0001 ===========================================================
0002 LZO stream format as understood by Linux's LZO decompressor
0003 ===========================================================
0004
0005 Introduction
0006 ============
0007
0008 This is not a specification. No specification seems to be publicly available
0009 for the LZO stream format. This document describes what input format the LZO
0010 decompressor as implemented in the Linux kernel understands. The file subject
0011 of this analysis is lib/lzo/lzo1x_decompress_safe.c. No analysis was made on
0012 the compressor nor on any other implementations though it seems likely that
0013 the format matches the standard one. The purpose of this document is to
0014 better understand what the code does in order to propose more efficient fixes
0015 for future bug reports.
0016
0017 Description
0018 ===========
0019
0020 The stream is composed of a series of instructions, operands, and data. The
0021 instructions consist in a few bits representing an opcode, and bits forming
0022 the operands for the instruction, whose size and position depend on the
0023 opcode and on the number of literals copied by previous instruction. The
0024 operands are used to indicate:
0025
0026 - a distance when copying data from the dictionary (past output buffer)
0027 - a length (number of bytes to copy from dictionary)
0028 - the number of literals to copy, which is retained in variable "state"
0029 as a piece of information for next instructions.
0030
0031 Optionally depending on the opcode and operands, extra data may follow. These
0032 extra data can be a complement for the operand (eg: a length or a distance
0033 encoded on larger values), or a literal to be copied to the output buffer.
0034
0035 The first byte of the block follows a different encoding from other bytes, it
0036 seems to be optimized for literal use only, since there is no dictionary yet
0037 prior to that byte.
0038
0039 Lengths are always encoded on a variable size starting with a small number
0040 of bits in the operand. If the number of bits isn't enough to represent the
0041 length, up to 255 may be added in increments by consuming more bytes with a
0042 rate of at most 255 per extra byte (thus the compression ratio cannot exceed
0043 around 255:1). The variable length encoding using #bits is always the same::
0044
0045 length = byte & ((1 << #bits) - 1)
0046 if (!length) {
0047 length = ((1 << #bits) - 1)
0048 length += 255*(number of zero bytes)
0049 length += first-non-zero-byte
0050 }
0051 length += constant (generally 2 or 3)
0052
0053 For references to the dictionary, distances are relative to the output
0054 pointer. Distances are encoded using very few bits belonging to certain
0055 ranges, resulting in multiple copy instructions using different encodings.
0056 Certain encodings involve one extra byte, others involve two extra bytes
0057 forming a little-endian 16-bit quantity (marked LE16 below).
0058
0059 After any instruction except the large literal copy, 0, 1, 2 or 3 literals
0060 are copied before starting the next instruction. The number of literals that
0061 were copied may change the meaning and behaviour of the next instruction. In
0062 practice, only one instruction needs to know whether 0, less than 4, or more
0063 literals were copied. This is the information stored in the <state> variable
0064 in this implementation. This number of immediate literals to be copied is
0065 generally encoded in the last two bits of the instruction but may also be
0066 taken from the last two bits of an extra operand (eg: distance).
0067
0068 End of stream is declared when a block copy of distance 0 is seen. Only one
0069 instruction may encode this distance (0001HLLL), it takes one LE16 operand
0070 for the distance, thus requiring 3 bytes.
0071
0072 .. important::
0073
0074 In the code some length checks are missing because certain instructions
0075 are called under the assumption that a certain number of bytes follow
0076 because it has already been guaranteed before parsing the instructions.
0077 They just have to "refill" this credit if they consume extra bytes. This
0078 is an implementation design choice independent on the algorithm or
0079 encoding.
0080
0081 Versions
0082
0083 0: Original version
0084 1: LZO-RLE
0085
0086 Version 1 of LZO implements an extension to encode runs of zeros using run
0087 length encoding. This improves speed for data with many zeros, which is a
0088 common case for zram. This modifies the bitstream in a backwards compatible way
0089 (v1 can correctly decompress v0 compressed data, but v0 cannot read v1 data).
0090
0091 For maximum compatibility, both versions are available under different names
0092 (lzo and lzo-rle). Differences in the encoding are noted in this document with
0093 e.g.: version 1 only.
0094
0095 Byte sequences
0096 ==============
0097
0098 First byte encoding::
0099
0100 0..16 : follow regular instruction encoding, see below. It is worth
0101 noting that code 16 will represent a block copy from the
0102 dictionary which is empty, and that it will always be
0103 invalid at this place.
0104
0105 17 : bitstream version. If the first byte is 17, and compressed
0106 stream length is at least 5 bytes (length of shortest possible
0107 versioned bitstream), the next byte gives the bitstream version
0108 (version 1 only).
0109 Otherwise, the bitstream version is 0.
0110
0111 18..21 : copy 0..3 literals
0112 state = (byte - 17) = 0..3 [ copy <state> literals ]
0113 skip byte
0114
0115 22..255 : copy literal string
0116 length = (byte - 17) = 4..238
0117 state = 4 [ don't copy extra literals ]
0118 skip byte
0119
0120 Instruction encoding::
0121
0122 0 0 0 0 X X X X (0..15)
0123 Depends on the number of literals copied by the last instruction.
0124 If last instruction did not copy any literal (state == 0), this
0125 encoding will be a copy of 4 or more literal, and must be interpreted
0126 like this :
0127
0128 0 0 0 0 L L L L (0..15) : copy long literal string
0129 length = 3 + (L ?: 15 + (zero_bytes * 255) + non_zero_byte)
0130 state = 4 (no extra literals are copied)
0131
0132 If last instruction used to copy between 1 to 3 literals (encoded in
0133 the instruction's opcode or distance), the instruction is a copy of a
0134 2-byte block from the dictionary within a 1kB distance. It is worth
0135 noting that this instruction provides little savings since it uses 2
0136 bytes to encode a copy of 2 other bytes but it encodes the number of
0137 following literals for free. It must be interpreted like this :
0138
0139 0 0 0 0 D D S S (0..15) : copy 2 bytes from <= 1kB distance
0140 length = 2
0141 state = S (copy S literals after this block)
0142 Always followed by exactly one byte : H H H H H H H H
0143 distance = (H << 2) + D + 1
0144
0145 If last instruction used to copy 4 or more literals (as detected by
0146 state == 4), the instruction becomes a copy of a 3-byte block from the
0147 dictionary from a 2..3kB distance, and must be interpreted like this :
0148
0149 0 0 0 0 D D S S (0..15) : copy 3 bytes from 2..3 kB distance
0150 length = 3
0151 state = S (copy S literals after this block)
0152 Always followed by exactly one byte : H H H H H H H H
0153 distance = (H << 2) + D + 2049
0154
0155 0 0 0 1 H L L L (16..31)
0156 Copy of a block within 16..48kB distance (preferably less than 10B)
0157 length = 2 + (L ?: 7 + (zero_bytes * 255) + non_zero_byte)
0158 Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S
0159 distance = 16384 + (H << 14) + D
0160 state = S (copy S literals after this block)
0161 End of stream is reached if distance == 16384
0162 In version 1 only, to prevent ambiguity with the RLE case when
0163 ((distance & 0x803f) == 0x803f) && (261 <= length <= 264), the
0164 compressor must not emit block copies where distance and length
0165 meet these conditions.
0166
0167 In version 1 only, this instruction is also used to encode a run of
0168 zeros if distance = 0xbfff, i.e. H = 1 and the D bits are all 1.
0169 In this case, it is followed by a fourth byte, X.
0170 run length = ((X << 3) | (0 0 0 0 0 L L L)) + 4
0171
0172 0 0 1 L L L L L (32..63)
0173 Copy of small block within 16kB distance (preferably less than 34B)
0174 length = 2 + (L ?: 31 + (zero_bytes * 255) + non_zero_byte)
0175 Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S
0176 distance = D + 1
0177 state = S (copy S literals after this block)
0178
0179 0 1 L D D D S S (64..127)
0180 Copy 3-4 bytes from block within 2kB distance
0181 state = S (copy S literals after this block)
0182 length = 3 + L
0183 Always followed by exactly one byte : H H H H H H H H
0184 distance = (H << 3) + D + 1
0185
0186 1 L L D D D S S (128..255)
0187 Copy 5-8 bytes from block within 2kB distance
0188 state = S (copy S literals after this block)
0189 length = 5 + L
0190 Always followed by exactly one byte : H H H H H H H H
0191 distance = (H << 3) + D + 1
0192
0193 Authors
0194 =======
0195
0196 This document was written by Willy Tarreau <w@1wt.eu> on 2014/07/19 during an
0197 analysis of the decompression code available in Linux 3.16-rc5, and updated
0198 by Dave Rodgman <dave.rodgman@arm.com> on 2018/10/30 to introduce run-length
0199 encoding. The code is tricky, it is possible that this document contains
0200 mistakes or that a few corner cases were overlooked. In any case, please
0201 report any doubt, fix, or proposed updates to the author(s) so that the
0202 document can be updated.