SAI switch delta processing for UDF ACLs

Summary:
Remove UDF groups after ACL processing.

1. Add new UDF groups
2. Delete ACL table with old entries and UDF groups
3. Create new ACL table with new UDF groups
4. Only add ACL entries present in new list
5. Delete unwanted UDF groups

Reviewed By: zechengh09

Differential Revision: D65696495

fbshipit-source-id: 4efdde3d89ec70f076a12ec2f9998b196a0c1e12

fboss/agent/hw/sai/switch/SaiSwitch.cpp

@@ -975,6 +975,21 @@ std::shared_ptr<SwitchState> SaiSwitch::stateChangedImplLocked(
         &SaiInSegEntryManager::processRemovedInSegEntry);
   }
 
+#if SAI_API_VERSION >= SAI_VERSION(1, 12, 0)
+  // UDF groups are processed prior to load balancer and ACL tables
+  // Both require UDF groups to be created before referencing them
+  processAddedDelta(
+      delta.getUdfPacketMatcherDelta(),
+      managerTable_->udfManager(),
+      lockPolicy,
+      &SaiUdfManager::addUdfMatch);
+  processAddedDelta(
+      delta.getUdfGroupDelta(),
+      managerTable_->udfManager(),
+      lockPolicy,
+      &SaiUdfManager::addUdfGroup);
+#endif
+
 #if SAI_API_VERSION >= SAI_VERSION(1, 12, 0)
   if (platform_->getAsic()->isSupported(HwAsic::Feature::SAI_UDF_HASH)) {
     // There're several constraints for load balancer and Udf objects.
@@ -987,16 +1002,6 @@ std::shared_ptr<SwitchState> SaiSwitch::stateChangedImplLocked(
     // 4. In the case of changing load balancer: a. new Udf group needs to be
     // created, b. Load balancer starts to use new Udf group, c. Remove old
     // Udf group.
-    processAddedDelta(
-        delta.getUdfPacketMatcherDelta(),
-        managerTable_->udfManager(),
-        lockPolicy,
-        &SaiUdfManager::addUdfMatch);
-    processAddedDelta(
-        delta.getUdfGroupDelta(),
-        managerTable_->udfManager(),
-        lockPolicy,
-        &SaiUdfManager::addUdfGroup);
     processAddedDelta(
         delta.getLoadBalancersDelta(),
         managerTable_->switchManager(),
@@ -1014,16 +1019,6 @@ std::shared_ptr<SwitchState> SaiSwitch::stateChangedImplLocked(
         managerTable_->switchManager(),
         lockPolicy,
         &SaiSwitchManager::removeLoadBalancer);
-    processRemovedDelta(
-        delta.getUdfPacketMatcherDelta(),
-        managerTable_->udfManager(),
-        lockPolicy,
-        &SaiUdfManager::removeUdfMatch);
-    processRemovedDelta(
-        delta.getUdfGroupDelta(),
-        managerTable_->udfManager(),
-        lockPolicy,
-        &SaiUdfManager::removeUdfGroup);
   } else {
     processDelta(
         delta.getLoadBalancersDelta(),
@@ -1130,6 +1125,20 @@ std::shared_ptr<SwitchState> SaiSwitch::stateChangedImplLocked(
         cfg::switch_config_constants::DEFAULT_INGRESS_ACL_TABLE());
   }
 
+#if SAI_API_VERSION >= SAI_VERSION(1, 12, 0)
+  // ACLs are done processing. Remove UDF groups not required
+  processRemovedDelta(
+      delta.getUdfPacketMatcherDelta(),
+      managerTable_->udfManager(),
+      lockPolicy,
+      &SaiUdfManager::removeUdfMatch);
+  processRemovedDelta(
+      delta.getUdfGroupDelta(),
+      managerTable_->udfManager(),
+      lockPolicy,
+      &SaiUdfManager::removeUdfGroup);
+#endif
+
   processPfcWatchdogGlobalDelta(delta, lockPolicy);
 
   if (platform_->getAsic()->isSupported(