* [RFC] HID: uclogic: Add support for Xencelabs Pen Display (28bd:520d) and request for switch-to-vendor-mode sequence
@ 2026-10-17 3:02 willowswaving
0 siblings, 0 replies; only message in thread
From: willowswaving @ 2026-10-17 3:02 UTC (permalink / raw)
To: Linux Input
[-- Attachment #1.1: Type: text/plain, Size: 3131 bytes --]
Hello,
I would like to report a missing device support in the hid-uclogic
driver, and ask for guidance on how to properly add it.
Device information
------------------
Name: Xencelabs Pen Display
Vendor ID: 0x28bd (Hanvon Ugee / XP-Pen)
Product ID: 0x520d
Firmware: 20250121(230322)
Model: UG902_LPH2412_P10
Problem
-------
The device is not handled by hid-uclogic. With hid-generic, the device
is registered only as a mouse and no pen events (ABS_X, ABS_Y,
ABS_PRESSURE, ABS_TILT) are reported to userspace.
When I add the device ID to hid-uclogic-core.c, the driver binds, but
the resulting interface is still a mouse. evtest shows no pen events.
This suggests the device is still in "firmware mode" and never gets
switched into the vendor reporting mode that exposes the pen interface.
Key observations from testing
-----------------------------
1. lsusb reports only one interface (bNumInterfaces = 1, interface 0,
HID class, mouse). It has only two interrupt endpoints:
- 0x81 (IN, 64 bytes)
- 0x01 (OUT, 64 bytes)
Note: There is NO endpoint 0x03, which is the endpoint used by
uclogic_ugee_v2_probe_endpoint in hid-uclogic-params.c. Any attempt
to send magic bytes to 0x03 fails with "Invalid endpoint address".
2. Reading the string descriptor at index 0x64 under LANGID 0x0409
successfully returns a 14-byte binary blob (13 bytes of content).
Raw HEX: 0e03289a78e60300ff1fd8130100
(Other indexes return normal strings like the serial number and
"hanvon ugee Tech"). Reading index 0x64 does NOT switch the device.
3. Sending the UGEE v2 magic bytes (02 b0 04 00 00 00 00 00 00 00)
via SET_REPORT (Feature 0x02, Output 0x02, Feature 0x03) returns
success, but the device never re-enumerates.
4. A vendor-specific control request (bRequest 0xb0, wValue 0x0402)
times out.
5. Note: Sending unexpected control transfers to this device can cause
the USB HID interface to hang. It requires a complete power cycle
(unplugging USB and power) to recover.
Request
-------
Could someone with access to the Xencelabs USB documentation, or
someone who has reverse-engineered the 520d, share the correct
sequence to switch this device into vendor mode?
Specifically:
- Is the 0x64 string descriptor read the right trigger, or is a
specific control transfer required?
- If a control transfer is needed, what is the correct bRequest,
wValue, wIndex, and endpoint?
- Are there known quirks for this device?
If a capture from the Windows driver is needed, I can provide one.
If you have any hints, I will be happy to prepare a proper patch
with hid-uclogic-params.c changes and re-test.
I am attaching the text files with:
- lsusb -v output for 28bd:520d
- the raw HID report descriptor (usbhid-dump)
- the string descriptor enumeration (showing 0x64)
- dmesg logs showing the binding behavior.
Thank you very much for your time.
Best regards,
Willows
--
https://tuta.com/free-email
[-- Attachment #1.2: Type: text/html, Size: 5557 bytes --]
[-- Attachment #2: lsusb-v-520d.txt --]
[-- Type: text/plain, Size: 2435 bytes --]
Bus 004 Device 013: ID 28bd:520d XP-Pen Xencelabs Pen Display
Negotiated speed: Full Speed (12Mbps)
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 [unknown]
bDeviceSubClass 0 [unknown]
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x28bd XP-Pen
idProduct 0x520d Xencelabs Pen Display
bcdDevice 0.00
iManufacturer 1 hanvon ugee
iProduct 2 Xencelabs Pen Display
iSerial 3 XP317BV1003174
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0029
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 3 Human Interface Device
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 0
HID Device Descriptor:
bLength 9
bDescriptorType 33
bcdHID 1.00
bCountryCode 0 Not supported
bNumDescriptors 1
bDescriptorType 34 Report
wDescriptorLength 143
Report Descriptors:
** UNAVAILABLE **
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 1
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 10
Device Status: 0x0000
(Bus Powered)
[-- Attachment #3: string-descriptors.txt --]
[-- Type: text/plain, Size: 779 bytes --]
Found device: Bus 4 Device 13
Supported LANGIDs: ['0x409']
--- LANGID 0x0409 ---
Index 0x00 (4 bytes): 'Љ'
Index 0x01 (24 bytes): 'hanvon ugee'
Index 0x02 (44 bytes): 'Xencelabs Pen Display'
Index 0x03 (38 bytes): 'XP317BV1003174'
Index 0x04 (36 bytes): 'UG902_LPH2412_P10'
Index 0x05 (34 bytes): '20250121(230322)'
Index 0x64 (14 bytes): '騨\ue678\x03\u1fffᏘ\x01'
RAW HEX: 0e03289a78e60300ff1fd8130100
Index 0x66 (34 bytes): 'hanvon ugee Tech'
RAW HEX: 2203680061006e0076006f006e002000750067006500650020005400650063006800
Index 0x67 (8 bytes): '隱㐳㐰'
RAW HEX: 0803b19633343034
Index 0x68 (6 bytes): 'Ă!'
Index 0x69 (4 bytes): '\x02'
Index 0x6e (10 bytes): '\u3000\x00\x00䐃'
Index 0x83 (6 bytes): 'Ё\u2000'
[-- Attachment #4: usbhid-dump-descriptor.txt --]
[-- Type: text/plain, Size: 488 bytes --]
004:013:000:DESCRIPTOR 1792205225.769689
06 0A FF 09 01 A1 01 85 02 09 02 75 08 95 1F 15
00 26 FF 00 81 02 09 03 75 08 95 20 15 00 26 FF
00 91 02 C0 05 0D 09 02 A1 01 85 07 09 20 A1 00
09 42 09 44 09 45 09 46 09 3C 15 00 25 01 75 01
95 05 81 02 09 32 95 01 81 02 95 02 81 03 75 10
95 01 35 00 A4 05 01 09 30 65 13 55 0D 46 64 CC
26 50 57 81 02 09 31 46 A0 73 26 92 36 81 02 B4
09 30 45 00 26 FF 1F 81 42 09 3D 15 81 25 7F 75
08 95 01 81 02 09 3E 15 81 25 7F 81 02 C0 C0
[-- Attachment #5: dmesg-binding.txt --]
[-- Type: text/plain, Size: 2165 bytes --]
[ 2.723183] hid-generic 0003:09DA:6406.0001: input,hidraw0: USB HID v1.11 Keyboard [A4tech A4tech KB] on usb-0000:00:14.0-3/input0
[ 2.778037] hid-generic 0003:09DA:6406.0002: input,hiddev96,hidraw1: USB HID v1.11 Device [A4tech A4tech KB] on usb-0000:00:14.0-3/input1
[ 3.016559] hid-generic 0003:23E5:A2F9.0003: hiddev97,hidraw2: USB HID v1.11 Device [Antelope Audio Zen Quadro SC] on usb-0000:00:14.0-4/input3
[ 3.030171] hid-generic 0003:2022:0522.0004: hiddev98,hidraw3: USB HID v1.10 Device [DINK_HID_DEVICE DINK_HID_DEVICE] on usb-0000:00:1a.0-1.2/input0
[ 3.408966] hid-generic 0003:0403:6030.0005: hidraw4: USB HID v1.11 Device [FTDI FT260] on usb-0000:00:1d.0-1.7.1/input0
[ 3.411009] hid-generic 0003:0403:6030.0006: hidraw5: USB HID v1.11 Device [FTDI FT260] on usb-0000:00:1d.0-1.7.1/input1
[ 671.015347] hid-generic 0005:046D:B036.0007: input,hidraw4: BLUETOOTH HID v0.06 Mouse [Pebble M350s] on ec:ed:04:94:96:15
[ 1662.091759] usb 4-1.8.3: New USB device found, idVendor=28bd, idProduct=520d, bcdDevice= 0.00
[ 1662.093419] input: hanvon ugee Xencelabs Pen Display as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000A/input/input21
[ 1662.093514] input: hanvon ugee Xencelabs Pen Display Stylus as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000A/input/input22
[ 1662.093729] hid-generic 0003:28BD:520D.000A: input,hiddev99,hidraw5: USB HID v1.00 Device [hanvon ugee Xencelabs Pen Display] on usb-0000:00:1d.0-1.8.3/input0
[ 1662.164066] input: hanvon ugee Xencelabs Pen Display Mouse as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000A/input/input23
[ 1662.164270] uclogic 0003:28BD:520D.000A: input,hidraw5: USB HID v1.00 Mouse [hanvon ugee Xencelabs Pen Display] on usb-0000:00:1d.0-1.8.3/input0
[ 1965.125557] input: hanvon ugee Xencelabs Pen Display Mouse as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.8/4-1.8.3/4-1.8.3:1.0/0003:28BD:520D.000B/input/input24
[ 1965.125803] uclogic 0003:28BD:520D.000B: input,hidraw5: USB HID v1.00 Mouse [hanvon ugee Xencelabs Pen Display] on usb-0000:00:1d.0-1.8.3/input0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-17 3:09 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-17 3:02 [RFC] HID: uclogic: Add support for Xencelabs Pen Display (28bd:520d) and request for switch-to-vendor-mode sequence willowswaving
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox