How to properly set up Manjaro with btrfs + hibernation + encryption?

Support
, , , ,
1

Hello guys,

Manjaro-Newbie here! I’m currently trying to set up my Manjaro to use hibernation. I have read a lot of related forum posts here, watched a lot of tutorials on YouTube and also read the manjaro and arch wiki. But it seems, that none of the docs could provide a working solution for what i am trying to do.

I have installed Manjaro KDE using the USB-Installer. During installation i have choosen to use btrfs (because of timeshift snapshots) with encryption and hibernation. I let the installer configure my partition layout and btrfs subvolumes.
After a successful installation i immediately tried to hibernate, but it didn’t work properly. Meaning, my Laptop seemed to go to hibernation, but after waking it up the current state (all open apps etc) were gone.

Needles to say, that during boot i’m getting the error:

device does not exist or access denied.
ERROR: resume: hibernation device /dev/mapper/luks....

I searched this forum and found posts, that were stating i have to fix the resume device by setting the correct UUID of the swap partition in /etc/default/grub and set the proper hooks in /etc/mkinitcpio.conf. Which i did with no success. I’m seeing an error during boot and hibernation fails.

I have found a post (with the title linux-laptop-with-encrypted-disk-and-hibernation) which describes how to setup a swapfile - which i followed without any success. I only get more errors during boot and hibernation fails immediately.

So my newbie questions are:

  • What are my options for using hibernation with my configuration?
    • swap partition?
    • swap file?
    • there is also btrfs-swapon, what’s that?

I’m completely confused. I kindly like to ask for clarification on how to setup my Manjaro with hibernation and encryption.

Thanks!

Here’s my configuration:

root@localhost# /etc/fstab
UUID=yyyy-yyyy                            /boot/efi      vfat    umask=0077 0 2
/dev/mapper/luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx /              btrfs   subvol=/@,defaults,discard=async 0 0
/dev/mapper/luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx /home          btrfs   subvol=/@home,defaults,discard=async 0 0
/dev/mapper/luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx /var/cache     btrfs   subvol=/@cache,defaults,discard=async 0 0
/dev/mapper/luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx /var/log       btrfs   subvol=/@log,defaults,discard=async 0 0
/swapfile       none    swap    defaults 0 0 
tmpfs                                     /tmp           tmpfs   defaults,noatime,mode=1777 0 0

with xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx being the UUID of my root partition and
yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy being the UUID of my swapfile determined by

root@localhost# head /etc/default/grub
GRUB_DEFAULT=saved
GRUB_TIMEOUT=5
GRUB_TIMEOUT_STYLE=hidden
GRUB_DISTRIBUTOR="Manjaro"
GRUB_CMDLINE_LINUX_DEFAULT="quiet cryptdevice=UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx:luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx root=/dev/mapper/luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx apparmor=1 security=apparmor udev.log_priority=3 resume=UUID=yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy resume_offset=10755328"
GRUB_CMDLINE_LINUX=""


root@localhost# cat /etc/openswap.conf
## cryptsetup open $swap_device $crypt_swap_name
## get uuid using e.g. lsblk -f
# swap_device=/dev/disk/by-uuid/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
swap_device=/swapfile
# crypt_swap_name=luks-zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz

## one can optionally provide a keyfile device and path on this device
## to the keyfile
# keyfile_device=/dev/mapper/luks-zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
# keyfile_filename=crypto_keyfile.bin

## additional arguments are given to mount for keyfile_device
## has to start with --options (if so desired)
## keyfile_device_mount_options="--options=subvol=__active/__"

## additional arguments are given to cryptsetup
## --allow-discards options is desired in case swap is on SSD partition
# cryptsetup_options="--type luks"

→ What is the openswap.conf? Do i need it? I stumbled upon it, and tried to setup the swap file there as my swap.

root@localhost# grep HOOKS /etc/mkinitcpio.conf 

# HOOKS
# This is the most important setting in this file.  The HOOKS control the
# order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
#    HOOKS=(base)
#    HOOKS=(base udev autodetect block filesystems)
#    HOOKS=(base udev block filesystems)
#    HOOKS=(base udev block mdadm encrypt filesystems)
#    HOOKS=(base udev block lvm2 filesystems)
HOOKS="base udev autodetect modconf block encrypt openswap keyboard keymap consolefont filesystems resume"

root@localhost# lsblkid # without the loop devices
sda                                             8:0    0 111,8G  0 disk  
├─sda1                                          8:1    0   300M  0 part  /boot/efi
├─sda2                                          8:2    0  98,8G  0 part  
│ └─luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx 254:0    0  98,8G  0 crypt /run/timeshift/backup
│                                                                        /var/log
│                                                                        /home
│                                                                        /var/cache
│                                                                        /
└─sda3                                          8:3    0  12,7G  0 part  
  └─luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx 254:1    0  12,7G  0 crypt 


## Some infos from inxi -b
System:
  Kernel: 5.15.28-1-MANJARO arch: x86_64 bits: 64 compiler: gcc v: 11.2.0
    parameters: BOOT_IMAGE=/@/boot/vmlinuz-5.15-x86_64
    root=UUID=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz rw rootflags=subvol=@ quiet
    cryptdevice=UUID=yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy:luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy
    root=/dev/mapper/luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy apparmor=1
    security=apparmor udev.log_priority=3
    resume=UUID=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz resume_offset=10755328
  Console: pty pts/1 DM: SDDM Distro: Manjaro Linux base: Arch Linux
Machine:
  Type: Laptop System: LENOVO product: 20BWCT0PC0 v: ThinkPad T450s
    serial: <filter> Chassis: type: 10 serial: <filter>
  Mobo: LENOVO model: 20BWCT0PC0 v: 0B98417 WIN serial: <filter>
    UEFI: LENOVO v: JBET73WW (1.37 ) date: 08/14/2019
Battery:
  ID-1: BAT0 charge: 17.4 Wh (100.0%) condition: 17.4/23.2 Wh (74.8%)
    volts: 12.3 min: 11.1 model: SANYO 45N1773 type: Li-ion serial: <filter>
    status: full
  ID-2: BAT1 charge: 44.6 Wh (64.1%) condition: 69.6/71.3 Wh (97.7%)
    volts: 11.3 min: 10.8 model: SANYO 45N1777 type: Li-ion serial: <filter>
    status: discharging
Memory:
  RAM: total: 11.57 GiB used: 4.21 GiB (36.4%)
  Array-1: capacity: 16 GiB slots: 2 EC: None max-module-size: 8 GiB
    note: est.
  Device-1: ChannelA-DIMM0 size: 4 GiB speed: 1600 MT/s type: DDR3
    detail: synchronous bus-width: 64 bits total: 64 bits manufacturer: Samsung
    part-no: K4B8G1646B-MYK0 serial: <filter>
  Device-2: ChannelB-DIMM0 size: 8 GiB speed: 1600 MT/s type: DDR3
    detail: synchronous bus-width: 64 bits total: 64 bits manufacturer: 1324
    part-no: H641GU67G1600G serial: N/A
CPU:
  Info: model: Intel Core i7-5600U socket: BGA1168 (U3E1) note: check bits: 64
    type: MT MCP arch: Broadwell family: 6 model-id: 0x3D (61) stepping: 4
    microcode: 0x2F
  Topology: cpus: 1x cores: 2 tpc: 2 threads: 4 smt: enabled cache:
    L1: 128 KiB desc: d-2x32 KiB; i-2x32 KiB L2: 512 KiB desc: 2x256 KiB
    L3: 4 MiB desc: 1x4 MiB
  Speed (MHz): avg: 1584 high: 2594 min/max: 500/3200 base/boost: 2600/3600
    scaling: driver: intel_cpufreq governor: schedutil volts: 1.1 V
    ext-clock: 100 MHz cores: 1: 1487 2: 807 3: 1449 4: 2594 bogomips: 20759
  Flags: 3dnowprefetch abm acpi adx aes aperfmperf apic arat arch_perfmon
    avx avx2 bmi1 bmi2 bts clflush cmov constant_tsc cpuid cpuid_fault cx16 cx8
    de ds_cpl dtes64 dtherm dts epb ept ept_ad erms est f16c flexpriority
    flush_l1d fma fpu fsgsbase fxsr hle ht ibpb ibrs ida intel_pt invpcid
    invpcid_single lahf_lm lm mca mce md_clear mmx monitor movbe msr mtrr
    nonstop_tsc nopl nx pae pat pbe pcid pclmulqdq pdcm pdpe1gb pebs pge pln
    pni popcnt pse pse36 pti pts rdrand rdseed rdtscp rep_good rtm sdbg sep
    smap smep smx ss ssbd sse sse2 sse4_1 sse4_2 ssse3 stibp syscall tm tm2
    tpr_shadow tsc tsc_adjust tsc_deadline_timer vme vmx vnmi vpid x2apic
    xsave xsaveopt xtopology xtpr
  Vulnerabilities:
  Type: itlb_multihit status: KVM: VMX disabled
  Type: l1tf
    mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
  Type: mds mitigation: Clear CPU buffers; SMT vulnerable
  Type: meltdown mitigation: PTI
  Type: spec_store_bypass
    mitigation: Speculative Store Bypass disabled via prctl and seccomp
  Type: spectre_v1
    mitigation: usercopy/swapgs barriers and __user pointer sanitization
  Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, IBRS_FW,
    STIBP: conditional, RSB filling
  Type: srbds mitigation: Microcode
  Type: tsx_async_abort mitigation: Clear CPU buffers; SMT vulnerable
Graphics:
  Device-1: Intel HD Graphics 5500 vendor: Lenovo driver: i915 v: kernel
    ports: active: eDP-1 empty: DP-1, DP-2, HDMI-A-1, HDMI-A-2 bus-ID: 00:02.0
    chip-ID: 8086:1616 class-ID: 0300
  Device-2: Chicony Integrated Camera type: USB driver: uvcvideo
    bus-ID: 2-8:5 chip-ID: 04f2:b449 class-ID: 0e02 serial: <filter>
  Display: server: X.org v: 1.21.1.3 with: Xwayland v: 22.1.0
    compositor: kwin_wayland driver: X: loaded: modesetting
    alternate: fbdev,vesa gpu: i915 tty: 196x44
  Monitor-1: eDP-1 model: AU Optronics 0x303e built: 2012 res: 1600x900
    dpi: 132 gamma: 1.2 size: 309x174mm (12.17x6.85") diag: 355mm (14")
    ratio: 16:9 modes: 1600x900
  Message: GL data unavailable in console for root.
Audio:
  Device-1: Intel Broadwell-U Audio vendor: Lenovo driver: snd_hda_intel
    v: kernel bus-ID: 00:03.0 chip-ID: 8086:160c class-ID: 0403
  Device-2: Intel Wildcat Point-LP High Definition Audio vendor: Lenovo
    driver: snd_hda_intel v: kernel bus-ID: 00:1b.0 chip-ID: 8086:9ca0
    class-ID: 0403
  Sound Server-1: ALSA v: k5.15.28-1-MANJARO running: yes
  Sound Server-2: JACK v: 1.9.20 running: no
  Sound Server-3: PulseAudio v: 15.0 running: yes
  Sound Server-4: PipeWire v: 0.3.48 running: yes
Network:
  Device-1: Intel Ethernet I218-LM vendor: Lenovo driver: e1000e v: kernel
    port: 3080 bus-ID: 00:19.0 chip-ID: 8086:15a2 class-ID: 0200
  IF: enp0s25 state: down mac: <filter>
  Device-2: Intel Wireless 7265 driver: iwlwifi v: kernel pcie: gen: 1
    speed: 2.5 GT/s lanes: 1 bus-ID: 03:00.0 chip-ID: 8086:095b class-ID: 0280
  IF: wlp3s0 state: up mac: <filter>
  IP v4: <filter> type: dynamic noprefixroute scope: global
    broadcast: <filter>
  IP v6: <filter> type: noprefixroute scope: link
  IF-ID-1: wwp0s20u4 state: down mac: <filter>
  WAN IP: <filter>
Bluetooth:
  Device-1: Intel Bluetooth wireless interface type: USB driver: btusb v: 0.8
    bus-ID: 2-7:4 chip-ID: 8087:0a2a class-ID: e001
  Report: rfkill ID: hci0 rfk-id: 5 state: up address: see --recommends
Logical:
  Message: No logical block device data found.
  Device-1: luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy maj-min: 254:0
    type: LUKS dm: dm-0 size: 98.76 GiB
  Components:
  p-1: sda2 maj-min: 8:2 size: 98.77 GiB
  Device-2: luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx maj-min: 254:1
    type: LUKS dm: dm-1 size: 12.73 GiB
  Components:
  p-1: sda3 maj-min: 8:3 size: 12.73 GiB
RAID:
  Message: No RAID data found.
Drives:
  Local Storage: total: 111.79 GiB used: 59.38 GiB (53.1%)
  ID-1: /dev/sda maj-min: 8:0 vendor: Crucial model: CT120BX500SSD1
    family: Micron Client SSDs size: 111.79 GiB block-size: physical: 512 B
    logical: 512 B sata: 3.2 speed: 6.0 Gb/s type: SSD serial: <filter>
    rev: R013 temp: 33 C scheme: GPT
  SMART: yes state: enabled health: PASSED on: 196d 13h cycles: 54
    written: 8.76 TiB
  Message: No optical or floppy data found.
Partition:
  ID-1: / raw-size: 98.76 GiB size: 98.76 GiB (100.00%)
    used: 59.38 GiB (60.1%) fs: btrfs block-size: 4096 B dev: /dev/dm-0
    maj-min: 254:0 mapped: luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy
    label: N/A uuid: zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
  ID-2: /boot/efi raw-size: 300 MiB size: 299.4 MiB (99.80%)
    used: 712 KiB (0.2%) fs: vfat block-size: 512 B dev: /dev/sda1 maj-min: 8:1
    label: NO_LABEL uuid: 6567-F467
  ID-3: /home raw-size: 98.76 GiB size: 98.76 GiB (100.00%)
    used: 59.38 GiB (60.1%) fs: btrfs block-size: 4096 B dev: /dev/dm-0
    maj-min: 254:0 mapped: luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy
    label: N/A uuid: zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
  ID-4: /run/timeshift/backup raw-size: 98.76 GiB size: 98.76 GiB (100.00%)
    used: 59.38 GiB (60.1%) fs: btrfs block-size: 4096 B dev: /dev/dm-0
    maj-min: 254:0 mapped: luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy
    label: N/A uuid: zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
  ID-5: /var/cache raw-size: 98.76 GiB size: 98.76 GiB (100.00%)
    used: 59.38 GiB (60.1%) fs: btrfs block-size: 4096 B dev: /dev/dm-0
    maj-min: 254:0 mapped: luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy
    label: N/A uuid: zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
  ID-6: /var/log raw-size: 98.76 GiB size: 98.76 GiB (100.00%)
    used: 59.38 GiB (60.1%) fs: btrfs block-size: 4096 B dev: /dev/dm-0
    maj-min: 254:0 mapped: luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyy
    label: N/A uuid: zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
Swap:
  Kernel: swappiness: 60 (default) cache-pressure: 100 (default)
  ID-1: swap-1 type: file size: 16 GiB used: 0 KiB (0.0%) priority: -2
    file: /swapfile
Unmounted:
  ID-1: /dev/dm-1 maj-min: 254:1
    mapped: luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx size: 12.73 GiB fs: swap
    label: swap uuid: 19cc24bc-a652-4fce-aa0b-eca82837a631
USB:
  Hub-1: 1-0:1 info: Full speed or root hub ports: 3 rev: 2.0 speed: 480 Mb/s
    chip-ID: 1d6b:0002 class-ID: 0900
  Hub-2: 1-1:2 info: Intel Integrated Hub ports: 8 rev: 2.0 speed: 480 Mb/s
    chip-ID: 8087:8001 class-ID: 0900
  Hub-3: 2-0:1 info: Hi-speed hub with single TT ports: 11 rev: 2.0
    speed: 480 Mb/s chip-ID: 1d6b:0002 class-ID: 0900
  Device-1: 2-4:10 info: Sierra Wireless Wireless EM7345 4G LTE
    type: Communication,CDC-Data,Abstract (modem) driver: cdc_acm,cdc_mbim
    interfaces: 4 rev: 2.0 speed: 480 Mb/s power: 100mA chip-ID: 1199:a001
    class-ID: 0a00 serial: <filter>
  Device-2: 2-6:9 info: Validity Sensors VFS 5011 fingerprint sensor
    type: <vendor specific> driver: N/A interfaces: 1 rev: 1.1 speed: 12 Mb/s
    power: 100mA chip-ID: 138a:0017 class-ID: ff00 serial: <filter>
  Device-3: 2-7:4 info: Intel Bluetooth wireless interface type: Bluetooth
    driver: btusb interfaces: 2 rev: 2.0 speed: 12 Mb/s power: 100mA
    chip-ID: 8087:0a2a class-ID: e001
  Device-4: 2-8:5 info: Chicony Integrated Camera type: Video
    driver: uvcvideo interfaces: 2 rev: 2.0 speed: 480 Mb/s power: 500mA
    chip-ID: 04f2:b449 class-ID: 0e02 serial: <filter>
  Hub-4: 3-0:1 info: Super-speed hub ports: 4 rev: 3.0 speed: 5 Gb/s
    chip-ID: 1d6b:0003 class-ID: 0900
Sensors:
  System Temperatures: cpu: 44.0 C pch: 43.0 C mobo: N/A
  Fan Speeds (RPM): fan-1: 0
Info:
  Processes: 266 Uptime: 22h 52m wakeups: 3 Init: systemd v: 250
  tool: systemctl Compilers: gcc: 11.2.0 clang: 13.0.1 Packages: 1293
  pacman: 1267 lib: 341 flatpak: 13 snap: 13 Shell: Bash (su) v: 5.1.16
  running-in: pty pts/1 inxi: 3.3.14
1 Like
2

The issue with hibernation on encrypted system is the location of the hibernation file/partition.

I am not that keen on using encryption so my knowledge and understand of the process is limited - perhaps flawed.

If it is inside the encrypted container it is inaccessible for reading until the container is decrypted which is too late as the kernel has already loaded.

If it is outside the container - the content is not encrypted and the swapped out state may contain sensible information which can be extracted if the information is important for an attacker.

There is no one-stop solution as it all depends on the use case and the needs of the owner.

The Arch wiki contains several useful articles on the subject

From the info I have gathered over time it seems that using LVM on LUKS provides the necessary setup to support resume-from-disk scenario.

1 Like
3

Hey! Thanks a lot, for your reply. That’s something i didn’t knew. But it makes sense.
Therefore the swapfile option is from the table.

What i know about LVM is, that it’s just another layer for easier managing volumes and disks. I would say, that LVM is not nessecary for successful hibernation with encryption. It seems to me, that the partition layout, that was set up by the manjaro installer was actually ok. Except for the size of the swap partition, which was exactly the size of my ram. According to this article Swap - Manjaro it has to be a bit more.

That means btrfs-swap would also be no option for me.

Following your arch wiki link i land here dm-crypt/Swap encryption - ArchWiki. I’ll study the section about mkinitcpio hook.

Thanks

4

So after watching this video i learned, that it’s possible to use a swapfile with encrypted btrfs. At least i set up everything like in the video (meaning Swapfile, grub kernel parameter and mkinitcpio hooks) and the error messages complaining about a missing swapfile were gone.
The key was to set the resume kernel parameter to the root UUID, where my swapfile is located. Furthermore, it seems to be very important to set the correct resume_offset if you’re using btrfs.

BUT, still hibernation does not work. When I try to hibernate via systemctl hibernate i get the message complaining about the swap beeing too small for hibernation:

Not enough swap space for hibernation

I could get rid of that message by suppressing the size check with the following setting in the logind service:

sudo systemctl edit systemd-logind.service

[Service]       
Environment=SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1

But still hibernation does not work properly.

5

Latest update. I figured out, that i can see some more logs with looking into the journal. But still it doesn’t give me any clue on what to do and how to fix it:

 systemd-hibernate.service - Hibernate
     Loaded: loaded (/usr/lib/systemd/system/systemd-hibernate.service; static)
     Active: failed (Result: exit-code) since Sat 2022-04-09 22:27:23 CEST; 58s ago
       Docs: man:systemd-hibernate.service(8)
    Process: 1674 ExecStart=/usr/lib/systemd/systemd-sleep hibernate (code=exited, status=1/FAILURE)
   Main PID: 1674 (code=exited, status=1/FAILURE)
        CPU: 5ms

Apr 09 22:27:23 razer-x systemd[1]: Starting Hibernate...
Apr 09 22:27:23 razer-x systemd-sleep[1674]: Failed to find location to hibernate to: Function not implemented
Apr 09 22:27:23 razer-x systemd[1]: systemd-hibernate.service: Main process exited, code=exited, status=1/FAILURE
Apr 09 22:27:23 razer-x systemd[1]: systemd-hibernate.service: Failed with result 'exit-code'.
Apr 09 22:27:23 razer-x systemd[1]: Failed to start Hibernate.

Meanwhile, i switched back to the usage of my dedicated swap partition (as i still had one setup). Unfortunately, this also didn’t helped.

6

Final update, that marks this post as solved.

I read this post ([HowTo] Enable and configure hibernation with BTRFS) and followed the instructions. After a few attempts i was successfully able to hibernate my laptop.

Somehow, the script did not worked for me. But following the instructions carefully did. In my first attempts i used the wrong UUID. The mkswap tool returns a UUID after succesfully creating a swap. But that UUID is not to be used for the resume kernel parameter. I had to use the UUID that is returned by findmnt.

1 Like