Add support for apple-arm64 returned structures

[pjcreath]

What is the feature you'd like to have?
When a function returns a structure (or any value > 128 bits), apple-arm64 (maybe all arm64?) specifies that the caller provides a pointer to the storage for that return value in register x8.

I'd like BN to automatically recognize the use of x8 and represent it appropriately in HLIL, propagating type information as available.

Is your feature request related to a problem?
By default, BN's analysis thinks x8 is unused, failing to recognize that it is identifying the pointer to the return value.

Are any alternative solutions acceptable?
I can manually fix up a function by adding a new parameter struct MyStruct retval @ x8 and change the return type to void. While this lets the caller know that x8 is used, and lets the function know that x8 is an inbound pointer, it remains at odds with the function's type when it declares the type of the return value.

Additional Information:

• https://medium.com/@tunacici7/aarch64-procedure-call-standard-aapcs64-abi-calling-conventions-machine-registers-a2c762540278
• https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md
• https://github.com/ARM-software/abi-aa/blob/main/aapcs64/aapcs64.rst

[emesare]

The problem is we do not have a way to describe this in the calling convention, see #5922 (comment) for another example of where we get this wrong, however in that case it is with an extern where we cannot infer the return param based off the registers usage in the body, rather we need to take into account the size of the return type, both heuristics together would be enough to accurately identify this pattern I believe.

[pjcreath]

Returning large values from functions is messy in every calling convention I've ever seen. I am essentially asking for enhancement of BN's notion of calling conventions.

I'm less concerned with BN inferring the type correctly, as I can always type the variable on the stack. I'd at least like it to know the idiom of:

uint128_t var_a0;
var_a0 = function(args);

coming from

x8 = &var_a0
x0 = arg1
...
call function