meta-kernel-block: add bpf capability

Signed-off-by: Alex Gonzalez <alexg@balena.io>

Author: alexgg

layers/meta-kernel-block/classes/kernel-extension.bbclass

@@ -9,16 +9,18 @@
 #
 # Strategy:
 # 1. After do_kernel_resin_injectconfig runs (balena defconfig + BALENA_CONFIGS
-#    are already merged into .config), apply kernel-extension.cfg via
-#    scripts/kconfig/merge_config.sh.
-# 2. Run olddefconfig to resolve dependencies.
+#    are already merged into .config), discover every *.cfg fragment reachable
+#    via FILESEXTRAPATHS and merge them all via scripts/kconfig/merge_config.sh
+#    in sorted order.
+# 2. Run olddefconfig once to resolve dependencies.
 # 3. Let the normal do_compile / do_install flow proceed.
 #
 # Usage:
 #   inherit kernel-extension
-#   # Place kernel-extension.cfg in a FILESEXTRAPATHS-reachable directory.
+#   # Place one or more *.cfg fragments in a FILESEXTRAPATHS-reachable dir.
 
 python do_kernel_extend_config() {
+    import glob
     import os
     import subprocess
 
@@ -32,31 +34,40 @@ python do_kernel_extend_config() {
     if not arch:
         bb.fatal("kernel-extension: ARCH variable not set")
 
-    # 1. Locate kernel-extension.cfg via FILESEXTRAPATHS.
-    extension_cfg = None
+    # 1. Discover every *.cfg fragment reachable via FILESEXTRAPATHS, in
+    #    sorted order. Deduplicate paths reachable via multiple entries.
+    fragments = []
+    seen = set()
     filesextrapaths = d.getVar("FILESEXTRAPATHS") or ""
     for path in filesextrapaths.split(":"):
-        candidate = os.path.join(path, "kernel-extension.cfg")
-        if os.path.exists(candidate):
-            extension_cfg = candidate
-            break
+        if not path:
+            continue
+        for cfg in sorted(glob.glob(os.path.join(path, "*.cfg"))):
+            if cfg not in seen:
+                seen.add(cfg)
+                fragments.append(cfg)
 
-    if not extension_cfg:
+    if not fragments:
         bb.fatal(
-            "kernel-extension: kernel-extension.cfg not found.\n"
-            "Place it in a directory reachable via FILESEXTRAPATHS.\n"
+            "kernel-extension: no *.cfg fragments found via FILESEXTRAPATHS.\n"
+            "Place at least one fragment in a FILESEXTRAPATHS-reachable dir.\n"
             f"Searched paths: {filesextrapaths}"
         )
 
-    bb.note(f"Using kernel extension fragment: {extension_cfg}")
+    bb.note(f"Merging {len(fragments)} kernel extension fragment(s):")
+    for f in fragments:
+        bb.note(f"  {f}")
 
-    # 2. Merge the fragment into .config.
+    # 2. Merge every fragment in a single merge_config.sh invocation.
+    #    merge_config.sh accepts multiple input fragments; later inputs
+    #    override earlier ones for conflicting symbols and warn on stderr.
     merge_script = os.path.join(S, "scripts", "kconfig", "merge_config.sh")
-    cmd = f'{merge_script} -m -O {B} {base_config} {extension_cfg}'
-    bb.note("Merging kernel-extension.cfg")
+    cmd = " ".join([merge_script, "-m", "-O", B, base_config, *fragments])
     ret = subprocess.run(cmd, shell=True, capture_output=True, text=True)
     if ret.returncode != 0:
         bb.fatal(f"merge_config.sh failed:\n{ret.stderr}")
+    if ret.stderr:
+        bb.note(ret.stderr)
 
     # 3. Resolve dependencies.
     cmd = f'{make_cmd} {make_opts} -C {S} O={B} ARCH={arch} olddefconfig'

layers/meta-kernel-block/recipes-core/images/balena-kernel-block.bb

@@ -3,7 +3,7 @@ LICENSE = "MIT"
 
 inherit balena-hostapp-extension
 
-IMAGE_INSTALL = "kernel-modules kernel-image kernel-devicetree"
+IMAGE_INSTALL = "kernel-modules kernel-image kernel-devicetree bpftool libbpf"
 
 IMAGE_LINGUAS = ""
 VIRTUAL-RUNTIME_init_manager = ""
@@ -14,6 +14,6 @@ remove_unnecessary_files() {
     rm -f ${IMAGE_ROOTFS}/bin ${IMAGE_ROOTFS}/sbin
     rm -rf ${IMAGE_ROOTFS}/etc
     rm -rf ${IMAGE_ROOTFS}/run
-    rm -rf ${IMAGE_ROOTFS}/usr/bin
+    rm -rf ${IMAGE_ROOTFS}/var
 }
 IMAGE_PREPROCESS_COMMAND += "remove_unnecessary_files;"

layers/meta-kernel-block/recipes-kernel/bpftool/bpftool.bbappend

@@ -0,0 +1 @@
+COMPATIBLE_HOST = "(x86_64|aarch64).*-linux"

layers/meta-kernel-block/recipes-kernel/linux/files/bpf-lsm-debug.cfg

@@ -0,0 +1,35 @@
+# BPF LSM + BTF + tracing/observability
+#
+# Enables the in-kernel BPF security module, BTF type information for
+# kernel introspection, always-on JIT, and the function/kprobe tracing
+# surface bpftrace/Tetragon-class agents need.
+#
+# These entries require =y kernel-config changes (LSM hook chain,
+# DEBUG_INFO). meta-kernel-modules-block could not have produced them.
+
+# Debug info / BTF prerequisites. Full DWARF is required for BTF.
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO_NONE is not set
+# CONFIG_DEBUG_INFO_REDUCED is not set
+CONFIG_DEBUG_INFO_BTF=y
+
+# BPF core. Most of these are typically already =y in modern defconfigs;
+# stating them explicitly keeps the fragment robust against base changes.
+CONFIG_BPF=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_BPF_JIT_ALWAYS_ON=y
+
+# BPF LSM. CONFIG_LSM is a comma-separated string of active LSMs; the
+# value below matches the upstream 5.18+ default with bpf included. If
+# the balena base defconfig has a custom LSM order, this overrides it.
+CONFIG_BPF_LSM=y
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf,integrity"
+
+# Tracing surface for observability.
+CONFIG_FTRACE=y
+CONFIG_FUNCTION_TRACER=y
+CONFIG_KPROBES=y
+CONFIG_KPROBE_EVENTS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_BPF_EVENTS=y

layers/meta-kernel-block/recipes-kernel/linux/files/kernel-extension.cfg

@@ -5,9 +5,21 @@
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
 
-# Track kernel-extension.cfg in the task hash so changes trigger re-execution.
+# Track every *.cfg fragment under files/ in the task hash so any fragment
+# edit triggers re-execution. The bbclass discovers fragments by glob; the
+# bbappend mirrors that discovery here for hash correctness.
+#
 # NOT in SRC_URI because Yocto would auto-merge .cfg files into the kernel
-# config — the bbclass applies it manually.
-do_kernel_extend_config[file-checksums] += "${THISDIR}/files/kernel-extension.cfg:True"
+# config — the bbclass applies them manually.
+python () {
+    import glob
+    import os
+    thisdir = d.getVar("THISDIR")
+    fragments = sorted(glob.glob(os.path.join(thisdir, "files", "*.cfg")))
+    d.appendVarFlag(
+        "do_kernel_extend_config", "file-checksums",
+        " " + " ".join(f"{p}:True" for p in fragments),
+    )
+}
 
 inherit kernel-extension