Access first argument of syscall

[fhilgers]

The libbpf folks did the following here: libbpf/libbpf@9f6e3a7

I do not have a arm64 machine currently to test whether accessing the first syscall using aya works, but I stumbled over this while looking into their implementation and though this might be relevant here, as aya is just using arg[0] for pt_regs.

Also for syscalls on other platforms there are some differences, for example on x86_64 the 4th (starting from 1) argument is passed via r10 instaed of rcx like normal.

Maybe a note that PtRegs cannot be used for syscall arguments, tests or another struct for Syscall arguments might be useful. Let me know what you prefer.

Edit:

Relevant code here:

• https://github.com/libbpf/libbpf/blob/324f3c3846d99c8a1e1384a55591f893f0ae5de4/src/bpf_tracing.h#L100
• https://github.com/libbpf/libbpf/blob/324f3c3846d99c8a1e1384a55591f893f0ae5de4/src/bpf_tracing.h#L238C1-L238C39
• https://github.com/libbpf/libbpf/blob/324f3c3846d99c8a1e1384a55591f893f0ae5de4/src/bpf_tracing.h#L118

[tamird]

@fhilgers as of #1148 our integration tests are running on ARM. Would you like to work on adding a test that exercises this?