Static Analysis of the XEN Kernel using Frama-C