diff --git a/pkg/sentry/platform/kvm/bluepill_unsafe.go b/pkg/sentry/platform/kvm/bluepill_unsafe.go
index 8de434c1f..fe161acdd 100644
--- a/pkg/sentry/platform/kvm/bluepill_unsafe.go
+++ b/pkg/sentry/platform/kvm/bluepill_unsafe.go
@@ -127,7 +127,7 @@ func bluepillHandler(context unsafe.Pointer) {
 
 	for {
 		hostExitCounter.Increment()
-		_, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(c.fd), KVM_RUN, 0) // escapes: no.
+		errno := hostsyscall.RawSyscallErrno(unix.SYS_IOCTL, uintptr(c.fd), KVM_RUN, 0) // escapes: no.
 		switch errno {
 		case 0: // Expected case.
 		case unix.EINTR:
@@ -137,7 +137,7 @@ func bluepillHandler(context unsafe.Pointer) {
 			// currently, all signals are masked and the signal
 			// must have been delivered directly to this thread.
 			timeout := unix.Timespec{}
-			sig, _, errno := unix.RawSyscall6( // escapes: no.
+			sig, errno := hostsyscall.RawSyscall6( // escapes: no.
 				unix.SYS_RT_SIGTIMEDWAIT,
 				uintptr(unsafe.Pointer(&bounceSignalMask)),
 				0,                                 // siginfo.
diff --git a/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go b/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
index 2ac6ec882..42543adb6 100644
--- a/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
@@ -22,6 +22,7 @@ import (
 	"unsafe"
 
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 var (
@@ -32,7 +33,7 @@ var (
 
 func updateSystemValues(fd int) error {
 	// Extract the mmap size.
-	sz, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(fd), KVM_GET_VCPU_MMAP_SIZE, 0)
+	sz, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(fd), KVM_GET_VCPU_MMAP_SIZE, 0)
 	if errno != 0 {
 		return fmt.Errorf("getting VCPU mmap size: %v", errno)
 	}
@@ -41,7 +42,7 @@ func updateSystemValues(fd int) error {
 	runDataSize = int(sz)
 
 	// Must do the dance to figure out the number of entries.
-	_, _, errno = unix.RawSyscall(
+	errno = hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(fd),
 		KVM_GET_SUPPORTED_CPUID,
@@ -52,7 +53,7 @@ func updateSystemValues(fd int) error {
 	}
 
 	// The number should now be correct.
-	_, _, errno = unix.RawSyscall(
+	errno = hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(fd),
 		KVM_GET_SUPPORTED_CPUID,
diff --git a/pkg/sentry/platform/kvm/kvm_arm64_unsafe.go b/pkg/sentry/platform/kvm/kvm_arm64_unsafe.go
index 42dddf989..e4db90d09 100644
--- a/pkg/sentry/platform/kvm/kvm_arm64_unsafe.go
+++ b/pkg/sentry/platform/kvm/kvm_arm64_unsafe.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 var (
@@ -30,7 +31,7 @@ var (
 
 func updateSystemValues(fd int) error {
 	// Extract the mmap size.
-	sz, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(fd), KVM_GET_VCPU_MMAP_SIZE, 0)
+	sz, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(fd), KVM_GET_VCPU_MMAP_SIZE, 0)
 	if errno != 0 {
 		return fmt.Errorf("getting VCPU mmap size: %v", errno)
 	}
diff --git a/pkg/sentry/platform/kvm/machine.go b/pkg/sentry/platform/kvm/machine.go
index 1aa537fe3..ebaccb2eb 100644
--- a/pkg/sentry/platform/kvm/machine.go
+++ b/pkg/sentry/platform/kvm/machine.go
@@ -26,6 +26,7 @@ import (
 	"gvisor.dev/gvisor/pkg/atomicbitops"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/hostos"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/hosttid"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/metric"
@@ -229,7 +230,7 @@ type dieState struct {
 // Precondition: mu must be held.
 func (m *machine) createVCPU(id int) *vCPU {
 	// Create the vCPU.
-	fd, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CREATE_VCPU, uintptr(id))
+	fd, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CREATE_VCPU, uintptr(id))
 	if errno != 0 {
 		panic(fmt.Sprintf("error creating new vCPU: %v", errno))
 	}
@@ -285,7 +286,7 @@ func newMachine(vm int) (*machine, error) {
 	m.kernel.Init(m.maxVCPUs)
 
 	// Pull the maximum slots.
-	maxSlots, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_MAX_MEMSLOTS)
+	maxSlots, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_MAX_MEMSLOTS)
 	if errno != 0 {
 		m.maxSlots = _KVM_NR_MEMSLOTS
 	} else {
@@ -295,7 +296,7 @@ func newMachine(vm int) (*machine, error) {
 	m.usedSlots = make([]uintptr, m.maxSlots)
 
 	// Check TSC Scaling
-	hasTSCControl, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_TSC_CONTROL)
+	hasTSCControl, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_TSC_CONTROL)
 	m.tscControl = errno == 0 && hasTSCControl == 1
 	log.Debugf("TSC scaling support: %t.", m.tscControl)
 
diff --git a/pkg/sentry/platform/kvm/machine_amd64.go b/pkg/sentry/platform/kvm/machine_amd64.go
index 0410521f0..605e8196a 100644
--- a/pkg/sentry/platform/kvm/machine_amd64.go
+++ b/pkg/sentry/platform/kvm/machine_amd64.go
@@ -28,6 +28,7 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/cpuid"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/ring0"
 	"gvisor.dev/gvisor/pkg/ring0/pagetables"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -39,7 +40,7 @@ import (
 func (m *machine) initArchState() error {
 	// Set the legacy TSS address. This address is covered by the reserved
 	// range (up to 4GB). In fact, this is a main reason it exists.
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(m.fd),
 		KVM_SET_TSS_ADDR,
@@ -495,7 +496,7 @@ func (m *machine) mapUpperHalf(pageTable *pagetables.PageTables) {
 
 // getMaxVCPU get max vCPU number
 func (m *machine) getMaxVCPU() {
-	maxVCPUs, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_MAX_VCPUS)
+	maxVCPUs, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_MAX_VCPUS)
 	if errno != 0 {
 		m.maxVCPUs = _KVM_NR_VCPUS
 	} else {
diff --git a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
index d5394813d..3ec39ca80 100644
--- a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
@@ -32,14 +32,14 @@ import (
 //
 //go:nosplit
 func (c *vCPU) loadSegments(tid uint64) {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_ARCH_PRCTL,
 		linux.ARCH_GET_FS,
 		uintptr(unsafe.Pointer(&c.CPU.Registers().Fs_base)),
 		0); errno != 0 {
 		throw("getting FS segment")
 	}
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_ARCH_PRCTL,
 		linux.ARCH_GET_GS,
 		uintptr(unsafe.Pointer(&c.CPU.Registers().Gs_base)),
@@ -51,7 +51,7 @@ func (c *vCPU) loadSegments(tid uint64) {
 
 // setCPUID sets the CPUID to be used by the guest.
 func (c *vCPU) setCPUID() error {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		KVM_SET_CPUID2,
@@ -65,7 +65,7 @@ func (c *vCPU) setCPUID() error {
 //
 // If mustSucceed is true, then this function panics on error.
 func (c *vCPU) getTSCFreq() (uintptr, error) {
-	rawFreq, _, errno := unix.RawSyscall(
+	rawFreq, errno := hostsyscall.RawSyscall(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		KVM_GET_TSC_KHZ,
@@ -78,7 +78,7 @@ func (c *vCPU) getTSCFreq() (uintptr, error) {
 
 // setTSCFreq sets the TSC frequency.
 func (c *vCPU) setTSCFreq(freq uintptr) error {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		KVM_SET_TSC_KHZ,
@@ -101,7 +101,7 @@ func (c *vCPU) setTSCOffset() error {
 		attr:  _KVM_VCPU_TSC_OFFSET,
 		addr:  unsafe.Pointer(&offset),
 	}
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		KVM_SET_DEVICE_ATTR,
@@ -119,7 +119,7 @@ func (c *vCPU) setTSC(value uint64) error {
 	}
 	registers.entries[0].index = _MSR_IA32_TSC
 	registers.entries[0].data = value
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		KVM_SET_MSRS,
diff --git a/pkg/sentry/platform/kvm/machine_arm64.go b/pkg/sentry/platform/kvm/machine_arm64.go
index c6a59ac39..ee770f36b 100644
--- a/pkg/sentry/platform/kvm/machine_arm64.go
+++ b/pkg/sentry/platform/kvm/machine_arm64.go
@@ -24,6 +24,7 @@ import (
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/ring0"
 	"gvisor.dev/gvisor/pkg/ring0/pagetables"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
@@ -208,7 +209,7 @@ func (c *vCPU) fault(signal int32, info *linux.SignalInfo) (hostarch.AccessType,
 // getMaxVCPU get max vCPU number
 func (m *machine) getMaxVCPU() {
 	rmaxVCPUs := runtime.NumCPU()
-	smaxVCPUs, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_MAX_VCPUS)
+	smaxVCPUs, errno := hostsyscall.RawSyscall(unix.SYS_IOCTL, uintptr(m.fd), KVM_CHECK_EXTENSION, _KVM_CAP_MAX_VCPUS)
 	// compare the max vcpu number from runtime and syscall, use smaller one.
 	if errno != 0 {
 		m.maxVCPUs = rmaxVCPUs
diff --git a/pkg/sentry/platform/kvm/machine_arm64_unsafe.go b/pkg/sentry/platform/kvm/machine_arm64_unsafe.go
index 950f914a9..e0c74bac3 100644
--- a/pkg/sentry/platform/kvm/machine_arm64_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_arm64_unsafe.go
@@ -41,7 +41,7 @@ var vcpuInit kvmVcpuInit
 
 // initArchState initializes architecture-specific state.
 func (m *machine) initArchState() error {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(m.fd),
 		_KVM_ARM_PREFERRED_TARGET,
@@ -74,7 +74,7 @@ func (c *vCPU) initArchState() error {
 	regGet.addr = uint64(reflect.ValueOf(&dataGet).Pointer())
 
 	vcpuInit.features[0] |= (1 << _KVM_ARM_VCPU_PSCI_0_2)
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		_KVM_ARM_VCPU_INIT,
@@ -260,7 +260,7 @@ func (c *vCPU) loadSegments(tid uint64) {
 }
 
 func (c *vCPU) setOneRegister(reg *kvmOneReg) error {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		_KVM_SET_ONE_REG,
@@ -271,7 +271,7 @@ func (c *vCPU) setOneRegister(reg *kvmOneReg) error {
 }
 
 func (c *vCPU) getOneRegister(reg *kvmOneReg) error {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		_KVM_GET_ONE_REG,
diff --git a/pkg/sentry/platform/kvm/machine_unsafe.go b/pkg/sentry/platform/kvm/machine_unsafe.go
index 6548cbf6f..179c318e7 100644
--- a/pkg/sentry/platform/kvm/machine_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_unsafe.go
@@ -66,7 +66,7 @@ func (m *machine) setMemoryRegion(slot int, physical, length, virtual uintptr, f
 
 // mapRunData maps the vCPU run data.
 func mapRunData(fd int) (*runData, error) {
-	r, _, errno := unix.RawSyscall6(
+	r, errno := hostsyscall.RawSyscall6(
 		unix.SYS_MMAP,
 		0,
 		uintptr(runDataSize),
@@ -82,7 +82,7 @@ func mapRunData(fd int) (*runData, error) {
 
 // unmapRunData unmaps the vCPU run data.
 func unmapRunData(r *runData) error {
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_MUNMAP,
 		uintptr(unsafe.Pointer(r)),
 		uintptr(runDataSize),
@@ -120,12 +120,12 @@ func (a *atomicAddressSpace) get() *addressSpace {
 //
 //go:nosplit
 func (c *vCPU) notify() {
-	errno := hostsyscall.RawSyscallErrno6( // escapes: no.
+	errno := hostsyscall.RawSyscallErrno( // escapes: no.
 		unix.SYS_FUTEX,
 		uintptr(unsafe.Pointer(&c.state)),
 		linux.FUTEX_WAKE|linux.FUTEX_PRIVATE_FLAG,
-		math.MaxInt32, // Number of waiters.
-		0, 0, 0)
+		// Number of waiters.
+		math.MaxInt32)
 	if errno != 0 {
 		throw("futex wake error")
 	}
@@ -138,12 +138,11 @@ func (c *vCPU) notify() {
 //
 // This panics on error.
 func (c *vCPU) waitUntilNot(state uint32) {
-	_, _, errno := unix.Syscall6(
+	errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_FUTEX,
 		uintptr(unsafe.Pointer(&c.state)),
 		linux.FUTEX_WAIT|linux.FUTEX_PRIVATE_FLAG,
-		uintptr(state),
-		0, 0, 0)
+		uintptr(state))
 	if errno != 0 && errno != unix.EINTR && errno != unix.EAGAIN {
 		panic("futex wait error")
 	}
@@ -164,7 +163,7 @@ func (c *vCPU) setSignalMask() error {
 	data.length = 8 // Fixed sigset size.
 	data.mask1 = ^uint32(bounceSignalMask & 0xffffffff)
 	data.mask2 = ^uint32(bounceSignalMask >> 32)
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_IOCTL,
 		uintptr(c.fd),
 		KVM_SET_SIGNAL_MASK,
@@ -198,7 +197,7 @@ func seccompMmapSync() {
 // disableAsyncPreemption disables asynchronous preemption of go-routines.
 func disableAsyncPreemption() {
 	set := linux.MakeSignalSet(linux.SIGURG)
-	_, _, errno := unix.RawSyscall6(unix.SYS_RT_SIGPROCMASK, linux.SIG_BLOCK,
+	errno := hostsyscall.RawSyscallErrno6(unix.SYS_RT_SIGPROCMASK, linux.SIG_BLOCK,
 		uintptr(unsafe.Pointer(&set)), 0, linux.SignalSetSize, 0, 0)
 	if errno != 0 {
 		panic(fmt.Sprintf("sigprocmask failed: %d", errno))
@@ -208,7 +207,7 @@ func disableAsyncPreemption() {
 // enableAsyncPreemption enables asynchronous preemption of go-routines.
 func enableAsyncPreemption() {
 	set := linux.MakeSignalSet(linux.SIGURG)
-	_, _, errno := unix.RawSyscall6(unix.SYS_RT_SIGPROCMASK, linux.SIG_UNBLOCK,
+	errno := hostsyscall.RawSyscallErrno6(unix.SYS_RT_SIGPROCMASK, linux.SIG_UNBLOCK,
 		uintptr(unsafe.Pointer(&set)), 0, linux.SignalSetSize, 0, 0)
 	if errno != 0 {
 		panic(fmt.Sprintf("sigprocmask failed: %d", errno))
diff --git a/pkg/sentry/platform/kvm/physical_map.go b/pkg/sentry/platform/kvm/physical_map.go
index f68414177..fa5b47a50 100644
--- a/pkg/sentry/platform/kvm/physical_map.go
+++ b/pkg/sentry/platform/kvm/physical_map.go
@@ -20,6 +20,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/ring0"
 )
@@ -93,7 +94,7 @@ func fillAddressSpace() (excludedRegions []region) {
 	required := uintptr(requiredAddr)
 	current := required // Attempted mmap size.
 	for filled := uintptr(0); filled < required && current > 0; {
-		addr, _, errno := unix.RawSyscall6(
+		addr, errno := hostsyscall.RawSyscall6(
 			unix.SYS_MMAP,
 			0, // Suggested address.
 			current,