bpf

perform a command on an extended BPF map or program

sys_bpf(int cmd, union bpf_attr *attr, unsigned int size, struct bpf_common_attr *attr_common, unsigned int size_common)

register	value
`g1`	349, the syscall number
`o0`	int cmd
`o1`	union bpf_attr *attr
`o2`	unsigned int size
`o3`	struct bpf_common_attr *attr_common
`o4`	unsigned int size_common
`o0`	the return value

Then run t 0x10 to enter the kernel.

Same syscall on other architectures