Arm64: [PAC-RET] NativeAOT changes

[SwapnilGaikwad]

This PR covers the final subset of changes from #125436 related to NativeAOT as suggested in comment.
It follows the previous work from- #127949, #127838 and #128147.

More details on PAC and its role in software security can be found (here).

cc: @dotnet/arm64-contrib @a74nh @jkotas @dhartglassMSFT

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib
See info in area-owners.md if you want to be subscribed.

[jkotas]

/azp run runtime-nativeaot-outerloop

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[jkotas]

Tests failing on linux-arm64 with

Debug Assertion Violation

Expression: 'IsUnwindable((PTR_VOID)pRegisterSet->IP)'

File: /__w/1/s/src/coreclr/nativeaot/Runtime/unix/UnixNativeCodeManager.cpp, Line: 1476

[SwapnilGaikwad]

The CdacTest failures on MacOS seem unrelated to the patch.

[jkotas]

/azp run runtime-nativeaot-outerloop

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[jkotas]

Tests are crashing on linux-arm64 and osx-arm64

[SwapnilGaikwad]

Tests are crashing on linux-arm64 and osx-arm64

These crashes came from changes to bail out if we interrupt on RET when pac is enabled. Previously PR was handling RET incorrect in TrailingEpilogueInstructionsCount that led to hijacking the current frame instead of the parent frame on return, now moved the check to PAC specific part.

[jkotas]

Should this check be in TrailingEpilogueInstructionsCount so that all epilog-related checks are together?

[SwapnilGaikwad]

True, it was in there before and returned 1 on RET instruction (cannot return 0/-1 as it means not in in epilog/unknown). However when PAC is disabled, it allowed hijacking the current frame when interrupted on the RET instruction. That caused the crashes that we saw earlier. To keep PAC related changes separate, I added them in PAC specific area. I can extract the RET check into a separate function for better readability.

[jkotas]

This looks like unreachable code. TrailingEpilogueInstructionsCount on Arm64 returns -1 or 0. We have checked for -1 above, so epilogueInstructions should be 0 here.

[SwapnilGaikwad]

That's unreachable code now. epilogueInstructions == 0 would be true for regular hijacks in function body so having that check will bailout regular hijacks in function body outside prolog/epilog. Removing the check as it's no longer needed.