I think I need newer OVMF firmware than in the Ubuntu repos to update my Windows 10 VM. Best way?

I have a Windows qemu-KVM virtual machine which cannot be updated with the Windows KB5012170 update.

I am pretty sure the issue is the same as described in this thread on GitHub https://github.com/tianocore/edk2/discussions/3221

It seems that the problem is due to the use of older OVMF files, and that the fix is use newer ones.

I am using ubuntu 20.04.5 and My OVMF version is 0~20191122.bd85bf54-2ubuntu3.3

My current ovmf files:

OVMF_CODE.fd     OVMF_CODE.secboot.fd  OVMF_VARS.ms.fd
OVMF_CODE.ms.fd  OVMF_VARS.fd          OVMF_VARS.snakeoil.fd

Can I just use the OVMF_CODE_4M.fd file directly from the Debian 11 repo as discussed in this comment, or might I need to build them myself? Can I expect any issues changing firmware on an existing VM?

I was in the exact same situation as you. I'm running Mint 20.2, which is based on Ubuntu 20.04, and I couldn't install the KB5012170 update on my Windows 11 VM. I basically went through all the same links that you did.

I can't answer whether the Debian 11 version of OVMF works, but I can confirm that building your own updated version of OVMF in Ubuntu works. After installing it, I was able to update Windows.

Here are the steps I followed, using the following resources:

KVM: Building the latest OVMF firmware for virtual machines

Latest stable release not building on Ubuntu 20.04 #2988

How to install NASM on Ubuntu 20.04 LTS | NASM Assembler TAR.GZ File Installation In Ubuntu(Linux)

Update NASM

mkdir nasm; cd nasm/
wget https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/nasm-2.15.05.tar.gz
tar xvfz nasm-2.15.05.tar.gz 
cd nasm-2.15.05/
./configure
make
sudo make install
nasm --version

Build OVMF

 mkdir -p uuefi; cd uuefi/
 git clone https://github.com/tianocore/edk2.git
 cd edk2/
 git submodule update --init
 source ./edksetup.sh 
 make -C BaseTools/
 OvmfPkg/build.sh -a X64 -b RELEASE
 find Build -name OVMF.fd

Install OVMF

Shutdown your VM.

sudo cp -a Build/OvmfX64/RELEASE_GCC5/FV/OVMF.fd /usr/share/OVMF/
sudo chown root.root /usr/share/OVMF/OVMF.fd 
sudo virsh edit <virtual machine name>

Change

<loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>

to

<loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF.fd</loader>

Save & exit, then start your VM. I had to reset my login PIN, but after that, I was able to install the KB5012170 update.