Make bytes_to_python const non-static

Add userspace utils for Structs and maps, starting with PERF_EVENT_ARRAY

.github/workflows/pip.yml

@@ -1,29 +1,38 @@
 name: Pip
 
 on:
-  workflow_dispatch:
-  pull_request:
   push:
-    branches:
+    branches: [main, master]
-      - master
+  pull_request:
-      - main
+    branches: [main, master]
+  workflow_dispatch:
 
 jobs:
-  build:
+  test:
+    name: Test on Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        platform: [ubuntu-latest]
+        python-version: ['3.12', '3.13']
-        python-version: ["3.8", "3.12"]
-
-    runs-on: ${{ matrix.platform }}
 
     steps:
-    - uses: actions/checkout@v5
+    - name: Checkout code
+      uses: actions/checkout@v5
       with:
-        submodules: true
+        submodules: recursive
 
-    - uses: actions/setup-python@v6
+    - name: Verify submodules
+      run: |
+        echo "Checking submodule status:"
+        git submodule status
+        echo "Checking libbpf directory:"
+        ls -la libbpf/
+        echo "Checking libbpf/src:"
+        ls -la libbpf/src/ || echo "libbpf/src not found!"
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -33,19 +42,72 @@ jobs:
         sudo apt-get install -y \
           libbpf-dev \
           libelf-dev \
-          linux-headers-generic \
+          zlib1g-dev \
           build-essential \
+          clang \
           cmake \
-          ninja-build
+          ninja-build \
+          pkg-config \
+          git \
+          make
 
-    - name: Add requirements
+    - name: Install Python build dependencies
-      run: python -m pip install --upgrade pip wheel setuptools
+      run: |
+        python -m pip install --upgrade pip
+        pip install --upgrade "setuptools>=77.0.0" wheel
+        pip install cmake ninja pybind11
 
-    - name: Build and install
+    - name: Check build requirements
-      run: pip install --verbose .[test]
+      run: |
+        echo "Python version:"
+        python --version
+        echo "CMake version:"
+        cmake --version
+        echo "Ninja version:"
+        ninja --version
+        echo "Setuptools version:"
+        python -c "import setuptools; print(setuptools.__version__)"
 
-    - name: Test import
+    - name: Build and install pylibbpf (verbose)
-      run: python -c "import pylibbpf; print('Import successful')"
+      run: |
+        pip install -v -e . 2>&1 | tee build.log
+      continue-on-error: false
 
-    - name: Test
+    - name: Check build output
-      run: python -m pytest -v
+      run: |
+        echo "Build directory contents:"
+        find build -type f -name "*.so" 2>/dev/null || echo "No .so files found in build/"
+        echo ""
+        echo "Looking for pylibbpf extension:"
+        find . -name "pylibbpf*.so" -o -name "pylibbpf*.pyd"
+        echo ""
+        echo "Site-packages contents:"
+        python -c "import site; print(site.getsitepackages())"
+        ls -la $(python -c "import site; print(site.getsitepackages()[0])")/pylibbpf/ || echo "pylibbpf not in site-packages"
+
+    - name: Try importing extension directly
+      run: |
+        python -c "
+        import sys
+        print('Python path:', sys.path)
+        try:
+            from pylibbpf import pylibbpf
+            print('Successfully imported pylibbpf.pylibbpf')
+            print('pylibbpf.pylibbpf members:', dir(pylibbpf))
+        except ImportError as e:
+            print(f'Failed to import pylibbpf.pylibbpf: {e}')
+        "
+
+    - name: Verify extension loaded
+      run: |
+        python -c "import pylibbpf; print('Members:', dir(pylibbpf)); assert hasattr(pylibbpf, 'BpfObject'), 'BpfObject not found!'; print('✓ OK')"
+
+    - name: Install test dependencies
+      if: success()
+      run: |
+        pip install pytest pytest-cov
+
+    - name: Run tests
+      if: success()
+      run: |
+        python -I -m pytest -v -s --cov=pylibbpf --cov-report=term-missing

.github/workflows/wheels.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
-        submodules: true
+        submodules: recursive
 
     - name: Build SDist
       run: pipx run build --sdist
@@ -41,22 +41,24 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
-        submodules: true
+        submodules: recursive
 
     - name: Build wheels
       uses: pypa/cibuildwheel@v3.2
       env:
         CIBW_PLATFORM: linux
         CIBW_ARCHS_LINUX: ${{ matrix.arch }}
-        CIBW_BUILD: "cp38-* cp311-*"
+        CIBW_BUILD: "cp312-* cp313-*"
         CIBW_SKIP: "*-musllinux*"
-        CIBW_TEST_COMMAND: "python -c 'import pylibbpf; print(f\"pylibbpf {pylibbpf.__version__} imported successfully\")'"
+        CIBW_TEST_COMMAND: "python -c 'import pylibbpf; assert hasattr(pylibbpf, \"BpfObject\"), \"BpfObject not found\"; print(f\"pylibbpf {pylibbpf.__version__} OK\")'"
         CIBW_TEST_SKIP: "*-linux_aarch64"
 
         CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
 
         CIBW_BEFORE_ALL_LINUX: |
-          dnf install -y elfutils-libelf-devel zlib-devel
+          dnf install -y elfutils-libelf-devel zlib-devel make gcc gcc-c++ git
+        CIBW_BEFORE_BUILD: >
+          pip install --upgrade "setuptools>=77.0.0" wheel cmake ninja pybind11
 
     - name: Verify clean directory
       run: git diff --exit-code

CMakeLists.txt

@@ -5,21 +5,32 @@ set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CXX_EXTENSIONS OFF)
 
+find_package(
+  Python
+  COMPONENTS Interpreter Development.Module
+  REQUIRED)
+
 # pybind11
 include_directories(${CMAKE_SOURCE_DIR}/src)
 add_subdirectory(pybind11)
 pybind11_add_module(
   pylibbpf
+  # Core
   src/core/bpf_program.h
   src/core/bpf_exception.h
   src/core/bpf_map.h
   src/core/bpf_object.h
-  src/core/bpf_perf_buffer.h
-  src/bindings/main.cpp
   src/core/bpf_program.cpp
   src/core/bpf_map.cpp
   src/core/bpf_object.cpp
-  src/core/bpf_perf_buffer.cpp)
+  # Maps
+  src/maps/perf_event_array.h
+  src/maps/perf_event_array.cpp
+  # Utils
+  src/utils/struct_parser.h
+  src/utils/struct_parser.cpp
+  # Bindings
+  src/bindings/main.cpp)
 
 # --- libbpf build rules ---
 set(LIBBPF_SRC_DIR ${CMAKE_CURRENT_SOURCE_DIR}/libbpf/src)

examples/execve.py

@@ -1,10 +1,11 @@
 import time
 from ctypes import c_int32, c_int64, c_uint64, c_void_p
 
-from pylibbpf import BpfMap
 from pythonbpf import BPF, bpf, bpfglobal, map, section
 from pythonbpf.maps import HashMap
 
+from pylibbpf import BpfMap
+
 
 @bpf
 @map

pylibbpf/__init__.py

@@ -0,0 +1,46 @@
+import logging
+
+from .ir_to_ctypes import convert_structs_to_ctypes, is_pythonbpf_structs
+from .pylibbpf import (
+    BpfException,
+    BpfMap,
+    BpfProgram,
+    PerfEventArray,
+    StructParser,
+)
+from .pylibbpf import (
+    BpfObject as _BpfObject,  # C++ object (internal)
+)
+from .wrappers import BpfObjectWrapper
+
+logger = logging.getLogger(__name__)
+
+
+class BpfObject(BpfObjectWrapper):
+    """BpfObject with automatic struct conversion"""
+
+    def __init__(self, object_path: str, structs=None):
+        """Create a BPF object"""
+        if structs is None:
+            structs = {}
+        elif is_pythonbpf_structs(structs):
+            logger.info(f"Auto-converting {len(structs)} PythonBPF structs to ctypes")
+            structs = convert_structs_to_ctypes(structs)
+
+        # Create C++ BpfObject with converted structs
+        cpp_obj = _BpfObject(object_path, structs)
+
+        # Initialize wrapper
+        super().__init__(cpp_obj)
+
+
+__all__ = [
+    "BpfObject",
+    "BpfProgram",
+    "BpfMap",
+    "PerfEventArray",
+    "StructParser",
+    "BpfException",
+]
+
+__version__ = "0.0.6"

pylibbpf/ir_to_ctypes.py

@@ -0,0 +1,104 @@
+import ctypes
+import logging
+
+from llvmlite import ir
+
+logger = logging.getLogger(__name__)
+
+
+def ir_type_to_ctypes(ir_type):
+    """Convert LLVM IR type to ctypes type."""
+    if isinstance(ir_type, ir.IntType):
+        width = ir_type.width
+        type_map = {
+            8: ctypes.c_uint8,
+            16: ctypes.c_uint16,
+            32: ctypes.c_uint32,
+            64: ctypes.c_uint64,
+        }
+        if width not in type_map:
+            raise ValueError(f"Unsupported integer width: {width}")
+        return type_map[width]
+
+    elif isinstance(ir_type, ir.ArrayType):
+        count = ir_type.count
+        element_type_ir = ir_type.element
+
+        if isinstance(element_type_ir, ir.IntType) and element_type_ir.width == 8:
+            # Use c_char for string fields (will have .decode())
+            return ctypes.c_char * count
+        else:
+            element_type = ir_type_to_ctypes(element_type_ir)
+            return element_type * count
+    elif isinstance(ir_type, ir.PointerType):
+        return ctypes.c_void_p
+
+    else:
+        raise TypeError(f"Unsupported IR type: {ir_type}")
+
+
+def _make_repr(struct_name: str, fields: list):
+    """Create a __repr__ function for a struct"""
+
+    def __repr__(self):
+        field_strs = []
+        for field_name, _ in fields:
+            value = getattr(self, field_name)
+            field_strs.append(f"{field_name}={value}")
+        return f"<{struct_name} {' '.join(field_strs)}>"
+
+    return __repr__
+
+
+def convert_structs_to_ctypes(structs_sym_tab) -> dict[str, type[ctypes.Structure]]:
+    """Convert PythonBPF's structs_sym_tab to ctypes.Structure classes."""
+    if not structs_sym_tab:
+        return {}
+
+    ctypes_structs = {}
+
+    for struct_name, struct_type_obj in structs_sym_tab.items():
+        try:
+            fields = []
+            for field_name, field_ir_type in struct_type_obj.fields.items():
+                field_ctypes = ir_type_to_ctypes(field_ir_type)
+                fields.append((field_name, field_ctypes))
+
+            repr_func = _make_repr(struct_name, fields)
+
+            struct_class = type(
+                struct_name,
+                (ctypes.Structure,),
+                {
+                    "_fields_": fields,
+                    "__module__": "pylibbpf.ir_to_ctypes",
+                    "__doc__": f"Auto-generated ctypes structure for {struct_name}",
+                    "__repr__": repr_func,
+                },
+            )
+
+            ctypes_structs[struct_name] = struct_class
+            # Pretty print field info
+            field_info = ", ".join(f"{name}: {typ.__name__}" for name, typ in fields)
+            logger.debug(f"  {struct_name}({field_info})")
+        except Exception as e:
+            logger.error(f"Failed to convert struct '{struct_name}': {e}")
+            raise
+    logger.info(f"Converted struct '{struct_name}' to ctypes")
+    return ctypes_structs
+
+
+def is_pythonbpf_structs(structs) -> bool:
+    """Check if structs dict is from PythonBPF."""
+    if not isinstance(structs, dict) or not structs:
+        return False
+
+    first_value = next(iter(structs.values()))
+    return (
+        hasattr(first_value, "ir_type")
+        and hasattr(first_value, "fields")
+        and hasattr(first_value, "size")
+    )
+
+
+__all__ = ["convert_structs_to_ctypes", "is_pythonbpf_structs"]

pylibbpf/wrappers.py

@@ -0,0 +1,77 @@
+from collections.abc import Callable
+
+
+class PerfEventArrayHelper:
+    """Fluent wrapper for PERF_EVENT_ARRAY maps."""
+
+    def __init__(self, bpf_map):
+        self._map = bpf_map
+        self._perf_buffer = None
+
+    def open_perf_buffer(
+        self,
+        callback: Callable,
+        struct_name: str = "",
+        page_cnt: int = 8,
+        lost_callback: Callable | None = None,
+    ):
+        """Open perf buffer with auto-deserialization."""
+        from .pylibbpf import PerfEventArray
+
+        if struct_name:
+            self._perf_buffer = PerfEventArray(
+                self._map,
+                page_cnt,
+                callback,
+                struct_name,
+                lost_callback or (lambda cpu, cnt: None),
+            )
+        else:
+            self._perf_buffer = PerfEventArray(
+                self._map, page_cnt, callback, lost_callback or (lambda cpu, cnt: None)
+            )
+
+        return self
+
+    def poll(self, timeout_ms: int = -1) -> int:
+        if not self._perf_buffer:
+            raise RuntimeError("Call open_perf_buffer() first")
+        return self._perf_buffer.poll(timeout_ms)
+
+    def consume(self) -> int:
+        if not self._perf_buffer:
+            raise RuntimeError("Call open_perf_buffer() first")
+        return self._perf_buffer.consume()
+
+    def __getattr__(self, name):
+        return getattr(self._map, name)
+
+
+class BpfObjectWrapper:
+    """Smart wrapper that returns map-specific helpers."""
+
+    BPF_MAP_TYPE_PERF_EVENT_ARRAY = 4
+    BPF_MAP_TYPE_RINGBUF = 27
+
+    def __init__(self, bpf_object):
+        self._obj = bpf_object
+        self._map_helpers = {}
+
+    def __getitem__(self, name: str):
+        """Return appropriate helper based on map type."""
+        if name in self._map_helpers:
+            return self._map_helpers[name]
+
+        map_obj = self._obj[name]
+        map_type = map_obj.get_type()
+
+        if map_type == self.BPF_MAP_TYPE_PERF_EVENT_ARRAY:
+            helper = PerfEventArrayHelper(map_obj)
+        else:
+            helper = map_obj
+
+        self._map_helpers[name] = helper
+        return helper
+
+    def __getattr__(self, name):
+        return getattr(self._obj, name)

pyproject.toml

@@ -1,23 +1,24 @@
 [build-system]
 requires = [
-    "setuptools>=42",
+    "setuptools>=77",
     "wheel",
     "ninja",
     "cmake>=4.0",
+    "pybind11>=2.10",
 ]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "pylibbpf"
-version = "0.0.5"
+version = "0.0.6"
 description = "Python Bindings for Libbpf"
 authors = [
     { name = "r41k0u", email = "pragyanshchaturvedi18@gmail.com" },
     { name = "varun-r-mallya", email = "varunrmallya@gmail.com" }
 ]
 readme = "README.md"
-license = { file = "LICENSE" }
+license = "Apache-2.0"
-requires-python = ">=3.8"
+requires-python = ">=3.12"
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
@@ -28,22 +29,26 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "Programming Language :: C++",
     "Topic :: Software Development :: Libraries :: Python Modules",
     "Topic :: System :: Operating System Kernels :: Linux",
 ]
+dependencies = [
+    "llvmlite>=0.40.0",
+]
 
 [project.optional-dependencies]
 test = ["pytest>=6.0"]
 
 [project.urls]
-Homepage = "https://github.com/varun-r-mallya/pylibbpf"
+Homepage = "https://github.com/pythonbpf/pylibbpf"
-Repository = "https://github.com/varun-r-mallya/pylibbpf"
+Repository = "https://github.com/pythonbpf/pylibbpf"
-Issues = "https://github.com/varun-r-mallya/pylibbpf/issues"
+Issues = "https://github.com/pythonbpf/pylibbpf/issues"
 
 [tool.mypy]
 files = "setup.py"
-python_version = "3.8"
+python_version = "3.12"
 strict = true
 show_error_codes = true
 enable_error_code = ["ignore-without-code", "redundant-expr", "truthy-bool"]
@@ -64,7 +69,7 @@ filterwarnings = [
 testpaths = ["tests"]
 
 [tool.ruff]
-target-version = "py38"
+target-version = "py312"
 line-length = 88
 
 [tool.ruff.lint]
@@ -75,3 +80,7 @@ extend-select = [
     "RUF", # Ruff-specific
     "UP", # pyupgrade
 ]
+
+[tool.setuptools]
+packages = ["pylibbpf"]
+package-data = {"pylibbpf" = ["*.py", "*.so", "*.pyd", "py.typed"]}

setup.py

@@ -6,14 +6,6 @@ from pathlib import Path
 from setuptools import Extension, setup
 from setuptools.command.build_ext import build_ext
 
-# Convert distutils Windows platform specifiers to CMake -A arguments
-PLAT_TO_CMAKE = {
-    "win32": "Win32",
-    "win-amd64": "x64",
-    "win-arm32": "ARM",
-    "win-arm64": "ARM64",
-}
-
 
 # A CMakeExtension needs a sourcedir instead of a file list.
 # The name must be the _single_ output extension from the CMake build.
@@ -45,8 +37,8 @@ class CMakeBuild(build_ext):
         # from Python.
         cmake_args = [
             f"-DCMAKE_LIBRARY_OUTPUT_DIRECTORY={extdir}{os.sep}",
-            f"-DPYTHON_EXECUTABLE={sys.executable}",
             f"-DCMAKE_BUILD_TYPE={cfg}",  # not used on MSVC, but no harm
+            f"-DPython_EXECUTABLE={sys.executable}",
         ]
         build_args = []
 
@@ -122,31 +114,6 @@ if readme_path.exists():
     long_description = readme_path.read_text(encoding="utf-8")
 
 setup(
-    name="pylibbpf",
+    ext_modules=[CMakeExtension("pylibbpf.pylibbpf")],
-    version="0.0.1",
-    author="varun-r-mallya, r41k0u",
-    author_email="varunrmallyagmail.com",
-    description="Python Bindings for Libbpf",
-    long_description=long_description,
-    long_description_content_type="text/markdown",
-    url="https://github.com/varun-r-mallya/pylibbpf",
-    ext_modules=[CMakeExtension("pylibbpf")],
     cmdclass={"build_ext": CMakeBuild},
-    zip_safe=False,
-    classifiers=[
-        "Development Status :: 3 - Alpha",
-        "Intended Audience :: Developers",
-        "Operating System :: POSIX :: Linux",
-        "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.8",
-        "Programming Language :: Python :: 3.9",
-        "Programming Language :: Python :: 3.10",
-        "Programming Language :: Python :: 3.11",
-        "Programming Language :: Python :: 3.12",
-        "Programming Language :: C++",
-        "Topic :: Software Development :: Libraries :: Python Modules",
-        "Topic :: System :: Operating System Kernels :: Linux",
-    ],
-    extras_require={"test": ["pytest>=6.0"]},
-    python_requires=">=3.8",
 )

src/bindings/main.cpp

@@ -2,20 +2,17 @@
 #define STRINGIFY(x) #x
 #define MACRO_STRINGIFY(x) STRINGIFY(x)
 
-extern "C" {
-#include <libbpf.h>
-}
-
-#include "core/bpf_object.h"
-#include "core/bpf_program.h"
 #include "core/bpf_exception.h"
 #include "core/bpf_map.h"
-#include "core/bpf_perf_buffer.h"
+#include "core/bpf_object.h"
+#include "core/bpf_program.h"
+#include "maps/perf_event_array.h"
+#include "utils/struct_parser.h"
 
 namespace py = pybind11;
 
 PYBIND11_MODULE(pylibbpf, m) {
-    m.doc() = R"pbdoc(
+  m.doc() = R"pbdoc(
         Pylibbpf - libbpf bindings for Python
         -----------------------
 
@@ -29,56 +26,77 @@ PYBIND11_MODULE(pylibbpf, m) {
            BpfException
     )pbdoc";
 
-    // Register the custom exception
+  // Register the custom exception
-    py::register_exception<BpfException>(m, "BpfException");
+  py::register_exception<BpfException>(m, "BpfException");
 
-    // BpfObject
+  // BpfObject
-    py::class_<BpfObject, std::shared_ptr<BpfObject>>(m, "BpfObject")
+  py::class_<BpfObject, std::shared_ptr<BpfObject>>(m, "BpfObject")
-        .def(py::init<std::string>(), py::arg("object_path"))
+      .def(py::init<std::string, py::dict>(), py::arg("object_path"),
-        .def("load", &BpfObject::load)
+           py::arg("structs") = py::dict())
-        .def("is_loaded", &BpfObject::is_loaded)
+      .def("load", &BpfObject::load)
-        .def("get_program_names", &BpfObject::get_program_names)
+      .def("is_loaded", &BpfObject::is_loaded)
-        .def("get_program", &BpfObject::get_program, py::arg("name"))
+      .def("get_program_names", &BpfObject::get_program_names)
-        .def("attach_all", &BpfObject::attach_all)
+      .def("get_program", &BpfObject::get_program, py::arg("name"))
-        .def("get_map_names", &BpfObject::get_map_names)
+      .def("attach_all", &BpfObject::attach_all)
-        .def("get_map", &BpfObject::get_map, py::arg("name"));
+      .def("get_map_names", &BpfObject::get_map_names)
+      .def("get_map", &BpfObject::get_map, py::arg("name"))
+      .def("get_struct_defs", &BpfObject::get_struct_defs)
+      .def("__getitem__", &BpfObject::get_map, py::arg("name"));
 
-    // BpfProgram
+  // BpfProgram
-    py::class_<BpfProgram, std::shared_ptr<BpfProgram>>(m, "BpfProgram")
+  py::class_<BpfProgram, std::shared_ptr<BpfProgram>>(m, "BpfProgram")
-        .def("attach", &BpfProgram::attach)
+      .def("attach", &BpfProgram::attach)
-        .def("detach", &BpfProgram::detach)
+      .def("detach", &BpfProgram::detach)
-        .def("is_attached", &BpfProgram::is_attached)
+      .def("is_attached", &BpfProgram::is_attached)
-        .def("get_name", &BpfProgram::get_name);
+      .def("get_name", &BpfProgram::get_name);
 
-    // BpfMap
+  // BpfMap
-    py::class_<BpfMap, std::shared_ptr<BpfMap>>(m, "BpfMap")
+  py::class_<BpfMap, std::shared_ptr<BpfMap>>(m, "BpfMap")
-        .def("lookup", &BpfMap::lookup, py::arg("key"))
+      .def("lookup", &BpfMap::lookup, py::arg("key"))
-        .def("update", &BpfMap::update, py::arg("key"), py::arg("value"))
+      .def("update", &BpfMap::update, py::arg("key"), py::arg("value"))
-        .def("delete_elem", &BpfMap::delete_elem, py::arg("key"))
+      .def("delete_elem", &BpfMap::delete_elem, py::arg("key"))
-        .def("get_next_key", &BpfMap::get_next_key, py::arg("key") = py::none())
+      .def("get_next_key", &BpfMap::get_next_key, py::arg("key") = py::none())
-        .def("items", &BpfMap::items)
+      .def("items", &BpfMap::items)
-        .def("keys", &BpfMap::keys)
+      .def("keys", &BpfMap::keys)
-        .def("values", &BpfMap::values)
+      .def("values", &BpfMap::values)
-        .def("get_name", &BpfMap::get_name)
+      .def("get_name", &BpfMap::get_name)
-        .def("get_fd", &BpfMap::get_fd)
+      .def("get_fd", &BpfMap::get_fd)
-        .def("get_type", &BpfMap::get_type)
+      .def("get_type", &BpfMap::get_type)
-        .def("get_key_size", &BpfMap::get_key_size)
+      .def("get_key_size", &BpfMap::get_key_size)
-        .def("get_value_size", &BpfMap::get_value_size)
+      .def("get_value_size", &BpfMap::get_value_size)
-        .def("get_max_entries", &BpfMap::get_max_entries);
+      .def("get_max_entries", &BpfMap::get_max_entries)
+      .def("set_value_struct", &BpfMap::set_value_struct,
+           py::arg("struct_name"))
+      .def("get_value_struct_name", &BpfMap::get_value_struct_name)
+      .def("has_struct_value", &BpfMap::has_struct_value)
+      .def("__getitem__", &BpfMap::lookup, py::arg("key"))
+      .def("__setitem__", &BpfMap::update, py::arg("key"), py::arg("value"))
+      .def("__delitem__", &BpfMap::delete_elem, py::arg("key"));
 
-    py::class_<BpfPerfBuffer>(m, "BpfPerfBuffer")
+  // StructParser
-            .def(py::init<int, int, py::function, py::object>(),
+  py::class_<StructParser>(m, "StructParser")
-                 py::arg("map_fd"),
+      .def(py::init<py::dict>(), py::arg("structs"))
-                 py::arg("page_cnt") = 8,
+      .def("parse", &StructParser::parse, py::arg("struct_name"),
-                 py::arg("callback"),
+           py::arg("data"))
-                 py::arg("lost_callback") = py::none())
+      .def("has_struct", &StructParser::has_struct, py::arg("struct_name"));
-            .def("poll", &BpfPerfBuffer::poll, py::arg("timeout_ms") = -1)
-            .def("consume", &BpfPerfBuffer::consume);
 
+  // PerfEventArray
+  py::class_<PerfEventArray, std::shared_ptr<PerfEventArray>>(m,
+                                                              "PerfEventArray")
+      .def(py::init<std::shared_ptr<BpfMap>, int, py::function, py::object>(),
+           py::arg("map"), py::arg("page_cnt"), py::arg("callback"),
+           py::arg("lost_callback") = py::none())
+      .def(py::init<std::shared_ptr<BpfMap>, int, py::function, std::string,
+                    py::object>(),
+           py::arg("map"), py::arg("page_cnt"), py::arg("callback"),
+           py::arg("struct_name"), py::arg("lost_callback") = py::none())
+      .def("poll", &PerfEventArray::poll, py::arg("timeout_ms"))
+      .def("consume", &PerfEventArray::consume)
+      .def("get_map", &PerfEventArray::get_map);
 
 #ifdef VERSION_INFO
-    m.attr("__version__") = MACRO_STRINGIFY(VERSION_INFO);
+  m.attr("__version__") = MACRO_STRINGIFY(VERSION_INFO);
 #else
-    m.attr("__version__") = "dev";
+  m.attr("__version__") = "dev";
 #endif
 }

src/core/bpf_map.cpp

@@ -1,6 +1,10 @@
-#include "bpf_map.h"
+#include "core/bpf_map.h"
-#include "bpf_exception.h"
+#include "core/bpf_exception.h"
-#include "bpf_object.h"
+#include "core/bpf_object.h"
+#include "utils/struct_parser.h"
+#include <algorithm>
+#include <cerrno>
+#include <cstring>
 
 BpfMap::BpfMap(std::shared_ptr<BpfObject> parent, struct bpf_map *raw_map,
                const std::string &map_name)
@@ -22,6 +26,24 @@ BpfMap::BpfMap(std::shared_ptr<BpfObject> parent, struct bpf_map *raw_map,
   value_size_ = bpf_map__value_size(map_);
 }
 
+void BpfMap::set_value_struct(const std::string &struct_name) {
+  auto parent = parent_obj_.lock();
+  if (!parent) {
+    throw BpfException("Parent BpfObject no longer exists");
+  }
+
+  struct_parser_ = parent->get_struct_parser();
+  if (!struct_parser_) {
+    throw BpfException("No struct definitions available in BpfObject");
+  }
+
+  if (!struct_parser_->has_struct(struct_name)) {
+    throw BpfException("Unknown struct: " + struct_name);
+  }
+
+  value_struct_name_ = struct_name;
+}
+
 py::object BpfMap::lookup(const py::object &key) const {
   if (map_fd_ < 0)
     throw BpfException("Map '" + map_name_ + "' is not initialized properly");
@@ -39,7 +61,7 @@ py::object BpfMap::lookup(const py::object &key) const {
                                        value_span.data(), value_size_, BPF_ANY);
   if (ret < 0) {
     if (ret == -ENOENT)
-      throw py::key_error("Key not found in map '" + map_name_ + "'");
+      return py::none();
     throw BpfException("Failed to lookup key in map '" + map_name_ +
                        "': " + std::strerror(-ret));
   }
@@ -212,7 +234,13 @@ void BpfMap::python_to_bytes_inplace(const py::object &obj,
   }
 }
 
-py::object BpfMap::bytes_to_python(std::span<const uint8_t> data) {
+py::object BpfMap::bytes_to_python(std::span<const uint8_t> data) const {
+  //  NOTE: Struct parsing for value type
+  if (struct_parser_ && !value_struct_name_.empty()) {
+    py::bytes py_data(reinterpret_cast<const char *>(data.data()), data.size());
+    return struct_parser_->parse(value_struct_name_, py_data);
+  }
+
   if (data.size() == 4) {
     uint32_t value;
     std::memcpy(&value, data.data(), 4);

src/core/bpf_map.h

@@ -1,10 +1,7 @@
 #ifndef PYLIBBPF_BPF_MAP_H
 #define PYLIBBPF_BPF_MAP_H
 
-#include <algorithm>
 #include <array>
-#include <cerrno>
-#include <cstring>
 #include <libbpf.h>
 #include <pybind11/pybind11.h>
 #include <span>
@@ -12,10 +9,11 @@
 #include <vector>
 
 class BpfObject;
+class StructParser;
 
 namespace py = pybind11;
 
-class BpfMap {
+class BpfMap : public std::enable_shared_from_this<BpfMap> {
 private:
   std::weak_ptr<BpfObject> parent_obj_;
   struct bpf_map *map_;
@@ -23,6 +21,11 @@ private:
   std::string map_name_;
   __u32 key_size_, value_size_;
 
+  //  TODO: For now, we'll only support struct parsing for value types
+  // later we can extend this to keys
+  std::shared_ptr<StructParser> struct_parser_;
+  std::string value_struct_name_;
+
   template <size_t StackSize = 64> struct BufferManager {
     std::array<uint8_t, StackSize> stack_buf;
     std::vector<uint8_t> heap_buf;
@@ -55,6 +58,7 @@ public:
   py::dict items() const;
   py::list keys() const;
   py::list values() const;
+  void set_value_struct(const std::string &struct_name);
 
   [[nodiscard]] std::string get_name() const { return map_name_; }
   [[nodiscard]] int get_fd() const { return map_fd_; }
@@ -62,11 +66,20 @@ public:
   [[nodiscard]] int get_key_size() const { return key_size_; };
   [[nodiscard]] int get_value_size() const { return value_size_; };
   [[nodiscard]] int get_max_entries() const;
+  [[nodiscard]] std::shared_ptr<BpfObject> get_parent() const {
+    return parent_obj_.lock();
+  }
+  [[nodiscard]] std::string get_value_struct_name() const {
+    return value_struct_name_;
+  }
+  [[nodiscard]] bool has_struct_value() const {
+    return !value_struct_name_.empty();
+  }
 
 private:
   static void python_to_bytes_inplace(const py::object &obj,
                                       std::span<uint8_t> buffer);
-  static py::object bytes_to_python(std::span<const uint8_t> data);
+  py::object bytes_to_python(std::span<const uint8_t> data) const;
 };
 
-#endif // PYLIBBPF_MAPS_H
+#endif // PYLIBBPF_BPF_MAP_H

src/core/bpf_object.cpp

@@ -1,11 +1,15 @@
-#include "bpf_object.h"
+#include "core/bpf_object.h"
-#include "bpf_exception.h"
+#include "core/bpf_exception.h"
-#include "bpf_map.h"
+#include "core/bpf_map.h"
-#include "bpf_program.h"
+#include "core/bpf_program.h"
+#include "utils/struct_parser.h"
 #include <cerrno>
+#include <cstring>
+#include <utility>
 
-BpfObject::BpfObject(std::string object_path)
+BpfObject::BpfObject(std::string object_path, py::dict structs)
-    : obj_(nullptr), object_path_(std::move(object_path)), loaded_(false) {}
+    : obj_(nullptr), object_path_(std::move(object_path)), loaded_(false),
+      struct_defs_(structs), struct_parser_(nullptr) {}
 
 BpfObject::~BpfObject() {
   // Clear caches first (order matters!)
@@ -20,9 +24,13 @@ BpfObject::~BpfObject() {
 }
 
 BpfObject::BpfObject(BpfObject &&other) noexcept
-    : obj_(other.obj_), object_path_(std::move(other.object_path_)),
+    : obj_(std::exchange(other.obj_, nullptr)),
-      loaded_(other.loaded_), prog_cache_(std::move(other.prog_cache_)),
+      object_path_(std::move(other.object_path_)),
-      maps_cache_(std::move(other.maps_cache_)) {
+      loaded_(std::exchange(other.loaded_, false)),
+      maps_cache_(std::move(other.maps_cache_)),
+      prog_cache_(std::move(other.prog_cache_)),
+      struct_defs_(std::move(other.struct_defs_)),
+      struct_parser_(std::move(other.struct_parser_)) {
 
   other.obj_ = nullptr;
   other.loaded_ = false;
@@ -36,14 +44,13 @@ BpfObject &BpfObject::operator=(BpfObject &&other) noexcept {
       bpf_object__close(obj_);
     }
 
-    obj_ = other.obj_;
+    obj_ = std::exchange(other.obj_, nullptr);
     object_path_ = std::move(other.object_path_);
-    loaded_ = other.loaded_;
+    loaded_ = std::exchange(other.loaded_, false);
-    prog_cache_ = std::move(other.prog_cache_);
     maps_cache_ = std::move(other.maps_cache_);
-
+    prog_cache_ = std::move(other.prog_cache_);
-    other.obj_ = nullptr;
+    struct_defs_ = std::move(other.struct_defs_);
-    other.loaded_ = false;
+    struct_parser_ = std::move(other.struct_parser_);
   }
   return *this;
 }
@@ -255,3 +262,11 @@ py::dict BpfObject::get_cached_maps() const {
   }
   return maps;
 }
+
+std::shared_ptr<StructParser> BpfObject::get_struct_parser() const {
+  if (!struct_parser_ && !struct_defs_.empty()) {
+    // Create parser on first access
+    struct_parser_ = std::make_shared<StructParser>(struct_defs_);
+  }
+  return struct_parser_;
+}

src/core/bpf_object.h

@@ -6,12 +6,12 @@
 #include <pybind11/pybind11.h>
 #include <string>
 #include <unordered_map>
-#include <vector>
 
 namespace py = pybind11;
 
 class BpfProgram;
 class BpfMap;
+class StructParser;
 
 /**
  * BpfObject - Represents a loaded BPF object file.
@@ -28,12 +28,14 @@ private:
   mutable std::unordered_map<std::string, std::shared_ptr<BpfMap>> maps_cache_;
   mutable std::unordered_map<std::string, std::shared_ptr<BpfProgram>>
       prog_cache_;
+  py::dict struct_defs_;
+  mutable std::shared_ptr<StructParser> struct_parser_;
 
   std::shared_ptr<BpfProgram> _get_or_create_program(struct bpf_program *prog);
   std::shared_ptr<BpfMap> _get_or_create_map(struct bpf_map *map);
 
 public:
-  explicit BpfObject(std::string object_path);
+  explicit BpfObject(std::string object_path, py::dict structs = py::dict());
   ~BpfObject();
 
   // Disable copy, allow move
@@ -77,6 +79,10 @@ public:
   [[nodiscard]] std::shared_ptr<BpfMap> get_map(const std::string &name);
   [[nodiscard]] struct bpf_map *find_map_by_name(const std::string &name) const;
   [[nodiscard]] py::dict get_cached_maps() const;
+
+  // Struct parsing
+  [[nodiscard]] py::dict get_struct_defs() const { return struct_defs_; }
+  [[nodiscard]] std::shared_ptr<StructParser> get_struct_parser() const;
 };
 
 #endif // PYLIBBPF_BPF_OBJECT_H

src/core/bpf_perf_buffer.cpp

@@ -1,80 +0,0 @@
-#include "bpf_perf_buffer.h"
-#include "bpf_exception.h"
-
-BpfPerfBuffer::BpfPerfBuffer(int map_fd, int page_cnt, py::function callback,
-                             py::object lost_callback)
-    : pb_(nullptr), callback_(std::move(callback)),
-      lost_callback_(lost_callback) {
-
-  if (page_cnt <= 0 || (page_cnt & (page_cnt - 1)) != 0) {
-    throw BpfException("page_cnt must be a positive power of 2");
-  }
-
-  struct perf_buffer_opts pb_opts = {};
-  pb_opts.sz = sizeof(pb_opts); // Required for forward compatibility
-
-  pb_ = perf_buffer__new(
-      map_fd, page_cnt,
-      sample_callback_wrapper,                                   // sample_cb
-      lost_callback.is_none() ? nullptr : lost_callback_wrapper, // lost_cb
-      this,                                                      // ctx
-      &pb_opts                                                   // opts
-  );
-
-  if (!pb_) {
-    throw BpfException("Failed to create perf buffer: " +
-                       std::string(std::strerror(errno)));
-  }
-}
-
-BpfPerfBuffer::~BpfPerfBuffer() {
-  if (pb_) {
-    perf_buffer__free(pb_);
-  }
-}
-
-void BpfPerfBuffer::sample_callback_wrapper(void *ctx, int cpu, void *data,
-                                            unsigned int size) {
-  auto *self = static_cast<BpfPerfBuffer *>(ctx);
-
-  // Acquire GIL for Python calls
-  py::gil_scoped_acquire acquire;
-
-  try {
-    // Convert data to Python bytes
-    py::bytes py_data(static_cast<const char *>(data), size);
-
-    // Call Python callback: callback(cpu, data, size)
-    self->callback_(cpu, py_data, size);
-  } catch (const py::error_already_set &e) {
-    PyErr_Print();
-  }
-}
-
-void BpfPerfBuffer::lost_callback_wrapper(void *ctx, int cpu,
-                                          unsigned long long cnt) {
-  auto *self = static_cast<BpfPerfBuffer *>(ctx);
-
-  if (self->lost_callback_.is_none()) {
-    return;
-  }
-
-  py::gil_scoped_acquire acquire;
-
-  try {
-    self->lost_callback_(cpu, cnt);
-  } catch (const py::error_already_set &e) {
-    PyErr_Print();
-  }
-}
-
-int BpfPerfBuffer::poll(int timeout_ms) {
-  // Release GIL during blocking poll
-  py::gil_scoped_release release;
-  return perf_buffer__poll(pb_, timeout_ms);
-}
-
-int BpfPerfBuffer::consume() {
-  py::gil_scoped_release release;
-  return perf_buffer__consume(pb_);
-}

src/core/bpf_perf_buffer.h

@@ -1,31 +0,0 @@
-#ifndef PYLIBBPF_BPF_PERF_BUFFER_H
-#define PYLIBBPF_BPF_PERF_BUFFER_H
-
-#include <libbpf.h>
-#include <pybind11/functional.h>
-#include <pybind11/pybind11.h>
-
-namespace py = pybind11;
-
-class BpfPerfBuffer {
-private:
-  struct perf_buffer *pb_;
-  py::function callback_;
-  py::function lost_callback_;
-
-  // Static callback wrappers for C API
-  static void sample_callback_wrapper(void *ctx, int cpu, void *data,
-                                      unsigned int size);
-  static void lost_callback_wrapper(void *ctx, int cpu, unsigned long long cnt);
-
-public:
-  BpfPerfBuffer(int map_fd, int page_cnt, py::function callback,
-                py::object lost_callback = py::none());
-  ~BpfPerfBuffer();
-
-  int poll(int timeout_ms);
-  int consume();
-  [[nodiscard]] int fd() const;
-};
-
-#endif // PYLIBBPF_BPF_PERF_BUFFER_H

src/core/bpf_program.cpp

@@ -1,7 +1,8 @@
-#include "bpf_program.h"
+#include "core/bpf_program.h"
-#include "bpf_exception.h"
+#include "core/bpf_exception.h"
-#include "bpf_object.h"
+#include "core/bpf_object.h"
 #include <cerrno>
+#include <cstring>
 #include <utility>
 
 BpfProgram::BpfProgram(std::shared_ptr<BpfObject> parent,

src/core/bpf_program.h

@@ -1,7 +1,6 @@
 #ifndef PYLIBBPF_BPF_PROGRAM_H
 #define PYLIBBPF_BPF_PROGRAM_H
 
-#include <cstring>
 #include <libbpf.h>
 #include <memory>
 #include <string>

src/maps/perf_event_array.cpp

@@ -0,0 +1,117 @@
+#include "maps/perf_event_array.h"
+#include "core/bpf_exception.h"
+#include "core/bpf_map.h"
+#include "core/bpf_object.h"
+#include "utils/struct_parser.h"
+#include <cerrno>
+#include <cstring>
+
+PerfEventArray::PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                               py::function callback, py::object lost_callback)
+    : map_(map), pb_(nullptr), callback_(std::move(callback)),
+      lost_callback_(std::move(lost_callback)) {
+
+  if (map->get_type() != BPF_MAP_TYPE_PERF_EVENT_ARRAY) {
+    throw BpfException("Map '" + map->get_name() +
+                       "' is not a PERF_EVENT_ARRAY");
+  }
+
+  if (page_cnt <= 0 || (page_cnt & (page_cnt - 1)) != 0) {
+    throw BpfException("page_cnt must be a positive power of 2");
+  }
+
+  struct perf_buffer_opts pb_opts = {};
+  pb_opts.sz = sizeof(pb_opts); // Required for forward compatibility
+
+  pb_ = perf_buffer__new(
+      map->get_fd(), page_cnt,
+      sample_callback_wrapper,                                   // sample_cb
+      lost_callback.is_none() ? nullptr : lost_callback_wrapper, // lost_cb
+      this,                                                      // ctx
+      &pb_opts                                                   // opts
+  );
+
+  if (!pb_) {
+    throw BpfException("Failed to create perf buffer: " +
+                       std::string(std::strerror(errno)));
+  }
+}
+
+PerfEventArray::PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                               py::function callback,
+                               const std::string &struct_name,
+                               py::object lost_callback)
+    : PerfEventArray(map, page_cnt, callback, lost_callback) {
+
+  auto parent = map->get_parent();
+  if (!parent) {
+    throw BpfException("Parent BpfObject has been destroyed");
+  }
+
+  parser_ = parent->get_struct_parser();
+  struct_name_ = struct_name;
+
+  if (!parser_) {
+    throw BpfException("No struct definitions available");
+  }
+}
+
+PerfEventArray::~PerfEventArray() {
+  if (pb_) {
+    perf_buffer__free(pb_);
+  }
+}
+
+void PerfEventArray::sample_callback_wrapper(void *ctx, int cpu, void *data,
+                                             unsigned int size) {
+  auto *self = static_cast<PerfEventArray *>(ctx);
+
+  // Acquire GIL for Python calls
+  py::gil_scoped_acquire acquire;
+
+  try {
+    // Convert data to Python bytes
+    py::bytes py_data(static_cast<const char *>(data), size);
+
+    if (self->parser_ && !self->struct_name_.empty()) {
+      py::object event = self->parser_->parse(self->struct_name_, py_data);
+      self->callback_(cpu, event);
+    } else {
+      self->callback_(cpu, py_data);
+    }
+
+  } catch (const py::error_already_set &e) {
+    PyErr_Print();
+  } catch (const std::exception &e) {
+    py::print("C++ error in perf callback:", e.what());
+  }
+}
+
+void PerfEventArray::lost_callback_wrapper(void *ctx, int cpu,
+                                           unsigned long long cnt) {
+  auto *self = static_cast<PerfEventArray *>(ctx);
+
+  py::gil_scoped_acquire acquire;
+
+  try {
+    if (!self->lost_callback_.is_none()) {
+      py::function lost_fn = py::cast<py::function>(self->lost_callback_);
+      lost_fn(cpu, cnt);
+    } else {
+      py::print("Lost", cnt, "events on CPU", cpu);
+    }
+  } catch (const py::error_already_set &e) {
+    PyErr_Print();
+  }
+}
+
+int PerfEventArray::poll(int timeout_ms) {
+  // Release GIL during blocking poll
+  py::gil_scoped_release release;
+  return perf_buffer__poll(pb_, timeout_ms);
+}
+
+int PerfEventArray::consume() {
+  py::gil_scoped_release release;
+  return perf_buffer__consume(pb_);
+}

src/maps/perf_event_array.h

@@ -0,0 +1,46 @@
+#ifndef PYLIBBPF_PERF_EVENT_ARRAY_H
+#define PYLIBBPF_PERF_EVENT_ARRAY_H
+
+#include <libbpf.h>
+#include <memory>
+#include <pybind11/pybind11.h>
+#include <string>
+
+class StructParser;
+class BpfMap;
+
+namespace py = pybind11;
+
+class PerfEventArray {
+private:
+  std::shared_ptr<BpfMap> map_;
+  struct perf_buffer *pb_;
+  py::function callback_;
+  py::object lost_callback_;
+
+  std::shared_ptr<StructParser> parser_;
+  std::string struct_name_;
+
+  // Static callback wrappers for C API
+  static void sample_callback_wrapper(void *ctx, int cpu, void *data,
+                                      unsigned int size);
+  static void lost_callback_wrapper(void *ctx, int cpu, unsigned long long cnt);
+
+public:
+  PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                 py::function callback, py::object lost_callback = py::none());
+  PerfEventArray(std::shared_ptr<BpfMap> map, int page_cnt,
+                 py::function callback, const std::string &struct_name,
+                 py::object lost_callback = py::none());
+  ~PerfEventArray();
+
+  PerfEventArray(const PerfEventArray &) = delete;
+  PerfEventArray &operator=(const PerfEventArray &) = delete;
+
+  int poll(int timeout_ms);
+  int consume();
+
+  [[nodiscard]] std::shared_ptr<BpfMap> get_map() const { return map_; }
+};
+
+#endif // PYLIBBPF_PERF_EVENT_ARRAY_H

src/utils/struct_parser.cpp

@@ -0,0 +1,25 @@
+#include "struct_parser.h"
+#include "core/bpf_exception.h"
+
+StructParser::StructParser(py::dict structs) {
+  for (auto item : structs) {
+    std::string name = py::str(item.first);
+    struct_types_[name] = py::reinterpret_borrow<py::object>(item.second);
+  }
+}
+
+py::object StructParser::parse(const std::string &struct_name, py::bytes data) {
+  auto it = struct_types_.find(struct_name);
+  if (it == struct_types_.end()) {
+    throw BpfException("Unknown struct: " + struct_name);
+  }
+
+  py::object struct_type = it->second;
+
+  // Use ctypes.from_buffer_copy() to create struct from bytes
+  return struct_type.attr("from_buffer_copy")(data);
+}
+
+bool StructParser::has_struct(const std::string &struct_name) const {
+  return struct_types_.find(struct_name) != struct_types_.end();
+}

src/utils/struct_parser.h

@@ -0,0 +1,20 @@
+#ifndef PYLIBBPF_STRUCT_PARSER_H
+#define PYLIBBPF_STRUCT_PARSER_H
+
+#include <pybind11/pybind11.h>
+#include <string>
+#include <unordered_map>
+
+namespace py = pybind11;
+
+class StructParser {
+private:
+  std::unordered_map<std::string, py::object> struct_types_;
+
+public:
+  explicit StructParser(py::dict structs);
+  py::object parse(const std::string &struct_name, py::bytes data);
+  bool has_struct(const std::string &struct_name) const;
+};
+
+#endif

tests/test_basic.py

@@ -2,6 +2,6 @@ import pylibbpf as m
 
 
 def test_main():
-    assert m.__version__ == "0.0.5"
+    assert m.__version__ == "0.0.6"
-    prog = m.BpfObject("tests/execve2.o")
+    prog = m.BpfObject("tests/execve2.o", structs={})
     print(prog)