CloudVisor: retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization
seL4: formal verification of an OS kernel