xen: restrict only for x64 (32bit hypervisor unsupported anyway).