diff --git a/grub-core/lib/i386/random.c b/grub-core/lib/i386/random.c
index cd83d2f8f..e060a2614 100644
--- a/grub-core/lib/i386/random.c
+++ b/grub-core/lib/i386/random.c
@@ -54,7 +54,8 @@ pmtimer_tsc_get_random_bit (void)
       have_pmtimer = 0;
       return -1;
     }
-  return tsc_diff & 1;
+  /* Do not use LSB. */
+  return (tsc_diff >> 1) & 1;
 }
 
 static int
diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
index 1f9128f6f..67e40e2da 100644
--- a/grub-core/loader/i386/bsd.c
+++ b/grub-core/loader/i386/bsd.c
@@ -35,6 +35,7 @@
 #include <grub/ns8250.h>
 #include <grub/bsdlabel.h>
 #include <grub/crypto.h>
+#include <grub/random.h>
 #include <grub/safemath.h>
 #include <grub/verify.h>
 #ifdef GRUB_MACHINE_PCBIOS
@@ -1335,6 +1336,45 @@ grub_bsd_load_aout (grub_file_t file, const char *filename)
 			 ah.aout32.a_text + ah.aout32.a_data,
 			 bss_size);
 }
+static grub_err_t
+grub_fill_random_bytes(grub_uint8_t *addr, grub_size_t size)
+{
+  grub_uint8_t key[16], iv[16];
+  grub_uint8_t *buf;
+  grub_crypto_cipher_handle_t handle;
+  grub_size_t rd_size, remainder;
+  const gcry_cipher_spec_t *cipher;
+
+  rd_size = size & 0xfffffff0;
+  remainder = size & 0xf;
+
+  if ((buf = grub_calloc (1, rd_size)) == NULL)
+    return GRUB_ERR_OUT_OF_MEMORY;
+
+  if ((cipher = grub_crypto_lookup_cipher_by_name ("aes")) == NULL ||
+      grub_crypto_get_random (key, sizeof(key)) != GRUB_ERR_NONE ||
+      grub_crypto_get_random (iv, sizeof(iv)) != GRUB_ERR_NONE ||
+      (handle = grub_crypto_cipher_open (cipher)) == NULL)
+    goto err;
+
+  if (grub_crypto_cipher_set_key (handle, key, sizeof(key)) != GPG_ERR_NO_ERROR ||
+      grub_crypto_cbc_encrypt (handle, addr, buf, rd_size, iv) != GPG_ERR_NO_ERROR)
+    goto err2;
+
+  if (remainder > 0 &&
+      grub_crypto_get_random (addr + rd_size , size & 0xf) != GRUB_ERR_NONE)
+    goto err2;
+
+  grub_crypto_cipher_close (handle);
+  grub_free (buf);
+  return GRUB_ERR_NONE;
+
+err2:
+  grub_crypto_cipher_close (handle);
+err:
+  grub_free (buf);
+  return GRUB_ERR_BAD_MODULE;
+}
 
 static grub_err_t
 grub_bsd_load_elf (grub_elf_t elf, const char *filename)
@@ -1348,6 +1388,8 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
     {
       grub_relocator_chunk_t ch;
       Elf32_Phdr *phdr;
+      Elf32_Addr prandaddr = 0;
+      Elf32_Xword prandsize = 0;
 
       entry = elf->ehdr.ehdr32.e_entry & 0xFFFFFFF;
 
@@ -1356,7 +1398,8 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
 	  Elf32_Addr paddr;
 
 	  if (phdr->p_type != PT_LOAD
-	      && phdr->p_type != PT_DYNAMIC)
+	      && phdr->p_type != PT_DYNAMIC
+	      && phdr->p_type != PT_OPENBSD_RANDOMIZE)
 	    continue;
 
 	  paddr = phdr->p_paddr & 0xFFFFFFF;
@@ -1366,6 +1409,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
 
 	  if (paddr + phdr->p_memsz > kern_end)
 	    kern_end = paddr + phdr->p_memsz;
+
+	  if (phdr->p_type == PT_OPENBSD_RANDOMIZE) {
+	    prandaddr = paddr;
+	    prandsize = phdr->p_memsz;
+	  }
 	}
 
       if (grub_errno)
@@ -1382,12 +1430,18 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
 	return err;
       if (kernel_type != KERNEL_TYPE_OPENBSD)
 	return GRUB_ERR_NONE;
+      if (prandaddr >0 && prandsize > 0 &&
+	  grub_fill_random_bytes ((grub_uint8_t *)kern_chunk_src - kern_start + prandaddr,
+				  prandsize) == GRUB_ERR_NONE)
+	bootflags |= OPENBSD_RB_GOODRANDOM;
       return grub_openbsd_find_ramdisk32 (elf->file, filename, kern_start,
 					  kern_chunk_src, &openbsd_ramdisk);
     }
   else if (grub_elf_is_elf64 (elf))
     {
       Elf64_Phdr *phdr;
+      Elf64_Addr prandaddr = 0;
+      Elf64_Xword prandsize = 0;
 
       is_64bit = 1;
 
@@ -1411,7 +1465,8 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
 	  Elf64_Addr paddr;
 
 	  if (phdr->p_type != PT_LOAD
-	      && phdr->p_type != PT_DYNAMIC)
+	      && phdr->p_type != PT_DYNAMIC
+	      && phdr->p_type != PT_OPENBSD_RANDOMIZE)
 	    continue;
 
 	  paddr = phdr->p_paddr & 0xFFFFFFF;
@@ -1421,6 +1476,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
 
 	  if (paddr + phdr->p_memsz > kern_end)
 	    kern_end = paddr + phdr->p_memsz;
+
+	  if (phdr->p_type == PT_OPENBSD_RANDOMIZE) {
+	    prandaddr = paddr;
+	    prandsize = phdr->p_memsz;
+	  }
 	}
 
       if (grub_errno)
@@ -1444,6 +1504,10 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename)
 	return err;
       if (kernel_type != KERNEL_TYPE_OPENBSD)
 	return GRUB_ERR_NONE;
+      if (prandaddr >0 && prandsize > 0 &&
+	  grub_fill_random_bytes ((grub_uint8_t *)kern_chunk_src - kern_start + prandaddr,
+				  prandsize) == GRUB_ERR_NONE)
+	bootflags |= OPENBSD_RB_GOODRANDOM;
       return grub_openbsd_find_ramdisk64 (elf->file, filename, kern_start,
 					  kern_chunk_src, &openbsd_ramdisk);
     }
diff --git a/include/grub/elf.h b/include/grub/elf.h
index bd313a70b..09002c5fd 100644
--- a/include/grub/elf.h
+++ b/include/grub/elf.h
@@ -564,6 +564,7 @@ typedef struct
 #define PT_LOOS		0x60000000	/* Start of OS-specific */
 #define PT_GNU_EH_FRAME	0x6474e550	/* GCC .eh_frame_hdr segment */
 #define PT_GNU_STACK	0x6474e551      /* GCC stack segment  */
+#define PT_OPENBSD_RANDOMIZE 0x65a3dbe6 /* fill with random data */
 #define PT_LOSUNW	0x6ffffffa
 #define PT_SUNWBSS	0x6ffffffa	/* Sun Specific segment */
 #define PT_SUNWSTACK	0x6ffffffb	/* Stack segment */
diff --git a/include/grub/i386/openbsd_reboot.h b/include/grub/i386/openbsd_reboot.h
index 3f6571a44..a12a49d87 100644
--- a/include/grub/i386/openbsd_reboot.h
+++ b/include/grub/i386/openbsd_reboot.h
@@ -68,6 +68,9 @@
 #define OPENBSD_RB_POWERDOWN	(1 << 12) /* attempt to power down machine */
 #define OPENBSD_RB_SERCONS	(1 << 13) /* use serial console if available */
 #define OPENBSD_RB_USERREQ	(1 << 14) /* boot() called at user request (e.g. ddb) */
+#define OPENBSD_RB_RESET        (1 << 15) /* just reset, no cleanup  */
+#define OPENBSD_RB_GOODRANDOM   (1 << 16) /* excellent random seed loaded */
+#define OPENBSD_RB_UNHIBERNATE  (1 << 17) /* unhibernate */
 
 #define OPENBSD_B_DEVMAGIC	0xa0000000
 #define OPENBSD_B_ADAPTORSHIFT	24
