When you hotplug an SR-IOV card to the root domain and then assign virtual functions to it to an I/O domain, the I/O domain might fail to provide resiliency when the root domain fails. Therefore, you should only add the SR-IOV card while the root domain is down. Then assign the virtual functions after the root domain boots.
If you have a resilient I/O domain and then assign a device in one of the following ways, then the I/O domain is no longer resilient:
Add a virtual function from a card that does not support I/O resiliency
Directly assign a device by using the direct I/O feature
In that case, set the failure-policy from ignore to reset or stop.