* restrict all KVM hosts