Formal Models of Operating System Kernels