diff --git a/pkg/sentry/platform/systrap/BUILD b/pkg/sentry/platform/systrap/BUILD
index fadbaa0a8..e39e44ac7 100644
--- a/pkg/sentry/platform/systrap/BUILD
+++ b/pkg/sentry/platform/systrap/BUILD
@@ -82,6 +82,7 @@ go_library(
         "//pkg/cpuid",
         "//pkg/fd",
         "//pkg/hostarch",
+        "//pkg/hostsyscall",
         "//pkg/log",
         "//pkg/memutil",
         "//pkg/metric",
diff --git a/pkg/sentry/platform/systrap/context_queue_unsafe.go b/pkg/sentry/platform/systrap/context_queue_unsafe.go
index cefd9311b..23671e10c 100644
--- a/pkg/sentry/platform/systrap/context_queue_unsafe.go
+++ b/pkg/sentry/platform/systrap/context_queue_unsafe.go
@@ -19,10 +19,11 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 func (q *contextQueue) wakeupSysmsgThread() {
-	unix.RawSyscall6(unix.SYS_FUTEX,
+	hostsyscall.RawSyscall(unix.SYS_FUTEX,
 		uintptr(unsafe.Pointer(&q.numThreadsToWakeup)),
-		linux.FUTEX_WAKE, 1, 0, 0, 0)
+		linux.FUTEX_WAKE, 1)
 }
diff --git a/pkg/sentry/platform/systrap/shared_context.go b/pkg/sentry/platform/systrap/shared_context.go
index 232d7b64b..a3e900aec 100644
--- a/pkg/sentry/platform/systrap/shared_context.go
+++ b/pkg/sentry/platform/systrap/shared_context.go
@@ -22,6 +22,7 @@ import (
 	"time"
 
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
 	"gvisor.dev/gvisor/pkg/sentry/platform/systrap/sysmsg"
@@ -140,7 +141,7 @@ func (sc *sharedContext) NotifyInterrupt() {
 	}
 
 	t := sysmsgThread.thread
-	if _, _, e := unix.RawSyscall(unix.SYS_TGKILL, uintptr(t.tgid), uintptr(t.tid), uintptr(platform.SignalInterrupt)); e != 0 {
+	if e := hostsyscall.RawSyscallErrno(unix.SYS_TGKILL, uintptr(t.tgid), uintptr(t.tid), uintptr(platform.SignalInterrupt)); e != 0 {
 		panic(fmt.Sprintf("failed to interrupt the child process %d: %v", t.tid, e))
 	}
 }
diff --git a/pkg/sentry/platform/systrap/stub_unsafe.go b/pkg/sentry/platform/systrap/stub_unsafe.go
index 462e66923..ef6bf5b6d 100644
--- a/pkg/sentry/platform/systrap/stub_unsafe.go
+++ b/pkg/sentry/platform/systrap/stub_unsafe.go
@@ -23,6 +23,7 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/bpf"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/safecopy"
 	"gvisor.dev/gvisor/pkg/sentry/platform/systrap/sysmsg"
@@ -88,7 +89,7 @@ func copySeccompRulesToStub(instrs []bpf.Instruction, stubAddr, size uintptr) {
 	sockProg.Len = uint16(len(instrs))
 	sockProg.Filter = (*linux.BPFInstruction)(unsafe.Pointer(progPtr))
 	// Make the seccomp rules stub read-only.
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_MPROTECT,
 		stubAddr,
 		size,
@@ -176,7 +177,7 @@ func stubInit() {
 		// something that may have been there already. We just walk
 		// down the address space until we find a place where the stub
 		// can be placed.
-		addr, _, _ := unix.RawSyscall6(
+		addr, _ := hostsyscall.RawSyscall6(
 			unix.SYS_MMAP,
 			stubStart,
 			stubROMapEnd,
@@ -188,7 +189,7 @@ func stubInit() {
 		}
 		if addr != 0 {
 			// Unmap the region we've mapped accidentally.
-			unix.RawSyscall(unix.SYS_MUNMAP, addr, stubROMapEnd, 0)
+			hostsyscall.RawSyscall(unix.SYS_MUNMAP, addr, stubROMapEnd, 0)
 		}
 		stubStart = uintptr(0)
 	}
@@ -246,7 +247,7 @@ func stubInit() {
 		stubSyscallRules, stubSyscallRulesLen)
 
 	// Make the stub executable.
-	if _, _, errno := unix.RawSyscall(
+	if errno := hostsyscall.RawSyscallErrno(
 		unix.SYS_MPROTECT,
 		stubStart,
 		stubROMapEnd-stubStart,
diff --git a/pkg/sentry/platform/systrap/subprocess.go b/pkg/sentry/platform/systrap/subprocess.go
index ae77afd6a..f1fdd15f1 100644
--- a/pkg/sentry/platform/systrap/subprocess.go
+++ b/pkg/sentry/platform/systrap/subprocess.go
@@ -25,6 +25,7 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/atomicbitops"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/pool"
 	"gvisor.dev/gvisor/pkg/seccomp"
@@ -181,7 +182,7 @@ type subprocess struct {
 var seccompNotifyIsSupported = false
 
 func initSeccompNotify() {
-	_, _, errno := unix.Syscall(seccomp.SYS_SECCOMP, linux.SECCOMP_SET_MODE_FILTER, linux.SECCOMP_FILTER_FLAG_NEW_LISTENER, 0)
+	errno := hostsyscall.RawSyscallErrno(seccomp.SYS_SECCOMP, linux.SECCOMP_SET_MODE_FILTER, linux.SECCOMP_FILTER_FLAG_NEW_LISTENER, 0)
 	switch errno {
 	case unix.EFAULT:
 		// seccomp unotify is supported.
@@ -285,7 +286,7 @@ func (s *subprocess) handlePtraceSyscallRequest(req any) {
 		}
 		t.sysmsgStackID = id
 
-		if _, _, e := unix.RawSyscall(unix.SYS_TGKILL, uintptr(t.tgid), uintptr(t.tid), uintptr(unix.SIGSTOP)); e != 0 {
+		if e := hostsyscall.RawSyscallErrno(unix.SYS_TGKILL, uintptr(t.tgid), uintptr(t.tid), uintptr(unix.SIGSTOP)); e != 0 {
 			handlePtraceSyscallRequestError(req, "tkill failed: %v", e)
 			return
 		}
@@ -423,7 +424,7 @@ func (s *subprocess) mapSharedRegions() {
 	if err != nil {
 		panic(fmt.Sprintf("failed to allocate a new subprocess context memory region"))
 	}
-	sentryThreadContextRegionAddr, _, errno := unix.RawSyscall6(
+	sentryThreadContextRegionAddr, errno := hostsyscall.RawSyscall6(
 		unix.SYS_MMAP,
 		0,
 		uintptr(threadContextFR.Length()),
@@ -503,7 +504,7 @@ func (s *subprocess) release() {
 
 // attach attaches to the thread.
 func (t *thread) attach() error {
-	if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, unix.PTRACE_ATTACH, uintptr(t.tid), 0, 0, 0, 0); errno != 0 {
+	if errno := hostsyscall.RawSyscallErrno(unix.SYS_PTRACE, unix.PTRACE_ATTACH, uintptr(t.tid), 0); errno != 0 {
 		return fmt.Errorf("unable to attach: %v", errno)
 	}
 
@@ -537,7 +538,7 @@ func (t *thread) grabInitRegs() {
 //
 // Because the SIGSTOP is not suppressed, the thread will enter group-stop.
 func (t *thread) detach() {
-	if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, unix.PTRACE_DETACH, uintptr(t.tid), 0, uintptr(unix.SIGSTOP), 0, 0); errno != 0 {
+	if errno := hostsyscall.RawSyscallErrno6(unix.SYS_PTRACE, unix.PTRACE_DETACH, uintptr(t.tid), 0, uintptr(unix.SIGSTOP), 0, 0); errno != 0 {
 		panic(fmt.Sprintf("can't detach new clone: %v", errno))
 	}
 }
@@ -682,7 +683,7 @@ func (t *thread) init() {
 	// Set the TRACESYSGOOD option to differentiate real SIGTRAP.
 	// set PTRACE_O_EXITKILL to ensure that the unexpected exit of the
 	// sentry will immediately kill the associated stubs.
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_SETOPTIONS,
 		uintptr(t.tid),
@@ -709,7 +710,7 @@ func (t *thread) syscall(regs *arch.Registers) (uintptr, error) {
 		// Execute the syscall instruction. The task has to stop on the
 		// trap instruction which is right after the syscall
 		// instruction.
-		if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, unix.PTRACE_CONT, uintptr(t.tid), 0, 0, 0, 0); errno != 0 {
+		if errno := hostsyscall.RawSyscallErrno(unix.SYS_PTRACE, unix.PTRACE_CONT, uintptr(t.tid), 0); errno != 0 {
 			panic(fmt.Sprintf("ptrace syscall-enter failed: %v", errno))
 		}
 
@@ -1061,7 +1062,7 @@ func (s *subprocess) createSysmsgThread() error {
 	}
 
 	// Skip SIGSTOP.
-	if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, unix.PTRACE_CONT, uintptr(p.tid), 0, 0, 0, 0); errno != 0 {
+	if errno := hostsyscall.RawSyscallErrno(unix.SYS_PTRACE, unix.PTRACE_CONT, uintptr(p.tid), 0); errno != 0 {
 		panic(fmt.Sprintf("ptrace cont failed: %v", errno))
 	}
 	sig := p.wait(stopped)
@@ -1089,7 +1090,7 @@ func (s *subprocess) createSysmsgThread() error {
 	threadID := uint32(p.sysmsgStackID)
 
 	// Map the stack into the sentry.
-	sentryStackAddr, _, errno := unix.RawSyscall6(
+	sentryStackAddr, errno := hostsyscall.RawSyscall6(
 		unix.SYS_MMAP,
 		0,
 		sysmsg.PerThreadSharedStackSize,
@@ -1169,11 +1170,11 @@ func (s *subprocess) createSysmsgThread() error {
 	}
 	archSpecificSysmsgThreadInit(sysThread)
 	// Skip SIGSTOP.
-	if _, _, e := unix.RawSyscall(unix.SYS_TGKILL, uintptr(p.tgid), uintptr(p.tid), uintptr(unix.SIGCONT)); e != 0 {
+	if e := hostsyscall.RawSyscallErrno(unix.SYS_TGKILL, uintptr(p.tgid), uintptr(p.tid), uintptr(unix.SIGCONT)); e != 0 {
 		panic(fmt.Sprintf("tkill failed: %v", e))
 	}
 	// Resume the BPF process.
-	if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, unix.PTRACE_DETACH, uintptr(p.tid), 0, 0, 0, 0); errno != 0 {
+	if errno := hostsyscall.RawSyscallErrno(unix.SYS_PTRACE, unix.PTRACE_DETACH, uintptr(p.tid), 0); errno != 0 {
 		panic(fmt.Sprintf("can't detach new clone: %v", errno))
 	}
 
diff --git a/pkg/sentry/platform/systrap/subprocess_amd64.go b/pkg/sentry/platform/systrap/subprocess_amd64.go
index 4a19ac59a..3456103be 100644
--- a/pkg/sentry/platform/systrap/subprocess_amd64.go
+++ b/pkg/sentry/platform/systrap/subprocess_amd64.go
@@ -23,6 +23,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/platform/systrap/sysmsg"
@@ -174,7 +175,7 @@ func maybePatchSignalInfo(regs *arch.Registers, signalInfo *linux.SignalInfo) bo
 //go:nosplit
 //go:norace
 func enableCpuidFault() {
-	unix.RawSyscall6(unix.SYS_ARCH_PRCTL, linux.ARCH_SET_CPUID, 0, 0, 0, 0, 0)
+	hostsyscall.RawSyscall(unix.SYS_ARCH_PRCTL, linux.ARCH_SET_CPUID, 0, 0)
 }
 
 // appendArchSeccompRules append architecture specific seccomp rules when creating BPF program.
diff --git a/pkg/sentry/platform/systrap/subprocess_arm64.go b/pkg/sentry/platform/systrap/subprocess_arm64.go
index f43c394d5..86fad320f 100644
--- a/pkg/sentry/platform/systrap/subprocess_arm64.go
+++ b/pkg/sentry/platform/systrap/subprocess_arm64.go
@@ -23,6 +23,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/platform/systrap/sysmsg"
@@ -151,10 +152,10 @@ func (s *subprocess) arm64SyscallWorkaround(t *thread, regs *arch.Registers) {
 	// signal, resume a stub thread and catch it on a signal handling.
 	t.NotifyInterrupt()
 	for {
-		if _, _, errno := unix.RawSyscall6(
+		if errno := hostsyscall.RawSyscallErrno(
 			unix.SYS_PTRACE,
 			unix.PTRACE_SYSEMU,
-			uintptr(t.tid), 0, 0, 0, 0); errno != 0 {
+			uintptr(t.tid), 0); errno != 0 {
 			panic(fmt.Sprintf("ptrace sysemu failed: %v", errno))
 		}
 
@@ -190,7 +191,7 @@ func retrieveArchSpecificState(ctx *sysmsg.ThreadContext, ac *arch.Context64) {
 
 func archSpecificSysmsgThreadInit(sysThread *sysmsgThread) {
 	// Send a fake event to stop the BPF process so that it enters the sighandler.
-	if _, _, e := unix.RawSyscall(unix.SYS_TGKILL, uintptr(sysThread.thread.tgid), uintptr(sysThread.thread.tid), uintptr(unix.SIGSEGV)); e != 0 {
+	if e := hostsyscall.RawSyscallErrno(unix.SYS_TGKILL, uintptr(sysThread.thread.tgid), uintptr(sysThread.thread.tid), uintptr(unix.SIGSEGV)); e != 0 {
 		panic(fmt.Sprintf("tkill failed: %v", e))
 	}
 }
diff --git a/pkg/sentry/platform/systrap/subprocess_linux.go b/pkg/sentry/platform/systrap/subprocess_linux.go
index 844f5043a..daccc5f35 100644
--- a/pkg/sentry/platform/systrap/subprocess_linux.go
+++ b/pkg/sentry/platform/systrap/subprocess_linux.go
@@ -23,6 +23,7 @@ import (
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/bpf"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 )
@@ -167,13 +168,13 @@ func forkStub(flags uintptr, instrs []bpf.Instruction) (*thread, error) {
 	)
 
 	// Remember the current ppid for the pdeathsig race.
-	ppid, _, _ = unix.RawSyscall(unix.SYS_GETPID, 0, 0, 0)
+	ppid, _ = hostsyscall.RawSyscall(unix.SYS_GETPID, 0, 0, 0)
 
 	// Among other things, beforeFork masks all signals.
 	beforeFork()
 
 	// Do the clone.
-	pid, _, errno = unix.RawSyscall6(unix.SYS_CLONE, flags, 0, 0, 0, 0, 0)
+	pid, errno = hostsyscall.RawSyscall(unix.SYS_CLONE, flags, 0, 0)
 	if errno != 0 {
 		afterFork()
 		return nil, errno
@@ -210,8 +211,8 @@ func forkStub(flags uintptr, instrs []bpf.Instruction) (*thread, error) {
 	// prevents the stub from getting PTY job control signals intended only
 	// for the sentry process. We must call this before restoring signal
 	// mask.
-	if _, _, errno := unix.RawSyscall(unix.SYS_SETSID, 0, 0, 0); errno != 0 {
-		unix.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
+	if errno := hostsyscall.RawSyscallErrno(unix.SYS_SETSID, 0, 0, 0); errno != 0 {
+		hostsyscall.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
 	}
 
 	// afterForkInChild resets all signals to their default dispositions
@@ -219,19 +220,19 @@ func forkStub(flags uintptr, instrs []bpf.Instruction) (*thread, error) {
 	afterForkInChild()
 
 	if errno := sysmsgSigactions(stubSysmsgStart); errno != 0 {
-		unix.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
+		hostsyscall.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
 	}
 
 	// Explicitly unmask all signals to ensure that the tracer can see
 	// them.
 	if errno := unmaskAllSignals(); errno != 0 {
-		unix.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
+		hostsyscall.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
 	}
 
 	// Set an aggressive BPF filter for the stub and all it's children. See
 	// the description of the BPF program built above.
 	if errno := seccomp.SetFilterInChild(instrs); errno != 0 {
-		unix.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
+		hostsyscall.RawSyscall(unix.SYS_EXIT, uintptr(errno), 0, 0)
 	}
 
 	// Enable cpuid-faulting.
diff --git a/pkg/sentry/platform/systrap/subprocess_linux_unsafe.go b/pkg/sentry/platform/systrap/subprocess_linux_unsafe.go
index a19e72625..5cbb50d66 100644
--- a/pkg/sentry/platform/systrap/subprocess_linux_unsafe.go
+++ b/pkg/sentry/platform/systrap/subprocess_linux_unsafe.go
@@ -23,6 +23,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 // maskPool contains reusable CPU masks for setting affinity. Unfortunately,
@@ -47,6 +48,6 @@ var maskPool = sync.Pool{
 //go:norace
 func unmaskAllSignals() unix.Errno {
 	var set linux.SignalSet
-	_, _, errno := unix.RawSyscall6(unix.SYS_RT_SIGPROCMASK, linux.SIG_SETMASK, uintptr(unsafe.Pointer(&set)), 0, linux.SignalSetSize, 0, 0)
+	errno := hostsyscall.RawSyscallErrno6(unix.SYS_RT_SIGPROCMASK, linux.SIG_SETMASK, uintptr(unsafe.Pointer(&set)), 0, linux.SignalSetSize, 0, 0)
 	return errno
 }
diff --git a/pkg/sentry/platform/systrap/subprocess_unsafe.go b/pkg/sentry/platform/systrap/subprocess_unsafe.go
index c31695d3a..c711865e7 100644
--- a/pkg/sentry/platform/systrap/subprocess_unsafe.go
+++ b/pkg/sentry/platform/systrap/subprocess_unsafe.go
@@ -27,6 +27,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
@@ -64,7 +65,7 @@ func mmapContextQueueForSentry(memoryFile *pgalloc.MemoryFile, opts pgalloc.Allo
 	if err != nil {
 		panic(fmt.Sprintf("failed to allocate a new subprocess context memory region"))
 	}
-	addr, _, errno := unix.RawSyscall6(
+	addr, errno := hostsyscall.RawSyscall6(
 		unix.SYS_MMAP,
 		0,
 		uintptr(fr.Length()),
diff --git a/pkg/sentry/platform/systrap/syscall_thread.go b/pkg/sentry/platform/systrap/syscall_thread.go
index 0ff1accf8..cbbee15eb 100644
--- a/pkg/sentry/platform/systrap/syscall_thread.go
+++ b/pkg/sentry/platform/systrap/syscall_thread.go
@@ -22,6 +22,7 @@ import (
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/seccomp"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
@@ -105,7 +106,7 @@ func (t *syscallThread) init(seccompNotify bool) error {
 	}
 
 	// Map the stack into the sentry.
-	sentryAddr, _, errno := unix.RawSyscall6(
+	sentryAddr, errno := hostsyscall.RawSyscall6(
 		unix.SYS_MMAP,
 		0,
 		syscallThreadMessageSize,
@@ -124,11 +125,11 @@ func (t *syscallThread) init(seccompNotify bool) error {
 
 func (t *syscallThread) destroy() {
 	if t.sentryAddr != 0 {
-		_, _, errno := unix.RawSyscall6(
+		errno := hostsyscall.RawSyscallErrno(
 			unix.SYS_MUNMAP,
 			t.sentryAddr,
 			syscallThreadMessageSize,
-			0, 0, 0, 0)
+			0)
 		if errno != 0 {
 			panic(fmt.Sprintf("mumap failed: %v", errno))
 		}
@@ -153,7 +154,7 @@ func (t *syscallThread) installSeccompNotify() (*os.File, error) {
 	if err != nil {
 		return nil, err
 	}
-	_, _, errno := unix.RawSyscall(unix.SYS_IOCTL, fd, linux.SECCOMP_IOCTL_NOTIF_SET_FLAGS, linux.SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
+	errno := hostsyscall.RawSyscallErrno(unix.SYS_IOCTL, fd, linux.SECCOMP_IOCTL_NOTIF_SET_FLAGS, linux.SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP)
 	if errno != 0 {
 		t.thread.Debugf("failed to set SECCOMP_USER_NOTIF_FD_SYNC_WAKE_UP")
 	}
diff --git a/pkg/sentry/platform/systrap/syscall_thread_amd64.go b/pkg/sentry/platform/systrap/syscall_thread_amd64.go
index 179c366ef..f207b9001 100644
--- a/pkg/sentry/platform/systrap/syscall_thread_amd64.go
+++ b/pkg/sentry/platform/systrap/syscall_thread_amd64.go
@@ -22,6 +22,7 @@ import (
 	"runtime"
 
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 )
 
@@ -47,7 +48,7 @@ func (t *syscallThread) detach() {
 		panic(fmt.Sprintf("ptrace set regs failed: %v", err))
 	}
 	p.detach()
-	if _, _, e := unix.RawSyscall(unix.SYS_TGKILL, uintptr(p.tgid), uintptr(p.tid), uintptr(unix.SIGCONT)); e != 0 {
+	if e := hostsyscall.RawSyscallErrno(unix.SYS_TGKILL, uintptr(p.tgid), uintptr(p.tid), uintptr(unix.SIGCONT)); e != 0 {
 		panic(fmt.Sprintf("tkill failed: %v", e))
 	}
 	runtime.UnlockOSThread()
diff --git a/pkg/sentry/platform/systrap/syscall_thread_arm64.go b/pkg/sentry/platform/systrap/syscall_thread_arm64.go
index 055aaba84..3afaab6e0 100644
--- a/pkg/sentry/platform/systrap/syscall_thread_arm64.go
+++ b/pkg/sentry/platform/systrap/syscall_thread_arm64.go
@@ -22,6 +22,7 @@ import (
 	"runtime"
 
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 )
 
@@ -47,7 +48,7 @@ func (t *syscallThread) detach() {
 		panic(fmt.Sprintf("ptrace set regs failed: %v", err))
 	}
 	p.detach()
-	if _, _, e := unix.RawSyscall(unix.SYS_TGKILL, uintptr(p.tgid), uintptr(p.tid), uintptr(unix.SIGCONT)); e != 0 {
+	if e := hostsyscall.RawSyscallErrno(unix.SYS_TGKILL, uintptr(p.tgid), uintptr(p.tid), uintptr(unix.SIGCONT)); e != 0 {
 		panic(fmt.Sprintf("tkill failed: %v", e))
 	}
 	runtime.UnlockOSThread()
diff --git a/pkg/sentry/platform/systrap/syscall_thread_unsafe.go b/pkg/sentry/platform/systrap/syscall_thread_unsafe.go
index 898cdb8ad..7cd9fabb7 100644
--- a/pkg/sentry/platform/systrap/syscall_thread_unsafe.go
+++ b/pkg/sentry/platform/systrap/syscall_thread_unsafe.go
@@ -21,6 +21,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 func (t *syscallThread) initRequestReplyAddresses(sentryStackAddr uintptr) {
@@ -38,7 +39,7 @@ func (t *syscallThread) maskAllSignalsAttached() {
 	p := t.thread
 
 	mask := ^uint64(0)
-	if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, linux.PTRACE_SETSIGMASK, uintptr(p.tid), 8, uintptr(unsafe.Pointer(&mask)), 0, 0); errno != 0 {
+	if errno := hostsyscall.RawSyscallErrno6(unix.SYS_PTRACE, linux.PTRACE_SETSIGMASK, uintptr(p.tid), 8, uintptr(unsafe.Pointer(&mask)), 0, 0); errno != 0 {
 		panic(fmt.Sprintf("unable to setmask: %v", errno))
 	}
 }
@@ -47,13 +48,13 @@ func (t *syscallThread) maskAllSignalsAttached() {
 func (t *syscallThread) unmaskAllSignalsAttached() {
 	p := t.thread
 	mask := uint64(0)
-	if _, _, errno := unix.RawSyscall6(unix.SYS_PTRACE, linux.PTRACE_SETSIGMASK, uintptr(p.tid), 8, uintptr(unsafe.Pointer(&mask)), 0, 0); errno != 0 {
+	if errno := hostsyscall.RawSyscallErrno6(unix.SYS_PTRACE, linux.PTRACE_SETSIGMASK, uintptr(p.tid), 8, uintptr(unsafe.Pointer(&mask)), 0, 0); errno != 0 {
 		panic(fmt.Sprintf("unable to setmask: %v", errno))
 	}
 }
 
 func futexWakeUint32(addr *uint32) error {
-	if _, _, e := unix.RawSyscall6(unix.SYS_FUTEX, uintptr(unsafe.Pointer(addr)), linux.FUTEX_WAKE, 1, 0, 0, 0); e != 0 {
+	if e := hostsyscall.RawSyscallErrno(unix.SYS_FUTEX, uintptr(unsafe.Pointer(addr)), linux.FUTEX_WAKE, 1); e != 0 {
 		return fmt.Errorf("failed to FUTEX_WAKE: %v", e)
 	}
 	return nil
@@ -91,7 +92,7 @@ func futexWaitWake(futexAddr *uint32, futexValue uint32) error {
 }
 
 func (t *syscallThread) kickSeccompNotify() unix.Errno {
-	_, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(t.seccompNotify.Fd()),
+	errno := hostsyscall.RawSyscallErrno(unix.SYS_IOCTL, uintptr(t.seccompNotify.Fd()),
 		uintptr(linux.SECCOMP_IOCTL_NOTIF_SEND),
 		uintptr(unsafe.Pointer(&t.seccompNotifyResp)))
 	return errno
@@ -100,7 +101,7 @@ func (t *syscallThread) kickSeccompNotify() unix.Errno {
 func (t *syscallThread) waitForSeccompNotify() error {
 	for {
 		req := linux.SeccompNotif{}
-		_, _, errno := unix.RawSyscall(unix.SYS_IOCTL, uintptr(t.seccompNotify.Fd()),
+		errno := hostsyscall.RawSyscallErrno(unix.SYS_IOCTL, uintptr(t.seccompNotify.Fd()),
 			uintptr(linux.SECCOMP_IOCTL_NOTIF_RECV),
 			uintptr(unsafe.Pointer(&req)))
 		if errno == 0 {
diff --git a/pkg/sentry/platform/systrap/sysmsg/BUILD b/pkg/sentry/platform/systrap/sysmsg/BUILD
index 418036e42..5bd68ddd1 100644
--- a/pkg/sentry/platform/systrap/sysmsg/BUILD
+++ b/pkg/sentry/platform/systrap/sysmsg/BUILD
@@ -131,6 +131,7 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/cpuid",
         "//pkg/hostarch",
+        "//pkg/hostsyscall",
         "//pkg/sentry/platform",
         "@org_golang_x_sys//unix:go_default_library",
     ],
diff --git a/pkg/sentry/platform/systrap/sysmsg/sysmsg_unsafe.go b/pkg/sentry/platform/systrap/sysmsg/sysmsg_unsafe.go
index 0261d6e77..09dc0b44e 100644
--- a/pkg/sentry/platform/systrap/sysmsg/sysmsg_unsafe.go
+++ b/pkg/sentry/platform/systrap/sysmsg/sysmsg_unsafe.go
@@ -20,6 +20,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 // SleepOnState makes the caller sleep on the ThreadContext.State futex.
@@ -37,6 +38,6 @@ func (m *Msg) WakeSysmsgThread() (bool, syscall.Errno) {
 	if !m.State.CompareAndSwap(ThreadStateAsleep, ThreadStatePrep) {
 		return false, 0
 	}
-	_, _, e := unix.RawSyscall6(unix.SYS_FUTEX, uintptr(unsafe.Pointer(&m.State)), linux.FUTEX_WAKE, 1, 0, 0, 0)
+	e := hostsyscall.RawSyscallErrno(unix.SYS_FUTEX, uintptr(unsafe.Pointer(&m.State)), linux.FUTEX_WAKE, 1)
 	return true, e
 }
diff --git a/pkg/sentry/platform/systrap/sysmsg_thread_unsafe.go b/pkg/sentry/platform/systrap/sysmsg_thread_unsafe.go
index 59d553222..bc44236e2 100644
--- a/pkg/sentry/platform/systrap/sysmsg_thread_unsafe.go
+++ b/pkg/sentry/platform/systrap/sysmsg_thread_unsafe.go
@@ -20,12 +20,13 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/platform/systrap/sysmsg"
 )
 
 func (p *sysmsgThread) unmapStackFromSentry() {
-	_, _, errno := unix.RawSyscall(unix.SYS_MUNMAP, sysmsg.MsgToStackAddr(uintptr(unsafe.Pointer(p.msg))), sysmsg.PerThreadSharedStackSize, 0)
+	errno := hostsyscall.RawSyscallErrno(unix.SYS_MUNMAP, sysmsg.MsgToStackAddr(uintptr(unsafe.Pointer(p.msg))), sysmsg.PerThreadSharedStackSize, 0)
 	if errno != 0 {
 		panic("failed to unmap: " + errno.Error())
 	}
@@ -85,7 +86,7 @@ func sysmsgSigactions(stubSysmsgStart uintptr) unix.Errno {
 		unix.SIGTRAP,
 		unix.SIGSEGV,
 	} {
-		_, _, errno := unix.RawSyscall6(unix.SYS_RT_SIGACTION, uintptr(s), uintptr(unsafe.Pointer(&act)), 0, 8, 0, 0)
+		errno := hostsyscall.RawSyscallErrno6(unix.SYS_RT_SIGACTION, uintptr(s), uintptr(unsafe.Pointer(&act)), 0, 8, 0, 0)
 		if errno != 0 {
 			return errno
 		}
diff --git a/pkg/sentry/platform/systrap/systrap_arm64_unsafe.go b/pkg/sentry/platform/systrap/systrap_arm64_unsafe.go
index eead7768d..c143c7902 100644
--- a/pkg/sentry/platform/systrap/systrap_arm64_unsafe.go
+++ b/pkg/sentry/platform/systrap/systrap_arm64_unsafe.go
@@ -22,6 +22,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 )
 
 // getTLS gets the thread local storage register.
@@ -30,7 +31,7 @@ func (t *thread) getTLS(tls *uint64) error {
 		Base: (*byte)(unsafe.Pointer(tls)),
 		Len:  uint64(unsafe.Sizeof(*tls)),
 	}
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_GETREGSET,
 		uintptr(t.tid),
@@ -49,7 +50,7 @@ func (t *thread) setTLS(tls *uint64) error {
 		Base: (*byte)(unsafe.Pointer(tls)),
 		Len:  uint64(unsafe.Sizeof(*tls)),
 	}
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_SETREGSET,
 		uintptr(t.tid),
diff --git a/pkg/sentry/platform/systrap/systrap_unsafe.go b/pkg/sentry/platform/systrap/systrap_unsafe.go
index eba22e920..c48a6084a 100644
--- a/pkg/sentry/platform/systrap/systrap_unsafe.go
+++ b/pkg/sentry/platform/systrap/systrap_unsafe.go
@@ -20,6 +20,7 @@ import (
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/hostarch"
+	"gvisor.dev/gvisor/pkg/hostsyscall"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 )
 
@@ -29,7 +30,7 @@ func (t *thread) getRegs(regs *arch.Registers) error {
 		Base: (*byte)(unsafe.Pointer(regs)),
 		Len:  uint64(unsafe.Sizeof(*regs)),
 	}
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_GETREGSET,
 		uintptr(t.tid),
@@ -48,7 +49,7 @@ func (t *thread) setRegs(regs *arch.Registers) error {
 		Base: (*byte)(unsafe.Pointer(regs)),
 		Len:  uint64(unsafe.Sizeof(*regs)),
 	}
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_SETREGSET,
 		uintptr(t.tid),
@@ -63,7 +64,7 @@ func (t *thread) setRegs(regs *arch.Registers) error {
 
 // getSignalInfo retrieves information about the signal that caused the stop.
 func (t *thread) getSignalInfo(si *linux.SignalInfo) error {
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_GETSIGINFO,
 		uintptr(t.tid),
@@ -126,7 +127,7 @@ func (t *thread) clone() (*thread, error) {
 // getEventMessage retrieves a message about the ptrace event that just happened.
 func (t *thread) getEventMessage() (uintptr, error) {
 	var msg uintptr
-	_, _, errno := unix.RawSyscall6(
+	errno := hostsyscall.RawSyscallErrno6(
 		unix.SYS_PTRACE,
 		unix.PTRACE_GETEVENTMSG,
 		uintptr(t.tid),