always decrypt root
cryptsetup update for SSD support