[BUG] Making a PCIDeviceClaim for a device in an IOMMU group can violate IOMMU restrictions, preventing successful allocation to a VM

[Tobi Lehman]

For example, suppose you have an NVIDIA GPU with

• a VGA controller on board and
• an Audio device on board
  Both with their own PCI addresses. They belong to the same IOMMU group.

If you claim just the VGA controller but not the Audio device, then it cannot be attached to a KubeVirt VM. Currently, users have to claim both and then assign them both to the same VM, but this is a sub-par user experience. It allows the user to violate IOMMU restrictions.

One way to solve this problem would be to have the PCIDeviceClaim controller automatically create claims for all members of the same IOMMU group. But assignment to a VM will have to change as well, since it's possible that two VMs get assigned members of the same IOMMU group.

See this archived page for a more detailed discussion of this failure mode.