GCP at least takes the approach of monitoring single and double bit flips to kill offending VMs. There's also a potential performance tradeoff (no idea if GCP

GCP at least takes the approach of monitoring single and double bit flips to kill offending VMs. There's also a potential performance tradeoff (no idea if GCP is using this) of running some single channel DIMMs for isolating VMs from the kernel and kvm userspace. Reference: https://www.google.com/amp/s/cloudblog.withgoogle.com/products/gcp/7-ways-we-harden-our-kvm-hypervisor-at-google-cloud-security-in-plaintext/amp/ https://www.google.com/amp/s/cloudblog.withgoogle.com/produc...