101 files changed, 971 insertions, 1428 deletions
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 573ff6c1be5f..613673b12fa6 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -279,6 +279,7 @@ static int hci_uart_tty_open(struct tty_struct *tty)
        tty->disc_data = hu;
        hu->tty = tty;
+        tty->receive_room = 65536;
        spin_lock_init(&hu->rx_lock);
@@ -348,20 +349,6 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty)
                hci_uart_tx_wakeup(hu);
 }
-/* hci_uart_tty_room()
- * 
- *    Callback function from tty driver. Return the amount of 
- *    space left in the receiver's buffer to decide if remote
- *    transmitter is to be throttled.
- *
- * Arguments:        tty    pointer to associated tty instance data
- * Return Value:    number of bytes left in receive buffer
- */
-static int hci_uart_tty_room (struct tty_struct *tty)
-{
-        return 65536;
-}
 /* hci_uart_tty_receive()
 * 
 *     Called by tty low level driver when receive data is
@@ -544,7 +531,6 @@ static int __init hci_uart_init(void)
        hci_uart_ldisc.write            = hci_uart_tty_write;
        hci_uart_ldisc.ioctl            = hci_uart_tty_ioctl;
        hci_uart_ldisc.poll             = hci_uart_tty_poll;
-        hci_uart_ldisc.receive_room     = hci_uart_tty_room;
        hci_uart_ldisc.receive_buf      = hci_uart_tty_receive;
        hci_uart_ldisc.write_wakeup     = hci_uart_tty_wakeup;
        hci_uart_ldisc.owner            = THIS_MODULE;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 977a74e16efb..d6fcd0a36f9f 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -80,7 +80,7 @@ config SERIAL_NONSTANDARD
 config COMPUTONE
        tristate "Computone IntelliPort Plus serial support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD
        ---help---
          This driver supports the entire family of Intelliport II/Plus
          controllers with the exception of the MicroChannel controllers and
@@ -153,7 +153,7 @@ config DIGIEPCA
 config ESPSERIAL
        tristate "Hayes ESP serial port support"
-        depends on SERIAL_NONSTANDARD && ISA && BROKEN_ON_SMP && ISA_DMA_API
+        depends on SERIAL_NONSTANDARD && ISA && ISA_DMA_API
        help
          This is a driver which supports Hayes ESP serial ports.  Both single
          port cards and multiport cards are supported.  Make sure to read
@@ -166,7 +166,7 @@ config ESPSERIAL
 config MOXA_INTELLIO
        tristate "Moxa Intellio support"
-        depends on SERIAL_NONSTANDARD && BROKEN_ON_SMP
+        depends on SERIAL_NONSTANDARD
        help
          Say Y here if you have a Moxa Intellio multiport serial card.
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 10c81ecdace8..869518e4035f 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -265,8 +265,9 @@ static _INLINE_ void receive_chars(struct async_struct *info)
        int status;
        int serdatr;
        struct tty_struct *tty = info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        struct  async_icount *icount;
+        int oe = 0;
        icount = &info->state->icount;
@@ -282,15 +283,12 @@ static _INLINE_ void receive_chars(struct async_struct *info)
            status |= UART_LSR_OE;
        ch = serdatr & 0xff;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-          goto ignore_char;
-        *tty->flip.char_buf_ptr = ch;
        icount->rx++;
 #ifdef SERIAL_DEBUG_INTR
        printk("DR%02x:%02x...", ch, status);
 #endif
-        *tty->flip.flag_buf_ptr = 0;
+        flag = TTY_NORMAL;
        /*
         * We don't handle parity or frame errors - but I have left
@@ -319,7 +317,7 @@ static _INLINE_ void receive_chars(struct async_struct *info)
           * should be ignored.
           */
          if (status & info->ignore_status_mask)
-            goto ignore_char;
+            goto out;
          status &= info->read_status_mask;
@@ -327,33 +325,28 @@ static _INLINE_ void receive_chars(struct async_struct *info)
 #ifdef SERIAL_DEBUG_INTR
            printk("handling break....");
 #endif
-            *tty->flip.flag_buf_ptr = TTY_BREAK;
+            flag = TTY_BREAK;
            if (info->flags & ASYNC_SAK)
              do_SAK(tty);
          } else if (status & UART_LSR_PE)
-            *tty->flip.flag_buf_ptr = TTY_PARITY;
+            flag = TTY_PARITY;
          else if (status & UART_LSR_FE)
-            *tty->flip.flag_buf_ptr = TTY_FRAME;
+            flag = TTY_FRAME;
          if (status & UART_LSR_OE) {
            /*
             * Overrun is special, since it's
             * reported immediately, and doesn't
             * affect the current character
             */
-            if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+             oe = 1;
-              tty->flip.count++;
-              tty->flip.flag_buf_ptr++;
-              tty->flip.char_buf_ptr++;
-              *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-            }
          }
        }
-        tty->flip.flag_buf_ptr++;
+        tty_insert_flip_char(tty, ch, flag);
-        tty->flip.char_buf_ptr++;
+        if (oe == 1)
-        tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
- ignore_char:
        tty_flip_buffer_push(tty);
+out:
+        return;
 }
 static _INLINE_ void transmit_chars(struct async_struct *info)
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index c8e7daecad72..39c61a71176e 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -641,6 +641,7 @@ static char rcsid[] =
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/serial.h>
 #include <linux/major.h>
 #include <linux/string.h>
@@ -1086,7 +1087,7 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
  int had_work;
  int mdm_change;
  int mdm_status;
+  int len;
    if((cinfo = (struct cyclades_card *)dev_id) == 0){
 #ifdef CY_DEBUG_INTERRUPTS
        printk("cyy_interrupt: spurious interrupt %d\n\r", irq);
@@ -1163,63 +1164,43 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                                info->icount.rx++;
                                continue;
                            }
-                            if (tty->flip.count < TTY_FLIPBUF_SIZE){
+                            if (tty_buffer_request_room(tty, 1)) {
-                                tty->flip.count++;
                                if (data & info->read_status_mask){
                                    if(data & CyBREAK){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_BREAK);
-                                                            TTY_BREAK;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
                                        info->icount.rx++;
                                        if (info->flags & ASYNC_SAK){
                                            do_SAK(tty);
                                        }
                                    }else if(data & CyFRAME){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_FRAME);
-                                                            TTY_FRAME;
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
                                        info->icount.rx++;
                                        info->idle_stats.frame_errs++;
                                    }else if(data & CyPARITY){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        /* Pieces of seven... */
-                                                            TTY_PARITY;
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_PARITY);
-                                        *tty->flip.char_buf_ptr++ =
-                                          cy_readb(base_addr+(CyRDSR<<index));
                                        info->icount.rx++;
                                        info->idle_stats.parity_errs++;
                                    }else if(data & CyOVERRUN){
-                                        *tty->flip.flag_buf_ptr++ =
+                                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                                                            TTY_OVERRUN;
-                                        *tty->flip.char_buf_ptr++ = 0;
                                        info->icount.rx++;
                                        /* If the flip buffer itself is
                                           overflowing, we still lose
                                           the next incoming character.
                                         */
-                                        if(tty->flip.count
+                                        tty_insert_flip_char(tty, cy_readb(base_addr+(CyRDSR<<index)), TTY_FRAME);
-                                                   < TTY_FLIPBUF_SIZE){
+                                        info->icount.rx++;
-                                            tty->flip.count++;
-                                            *tty->flip.flag_buf_ptr++ =
-                                                             TTY_NORMAL;
-                                           *tty->flip.char_buf_ptr++ =
-                                            cy_readb(base_addr+(CyRDSR<<index));
-                                            info->icount.rx++;
-                                        }
                                        info->idle_stats.overruns++;
                                    /* These two conditions may imply */
                                    /* a normal read should be done. */
                                    /* }else if(data & CyTIMEOUT){ */
                                    /* }else if(data & CySPECHAR){ */
-                                    }else{
+                                    }else {
-                                        *tty->flip.flag_buf_ptr++ = 0;
+                                        tty_insert_flip_char(tty, 0, TTY_NORMAL);
-                                        *tty->flip.char_buf_ptr++ = 0;
+                                        info->icount.rx++;
-                                        info->icount.rx++;
                                    }
                                }else{
-                                    *tty->flip.flag_buf_ptr++ = 0;
+                                    tty_insert_flip_char(tty, 0, TTY_NORMAL);
-                                    *tty->flip.char_buf_ptr++ = 0;
                                    info->icount.rx++;
                                }
                            }else{
@@ -1240,14 +1221,10 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                               info->mon.char_max = char_count;
                            info->mon.char_last = char_count;
 #endif
-                            while(char_count--){
+                            len = tty_buffer_request_room(tty, char_count);
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE){
+                            while(len--){
-                                        break;
-                                }
-                                tty->flip.count++;
                                data = cy_readb(base_addr+(CyRDSR<<index));
-                                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
+                                tty_insert_flip_char(tty, data, TTY_NORMAL);
-                                *tty->flip.char_buf_ptr++ = data;
                                info->idle_stats.recv_bytes++;
                                info->icount.rx++;
 #ifdef CY_16Y_HACK
@@ -1256,7 +1233,7 @@ cyy_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                            }
                             info->idle_stats.recv_idle = jiffies;
                        }
-                        schedule_delayed_work(&tty->flip.work, 1);
+                        schedule_delayed_work(&tty->buf.work, 1);
                    }
                    /* end of service */
                    cy_writeb(base_addr+(CyRIR<<index), (save_xir & 0x3f));
@@ -1551,6 +1528,7 @@ cyz_handle_rx(struct cyclades_port *info,
  struct cyclades_card *cinfo = &cy_card[info->card];
  struct tty_struct *tty = info->tty;
  volatile int char_count;
+  int len;
 #ifdef BLOCKMOVE
  int small_count;
 #else
@@ -1606,18 +1584,11 @@ cyz_handle_rx(struct cyclades_port *info,
                tty->flip.count += small_count;
            }
 #else
-            while(char_count--){
+            len = tty_buffer_request_room(tty, char_count);
-                if (tty->flip.count >= N_TTY_BUF_SIZE - tty->read_cnt)
+            while(len--){
-                    break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                    break;
                data = cy_readb(cinfo->base_addr + rx_bufaddr + new_rx_get);
                new_rx_get = (new_rx_get + 1) & (rx_bufsize - 1);
-                tty->flip.count++;
+                tty_insert_flip_char(tty, data, TTY_NORMAL);
-                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                *tty->flip.char_buf_ptr++ = data;
                info->idle_stats.recv_bytes++;
                info->icount.rx++;
            }
@@ -1635,7 +1606,7 @@ cyz_handle_rx(struct cyclades_port *info,
            }
 #endif
            info->idle_stats.recv_idle = jiffies;
-            schedule_delayed_work(&tty->flip.work, 1);
+            schedule_delayed_work(&tty->buf.work, 1);
        }
        /* Update rx_get */
        cy_writel(&buf_ctrl->rx_get, new_rx_get);
@@ -1763,23 +1734,17 @@ cyz_handle_cmd(struct cyclades_card *cinfo)
        switch(cmd) {
            case C_CM_PR_ERROR:
-                tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_PARITY);
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
-                *tty->flip.char_buf_ptr++ = 0;
                info->icount.rx++;
                special_count++;
                break;
            case C_CM_FR_ERROR:
-                tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_FRAME);
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
-                *tty->flip.char_buf_ptr++ = 0;
                info->icount.rx++;
                special_count++;
                break;
            case C_CM_RXBRK:
-                tty->flip.count++;
+                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                *tty->flip.char_buf_ptr++ = 0;
                info->icount.rx++;
                special_count++;
                break;
@@ -1844,7 +1809,7 @@ cyz_handle_cmd(struct cyclades_card *cinfo)
        if(delta_count)
            cy_sched_event(info, Cy_EVENT_DELTA_WAKEUP);
        if(special_count)
-            schedule_delayed_work(&tty->flip.work, 1);
+            schedule_delayed_work(&tty->buf.work, 1);
    }
 }
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 407708a001e4..765c5c108bf4 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -1786,9 +1786,7 @@ static void doevent(int crd)
                if (tty)  { /* Begin if valid tty */
                        if (event & BREAK_IND)  { /* Begin if BREAK_IND */
                                /* A break has been indicated */
-                                tty->flip.count++;
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                *tty->flip.char_buf_ptr++ = 0;
                                tty_schedule_flip(tty); 
                        } else if (event & LOWTX_IND)  { /* Begin LOWTX_IND */
                                if (ch->statusflags & LOWWAIT) 
@@ -2124,7 +2122,6 @@ static void receive_data(struct channel *ch)
        int dataToRead, wrapgap, bytesAvailable;
        unsigned int tail, head;
        unsigned int wrapmask;
-        int rc;
        /* ---------------------------------------------------------------
                This routine is called by doint when a receive data event 
@@ -2162,16 +2159,15 @@ static void receive_data(struct channel *ch)
                return;
        }
-        if (tty->flip.count == TTY_FLIPBUF_SIZE) 
+        if (tty_buffer_request_room(tty, bytesAvailable + 1) == 0)
                return;
        if (readb(&bc->orun)) {
                writeb(0, &bc->orun);
                printk(KERN_WARNING "epca; overrun! DigiBoard device %s\n",tty->name);
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
        }
        rxwinon(ch);
-        rptr = tty->flip.char_buf_ptr;
-        rc = tty->flip.count;
        while (bytesAvailable > 0)  { /* Begin while there is data on the card */
                wrapgap = (head >= tail) ? head - tail : ch->rxbufsize - tail;
                /* ---------------------------------------------------------------
@@ -2183,8 +2179,7 @@ static void receive_data(struct channel *ch)
                /* --------------------------------------------------------------
                   Make sure we don't overflow the buffer
                ----------------------------------------------------------------- */
-                if ((rc + dataToRead) > TTY_FLIPBUF_SIZE)
+                dataToRead = tty_prepare_flip_string(tty, &rptr, dataToRead);
-                        dataToRead = TTY_FLIPBUF_SIZE - rc;
                if (dataToRead == 0)
                        break;
                /* ---------------------------------------------------------------
@@ -2192,13 +2187,9 @@ static void receive_data(struct channel *ch)
                        for translation if necessary.
                ------------------------------------------------------------------ */
                memcpy_fromio(rptr, ch->rxptr + tail, dataToRead);
-                rc   += dataToRead;
-                rptr += dataToRead;
                tail = (tail + dataToRead) & wrapmask;
                bytesAvailable -= dataToRead;
        } /* End while there is data on the card */
-        tty->flip.count = rc;
-        tty->flip.char_buf_ptr = rptr;
        globalwinon(ch);
        writew(tail, &bc->rout);
        /* Must be called with global data */
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
index 9f53d2fcc360..e469f641c728 100644
--- a/drivers/char/esp.c
+++ b/drivers/char/esp.c
@@ -345,26 +345,22 @@ static inline void receive_chars_pio(struct esp_struct *info, int num_bytes)
        for (i = 0; i < num_bytes; i++) {
                if (!(err_buf->data[i] & status_mask)) {
-                        *(tty->flip.char_buf_ptr++) = pio_buf->data[i];
+                        int flag = 0;
                        if (err_buf->data[i] & 0x04) {
-                                *(tty->flip.flag_buf_ptr++) = TTY_BREAK;
+                                flag = TTY_BREAK;
                                if (info->flags & ASYNC_SAK)
                                        do_SAK(tty);
                        }
                        else if (err_buf->data[i] & 0x02)
-                                *(tty->flip.flag_buf_ptr++) = TTY_FRAME;
+                                flag = TTY_FRAME;
                        else if (err_buf->data[i] & 0x01)
-                                *(tty->flip.flag_buf_ptr++) = TTY_PARITY;
+                                flag = TTY_PARITY;
-                        else
+                        tty_insert_flip_char(tty, pio_buf->data[i], flag);
-                                *(tty->flip.flag_buf_ptr++) = 0;
-                
-                        tty->flip.count++;
                }
        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        schedule_delayed_work(&tty->buf.work, 1);
        info->stat_flags &= ~ESP_STAT_RX_TIMEOUT;
        release_pio_buffer(pio_buf);
@@ -397,7 +393,6 @@ static inline void receive_chars_dma_done(struct esp_struct *info,
        int num_bytes;
        unsigned long flags;
        
-        
        flags=claim_dma_lock();
        disable_dma(dma);
        clear_dma_ff(dma);
@@ -408,38 +403,31 @@ static inline void receive_chars_dma_done(struct esp_struct *info,
        
        info->icount.rx += num_bytes;
-        memcpy(tty->flip.char_buf_ptr, dma_buffer, num_bytes);
-        tty->flip.char_buf_ptr += num_bytes;
-        tty->flip.count += num_bytes;
-        memset(tty->flip.flag_buf_ptr, 0, num_bytes);
-        tty->flip.flag_buf_ptr += num_bytes;
        if (num_bytes > 0) {
-                tty->flip.flag_buf_ptr--;
+                tty_insert_flip_string(tty, dma_buffer, num_bytes - 1);
                status &= (0x1c & info->read_status_mask);
+                
+                /* Is the status significant or do we throw the last byte ? */
+                if (!(status & info->ignore_status_mask)) {
+                        int statflag = 0;
-                if (status & info->ignore_status_mask) {
+                        if (status & 0x10) {
-                        tty->flip.count--;
+                                statflag = TTY_BREAK;
-                        tty->flip.char_buf_ptr--;
+                                (info->icount.brk)++;
-                        tty->flip.flag_buf_ptr--;
+                                if (info->flags & ASYNC_SAK)
-                } else if (status & 0x10) {
+                                        do_SAK(tty);
-                        *tty->flip.flag_buf_ptr = TTY_BREAK;
+                        } else if (status & 0x08) {
-                        (info->icount.brk)++;
+                                statflag = TTY_FRAME;
-                        if (info->flags & ASYNC_SAK)
+                                (info->icount.frame)++;
-                                do_SAK(tty);
+                        }
-                } else if (status & 0x08) {
+                        else if (status & 0x04) {
-                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                statflag = TTY_PARITY;
-                        (info->icount.frame)++;
+                                (info->icount.parity)++;
-                }
+                        }
-                else if (status & 0x04) {
+                        tty_insert_flip_char(tty, dma_buffer[num_bytes - 1], statflag);
-                        *tty->flip.flag_buf_ptr = TTY_PARITY;
-                        (info->icount.parity)++;
                }
+                schedule_delayed_work(&tty->buf.work, 1);
-                tty->flip.flag_buf_ptr++;
-                
-                schedule_delayed_work(&tty->flip.work, 1);
        }
        if (dma_bytes != num_bytes) {
@@ -693,8 +681,7 @@ static irqreturn_t rs_interrupt_single(int irq, void *dev_id,
                num_bytes = serial_in(info, UART_ESI_STAT1) << 8;
                num_bytes |= serial_in(info, UART_ESI_STAT2);
-                if (num_bytes > (TTY_FLIPBUF_SIZE - info->tty->flip.count))
+                num_bytes = tty_buffer_request_room(info->tty, num_bytes);
-                  num_bytes = TTY_FLIPBUF_SIZE - info->tty->flip.count;
                if (num_bytes) {
                        if (dma_bytes ||
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index f92177634677..1994a92d4733 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -597,9 +597,7 @@ static int hvc_poll(struct hvc_struct *hp)
        /* Read data if any */
        for (;;) {
-                int count = N_INBUF;
+                int count = tty_buffer_request_room(tty, N_INBUF);
-                if (count > (TTY_FLIPBUF_SIZE - tty->flip.count))
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
                /* If flip is full, just reschedule a later read */
                if (count == 0) {
@@ -635,7 +633,7 @@ static int hvc_poll(struct hvc_struct *hp)
                        tty_insert_flip_char(tty, buf[i], 0);
                }
-                if (tty->flip.count)
+                if (count)
                        tty_schedule_flip(tty);
                /*
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 53dc77c760fc..831eb4e8d9d3 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -456,12 +456,11 @@ static int hvcs_io(struct hvcs_struct *hvcsd)
        /* remove the read masks */
        hvcsd->todo_mask &= ~(HVCS_READ_MASK);
-        if ((tty->flip.count + HVCS_BUFF_LEN) < TTY_FLIPBUF_SIZE) {
+        if (tty_buffer_request_room(tty, HVCS_BUFF_LEN) >= HVCS_BUFF_LEN) {
                got = hvc_get_chars(unit_address,
                                &buf[0],
                                HVCS_BUFF_LEN);
-                for (i=0;got && i<got;i++)
+                tty_insert_flip_string(tty, buf, got);
-                        tty_insert_flip_char(tty, buf[i], TTY_NORMAL);
        }
        /* Give the TTY time to process the data we just sent. */
@@ -469,10 +468,9 @@ static int hvcs_io(struct hvcs_struct *hvcsd)
                hvcsd->todo_mask |= HVCS_QUICK_READ;
        spin_unlock_irqrestore(&hvcsd->lock, flags);
-        if (tty->flip.count) {
+        /* This is synch because tty->low_latency == 1 */
-                /* This is synch because tty->low_latency == 1 */
+        if(got)
                tty_flip_buffer_push(tty);
-        }
        if (!got) {
                /* Do this _after_ the flip_buffer_push */
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 1bbf507adda5..86033bed5d6c 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -115,6 +115,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/termios.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
@@ -773,6 +774,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
        unsigned short base, header, word_count, count;
        unsigned char channel;
        short byte_count;
+        unsigned char *rp;
        
        card = (struct isi_board *) dev_id;
@@ -903,14 +905,10 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                                break;
                                
                        case 1: /* Received Break !!!    */
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                                        break;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
-                                *tty->flip.char_buf_ptr++ = 0;
-                                tty->flip.count++;
                                if (port->flags & ASYNC_SAK)
                                        do_SAK(tty);
-                                schedule_delayed_work(&tty->flip.work, 1);
+                                tty_flip_buffer_push(tty);
                                break;
                                
                        case 2: /* Statistics            */
@@ -923,23 +921,19 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                }        
        }
        else {                          /* Data   Packet */
-                count = min_t(unsigned short, byte_count, (TTY_FLIPBUF_SIZE - tty->flip.count));
+                count = tty_prepare_flip_string(tty, &rp, byte_count & ~1);
 #ifdef ISICOM_DEBUG
                printk(KERN_DEBUG "ISICOM: Intr: Can rx %d of %d bytes.\n", 
                                        count, byte_count);
 #endif                  
                word_count = count >> 1;
-                insw(base, tty->flip.char_buf_ptr, word_count);
+                insw(base, rp, word_count);
-                tty->flip.char_buf_ptr += (word_count << 1);            
                byte_count -= (word_count << 1);
                if (count & 0x0001) {
-                        *tty->flip.char_buf_ptr++ = (char)(inw(base) & 0xff);
+                        tty_insert_flip_char(tty,  inw(base) & 0xff, TTY_NORMAL);
                        byte_count -= 2;
                }       
-                memset(tty->flip.flag_buf_ptr, 0, count);
-                tty->flip.flag_buf_ptr += count;
-                tty->flip.count += count;
-                
                if (byte_count > 0) {
                        printk(KERN_DEBUG "ISICOM: Intr(0x%x:%d): Flip buffer overflow! dropping bytes...\n",
                                        base, channel+1);
@@ -948,7 +942,7 @@ static irqreturn_t isicom_interrupt(int irq, void *dev_id,
                                byte_count -= 2;
                        }
                }
-                schedule_delayed_work(&tty->flip.work, 1);
+                tty_flip_buffer_push(tty);
        }
        if (card->isa == YES)
                ClearInterrupt(base);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 24435f8daa68..28c5a3193b81 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -2711,17 +2711,13 @@ static void stli_read(stlibrd_t *brdp, stliport_t *portp)
                stlen = size - tail;
        }
-        len = MIN(len, (TTY_FLIPBUF_SIZE - tty->flip.count));
+        len = tty_buffer_request_room(tty, len);
+        /* FIXME : iomap ? */
        shbuf = (volatile char *) EBRDGETMEMPTR(brdp, portp->rxoffset);
        while (len > 0) {
                stlen = MIN(len, stlen);
-                memcpy(tty->flip.char_buf_ptr, (char *) (shbuf + tail), stlen);
+                tty_insert_flip_string(tty, (char *)(shbuf + tail), stlen);
-                memset(tty->flip.flag_buf_ptr, 0, stlen);
-                tty->flip.char_buf_ptr += stlen;
-                tty->flip.flag_buf_ptr += stlen;
-                tty->flip.count += stlen;
                len -= stlen;
                tail += stlen;
                if (tail >= size) {
@@ -2906,16 +2902,12 @@ static int stli_hostcmd(stlibrd_t *brdp, stliport_t *portp)
                if ((nt.data & DT_RXBREAK) && (portp->rxmarkmsk & BRKINT)) {
                        if (tty != (struct tty_struct *) NULL) {
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                                tty_insert_flip_char(tty, 0, TTY_BREAK);
-                                        tty->flip.count++;
+                                if (portp->flags & ASYNC_SAK) {
-                                        *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                        do_SAK(tty);
-                                        *tty->flip.char_buf_ptr++ = 0;
+                                        EBRDENABLE(brdp);
-                                        if (portp->flags & ASYNC_SAK) {
-                                                do_SAK(tty);
-                                                EBRDENABLE(brdp);
-                                        }
-                                        tty_schedule_flip(tty);
                                }
+                                tty_schedule_flip(tty);
                        }
                }
@@ -4940,7 +4932,7 @@ static int stli_portcmdstats(stliport_t *portp)
        if (portp->tty != (struct tty_struct *) NULL) {
                if (portp->tty->driver_data == portp) {
                        stli_comstats.ttystate = portp->tty->flags;
-                        stli_comstats.rxbuffered = portp->tty->flip.count;
+                        stli_comstats.rxbuffered = -1 /*portp->tty->flip.count*/;
                        if (portp->tty->termios != (struct termios *) NULL) {
                                stli_comstats.cflags = portp->tty->termios->c_cflag;
                                stli_comstats.iflags = portp->tty->termios->c_iflag;
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 46a3a8ccd65f..5e3ef5522194 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -269,7 +269,7 @@ static int MoxaPortDCDChange(int);
 static int MoxaPortDCDON(int);
 static void MoxaPortFlushData(int, int);
 static int MoxaPortWriteData(int, unsigned char *, int);
-static int MoxaPortReadData(int, unsigned char *, int);
+static int MoxaPortReadData(int, struct tty_struct *tty);
 static int MoxaPortTxQueue(int);
 static int MoxaPortRxQueue(int);
 static int MoxaPortTxFree(int);
@@ -301,6 +301,8 @@ static struct tty_operations moxa_ops = {
        .tiocmset = moxa_tiocmset,
 };
+static spinlock_t moxa_lock = SPIN_LOCK_UNLOCKED;
 #ifdef CONFIG_PCI
 static int moxa_get_PCI_conf(struct pci_dev *p, int board_type, moxa_board_conf * board)
 {
@@ -645,10 +647,10 @@ static int moxa_write(struct tty_struct *tty,
        if (ch == NULL)
                return (0);
        port = ch->port;
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&moxa_lock, flags);
        len = MoxaPortWriteData(port, (unsigned char *) buf, count);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
        /*********************************************
        if ( !(ch->statusflags & LOWWAIT) &&
@@ -723,11 +725,10 @@ static void moxa_put_char(struct tty_struct *tty, unsigned char c)
        if (ch == NULL)
                return;
        port = ch->port;
-        save_flags(flags);
+        spin_lock_irqsave(&moxa_lock, flags);
-        cli();
        moxaXmitBuff[0] = c;
        MoxaPortWriteData(port, moxaXmitBuff, 1);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
        /************************************************
        if ( !(ch->statusflags & LOWWAIT) && (MoxaPortTxFree(port) <= 100) )
        *************************************************/
@@ -1030,12 +1031,12 @@ static int block_till_ready(struct tty_struct *tty, struct file *filp,
        printk("block_til_ready before block: ttys%d, count = %d\n",
               ch->line, ch->count);
 #endif
-        save_flags(flags);
+        spin_lock_irqsave(&moxa_lock, flags);
-        cli();
        if (!tty_hung_up_p(filp))
                ch->count--;
-        restore_flags(flags);
        ch->blocked_open++;
+        spin_unlock_irqrestore(&moxa_lock, flags);
        while (1) {
                set_current_state(TASK_INTERRUPTIBLE);
                if (tty_hung_up_p(filp) ||
@@ -1062,17 +1063,21 @@ static int block_till_ready(struct tty_struct *tty, struct file *filp,
        }
        set_current_state(TASK_RUNNING);
        remove_wait_queue(&ch->open_wait, &wait);
+        spin_lock_irqsave(&moxa_lock, flags);
        if (!tty_hung_up_p(filp))
                ch->count++;
        ch->blocked_open--;
+        spin_unlock_irqrestore(&moxa_lock, flags);
 #ifdef SERIAL_DEBUG_OPEN
        printk("block_til_ready after blocking: ttys%d, count = %d\n",
               ch->line, ch->count);
 #endif
        if (retval)
                return (retval);
+        /* FIXME: review to see if we need to use set_bit on these */
        ch->asyncflags |= ASYNC_NORMAL_ACTIVE;
-        return (0);
+        return 0;
 }
 static void setup_empty_event(struct tty_struct *tty)
@@ -1080,15 +1085,14 @@ static void setup_empty_event(struct tty_struct *tty)
        struct moxa_str *ch = tty->driver_data;
        unsigned long flags;
-        save_flags(flags);
+        spin_lock_irqsave(&moxa_lock, flags);
-        cli();
        ch->statusflags |= EMPTYWAIT;
        moxaEmptyTimer_on[ch->port] = 0;
        del_timer(&moxaEmptyTimer[ch->port]);
        moxaEmptyTimer[ch->port].expires = jiffies + HZ;
        moxaEmptyTimer_on[ch->port] = 1;
        add_timer(&moxaEmptyTimer[ch->port]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&moxa_lock, flags);
 }
 static void check_xmit_empty(unsigned long data)
@@ -1135,8 +1139,6 @@ static void receive_data(struct moxa_str *ch)
 {
        struct tty_struct *tp;
        struct termios *ts;
-        int i, count, rc, space;
-        unsigned char *charptr, *flagptr;
        unsigned long flags;
        ts = NULL;
@@ -1150,24 +1152,10 @@ static void receive_data(struct moxa_str *ch)
                MoxaPortFlushData(ch->port, 0);
                return;
        }
-        space = TTY_FLIPBUF_SIZE - tp->flip.count;
+        spin_lock_irqsave(&moxa_lock, flags);
-        if (space <= 0)
+        MoxaPortReadData(ch->port, tp);
-                return;
+        spin_unlock_irqrestore(&moxa_lock, flags);
-        charptr = tp->flip.char_buf_ptr;
+        tty_schedule_flip(tp);
-        flagptr = tp->flip.flag_buf_ptr;
-        rc = tp->flip.count;
-        save_flags(flags);
-        cli();
-        count = MoxaPortReadData(ch->port, charptr, space);
-        restore_flags(flags);
-        for (i = 0; i < count; i++)
-                *flagptr++ = 0;
-        charptr += count;
-        rc += count;
-        tp->flip.count = rc;
-        tp->flip.char_buf_ptr = charptr;
-        tp->flip.flag_buf_ptr = flagptr;
-        tty_schedule_flip(ch->tty);
 }
 #define Magic_code      0x404
@@ -1774,7 +1762,7 @@ int MoxaPortsOfCard(int cardno)
 *      14. MoxaPortDCDON(int port);                                         *
 *      15. MoxaPortFlushData(int port, int mode);                           *
 *      16. MoxaPortWriteData(int port, unsigned char * buffer, int length); *
- *      17. MoxaPortReadData(int port, unsigned char * buffer, int length);  *
+ *      17. MoxaPortReadData(int port, struct tty_struct *tty);              *
 *      18. MoxaPortTxBufSize(int port);                                     *
 *      19. MoxaPortRxBufSize(int port);                                     *
 *      20. MoxaPortTxQueue(int port);                                       *
@@ -2003,10 +1991,9 @@ int MoxaPortsOfCard(int cardno)
 *
 *      Function 21:    Read data.
 *      Syntax:
- *      int  MoxaPortReadData(int port, unsigned char * buffer, int length);
+ *      int  MoxaPortReadData(int port, struct tty_struct *tty);
 *           int port           : port number (0 - 127)
- *           unsigned char * buffer     : pointer to read data buffer.
+ *           struct tty_struct *tty : tty for data
- *           int length         : read data buffer length
 *
 *           return:    0 - length      : real read data length
 *
@@ -2504,7 +2491,7 @@ int MoxaPortWriteData(int port, unsigned char * buffer, int len)
        return (total);
 }
-int MoxaPortReadData(int port, unsigned char * buffer, int space)
+int MoxaPortReadData(int port, struct tty_struct *tty)
 {
        register ushort head, pageofs;
        int i, count, cnt, len, total, remain;
@@ -2522,9 +2509,9 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
        count = (tail >= head) ? (tail - head)
            : (tail - head + rx_mask + 1);
        if (count == 0)
-                return (0);
+                return 0;
-        total = (space > count) ? count : space;
+        total = count;
        remain = count - total;
        moxaLog.rxcnt[port] += total;
        count = total;
@@ -2539,7 +2526,7 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
                        len = (count > len) ? len : count;
                        ofs = baseAddr + DynPage_addr + bufhead + head;
                        for (i = 0; i < len; i++)
-                                *buffer++ = readb(ofs + i);
+                                tty_insert_flip_char(tty, readb(ofs + i), TTY_NORMAL);
                        head = (head + len) & rx_mask;
                        count -= len;
                }
@@ -2556,7 +2543,7 @@ int MoxaPortReadData(int port, unsigned char * buffer, int space)
                        writew(pageno, baseAddr + Control_reg);
                        ofs = baseAddr + DynPage_addr + pageofs;
                        for (i = 0; i < cnt; i++)
-                                *buffer++ = readb(ofs + i);
+                                tty_insert_flip_char(tty, readb(ofs + i), TTY_NORMAL);
                        if (count == 0) {
                                writew((head + len) & rx_mask, ofsAddr + RXrptr);
                                break;
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 51bb2a3cf8b3..ea725a9964e2 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1982,7 +1982,7 @@ static void mxser_receive_chars(struct mxser_struct *info, int *status)
        spin_lock_irqsave(&info->slock, flags);
-        recv_room = tty->ldisc.receive_room(tty);
+        recv_room = tty->receive_room;
        if ((recv_room == 0) && (!info->ldisc_stop_rx)) {
                //mxser_throttle(tty);
                mxser_stoprx(tty);
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index a133a62f3d55..70f487dd7b8d 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -212,7 +212,6 @@ static struct tty_ldisc n_hdlc_ldisc = {
        .ioctl          = n_hdlc_tty_ioctl,
        .poll           = n_hdlc_tty_poll,
        .receive_buf    = n_hdlc_tty_receive,
-        .receive_room   = n_hdlc_tty_room,
        .write_wakeup   = n_hdlc_tty_wakeup,
 };
@@ -337,6 +336,7 @@ static int n_hdlc_tty_open (struct tty_struct *tty)
                
        tty->disc_data = n_hdlc;
        n_hdlc->tty    = tty;
+        tty->receive_room = 65536;
        
 #if defined(TTY_NO_WRITE_SPLIT)
        /* change tty_io write() to not split large writes into 8K chunks */
@@ -478,22 +478,6 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty)
 }       /* end of n_hdlc_tty_wakeup() */
 /**
- * n_hdlc_tty_room - Return the amount of space left in the receiver's buffer
- * @tty - pointer to associated tty instance data
- *
- * Callback function from tty driver. Return the amount of space left in the
- * receiver's buffer to decide if remote transmitter is to be throttled.
- */
-static int n_hdlc_tty_room(struct tty_struct *tty)
-{
-        if (debuglevel >= DEBUG_LEVEL_INFO)     
-                printk("%s(%d)n_hdlc_tty_room() called\n",__FILE__,__LINE__);
-        /* always return a larger number to prevent */
-        /* throttling of remote transmitter. */
-        return 65536;
-}       /* end of n_hdlc_tty_root() */
-/**
 * n_hdlc_tty_receive - Called by tty driver when receive data is available
 * @tty - pointer to tty instance data
 * @data - pointer to received data
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 853c98cee64f..c48de09d68f0 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -147,7 +147,6 @@ static unsigned int r3964_poll(struct tty_struct * tty, struct file * file,
                      struct poll_table_struct  *wait);
 static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                              char *fp, int count);
-static int  r3964_receive_room(struct tty_struct *tty);
 static struct tty_ldisc tty_ldisc_N_R3964 = {
        .owner   = THIS_MODULE,
@@ -161,7 +160,6 @@ static struct tty_ldisc tty_ldisc_N_R3964 = {
        .set_termios = r3964_set_termios,
        .poll   = r3964_poll,            
        .receive_buf = r3964_receive_buf,
-        .receive_room = r3964_receive_room,
 };
@@ -1119,6 +1117,7 @@ static int r3964_open(struct tty_struct *tty)
   pInfo->nRetry = 0;
   
   tty->disc_data = pInfo;
+   tty->receive_room = 65536;
   init_timer(&pInfo->tmr);
   pInfo->tmr.data = (unsigned long)pInfo;
@@ -1405,12 +1404,5 @@ static void r3964_receive_buf(struct tty_struct *tty, const unsigned char *cp,
    }
 }
-static int r3964_receive_room(struct tty_struct *tty)
-{
-   TRACE_L("receive_room");
-   return -1;
-}
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_LDISC(N_R3964);
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index c556f4d3ccd7..ccad7ae94541 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -78,7 +78,32 @@ static inline void free_buf(unsigned char *buf)
                free_page((unsigned long) buf);
 }
-static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
+/**
+ *      n_tty_set__room -       receive space
+ *      @tty: terminal
+ *
+ *      Called by the driver to find out how much data it is
+ *      permitted to feed to the line discipline without any being lost
+ *      and thus to manage flow control. Not serialized. Answers for the
+ *      "instant".
+ */
+static void n_tty_set_room(struct tty_struct *tty)
+{
+        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
+        /*
+         * If we are doing input canonicalization, and there are no
+         * pending newlines, let characters through without limit, so
+         * that erase characters will be handled.  Other excess
+         * characters will be beeped.
+         */
+        if (left <= 0)
+                left = tty->icanon && !tty->canon_data;
+        tty->receive_room = left;
+}
+static void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
 {
        if (tty->read_cnt < N_TTY_BUF_SIZE) {
                tty->read_buf[tty->read_head] = c;
@@ -87,7 +112,7 @@ static inline void put_tty_queue_nolock(unsigned char c, struct tty_struct *tty)
        }
 }
-static inline void put_tty_queue(unsigned char c, struct tty_struct *tty)
+static void put_tty_queue(unsigned char c, struct tty_struct *tty)
 {
        unsigned long flags;
        /*
@@ -136,6 +161,7 @@ static void reset_buffer_flags(struct tty_struct *tty)
        spin_unlock_irqrestore(&tty->read_lock, flags);
        tty->canon_head = tty->canon_data = tty->erasing = 0;
        memset(&tty->read_flags, 0, sizeof tty->read_flags);
+        n_tty_set_room(tty);
        check_unthrottle(tty);
 }
@@ -838,30 +864,6 @@ send_signal:
        put_tty_queue(c, tty);
 }       
-/**
- *      n_tty_receive_room      -       receive space
- *      @tty: terminal
- *
- *      Called by the driver to find out how much data it is
- *      permitted to feed to the line discipline without any being lost
- *      and thus to manage flow control. Not serialized. Answers for the
- *      "instant".
- */
- 
-static int n_tty_receive_room(struct tty_struct *tty)
-{
-        int     left = N_TTY_BUF_SIZE - tty->read_cnt - 1;
-        /*
-         * If we are doing input canonicalization, and there are no
-         * pending newlines, let characters through without limit, so
-         * that erase characters will be handled.  Other excess
-         * characters will be beeped.
-         */
-        if (left <= 0)
-                left = tty->icanon && !tty->canon_data;
-        return left;
-}
 /**
 *      n_tty_write_wakeup      -       asynchronous I/O notifier
@@ -953,6 +955,8 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                        tty->driver->flush_chars(tty);
        }
+        n_tty_set_room(tty);
        if (!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) {
                kill_fasync(&tty->fasync, SIGIO, POLL_IN);
                if (waitqueue_active(&tty->read_wait))
@@ -964,7 +968,7 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
         * mode.  We don't want to throttle the driver if we're in
         * canonical mode and don't have a newline yet!
         */
-        if (n_tty_receive_room(tty) < TTY_THRESHOLD_THROTTLE) {
+        if (tty->receive_room < TTY_THRESHOLD_THROTTLE) {
                /* check TTY_THROTTLED first so it indicates our state */
                if (!test_and_set_bit(TTY_THROTTLED, &tty->flags) &&
                    tty->driver->throttle)
@@ -999,6 +1003,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
        if (test_bit(TTY_HW_COOK_IN, &tty->flags)) {
                tty->raw = 1;
                tty->real_raw = 1;
+                n_tty_set_room(tty);
                return;
        }
        if (I_ISTRIP(tty) || I_IUCLC(tty) || I_IGNCR(tty) ||
@@ -1051,6 +1056,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct termios * old)
                else
                        tty->real_raw = 0;
        }
+        n_tty_set_room(tty);
 }
 /**
@@ -1130,7 +1136,7 @@ static inline int input_available_p(struct tty_struct *tty, int amt)
 *
 */
 
-static inline int copy_from_read_buf(struct tty_struct *tty,
+static int copy_from_read_buf(struct tty_struct *tty,
                                      unsigned char __user **b,
                                      size_t *nr)
@@ -1308,6 +1314,7 @@ do_it_again:
                                retval = -ERESTARTSYS;
                                break;
                        }
+                        n_tty_set_room(tty);
                        clear_bit(TTY_DONT_FLIP, &tty->flags);
                        timeout = schedule_timeout(timeout);
                        set_bit(TTY_DONT_FLIP, &tty->flags);
@@ -1401,6 +1408,8 @@ do_it_again:
        } else if (test_and_clear_bit(TTY_PUSH, &tty->flags))
                 goto do_it_again;
+        n_tty_set_room(tty);
        return retval;
 }
@@ -1553,7 +1562,6 @@ struct tty_ldisc tty_ldisc_N_TTY = {
        normal_poll,            /* poll */
        NULL,                   /* hangup */
        n_tty_receive_buf,      /* receive_buf */
-        n_tty_receive_room,     /* receive_room */
        n_tty_write_wakeup      /* write_wakeup */
 };
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 9fb10c9fec88..8a8ca32822ba 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -1007,8 +1007,9 @@ static void rx_ready_hdlc(MGSLPC_INFO *info, int eom)
 static void rx_ready_async(MGSLPC_INFO *info, int tcd)
 {
-        unsigned char data, status;
+        unsigned char data, status, flag;
        int fifo_count;
+        int work = 0;
        struct tty_struct *tty = info->tty;
        struct mgsl_icount *icount = &info->icount;
@@ -1023,20 +1024,16 @@ static void rx_ready_async(MGSLPC_INFO *info, int tcd)
                        fifo_count = 32;
        } else
                fifo_count = 32;
-        
+        tty_buffer_request_room(tty, fifo_count);
        /* Flush received async data to receive data buffer. */ 
        while (fifo_count) {
                data   = read_reg(info, CHA + RXFIFO);
                status = read_reg(info, CHA + RXFIFO);
                fifo_count -= 2;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-                        
-                *tty->flip.char_buf_ptr = data;
                icount->rx++;
-                
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = 0;
                // if no frameing/crc error then save data
                // BIT7:parity error
@@ -1055,26 +1052,23 @@ static void rx_ready_async(MGSLPC_INFO *info, int tcd)
                        status &= info->read_status_mask;
                        if (status & BIT7)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (status & BIT6)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
-                
+                work += tty_insert_flip_char(tty, data, flag);
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
        }
        issue_command(info, CHA, CMD_RXFIFO);
        if (debug_level >= DEBUG_LEVEL_ISR) {
-                printk("%s(%d):rx_ready_async count=%d\n",
+                printk("%s(%d):rx_ready_async",
-                        __FILE__,__LINE__,tty->flip.count);
+                        __FILE__,__LINE__);
                printk("%s(%d):rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                        __FILE__,__LINE__,icount->rx,icount->brk,
                        icount->parity,icount->frame,icount->overrun);
        }
                        
-        if (tty->flip.count)
+        if (work)
                tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 49f3997fd251..9b5a2c0e7008 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -111,7 +111,7 @@ static int pty_write(struct tty_struct * tty, const unsigned char *buf, int coun
        if (!to || tty->stopped)
                return 0;
-        c = to->ldisc.receive_room(to);
+        c = to->receive_room;
        if (c > count)
                c = count;
        to->ldisc.receive_buf(to, buf, NULL, c);
@@ -126,7 +126,7 @@ static int pty_write_room(struct tty_struct *tty)
        if (!to || tty->stopped)
                return 0;
-        return to->ldisc.receive_room(to);
+        return to->receive_room;
 }
 /*
diff --git a/drivers/char/rio/riointr.c b/drivers/char/rio/riointr.c
index e42e7b50bf6b..ddda9c14e059 100644
--- a/drivers/char/rio/riointr.c
+++ b/drivers/char/rio/riointr.c
@@ -38,6 +38,7 @@ static char *_riointr_c_sccs_ = "@(#)riointr.c	1.2";
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <asm/io.h>
 #include <asm/system.h>
 #include <asm/string.h>
@@ -560,6 +561,7 @@ struct Port *		PortP;
  struct PKT *PacketP;
  register uint DataCnt;
  uchar *       ptr;
+  unsigned char *buf;
  int copied =0;
  static int intCount, RxIntCnt;
@@ -657,8 +659,7 @@ struct Port *		PortP;
          ** and available space.
          */
                        
-          transCount = min_t(unsigned int, PacketP->len & PKT_LEN_MASK,
+          transCount = tty_buffer_request_room(TtyP, PacketP->len & PKT_LEN_MASK);
-                           TTY_FLIPBUF_SIZE - TtyP->flip.count);
          rio_dprintk (RIO_DEBUG_REC,  "port %d: Copy %d bytes\n", 
                                      PortP->PortNum, transCount);
          /*
@@ -678,9 +679,8 @@ struct Port *		PortP;
 #endif
          ptr = (uchar *) PacketP->data + PortP->RxDataStart;
-          rio_memcpy_fromio (TtyP->flip.char_buf_ptr, ptr, transCount);
+          tty_prepare_flip_string(TtyP, &buf, transCount);
-          memset(TtyP->flip.flag_buf_ptr, TTY_NORMAL, transCount);
+          rio_memcpy_fromio (buf, ptr, transCount);
 #ifdef STATS
          /*
          ** keep a count for statistical purposes
@@ -690,9 +690,6 @@ struct Port *		PortP;
          PortP->RxDataStart    += transCount;
          PacketP->len          -= transCount;
          copied += transCount;
-          TtyP->flip.count += transCount;
-          TtyP->flip.char_buf_ptr += transCount;
-          TtyP->flip.flag_buf_ptr += transCount;
 #ifdef ___DEBUG_IT___
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 5dae32521620..050e70ee5920 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -46,6 +46,7 @@
 #include <linux/major.h>
 #include <linux/init.h>
 #include <linux/delay.h>
+#include <linux/tty_flip.h>
 #include <asm/uaccess.h>
@@ -354,28 +355,17 @@ static inline void rc_receive_exc(struct riscom_board const * bp)
        struct riscom_port *port;
        struct tty_struct *tty;
        unsigned char status;
-        unsigned char ch;
+        unsigned char ch, flag;
        
        if (!(port = rc_get_port(bp, "Receive")))
                return;
        tty = port->tty;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)  {
-                printk(KERN_WARNING "rc%d: port %d: Working around flip "
-                                    "buffer overflow.\n",
-                       board_No(bp), port_No(port));
-                return;
-        }
        
 #ifdef RC_REPORT_OVERRUN        
        status = rc_in(bp, CD180_RCSR);
-        if (status & RCSR_OE)  {
+        if (status & RCSR_OE)
                port->overrun++;
-#if 0           
-                printk(KERN_ERR "rc%d: port %d: Overrun. Total %ld overruns\n", 
-                       board_No(bp), port_No(port), port->overrun);
-#endif          
-        }
        status &= port->mark_mask;
 #else   
        status = rc_in(bp, CD180_RCSR) & port->mark_mask;
@@ -393,25 +383,24 @@ static inline void rc_receive_exc(struct riscom_board const * bp)
        } else if (status & RCSR_BREAK)  {
                printk(KERN_INFO "rc%d: port %d: Handling break...\n",
                       board_No(bp), port_No(port));
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                flag = TTY_BREAK;
                if (port->flags & ASYNC_SAK)
                        do_SAK(tty);
                
        } else if (status & RCSR_PE) 
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                flag = TTY_PARITY;
        
        else if (status & RCSR_FE) 
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                flag = TTY_FRAME;
        
        else if (status & RCSR_OE)
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                flag = TTY_OVERRUN;
        
        else
-                *tty->flip.flag_buf_ptr++ = 0;
+                flag = TTY_NORMAL;
        
-        *tty->flip.char_buf_ptr++ = ch;
+        tty_insert_flip_char(tty, ch, flag);
-        tty->flip.count++;
+        tty_flip_buffer_push(tty);
-        schedule_delayed_work(&tty->flip.work, 1);
 }
 static inline void rc_receive(struct riscom_board const * bp)
@@ -432,17 +421,15 @@ static inline void rc_receive(struct riscom_board const * bp)
 #endif  
        
        while (count--)  {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)  {
+                if (tty_buffer_request_room(tty, 1) == 0)  {
                        printk(KERN_WARNING "rc%d: port %d: Working around "
                                            "flip buffer overflow.\n",
                               board_No(bp), port_No(port));
                        break;
                }
-                *tty->flip.char_buf_ptr++ = rc_in(bp, CD180_RDR);
+                tty_insert_flip_char(tty, rc_in(bp, CD180_RDR), TTY_NORMAL);
-                *tty->flip.flag_buf_ptr++ = 0;
-                tty->flip.count++;
        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        tty_flip_buffer_push(tty);
 }
 static inline void rc_transmit(struct riscom_board const * bp)
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index d3bc731fbb27..0949dcef0697 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -325,19 +325,16 @@ static void rp_do_receive(struct r_port *info,
 {
        unsigned int CharNStat;
        int ToRecv, wRecv, space = 0, count;
-        unsigned char *cbuf;
+        unsigned char *cbuf, *chead;
-        char *fbuf;
+        char *fbuf, *fhead;
        struct tty_ldisc *ld;
        ld = tty_ldisc_ref(tty);
        ToRecv = sGetRxCnt(cp);
-        if (ld)
+        space = tty->receive_room;
-                space = ld->receive_room(tty);
        if (space > 2 * TTY_FLIPBUF_SIZE)
                space = 2 * TTY_FLIPBUF_SIZE;
-        cbuf = tty->flip.char_buf;
-        fbuf = tty->flip.flag_buf;
        count = 0;
 #ifdef ROCKET_DEBUG_INTR
        printk(KERN_INFO "rp_do_receive(%d, %d)...", ToRecv, space);
@@ -350,9 +347,13 @@ static void rp_do_receive(struct r_port *info,
        if (ToRecv > space)
                ToRecv = space;
+        ToRecv = tty_prepare_flip_string_flags(tty, &chead, &fhead, ToRecv);
        if (ToRecv <= 0)
                goto done;
+        cbuf = chead;
+        fbuf = fhead;
        /*
         * if status indicates there are errored characters in the
         * FIFO, then enter status mode (a word in FIFO holds
@@ -399,7 +400,7 @@ static void rp_do_receive(struct r_port *info,
                        else if (CharNStat & STMRCVROVRH)
                                *fbuf++ = TTY_OVERRUN;
                        else
-                                *fbuf++ = 0;
+                                *fbuf++ = TTY_NORMAL;
                        *cbuf++ = CharNStat & 0xff;
                        count++;
                        ToRecv--;
@@ -426,13 +427,13 @@ static void rp_do_receive(struct r_port *info,
                        sInStrW(sGetTxRxDataIO(cp), (unsigned short *) cbuf, wRecv);
                if (ToRecv & 1)
                        cbuf[ToRecv - 1] = sInB(sGetTxRxDataIO(cp));
-                memset(fbuf, 0, ToRecv);
+                memset(fbuf, TTY_NORMAL, ToRecv);
                cbuf += ToRecv;
                fbuf += ToRecv;
                count += ToRecv;
        }
        /*  Push the data up to the tty layer */
-        ld->receive_buf(tty, tty->flip.char_buf, tty->flip.flag_buf, count);
+        ld->receive_buf(tty, cbuf, fbuf, count);
 done:
        tty_ldisc_deref(ld);
 }
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index 5b187c895c18..71093a9fc462 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -275,7 +275,8 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
 int paste_selection(struct tty_struct *tty)
 {
        struct vc_data *vc = (struct vc_data *)tty->driver_data;
-        int     pasted = 0, count;
+        int     pasted = 0;
+        unsigned int count;
        struct  tty_ldisc *ld;
        DECLARE_WAITQUEUE(wait, current);
@@ -293,7 +294,7 @@ int paste_selection(struct tty_struct *tty)
                        continue;
                }
                count = sel_buffer_lth - pasted;
-                count = min(count, tty->ldisc.receive_room(tty));
+                count = min(count, tty->receive_room);
                tty->ldisc.receive_buf(tty, sel_buffer + pasted, NULL, count);
                pasted += count;
        }
diff --git a/drivers/char/ser_a2232.c b/drivers/char/ser_a2232.c
index dda30e42ec79..80a5b840e22f 100644
--- a/drivers/char/ser_a2232.c
+++ b/drivers/char/ser_a2232.c
@@ -194,11 +194,6 @@ static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
 */
        struct tty_struct *tty = port->gs.tty;
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                return;
-        tty->flip.count++;
 #if 0
        switch(err) {
        case TTY_BREAK:
@@ -212,8 +207,7 @@ static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
        }
 #endif
-        *tty->flip.flag_buf_ptr++ = err;
+        tty_insert_flip_char(tty, ch, err);
-        *tty->flip.char_buf_ptr++ = ch;
        tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index a580748b92a1..f36342ae8e7e 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -422,45 +422,35 @@ cd2401_rxerr_interrupt(int irq, void *dev_id, struct pt_regs *fp)
            base_addr[CyREOIR] = rfoc ? 0 : CyNOTRANS;
            return IRQ_HANDLED;
        }
-        if (tty->flip.count < TTY_FLIPBUF_SIZE){
+        if (tty_buffer_request_room(tty, 1) != 0){
-            tty->flip.count++;
            if (err & info->read_status_mask){
                if(err & CyBREAK){
-                    *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                    tty_insert_flip_char(tty, data, TTY_BREAK);
-                    *tty->flip.char_buf_ptr++ = data;
                    if (info->flags & ASYNC_SAK){
                        do_SAK(tty);
                    }
                }else if(err & CyFRAME){
-                    *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                    tty_insert_flip_char(tty, data, TTY_FRAME);
-                    *tty->flip.char_buf_ptr++ = data;
                }else if(err & CyPARITY){
-                    *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                    tty_insert_flip_char(tty, data, TTY_PARITY);
-                    *tty->flip.char_buf_ptr++ = data;
                }else if(err & CyOVERRUN){
-                    *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                    tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                    *tty->flip.char_buf_ptr++ = 0;
                    /*
                       If the flip buffer itself is
                       overflowing, we still loose
                       the next incoming character.
                     */
-                    if(tty->flip.count < TTY_FLIPBUF_SIZE){
+                    tty_insert_flip_char(tty, data, TTY_NORMAL);
-                        tty->flip.count++;
+                }
-                        *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                        *tty->flip.char_buf_ptr++ = data;
-                    }
                /* These two conditions may imply */
                /* a normal read should be done. */
                /* else if(data & CyTIMEOUT) */
                /* else if(data & CySPECHAR) */
                }else{
-                    *tty->flip.flag_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, 0, TTY_NORMAL);
-                    *tty->flip.char_buf_ptr++ = 0;
                }
            }else{
-                *tty->flip.flag_buf_ptr++ = 0;
+                    tty_insert_flip_char(tty, data, TTY_NORMAL);
-                *tty->flip.char_buf_ptr++ = 0;
            }
        }else{
            /* there was a software buffer overrun
@@ -692,12 +682,7 @@ cd2401_rx_interrupt(int irq, void *dev_id, struct pt_regs *fp)
 #endif
        while(char_count--){
            data = base_addr[CyRDR];
-            if (tty->flip.count >= TTY_FLIPBUF_SIZE){
+            tty_insert_flip_char(tty, data, TTY_NORMAL);
-                continue;
-            }
-            tty->flip.count++;
-            *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-            *tty->flip.char_buf_ptr++ = data;
 #ifdef CYCLOM_16Y_HACK
            udelay(10L);
 #endif
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 0bbfce43031c..0a574bdbce36 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -85,6 +85,7 @@
 #include <linux/interrupt.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/mm.h>
 #include <linux/serial.h>
 #include <linux/fcntl.h>
@@ -665,7 +666,7 @@ static inline void sx_receive_exc(struct specialix_board * bp)
        struct specialix_port *port;
        struct tty_struct *tty;
        unsigned char status;
-        unsigned char ch;
+        unsigned char ch, flag;
        func_enter();
@@ -676,8 +677,6 @@ static inline void sx_receive_exc(struct specialix_board * bp)
                return;
        }
        tty = port->tty;
-        dprintk (SX_DEBUG_RX, "port: %p count: %d BUFF_SIZE: %d\n",
-                 port,  tty->flip.count, TTY_FLIPBUF_SIZE);
        status = sx_in(bp, CD186x_RCSR);
@@ -691,7 +690,7 @@ static inline void sx_receive_exc(struct specialix_board * bp)
        /* This flip buffer check needs to be below the reading of the
           status register to reset the chip's IRQ.... */
-        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+        if (tty_buffer_request_room(tty, 1) == 0) {
                dprintk(SX_DEBUG_FIFO, "sx%d: port %d: Working around flip buffer overflow.\n",
                       board_No(bp), port_No(port));
                func_exit();
@@ -712,26 +711,24 @@ static inline void sx_receive_exc(struct specialix_board * bp)
        } else if (status & RCSR_BREAK) {
                dprintk(SX_DEBUG_RX, "sx%d: port %d: Handling break...\n",
                       board_No(bp), port_No(port));
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                flag = TTY_BREAK;
                if (port->flags & ASYNC_SAK)
                        do_SAK(tty);
        } else if (status & RCSR_PE)
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                flag = TTY_PARITY;
        else if (status & RCSR_FE)
-                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                flag = TTY_FRAME;
        else if (status & RCSR_OE)
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                flag = TTY_OVERRUN;
        else
-                *tty->flip.flag_buf_ptr++ = 0;
+                flag = TTY_NORMAL;
-        *tty->flip.char_buf_ptr++ = ch;
-        tty->flip.count++;
-        schedule_delayed_work(&tty->flip.work, 1);
+        if(tty_insert_flip_char(tty, ch, flag))
+                tty_flip_buffer_push(tty);
        func_exit();
 }
@@ -755,18 +752,11 @@ static inline void sx_receive(struct specialix_board * bp)
        dprintk (SX_DEBUG_RX, "port: %p: count: %d\n", port, count);
        port->hits[count > 8 ? 9 : count]++;
-        while (count--) {
+        tty_buffer_request_room(tty, count);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        printk(KERN_INFO "sx%d: port %d: Working around flip buffer overflow.\n",
-                               board_No(bp), port_No(port));
-                        break;
-                }
-                *tty->flip.char_buf_ptr++ = sx_in(bp, CD186x_RDR);
-                *tty->flip.flag_buf_ptr++ = 0;
-                tty->flip.count++;
-        }
-        schedule_delayed_work(&tty->flip.work, 1);
+        while (count--)
+                tty_insert_flip_char(tty, sx_in(bp, CD186x_RDR), TTY_NORMAL);
+        tty_flip_buffer_push(tty);
        func_exit();
 }
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index acef2abf3f0d..0e20780d4a29 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -2901,7 +2901,8 @@ static int stl_getportstats(stlport_t *portp, comstats_t __user *cp)
        if (portp->tty != (struct tty_struct *) NULL) {
                if (portp->tty->driver_data == portp) {
                        portp->stats.ttystate = portp->tty->flags;
-                        portp->stats.rxbuffered = portp->tty->flip.count;
+                        /* No longer available as a statistic */
+                        portp->stats.rxbuffered = 1; /*portp->tty->flip.count; */
                        if (portp->tty->termios != (struct termios *) NULL) {
                                portp->stats.cflags = portp->tty->termios->c_cflag;
                                portp->stats.iflags = portp->tty->termios->c_iflag;
@@ -4045,9 +4046,7 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
        if ((ioack & ACK_TYPMASK) == ACK_TYPRXGOOD) {
                outb((RDCR + portp->uartaddr), ioaddr);
                len = inb(ioaddr + EREG_DATA);
-                if ((tty == (struct tty_struct *) NULL) ||
+                if (tty == NULL || (buflen = tty_buffer_request_room(tty, len)) == 0) {
-                    (tty->flip.char_buf_ptr == (char *) NULL) ||
-                    ((buflen = TTY_FLIPBUF_SIZE - tty->flip.count) == 0)) {
                        len = MIN(len, sizeof(stl_unwanted));
                        outb((RDSR + portp->uartaddr), ioaddr);
                        insb((ioaddr + EREG_DATA), &stl_unwanted[0], len);
@@ -4056,12 +4055,10 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                } else {
                        len = MIN(len, buflen);
                        if (len > 0) {
+                                unsigned char *ptr;
                                outb((RDSR + portp->uartaddr), ioaddr);
-                                insb((ioaddr + EREG_DATA), tty->flip.char_buf_ptr, len);
+                                tty_prepare_flip_string(tty, &ptr, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
+                                insb((ioaddr + EREG_DATA), ptr, len);
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.count += len;
                                tty_schedule_flip(tty);
                                portp->stats.rxtotal += len;
                        }
@@ -4085,8 +4082,7 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                                portp->stats.txxoff++;
                        goto stl_rxalldone;
                }
-                if ((tty != (struct tty_struct *) NULL) &&
+                if (tty != NULL && (portp->rxignoremsk & status) == 0) {
-                    ((portp->rxignoremsk & status) == 0)) {
                        if (portp->rxmarkmsk & status) {
                                if (status & ST_BREAK) {
                                        status = TTY_BREAK;
@@ -4106,14 +4102,8 @@ static void stl_cd1400rxisr(stlpanel_t *panelp, int ioaddr)
                        } else {
                                status = 0;
                        }
-                        if (tty->flip.char_buf_ptr != (char *) NULL) {
+                        tty_insert_flip_char(tty, ch, status);
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                        tty_schedule_flip(tty);
-                                        *tty->flip.flag_buf_ptr++ = status;
-                                        *tty->flip.char_buf_ptr++ = ch;
-                                        tty->flip.count++;
-                                }
-                                tty_schedule_flip(tty);
-                        }
                }
        } else {
                printk("STALLION: bad RX interrupt ack value=%x\n", ioack);
@@ -5012,9 +5002,7 @@ static void stl_sc26198rxisr(stlport_t *portp, unsigned int iack)
        len = inb(ioaddr + XP_DATA) + 1;
        if ((iack & IVR_TYPEMASK) == IVR_RXDATA) {
-                if ((tty == (struct tty_struct *) NULL) ||
+                if (tty == NULL || (buflen = tty_buffer_request_room(tty, len)) == 0) {
-                    (tty->flip.char_buf_ptr == (char *) NULL) ||
-                    ((buflen = TTY_FLIPBUF_SIZE - tty->flip.count) == 0)) {
                        len = MIN(len, sizeof(stl_unwanted));
                        outb(GRXFIFO, (ioaddr + XP_ADDR));
                        insb((ioaddr + XP_DATA), &stl_unwanted[0], len);
@@ -5023,12 +5011,10 @@ static void stl_sc26198rxisr(stlport_t *portp, unsigned int iack)
                } else {
                        len = MIN(len, buflen);
                        if (len > 0) {
+                                unsigned char *ptr;
                                outb(GRXFIFO, (ioaddr + XP_ADDR));
-                                insb((ioaddr + XP_DATA), tty->flip.char_buf_ptr, len);
+                                tty_prepare_flip_string(tty, &ptr, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
+                                insb((ioaddr + XP_DATA), ptr, len);
-                                tty->flip.flag_buf_ptr += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.count += len;
                                tty_schedule_flip(tty);
                                portp->stats.rxtotal += len;
                        }
@@ -5096,14 +5082,8 @@ static inline void stl_sc26198rxbadch(stlport_t *portp, unsigned char status, ch
                        status = 0;
                }
-                if (tty->flip.char_buf_ptr != (char *) NULL) {
+                tty_insert_flip_char(tty, ch, status);
-                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                tty_schedule_flip(tty);
-                                *tty->flip.flag_buf_ptr++ = status;
-                                *tty->flip.char_buf_ptr++ = ch;
-                                tty->flip.count++;
-                        }
-                        tty_schedule_flip(tty);
-                }
                if (status == 0)
                        portp->stats.rxtotal++;
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 564f31778eb3..64bf89cb574f 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1085,6 +1085,7 @@ static inline void sx_receive_chars (struct sx_port *port)
        int rx_op;
        struct tty_struct *tty;
        int copied=0;
+        unsigned char *rp;
        func_enter2 ();
        tty = port->gs.tty;
@@ -1095,8 +1096,8 @@ static inline void sx_receive_chars (struct sx_port *port)
                sx_dprintk (SX_DEBUG_RECEIVE, "rxop=%d, c = %d.\n", rx_op, c); 
                /* Don't copy more bytes than there is room for in the buffer */
-                if (tty->flip.count + c > TTY_FLIPBUF_SIZE) 
-                        c = TTY_FLIPBUF_SIZE - tty->flip.count;
+                c = tty_prepare_flip_string(tty, &rp, c);
                sx_dprintk (SX_DEBUG_RECEIVE, "c = %d.\n", c); 
@@ -1111,14 +1112,8 @@ static inline void sx_receive_chars (struct sx_port *port)
                sx_dprintk (SX_DEBUG_RECEIVE , "Copying over %d chars. First is %d at %lx\n", c, 
                            read_sx_byte (port->board, CHAN_OFFSET(port,hi_rxbuf) + rx_op),
                            CHAN_OFFSET(port, hi_rxbuf)); 
-                memcpy_fromio (tty->flip.char_buf_ptr, 
+                memcpy_fromio (rp,
                               port->board->base + CHAN_OFFSET(port,hi_rxbuf) + rx_op, c);
-                memset(tty->flip.flag_buf_ptr, TTY_NORMAL, c);
-                /* Update the kernel buffer end */
-                tty->flip.count += c;
-                tty->flip.char_buf_ptr += c;
-                tty->flip.flag_buf_ptr += c;
                /* This one last. ( Not essential.)
                   It allows the card to start putting more data into the buffer! 
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index 789572fc002b..9f1b466c4f84 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -1467,6 +1467,7 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
 {
        int Fifocount;
        u16 status;
+        int work = 0;
        unsigned char DataByte;
        struct tty_struct *tty = info->tty;
        struct  mgsl_icount *icount = &info->icount;
@@ -1487,6 +1488,8 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
        /* flush the receive FIFO */
        while( (Fifocount = (usc_InReg(info,RICR) >> 8)) ) {
+                int flag;
                /* read one byte from RxFIFO */
                outw( (inw(info->io_base + CCAR) & 0x0780) | (RDR+LSBONLY),
                      info->io_base + CCAR );
@@ -1498,13 +1501,9 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
                                RXSTATUS_OVERRUN + RXSTATUS_BREAK_RECEIVED) )
                        usc_UnlatchRxstatusBits(info,RXSTATUS_ALL);
                
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        continue;
-                        
-                *tty->flip.char_buf_ptr = DataByte;
                icount->rx++;
                
-                *tty->flip.flag_buf_ptr = 0;
+                flag = 0;
                if ( status & (RXSTATUS_FRAMING_ERROR + RXSTATUS_PARITY_ERROR +
                                RXSTATUS_OVERRUN + RXSTATUS_BREAK_RECEIVED) ) {
                        printk("rxerr=%04X\n",status);                                  
@@ -1530,41 +1529,31 @@ static void mgsl_isr_receive_data( struct mgsl_struct *info )
                        status &= info->read_status_mask;
                
                        if (status & RXSTATUS_BREAK_RECEIVED) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                                if (info->flags & ASYNC_SAK)
                                        do_SAK(tty);
                        } else if (status & RXSTATUS_PARITY_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (status & RXSTATUS_FRAMING_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        if (status & RXSTATUS_OVERRUN) {
-                                /* Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                }
-                        }
                }       /* end of if (error) */
-                
+                tty_insert_flip_char(tty, DataByte, flag);
-                tty->flip.flag_buf_ptr++;
+                if (status & RXSTATUS_OVERRUN) {
-                tty->flip.char_buf_ptr++;
+                        /* Overrun is special, since it's
-                tty->flip.count++;
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        work += tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                }
        }
        if ( debug_level >= DEBUG_LEVEL_ISR ) {
-                printk("%s(%d):mgsl_isr_receive_data flip count=%d\n",
-                        __FILE__,__LINE__,tty->flip.count);
                printk("%s(%d):rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                        __FILE__,__LINE__,icount->rx,icount->brk,
                        icount->parity,icount->frame,icount->overrun);
        }
                        
-        if ( tty->flip.count )
+        if(work)
                tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 41759cd70a4f..79c81def4104 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -1749,6 +1749,9 @@ static void rx_async(struct slgt_info *info)
        unsigned char status;
        struct slgt_desc *bufs = info->rbufs;
        int i, count;
+        int chars = 0;
+        int stat;
+        unsigned char ch;
        start = end = info->rbuf_current;
@@ -1760,16 +1763,15 @@ static void rx_async(struct slgt_info *info)
                DBGDATA(info, p, count, "rx");
                for(i=0 ; i < count; i+=2, p+=2) {
-                        if (tty) {
+                        if (tty && chars) {
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                                tty_flip_buffer_push(tty);
-                                        tty_flip_buffer_push(tty);
+                                chars = 0;
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                        break;
-                                *tty->flip.char_buf_ptr = *p;
-                                *tty->flip.flag_buf_ptr = 0;
                        }
+                        ch = *p;
                        icount->rx++;
+                        stat = 0;
                        if ((status = *(p+1) & (BIT9 + BIT8))) {
                                if (status & BIT9)
                                        icount->parity++;
@@ -1778,17 +1780,14 @@ static void rx_async(struct slgt_info *info)
                                /* discard char if tty control flags say so */
                                if (status & info->ignore_status_mask)
                                        continue;
-                                if (tty) {
+                                if (status & BIT9)
-                                        if (status & BIT9)
+                                        stat = TTY_PARITY;
-                                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                else if (status & BIT8)
-                                        else if (status & BIT8)
+                                        stat = TTY_FRAME;
-                                                *tty->flip.flag_buf_ptr = TTY_FRAME;
-                                }
                        }
                        if (tty) {
-                                tty->flip.flag_buf_ptr++;
+                                tty_insert_flip_char(tty, ch, stat);
-                                tty->flip.char_buf_ptr++;
+                                chars++;
-                                tty->flip.count++;
                        }
                }
@@ -1811,7 +1810,7 @@ static void rx_async(struct slgt_info *info)
                        break;
        }
-        if (tty && tty->flip.count)
+        if (tty && chars)
                tty_flip_buffer_push(tty);
 }
@@ -2029,7 +2028,7 @@ static void isr_serial(struct slgt_info *info)
                        if (info->tty) {
                                if (!(status & info->ignore_status_mask)) {
                                        if (info->read_status_mask & MASK_BREAK) {
-                                                *info->tty->flip.flag_buf_ptr = TTY_BREAK;
+                                                tty_insert_flip_char(info->tty, 0, TTY_BREAK);
                                                if (info->flags & ASYNC_SAK)
                                                        do_SAK(info->tty);
                                        }
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index a9467e7d3747..960adb256fbb 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -2196,7 +2196,7 @@ void isr_rxint(SLMP_INFO * info)
                        if ( tty ) {
                                if (!(status & info->ignore_status_mask1)) {
                                        if (info->read_status_mask1 & BRKD) {
-                                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                                tty_insert_flip_char(tty, 0, TTY_BREAK);
                                                if (info->flags & ASYNC_SAK)
                                                        do_SAK(tty);
                                        }
@@ -2240,16 +2240,10 @@ void isr_rxrdy(SLMP_INFO * info)
        while((status = read_reg(info,CST0)) & BIT0)
        {
+                int flag = 0;
+                int over = 0;
                DataByte = read_reg(info,TRB);
-                if ( tty ) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                continue;
-                        *tty->flip.char_buf_ptr = DataByte;
-                        *tty->flip.flag_buf_ptr = 0;
-                }
                icount->rx++;
                if ( status & (PE + FRME + OVRN) ) {
@@ -2272,42 +2266,34 @@ void isr_rxrdy(SLMP_INFO * info)
                        if ( tty ) {
                                if (status & PE)
-                                        *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                else if (status & FRME)
-                                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                        flag = TTY_FRAME;
                                if (status & OVRN) {
                                        /* Overrun is special, since it's
                                         * reported immediately, and doesn't
                                         * affect the current character
                                         */
-                                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                                        over = 1;
-                                                tty->flip.count++;
-                                                tty->flip.flag_buf_ptr++;
-                                                tty->flip.char_buf_ptr++;
-                                                *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                        }
                                }
                        }
                }       /* end of if (error) */
                if ( tty ) {
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, DataByte, flag);
-                        tty->flip.char_buf_ptr++;
+                        if (over)
-                        tty->flip.count++;
+                                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                }
        }
        if ( debug_level >= DEBUG_LEVEL_ISR ) {
-                printk("%s(%d):%s isr_rxrdy() flip count=%d\n",
-                        __FILE__,__LINE__,info->device_name,
-                        tty ? tty->flip.count : 0);
                printk("%s(%d):%s rx=%d brk=%d parity=%d frame=%d overrun=%d\n",
                        __FILE__,__LINE__,info->device_name,
                        icount->rx,icount->brk,icount->parity,
                        icount->frame,icount->overrun);
        }
-        if ( tty && tty->flip.count )
+        if ( tty )
                tty_flip_buffer_push(tty);
 }
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 4b1eef51ec59..1eda82b31a61 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -166,9 +166,12 @@ static struct tty_struct *alloc_tty_struct(void)
        return tty;
 }
+static void tty_buffer_free_all(struct tty_struct *);
 static inline void free_tty_struct(struct tty_struct *tty)
 {
        kfree(tty->write_buf);
+        tty_buffer_free_all(tty);
        kfree(tty);
 }
@@ -231,6 +234,201 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
 }
 /*
+ * Tty buffer allocation management
+ */
+static void tty_buffer_free_all(struct tty_struct *tty)
+{
+        struct tty_buffer *thead;
+        while((thead = tty->buf.head) != NULL) {
+                tty->buf.head = thead->next;
+                kfree(thead);
+        }
+        while((thead = tty->buf.free) != NULL) {
+                tty->buf.free = thead->next;
+                kfree(thead);
+        }
+        tty->buf.tail = NULL;
+}
+static void tty_buffer_init(struct tty_struct *tty)
+{
+        tty->buf.head = NULL;
+        tty->buf.tail = NULL;
+        tty->buf.free = NULL;
+}
+static struct tty_buffer *tty_buffer_alloc(size_t size)
+{
+        struct tty_buffer *p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
+        if(p == NULL)
+                return NULL;
+        p->used = 0;
+        p->size = size;
+        p->next = NULL;
+        p->char_buf_ptr = (char *)(p->data);
+        p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
+/*      printk("Flip create %p\n", p); */
+        return p;
+}
+/* Must be called with the tty_read lock held. This needs to acquire strategy
+   code to decide if we should kfree or relink a given expired buffer */
+static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
+{
+        /* Dumb strategy for now - should keep some stats */
+/*      printk("Flip dispose %p\n", b); */
+        if(b->size >= 512)
+                kfree(b);
+        else {
+                b->next = tty->buf.free;
+                tty->buf.free = b;
+        }
+}
+static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer **tbh = &tty->buf.free;
+        while((*tbh) != NULL) {
+                struct tty_buffer *t = *tbh;
+                if(t->size >= size) {
+                        *tbh = t->next;
+                        t->next = NULL;
+                        t->used = 0;
+                        /* DEBUG ONLY */
+                        memset(t->data, '*', size);
+/*                      printk("Flip recycle %p\n", t); */
+                        return t;
+                }
+                tbh = &((*tbh)->next);
+        }
+        /* Round the buffer size out */
+        size = (size + 0xFF) & ~ 0xFF;
+        return tty_buffer_alloc(size);
+        /* Should possibly check if this fails for the largest buffer we
+           have queued and recycle that ? */
+}
+int tty_buffer_request_room(struct tty_struct *tty, size_t size)
+{
+        struct tty_buffer *b = tty->buf.head, *n;
+        int left = 0;
+        /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
+           remove this conditional if its worth it. This would be invisible
+           to the callers */
+        if(b != NULL)
+                left = b->size - b->used;
+        if(left >= size)
+                return size;
+        /* This is the slow path - looking for new buffers to use */
+        n = tty_buffer_find(tty, size);
+        if(n == NULL)
+                return left;
+        n->next = b;
+        if(b != NULL)
+                b->next = n;
+        else
+                tty->buf.head = n;
+        tty->buf.tail = n;
+        return size;
+}
+EXPORT_SYMBOL_GPL(tty_buffer_request_room);
+int tty_insert_flip_string(struct tty_struct *tty, unsigned char *chars, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if(unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+/*              printk("Flip insert %d.\n", space); */
+        }
+        /* There is a small chance that we need to split the data over
+           several buffers. If this is the case we must loop */
+        while (unlikely(size > copied));
+        return copied;
+}
+EXPORT_SYMBOL_GPL(tty_insert_flip_string);
+int tty_insert_flip_string_flags(struct tty_struct *tty, unsigned char *chars, char *flags, size_t size)
+{
+        int copied = 0;
+        do {
+                int space = tty_buffer_request_room(tty, size - copied);
+                struct tty_buffer *tb = tty->buf.tail;
+                /* If there is no space then tb may be NULL */
+                if(unlikely(space == 0))
+                        break;
+                memcpy(tb->char_buf_ptr + tb->used, chars, space);
+                memcpy(tb->flag_buf_ptr + tb->used, flags, space);
+                tb->used += space;
+                copied += space;
+                chars += space;
+                flags += space;
+        }
+        /* There is a small chance that we need to split the data over
+           several buffers. If this is the case we must loop */
+        while (unlikely(size > copied));
+        return copied;
+}
+EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
+/*
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for normal characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ */
+int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        struct tty_buffer *tb = tty->buf.tail;
+        *chars = tb->char_buf_ptr + tb->used;
+        memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
+        tb->used += space;
+        return space;
+}
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
+/*
+ *      Prepare a block of space in the buffer for data. Returns the length
+ *      available and buffer pointer to the space which is now allocated and
+ *      accounted for as ready for characters. This is used for drivers
+ *      that need their own block copy routines into the buffer. There is no
+ *      guarantee the buffer is a DMA target!
+ */
+int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
+{
+        int space = tty_buffer_request_room(tty, size);
+        struct tty_buffer *tb = tty->buf.tail;
+        *chars = tb->char_buf_ptr + tb->used;
+        *flags = tb->flag_buf_ptr + tb->used;
+        tb->used += space;
+        return space;
+}
+EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
+/*
 *      This is probably overkill for real world processors but
 *      they are not on hot paths so a little discipline won't do 
 *      any harm.
@@ -492,6 +690,17 @@ restart:
        if (ld == NULL)
                return -EINVAL;
+        /*
+         *      No more input please, we are switching. The new ldisc
+         *      will update this value in the ldisc open function
+         */
+        tty->receive_room = 0;
+        /*
+         *      Problem: What do we do if this blocks ?
+         */
        tty_wait_until_sent(tty, 0);
        if (tty->ldisc.num == ldisc) {
@@ -560,9 +769,9 @@ restart:
         *      we say so later on.
         */
-        work = cancel_delayed_work(&tty->flip.work);
+        work = cancel_delayed_work(&tty->buf.work);
        /*
-         * Wait for ->hangup_work and ->flip.work handlers to terminate
+         * Wait for ->hangup_work and ->buf.work handlers to terminate
         */
         
        flush_scheduled_work();
@@ -616,7 +825,7 @@ restart:
        /* Restart it in case no characters kick it off. Safe if
           already running */
        if (work)
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
        return retval;
 }
@@ -1721,10 +1930,10 @@ static void release_dev(struct file * filp)
         */
        clear_bit(TTY_LDISC, &tty->flags);
        clear_bit(TTY_DONT_FLIP, &tty->flags);
-        cancel_delayed_work(&tty->flip.work);
+        cancel_delayed_work(&tty->buf.work);
        /*
-         * Wait for ->hangup_work and ->flip.work handlers to terminate
+         * Wait for ->hangup_work and ->buf.work handlers to terminate
         */
         
        flush_scheduled_work();
@@ -2518,17 +2727,15 @@ EXPORT_SYMBOL(do_SAK);
 /*
 * This routine is called out of the software interrupt to flush data
- * from the flip buffer to the line discipline. 
+ * from the buffer chain to the line discipline.
 */
 
 static void flush_to_ldisc(void *private_)
 {
        struct tty_struct *tty = (struct tty_struct *) private_;
-        unsigned char   *cp;
-        char            *fp;
-        int             count;
        unsigned long   flags;
        struct tty_ldisc *disc;
+        struct tty_buffer *tbuf;
        disc = tty_ldisc_ref(tty);
        if (disc == NULL)       /*  !TTY_LDISC */
@@ -2538,28 +2745,22 @@ static void flush_to_ldisc(void *private_)
                /*
                 * Do it after the next timer tick:
                 */
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
                goto out;
        }
        spin_lock_irqsave(&tty->read_lock, flags);
-        if (tty->flip.buf_num) {
+        while((tbuf = tty->buf.head) != NULL) {
-                cp = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
+                tty->buf.head = tbuf->next;
-                fp = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
+                spin_unlock_irqrestore(&tty->read_lock, flags);
-                tty->flip.buf_num = 0;
+                /* printk("Process buffer %p for %d\n", tbuf, tbuf->used); */
-                tty->flip.char_buf_ptr = tty->flip.char_buf;
+                disc->receive_buf(tty, tbuf->char_buf_ptr,
-                tty->flip.flag_buf_ptr = tty->flip.flag_buf;
+                                       tbuf->flag_buf_ptr,
-        } else {
+                                       tbuf->used);
-                cp = tty->flip.char_buf;
+                spin_lock_irqsave(&tty->read_lock, flags);
-                fp = tty->flip.flag_buf;
+                tty_buffer_free(tty, tbuf);
-                tty->flip.buf_num = 1;
+        }
-                tty->flip.char_buf_ptr = tty->flip.char_buf + TTY_FLIPBUF_SIZE;
+        tty->buf.tail = NULL;
-                tty->flip.flag_buf_ptr = tty->flip.flag_buf + TTY_FLIPBUF_SIZE;
-        }
-        count = tty->flip.count;
-        tty->flip.count = 0;
        spin_unlock_irqrestore(&tty->read_lock, flags);
-        disc->receive_buf(tty, cp, fp, count);
 out:
        tty_ldisc_deref(disc);
 }
@@ -2654,11 +2855,12 @@ void tty_flip_buffer_push(struct tty_struct *tty)
        if (tty->low_latency)
                flush_to_ldisc((void *) tty);
        else
-                schedule_delayed_work(&tty->flip.work, 1);
+                schedule_delayed_work(&tty->buf.work, 1);
 }
 EXPORT_SYMBOL(tty_flip_buffer_push);
 /*
 * This subroutine initializes a tty structure.
 */
@@ -2669,10 +2871,10 @@ static void initialize_tty_struct(struct tty_struct *tty)
        tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
        tty->pgrp = -1;
        tty->overrun_time = jiffies;
-        tty->flip.char_buf_ptr = tty->flip.char_buf;
+        tty->buf.head = tty->buf.tail = NULL;
-        tty->flip.flag_buf_ptr = tty->flip.flag_buf;
+        tty_buffer_init(tty);
-        INIT_WORK(&tty->flip.work, flush_to_ldisc, tty);
+        INIT_WORK(&tty->buf.work, flush_to_ldisc, tty);
-        init_MUTEX(&tty->flip.pty_sem);
+        init_MUTEX(&tty->buf.pty_sem);
        init_MUTEX(&tty->termios_sem);
        init_waitqueue_head(&tty->write_wait);
        init_waitqueue_head(&tty->read_wait);
diff --git a/drivers/char/viocons.c b/drivers/char/viocons.c
index 4d75c261f98a..cb82ebf4cb07 100644
--- a/drivers/char/viocons.c
+++ b/drivers/char/viocons.c
@@ -993,11 +993,10 @@ static void vioHandleData(struct HvLpEvent *event)
                 * Don't attempt to copy more data into the buffer than we
                 * have room for because it would fail without indication.
                 */
-                if ((tty->flip.count + 1) > TTY_FLIPBUF_SIZE) {
+                if(tty_insert_flip_char(tty, cevent->data[index], TTY_NORMAL) == 0) {
                        printk(VIOCONS_KERN_WARN "input buffer overflow!\n");
                        break;
                }
-                tty_insert_flip_char(tty, cevent->data[index], TTY_NORMAL);
        }
        /* if cevent->len == 0 then no data was added to the buffer and flip.count == 0 */
diff --git a/drivers/char/vme_scc.c b/drivers/char/vme_scc.c
index 33e71e23b212..d9325281e482 100644
--- a/drivers/char/vme_scc.c
+++ b/drivers/char/vme_scc.c
@@ -434,13 +434,7 @@ static irqreturn_t scc_rx_int(int irq, void *data, struct pt_regs *fp)
                SCCwrite_NB(COMMAND_REG, CR_HIGHEST_IUS_RESET);
                return IRQ_HANDLED;
        }
-        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+        tty_insert_flip_char(tty, ch, 0);
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = 0;
-                tty->flip.flag_buf_ptr++;
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
-        }
        /* Check if another character is already ready; in that case, the
         * spcond_int() function must be used, because this character may have an
@@ -487,13 +481,7 @@ static irqreturn_t scc_spcond_int(int irq, void *data, struct pt_regs *fp)
                else
                        err = 0;
-                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
+                tty_insert_flip_char(tty, ch, err);
-                        *tty->flip.char_buf_ptr = ch;
-                        *tty->flip.flag_buf_ptr = err;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
                /* ++TeSche: *All* errors have to be cleared manually,
                 * else the condition persists for the next chars
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 1bd88fca0542..54a680cc704d 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -96,6 +96,7 @@ static int serport_ldisc_open(struct tty_struct *tty)
        init_waitqueue_head(&serport->wait);
        tty->disc_data = serport;
+        tty->receive_room = 256;
        set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
        return 0;
@@ -140,17 +141,6 @@ out:
 }
 /*
- * serport_ldisc_room() reports how much room we do have for receiving data.
- * Although we in fact have infinite room, we need to specify some value
- * here, and 256 seems to be reasonable.
- */
-static int serport_ldisc_room(struct tty_struct *tty)
-{
-        return 256;
-}
-/*
 * serport_ldisc_read() just waits indefinitely if everything goes well.
 * However, when the serio driver closes the serio port, it finishes,
 * returning 0 characters.
@@ -237,7 +227,6 @@ static struct tty_ldisc serport_ldisc = {
        .read =         serport_ldisc_read,
        .ioctl =        serport_ldisc_ioctl,
        .receive_buf =  serport_ldisc_receive,
-        .receive_room = serport_ldisc_room,
        .write_wakeup = serport_ldisc_write_wakeup
 };
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 11ae0fddea04..623adbb0d13a 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -463,8 +463,7 @@ static int handle_recv_skb(struct capiminor *mp, struct sk_buff *skb)
 #endif
                goto bad;
        }
-        if (ld->receive_room &&
+        if (mp->tty->receive_room < datalen) {
-            ld->receive_room(mp->tty) < datalen) {
 #if defined(_DEBUG_DATAFLOW) || defined(_DEBUG_TTYFUNCS)
                printk(KERN_DEBUG "capi: no room in tty\n");
 #endif
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 4643df097bfe..22759c01746a 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -857,6 +857,118 @@ isdn_readbchan(int di, int channel, u_char * buf, u_char * fp, int len, wait_que
        return count;
 }
+/*
+ * isdn_readbchan_tty() tries to get data from the read-queue.
+ * It MUST be called with interrupts off.
+ *
+ * Be aware that this is not an atomic operation when sleep != 0, even though
+ * interrupts are turned off! Well, like that we are currently only called
+ * on behalf of a read system call on raw device files (which are documented
+ * to be dangerous and for for debugging purpose only). The inode semaphore
+ * takes care that this is not called for the same minor device number while
+ * we are sleeping, but access is not serialized against simultaneous read()
+ * from the corresponding ttyI device. Can other ugly events, like changes
+ * of the mapping (di,ch)<->minor, happen during the sleep? --he
+ */
+int
+isdn_readbchan_tty(int di, int channel, struct tty_struct *tty, int cisco_hack)
+{
+        int count;
+        int count_pull;
+        int count_put;
+        int dflag;
+        struct sk_buff *skb;
+        char last = 0;
+        int len;
+        if (!dev->drv[di])
+                return 0;
+        if (skb_queue_empty(&dev->drv[di]->rpqueue[channel]))
+                        return 0;
+        len = tty_buffer_request_room(tty, dev->drv[di]->rcvcount[channel]);
+        if(len == 0)
+                return len;
+        count = 0;
+        while (len) {
+                if (!(skb = skb_peek(&dev->drv[di]->rpqueue[channel])))
+                        break;
+#ifdef CONFIG_ISDN_AUDIO
+                if (ISDN_AUDIO_SKB_LOCK(skb))
+                        break;
+                ISDN_AUDIO_SKB_LOCK(skb) = 1;
+                if ((ISDN_AUDIO_SKB_DLECOUNT(skb)) || (dev->drv[di]->DLEflag & (1 << channel))) {
+                        char *p = skb->data;
+                        unsigned long DLEmask = (1 << channel);
+                        dflag = 0;
+                        count_pull = count_put = 0;
+                        while ((count_pull < skb->len) && (len > 0)) {
+                                len--;
+                                if (dev->drv[di]->DLEflag & DLEmask) {
+                                        last = DLE;
+                                        dev->drv[di]->DLEflag &= ~DLEmask;
+                                } else {
+                                        last = *p;
+                                        if (last == DLE) {
+                                                dev->drv[di]->DLEflag |= DLEmask;
+                                                (ISDN_AUDIO_SKB_DLECOUNT(skb))--;
+                                        }
+                                        p++;
+                                        count_pull++;
+                                }
+                                count_put++;
+                        }
+                        if (count_pull >= skb->len)
+                                dflag = 1;
+                } else {
+#endif
+                        /* No DLE's in buff, so simply copy it */
+                        dflag = 1;
+                        if ((count_pull = skb->len) > len) {
+                                count_pull = len;
+                                dflag = 0;
+                        }
+                        count_put = count_pull;
+                        if(count_put > 1)
+                                tty_insert_flip_string(tty, skb->data, count_put - 1);
+                        last = skb->data[count_put] - 1;
+                        len -= count_put;
+#ifdef CONFIG_ISDN_AUDIO
+                }
+#endif
+                count += count_put;
+                if (dflag) {
+                        /* We got all the data in this buff.
+                         * Now we can dequeue it.
+                         */
+                        if(cisco_hack)
+                                tty_insert_flip_char(tty, last, 0xFF);
+                        else
+                                tty_insert_flip_char(tty, last, TTY_NORMAL);
+#ifdef CONFIG_ISDN_AUDIO
+                        ISDN_AUDIO_SKB_LOCK(skb) = 0;
+#endif
+                        skb = skb_dequeue(&dev->drv[di]->rpqueue[channel]);
+                        dev_kfree_skb(skb);
+                } else {
+                        tty_insert_flip_char(tty, last, TTY_NORMAL);
+                        /* Not yet emptied this buff, so it
+                         * must stay in the queue, for further calls
+                         * but we pull off the data we got until now.
+                         */
+                        skb_pull(skb, count_pull);
+#ifdef CONFIG_ISDN_AUDIO
+                        ISDN_AUDIO_SKB_LOCK(skb) = 0;
+#endif
+                }
+                dev->drv[di]->rcvcount[channel] -= count_put;
+        }
+        return count;
+}
 static __inline int
 isdn_minor2drv(int minor)
 {
diff --git a/drivers/isdn/i4l/isdn_common.h b/drivers/isdn/i4l/isdn_common.h
index e27e9c3a81ed..082735dbb412 100644
--- a/drivers/isdn/i4l/isdn_common.h
+++ b/drivers/isdn/i4l/isdn_common.h
@@ -37,6 +37,7 @@ extern void isdn_timer_ctrl(int tf, int onoff);
 extern void isdn_unexclusive_channel(int di, int ch);
 extern int  isdn_getnum(char **);
 extern int  isdn_readbchan(int, int, u_char *, u_char *, int, wait_queue_head_t *);
+extern int  isdn_readbchan_tty(int, int, struct tty_struct *, int);
 extern int  isdn_get_free_channel(int, int, int, int, int, char *);
 extern int  isdn_writebuf_skb_stub(int, int, int, struct sk_buff *);
 extern int  register_isdn(isdn_if * i);
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index 8c404b4e2482..f190a99604f0 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -64,37 +64,42 @@ isdn_tty_try_read(modem_info * info, struct sk_buff *skb)
        int c;
        int len;
        struct tty_struct *tty;
+        char last;
        if (info->online) {
                if ((tty = info->tty)) {
                        if (info->mcr & UART_MCR_RTS) {
-                                c = TTY_FLIPBUF_SIZE - tty->flip.count;
                                len = skb->len
 #ifdef CONFIG_ISDN_AUDIO
                                        + ISDN_AUDIO_SKB_DLECOUNT(skb)
 #endif
                                        ;
+                                c = tty_buffer_request_room(tty, len);
                                if (c >= len) {
 #ifdef CONFIG_ISDN_AUDIO
-                                        if (ISDN_AUDIO_SKB_DLECOUNT(skb))
+                                        if (ISDN_AUDIO_SKB_DLECOUNT(skb)) {
-                                                while (skb->len--) {
+                                                int l = skb->len;
+                                                unsigned char *dp = skb->data;
+                                                while (--l) {
                                                        if (*skb->data == DLE)
                                                                tty_insert_flip_char(tty, DLE, 0);
-                                                        tty_insert_flip_char(tty, *skb->data++, 0);
+                                                        tty_insert_flip_char(tty, *dp++, 0);
+                                                }
+                                                last = *dp;
                                        } else {
 #endif
-                                                memcpy(tty->flip.char_buf_ptr,
+                                                if(len > 1)
-                                                       skb->data, len);
+                                                        tty_insert_flip_string(tty, skb->data, len - 1);
-                                                tty->flip.count += len;
+                                                last = skb->data[len - 1];
-                                                tty->flip.char_buf_ptr += len;
-                                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                                tty->flip.flag_buf_ptr += len;
 #ifdef CONFIG_ISDN_AUDIO
                                        }
 #endif
                                        if (info->emu.mdmreg[REG_CPPP] & BIT_CPPP)
-                                                tty->flip.flag_buf_ptr[len - 1] = 0xff;
+                                                tty_insert_flip_char(tty, last, 0xFF);
-                                        schedule_delayed_work(&tty->flip.work, 1);
+                                        else
+                                                tty_insert_flip_char(tty, last, TTY_NORMAL);
+                                        tty_flip_buffer_push(tty);
                                        kfree_skb(skb);
                                        return 1;
                                }
@@ -114,7 +119,6 @@ isdn_tty_readmodem(void)
        int resched = 0;
        int midx;
        int i;
-        int c;
        int r;
        struct tty_struct *tty;
        modem_info *info;
@@ -131,20 +135,13 @@ isdn_tty_readmodem(void)
 #endif
                                if ((tty = info->tty)) {
                                        if (info->mcr & UART_MCR_RTS) {
-                                                c = TTY_FLIPBUF_SIZE - tty->flip.count;
+                                                /* CISCO AsyncPPP Hack */
-                                                if (c > 0) {
+                                                if (!(info->emu.mdmreg[REG_CPPP] & BIT_CPPP))
-                                                        r = isdn_readbchan(info->isdn_driver, info->isdn_channel,
+                                                        r = isdn_readbchan_tty(info->isdn_driver, info->isdn_channel, tty, 0);
-                                                                           tty->flip.char_buf_ptr,
+                                                else
-                                                                           tty->flip.flag_buf_ptr, c, NULL);
+                                                        r = isdn_readbchan_tty(info->isdn_driver, info->isdn_channel, tty, 1);
-                                                        /* CISCO AsyncPPP Hack */
+                                                if (r)
-                                                        if (!(info->emu.mdmreg[REG_CPPP] & BIT_CPPP))
+                                                        tty_flip_buffer_push(tty);
-                                                                memset(tty->flip.flag_buf_ptr, 0, r);
-                                                        tty->flip.count += r;
-                                                        tty->flip.flag_buf_ptr += r;
-                                                        tty->flip.char_buf_ptr += r;
-                                                        if (r)
-                                                                schedule_delayed_work(&tty->flip.work, 1);
-                                                }
                                        } else
                                                r = 1;
                                } else
@@ -249,7 +246,7 @@ isdn_tty_rcv_skb(int i, int di, int channel, struct sk_buff *skb)
        }
 #endif
 #endif
-        /* Try to deliver directly via tty-flip-buf if queue is empty */
+        /* Try to deliver directly via tty-buf if queue is empty */
        spin_lock_irqsave(&info->readlock, flags);
        if (skb_queue_empty(&dev->drv[di]->rpqueue[channel]))
                if (isdn_tty_try_read(info, skb)) {
@@ -534,7 +531,7 @@ isdn_tty_senddown(modem_info * info)
 /* The next routine is called once from within timer-interrupt
 * triggered within isdn_tty_modem_ncarrier(). It calls
 * isdn_tty_modem_result() to stuff a "NO CARRIER" Message
- * into the tty's flip-buffer.
+ * into the tty's buffer.
 */
 static void
 isdn_tty_modem_do_ncarrier(unsigned long data)
@@ -2347,6 +2344,7 @@ isdn_tty_at_cout(char *msg, modem_info * info)
        u_long flags;
        struct sk_buff *skb = NULL;
        char *sp = NULL;
+        int l = strlen(msg);
        if (!msg) {
                printk(KERN_WARNING "isdn_tty: Null-Message in isdn_tty_at_cout\n");
@@ -2359,16 +2357,16 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                return;
        }
-        /* use queue instead of direct flip, if online and */
+        /* use queue instead of direct, if online and */
-        /* data is in queue or flip buffer is full */
+        /* data is in queue or buffer is full */
-        if ((info->online) && (((tty->flip.count + strlen(msg)) >= TTY_FLIPBUF_SIZE) ||
+        if ((info->online && tty_buffer_request_room(tty, l) < l) ||
-            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel])))) {
+            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {
-                skb = alloc_skb(strlen(msg), GFP_ATOMIC);
+                skb = alloc_skb(l, GFP_ATOMIC);
                if (!skb) {
                        spin_unlock_irqrestore(&info->readlock, flags);
                        return;
                }
-                sp = skb_put(skb, strlen(msg));
+                sp = skb_put(skb, l);
 #ifdef CONFIG_ISDN_AUDIO
                ISDN_AUDIO_SKB_DLECOUNT(skb) = 0;
                ISDN_AUDIO_SKB_LOCK(skb) = 0;
@@ -2392,9 +2390,8 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                if (skb) {
                        *sp++ = c;
                } else {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        if(tty_insert_flip_char(tty, c, TTY_NORMAL) == 0)
                                break;
-                        tty_insert_flip_char(tty, c, 0);
                }
        }
        if (skb) {
@@ -2402,12 +2399,12 @@ isdn_tty_at_cout(char *msg, modem_info * info)
                dev->drv[info->isdn_driver]->rcvcount[info->isdn_channel] += skb->len;
                spin_unlock_irqrestore(&info->readlock, flags);
                /* Schedule dequeuing */
-                if ((dev->modempoll) && (info->rcvsched))
+                if (dev->modempoll && info->rcvsched)
                        isdn_timer_ctrl(ISDN_TIMER_MODEMREAD, 1);
        } else {
                spin_unlock_irqrestore(&info->readlock, flags);
-                schedule_delayed_work(&tty->flip.work, 1);
+                tty_flip_buffer_push(tty);
        }
 }
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 90999867a32c..102c1f0b90da 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -456,11 +456,6 @@ out:
 /* ----------------------------------------------------------------------- */
-static int sixpack_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Handle the 'receiver data ready' interrupt.
 * This function is called by the 'tty_io' module in the kernel when
@@ -671,6 +666,7 @@ static int sixpack_open(struct tty_struct *tty)
        /* Done.  We have linked the TTY line to a channel. */
        tty->disc_data = sp;
+        tty->receive_room = 65536;
        /* Now we're ready to register. */
        if (register_netdev(dev))
@@ -802,7 +798,6 @@ static struct tty_ldisc sp_ldisc = {
        .close          = sixpack_close,
        .ioctl          = sixpack_ioctl,
        .receive_buf    = sixpack_receive_buf,
-        .receive_room   = sixpack_receive_room,
        .write_wakeup   = sixpack_write_wakeup,
 };
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index f4424cf886c5..dc5e9d59deed 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -753,6 +753,7 @@ static int mkiss_open(struct tty_struct *tty)
        ax->tty = tty;
        tty->disc_data = ax;
+        tty->receive_room = 65535;
        if (tty->driver->flush_buffer)
                tty->driver->flush_buffer(tty);
@@ -940,11 +941,6 @@ static void mkiss_receive_buf(struct tty_struct *tty, const unsigned char *cp,
                tty->driver->unthrottle(tty);
 }
-static int mkiss_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Called by the driver when there's room for more data.  If we have
 * more packets to send, we send them here.
@@ -983,7 +979,6 @@ static struct tty_ldisc ax_ldisc = {
        .close          = mkiss_close,
        .ioctl          = mkiss_ioctl,
        .receive_buf    = mkiss_receive_buf,
-        .receive_room   = mkiss_receive_room,
        .write_wakeup   = mkiss_write_wakeup
 };
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index b8d112348ba4..101750bf210f 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -289,22 +289,6 @@ static void irtty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 }
 /*
- * Function irtty_receive_room (tty)
- *
- *    Used by the TTY to find out how much data we can receive at a time
- * 
-*/
-static int irtty_receive_room(struct tty_struct *tty) 
-{
-        struct sirtty_cb *priv = tty->disc_data;
-        IRDA_ASSERT(priv != NULL, return 0;);
-        IRDA_ASSERT(priv->magic == IRTTY_MAGIC, return 0;);
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
-/*
 * Function irtty_write_wakeup (tty)
 *
 *    Called by the driver when there's room for more data.  If we have
@@ -534,6 +518,7 @@ static int irtty_open(struct tty_struct *tty)
        dev->priv = priv;
        tty->disc_data = priv;
+        tty->receive_room = 65536;
        up(&irtty_sem);
@@ -605,7 +590,6 @@ static struct tty_ldisc irda_ldisc = {
        .ioctl          = irtty_ioctl,
        .poll           = NULL,
        .receive_buf    = irtty_receive_buf,
-        .receive_room   = irtty_receive_room,
        .write_wakeup   = irtty_write_wakeup,
        .owner          = THIS_MODULE,
 };
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 400f652282d7..aa6540b39466 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -189,7 +189,7 @@ ppp_asynctty_open(struct tty_struct *tty)
                goto out_free;
        tty->disc_data = ap;
+        tty->receive_room = 65536;
        return 0;
 out_free:
@@ -343,12 +343,6 @@ ppp_asynctty_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
        return 0;
 }
-static int
-ppp_asynctty_room(struct tty_struct *tty)
-{
-        return 65535;
-}
 /*
 * This can now be called from hard interrupt level as well
 * as soft interrupt level or mainline.
@@ -398,7 +392,6 @@ static struct tty_ldisc ppp_ldisc = {
        .write  = ppp_asynctty_write,
        .ioctl  = ppp_asynctty_ioctl,
        .poll   = ppp_asynctty_poll,
-        .receive_room = ppp_asynctty_room,
        .receive_buf = ppp_asynctty_receive,
        .write_wakeup = ppp_asynctty_wakeup,
 };
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index 4d51c0c8023d..33cb8254e79d 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -237,7 +237,7 @@ ppp_sync_open(struct tty_struct *tty)
                goto out_free;
        tty->disc_data = ap;
+        tty->receive_room = 65536;
        return 0;
 out_free:
@@ -384,12 +384,6 @@ ppp_sync_poll(struct tty_struct *tty, struct file *file, poll_table *wait)
        return 0;
 }
-static int
-ppp_sync_room(struct tty_struct *tty)
-{
-        return 65535;
-}
 /*
 * This can now be called from hard interrupt level as well
 * as soft interrupt level or mainline.
@@ -439,7 +433,6 @@ static struct tty_ldisc ppp_sync_ldisc = {
        .write  = ppp_sync_write,
        .ioctl  = ppp_synctty_ioctl,
        .poll   = ppp_sync_poll,
-        .receive_room = ppp_sync_room,
        .receive_buf = ppp_sync_receive,
        .write_wakeup = ppp_sync_wakeup,
 };
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 404ea4297e32..b2e18d28850d 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -651,11 +651,6 @@ static void sl_setup(struct net_device *dev)
 ******************************************/
-static int slip_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Handle the 'receiver data ready' interrupt.
 * This function is called by the 'tty_io' module in the kernel when
@@ -869,10 +864,6 @@ static int slip_open(struct tty_struct *tty)
        sl->line = tty_devnum(tty);
        sl->pid = current->pid;
        
-        /* FIXME: already done before we were called - seems this can go */
-        if (tty->driver->flush_buffer)
-                tty->driver->flush_buffer(tty);
-                
        if (!test_bit(SLF_INUSE, &sl->flags)) {
                /* Perform the low-level SLIP initialization. */
                if ((err = sl_alloc_bufs(sl, SL_MTU)) != 0)
@@ -897,6 +888,7 @@ static int slip_open(struct tty_struct *tty)
        /* Done.  We have linked the TTY line to a channel. */
        rtnl_unlock();
+        tty->receive_room = 65536;      /* We don't flow control */
        return sl->dev->base_addr;
 err_free_bufs:
@@ -1329,7 +1321,6 @@ static struct tty_ldisc	sl_ldisc = {
        .close          = slip_close,
        .ioctl          = slip_ioctl,
        .receive_buf    = slip_receive_buf,
-        .receive_room   = slip_receive_room,
        .write_wakeup   = slip_write_wakeup,
 };
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 52f26b9c69d2..931cbdf6d791 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -689,7 +689,7 @@ static void cpc_tty_rx_work(void * data)
                                        }
                                }       
                                cpc_tty->buf_rx.first = cpc_tty->buf_rx.first->next;
-                                kfree(buf);
+                                kfree((void *)buf);
                                buf = cpc_tty->buf_rx.first;
                                flg_rx = 1;
                        }
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index bdf672c48182..9c3ccc669143 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -515,11 +515,6 @@ static int x25_asy_close(struct net_device *dev)
        return 0;
 }
-static int x25_asy_receive_room(struct tty_struct *tty)
-{
-        return 65536;  /* We can handle an infinite amount of data. :-) */
-}
 /*
 * Handle the 'receiver data ready' interrupt.
 * This function is called by the 'tty_io' module in the kernel when
@@ -573,6 +568,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
        sl->tty = tty;
        tty->disc_data = sl;
+        tty->receive_room = 65536;
        if (tty->driver->flush_buffer)  {
                tty->driver->flush_buffer(tty);
        }
@@ -779,7 +775,6 @@ static struct tty_ldisc x25_ldisc = {
        .close          = x25_asy_close_tty,
        .ioctl          = x25_asy_ioctl,
        .receive_buf    = x25_asy_receive_buf,
-        .receive_room   = x25_asy_receive_room,
        .write_wakeup   = x25_asy_write_wakeup,
 };
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index d25264ba0c0e..18baacfc5a2c 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -1675,11 +1675,6 @@ static int strip_rebuild_header(struct sk_buff *skb)
 /************************************************************************/
 /* Receiving routines                                                   */
-static int strip_receive_room(struct tty_struct *tty)
-{
-        return 0x10000;         /* We can handle an infinite amount of data. :-) */
-}
 /*
 * This function parses the response to the ATS300? command,
 * extracting the radio version and serial number.
@@ -2424,7 +2419,7 @@ static struct net_device_stats *strip_get_stats(struct net_device *dev)
 /*
 * Here's the order things happen:
 * When the user runs "slattach -p strip ..."
- *  1. The TTY module calls strip_open
+ *  1. The TTY module calls strip_open;;
 *  2. strip_open calls strip_alloc
 *  3.                  strip_alloc calls register_netdev
 *  4.                  register_netdev calls strip_dev_init
@@ -2652,6 +2647,8 @@ static int strip_open(struct tty_struct *tty)
        strip_info->tty = tty;
        tty->disc_data = strip_info;
+        tty->receive_room = 65536;
        if (tty->driver->flush_buffer)
                tty->driver->flush_buffer(tty);
@@ -2762,7 +2759,6 @@ static struct tty_ldisc strip_ldisc = {
        .close = strip_close,
        .ioctl = strip_ioctl,
        .receive_buf = strip_receive_buf,
-        .receive_room = strip_receive_room,
        .write_wakeup = strip_write_some_more,
 };
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 75419cf9d353..1f060914cfa4 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -16,6 +16,7 @@
 #include <linux/types.h>
 #include <linux/kdev_t.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/vt_kern.h>
 #include <linux/init.h>
 #include <linux/console.h>
@@ -432,8 +433,6 @@ raw3215_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                                if (count > slen)
                                        count = slen;
                        } else
-                        if (count >= TTY_FLIPBUF_SIZE - tty->flip.count)
-                                count = TTY_FLIPBUF_SIZE - tty->flip.count - 1;
                        EBCASC(raw->inbuf, count);
                        cchar = ctrlchar_handle(raw->inbuf, count, tty);
                        switch (cchar & CTRLCHAR_MASK) {
@@ -441,28 +440,20 @@ raw3215_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                                break;
                        case CTRLCHAR_CTRL:
-                                tty->flip.count++;
+                                tty_insert_flip_char(tty, cchar, TTY_NORMAL);
-                                *tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                                *tty->flip.char_buf_ptr++ = cchar;
                                tty_flip_buffer_push(raw->tty);
                                break;
                        case CTRLCHAR_NONE:
-                                memcpy(tty->flip.char_buf_ptr,
-                                       raw->inbuf, count);
                                if (count < 2 ||
-                                    (strncmp(raw->inbuf+count-2, "^n", 2) &&
+                                    (strncmp(raw->inbuf+count-2, "\252n", 2) &&
-                                    strncmp(raw->inbuf+count-2, "\252n", 2)) ) {
+                                     strncmp(raw->inbuf+count-2, "^n", 2)) ) {
-                                        /* don't add the auto \n */
+                                        /* add the auto \n */
-                                        tty->flip.char_buf_ptr[count] = '\n';
+                                        raw->inbuf[count] = '\n';
-                                        memset(tty->flip.flag_buf_ptr,
-                                               TTY_NORMAL, count + 1);
                                        count++;
                                } else
-                                        count-=2;
+                                        count -= 2;
-                                tty->flip.char_buf_ptr += count;
+                                tty_insert_flip_string(tty, raw->inbuf, count);
-                                tty->flip.flag_buf_ptr += count;
-                                tty->flip.count += count;
                                tty_flip_buffer_push(raw->tty);
                                break;
                        }
diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c
index a20d7c89341d..6cbf067f1a8f 100644
--- a/drivers/s390/char/sclp_tty.c
+++ b/drivers/s390/char/sclp_tty.c
@@ -13,6 +13,7 @@
 #include <linux/kmod.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
@@ -496,25 +497,19 @@ sclp_tty_input(unsigned char* buf, unsigned int count)
        case CTRLCHAR_SYSRQ:
                break;
        case CTRLCHAR_CTRL:
-                sclp_tty->flip.count++;
+                tty_insert_flip_char(sclp_tty, cchar, TTY_NORMAL);
-                *sclp_tty->flip.flag_buf_ptr++ = TTY_NORMAL;
-                *sclp_tty->flip.char_buf_ptr++ = cchar;
                tty_flip_buffer_push(sclp_tty);
                break;
        case CTRLCHAR_NONE:
                /* send (normal) input to line discipline */
-                memcpy(sclp_tty->flip.char_buf_ptr, buf, count);
                if (count < 2 ||
-                    (strncmp ((const char *) buf + count - 2, "^n", 2) &&
+                    (strncmp((const char *) buf + count - 2, "^n", 2) &&
-                     strncmp ((const char *) buf + count - 2, "\0252n", 2))) {
+                     strncmp((const char *) buf + count - 2, "\252n", 2))) {
-                        sclp_tty->flip.char_buf_ptr[count] = '\n';
+                        /* add the auto \n */
-                        count++;
+                        tty_insert_flip_string(sclp_tty, buf, count);
+                        tty_insert_flip_char(sclp_tty, '\n', TTY_NORMAL);
                } else
-                        count -= 2;
+                        tty_insert_flip_string(sclp_tty, buf, count - 2);
-                memset(sclp_tty->flip.flag_buf_ptr, TTY_NORMAL, count);
-                sclp_tty->flip.char_buf_ptr += count;
-                sclp_tty->flip.flag_buf_ptr += count;
-                sclp_tty->flip.count += count;
                tty_flip_buffer_push(sclp_tty);
                break;
        }
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 06bd85824d7b..9e02625c82cf 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
@@ -482,16 +483,7 @@ sclp_vt220_receiver_fn(struct evbuf_header *evbuf)
                /* Send input to line discipline */
                buffer++;
                count--;
-                /* Prevent buffer overrun by discarding input. Note that
+                tty_insert_flip_string(sclp_vt220_tty, buffer, count);
-                 * because buffer_push works asynchronously, we cannot wait
-                 * for the buffer to be emptied. */
-                if (count + sclp_vt220_tty->flip.count > TTY_FLIPBUF_SIZE)
-                        count = TTY_FLIPBUF_SIZE - sclp_vt220_tty->flip.count;
-                memcpy(sclp_vt220_tty->flip.char_buf_ptr, buffer, count);
-                memset(sclp_vt220_tty->flip.flag_buf_ptr, TTY_NORMAL, count);
-                sclp_vt220_tty->flip.char_buf_ptr += count;
-                sclp_vt220_tty->flip.flag_buf_ptr += count;
-                sclp_vt220_tty->flip.count += count;
                tty_flip_buffer_push(sclp_vt220_tty);
                break;
        }
diff --git a/drivers/s390/net/ctctty.c b/drivers/s390/net/ctctty.c
index 968f2c113efe..93d1725eb79b 100644
--- a/drivers/s390/net/ctctty.c
+++ b/drivers/s390/net/ctctty.c
@@ -25,6 +25,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/serial_reg.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -101,25 +102,17 @@ static spinlock_t ctc_tty_lock;
 static int
 ctc_tty_try_read(ctc_tty_info * info, struct sk_buff *skb)
 {
-        int c;
        int len;
        struct tty_struct *tty;
        DBF_TEXT(trace, 5, __FUNCTION__);
        if ((tty = info->tty)) {
                if (info->mcr & UART_MCR_RTS) {
-                        c = TTY_FLIPBUF_SIZE - tty->flip.count;
                        len = skb->len;
-                        if (c >= len) {
+                        tty_insert_flip_string(tty, skb->data, len);
-                                memcpy(tty->flip.char_buf_ptr, skb->data, len);
+                        tty_flip_buffer_push(tty);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
+                        kfree_skb(skb);
-                                tty->flip.count += len;
+                        return 1;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
-                                tty_flip_buffer_push(tty);
-                                kfree_skb(skb);
-                                return 1;
-                        }
                }
        }
        return 0;
@@ -138,19 +131,12 @@ ctc_tty_readmodem(ctc_tty_info *info)
        DBF_TEXT(trace, 5, __FUNCTION__);
        if ((tty = info->tty)) {
                if (info->mcr & UART_MCR_RTS) {
-                        int c = TTY_FLIPBUF_SIZE - tty->flip.count;
                        struct sk_buff *skb;
                        
-                        if ((c > 0) && (skb = skb_dequeue(&info->rx_queue))) {
+                        if ((skb = skb_dequeue(&info->rx_queue))) {
                                int len = skb->len;
-                                if (len > c)
+                                tty_insert_flip_string(tty, skb->data, len);
-                                        len = c;
-                                memcpy(tty->flip.char_buf_ptr, skb->data, len);
                                skb_pull(skb, len);
-                                memset(tty->flip.flag_buf_ptr, 0, len);
-                                tty->flip.count += len;
-                                tty->flip.char_buf_ptr += len;
-                                tty->flip.flag_buf_ptr += len;
                                tty_flip_buffer_push(tty);
                                if (skb->len > 0)
                                        skb_queue_head(&info->rx_queue, skb);
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index b5cf39468d18..221999bcf8fe 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -94,15 +94,6 @@ static irqreturn_t serial21285_rx_chars(int irq, void *dev_id, struct pt_regs *r
        status = *CSR_UARTFLG;
        while (!(status & 0x10) && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = *CSR_UARTDR;
                flag = TTY_NORMAL;
                port->icount.rx++;
diff --git a/drivers/serial/68328serial.c b/drivers/serial/68328serial.c
index 67e9afa000c1..4dd5c3f98167 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/serial/68328serial.c
@@ -294,7 +294,7 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
 {
        struct tty_struct *tty = info->tty;
        m68328_uart *uart = &uart_addr[info->line];
-        unsigned char ch;
+        unsigned char ch, flag;
        /*
         * This do { } while() loop will get ALL chars out of Rx FIFO 
@@ -332,26 +332,24 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
                /*
                 * Make sure that we do not overflow the buffer
                 */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                if (tty_request_buffer_room(tty, 1) == 0) {
                        schedule_work(&tty->flip.work);
                        return;
                }
+                flag = TTY_NORMAL;
                if(rx & URX_PARITY_ERROR) {
-                        *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                        flag = TTY_PARITY;
                        status_handle(info, rx);
                } else if(rx & URX_OVRUN) {
-                        *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        flag = TTY_OVERRUN;
                        status_handle(info, rx);
                } else if(rx & URX_FRAME_ERROR) {
-                        *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                        flag = TTY_FRAME;
                        status_handle(info, rx);
-                } else {
-                        *tty->flip.flag_buf_ptr++ = 0; /* XXX */
                }
-                *tty->flip.char_buf_ptr++ = ch;
+                tty_insert_flip_char(tty, ch, flag);
-                tty->flip.count++;
 #ifndef CONFIG_XCOPILOT_BUGS
        } while((rx = uart->urx.w) & URX_DATA_READY);
 #endif
diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
index 170c9d2a749c..60f5a5dc17f1 100644
--- a/drivers/serial/68360serial.c
+++ b/drivers/serial/68360serial.c
@@ -394,7 +394,7 @@ static void rs_360_start(struct tty_struct *tty)
 static _INLINE_ void receive_chars(ser_info_t *info)
 {
        struct tty_struct *tty = info->tty;
-        unsigned char ch, *cp;
+        unsigned char ch, flag, *cp;
        /*int   ignored = 0;*/
        int     i;
        ushort  status;
@@ -438,24 +438,15 @@ static _INLINE_ void receive_chars(ser_info_t *info)
                cp = (char *)bdp->buf;
                status = bdp->status;
-                /* Check to see if there is room in the tty buffer for
-                 * the characters in our BD buffer.  If not, we exit
-                 * now, leaving the BD with the characters.  We'll pick
-                 * them up again on the next receive interrupt (which could
-                 * be a timeout).
-                 */
-                if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE)
-                        break;
                while (i-- > 0) {
                        ch = *cp++;
-                        *tty->flip.char_buf_ptr = ch;
                        icount->rx++;
 #ifdef SERIAL_DEBUG_INTR
                        printk("DR%02x:%02x...", ch, status);
 #endif
-                        *tty->flip.flag_buf_ptr = 0;
+                        flag = TTY_NORMAL;
                        if (status & (BD_SC_BR | BD_SC_FR |
                                       BD_SC_PR | BD_SC_OV)) {
                                /*
@@ -490,30 +481,18 @@ static _INLINE_ void receive_chars(ser_info_t *info)
                                        if (info->flags & ASYNC_SAK)
                                                do_SAK(tty);
                                } else if (status & BD_SC_PR)
-                                        *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                else if (status & BD_SC_FR)
-                                        *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                        flag = TTY_FRAME;
-                                if (status & BD_SC_OV) {
-                                        /*
-                                         * Overrun is special, since it's
-                                         * reported immediately, and doesn't
-                                         * affect the current character
-                                         */
-                                        if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                                tty->flip.count++;
-                                                tty->flip.flag_buf_ptr++;
-                                                tty->flip.char_buf_ptr++;
-                                                *tty->flip.flag_buf_ptr =
-                                                                TTY_OVERRUN;
-                                        }
-                                }
                        }
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        tty_insert_flip_char(tty, ch, flag);
-                                break;
+                        if (status & BD_SC_OV)
+                                /*
-                        tty->flip.flag_buf_ptr++;
+                                 * Overrun is special, since it's
-                        tty->flip.char_buf_ptr++;
+                                 * reported immediately, and doesn't
-                        tty->flip.count++;
+                                 * affect the current character
+                                 */
+                                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
                }
                /* This BD is ready to be used again.  Clear status.
@@ -541,12 +520,7 @@ static _INLINE_ void receive_break(ser_info_t *info)
        /* Check to see if there is room in the tty buffer for
         * the break.  If not, we exit now, losing the break.  FIXME
         */
-        if ((tty->flip.count + 1) >= TTY_FLIPBUF_SIZE)
+        tty_insert_flip_char(tty, 0, TTY_BREAK);
-                return;
-        *(tty->flip.flag_buf_ptr++) = TTY_BREAK;
-        *(tty->flip.char_buf_ptr++) = 0;
-        tty->flip.count++;
        schedule_work(&tty->flip.work);
 }
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index e8454611cb65..54e5cc0dd5f8 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1142,19 +1142,6 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
        char flag;
        do {
-                /* The following is not allowed by the tty layer and
-                   unsafe. It should be fixed ASAP */
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency) {
-                                spin_unlock(&up->port.lock);
-                                tty_flip_buffer_push(tty);
-                                spin_lock(&up->port.lock);
-                        }
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = serial_inp(up, UART_RX);
                flag = TTY_NORMAL;
                up->port.icount.rx++;
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 48f6e872314b..3490022e9fdc 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -154,15 +154,6 @@ pl010_rx_chars(struct uart_port *port)
        status = UART_GET_FR(port);
        while (UART_RX_DATA(status) && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts.
-                         */
-                }
                ch = UART_GET_CHAR(port);
                flag = TTY_NORMAL;
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 129670556162..034a029e356e 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -120,15 +120,6 @@ pl011_rx_chars(struct uart_amba_port *uap)
        status = readw(uap->port.membase + UART01x_FR);
        while ((status & UART01x_FR_RXFE) == 0 && max_count--) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = readw(uap->port.membase + UART01x_DR) | UART_DUMMY_DR_RX;
                flag = TTY_NORMAL;
                uap->port.icount.rx++;
diff --git a/drivers/serial/au1x00_uart.c b/drivers/serial/au1x00_uart.c
index a274ebf256a1..ceb5d7f37bbd 100644
--- a/drivers/serial/au1x00_uart.c
+++ b/drivers/serial/au1x00_uart.c
@@ -241,18 +241,12 @@ static _INLINE_ void
 receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
 {
        struct tty_struct *tty = up->port.info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        int max_count = 256;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return; // if TTY_DONT_FLIP is set
-                }
                ch = serial_inp(up, UART_RX);
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -292,30 +286,23 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
 #endif
                        if (*status & UART_LSR_BI) {
                                DEBUG_INTR("handling break....");
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
+                if ((*status & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
+                if (*status & UART_LSR_OE)
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
                        /*
                         * Overrun is special, since it's reported
                         * immediately, and doesn't affect the current
                         * character.
                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
        ignore_char:
                *status = serial_inp(up, UART_LSR);
diff --git a/drivers/serial/clps711x.c b/drivers/serial/clps711x.c
index 87ef368384fb..8ef999481f93 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/serial/clps711x.c
@@ -104,8 +104,6 @@ static irqreturn_t clps711xuart_int_rx(int irq, void *dev_id, struct pt_regs *re
        while (!(status & SYSFLG_URXFE)) {
                ch = clps_readl(UARTDR(port));
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto ignore_char;
                port->icount.rx++;
                flg = TTY_NORMAL;
diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
index 4d8516d1bb71..a64ba26a94e8 100644
--- a/drivers/serial/dz.c
+++ b/drivers/serial/dz.c
@@ -216,8 +216,6 @@ static inline void dz_receive_chars(struct dz_port *dport)
                if (!tty)
                        break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
                icount->rx++;
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index eb31125c6a30..144a7a352b28 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -729,19 +729,20 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
        unsigned short int status;
        struct uart_icount *icount;
        unsigned long offset;
+        unsigned char flag;
        trace(icom_port, "RCV_COMPLETE", 0);
        rcv_buff = icom_port->next_rcv;
        status = cpu_to_le16(icom_port->statStg->rcv[rcv_buff].flags);
        while (status & SA_FL_RCV_DONE) {
+                int first = -1;
                trace(icom_port, "FID_STATUS", status);
                count = cpu_to_le16(icom_port->statStg->rcv[rcv_buff].leLength);
+                count = tty_buffer_request_room(tty, count);
                trace(icom_port, "RCV_COUNT", count);
-                if (count > (TTY_FLIPBUF_SIZE - tty->flip.count))
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
                trace(icom_port, "REAL_COUNT", count);
@@ -749,15 +750,10 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                        cpu_to_le32(icom_port->statStg->rcv[rcv_buff].leBuffer) -
                        icom_port->recv_buf_pci;
-                memcpy(tty->flip.char_buf_ptr,(unsigned char *)
+                /* Block copy all but the last byte as this may have status */
-                       ((unsigned long)icom_port->recv_buf + offset), count);
                if (count > 0) {
-                        tty->flip.count += count - 1;
+                        first = icom_port->recv_buf[offset];
-                        tty->flip.char_buf_ptr += count - 1;
+                        tty_insert_flip_string(tty, icom_port->recv_buf + offset, count - 1);
-                        memset(tty->flip.flag_buf_ptr, 0, count);
-                        tty->flip.flag_buf_ptr += count - 1;
                }
                icount = &icom_port->uart_port.icount;
@@ -765,12 +761,14 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                /* Break detect logic */
                if ((status & SA_FLAGS_FRAME_ERROR)
-                    && (tty->flip.char_buf_ptr[0] == 0x00)) {
+                    && first == 0) {
                        status &= ~SA_FLAGS_FRAME_ERROR;
                        status |= SA_FLAGS_BREAK_DET;
                        trace(icom_port, "BREAK_DET", 0);
                }
+                flag = TTY_NORMAL;
                if (status &
                    (SA_FLAGS_BREAK_DET | SA_FLAGS_PARITY_ERROR |
                     SA_FLAGS_FRAME_ERROR | SA_FLAGS_OVERRUN)) {
@@ -797,33 +795,26 @@ static void recv_interrupt(u16 port_int_reg, struct icom_port *icom_port)
                        status &= icom_port->read_status_mask;
                        if (status & SA_FLAGS_BREAK_DET) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (status & SA_FLAGS_PARITY_ERROR) {
                                trace(icom_port, "PARITY_ERROR", 0);
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        } else if (status & SA_FLAGS_FRAME_ERROR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        if (status & SA_FLAGS_OVERRUN) {
-                                /*
-                                 * Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < TTY_FLIPBUF_SIZE) {
-                                        tty->flip.count++;
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                                }
-                        }
                }
-                tty->flip.flag_buf_ptr++;
+                tty_insert_flip_char(tty, *(icom_port->recv_buf + offset + count - 1), flag);
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
+                if (status & SA_FLAGS_OVERRUN)
-                ignore_char:
+                        /*
-                        icom_port->statStg->rcv[rcv_buff].flags = 0;
+                         * Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+ignore_char:
+                icom_port->statStg->rcv[rcv_buff].flags = 0;
                icom_port->statStg->rcv[rcv_buff].leLength = 0;
                icom_port->statStg->rcv[rcv_buff].WorkingLength =
                        (unsigned short int) cpu_to_le16(RCV_BUFF_SZ);
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 83c4c1216587..5c098be9346b 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -256,9 +256,6 @@ static irqreturn_t imx_rxint(int irq, void *dev_id, struct pt_regs *regs)
        error_return:
                tty_insert_flip_char(tty, rx, flg);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto out;
        ignore_char:
                rx = URXD0((u32)sport->port.membase);
        } while(rx & URXD_CHARRDY);
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 771676abee60..1d85533d46d2 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2327,19 +2327,13 @@ static void receive_chars(struct uart_port *the_port)
        spin_lock_irqsave(&the_port->lock, pflags);
        tty = info->tty;
-        if (request_count > TTY_FLIPBUF_SIZE - tty->flip.count)
+        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS - 2);
-                request_count = TTY_FLIPBUF_SIZE - tty->flip.count;
        if (request_count > 0) {
                icount = &the_port->icount;
                read_count = do_read(the_port, ch, request_count);
                if (read_count > 0) {
-                        flip = 1;
+                        tty_insert_flip_string(tty, ch, read_count);
-                        memcpy(tty->flip.char_buf_ptr, ch, read_count);
-                        memset(tty->flip.flag_buf_ptr, TTY_NORMAL, read_count);
-                        tty->flip.char_buf_ptr += read_count;
-                        tty->flip.flag_buf_ptr += read_count;
-                        tty->flip.count += read_count;
                        icount->rx += read_count;
                }
        }
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index ef132349f310..66f117d15065 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -259,13 +259,7 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
        struct tty_struct *tty = up->port.info->tty;    /* XXX info==NULL? */
        while (1) {
-                unsigned char ch, r1;
+                unsigned char ch, r1, flag;
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return;         /* XXX Ignores SysRq when we need it most. Fix. */
-                }
                r1 = read_zsreg(channel, R1);
                if (r1 & (PAR_ERR | Rx_OVR | CRC_ERR)) {
@@ -303,8 +297,7 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
                }
                /* A real serial line, record the character and status.  */
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (r1 & (BRK_ABRT | PAR_ERR | Rx_OVR | CRC_ERR)) {
                        if (r1 & BRK_ABRT) {
@@ -321,28 +314,21 @@ static void ip22zilog_receive_chars(struct uart_ip22zilog_port *up,
                                up->port.icount.overrun++;
                        r1 &= up->port.read_status_mask;
                        if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto next_char;
                if (up->port.ignore_status_mask == 0xff ||
-                    (r1 & up->port.ignore_status_mask) == 0) {
+                    (r1 & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                if (r1 & Rx_OVR)
-                }
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
        next_char:
                ch = readb(&channel->control);
                ZSDELAY();
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index b0ecc7537ce5..b48066a64a7d 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -331,17 +331,12 @@ static _INLINE_ void receive_chars(struct uart_sio_port *up, int *status,
 {
        struct tty_struct *tty = up->port.info->tty;
        unsigned char ch;
+        unsigned char flag;
        int max_count = 256;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return; // if TTY_DONT_FLIP is set
-                }
                ch = sio_in(up, SIORXB);
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -380,30 +375,24 @@ static _INLINE_ void receive_chars(struct uart_sio_port *up, int *status,
                        if (*status & UART_LSR_BI) {
                                DEBUG_INTR("handling break....");
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
+                if ((*status & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
+                if (*status & UART_LSR_OE) {
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
                        /*
                         * Overrun is special, since it's reported
                         * immediately, and doesn't affect the current
                         * character.
                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
        ignore_char:
                *status = serial_in(up, UART_LSR);
diff --git a/drivers/serial/mcfserial.c b/drivers/serial/mcfserial.c
index 47f7404cb045..f2a51e61eec7 100644
--- a/drivers/serial/mcfserial.c
+++ b/drivers/serial/mcfserial.c
@@ -313,7 +313,7 @@ static inline void receive_chars(struct mcf_serial *info)
 {
        volatile unsigned char  *uartp;
        struct tty_struct       *tty = info->tty;
-        unsigned char           status, ch;
+        unsigned char           status, ch, flag;
        if (!tty)
                return;
@@ -321,10 +321,6 @@ static inline void receive_chars(struct mcf_serial *info)
        uartp = info->addr;
        while ((status = uartp[MCFUART_USR]) & MCFUART_USR_RXREADY) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
                ch = uartp[MCFUART_URB];
                info->stats.rx++;
@@ -335,29 +331,24 @@ static inline void receive_chars(struct mcf_serial *info)
                }
 #endif
-                tty->flip.count++;
+                flag = TTY_NORMAL;
                if (status & MCFUART_USR_RXERR) {
                        uartp[MCFUART_UCR] = MCFUART_UCR_CMDRESETERR;
                        if (status & MCFUART_USR_RXBREAK) {
                                info->stats.rxbreak++;
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (status & MCFUART_USR_RXPARITY) {
                                info->stats.rxparity++;
-                                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
+                                flag = TTY_PARITY;
                        } else if (status & MCFUART_USR_RXOVERRUN) {
                                info->stats.rxoverrun++;
-                                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                                flag = TTY_OVERRUN;
                        } else if (status & MCFUART_USR_RXFRAMING) {
                                info->stats.rxframing++;
-                                *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        } else {
-                                /* This should never happen... */
-                                *tty->flip.flag_buf_ptr++ = 0;
                        }
-                } else {
-                        *tty->flip.flag_buf_ptr++ = 0;
                }
-                *tty->flip.char_buf_ptr++ = ch;
+                tty_insert_flip_char(tty, ch, flag);
        }
        schedule_work(&tty->flip.work);
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 1288d6203e94..61dd17d7bace 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -405,17 +405,13 @@ static inline int
 mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
 {
        struct tty_struct *tty = port->info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        unsigned short status;
        /* While we can read, do so ! */
        while ( (status = in_be16(&PSC(port)->mpc52xx_psc_status)) &
                MPC52xx_PSC_SR_RXRDY) {
-                /* If we are full, just stop reading */
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        break;
-                
                /* Get the char */
                ch = in_8(&PSC(port)->mpc52xx_psc_buffer_8);
@@ -428,45 +424,35 @@ mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
 #endif
                /* Store it */
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = 0;
+                flag = TTY_NORMAL;
                port->icount.rx++;
        
                if ( status & (MPC52xx_PSC_SR_PE |
                               MPC52xx_PSC_SR_FE |
-                               MPC52xx_PSC_SR_RB |
+                               MPC52xx_PSC_SR_RB) ) {
-                               MPC52xx_PSC_SR_OE) ) {
                        
                        if (status & MPC52xx_PSC_SR_RB) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                                uart_handle_break(port);
                        } else if (status & MPC52xx_PSC_SR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (status & MPC52xx_PSC_SR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
-                        if (status & MPC52xx_PSC_SR_OE) {
-                                /*
-                                 * Overrun is special, since it's
-                                 * reported immediately, and doesn't
-                                 * affect the current character
-                                 */
-                                if (tty->flip.count < (TTY_FLIPBUF_SIZE-1)) {
-                                        tty->flip.flag_buf_ptr++;
-                                        tty->flip.char_buf_ptr++;
-                                        tty->flip.count++;
-                                }
-                                *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        }
                        /* Clear error condition */
                        out_8(&PSC(port)->command,MPC52xx_PSC_RST_ERR_STAT);
                }
+                tty_insert_flip_char(tty, ch, flag);
-                tty->flip.char_buf_ptr++;
+                if (status & MPC52xx_PSC_SR_OE) {
-                tty->flip.flag_buf_ptr++;
+                        /*
-                tty->flip.count++;
+                         * Overrun is special, since it's
+                         * reported immediately, and doesn't
+                         * affect the current character
+                         */
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                }
        }
        tty_flip_buffer_push(tty);
diff --git a/drivers/serial/mpsc.c b/drivers/serial/mpsc.c
index 8f83e4007ecd..0ca83ac31d07 100644
--- a/drivers/serial/mpsc.c
+++ b/drivers/serial/mpsc.c
@@ -769,12 +769,12 @@ mpsc_rx_intr(struct mpsc_port_info *pi, struct pt_regs *regs)
                bytes_in = be16_to_cpu(rxre->bytecnt);
                /* Following use of tty struct directly is deprecated */
-                if (unlikely((tty->flip.count + bytes_in) >= TTY_FLIPBUF_SIZE)){
+                if (unlikely(tty_buffer_request_room(tty, bytes_in) < bytes_in)) {
                        if (tty->low_latency)
                                tty_flip_buffer_push(tty);
                        /*
-                         * If this failed then we will throw awa the bytes
+                         * If this failed then we will throw away the bytes
-                         * but mst do so to clear interrupts.
+                         * but must do so to clear interrupts.
                         */
                }
diff --git a/drivers/serial/mux.c b/drivers/serial/mux.c
index 7633132a10aa..4e49168c3176 100644
--- a/drivers/serial/mux.c
+++ b/drivers/serial/mux.c
@@ -223,11 +223,6 @@ static void mux_read(struct uart_port *port)
                if (MUX_EOFIFO(data))
                        break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        continue;
-                *tty->flip.char_buf_ptr = data & 0xffu;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                port->icount.rx++;
                if (MUX_BREAK(data)) {
@@ -239,9 +234,7 @@ static void mux_read(struct uart_port *port)
                if (uart_handle_sysrq_char(port, data & 0xffu, NULL))
                        continue;
-                tty->flip.flag_buf_ptr++;
+                tty_insert_flip_char(tty, data & 0xFF, TTY_NORMAL);
-                tty->flip.char_buf_ptr++;
-                tty->flip.count++;
        }
        
        if (start_count != port->icount.rx) {
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index ea24129eb6b9..f330d6c0e0df 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -210,10 +210,9 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                                            struct pt_regs *regs)
 {
        struct tty_struct *tty = NULL;
-        unsigned char ch, r1, drop, error;
+        unsigned char ch, r1, drop, error, flag;
        int loops = 0;
- retry:
        /* The interrupt can be enabled when the port isn't open, typically
         * that happens when using one port is open and the other closed (stale
         * interrupt) or when one port is used as a console.
@@ -246,20 +245,6 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                error = 0;
                drop = 0;
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        /* Have to drop the lock here */
-                        pmz_debug("pmz: flip overflow\n");
-                        spin_unlock(&uap->port.lock);
-                        tty->flip.work.func((void *)tty);
-                        spin_lock(&uap->port.lock);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                drop = 1;
-                        if (ZS_IS_ASLEEP(uap))
-                                return NULL;
-                        if (!ZS_IS_OPEN(uap))
-                                goto retry;
-                }
                r1 = read_zsreg(uap, R1);
                ch = read_zsdata(uap);
@@ -295,8 +280,7 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                if (drop)
                        goto next_char;
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                uap->port.icount.rx++;
                if (r1 & (PAR_ERR | Rx_OVR | CRC_ERR | BRK_ABRT)) {
@@ -316,26 +300,19 @@ static struct tty_struct *pmz_receive_chars(struct uart_pmac_port *uap,
                                uap->port.icount.overrun++;
                        r1 &= uap->port.read_status_mask;
                        if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uap->port.ignore_status_mask == 0xff ||
                    (r1 & uap->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
        next_char:
                /* We can get stuck in an infinite loop getting char 0 when the
                 * line is in a wrong HW state, we break that here.
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index cc998b99a19f..10535f00301f 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -107,14 +107,6 @@ receive_chars(struct uart_pxa_port *up, int *status, struct pt_regs *regs)
        int max_count = 256;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                ch = serial_in(up, UART_RX);
                flag = TTY_NORMAL;
                up->port.icount.rx++;
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index fe83ce6fef52..eb4883efb7c6 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -323,16 +323,6 @@ s3c24xx_serial_rx_chars(int irq, void *dev_id, struct pt_regs *regs)
                if (s3c24xx_serial_rx_fifocnt(ourport, ufstat) == 0)
                        break;
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                uerstat = rd_regl(port, S3C2410_UERSTAT);
                ch = rd_regb(port, S3C2410_URXH);
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index 25a086458ab9..1bd93168f504 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -201,8 +201,6 @@ sa1100_rx_chars(struct sa1100_port *sport, struct pt_regs *regs)
        while (status & UTSR1_TO_SM(UTSR1_RNE)) {
                ch = UART_GET_CHAR(sport);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                        goto ignore_char;
                sport->port.icount.rx++;
                flg = TTY_NORMAL;
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index d01dbe5da3b9..d4a1f0e798c1 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -148,15 +148,6 @@ lh7a40xuart_rx_chars (struct uart_port* port)
        unsigned int data, flag;/* Received data and status */
        while (!(UR (port, UART_R_STATUS) & nRxRdy) && --cbRxMax) {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                        /*
-                         * If this failed then we will throw away the
-                         * bytes but must do so to clear interrupts
-                         */
-                }
                data = UR (port, UART_R_DATA);
                flag = TTY_NORMAL;
                ++port->icount.rx;
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index 995d9dd9ddd5..fdd1f1915a42 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -303,17 +303,6 @@ receive_chars(struct uart_txx9_port *up, unsigned int *status, struct pt_regs *r
        char flag;
        do {
-                /* The following is not allowed by the tty layer and
-                   unsafe. It should be fixed ASAP */
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency) {
-                                spin_unlock(&up->port.lock);
-                                tty_flip_buffer_push(tty);
-                                spin_lock(&up->port.lock);
-                        }
-                        /* If this failed then we will throw away the
-                           bytes but must do so to clear interrupts */
-                }
                ch = sio_in(up, TXX9_SIRFIFO);
                flag = TTY_NORMAL;
                up->port.icount.rx++;
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 430754ebac8a..a9e070759628 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -482,6 +482,7 @@ static inline void sci_receive_chars(struct uart_port *port,
        struct tty_struct *tty = port->info->tty;
        int i, count, copied = 0;
        unsigned short status;
+        unsigned char flag;
        status = sci_in(port, SCxSR);
        if (!(status & SCxSR_RDxF(port)))
@@ -499,8 +500,7 @@ static inline void sci_receive_chars(struct uart_port *port,
 #endif
                /* Don't copy more bytes than there is room for in the buffer */
-                if (tty->flip.count + count > TTY_FLIPBUF_SIZE)
+                count = tty_buffer_request_room(tty, count);
-                        count = TTY_FLIPBUF_SIZE - tty->flip.count;
                /* If for any reason we can't copy more data, we're done! */
                if (count == 0)
@@ -512,8 +512,7 @@ static inline void sci_receive_chars(struct uart_port *port,
                            || uart_handle_sysrq_char(port, c, regs)) {
                                count = 0;
                        } else {
-                            tty->flip.char_buf_ptr[0] = c;
+                            tty_insert_flip_char(tty, c, TTY_NORMAL);
-                            tty->flip.flag_buf_ptr[0] = TTY_NORMAL;
                        }
                } else {
                        for (i=0; i<count; i++) {
@@ -542,26 +541,21 @@ static inline void sci_receive_chars(struct uart_port *port,
                                }
                                /* Store data and status */
-                                tty->flip.char_buf_ptr[i] = c;
                                if (status&SCxSR_FER(port)) {
-                                        tty->flip.flag_buf_ptr[i] = TTY_FRAME;
+                                        flag = TTY_FRAME;
                                        pr_debug("sci: frame error\n");
                                } else if (status&SCxSR_PER(port)) {
-                                        tty->flip.flag_buf_ptr[i] = TTY_PARITY;
+                                        flag = TTY_PARITY;
                                        pr_debug("sci: parity error\n");
-                                } else {
+                                } else
-                                        tty->flip.flag_buf_ptr[i] = TTY_NORMAL;
+                                        flag = TTY_NORMAL;
-                                }
+                                tty_insert_flip_char(tty, c, flag);
                        }
                }
                sci_in(port, SCxSR); /* dummy read */
                sci_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
-                /* Update the kernel buffer end */
-                tty->flip.count += count;
-                tty->flip.char_buf_ptr += count;
-                tty->flip.flag_buf_ptr += count;
                copied += count;
                port->icount.rx += count;
        }
@@ -608,48 +602,45 @@ static inline int sci_handle_errors(struct uart_port *port)
        unsigned short status = sci_in(port, SCxSR);
        struct tty_struct *tty = port->info->tty;
-        if (status&SCxSR_ORER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_ORER(port)) {
                /* overrun error */
-                copied++;
+                if(tty_insert_flip_char(tty, 0, TTY_OVERRUN))
-                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        copied++;
                pr_debug("sci: overrun error\n");
        }
-        if (status&SCxSR_FER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_FER(port)) {
                if (sci_rxd_in(port) == 0) {
                        /* Notify of BREAK */
                        struct sci_port * sci_port = (struct sci_port *)port;
-                       if(!sci_port->break_flag) {
+                        if(!sci_port->break_flag) {
-                                sci_port->break_flag = 1;
+                                sci_port->break_flag = 1;
-                               sci_schedule_break_timer((struct sci_port *)port);
+                                sci_schedule_break_timer((struct sci_port *)port);
                                /* Do sysrq handling. */
-                                if(uart_handle_break(port)) {
+                                if(uart_handle_break(port))
                                        return 0;
-                                }
                                pr_debug("sci: BREAK detected\n");
-                                copied++;
+                                if(tty_insert_flip_char(tty, 0, TTY_BREAK))
-                                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                                        copied++;
                       }
                }
                else {
                        /* frame error */
-                        copied++;
+                        if(tty_insert_flip_char(tty, 0, TTY_FRAME))
-                        *tty->flip.flag_buf_ptr++ = TTY_FRAME;
+                                copied++;
                        pr_debug("sci: frame error\n");
                }
        }
-        if (status&SCxSR_PER(port) && tty->flip.count<TTY_FLIPBUF_SIZE) {
+        if (status&SCxSR_PER(port)) {
+                if(tty_insert_flip_char(tty, 0, TTY_PARITY))
+                        copied++;
                /* parity error */
-                copied++;
-                *tty->flip.flag_buf_ptr++ = TTY_PARITY;
                pr_debug("sci: parity error\n");
        }
-        if (copied) {
+        if (copied)
-                tty->flip.count += copied;
                tty_flip_buffer_push(tty);
-        }
        return copied;
 }
@@ -661,15 +652,14 @@ static inline int sci_handle_breaks(struct uart_port *port)
        struct tty_struct *tty = port->info->tty;
        struct sci_port *s = &sci_ports[port->line];
-        if (!s->break_flag && status & SCxSR_BRK(port) &&
+        if (!s->break_flag && status & SCxSR_BRK(port))
-            tty->flip.count < TTY_FLIPBUF_SIZE) {
 #if defined(CONFIG_CPU_SH3)
                /* Debounce break */
                s->break_flag = 1;
 #endif
                /* Notify of BREAK */
-                copied++;
+                if(tty_insert_flip_char(tty, 0, TTY_BREAK))
-                *tty->flip.flag_buf_ptr++ = TTY_BREAK;
+                        copied++;
                pr_debug("sci: BREAK detected\n");
        }
@@ -677,19 +667,15 @@ static inline int sci_handle_breaks(struct uart_port *port)
        /* XXX: Handle SCIF overrun error */
        if (port->type == PORT_SCIF && (sci_in(port, SCLSR) & SCIF_ORER) != 0) {
                sci_out(port, SCLSR, 0);
-                if(tty->flip.count<TTY_FLIPBUF_SIZE) {
+                if(tty_insert_flip_char(tty, 0, TTY_OVERRUN)) {
                        copied++;
-                        *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
                        pr_debug("sci: overrun error\n");
                }
        }
 #endif
-        if (copied) {
+        if (copied)
-                tty->flip.count += copied;
                tty_flip_buffer_push(tty);
-        }
        return copied;
 }
@@ -732,12 +718,9 @@ static irqreturn_t sci_er_interrupt(int irq, void *ptr, struct pt_regs *regs)
                        struct tty_struct *tty = port->info->tty;
                        sci_out(port, SCLSR, 0);
-                        if(tty->flip.count<TTY_FLIPBUF_SIZE) {
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                                *tty->flip.flag_buf_ptr++ = TTY_OVERRUN;
+                        tty_flip_buffer_push(tty);
-                                tty->flip.count++;
+                        pr_debug("scif: overrun error\n");
-                                tty_flip_buffer_push(tty);
-                                pr_debug("scif: overrun error\n");
-                        }
                }
 #endif
                sci_rx_interrupt(irq, ptr, regs);
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 313f9df24a2d..5468e5a767e2 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -519,11 +519,7 @@ sn_receive_chars(struct sn_cons_port *port, struct pt_regs *regs,
                /* record the character to pass up to the tty layer */
                if (tty) {
-                        *tty->flip.char_buf_ptr = ch;
+                        if(tty_insert_flip_char(tty, ch, TTY_NORMAL) == 0)
-                        *tty->flip.flag_buf_ptr = TTY_NORMAL;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                        if (tty->flip.count == TTY_FLIPBUF_SIZE)
                                break;
                }
                port->sc_port.icount.rx++;
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index ba9381fd3f2d..7e773ff76c61 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -159,21 +159,14 @@ receive_chars(struct uart_sunsab_port *up,
                saw_console_brk = 1;
        for (i = 0; i < count; i++) {
-                unsigned char ch = buf[i];
+                unsigned char ch = buf[i], flag;
                if (tty == NULL) {
                        uart_handle_sysrq_char(&up->port, ch, regs);
                        continue;
                }
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
+                flag = TTY_NORMAL;
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return tty; // if TTY_DONT_FLIP is set
-                }
-                *tty->flip.char_buf_ptr = ch;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(stat->sreg.isr0 & (SAB82532_ISR0_PERR |
@@ -209,34 +202,21 @@ receive_chars(struct uart_sunsab_port *up,
                        stat->sreg.isr1 &= ((up->port.read_status_mask >> 8) & 0xff);
                        if (stat->sreg.isr1 & SAB82532_ISR1_BRK) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (stat->sreg.isr0 & SAB82532_ISR0_PERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (stat->sreg.isr0 & SAB82532_ISR0_FERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        continue;
                if ((stat->sreg.isr0 & (up->port.ignore_status_mask & 0xff)) == 0 &&
-                    (stat->sreg.isr1 & ((up->port.ignore_status_mask >> 8) & 0xff)) == 0){
+                    (stat->sreg.isr1 & ((up->port.ignore_status_mask >> 8) & 0xff)) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
+                if (stat->sreg.isr0 & SAB82532_ISR0_RFO)
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
-                if ((stat->sreg.isr0 & SAB82532_ISR0_RFO) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
        }
        if (saw_console_brk)
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index f0738533f39a..9a3665b34d97 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -323,19 +323,13 @@ static _INLINE_ struct tty_struct *
 receive_chars(struct uart_sunsu_port *up, unsigned char *status, struct pt_regs *regs)
 {
        struct tty_struct *tty = up->port.info->tty;
-        unsigned char ch;
+        unsigned char ch, flag;
        int max_count = 256;
        int saw_console_brk = 0;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                return tty; // if TTY_DONT_FLIP is set
-                }
                ch = serial_inp(up, UART_RX);
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
@@ -377,31 +371,23 @@ receive_chars(struct uart_sunsu_port *up, unsigned char *status, struct pt_regs
                        }
                        if (*status & UART_LSR_BI) {
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        } else if (*status & UART_LSR_PE)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (*status & UART_LSR_FE)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
+                if ((*status & up->port.ignore_status_mask) == 0)
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
+                if (*status & UART_LSR_OE)
-                        tty->flip.count++;
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
                        /*
                         * Overrun is special, since it's reported
                         * immediately, and doesn't affect the current
                         * character.
                         */
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
+                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
        ignore_char:
                *status = serial_inp(up, UART_LSR);
        } while ((*status & UART_LSR_DR) && (max_count-- > 0));
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 7653d6cf05af..3c72484adea7 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -319,7 +319,7 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                       struct pt_regs *regs)
 {
        struct tty_struct *tty;
-        unsigned char ch, r1;
+        unsigned char ch, r1, flag;
        tty = NULL;
        if (up->port.info != NULL &&            /* Unopened serial console */
@@ -362,19 +362,8 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                        continue;
                }
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        tty->flip.work.func((void *)tty);
-                        /*
-                         * The 8250 bails out of the loop here,
-                         * but we need to read everything, or die.
-                         */
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-                                continue;
-                }
                /* A real serial line, record the character and status.  */
-                *tty->flip.char_buf_ptr = ch;
+                flag = TTY_NORMAL;
-                *tty->flip.flag_buf_ptr = TTY_NORMAL;
                up->port.icount.rx++;
                if (r1 & (BRK_ABRT | PAR_ERR | Rx_OVR | CRC_ERR)) {
                        if (r1 & BRK_ABRT) {
@@ -391,28 +380,21 @@ sunzilog_receive_chars(struct uart_sunzilog_port *up,
                                up->port.icount.overrun++;
                        r1 &= up->port.read_status_mask;
                        if (r1 & BRK_ABRT)
-                                *tty->flip.flag_buf_ptr = TTY_BREAK;
+                                flag = TTY_BREAK;
                        else if (r1 & PAR_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_PARITY;
+                                flag = TTY_PARITY;
                        else if (r1 & CRC_ERR)
-                                *tty->flip.flag_buf_ptr = TTY_FRAME;
+                                flag = TTY_FRAME;
                }
                if (uart_handle_sysrq_char(&up->port, ch, regs))
                        continue;
                if (up->port.ignore_status_mask == 0xff ||
                    (r1 & up->port.ignore_status_mask) == 0) {
-                        tty->flip.flag_buf_ptr++;
+                        tty_insert_flip_char(tty, ch, flag);
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
-                }
-                if ((r1 & Rx_OVR) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        *tty->flip.flag_buf_ptr = TTY_OVERRUN;
-                        tty->flip.flag_buf_ptr++;
-                        tty->flip.char_buf_ptr++;
-                        tty->flip.count++;
                }
+                if (r1 & Rx_OVR)
+                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
        }
        return tty;
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index 865d4dea65df..0a28deeb098d 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -371,11 +371,6 @@ static inline void receive_chars(struct uart_port *port, uint8_t *status,
        lsr = *status;
        do {
-                if (unlikely(tty->flip.count >= TTY_FLIPBUF_SIZE)) {
-                        if (tty->low_latency)
-                                tty_flip_buffer_push(tty);
-                }
                ch = siu_read(port, UART_RX);
                port->icount.rx++;
                flag = TTY_NORMAL;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 248279e44c99..b9fd39fd1b5b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -335,14 +335,9 @@ next_buffer:
        dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d\n", buf, buf->size);
-        for (i = 0; i < buf->size && !acm->throttle; i++) {
+        tty_buffer_request_room(tty, buf->size);
-                /* if we insert more than TTY_FLIPBUF_SIZE characters,
+        if (!acm->throttle)
-                   we drop them. */
+                tty_insert_flip_string(tty, buf->base, buf->size);
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                }
-                tty_insert_flip_char(tty, buf->base[i], 0);
-        }
        tty_flip_buffer_push(tty);
        spin_lock(&acm->throttle_lock);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 65e084a2c87e..2e6926b33455 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -1271,6 +1271,7 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
        unsigned int len;
        struct gs_port *port;
        int ret;
+        struct tty_struct *tty;
        /* TEMPORARY -- only port 0 is supported right now */
        port = dev->dev_port[0];
@@ -1290,7 +1291,10 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
                goto exit;
        }
-        if (port->port_tty == NULL) {
+        tty = port->port_tty;
+        if (tty == NULL) {
                printk(KERN_ERR "gs_recv_packet: port=%d, NULL tty pointer\n",
                        port->port_num);
                ret = -EIO;
@@ -1304,20 +1308,13 @@ static int gs_recv_packet(struct gs_dev *dev, char *packet, unsigned int size)
                goto exit;
        }
-        len = (unsigned int)(TTY_FLIPBUF_SIZE - port->port_tty->flip.count);
+        len = tty_buffer_request_room(tty, size);
-        if (len < size)
+        if (len > 0) {
-                size = len;
+                tty_insert_flip_string(tty, packet, len);
-        if (size > 0) {
-                memcpy(port->port_tty->flip.char_buf_ptr, packet, size);
-                port->port_tty->flip.char_buf_ptr += size;
-                port->port_tty->flip.count += size;
                tty_flip_buffer_push(port->port_tty);
                wake_up_interruptible(&port->port_tty->read_wait);
        }
        ret = 0;
 exit:
        spin_unlock(&port->port_lock);
        return ret;
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 14f55fd26a64..be5dc80836c3 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -84,7 +84,7 @@ config USB_SERIAL_BELKIN
 config USB_SERIAL_WHITEHEAT
        tristate "USB ConnectTech WhiteHEAT Serial Driver"
-        depends on USB_SERIAL && BROKEN_ON_SMP
+        depends on USB_SERIAL
        help
          Say Y here if you want to use a ConnectTech WhiteHEAT 4 port
          USB to serial converter device.
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 6d18d4eaba35..2357b1d102d7 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -364,7 +364,6 @@ static void cyberjack_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
        short todo;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -381,14 +380,8 @@ static void cyberjack_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                return;
        }
        if (urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 4e9637eb6137..68067fe117a4 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -1263,12 +1263,10 @@ static void cypress_read_int_callback(struct urb *urb, struct pt_regs *regs)
        /* process read if there is data other than line status */
        if (tty && (bytes > i)) {
+                bytes = tty_buffer_request_room(tty, bytes);
                for (; i < bytes ; ++i) {
                        dbg("pushing byte number %d - %d - %c", i, data[i],
                                        data[i]);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
                        tty_insert_flip_char(tty, data[i], tty_flag);
                }
                tty_flip_buffer_push(port->tty);
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 8fc414bd5b24..b3f776a90c93 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -946,13 +946,10 @@ dbg( "digi_rx_unthrottle: TOP: port=%d", priv->dp_port_num );
        spin_lock_irqsave( &priv->dp_port_lock, flags );
        /* send any buffered chars from throttle time on to tty subsystem */
-        len = min(priv->dp_in_buf_len, TTY_FLIPBUF_SIZE - tty->flip.count );
+        len = tty_buffer_request_room(tty, priv->dp_in_buf_len);
        if( len > 0 ) {
-                memcpy( tty->flip.char_buf_ptr, priv->dp_in_buf, len );
+                tty_insert_flip_string_flags(tty, priv->dp_in_buf, priv->dp_in_flag_buf, len);
-                memcpy( tty->flip.flag_buf_ptr, priv->dp_in_flag_buf, len );
-                tty->flip.char_buf_ptr += len;
-                tty->flip.flag_buf_ptr += len;
-                tty->flip.count += len;
                tty_flip_buffer_push( tty );
        }
@@ -1827,6 +1824,7 @@ static int digi_read_inb_callback( struct urb *urb )
        int status = ((unsigned char *)urb->transfer_buffer)[2];
        unsigned char *data = ((unsigned char *)urb->transfer_buffer)+3;
        int flag,throttled;
+        int i;
        /* do not process callbacks on closed ports */
        /* but do continue the read chain */
@@ -1885,20 +1883,18 @@ static int digi_read_inb_callback( struct urb *urb )
                        }
                } else {
+                        len = tty_buffer_request_room(tty, len);
-                        len = min( len, TTY_FLIPBUF_SIZE - tty->flip.count );
                        if( len > 0 ) {
-                                memcpy( tty->flip.char_buf_ptr, data, len );
+                                /* Hot path */
-                                memset( tty->flip.flag_buf_ptr, flag, len );
+                                if(flag == TTY_NORMAL)
-                                tty->flip.char_buf_ptr += len;
+                                        tty_insert_flip_string(tty, data, len);
-                                tty->flip.flag_buf_ptr += len;
+                                else {
-                                tty->flip.count += len;
+                                        for(i = 0; i < len; i++)
+                                                tty_insert_flip_char(tty, data[i], flag);
+                                }
                                tty_flip_buffer_push( tty );
                        }
                }
        }
        spin_unlock( &priv->dp_port_lock );
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 79a766e9ca23..63f7c78a1152 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -344,7 +344,6 @@ static void empeg_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        struct usb_serial_port *port = (struct usb_serial_port *)urb->context;
        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -359,19 +358,8 @@ static void empeg_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* gb - 2000/11/13
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                         * If we insert too many characters we'll overflow the buffer.
-                         * This means we'll lose bytes - Decidedly bad.
-                         */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                                }
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
-                /* gb - 2000/11/13
-                 * Goes straight through instead of scheduling - if tty->low_latency is set.
-                 */
                tty_flip_buffer_push(tty);
                bytes_in += urb->actual_length;
        }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index eb863b3f2d79..10bc1bf23b35 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1610,24 +1610,11 @@ static void ftdi_process_read (void *param)
                        length = 0;
                }
-                /* have to make sure we don't overflow the buffer
-                   with tty_insert_flip_char's */
-                if (tty->flip.count+length > TTY_FLIPBUF_SIZE) {
-                        tty_flip_buffer_push(tty);
-                        need_flip = 0;
-                        if (tty->flip.count != 0) {
-                                /* flip didn't work, this happens when ftdi_process_read() is
-                                 * called from ftdi_unthrottle, because TTY_DONT_FLIP is set */
-                                dbg("%s - flip buffer push failed", __FUNCTION__);
-                                break;
-                        }
-                }
                if (priv->rx_flags & THROTTLED) {
                        dbg("%s - throttled", __FUNCTION__);
                        break;
                }
-                if (tty->ldisc.receive_room(tty)-tty->flip.count < length) {
+                if (tty_buffer_request_room(tty, length) < length) {
                        /* break out & wait for throttling/unthrottling to happen */
                        dbg("%s - receive room low", __FUNCTION__);
                        break;
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 452efce72714..d6f55e9dccae 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -275,23 +275,14 @@ static void send_to_tty(struct usb_serial_port *port,
                        char *data, unsigned int actual_length)
 {
        struct tty_struct *tty = port->tty;
-        int i;
        if (tty && actual_length) {
                usb_serial_debug_data(debug, &port->dev, 
                                        __FUNCTION__, actual_length, data);
-                for (i = 0; i < actual_length ; ++i) {
+                tty_buffer_request_room(tty, actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters,
+                tty_insert_flip_string(tty, data, actual_length);
-                           we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless
-                           tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
 }
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 4ddac620fc0c..476cda107f4f 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -254,7 +254,6 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
        struct usb_serial *serial = port->serial;
        struct tty_struct *tty;
        unsigned char *data = urb->transfer_buffer;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -268,14 +267,8 @@ void usb_serial_generic_read_bulk_callback (struct urb *urb, struct pt_regs *reg
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index faedbeb6ba49..3f29e6b0fd19 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -1965,20 +1965,14 @@ static void edge_tty_recv(struct device *dev, struct tty_struct *tty, unsigned c
        int cnt;
        do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                cnt = tty_buffer_request_room(tty, length);
-                        tty_flip_buffer_push(tty);
+                if (cnt < length) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n",
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n",
+                                        __FUNCTION__, length - cnt);
-                                        __FUNCTION__, length);
+                        if(cnt == 0)
-                                return;
+                                break;
-                        }
                }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
+                tty_insert_flip_string(tty, data, cnt);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
                data += cnt;
                length -= cnt;
        } while (length > 0);
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 2edf9cabad20..afc0f34b3a46 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1865,20 +1865,14 @@ static void edge_tty_recv(struct device *dev, struct tty_struct *tty, unsigned c
        int cnt;
        do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                cnt = tty_buffer_request_room(tty, length);
-                        tty_flip_buffer_push(tty);
+                if (cnt < length) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n",
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n",
+                                __FUNCTION__, length - cnt);
-                                        __FUNCTION__, length);
+                        if(cnt == 0)
-                                return;
+                                break;
-                        }
                }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
+                tty_insert_flip_string(tty, data, cnt);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
                data += cnt;
                length -= cnt;
        } while (length > 0);
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 06d07cea0b70..9a5c97989562 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -711,7 +711,7 @@ static void ipaq_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        struct usb_serial_port  *port = (struct usb_serial_port *)urb->context;
        struct tty_struct       *tty;
        unsigned char           *data = urb->transfer_buffer;
-        int                     i, result;
+        int                     result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -724,14 +724,8 @@ static void ipaq_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
                bytes_in += urb->actual_length;
        }
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index 2dd191f5fe76..e760a70242c1 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -166,7 +166,6 @@ static void ipw_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        struct usb_serial_port *port = urb->context;
        unsigned char *data = urb->transfer_buffer;
        struct tty_struct *tty;
-        int i;
        int result;
        dbg("%s - port %d", __FUNCTION__, port->number);
@@ -180,14 +179,8 @@ static void ipw_read_bulk_callback(struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 4e2f7dfb58b2..78335a5f7743 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -648,7 +648,6 @@ static void klsi_105_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                usb_serial_debug_data(debug, &port->dev, __FUNCTION__,
                                      urb->actual_length, data);
        } else {
-                int i;
                int bytes_sent = ((__u8 *) data)[0] +
                                 ((unsigned int) ((__u8 *) data)[1] << 8);
                tty = port->tty;
@@ -669,16 +668,8 @@ static void klsi_105_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
                        bytes_sent = urb->actual_length - 2;
                }
-                for (i = 2; i < 2+bytes_sent; i++) {
+                tty_buffer_request_room(tty, bytes_sent);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters,
+                tty_insert_flip_string(tty, data + 2, bytes_sent);
-                         * we drop them. */
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless 
-                         * tty->low_latency is set */
-                        tty_insert_flip_char(tty, ((__u8*) data)[i], 0);
-                }
                tty_flip_buffer_push(tty);
                /* again lockless, but debug info only */
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index d9c21e275130..b8b213185d0f 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -365,7 +365,6 @@ static void kobil_close (struct usb_serial_port *port, struct file *filp)
 static void kobil_read_int_callback( struct urb *purb, struct pt_regs *regs)
 {
-        int i;
        int result;
        struct usb_serial_port *port = (struct usb_serial_port *) purb->context;
        struct tty_struct *tty;
@@ -397,14 +396,8 @@ static void kobil_read_int_callback( struct urb *purb, struct pt_regs *regs)
                */
                // END DEBUG
-                for (i = 0; i < purb->actual_length; ++i) {
+                tty_buffer_request_room(tty, purb->actual_length);
-                        // if we insert more than TTY_FLIPBUF_SIZE characters, we drop them.
+                tty_insert_flip_string(tty, data, purb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        // this doesn't actually push the data through unless tty->low_latency is set
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 3fd2405304fd..52bdf6fe46f2 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -321,7 +321,7 @@ static int option_write(struct usb_serial_port *port,
 static void option_indat_callback(struct urb *urb, struct pt_regs *regs)
 {
-        int i, err;
+        int err;
        int endpoint;
        struct usb_serial_port *port;
        struct tty_struct *tty;
@@ -338,11 +338,8 @@ static void option_indat_callback(struct urb *urb, struct pt_regs *regs)
        } else {
                tty = port->tty;
                if (urb->actual_length) {
-                        for (i = 0; i < urb->actual_length ; ++i) {
+                        tty_buffer_request_room(tty, urb->actual_length);
-                                if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                        tty_insert_flip_string(tty, data, urb->actual_length);
-                                        tty_flip_buffer_push(tty);
-                                tty_insert_flip_char(tty, data[i], 0);
-                        }
                        tty_flip_buffer_push(tty);
                } else {
                        dbg("%s: empty read urb received", __FUNCTION__);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index f03721056190..9ffff1938239 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -924,16 +924,12 @@ static void pl2303_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
+                tty_buffer_request_room(tty, urb->actual_length + 1);
                /* overrun is special, not associated with a char */
                if (status & UART_OVERRUN_ERROR)
                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                for (i = 0; i < urb->actual_length; ++i)
-                for (i = 0; i < urb->actual_length; ++i) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
                        tty_insert_flip_char (tty, data[i], tty_flag);
-                }
                tty_flip_buffer_push (tty);
        }
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index abb830cb77bd..c18db3257073 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1280,24 +1280,18 @@ static void ti_recv(struct device *dev, struct tty_struct *tty,
        int cnt;
        do {
-                if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                cnt = tty_buffer_request_room(tty, length);
-                        tty_flip_buffer_push(tty);
+                if (cnt < length) {
-                        if (tty->flip.count >= TTY_FLIPBUF_SIZE) {
+                        dev_err(dev, "%s - dropping data, %d bytes lost\n", __FUNCTION__, length - cnt);
-                                dev_err(dev, "%s - dropping data, %d bytes lost\n", __FUNCTION__, length);
+                        if(cnt == 0)
-                                return;
+                                break;
-                        }
                }
-                cnt = min(length, TTY_FLIPBUF_SIZE - tty->flip.count);
+                tty_insert_flip_string(tty, data, cnt);
-                memcpy(tty->flip.char_buf_ptr, data, cnt);
+                tty_flip_buffer_push(tty);
-                memset(tty->flip.flag_buf_ptr, 0, cnt);
-                tty->flip.char_buf_ptr += cnt;
-                tty->flip.flag_buf_ptr += cnt;
-                tty->flip.count += cnt;
                data += cnt;
                length -= cnt;
        } while (length > 0);
-        tty_flip_buffer_push(tty);
 }
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index 49b1fbe61f25..bce3d55affd8 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -488,7 +488,6 @@ static void visor_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        unsigned char *data = urb->transfer_buffer;
        struct tty_struct *tty;
        unsigned long flags;
-        int i;
        int throttled;
        int result;
@@ -503,14 +502,8 @@ static void visor_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
        tty = port->tty;
        if (tty && urb->actual_length) {
-                for (i = 0; i < urb->actual_length ; ++i) {
+                tty_buffer_request_room(tty, urb->actual_length);
-                        /* if we insert more than TTY_FLIPBUF_SIZE characters, we drop them. */
+                tty_insert_flip_string(tty, data, urb->actual_length);
-                        if(tty->flip.count >= TTY_FLIPBUF_SIZE) {
-                                tty_flip_buffer_push(tty);
-                        }
-                        /* this doesn't actually push the data through unless tty->low_latency is set */
-                        tty_insert_flip_char(tty, data[i], 0);
-                }
                tty_flip_buffer_push(tty);
        }
        spin_lock_irqsave(&priv->lock, flags);
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index a7c3c4734d83..557411c6e7c7 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -1434,7 +1434,9 @@ static void rx_data_softint(void *private)
                urb = wrap->urb;
                if (tty && urb->actual_length) {
-                        if (urb->actual_length > TTY_FLIPBUF_SIZE - tty->flip.count) {
+                        int len = tty_buffer_request_room(tty, urb->actual_length);
+                        /* This stuff can go away now I suspect */
+                        if (unlikely(len < urb->actual_length)) {
                                spin_lock_irqsave(&info->lock, flags);
                                list_add(tmp, &info->rx_urb_q);
                                spin_unlock_irqrestore(&info->lock, flags);
@@ -1442,11 +1444,8 @@ static void rx_data_softint(void *private)
                                schedule_work(&info->rx_work);
                                return;
                        }
+                        tty_insert_flip_string(tty, urb->transfer_buffer, len);
-                        memcpy(tty->flip.char_buf_ptr, urb->transfer_buffer, urb->actual_length);
+                        sent += len;
-                        tty->flip.char_buf_ptr += urb->actual_length;
-                        tty->flip.count += urb->actual_length;
-                        sent += urb->actual_length;
                }
                urb->dev = port->serial->dev;