Add the shared PBR ACL priority flag

Summary: Adds `FLAGS_pbr_acl_priority` (default 50000), the single priority every PBR ACL entry will be programmed at. Lives in `AgentFeatures` so it can be retuned without a rebuild. Nothing consumes it yet.

Reviewed By: jasmeetbagga

Differential Revision: D116378072

fbshipit-source-id: be8678e5e28e4bd43478bbbcadc8626046dbaab5

Author: Ron He

fboss/agent/AgentFeatures.cpp

@@ -627,6 +627,12 @@ DEFINE_bool(
     false,
     "Enable bulk programming of ECMP members");
 
+DEFINE_int32(
+    pbr_acl_priority,
+    50000,
+    "Priority shared by every synthesized PBR ACL entry. Must stay below "
+    "AclTable::kDataplaneAclMaxPriority so no config ACL can be assigned it");
+
 DEFINE_bool(
     enable_pfc_priority_to_pg_map,
     false,

fboss/agent/AgentFeatures.h

@@ -173,6 +173,7 @@ DECLARE_bool(enforce_single_nbr_mac_per_intf);
 DECLARE_int32(max_tx_packets);
 DECLARE_bool(enable_acl_table_redirect_action);
 DECLARE_bool(enable_bulk_create_ecmp_members);
+DECLARE_int32(pbr_acl_priority);
 DECLARE_bool(enable_pfc_priority_to_pg_map);
 DECLARE_bool(enable_port_cl72_retry);
 DECLARE_bool(enable_remote_intf_route_reconcile);

fboss/agent/ApplyThriftConfig.cpp

@@ -4189,6 +4189,8 @@ std::shared_ptr<AclMap> ThriftConfigApplier::updateAclsImpl(
   int numExistingProcessed = 0;
   int dataPriority = AclTable::kDataplaneAclMaxPriority;
   int cpuPriority = 1;
+  CHECK_LT(FLAGS_pbr_acl_priority, AclTable::kDataplaneAclMaxPriority)
+      << "PBR must sit below the dataplane band so no config ACL can reach it";
 
   flat_map<std::string, const cfg::TrafficCounter*> counterByName;
   folly::gen::from(*cfg_->trafficCounters()) |
@@ -4320,10 +4322,20 @@ std::shared_ptr<AclMap> ThriftConfigApplier::updateAclsImpl(
         ma = &matchAction;
       }
 
+      int aclPriority = isCoppAcl ? cpuPriority++ : dataPriority++;
+      if (aclPriority == FLAGS_pbr_acl_priority) {
+        throw FbossError(
+            "ACL ",
+            *aclCfg.name(),
+            " was assigned priority ",
+            aclPriority,
+            ", which is reserved for PBR ACL entries");
+      }
+
       auto acl = updateAcl(
           aclStage,
           aclCfg,
-          isCoppAcl ? cpuPriority++ : dataPriority++,
+          aclPriority,
           &numExistingProcessed,
           &changed,
           tableName,