┌─────────────────────────────────────────────────┐
│  Userspace: Load BPF object via libbpf-rs       │
│  Register via netlink/bpf_tcp_attach           │
└──────────────────┬──────────────────────────────┘
                   │
                   ▼
┌─────────────────────────────────────────────────┐
│           Kernel TCP Stack                      │
│                                                 │
│  on ACK received ──► cong_avoid() ──► BPF      │
│  on loss detected ──► cong_avoid() ──► BPF     │
│  on RTO timeout  ──► undo_cwnd() ──► BPF       │
│  on mem limit    ──► mem_limit()  ──► BPF      │
│                                                 │
│  Returns: new cwnd, ssthresh, sndbuf size      │
└─────────────────────────────────────────────────┘

// fedbuf_cong.c
// Compile with: clang -O2 -target bpf -c fedbuf_cong.c -o fedbuf.o
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>

#define RTT_TARGET_US     500   // 500µs target RTT for intra-DC paths
#define QUEUE_RATIO_SCALE  10   // Using scale to avoid floating point (1.0 ratio)
#define QUEUE_THRESHOLD    13   // rtt > srtt * (13/10) => 1.3x ratio
#define MIN_CWND_MSS      2
#define MAX_CWND_MSS      65535

struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __uint(max_entries, 1);
    __type(key, __u32);
    __type(value, __u64);
} metrics SEC(".maps");

struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __uint(max_entries, 1);
    __type(key, __u32);
    __type(key, __u32);
    __type(value, __u32);
} queue_alerts SEC(".maps");

SEC("cong_avoid")
int fedbuf_cong_avoid(struct sock *sk, u32 ack, u32 acked)
{
    struct tcp_sock *tp = &sk->__sk_sock;
    __u32 rtt_us = tp->srtt_us;
    __u32 srtt_us = tp->srtt_us; // Simplified for demonstration
    __u32 cwnd = tp->snd_cwnd;
    __u32 ssthresh = tp->snd_ssthresh;

    // 1. Detect Queueing using RTT/srtt ratio
    // We use integer math to avoid floating point in BPF
    if (srtt_us > 0 && (rtt_us * QUEUE_RATIO_SCALE) > (srtt_us * QUEUE_THRESHOLD)) {
        // Queueing detected: Multiplicative Decrease
        cwnd = ssthresh / 2;
        if (cwnd < MIN_CWND_MSS) cwnd = MIN_CWND_MSS;

        // Record an alert for monitoring
        __u32 alert_key[2] = {0, 1};
        bpf_map_update_elem(&queue_alerts, &alert_key, &1, BPF_ANY);
    } else {
        // 2. Additive Increase (standard AIMD)
        if (cwnd < ssthresh) {
            cwnd += 1;
        } else {
            // Slow start/Exponential growth logic could be added here
        }
    }

    // 3. Clamp and write back to the TCP socket structure
    if (cwnd > MAX_CWND_MSS) cwnd = MAX_CWND_MSS;
    if (cwnd < MIN_CWND_MSS) cwnd = MIN_CWND_MSS;

    tp->snd_cwnd = cwnd;
    tp->snd_ssthresh = ssthresh;

    return 0;
}

SEC("undo_cwnd")
void fedbuf_undo_cwnd(struct sock *sk)
{
    struct tcp_sock *tp = &sk.__sk_sock;
    tp->snd_cwnd = (tp->snd_cwnd > 2)? tp->snd_cwnd / 2 : 1;
}

SEC("mem_limit")
__u32 fedbuf_mem_limit(struct sock *sk)
{
    // Enforce a strict 4MB buffer limit per socket to prevent bufferbloat
    return 4 * 1024 * 1024;
}

char _license[] SEC("license") = "GPL";

use libbpf_rs::Skel;
use std::thread;
use std::time::Duration;

fn main() -> anyhow::Result<()> {
    // 1. Load the BPF skeleton
    let mut skel = fedbuf_cong::FedbufSkel::load()?;

    // 2. Attach the programs to the TCP congestion ops
    // Note: In a production environment, this uses the BPF TCP attachment API
    skel.attach()?;

    println!("[fedbuf] Controller attached to kernel TCP stack.");

    // 3. Metrics Reporting Loop
    let metrics_map = skel.maps().get("metrics").unwrap();

    loop {
        // In a real scenario, we would write these to a Prometheus textfile
        // or expose them via a local Unix Domain Socket.
        if let Ok(Some(val)) = metrics_map.get_keyed::<u32, u64>(0) {
            let cwnd = (val >> 32) as u32;
            let ssthresh = (val & 0xFFFFFFFF) as u32;
            println!("[metrics] cwnd: {}, ssthresh: {}", cwnd, ssthresh);
        }
        thread::sleep(Duration::from_secs(1));
    }
}

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fedbuf-controller
  namespace: infra
spec:
  template:
    spec:
      hostNetwork: true
      hostPID: true
      securityContext:
        privileged: true
        capabilities:
          add: ['BPF', 'SYS_ADMIN', 'NET_ADMIN']
      containers:
        - name: loader
          image: trading/fedbuf-loader:v1
          volumeMounts:
            - name: sys-fs-bpf
              mountPath: /sys/fs/bpf
      volumes:
        - name: sys-fs-bpf
          hostPath:
            path: /sys/fs/bpf
            type: Directory

# Create an isolated environment
ip netns add test_env

# Move a virtual interface into the namespace
ip link set veth1 netns test_env

# Run a test inside the namespace
ip netns exec test_env sysctl -w net.ipv4.tcp_congestion_control=fedbuf