I'm wondering what actually happens to a Linux-swap partition reboot. I've been taking a course in computer organization and while installing/partitioning a new drive I became rather curious about this.

  1. As I understand it, Linux-swap partitions are more-or-less unallocated space within a partitioning scheme on a hard-drive that acts as a stack of memory in similar fasion to ram but had a larger databus waiting time (since it is a HDD/SSD managed in part by the drive itself rather than true ram managed directly by the CPU). Is this model correct?

  2. Is information persistent until a Linux-swap tool cleans it, unlike RAM which is erased by a lapse in power?

  3. Can you address it directly? Or in C/C++ by the assistance of the kernel (so as to not mess stuff up)?

2 Answers 2

  1. Your course probably covered the differences between L1/L2 cache and registers; with a hierarchy of registers, L1, L2, L3, RAM. Similarly, as you note, you can consider the swap as unallocated space that RAM is swapped out to.
  2. Swap may be persistent, depending on the system configuration. Some Linux distributions deliberately erase/zero swap on boot or shutdown for security or performance reasons. If you run swap on SSD, it may be benefical to issue TRIM/DISCARD on a block of swap space when the contents are copied back to RAM. There is no specific tool to clean swap, other than letting the kernel reuse the space (if it's unallocated, and only writes to it, it doesn't care what was there before). Another common paradigm is to encrypt swap with a new key on each boot, and then just discard the key at shutdown.
  3. You cannot access the contents of swap directly from the kernel. You could bypass the normal memory process and try to read it as disk, but you normally have no knowledge of where or even if any part of your process is in swap.

Swap space is a part of the disk that's used to store additional content from the memory. Since it's stored on disk, it isn't erased when the power goes out (unlike the RAM content). However, when the system boots, it doesn't read back anything that was stored in swap — the data there is not directly usable since it belongs to programs that are no longer running.

The kernel uses the swap space to store some of the data that would normally be stored in RAM. The data can't be used directly while it's on disk, so it needs to be loaded back into RAM when it is used. The point of swap is to allow the system to use more memory than is available in RAM alone. The kernel starts writing out parts of the RAM content to swap when RAM usage gets high.

Data that is in the swap space remains until it's overwritten by new data. Mostly that information is unusable because it's too fragmented and partial. However, if confidential information is written to swap, it may be a security risk — all it takes is for one key to be written there. So if there is a risk that your hard disk is stolen, you should encrypt your swap space.

Linux can use the swap space to hibernate the system. In this case, it swaps out all processes (and not just some pages as needed, as is normally the case) and writes additional data to the swap space that allow the kernel to reconstruct the full memory layout on the next boot. In addition, the information is stored in a different format (in most configurations, the hibernation image is compressed).

Swap is completely transparent to processes. A process doesn't know whether a particular location in memory happens to have been swapped out. At the time a process is accessing a memory location, that location is always in RAM. You can read from the swap partition directly, but you can't do anything useful that way.

  • IIRC there are kernel calls to mark data as being something that should never be swapped out. gnome-keyring does this.
    – strugee
    Dec 9, 2013 at 3:16
  • 1
    @strugee Yes, mlock, subject to a per-process limit. Dec 9, 2013 at 10:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .