[compiler-rt] Remove dlsym interceptor and support `-shared-libsan` for CSan
Summary:
Follow the UBSan offload runtime. Offload now resolves HSA through the
global scope, so the `dlsym` interceptor is no longer needed. The real
HSA entry points are still taken from the loaded HSA library rather than
`RTLD_NEXT`, since every DSO with a static runtime exports the same
wrappers and they would otherwise chain back into each other.
Build `libclang_rt.csan.so` with the offload objects folded in. The
exported HSA wrappers report failure when HSA is absent and warn when HSA
was loaded ahead of the runtime. The preinit hook moves to a separate
`csan_offload-preinit` archive for executables.
[compiler-rt] Add 'csan' library for the concurrency sanitizer
Summary:
Adds the runtime for the concurrency sanitizer, both CPU and GPU.
Fundamentally, this works using the following pseudocode:
```c
static u64 watchpoints[N]; // Hash-indexed, zero is empty.
// Emitted before the access, so we never trip on our own write.
void check_access(volatile void *addr, u32 size, u32 type) {
// Every access probes. A read conflicts only with a watched write, a
// write conflicts with either.
if (u64 *wp = find_watchpoint(addr, size, type))
consume(wp, this_pc()); // Hand our location to the owner.
if (!should_sample()) // Wave-uniform, 1-in-N chance.
return;
[17 lines not shown]
[Clang] Support `-shared-libsan` for offload CSan
Summary:
Follow the UBSan handling. The shared runtime embeds the HSA
interceptors, so `csan_offload` is only linked with static runtimes and
executables pull in `csan_offload-preinit` to initialize early.
[Clang] Add support for the `-fsanitize=concurrency` runtime
Summary:
Add the frontend sanitizer kind, function attributes, pass pipeline
integration, predefined macro, driver handling, and documentation for
ConcurrencySanitizer.
security/vuxml: add FreeBSD SAs issued on 2026-10-14
FreeBSD-SA-26:70.tcp affects 15.1R
FreeBSD-SA-26:71.sound affects all supported releases
FreeBSD-SA-26:72.bhyve affects all supported releases
[ClangIR] Support bool-returning await_suspend (#227527)
Support bool-returning `await_suspend` in ClangIR:
- Add an optional boolean condition operand to `cir.coro.suspend_point`
to signal whether suspension takes effect or is vetoed.
- In CIRGen, evaluate the `await_suspend` expression as boolean when
`SuspendReturnType::SuspendBool` and pass the condition to
`cir.coro.suspend_point`.
- Update control flow and successor regions for `cir.await` accordingly.
- Add MLIR and CodeGen test coverage.
Closes #227404
[libc++] Extract running the benchmarks into reusable workflows (#232168)
This patch moves the jobs that actually run the benchmarks into their
own workflows and defines the full "benchmarking pipeline" in a
dedicated workflow as well. This allows seeing the full set of steps in
the pipeline in a concise way, and removes most of the remaining
duplication of logic.
[DAG] Handle widened step vectors in expandGetActiveLaneMask
On AVX512 getLegalMaskAndStepVector will need to widen the step vector type. Handle this in expandGetActiveLaneMask, so we don't crash on AVX512 which widens e.g. v8i1 -> v16i1. We don't actually use Mask, it's just a dummy poison value to work out what type the final mask result should be.
[mlir][bufferization] Skip read collection when no writes exist (#231771)
Collect aliasing writes before reads in the One-Shot Bufferization RaW
interference check. When there are no in-place writes, return without
collecting aliasing reads.
This avoids unnecessary read scans during pre-bufferization checks and
other cases without writes.
Rework how license changes are applied
This PR adds changes to replace the license reconcile delegates and the post_license_update hook with a single apply path driven by the entitlement matrix. Every install path (upload, TNC heartbeat, HA peer propagation, legacy sync) snapshots entitlements before and after the change, diffs them and runs only the delegates of the features that actually flipped, so unaffected services are no longer reloaded/restarted on every license change.
Delegates are defined next to their plugins on top of a small base (converge, workload and custom kinds) which owns the service control flags, running/active node checks and failure reporting. Revoking a feature now revokes running functionality as well: VMs and containers are shut down (autostart ones come back on re-grant), docker is stopped while keeping its pool, webshare is stopped and masked, NFS snapshot exposure and DS auth are gated at render time (DS auth is left alone if no usable local admin exists), FC/RDMA targets are converged and KMIP keys are pulled back locally. STIG/FIPS, dedup, NVMe-oF SPDK and network FEC are alert-only. A single alert lists features which are not licensed but still in use, including revokes which did not complete.
On HA, uploads are refused on the standby, during failover and when they would drop HA on a configured pair, and the newer license is pushed to the peer when it reconnects. The pending changes are journalled in /run so a middlewared restart between install and apply does not lose them.
