On Fri, Jul 03, 2026 at 08:26:36AM +0200, Sven Schnelle wrote:

The difference between x86 and s390 is that on s390, regs->gprs[2] is
used for both the syscall number and the syscall return value.
That was a design mistake early in the begin about 25 years ago, but
it's ABI now, so it cannot be changed.

When seccomp decides to skip a syscall, it write a return value into
regs->gprs[2]. When syscall_enter_from_user_mode_work() returns, it
returns this number. If it's negative all is good - the 'if (likely(nr <
NR_syscalls))' conditiion would just catch it and skip the syscall.

You do have regs->orig_gpr2; I didn't fully track its usage, but can't
you treat that as the syscall nr and always consider regs->gprs[2] as the
return value?