Fix Bindings and PerfEventArray

CMakeLists.txt

@@ -10,16 +10,27 @@ include_directories(${CMAKE_SOURCE_DIR}/src)
 add_subdirectory(pybind11)
 pybind11_add_module(
   pylibbpf
+
+  # Core
   src/core/bpf_program.h
   src/core/bpf_exception.h
   src/core/bpf_map.h
   src/core/bpf_object.h
-  src/core/bpf_perf_buffer.h
-  src/bindings/main.cpp
   src/core/bpf_program.cpp
   src/core/bpf_map.cpp
   src/core/bpf_object.cpp
-  src/core/bpf_perf_buffer.cpp)
+
+  # Maps
+  src/maps/perf_event_array.h
+  src/maps/perf_event_array.cpp
+
+  # Utils
+  src/utils/struct_parser.h
+  src/utils/struct_parser.cpp
+
+  # Bindings
+  src/bindings/main.cpp
+)
 
 # --- libbpf build rules ---
 set(LIBBPF_SRC_DIR ${CMAKE_CURRENT_SOURCE_DIR}/libbpf/src)

src/bindings/main.cpp

@@ -6,16 +6,17 @@ extern "C" {
 #include <libbpf.h>
 }
 
-#include "core/bpf_object.h"
-#include "core/bpf_program.h"
 #include "core/bpf_exception.h"
 #include "core/bpf_map.h"
-#include "core/bpf_perf_buffer.h"
+#include "core/bpf_object.h"
+#include "core/bpf_program.h"
+#include "maps/perf_event_array.h"
+#include "utils/struct_parser.h"
 
 namespace py = pybind11;
 
 PYBIND11_MODULE(pylibbpf, m) {
-    m.doc() = R"pbdoc(
+  m.doc() = R"pbdoc(
         Pylibbpf - libbpf bindings for Python
         -----------------------
 
@@ -29,56 +30,72 @@ PYBIND11_MODULE(pylibbpf, m) {
            BpfException
     )pbdoc";
 
-    // Register the custom exception
-    py::register_exception<BpfException>(m, "BpfException");
+  // Register the custom exception
+  py::register_exception<BpfException>(m, "BpfException");
 
-    // BpfObject
-    py::class_<BpfObject, std::shared_ptr<BpfObject>>(m, "BpfObject")
-        .def(py::init<std::string>(), py::arg("object_path"))
-        .def("load", &BpfObject::load)
-        .def("is_loaded", &BpfObject::is_loaded)
-        .def("get_program_names", &BpfObject::get_program_names)
-        .def("get_program", &BpfObject::get_program, py::arg("name"))
-        .def("attach_all", &BpfObject::attach_all)
-        .def("get_map_names", &BpfObject::get_map_names)
-        .def("get_map", &BpfObject::get_map, py::arg("name"));
+  // BpfObject
+  py::class_<BpfObject, std::shared_ptr<BpfObject>>(m, "BpfObject")
+      .def(py::init<std::string, py::dict>(), py::arg("object_path"),
+           py::arg("structs") = py::dict())
+      .def("load", &BpfObject::load)
+      .def("is_loaded", &BpfObject::is_loaded)
+      .def("get_program_names", &BpfObject::get_program_names)
+      .def("get_program", &BpfObject::get_program, py::arg("name"))
+      .def("attach_all", &BpfObject::attach_all)
+      .def("get_map_names", &BpfObject::get_map_names)
+      .def("get_map", &BpfObject::get_map, py::arg("name"))
+      .def("get_struct_defs", &BpfObject::get_struct_defs)
+      .def("__getitem__", &BpfObject::get_map, py::arg("name"));
 
-    // BpfProgram
-    py::class_<BpfProgram, std::shared_ptr<BpfProgram>>(m, "BpfProgram")
-        .def("attach", &BpfProgram::attach)
-        .def("detach", &BpfProgram::detach)
-        .def("is_attached", &BpfProgram::is_attached)
-        .def("get_name", &BpfProgram::get_name);
+  // BpfProgram
+  py::class_<BpfProgram, std::shared_ptr<BpfProgram>>(m, "BpfProgram")
+      .def("attach", &BpfProgram::attach)
+      .def("detach", &BpfProgram::detach)
+      .def("is_attached", &BpfProgram::is_attached)
+      .def("get_name", &BpfProgram::get_name);
 
-    // BpfMap
-    py::class_<BpfMap, std::shared_ptr<BpfMap>>(m, "BpfMap")
-        .def("lookup", &BpfMap::lookup, py::arg("key"))
-        .def("update", &BpfMap::update, py::arg("key"), py::arg("value"))
-        .def("delete_elem", &BpfMap::delete_elem, py::arg("key"))
-        .def("get_next_key", &BpfMap::get_next_key, py::arg("key") = py::none())
-        .def("items", &BpfMap::items)
-        .def("keys", &BpfMap::keys)
-        .def("values", &BpfMap::values)
-        .def("get_name", &BpfMap::get_name)
-        .def("get_fd", &BpfMap::get_fd)
-        .def("get_type", &BpfMap::get_type)
-        .def("get_key_size", &BpfMap::get_key_size)
-        .def("get_value_size", &BpfMap::get_value_size)
-        .def("get_max_entries", &BpfMap::get_max_entries);
+  // BpfMap
+  py::class_<BpfMap, std::shared_ptr<BpfMap>>(m, "BpfMap")
+      .def("lookup", &BpfMap::lookup, py::arg("key"))
+      .def("update", &BpfMap::update, py::arg("key"), py::arg("value"))
+      .def("delete_elem", &BpfMap::delete_elem, py::arg("key"))
+      .def("get_next_key", &BpfMap::get_next_key, py::arg("key") = py::none())
+      .def("items", &BpfMap::items)
+      .def("keys", &BpfMap::keys)
+      .def("values", &BpfMap::values)
+      .def("get_name", &BpfMap::get_name)
+      .def("get_fd", &BpfMap::get_fd)
+      .def("get_type", &BpfMap::get_type)
+      .def("get_key_size", &BpfMap::get_key_size)
+      .def("get_value_size", &BpfMap::get_value_size)
+      .def("get_max_entries", &BpfMap::get_max_entries)
+      .def("__getitem__", &BpfMap::lookup, py::arg("key"))
+      .def("__setitem__", &BpfMap::update, py::arg("key"), py::arg("value"));
 
-    py::class_<BpfPerfBuffer>(m, "BpfPerfBuffer")
-            .def(py::init<int, int, py::function, py::object>(),
-                 py::arg("map_fd"),
-                 py::arg("page_cnt") = 8,
-                 py::arg("callback"),
-                 py::arg("lost_callback") = py::none())
-            .def("poll", &BpfPerfBuffer::poll, py::arg("timeout_ms") = -1)
-            .def("consume", &BpfPerfBuffer::consume);
+  // StructParser
+  py::class_<StructParser>(m, "StructParser")
+      .def(py::init<py::dict>(), py::arg("structs"))
+      .def("parse", &StructParser::parse, py::arg("struct_name"),
+           py::arg("data"))
+      .def("has_struct", &StructParser::has_struct, py::arg("struct_name"));
 
+  // PerfEventArray
+  py::class_<PerfEventArray, std::shared_ptr<PerfEventArray>>(m,
+                                                              "PerfEventArray")
+      .def(py::init<std::shared_ptr<BpfMap>, int, py::function, py::object>(),
+           py::arg("map"), py::arg("page_cnt"), py::arg("callback"),
+           py::arg("lost_callback") = py::none())
+      .def(py::init<std::shared_ptr<BpfMap>, int, py::function, std::string,
+                    py::object>(),
+           py::arg("map"), py::arg("page_cnt"), py::arg("callback"),
+           py::arg("struct_name"), py::arg("lost_callback") = py::none())
+      .def("poll", &PerfEventArray::poll, py::arg("timeout_ms"))
+      .def("consume", &PerfEventArray::consume)
+      .def("get_map", &PerfEventArray::get_map);
 
 #ifdef VERSION_INFO
-    m.attr("__version__") = MACRO_STRINGIFY(VERSION_INFO);
+  m.attr("__version__") = MACRO_STRINGIFY(VERSION_INFO);
 #else
-    m.attr("__version__") = "dev";
+  m.attr("__version__") = "dev";
 #endif
 }

src/core/bpf_map.h

@@ -15,7 +15,7 @@ class BpfObject;
 
 namespace py = pybind11;
 
-class BpfMap {
+class BpfMap : public std::enable_shared_from_this<BpfMap> {
 private:
   std::weak_ptr<BpfObject> parent_obj_;
   struct bpf_map *map_;
@@ -62,6 +62,9 @@ public:
   [[nodiscard]] int get_key_size() const { return key_size_; };
   [[nodiscard]] int get_value_size() const { return value_size_; };
   [[nodiscard]] int get_max_entries() const;
+  [[nodiscard]] std::shared_ptr<BpfObject> get_parent() const {
+    return parent_obj_.lock();
+  }
 
 private:
   static void python_to_bytes_inplace(const py::object &obj,

src/core/bpf_object.cpp

@@ -2,10 +2,12 @@
 #include "bpf_exception.h"
 #include "bpf_map.h"
 #include "bpf_program.h"
+#include "utils/struct_parser.h"
 #include <cerrno>
 
-BpfObject::BpfObject(std::string object_path)
-    : obj_(nullptr), object_path_(std::move(object_path)), loaded_(false) {}
+BpfObject::BpfObject(std::string object_path, py::dict structs)
+    : obj_(nullptr), object_path_(std::move(object_path)), loaded_(false),
+      struct_defs_(structs), struct_parser_(nullptr) {}
 
 BpfObject::~BpfObject() {
   // Clear caches first (order matters!)
@@ -255,3 +257,11 @@ py::dict BpfObject::get_cached_maps() const {
   }
   return maps;
 }
+
+std::shared_ptr<StructParser> BpfObject::get_struct_parser() const {
+    if (!struct_parser_ && !struct_defs_.empty()) {
+        // Create parser on first access
+        struct_parser_ = std::make_shared<StructParser>(struct_defs_);
+    }
+    return struct_parser_;
+}

src/core/bpf_object.h

@@ -12,6 +12,7 @@ namespace py = pybind11;
 
 class BpfProgram;
 class BpfMap;
+class StructParser;
 
 /**
  * BpfObject - Represents a loaded BPF object file.
@@ -28,12 +29,14 @@ private:
   mutable std::unordered_map<std::string, std::shared_ptr<BpfMap>> maps_cache_;
   mutable std::unordered_map<std::string, std::shared_ptr<BpfProgram>>
       prog_cache_;
+  py::dict struct_defs_;
+  mutable std::shared_ptr<StructParser> struct_parser_;
 
   std::shared_ptr<BpfProgram> _get_or_create_program(struct bpf_program *prog);
   std::shared_ptr<BpfMap> _get_or_create_map(struct bpf_map *map);
 
 public:
-  explicit BpfObject(std::string object_path);
+  explicit BpfObject(std::string object_path, py::dict structs = py::dict());
   ~BpfObject();
 
   // Disable copy, allow move
@@ -77,6 +80,10 @@ public:
   [[nodiscard]] std::shared_ptr<BpfMap> get_map(const std::string &name);
   [[nodiscard]] struct bpf_map *find_map_by_name(const std::string &name) const;
   [[nodiscard]] py::dict get_cached_maps() const;
+
+  // Struct parsing
+  [[nodiscard]] py::dict get_struct_defs() const { return struct_defs_; }
+  [[nodiscard]] std::shared_ptr<StructParser> get_struct_parser() const;
 };
 
 #endif // PYLIBBPF_BPF_OBJECT_H

src/core/bpf_perf_buffer.cpp

@@ -1,80 +0,0 @@
-#include "bpf_perf_buffer.h"
-#include "bpf_exception.h"
-
-BpfPerfBuffer::BpfPerfBuffer(int map_fd, int page_cnt, py::function callback,
-                             py::object lost_callback)
-    : pb_(nullptr), callback_(std::move(callback)),
-      lost_callback_(lost_callback) {
-
-  if (page_cnt <= 0 || (page_cnt & (page_cnt - 1)) != 0) {
-    throw BpfException("page_cnt must be a positive power of 2");
-  }
-
-  struct perf_buffer_opts pb_opts = {};
-  pb_opts.sz = sizeof(pb_opts); // Required for forward compatibility
-
-  pb_ = perf_buffer__new(
-      map_fd, page_cnt,
-      sample_callback_wrapper,                                   // sample_cb
-      lost_callback.is_none() ? nullptr : lost_callback_wrapper, // lost_cb
-      this,                                                      // ctx
-      &pb_opts                                                   // opts
-  );
-
-  if (!pb_) {
-    throw BpfException("Failed to create perf buffer: " +
-                       std::string(std::strerror(errno)));
-  }
-}
-
-BpfPerfBuffer::~BpfPerfBuffer() {
-  if (pb_) {
-    perf_buffer__free(pb_);
-  }
-}
-
-void BpfPerfBuffer::sample_callback_wrapper(void *ctx, int cpu, void *data,
-                                            unsigned int size) {
-  auto *self = static_cast<BpfPerfBuffer *>(ctx);
-
-  // Acquire GIL for Python calls
-  py::gil_scoped_acquire acquire;
-
-  try {
-    // Convert data to Python bytes
-    py::bytes py_data(static_cast<const char *>(data), size);
-
-    // Call Python callback: callback(cpu, data, size)
-    self->callback_(cpu, py_data, size);
-  } catch (const py::error_already_set &e) {
-    PyErr_Print();
-  }
-}
-
-void BpfPerfBuffer::lost_callback_wrapper(void *ctx, int cpu,
-                                          unsigned long long cnt) {
-  auto *self = static_cast<BpfPerfBuffer *>(ctx);
-
-  if (self->lost_callback_.is_none()) {
-    return;
-  }
-
-  py::gil_scoped_acquire acquire;
-
-  try {
-    self->lost_callback_(cpu, cnt);
-  } catch (const py::error_already_set &e) {
-    PyErr_Print();
-  }
-}
-
-int BpfPerfBuffer::poll(int timeout_ms) {
-  // Release GIL during blocking poll
-  py::gil_scoped_release release;
-  return perf_buffer__poll(pb_, timeout_ms);
-}
-
-int BpfPerfBuffer::consume() {
-  py::gil_scoped_release release;
-  return perf_buffer__consume(pb_);
-}

src/core/bpf_perf_buffer.h

@@ -1,31 +0,0 @@
-#ifndef PYLIBBPF_BPF_PERF_BUFFER_H
-#define PYLIBBPF_BPF_PERF_BUFFER_H
-
-#include <libbpf.h>
-#include <pybind11/functional.h>
-#include <pybind11/pybind11.h>
-
-namespace py = pybind11;
-
-class BpfPerfBuffer {
-private:
-  struct perf_buffer *pb_;
-  py::function callback_;
-  py::function lost_callback_;
-
-  // Static callback wrappers for C API
-  static void sample_callback_wrapper(void *ctx, int cpu, void *data,
-                                      unsigned int size);
-  static void lost_callback_wrapper(void *ctx, int cpu, unsigned long long cnt);
-
-public:
-  BpfPerfBuffer(int map_fd, int page_cnt, py::function callback,
-                py::object lost_callback = py::none());
-  ~BpfPerfBuffer();
-
-  int poll(int timeout_ms);
-  int consume();
-  [[nodiscard]] int fd() const;
-};
-
-#endif // PYLIBBPF_BPF_PERF_BUFFER_H

src/maps/perf_event_array.cpp

@@ -0,0 +1,115 @@
+#include "perf_event_array.h"
+#include "core/bpf_exception.h"
+#include "core/bpf_map.h"
+#include "core/bpf_object.h"
+#include "utils/struct_parser.h"
+
+PerfEventArray::PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                               py::function callback, py::object lost_callback)
+    : map_(map), pb_(nullptr), callback_(std::move(callback)),
+      lost_callback_(lost_callback) {
+
+  if (map->get_type() != BPF_MAP_TYPE_PERF_EVENT_ARRAY) {
+    throw BpfException("Map '" + map->get_name() +
+                       "' is not a PERF_EVENT_ARRAY");
+  }
+
+  if (page_cnt <= 0 || (page_cnt & (page_cnt - 1)) != 0) {
+    throw BpfException("page_cnt must be a positive power of 2");
+  }
+
+  struct perf_buffer_opts pb_opts = {};
+  pb_opts.sz = sizeof(pb_opts); // Required for forward compatibility
+
+  pb_ = perf_buffer__new(
+      map->get_fd(), page_cnt,
+      sample_callback_wrapper,                                   // sample_cb
+      lost_callback.is_none() ? nullptr : lost_callback_wrapper, // lost_cb
+      this,                                                      // ctx
+      &pb_opts                                                   // opts
+  );
+
+  if (!pb_) {
+    throw BpfException("Failed to create perf buffer: " +
+                       std::string(std::strerror(errno)));
+  }
+}
+
+PerfEventArray::PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                               py::function callback,
+                               const std::string &struct_name,
+                               py::object lost_callback)
+    : PerfEventArray(map, page_cnt, callback, lost_callback) {
+
+  auto parent = map->get_parent();
+  if (!parent) {
+    throw BpfException("Parent BpfObject has been destroyed");
+  }
+
+  parser_ = parent->get_struct_parser();
+  struct_name_ = struct_name;
+
+  if (!parser_) {
+    throw BpfException("No struct definitions available");
+  }
+}
+
+PerfEventArray::~PerfEventArray() {
+  if (pb_) {
+    perf_buffer__free(pb_);
+  }
+}
+
+void PerfEventArray::sample_callback_wrapper(void *ctx, int cpu, void *data,
+                                             unsigned int size) {
+  auto *self = static_cast<PerfEventArray *>(ctx);
+
+  // Acquire GIL for Python calls
+  py::gil_scoped_acquire acquire;
+
+  try {
+    // Convert data to Python bytes
+    py::bytes py_data(static_cast<const char *>(data), size);
+
+    if (self->parser_ && !self->struct_name_.empty()) {
+      py::object event = self->parser_->parse(self->struct_name_, py_data);
+      self->callback_(cpu, event);
+    } else {
+      self->callback_(cpu, py_data);
+    }
+
+  } catch (const py::error_already_set &e) {
+    PyErr_Print();
+  } catch (const std::exception &e) {
+    py::gil_scoped_acquire acquire;
+    py::print("C++ error in perf callback:", e.what());
+  }
+}
+
+void PerfEventArray::lost_callback_wrapper(void *ctx, int cpu,
+                                           unsigned long long cnt) {
+  auto *self = static_cast<PerfEventArray *>(ctx);
+
+  if (self->lost_callback_.is_none()) {
+    return;
+  }
+
+  py::gil_scoped_acquire acquire;
+
+  try {
+    self->lost_callback_(cpu, cnt);
+  } catch (const py::error_already_set &e) {
+    PyErr_Print();
+  }
+}
+
+int PerfEventArray::poll(int timeout_ms) {
+  // Release GIL during blocking poll
+  py::gil_scoped_release release;
+  return perf_buffer__poll(pb_, timeout_ms);
+}
+
+int PerfEventArray::consume() {
+  py::gil_scoped_release release;
+  return perf_buffer__consume(pb_);
+}

src/maps/perf_event_array.h

@@ -0,0 +1,46 @@
+#ifndef PYLIBBPF_PERF_EVENT_ARRAY_H
+#define PYLIBBPF_PERF_EVENT_ARRAY_H
+
+#include <libbpf.h>
+#include <pybind11/functional.h>
+#include <pybind11/pybind11.h>
+#include <string>
+
+class StructParser;
+class BpfMap;
+
+namespace py = pybind11;
+
+class PerfEventArray {
+private:
+  std::shared_ptr<BpfMap> map_;
+  struct perf_buffer *pb_;
+  py::function callback_;
+  py::function lost_callback_;
+
+  std::shared_ptr<StructParser> parser_;
+  std::string struct_name_;
+
+  // Static callback wrappers for C API
+  static void sample_callback_wrapper(void *ctx, int cpu, void *data,
+                                      unsigned int size);
+  static void lost_callback_wrapper(void *ctx, int cpu, unsigned long long cnt);
+
+public:
+  PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                 py::function callback, py::object lost_callback = py::none());
+  PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                 py::function callback, const std::string &struct_name,
+                 py::object lost_callback = py::none());
+  ~PerfEventArray();
+
+  PerfEventArray(const PerfEventArray &) = delete;
+  PerfEventArray &operator=(const PerfEventArray &) = delete;
+
+  int poll(int timeout_ms);
+  int consume();
+
+  [[nodiscard]] std::shared_ptr<BpfMap> get_map() const { return map_; }
+};
+
+#endif // PYLIBBPF_PERF_EVENT_ARRAY_H

src/utils/struct_parser.cpp

@@ -0,0 +1,25 @@
+#include "struct_parser.h"
+#include "core/bpf_exception.h"
+
+StructParser::StructParser(py::dict structs) {
+  for (auto item : structs) {
+    std::string name = py::str(item.first);
+    struct_types_[name] = py::reinterpret_borrow<py::object>(item.second);
+  }
+}
+
+py::object StructParser::parse(const std::string &struct_name, py::bytes data) {
+  auto it = struct_types_.find(struct_name);
+  if (it == struct_types_.end()) {
+    throw BpfException("Unknown struct: " + struct_name);
+  }
+
+  py::object struct_type = it->second;
+
+  // Use ctypes.from_buffer_copy() to create struct from bytes
+  return struct_type.attr("from_buffer_copy")(data);
+}
+
+bool StructParser::has_struct(const std::string &struct_name) const {
+  return struct_types_.find(struct_name) != struct_types_.end();
+}

src/utils/struct_parser.h

@@ -0,0 +1,20 @@
+#ifndef PYLIBBPF_STRUCT_PARSER_H
+#define PYLIBBPF_STRUCT_PARSER_H
+
+#include <pybind11/pybind11.h>
+#include <string>
+#include <unordered_map>
+
+namespace py = pybind11;
+
+class StructParser {
+private:
+  std::unordered_map<std::string, py::object> struct_types_;
+
+public:
+  explicit StructParser(py::dict structs);
+  py::object parse(const std::string &struct_name, py::bytes data);
+  bool has_struct(const std::string &struct_name) const;
+};
+
+#endif