Arm64: [PAC-RET] Add Pointer Authentication support for Arm64

[SwapnilGaikwad]

This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller.

More details on PAC and its role in software security can be found (here).

• The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1.
• PAC protects link register (LR) by signing it in the prolog (using paciasp) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using autiasp) before the function returns. If the signature is invalid, the execution fails with SIGILL.
• When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using xpaclri) and re-signs the new target address before storing it back.
• To simply tracking the SP in return address hijacking, we avoid using the pre-indexed variant of storing FP/LR on stack (e.g., stp fp,lr,[sp,-#framesz]! ) to simply tracking the SP in return address hijacking. We obtain the value of SP at the time of signing the LR from the location of the current FP. We can't use this approach when the pre-indexed stp is used because we don't know the#framesz.
• The updated prolog/epilog sequences generated by the JIT now look like:

 // Prolog
 sub     sp, sp, #framesz
 paciasp                 ; sign LR with A-key + SP
 stp     fp, lr, [sp]

 // Epilog
 ldp     fp, lr, [sp]
 autiasp                 ; authenticate LR
 add     sp, sp, #framesz
 ret

ToDos

• Disable PAC by default before merge.
• Restore the original frame layout that used pre-indexed variant of stp to store FP/LR.
• Authenticate the return address instead of stripping in return address hijacking and unwinding. [] Identify increased binary size for System.*.dll
• Determine performance regressions using benchmarks such as OrchirdCMS.

Contributes to #109457

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.