arm: The cache may not be cleaned for newly allocated scrubbed pages

ISSUE DESCRIPTION

On Arm, a guest is allowed to control whether memory access bypass the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest.
Unfortunately the operation to clean the cache happens before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.

IMPACT

A malicious guest may be able to read sensitive data from memory that previously belonged to another guest.

VULNERABLE SYSTEMS

Xen version 4.9 onwards are vulnerable. Only Arm systems are vulnerable.