meta-kernel-block: add BPF support

Change-type: patch
Signed-off-by: Alex Gonzalez <alexg@balena.io>

Author: alexgg

layers/meta-kernel-block/recipes-core/images/balena-kernel-block.bb

@@ -3,7 +3,7 @@ LICENSE = "MIT"
 
 inherit balena-hostapp-extension
 
-IMAGE_INSTALL = "kernel-extension-modules kernel-extension-image-initramfs kernel-extension-devicetree"
+IMAGE_INSTALL = "kernel-extension-modules kernel-extension-image-initramfs kernel-extension-devicetree bpftool libbpf"
 
 IMAGE_LINGUAS = ""
 VIRTUAL-RUNTIME_init_manager = ""

layers/meta-kernel-block/recipes-kernel/bpftool/bpftool.bbappend

@@ -0,0 +1 @@
+COMPATIBLE_HOST = "(x86_64|aarch64).*-linux"

layers/meta-kernel-block/recipes-kernel/linux/files/bpf-lsm-debug.cfg

@@ -0,0 +1,35 @@
+# BPF LSM + BTF + tracing/observability
+#
+# Enables the in-kernel BPF security module, BTF type information for
+# kernel introspection, always-on JIT, and the function/kprobe tracing
+# surface bpftrace/Tetragon-class agents need.
+#
+# These entries require =y kernel-config changes (LSM hook chain,
+# DEBUG_INFO). meta-kernel-modules-block could not have produced them.
+
+# Debug info / BTF prerequisites. Full DWARF is required for BTF.
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO_NONE is not set
+# CONFIG_DEBUG_INFO_REDUCED is not set
+CONFIG_DEBUG_INFO_BTF=y
+
+# BPF core. Most of these are typically already =y in modern defconfigs;
+# stating them explicitly keeps the fragment robust against base changes.
+CONFIG_BPF=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_BPF_JIT_ALWAYS_ON=y
+
+# BPF LSM. CONFIG_LSM is a comma-separated string of active LSMs; the
+# value below matches the upstream 5.18+ default with bpf included. If
+# the balena base defconfig has a custom LSM order, this overrides it.
+CONFIG_BPF_LSM=y
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf,integrity"
+
+# Tracing surface for observability.
+CONFIG_FTRACE=y
+CONFIG_FUNCTION_TRACER=y
+CONFIG_KPROBES=y
+CONFIG_KPROBE_EVENTS=y
+CONFIG_PERF_EVENTS=y
+CONFIG_BPF_EVENTS=y