Wire protocol

Huawei Link Protocol V2

Network Packets

Packet types in a nutshell:

• Single package
  • Non-sliced
  • Sliced
• Multi (partial) package

Single non-sliced packages are used for short primitive commands and responses.

Sliced packages seem to be some sort of high-level packet fragmentation scheme to prevent running into ATT attribute value length limit (512 bytes).

Multi packages are apparently fragmented at a lower level (split without re-wrapping individual parts with the normal package structural elements like header and checksum). They can be thus reassembled verbatim.

N.B. At the moment only single non-sliced packages are supported by the current code, other types need more research.

N.B. Check out this Stack Overflow answer for the details about Bluetooth packet size limits.

Single Package

Non-sliced

0x5A LLLL 0x00 BODY CRC16

Field	Width	Description
LLLL	2B	len(BODY) + 1
BODY	64K	Command
CRC16	2B	CRC-CCITT (XMODEM)

CRC16 = CRC-CCITT(0x5A LLLL 0x00 BODY, 0)

Sliced

0x5A LLLL XX YY BODY CRC16

Field	Width	Description
LLLL	2B	len(BODY) + 2
XX	1B	Sliced flag: 0x1, 0x2, 0x3
YY	1B	Slice index
BODY	64K	Command
CRC16	2B	CRC-CCITT (XMODEM)

Apparently 0x3 is used as a magic value to mark sliced packets.

Multi Package

Just re-assemble in single packages as is.

Command Structure

BODY Structure

SS CC TLV1 TLV2 ...

Field	Width	Description
SS	1B	Service ID
CC	1B	Command ID
TLVN	>= 2B	Tag Length Value

TLV Structure

Inspired by ASN.1 X.690 DER encoding.

TAG LENGTH VALUE

Field	Width	Description
TAG	1B	Tag ID, may indicate nesting (see below)
LENGTH	>= 1B	len(VALUE), VarInt
VALUE	>= 0B	Value: integer, bytes, further TLVs

Variable-Length Integer (VarInt)

See Variable-length quantity.

Nested TLVs

If TAG MSB is set, this TLV contains one or more nested TLVs.