Parsing UF2 extension tags fails

[Gergely Tóth]

Hi Everyone,

I'm new to fwupd. Our goal at Lightware is to firmware upgrade our device from a Google Meet box using fwupd.

I have a UF2 compatible interface set up. I'm trying to expose our current firmware version through CURRENT.UF2.

My CURRENT.UF2 is a 256 byte dummy payload and the example extension data from the UF2 specification (https://github.com/microsoft/uf2?tab=readme-ov-file#extension-tags).

I would expect this to print the version and device description:

$ fwupdtool firmware-parse current.uf2 uf2

Except it fails with:

FuPluginUf2          unknown tag 0xfaefbe

FuPluginUf2          unknown tag 0xbecefa

invalid extension tag size

This is on a Arch Linux box with the package extra/fwupd 2.0.13-1.

I have attached CURRENT.UF2 and verbose log.

Looking into the parser I can see a few issues.

As I can't confirm my CURRENT.UF2 is absolutely correct, it would be nice to discuss this with someone.

I have checked some hex editors with UF2 support but they all break a different way when it comes to extension tags.

Thanks.

Best regards,

Gergely Ompoly Toth

[Richard Hughes]

On Wednesday, 13 August 2025 at 15:56, Gergely Tóth <gergel...@lightware.com> wrote:
> Hi Everyone,

Welcome!

> Except it fails with:
> FuPluginUf2          unknown tag 0xfaefbe
> FuPluginUf2          unknown tag 0xbecefa

Are these tags defined by you? What do they do? I think fwupd ignores these properly, but if you give us a name of each we can print something better in the logs.

> invalid extension tag size

This is saying "the current tag is too small" -- not helped by not printing *what* tag it's trying to parse. The spec says:

>The first byte of tag contains its total size in bytes (including the size byte and type designation). The next three bytes designate the type of tag (if you want to define custom tags, pick them at random).

So I'm checking that the size is at least 4 bytes in size.

The spec also says:

> The last tag has size of 0 and type of 0.

I suspect this is what's going wrong; I'm confused how we can read the 3-byte tag if the size (which includes the tag-id) is zero -- i.e. seems like a spec bug to me.

I've attached a patch; that seems to fix parsing for me -- but I'd really like to work out what 0xfaefbe and 0xbecefa are before doing a PR.

Richard

[Gergely Ompoly Tóth]

Hi Richard,

The tags should be 0x9fc7bc (version) and 0x650d9d (description).
0xbeefface is the payload. 0xfaefbe and 0xbecefa are part of that.

I believe we have four issues:

* tag parsing starts at offset 32 not at 32 + payloadSize

* tag should be shifted down a byte as the least significant byte is the length in that u32

* 0x00 00 00 00 should be treated as a valid closing tag and should terminate parsing with a success return value
* offset to the next tag should be 4 byte aligned not consecutive

I hope this helps.

Gergely

[Richard Hughes]

On Thursday, 14 August 2025 at 09:14, Gergely Ompoly Tóth <gergel...@lightware.com> wrote:
> I believe we have four issues:
> * tag parsing starts at offset 32 not at 32 + payloadSize
> * tag should be shifted down a byte as the least significant byte is the length in that u32
> * 0x00 00 00 00 should be treated as a valid closing tag and should terminate parsing with a success return value
> * offset to the next tag should be 4 byte aligned not consecutive

All fixed in the hughsie/uf2 branch I think -- with that I get:

<firmware gtype="FuUf2Firmware">
<flags>done-parse</flags>
<id>ACME Toaster mk3</id>
<version>0.1.2</version>
<data type="GBytes" size="0x100" />
</firmware>

If you could confirm that works for you, I'll do a PR -- as the fixes currently depend on https://github.com/fwupd/fwupd/pull/9136 being merged. I've also added reading and writing UF2 extensions into the tests.

Richard

[Gergely Ompoly Tóth]

Great. The change looks good and works as expected. Thank you.

Gergely

[Richard Hughes]

On Thursday, 14 August 2025 at 12:54, Gergely Ompoly Tóth <gergel...@lightware.com> wrote:

> Great. The change looks good and works as expected. Thank you.

> https://github.com/fwupd/fwupd/pull/9138