I have comitted SR-IOV crimes. A little extension on the pcie_acs_override patchset zen already ships that also bypasses the "External" checks.

This allows me to split the 25GbE Thunderbolt NIC (a ConnectX-4) into 7 VFs (not more, the enclosure doesn't do ARI forwarding, long story, no thunderbolt chipset I have does) in different iommu groups.

And then put one of these VFs into my HAOS VM.

Nice :3