Hello, I found out that more bluetooth headsets supports AuriStream codec in bluetooth HSP/HFP profile. It is proprietary CSR codec described as some ADPCM variant with better quality as default CVSD codec. Headset announce their support by sending command AT+CSRSF, in sixth number with first or second bit set (counted from zero). E.g.: AT+CSRSF=0,0,0,0,0,7 Codec is then selected by host with sending: +CSRFN: (6,4) OK And answer from headset is acknowledged by another: OK Problem is that on Linux after issuing these AT commands I cannot longer connect to SCO socket. connect() fails with Protocol Error. And in btmon is following error: > HCI Event: Synchronous Connect Complete (0x2c) plen 17 Status: Invalid LMP Parameters / Invalid LL Parameters (0x1e) In some CSR SKD is example how to activate it and there is code which seems to sets following HCI connection parameters: syncPktTypes = 0x003F bandwidth = 4000 max_latency = 16 voice_settings = 0x63 retx_effort = 2 I figured out that voice_settings can be configured via setsockopt() SOL_BLUETOOTH + BT_VOICE. But for some unknown reason linux kernel accept only two whitelisted values: 0x0003 and 0x0060. So I tried to set 0x0003 value (BT_VOICE_TRANSPARENT). In btmon I saw that kernel really changed "Air Coding Format" from CVSD to Transparent, but I still got same "Invalid LMP Parameters" error. I tried to remove that whilelist from BT_VOICE option via patch below: diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 9a580999ca57..06db91de4f23 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -231,7 +231,7 @@ static int sco_connect(struct sock *sk) else type = SCO_LINK; - if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT && + if ((sco_pi(sk)->setting & SCO_AIRMODE_MASK) == SCO_AIRMODE_TRANSP && (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) { err = -EOPNOTSUPP; goto done; @@ -836,13 +836,6 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname, break; } - /* Explicitly check for these values */ - if (voice.setting != BT_VOICE_TRANSPARENT && - voice.setting != BT_VOICE_CVSD_16BIT) { - err = -EINVAL; - break; - } - sco_pi(sk)->setting = voice.setting; break; Btmon now really showed Settings as 0x63, but still did not worked. Again exactly same HCI error. Next I tried hacking linux kernel to customize packet type and max latency. But even I changed these values I still got that HCI error. After I changed tx_bandwidth and rx_bandwidth to 4000 (as described in above connection parameters), connect() syscall for that SCO socket succeeded and I started getting voice microphone data on that socket. And it worked also with voice settings 0x0003 with active in-kernel whitelist. Patch which is needed is following: Change bandwidth to 4000: diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index bd4978ce8c45..2dd4d0412971 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -283,8 +283,8 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle) cp.handle = cpu_to_le16(handle); - cp.tx_bandwidth = cpu_to_le32(0x00001f40); - cp.rx_bandwidth = cpu_to_le32(0x00001f40); + cp.tx_bandwidth = cpu_to_le32(4000); + cp.rx_bandwidth = cpu_to_le32(4000); cp.voice_setting = cpu_to_le16(conn->setting); switch (conn->setting & SCO_AIRMODE_MASK) { I have really no idea what it does with headset. But without this patch I'm not able to switch HSP codec from CVSD to AuriStream. Is somebody able to explain how above change can allow opening SCO socket? Because without it I'm not able to activate AuriStream codec, could you consider allowing userspace (via some setsockoptň to change bandwidth? Because now it is hardcoded in kernel source code. For more details here is btmon output with default bandwidth which is failing: $ sudo ./monitor/btmon Bluetooth monitor ver 5.50 = Note: Linux version 4.9.0-9-amd64 (x86_64) = Note: Bluetooth subsystem version 2.22 = New Index: XX:XX:XX:XX:XX:XX (Primary,USB,hci0) = Open Index: XX:XX:XX:XX:XX:XX = Index Info: XX:XX:XX:XX:XX:XX (Intel Corp.) @ MGMT Open: bluetoothd (privileged) version 1.14 @ MGMT Open: btmon (privileged) version 1.14 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17 Handle: 34 Transmit bandwidth: 8000 Receive bandwidth: 8000 Max latency: 13 Setting: 0x0003 Input Coding: Linear Input Data Format: 1's complement Input Sample Size: 8-bit # of bits padding at MSB: 0 Air Coding Format: Transparent Data Retransmission effort: Optimize for link quality (0x02) Packet type: 0x0380 3-EV3 may not be used 2-EV5 may not be used 3-EV5 may not be used > HCI Event: Command Status (0x0f) plen 4 Setup Synchronous Connection (0x01|0x0028) ncmd 1 Status: Success (0x00) > HCI Event: Max Slots Change (0x1b) plen 3 Handle: 34 Max slots: 1 > HCI Event: Synchronous Connect Complete (0x2c) plen 17 Status: Invalid LMP Parameters / Invalid LL Parameters (0x1e) Handle: 34 Address: XX:XX:XX:XX:XX:XX (Creative Technology, Ltd.) Link type: eSCO (0x02) Transmission interval: 0x00 Retransmission window: 0x00 RX packet length: 0 TX packet length: 0 Air mode: u-law log (0x00) > HCI Event: Max Slots Change (0x1b) plen 3 Handle: 34 Max slots: 5 And here is btmon output with above kernel patch which changes bandwidth to 4000: $ sudo ./monitor/btmon Bluetooth monitor ver 5.50 = Note: Linux version 4.9.0-9-amd64 (x86_64) = Note: Bluetooth subsystem version 2.22 = New Index: XX:XX:XX:XX:XX:XX (Primary,USB,hci0) = Open Index: XX:XX:XX:XX:XX:XX = Index Info: XX:XX:XX:XX:XX:XX (Intel Corp.) @ MGMT Open: bluetoothd (privileged) version 1.14 @ MGMT Open: btmon (privileged) version 1.14 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17 Handle: 34 Transmit bandwidth: 4000 Receive bandwidth: 4000 Max latency: 13 Setting: 0x0003 Input Coding: Linear Input Data Format: 1's complement Input Sample Size: 8-bit # of bits padding at MSB: 0 Air Coding Format: Transparent Data Retransmission effort: Optimize for link quality (0x02) Packet type: 0x0380 3-EV3 may not be used 2-EV5 may not be used 3-EV5 may not be used > HCI Event: Command Status (0x0f) plen 4 Setup Synchronous Connection (0x01|0x0028) ncmd 1 Status: Success (0x00) > HCI Event: Max Slots Change (0x1b) plen 3 Handle: 34 Max slots: 1 > HCI Event: Synchronous Connect Complete (0x2c) plen 17 Status: Success (0x00) Handle: 38 Address: XX:XX:XX:XX:XX:XX (Creative Technology, Ltd.) Link type: eSCO (0x02) Transmission interval: 0x10 Retransmission window: 0x02 RX packet length: 40 TX packet length: 40 Air mode: Transparent (0x03) < SCO Data TX: Handle 38 flags 0x00 dlen 48 < ACL Data TX: Handle 34 flags 0x00 dlen 18 Channel: 105 len 14 [PSM 0 mode 0] {chan 0} 61 ef 15 0d 0a 2b 56 47 4d 3d 34 0d 0a d4 a....+VGM=4... > HCI Event: Number of Completed Packets (0x13) plen 5 Num handles: 1 Handle: 34 Count: 1 > SCO Data RX: Handle 38 flags 0x00 dlen 24 > SCO Data RX: Handle 38 flags 0x00 dlen 24 > SCO Data RX: Handle 38 flags 0x00 dlen 24 < SCO Data TX: Handle 38 flags 0x00 dlen 48 > HCI Event: Max Slots Change (0x1b) plen 3 Handle: 34 Max slots: 5 ... and SCO data are coming on SCO socket. -- Pali Rohár pali.rohar@gmail.com