Hi,
Agreed. So keep PANIC_ON but remove a lot of it's users, or add some wrapper that depends on a "guest_panic" parameter that defaults off.
Maybe keep PANIC_ON in case there are any which can trigger on qemu bugs only. Add a new one where the name makes clear this triggers on case the guest driver does something wrong, maybe qxl_guest_bug() or so. Note this isn't a simple search/replace as qemu continues execution, but still has to ignore the invalid request from the guest (and maybe raise an error irq)?
cheers, Gerd