add support with ctypes getattr offset. Also supports bitfields.

* breaks when struct_ring_buffer_per_cpu

pythonbpf/vmlinux_parser/class_handler.py

@@ -60,6 +60,10 @@ def process_vmlinux_post_ast(
             pass
         else:
             new_dep_node = DependencyNode(name=current_symbol_name)
+
+            # elem_type_class is the actual vmlinux struct/class
+            new_dep_node.set_ctype_struct(elem_type_class)
+
             handler.add_node(new_dep_node)
             class_obj = getattr(imported_module, current_symbol_name)
             # Inspect the class fields
@@ -71,9 +75,6 @@ def process_vmlinux_post_ast(
                     if len(field_elem) == 2:
                         field_name, field_type = field_elem
                     elif len(field_elem) == 3:
-                        raise NotImplementedError(
-                            "Bitfields are not supported in the current version"
-                        )
                         field_name, field_type, bitfield_size = field_elem
                     field_table[field_name] = [field_type, bitfield_size]
             elif hasattr(class_obj, "__annotations__"):

pythonbpf/vmlinux_parser/dependency_node.py

@@ -116,6 +116,7 @@ class DependencyNode:
     fields: Dict[str, Field] = field(default_factory=dict)
     _ready_cache: Optional[bool] = field(default=None, repr=False)
     current_offset: int = 0
+    ctype_struct: Optional[Any] = field(default=None, repr=False)
 
     def add_field(
             self,
@@ -146,7 +147,14 @@ class DependencyNode:
         # Invalidate readiness cache
         self._ready_cache = None
 
+    def set_ctype_struct(self, ctype_struct: Any) -> None:
+        """Set the ctypes structure for automatic offset calculation."""
+        self.ctype_struct = ctype_struct
+
     def __sizeof__(self):
+        # If we have a ctype_struct, use its size
+        if self.ctype_struct is not None:
+            return ctypes.sizeof(self.ctype_struct)
         return self.current_offset
 
     def get_field(self, name: str) -> Field:
@@ -226,8 +234,20 @@ class DependencyNode:
             raise KeyError(f"Field '{name}' does not exist in node '{self.name}'")
 
         self.fields[name].set_ready(is_ready)
+
+        # Use ctypes built-in offset if available
+        if self.ctype_struct is not None:
+            try:
+                self.fields[name].set_offset(getattr(self.ctype_struct, name).offset)
+            except AttributeError:
+                # Fallback to manual calculation if field not found in ctype_struct
                 self.fields[name].set_offset(self.current_offset)
                 self.current_offset += self._calculate_size(name, size_of_containing_type)
+        else:
+            # Manual offset calculation when no ctype_struct is available
+            self.fields[name].set_offset(self.current_offset)
+            self.current_offset += self._calculate_size(name, size_of_containing_type)
+
         # Invalidate readiness cache
         self._ready_cache = None
 
@@ -240,7 +260,6 @@ class DependencyNode:
             size_of_field = ctypes.sizeof(processing_field.type)
             return size_of_field
         elif processing_field.type.__module__ == "vmlinux":
-            #TODO: does not take into account offset calculation when not array but has type size
             if processing_field.ctype_complex_type is not None:
                 if issubclass(processing_field.ctype_complex_type, ctypes.Array):
                     if processing_field.containing_type.__module__ == ctypes.__name__:
@@ -276,8 +295,28 @@ class DependencyNode:
                     raise NotImplementedError(
                         "This subclass of ctype not supported yet"
                     )
+            elif processing_field.type_size is not None:
+                # Handle vmlinux types with type_size but no ctype_complex_type
+                # This means it's a direct vmlinux struct field (not array/pointer wrapped)
+                # The type_size should already contain the full size of the struct
+                # But if there's a containing_type from vmlinux, we need that size
+                if processing_field.containing_type is not None:
+                    if processing_field.containing_type.__module__ == "vmlinux":
+                        # For vmlinux containing types, we need the pre-calculated size
+                        if size_of_containing_type is not None:
+                            return size_of_containing_type * processing_field.type_size
                         else:
-                # search up pre-created stuff and get size
+                            raise RuntimeError(
+                                f"Field {name}: vmlinux containing_type requires size_of_containing_type"
+                            )
+                    else:
+                        raise ModuleNotFoundError(
+                            f"Containing type module {processing_field.containing_type.__module__} not supported"
+                        )
+                else:
+                    raise RuntimeError("Wrong type found with no containing type")
+            else:
+                # No ctype_complex_type and no type_size, must rely on size_of_containing_type
                 if size_of_containing_type is None:
                     raise RuntimeError(
                         f"Size of containing type {size_of_containing_type} is None"