From b901fb0088a7605eec00af7b644e25987995d693 Mon Sep 17 00:00:00 2001 From: Harish Sadineni Date: Sat, 7 Mar 2026 07:18:43 -0800 Subject: [PATCH] Add ARM64 syscall prefix detection in C++ API Fixes issue where bpf.get_syscall_fnname() on ARM64 returns bare syscall name instead of the prefixed __arm64_sys_ variant, causing kprobe attachment failures. Now detects ARM64 prefix alongside x64 (__x64_sys_) and generic (sys_) prefixes. Fixes: #5350 Upstream-Status: Submitted [https://github.com/iovisor/bcc/pull/5489] Signed-off-by: Harish Sadineni --- src/cc/api/BPF.cc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/cc/api/BPF.cc b/src/cc/api/BPF.cc index 2a77c2c9..11c6c542 100644 --- a/src/cc/api/BPF.cc +++ b/src/cc/api/BPF.cc @@ -780,6 +780,8 @@ std::string BPF::get_syscall_fnname(const std::string& name) { syscall_prefix_.reset(new std::string("sys_")); else if (ksym.resolve_name(nullptr, "__x64_sys_bpf", &addr)) syscall_prefix_.reset(new std::string("__x64_sys_")); + else if (ksym.resolve_name(nullptr, "__arm64_sys_bpf", &addr)) + syscall_prefix_.reset(new std::string("__arm64_sys_")); else syscall_prefix_.reset(new std::string()); } -- 2.49.0