From da01655f0f335584867b3427005b95384499a020 Mon Sep 17 00:00:00 2001
From: Harish Sadineni <Harish.Sadineni@windriver.com>
Date: Sat, 7 Mar 2026 20:20:04 -0800
Subject: [PATCH 2/2] Add riscv syscall prefix detection in C++ API

Fixes issue where bpf.get_syscall_fnname() on riscv64 returns bare syscall
name instead of the prefixed _riscv_sys variant, causing kprobe
attachment failures.

Upstream-Status: Submitted [https://github.com/iovisor/bcc/pull/5490]

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
---
 src/cc/api/BPF.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/cc/api/BPF.cc b/src/cc/api/BPF.cc
index 11c6c542..e1df8208 100644
--- a/src/cc/api/BPF.cc
+++ b/src/cc/api/BPF.cc
@@ -782,6 +782,8 @@ std::string BPF::get_syscall_fnname(const std::string& name) {
       syscall_prefix_.reset(new std::string("__x64_sys_"));
     else if (ksym.resolve_name(nullptr, "__arm64_sys_bpf", &addr))
       syscall_prefix_.reset(new std::string("__arm64_sys_"));
+    else if (ksym.resolve_name(nullptr, "__riscv_sys_bpf", &addr))
+      syscall_prefix_.reset(new std::string("__riscv_sys_"));
     else
       syscall_prefix_.reset(new std::string());
   }
-- 
2.49.0

