If you have a resilient I/O domain and then assign a device in one of the following ways, then the I/O domain is no longer resilient:
Add a virtual function from a card that does not support I/O resiliency.
Directly assign a device by using the direct I/O feature.
In the above cases, set the failure-policy from ignore to reset or stop.
When you hotplug an SR-IOV card to the root domain and then assign virtual functions from it to an I/O domain, the I/O domain might fail to provide resiliency when the root domain fails. Therefore, it is best practice to add the SR-IOV card while the root domain is down. Then assign the virtual functions after the root domain boots.