Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World
seL4: formal verification of an OS kernel