Breaking up is hard to do: security and functionality in a commodity hypervisor
seL4: formal verification of an OS kernel