Cold Plugging vs Hot Plugging in Linux Explained

This article explores the fundamental differences between cold plugging and hot plugging devices within the Linux operating system. It details how the Linux kernel detects hardware, manages dynamic device states, and handles system resources when hardware is connected before system boot versus during active runtime. By understanding the roles of the Linux kernel, sysfs, and the udev device manager, system administrators and developers can better manage hardware connectivity and troubleshooting in a Linux environment.

What is Cold Plugging?

Cold plugging refers to connecting hardware components to a computer while the system is powered off. When the machine powers on, the system firmware (BIOS or UEFI) initializes the base hardware and passes system configuration data to the Linux kernel via ACPI or Device Tree tables.

During the boot process, the kernel enumerates all connected buses (such as PCI, SATA, and USB) to identify attached devices. Once identified, the kernel creates the corresponding device structures in the virtual filesystem /sys (sysfs). The system's device manager, typically systemd-udevd, then processes this static state, loads required kernel modules (drivers), and creates the corresponding device nodes under the /dev directory before user-space initialization completes.

Typical cold-plugged devices include internal components that do not support runtime insertion, such as standard RAM modules, non-hot-swap CPUs, and conventional internal PCIe expansion cards.

What is Hot Plugging?

Hot plugging is the process of adding or removing hardware components while the computer system is powered on and the Linux operating system is actively running, without requiring a reboot.

When a hot-pluggable device is inserted (such as a USB drive, Thunderbolt peripheral, or hot-swappable NVMe drive):

Hardware Interrupt: The underlying bus hardware detects electrical state changes and generates a hardware interrupt.
Kernel Event: The kernel driver for the bus handles the interrupt, identifies the new hardware, and generates a uevent message containing device metadata.
Netlink Transmission: The kernel broadcasts the uevent to user space over a Netlink socket.
Udev Handling: The systemd-udevd daemon listens for these events, reads matching configuration rules from /etc/udev/rules.d/ and /usr/lib/udev/rules.d/, loads necessary kernel modules via modprobe, and dynamically creates device files in /dev.

When a device is safely disconnected (unplugged), the inverse occurs: the kernel detects the removal, issues a removal uevent, and udev cleans up the associated device nodes.

Key Differences

Feature	Cold Plugging	Hot Plugging
System State	System is powered off during connection.	System is running and active during connection.
Detection Method	Firmware scan followed by kernel boot-time hardware enumeration.	Asynchronous hardware interrupts and dynamic bus scans.
User-Space Event	`udev` processes a batch of pre-existing devices sequentially at boot.	`udev` dynamically processes real-time `uevents` asynchronously.
Driver Loading	Drivers load during the system startup sequence.	Drivers load on demand when the device insertion is detected.
Device Examples	Motherboards, standard RAM, internal GPUs, non-hot-swap power supplies.	USB storage, Thunderbolt docks, external mice/keyboards, hot-swap SATA/SAS drives.

The Linux "Coldplug" Subsystem

To maintain consistency, modern Linux systems treat cold-plugged devices similarly to hot-plugged devices via a mechanism called the "coldplug trigger." During the boot sequence, udev triggers synthetic uevents for all hardware discovered by the kernel before udev was running. This ensures that a single configuration path handles driver loading, permission management, and device node generation regardless of when the physical hardware was connected.