That's not what I mean. It appears the routine audit_execve in auditmodule.c assumes a kernel structure to which it refers contains places to store the x86 registers like ebx. This is probably some context information found in places like tss_struct (in processor.h) or sigcontext (in signcontext.h). The code will need to be changed to reflect what the kernel gives for the s390 architecture.
-----Original Message----- Not being that familar with the Z/Linux implementation and building products, what is the gcc option to pass for the z/VM / Z Series arch?
