diff --git a/build.rs b/build.rs
index e1445fa..01dfc7c 100644
--- a/build.rs
+++ b/build.rs
@@ -298,7 +298,7 @@ fn main() {
         .allowlist_function(".*.aio.*")
         .allowlist_function("^accel.*")
         .allowlist_function(".*.crypto_disk.*")
-        .allowlist_function(".*.crypto_opts")
+        .allowlist_function(".*.crypto_opts.*")
         .allowlist_function(".*.iscsi.*")
         .allowlist_function(".*.lock_lba_range")
         .allowlist_function(".*.lvol.*")
diff --git a/src/bdev.rs b/src/bdev.rs
index f58ee88..49a13ea 100644
--- a/src/bdev.rs
+++ b/src/bdev.rs
@@ -17,7 +17,7 @@ use crate::{
         spdk_bdev_get_aliases, spdk_bdev_get_buf_align, spdk_bdev_get_by_name,
         spdk_bdev_has_write_cache, spdk_bdev_io_type_supported, spdk_bdev_module,
         spdk_bdev_module_release_bdev, spdk_bdev_register, spdk_bdev_unregister,
-        SPDK_BDEV_CLAIM_EXCL_WRITE, SPDK_BDEV_CLAIM_NONE,
+        vbdev_crypto_disk_get_base_bdev, SPDK_BDEV_CLAIM_EXCL_WRITE, SPDK_BDEV_CLAIM_NONE,
     },
     BdevIo, BdevModule, BdevOps, IoChannel, IoDevice, IoType, Thread, Uuid,
 };
@@ -71,6 +71,20 @@ where
         unsafe { (*self.as_inner_ref().module).name.as_str() }
     }
 
+    /// Returns the bdev handle which is the base of `self` bdev here.
+    /// e.g self could be a crypto vbdev and base an aio bdev.
+    /// XXX: This must be called only by crypto vbdev today.
+    pub fn crypto_base_bdev(&self) -> Option<Self> {
+        let p = unsafe {
+            vbdev_crypto_disk_get_base_bdev(self.name().as_ptr() as *mut std::os::raw::c_char)
+        };
+        if p.is_null() {
+            None
+        } else {
+            Some(Self::from_inner_ptr(p))
+        }
+    }
+
     /// TODO
     /// ... lookup a bdev by its name
     pub fn lookup_by_name(name: &str) -> Option<Self> {