diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
index 4f58b9c0efe3cbb5f57a2bfda39371153b3eff2f..f48bef15b4f0dd5de72d4bbcc39f8c4f881947b6 100644
--- a/arch/i386/kernel/syscall_table.S
+++ b/arch/i386/kernel/syscall_table.S
@@ -314,3 +314,4 @@ ENTRY(sys_call_table)
 	.long sys_get_robust_list
 	.long sys_splice
 	.long sys_sync_file_range
+	.long sys_tee			/* 315 */
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 6e16f6b35bd33c3739dbcdd1dba0dae7744807a2..e3079881121667346e96d8141a838fded794bf15 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1609,5 +1609,6 @@ sys_call_table:
 	data8 sys_set_robust_list
 	data8 sys_get_robust_list
 	data8 sys_sync_file_range		// 1300
+	data8 sys_tee
 
 	.org sys_call_table + 8*NR_syscalls	// guard against failures to increase NR_syscalls
diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
index 1424eab450ee915322478f21ab00cefb5fd8a04b..a14c964038403fa6d6271967df95fa5727a41b1f 100644
--- a/arch/powerpc/kernel/systbl.S
+++ b/arch/powerpc/kernel/systbl.S
@@ -323,3 +323,4 @@ COMPAT_SYS(pselect6)
 COMPAT_SYS(ppoll)
 SYSCALL(unshare)
 SYSCALL(splice)
+SYSCALL(tee)
diff --git a/fs/pipe.c b/fs/pipe.c
index e984beb93a0ea88c436037f6e17c0edfbad37d54..7fefb10db8d9d6ad2a187d3c352cd0557beb30f5 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -131,12 +131,19 @@ static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
 	return 0;
 }
 
+static void anon_pipe_buf_get(struct pipe_inode_info *info,
+			      struct pipe_buffer *buf)
+{
+	page_cache_get(buf->page);
+}
+
 static struct pipe_buf_operations anon_pipe_buf_ops = {
 	.can_merge = 1,
 	.map = anon_pipe_buf_map,
 	.unmap = anon_pipe_buf_unmap,
 	.release = anon_pipe_buf_release,
 	.steal = anon_pipe_buf_steal,
+	.get = anon_pipe_buf_get,
 };
 
 static ssize_t
diff --git a/fs/splice.c b/fs/splice.c
index e50a460239dd28fe267dde5bde37c7566445a0ba..8d57e89924a68990efa6a72d279dd35efa0fc7a7 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -125,12 +125,19 @@ static void page_cache_pipe_buf_unmap(struct pipe_inode_info *info,
 	kunmap(buf->page);
 }
 
+static void page_cache_pipe_buf_get(struct pipe_inode_info *info,
+				    struct pipe_buffer *buf)
+{
+	page_cache_get(buf->page);
+}
+
 static struct pipe_buf_operations page_cache_pipe_buf_ops = {
 	.can_merge = 0,
 	.map = page_cache_pipe_buf_map,
 	.unmap = page_cache_pipe_buf_unmap,
 	.release = page_cache_pipe_buf_release,
 	.steal = page_cache_pipe_buf_steal,
+	.get = page_cache_pipe_buf_get,
 };
 
 /*
@@ -231,8 +238,9 @@ static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
 }
 
 static int
-__generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
-			   size_t len, unsigned int flags)
+__generic_file_splice_read(struct file *in, loff_t *ppos,
+			   struct pipe_inode_info *pipe, size_t len,
+			   unsigned int flags)
 {
 	struct address_space *mapping = in->f_mapping;
 	unsigned int offset, nr_pages;
@@ -241,8 +249,8 @@ __generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
 	pgoff_t index;
 	int i, error;
 
-	index = in->f_pos >> PAGE_CACHE_SHIFT;
-	offset = in->f_pos & ~PAGE_CACHE_MASK;
+	index = *ppos >> PAGE_CACHE_SHIFT;
+	offset = *ppos & ~PAGE_CACHE_MASK;
 	nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
 	if (nr_pages > PIPE_BUFFERS)
@@ -348,8 +356,9 @@ fill_it:
  *
  * Will read pages from given file and fill them into a pipe.
  */
-ssize_t generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
-				 size_t len, unsigned int flags)
+ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
+				 struct pipe_inode_info *pipe, size_t len,
+				 unsigned int flags)
 {
 	ssize_t spliced;
 	int ret;
@@ -358,12 +367,12 @@ ssize_t generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
 	spliced = 0;
 
 	while (len) {
-		ret = __generic_file_splice_read(in, pipe, len, flags);
+		ret = __generic_file_splice_read(in, ppos, pipe, len, flags);
 
 		if (ret <= 0)
 			break;
 
-		in->f_pos += ret;
+		*ppos += ret;
 		len -= ret;
 		spliced += ret;
 
@@ -561,7 +570,7 @@ typedef int (splice_actor)(struct pipe_inode_info *, struct pipe_buffer *,
  * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
  */
 static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
-			      size_t len, unsigned int flags,
+			      loff_t *ppos, size_t len, unsigned int flags,
 			      splice_actor *actor)
 {
 	int ret, do_wakeup, err;
@@ -573,7 +582,7 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
 	sd.total_len = len;
 	sd.flags = flags;
 	sd.file = out;
-	sd.pos = out->f_pos;
+	sd.pos = *ppos;
 
 	if (pipe->inode)
 		mutex_lock(&pipe->inode->i_mutex);
@@ -656,9 +665,7 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
 		kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
 	}
 
-	out->f_pos = sd.pos;
 	return ret;
-
 }
 
 /**
@@ -674,12 +681,12 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
  */
 ssize_t
 generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
-			  size_t len, unsigned int flags)
+			  loff_t *ppos, size_t len, unsigned int flags)
 {
 	struct address_space *mapping = out->f_mapping;
 	ssize_t ret;
 
-	ret = move_from_pipe(pipe, out, len, flags, pipe_to_file);
+	ret = move_from_pipe(pipe, out, ppos, len, flags, pipe_to_file);
 
 	/*
 	 * If file or inode is SYNC and we actually wrote some data, sync it.
@@ -715,9 +722,9 @@ EXPORT_SYMBOL(generic_file_splice_write);
  *
  */
 ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe, struct file *out,
-				size_t len, unsigned int flags)
+				loff_t *ppos, size_t len, unsigned int flags)
 {
-	return move_from_pipe(pipe, out, len, flags, pipe_to_sendpage);
+	return move_from_pipe(pipe, out, ppos, len, flags, pipe_to_sendpage);
 }
 
 EXPORT_SYMBOL(generic_splice_sendpage);
@@ -726,9 +733,8 @@ EXPORT_SYMBOL(generic_splice_sendpage);
  * Attempt to initiate a splice from pipe to file.
  */
 static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
-			   size_t len, unsigned int flags)
+			   loff_t *ppos, size_t len, unsigned int flags)
 {
-	loff_t pos;
 	int ret;
 
 	if (unlikely(!out->f_op || !out->f_op->splice_write))
@@ -737,22 +743,21 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
 	if (unlikely(!(out->f_mode & FMODE_WRITE)))
 		return -EBADF;
 
-	pos = out->f_pos;
-
-	ret = rw_verify_area(WRITE, out, &pos, len);
+	ret = rw_verify_area(WRITE, out, ppos, len);
 	if (unlikely(ret < 0))
 		return ret;
 
-	return out->f_op->splice_write(pipe, out, len, flags);
+	return out->f_op->splice_write(pipe, out, ppos, len, flags);
 }
 
 /*
  * Attempt to initiate a splice from a file to a pipe.
  */
-static long do_splice_to(struct file *in, struct pipe_inode_info *pipe,
-			 size_t len, unsigned int flags)
+static long do_splice_to(struct file *in, loff_t *ppos,
+			 struct pipe_inode_info *pipe, size_t len,
+			 unsigned int flags)
 {
-	loff_t pos, isize, left;
+	loff_t isize, left;
 	int ret;
 
 	if (unlikely(!in->f_op || !in->f_op->splice_read))
@@ -761,28 +766,27 @@ static long do_splice_to(struct file *in, struct pipe_inode_info *pipe,
 	if (unlikely(!(in->f_mode & FMODE_READ)))
 		return -EBADF;
 
-	pos = in->f_pos;
-
-	ret = rw_verify_area(READ, in, &pos, len);
+	ret = rw_verify_area(READ, in, ppos, len);
 	if (unlikely(ret < 0))
 		return ret;
 
 	isize = i_size_read(in->f_mapping->host);
-	if (unlikely(in->f_pos >= isize))
+	if (unlikely(*ppos >= isize))
 		return 0;
 	
-	left = isize - in->f_pos;
+	left = isize - *ppos;
 	if (unlikely(left < len))
 		len = left;
 
-	return in->f_op->splice_read(in, pipe, len, flags);
+	return in->f_op->splice_read(in, ppos, pipe, len, flags);
 }
 
-long do_splice_direct(struct file *in, struct file *out, size_t len,
-		      unsigned int flags)
+long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
+		      size_t len, unsigned int flags)
 {
 	struct pipe_inode_info *pipe;
 	long ret, bytes;
+	loff_t out_off;
 	umode_t i_mode;
 	int i;
 
@@ -820,6 +824,7 @@ long do_splice_direct(struct file *in, struct file *out, size_t len,
 	 */
 	ret = 0;
 	bytes = 0;
+	out_off = 0;
 
 	while (len) {
 		size_t read_len, max_read_len;
@@ -829,7 +834,7 @@ long do_splice_direct(struct file *in, struct file *out, size_t len,
 		 */
 		max_read_len = min(len, (size_t)(PIPE_BUFFERS*PAGE_SIZE));
 
-		ret = do_splice_to(in, pipe, max_read_len, flags);
+		ret = do_splice_to(in, ppos, pipe, max_read_len, flags);
 		if (unlikely(ret < 0))
 			goto out_release;
 
@@ -840,7 +845,7 @@ long do_splice_direct(struct file *in, struct file *out, size_t len,
 		 * must not do the output in nonblocking mode as then we
 		 * could get stuck data in the internal pipe:
 		 */
-		ret = do_splice_from(pipe, out, read_len,
+		ret = do_splice_from(pipe, out, &out_off, read_len,
 				     flags & ~SPLICE_F_NONBLOCK);
 		if (unlikely(ret < 0))
 			goto out_release;
@@ -898,6 +903,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
 		      size_t len, unsigned int flags)
 {
 	struct pipe_inode_info *pipe;
+	loff_t offset, *off;
 
 	pipe = in->f_dentry->d_inode->i_pipe;
 	if (pipe) {
@@ -906,12 +912,13 @@ static long do_splice(struct file *in, loff_t __user *off_in,
 		if (off_out) {
 			if (out->f_op->llseek == no_llseek)
 				return -EINVAL;
-			if (copy_from_user(&out->f_pos, off_out,
-					   sizeof(loff_t)))
+			if (copy_from_user(&offset, off_out, sizeof(loff_t)))
 				return -EFAULT;
-		}
+			off = &offset;
+		} else
+			off = &out->f_pos;
 
-		return do_splice_from(pipe, out, len, flags);
+		return do_splice_from(pipe, out, off, len, flags);
 	}
 
 	pipe = out->f_dentry->d_inode->i_pipe;
@@ -921,11 +928,13 @@ static long do_splice(struct file *in, loff_t __user *off_in,
 		if (off_in) {
 			if (in->f_op->llseek == no_llseek)
 				return -EINVAL;
-			if (copy_from_user(&in->f_pos, off_in, sizeof(loff_t)))
+			if (copy_from_user(&offset, off_in, sizeof(loff_t)))
 				return -EFAULT;
-		}
+			off = &offset;
+		} else
+			off = &in->f_pos;
 
-		return do_splice_to(in, pipe, len, flags);
+		return do_splice_to(in, off, pipe, len, flags);
 	}
 
 	return -EINVAL;
@@ -961,3 +970,182 @@ asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
 
 	return error;
 }
+
+/*
+ * Link contents of ipipe to opipe.
+ */
+static int link_pipe(struct pipe_inode_info *ipipe,
+		     struct pipe_inode_info *opipe,
+		     size_t len, unsigned int flags)
+{
+	struct pipe_buffer *ibuf, *obuf;
+	int ret = 0, do_wakeup = 0, i;
+
+	/*
+	 * Potential ABBA deadlock, work around it by ordering lock
+	 * grabbing by inode address. Otherwise two different processes
+	 * could deadlock (one doing tee from A -> B, the other from B -> A).
+	 */
+	if (ipipe->inode < opipe->inode) {
+		mutex_lock(&ipipe->inode->i_mutex);
+		mutex_lock(&opipe->inode->i_mutex);
+	} else {
+		mutex_lock(&opipe->inode->i_mutex);
+		mutex_lock(&ipipe->inode->i_mutex);
+	}
+
+	for (i = 0;; i++) {
+		if (!opipe->readers) {
+			send_sig(SIGPIPE, current, 0);
+			if (!ret)
+				ret = -EPIPE;
+			break;
+		}
+		if (ipipe->nrbufs - i) {
+			ibuf = ipipe->bufs + ((ipipe->curbuf + i) & (PIPE_BUFFERS - 1));
+
+			/*
+			 * If we have room, fill this buffer
+			 */
+			if (opipe->nrbufs < PIPE_BUFFERS) {
+				int nbuf = (opipe->curbuf + opipe->nrbufs) & (PIPE_BUFFERS - 1);
+
+				/*
+				 * Get a reference to this pipe buffer,
+				 * so we can copy the contents over.
+				 */
+				ibuf->ops->get(ipipe, ibuf);
+
+				obuf = opipe->bufs + nbuf;
+				*obuf = *ibuf;
+
+				if (obuf->len > len)
+					obuf->len = len;
+
+				opipe->nrbufs++;
+				do_wakeup = 1;
+				ret += obuf->len;
+				len -= obuf->len;
+
+				if (!len)
+					break;
+				if (opipe->nrbufs < PIPE_BUFFERS)
+					continue;
+			}
+
+			/*
+			 * We have input available, but no output room.
+			 * If we already copied data, return that.
+			 */
+			if (flags & SPLICE_F_NONBLOCK) {
+				if (!ret)
+					ret = -EAGAIN;
+				break;
+			}
+			if (signal_pending(current)) {
+				if (!ret)
+					ret = -ERESTARTSYS;
+				break;
+			}
+			if (do_wakeup) {
+				smp_mb();
+				if (waitqueue_active(&opipe->wait))
+					wake_up_interruptible(&opipe->wait);
+				kill_fasync(&opipe->fasync_readers, SIGIO, POLL_IN);
+				do_wakeup = 0;
+			}
+
+			opipe->waiting_writers++;
+			pipe_wait(opipe);
+			opipe->waiting_writers--;
+			continue;
+		}
+
+		/*
+		 * No input buffers, do the usual checks for available
+		 * writers and blocking and wait if necessary
+		 */
+		if (!ipipe->writers)
+			break;
+		if (!ipipe->waiting_writers) {
+			if (ret)
+				break;
+		}
+		if (flags & SPLICE_F_NONBLOCK) {
+			if (!ret)
+				ret = -EAGAIN;
+			break;
+		}
+		if (signal_pending(current)) {
+			if (!ret)
+				ret = -ERESTARTSYS;
+			break;
+		}
+
+		if (waitqueue_active(&ipipe->wait))
+			wake_up_interruptible_sync(&ipipe->wait);
+		kill_fasync(&ipipe->fasync_writers, SIGIO, POLL_OUT);
+
+		pipe_wait(ipipe);
+	}
+
+	mutex_unlock(&ipipe->inode->i_mutex);
+	mutex_unlock(&opipe->inode->i_mutex);
+
+	if (do_wakeup) {
+		smp_mb();
+		if (waitqueue_active(&opipe->wait))
+			wake_up_interruptible(&opipe->wait);
+		kill_fasync(&opipe->fasync_readers, SIGIO, POLL_IN);
+	}
+
+	return ret;
+}
+
+/*
+ * This is a tee(1) implementation that works on pipes. It doesn't copy
+ * any data, it simply references the 'in' pages on the 'out' pipe.
+ * The 'flags' used are the SPLICE_F_* variants, currently the only
+ * applicable one is SPLICE_F_NONBLOCK.
+ */
+static long do_tee(struct file *in, struct file *out, size_t len,
+		   unsigned int flags)
+{
+	struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
+	struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+
+	/*
+	 * Link ipipe to the two output pipes, consuming as we go along.
+	 */
+	if (ipipe && opipe)
+		return link_pipe(ipipe, opipe, len, flags);
+
+	return -EINVAL;
+}
+
+asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags)
+{
+	struct file *in;
+	int error, fput_in;
+
+	if (unlikely(!len))
+		return 0;
+
+	error = -EBADF;
+	in = fget_light(fdin, &fput_in);
+	if (in) {
+		if (in->f_mode & FMODE_READ) {
+			int fput_out;
+			struct file *out = fget_light(fdout, &fput_out);
+
+			if (out) {
+				if (out->f_mode & FMODE_WRITE)
+					error = do_tee(in, out, len, flags);
+				fput_light(out, fput_out);
+			}
+		}
+ 		fput_light(in, fput_in);
+ 	}
+
+	return error;
+}
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 269721af02f3bf4390ac325b54f64f05435ee960..c847416f6d1010ac9ffea5ad764661662472632a 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -252,6 +252,7 @@ xfs_file_sendfile_invis(
 STATIC ssize_t
 xfs_file_splice_read(
 	struct file		*infilp,
+	loff_t			*ppos,
 	struct pipe_inode_info	*pipe,
 	size_t			len,
 	unsigned int		flags)
@@ -259,13 +260,14 @@ xfs_file_splice_read(
 	vnode_t			*vp = vn_from_inode(infilp->f_dentry->d_inode);
 	ssize_t			rval;
 
-	VOP_SPLICE_READ(vp, infilp, pipe, len, flags, 0, NULL, rval);
+	VOP_SPLICE_READ(vp, infilp, ppos, pipe, len, flags, 0, NULL, rval);
 	return rval;
 }
 
 STATIC ssize_t
 xfs_file_splice_read_invis(
 	struct file		*infilp,
+	loff_t			*ppos,
 	struct pipe_inode_info	*pipe,
 	size_t			len,
 	unsigned int		flags)
@@ -273,7 +275,7 @@ xfs_file_splice_read_invis(
 	vnode_t			*vp = vn_from_inode(infilp->f_dentry->d_inode);
 	ssize_t			rval;
 
-	VOP_SPLICE_READ(vp, infilp, pipe, len, flags, IO_INVIS, NULL, rval);
+	VOP_SPLICE_READ(vp, infilp, ppos, pipe, len, flags, IO_INVIS, NULL, rval);
 	return rval;
 }
 
@@ -281,13 +283,14 @@ STATIC ssize_t
 xfs_file_splice_write(
 	struct pipe_inode_info	*pipe,
 	struct file		*outfilp,
+	loff_t			*ppos,
 	size_t			len,
 	unsigned int		flags)
 {
 	vnode_t			*vp = vn_from_inode(outfilp->f_dentry->d_inode);
 	ssize_t			rval;
 
-	VOP_SPLICE_WRITE(vp, pipe, outfilp, len, flags, 0, NULL, rval);
+	VOP_SPLICE_WRITE(vp, pipe, outfilp, ppos, len, flags, 0, NULL, rval);
 	return rval;
 }
 
@@ -295,13 +298,14 @@ STATIC ssize_t
 xfs_file_splice_write_invis(
 	struct pipe_inode_info	*pipe,
 	struct file		*outfilp,
+	loff_t			*ppos,
 	size_t			len,
 	unsigned int		flags)
 {
 	vnode_t			*vp = vn_from_inode(outfilp->f_dentry->d_inode);
 	ssize_t			rval;
 
-	VOP_SPLICE_WRITE(vp, pipe, outfilp, len, flags, IO_INVIS, NULL, rval);
+	VOP_SPLICE_WRITE(vp, pipe, outfilp, ppos, len, flags, IO_INVIS, NULL, rval);
 	return rval;
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 74a52937f20848159949ccb64ad63f030fc2be7e..67efe3308980a0110030b58cbfca276a230ee32e 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -338,6 +338,7 @@ ssize_t
 xfs_splice_read(
 	bhv_desc_t		*bdp,
 	struct file		*infilp,
+	loff_t			*ppos,
 	struct pipe_inode_info	*pipe,
 	size_t			count,
 	int			flags,
@@ -360,7 +361,7 @@ xfs_splice_read(
 		int error;
 
 		error = XFS_SEND_DATA(mp, DM_EVENT_READ, BHV_TO_VNODE(bdp),
-					infilp->f_pos, count,
+					*ppos, count,
 					FILP_DELAY_FLAG(infilp), &locktype);
 		if (error) {
 			xfs_iunlock(ip, XFS_IOLOCK_SHARED);
@@ -368,8 +369,8 @@ xfs_splice_read(
 		}
 	}
 	xfs_rw_enter_trace(XFS_SPLICE_READ_ENTER, &ip->i_iocore,
-			   pipe, count, infilp->f_pos, ioflags);
-	ret = generic_file_splice_read(infilp, pipe, count, flags);
+			   pipe, count, *ppos, ioflags);
+	ret = generic_file_splice_read(infilp, ppos, pipe, count, flags);
 	if (ret > 0)
 		XFS_STATS_ADD(xs_read_bytes, ret);
 
@@ -382,6 +383,7 @@ xfs_splice_write(
 	bhv_desc_t		*bdp,
 	struct pipe_inode_info	*pipe,
 	struct file		*outfilp,
+	loff_t			*ppos,
 	size_t			count,
 	int			flags,
 	int			ioflags,
@@ -403,7 +405,7 @@ xfs_splice_write(
 		int error;
 
 		error = XFS_SEND_DATA(mp, DM_EVENT_WRITE, BHV_TO_VNODE(bdp),
-					outfilp->f_pos, count,
+					*ppos, count,
 					FILP_DELAY_FLAG(outfilp), &locktype);
 		if (error) {
 			xfs_iunlock(ip, XFS_IOLOCK_EXCL);
@@ -411,8 +413,8 @@ xfs_splice_write(
 		}
 	}
 	xfs_rw_enter_trace(XFS_SPLICE_WRITE_ENTER, &ip->i_iocore,
-			   pipe, count, outfilp->f_pos, ioflags);
-	ret = generic_file_splice_write(pipe, outfilp, count, flags);
+			   pipe, count, *ppos, ioflags);
+	ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
 	if (ret > 0)
 		XFS_STATS_ADD(xs_write_bytes, ret);
 
diff --git a/fs/xfs/linux-2.6/xfs_lrw.h b/fs/xfs/linux-2.6/xfs_lrw.h
index 55c689a86ad2e9b40f1dece835952d73e412cd2c..8f4539952350e235991e857cdf97548e230f7632 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.h
+++ b/fs/xfs/linux-2.6/xfs_lrw.h
@@ -93,11 +93,11 @@ extern ssize_t xfs_write(struct bhv_desc *, struct kiocb *,
 extern ssize_t xfs_sendfile(struct bhv_desc *, struct file *,
 				loff_t *, int, size_t, read_actor_t,
 				void *, struct cred *);
-extern ssize_t xfs_splice_read(struct bhv_desc *, struct file *,
+extern ssize_t xfs_splice_read(struct bhv_desc *, struct file *, loff_t *,
 				struct pipe_inode_info *, size_t, int, int,
 				struct cred *);
 extern ssize_t xfs_splice_write(struct bhv_desc *, struct pipe_inode_info *,
-				struct file *, size_t, int, int,
+				struct file *, loff_t *, size_t, int, int,
 				struct cred *);
 
 #endif	/* __XFS_LRW_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/linux-2.6/xfs_vnode.h
index 88b09f18628995ccb3c8d61dc6923260f3438b24..2a8e16c22353c98f44a12bc462130a43c2646555 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/linux-2.6/xfs_vnode.h
@@ -173,11 +173,11 @@ typedef ssize_t (*vop_write_t)(bhv_desc_t *, struct kiocb *,
 typedef ssize_t (*vop_sendfile_t)(bhv_desc_t *, struct file *,
 				loff_t *, int, size_t, read_actor_t,
 				void *, struct cred *);
-typedef ssize_t (*vop_splice_read_t)(bhv_desc_t *, struct file *,
+typedef ssize_t (*vop_splice_read_t)(bhv_desc_t *, struct file *, loff_t *,
 				struct pipe_inode_info *, size_t, int, int,
 				struct cred *);
 typedef ssize_t (*vop_splice_write_t)(bhv_desc_t *, struct pipe_inode_info *,
-				struct file *, size_t, int, int,
+				struct file *, loff_t *, size_t, int, int,
 				struct cred *);
 typedef int	(*vop_ioctl_t)(bhv_desc_t *, struct inode *, struct file *,
 				int, unsigned int, void __user *);
@@ -284,10 +284,10 @@ typedef struct vnodeops {
 	rv = _VOP_(vop_write, vp)((vp)->v_fbhv,file,iov,segs,offset,ioflags,cr)
 #define VOP_SENDFILE(vp,f,off,ioflags,cnt,act,targ,cr,rv)		\
 	rv = _VOP_(vop_sendfile, vp)((vp)->v_fbhv,f,off,ioflags,cnt,act,targ,cr)
-#define VOP_SPLICE_READ(vp,f,pipe,cnt,fl,iofl,cr,rv)			\
-	rv = _VOP_(vop_splice_read, vp)((vp)->v_fbhv,f,pipe,cnt,fl,iofl,cr)
-#define VOP_SPLICE_WRITE(vp,f,pipe,cnt,fl,iofl,cr,rv)			\
-	rv = _VOP_(vop_splice_write, vp)((vp)->v_fbhv,f,pipe,cnt,fl,iofl,cr)
+#define VOP_SPLICE_READ(vp,f,o,pipe,cnt,fl,iofl,cr,rv)			\
+	rv = _VOP_(vop_splice_read, vp)((vp)->v_fbhv,f,o,pipe,cnt,fl,iofl,cr)
+#define VOP_SPLICE_WRITE(vp,f,o,pipe,cnt,fl,iofl,cr,rv)			\
+	rv = _VOP_(vop_splice_write, vp)((vp)->v_fbhv,f,o,pipe,cnt,fl,iofl,cr)
 #define VOP_BMAP(vp,of,sz,rw,b,n,rv)					\
 	rv = _VOP_(vop_bmap, vp)((vp)->v_fbhv,of,sz,rw,b,n)
 #define VOP_OPEN(vp, cr, rv)						\
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index 6a8dd83c350f9cbc3e2c5fdf8e6a489a4326e0da..d81d6cfc1bb4a81f40b213cab6a14eed67f371c9 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -320,8 +320,9 @@
 #define __NR_get_robust_list	312
 #define __NR_splice		313
 #define __NR_sync_file_range	314
+#define __NR_tee		315
 
-#define NR_syscalls 315
+#define NR_syscalls 316
 
 /*
  * user-visible error numbers are in the range -1 - -128: see
diff --git a/include/asm-ia64/unistd.h b/include/asm-ia64/unistd.h
index 1c749acca021b7581f91ddecfc83c9b5a16efa0b..a40ebec6aeebe234a91dc84767e266177a9c058d 100644
--- a/include/asm-ia64/unistd.h
+++ b/include/asm-ia64/unistd.h
@@ -289,12 +289,13 @@
 #define __NR_set_robust_list		1298
 #define __NR_get_robust_list		1299
 #define __NR_sync_file_range		1300
+#define __NR_tee			1301
 
 #ifdef __KERNEL__
 
 #include <linux/config.h>
 
-#define NR_syscalls			277 /* length of syscall table */
+#define NR_syscalls			278 /* length of syscall table */
 
 #define __ARCH_WANT_SYS_RT_SIGACTION
 
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index 536ba0873052c92be7e314446f69b1ae8b5b2e0c..c612f1a6277240edd9ae5526fe1678415fd2f48b 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -302,8 +302,9 @@
 #define __NR_ppoll		281
 #define __NR_unshare		282
 #define __NR_splice		283
+#define __NR_tee		284
 
-#define __NR_syscalls		284
+#define __NR_syscalls		285
 
 #ifdef __KERNEL__
 #define __NR__exit __NR_exit
diff --git a/include/asm-x86_64/unistd.h b/include/asm-x86_64/unistd.h
index f21ff2c1e960bfcafeb735b058857c14f0529a2e..d86494e23b638460557133d1f388f5c18030b17b 100644
--- a/include/asm-x86_64/unistd.h
+++ b/include/asm-x86_64/unistd.h
@@ -611,8 +611,10 @@ __SYSCALL(__NR_set_robust_list, sys_set_robust_list)
 __SYSCALL(__NR_get_robust_list, sys_get_robust_list)
 #define __NR_splice		275
 __SYSCALL(__NR_splice, sys_splice)
+#define __NR_tee		276
+__SYSCALL(__NR_tee, sys_tee)
 
-#define __NR_syscall_max __NR_splice
+#define __NR_syscall_max __NR_tee
 
 #ifndef __NO_STUBS
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 162c6e57307a0e528040d7f3e9b287b61c711760..3de2bfb2410ffcdc0449a7b5cbe5d1eee1dc54a2 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1039,8 +1039,8 @@ struct file_operations {
 	int (*check_flags)(int);
 	int (*dir_notify)(struct file *filp, unsigned long arg);
 	int (*flock) (struct file *, int, struct file_lock *);
-	ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, size_t, unsigned int);
-	ssize_t (*splice_read)(struct file *, struct pipe_inode_info *, size_t, unsigned int);
+	ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int);
+	ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int);
 };
 
 struct inode_operations {
@@ -1613,13 +1613,13 @@ extern void do_generic_mapping_read(struct address_space *mapping,
 				    loff_t *, read_descriptor_t *, read_actor_t);
 
 /* fs/splice.c */
-extern ssize_t generic_file_splice_read(struct file *,
+extern ssize_t generic_file_splice_read(struct file *, loff_t *,
 		struct pipe_inode_info *, size_t, unsigned int);
 extern ssize_t generic_file_splice_write(struct pipe_inode_info *,
-		struct file *, size_t, unsigned int);
+		struct file *, loff_t *, size_t, unsigned int);
 extern ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe,
-		struct file *out, size_t len, unsigned int flags);
-extern long do_splice_direct(struct file *in, struct file *out,
+		struct file *out, loff_t *, size_t len, unsigned int flags);
+extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 		size_t len, unsigned int flags);
 
 extern void
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 123a7c24bc72b18c6192223a703b1cd8711c204c..ef7f33c0be19190590cc205f5828ba1fc6ea9170 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -21,6 +21,7 @@ struct pipe_buf_operations {
 	void (*unmap)(struct pipe_inode_info *, struct pipe_buffer *);
 	void (*release)(struct pipe_inode_info *, struct pipe_buffer *);
 	int (*steal)(struct pipe_inode_info *, struct pipe_buffer *);
+	void (*get)(struct pipe_inode_info *, struct pipe_buffer *);
 };
 
 struct pipe_inode_info {
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index f001bad28d9acc06941a1044e9a86f8d10bce910..d3ebc0e68b2b4cbc20d847cc86598a6e12bedaa0 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -574,6 +574,8 @@ asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
 			   int fd_out, loff_t __user *off_out,
 			   size_t len, unsigned int flags);
 
+asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags);
+
 asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
 					unsigned int flags);