bpf

perform a command on an extended BPF map or program

sys_bpf(int cmd, union bpf_attr *attr, unsigned int size, struct bpf_common_attr *attr_common, unsigned int size_common)

register	value
`eax`	357, the syscall number
`ebx`	int cmd
`ecx`	union bpf_attr *attr
`edx`	unsigned int size
`esi`	struct bpf_common_attr *attr_common
`edi`	unsigned int size_common
`eax`	the return value

Then run int 0x80 to enter the kernel.

Same syscall on other architectures