.SQUASHFS File Format

Introduction

SquashFS 1 is the first version of the compressed read-only Linux filesystem, and the one with the most restrictions: a 16-bit block size (32 KiB blocks), no fragments, user and group ids chosen from small tables, and inodes packed as tightly as possible. Version 2 replaced it. It compresses with gzip only, and unsquashfs still reads it.

The file starts with hsqs (little-endian) or sqsh (big-endian), the same magic as every other version; the major version number 1 at byte 28 tells them apart. The minor number is 0.

How it works

A 119-byte superblock (the structure shared by versions 1 to 3, of which version 1 uses the 32-bit fields and a 16-bit block size) gives the offset of each table. Files are cut into blocks of the block size, each compressed on its own (a zlib stream) with a 16-bit size word, and the last block of a file is short: there are no fragments. The inodes and the directory listings are in metadata blocks of at most 8 KiB. An inode’s header is 3 bytes: the owner is a 4-bit index plus a group number folded into the type. The user and group ids are two plain arrays at the end of the file (at most 48 users and 15 groups). There are no inode numbers.

In the explorer

Drop a .squashfs, .sqsh or .sfs file. The explorer reads the version from the file and shows version 1 as it does version 4: a structure tree that covers every byte, and the tables Files, Directory entries, Inodes, Ids, Metadata blocks, Data blocks and Problems. Inode numbers, which the image does not store, are shown as the kernel computes them from the position. Files open decompressed on demand, and a damaged image is reported, never hung on. Both byte orders are read.

Not described

The layouts are those of the squashfs-tools 3.4 source (squashfs_fs.h and its _1 structures with the bit position of every field). No program that writes version 1 runs on the machine that built these pages: the test images (little-endian and big-endian) were written by a script from those definitions, and unsquashfs 4.7.5, which reads version 1, agrees with the explorer on every listed path, field and file byte of them.

Known, not yet covered

• Viewer: every metadata block of the test images is stored uncompressed; compressed metadata blocks use the code the version 4 tests check.

Unknown

• Reference and Viewer: no real image in version 1 was available, so the form found in the wild is unchecked.

Variants

• SquashFS 4.0 filesystem – the current format: six compressors, extended attributes, little- or big-endian
• SquashFS 3 filesystem – gzip only, bit-field inodes, fragments, sparse blocks, a lookup table for NFS (3.1)
• SquashFS 2 filesystem – fragments, no inode numbers or link counts
• SquashFS 1 filesystem – the first version: no fragments, 16-bit block sizes

Links