16 files changed, 440 insertions, 136 deletions

diff --git a/fs/exec.c b/fs/exec.c
index 3234a0c32d54..4121bb559739 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -665,9 +665,7 @@ static int de_thread(struct task_struct *tsk)
          * and to assume its PID:
          */
         if (!thread_group_leader(current)) {
-                struct task_struct *parent;
                 struct dentry *proc_dentry1, *proc_dentry2;
-                unsigned long ptrace;
 
                 /*
                  * Wait for the thread group leader to be a zombie.
@@ -704,22 +702,6 @@ static int de_thread(struct task_struct *tsk)
                  * two threads with a switched PID, and release
                  * the former thread group leader:
                  */
-                ptrace = leader->ptrace;
-                parent = leader->parent;
-                if (unlikely(ptrace) && unlikely(parent == current)) {
-                        /*
-                         * Joker was ptracing his own group leader,
-                         * and now he wants to be his own parent!
-                         * We can't have that.
-                         */
-                        ptrace = 0;
-                }
-
-                ptrace_unlink(current);
-                ptrace_unlink(leader);
-                remove_parent(current);
-                remove_parent(leader);
-
 
                 /* Become a process group leader with the old leader's pid.
                  * Note: The old leader also uses thispid until release_task
@@ -732,8 +714,6 @@ static int de_thread(struct task_struct *tsk)
                 attach_pid(current, PIDTYPE_SID,  current->signal->session);
                 list_add_tail(&current->tasks, &init_task.tasks);
 
-                current->parent = current->real_parent = leader->real_parent;
-                leader->parent = leader->real_parent = child_reaper;
                 current->group_leader = current;
                 leader->group_leader = current;
 
@@ -742,13 +722,6 @@ static int de_thread(struct task_struct *tsk)
                 detach_pid(leader, PIDTYPE_SID);
                 list_del_init(&leader->tasks);
 
-                add_parent(current);
-                add_parent(leader);
-                if (ptrace) {
-                        current->ptrace = ptrace;
-                        __ptrace_link(current, parent);
-                }
-
                 current->exit_signal = SIGCHLD;
 
                 BUG_ON(leader->exit_state != EXIT_ZOMBIE);
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 14f5f6ea3e72..c5ffa8523968 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -767,6 +767,7 @@ int ext3_group_add(struct super_block *sb, struct ext3_new_group_data *input)
         if (input->group != sbi->s_groups_count) {
                 ext3_warning(sb, __FUNCTION__,
                              "multiple resizers run on filesystem!");
+                unlock_super(sb);
                 err = -EBUSY;
                 goto exit_journal;
         }
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 6c740f860665..cc750c68fe70 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -92,48 +92,50 @@ struct fuse_req *fuse_get_req(struct fuse_conn *fc)
 {
         struct fuse_req *req;
         sigset_t oldset;
+        int intr;
         int err;
 
+        atomic_inc(&fc->num_waiting);
         block_sigs(&oldset);
-        err = wait_event_interruptible(fc->blocked_waitq, !fc->blocked);
+        intr = wait_event_interruptible(fc->blocked_waitq, !fc->blocked);
         restore_sigs(&oldset);
-        if (err)
-                return ERR_PTR(-EINTR);
+        err = -EINTR;
+        if (intr)
+                goto out;
 
         req = fuse_request_alloc();
+        err = -ENOMEM;
         if (!req)
-                return ERR_PTR(-ENOMEM);
+                goto out;
 
-        atomic_inc(&fc->num_waiting);
-        fuse_request_init(req);
         req->in.h.uid = current->fsuid;
         req->in.h.gid = current->fsgid;
         req->in.h.pid = current->pid;
+        req->waiting = 1;
         return req;
+
+ out:
+        atomic_dec(&fc->num_waiting);
+        return ERR_PTR(err);
 }
 
 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         if (atomic_dec_and_test(&req->count)) {
-                atomic_dec(&fc->num_waiting);
+                if (req->waiting)
+                        atomic_dec(&fc->num_waiting);
                 fuse_request_free(req);
         }
 }
 
-void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req)
+void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req)
 {
-        iput(req->inode);
-        iput(req->inode2);
-        if (req->file)
-                fput(req->file);
-        spin_lock(&fc->lock);
-        list_del(&req->bg_entry);
+        list_del_init(&req->bg_entry);
         if (fc->num_background == FUSE_MAX_BACKGROUND) {
                 fc->blocked = 0;
                 wake_up_all(&fc->blocked_waitq);
         }
         fc->num_background--;
-        spin_unlock(&fc->lock);
 }
 
 /*
@@ -163,17 +165,27 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
                 wake_up(&req->waitq);
                 fuse_put_request(fc, req);
         } else {
+                struct inode *inode = req->inode;
+                struct inode *inode2 = req->inode2;
+                struct file *file = req->file;
                 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
                 req->end = NULL;
+                req->inode = NULL;
+                req->inode2 = NULL;
+                req->file = NULL;
+                if (!list_empty(&req->bg_entry))
+                        fuse_remove_background(fc, req);
                 spin_unlock(&fc->lock);
-                down_read(&fc->sbput_sem);
-                if (fc->mounted)
-                        fuse_release_background(fc, req);
-                up_read(&fc->sbput_sem);
+
                 if (end)
                         end(fc, req);
                 else
                         fuse_put_request(fc, req);
+
+                if (file)
+                        fput(file);
+                iput(inode);
+                iput(inode2);
         }
 }
 
@@ -277,6 +289,10 @@ static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
                 len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
         list_add_tail(&req->list, &fc->pending);
         req->state = FUSE_REQ_PENDING;
+        if (!req->waiting) {
+                req->waiting = 1;
+                atomic_inc(&fc->num_waiting);
+        }
         wake_up(&fc->waitq);
         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 }
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index e4f041a11bb5..fc342cf7c2cc 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1,6 +1,6 @@
 /*
   FUSE: Filesystem in Userspace
-  Copyright (C) 2001-2005  Miklos Szeredi <miklos@szeredi.hu>
+  Copyright (C) 2001-2006  Miklos Szeredi <miklos@szeredi.hu>
 
   This program can be distributed under the terms of the GNU GPL.
   See the file COPYING.
@@ -565,8 +565,12 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                 buf += nres;
                 if (nres != nbytes)
                         break;
-                if (count)
-                        fuse_reset_request(req);
+                if (count) {
+                        fuse_put_request(fc, req);
+                        req = fuse_get_req(fc);
+                        if (IS_ERR(req))
+                                break;
+                }
         }
         fuse_put_request(fc, req);
         if (res > 0) {
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 19c7185a7546..59661c481d9d 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -159,6 +159,9 @@ struct fuse_req {
         /** Data is being copied to/from the request */
         unsigned locked:1;
 
+        /** Request is counted as "waiting" */
+        unsigned waiting:1;
+
         /** State of the request */
         enum fuse_req_state state;
 
@@ -255,15 +258,9 @@ struct fuse_conn {
         /** waitq for blocked connection */
         wait_queue_head_t blocked_waitq;
 
-        /** RW semaphore for exclusion with fuse_put_super() */
-        struct rw_semaphore sbput_sem;
-
         /** The next unique request id */
         u64 reqctr;
 
-        /** Mount is active */
-        unsigned mounted;
-
         /** Connection established, cleared on umount, connection
             abort and device release */
         unsigned connected;
@@ -474,11 +471,11 @@ void request_send_noreply(struct fuse_conn *fc, struct fuse_req *req);
 void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
 
 /**
- * Release inodes and file associated with background request
+ * Remove request from the the background list
  */
-void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req);
+void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req);
 
-/* Abort all requests */
+/** Abort all requests */
 void fuse_abort_conn(struct fuse_conn *fc);
 
 /**
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index fd34037b0588..43a6fc0db8a7 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -204,17 +204,26 @@ static void fuse_put_super(struct super_block *sb)
 {
         struct fuse_conn *fc = get_fuse_conn_super(sb);
 
-        down_write(&fc->sbput_sem);
-        while (!list_empty(&fc->background))
-                fuse_release_background(fc,
-                                        list_entry(fc->background.next,
-                                                   struct fuse_req, bg_entry));
-
         spin_lock(&fc->lock);
-        fc->mounted = 0;
         fc->connected = 0;
+        while (!list_empty(&fc->background)) {
+                struct fuse_req *req = list_entry(fc->background.next,
+                                                  struct fuse_req, bg_entry);
+                struct inode *inode = req->inode;
+                struct inode *inode2 = req->inode2;
+
+                /* File would hold a reference to vfsmount */
+                BUG_ON(req->file);
+                req->inode = NULL;
+                req->inode2 = NULL;
+                fuse_remove_background(fc, req);
+
+                spin_unlock(&fc->lock);
+                iput(inode);
+                iput(inode2);
+                spin_lock(&fc->lock);
+        }
         spin_unlock(&fc->lock);
-        up_write(&fc->sbput_sem);
         /* Flush all readers on this fs */
         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
         wake_up_all(&fc->waitq);
@@ -386,7 +395,6 @@ static struct fuse_conn *new_conn(void)
                 INIT_LIST_HEAD(&fc->processing);
                 INIT_LIST_HEAD(&fc->io);
                 INIT_LIST_HEAD(&fc->background);
-                init_rwsem(&fc->sbput_sem);
                 kobj_set_kset_s(fc, connections_subsys);
                 kobject_init(&fc->kobj);
                 atomic_set(&fc->num_waiting, 0);
@@ -541,7 +549,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
                 goto err_free_req;
 
         sb->s_root = root_dentry;
-        fc->mounted = 1;
         fc->connected = 1;
         kobject_get(&fc->kobj);
         file->private_data = fc;
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index af0cb4b9e784..45ae7dd3c650 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -331,7 +331,9 @@ void delete_partition(struct gendisk *disk, int part)
         devfs_remove("%s/part%d", disk->devfs_name, part);
         if (p->holder_dir)
                 kobject_unregister(p->holder_dir);
-        kobject_unregister(&p->kobj);
+        kobject_uevent(&p->kobj, KOBJ_REMOVE);
+        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 }
 
 void add_partition(struct gendisk *disk, int part, sector_t start, sector_t len)
@@ -357,7 +359,10 @@ void add_partition(struct gendisk *disk, int part, sector_t start, sector_t len)
                 snprintf(p->kobj.name,KOBJ_NAME_LEN,"%s%d",disk->kobj.name,part);
         p->kobj.parent = &disk->kobj;
         p->kobj.ktype = &ktype_part;
-        kobject_register(&p->kobj);
+        kobject_init(&p->kobj);
+        kobject_add(&p->kobj);
+        if (!disk->part_uevent_suppress)
+                kobject_uevent(&p->kobj, KOBJ_ADD);
         partition_sysfs_add_subdir(p);
         disk->part[part-1] = p;
 }
@@ -367,6 +372,7 @@ static char *make_block_name(struct gendisk *disk)
         char *name;
         static char *block_str = "block:";
         int size;
+        char *s;
 
         size = strlen(block_str) + strlen(disk->disk_name) + 1;
         name = kmalloc(size, GFP_KERNEL);
@@ -374,6 +380,10 @@ static char *make_block_name(struct gendisk *disk)
                 return NULL;
         strcpy(name, block_str);
         strcat(name, disk->disk_name);
+        /* ewww... some of these buggers have / in name... */
+        s = strchr(name, '/');
+        if (s)
+                *s = '!';
         return name;
 }
 
@@ -395,6 +405,8 @@ void register_disk(struct gendisk *disk)
 {
         struct block_device *bdev;
         char *s;
+        int i;
+        struct hd_struct *p;
         int err;
 
         strlcpy(disk->kobj.name,disk->disk_name,KOBJ_NAME_LEN);
@@ -406,13 +418,12 @@ void register_disk(struct gendisk *disk)
                 return;
         disk_sysfs_symlinks(disk);
         disk_sysfs_add_subdirs(disk);
-        kobject_uevent(&disk->kobj, KOBJ_ADD);
 
         /* No minors to use for partitions */
         if (disk->minors == 1) {
                 if (disk->devfs_name[0] != '\0')
                         devfs_add_disk(disk);
-                return;
+                goto exit;
         }
 
         /* always add handle for the whole disk */
@@ -420,16 +431,32 @@ void register_disk(struct gendisk *disk)
 
         /* No such device (e.g., media were just removed) */
         if (!get_capacity(disk))
-                return;
+                goto exit;
 
         bdev = bdget_disk(disk, 0);
         if (!bdev)
-                return;
+                goto exit;
 
+        /* scan partition table, but suppress uevents */
         bdev->bd_invalidated = 1;
-        if (blkdev_get(bdev, FMODE_READ, 0) < 0)
-                return;
+        disk->part_uevent_suppress = 1;
+        err = blkdev_get(bdev, FMODE_READ, 0);
+        disk->part_uevent_suppress = 0;
+        if (err < 0)
+                goto exit;
         blkdev_put(bdev);
+
+exit:
+        /* announce disk after possible partitions are already created */
+        kobject_uevent(&disk->kobj, KOBJ_ADD);
+
+        /* announce possible partitions */
+        for (i = 1; i < disk->minors; i++) {
+                p = disk->part[i-1];
+                if (!p || !p->nr_sects)
+                        continue;
+                kobject_uevent(&p->kobj, KOBJ_ADD);
+        }
 }
 
 int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
diff --git a/fs/pipe.c b/fs/pipe.c
index e984beb93a0e..7fefb10db8d9 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -131,12 +131,19 @@ static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
         return 0;
 }
 
+static void anon_pipe_buf_get(struct pipe_inode_info *info,
+                              struct pipe_buffer *buf)
+{
+        page_cache_get(buf->page);
+}
+
 static struct pipe_buf_operations anon_pipe_buf_ops = {
         .can_merge = 1,
         .map = anon_pipe_buf_map,
         .unmap = anon_pipe_buf_unmap,
         .release = anon_pipe_buf_release,
         .steal = anon_pipe_buf_steal,
+        .get = anon_pipe_buf_get,
 };
 
 static ssize_t
diff --git a/fs/splice.c b/fs/splice.c
index e50a460239dd..8d57e89924a6 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -125,12 +125,19 @@ static void page_cache_pipe_buf_unmap(struct pipe_inode_info *info,
         kunmap(buf->page);
 }
 
+static void page_cache_pipe_buf_get(struct pipe_inode_info *info,
+                                    struct pipe_buffer *buf)
+{
+        page_cache_get(buf->page);
+}
+
 static struct pipe_buf_operations page_cache_pipe_buf_ops = {
         .can_merge = 0,
         .map = page_cache_pipe_buf_map,
         .unmap = page_cache_pipe_buf_unmap,
         .release = page_cache_pipe_buf_release,
         .steal = page_cache_pipe_buf_steal,
+        .get = page_cache_pipe_buf_get,
 };
 
 /*
@@ -231,8 +238,9 @@ static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
 }
 
 static int
-__generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
-                           size_t len, unsigned int flags)
+__generic_file_splice_read(struct file *in, loff_t *ppos,
+                           struct pipe_inode_info *pipe, size_t len,
+                           unsigned int flags)
 {
         struct address_space *mapping = in->f_mapping;
         unsigned int offset, nr_pages;
@@ -241,8 +249,8 @@ __generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
         pgoff_t index;
         int i, error;
 
-        index = in->f_pos >> PAGE_CACHE_SHIFT;
-        offset = in->f_pos & ~PAGE_CACHE_MASK;
+        index = *ppos >> PAGE_CACHE_SHIFT;
+        offset = *ppos & ~PAGE_CACHE_MASK;
         nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
         if (nr_pages > PIPE_BUFFERS)
@@ -348,8 +356,9 @@ fill_it:
  *
  * Will read pages from given file and fill them into a pipe.
  */
-ssize_t generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
-                                 size_t len, unsigned int flags)
+ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
+                                 struct pipe_inode_info *pipe, size_t len,
+                                 unsigned int flags)
 {
         ssize_t spliced;
         int ret;
@@ -358,12 +367,12 @@ ssize_t generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
         spliced = 0;
 
         while (len) {
-                ret = __generic_file_splice_read(in, pipe, len, flags);
+                ret = __generic_file_splice_read(in, ppos, pipe, len, flags);
 
                 if (ret <= 0)
                         break;
 
-                in->f_pos += ret;
+                *ppos += ret;
                 len -= ret;
                 spliced += ret;
 
@@ -561,7 +570,7 @@ typedef int (splice_actor)(struct pipe_inode_info *, struct pipe_buffer *,
  * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
  */
 static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
-                              size_t len, unsigned int flags,
+                              loff_t *ppos, size_t len, unsigned int flags,
                               splice_actor *actor)
 {
         int ret, do_wakeup, err;
@@ -573,7 +582,7 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
         sd.total_len = len;
         sd.flags = flags;
         sd.file = out;
-        sd.pos = out->f_pos;
+        sd.pos = *ppos;
 
         if (pipe->inode)
                 mutex_lock(&pipe->inode->i_mutex);
@@ -656,9 +665,7 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                 kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
 
-        out->f_pos = sd.pos;
         return ret;
-
 }
 
 /**
@@ -674,12 +681,12 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
  */
 ssize_t
 generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-                          size_t len, unsigned int flags)
+                          loff_t *ppos, size_t len, unsigned int flags)
 {
         struct address_space *mapping = out->f_mapping;
         ssize_t ret;
 
-        ret = move_from_pipe(pipe, out, len, flags, pipe_to_file);
+        ret = move_from_pipe(pipe, out, ppos, len, flags, pipe_to_file);
 
         /*
          * If file or inode is SYNC and we actually wrote some data, sync it.
@@ -715,9 +722,9 @@ EXPORT_SYMBOL(generic_file_splice_write);
  *
  */
 ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe, struct file *out,
-                                size_t len, unsigned int flags)
+                                loff_t *ppos, size_t len, unsigned int flags)
 {
-        return move_from_pipe(pipe, out, len, flags, pipe_to_sendpage);
+        return move_from_pipe(pipe, out, ppos, len, flags, pipe_to_sendpage);
 }
 
 EXPORT_SYMBOL(generic_splice_sendpage);
@@ -726,9 +733,8 @@ EXPORT_SYMBOL(generic_splice_sendpage);
  * Attempt to initiate a splice from pipe to file.
  */
 static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
-                           size_t len, unsigned int flags)
+                           loff_t *ppos, size_t len, unsigned int flags)
 {
-        loff_t pos;
         int ret;
 
         if (unlikely(!out->f_op || !out->f_op->splice_write))
@@ -737,22 +743,21 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
         if (unlikely(!(out->f_mode & FMODE_WRITE)))
                 return -EBADF;
 
-        pos = out->f_pos;
-
-        ret = rw_verify_area(WRITE, out, &pos, len);
+        ret = rw_verify_area(WRITE, out, ppos, len);
         if (unlikely(ret < 0))
                 return ret;
 
-        return out->f_op->splice_write(pipe, out, len, flags);
+        return out->f_op->splice_write(pipe, out, ppos, len, flags);
 }
 
 /*
  * Attempt to initiate a splice from a file to a pipe.
  */
-static long do_splice_to(struct file *in, struct pipe_inode_info *pipe,
-                         size_t len, unsigned int flags)
+static long do_splice_to(struct file *in, loff_t *ppos,
+                         struct pipe_inode_info *pipe, size_t len,
+                         unsigned int flags)
 {
-        loff_t pos, isize, left;
+        loff_t isize, left;
         int ret;
 
         if (unlikely(!in->f_op || !in->f_op->splice_read))
@@ -761,28 +766,27 @@ static long do_splice_to(struct file *in, struct pipe_inode_info *pipe,
         if (unlikely(!(in->f_mode & FMODE_READ)))
                 return -EBADF;
 
-        pos = in->f_pos;
-
-        ret = rw_verify_area(READ, in, &pos, len);
+        ret = rw_verify_area(READ, in, ppos, len);
         if (unlikely(ret < 0))
                 return ret;
 
         isize = i_size_read(in->f_mapping->host);
-        if (unlikely(in->f_pos >= isize))
+        if (unlikely(*ppos >= isize))
                 return 0;
         
-        left = isize - in->f_pos;
+        left = isize - *ppos;
         if (unlikely(left < len))
                 len = left;
 
-        return in->f_op->splice_read(in, pipe, len, flags);
+        return in->f_op->splice_read(in, ppos, pipe, len, flags);
 }
 
-long do_splice_direct(struct file *in, struct file *out, size_t len,
-                      unsigned int flags)
+long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
+                      size_t len, unsigned int flags)
 {
         struct pipe_inode_info *pipe;
         long ret, bytes;
+        loff_t out_off;
         umode_t i_mode;
         int i;
 
@@ -820,6 +824,7 @@ long do_splice_direct(struct file *in, struct file *out, size_t len,
          */
         ret = 0;
         bytes = 0;
+        out_off = 0;
 
         while (len) {
                 size_t read_len, max_read_len;
@@ -829,7 +834,7 @@ long do_splice_direct(struct file *in, struct file *out, size_t len,
                  */
                 max_read_len = min(len, (size_t)(PIPE_BUFFERS*PAGE_SIZE));
 
-                ret = do_splice_to(in, pipe, max_read_len, flags);
+                ret = do_splice_to(in, ppos, pipe, max_read_len, flags);
                 if (unlikely(ret < 0))
                         goto out_release;
 
@@ -840,7 +845,7 @@ long do_splice_direct(struct file *in, struct file *out, size_t len,
                  * must not do the output in nonblocking mode as then we
                  * could get stuck data in the internal pipe:
                  */
-                ret = do_splice_from(pipe, out, read_len,
+                ret = do_splice_from(pipe, out, &out_off, read_len,
                                      flags & ~SPLICE_F_NONBLOCK);
                 if (unlikely(ret < 0))
                         goto out_release;
@@ -898,6 +903,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                       size_t len, unsigned int flags)
 {
         struct pipe_inode_info *pipe;
+        loff_t offset, *off;
 
         pipe = in->f_dentry->d_inode->i_pipe;
         if (pipe) {
@@ -906,12 +912,13 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 if (off_out) {
                         if (out->f_op->llseek == no_llseek)
                                 return -EINVAL;
-                        if (copy_from_user(&out->f_pos, off_out,
-                                           sizeof(loff_t)))
+                        if (copy_from_user(&offset, off_out, sizeof(loff_t)))
                                 return -EFAULT;
-                }
+                        off = &offset;
+                } else
+                        off = &out->f_pos;
 
-                return do_splice_from(pipe, out, len, flags);
+                return do_splice_from(pipe, out, off, len, flags);
         }
 
         pipe = out->f_dentry->d_inode->i_pipe;
@@ -921,11 +928,13 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 if (off_in) {
                         if (in->f_op->llseek == no_llseek)
                                 return -EINVAL;
-                        if (copy_from_user(&in->f_pos, off_in, sizeof(loff_t)))
+                        if (copy_from_user(&offset, off_in, sizeof(loff_t)))
                                 return -EFAULT;
-                }
+                        off = &offset;
+                } else
+                        off = &in->f_pos;
 
-                return do_splice_to(in, pipe, len, flags);
+                return do_splice_to(in, off, pipe, len, flags);
         }
 
         return -EINVAL;
@@ -961,3 +970,182 @@ asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
 
         return error;
 }
+
+/*
+ * Link contents of ipipe to opipe.
+ */
+static int link_pipe(struct pipe_inode_info *ipipe,
+                     struct pipe_inode_info *opipe,
+                     size_t len, unsigned int flags)
+{
+        struct pipe_buffer *ibuf, *obuf;
+        int ret = 0, do_wakeup = 0, i;
+
+        /*
+         * Potential ABBA deadlock, work around it by ordering lock
+         * grabbing by inode address. Otherwise two different processes
+         * could deadlock (one doing tee from A -> B, the other from B -> A).
+         */
+        if (ipipe->inode < opipe->inode) {
+                mutex_lock(&ipipe->inode->i_mutex);
+                mutex_lock(&opipe->inode->i_mutex);
+        } else {
+                mutex_lock(&opipe->inode->i_mutex);
+                mutex_lock(&ipipe->inode->i_mutex);
+        }
+
+        for (i = 0;; i++) {
+                if (!opipe->readers) {
+                        send_sig(SIGPIPE, current, 0);
+                        if (!ret)
+                                ret = -EPIPE;
+                        break;
+                }
+                if (ipipe->nrbufs - i) {
+                        ibuf = ipipe->bufs + ((ipipe->curbuf + i) & (PIPE_BUFFERS - 1));
+
+                        /*
+                         * If we have room, fill this buffer
+                         */
+                        if (opipe->nrbufs < PIPE_BUFFERS) {
+                                int nbuf = (opipe->curbuf + opipe->nrbufs) & (PIPE_BUFFERS - 1);
+
+                                /*
+                                 * Get a reference to this pipe buffer,
+                                 * so we can copy the contents over.
+                                 */
+                                ibuf->ops->get(ipipe, ibuf);
+
+                                obuf = opipe->bufs + nbuf;
+                                *obuf = *ibuf;
+
+                                if (obuf->len > len)
+                                        obuf->len = len;
+
+                                opipe->nrbufs++;
+                                do_wakeup = 1;
+                                ret += obuf->len;
+                                len -= obuf->len;
+
+                                if (!len)
+                                        break;
+                                if (opipe->nrbufs < PIPE_BUFFERS)
+                                        continue;
+                        }
+
+                        /*
+                         * We have input available, but no output room.
+                         * If we already copied data, return that.
+                         */
+                        if (flags & SPLICE_F_NONBLOCK) {
+                                if (!ret)
+                                        ret = -EAGAIN;
+                                break;
+                        }
+                        if (signal_pending(current)) {
+                                if (!ret)
+                                        ret = -ERESTARTSYS;
+                                break;
+                        }
+                        if (do_wakeup) {
+                                smp_mb();
+                                if (waitqueue_active(&opipe->wait))
+                                        wake_up_interruptible(&opipe->wait);
+                                kill_fasync(&opipe->fasync_readers, SIGIO, POLL_IN);
+                                do_wakeup = 0;
+                        }
+
+                        opipe->waiting_writers++;
+                        pipe_wait(opipe);
+                        opipe->waiting_writers--;
+                        continue;
+                }
+
+                /*
+                 * No input buffers, do the usual checks for available
+                 * writers and blocking and wait if necessary
+                 */
+                if (!ipipe->writers)
+                        break;
+                if (!ipipe->waiting_writers) {
+                        if (ret)
+                                break;
+                }
+                if (flags & SPLICE_F_NONBLOCK) {
+                        if (!ret)
+                                ret = -EAGAIN;
+                        break;
+                }
+                if (signal_pending(current)) {
+                        if (!ret)
+                                ret = -ERESTARTSYS;
+                        break;
+                }
+
+                if (waitqueue_active(&ipipe->wait))
+                        wake_up_interruptible_sync(&ipipe->wait);
+                kill_fasync(&ipipe->fasync_writers, SIGIO, POLL_OUT);
+
+                pipe_wait(ipipe);
+        }
+
+        mutex_unlock(&ipipe->inode->i_mutex);
+        mutex_unlock(&opipe->inode->i_mutex);
+
+        if (do_wakeup) {
+                smp_mb();
+                if (waitqueue_active(&opipe->wait))
+                        wake_up_interruptible(&opipe->wait);
+                kill_fasync(&opipe->fasync_readers, SIGIO, POLL_IN);
+        }
+
+        return ret;
+}
+
+/*
+ * This is a tee(1) implementation that works on pipes. It doesn't copy
+ * any data, it simply references the 'in' pages on the 'out' pipe.
+ * The 'flags' used are the SPLICE_F_* variants, currently the only
+ * applicable one is SPLICE_F_NONBLOCK.
+ */
+static long do_tee(struct file *in, struct file *out, size_t len,
+                   unsigned int flags)
+{
+        struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
+        struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+
+        /*
+         * Link ipipe to the two output pipes, consuming as we go along.
+         */
+        if (ipipe && opipe)
+                return link_pipe(ipipe, opipe, len, flags);
+
+        return -EINVAL;
+}
+
+asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags)
+{
+        struct file *in;
+        int error, fput_in;
+
+        if (unlikely(!len))
+                return 0;
+
+        error = -EBADF;
+        in = fget_light(fdin, &fput_in);
+        if (in) {
+                if (in->f_mode & FMODE_READ) {
+                        int fput_out;
+                        struct file *out = fget_light(fdout, &fput_out);
+
+                        if (out) {
+                                if (out->f_mode & FMODE_WRITE)
+                                        error = do_tee(in, out, len, flags);
+                                fput_light(out, fput_out);
+                        }
+                }
+                fput_light(in, fput_in);
+        }
+
+        return error;
+}
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 6cfdc9a87772..610b5bdbe75b 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -43,6 +43,7 @@ static struct sysfs_dirent * sysfs_new_dirent(struct sysfs_dirent * parent_sd,
 
         memset(sd, 0, sizeof(*sd));
         atomic_set(&sd->s_count, 1);
+        atomic_set(&sd->s_event, 0);
         INIT_LIST_HEAD(&sd->s_children);
         list_add(&sd->s_sibling, &parent_sd->s_children);
         sd->s_element = element;
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index f1cb1ddde511..cf3786625bfa 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -6,6 +6,7 @@
 #include <linux/fsnotify.h>
 #include <linux/kobject.h>
 #include <linux/namei.h>
+#include <linux/poll.h>
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
 
@@ -57,6 +58,7 @@ struct sysfs_buffer {
         struct sysfs_ops        * ops;
         struct semaphore        sem;
         int                     needs_read_fill;
+        int                     event;
 };
 
 
@@ -72,6 +74,7 @@ struct sysfs_buffer {
  */
 static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer)
 {
+        struct sysfs_dirent * sd = dentry->d_fsdata;
         struct attribute * attr = to_attr(dentry);
         struct kobject * kobj = to_kobj(dentry->d_parent);
         struct sysfs_ops * ops = buffer->ops;
@@ -83,6 +86,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
         if (!buffer->page)
                 return -ENOMEM;
 
+        buffer->event = atomic_read(&sd->s_event);
         count = ops->show(kobj,attr,buffer->page);
         buffer->needs_read_fill = 0;
         BUG_ON(count > (ssize_t)PAGE_SIZE);
@@ -348,12 +352,84 @@ static int sysfs_release(struct inode * inode, struct file * filp)
         return 0;
 }
 
+/* Sysfs attribute files are pollable.  The idea is that you read
+ * the content and then you use 'poll' or 'select' to wait for
+ * the content to change.  When the content changes (assuming the
+ * manager for the kobject supports notification), poll will
+ * return POLLERR|POLLPRI, and select will return the fd whether
+ * it is waiting for read, write, or exceptions.
+ * Once poll/select indicates that the value has changed, you
+ * need to close and re-open the file, as simply seeking and reading
+ * again will not get new data, or reset the state of 'poll'.
+ * Reminder: this only works for attributes which actively support
+ * it, and it is not possible to test an attribute from userspace
+ * to see if it supports poll (Nether 'poll' or 'select' return
+ * an appropriate error code).  When in doubt, set a suitable timeout value.
+ */
+static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
+{
+        struct sysfs_buffer * buffer = filp->private_data;
+        struct kobject * kobj = to_kobj(filp->f_dentry->d_parent);
+        struct sysfs_dirent * sd = filp->f_dentry->d_fsdata;
+        int res = 0;
+
+        poll_wait(filp, &kobj->poll, wait);
+
+        if (buffer->event != atomic_read(&sd->s_event)) {
+                res = POLLERR|POLLPRI;
+                buffer->needs_read_fill = 1;
+        }
+
+        return res;
+}
+
+
+static struct dentry *step_down(struct dentry *dir, const char * name)
+{
+        struct dentry * de;
+
+        if (dir == NULL || dir->d_inode == NULL)
+                return NULL;
+
+        mutex_lock(&dir->d_inode->i_mutex);
+        de = lookup_one_len(name, dir, strlen(name));
+        mutex_unlock(&dir->d_inode->i_mutex);
+        dput(dir);
+        if (IS_ERR(de))
+                return NULL;
+        if (de->d_inode == NULL) {
+                dput(de);
+                return NULL;
+        }
+        return de;
+}
+
+void sysfs_notify(struct kobject * k, char *dir, char *attr)
+{
+        struct dentry *de = k->dentry;
+        if (de)
+                dget(de);
+        if (de && dir)
+                de = step_down(de, dir);
+        if (de && attr)
+                de = step_down(de, attr);
+        if (de) {
+                struct sysfs_dirent * sd = de->d_fsdata;
+                if (sd)
+                        atomic_inc(&sd->s_event);
+                wake_up_interruptible(&k->poll);
+                dput(de);
+        }
+}
+EXPORT_SYMBOL_GPL(sysfs_notify);
+
 const struct file_operations sysfs_file_operations = {
         .read           = sysfs_read_file,
         .write          = sysfs_write_file,
         .llseek         = generic_file_llseek,
         .open           = sysfs_open_file,
         .release        = sysfs_release,
+        .poll           = sysfs_poll,
 };
 
 
diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index 32958a7c50e9..3651ffb5ec09 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -11,6 +11,7 @@ extern int sysfs_make_dirent(struct sysfs_dirent *, struct dentry *, void *,
 
 extern int sysfs_add_file(struct dentry *, const struct attribute *, int);
 extern void sysfs_hash_and_remove(struct dentry * dir, const char * name);
+extern struct sysfs_dirent *sysfs_find(struct sysfs_dirent *dir, const char * name);
 
 extern int sysfs_create_subdir(struct kobject *, const char *, struct dentry **);
 extern void sysfs_remove_subdir(struct dentry *);
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 269721af02f3..c847416f6d10 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -252,6 +252,7 @@ xfs_file_sendfile_invis(
 STATIC ssize_t
 xfs_file_splice_read(
         struct file             *infilp,
+        loff_t                  *ppos,
         struct pipe_inode_info  *pipe,
         size_t                  len,
         unsigned int            flags)
@@ -259,13 +260,14 @@ xfs_file_splice_read(
         vnode_t                 *vp = vn_from_inode(infilp->f_dentry->d_inode);
         ssize_t                 rval;
 
-        VOP_SPLICE_READ(vp, infilp, pipe, len, flags, 0, NULL, rval);
+        VOP_SPLICE_READ(vp, infilp, ppos, pipe, len, flags, 0, NULL, rval);
         return rval;
 }
 
 STATIC ssize_t
 xfs_file_splice_read_invis(
         struct file             *infilp,
+        loff_t                  *ppos,
         struct pipe_inode_info  *pipe,
         size_t                  len,
         unsigned int            flags)
@@ -273,7 +275,7 @@ xfs_file_splice_read_invis(
         vnode_t                 *vp = vn_from_inode(infilp->f_dentry->d_inode);
         ssize_t                 rval;
 
-        VOP_SPLICE_READ(vp, infilp, pipe, len, flags, IO_INVIS, NULL, rval);
+        VOP_SPLICE_READ(vp, infilp, ppos, pipe, len, flags, IO_INVIS, NULL, rval);
         return rval;
 }
 
@@ -281,13 +283,14 @@ STATIC ssize_t
 xfs_file_splice_write(
         struct pipe_inode_info  *pipe,
         struct file             *outfilp,
+        loff_t                  *ppos,
         size_t                  len,
         unsigned int            flags)
 {
         vnode_t                 *vp = vn_from_inode(outfilp->f_dentry->d_inode);
         ssize_t                 rval;
 
-        VOP_SPLICE_WRITE(vp, pipe, outfilp, len, flags, 0, NULL, rval);
+        VOP_SPLICE_WRITE(vp, pipe, outfilp, ppos, len, flags, 0, NULL, rval);
         return rval;
 }
 
@@ -295,13 +298,14 @@ STATIC ssize_t
 xfs_file_splice_write_invis(
         struct pipe_inode_info  *pipe,
         struct file             *outfilp,
+        loff_t                  *ppos,
         size_t                  len,
         unsigned int            flags)
 {
         vnode_t                 *vp = vn_from_inode(outfilp->f_dentry->d_inode);
         ssize_t                 rval;
 
-        VOP_SPLICE_WRITE(vp, pipe, outfilp, len, flags, IO_INVIS, NULL, rval);
+        VOP_SPLICE_WRITE(vp, pipe, outfilp, ppos, len, flags, IO_INVIS, NULL, rval);
         return rval;
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 74a52937f208..67efe3308980 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -338,6 +338,7 @@ ssize_t
 xfs_splice_read(
         bhv_desc_t              *bdp,
         struct file             *infilp,
+        loff_t                  *ppos,
         struct pipe_inode_info  *pipe,
         size_t                  count,
         int                     flags,
@@ -360,7 +361,7 @@ xfs_splice_read(
                 int error;
 
                 error = XFS_SEND_DATA(mp, DM_EVENT_READ, BHV_TO_VNODE(bdp),
-                                        infilp->f_pos, count,
+                                        *ppos, count,
                                         FILP_DELAY_FLAG(infilp), &locktype);
                 if (error) {
                         xfs_iunlock(ip, XFS_IOLOCK_SHARED);
@@ -368,8 +369,8 @@ xfs_splice_read(
                 }
         }
         xfs_rw_enter_trace(XFS_SPLICE_READ_ENTER, &ip->i_iocore,
-                           pipe, count, infilp->f_pos, ioflags);
-        ret = generic_file_splice_read(infilp, pipe, count, flags);
+                           pipe, count, *ppos, ioflags);
+        ret = generic_file_splice_read(infilp, ppos, pipe, count, flags);
         if (ret > 0)
                 XFS_STATS_ADD(xs_read_bytes, ret);
 
@@ -382,6 +383,7 @@ xfs_splice_write(
         bhv_desc_t              *bdp,
         struct pipe_inode_info  *pipe,
         struct file             *outfilp,
+        loff_t                  *ppos,
         size_t                  count,
         int                     flags,
         int                     ioflags,
@@ -403,7 +405,7 @@ xfs_splice_write(
                 int error;
 
                 error = XFS_SEND_DATA(mp, DM_EVENT_WRITE, BHV_TO_VNODE(bdp),
-                                        outfilp->f_pos, count,
+                                        *ppos, count,
                                         FILP_DELAY_FLAG(outfilp), &locktype);
                 if (error) {
                         xfs_iunlock(ip, XFS_IOLOCK_EXCL);
@@ -411,8 +413,8 @@ xfs_splice_write(
                 }
         }
         xfs_rw_enter_trace(XFS_SPLICE_WRITE_ENTER, &ip->i_iocore,
-                           pipe, count, outfilp->f_pos, ioflags);
-        ret = generic_file_splice_write(pipe, outfilp, count, flags);
+                           pipe, count, *ppos, ioflags);
+        ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
         if (ret > 0)
                 XFS_STATS_ADD(xs_write_bytes, ret);
 
diff --git a/fs/xfs/linux-2.6/xfs_lrw.h b/fs/xfs/linux-2.6/xfs_lrw.h
index 55c689a86ad2..8f4539952350 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.h
+++ b/fs/xfs/linux-2.6/xfs_lrw.h
@@ -93,11 +93,11 @@ extern ssize_t xfs_write(struct bhv_desc *, struct kiocb *,
 extern ssize_t xfs_sendfile(struct bhv_desc *, struct file *,
                                 loff_t *, int, size_t, read_actor_t,
                                 void *, struct cred *);
-extern ssize_t xfs_splice_read(struct bhv_desc *, struct file *,
+extern ssize_t xfs_splice_read(struct bhv_desc *, struct file *, loff_t *,
                                 struct pipe_inode_info *, size_t, int, int,
                                 struct cred *);
 extern ssize_t xfs_splice_write(struct bhv_desc *, struct pipe_inode_info *,
-                                struct file *, size_t, int, int,
+                                struct file *, loff_t *, size_t, int, int,
                                 struct cred *);
 
 #endif  /* __XFS_LRW_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/linux-2.6/xfs_vnode.h
index 88b09f186289..2a8e16c22353 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/linux-2.6/xfs_vnode.h
@@ -173,11 +173,11 @@ typedef ssize_t (*vop_write_t)(bhv_desc_t *, struct kiocb *,
 typedef ssize_t (*vop_sendfile_t)(bhv_desc_t *, struct file *,
                                 loff_t *, int, size_t, read_actor_t,
                                 void *, struct cred *);
-typedef ssize_t (*vop_splice_read_t)(bhv_desc_t *, struct file *,
+typedef ssize_t (*vop_splice_read_t)(bhv_desc_t *, struct file *, loff_t *,
                                 struct pipe_inode_info *, size_t, int, int,
                                 struct cred *);
 typedef ssize_t (*vop_splice_write_t)(bhv_desc_t *, struct pipe_inode_info *,
-                                struct file *, size_t, int, int,
+                                struct file *, loff_t *, size_t, int, int,
                                 struct cred *);
 typedef int     (*vop_ioctl_t)(bhv_desc_t *, struct inode *, struct file *,
                                 int, unsigned int, void __user *);
@@ -284,10 +284,10 @@ typedef struct vnodeops {
         rv = _VOP_(vop_write, vp)((vp)->v_fbhv,file,iov,segs,offset,ioflags,cr)
 #define VOP_SENDFILE(vp,f,off,ioflags,cnt,act,targ,cr,rv)               \
         rv = _VOP_(vop_sendfile, vp)((vp)->v_fbhv,f,off,ioflags,cnt,act,targ,cr)
-#define VOP_SPLICE_READ(vp,f,pipe,cnt,fl,iofl,cr,rv)                    \
-        rv = _VOP_(vop_splice_read, vp)((vp)->v_fbhv,f,pipe,cnt,fl,iofl,cr)
-#define VOP_SPLICE_WRITE(vp,f,pipe,cnt,fl,iofl,cr,rv)                   \
-        rv = _VOP_(vop_splice_write, vp)((vp)->v_fbhv,f,pipe,cnt,fl,iofl,cr)
+#define VOP_SPLICE_READ(vp,f,o,pipe,cnt,fl,iofl,cr,rv)                  \
+        rv = _VOP_(vop_splice_read, vp)((vp)->v_fbhv,f,o,pipe,cnt,fl,iofl,cr)
+#define VOP_SPLICE_WRITE(vp,f,o,pipe,cnt,fl,iofl,cr,rv)                 \
+        rv = _VOP_(vop_splice_write, vp)((vp)->v_fbhv,f,o,pipe,cnt,fl,iofl,cr)
 #define VOP_BMAP(vp,of,sz,rw,b,n,rv)                                    \
         rv = _VOP_(vop_bmap, vp)((vp)->v_fbhv,of,sz,rw,b,n)
 #define VOP_OPEN(vp, cr, rv)                                            \