7 files changed, 78 insertions, 2 deletions

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e8e52da2b26b..4bee030e4b52 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -402,6 +402,14 @@ struct hci_cp_reject_sync_conn_req {
         __u8     reason;
 } __packed;
 
+#define HCI_OP_IO_CAPABILITY_REPLY      0x042b
+struct hci_cp_io_capability_reply {
+        bdaddr_t bdaddr;
+        __u8     capability;
+        __u8     oob_data;
+        __u8     authentication;
+} __packed;
+
 #define HCI_OP_IO_CAPABILITY_NEG_REPLY  0x0434
 struct hci_cp_io_capability_neg_reply {
         bdaddr_t bdaddr;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9ac3da6e4a9a..6163bff6fa91 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -106,6 +106,7 @@ struct hci_dev {
         __u16           manufacturer;
         __le16          lmp_subver;
         __u16           voice_setting;
+        __u8            io_capability;
 
         __u16           pkt_type;
         __u16           esco_type;
@@ -214,6 +215,7 @@ struct hci_conn {
         __u8             sec_level;
         __u8             pending_sec_level;
         __u8             pin_length;
+        __u8             io_capability;
         __u8             power_save;
         __u16            disc_timeout;
         unsigned long    pend;
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index 46fb56d21b59..44ac55c85079 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -154,6 +154,12 @@ struct mgmt_cp_pin_code_neg_reply {
         bdaddr_t bdaddr;
 } __packed;
 
+#define MGMT_OP_SET_IO_CAPABILITY       0x0013
+struct mgmt_cp_set_io_capability {
+        __le16 index;
+        __u8 io_capability;
+} __packed;
+
 #define MGMT_EV_CMD_COMPLETE            0x0001
 struct mgmt_ev_cmd_complete {
         __le16 opcode;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 99cd8d9d891b..42dc39f25b72 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -234,6 +234,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->mode  = HCI_CM_ACTIVE;
         conn->state = BT_OPEN;
         conn->auth_type = HCI_AT_GENERAL_BONDING;
+        conn->io_capability = hdev->io_capability;
 
         conn->power_save = 1;
         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8ca8cf147058..bf6729a53378 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1084,6 +1084,7 @@ int hci_register_dev(struct hci_dev *hdev)
         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
         hdev->esco_type = (ESCO_HV1);
         hdev->link_mode = (HCI_LM_ACCEPT);
+        hdev->io_capability = 0x03; /* No Input No Output */
 
         hdev->idle_timeout = 0;
         hdev->sniff_max_interval = 800;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 98bcf78f2021..617f58363dbc 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2198,6 +2198,25 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         hci_dev_unlock(hdev);
 }
 
+static inline u8 hci_get_auth_req(struct hci_conn *conn)
+{
+        /* If remote requests dedicated bonding follow that lead */
+        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
+                /* If both remote and local IO capabilities allow MITM
+                 * protection then require it, otherwise don't */
+                if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
+                        return 0x02;
+                else
+                        return 0x03;
+        }
+
+        /* If remote requests no-bonding follow that lead */
+        if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
+                return 0x00;
+
+        return conn->auth_type;
+}
+
 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_io_capa_request *ev = (void *) skb->data;
@@ -2218,8 +2237,15 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
 
         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
-                /* FIXME: Do IO capa response based on information
-                 * provided through the management interface */
+                struct hci_cp_io_capability_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                cp.capability = conn->io_capability;
+                cp.oob_data = 0;
+                cp.authentication = hci_get_auth_req(conn);
+
+                hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
+                                                        sizeof(cp), &cp);
         } else {
                 struct hci_cp_io_capability_neg_reply cp;
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 3800aaf5792d..b2bda83050a4 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1016,6 +1016,35 @@ failed:
         return err;
 }
 
+static int set_io_capability(struct sock *sk, unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_set_io_capability *cp;
+        u16 dev_id;
+
+        BT_DBG("");
+
+        cp = (void *) data;
+        dev_id = get_unaligned_le16(&cp->index);
+
+        hdev = hci_dev_get(dev_id);
+        if (!hdev)
+                return cmd_status(sk, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
+
+        hci_dev_lock_bh(hdev);
+
+        hdev->io_capability = cp->io_capability;
+
+        BT_DBG("%s IO capability set to 0x%02x", hdev->name,
+                                                hdev->io_capability);
+
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+
+        return cmd_complete(sk, MGMT_OP_SET_IO_CAPABILITY,
+                                                &dev_id, sizeof(dev_id));
+}
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 {
         unsigned char *buf;
@@ -1098,6 +1127,9 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         case MGMT_OP_PIN_CODE_NEG_REPLY:
                 err = pin_code_neg_reply(sk, buf + sizeof(*hdr), len);
                 break;
+        case MGMT_OP_SET_IO_CAPABILITY:
+                err = set_io_capability(sk, buf + sizeof(*hdr), len);
+                break;
         default:
                 BT_DBG("Unknown op %u", opcode);
                 err = cmd_status(sk, opcode, 0x01);