From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.w13.tutanota.de (mail.w13.tutanota.de [185.205.69.213]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D916413B293 for ; Sat, 17 Oct 2026 03:09:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.205.69.213 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792206582; cv=none; b=Jyf3xFR7Z+1LY8cV2vxGbanil8A5fvfXJy+UJJBKe6kx8pe+BDHMPKwkrHZP0fDNzD/6RMJLMH69EtlLnGts2w4IxIVxmdwpM/0/o3eVhByrSYxmdraOW9VwqXWfPZICuclB42AqlO76835OT43Hxn/jTY610QahWrQLp9TlxsE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792206582; c=relaxed/simple; bh=AkFl35Ivj2VucTmkCJOLM5EthwvGJLAzlc/I7g4a1Lc=; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type; b=OIMuIC46Riign4d0LoMq5VLwLGkI1SImZvwHD2SSqYnsrAnOMr2sdcD6col2rKZZVlfCMCqyPfYirU7vNcQ5zKL4pe+i0xzWNBaio/3Dt5AOpFVux+Du+QCDDAqPP9ZWttAGZL8RNqJvMniVgD+JwNrrI1sj/SP+6BnLypof8HE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=tutamail.com; spf=pass smtp.mailfrom=tutamail.com; dkim=pass (2048-bit key) header.d=tutamail.com header.i=@tutamail.com header.b=EnMh2GP/; arc=none smtp.client-ip=185.205.69.213 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=tutamail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=tutamail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=tutamail.com header.i=@tutamail.com header.b="EnMh2GP/" Received: from tutadb.w10.tutanota.de (w10.api.tuta.com [IPv6:fd:ac::d:10]) by mail.w13.tutanota.de (Postfix) with ESMTP id D9F311936B715 for ; Sat, 17 Oct 2026 05:02:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1792206126; s=s1; d=tutamail.com; h=From:From:To:To:Subject:Subject:Content-Description:Content-ID:Content-Type:Content-Type:Content-Transfer-Encoding:Cc:Date:Date:In-Reply-To:MIME-Version:MIME-Version:Message-ID:Message-ID:Reply-To:References:Sender; bh=juaSIMcIPfMXts2CaNzsq1iv/uCf0Ji+XTy02pNAJ3w=; b=EnMh2GP//UhpG760fOYJYDCGEXWTFtWy+pZDnq7ndiTGwoPsH9T2NbyIchPB/cHT jhd+5WeS2+JcKBKLdQm+jES9WZVw1EvkctX232/cFKBBSSTa7UXpunfr6Cv1n3kxtDi 5eu7KKZrHc2SEtPA5ND7xAELHyHGCmEn/7JxoUEriD1xE5KxF/aUkWLpw2YPDU6o61t 7TVbHSKrs+hYgagJBiRsqCGP2GpIJvII1LgSnlM83J27GpyTsDh1PTQUFoJbtn/5ZkJ j7aXbKHUrmb0FD6CfLu0AMjgxhbake+w9g9vDTNEIpiqBN1Um7ImWIgg2nY7+Tn3fCy jb9AfNPvSg== Date: Sat, 17 Oct 2026 05:02:06 +0200 (CEST) From: willowswaving@tutamail.com To: Linux Input Message-ID: Subject: [RFC] HID: uclogic: Add support for Xencelabs Pen Display (28bd:520d) and request for switch-to-vendor-mode sequence Precedence: bulk X-Mailing-List: linux-input@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_406316_1321745885.1792206126886" Feedback-ID: 015fe4ab774a31809b4b05b8c610ead356bcc03e5c866e6007fd3e8866c7c0a22bb5af78b76e2b2d682867fe72df3c2e2eae226386f9c0a8fc7fe2cb63b896dd32:TurnOnPrivacy!:tutamail ------=_Part_406316_1321745885.1792206126886 Content-Type: multipart/alternative; boundary="----=_Part_406317_706363494.1792206126886" ------=_Part_406317_706363494.1792206126886 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, I would like to report a missing device support in the hid-uclogic driver, and ask for guidance on how to properly add it. Device information ------------------ =C2=A0 Name:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Xencelabs Pen Display =C2=A0 Vendor ID:=C2=A0 0x28bd (Hanvon Ugee / XP-Pen) =C2=A0 Product ID: 0x520d =C2=A0 Firmware:=C2=A0=C2=A0 20250121(230322) =C2=A0 Model:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 UG902_LPH2412_P10 Problem ------- The device is not handled by hid-uclogic. With hid-generic, the device is registered only as a mouse and no pen events (ABS_X, ABS_Y, ABS_PRESSURE, ABS_TILT) are reported to userspace. When I add the device ID to hid-uclogic-core.c, the driver binds, but the resulting interface is still a mouse. evtest shows no pen events. This suggests the device is still in "firmware mode" and never gets switched into the vendor reporting mode that exposes the pen interface. Key observations from testing ----------------------------- 1. lsusb reports only one interface (bNumInterfaces =3D 1, interface 0, =C2=A0=C2=A0 HID class, mouse). It has only two interrupt endpoints: =C2=A0=C2=A0=C2=A0=C2=A0 - 0x81 (IN, 64 bytes) =C2=A0=C2=A0=C2=A0=C2=A0 - 0x01 (OUT, 64 bytes) =C2=A0=C2=A0 Note: There is NO endpoint 0x03, which is the endpoint used by =C2=A0=C2=A0 uclogic_ugee_v2_probe_endpoint in hid-uclogic-params.c. Any at= tempt =C2=A0=C2=A0 to send magic bytes to 0x03 fails with "Invalid endpoint addre= ss". 2. Reading the string descriptor at index 0x64 under LANGID 0x0409 =C2=A0=C2=A0 successfully returns a 14-byte binary blob (13 bytes of conten= t). =C2=A0=C2=A0 Raw HEX: 0e03289a78e60300ff1fd8130100 =C2=A0=C2=A0 (Other indexes return normal strings like the serial number an= d =C2=A0=C2=A0 "hanvon ugee Tech"). Reading index 0x64 does NOT switch the de= vice. 3. Sending the UGEE v2 magic bytes (02 b0 04 00 00 00 00 00 00 00) =C2=A0=C2=A0 via SET_REPORT (Feature 0x02, Output 0x02, Feature 0x03) retur= ns =C2=A0=C2=A0 success, but the device never re-enumerates. 4. A vendor-specific control request (bRequest 0xb0, wValue 0x0402) =C2=A0=C2=A0 times out. 5. Note: Sending unexpected control transfers to this device can cause =C2=A0=C2=A0 the USB HID interface to hang. It requires a complete power cy= cle =C2=A0=C2=A0 (unplugging USB and power) to recover. Request ------- Could someone with access to the Xencelabs USB documentation, or someone who has reverse-engineered the 520d, share the correct sequence to switch this device into vendor mode? Specifically: =C2=A0 - Is the 0x64 string descriptor read the right trigger, or is a =C2=A0=C2=A0=C2=A0 specific control transfer required? =C2=A0 - If a control transfer is needed, what is the correct bRequest, =C2=A0=C2=A0=C2=A0 wValue, wIndex, and endpoint? =C2=A0 - Are there known quirks for this device? If a capture from the Windows driver is needed, I can provide one. If you have any hints, I will be happy to prepare a proper patch with hid-uclogic-params.c changes and re-test. I am attaching the text files with: =C2=A0 - lsusb -v output for 28bd:520d =C2=A0 - the raw HID report descriptor (usbhid-dump) =C2=A0 - the string descriptor enumeration (showing 0x64) =C2=A0 - dmesg logs showing the binding behavior. Thank you very much for your time. Best regards, Willows --=20 =C2=A0https://tuta.com/free-email ------=_Part_406317_706363494.1792206126886 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hello,

I would like to report a missing device support in the hid-uclogic
=
driver, and ask for guidance on how to properly add= it.

Device informat= ion
------------------
  Name:       Xencelabs Pen Display
  Vendor ID:  0x28bd (Hanvon Ugee / XP-P= en)
  Product ID: 0x520d
  Firmware:   20250121(230322)
  Model:      UG902_LPH2412_P10
=

Problem
-------
The device is not handled by= hid-uclogic. With hid-generic, the device
is re= gistered only as a mouse and no pen events (ABS_X, ABS_Y,
ABS_PRESSURE, ABS_TILT) are reported to userspace.

When I add the device ID to hid-uc= logic-core.c, the driver binds, but
the resultin= g interface is still a mouse. evtest shows no pen events.
This suggests the device is still in "firmware mode" and never ge= ts
switched into the vendor reporting mode that = exposes the pen interface.

Key observations from testing
-----------= ------------------
1. lsusb reports only one int= erface (bNumInterfaces =3D 1, interface 0,
 = ;  HID class, mouse). It has only two interrupt endpoints:
     - 0x81 (IN, 64 bytes)
     - 0x01 (OUT, 64 bytes)
   Note: There is NO endpoint 0x03, which is the e= ndpoint used by
   uclogic_ugee_v2_pro= be_endpoint in hid-uclogic-params.c. Any attempt
   to send magic bytes to 0x03 fails with "Invalid endpoint addr= ess".

2. Reading the= string descriptor at index 0x64 under LANGID 0x0409
   successfully returns a 14-byte binary blob (13 bytes of c= ontent).
   Raw HEX: 0e03289a78e60300f= f1fd8130100
   (Other indexes return n= ormal strings like the serial number and
 &= nbsp; "hanvon ugee Tech"). Reading index 0x64 does NOT switch the device.

3. Sending the UGEE v= 2 magic bytes (02 b0 04 00 00 00 00 00 00 00)
&n= bsp;  via SET_REPORT (Feature 0x02, Output 0x02, Feature 0x03) returns=
   success, but the device never re-e= numerates.

4. A vend= or-specific control request (bRequest 0xb0, wValue 0x0402)
   times out.

5. Note: Sending unexpected control transfers to this device= can cause
   the USB HID interface to= hang. It requires a complete power cycle
 =   (unplugging USB and power) to recover.
Request
-------
Could someone with access to the Xencelabs USB documen= tation, or
someone who has reverse-engineered th= e 520d, share the correct
sequence to switch thi= s device into vendor mode?

Specifically:
  - Is the 0x64 string= descriptor read the right trigger, or is a
&nbs= p;   specific control transfer required?
  - If a control transfer is needed, what is the correct bRequest,<= br>
    wValue, wIndex, and endpoint?=
  - Are there known quirks for this device= ?

If a capture from = the Windows driver is needed, I can provide one.
If you have any hints, I will be happy to prepare a proper patch
=
with hid-uclogic-params.c changes and re-test.
<= div dir=3D"auto">
I am attaching the text files = with:
  - lsusb -v output for 28bd:520d
=
  - the raw HID report descriptor (usbhid-dump= )
  - the string descriptor enumeration (sh= owing 0x64)
  - dmesg logs showing the bind= ing behavior.

Thank = you very much for your time.

Best regards,
Willows

--
------=_Part_406317_706363494.1792206126886-- ------=_Part_406316_1321745885.1792206126886 Content-Type: text/plain; charset=us-ascii; name=lsusb-v-520d.txt Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=lsusb-v-520d.txt Bus 004 Device 013: ID 28bd:520d XP-Pen Xencelabs Pen Display Negotiated speed: Full Speed (12Mbps) Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 [unknown] bDeviceSubClass 0 [unknown] bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x28bd XP-Pen idProduct 0x520d Xencelabs Pen Display bcdDevice 0.00 iManufacturer 1 hanvon ugee iProduct 2 Xencelabs Pen Display iSerial 3 XP317BV1003174 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0029 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xa0 (Bus Powered) Remote Wakeup MaxPower 100mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 0 [unknown] bInterfaceProtocol 0 iInterface 0 HID Device Descriptor: bLength 9 bDescriptorType 33 bcdHID 1.00 bCountryCode 0 Not supported bNumDescriptors 1 bDescriptorType 34 Report wDescriptorLength 143 Report Descriptors: ** UNAVAILABLE ** Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 1 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 10 Device Status: 0x0000 (Bus Powered) ------=_Part_406316_1321745885.1792206126886 Content-Type: text/plain; charset=UTF-8; name=string-descriptors.txt Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename=string-descriptors.txt Found device: Bus 4 Device 13 Supported LANGIDs: ['0x409'] --- LANGID 0x0409 --- Index 0x00 (4 bytes): '=D0=89' Index 0x01 (24 bytes): 'hanvon ugee' Index 0x02 (44 bytes): 'Xencelabs Pen Display' Index 0x03 (38 bytes): 'XP317BV1003174' Index 0x04 (36 bytes): 'UG902_LPH2412_P10' Index 0x05 (34 bytes): '20250121(230322)' Index 0x64 (14 bytes): '=E9=A8=A8\ue678\x03\u1fff=E1=8F=98\x01' RAW HEX: 0e03289a78e60300ff1fd8130100 Index 0x66 (34 bytes): 'hanvon ugee Tech' RAW HEX: 2203680061006e0076006f006e002000750067006500650020005400650063= 006800 Index 0x67 (8 bytes): '=E9=9A=B1=E3=90=B3=E3=90=B0' RAW HEX: 0803b19633343034 Index 0x68 (6 bytes): '=C4=82!' Index 0x69 (4 bytes): '\x02' Index 0x6e (10 bytes): '\u3000\x00\x00=E4=90=83' Index 0x83 (6 bytes): '=D0=81\u2000' ------=_Part_406316_1321745885.1792206126886 Content-Type: text/plain; charset=us-ascii; name=usbhid-dump-descriptor.txt Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=usbhid-dump-descriptor.txt 004:013:000:DESCRIPTOR 1792205225.769689 06 0A FF 09 01 A1 01 85 02 09 02 75 08 95 1F 15 00 26 FF 00 81 02 09 03 75 08 95 20 15 00 26 FF 00 91 02 C0 05 0D 09 02 A1 01 85 07 09 20 A1 00 09 42 09 44 09 45 09 46 09 3C 15 00 25 01 75 01 95 05 81 02 09 32 95 01 81 02 95 02 81 03 75 10 95 01 35 00 A4 05 01 09 30 65 13 55 0D 46 64 CC 26 50 57 81 02 09 31 46 A0 73 26 92 36 81 02 B4 09 30 45 00 26 FF 1F 81 42 09 3D 15 81 25 7F 75 08 95 01 81 02 09 3E 15 81 25 7F 81 02 C0 C0 ------=_Part_406316_1321745885.1792206126886 Content-Type: text/plain; charset=us-ascii; name=dmesg-binding.txt Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=dmesg-binding.txt [ 2.723183] hid-generic 0003:09DA:6406.0001: input,hidraw0: USB HID v1.11 Keyboard [A4tech A4tech KB] on usb-0000:00:14.0-3/input0 [ 2.778037] hid-generic 0003:09DA:6406.0002: input,hiddev96,hidraw1: USB HID v1.11 Device [A4tech A4tech KB] on usb-0000:00:14.0-3/input1 [ 3.016559] hid-generic 0003:23E5:A2F9.0003: hiddev97,hidraw2: USB HID v1.11 Device [Antelope Audio Zen Quadro SC] on usb-0000:00:14.0-4/input3 [ 3.030171] hid-generic 0003:2022:0522.0004: hiddev98,hidraw3: USB HID v1.10 Device [DINK_HID_DEVICE DINK_HID_DEVICE] on usb-0000:00:1a.0-1.2/input0 [ 3.408966] hid-generic 0003:0403:6030.0005: hidraw4: USB HID v1.11 Device [FTDI FT260] on usb-0000:00:1d.0-1.7.1/input0 [ 3.411009] hid-generic 0003:0403:6030.0006: hidraw5: USB HID v1.11 Device [FTDI FT260] on usb-0000:00:1d.0-1.7.1/input1 [ 671.015347] hid-generic 0005:046D:B036.0007: input,hidraw4: BLUETOOTH HID v0.06 Mouse [Pebble M350s] on ec:ed:04:94:96:15 [ 1662.091759] usb 4-1.8.3: New USB device found, idVendor=28bd, idProduct=520d, bcdDevice= 0.00 [ 1662.093419] input: hanvon ugee Xencelabs Pen Display as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000A/input/input21 [ 1662.093514] input: hanvon ugee Xencelabs Pen Display Stylus as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000A/input/input22 [ 1662.093729] hid-generic 0003:28BD:520D.000A: input,hiddev99,hidraw5: USB HID v1.00 Device [hanvon ugee Xencelabs Pen Display] on usb-0000:00:1d.0-1.8.3/input0 [ 1662.164066] input: hanvon ugee Xencelabs Pen Display Mouse as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000A/input/input23 [ 1662.164270] uclogic 0003:28BD:520D.000A: input,hidraw5: USB HID v1.00 Mouse [hanvon ugee Xencelabs Pen Display] on usb-0000:00:1d.0-1.8.3/input0 [ 1965.125557] input: hanvon ugee Xencelabs Pen Display Mouse as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000B/input/input24 [ 1965.125803] uclogic 0003:28BD:520D.000B: input,hidraw5: USB HID v1.00 Mouse [hanvon ugee Xencelabs Pen Display] on usb-0000:00:1d.0-1.8.3/input0 ------=_Part_406316_1321745885.1792206126886--