Merge branch 'payloads/x86/updates-20170430' of libreboot/libreboot into master

12 files changed, 3 insertions, 1763 deletions

diff --git a/resources/grub/patch/grub.johnlane.ie/0001-Cryptomount-support-LUKS-detached-header.patch b/resources/grub/patch/grub.johnlane.ie/0001-Cryptomount-support-LUKS-detached-header.patch
deleted file mode 100644
index f14241b9..00000000
--- a/resources/grub/patch/grub.johnlane.ie/0001-Cryptomount-support-LUKS-detached-header.patch
+++ /dev/null
@@ -1,247 +0,0 @@
-From 04e079fed3b275b8ba2081c7fbf9acd853ce055b Mon Sep 17 00:00:00 2001
-From: John Lane <john@lane.uk.net>
-Date: Tue, 23 Jun 2015 11:16:30 +0100
-Subject: [PATCH 02/10] Cryptomount support LUKS detached header
-
----
- grub-core/disk/cryptodisk.c | 22 ++++++++++++++++++----
- grub-core/disk/geli.c       |  7 +++++--
- grub-core/disk/luks.c       | 45 +++++++++++++++++++++++++++++++++++++--------
- include/grub/cryptodisk.h   |  5 +++--
- 4 files changed, 63 insertions(+), 16 deletions(-)
-
-diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index 1e03a09..dd8870d 100644
---- a/grub-core/disk/cryptodisk.c
-+++ b/grub-core/disk/cryptodisk.c
-@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
-     /* TRANSLATORS: It's still restricted to cryptodisks only.  */
-     {"all", 'a', 0, N_("Mount all."), 0, 0},
-     {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
-+    {"header", 'H', 0, N_("Read LUKS header from file"), 0, ARG_TYPE_STRING},
-     {0, 0, 0, 0, 0, 0}
-   };
- 
-@@ -808,6 +809,7 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
- 
- static int check_boot, have_it;
- static char *search_uuid;
-+static grub_file_t hdr;
- 
- static void
- cryptodisk_close (grub_cryptodisk_t dev)
-@@ -832,13 +834,13 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
- 
-   FOR_CRYPTODISK_DEVS (cr)
-   {
--    dev = cr->scan (source, search_uuid, check_boot);
-+    dev = cr->scan (source, search_uuid, check_boot, hdr);
-     if (grub_errno)
-       return grub_errno;
-     if (!dev)
-       continue;
-     
--    err = cr->recover_key (source, dev);
-+    err = cr->recover_key (source, dev, hdr);
-     if (err)
-     {
-       cryptodisk_close (dev);
-@@ -879,7 +881,7 @@ grub_cryptodisk_cheat_mount (const char *sourcedev, const char *cheat)
- 
-   FOR_CRYPTODISK_DEVS (cr)
-   {
--    dev = cr->scan (source, search_uuid, check_boot);
-+    dev = cr->scan (source, search_uuid, check_boot,0);
-     if (grub_errno)
-       return grub_errno;
-     if (!dev)
-@@ -933,6 +935,18 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
-   if (argc < 1 && !state[1].set && !state[2].set)
-     return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required");
- 
-+  if (state[3].set) /* LUKS detached header */
-+    {
-+      if (state[0].set) /* Cannot use UUID lookup with detached header */
-+        return GRUB_ERR_BAD_ARGUMENT;
-+
-+      hdr = grub_file_open (state[3].arg);
-+      if (!hdr)
-+        return grub_errno;
-+    }
-+  else
-+    hdr = NULL;
-+
-   have_it = 0;
-   if (state[0].set)
-     {
-@@ -1140,7 +1154,7 @@ GRUB_MOD_INIT (cryptodisk)
- {
-   grub_disk_dev_register (&grub_cryptodisk_dev);
-   cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0,
--			      N_("SOURCE|-u UUID|-a|-b"),
-+			      N_("SOURCE|-u UUID|-a|-b|-H file"),
- 			      N_("Mount a crypto device."), options);
-   grub_procfs_register ("luks_script", &luks_script);
- }
-diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
-index e9d2329..f4394eb 100644
---- a/grub-core/disk/geli.c
-+++ b/grub-core/disk/geli.c
-@@ -52,6 +52,7 @@
- #include <grub/dl.h>
- #include <grub/err.h>
- #include <grub/disk.h>
-+#include <grub/file.h>
- #include <grub/crypto.h>
- #include <grub/partition.h>
- #include <grub/i18n.h>
-@@ -243,7 +244,8 @@ grub_util_get_geli_uuid (const char *dev)
- 
- static grub_cryptodisk_t
- configure_ciphers (grub_disk_t disk, const char *check_uuid,
--		   int boot_only)
-+		   int boot_only,
-+		   grub_file_t hdr __attribute__ ((unused)) )
- {
-   grub_cryptodisk_t newdev;
-   struct grub_geli_phdr header;
-@@ -398,7 +400,8 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
- }
- 
- static grub_err_t
--recover_key (grub_disk_t source, grub_cryptodisk_t dev)
-+recover_key (grub_disk_t source, grub_cryptodisk_t dev,
-+	     grub_file_t hdr __attribute__ ((unused)) )
- {
-   grub_size_t keysize;
-   grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
-diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
-index 86c50c6..66e64c0 100644
---- a/grub-core/disk/luks.c
-+++ b/grub-core/disk/luks.c
-@@ -23,6 +23,7 @@
- #include <grub/dl.h>
- #include <grub/err.h>
- #include <grub/disk.h>
-+#include <grub/file.h>
- #include <grub/crypto.h>
- #include <grub/partition.h>
- #include <grub/i18n.h>
-@@ -66,7 +67,7 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,
- 
- static grub_cryptodisk_t
- configure_ciphers (grub_disk_t disk, const char *check_uuid,
--		   int check_boot)
-+		   int check_boot, grub_file_t hdr)
- {
-   grub_cryptodisk_t newdev;
-   const char *iptr;
-@@ -86,11 +87,21 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-   int benbi_log = 0;
-   grub_err_t err;
- 
-+  err = GRUB_ERR_NONE;
-+
-   if (check_boot)
-     return NULL;
- 
-   /* Read the LUKS header.  */
--  err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
-+  if (hdr)
-+  {
-+    grub_file_seek (hdr, 0);
-+    if (grub_file_read (hdr, &header, sizeof (header)) != sizeof (header))
-+        err = GRUB_ERR_READ_ERROR;
-+  }
-+  else
-+    err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
-+
-   if (err)
-     {
-       if (err == GRUB_ERR_OUT_OF_RANGE)
-@@ -304,12 +315,14 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-   grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
-   newdev->modname = "luks";
-   COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));
-+
-   return newdev;
- }
- 
- static grub_err_t
- luks_recover_key (grub_disk_t source,
--		  grub_cryptodisk_t dev)
-+		  grub_cryptodisk_t dev,
-+	          grub_file_t hdr)
- {
-   struct grub_luks_phdr header;
-   grub_size_t keysize;
-@@ -321,8 +334,19 @@ luks_recover_key (grub_disk_t source,
-   grub_err_t err;
-   grub_size_t max_stripes = 1;
-   char *tmp;
-+  grub_uint32_t sector;
-+
-+  err = GRUB_ERR_NONE;
-+
-+  if (hdr)
-+  {
-+    grub_file_seek (hdr, 0);
-+    if (grub_file_read (hdr, &header, sizeof (header)) != sizeof (header))
-+        err = GRUB_ERR_READ_ERROR;
-+  }
-+  else
-+    err = grub_disk_read (source, 0, 0, sizeof (header), &header);
- 
--  err = grub_disk_read (source, 0, 0, sizeof (header), &header);
-   if (err)
-     return err;
- 
-@@ -391,13 +415,18 @@ luks_recover_key (grub_disk_t source,
- 	  return grub_crypto_gcry_error (gcry_err);
- 	}
- 
-+      sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
-       length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
- 
-       /* Read and decrypt the key material from the disk.  */
--      err = grub_disk_read (source,
--			    grub_be_to_cpu32 (header.keyblock
--					      [i].keyMaterialOffset), 0,
--			    length, split_key);
-+      if (hdr)
-+        {
-+	  grub_file_seek (hdr, sector * 512);
-+          if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
-+            err = GRUB_ERR_READ_ERROR;
-+        }
-+      else
-+        err = grub_disk_read (source, sector, 0, length, split_key);
-       if (err)
- 	{
- 	  grub_free (split_key);
-diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
-index 32f564a..4e6e89a 100644
---- a/include/grub/cryptodisk.h
-+++ b/include/grub/cryptodisk.h
-@@ -20,6 +20,7 @@
- #define GRUB_CRYPTODISK_HEADER	1
- 
- #include <grub/disk.h>
-+#include <grub/file.h>
- #include <grub/crypto.h>
- #include <grub/list.h>
- #ifdef GRUB_UTIL
-@@ -107,8 +108,8 @@ struct grub_cryptodisk_dev
-   struct grub_cryptodisk_dev **prev;
- 
-   grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
--			     int boot_only);
--  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev);
-+			     int boot_only, grub_file_t hdr);
-+  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev, grub_file_t hdr);
- };
- typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;
- 
--- 
-1.9.1
-
diff --git a/resources/grub/patch/grub.johnlane.ie/0002-Cryptomount-support-key-files.patch b/resources/grub/patch/grub.johnlane.ie/0002-Cryptomount-support-key-files.patch
deleted file mode 100644
index 9c33b9b0..00000000
--- a/resources/grub/patch/grub.johnlane.ie/0002-Cryptomount-support-key-files.patch
+++ /dev/null
@@ -1,205 +0,0 @@
-From 3b7ef4a5fd57b042201fbefb92a217070b944d67 Mon Sep 17 00:00:00 2001
-From: John Lane <john@lane.uk.net>
-Date: Fri, 26 Jun 2015 13:37:10 +0100
-Subject: [PATCH 03/10] Cryptomount support key files
-
----
- grub-core/disk/cryptodisk.c | 46 ++++++++++++++++++++++++++++++++++++++++++++-
- grub-core/disk/geli.c       |  4 +++-
- grub-core/disk/luks.c       | 44 +++++++++++++++++++++++++++++--------------
- include/grub/cryptodisk.h   |  5 ++++-
- 4 files changed, 82 insertions(+), 17 deletions(-)
-
-diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index dd8870d..0e7ced8 100644
---- a/grub-core/disk/cryptodisk.c
-+++ b/grub-core/disk/cryptodisk.c
-@@ -42,6 +42,9 @@ static const struct grub_arg_option options[] =
-     {"all", 'a', 0, N_("Mount all."), 0, 0},
-     {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
-     {"header", 'H', 0, N_("Read LUKS header from file"), 0, ARG_TYPE_STRING},
-+    {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
-+    {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
-+    {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
-     {0, 0, 0, 0, 0, 0}
-   };
- 
-@@ -810,6 +813,8 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
- static int check_boot, have_it;
- static char *search_uuid;
- static grub_file_t hdr;
-+static grub_uint8_t *key, keyfile_buffer[GRUB_CRYPTODISK_MAX_KEYFILE_SIZE];
-+static grub_size_t keyfile_size;
- 
- static void
- cryptodisk_close (grub_cryptodisk_t dev)
-@@ -840,7 +845,7 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
-     if (!dev)
-       continue;
-     
--    err = cr->recover_key (source, dev, hdr);
-+    err = cr->recover_key (source, dev, hdr, key, keyfile_size);
-     if (err)
-     {
-       cryptodisk_close (dev);
-@@ -948,6 +953,45 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
-     hdr = NULL;
- 
-   have_it = 0;
-+  key = NULL;
-+
-+  if (state[4].set) /* Key file; fails back to passphrase entry */
-+    {
-+      grub_file_t keyfile;
-+      int keyfile_offset;
-+      grub_size_t requested_keyfile_size;
-+
-+      requested_keyfile_size = state[6].set ? grub_strtoul(state[6].arg, 0, 0) : 0;
-+
-+      if (requested_keyfile_size > GRUB_CRYPTODISK_MAX_KEYFILE_SIZE)
-+        grub_printf (N_("Key file size exceeds maximum (%llu)\n"), \
-+	                     (unsigned long long) GRUB_CRYPTODISK_MAX_KEYFILE_SIZE);
-+      else
-+        {
-+          keyfile_offset = state[5].set ? grub_strtoul (state[5].arg, 0, 0) : 0;
-+          keyfile_size = requested_keyfile_size ? requested_keyfile_size : \
-+		                             GRUB_CRYPTODISK_MAX_KEYFILE_SIZE;
-+
-+          keyfile = grub_file_open (state[4].arg);
-+          if (!keyfile)
-+            grub_printf (N_("Unable to open key file %s\n"), state[4].arg);
-+          else if (grub_file_seek (keyfile, keyfile_offset) == (grub_off_t)-1)
-+            grub_printf (N_("Unable to seek to offset %d in key file\n"), keyfile_offset);
-+          else
-+            {
-+              keyfile_size = grub_file_read (keyfile, keyfile_buffer, keyfile_size);
-+              if (keyfile_size == (grub_size_t)-1)
-+                 grub_printf (N_("Error reading key file\n"));
-+	      else if (requested_keyfile_size && (keyfile_size != requested_keyfile_size))
-+                 grub_printf (N_("Cannot read %llu bytes for key file (read %llu bytes)\n"),
-+                                                (unsigned long long) requested_keyfile_size,
-+						(unsigned long long) keyfile_size);
-+              else
-+                key = keyfile_buffer;
-+	    }
-+        }
-+    }
-+
-   if (state[0].set)
-     {
-       grub_cryptodisk_t dev;
-diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
-index f4394eb..da6aa6a 100644
---- a/grub-core/disk/geli.c
-+++ b/grub-core/disk/geli.c
-@@ -401,7 +401,9 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
- 
- static grub_err_t
- recover_key (grub_disk_t source, grub_cryptodisk_t dev,
--	     grub_file_t hdr __attribute__ ((unused)) )
-+	     grub_file_t hdr __attribute__ ((unused)),
-+	     grub_uint8_t *key __attribute__ ((unused)),
-+	     grub_size_t keyfile_size __attribute__ ((unused)) )
- {
-   grub_size_t keysize;
-   grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
-diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
-index 66e64c0..5882368 100644
---- a/grub-core/disk/luks.c
-+++ b/grub-core/disk/luks.c
-@@ -322,12 +322,16 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
- static grub_err_t
- luks_recover_key (grub_disk_t source,
- 		  grub_cryptodisk_t dev,
--	          grub_file_t hdr)
-+		  grub_file_t hdr,
-+		  grub_uint8_t *keyfile_bytes,
-+		  grub_size_t keyfile_bytes_size)
- {
-   struct grub_luks_phdr header;
-   grub_size_t keysize;
-   grub_uint8_t *split_key = NULL;
--  char passphrase[MAX_PASSPHRASE] = "";
-+  char interactive_passphrase[MAX_PASSPHRASE] = "";
-+  grub_uint8_t *passphrase;
-+  grub_size_t passphrase_length;
-   grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
-   unsigned i;
-   grub_size_t length;
-@@ -364,18 +368,30 @@ luks_recover_key (grub_disk_t source,
-   if (!split_key)
-     return grub_errno;
- 
--  /* Get the passphrase from the user.  */
--  tmp = NULL;
--  if (source->partition)
--    tmp = grub_partition_get_name (source->partition);
--  grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
--	       source->partition ? "," : "", tmp ? : "",
--	       dev->uuid);
--  grub_free (tmp);
--  if (!grub_password_get (passphrase, MAX_PASSPHRASE))
-+  if (keyfile_bytes)
-     {
--      grub_free (split_key);
--      return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
-+      /* Use bytestring from key file as passphrase */
-+      passphrase = keyfile_bytes;
-+      passphrase_length = keyfile_bytes_size;
-+    }
-+  else
-+    {
-+      /* Get the passphrase from the user.  */
-+      tmp = NULL;
-+      if (source->partition)
-+        tmp = grub_partition_get_name (source->partition);
-+      grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
-+		    source->partition ? "," : "", tmp ? : "", dev->uuid);
-+      grub_free (tmp);
-+      if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
-+        {
-+          grub_free (split_key);
-+          return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
-+        }
-+
-+      passphrase = (grub_uint8_t *)interactive_passphrase;
-+      passphrase_length = grub_strlen (interactive_passphrase);
-+
-     }
- 
-   /* Try to recover master key from each active keyslot.  */
-@@ -393,7 +409,7 @@ luks_recover_key (grub_disk_t source,
- 
-       /* Calculate the PBKDF2 of the user supplied passphrase.  */
-       gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
--				     grub_strlen (passphrase),
-+				     passphrase_length,
- 				     header.keyblock[i].passwordSalt,
- 				     sizeof (header.keyblock[i].passwordSalt),
- 				     grub_be_to_cpu32 (header.keyblock[i].
-diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
-index 4e6e89a..67f6b0b 100644
---- a/include/grub/cryptodisk.h
-+++ b/include/grub/cryptodisk.h
-@@ -55,6 +55,8 @@ typedef enum
- #define GRUB_CRYPTODISK_GF_BYTES (1U << GRUB_CRYPTODISK_GF_LOG_BYTES)
- #define GRUB_CRYPTODISK_MAX_KEYLEN 128
- 
-+#define GRUB_CRYPTODISK_MAX_KEYFILE_SIZE 8192
-+
- struct grub_cryptodisk;
- 
- typedef gcry_err_code_t
-@@ -109,7 +111,8 @@ struct grub_cryptodisk_dev
- 
-   grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
- 			     int boot_only, grub_file_t hdr);
--  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev, grub_file_t hdr);
-+  grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev,
-+			    grub_file_t hdr, grub_uint8_t *key, grub_size_t keyfile_size);
- };
- typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;
- 
--- 
-1.9.1
-
diff --git a/resources/grub/patch/grub.johnlane.ie/0003-Cryptomount-luks-allow-multiple-passphrase-attempts.patch b/resources/grub/patch/grub.johnlane.ie/0003-Cryptomount-luks-allow-multiple-passphrase-attempts.patch
deleted file mode 100644
index 538f4aef..00000000
--- a/resources/grub/patch/grub.johnlane.ie/0003-Cryptomount-luks-allow-multiple-passphrase-attempts.patch
+++ /dev/null
@@ -1,329 +0,0 @@
-From f39e8ee5696f15860c73b07e652a8b59fcc834c7 Mon Sep 17 00:00:00 2001
-From: John Lane <john@lane.uk.net>
-Date: Fri, 26 Jun 2015 13:49:58 +0100
-Subject: [PATCH 04/10] Cryptomount luks allow multiple passphrase attempts
-
----
- grub-core/disk/luks.c | 278 ++++++++++++++++++++++++++------------------------
- 1 file changed, 143 insertions(+), 135 deletions(-)
-
-diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
-index 5882368..11e437e 100644
---- a/grub-core/disk/luks.c
-+++ b/grub-core/disk/luks.c
-@@ -321,10 +321,10 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
- 
- static grub_err_t
- luks_recover_key (grub_disk_t source,
--		  grub_cryptodisk_t dev,
--		  grub_file_t hdr,
--		  grub_uint8_t *keyfile_bytes,
--		  grub_size_t keyfile_bytes_size)
-+                  grub_cryptodisk_t dev,
-+                  grub_file_t hdr,
-+                  grub_uint8_t *keyfile_bytes,
-+                  grub_size_t keyfile_bytes_size)
- {
-   struct grub_luks_phdr header;
-   grub_size_t keysize;
-@@ -339,6 +339,7 @@ luks_recover_key (grub_disk_t source,
-   grub_size_t max_stripes = 1;
-   char *tmp;
-   grub_uint32_t sector;
-+  unsigned attempts = 2;
- 
-   err = GRUB_ERR_NONE;
- 
-@@ -361,151 +362,158 @@ luks_recover_key (grub_disk_t source,
- 
-   for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
-     if (grub_be_to_cpu32 (header.keyblock[i].active) == LUKS_KEY_ENABLED
--	&& grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
-+        && grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
-       max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes);
- 
-   split_key = grub_malloc (keysize * max_stripes);
-   if (!split_key)
-     return grub_errno;
- 
--  if (keyfile_bytes)
-+  while (attempts)
-     {
--      /* Use bytestring from key file as passphrase */
--      passphrase = keyfile_bytes;
--      passphrase_length = keyfile_bytes_size;
--    }
--  else
--    {
--      /* Get the passphrase from the user.  */
--      tmp = NULL;
--      if (source->partition)
--        tmp = grub_partition_get_name (source->partition);
--      grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
--		    source->partition ? "," : "", tmp ? : "", dev->uuid);
--      grub_free (tmp);
--      if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
-+      if (keyfile_bytes)
-         {
--          grub_free (split_key);
--          return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
--        }
--
--      passphrase = (grub_uint8_t *)interactive_passphrase;
--      passphrase_length = grub_strlen (interactive_passphrase);
--
--    }
--
--  /* Try to recover master key from each active keyslot.  */
--  for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
--    {
--      gcry_err_code_t gcry_err;
--      grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
--      grub_uint8_t digest[GRUB_CRYPTODISK_MAX_KEYLEN];
--
--      /* Check if keyslot is enabled.  */
--      if (grub_be_to_cpu32 (header.keyblock[i].active) != LUKS_KEY_ENABLED)
--	continue;
--
--      grub_dprintf ("luks", "Trying keyslot %d\n", i);
--
--      /* Calculate the PBKDF2 of the user supplied passphrase.  */
--      gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
--				     passphrase_length,
--				     header.keyblock[i].passwordSalt,
--				     sizeof (header.keyblock[i].passwordSalt),
--				     grub_be_to_cpu32 (header.keyblock[i].
--						       passwordIterations),
--				     digest, keysize);
--
--      if (gcry_err)
--	{
--	  grub_free (split_key);
--	  return grub_crypto_gcry_error (gcry_err);
--	}
--
--      grub_dprintf ("luks", "PBKDF2 done\n");
--
--      gcry_err = grub_cryptodisk_setkey (dev, digest, keysize); 
--      if (gcry_err)
--	{
--	  grub_free (split_key);
--	  return grub_crypto_gcry_error (gcry_err);
--	}
--
--      sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
--      length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
--
--      /* Read and decrypt the key material from the disk.  */
--      if (hdr)
--        {
--	  grub_file_seek (hdr, sector * 512);
--          if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
--            err = GRUB_ERR_READ_ERROR;
-+          /* Use bytestring from key file as passphrase */
-+          passphrase = keyfile_bytes;
-+          passphrase_length = keyfile_bytes_size;
-+	  keyfile_bytes = NULL; /* use it only once */
-         }
-       else
--        err = grub_disk_read (source, sector, 0, length, split_key);
--      if (err)
--	{
--	  grub_free (split_key);
--	  return err;
--	}
--
--      gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0);
--      if (gcry_err)
--	{
--	  grub_free (split_key);
--	  return grub_crypto_gcry_error (gcry_err);
--	}
--
--      /* Merge the decrypted key material to get the candidate master key.  */
--      gcry_err = AF_merge (dev->hash, split_key, candidate_key, keysize,
--			   grub_be_to_cpu32 (header.keyblock[i].stripes));
--      if (gcry_err)
--	{
--	  grub_free (split_key);
--	  return grub_crypto_gcry_error (gcry_err);
--	}
--
--      grub_dprintf ("luks", "candidate key recovered\n");
--
--      /* Calculate the PBKDF2 of the candidate master key.  */
--      gcry_err = grub_crypto_pbkdf2 (dev->hash, candidate_key,
--				     grub_be_to_cpu32 (header.keyBytes),
--				     header.mkDigestSalt,
--				     sizeof (header.mkDigestSalt),
--				     grub_be_to_cpu32
--				     (header.mkDigestIterations),
--				     candidate_digest,
--				     sizeof (candidate_digest));
--      if (gcry_err)
--	{
--	  grub_free (split_key);
--	  return grub_crypto_gcry_error (gcry_err);
--	}
--
--      /* Compare the calculated PBKDF2 to the digest stored
--         in the header to see if it's correct.  */
--      if (grub_memcmp (candidate_digest, header.mkDigest,
--		       sizeof (header.mkDigest)) != 0)
--	{
--	  grub_dprintf ("luks", "bad digest\n");
--	  continue;
--	}
-+        {
-+          /* Get the passphrase from the user.  */
-+          tmp = NULL;
-+          if (source->partition)
-+            tmp = grub_partition_get_name (source->partition);
-+          grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
-+                              source->partition ? "," : "", tmp ? : "", dev->uuid);
-+          grub_free (tmp);
-+          if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
-+            {
-+              grub_free (split_key);
-+              return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
-+            }
-+
-+          passphrase = (grub_uint8_t *)interactive_passphrase;
-+          passphrase_length = grub_strlen (interactive_passphrase);
- 
--      /* TRANSLATORS: It's a cryptographic key slot: one element of an array
--	 where each element is either empty or holds a key.  */
--      grub_printf_ (N_("Slot %d opened\n"), i);
-+        }
- 
--      /* Set the master key.  */
--      gcry_err = grub_cryptodisk_setkey (dev, candidate_key, keysize); 
--      if (gcry_err)
--	{
--	  grub_free (split_key);
--	  return grub_crypto_gcry_error (gcry_err);
--	}
-+      /* Try to recover master key from each active keyslot.  */
-+      for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
-+        {
-+          gcry_err_code_t gcry_err;
-+          grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
-+          grub_uint8_t digest[GRUB_CRYPTODISK_MAX_KEYLEN];
-+
-+          /* Check if keyslot is enabled.  */
-+          if (grub_be_to_cpu32 (header.keyblock[i].active) != LUKS_KEY_ENABLED)
-+            continue;
-+
-+          grub_dprintf ("luks", "Trying keyslot %d\n", i);
-+
-+          /* Calculate the PBKDF2 of the user supplied passphrase.  */
-+          gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
-+                                         passphrase_length,
-+                                         header.keyblock[i].passwordSalt,
-+                                         sizeof (header.keyblock[i].passwordSalt),
-+                                         grub_be_to_cpu32 (header.keyblock[i].
-+                                         passwordIterations),
-+                                         digest, keysize);
-+
-+          if (gcry_err)
-+            {
-+              grub_free (split_key);
-+              return grub_crypto_gcry_error (gcry_err);
-+            }
-+
-+          grub_dprintf ("luks", "PBKDF2 done\n");
-+
-+          gcry_err = grub_cryptodisk_setkey (dev, digest, keysize);
-+          if (gcry_err)
-+            {
-+              grub_free (split_key);
-+              return grub_crypto_gcry_error (gcry_err);
-+            }
-+
-+          sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
-+          length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
-+
-+          /* Read and decrypt the key material from the disk.  */
-+          if (hdr)
-+            {
-+              grub_file_seek (hdr, sector * 512);
-+              if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
-+                err = GRUB_ERR_READ_ERROR;
-+            }
-+          else
-+            err = grub_disk_read (source, sector, 0, length, split_key);
-+          if (err)
-+            {
-+              grub_free (split_key);
-+              return err;
-+            }
-+
-+          gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0);
-+          if (gcry_err)
-+            {
-+              grub_free (split_key);
-+              return grub_crypto_gcry_error (gcry_err);
-+            }
-+
-+          /* Merge the decrypted key material to get the candidate master key.  */
-+          gcry_err = AF_merge (dev->hash, split_key, candidate_key, keysize,
-+                               grub_be_to_cpu32 (header.keyblock[i].stripes));
-+          if (gcry_err)
-+            {
-+              grub_free (split_key);
-+              return grub_crypto_gcry_error (gcry_err);
-+            }
-+
-+          grub_dprintf ("luks", "candidate key recovered\n");
-+
-+          /* Calculate the PBKDF2 of the candidate master key.  */
-+          gcry_err = grub_crypto_pbkdf2 (dev->hash, candidate_key,
-+                                     grub_be_to_cpu32 (header.keyBytes),
-+                                     header.mkDigestSalt,
-+                                     sizeof (header.mkDigestSalt),
-+                                     grub_be_to_cpu32
-+                                     (header.mkDigestIterations),
-+                                     candidate_digest,
-+                                     sizeof (candidate_digest));
-+          if (gcry_err)
-+            {
-+              grub_free (split_key);
-+              return grub_crypto_gcry_error (gcry_err);
-+            }
-+
-+          /* Compare the calculated PBKDF2 to the digest stored
-+             in the header to see if it's correct.  */
-+          if (grub_memcmp (candidate_digest, header.mkDigest,
-+                                             sizeof (header.mkDigest)) != 0)
-+            {
-+              grub_dprintf ("luks", "bad digest\n");
-+              continue;
-+            }
-+
-+          /* TRANSLATORS: It's a cryptographic key slot: one element of an array
-+             where each element is either empty or holds a key.  */
-+          grub_printf_ (N_("Slot %d opened\n"), i);
-+
-+          /* Set the master key.  */
-+          gcry_err = grub_cryptodisk_setkey (dev, candidate_key, keysize);
-+          if (gcry_err)
-+            {
-+              grub_free (split_key);
-+              return grub_crypto_gcry_error (gcry_err);
-+            }
- 
--      grub_free (split_key);
-+          grub_free (split_key);
- 
--      return GRUB_ERR_NONE;
-+          return GRUB_ERR_NONE;
-+        }
-+      grub_printf_ (N_("Failed to decrypt master key.\n"));
-+      if (--attempts) grub_printf_ (N_("%u attempt%s remaining.\n"), attempts,
-+		                    (attempts==1) ? "" : "s");
-     }
- 
-   grub_free (split_key);
--- 
-1.9.1
-
diff --git a/resources/grub/patch/grub.johnlane.ie/0004-Cryptomount-support-plain-dm-crypt.patch b/resources/grub/patch/grub.johnlane.ie/0004-Cryptomount-support-plain-dm-crypt.patch
deleted file mode 100644
index 54635442..00000000
--- a/resources/grub/patch/grub.johnlane.ie/0004-Cryptomount-support-plain-dm-crypt.patch
+++ /dev/null
@@ -1,636 +0,0 @@
-From 632155a6e8923cdd5c1d4e23576cfadcb78ee67b Mon Sep 17 00:00:00 2001
-From: John Lane <john@lane.uk.net>
-Date: Fri, 26 Jun 2015 22:09:52 +0100
-Subject: [PATCH 05/10] Cryptomount support plain dm-crypt
-
----
- grub-core/disk/cryptodisk.c | 298 +++++++++++++++++++++++++++++++++++++++++++-
- grub-core/disk/luks.c       | 195 +----------------------------
- include/grub/cryptodisk.h   |   8 ++
- 3 files changed, 311 insertions(+), 190 deletions(-)
-
-diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index 0e7ced8..57fb904 100644
---- a/grub-core/disk/cryptodisk.c
-+++ b/grub-core/disk/cryptodisk.c
-@@ -45,6 +45,12 @@ static const struct grub_arg_option options[] =
-     {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
-     {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
-     {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
-+    {"plain", 'p', 0, N_("Plain (no LUKS header)"), 0, ARG_TYPE_NONE},
-+    {"cipher", 'c', 0, N_("Plain mode cipher"), 0, ARG_TYPE_STRING},
-+    {"digest", 'd', 0, N_("Plain mode passphrase digest (hash)"), 0, ARG_TYPE_STRING},
-+    {"offset", 'o', 0, N_("Plain mode data sector offset"), 0, ARG_TYPE_INT},
-+    {"size", 's', 0, N_("Size of raw device (sectors, defaults to whole device)"), 0, ARG_TYPE_INT},
-+    {"key-size", 'K', 0, N_("Set key size (bits)"), 0, ARG_TYPE_INT},
-     {0, 0, 0, 0, 0, 0}
-   };
- 
-@@ -932,6 +938,48 @@ grub_cryptodisk_scan_device (const char *name,
-   return have_it && search_uuid ? 1 : 0;
- }
- 
-+/* Hashes a passphrase into a key and stores it with cipher. */
-+static gcry_err_code_t
-+set_passphrase (grub_cryptodisk_t dev, grub_size_t keysize, const char *passphrase)
-+{
-+  grub_uint8_t derived_hash[GRUB_CRYPTODISK_MAX_KEYLEN * 2], *dh = derived_hash;
-+  char *p;
-+  unsigned int round, i;
-+  unsigned int len, size;
-+
-+  /* Need no passphrase if there's no key */
-+  if (keysize == 0)
-+    return GPG_ERR_INV_KEYLEN;
-+
-+  /* Hack to support the "none" hash */
-+  if (dev->hash)
-+    len = dev->hash->mdlen;
-+  else
-+    len = grub_strlen (passphrase);
-+
-+  if (keysize > GRUB_CRYPTODISK_MAX_KEYLEN || len > GRUB_CRYPTODISK_MAX_KEYLEN)
-+    return GPG_ERR_INV_KEYLEN;
-+
-+  p = grub_malloc (grub_strlen (passphrase) + 2 + keysize / len);
-+  if (!p)
-+    return grub_errno;
-+
-+  for (round = 0, size = keysize; size; round++, dh += len, size -= len)
-+    {
-+      for (i = 0; i < round; i++)
-+	p[i] = 'A';
-+
-+      grub_strcpy (p + i, passphrase);
-+
-+      if (len > size)
-+	len = size;
-+
-+      grub_crypto_hash (dev->hash, dh, p, grub_strlen (p));
-+    }
-+
-+  return grub_cryptodisk_setkey (dev, derived_hash, keysize);
-+}
-+
- static grub_err_t
- grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
- {
-@@ -1061,6 +1109,64 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
- 
-       err = grub_cryptodisk_scan_device_real (diskname, disk);
- 
-+      if (state[7].set) /* Plain mode */
-+        {
-+          char *cipher;
-+          char *mode;
-+          char *digest;
-+          int offset, size, key_size;
-+
-+          cipher = grub_strdup (state[8].set ? state[8].arg : GRUB_CRYPTODISK_PLAIN_CIPHER);
-+          digest = grub_strdup (state[9].set ? state[9].arg : GRUB_CRYPTODISK_PLAIN_DIGEST);
-+          offset = state[10].set ? grub_strtoul (state[10].arg, 0, 0) : 0;
-+          size   = state[11].set ? grub_strtoul (state[11].arg, 0, 0) : 0;
-+          key_size = ( state[12].set ? grub_strtoul (state[12].arg, 0, 0) \
-+			             : GRUB_CRYPTODISK_PLAIN_KEYSIZE ) / 8;
-+
-+          /* no strtok, do it manually */
-+          mode = grub_strchr(cipher,'-');
-+          if (!mode)
-+            return GRUB_ERR_BAD_ARGUMENT;
-+          else
-+            *mode++ = 0;
-+
-+          dev = grub_cryptodisk_create (disk, NULL, cipher, mode, digest);
-+
-+          dev->offset = offset;
-+	  if (size) dev->total_length = size;
-+
-+          if (key)
-+	    {
-+              err = grub_cryptodisk_setkey (dev, key, key_size);
-+              if (err)
-+                return err;
-+	    }
-+	  else
-+	    {
-+              char passphrase[GRUB_CRYPTODISK_MAX_PASSPHRASE] = "";
-+
-+              grub_printf_ (N_("Enter passphrase for %s: "), diskname);
-+              if (!grub_password_get (passphrase, GRUB_CRYPTODISK_MAX_PASSPHRASE))
-+                return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
-+
-+              err = set_passphrase (dev, key_size, passphrase);
-+              if (err)
-+                {
-+                  grub_crypto_cipher_close (dev->cipher);
-+                  return err;
-+                }
-+	    }
-+
-+          grub_cryptodisk_insert (dev, diskname, disk);
-+
-+          grub_free (cipher);
-+          grub_free (digest);
-+
-+          err = GRUB_ERR_NONE;
-+        }
-+      else
-+        err = grub_cryptodisk_scan_device_real (args[0], disk);
-+
-       grub_disk_close (disk);
-       if (disklast)
- 	*disklast = ')';
-@@ -1192,13 +1298,203 @@ struct grub_procfs_entry luks_script =
-   .get_contents = luks_script_get
- };
- 
-+grub_cryptodisk_t
-+grub_cryptodisk_create (grub_disk_t disk, char *uuid,
-+		   char *ciphername, char *ciphermode, char *hashspec)
-+{
-+  grub_cryptodisk_t newdev;
-+  char *cipheriv = NULL;
-+  grub_crypto_cipher_handle_t cipher = NULL, secondary_cipher = NULL;
-+  grub_crypto_cipher_handle_t essiv_cipher = NULL;
-+  const gcry_md_spec_t *hash = NULL, *essiv_hash = NULL;
-+  const struct gcry_cipher_spec *ciph;
-+  grub_cryptodisk_mode_t mode;
-+  grub_cryptodisk_mode_iv_t mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
-+  int benbi_log = 0;
-+
-+  if (!uuid)
-+    uuid = (char*)"00000000000000000000000000000000";
-+
-+  ciph = grub_crypto_lookup_cipher_by_name (ciphername);
-+  if (!ciph)
-+    {
-+      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Cipher %s isn't available",
-+		  ciphername);
-+      return NULL;
-+    }
-+
-+  /* Configure the cipher used for the bulk data.  */
-+  cipher = grub_crypto_cipher_open (ciph);
-+  if (!cipher)
-+    return NULL;
-+
-+  /* Configure the cipher mode.  */
-+  if (grub_strcmp (ciphermode, "ecb") == 0)
-+    {
-+      mode = GRUB_CRYPTODISK_MODE_ECB;
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
-+      cipheriv = NULL;
-+    }
-+  else if (grub_strcmp (ciphermode, "plain") == 0)
-+    {
-+      mode = GRUB_CRYPTODISK_MODE_CBC;
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
-+      cipheriv = NULL;
-+    }
-+  else if (grub_memcmp (ciphermode, "cbc-", sizeof ("cbc-") - 1) == 0)
-+    {
-+      mode = GRUB_CRYPTODISK_MODE_CBC;
-+      cipheriv = ciphermode + sizeof ("cbc-") - 1;
-+    }
-+  else if (grub_memcmp (ciphermode, "pcbc-", sizeof ("pcbc-") - 1) == 0)
-+    {
-+      mode = GRUB_CRYPTODISK_MODE_PCBC;
-+      cipheriv = ciphermode + sizeof ("pcbc-") - 1;
-+    }
-+  else if (grub_memcmp (ciphermode, "xts-", sizeof ("xts-") - 1) == 0)
-+    {
-+      mode = GRUB_CRYPTODISK_MODE_XTS;
-+      cipheriv = ciphermode + sizeof ("xts-") - 1;
-+      secondary_cipher = grub_crypto_cipher_open (ciph);
-+      if (!secondary_cipher)
-+	{
-+	  grub_crypto_cipher_close (cipher);
-+	  return NULL;
-+	}
-+      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
-+	{
-+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
-+		      cipher->cipher->blocksize);
-+	  grub_crypto_cipher_close (cipher);
-+	  grub_crypto_cipher_close (secondary_cipher);
-+	  return NULL;
-+	}
-+      if (secondary_cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
-+	{
-+	  grub_crypto_cipher_close (cipher);
-+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
-+		      secondary_cipher->cipher->blocksize);
-+	  grub_crypto_cipher_close (secondary_cipher);
-+	  return NULL;
-+	}
-+    }
-+  else if (grub_memcmp (ciphermode, "lrw-", sizeof ("lrw-") - 1) == 0)
-+    {
-+      mode = GRUB_CRYPTODISK_MODE_LRW;
-+      cipheriv = ciphermode + sizeof ("lrw-") - 1;
-+      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
-+	{
-+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported LRW block size: %d",
-+		      cipher->cipher->blocksize);
-+	  grub_crypto_cipher_close (cipher);
-+	  return NULL;
-+	}
-+    }
-+  else
-+    {
-+      grub_crypto_cipher_close (cipher);
-+      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown cipher mode: %s",
-+		  ciphermode);
-+      return NULL;
-+    }
-+
-+  if (cipheriv == NULL);
-+  else if (grub_memcmp (cipheriv, "plain", sizeof ("plain") - 1) == 0)
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
-+  else if (grub_memcmp (cipheriv, "plain64", sizeof ("plain64") - 1) == 0)
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
-+  else if (grub_memcmp (cipheriv, "benbi", sizeof ("benbi") - 1) == 0)
-+    {
-+      if (cipher->cipher->blocksize & (cipher->cipher->blocksize - 1)
-+	  || cipher->cipher->blocksize == 0)
-+	grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported benbi blocksize: %d",
-+		    cipher->cipher->blocksize);
-+	/* FIXME should we return an error here? */
-+      for (benbi_log = 0;
-+	   (cipher->cipher->blocksize << benbi_log) < GRUB_DISK_SECTOR_SIZE;
-+	   benbi_log++);
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_BENBI;
-+    }
-+  else if (grub_memcmp (cipheriv, "null", sizeof ("null") - 1) == 0)
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_NULL;
-+  else if (grub_memcmp (cipheriv, "essiv:", sizeof ("essiv:") - 1) == 0)
-+    {
-+      char *hash_str = cipheriv + 6;
-+
-+      mode_iv = GRUB_CRYPTODISK_MODE_IV_ESSIV;
-+
-+      /* Configure the hash and cipher used for ESSIV.  */
-+      essiv_hash = grub_crypto_lookup_md_by_name (hash_str);
-+      if (!essiv_hash)
-+	{
-+	  grub_crypto_cipher_close (cipher);
-+	  grub_crypto_cipher_close (secondary_cipher);
-+	  grub_error (GRUB_ERR_FILE_NOT_FOUND,
-+		      "Couldn't load %s hash", hash_str);
-+	  return NULL;
-+	}
-+      essiv_cipher = grub_crypto_cipher_open (ciph);
-+      if (!essiv_cipher)
-+	{
-+	  grub_crypto_cipher_close (cipher);
-+	  grub_crypto_cipher_close (secondary_cipher);
-+	  return NULL;
-+	}
-+    }
-+  else
-+    {
-+      grub_crypto_cipher_close (cipher);
-+      grub_crypto_cipher_close (secondary_cipher);
-+      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown IV mode: %s",
-+		  cipheriv);
-+      return NULL;
-+    }
-+
-+  /* Configure the passphrase hash (LUKS also uses AF splitter and HMAC).  */
-+  hash = grub_crypto_lookup_md_by_name (hashspec);
-+  if (!hash)
-+    {
-+      grub_crypto_cipher_close (cipher);
-+      grub_crypto_cipher_close (essiv_cipher);
-+      grub_crypto_cipher_close (secondary_cipher);
-+      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Couldn't load %s hash",
-+		  hashspec);
-+      return NULL;
-+    }
-+
-+  newdev = grub_zalloc (sizeof (struct grub_cryptodisk));
-+  if (!newdev)
-+    {
-+      grub_crypto_cipher_close (cipher);
-+      grub_crypto_cipher_close (essiv_cipher);
-+      grub_crypto_cipher_close (secondary_cipher);
-+      return NULL;
-+    }
-+  newdev->cipher = cipher;
-+  newdev->offset = 0;
-+  newdev->source_disk = NULL;
-+  newdev->benbi_log = benbi_log;
-+  newdev->mode = mode;
-+  newdev->mode_iv = mode_iv;
-+  newdev->secondary_cipher = secondary_cipher;
-+  newdev->essiv_cipher = essiv_cipher;
-+  newdev->essiv_hash = essiv_hash;
-+  newdev->hash = hash;
-+  newdev->log_sector_size = 9;
-+  newdev->total_length = grub_disk_get_size (disk) - newdev->offset;
-+  grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
-+  COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));
-+
-+  return newdev;
-+}
-+
- static grub_extcmd_t cmd;
- 
- GRUB_MOD_INIT (cryptodisk)
- {
-   grub_disk_dev_register (&grub_cryptodisk_dev);
-   cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0,
--			      N_("SOURCE|-u UUID|-a|-b|-H file"),
-+			      N_("SOURCE|-u UUID|-a|-b|-H file|-p -c cipher -d digest"),
- 			      N_("Mount a crypto device."), options);
-   grub_procfs_register ("luks_script", &luks_script);
- }
-diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
-index 11e437e..4ebe21b 100644
---- a/grub-core/disk/luks.c
-+++ b/grub-core/disk/luks.c
-@@ -30,8 +30,6 @@
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
--#define MAX_PASSPHRASE 256
--
- #define LUKS_KEY_ENABLED  0x00AC71F3
- 
- /* On disk LUKS header */
-@@ -76,15 +74,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-   char uuid[sizeof (header.uuid) + 1];
-   char ciphername[sizeof (header.cipherName) + 1];
-   char ciphermode[sizeof (header.cipherMode) + 1];
--  char *cipheriv = NULL;
-   char hashspec[sizeof (header.hashSpec) + 1];
--  grub_crypto_cipher_handle_t cipher = NULL, secondary_cipher = NULL;
--  grub_crypto_cipher_handle_t essiv_cipher = NULL;
--  const gcry_md_spec_t *hash = NULL, *essiv_hash = NULL;
--  const struct gcry_cipher_spec *ciph;
--  grub_cryptodisk_mode_t mode;
--  grub_cryptodisk_mode_iv_t mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
--  int benbi_log = 0;
-   grub_err_t err;
- 
-   err = GRUB_ERR_NONE;
-@@ -119,7 +109,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-        iptr++)
-     {
-       if (*iptr != '-')
--	*optr++ = *iptr;
-+        *optr++ = *iptr;
-     }
-   *optr = 0;
- 
-@@ -129,6 +119,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-       return NULL;
-     }
- 
-+
-   /* Make sure that strings are null terminated.  */
-   grub_memcpy (ciphername, header.cipherName, sizeof (header.cipherName));
-   ciphername[sizeof (header.cipherName)] = 0;
-@@ -137,184 +128,10 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-   grub_memcpy (hashspec, header.hashSpec, sizeof (header.hashSpec));
-   hashspec[sizeof (header.hashSpec)] = 0;
- 
--  ciph = grub_crypto_lookup_cipher_by_name (ciphername);
--  if (!ciph)
--    {
--      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Cipher %s isn't available",
--		  ciphername);
--      return NULL;
--    }
--
--  /* Configure the cipher used for the bulk data.  */
--  cipher = grub_crypto_cipher_open (ciph);
--  if (!cipher)
--    return NULL;
--
--  if (grub_be_to_cpu32 (header.keyBytes) > 1024)
--    {
--      grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid keysize %d",
--		  grub_be_to_cpu32 (header.keyBytes));
--      grub_crypto_cipher_close (cipher);
--      return NULL;
--    }
--
--  /* Configure the cipher mode.  */
--  if (grub_strcmp (ciphermode, "ecb") == 0)
--    {
--      mode = GRUB_CRYPTODISK_MODE_ECB;
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
--      cipheriv = NULL;
--    }
--  else if (grub_strcmp (ciphermode, "plain") == 0)
--    {
--      mode = GRUB_CRYPTODISK_MODE_CBC;
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
--      cipheriv = NULL;
--    }
--  else if (grub_memcmp (ciphermode, "cbc-", sizeof ("cbc-") - 1) == 0)
--    {
--      mode = GRUB_CRYPTODISK_MODE_CBC;
--      cipheriv = ciphermode + sizeof ("cbc-") - 1;
--    }
--  else if (grub_memcmp (ciphermode, "pcbc-", sizeof ("pcbc-") - 1) == 0)
--    {
--      mode = GRUB_CRYPTODISK_MODE_PCBC;
--      cipheriv = ciphermode + sizeof ("pcbc-") - 1;
--    }
--  else if (grub_memcmp (ciphermode, "xts-", sizeof ("xts-") - 1) == 0)
--    {
--      mode = GRUB_CRYPTODISK_MODE_XTS;
--      cipheriv = ciphermode + sizeof ("xts-") - 1;
--      secondary_cipher = grub_crypto_cipher_open (ciph);
--      if (!secondary_cipher)
--	{
--	  grub_crypto_cipher_close (cipher);
--	  return NULL;
--	}
--      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
--	{
--	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
--		      cipher->cipher->blocksize);
--	  grub_crypto_cipher_close (cipher);
--	  grub_crypto_cipher_close (secondary_cipher);
--	  return NULL;
--	}
--      if (secondary_cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
--	{
--	  grub_crypto_cipher_close (cipher);
--	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
--		      secondary_cipher->cipher->blocksize);
--	  grub_crypto_cipher_close (secondary_cipher);
--	  return NULL;
--	}
--    }
--  else if (grub_memcmp (ciphermode, "lrw-", sizeof ("lrw-") - 1) == 0)
--    {
--      mode = GRUB_CRYPTODISK_MODE_LRW;
--      cipheriv = ciphermode + sizeof ("lrw-") - 1;
--      if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
--	{
--	  grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported LRW block size: %d",
--		      cipher->cipher->blocksize);
--	  grub_crypto_cipher_close (cipher);
--	  return NULL;
--	}
--    }
--  else
--    {
--      grub_crypto_cipher_close (cipher);
--      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown cipher mode: %s",
--		  ciphermode);
--      return NULL;
--    }
--
--  if (cipheriv == NULL);
--  else if (grub_memcmp (cipheriv, "plain", sizeof ("plain") - 1) == 0)
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
--  else if (grub_memcmp (cipheriv, "plain64", sizeof ("plain64") - 1) == 0)
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
--  else if (grub_memcmp (cipheriv, "benbi", sizeof ("benbi") - 1) == 0)
--    {
--      if (cipher->cipher->blocksize & (cipher->cipher->blocksize - 1)
--	  || cipher->cipher->blocksize == 0)
--	grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported benbi blocksize: %d",
--		    cipher->cipher->blocksize);
--	/* FIXME should we return an error here? */
--      for (benbi_log = 0; 
--	   (cipher->cipher->blocksize << benbi_log) < GRUB_DISK_SECTOR_SIZE;
--	   benbi_log++);
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_BENBI;
--    }
--  else if (grub_memcmp (cipheriv, "null", sizeof ("null") - 1) == 0)
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_NULL;
--  else if (grub_memcmp (cipheriv, "essiv:", sizeof ("essiv:") - 1) == 0)
--    {
--      char *hash_str = cipheriv + 6;
--
--      mode_iv = GRUB_CRYPTODISK_MODE_IV_ESSIV;
--
--      /* Configure the hash and cipher used for ESSIV.  */
--      essiv_hash = grub_crypto_lookup_md_by_name (hash_str);
--      if (!essiv_hash)
--	{
--	  grub_crypto_cipher_close (cipher);
--	  grub_crypto_cipher_close (secondary_cipher);
--	  grub_error (GRUB_ERR_FILE_NOT_FOUND,
--		      "Couldn't load %s hash", hash_str);
--	  return NULL;
--	}
--      essiv_cipher = grub_crypto_cipher_open (ciph);
--      if (!essiv_cipher)
--	{
--	  grub_crypto_cipher_close (cipher);
--	  grub_crypto_cipher_close (secondary_cipher);
--	  return NULL;
--	}
--    }
--  else
--    {
--      grub_crypto_cipher_close (cipher);
--      grub_crypto_cipher_close (secondary_cipher);
--      grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown IV mode: %s",
--		  cipheriv);
--      return NULL;
--    }
--
--  /* Configure the hash used for the AF splitter and HMAC.  */
--  hash = grub_crypto_lookup_md_by_name (hashspec);
--  if (!hash)
--    {
--      grub_crypto_cipher_close (cipher);
--      grub_crypto_cipher_close (essiv_cipher);
--      grub_crypto_cipher_close (secondary_cipher);
--      grub_error (GRUB_ERR_FILE_NOT_FOUND, "Couldn't load %s hash",
--		  hashspec);
--      return NULL;
--    }
-+  newdev = grub_cryptodisk_create (disk, uuid, ciphername, ciphermode, hashspec);
- 
--  newdev = grub_zalloc (sizeof (struct grub_cryptodisk));
--  if (!newdev)
--    {
--      grub_crypto_cipher_close (cipher);
--      grub_crypto_cipher_close (essiv_cipher);
--      grub_crypto_cipher_close (secondary_cipher);
--      return NULL;
--    }
--  newdev->cipher = cipher;
-   newdev->offset = grub_be_to_cpu32 (header.payloadOffset);
--  newdev->source_disk = NULL;
--  newdev->benbi_log = benbi_log;
--  newdev->mode = mode;
--  newdev->mode_iv = mode_iv;
--  newdev->secondary_cipher = secondary_cipher;
--  newdev->essiv_cipher = essiv_cipher;
--  newdev->essiv_hash = essiv_hash;
--  newdev->hash = hash;
--  newdev->log_sector_size = 9;
--  newdev->total_length = grub_disk_get_size (disk) - newdev->offset;
--  grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
-   newdev->modname = "luks";
--  COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));
- 
-   return newdev;
- }
-@@ -329,7 +146,7 @@ luks_recover_key (grub_disk_t source,
-   struct grub_luks_phdr header;
-   grub_size_t keysize;
-   grub_uint8_t *split_key = NULL;
--  char interactive_passphrase[MAX_PASSPHRASE] = "";
-+  char interactive_passphrase[GRUB_CRYPTODISK_MAX_PASSPHRASE] = "";
-   grub_uint8_t *passphrase;
-   grub_size_t passphrase_length;
-   grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
-@@ -376,7 +193,7 @@ luks_recover_key (grub_disk_t source,
-           /* Use bytestring from key file as passphrase */
-           passphrase = keyfile_bytes;
-           passphrase_length = keyfile_bytes_size;
--	  keyfile_bytes = NULL; /* use it only once */
-+          keyfile_bytes = NULL; /* use it only once */
-         }
-       else
-         {
-@@ -387,7 +204,7 @@ luks_recover_key (grub_disk_t source,
-           grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
-                               source->partition ? "," : "", tmp ? : "", dev->uuid);
-           grub_free (tmp);
--          if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
-+          if (!grub_password_get (interactive_passphrase, GRUB_CRYPTODISK_MAX_PASSPHRASE))
-             {
-               grub_free (split_key);
-               return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
-diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
-index 67f6b0b..bb25ab7 100644
---- a/include/grub/cryptodisk.h
-+++ b/include/grub/cryptodisk.h
-@@ -54,9 +54,14 @@ typedef enum
- #define GRUB_CRYPTODISK_GF_LOG_BYTES (GRUB_CRYPTODISK_GF_LOG_SIZE - 3)
- #define GRUB_CRYPTODISK_GF_BYTES (1U << GRUB_CRYPTODISK_GF_LOG_BYTES)
- #define GRUB_CRYPTODISK_MAX_KEYLEN 128
-+#define GRUB_CRYPTODISK_MAX_PASSPHRASE 256
- 
- #define GRUB_CRYPTODISK_MAX_KEYFILE_SIZE 8192
- 
-+#define GRUB_CRYPTODISK_PLAIN_CIPHER  "aes-cbc-essiv:sha256"
-+#define GRUB_CRYPTODISK_PLAIN_DIGEST  "ripemd160"
-+#define GRUB_CRYPTODISK_PLAIN_KEYSIZE 256
-+
- struct grub_cryptodisk;
- 
- typedef gcry_err_code_t
-@@ -160,4 +165,7 @@ grub_util_get_geli_uuid (const char *dev);
- grub_cryptodisk_t grub_cryptodisk_get_by_uuid (const char *uuid);
- grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk);
- 
-+grub_cryptodisk_t grub_cryptodisk_create (grub_disk_t disk, char *uuid,
-+				   char *ciphername, char *ciphermode, char *digest);
-+
- #endif
--- 
-1.9.1
-
diff --git a/resources/grub/patch/grub.johnlane.ie/0005-Cryptomount-support-for-hyphens-in-UUID.patch b/resources/grub/patch/grub.johnlane.ie/0005-Cryptomount-support-for-hyphens-in-UUID.patch
deleted file mode 100644
index 2684f062..00000000
--- a/resources/grub/patch/grub.johnlane.ie/0005-Cryptomount-support-for-hyphens-in-UUID.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 047a5b323de2a0c45a6fe2b6854106830da5f3ae Mon Sep 17 00:00:00 2001
-From: John Lane <john@lane.uk.net>
-Date: Fri, 26 Jun 2015 22:48:03 +0100
-Subject: [PATCH 06/10] Cryptomount support for hyphens in UUID
-
----
- grub-core/disk/cryptodisk.c | 20 +++++++++++++++++---
- grub-core/disk/luks.c       | 26 ++++++++------------------
- include/grub/cryptodisk.h   |  2 ++
- 3 files changed, 27 insertions(+), 21 deletions(-)
-
-diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index 57fb904..5430b2e 100644
---- a/grub-core/disk/cryptodisk.c
-+++ b/grub-core/disk/cryptodisk.c
-@@ -114,6 +114,20 @@ gf_mul_be (grub_uint8_t *o, const grub_uint8_t *a, const grub_uint8_t *b)
-     }
- }
- 
-+int
-+grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b)
-+{
-+  while ((*uuid_a != '\0') && (*uuid_b != '\0'))
-+    {
-+      while (*uuid_a == '-') uuid_a++;
-+      while (*uuid_b == '-') uuid_b++;
-+      if (grub_toupper(*uuid_a) != grub_toupper(*uuid_b)) break;
-+      uuid_a++;
-+      uuid_b++;
-+    }
-+  return (*uuid_a == '\0') && (*uuid_b == '\0');
-+}
-+
- static gcry_err_code_t
- grub_crypto_pcbc_decrypt (grub_crypto_cipher_handle_t cipher,
- 			 void *out, void *in, grub_size_t size,
-@@ -508,8 +522,8 @@ grub_cryptodisk_open (const char *name, grub_disk_t disk)
-   if (grub_memcmp (name, "cryptouuid/", sizeof ("cryptouuid/") - 1) == 0)
-     {
-       for (dev = cryptodisk_list; dev != NULL; dev = dev->next)
--	if (grub_strcasecmp (name + sizeof ("cryptouuid/") - 1, dev->uuid) == 0)
--	  break;
-+        if (grub_cryptodisk_uuidcmp(name + sizeof ("cryptouuid/") - 1, dev->uuid))
-+          break;
-     }
-   else
-     {
-@@ -741,7 +755,7 @@ grub_cryptodisk_get_by_uuid (const char *uuid)
- {
-   grub_cryptodisk_t dev;
-   for (dev = cryptodisk_list; dev != NULL; dev = dev->next)
--    if (grub_strcasecmp (dev->uuid, uuid) == 0)
-+    if (grub_cryptodisk_uuidcmp(dev->uuid, uuid))
-       return dev;
-   return NULL;
- }
-diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
-index 4ebe21b..80a7606 100644
---- a/grub-core/disk/luks.c
-+++ b/grub-core/disk/luks.c
-@@ -68,9 +68,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
- 		   int check_boot, grub_file_t hdr)
- {
-   grub_cryptodisk_t newdev;
--  const char *iptr;
-   struct grub_luks_phdr header;
--  char *optr;
-   char uuid[sizeof (header.uuid) + 1];
-   char ciphername[sizeof (header.cipherName) + 1];
-   char ciphermode[sizeof (header.cipherMode) + 1];
-@@ -104,22 +102,6 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-       || grub_be_to_cpu16 (header.version) != 1)
-     return NULL;
- 
--  optr = uuid;
--  for (iptr = header.uuid; iptr < &header.uuid[ARRAY_SIZE (header.uuid)];
--       iptr++)
--    {
--      if (*iptr != '-')
--        *optr++ = *iptr;
--    }
--  *optr = 0;
--
--  if (check_uuid && grub_strcasecmp (check_uuid, uuid) != 0)
--    {
--      grub_dprintf ("luks", "%s != %s\n", uuid, check_uuid);
--      return NULL;
--    }
--
--
-   /* Make sure that strings are null terminated.  */
-   grub_memcpy (ciphername, header.cipherName, sizeof (header.cipherName));
-   ciphername[sizeof (header.cipherName)] = 0;
-@@ -127,6 +109,14 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid,
-   ciphermode[sizeof (header.cipherMode)] = 0;
-   grub_memcpy (hashspec, header.hashSpec, sizeof (header.hashSpec));
-   hashspec[sizeof (header.hashSpec)] = 0;
-+  grub_memcpy (uuid, header.uuid, sizeof (header.uuid));
-+  uuid[sizeof (header.uuid)] = 0;
-+
-+  if ( check_uuid && ! grub_cryptodisk_uuidcmp(check_uuid, uuid))
-+    {
-+      grub_dprintf ("luks", "%s != %s\n", uuid, check_uuid);
-+      return NULL;
-+    }
- 
-   newdev = grub_cryptodisk_create (disk, uuid, ciphername, ciphermode, hashspec);
- 
-diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
-index bb25ab7..01c0269 100644
---- a/include/grub/cryptodisk.h
-+++ b/include/grub/cryptodisk.h
-@@ -168,4 +168,6 @@ grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk);
- grub_cryptodisk_t grub_cryptodisk_create (grub_disk_t disk, char *uuid,
- 				   char *ciphername, char *ciphermode, char *digest);
- 
-+int
-+grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b);
- #endif
--- 
-1.9.1
-
diff --git a/resources/grub/patch/grub.johnlane.ie/0006-grub-core-disk-cryptodisk.c-Point-to-const-char.patch b/resources/grub/patch/grub.johnlane.ie/0006-grub-core-disk-cryptodisk.c-Point-to-const-char.patch
deleted file mode 100644
index b9314e5a..00000000
--- a/resources/grub/patch/grub.johnlane.ie/0006-grub-core-disk-cryptodisk.c-Point-to-const-char.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From fd72a029d64e0ee9552e4433387ee01f3cb05592 Mon Sep 17 00:00:00 2001
-From: Klemens Nanni <contact@autoboot.org>
-Date: Tue, 15 Sep 2015 16:00:03 +0200
-Subject: [PATCH 07/10] grub-core/disk/cryptodisk.c: Point to const char
-
----
- grub-core/disk/cryptodisk.c | 2 +-
- include/grub/cryptodisk.h   | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
-index 5430b2e..633edb2 100644
---- a/grub-core/disk/cryptodisk.c
-+++ b/grub-core/disk/cryptodisk.c
-@@ -115,7 +115,7 @@ gf_mul_be (grub_uint8_t *o, const grub_uint8_t *a, const grub_uint8_t *b)
- }
- 
- int
--grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b)
-+grub_cryptodisk_uuidcmp(const char *uuid_a, const char *uuid_b)
- {
-   while ((*uuid_a != '\0') && (*uuid_b != '\0'))
-     {
-diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
-index 01c0269..cd6a545 100644
---- a/include/grub/cryptodisk.h
-+++ b/include/grub/cryptodisk.h
-@@ -169,5 +169,5 @@ grub_cryptodisk_t grub_cryptodisk_create (grub_disk_t disk, char *uuid,
- 				   char *ciphername, char *ciphermode, char *digest);
- 
- int
--grub_cryptodisk_uuidcmp(char *uuid_a, char *uuid_b);
-+grub_cryptodisk_uuidcmp(const char *uuid_a, const char *uuid_b);
- #endif
--- 
-1.9.1
-
diff --git a/resources/grub/patch/reproducible/0001-mkstandalone-add-argument-fixed-time-to-override-mti.patch b/resources/grub/patch/reproducible/0001-mkstandalone-add-argument-fixed-time-to-override-mti.patch
deleted file mode 100644
index 1d537e87..00000000
--- a/resources/grub/patch/reproducible/0001-mkstandalone-add-argument-fixed-time-to-override-mti.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 8dde1d7be2dd321a375570b7ff7e22bb01293044 Mon Sep 17 00:00:00 2001
-From: Alexander Couzens <lynxis@fe80.eu>
-Date: Fri, 4 Dec 2015 17:10:42 +0100
-Subject: [PATCH 08/10] mkstandalone: add argument --fixed-time to override
- mtime of files
-
-mkstandalone adds several files to an archive. Doing this it uses the
-mtime to give these files a timestamp.
---fixed-time <TIME_EPOCH> overrides these timestamps with a given.
-
-Replacing all timestamps with a specific one is required
-to get reproducible builds. See source epoch specification of
-reproducible-builds.org
----
- util/grub-mkstandalone.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/util/grub-mkstandalone.c b/util/grub-mkstandalone.c
-index 4907d44..047f0cd 100644
---- a/util/grub-mkstandalone.c
-+++ b/util/grub-mkstandalone.c
-@@ -30,6 +30,7 @@
- #pragma GCC diagnostic error "-Wmissing-prototypes"
- #pragma GCC diagnostic error "-Wmissing-declarations"
- 
-+static time_t fixed_time;
- static char *output_image;
- static char **files;
- static int nfiles;
-@@ -48,6 +49,7 @@ static struct argp_option options[] = {
-    0, N_("save output in FILE [required]"), 2},
-   {"format", 'O', N_("FILE"), 0, 0, 2},
-   {"compression", 'C', "xz|none|auto", OPTION_HIDDEN, 0, 2},
-+  {"fixed-time", 't', N_("TIMEEPOCH"), 0, N_("Use a fixed timestamp to override mtime of all files. Time since epoch is used."), 2},
-   {0, 0, 0, 0, 0, 0}
- };
- 
-@@ -72,6 +74,7 @@ help_filter (int key, const char *text, void *input __attribute__ ((unused)))
- static error_t
- argp_parser (int key, char *arg, struct argp_state *state)
- {
-+  char *b;
-   if (key == 'C')
-     key = GRUB_INSTALL_OPTIONS_INSTALL_CORE_COMPRESS;
- 
-@@ -80,6 +83,14 @@ argp_parser (int key, char *arg, struct argp_state *state)
- 
-   switch (key)
-     {
-+    case 't':
-+      fixed_time = strtoll (arg, &b, 10);
-+      if (*b !='\0') {
-+        printf (_("invalid fixed time number: %s\n"), arg);
-+        argp_usage (state);
-+        exit (1);
-+      }
-+      break;
- 
-     case 'o':
-       if (output_image)
-@@ -192,7 +203,8 @@ add_tar_file (const char *from,
-   if (grub_util_is_special_file (from))
-     return;
- 
--  mtime = grub_util_get_mtime (from);
-+  /* use fixed_time if given for mtime */
-+  mtime = fixed_time != -1 ? fixed_time : grub_util_get_mtime (from);
- 
-   optr = tcn = xmalloc (strlen (to) + 1);
-   for (iptr = to; *iptr == '/'; iptr++);
--- 
-1.9.1
-
diff --git a/resources/grub/patch/reproducible/0002-mkrescue-add-argument-fixed-time-to-get-reproducible.patch b/resources/grub/patch/reproducible/0002-mkrescue-add-argument-fixed-time-to-get-reproducible.patch
deleted file mode 100644
index 0612ade0..00000000
--- a/resources/grub/patch/reproducible/0002-mkrescue-add-argument-fixed-time-to-get-reproducible.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 0f1e1a29d4d019e7b2b1a3ac3db7ca22c75e8d88 Mon Sep 17 00:00:00 2001
-From: Alexander Couzens <lynxis@fe80.eu>
-Date: Fri, 4 Dec 2015 17:10:43 +0100
-Subject: [PATCH 09/10] mkrescue: add argument --fixed-time to get reproducible
- uuids
-
-The uuid generation is based on the time.
----
- util/grub-mkrescue.c | 15 ++++++++++++++-
- 1 file changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/util/grub-mkrescue.c b/util/grub-mkrescue.c
-index 238d484..a3e0155 100644
---- a/util/grub-mkrescue.c
-+++ b/util/grub-mkrescue.c
-@@ -52,6 +52,7 @@ static int xorriso_arg_alloc;
- static char **xorriso_argv;
- static char *iso_uuid;
- static char *iso9660_dir;
-+static time_t fixed_time;
- 
- static void
- xorriso_push (const char *val)
-@@ -110,6 +111,7 @@ static struct argp_option options[] = {
-   {"product-version", OPTION_PRODUCT_VERSION, N_("STRING"), 0, N_("use STRING as product version"), 2},
-   {"sparc-boot", OPTION_SPARC_BOOT, 0, 0, N_("enable sparc boot. Disables HFS+, APM, ARCS and boot as disk image for i386-pc"), 2},
-   {"arcs-boot", OPTION_ARCS_BOOT, 0, 0, N_("enable ARCS (big-endian mips machines, mostly SGI) boot. Disables HFS+, APM, sparc64 and boot as disk image for i386-pc"), 2},
-+  {"fixed-time", 't', N_("TIMEEPOCH"), 0, N_("use a fixed timestamp for uuid generation"), 2},
-   {0, 0, 0, 0, 0, 0}
- };
- 
-@@ -153,6 +155,8 @@ enum {
- static error_t 
- argp_parser (int key, char *arg, struct argp_state *state)
- {
-+  char *b;
-+
-   if (grub_install_parse (key, arg))
-     return 0;
-   switch (key)
-@@ -212,6 +216,15 @@ argp_parser (int key, char *arg, struct argp_state *state)
-       xorriso = xstrdup (arg);
-       return 0;
- 
-+    case 't':
-+      fixed_time = strtoll (arg, &b, 10);
-+      if (*b !='\0') {
-+        printf (_("invalid fixed time number: %s\n"), arg);
-+        argp_usage (state);
-+        exit (1);
-+      }
-+      return 0;
-+
-     default:
-       return ARGP_ERR_UNKNOWN;
-     }
-@@ -542,7 +555,7 @@ main (int argc, char *argv[])
-   {
-     time_t tim;
-     struct tm *tmm;
--    tim = time (NULL);
-+    tim = fixed_time != -1 ? fixed_time : time (NULL);
-     tmm = gmtime (&tim);
-     iso_uuid = xmalloc (55);
-     grub_snprintf (iso_uuid, 50,
--- 
-1.9.1
-
diff --git a/resources/grub/patch/reproducible/0003-Makefile-use-FIXED_TIMESTAMP-for-mkstandalone-if-set.patch b/resources/grub/patch/reproducible/0003-Makefile-use-FIXED_TIMESTAMP-for-mkstandalone-if-set.patch
deleted file mode 100644
index f06dbfb5..00000000
--- a/resources/grub/patch/reproducible/0003-Makefile-use-FIXED_TIMESTAMP-for-mkstandalone-if-set.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 57174ed960905be4f9c229bbf3913b25745dbfd9 Mon Sep 17 00:00:00 2001
-From: Alexander Couzens <lynxis@fe80.eu>
-Date: Fri, 4 Dec 2015 17:10:44 +0100
-Subject: [PATCH 10/10] Makefile: use FIXED_TIMESTAMP for mkstandalone if set
-
-mkstandalone sets timestamps for files which can be overriden by a fixed_timestamp.
-This makes it possible to build reproducible builds for coreboot.
-
-To build a reproducible build of grub for coreboot do:
-make default_payload.elf FIXED_TIMESTAMP=1134242
----
- Makefile.am | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 00a9663..ed7f148 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -411,7 +411,7 @@ bootcheck: $(BOOTCHECKS)
- if COND_i386_coreboot
- default_payload.elf: grub-mkstandalone grub-mkimage FORCE
- 	test -f $@ && rm $@ || true
--	pkgdatadir=. ./grub-mkstandalone --grub-mkimage=./grub-mkimage -O i386-coreboot -o $@ --modules='ahci pata ehci uhci ohci usb_keyboard usbms part_msdos ext2 fat at_keyboard part_gpt usbserial_usbdebug cbfs' --install-modules='ls linux search configfile normal cbtime cbls memrw iorw minicmd lsmmap lspci halt reboot hexdump pcidump regexp setpci lsacpi chain test serial multiboot cbmemc linux16 gzio echo help syslinuxcfg xnu $(shell cat grub-core/fs.lst) password_pbkdf2 $(EXTRA_PAYLOAD_MODULES)' --fonts= --themes= --locales= -d grub-core/ /boot/grub/grub.cfg=$(srcdir)/coreboot.cfg
-+	pkgdatadir=. ./grub-mkstandalone --grub-mkimage=./grub-mkimage -O i386-coreboot -o $@ --modules='ahci pata ehci uhci ohci usb_keyboard usbms part_msdos ext2 fat at_keyboard part_gpt usbserial_usbdebug cbfs' --install-modules='ls linux search configfile normal cbtime cbls memrw iorw minicmd lsmmap lspci halt reboot hexdump pcidump regexp setpci lsacpi chain test serial multiboot cbmemc linux16 gzio echo help syslinuxcfg xnu $(shell cat grub-core/fs.lst) password_pbkdf2 $(EXTRA_PAYLOAD_MODULES)' --fonts= --themes= --locales= -d grub-core/ /boot/grub/grub.cfg=$(srcdir)/coreboot.cfg $(if $(FIXED_TIMESTAMP),-t $(FIXED_TIMESTAMP))
- endif
- 
- endif
--- 
-1.9.1
-
diff --git a/resources/scripts/helpers/download/grub b/resources/scripts/helpers/download/grub
index d0d42817..1847de9a 100755
--- a/resources/scripts/helpers/download/grub
+++ b/resources/scripts/helpers/download/grub
@@ -41,7 +41,7 @@ git clone git://git.savannah.gnu.org/grub.git || git clone http://git.savannah.g
 cd "grub/"
 
 # reset to known revision
-git reset --hard 7f2a856faec951b7ab816880bd26e1e10b17a596
+git reset --hard e54c99aaff5e5f6f5d3b06028506c57e66d8ef77
 
 # Apply patches
 # ------------------------------------------------------------------------------
@@ -49,20 +49,6 @@ git reset --hard 7f2a856faec951b7ab816880bd26e1e10b17a596
 # Replace "GNU GRUB version" in GRUB screen with "FREE AS IN FREEDOM"
 git am "../resources/grub/patch/0001-grub-core-normal-main.c-Display-FREE-AS-IN-FREEDOM-n.patch"
 
-# GRUB enhancement patches from grub.johnlane.ie (rebased in libreboot's GRUB, unofficially, on 30 November 2015)
-git am "../resources/grub/patch/grub.johnlane.ie/0001-Cryptomount-support-LUKS-detached-header.patch"
-git am "../resources/grub/patch/grub.johnlane.ie/0002-Cryptomount-support-key-files.patch"
-git am "../resources/grub/patch/grub.johnlane.ie/0003-Cryptomount-luks-allow-multiple-passphrase-attempts.patch"
-git am "../resources/grub/patch/grub.johnlane.ie/0004-Cryptomount-support-plain-dm-crypt.patch"
-git am "../resources/grub/patch/grub.johnlane.ie/0005-Cryptomount-support-for-hyphens-in-UUID.patch"
-# hotfix from kl3 (merged from autoboot) (ditto)
-git am "../resources/grub/patch/grub.johnlane.ie/0006-grub-core-disk-cryptodisk.c-Point-to-const-char.patch"
-
-# Needed for reproducible builds in GRUB
-git am "../resources/grub/patch/reproducible/0001-mkstandalone-add-argument-fixed-time-to-override-mti.patch"
-git am "../resources/grub/patch/reproducible/0002-mkrescue-add-argument-fixed-time-to-get-reproducible.patch"
-git am "../resources/grub/patch/reproducible/0003-Makefile-use-FIXED_TIMESTAMP-for-mkstandalone-if-set.patch"
-
 cd "../"
 
 # Also download SeaBIOS, which we use with GRUB, to implement SeaGRUB
diff --git a/resources/scripts/helpers/download/seabios b/resources/scripts/helpers/download/seabios
index 39036ebb..18f90dd6 100755
--- a/resources/scripts/helpers/download/seabios
+++ b/resources/scripts/helpers/download/seabios
@@ -44,7 +44,7 @@ cd "seabios/"
 # Reset to the last commit that was tested (we use stable releases for seabios)
 # ------------------------------------------------------------------------------
 
-git reset --hard rel-1.9.1
+git reset --hard 19fdcca467ad3436d68ef88899b4dcd78154a9c6
 )
 
 
diff --git a/resources/seabios/config/config b/resources/seabios/config/config
index 8333ea9e..cd13ec77 100644
--- a/resources/seabios/config/config
+++ b/resources/seabios/config/config
@@ -87,4 +87,5 @@ CONFIG_VGA_EXTRA_STACK_SIZE=512
 #
 CONFIG_DEBUG_LEVEL=1
 # CONFIG_DEBUG_SERIAL is not set
+# CONFIG_DEBUG_SERIAL_MMIO is not set
 CONFIG_DEBUG_COREBOOT=y