29 files changed, 181 insertions, 150 deletions

diff --git a/arch/arm/include/asm/kprobes.h b/arch/arm/include/asm/kprobes.h
index feec86768f9c..f82ec22eeb11 100644
--- a/arch/arm/include/asm/kprobes.h
+++ b/arch/arm/include/asm/kprobes.h
@@ -24,7 +24,6 @@
 #define MAX_INSN_SIZE                   2
 #define MAX_STACK_SIZE                  64      /* 32 would probably be OK */
 
-#define regs_return_value(regs)         ((regs)->ARM_r0)
 #define flush_insn_slot(p)              do { } while (0)
 #define kretprobe_blacklist_size        0
 
diff --git a/arch/arm/include/asm/ptrace.h b/arch/arm/include/asm/ptrace.h
index 96187ff58c24..451808ba1211 100644
--- a/arch/arm/include/asm/ptrace.h
+++ b/arch/arm/include/asm/ptrace.h
@@ -189,6 +189,11 @@ static inline int valid_user_regs(struct pt_regs *regs)
         return 0;
 }
 
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->ARM_r0;
+}
+
 #define instruction_pointer(regs)       (regs)->ARM_pc
 
 #ifdef CONFIG_SMP
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 0f30c3a78fc1..d4c24d412a8d 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -129,6 +129,7 @@ extern void vfp_flush_hwstate(struct thread_info *);
 /*
  * thread information flags:
  *  TIF_SYSCALL_TRACE   - syscall trace active
+ *  TIF_SYSCAL_AUDIT    - syscall auditing active
  *  TIF_SIGPENDING      - signal pending
  *  TIF_NEED_RESCHED    - rescheduling necessary
  *  TIF_NOTIFY_RESUME   - callback before returning to user
@@ -139,6 +140,7 @@ extern void vfp_flush_hwstate(struct thread_info *);
 #define TIF_NEED_RESCHED        1
 #define TIF_NOTIFY_RESUME       2       /* callback before returning to user */
 #define TIF_SYSCALL_TRACE       8
+#define TIF_SYSCALL_AUDIT       9
 #define TIF_POLLING_NRFLAG      16
 #define TIF_USING_IWMMXT        17
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
@@ -149,11 +151,15 @@ extern void vfp_flush_hwstate(struct thread_info *);
 #define _TIF_NEED_RESCHED       (1 << TIF_NEED_RESCHED)
 #define _TIF_NOTIFY_RESUME      (1 << TIF_NOTIFY_RESUME)
 #define _TIF_SYSCALL_TRACE      (1 << TIF_SYSCALL_TRACE)
+#define _TIF_SYSCALL_AUDIT      (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_POLLING_NRFLAG     (1 << TIF_POLLING_NRFLAG)
 #define _TIF_USING_IWMMXT       (1 << TIF_USING_IWMMXT)
 #define _TIF_RESTORE_SIGMASK    (1 << TIF_RESTORE_SIGMASK)
 #define _TIF_SECCOMP            (1 << TIF_SECCOMP)
 
+/* Checks for any syscall work in entry-common.S */
+#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT)
+
 /*
  * Change these and you break ASM code in entry-common.S
  */
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index b2a27b6b0046..520889cf1b5b 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -87,7 +87,7 @@ ENTRY(ret_from_fork)
         get_thread_info tsk
         ldr     r1, [tsk, #TI_FLAGS]            @ check for syscall tracing
         mov     why, #1
-        tst     r1, #_TIF_SYSCALL_TRACE         @ are we tracing syscalls?
+        tst     r1, #_TIF_SYSCALL_WORK          @ are we tracing syscalls?
         beq     ret_slow_syscall
         mov     r1, sp
         mov     r0, #1                          @ trace exit [IP = 1]
@@ -443,7 +443,7 @@ ENTRY(vector_swi)
 1:
 #endif
 
-        tst     r10, #_TIF_SYSCALL_TRACE                @ are we tracing syscalls?
+        tst     r10, #_TIF_SYSCALL_WORK         @ are we tracing syscalls?
         bne     __sys_trace
 
         cmp     scno, #NR_syscalls              @ check upper syscall limit
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 483727ad6892..e1d5e1929fbd 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -906,11 +906,6 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
 {
         unsigned long ip;
 
-        if (!test_thread_flag(TIF_SYSCALL_TRACE))
-                return scno;
-        if (!(current->ptrace & PT_PTRACED))
-                return scno;
-
         /*
          * Save IP.  IP is used to denote syscall entry/exit:
          *  IP = 0 -> entry, = 1 -> exit
@@ -918,6 +913,17 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
         ip = regs->ARM_ip;
         regs->ARM_ip = why;
 
+        if (!ip)
+                audit_syscall_exit(regs);
+        else
+                audit_syscall_entry(AUDIT_ARCH_ARMEB, scno, regs->ARM_r0,
+                                    regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
+
+        if (!test_thread_flag(TIF_SYSCALL_TRACE))
+                return scno;
+        if (!(current->ptrace & PT_PTRACED))
+                return scno;
+
         current_thread_info()->syscall = scno;
 
         /* the 0x80 provides a way for the tracing parent to distinguish
diff --git a/arch/ia64/include/asm/ptrace.h b/arch/ia64/include/asm/ptrace.h
index f5cb27614e35..68c98f5b3ca6 100644
--- a/arch/ia64/include/asm/ptrace.h
+++ b/arch/ia64/include/asm/ptrace.h
@@ -246,7 +246,18 @@ static inline unsigned long user_stack_pointer(struct pt_regs *regs)
         return regs->ar_bspstore;
 }
 
-#define regs_return_value(regs) ((regs)->r8)
+static inline int is_syscall_success(struct pt_regs *regs)
+{
+        return regs->r10 != -1;
+}
+
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        if (is_syscall_success(regs))
+                return regs->r8;
+        else
+                return -regs->r8;
+}
 
 /* Conserve space in histogram by encoding slot bits in address
  * bits 2 and 3 rather than bits 0 and 1.
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 8848f43d819e..dad91661ddf9 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -1246,15 +1246,8 @@ syscall_trace_enter (long arg0, long arg1, long arg2, long arg3,
         if (test_thread_flag(TIF_RESTORE_RSE))
                 ia64_sync_krbs();
 
-        if (unlikely(current->audit_context)) {
-                long syscall;
-                int arch;
 
-                syscall = regs.r15;
-                arch = AUDIT_ARCH_IA64;
-
-                audit_syscall_entry(arch, syscall, arg0, arg1, arg2, arg3);
-        }
+        audit_syscall_entry(AUDIT_ARCH_IA64, regs.r15, arg0, arg1, arg2, arg3);
 
         return 0;
 }
@@ -1268,14 +1261,7 @@ syscall_trace_leave (long arg0, long arg1, long arg2, long arg3,
 {
         int step;
 
-        if (unlikely(current->audit_context)) {
-                int success = AUDITSC_RESULT(regs.r10);
-                long result = regs.r8;
-
-                if (success != AUDITSC_SUCCESS)
-                        result = -result;
-                audit_syscall_exit(success, result);
-        }
+        audit_syscall_exit(&regs);
 
         step = test_thread_flag(TIF_SINGLESTEP);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/microblaze/include/asm/ptrace.h b/arch/microblaze/include/asm/ptrace.h
index 816bee64b196..94e92c805859 100644
--- a/arch/microblaze/include/asm/ptrace.h
+++ b/arch/microblaze/include/asm/ptrace.h
@@ -61,6 +61,11 @@ struct pt_regs {
 #define instruction_pointer(regs)       ((regs)->pc)
 #define profile_pc(regs)                instruction_pointer(regs)
 
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->r3;
+}
+
 #else /* __KERNEL__ */
 
 /* pt_regs offsets used by gdbserver etc in ptrace syscalls */
diff --git a/arch/microblaze/kernel/ptrace.c b/arch/microblaze/kernel/ptrace.c
index 043cb58f9c44..6eb2aa927d89 100644
--- a/arch/microblaze/kernel/ptrace.c
+++ b/arch/microblaze/kernel/ptrace.c
@@ -147,10 +147,8 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                  */
                 ret = -1L;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(EM_MICROBLAZE, regs->r12,
-                                    regs->r5, regs->r6,
-                                    regs->r7, regs->r8);
+        audit_syscall_entry(EM_MICROBLAZE, regs->r12, regs->r5, regs->r6,
+                            regs->r7, regs->r8);
 
         return ret ?: regs->r12;
 }
@@ -159,8 +157,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->r3), regs->r3);
+        audit_syscall_exit(regs);
 
         step = test_thread_flag(TIF_SINGLESTEP);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
index 7b99c670e478..4b7f5252d2fd 100644
--- a/arch/mips/include/asm/ptrace.h
+++ b/arch/mips/include/asm/ptrace.h
@@ -137,7 +137,19 @@ extern int ptrace_set_watch_regs(struct task_struct *child,
  */
 #define user_mode(regs) (((regs)->cp0_status & KU_MASK) == KU_USER)
 
-#define regs_return_value(_regs) ((_regs)->regs[2])
+static inline int is_syscall_success(struct pt_regs *regs)
+{
+        return !regs->regs[7];
+}
+
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        if (is_syscall_success(regs))
+                return regs->regs[2];
+        else
+                return -regs->regs[2];
+}
+
 #define instruction_pointer(regs) ((regs)->cp0_epc)
 #define profile_pc(regs) instruction_pointer(regs)
 
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 4e6ea1ffad46..7786b608d932 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -560,10 +560,9 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
         }
 
 out:
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(audit_arch(), regs->regs[2],
-                                    regs->regs[4], regs->regs[5],
-                                    regs->regs[6], regs->regs[7]);
+        audit_syscall_entry(audit_arch(), regs->regs[2],
+                            regs->regs[4], regs->regs[5],
+                            regs->regs[6], regs->regs[7]);
 }
 
 /*
@@ -572,9 +571,7 @@ out:
  */
 asmlinkage void syscall_trace_leave(struct pt_regs *regs)
 {
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->regs[7]),
-                                   -regs->regs[2]);
+        audit_syscall_exit(regs);
 
         if (!(current->ptrace & PT_PTRACED))
                 return;
diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
index 48223f9b8728..78a205162fd7 100644
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -86,7 +86,18 @@ struct pt_regs {
 #define instruction_pointer(regs) ((regs)->nip)
 #define user_stack_pointer(regs) ((regs)->gpr[1])
 #define kernel_stack_pointer(regs) ((regs)->gpr[1])
-#define regs_return_value(regs) ((regs)->gpr[3])
+static inline int is_syscall_success(struct pt_regs *regs)
+{
+        return !(regs->ccr & 0x10000000);
+}
+
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        if (is_syscall_success(regs))
+                return regs->gpr[3];
+        else
+                return -regs->gpr[3];
+}
 
 #ifdef CONFIG_SMP
 extern unsigned long profile_pc(struct pt_regs *regs);
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 5de73dbd15c7..5b43325402bc 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1724,22 +1724,20 @@ long do_syscall_trace_enter(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_enter(regs, regs->gpr[0]);
 
-        if (unlikely(current->audit_context)) {
 #ifdef CONFIG_PPC64
-                if (!is_32bit_task())
-                        audit_syscall_entry(AUDIT_ARCH_PPC64,
-                                            regs->gpr[0],
-                                            regs->gpr[3], regs->gpr[4],
-                                            regs->gpr[5], regs->gpr[6]);
-                else
+        if (!is_32bit_task())
+                audit_syscall_entry(AUDIT_ARCH_PPC64,
+                                    regs->gpr[0],
+                                    regs->gpr[3], regs->gpr[4],
+                                    regs->gpr[5], regs->gpr[6]);
+        else
 #endif
-                        audit_syscall_entry(AUDIT_ARCH_PPC,
-                                            regs->gpr[0],
-                                            regs->gpr[3] & 0xffffffff,
-                                            regs->gpr[4] & 0xffffffff,
-                                            regs->gpr[5] & 0xffffffff,
-                                            regs->gpr[6] & 0xffffffff);
-        }
+                audit_syscall_entry(AUDIT_ARCH_PPC,
+                                    regs->gpr[0],
+                                    regs->gpr[3] & 0xffffffff,
+                                    regs->gpr[4] & 0xffffffff,
+                                    regs->gpr[5] & 0xffffffff,
+                                    regs->gpr[6] & 0xffffffff);
 
         return ret ?: regs->gpr[0];
 }
@@ -1748,9 +1746,7 @@ void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit((regs->ccr&0x10000000)?AUDITSC_FAILURE:AUDITSC_SUCCESS,
-                                   regs->result);
+        audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->result);
diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index 56da355678f4..aeb77f017985 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -541,9 +541,13 @@ struct user_regs_struct
 #define user_mode(regs) (((regs)->psw.mask & PSW_MASK_PSTATE) != 0)
 #define instruction_pointer(regs) ((regs)->psw.addr & PSW_ADDR_INSN)
 #define user_stack_pointer(regs)((regs)->gprs[15])
-#define regs_return_value(regs)((regs)->gprs[2])
 #define profile_pc(regs) instruction_pointer(regs)
 
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->gprs[2];
+}
+
 int regs_query_register_offset(const char *name);
 const char *regs_query_register_name(unsigned int offset);
 unsigned long regs_get_register(struct pt_regs *regs, unsigned int offset);
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 573bc29551ef..9d82ed4bcb27 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -740,20 +740,17 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_enter(regs, regs->gprs[2]);
 
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(is_compat_task() ?
-                                        AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
-                                    regs->gprs[2], regs->orig_gpr2,
-                                    regs->gprs[3], regs->gprs[4],
-                                    regs->gprs[5]);
+        audit_syscall_entry(is_compat_task() ?
+                                AUDIT_ARCH_S390 : AUDIT_ARCH_S390X,
+                            regs->gprs[2], regs->orig_gpr2,
+                            regs->gprs[3], regs->gprs[4],
+                            regs->gprs[5]);
         return ret ?: regs->gprs[2];
 }
 
 asmlinkage void do_syscall_trace_exit(struct pt_regs *regs)
 {
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->gprs[2]),
-                                   regs->gprs[2]);
+        audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->gprs[2]);
diff --git a/arch/sh/include/asm/ptrace_32.h b/arch/sh/include/asm/ptrace_32.h
index 6c2239cca1a2..2d3e906aa722 100644
--- a/arch/sh/include/asm/ptrace_32.h
+++ b/arch/sh/include/asm/ptrace_32.h
@@ -76,7 +76,10 @@ struct pt_dspregs {
 #ifdef __KERNEL__
 
 #define MAX_REG_OFFSET          offsetof(struct pt_regs, tra)
-#define regs_return_value(_regs)        ((_regs)->regs[0])
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->regs[0];
+}
 
 #endif /* __KERNEL__ */
 
diff --git a/arch/sh/include/asm/ptrace_64.h b/arch/sh/include/asm/ptrace_64.h
index bf9be7764d69..eb3fcceaf64b 100644
--- a/arch/sh/include/asm/ptrace_64.h
+++ b/arch/sh/include/asm/ptrace_64.h
@@ -13,7 +13,10 @@ struct pt_regs {
 #ifdef __KERNEL__
 
 #define MAX_REG_OFFSET          offsetof(struct pt_regs, tregs[7])
-#define regs_return_value(_regs)        ((_regs)->regs[3])
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->regs[3];
+}
 
 #endif /* __KERNEL__ */
 
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 92b3c276339a..a3e651563763 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -518,10 +518,9 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_enter(regs, regs->regs[0]);
 
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(audit_arch(), regs->regs[3],
-                                    regs->regs[4], regs->regs[5],
-                                    regs->regs[6], regs->regs[7]);
+        audit_syscall_entry(audit_arch(), regs->regs[3],
+                            regs->regs[4], regs->regs[5],
+                            regs->regs[6], regs->regs[7]);
 
         return ret ?: regs->regs[0];
 }
@@ -530,9 +529,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->regs[0]),
-                                   regs->regs[0]);
+        audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->regs[0]);
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index c8f97649f354..3d0080b5c976 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -536,10 +536,9 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_enter(regs, regs->regs[9]);
 
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(audit_arch(), regs->regs[1],
-                                    regs->regs[2], regs->regs[3],
-                                    regs->regs[4], regs->regs[5]);
+        audit_syscall_entry(audit_arch(), regs->regs[1],
+                            regs->regs[2], regs->regs[3],
+                            regs->regs[4], regs->regs[5]);
 
         return ret ?: regs->regs[9];
 }
@@ -548,9 +547,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->regs[9]),
-                                   regs->regs[9]);
+        audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->regs[9]);
diff --git a/arch/sparc/include/asm/ptrace.h b/arch/sparc/include/asm/ptrace.h
index a0e1bcf843a1..c00c3b5c2806 100644
--- a/arch/sparc/include/asm/ptrace.h
+++ b/arch/sparc/include/asm/ptrace.h
@@ -207,7 +207,15 @@ do {	current_thread_info()->syscall_noerror = 1; \
 #define instruction_pointer(regs) ((regs)->tpc)
 #define instruction_pointer_set(regs, val) ((regs)->tpc = (val))
 #define user_stack_pointer(regs) ((regs)->u_regs[UREG_FP])
-#define regs_return_value(regs) ((regs)->u_regs[UREG_I0])
+static inline int is_syscall_success(struct pt_regs *regs)
+{
+        return !(regs->tstate & (TSTATE_XCARRY | TSTATE_ICARRY));
+}
+
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->u_regs[UREG_I0];
+}
 #ifdef CONFIG_SMP
 extern unsigned long profile_pc(struct pt_regs *);
 #else
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 96ee50a80661..9388844cd88c 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -1071,32 +1071,22 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_enter(regs, regs->u_regs[UREG_G1]);
 
-        if (unlikely(current->audit_context) && !ret)
-                audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
-                                     AUDIT_ARCH_SPARC :
-                                     AUDIT_ARCH_SPARC64),
-                                    regs->u_regs[UREG_G1],
-                                    regs->u_regs[UREG_I0],
-                                    regs->u_regs[UREG_I1],
-                                    regs->u_regs[UREG_I2],
-                                    regs->u_regs[UREG_I3]);
+        audit_syscall_entry((test_thread_flag(TIF_32BIT) ?
+                             AUDIT_ARCH_SPARC :
+                             AUDIT_ARCH_SPARC64),
+                            regs->u_regs[UREG_G1],
+                            regs->u_regs[UREG_I0],
+                            regs->u_regs[UREG_I1],
+                            regs->u_regs[UREG_I2],
+                            regs->u_regs[UREG_I3]);
 
         return ret;
 }
 
 asmlinkage void syscall_trace_leave(struct pt_regs *regs)
 {
-#ifdef CONFIG_AUDITSYSCALL
-        if (unlikely(current->audit_context)) {
-                unsigned long tstate = regs->tstate;
-                int result = AUDITSC_SUCCESS;
+        audit_syscall_exit(regs);
 
-                if (unlikely(tstate & (TSTATE_XCARRY | TSTATE_ICARRY)))
-                        result = AUDITSC_FAILURE;
-
-                audit_syscall_exit(result, regs->u_regs[UREG_I0]);
-        }
-#endif
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->u_regs[UREG_G1]);
 
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index c9da32b0c707..06b190390505 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -167,17 +167,15 @@ void syscall_trace(struct uml_pt_regs *regs, int entryexit)
         int is_singlestep = (current->ptrace & PT_DTRACE) && entryexit;
         int tracesysgood;
 
-        if (unlikely(current->audit_context)) {
-                if (!entryexit)
-                        audit_syscall_entry(HOST_AUDIT_ARCH,
-                                            UPT_SYSCALL_NR(regs),
-                                            UPT_SYSCALL_ARG1(regs),
-                                            UPT_SYSCALL_ARG2(regs),
-                                            UPT_SYSCALL_ARG3(regs),
-                                            UPT_SYSCALL_ARG4(regs));
-                else audit_syscall_exit(AUDITSC_RESULT(UPT_SYSCALL_RET(regs)),
-                                        UPT_SYSCALL_RET(regs));
-        }
+        if (!entryexit)
+                audit_syscall_entry(HOST_AUDIT_ARCH,
+                                    UPT_SYSCALL_NR(regs),
+                                    UPT_SYSCALL_ARG1(regs),
+                                    UPT_SYSCALL_ARG2(regs),
+                                    UPT_SYSCALL_ARG3(regs),
+                                    UPT_SYSCALL_ARG4(regs));
+        else
+                audit_syscall_exit(regs);
 
         /* Fake a debug trap */
         if (is_singlestep)
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 1106261856c8..e3e734005e19 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -14,6 +14,7 @@
 #include <asm/segment.h>
 #include <asm/irqflags.h>
 #include <linux/linkage.h>
+#include <linux/err.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -189,7 +190,7 @@ sysexit_from_sys_call:
         movl %ebx,%edx                  /* 3rd arg: 1st syscall arg */
         movl %eax,%esi                  /* 2nd arg: syscall number */
         movl $AUDIT_ARCH_I386,%edi      /* 1st arg: audit arch */
-        call audit_syscall_entry
+        call __audit_syscall_entry
         movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall number */
         cmpq $(IA32_NR_syscalls-1),%rax
         ja ia32_badsys
@@ -206,12 +207,13 @@ sysexit_from_sys_call:
         TRACE_IRQS_ON
         sti
         movl %eax,%esi          /* second arg, syscall return value */
-        cmpl $0,%eax            /* is it < 0? */
-        setl %al                /* 1 if so, 0 if not */
+        cmpl $-MAX_ERRNO,%eax   /* is it an error ? */
+        jbe 1f
+        movslq %eax, %rsi       /* if error sign extend to 64 bits */
+1:      setbe %al               /* 1 if error, 0 if not */
         movzbl %al,%edi         /* zero-extend that into %edi */
-        inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
-        call audit_syscall_exit
-        movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall return value */
+        call __audit_syscall_exit
+        movq RAX-ARGOFFSET(%rsp),%rax   /* reload syscall return value */
         movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
         cli
         TRACE_IRQS_OFF
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 4af9fd2450a5..79d97e68f042 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -42,6 +42,7 @@
  */
 
 #include <linux/linkage.h>
+#include <linux/err.h>
 #include <asm/thread_info.h>
 #include <asm/irqflags.h>
 #include <asm/errno.h>
@@ -453,7 +454,7 @@ sysenter_audit:
         movl %ebx,%ecx                  /* 3rd arg: 1st syscall arg */
         movl %eax,%edx                  /* 2nd arg: syscall number */
         movl $AUDIT_ARCH_I386,%eax      /* 1st arg: audit arch */
-        call audit_syscall_entry
+        call __audit_syscall_entry
         pushl_cfi %ebx
         movl PT_EAX(%esp),%eax          /* reload syscall number */
         jmp sysenter_do_call
@@ -464,11 +465,10 @@ sysexit_audit:
         TRACE_IRQS_ON
         ENABLE_INTERRUPTS(CLBR_ANY)
         movl %eax,%edx          /* second arg, syscall return value */
-        cmpl $0,%eax            /* is it < 0? */
-        setl %al                /* 1 if so, 0 if not */
+        cmpl $-MAX_ERRNO,%eax   /* is it an error ? */
+        setbe %al               /* 1 if so, 0 if not */
         movzbl %al,%eax         /* zero-extend that */
-        inc %eax /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
-        call audit_syscall_exit
+        call __audit_syscall_exit
         DISABLE_INTERRUPTS(CLBR_ANY)
         TRACE_IRQS_OFF
         movl TI_flags(%ebp), %ecx
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 940ba711fc28..3fe8239fd8fb 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -55,6 +55,7 @@
 #include <asm/paravirt.h>
 #include <asm/ftrace.h>
 #include <asm/percpu.h>
+#include <linux/err.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -548,7 +549,7 @@ badsys:
 #ifdef CONFIG_AUDITSYSCALL
         /*
          * Fast path for syscall audit without full syscall trace.
-         * We just call audit_syscall_entry() directly, and then
+         * We just call __audit_syscall_entry() directly, and then
          * jump back to the normal fast path.
          */
 auditsys:
@@ -558,22 +559,21 @@ auditsys:
         movq %rdi,%rdx                  /* 3rd arg: 1st syscall arg */
         movq %rax,%rsi                  /* 2nd arg: syscall number */
         movl $AUDIT_ARCH_X86_64,%edi    /* 1st arg: audit arch */
-        call audit_syscall_entry
+        call __audit_syscall_entry
         LOAD_ARGS 0             /* reload call-clobbered registers */
         jmp system_call_fastpath
 
         /*
-         * Return fast path for syscall audit.  Call audit_syscall_exit()
+         * Return fast path for syscall audit.  Call __audit_syscall_exit()
          * directly and then jump back to the fast path with TIF_SYSCALL_AUDIT
          * masked off.
          */
 sysret_audit:
         movq RAX-ARGOFFSET(%rsp),%rsi   /* second arg, syscall return value */
-        cmpq $0,%rsi            /* is it < 0? */
-        setl %al                /* 1 if so, 0 if not */
+        cmpq $-MAX_ERRNO,%rsi   /* is it < -MAX_ERRNO? */
+        setbe %al               /* 1 if so, 0 if not */
         movzbl %al,%edi         /* zero-extend that into %edi */
-        inc %edi /* first arg, 0->1(AUDITSC_SUCCESS), 1->2(AUDITSC_FAILURE) */
-        call audit_syscall_exit
+        call __audit_syscall_exit
         movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
         jmp sysret_check
 #endif  /* CONFIG_AUDITSYSCALL */
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 89a04c7b5bb6..50267386b766 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1392,20 +1392,18 @@ long syscall_trace_enter(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_enter(regs, regs->orig_ax);
 
-        if (unlikely(current->audit_context)) {
-                if (IS_IA32)
-                        audit_syscall_entry(AUDIT_ARCH_I386,
-                                            regs->orig_ax,
-                                            regs->bx, regs->cx,
-                                            regs->dx, regs->si);
+        if (IS_IA32)
+                audit_syscall_entry(AUDIT_ARCH_I386,
+                                    regs->orig_ax,
+                                    regs->bx, regs->cx,
+                                    regs->dx, regs->si);
 #ifdef CONFIG_X86_64
-                else
-                        audit_syscall_entry(AUDIT_ARCH_X86_64,
-                                            regs->orig_ax,
-                                            regs->di, regs->si,
-                                            regs->dx, regs->r10);
+        else
+                audit_syscall_entry(AUDIT_ARCH_X86_64,
+                                    regs->orig_ax,
+                                    regs->di, regs->si,
+                                    regs->dx, regs->r10);
 #endif
-        }
 
         return ret ?: regs->orig_ax;
 }
@@ -1414,8 +1412,7 @@ void syscall_trace_leave(struct pt_regs *regs)
 {
         bool step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
+        audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->ax);
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 863f8753ab0a..af17e1c966dc 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -335,9 +335,9 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
         if (info->flags & VM86_SCREEN_BITMAP)
                 mark_screen_rdonly(tsk->mm);
 
-        /*call audit_syscall_exit since we do not exit via the normal paths */
+        /*call __audit_syscall_exit since we do not exit via the normal paths */
         if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(0), 0);
+                __audit_syscall_exit(1, 0);
 
         __asm__ __volatile__(
                 "movl %0,%%esp\n\t"
diff --git a/arch/x86/um/shared/sysdep/ptrace.h b/arch/x86/um/shared/sysdep/ptrace.h
index 711b1621747f..5ef9344a8b24 100644
--- a/arch/x86/um/shared/sysdep/ptrace.h
+++ b/arch/x86/um/shared/sysdep/ptrace.h
@@ -3,3 +3,8 @@
 #else
 #include "ptrace_64.h"
 #endif
+
+static inline long regs_return_value(struct uml_pt_regs *regs)
+{
+        return UPT_SYSCALL_RET(regs);
+}
diff --git a/arch/xtensa/kernel/ptrace.c b/arch/xtensa/kernel/ptrace.c
index a0d042aa2967..2dff698ab02e 100644
--- a/arch/xtensa/kernel/ptrace.c
+++ b/arch/xtensa/kernel/ptrace.c
@@ -334,8 +334,7 @@ void do_syscall_trace_enter(struct pt_regs *regs)
                 do_syscall_trace();
 
 #if 0
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
+        audit_syscall_entry(current, AUDIT_ARCH_XTENSA..);
 #endif
 }