Here's the second spin of my preferred approach to handling grouping of devices for safe assignment to guests.
Changes since v1: * Many name changes and file moves for improved consistency * Bugfixes and cleanups * The interface to the next layer up is considerably fleshed out, although it still needs work. * Example initialization of groups for p5ioc2 and p7ioc. TODO: * Need sample initialization of groups for intel and/or amd iommus * Use of sysfs attributes to control group permission is probably a mistake. Although it seems a bit odd, registering a chardev for each group is probably better, because perms can be set from udev rules, just like everything else. * Need more details of what the binder structure will need to contain. * Handle complete removal of groups. * Clarify what will need to happen on the hot unplug path.