Getting hibernation working on Manjaro with encrypted swap

I had trouble getting hibernation to work on a fresh Manjaro install. Took a moment to figure it out so I’m writing it down for later. Note that this might not work with btrfs partitions, tested the solution on ext4 only.

If during installation you configure Manjaro to:

  • create a swap partition for the purpose of hibernation, and
  • encrypt your entire disk

hibernation will not work immediately after you boot into the system. During boot, you will also always get an error like below (no matter if you are trying to resume or not):

Device does not exist or access denied.
ERROR: resume: hibernation device '/dev/mapper/luks-XXXXXXXX-XXXX-XXXX-XXXX-XXXX

There are at least two solutions to this problem. I think the correct one is to edit your /etc/openswap.conf file (which should have been filled in during installation but wasn’t) to contain the following information:

## cryptsetup open $swap_device $crypt_swap_name

## UUID-based path to the crypto partition with your swap

## Name of that partition, the same UUID as above prefixed with luks-

## /dev/mapper path to the main/first encrypted partition

## Name of the key file

## additional arguments given to cryptsetup
## --allow-discards options is desired in case swap is on SSD partition
cryptsetup_options="--type luks"

To get the paths for your devices, use lsblk -f. This command displays a tree of your partitions and should include records of your crypto_LUKS partitions as well.

For swap_device, find the crypto_LUKS record just above your swap partition. For crypt_swap_name - the exact name of that swap partition. For keyfile_device - the name of your main partition (e.g. ext4).

Output of the lsblk -f command, including a list of three partitions. There are two partitions which are using the crypto_LUKS format. The first one is the main partitions that contains the key file. The second one is the swap partition that we want to decrypt to be able to resume from hibernation.

The keyfile_filename should be the same as above, but to be sure run sudo cat /etc/crypttab and check the records in the second to last column (password).

Save the file and run sudo mkinitcpio -P to regenerate the ramdisks used while booting. You should see that the openswap hook generates without errors or warnings. If there are any errors around that step, check your config before rebooting!

See also