_close,
         .ioctl          = sixpack_ioctl,
         .receive_buf    = sixpack_receive_buf,
-        .receive_room   = sixpack_receive_room,
         .write_wakeup   = sixpack_write_wakeup,
 };
 
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index f4424cf886c5..dc5e9d59deed 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -753,6 +753,7 @@ static int mkiss_open(struct tty_struct *tty)
 
         ax->tty = tty;
         tty->disc_data = ax;
+        tty->receive_room = 65535;
 
         if (tty->driver->flush_buffer)
                 tty->driver->flush_buffer(tty);
@@ -940,11 +941,6 @@ static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                 tty->driver->unthrottle(tty);
 }
 
-static int mkiss_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-
 /*
  * Called by the driver when there's room for more data.  If we have
  * more packets to send, we send them here.
@@ -983,7 +979,6 @@ static struct tty_ldisc ax_ldisc = {
         .close          = mkiss_close,
         .ioctl          = mkiss_ioctl,
         .receive_buf    = mkiss_receive_buf,
-        .receive_room   = mkiss_receive_room,
         .write_wakeup   = mkiss_write_wakeup
 };
 
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index b8d112348ba4..101750bf210f 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -289,22 +289,6 @@ static void irtty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 }
 
 /*
- * Function irtty_receive_room (tty)
- *
- *    Used by the TTY to find out how much data we can receive at a time
- * 
-*/
-static int irtty_receive_room(struct tty_struct *tty) 
-{
-        struct sirtty_cb *priv = tty->disc_data;
-
-        IRDA_ASSERT(priv != NULL, return 0;);
-        IRDA_ASSERT(priv->magic == IRTTY_MAGIC, return 0;);
-
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-
-/*
  * Function irtty_write_wakeup (tty)
  *
  *    Called by the driver when there's room for more data.  If we have
@@ -534,6 +518,7 @@ static int irtty_open(struct tty_struct *tty)
 
         dev->priv = priv;
         tty->disc_data = priv;
+        tty->receive_room = 65536;
 
         up(&irtty_sem);
 
@@ -605,7 +590,6 @@ static struct tty_ldisc irda_ldisc = {
         .ioctl          = irtty_ioctl,
         .poll           = NULL,
         .receive_buf    = irtty_receive_buf,
-        .receive_room   = irtty_receive_room,
         .write_wakeup   = irtty_write_wakeup,
         .owner          = THIS_MODULE,
 };
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 400f652282d7..aa6540b39466 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -189,7 +189,7 @@ ppp_asynctty_open(struct tty_struct *tty)
                 goto out_free;
 
         tty->disc_data = ap;
-
+        tty->receive_room = 65536;
         return 0;
 
  out_free:
@@ -343,12 +343,6 @@ ppp_asynctty_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
         return 0;
 }
 
-static int
-ppp_asynctty_room(struct tty_struct *tty)
-{
-        return 65535;
-}
-
 /*
  * This can now be called from hard interrupt level as well
  * as soft interrupt level or mainline.
@@ -398,7 +392,6 @@ static struct tty_ldisc ppp_ldisc = {
         .write  = ppp_asynctty_write,
         .ioctl  = ppp_asynctty_ioctl,
         .poll   = ppp_asynctty_poll,
-        .receive_room = ppp_asynctty_room,
         .receive_buf = ppp_asynctty_receive,
         .write_wakeup = ppp_asynctty_wakeup,
 };
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index 4d51c0c8023d..33cb8254e79d 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -237,7 +237,7 @@ ppp_sync_open(struct tty_struct *tty)
                 goto out_free;
 
         tty->disc_data = ap;
-
+        tty->receive_room = 65536;
         return 0;
 
  out_free:
@@ -384,12 +384,6 @@ ppp_sync_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
         return 0;
 }
 
-static int
-ppp_sync_room(struct tty_struct *tty)
-{
-        return 65535;
-}
-
 /*
  * This can now be called from hard interrupt level as well
  * as soft interrupt level or mainline.
@@ -439,7 +433,6 @@ static struct tty_ldisc ppp_sync_ldisc = {
         .write  = ppp_sync_write,
         .ioctl  = ppp_synctty_ioctl,
         .poll   = ppp_sync_poll,
-        .receive_room = ppp_sync_room,
         .receive_buf = ppp_sync_receive,
         .write_wakeup = ppp_sync_wakeup,
 };
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 404ea4297e32..b2e18d28850d 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -651,11 +651,6 @@ static void sl_setup(struct net_device *dev)
  ******************************************/
 
 
-static int slip_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-
 /*
  * Handle the 'receiver data ready' interrupt.
  * This function is called by the 'tty_io' module in the kernel when
@@ -869,10 +864,6 @@ static int slip_open(struct tty_struct *tty)
         sl->line = tty_devnum(tty);
         sl->pid = current->pid;
         
-        /* FIXME: already done before we were called - seems this can go */
-        if (tty->driver->flush_buffer)
-                tty->driver->flush_buffer(tty);
-                
         if (!test_bit(SLF_INUSE, &sl->flags)) {
                 /* Perform the low-level SLIP initialization. */
                 if ((err = sl_alloc_bufs(sl, SL_MTU)) != 0)
@@ -897,6 +888,7 @@ static int slip_open(struct tty_struct *tty)
 
         /* Done.  We have linked the TTY line to a channel. */
         rtnl_unlock();
+        tty->receive_room = 65536;      /* We don't flow control */
         return sl->dev->base_addr;
 
 err_free_bufs:
@@ -1329,7 +1321,6 @@ static struct tty_ldisc	sl_ldisc = {
         .close          = slip_close,
         .ioctl          = slip_ioctl,
         .receive_buf    = slip_receive_buf,
-        .receive_room   = slip_receive_room,
         .write_wakeup   = slip_write_wakeup,
 };
 
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 52f26b9c69d2..931cbdf6d791 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -689,7 +689,7 @@ static void cpc_tty_rx_work(void * data)
                                         }
                                 }       
                                 cpc_tty->buf_rx.first = cpc_tty->buf_rx.first->next;
-                                kfree(buf);
+                                kfree((void *)buf);
                                 buf = cpc_tty->buf_rx.first;
                                 flg_rx = 1;
                         }
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index bdf672c48182..9c3ccc669143 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -515,11 +515,6 @@ static int x25_asy_close(struct net_device *dev)
         return 0;
 }
 
-static int x25_asy_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-
 /*
  * Handle the 'receiver data ready' interrupt.
  * This function is called by the 'tty_io' module in the kernel when
@@ -573,6 +568,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
 
         sl->tty = tty;
         tty->disc_data = sl;
+        tty->receive_room = 65536;
         if (tty->driver->flush_buffer)  {
                 tty->driver->flush_buffer(tty);
         }
@@ -779,7 +775,6 @@ static struct tty_ldisc x25_ldisc = {
         .close          = x25_asy_close_tty,
         .ioctl          = x25_asy_ioctl,
         .receive_buf    = x25_asy_receive_buf,
-        .receive_room   = x25_asy_receive_room,
         .write_wakeup   = x25_asy_write_wakeup,
 };
 
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index d25264ba0c0e..18baacfc5a2c 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -1675,11 +1675,6 @@ static int strip_rebuild_header(struct sk_buff *skb)
 /************************************************************************/
 /* Receiving routines                                                   */
 
-static int strip_receive_room(struct tty_struct *tty)
-{
-        return 0x10000;         /* We can handle an infinite amount of data. :-) */
-}
-
 /*
  * This function parses the response to the ATS300? command,
  * extracting the radio version and serial number.
@@ -2424,7 +2419,7 @@ static struct net_device_stats *strip_get_stats(struct net_device *dev)
 /*
  * Here's the order things happen:
  * When the user runs "slattach -p strip ..."
- *  1. The TTY module calls strip_open
+ *  1. The TTY module calls strip_open;;
  *  2. strip_open calls strip_alloc
  *  3.                  strip_alloc calls register_netdev
  *  4.                  register_netdev calls strip_dev_init
@@ -2652,6 +2647,8 @@ static int strip_open(struct tty_struct *tty)
 
         strip_info->tty = tty;
         tty->disc_data = strip_info;
+        tty->receive_room = 65536;
+
         if (tty->driver->flush_buffer)
                 tty->driver->flush_buffer(tty);
 
@@ -2762,7 +2759,6 @@ static struct tty_ldisc strip_ldisc = {
         .close = strip_close,
         .ioctl = strip_ioctl,
         .receive_buf = strip_receive_buf,
-        .receive_room = strip_receive_room,
         .write_wakeup = strip_write_some_more,
 };
 
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 75419cf9d353..1f060914cfa4 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -16,6 +16,7 @@
 #include <linux/types.h>
 #include <linux/kdev_t.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/vt_kern.h>
 #include <linux/init.h>
 #include <linux/console.h>
@@ -432,8 +433,6 @@ raw3215_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                                 if (count > slen)
                                         count = slen;
                         } else
-                        if (count >= TTY_FLIPBUF_SIZE - tty->flip.count)
-                                count = TTY_FLIPBUF_SIZE - tty->flip.count - 1;
                         EBCASC(raw->inbuf, count);
                         cchar = ctrlchar_handle(raw->inbuf, count, tty);
                         switch (cchar & CTRLCHAR_MASK) {
@@ -441,28 +440,20 @@ raw3215_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                                 break;
 
                         case CTRLCHAR_CTRL:
-                                tty->flip.count++;
-                                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                                *tty->flip.char_buf_ptr++ = cchar;
+                                tty_insert_flip_char(tty, cchar, TTY_NORMAL);
                                 tty_flip_buffer_push(raw->tty);
                                 break;
 
                         case CTRLCHAR_NONE:
-                                memcpy(tty->flip.char_buf_ptr,
-                                       raw->inbuf, count);
                                 if (count < 2 ||
-                                    (strncmp(raw->inbuf+count-2, "^n", 2) &&
-                                    strncmp(raw->inbuf+count-2, "\252n", 2)) ) {
-                                        /* don't add the auto \n */
-                                        tty->flip.char_buf_ptr[count] = '\n';
-                                        memset(tty->flip.flag_buf_ptr,
-                                               TTY_NORMAL, count + 1);
+                                    (strncmp(raw->inbuf+count-2, "\252n", 2) &&
+                                     strncmp(raw->inbuf+count-2, "^n", 2)) ) {
+                                        /* add the auto \n */
+                                        raw->inbuf[count] = '\n';
                                         count++;
                                 } else
-                                        count-=2;
-                                tty->flip.char_buf_ptr += count;
-                                tty->flip.flag_buf_ptr += count;
-                                tty->flip.count += count;
+                                        count -= 2;
+                                tty_insert_flip_string(tty, raw->inbuf, count);
                                 tty_flip_buffer_push(raw->tty);
                                 break;
                         }
diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c
index a20d7c89341d..6cbf067f1a8f 100644
--- a/drivers/s390/char/sclp_tty.c
+++ b/drivers/s390/char/sclp_tty.c
@@ -13,6 +13,7 @@
 #include <linux/kmod.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
@@ -496,25 +497,19 @@ sclp_tty_input(unsigned char* buf, unsigned int count)
         case CTRLCHAR_SYSRQ:
                 break;
         case CTRLCHAR_CTRL:
-                sclp_tty->flip.count++;
-                *sclp_tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                *sclp_tty->flip.char_buf_ptr++ = cchar;
+                tty_insert_flip_char(sclp_tty, cchar, TTY_NORMAL);
                 tty_flip_buffer_push(sclp_tty);
                 break;
         case CTRLCHAR_NONE:
                 /* send (normal) input to line discipline */
-                memcpy(sclp_tty->flip.char_buf_ptr, buf, count);
                 if (count < 2 ||
-                    (strncmp ((const char *) buf + count - 2, "^n", 2) &&
-                     strncmp ((const char *) buf + count - 2, "\0252n", 2))) {
-                        sclp_tty->flip.char_buf_ptr[count] = '\n';
-                        count++;
+                    (strncmp((const char *) buf + count - 2, "^n", 2) &&
+                     strncmp((const char *) buf + count - 2, "\252n", 2))) {
+                        /* add the auto \n */
+                        tty_insert_flip_string(sclp_tty, buf, count);
+                        tty_insert_flip_char(sclp_tty, '\n', TTY_NORMAL);
                 } else
-                        count -= 2;
-                memset(sclp_tty->flip.flag_buf_ptr, TTY_NORMAL, count);
-                sclp_tty->flip.char_buf_ptr += count;
-                sclp_tty->flip.flag_buf_ptr += count;
-                sclp_tty->flip.count += count;
+                        tty_insert_flip_string(sclp_tty, buf, count - 2);
                 tty_flip_buffer_push(sclp_tty);
                 break;
         }
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 06bd85824d7b..9e02625c82cf 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
@@ -482,16 +483,7 @@ sclp_vt220_receiver_fn(struct evbuf_header *evbuf)
                 /* Send input to line discipline */
                 buffer++;
                 count--;
-                /* Prevent buffer overrun by discarding input. Note that
-                 * because buffer_push works asynchronously, we cannot wait
-                 * for the buffer to be emptied. */
-                if (count + sclp_vt220_tty->flip.count > TTY_FLIPBUF_SIZE)
-                        count = TTY_FLIPBUF_SIZE - sclp_vt220_tty->flip.count;
-                memcpy(sclp_vt220_tty->flip.char_buf_ptr, buffer, count);
-                memset(sclp_vt220_tty->flip.flag_buf_ptr, TTY_NORMAL, count);
-                sclp_vt220_tty->flip.char_buf_ptr += count;
-                sclp_vt220_tty->flip.flag_buf_ptr += count;
-                sclp_vt220_tty->flip.count += count;
+                tty_insert_flip_string(sclp_vt220_tty, buffer, count);
                 tty_flip_buffer_push(sclp_vt220_tty);
                 break;
         }
diff --git a/drivers/s390/net/ctctty.c b/drivers/s390/net/ctctty.c
index 968f2c113efe..93d1725eb79b 100644
--- a/drivers/s390/net/ctctty.c
+++ b/drivers/s390/net/ctctty.c
@@ -25,6 +25,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/serial_reg.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -101,25 +102,17 @@ static spinlock_t ctc_tty_lock;
 static int
 ctc_tty_try_read(ctc_tty_info * info, struct sk_buff *skb)
 {
-        int c;
         int len;
         struct tty_struct *tty;
 
         DBF_TEXT(trace, 5, __FUNCTION__);
         if ((tty = info->tty)) {
                 if (info->mcr & UART_MCR_RTS) {
-                        c = TTY_FLIPBUF_SIZE - tty->flip.count;
                         len = skb->len;
-                        if (c >= len) {
-                                memcpy(tty->flip.char_buf_ptr, skb->data, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                tty->flip.count += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
-                                tty_flip_buffer_push(tty);
-                                kfree_skb(skb);
-                                return 1;
-                        }
+                        tty_insert_flip_string(tty, skb->data, len);
+                        tty_flip_buffer_push(tty);
+                        kfree_skb(skb);
+                        return 1;
                 }
         }
         return 0;
@@ -138,19 +131,12 @@ ctc_tty_readmodem(ctc_tty_info *info)
         DBF_TEXT(trace, 5, __FUNCTION__);
         if ((tty = info->tty)) {
                 if (info->mcr & UART_MCR_RTS) {
-                        int c = TTY_FLIPBUF_SIZE - tty->flip.count;
                         struct sk_buff *skb;
                         
-                        if ((c > 0) && (skb = skb_dequeue(&info->rx_queue))) {
+                        if ((skb = skb_dequeue(&info->rx_queue))) {
                                 int len = skb->len;
-                                if (len > c)
-                                        len = c;
-                                memcpy(tty->flip.char_buf_ptr, skb->data, len);
+                                tty_insert_flip_string(tty, skb->data, len);
                                 skb_pull(skb, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                tty->flip.count += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
                                 tty_flip_buffer_push(tty);
                                 if (skb->len > 0)
                                         skb_queue_head(&info->rx_queue, skb);
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index b5cf39468d18..221999bcf8fe 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -94,15 +94,6 @@ static irqreturn_t serial21285_rx_chars(int irq, void *dev_id, struct pt_regs *r
 
         status = *CSR_UARTFLG;
         while (!(status & 0x10) && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
-
                 ch = *CSR_UARTDR;
                 flag = TTY_NORMAL;
                 port->icount.rx++;
diff --git a/drivers/serial/68328serial.c b/drivers/serial/68328serial.c
index 67e9afa000c1..4dd5c3f98167 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/serial/68328serial.c
@@ -294,7 +294,7 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
 {
         struct tty_struct *tty = info->tty;
         m68328_uart *uart = &uart_addr[info->line];
-        unsigned char ch;
+        unsigned char ch, flag;
 
         /*
          * This do { } while() loop will get ALL chars out of Rx FIFO 
@@ -332,26 +332,24 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
                 /*
                  * Make sure that we do not overflow the buffer
                  */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                if (tty_request_buffer_room(tty, 1) == 0) {
                         schedule_work(&tty->flip.work);
                         return;
                 }
 
+                flag = TTY_NORMAL;
+
                 if(rx & URX_PARITY_ERROR) {
-                        *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                        flag = TTY_PARITY;
                         status_handle(info, rx);
                 } else if(rx & URX_OVRUN) {
-                        *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        flag = TTY_OVERRUN;
                         status_handle(info, rx);
                 } else if(rx & URX_FRAME_ERROR) {
-                        *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                        flag = TTY_FRAME;
                         status_handle(info, rx);
-                } else {
-                        *tty->flip.flag_buf_ptr++ = 0; /* XXX */
                 }
-                *tty->flip.char_buf_ptr++ = ch;
-                tty->flip.count++;
-
+                tty_insert_flip_char(tty, ch, flag);
 #ifndef CONFIG_XCOPILOT_BUGS
         } while((rx = uart->urx.w) & URX_DATA_READY);
 #endif
diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
index 170c9d2a749c..60f5a5dc17f1 100644
--- a/drivers/serial/68360serial.c
+++ b/drivers/serial/68360serial.c
@@ -394,7 +394,7 @@ static void rs_360_start(struct tty_struct *tty)
 static _INLINE_ void receive_chars(ser_info_t *info)
 {
         struct tty_struct *tty = info->tty;
-        unsigned char ch, *cp;
+        unsigned char ch, flag, *cp;
         /*int   ignored = 0;*/
         int     i;
         ushort  status;
@@ -438,24 +438,15 @@ static _INLINE_ void receive_chars(ser_info_t *info)
                 cp = (char *)bdp->buf;
                 status = bdp->status;
 
-                /* Check to see if there is room in the tty buffer for
-                 * the characters in our BD buffer.  If not, we exit
-                 * now, leaving the BD with the characters.  We'll pick
-                 * them up again on the next receive interrupt (which could
-                 * be a timeout).
-                 */
-                if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE)
-                        break;
-
                 while (i-- > 0) {
                         ch = *cp++;
-                        *tty->flip.char_buf_ptr = ch;
                         icount->rx++;
 
 #ifdef SERIAL_DEBUG_INTR
                         printk("DR%02x:%02x...", ch, status);
 #endif
-                        *tty->flip.flag_buf_ptr = 0;
+                        flag = TTY_NORMAL;
+
                         if (status & (BD_SC_BR | BD_SC_FR |
                                        BD_SC_PR | BD_SC_OV)) {
                                 /*
@@ -490,30 +481,18 @@ static _INLINE_ void receive_chars(ser_info_t *info)
                                         if (info->flags & ASYNC_SAK)
                                                 do_SAK(tty);
                                 } else if (status & BD_SC_PR)
-                                        *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                 else if (status & BD_SC_FR)
-                                        *tty->flip.flag_buf_ptr = TTY_FRAME;
-                                if (status & BD_SC_OV) {
-                                        /*
-                                         * Overrun is special, since it's
-                                         * reported immediately, and doesn't
-                                         * affect the current character
-                                         */
-                                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                                tty->flip.count++;
-                                                tty->flip.flag_buf_ptr++;
-                                                tty->flip.char_buf_ptr++;
-                                                *tty->flip.flag_buf_ptr =
-                                                                TTY_OVERRUN;
-                                        }
-                                }
+                                        flag = TTY_FRAME;
                         }
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                break;
-
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, ch, flag);
+                        if (status & BD_SC_OV)
+                                /*
+                                 * Overrun is special, since it's
+                                 * reported immediately, and doesn't
+                                 * affect the current character
+                                 */
+                                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                 }
 
                 /* This BD is ready to be used again.  Clear status.
@@ -541,12 +520,7 @@ static _INLINE_ void receive_break(ser_info_t *info)
         /* Check to see if there is room in the tty buffer for
          * the break.  If not, we exit now, losing the break.  FIXME
          */
-        if ((tty->flip.count + 1) >= TTY_FLIPBUF_SIZE)
-                return;
-        *(tty->flip.flag_buf_ptr++) = TTY_BREAK;
-        *(tty->flip.char_buf_ptr++) = 0;
-        tty->flip.count++;
-
+        tty_insert_flip_char(tty, 0, TTY_BREAK);
         schedule_work(&tty->flip.work);
 }
 
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index e8454611cb65..54e5cc0dd5f8 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1142,19 +1142,6 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
         char flag;
 
         do {
-                /* The following is not allowed by the tty layer and
-                   unsafe. It should be fixed ASAP */
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency) {
-                                spin_unlock(&up->port.lock);
-                                tty_flip_buffer_push(tty);
-                                spin_lock(&up->port.lock);
-                        }
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                 ch = serial_inp(up, UART_RX);
                 flag = TTY_NORMAL;
                 up->port.icount.rx++;
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 48f6e872314b..3490022e9fdc 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -154,15 +154,6 @@ pl010_rx_chars(struct uart_port *port)
 
         status = UART_GET_FR(port);
         while (UART_RX_DATA(status) && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts.
-                         */
-                }
-
                 ch = UART_GET_CHAR(port);
                 flag = TTY_NORMAL;
 
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 129670556162..034a029e356e 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -120,15 +120,6 @@ pl011_rx_chars(struct uart_amba_port *uap)
 
         status = readw(uap->port.membase + UART01x_FR);
         while ((status & UART01x_FR_RXFE) == 0 && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
-
                 ch = readw(uap->port.membase + UART01x_DR) | UART_DUMMY_DR_RX;
                 flag = TTY_NORMAL;
                 uap->port.icount.rx++;
diff --git a/drivers/serial/au1x00_uart.c b/drivers/serial/au1x00_uart.c
index a274ebf256a1..ceb5d7f37bbd 100644
--- a/drivers/serial/au1x00_uart.c
+++ b/drivers/serial/au1x00_uart.c
@@ -241,18 +241,12 @@ static _INLINE_ void
 receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
 {
         struct tty_struct *tty = up->port.info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
         int max_count = 256;
 
         do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return; // if TTY_DONT_FLIP is set
-                }
                 ch = serial_inp(up, UART_RX);
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 up->port.icount.rx++;
 
                 if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -292,30 +286,23 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
 #endif
                         if (*status & UART_LSR_BI) {
                                 DEBUG_INTR("handling break....");
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
+                if ((*status & up->port.ignore_status_mask) == 0)
+                        tty_insert_flip_char(tty, ch, flag);
+                if (*status & UART_LSR_OE)
                         /*
                          * Overrun is special, since it's reported
                          * immediately, and doesn't affect the current
                          * character.
                          */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                 }
         ignore_char:
                 *status = serial_inp(up, UART_LSR);
diff --git a/drivers/serial/clps711x.c b/drivers/serial/clps711x.c
index 87ef368384fb..8ef999481f93 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/serial/clps711x.c
@@ -104,8 +104,6 @@ static irqreturn_t clps711xuart_int_rx(int irq, void *dev_id, struct pt_regs *re
         while (!(status & SYSFLG_URXFE)) {
                 ch = clps_readl(UARTDR(port));
 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto ignore_char;
                 port->icount.rx++;
 
                 flg = TTY_NORMAL;
diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
index 4d8516d1bb71..a64ba26a94e8 100644
--- a/drivers/serial/dz.c
+++ b/drivers/serial/dz.c
@@ -216,8 +216,6 @@ static inline void dz_receive_chars(struct dz_port *dport)
 
                 if (!tty)
                         break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
 
                 icount->rx++;
 
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index eb31125c6a30..144a7a352b28 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -729,19 +729,20 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
         unsigned short int status;
         struct uart_icount *icount;
         unsigned long offset;
+        unsigned char flag;
 
         trace(icom_port, "RCV_COMPLETE", 0);
         rcv_buff = icom_port->next_rcv;
 
         status = cpu_to_le16(icom_port->statStg->rcv[rcv_buff].flags);
         while (status & SA_FL_RCV_DONE) {
+                int first = -1;
 
                 trace(icom_port, "FID_STATUS", status);
                 count = cpu_to_le16(icom_port->statStg->rcv[rcv_buff].leLength);
 
+                count = tty_buffer_request_room(tty, count);
                 trace(icom_port, "RCV_COUNT", count);
-                if (count > (TTY_FLIPBUF_SIZE - tty->flip.count))
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
 
                 trace(icom_port, "REAL_COUNT", count);
 
@@ -749,15 +750,10 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                         cpu_to_le32(icom_port->statStg->rcv[rcv_buff].leBuffer) -
                         icom_port->recv_buf_pci;
 
-                memcpy(tty->flip.char_buf_ptr,(unsigned char *)
-                       ((unsigned long)icom_port->recv_buf + offset), count);
-
+                /* Block copy all but the last byte as this may have status */
                 if (count > 0) {
-                        tty->flip.count += count - 1;
-                        tty->flip.char_buf_ptr += count - 1;
-
-                        memset(tty->flip.flag_buf_ptr, 0, count);
-                        tty->flip.flag_buf_ptr += count - 1;
+                        first = icom_port->recv_buf[offset];
+                        tty_insert_flip_string(tty, icom_port->recv_buf + offset, count - 1);
                 }
 
                 icount = &icom_port->uart_port.icount;
@@ -765,12 +761,14 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
 
                 /* Break detect logic */
                 if ((status & SA_FLAGS_FRAME_ERROR)
-                    && (tty->flip.char_buf_ptr[0] == 0x00)) {
+                    && first == 0) {
                         status &= ~SA_FLAGS_FRAME_ERROR;
                         status |= SA_FLAGS_BREAK_DET;
                         trace(icom_port, "BREAK_DET", 0);
                 }
 
+                flag = TTY_NORMAL;
+
                 if (status &
                     (SA_FLAGS_BREAK_DET | SA_FLAGS_PARITY_ERROR |
                      SA_FLAGS_FRAME_ERROR | SA_FLAGS_OVERRUN)) {
@@ -797,33 +795,26 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                         status &= icom_port->read_status_mask;
 
                         if (status & SA_FLAGS_BREAK_DET) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         } else if (status & SA_FLAGS_PARITY_ERROR) {
                                 trace(icom_port, "PARITY_ERROR", 0);
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         } else if (status & SA_FLAGS_FRAME_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
-
-                        if (status & SA_FLAGS_OVERRUN) {
-                                /*
-                                 * Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                }
-                        }
+                                flag = TTY_FRAME;
+
                 }
 
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
-                ignore_char:
-                        icom_port->statStg->rcv[rcv_buff].flags = 0;
+                tty_insert_flip_char(tty, *(icom_port->recv_buf + offset + count - 1), flag);
+
+                if (status & SA_FLAGS_OVERRUN)
+                        /*
+                         * Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+ignore_char:
+                icom_port->statStg->rcv[rcv_buff].flags = 0;
                 icom_port->statStg->rcv[rcv_buff].leLength = 0;
                 icom_port->statStg->rcv[rcv_buff].WorkingLength =
                         (unsigned short int) cpu_to_le16(RCV_BUFF_SZ);
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 83c4c1216587..5c098be9346b 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -256,9 +256,6 @@ static irqreturn_t imx_rxint(int irq, void *dev_id, struct pt_regs *regs)
         error_return:
                 tty_insert_flip_char(tty, rx, flg);
 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto out;
-
         ignore_char:
                 rx = URXD0((u32)sport->port.membase);
         } while(rx & URXD_CHARRDY);
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 771676abee60..1d85533d46d2 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2327,19 +2327,13 @@ static void receive_chars(struct uart_port *the_port)
         spin_lock_irqsave(&the_port->lock, pflags);
         tty = info->tty;
 
-        if (request_count > TTY_FLIPBUF_SIZE - tty->flip.count)
-                request_count = TTY_FLIPBUF_SIZE - tty->flip.count;
+        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS - 2);
 
         if (request_count > 0) {
                 icount = &the_port->icount;
                 read_count = do_read(the_port, ch, request_count);
                 if (read_count > 0) {
-                        flip = 1;
-                        memcpy(tty->flip.char_buf_ptr, ch, read_count);
-                        memset(tty->flip.flag_buf_ptr, TTY_NORMAL, read_count);
-                        tty->flip.char_buf_ptr += read_count;
-                        tty->flip.flag_buf_ptr += read_count;
-                        tty->flip.count += read_count;
+                        tty_insert_flip_string(tty, ch, read_count);
                         icount->rx += read_count;
                 }
         }
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index ef132349f310..66f117d15065 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -259,13 +259,7 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
         struct tty_struct *tty = up->port.info->tty;    /* XXX info==NULL? */
 
         while (1) {
-                unsigned char ch, r1;
-
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return;         /* XXX Ignores SysRq when we need it most. Fix. */
-                }
+                unsigned char ch, r1, flag;
 
                 r1 = read_zsreg(channel, R1);
                 if (r1 & (PAR_ERR | Rx_OVR | CRC_ERR)) {
@@ -303,8 +297,7 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
                 }
 
                 /* A real serial line, record the character and status.  */
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 up->port.icount.rx++;
                 if (r1 & (BRK_ABRT | PAR_ERR | Rx_OVR | CRC_ERR)) {
                         if (r1 & BRK_ABRT) {
@@ -321,28 +314,21 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
                                 up->port.icount.overrun++;
                         r1 &= up->port.read_status_mask;
                         if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto next_char;
 
                 if (up->port.ignore_status_mask == 0xff ||
-                    (r1 & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
+                    (r1 & up->port.ignore_status_mask) == 0)
+                        tty_insert_flip_char(tty, ch, flag);
+
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         next_char:
                 ch = readb(&channel->control);
                 ZSDELAY();
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index b0ecc7537ce5..b48066a64a7d 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -331,17 +331,12 @@ static _INLINE_ void receive_chars(struct uart_sio_port *up, int *status,
 {
         struct tty_struct *tty = up->port.info->tty;
         unsigned char ch;
+        unsigned char flag;
         int max_count = 256;
 
         do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return; // if TTY_DONT_FLIP is set
-                }
                 ch = sio_in(up, SIORXB);
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 up->port.icount.rx++;
 
                 if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -380,30 +375,24 @@ static _INLINE_ void receive_chars(struct uart_sio_port *up, int *status,
 
                         if (*status & UART_LSR_BI) {
                                 DEBUG_INTR("handling break....");
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
+                if ((*status & up->port.ignore_status_mask) == 0)
+                        tty_insert_flip_char(tty, ch, flag);
+
+                if (*status & UART_LSR_OE) {
                         /*
                          * Overrun is special, since it's reported
                          * immediately, and doesn't affect the current
                          * character.
                          */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                 }
         ignore_char:
                 *status = serial_in(up, UART_LSR);
diff --git a/drivers/serial/mcfserial.c b/drivers/serial/mcfserial.c
index 47f7404cb045..f2a51e61eec7 100644
--- a/drivers/serial/mcfserial.c
+++ b/drivers/serial/mcfserial.c
@@ -313,7 +313,7 @@ static inline void receive_chars(struct mcf_serial *info)
 {
         volatile unsigned char  *uartp;
         struct tty_struct       *tty = info->tty;
-        unsigned char           status, ch;
+        unsigned char           status, ch, flag;
 
         if (!tty)
                 return;
@@ -321,10 +321,6 @@ static inline void receive_chars(struct mcf_serial *info)
         uartp = info->addr;
 
         while ((status = uartp[MCFUART_USR]) & MCFUART_USR_RXREADY) {
-
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-
                 ch = uartp[MCFUART_URB];
                 info->stats.rx++;
 
@@ -335,29 +331,24 @@ static inline void receive_chars(struct mcf_serial *info)
                 }
 #endif
 
-                tty->flip.count++;
+                flag = TTY_NORMAL;
                 if (status & MCFUART_USR_RXERR) {
                         uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETERR;
                         if (status & MCFUART_USR_RXBREAK) {
                                 info->stats.rxbreak++;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                flag = TTY_BREAK;
                         } else if (status & MCFUART_USR_RXPARITY) {
                                 info->stats.rxparity++;
-                                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                                flag = TTY_PARITY;
                         } else if (status & MCFUART_USR_RXOVERRUN) {
                                 info->stats.rxoverrun++;
-                                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                                flag = TTY_OVERRUN;
                         } else if (status & MCFUART_USR_RXFRAMING) {
                                 info->stats.rxframing++;
-                                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
-                        } else {
-                                /* This should never happen... */
-                                *tty->flip.flag_buf_ptr++ = 0;
+                                flag = TTY_FRAME;
                         }
-                } else {
-                        *tty->flip.flag_buf_ptr++ = 0;
                 }
-                *tty->flip.char_buf_ptr++ = ch;
+                tty_insert_flip_char(tty, ch, flag);
         }
 
         schedule_work(&tty->flip.work);
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 1288d6203e94..61dd17d7bace 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -405,17 +405,13 @@ static inline int
 mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
 {
         struct tty_struct *tty = port->info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
         unsigned short status;
 
         /* While we can read, do so ! */
         while ( (status = in_be16(&PSC(port)->mpc52xx_psc_status)) &
                 MPC52xx_PSC_SR_RXRDY) {
 
-                /* If we are full, just stop reading */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-                
                 /* Get the char */
                 ch = in_8(&PSC(port)->mpc52xx_psc_buffer_8);
 
@@ -428,45 +424,35 @@ mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
 #endif
 
                 /* Store it */
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = 0;
+
+                flag = TTY_NORMAL;
                 port->icount.rx++;
         
                 if ( status & (MPC52xx_PSC_SR_PE |
                                MPC52xx_PSC_SR_FE |
-                               MPC52xx_PSC_SR_RB |
-                               MPC52xx_PSC_SR_OE) ) {
+                               MPC52xx_PSC_SR_RB) ) {
                         
                         if (status & MPC52xx_PSC_SR_RB) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                                 uart_handle_break(port);
                         } else if (status & MPC52xx_PSC_SR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (status & MPC52xx_PSC_SR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
-                        if (status & MPC52xx_PSC_SR_OE) {
-                                /*
-                                 * Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < (TTY_FLIPBUF_SIZE-1)) {
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        tty->flip.count++;
-                                }
-                                *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        }
+                                flag = TTY_FRAME;
 
                         /* Clear error condition */
                         out_8(&PSC(port)->command,MPC52xx_PSC_RST_ERR_STAT);
 
                 }
-
-                tty->flip.char_buf_ptr++;
-                tty->flip.flag_buf_ptr++;
-                tty->flip.count++;
-
+                tty_insert_flip_char(tty, ch, flag);
+                if (status & MPC52xx_PSC_SR_OE) {
+                        /*
+                         * Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                }
         }
 
         tty_flip_buffer_push(tty);
diff --git a/drivers/serial/mpsc.c b/drivers/serial/mpsc.c
index 8f83e4007ecd..0ca83ac31d07 100644
--- a/drivers/serial/mpsc.c
+++ b/drivers/serial/mpsc.c
@@ -769,12 +769,12 @@ mpsc_rx_intr(struct mpsc_port_info *pi, struct pt_regs *regs)
                 bytes_in = be16_to_cpu(rxre->bytecnt);
 
                 /* Following use of tty struct directly is deprecated */
-                if (unlikely((tty->flip.count + bytes_in) >= TTY_FLIPBUF_SIZE)){
+                if (unlikely(tty_buffer_request_room(tty, bytes_in) < bytes_in)) {
                         if (tty->low_latency)
                                 tty_flip_buffer_push(tty);
                         /*
-                         * If this failed then we will throw awa the bytes
-                         * but mst do so to clear interrupts.
+                         * If this failed then we will throw away the bytes
+                         * but must do so to clear interrupts.
                          */
                 }
 
diff --git a/drivers/serial/mux.c b/drivers/serial/mux.c
index 7633132a10aa..4e49168c3176 100644
--- a/drivers/serial/mux.c
+++ b/drivers/serial/mux.c
@@ -223,11 +223,6 @@ static void mux_read(struct uart_port *port)
                 if (MUX_EOFIFO(data))
                         break;
 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        continue;
-
-                *tty->flip.char_buf_ptr = data & 0xffu;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                 port->icount.rx++;
 
                 if (MUX_BREAK(data)) {
@@ -239,9 +234,7 @@ static void mux_read(struct uart_port *port)
                 if (uart_handle_sysrq_char(port, data & 0xffu, NULL))
                         continue;
 
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
+                tty_insert_flip_char(tty, data & 0xFF, TTY_NORMAL);
         }
         
         if (start_count != port->icount.rx) {
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index ea24129eb6b9..f330d6c0e0df 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -210,10 +210,9 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                                             struct pt_regs *regs)
 {
         struct tty_struct *tty = NULL;
-        unsigned char ch, r1, drop, error;
+        unsigned char ch, r1, drop, error, flag;
         int loops = 0;
 
- retry:
         /* The interrupt can be enabled when the port isn't open, typically
          * that happens when using one port is open and the other closed (stale
          * interrupt) or when one port is used as a console.
@@ -246,20 +245,6 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                 error = 0;
                 drop = 0;
 
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        /* Have to drop the lock here */
-                        pmz_debug("pmz: flip overflow\n");
-                        spin_unlock(&uap->port.lock);
-                        tty->flip.work.func((void *)tty);
-                        spin_lock(&uap->port.lock);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                drop = 1;
-                        if (ZS_IS_ASLEEP(uap))
-                                return NULL;
-                        if (!ZS_IS_OPEN(uap))
-                                goto retry;
-                }
-
                 r1 = read_zsreg(uap, R1);
                 ch = read_zsdata(uap);
 
@@ -295,8 +280,7 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                 if (drop)
                         goto next_char;
 
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 uap->port.icount.rx++;
 
                 if (r1 & (PAR_ERR | Rx_OVR | CRC_ERR | BRK_ABRT)) {
@@ -316,26 +300,19 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                                 uap->port.icount.overrun++;
                         r1 &= uap->port.read_status_mask;
                         if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
 
                 if (uap->port.ignore_status_mask == 0xff ||
                     (r1 & uap->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, ch, flag);
                 }
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         next_char:
                 /* We can get stuck in an infinite loop getting char 0 when the
                  * line is in a wrong HW state, we break that here.
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index cc998b99a19f..10535f00301f 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -107,14 +107,6 @@ receive_chars(struct uart_pxa_port *up, int *status, struct pt_regs *regs)
         int max_count = 256;
 
         do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                 ch = serial_in(up, UART_RX);
                 flag = TTY_NORMAL;
                 up->port.icount.rx++;
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index fe83ce6fef52..eb4883efb7c6 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -323,16 +323,6 @@ s3c24xx_serial_rx_chars(int irq, void *dev_id, struct pt_regs *regs)
                 if (s3c24xx_serial_rx_fifocnt(ourport, ufstat) == 0)
                         break;
 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
-
                 uerstat = rd_regl(port, S3C2410_UERSTAT);
                 ch = rd_regb(port, S3C2410_URXH);
 
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index 25a086458ab9..1bd93168f504 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -201,8 +201,6 @@ sa1100_rx_chars(struct sa1100_port *sport, struct pt_regs *regs)
         while (status & UTSR1_TO_SM(UTSR1_RNE)) {
                 ch = UART_GET_CHAR(sport);
 
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto ignore_char;
                 sport->port.icount.rx++;
 
                 flg = TTY_NORMAL;
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index d01dbe5da3b9..d4a1f0e798c1 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -148,15 +148,6 @@ lh7a40xuart_rx_chars (struct uart_port* port)
         unsigned int data, flag;/* Received data and status */
 
         while (!(UR (port, UART_R_STATUS) & nRxRdy) && --cbRxMax) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
-
                 data = UR (port, UART_R_DATA);
                 flag = TTY_NORMAL;
                 ++port->icount.rx;
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index 995d9dd9ddd5..fdd1f1915a42 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -303,17 +303,6 @@ receive_chars(struct uart_txx9_port *up, unsigned int *status, struct pt_regs *r
         char flag;
 
         do {
-                /* The following is not allowed by the tty layer and
-                   unsafe. It should be fixed ASAP */
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency) {
-                                spin_unlock(&up->port.lock);
-                                tty_flip_buffer_push(tty);
-                                spin_lock(&up->port.lock);
-                        }
-                        /* If this failed then we will throw away the
-                           bytes but must do so to clear interrupts */
-                }
                 ch = sio_in(up, TXX9_SIRFIFO);
                 flag = TTY_NORMAL;
                 up->port.icount.rx++;
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 430754ebac8a..a9e070759628 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -482,6 +482,7 @@ static inline void sci_receive_chars(struct uart_port *port,
         struct tty_struct *tty = port->info->tty;
         int i, count, copied = 0;
         unsigned short status;
+        unsigned char flag;
 
         status = sci_in(port, SCxSR);
         if (!(status & SCxSR_RDxF(port)))
@@ -499,8 +500,7 @@ static inline void sci_receive_chars(struct uart_port *port,
 #endif
 
                 /* Don't copy more bytes than there is room for in the buffer */
-                if (tty->flip.count + count > TTY_FLIPBUF_SIZE)
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
+                count = tty_buffer_request_room(tty, count);
 
                 /* If for any reason we can't copy more data, we're done! */
                 if (count == 0)
@@ -512,8 +512,7 @@ static inline void sci_receive_chars(struct uart_port *port,
                             || uart_handle_sysrq_char(port, c, regs)) {
                                 count = 0;
                         } else {
-                            tty->flip.char_buf_ptr[0] = c;
-                            tty->flip.flag_buf_ptr[0] = TTY_NORMAL;
+                            tty_insert_flip_char(tty, c, TTY_NORMAL);
                         }
                 } else {
                         for (i=0; i<count; i++) {
@@ -542,26 +541,21 @@ static inline void sci_receive_chars(struct uart_port *port,
                                 }
 
                                 /* Store data and status */
-                                tty->flip.char_buf_ptr[i] = c;
                                 if (status&SCxSR_FER(port)) {
-                                        tty->flip.flag_buf_ptr[i] = TTY_FRAME;
+                                        flag = TTY_FRAME;
                                         pr_debug("sci: frame error\n");
                                 } else if (status&SCxSR_PER(port)) {
-                                        tty->flip.flag_buf_ptr[i] = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                         pr_debug("sci: parity error\n");
-                                } else {
-                                        tty->flip.flag_buf_ptr[i] = TTY_NORMAL;
-                                }
+                                } else
+                                        flag = TTY_NORMAL;
+                                tty_insert_flip_char(tty, c, flag);
                         }
                 }
 
                 sci_in(port, SCxSR); /* dummy read */
                 sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
 
-                /* Update the kernel buffer end */
-                tty->flip.count += count;
-                tty->flip.char_buf_ptr += count;
-                tty->flip.flag_buf_ptr += count;
                 copied += count;
                 port->icount.rx += count;
         }
@@ -608,48 +602,45 @@ static inline int sci_handle_errors(struct uart_port *port)
         unsigned short status = sci_in(port, SCxSR);
         struct tty_struct *tty = port->info->tty;
 
-        if (status&SCxSR_ORER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_ORER(port)) {
                 /* overrun error */
-                copied++;
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                if(tty_insert_flip_char(tty, 0, TTY_OVERRUN))
+                        copied++;
                 pr_debug("sci: overrun error\n");
         }
 
-        if (status&SCxSR_FER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_FER(port)) {
                 if (sci_rxd_in(port) == 0) {
                         /* Notify of BREAK */
                         struct sci_port * sci_port = (struct sci_port *)port;
-                       if(!sci_port->break_flag) {
-                                sci_port->break_flag = 1;
-                               sci_schedule_break_timer((struct sci_port *)port);
+                        if(!sci_port->break_flag) {
+                                sci_port->break_flag = 1;
+                                sci_schedule_break_timer((struct sci_port *)port);
                                 /* Do sysrq handling. */
-                                if(uart_handle_break(port)) {
+                                if(uart_handle_break(port))
                                         return 0;
-                                }
                                 pr_debug("sci: BREAK detected\n");
-                                copied++;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                if(tty_insert_flip_char(tty, 0, TTY_BREAK))
+                                        copied++;
                        }
                 }
                 else {
                         /* frame error */
-                        copied++;
-                        *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                        if(tty_insert_flip_char(tty, 0, TTY_FRAME))
+                                copied++;
                         pr_debug("sci: frame error\n");
                 }
         }
 
-        if (status&SCxSR_PER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_PER(port)) {
+                if(tty_insert_flip_char(tty, 0, TTY_PARITY))
+                        copied++;
                 /* parity error */
-                copied++;
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
                 pr_debug("sci: parity error\n");
         }
 
-        if (copied) {
-                tty->flip.count += copied;
+        if (copied)
                 tty_flip_buffer_push(tty);
-        }
 
         return copied;
 }
@@ -661,15 +652,14 @@ static inline int sci_handle_breaks(struct uart_port *port)
         struct tty_struct *tty = port->info->tty;
         struct sci_port *s = &sci_ports[port->line];
 
-        if (!s->break_flag && status & SCxSR_BRK(port) &&
-            tty->flip.count < TTY_FLIPBUF_SIZE) {
+        if (!s->break_flag && status & SCxSR_BRK(port))
 #if defined(CONFIG_CPU_SH3)
                 /* Debounce break */
                 s->break_flag = 1;
 #endif
                 /* Notify of BREAK */
-                copied++;
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                if(tty_insert_flip_char(tty, 0, TTY_BREAK))
+                        copied++;
                 pr_debug("sci: BREAK detected\n");
         }
 
@@ -677,19 +667,15 @@ static inline int sci_handle_breaks(struct uart_port *port)
         /* XXX: Handle SCIF overrun error */
         if (port->type == PORT_SCIF && (sci_in(port, SCLSR) & SCIF_ORER) != 0) {
                 sci_out(port, SCLSR, 0);
-                if(tty->flip.count<TTY_FLIPBUF_SIZE) {
+                if(tty_insert_flip_char(tty, 0, TTY_OVERRUN)) {
                         copied++;
-                        *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
                         pr_debug("sci: overrun error\n");
                 }
         }
 #endif
 
-        if (copied) {
-                tty->flip.count += copied;
+        if (copied)
                 tty_flip_buffer_push(tty);
-        }
-
         return copied;
 }
 
@@ -732,12 +718,9 @@ static irqreturn_t sci_er_interrupt(int irq, void *ptr, struct pt_regs *regs)
                         struct tty_struct *tty = port->info->tty;
 
                         sci_out(port, SCLSR, 0);
-                        if(tty->flip.count<TTY_FLIPBUF_SIZE) {
-                                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
-                                tty->flip.count++;
-                                tty_flip_buffer_push(tty);
-                                pr_debug("scif: overrun error\n");
-                        }
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                        tty_flip_buffer_push(tty);
+                        pr_debug("scif: overrun error\n");
                 }
 #endif
                 sci_rx_interrupt(irq, ptr, regs);
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 313f9df24a2d..5468e5a767e2 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -519,11 +519,7 @@ sn_receive_chars(struct sn_cons_port *port, struct pt_regs *regs,
 
                 /* record the character to pass up to the tty layer */
                 if (tty) {
-                        *tty->flip.char_buf_ptr = ch;
-                        *tty->flip.flag_buf_ptr = TTY_NORMAL;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                        if (tty->flip.count == TTY_FLIPBUF_SIZE)
+                        if(tty_insert_flip_char(tty, ch, TTY_NORMAL) == 0)
                                 break;
                 }
                 port->sc_port.icount.rx++;
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index ba9381fd3f2d..7e773ff76c61 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -159,21 +159,14 @@ receive_chars(struct uart_sunsab_port *up,
                 saw_console_brk = 1;
 
         for (i = 0; i < count; i++) {
-                unsigned char ch = buf[i];
+                unsigned char ch = buf[i], flag;
 
                 if (tty == NULL) {
                         uart_handle_sysrq_char(&up->port, ch, regs);
                         continue;
                 }
 
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return tty; // if TTY_DONT_FLIP is set
-                }
-
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 up->port.icount.rx++;
 
                 if (unlikely(stat->sreg.isr0 & (SAB82532_ISR0_PERR |
@@ -209,34 +202,21 @@ receive_chars(struct uart_sunsab_port *up,
                         stat->sreg.isr1 &= ((up->port.read_status_mask >> 8) & 0xff);
 
                         if (stat->sreg.isr1 & SAB82532_ISR1_BRK) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         } else if (stat->sreg.isr0 & SAB82532_ISR0_PERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (stat->sreg.isr0 & SAB82532_ISR0_FERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
 
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         continue;
 
                 if ((stat->sreg.isr0 & (up->port.ignore_status_mask & 0xff)) == 0 &&
-                    (stat->sreg.isr1 & ((up->port.ignore_status_mask >> 8) & 0xff)) == 0){
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((stat->sreg.isr0 & SAB82532_ISR0_RFO) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
+                    (stat->sreg.isr1 & ((up->port.ignore_status_mask >> 8) & 0xff)) == 0)
+                        tty_insert_flip_char(tty, ch, flag);
+                if (stat->sreg.isr0 & SAB82532_ISR0_RFO)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         }
 
         if (saw_console_brk)
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index f0738533f39a..9a3665b34d97 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -323,19 +323,13 @@ static _INLINE_ struct tty_struct *
 receive_chars(struct uart_sunsu_port *up, unsigned char *status, struct pt_regs *regs)
 {
         struct tty_struct *tty = up->port.info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
         int max_count = 256;
         int saw_console_brk = 0;
 
         do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return tty; // if TTY_DONT_FLIP is set
-                }
                 ch = serial_inp(up, UART_RX);
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 up->port.icount.rx++;
 
                 if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -377,31 +371,23 @@ receive_chars(struct uart_sunsu_port *up, unsigned char *status, struct pt_regs
                         }
 
                         if (*status & UART_LSR_BI) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
+                if ((*status & up->port.ignore_status_mask) == 0)
+                        tty_insert_flip_char(tty, ch, flag);
+                if (*status & UART_LSR_OE)
                         /*
                          * Overrun is special, since it's reported
                          * immediately, and doesn't affect the current
                          * character.
                          */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
+                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         ignore_char:
                 *status = serial_inp(up, UART_LSR);
         } while ((*status & UART_LSR_DR) && (max_count-- > 0));
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 7653d6cf05af..3c72484adea7 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -319,7 +319,7 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                        struct pt_regs *regs)
 {
         struct tty_struct *tty;
-        unsigned char ch, r1;
+        unsigned char ch, r1, flag;
 
         tty = NULL;
         if (up->port.info != NULL &&            /* Unopened serial console */
@@ -362,19 +362,8 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                         continue;
                 }
 
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        /*
-                         * The 8250 bails out of the loop here,
-                         * but we need to read everything, or die.
-                         */
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                continue;
-                }
-
                 /* A real serial line, record the character and status.  */
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
+                flag = TTY_NORMAL;
                 up->port.icount.rx++;
                 if (r1 & (BRK_ABRT | PAR_ERR | Rx_OVR | CRC_ERR)) {
                         if (r1 & BRK_ABRT) {
@@ -391,28 +380,21 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                                 up->port.icount.overrun++;
                         r1 &= up->port.read_status_mask;
                         if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                         else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                         else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         continue;
 
                 if (up->port.ignore_status_mask == 0xff ||
                     (r1 & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, ch, flag);
                 }
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
         }
 
         return tty;
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index 865d4dea65df..0a28deeb098d 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -371,11 +371,6 @@ static inline void receive_chars(struct uart_port *port, uint8_t *status,
         lsr = *status;
 
         do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                }
-
                 ch = siu_read(port, UART_RX);
                 port->icount.rx++;
                 flag = TTY_NORMAL;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 248279e44c99..b9fd39fd1b5b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -335,14 +335,9 @@ next_buffer:
 
         dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d\n", buf, buf->size);
 
-        for (i = 0; i < buf->size && !acm->throttle; i++) {
-                /* if we insert more than TTY_FLIPBUF_SIZE characters,
-                   we drop them. */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                }
-                tty_insert_flip_char(tty, buf->base[i], 0);
-        }
+        tty_buffer_request_room(tty, buf->size);
+        if (!acm->throttle)
+                tty_insert_flip_string(tty, buf->base, buf->size);
         tty_flip_buffer_push(tty);
 
         spin_lock(&acm->throttle_lock);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 65e084a2c87e..2e6926b33455 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1271,6 +1271,7 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
         unsigned int len;
         struct gs_port *port;
         int ret;
+        struct tty_struct *tty;
 
         /* TEMPORARY -- only port 0 is supported right now */
         port = dev->dev_port[0];
@@ -1290,7 +1291,10 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
                 goto exit;
         }
 
-        if (port->port_tty == NULL) {
+
+        tty = port->port_tty;
+
+        if (tty == NULL) {
                 printk(KERN_ERR "gs_recv_packet: port=%d, NULL tty pointer\n",
                         port->port_num);
                 ret = -EIO;
@@ -1304,20 +1308,13 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
                 goto exit;
         }
 
-        len = (unsigned int)(TTY_FLIPBUF_SIZE - port->port_tty->flip.count);
-        if (len < size)
-                size = len;
-
-        if (size > 0) {
-                memcpy(port->port_tty->flip.char_buf_ptr, packet, size);
-                port->port_tty->flip.char_buf_ptr += size;
-                port->port_tty->flip.count += size;
+        len = tty_buffer_request_room(tty, size);
+        if (len > 0) {
+                tty_insert_flip_string(tty, packet, len);
                 tty_flip_buffer_push(port->port_tty);
                 wake_up_interruptible(&port->port_tty->read_wait);
         }
-
         ret = 0;
-
 exit:
         spin_unlock(&port->port_lock);
         return ret;
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 14f55fd26a64..be5dc80836c3 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -84,7 +84,7 @@ config USB_SERIAL_BELKIN
 
 config USB_SERIAL_WHITEHEAT
         tristate "USB ConnectTech WhiteHEAT Serial Driver"
-        depends on USB_SERIAL && BROKEN_ON_SMP
+        depends on USB_SERIAL
         help
           Say Y here if you want to use a ConnectTech WhiteHEAT 4 port
           USB to serial converter device.
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 6d18d4eaba35..2357b1d102d7 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -364,7 +364,6 @@ static void cyberjack_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
         struct tty_struct *tty;
         unsigned char *data = urb->transfer_buffer;
         short todo;
-        int i;
         int result;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
@@ -381,14 +380,8 @@ static void cyberjack_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 return;
         }
         if (urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
                 tty_flip_buffer_push(tty);
         }
 
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 4e9637eb6137..68067fe117a4 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -1263,12 +1263,10 @@ static void cypress_read_int_callback(struct urb *urb, struct pt_regs *regs)
 
         /* process read if there is data other than line status */
         if (tty && (bytes > i)) {
+                bytes = tty_buffer_request_room(tty, bytes);
                 for (; i < bytes ; ++i) {
                         dbg("pushing byte number %d - %d - %c", i, data[i],
                                         data[i]);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
                         tty_insert_flip_char(tty, data[i], tty_flag);
                 }
                 tty_flip_buffer_push(port->tty);
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 8fc414bd5b24..b3f776a90c93 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -946,13 +946,10 @@ dbg( "digi_rx_unthrottle: TOP: port=%d", priv->dp_port_num );
         spin_lock_irqsave( &priv->dp_port_lock, flags );
 
         /* send any buffered chars from throttle time on to tty subsystem */
-        len = min(priv->dp_in_buf_len, TTY_FLIPBUF_SIZE - tty->flip.count );
+
+        len = tty_buffer_request_room(tty, priv->dp_in_buf_len);
         if( len > 0 ) {
-                memcpy( tty->flip.char_buf_ptr, priv->dp_in_buf, len );
-                memcpy( tty->flip.flag_buf_ptr, priv->dp_in_flag_buf, len );
-                tty->flip.char_buf_ptr += len;
-                tty->flip.flag_buf_ptr += len;
-                tty->flip.count += len;
+                tty_insert_flip_string_flags(tty, priv->dp_in_buf, priv->dp_in_flag_buf, len);
                 tty_flip_buffer_push( tty );
         }
 
@@ -1827,6 +1824,7 @@ static int digi_read_inb_callback( struct urb *urb )
         int status = ((unsigned char *)urb->transfer_buffer)[2];
         unsigned char *data = ((unsigned char *)urb->transfer_buffer)+3;
         int flag,throttled;
+        int i;
 
         /* do not process callbacks on closed ports */
         /* but do continue the read chain */
@@ -1885,20 +1883,18 @@ static int digi_read_inb_callback( struct urb *urb )
                         }
 
                 } else {
-
-                        len = min( len, TTY_FLIPBUF_SIZE - tty->flip.count );
-
+                        len = tty_buffer_request_room(tty, len);
                         if( len > 0 ) {
-                                memcpy( tty->flip.char_buf_ptr, data, len );
-                                memset( tty->flip.flag_buf_ptr, flag, len );
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.count += len;
+                                /* Hot path */
+                                if(flag == TTY_NORMAL)
+                                        tty_insert_flip_string(tty, data, len);
+                                else {
+                                        for(i = 0; i < len; i++)
+                                                tty_insert_flip_char(tty, data[i], flag);
+                                }
                                 tty_flip_buffer_push( tty );
                         }
-
                 }
-
         }
 
         spin_unlock( &priv->dp_port_lock );
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 79a766e9ca23..63f7c78a1152 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -344,7 +344,6 @@ static void empeg_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
         struct usb_serial_port *port = (struct usb_serial_port *)urb->context;
         struct tty_struct *tty;
         unsigned char *data = urb->transfer_buffer;
-        int i;
         int result;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
@@ -359,19 +358,8 @@ static void empeg_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
         tty = port->tty;
 
         if (urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
-                        /* gb - 2000/11/13
-                         * If we insert too many characters we'll overflow the buffer.
-                         * This means we'll lose bytes - Decidedly bad.
-                         */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                                }
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
-                /* gb - 2000/11/13
-                 * Goes straight through instead of scheduling - if tty->low_latency is set.
-                 */
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
                 tty_flip_buffer_push(tty);
                 bytes_in += urb->actual_length;
         }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index eb863b3f2d79..10bc1bf23b35 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1610,24 +1610,11 @@ static void ftdi_process_read (void *param)
                         length = 0;
                 }
 
-                /* have to make sure we don't overflow the buffer
-                   with tty_insert_flip_char's */
-                if (tty->flip.count+length > TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                        need_flip = 0;
-
-                        if (tty->flip.count != 0) {
-                                /* flip didn't work, this happens when ftdi_process_read() is
-                                 * called from ftdi_unthrottle, because TTY_DONT_FLIP is set */
-                                dbg("%s - flip buffer push failed", __FUNCTION__);
-                                break;
-                        }
-                }
                 if (priv->rx_flags & THROTTLED) {
                         dbg("%s - throttled", __FUNCTION__);
                         break;
                 }
-                if (tty->ldisc.receive_room(tty)-tty->flip.count < length) {
+                if (tty_buffer_request_room(tty, length) < length) {
                         /* break out & wait for throttling/unthrottling to happen */
                         dbg("%s - receive room low", __FUNCTION__);
                         break;
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 452efce72714..d6f55e9dccae 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -275,23 +275,14 @@ static void send_to_tty(struct usb_serial_port *port,
                         char *data, unsigned int actual_length)
 {
         struct tty_struct *tty = port->tty;
-        int i;
 
         if (tty && actual_length) {
 
                 usb_serial_debug_data(debug, &port->dev, 
                                         __FUNCTION__, actual_length, data);
 
-                for (i = 0; i < actual_length ; ++i) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters,
-                           we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless
-                           tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, actual_length);
+                tty_insert_flip_string(tty, data, actual_length);
                 tty_flip_buffer_push(tty);
         }
 }
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 4ddac620fc0c..476cda107f4f 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -254,7 +254,6 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
         struct usb_serial *serial = port->serial;
         struct tty_struct *tty;
         unsigned char *data = urb->transfer_buffer;
-        int i;
         int result;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
@@ -268,14 +267,8 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
 
         tty = port->tty;
         if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
                 tty_flip_buffer_push(tty);
         }
 
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index faedbeb6ba49..3f29e6b0fd19 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -1965,20 +1965,14 @@ static void edge_tty_recv(struct device *dev, struct tty_struct *tty, unsigned c
         int cnt;
 
         do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n",
-                                        __FUNCTION__, length);
-                                return;
-                        }
+                cnt = tty_buffer_request_room(tty, length);
+                if (cnt < length) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n",
+                                        __FUNCTION__, length - cnt);
+                        if(cnt == 0)
+                                break;
                 }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
+                tty_insert_flip_string(tty, data, cnt);
                 data += cnt;
                 length -= cnt;
         } while (length > 0);
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 2edf9cabad20..afc0f34b3a46 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1865,20 +1865,14 @@ static void edge_tty_recv(struct device *dev, struct tty_struct *tty, unsigned c
         int cnt;
 
         do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n",
-                                        __FUNCTION__, length);
-                                return;
-                        }
+                cnt = tty_buffer_request_room(tty, length);
+                if (cnt < length) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n",
+                                __FUNCTION__, length - cnt);
+                        if(cnt == 0)
+                                break;
                 }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
+                tty_insert_flip_string(tty, data, cnt);
                 data += cnt;
                 length -= cnt;
         } while (length > 0);
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 06d07cea0b70..9a5c97989562 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -711,7 +711,7 @@ static void ipaq_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
         struct usb_serial_port  *port = (struct usb_serial_port *)urb->context;
         struct tty_struct       *tty;
         unsigned char           *data = urb->transfer_buffer;
-        int                     i, result;
+        int                     result;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
 
@@ -724,14 +724,8 @@ static void ipaq_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
 
         tty = port->tty;
         if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
                 tty_flip_buffer_push(tty);
                 bytes_in += urb->actual_length;
         }
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index 2dd191f5fe76..e760a70242c1 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -166,7 +166,6 @@ static void ipw_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
         struct usb_serial_port *port = urb->context;
         unsigned char *data = urb->transfer_buffer;
         struct tty_struct *tty;
-        int i;
         int result;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
@@ -180,14 +179,8 @@ static void ipw_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
 
         tty = port->tty;
         if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
                 tty_flip_buffer_push(tty);
         }
 
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 4e2f7dfb58b2..78335a5f7743 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -648,7 +648,6 @@ static void klsi_105_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 usb_serial_debug_data(debug, &port->dev, __FUNCTION__,
                                       urb->actual_length, data);
         } else {
-                int i;
                 int bytes_sent = ((__u8 *) data)[0] +
                                  ((unsigned int) ((__u8 *) data)[1] << 8);
                 tty = port->tty;
@@ -669,16 +668,8 @@ static void klsi_105_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                         bytes_sent = urb->actual_length - 2;
                 }
 
-                for (i = 2; i < 2+bytes_sent; i++) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters,
-                         * we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless 
-                         * tty->low_latency is set */
-                        tty_insert_flip_char(tty, ((__u8*) data)[i], 0);
-                }
+                tty_buffer_request_room(tty, bytes_sent);
+                tty_insert_flip_string(tty, data + 2, bytes_sent);
                 tty_flip_buffer_push(tty);
 
                 /* again lockless, but debug info only */
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index d9c21e275130..b8b213185d0f 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -365,7 +365,6 @@ static void kobil_close (struct usb_serial_port *port, struct file *filp)
 
 static void kobil_read_int_callback( struct urb *purb, struct pt_regs *regs)
 {
-        int i;
         int result;
         struct usb_serial_port *port = (struct usb_serial_port *) purb->context;
         struct tty_struct *tty;
@@ -397,14 +396,8 @@ static void kobil_read_int_callback( struct urb *purb, struct pt_regs *regs)
                 */
                 // END DEBUG
 
-                for (i = 0; i < purb->actual_length; ++i) {
-                        // if we insert more than TTY_FLIPBUF_SIZE characters, we drop them.
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        // this doesn't actually push the data through unless tty->low_latency is set
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, purb->actual_length);
+                tty_insert_flip_string(tty, data, purb->actual_length);
                 tty_flip_buffer_push(tty);
         }
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 3fd2405304fd..52bdf6fe46f2 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -321,7 +321,7 @@ static int option_write(struct usb_serial_port *port,
 
 static void option_indat_callback(struct urb *urb, struct pt_regs *regs)
 {
-        int i, err;
+        int err;
         int endpoint;
         struct usb_serial_port *port;
         struct tty_struct *tty;
@@ -338,11 +338,8 @@ static void option_indat_callback(struct urb *urb, struct pt_regs *regs)
         } else {
                 tty = port->tty;
                 if (urb->actual_length) {
-                        for (i = 0; i < urb->actual_length ; ++i) {
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                        tty_flip_buffer_push(tty);
-                                tty_insert_flip_char(tty, data[i], 0);
-                        }
+                        tty_buffer_request_room(tty, urb->actual_length);
+                        tty_insert_flip_string(tty, data, urb->actual_length);
                         tty_flip_buffer_push(tty);
                 } else {
                         dbg("%s: empty read urb received", __FUNCTION__);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index f03721056190..9ffff1938239 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -924,16 +924,12 @@ static void pl2303_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
 
         tty = port->tty;
         if (tty && urb->actual_length) {
+                tty_buffer_request_room(tty, urb->actual_length + 1);
                 /* overrun is special, not associated with a char */
                 if (status & UART_OVERRUN_ERROR)
                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-
-                for (i = 0; i < urb->actual_length; ++i) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
+                for (i = 0; i < urb->actual_length; ++i)
                         tty_insert_flip_char (tty, data[i], tty_flag);
-                }
                 tty_flip_buffer_push (tty);
         }
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index abb830cb77bd..c18db3257073 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1280,24 +1280,18 @@ static void ti_recv(struct device *dev, struct tty_struct *tty,
         int cnt;
 
         do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n", __FUNCTION__, length);
-                                return;
-                        }
+                cnt = tty_buffer_request_room(tty, length);
+                if (cnt < length) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n", __FUNCTION__, length - cnt);
+                        if(cnt == 0)
+                                break;
                 }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
+                tty_insert_flip_string(tty, data, cnt);
+                tty_flip_buffer_push(tty);
                 data += cnt;
                 length -= cnt;
         } while (length > 0);
 
-        tty_flip_buffer_push(tty);
 }
 
 
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index 49b1fbe61f25..bce3d55affd8 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -488,7 +488,6 @@ static void visor_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
         unsigned char *data = urb->transfer_buffer;
         struct tty_struct *tty;
         unsigned long flags;
-        int i;
         int throttled;
         int result;
 
@@ -503,14 +502,8 @@ static void visor_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
 
         tty = port->tty;
         if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
                 tty_flip_buffer_push(tty);
         }
         spin_lock_irqsave(&priv->lock, flags);
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index a7c3c4734d83..557411c6e7c7 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -1434,7 +1434,9 @@ static void rx_data_softint(void *private)
                 urb = wrap->urb;
 
                 if (tty && urb->actual_length) {
-                        if (urb->actual_length > TTY_FLIPBUF_SIZE - tty->flip.count) {
+                        int len = tty_buffer_request_room(tty, urb->actual_length);
+                        /* This stuff can go away now I suspect */
+                        if (unlikely(len < urb->actual_length)) {
                                 spin_lock_irqsave(&info->lock, flags);
                                 list_add(tmp, &info->rx_urb_q);
                                 spin_unlock_irqrestore(&info->lock, flags);
@@ -1442,11 +1444,8 @@ static void rx_data_softint(void *private)
                                 schedule_work(&info->rx_work);
                                 return;
                         }
-
-                        memcpy(tty->flip.char_buf_ptr, urb->transfer_buffer, urb->actual_length);
-                        tty->flip.char_buf_ptr += urb->actual_length;
-                        tty->flip.count += urb->actual_length;
-                        sent += urb->actual_length;
+                        tty_insert_flip_string(tty, urb->transfer_buffer, len);
+                        sent += len;
                 }
 
                 urb->dev = port->serial->dev;
diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
index 7428198111eb..45f625d7d0b2 100644
--- a/include/linux/kbd_kern.h
+++ b/include/linux/kbd_kern.h
@@ -151,7 +151,7 @@ extern unsigned int keymap_count;
 
 static inline void con_schedule_flip(struct tty_struct *t)
 {
-        schedule_work(&t->flip.work);
+        schedule_work(&t->buf.work);
 }
 
 #endif
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 57449704a47b..3787102e4b12 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -51,16 +51,22 @@
  */
 #define TTY_FLIPBUF_SIZE 512
 
-struct tty_flip_buffer {
+struct tty_buffer {
+        struct tty_buffer *next;
+        char *char_buf_ptr;
+        unsigned char *flag_buf_ptr;
+        int used;
+        int size;
+        /* Data points here */
+        unsigned long data[0];
+};
+
+struct tty_bufhead {
         struct work_struct              work;
         struct semaphore pty_sem;
-        char            *char_buf_ptr;
-        unsigned char   *flag_buf_ptr;
-        int             count;
-        int             buf_num;
-        unsigned char   char_buf[2*TTY_FLIPBUF_SIZE];
-        char            flag_buf[2*TTY_FLIPBUF_SIZE];
-        unsigned char   slop[4]; /* N.B. bug overwrites buffer by 1 */
+        struct tty_buffer *head;        /* Queue head */
+        struct tty_buffer *tail;        /* Active buffer */
+        struct tty_buffer *free;        /* Free queue head */
 };
 /*
  * The pty uses char_buf and flag_buf as a contiguous buffer
@@ -186,10 +192,11 @@ struct tty_struct {
         unsigned char stopped:1, hw_stopped:1, flow_stopped:1, packet:1;
         unsigned char low_latency:1, warned:1;
         unsigned char ctrl_status;
+        unsigned int receive_room;      /* Bytes free for queue */
 
         struct tty_struct *link;
         struct fasync_struct *fasync;
-        struct tty_flip_buffer flip;
+        struct tty_bufhead buf;
         int max_flip_cnt;
         int alt_speed;          /* For magic substitution of 38400 bps */
         wait_queue_head_t write_wait;
diff --git a/include/linux/tty_flip.h b/include/linux/tty_flip.h
index abe9bfcf226c..be1400e82482 100644
--- a/include/linux/tty_flip.h
+++ b/include/linux/tty_flip.h
@@ -1,25 +1,33 @@
 #ifndef _LINUX_TTY_FLIP_H
 #define _LINUX_TTY_FLIP_H
 
+extern int tty_buffer_request_room(struct tty_struct *tty, size_t size);
+extern int tty_insert_flip_string(struct tty_struct *tty, unsigned char *chars, size_t size);
+extern int tty_insert_flip_string_flags(struct tty_struct *tty, unsigned char *chars, char *flags, size_t size);
+extern int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size);
+extern int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size);
+
 #ifdef INCLUDE_INLINE_FUNCS
 #define _INLINE_ extern
 #else
 #define _INLINE_ static __inline__
 #endif
 
-_INLINE_ void tty_insert_flip_char(struct tty_struct *tty,
+_INLINE_ int tty_insert_flip_char(struct tty_struct *tty,
                                    unsigned char ch, char flag)
 {
-        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                tty->flip.count++;
-                *tty->flip.flag_buf_ptr++ = flag;
-                *tty->flip.char_buf_ptr++ = ch;
+        struct tty_buffer *tb = tty->buf.tail;
+        if (tb && tb->used < tb->size) {
+                tb->flag_buf_ptr[tb->used] = flag;
+                tb->char_buf_ptr[tb->used++] = ch;
+                return 1;
         }
+        return tty_insert_flip_string_flags(tty, &ch, &flag, 1);
 }
 
 _INLINE_ void tty_schedule_flip(struct tty_struct *tty)
 {
-        schedule_delayed_work(&tty->flip.work, 1);
+        schedule_delayed_work(&tty->buf.work, 1);
 }
 
 #undef _INLINE_
diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
index 6066afde5ce4..83c6e6c10ebb 100644
--- a/include/linux/tty_ldisc.h
+++ b/include/linux/tty_ldisc.h
@@ -81,14 +81,6 @@
  *      pointer of flag bytes which indicate whether a character was
  *      received with a parity error, etc.
  * 
- * int  (*receive_room)(struct tty_struct *);
- *
- *      This function is called by the low-level tty driver to
- *      determine how many characters the line discpline can accept.
- *      The low-level driver must not send more characters than was
- *      indicated by receive_room, or the line discpline may drop
- *      those characters.
- * 
  * void (*write_wakeup)(struct tty_struct *);
  *
  *      This function is called by the low-level tty driver to signal
@@ -136,7 +128,6 @@ struct tty_ldisc {
          */
         void    (*receive_buf)(struct tty_struct *, const unsigned char *cp,
                                char *fp, int count);
-        int     (*receive_room)(struct tty_struct *);
         void    (*write_wakeup)(struct tty_struct *);
 
         struct  module *owner;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 158a9c46d863..f57cde78c3de 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -480,13 +480,8 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
         BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
 
         if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
-                register int i;
-                for (i = 0; i < skb->len; i++) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                tty_flip_buffer_push(tty);
-
-                        tty_insert_flip_char(tty, skb->data[i], 0);
-                }
+                tty_buffer_request_room(tty, skb->len);
+                tty_insert_flip_string(tty, skb->data, skb->len);
                 tty_flip_buffer_push(tty);
         } else
                 tty->ldisc.receive_buf(tty, skb->data, NULL, skb->len);