Generic Probe Support: Add kprobe Functionality Alongside exiting uprobes

[manuelfelipe]

Summary

Refactors probe infrastructure introduced in open-telemetry#651 to support kprobes, kretprobes, uprobes, and uretprobes through a unified interface. Previously only uprobes were supported.

Motivation

We wanted to understand what causes shared memory pages to turn into private memory pages (copy-on-write) in our Ruby workers. Pitchfork workers start with everything shared post-fork but quickly grow private memory as requests come in.

Being able to attach kprobes to kernel functions like do_wp_page allows us to capture stack traces when CoW events occur, showing exactly which Ruby code is causing pages to be copied. This data could help us identify memory hotspots and optimization opportunities.

Previous uprobe-only support limited profiling to user space functions. Adding kprobe support enables profiling kernel-level events (page faults, syscalls, etc.) alongside regular CPU profiling, giving a complete picture of system behavior.

What Changed

Renamed uprobe-specific code to generic probe terminology:

• --uprobe-link → --probe-link flag
• UProbeLinks → ProbeLinks config
• TraceOriginUProbe → TraceOriginProbe
• support/ebpf/uprobe.ebpf.c → generic_probe.ebpf.c

Added kprobe support:

• New kprobe__generic eBPF entry point
• Unified probe attachment logic in tracer/probe.go
• Support for kprobe/kretprobe/uprobe/uretprobe types

Enhanced probe-ctrl tool:

• Works with all probe types
• Added --list flag to show loaded eBPF programs
• Better error messages

Usage

# Attach to kernel function
./ebpf-profiler -collection-agent=127.0.0.1:11000 -disable-tls -probe-link "kprobe:do_wp_page`

# Attach to user space function  
./ebpf-profiler -collection-agent=127.0.0.1:11000 -disable-tls -probe-link "uprobe:/root/ebpf-profiler:runtime.(*mheap).alloc"

Running ^ locally, with traces going to devfiler:

[dalehamel]

One minor nitpick, this looks great overall.

Curious what caused all the mod changes?

It would be good for the upstream PR description to also include a real world example we are using this for, describing the CoW debugging that was the motivation for facilitating this

[manuelfelipe]

Curious what caused all the mod changes?

before https://github.com/Shopify/opentelemetry-ebpf-profiler/pull/9/files#diff-411cc25513d351cd98dba8360c35b0cec01c0271246e3b15c71e3626eb63edc6R14, probe-ctrl was not actually importing the ebpf-profiler package and had its own code to load the program. Changed it to have the parsing and loading logic in the tracer pkg and using that from probe-ctrl side