Windows VM KB5012170 update install fails on Focal/QEMU hypervisor

[Mustafa Kemal Gilor]

[ Impact ]

Windows virtual machines running on top of Ubuntu Focal and Bionic hypervisors with the OVMF UEFI bios are facing an issue while installing the KB5012170 update from Microsoft. The windows update cannot proceed to install the KB5012170, because the 2MB OVMF image on the QEMU host no longer has sufficient space to store the contents for the update, which causes the update process to fail. The people running Windows VMs on Ubuntu Focal/QEMU are unable to update their VMs.

There is a known workaround problem, which is using 4MB OVMF images from either Debian or Ubuntu Jammy.

This fix is a backport of 4MB OVMF images from upstream for Focal. This fix also changes the default OVMF image from 2MB to 4MB for all new VMs that will be spawned by a hypervisor using the descriptor interface.

Apart from the fix, the SRU includes a patch that aims to eliminate the flakiness of the autopkgtests by increasing the timeout value, as well as autopkgtests for the backported changes.

[ Test Plan ]

The test plan basically boils down to the scenario below:

- Spawn a Focal/QEMU host with the container/VM technology of your choice
- Create a Windows 10 VM on QEMU (use existing OVMF images at launch)
- Try to install KB5012170 on VM, and it should fail
- Install the fix to the Focal/QEMU host via PPA
- Launch the VM with new 4M images
- Try to install KB5012170 on VM, and it should succeed

The steps below are a reproduction of the test plan above with LXC as a host environment for Focal/QEMU.

# Environment setup describes QEMU running over
# Focal LXC with X11 forwarding

# Download windows 10 ISO:
# https://www.microsoft.com/en-us/software-download/windows10ISO

# -- host shell --
# Create an LXC profile that enables X11 forwarding
# for containers <See the attached x11.profile file>
$ lxc profile create x11
$ cat x11.profile | lxc profile edit x11
# Create a Focal/QEMU container with X11 forwarding
$ lxc launch ubuntu:focal --profile default --profile x11 test-qemu-host
# Mount folder containing windows iso
$ lxc config device add test-qemu-host winiso disk source=/workspace/os-iso path=/os-iso
$ lxc exec test-qemu-host -- sudo --user ubuntu --login

# -- QEMU container shell --
# Install QEMU & OVMF
$ sudo apt -y update && sudo apt -y install qemu-kvm ovmf
# Create a windows VM
$ mkdir windows-vm && cd windows-vm
$ qemu-img create -f qcow2 windows.img 32G
$ cp /usr/share/OVMF/OVMF_VARS.ms.fd OVMF_VARS.ms.windows.fd
# Launch the VM
$ qemu-system-x86_64 -hda windows.img -m 4096M -smp cores=4 -M q35,smm=on -global ICH9-LPC.disable_s3=1 -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE.ms.fd -drive if=pflash,format=raw,file=./OVMF_VARS.ms.windows.fd -cdrom /os-iso/Win10_22H2_English_x64.iso
# Setup the operating system
# After everything settles:
# Download KB5012170 from Microsoft Update Catalog
# https://www.catalog.update.microsoft.com/Search.aspx?q=KB5012170
# Try to install the KB5012170 update, it should fail
# Shutdown VM
# Install fix to QEMU host from PPA:
sudo add-apt-repository ppa:mustafakemalgilor/lp-1885662-4
sudo apt update
# Re-launch VM with new 4M images:
cp /usr/share/OVMF/OVMF_VARS_4M.ms.fd OVMF_VARS_4M.ms.windows.fd
qemu-system-x86_64 -hda windows.img -m 8192M -smp cores=4 -M q35,smm=on -global ICH9-LPC.disable_s3=1 -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd -drive if=pflash,format=raw,file=./OVMF_VARS_4M.ms.windows.fd
# Re-try to install the KB5012170, it should succeed

[ Where problems could occur ]

This SRU introduces providing an OVMF image with a higher capacity variable store, which will have no impact on existing VMs. The migration of existing VMs will be opt-in.

The new VMs will be using the 4MB OVMF image by default, given that the owning hypervisor is using the descriptor interface.

The user will be able to switch back to the 2MB image in case of regression.

[ Other Info ]

This update does not replace the existing 2MB OVMF image; instead, it provides a new 4MB image. Therefore, the existing VMs should be manually migrated to the 4MB image.