I suppose this would still be susceptible to this class of attack: https://www.usenix.org/conference/usenixsecurity16/technical...

Unless you're very careful about which ranges of physical memory are mapped to each VM.