bpf

perform a command on an extended BPF map or program

sys_bpf(int cmd, union bpf_attr *attr, unsigned int size, struct bpf_common_attr *attr_common, unsigned int size_common)

register	value
`r20`	341, the syscall number
`r26`	int cmd
`r25`	union bpf_attr *attr
`r24`	unsigned int size
`r23`	struct bpf_common_attr *attr_common
`r22`	unsigned int size_common
`r28`	the return value

Then run ble 0x100(%sr2, %r0) to enter the kernel.

Same syscall on other architectures