qemu: 4.1.0 -> 4.2.0, including patch for minor CVE-2019-15890

[risicle]

Motivation for this change

Mostly the bump but also https://nvd.nist.gov/vuln/detail/CVE-2019-15890

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @

[risicle]

@GrahamcOfBorg build aqemu vagrant minikube cloud-utils

[blitz]

I gave this a quick shot. Looks good.

Testing done

• Booting grml LiveCD with qemu-system-x86_64
• Booting RISC-V kernel in qemu-system-riscv64

[wedens]

Unfortunately, qemu is already updated to 4.1 in unstable, but libvirt is still 5.4.0. so I'll mention it here.

Using some vpindex hyper-v enlightement with qemu > 4.0 and libvirt < 5.6.0 will result in this error:

"error: unsupported configuration: host doesn't support hyperv 'vpindex' feature"

Many other enlightements depend on vpindex presence.

It probably worth its own issue, but I just want to bring attention.

https://www.redhat.com/archives/libvir-list/2019-July/msg01642.html