3 files changed, 18 insertions, 10 deletions

diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
index 0d8650f7fce7..4f3cdef75797 100644
--- a/arch/ia64/kernel/fsys.S
+++ b/arch/ia64/kernel/fsys.S
@@ -611,8 +611,10 @@ GLOBAL_ENTRY(fsys_bubble_down)
         movl r2=ia64_ret_from_syscall
         ;;
         mov rp=r2                               // set the real return addr
-        tbit.z p8,p0=r3,TIF_SYSCALL_TRACE
+        and r3=_TIF_SYSCALL_TRACEAUDIT,r3
         ;;
+        cmp.eq p8,p0=r3,r0
+
 (p10)   br.cond.spnt.many ia64_ret_from_syscall // p10==true means out registers are more than 8
 (p8)    br.call.sptk.many b6=b6         // ignore this return addr
         br.cond.sptk ia64_trace_syscall
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index c253fd5914fc..907464ee7273 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1596,20 +1596,25 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
                      long arg4, long arg5, long arg6, long arg7,
                      struct pt_regs regs)
 {
-        long syscall;
+        if (test_thread_flag(TIF_SYSCALL_TRACE) 
+            && (current->ptrace & PT_PTRACED))
+                syscall_trace();
 
         if (unlikely(current->audit_context)) {
-                if (IS_IA32_PROCESS(&regs))
+                long syscall;
+                int arch;
+
+                if (IS_IA32_PROCESS(&regs)) {
                         syscall = regs.r1;
-                else
+                        arch = AUDIT_ARCH_I386;
+                } else {
                         syscall = regs.r15;
+                        arch = AUDIT_ARCH_IA64;
+                }
 
-                audit_syscall_entry(current, syscall, arg0, arg1, arg2, arg3);
+                audit_syscall_entry(current, arch, syscall, arg0, arg1, arg2, arg3);
         }
 
-        if (test_thread_flag(TIF_SYSCALL_TRACE)
-            && (current->ptrace & PT_PTRACED))
-                syscall_trace();
 }
 
 /* "asmlinkage" so the input arguments are preserved... */
@@ -1620,7 +1625,7 @@ syscall_trace_leave (long arg0, long arg1, long arg2, long arg3,
                      struct pt_regs regs)
 {
         if (unlikely(current->audit_context))
-                audit_syscall_exit(current, regs.r8);
+                audit_syscall_exit(current, AUDITSC_RESULT(regs.r10), regs.r8);
 
         if (test_thread_flag(TIF_SYSCALL_TRACE)
             && (current->ptrace & PT_PTRACED))
diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
index 6891d86937d9..645557418725 100644
--- a/arch/ia64/kernel/signal.c
+++ b/arch/ia64/kernel/signal.c
@@ -224,7 +224,8 @@ ia64_rt_sigreturn (struct sigscratch *scr)
          * could be corrupted.
          */
         retval = (long) &ia64_leave_kernel;
-        if (test_thread_flag(TIF_SYSCALL_TRACE))
+        if (test_thread_flag(TIF_SYSCALL_TRACE) 
+            || test_thread_flag(TIF_SYSCALL_AUDIT))
                 /*
                  * strace expects to be notified after sigreturn returns even though the
                  * context to which we return may not be in the middle of a syscall.