.SQUASHFS File Format

Introduction

SquashFS 2 is the version of the compressed read-only Linux filesystem that sits between the first (version 1) and version 3. It added fragments, so that the tails of small files share a block. Versions 2.0 and 2.1 exist: the only difference to a reader is that the entries of a directory are sorted by name in 2.1, and not in 2.0. It compresses with gzip only. The tools of 2.2 wrote version 2.1.

The file starts with hsqs (little-endian) or sqsh (big-endian), the same magic as every other version; the major version number 2 at byte 28 tells them apart. Version 2 keeps no inode numbers and no link counts, and a time only in file and directory inodes.

How it works

A 119-byte superblock (the structure shared by versions 1 to 3, of which version 2 uses the 32-bit fields) gives the block size and the offset of each table. Files are cut into blocks of the block size, each compressed on its own, and the tail of a file is in a fragment block. The inodes and the directory listings are in metadata blocks of at most 8 KiB, with their small fields packed into bit-fields. The user and group ids are two plain arrays at the end of the file. A directory entry carries no inode number: the kernel makes one from the position of the inode.

In the explorer

Drop a .squashfs, .sqsh or .sfs file. The explorer reads the version from the file and shows version 2 as it does version 4: a structure tree that covers every byte, and the tables Files, Directory entries, Inodes, Directory indexes, Fragments, Ids, Metadata blocks, Data blocks and Problems. Inode numbers, which the image does not store, are shown as the kernel computes them from the position. Files open decompressed on demand, and a damaged image is reported, never hung on. Both byte orders are read.

Not described

The layouts are those of the squashfs-tools 3.4 source (squashfs_fs.h and its _2 structures with the bit position of every field). No program that writes version 2 runs on the machine that built these pages: the test images (2.0 and 2.1, little-endian and big-endian) were written by a script from those definitions, and unsquashfs 4.7.5, which reads version 2, agrees with the explorer on every listed path, field and file byte of them.

Known, not yet covered

• Viewer: every metadata block of the test images is stored uncompressed; compressed metadata blocks use the code the version 4 tests check.

Unknown

• Reference and Viewer: no real image in version 2 was available, so the form found in the wild is unchecked.

Variants

• SquashFS 4.0 filesystem – the current format: six compressors, extended attributes, little- or big-endian
• SquashFS 3 filesystem – gzip only, bit-field inodes, fragments, sparse blocks, a lookup table for NFS (3.1)
• SquashFS 2 filesystem – fragments, no inode numbers or link counts
• SquashFS 1 filesystem – the first version: no fragments, 16-bit block sizes

Links