add arm support for orig_ax->x0 register

Author: tanelpoder

next/src/xcapture.bpf.c

@@ -194,7 +194,11 @@ int get_tasks(struct bpf_iter__task *ctx)
     // Read syscall nr and arguments from registers saved when invoking the syscall
     // on x86_64 ABI the args are stored in: rdi, rsi, rdx, r10, r8, r9
     if(regs) {
-        t->syscall_nr = (__s32) BPF_CORE_READ(regs, orig_ax);  // orig_ax holds syscall number (TODO: change for ARM64)
+#ifdef __x86_64__
+        t->syscall_nr = (__s32) BPF_CORE_READ(regs, orig_ax);
+#else // aarch64 for now
+        t->syscall_nr = (__s32) BPF_CORE_READ(regs, orig_x0);
+#endif
         t->syscall_args[0] = PT_REGS_PARM1_CORE_SYSCALL(regs);
         t->syscall_args[1] = PT_REGS_PARM2_CORE_SYSCALL(regs);
         t->syscall_args[2] = PT_REGS_PARM3_CORE_SYSCALL(regs);