q-dev: make pci can be only assigned as required

1. `ask-to-attach` is not even implemented for PCI (assigned devices will be ignored)
2. manual attaching could lead to unusable devices
3. `auto-attach` there is no good reason for ignoring absent of PCI device

Author: piotrbartman

qubesadmin/devices.py

@@ -64,6 +64,10 @@ def attach(self, assignment: DeviceAssignment) -> None:
 
         :param DeviceAssignment assignment: device object
         """
+        if assignment.devclass == 'pci':
+            raise qubesadmin.exc.QubesValueError(
+                f"PCI devices cannot be attached manually, "
+                f"did you mean `qvm-pci assign --required ...`")
         self._add(assignment, 'attach')
 
     def detach(self, assignment: DeviceAssignment) -> None:
@@ -85,7 +89,10 @@ def assign(self, assignment: DeviceAssignment) -> None:
                 and assignment.required):
             raise qubesadmin.exc.QubesValueError(
                 "Only pci and block devices can be assigned as required.")
-        if (assignment.devclass not in ('pci', 'testclass', 'usb', 'block')
+        if assignment.devclass == 'pci' and not assignment.required:
+            raise qubesadmin.exc.QubesValueError(
+                f"PCI devices cannot be assigned as not required.")
+        if (assignment.devclass not in ('testclass', 'usb', 'block')
                 and assignment.attach_automatically):
             raise qubesadmin.exc.QubesValueError(
                 f"{assignment.devclass} devices cannot be assigned "