Arm-64: Add initial support for PAC-RET

[SwapnilGaikwad]

This PR introduces initial support for Pointer Authentication (PAC) on Arm64. PAC is a hardware security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. The signed return address is stored on the stack and later authenticated before returning from a function, ensuring control flow returns to the intended caller.

More details on PAC and its role in software security can be found (here).

Enabling PAC involves inserting additional instructions into both the function prolog (for signing) and epilog (for authentication). This results in increased code size. For example, we observe a 1.8% increase in code size across System*.dll assemblies compiled using crossgen2.

The added instructions also introduce some runtime overhead. In our benchmark of Orchard CMS 9.0, we observe a 1.3% performance regression, which falls within the noise range (standard deviation: ~1.3%).

@kunalspathak @janvorli @a74nh

Contributes to #109457

[kunalspathak]

@SwapnilGaikwad - once you resolve the stack walking problem, can you also try something like this in a Foo() method?

paciasp
stp     fp, lr, [sp, #-0x10]!

mov x9, [sp] ;  overwrite lr value with random content
...
...
xpaclri  ; will fail and should give the call stack
...

[risc-vv]

@dotnet/samsung Could you please take a look? These changes may be related to riscv64.

[SwapnilGaikwad]

I'll move these strip operations to the source while populating the context. These are temporarily added until we get all the CI issues fixed.

[AndyAyersMS]

Have we tried running the diagnostic tests on this yet?

[risc-vv]

RISC-V Release-CLR-QEMU: 9080 / 9110 (99.67%)

=======================
      passed: 9080
      failed: 2
     skipped: 599
      killed: 28
------------------------
 TOTAL tests: 9709
VIRTUAL time: 35h 9min 36s 335ms
   REAL time: 35min 56s 818ms
=======================

report.xml, report.md, failures.xml, testclr_details.tar.zst

Build information and commands

GIT: 34401fb08d91f230ca12b3ff311cdf67fd54c858
CI: 78e142fd33020d1c98d51294d2e82d7c5be9fbf2
REPO: dotnet/runtime
BRANCH: main
CONFIG: Release
LIB_CONFIG: Release

[risc-vv]

RISC-V Release-CLR-VF2: 9083 / 9113 (99.67%)

=======================
      passed: 9083
      failed: 2
     skipped: 597
      killed: 28
------------------------
 TOTAL tests: 9710
VIRTUAL time: 11h 18min 11s 352ms
   REAL time: 45min 50s 923ms
=======================

report.xml, report.md, failures.xml, testclr_details.tar.zst

RISC-V Release-CLR-QEMU: 9082 / 9112 (99.67%)

=======================
      passed: 9082
      failed: 2
     skipped: 597
      killed: 28
------------------------
 TOTAL tests: 9709
VIRTUAL time: 37h 32min 14s 532ms
   REAL time: 38min 25s 818ms
=======================

report.xml, report.md, failures.xml, testclr_details.tar.zst

Build information and commands

GIT: 0bc660ee660772ffd6445818cdae223c1345a9a4
CI: d6c9c1ab3a7411819463edc05ded301e89ba586a
REPO: dotnet/runtime
BRANCH: main
CONFIG: Release
LIB_CONFIG: Release

[amanasifkhalid]

Have we tried running the diagnostic tests on this yet?

@steveisok is doing this now

[risc-vv]

@dotnet/samsung Could you please take a look? These changes may be related to riscv64.

[JulieLeeMSFT]

Moved to .NET 11.

[risc-vv]

@dotnet/samsung Could you please take a look? These changes may be related to riscv64.

[JulieLeeMSFT]

We will resume the work in .NET 11.

[JulieLeeMSFT]

@SwapnilGaikwad, I think this PR needs some work as discussed offline. Can we change this PR to draft until it is ready to review?