repart: use libcryptsetup to set default kdf params

Using pbkdf2 requires setting benchmark parameters, otherwise
libcryptsetup 2.7.x rejects the call:

Encrypting future partition 4...
Allocating context for crypt device /dev/vda5.
Trying to open and read device /dev/vda5 with direct-io.
Direct-io is supported and works.
Initialising device-mapper backend library.
Formatting device /dev/vda5 as type LUKS2.
Crypto backend (OpenSSL 3.5.7 9 Jun 2026 [default][threads][argon2]) initialized in cryptsetup library version 2.7.5.
Detected kernel Linux 6.6.158.1-microsoft-standard aarch64.
PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
Topology: IO (512/0), offset = 0; Required alignment is 1048576 bytes.
Checking if cipher aes-xts-plain64 is usable.
Using userspace crypto wrapper to access keyslot area.
Formatting LUKS2 with JSON metadata area 12288 bytes and keyslots area 16744448 bytes.
Creating new digest 0 (pbkdf2).
Setting PBKDF2 type key digest 0.
Running pbkdf2(sha256) benchmark.
PBKDF benchmark: memory cost = 0, iterations = 197397, threads = 0 (took 166 ms)
PBKDF benchmark: memory cost = 0, iterations = 200415, threads = 0 (took 654 ms)
Benchmark returns pbkdf2(sha256) 200415 iterations, 0 memory, 0 threads (for 512-bits key).
Segment 0 assigned to digest 0.
Wiping LUKS areas (0x000000 - 0x1000000) with zeroes.
Device size 507752448, offset 16777216.
Wiping keyslots area (0x008000 - 0x1000000) with random data.
Reusing open rw fd on device /dev/vda5
Device size 507752448, offset 16777216.
Acquiring write lock for device /dev/vda5.
Opening lock resource file /run/cryptsetup/L_253:5
Verifying lock handle for /dev/vda5.
Device /dev/vda5 WRITE lock taken.
Trying to write LUKS2 header (16384 bytes) at offset 0.
Reusing open rw fd on device /dev/vda5
Checksum:78aa194e1f36e1447774b6904438c7e91e4f3fc43bdd7e66eb020ade1e6af1ff (in-memory)
Trying to write LUKS2 header (16384 bytes) at offset 16384.
Reusing open rw fd on device /dev/vda5
Checksum:6100c4c27eb222056484124f99ce16f26f32ac5f69efff11d2c7ac4f3416944e (in-memory)
Device /dev/vda5 WRITE lock released.
Failed to set KDF type: Invalid argument
Releasing crypt device /dev/vda5 context.
Releasing device-mapper backend.
Closing read only fd for /dev/vda5.
Closing read write fd for /dev/vda5.
Failed to encrypt device: Invalid argument

Use the crypt_get_pbkdf_type_params() API to set the defaults in the
param struct we pass in.

Follow-up for fa6eb2e016

(cherry picked from commit 00d8a93838)
(cherry picked from commit 37d38a0df0)

src/repart/repart.c

@@ -5540,17 +5540,16 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
                          * (e.g. kdump with crashkernel=512MB). */
                         r = cryptsetup_set_minimal_pbkdf(cd);
                 } else {
-                        /* For argon2id or pbkdf2, set the type and let libcryptsetup benchmark
-                         * and determine the parameters. */
-                        static const struct crypt_pbkdf_type argon2id_pbkdf = {
-                                .type = "argon2id",
-                        };
-                        static const struct crypt_pbkdf_type pbkdf2_pbkdf = {
-                                .type = "pbkdf2",
-                        };
+                        assert(IN_SET(p->encrypt_kdf, ENCRYPT_KDF_ARGON2ID, ENCRYPT_KDF_PBKDF2));
 
-                        r = sym_crypt_set_pbkdf_type(cd, p->encrypt_kdf == ENCRYPT_KDF_ARGON2ID ?
-                                                     &argon2id_pbkdf : &pbkdf2_pbkdf);
+                        /* Use libcryptsetup's full defaults, including the benchmark target and hash. */
+                        const char *kdf = p->encrypt_kdf == ENCRYPT_KDF_ARGON2ID ? CRYPT_KDF_ARGON2ID : CRYPT_KDF_PBKDF2;
+                        const struct crypt_pbkdf_type *pbkdf = sym_crypt_get_pbkdf_type_params(kdf);
+                        if (!pbkdf)
+                                return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
+                                                       "Failed to get default parameters for KDF type '%s'.", kdf);
+
+                        r = sym_crypt_set_pbkdf_type(cd, pbkdf);
                 }
                 if (r < 0)
                         return log_error_errno(r, "Failed to set KDF type: %m");

src/shared/cryptsetup-util.c

@@ -30,6 +30,7 @@ DLSYM_PROTOTYPE(crypt_get_cipher_mode) = NULL;
 DLSYM_PROTOTYPE(crypt_get_data_offset) = NULL;
 DLSYM_PROTOTYPE(crypt_get_device_name) = NULL;
 DLSYM_PROTOTYPE(crypt_get_dir) = NULL;
+DLSYM_PROTOTYPE(crypt_get_pbkdf_type_params) = NULL;
 DLSYM_PROTOTYPE(crypt_get_type) = NULL;
 DLSYM_PROTOTYPE(crypt_get_uuid) = NULL;
 DLSYM_PROTOTYPE(crypt_get_verity_info) = NULL;
@@ -299,6 +300,7 @@ int dlopen_cryptsetup(int log_level) {
                         DLSYM_ARG(crypt_get_data_offset),
                         DLSYM_ARG(crypt_get_device_name),
                         DLSYM_ARG(crypt_get_dir),
+                        DLSYM_ARG(crypt_get_pbkdf_type_params),
                         DLSYM_ARG(crypt_get_type),
                         DLSYM_ARG(crypt_get_uuid),
                         DLSYM_ARG(crypt_get_verity_info),

src/shared/cryptsetup-util.h

@@ -35,6 +35,7 @@ extern DLSYM_PROTOTYPE(crypt_get_cipher_mode);
 extern DLSYM_PROTOTYPE(crypt_get_data_offset);
 extern DLSYM_PROTOTYPE(crypt_get_device_name);
 extern DLSYM_PROTOTYPE(crypt_get_dir);
+extern DLSYM_PROTOTYPE(crypt_get_pbkdf_type_params);
 extern DLSYM_PROTOTYPE(crypt_get_type);
 extern DLSYM_PROTOTYPE(crypt_get_uuid);
 extern DLSYM_PROTOTYPE(crypt_get_verity_info);

test/units/TEST-58-REPART.sh

@@ -351,6 +351,7 @@ Label=luks-format-copy
 UUID=7b93d1f2-595d-4ce3-b0b9-837fbd9e63b0
 Format=ext4
 Encrypt=yes
+EncryptKDF=pbkdf2
 CopyFiles=$defs:/def
 SizeMinBytes=48M
 VolumeLabel=schrupfel