Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-tracegrafted

Pull tracing fixes from Steven Rostedt:

 - Fix error output of boot instance creation failure

   Currently if a boot instance creation fails, instead of printing out
   the name of the instance that failed, it prints "(null)". That is
   because it prints "cur_str" that had already been processed by
   strsep(). Print the saved name instead.

   While at it, print the error code of the failure.

 - Fix use-after-free for same named historgrams

   Histograms can be named so that they can be used in multiple events.
   But if the named histogram has a variable attached, the second event
   that uses the named histogram which duplicates it and needs to free
   the original after duplication leaves the old variable in place and
   still visible. If another histogram uses than variable, it will use
   the stale one which will try to reference the freed duplicate
   histogram and crash the kernel.

   Free the duplicate variables along with the duplicated histogram
   data.

 - Check return value of kthread_run() in event self test

   The events self tests uses a kthread for testing but does not check
   if it succeeded in creating a kthread. If the kthread creation were
   to fail, the code will still try to call kthread_stop() on the error
   returned.

 - Fix race between reading trace_pipe and updating subbuffer size

   If a user is reading the trace_pipe file at the same time they update
   the ring buffer sub-buffer size, can cause the trace_pipe read to
   read stale data. Add trace_access_lock() around updating the ring
   buffer sub-buffer size.

 - Fix eventfs_inode on failure path in creation of the events directory

   In the creation of the "events" directory, if after allocating the
   eventfs_inode a failure is detected, it calls cleanup_ei() which
   calls free_ei(). The free_ei() will test if eventfs_inode being freed
   has no children. It is a bug if it does. But on the failure case of
   the creation of the "events" directory, the children lists have not
   yet been initialized and the free will trigger a warning because
   list_empty() on an uninitialized list returns false.

   Move the initialization into init_ei() where it makes more sense and
   makes sure that a created eventfs_inode has its lists initialized
   upon creation.

 - Check return value of kthread_run() in ftrace direct sample code

   The sample code that shows how to use the ftrace direct calls does
   not test the return of kthread_run() to see if it succeeds. Return a
   failure if the kthread_run() doesn't succeed.

 - Clear user events state on fork in case of alloc failure

   On fork, the child gets a pointer to the parent's user events state.
   It makes a copy of it then updates the child's pointer to it. But if
   the allocation fails, the duplication function leaves the child with
   a pointer to its parent's descriptor. When the child cleans up its
   data, it will free the parent's descriptor while the parent is still
   using it.

   In the duplication function, set the child's user_event_mm to NULL
   before testing if the allocation succeeded, and when it exits it will
   not free the parent's descriptor.

 - Fix retry exhaustion in simple ring buffer reader swap

   simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
   post-decrements it only after a failed link replacement. On the final
   attempt, a successful replacement leaves retry at zero, while a
   failed replacement leaves it at -1.

   But the check for success expects the retry value to be non-zero and
   exits with an error on zero. This is the opposite result. Fix it.

 - Fail nicely when the remote swap_reader_page() returns an error

   Currently, if the swap_reader_page() of a remote buffer fails, it
   triggers a WARN_ON_ONCE() and continues normally. Instead, have it
   exit with an error and a pr_warn() print instead of a full WARNING.

* tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Stop remote reader update when page swap fails
  tracing: Fix retry exhaustion in simple ring buffer reader swap
  tracing/user_events: Clear copied tracing state before fork duplication
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
  eventfs: Initialize ei->children and ei->list in init_ei()
  tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
  tracing: Fix crash passing ERR_PTR to kthread_stop()
  tracing: Fix use-after-free with same-name named triggers
  tracing: Fix logged instance name on creation failure

8 files changed, 3985 insertions, 0 deletions

diff --git a/drivers/input/tablet/Kconfig b/drivers/input/tablet/Kconfig
new file mode 100644
index 000000000..ec27eff6a
--- /dev/null
+++ b/drivers/input/tablet/Kconfig
@@ -0,0 +1,90 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Tablet driver configuration
+#
+menuconfig INPUT_TABLET
+	bool "Tablets"
+	help
+	  Say Y here, and a list of supported tablets will be displayed.
+	  This option doesn't affect the kernel.
+
+	  If unsure, say Y.
+
+if INPUT_TABLET
+
+config TABLET_USB_ACECAD
+	tristate "Acecad Flair tablet support (USB)"
+	depends on USB_ARCH_HAS_HCD
+	select USB
+	help
+	  Say Y here if you want to use the USB version of the Acecad Flair
+	  tablet.  Make sure to say Y to "Mouse support"
+	  (CONFIG_INPUT_MOUSEDEV) and/or "Event interface support"
+	  (CONFIG_INPUT_EVDEV) as well.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called acecad.
+
+config TABLET_USB_AIPTEK
+	tristate "Aiptek 6000U/8000U and Genius G_PEN tablet support (USB)"
+	depends on USB_ARCH_HAS_HCD
+	select USB
+	help
+	  Say Y here if you want to use the USB version of the Aiptek 6000U,
+	  Aiptek 8000U or Genius G-PEN 560 tablet.  Make sure to say Y to
+	  "Mouse support" (CONFIG_INPUT_MOUSEDEV) and/or "Event interface
+	  support" (CONFIG_INPUT_EVDEV) as well.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called aiptek.
+
+config TABLET_USB_HANWANG
+	tristate "Hanwang Art Master III tablet support (USB)"
+	depends on USB_ARCH_HAS_HCD
+	select USB
+	help
+	  Say Y here if you want to use the USB version of the Hanwang Art
+	  Master III tablet.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called hanwang.
+
+config TABLET_USB_KBTAB
+	tristate "KB Gear JamStudio tablet support (USB)"
+	depends on USB_ARCH_HAS_HCD
+	select USB
+	help
+	  Say Y here if you want to use the USB version of the KB Gear
+	  JamStudio tablet.  Make sure to say Y to "Mouse support"
+	  (CONFIG_INPUT_MOUSEDEV) and/or "Event interface support"
+	  (CONFIG_INPUT_EVDEV) as well.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called kbtab.
+
+config TABLET_USB_PEGASUS
+	tristate "Pegasus Mobile Notetaker Pen input tablet support"
+	depends on USB_ARCH_HAS_HCD
+	select USB
+	help
+	  Say Y here if you want to use the Pegasus Mobile Notetaker,
+	  also known as:
+	  Genie e-note The Notetaker,
+	  Staedtler Digital ballpoint pen 990 01,
+	  IRISnotes Express or
+	  NEWLink Digital Note Taker.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called pegasus_notetaker.
+
+config TABLET_SERIAL_WACOM4
+	tristate "Wacom protocol 4 serial tablet support"
+	select SERIO
+	help
+	  Say Y here if you want to use Wacom protocol 4 serial tablets.
+	  E.g. serial versions of the Cintiq, Graphire or Penpartner.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called wacom_serial4.
+
+endif
diff --git a/drivers/input/tablet/Makefile b/drivers/input/tablet/Makefile
new file mode 100644
index 000000000..adb636430
--- /dev/null
+++ b/drivers/input/tablet/Makefile
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# Makefile for the tablet drivers
+#
+
+
+obj-$(CONFIG_TABLET_USB_ACECAD)	+= acecad.o
+obj-$(CONFIG_TABLET_USB_AIPTEK)	+= aiptek.o
+obj-$(CONFIG_TABLET_USB_HANWANG) += hanwang.o
+obj-$(CONFIG_TABLET_USB_KBTAB)	+= kbtab.o
+obj-$(CONFIG_TABLET_USB_PEGASUS) += pegasus_notetaker.o
+obj-$(CONFIG_TABLET_SERIAL_WACOM4) += wacom_serial4.o
diff --git a/drivers/input/tablet/acecad.c b/drivers/input/tablet/acecad.c
new file mode 100644
index 000000000..ba79dff21
--- /dev/null
+++ b/drivers/input/tablet/acecad.c
@@ -0,0 +1,254 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  Copyright (c) 2001-2005 Edouard TISSERANT   <edouard.tisserant@wanadoo.fr>
+ *  Copyright (c) 2004-2005 Stephane VOLTZ      <svoltz@numericable.fr>
+ *
+ *  USB Acecad "Acecad Flair" tablet support
+ *
+ *  Changelog:
+ *      v3.2 - Added sysfs support
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/usb/input.h>
+
+MODULE_AUTHOR("Edouard TISSERANT <edouard.tisserant@wanadoo.fr>");
+MODULE_DESCRIPTION("USB Acecad Flair tablet driver");
+MODULE_LICENSE("GPL");
+
+#define USB_VENDOR_ID_ACECAD	0x0460
+#define USB_DEVICE_ID_FLAIR	0x0004
+#define USB_DEVICE_ID_302	0x0008
+
+struct usb_acecad {
+	char name[128];
+	char phys[64];
+	struct usb_interface *intf;
+	struct input_dev *input;
+	struct urb *irq;
+
+	unsigned char *data;
+	dma_addr_t data_dma;
+};
+
+static void usb_acecad_irq(struct urb *urb)
+{
+	struct usb_acecad *acecad = urb->context;
+	unsigned char *data = acecad->data;
+	struct input_dev *dev = acecad->input;
+	struct usb_interface *intf = acecad->intf;
+	struct usb_device *udev = interface_to_usbdev(intf);
+	int prox, status;
+
+	switch (urb->status) {
+	case 0:
+		/* success */
+		break;
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* this urb is terminated, clean up */
+		dev_dbg(&intf->dev, "%s - urb shutting down with status: %d\n",
+			__func__, urb->status);
+		return;
+	default:
+		dev_dbg(&intf->dev, "%s - nonzero urb status received: %d\n",
+			__func__, urb->status);
+		goto resubmit;
+	}
+
+	prox = (data[0] & 0x04) >> 2;
+	input_report_key(dev, BTN_TOOL_PEN, prox);
+
+	if (prox) {
+		int x = data[1] | (data[2] << 8);
+		int y = data[3] | (data[4] << 8);
+		/* Pressure should compute the same way for flair and 302 */
+		int pressure = data[5] | (data[6] << 8);
+		int touch = data[0] & 0x01;
+		int stylus = (data[0] & 0x10) >> 4;
+		int stylus2 = (data[0] & 0x20) >> 5;
+		input_report_abs(dev, ABS_X, x);
+		input_report_abs(dev, ABS_Y, y);
+		input_report_abs(dev, ABS_PRESSURE, pressure);
+		input_report_key(dev, BTN_TOUCH, touch);
+		input_report_key(dev, BTN_STYLUS, stylus);
+		input_report_key(dev, BTN_STYLUS2, stylus2);
+	}
+
+	/* event termination */
+	input_sync(dev);
+
+resubmit:
+	status = usb_submit_urb(urb, GFP_ATOMIC);
+	if (status)
+		dev_err(&intf->dev,
+			"can't resubmit intr, %s-%s/input0, status %d\n",
+			udev->bus->bus_name,
+			udev->devpath, status);
+}
+
+static int usb_acecad_open(struct input_dev *dev)
+{
+	struct usb_acecad *acecad = input_get_drvdata(dev);
+
+	acecad->irq->dev = interface_to_usbdev(acecad->intf);
+	if (usb_submit_urb(acecad->irq, GFP_KERNEL))
+		return -EIO;
+
+	return 0;
+}
+
+static void usb_acecad_close(struct input_dev *dev)
+{
+	struct usb_acecad *acecad = input_get_drvdata(dev);
+
+	usb_kill_urb(acecad->irq);
+}
+
+static int usb_acecad_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct usb_host_interface *interface = intf->cur_altsetting;
+	struct usb_endpoint_descriptor *endpoint;
+	struct usb_acecad *acecad;
+	struct input_dev *input_dev;
+	int pipe, maxp;
+	int err;
+
+	if (interface->desc.bNumEndpoints != 1)
+		return -ENODEV;
+
+	endpoint = &interface->endpoint[0].desc;
+
+	if (!usb_endpoint_is_int_in(endpoint))
+		return -ENODEV;
+
+	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
+	maxp = usb_maxpacket(dev, pipe);
+
+	acecad = kzalloc_obj(*acecad);
+	input_dev = input_allocate_device();
+	if (!acecad || !input_dev) {
+		err = -ENOMEM;
+		goto fail1;
+	}
+
+	acecad->data = usb_alloc_coherent(dev, 8, GFP_KERNEL, &acecad->data_dma);
+	if (!acecad->data) {
+		err= -ENOMEM;
+		goto fail1;
+	}
+
+	acecad->irq = usb_alloc_urb(0, GFP_KERNEL);
+	if (!acecad->irq) {
+		err = -ENOMEM;
+		goto fail2;
+	}
+
+	acecad->intf = intf;
+	acecad->input = input_dev;
+
+	if (dev->manufacturer)
+		strscpy(acecad->name, dev->manufacturer, sizeof(acecad->name));
+
+	if (dev->product) {
+		if (dev->manufacturer)
+			strlcat(acecad->name, " ", sizeof(acecad->name));
+		strlcat(acecad->name, dev->product, sizeof(acecad->name));
+	}
+
+	usb_make_path(dev, acecad->phys, sizeof(acecad->phys));
+	strlcat(acecad->phys, "/input0", sizeof(acecad->phys));
+
+	input_dev->name = acecad->name;
+	input_dev->phys = acecad->phys;
+	usb_to_input_id(dev, &input_dev->id);
+	input_dev->dev.parent = &intf->dev;
+
+	input_set_drvdata(input_dev, acecad);
+
+	input_dev->open = usb_acecad_open;
+	input_dev->close = usb_acecad_close;
+
+	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+	input_dev->keybit[BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_TOOL_PEN) |
+		BIT_MASK(BTN_TOUCH) | BIT_MASK(BTN_STYLUS) |
+		BIT_MASK(BTN_STYLUS2);
+
+	switch (id->driver_info) {
+	case 0:
+		input_set_abs_params(input_dev, ABS_X, 0, 5000, 4, 0);
+		input_set_abs_params(input_dev, ABS_Y, 0, 3750, 4, 0);
+		input_set_abs_params(input_dev, ABS_PRESSURE, 0, 512, 0, 0);
+		if (!strlen(acecad->name))
+			snprintf(acecad->name, sizeof(acecad->name),
+				"USB Acecad Flair Tablet %04x:%04x",
+				le16_to_cpu(dev->descriptor.idVendor),
+				le16_to_cpu(dev->descriptor.idProduct));
+		break;
+
+	case 1:
+		input_set_abs_params(input_dev, ABS_X, 0, 53000, 4, 0);
+		input_set_abs_params(input_dev, ABS_Y, 0, 2250, 4, 0);
+		input_set_abs_params(input_dev, ABS_PRESSURE, 0, 1024, 0, 0);
+		if (!strlen(acecad->name))
+			snprintf(acecad->name, sizeof(acecad->name),
+				"USB Acecad 302 Tablet %04x:%04x",
+				le16_to_cpu(dev->descriptor.idVendor),
+				le16_to_cpu(dev->descriptor.idProduct));
+		break;
+	}
+
+	usb_fill_int_urb(acecad->irq, dev, pipe,
+			acecad->data, maxp > 8 ? 8 : maxp,
+			usb_acecad_irq, acecad, endpoint->bInterval);
+	acecad->irq->transfer_dma = acecad->data_dma;
+	acecad->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+	err = input_register_device(acecad->input);
+	if (err)
+		goto fail3;
+
+	usb_set_intfdata(intf, acecad);
+
+	return 0;
+
+ fail3:	usb_free_urb(acecad->irq);
+ fail2:	usb_free_coherent(dev, 8, acecad->data, acecad->data_dma);
+ fail1: input_free_device(input_dev);
+	kfree(acecad);
+	return err;
+}
+
+static void usb_acecad_disconnect(struct usb_interface *intf)
+{
+	struct usb_acecad *acecad = usb_get_intfdata(intf);
+	struct usb_device *udev = interface_to_usbdev(intf);
+
+	usb_set_intfdata(intf, NULL);
+
+	input_unregister_device(acecad->input);
+	usb_free_urb(acecad->irq);
+	usb_free_coherent(udev, 8, acecad->data, acecad->data_dma);
+	kfree(acecad);
+}
+
+static const struct usb_device_id usb_acecad_id_table[] = {
+	{ USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_FLAIR), .driver_info = 0 },
+	{ USB_DEVICE(USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_302),	 .driver_info = 1 },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(usb, usb_acecad_id_table);
+
+static struct usb_driver usb_acecad_driver = {
+	.name =		"usb_acecad",
+	.probe =	usb_acecad_probe,
+	.disconnect =	usb_acecad_disconnect,
+	.id_table =	usb_acecad_id_table,
+};
+
+module_usb_driver(usb_acecad_driver);
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
new file mode 100644
index 000000000..0c1acb9e6
--- /dev/null
+++ b/drivers/input/tablet/aiptek.c
@@ -0,0 +1,1875 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  Native support for the Aiptek HyperPen USB Tablets
+ *  (4000U/5000U/6000U/8000U/12000U)
+ *
+ *  Copyright (c) 2001      Chris Atenasio   <chris@crud.net>
+ *  Copyright (c) 2002-2004 Bryan W. Headley <bwheadley@earthlink.net>
+ *
+ *  based on wacom.c by
+ *     Vojtech Pavlik      <vojtech@suse.cz>
+ *     Andreas Bach Aaen   <abach@stofanet.dk>
+ *     Clifford Wolf       <clifford@clifford.at>
+ *     Sam Mosel           <sam.mosel@computer.org>
+ *     James E. Blair      <corvus@gnu.org>
+ *     Daniel Egger        <egger@suse.de>
+ *
+ *  Many thanks to Oliver Kuechemann for his support.
+ *
+ * NOTE:
+ *      This kernel driver is augmented by the "Aiptek" XFree86 input
+ *      driver for your X server, as well as the Gaiptek GUI Front-end
+ *      "Tablet Manager".
+ *      These three products are highly interactive with one another,
+ *      so therefore it's easier to document them all as one subsystem.
+ *      Please visit the project's "home page", located at,
+ *      http://aiptektablet.sourceforge.net.
+ */
+
+#include <linux/hid.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/usb/input.h>
+#include <linux/uaccess.h>
+#include <linux/unaligned.h>
+
+/*
+ * Aiptek status packet:
+ *
+ * (returned as Report 1 - relative coordinates from mouse and stylus)
+ *
+ *        bit7  bit6  bit5  bit4  bit3  bit2  bit1  bit0
+ * byte0   0     0     0     0     0     0     0     1
+ * byte1   0     0     0     0     0    BS2   BS    Tip
+ * byte2  X7    X6    X5    X4    X3    X2    X1    X0
+ * byte3  Y7    Y6    Y5    Y4    Y3    Y2    Y1    Y0
+ *
+ * (returned as Report 2 - absolute coordinates from the stylus)
+ *
+ *        bit7  bit6  bit5  bit4  bit3  bit2  bit1  bit0
+ * byte0   0     0     0     0     0     0     1     0
+ * byte1  X7    X6    X5    X4    X3    X2    X1    X0
+ * byte2  X15   X14   X13   X12   X11   X10   X9    X8
+ * byte3  Y7    Y6    Y5    Y4    Y3    Y2    Y1    Y0
+ * byte4  Y15   Y14   Y13   Y12   Y11   Y10   Y9    Y8
+ * byte5   *     *     *    BS2   BS1   Tip   IR    DV
+ * byte6  P7    P6    P5    P4    P3    P2    P1    P0
+ * byte7  P15   P14   P13   P12   P11   P10   P9    P8
+ *
+ * (returned as Report 3 - absolute coordinates from the mouse)
+ *
+ *        bit7  bit6  bit5  bit4  bit3  bit2  bit1  bit0
+ * byte0   0     0     0     0     0     0     1     1
+ * byte1  X7    X6    X5    X4    X3    X2    X1    X0
+ * byte2  X15   X14   X13   X12   X11   X10   X9    X8
+ * byte3  Y7    Y6    Y5    Y4    Y3    Y2    Y1    Y0
+ * byte4  Y15   Y14   Y13   Y12   Y11   Y10   Y9    Y8
+ * byte5   *     *     *    BS2   BS1   Tip   IR    DV
+ * byte6  P7    P6    P5    P4    P3    P2    P1    P0
+ * byte7  P15   P14   P13   P12   P11   P10   P9    P8
+ *
+ * (returned as Report 4 - macrokeys from the stylus)
+ *
+ *        bit7  bit6  bit5  bit4  bit3  bit2  bit1  bit0
+ * byte0   0     0     0     0     0     1     0     0
+ * byte1   0     0     0    BS2   BS    Tip   IR    DV
+ * byte2   0     0     0     0     0     0     1     0
+ * byte3   0     0     0    K4    K3    K2    K1    K0
+ * byte4  P7    P6    P5    P4    P3    P2    P1    P0
+ * byte5  P15   P14   P13   P12   P11   P10   P9    P8
+ *
+ * (returned as Report 5 - macrokeys from the mouse)
+ *
+ *        bit7  bit6  bit5  bit4  bit3  bit2  bit1  bit0
+ * byte0   0     0     0     0     0     1     0     1
+ * byte1   0     0     0    BS2   BS    Tip   IR    DV
+ * byte2   0     0     0     0     0     0     1     0
+ * byte3   0     0     0    K4    K3    K2    K1    K0
+ * byte4  P7    P6    P5    P4    P3    P2    P1    P0
+ * byte5  P15   P14   P13   P12   P11   P10   P9    P8
+ *
+ * IR: In Range = Proximity on
+ * DV = Data Valid
+ * BS = Barrel Switch (as in, macro keys)
+ * BS2 also referred to as Tablet Pick
+ *
+ * Command Summary:
+ *
+ * Use report_type CONTROL (3)
+ * Use report_id   2
+ *
+ * Command/Data    Description     Return Bytes    Return Value
+ * 0x10/0x00       SwitchToMouse       0
+ * 0x10/0x01       SwitchToTablet      0
+ * 0x18/0x04       SetResolution       0
+ * 0x12/0xFF       AutoGainOn          0
+ * 0x17/0x00       FilterOn            0
+ * 0x01/0x00       GetXExtension       2           MaxX
+ * 0x01/0x01       GetYExtension       2           MaxY
+ * 0x02/0x00       GetModelCode        2           ModelCode = LOBYTE
+ * 0x03/0x00       GetODMCode          2           ODMCode
+ * 0x08/0x00       GetPressureLevels   2           =512
+ * 0x04/0x00       GetFirmwareVersion  2           Firmware Version
+ * 0x11/0x02       EnableMacroKeys     0
+ *
+ * To initialize the tablet:
+ *
+ * (1) Send Resolution500LPI (Command)
+ * (2) Query for Model code (Option Report)
+ * (3) Query for ODM code (Option Report)
+ * (4) Query for firmware (Option Report)
+ * (5) Query for GetXExtension (Option Report)
+ * (6) Query for GetYExtension (Option Report)
+ * (7) Query for GetPressureLevels (Option Report)
+ * (8) SwitchToTablet for Absolute coordinates, or
+ *     SwitchToMouse for Relative coordinates (Command)
+ * (9) EnableMacroKeys (Command)
+ * (10) FilterOn (Command)
+ * (11) AutoGainOn (Command)
+ *
+ * (Step 9 can be omitted, but you'll then have no function keys.)
+ */
+
+#define USB_VENDOR_ID_AIPTEK				0x08ca
+#define USB_VENDOR_ID_KYE				0x0458
+
+	/* PointerMode codes
+	 */
+#define AIPTEK_POINTER_ONLY_MOUSE_MODE			0
+#define AIPTEK_POINTER_ONLY_STYLUS_MODE			1
+#define AIPTEK_POINTER_EITHER_MODE			2
+
+#define AIPTEK_POINTER_ALLOW_MOUSE_MODE(a)		\
+	(a == AIPTEK_POINTER_ONLY_MOUSE_MODE ||		\
+	 a == AIPTEK_POINTER_EITHER_MODE)
+#define AIPTEK_POINTER_ALLOW_STYLUS_MODE(a)		\
+	(a == AIPTEK_POINTER_ONLY_STYLUS_MODE ||	\
+	 a == AIPTEK_POINTER_EITHER_MODE)
+
+	/* CoordinateMode code
+	 */
+#define AIPTEK_COORDINATE_RELATIVE_MODE			0
+#define AIPTEK_COORDINATE_ABSOLUTE_MODE			1
+
+       /* XTilt and YTilt values
+        */
+#define AIPTEK_TILT_MIN					(-128)
+#define AIPTEK_TILT_MAX					127
+#define AIPTEK_TILT_DISABLE				(-10101)
+
+	/* Wheel values
+	 */
+#define AIPTEK_WHEEL_MIN				0
+#define AIPTEK_WHEEL_MAX				1024
+#define AIPTEK_WHEEL_DISABLE				(-10101)
+
+	/* ToolCode values, which BTW are 0x140 .. 0x14f
+	 * We have things set up such that if the tool button has changed,
+	 * the tools get reset.
+	 */
+	/* toolMode codes
+	 */
+#define AIPTEK_TOOL_BUTTON_PEN_MODE			BTN_TOOL_PEN
+#define AIPTEK_TOOL_BUTTON_PENCIL_MODE			BTN_TOOL_PENCIL
+#define AIPTEK_TOOL_BUTTON_BRUSH_MODE			BTN_TOOL_BRUSH
+#define AIPTEK_TOOL_BUTTON_AIRBRUSH_MODE		BTN_TOOL_AIRBRUSH
+#define AIPTEK_TOOL_BUTTON_ERASER_MODE			BTN_TOOL_RUBBER
+#define AIPTEK_TOOL_BUTTON_MOUSE_MODE			BTN_TOOL_MOUSE
+#define AIPTEK_TOOL_BUTTON_LENS_MODE			BTN_TOOL_LENS
+
+	/* Diagnostic message codes
+	 */
+#define AIPTEK_DIAGNOSTIC_NA				0
+#define AIPTEK_DIAGNOSTIC_SENDING_RELATIVE_IN_ABSOLUTE	1
+#define AIPTEK_DIAGNOSTIC_SENDING_ABSOLUTE_IN_RELATIVE	2
+#define AIPTEK_DIAGNOSTIC_TOOL_DISALLOWED		3
+
+	/* Time to wait (in ms) to help mask hand jittering
+	 * when pressing the stylus buttons.
+	 */
+#define AIPTEK_JITTER_DELAY_DEFAULT			50
+
+	/* Time to wait (in ms) in-between sending the tablet
+	 * a command and beginning the process of reading the return
+	 * sequence from the tablet.
+	 */
+#define AIPTEK_PROGRAMMABLE_DELAY_25		25
+#define AIPTEK_PROGRAMMABLE_DELAY_50		50
+#define AIPTEK_PROGRAMMABLE_DELAY_100		100
+#define AIPTEK_PROGRAMMABLE_DELAY_200		200
+#define AIPTEK_PROGRAMMABLE_DELAY_300		300
+#define AIPTEK_PROGRAMMABLE_DELAY_400		400
+#define AIPTEK_PROGRAMMABLE_DELAY_DEFAULT	AIPTEK_PROGRAMMABLE_DELAY_400
+
+	/* Mouse button programming
+	 */
+#define AIPTEK_MOUSE_LEFT_BUTTON		0x04
+#define AIPTEK_MOUSE_RIGHT_BUTTON		0x08
+#define AIPTEK_MOUSE_MIDDLE_BUTTON		0x10
+
+	/* Stylus button programming
+	 */
+#define AIPTEK_STYLUS_LOWER_BUTTON		0x08
+#define AIPTEK_STYLUS_UPPER_BUTTON		0x10
+
+	/* Length of incoming packet from the tablet
+	 */
+#define AIPTEK_PACKET_LENGTH			8
+
+	/* We report in EV_MISC both the proximity and
+	 * whether the report came from the stylus, tablet mouse
+	 * or "unknown" -- Unknown when the tablet is in relative
+	 * mode, because we only get report 1's.
+	 */
+#define AIPTEK_REPORT_TOOL_UNKNOWN		0x10
+#define AIPTEK_REPORT_TOOL_STYLUS		0x20
+#define AIPTEK_REPORT_TOOL_MOUSE		0x40
+
+static int programmableDelay = AIPTEK_PROGRAMMABLE_DELAY_DEFAULT;
+static int jitterDelay = AIPTEK_JITTER_DELAY_DEFAULT;
+
+struct aiptek_features {
+	int odmCode;		/* Tablet manufacturer code       */
+	int modelCode;		/* Tablet model code (not unique) */
+	int firmwareCode;	/* prom/eeprom version            */
+	char usbPath[64 + 1];	/* device's physical usb path     */
+};
+
+struct aiptek_settings {
+	int pointerMode;	/* stylus-, mouse-only or either */
+	int coordinateMode;	/* absolute/relative coords      */
+	int toolMode;		/* pen, pencil, brush, etc. tool */
+	int xTilt;		/* synthetic xTilt amount        */
+	int yTilt;		/* synthetic yTilt amount        */
+	int wheel;		/* synthetic wheel amount        */
+	int stylusButtonUpper;	/* stylus upper btn delivers...  */
+	int stylusButtonLower;	/* stylus lower btn delivers...  */
+	int mouseButtonLeft;	/* mouse left btn delivers...    */
+	int mouseButtonMiddle;	/* mouse middle btn delivers...  */
+	int mouseButtonRight;	/* mouse right btn delivers...   */
+	int programmableDelay;	/* delay for tablet programming  */
+	int jitterDelay;	/* delay for hand jittering      */
+};
+
+struct aiptek {
+	struct input_dev *inputdev;		/* input device struct           */
+	struct usb_interface *intf;		/* usb interface struct          */
+	struct urb *urb;			/* urb for incoming reports      */
+	dma_addr_t data_dma;			/* our dma stuffage              */
+	struct aiptek_features features;	/* tablet's array of features    */
+	struct aiptek_settings curSetting;	/* tablet's current programmable */
+	struct aiptek_settings newSetting;	/* ... and new param settings    */
+	unsigned int ifnum;			/* interface number for IO       */
+	int diagnostic;				/* tablet diagnostic codes       */
+	unsigned long eventCount;		/* event count                   */
+	int inDelay;				/* jitter: in jitter delay?      */
+	unsigned long endDelay;			/* jitter: time when delay ends  */
+	int previousJitterable;			/* jitterable prev value     */
+
+	int lastMacro;				/* macro key to reset            */
+	int previousToolMode;			/* pen, pencil, brush, etc. tool */
+	unsigned char *data;			/* incoming packet data          */
+};
+
+static const int eventTypes[] = {
+        EV_KEY, EV_ABS, EV_REL, EV_MSC,
+};
+
+static const int absEvents[] = {
+        ABS_X, ABS_Y, ABS_PRESSURE, ABS_TILT_X, ABS_TILT_Y,
+        ABS_WHEEL, ABS_MISC,
+};
+
+static const int relEvents[] = {
+        REL_X, REL_Y, REL_WHEEL,
+};
+
+static const int buttonEvents[] = {
+	BTN_LEFT, BTN_RIGHT, BTN_MIDDLE,
+	BTN_TOOL_PEN, BTN_TOOL_RUBBER, BTN_TOOL_PENCIL, BTN_TOOL_AIRBRUSH,
+	BTN_TOOL_BRUSH, BTN_TOOL_MOUSE, BTN_TOOL_LENS, BTN_TOUCH,
+	BTN_STYLUS, BTN_STYLUS2,
+};
+
+/*
+ * Permit easy lookup of keyboard events to send, versus
+ * the bitmap which comes from the tablet. This hides the
+ * issue that the F_keys are not sequentially numbered.
+ */
+static const int macroKeyEvents[] = {
+	KEY_ESC, KEY_F1, KEY_F2, KEY_F3, KEY_F4, KEY_F5,
+	KEY_F6, KEY_F7, KEY_F8, KEY_F9, KEY_F10, KEY_F11,
+	KEY_F12, KEY_F13, KEY_F14, KEY_F15, KEY_F16, KEY_F17,
+	KEY_F18, KEY_F19, KEY_F20, KEY_F21, KEY_F22, KEY_F23,
+	KEY_F24, KEY_STOP, KEY_AGAIN, KEY_PROPS, KEY_UNDO,
+	KEY_FRONT, KEY_COPY, KEY_OPEN, KEY_PASTE, 0
+};
+
+/***********************************************************************
+ * Map values to strings and back. Every map should have the following
+ * as its last element: { NULL, AIPTEK_INVALID_VALUE }.
+ */
+#define AIPTEK_INVALID_VALUE	-1
+
+struct aiptek_map {
+	const char *string;
+	int value;
+};
+
+static int map_str_to_val(const struct aiptek_map *map, const char *str, size_t count)
+{
+	const struct aiptek_map *p;
+
+	if (str[count - 1] == '\n')
+		count--;
+
+	for (p = map; p->string; p++)
+	        if (!strncmp(str, p->string, count))
+			return p->value;
+
+	return AIPTEK_INVALID_VALUE;
+}
+
+static const char *map_val_to_str(const struct aiptek_map *map, int val)
+{
+	const struct aiptek_map *p;
+
+	for (p = map; p->value != AIPTEK_INVALID_VALUE; p++)
+		if (val == p->value)
+			return p->string;
+
+	return "unknown";
+}
+
+/***********************************************************************
+ * aiptek_irq can receive one of six potential reports.
+ * The documentation for each is in the body of the function.
+ *
+ * The tablet reports on several attributes per invocation of
+ * aiptek_irq. Because the Linux Input Event system allows the
+ * transmission of ONE attribute per input_report_xxx() call,
+ * collation has to be done on the other end to reconstitute
+ * a complete tablet report. Further, the number of Input Event reports
+ * submitted varies, depending on what USB report type, and circumstance.
+ * To deal with this, EV_MSC is used to indicate an 'end-of-report'
+ * message. This has been an undocumented convention understood by the kernel
+ * tablet driver and clients such as gpm and XFree86's tablet drivers.
+ *
+ * Of the information received from the tablet, the one piece I
+ * cannot transmit is the proximity bit (without resorting to an EV_MSC
+ * convention above.) I therefore have taken over REL_MISC and ABS_MISC
+ * (for relative and absolute reports, respectively) for communicating
+ * Proximity. Why two events? I thought it interesting to know if the
+ * Proximity event occurred while the tablet was in absolute or relative
+ * mode.
+ * Update: REL_MISC proved not to be such a good idea. With REL_MISC you
+ * get an event transmitted each time. ABS_MISC works better, since it
+ * can be set and re-set. Thus, only using ABS_MISC from now on.
+ *
+ * Other tablets use the notion of a certain minimum stylus pressure
+ * to infer proximity. While that could have been done, that is yet
+ * another 'by convention' behavior, the documentation for which
+ * would be spread between two (or more) pieces of software.
+ *
+ * EV_MSC usage was terminated for this purpose in Linux 2.5.x, and
+ * replaced with the input_sync() method (which emits EV_SYN.)
+ */
+
+static void aiptek_irq(struct urb *urb)
+{
+	struct aiptek *aiptek = urb->context;
+	unsigned char *data = aiptek->data;
+	struct input_dev *inputdev = aiptek->inputdev;
+	struct usb_interface *intf = aiptek->intf;
+	int jitterable = 0;
+	int retval, macro, x, y, z, left, right, middle, p, dv, tip, bs, pck;
+
+	switch (urb->status) {
+	case 0:
+		/* Success */
+		break;
+
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* This urb is terminated, clean up */
+		dev_dbg(&intf->dev, "%s - urb shutting down with status: %d\n",
+			__func__, urb->status);
+		return;
+
+	default:
+		dev_dbg(&intf->dev, "%s - nonzero urb status received: %d\n",
+			__func__, urb->status);
+		goto exit;
+	}
+
+	/* See if we are in a delay loop -- throw out report if true.
+	 */
+	if (aiptek->inDelay == 1 && time_after(aiptek->endDelay, jiffies)) {
+		goto exit;
+	}
+
+	aiptek->inDelay = 0;
+	aiptek->eventCount++;
+
+	/* Report 1 delivers relative coordinates with either a stylus
+	 * or the mouse. You do not know, however, which input
+	 * tool generated the event.
+	 */
+	if (data[0] == 1) {
+		if (aiptek->curSetting.coordinateMode ==
+		    AIPTEK_COORDINATE_ABSOLUTE_MODE) {
+			aiptek->diagnostic =
+			    AIPTEK_DIAGNOSTIC_SENDING_RELATIVE_IN_ABSOLUTE;
+		} else {
+			x = (signed char) data[2];
+			y = (signed char) data[3];
+
+			/* jitterable keeps track of whether any button has been pressed.
+			 * We're also using it to remap the physical mouse button mask
+			 * to pseudo-settings. (We don't specifically care about it's
+			 * value after moving/transposing mouse button bitmasks, except
+			 * that a non-zero value indicates that one or more
+			 * mouse button was pressed.)
+			 */
+			jitterable = data[1] & 0x07;
+
+			left = (data[1] & aiptek->curSetting.mouseButtonLeft >> 2) != 0 ? 1 : 0;
+			right = (data[1] & aiptek->curSetting.mouseButtonRight >> 2) != 0 ? 1 : 0;
+			middle = (data[1] & aiptek->curSetting.mouseButtonMiddle >> 2) != 0 ? 1 : 0;
+
+			input_report_key(inputdev, BTN_LEFT, left);
+			input_report_key(inputdev, BTN_MIDDLE, middle);
+			input_report_key(inputdev, BTN_RIGHT, right);
+
+			input_report_abs(inputdev, ABS_MISC,
+					 1 | AIPTEK_REPORT_TOOL_UNKNOWN);
+			input_report_rel(inputdev, REL_X, x);
+			input_report_rel(inputdev, REL_Y, y);
+
+			/* Wheel support is in the form of a single-event
+			 * firing.
+			 */
+			if (aiptek->curSetting.wheel != AIPTEK_WHEEL_DISABLE) {
+				input_report_rel(inputdev, REL_WHEEL,
+						 aiptek->curSetting.wheel);
+				aiptek->curSetting.wheel = AIPTEK_WHEEL_DISABLE;
+			}
+			if (aiptek->lastMacro != -1) {
+			        input_report_key(inputdev,
+						 macroKeyEvents[aiptek->lastMacro], 0);
+				aiptek->lastMacro = -1;
+			}
+			input_sync(inputdev);
+		}
+	}
+	/* Report 2 is delivered only by the stylus, and delivers
+	 * absolute coordinates.
+	 */
+	else if (data[0] == 2) {
+		if (aiptek->curSetting.coordinateMode == AIPTEK_COORDINATE_RELATIVE_MODE) {
+			aiptek->diagnostic = AIPTEK_DIAGNOSTIC_SENDING_ABSOLUTE_IN_RELATIVE;
+		} else if (!AIPTEK_POINTER_ALLOW_STYLUS_MODE
+			    (aiptek->curSetting.pointerMode)) {
+				aiptek->diagnostic = AIPTEK_DIAGNOSTIC_TOOL_DISALLOWED;
+		} else {
+			x = get_unaligned_le16(data + 1);
+			y = get_unaligned_le16(data + 3);
+			z = get_unaligned_le16(data + 6);
+
+			dv = (data[5] & 0x01) != 0 ? 1 : 0;
+			p = (data[5] & 0x02) != 0 ? 1 : 0;
+			tip = (data[5] & 0x04) != 0 ? 1 : 0;
+
+			/* Use jitterable to re-arrange button masks
+			 */
+			jitterable = data[5] & 0x18;
+
+			bs = (data[5] & aiptek->curSetting.stylusButtonLower) != 0 ? 1 : 0;
+			pck = (data[5] & aiptek->curSetting.stylusButtonUpper) != 0 ? 1 : 0;
+
+			/* dv indicates 'data valid' (e.g., the tablet is in sync
+			 * and has delivered a "correct" report) We will ignore
+			 * all 'bad' reports...
+			 */
+			if (dv != 0) {
+				/* If the selected tool changed, reset the old
+				 * tool key, and set the new one.
+				 */
+				if (aiptek->previousToolMode !=
+				    aiptek->curSetting.toolMode) {
+				        input_report_key(inputdev,
+							 aiptek->previousToolMode, 0);
+					input_report_key(inputdev,
+							 aiptek->curSetting.toolMode,
+							 1);
+					aiptek->previousToolMode =
+					          aiptek->curSetting.toolMode;
+				}
+
+				if (p != 0) {
+					input_report_abs(inputdev, ABS_X, x);
+					input_report_abs(inputdev, ABS_Y, y);
+					input_report_abs(inputdev, ABS_PRESSURE, z);
+
+					input_report_key(inputdev, BTN_TOUCH, tip);
+					input_report_key(inputdev, BTN_STYLUS, bs);
+					input_report_key(inputdev, BTN_STYLUS2, pck);
+
+					if (aiptek->curSetting.xTilt !=
+					    AIPTEK_TILT_DISABLE) {
+						input_report_abs(inputdev,
+								 ABS_TILT_X,
+								 aiptek->curSetting.xTilt);
+					}
+					if (aiptek->curSetting.yTilt != AIPTEK_TILT_DISABLE) {
+						input_report_abs(inputdev,
+								 ABS_TILT_Y,
+								 aiptek->curSetting.yTilt);
+					}
+
+					/* Wheel support is in the form of a single-event
+					 * firing.
+					 */
+					if (aiptek->curSetting.wheel !=
+					    AIPTEK_WHEEL_DISABLE) {
+						input_report_abs(inputdev,
+								 ABS_WHEEL,
+								 aiptek->curSetting.wheel);
+						aiptek->curSetting.wheel = AIPTEK_WHEEL_DISABLE;
+					}
+				}
+				input_report_abs(inputdev, ABS_MISC, p | AIPTEK_REPORT_TOOL_STYLUS);
+				if (aiptek->lastMacro != -1) {
+			                input_report_key(inputdev,
+							 macroKeyEvents[aiptek->lastMacro], 0);
+					aiptek->lastMacro = -1;
+				}
+				input_sync(inputdev);
+			}
+		}
+	}
+	/* Report 3's come from the mouse in absolute mode.
+	 */
+	else if (data[0] == 3) {
+		if (aiptek->curSetting.coordinateMode == AIPTEK_COORDINATE_RELATIVE_MODE) {
+			aiptek->diagnostic = AIPTEK_DIAGNOSTIC_SENDING_ABSOLUTE_IN_RELATIVE;
+		} else if (!AIPTEK_POINTER_ALLOW_MOUSE_MODE
+			(aiptek->curSetting.pointerMode)) {
+			aiptek->diagnostic = AIPTEK_DIAGNOSTIC_TOOL_DISALLOWED;
+		} else {
+			x = get_unaligned_le16(data + 1);
+			y = get_unaligned_le16(data + 3);
+
+			jitterable = data[5] & 0x1c;
+
+			dv = (data[5] & 0x01) != 0 ? 1 : 0;
+			p = (data[5] & 0x02) != 0 ? 1 : 0;
+			left = (data[5] & aiptek->curSetting.mouseButtonLeft) != 0 ? 1 : 0;
+			right = (data[5] & aiptek->curSetting.mouseButtonRight) != 0 ? 1 : 0;
+			middle = (data[5] & aiptek->curSetting.mouseButtonMiddle) != 0 ? 1 : 0;
+
+			if (dv != 0) {
+				/* If the selected tool changed, reset the old
+				 * tool key, and set the new one.
+				 */
+				if (aiptek->previousToolMode !=
+				    aiptek->curSetting.toolMode) {
+				        input_report_key(inputdev,
+							 aiptek->previousToolMode, 0);
+					input_report_key(inputdev,
+							 aiptek->curSetting.toolMode,
+							 1);
+					aiptek->previousToolMode =
+					          aiptek->curSetting.toolMode;
+				}
+
+				if (p != 0) {
+					input_report_abs(inputdev, ABS_X, x);
+					input_report_abs(inputdev, ABS_Y, y);
+
+					input_report_key(inputdev, BTN_LEFT, left);
+					input_report_key(inputdev, BTN_MIDDLE, middle);
+					input_report_key(inputdev, BTN_RIGHT, right);
+
+					/* Wheel support is in the form of a single-event
+					 * firing.
+					 */
+					if (aiptek->curSetting.wheel != AIPTEK_WHEEL_DISABLE) {
+						input_report_abs(inputdev,
+								 ABS_WHEEL,
+								 aiptek->curSetting.wheel);
+						aiptek->curSetting.wheel = AIPTEK_WHEEL_DISABLE;
+					}
+				}
+				input_report_abs(inputdev, ABS_MISC, p | AIPTEK_REPORT_TOOL_MOUSE);
+				if (aiptek->lastMacro != -1) {
+			                input_report_key(inputdev,
+							 macroKeyEvents[aiptek->lastMacro], 0);
+				        aiptek->lastMacro = -1;
+				}
+				input_sync(inputdev);
+			}
+		}
+	}
+	/* Report 4s come from the macro keys when pressed by stylus
+	 */
+	else if (data[0] == 4) {
+		jitterable = data[1] & 0x18;
+
+		dv = (data[1] & 0x01) != 0 ? 1 : 0;
+		p = (data[1] & 0x02) != 0 ? 1 : 0;
+		tip = (data[1] & 0x04) != 0 ? 1 : 0;
+		bs = (data[1] & aiptek->curSetting.stylusButtonLower) != 0 ? 1 : 0;
+		pck = (data[1] & aiptek->curSetting.stylusButtonUpper) != 0 ? 1 : 0;
+
+		macro = dv && p && tip && !(data[3] & 1) ? (data[3] >> 1) : -1;
+		if (macro >= ARRAY_SIZE(macroKeyEvents))
+			macro = -1;
+		z = get_unaligned_le16(data + 4);
+
+		if (dv) {
+		        /* If the selected tool changed, reset the old
+			 * tool key, and set the new one.
+			 */
+		        if (aiptek->previousToolMode !=
+			    aiptek->curSetting.toolMode) {
+			        input_report_key(inputdev,
+						 aiptek->previousToolMode, 0);
+				input_report_key(inputdev,
+						 aiptek->curSetting.toolMode,
+						 1);
+				aiptek->previousToolMode =
+				        aiptek->curSetting.toolMode;
+			}
+		}
+
+		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
+		        input_report_key(inputdev, macroKeyEvents[aiptek->lastMacro], 0);
+			aiptek->lastMacro = -1;
+		}
+
+		if (macro != -1 && macro != aiptek->lastMacro) {
+			input_report_key(inputdev, macroKeyEvents[macro], 1);
+			aiptek->lastMacro = macro;
+		}
+		input_report_abs(inputdev, ABS_MISC,
+				 p | AIPTEK_REPORT_TOOL_STYLUS);
+		input_sync(inputdev);
+	}
+	/* Report 5s come from the macro keys when pressed by mouse
+	 */
+	else if (data[0] == 5) {
+		jitterable = data[1] & 0x1c;
+
+		dv = (data[1] & 0x01) != 0 ? 1 : 0;
+		p = (data[1] & 0x02) != 0 ? 1 : 0;
+		left = (data[1]& aiptek->curSetting.mouseButtonLeft) != 0 ? 1 : 0;
+		right = (data[1] & aiptek->curSetting.mouseButtonRight) != 0 ? 1 : 0;
+		middle = (data[1] & aiptek->curSetting.mouseButtonMiddle) != 0 ? 1 : 0;
+		macro = dv && p && left && !(data[3] & 1) ? (data[3] >> 1) : -1;
+		if (macro >= ARRAY_SIZE(macroKeyEvents))
+			macro = -1;
+
+		if (dv) {
+		        /* If the selected tool changed, reset the old
+			 * tool key, and set the new one.
+			 */
+		        if (aiptek->previousToolMode !=
+			    aiptek->curSetting.toolMode) {
+		                input_report_key(inputdev,
+						 aiptek->previousToolMode, 0);
+			        input_report_key(inputdev,
+						 aiptek->curSetting.toolMode, 1);
+			        aiptek->previousToolMode = aiptek->curSetting.toolMode;
+			}
+		}
+
+		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
+		        input_report_key(inputdev, macroKeyEvents[aiptek->lastMacro], 0);
+			aiptek->lastMacro = -1;
+		}
+
+		if (macro != -1 && macro != aiptek->lastMacro) {
+			input_report_key(inputdev, macroKeyEvents[macro], 1);
+			aiptek->lastMacro = macro;
+		}
+
+		input_report_abs(inputdev, ABS_MISC,
+				 p | AIPTEK_REPORT_TOOL_MOUSE);
+		input_sync(inputdev);
+	}
+	/* We have no idea which tool can generate a report 6. Theoretically,
+	 * neither need to, having been given reports 4 & 5 for such use.
+	 * However, report 6 is the 'official-looking' report for macroKeys;
+	 * reports 4 & 5 supposively are used to support unnamed, unknown
+	 * hat switches (which just so happen to be the macroKeys.)
+	 */
+	else if (data[0] == 6) {
+		macro = get_unaligned_le16(data + 1);
+		if (macro > 0 && macro - 1 < ARRAY_SIZE(macroKeyEvents)) {
+			input_report_key(inputdev, macroKeyEvents[macro - 1],
+					 0);
+		}
+		if (macro + 1 < ARRAY_SIZE(macroKeyEvents)) {
+			input_report_key(inputdev, macroKeyEvents[macro + 1],
+					 0);
+		}
+
+		/* If the selected tool changed, reset the old
+		   tool key, and set the new one.
+		*/
+		if (aiptek->previousToolMode !=
+		    aiptek->curSetting.toolMode) {
+		        input_report_key(inputdev,
+					 aiptek->previousToolMode, 0);
+			input_report_key(inputdev,
+					 aiptek->curSetting.toolMode,
+					 1);
+			aiptek->previousToolMode =
+				aiptek->curSetting.toolMode;
+		}
+
+		if (macro < ARRAY_SIZE(macroKeyEvents))
+			input_report_key(inputdev, macroKeyEvents[macro], 1);
+		input_report_abs(inputdev, ABS_MISC,
+				 1 | AIPTEK_REPORT_TOOL_UNKNOWN);
+		input_sync(inputdev);
+	} else {
+		dev_dbg(&intf->dev, "Unknown report %d\n", data[0]);
+	}
+
+	/* Jitter may occur when the user presses a button on the stlyus
+	 * or the mouse. What we do to prevent that is wait 'x' milliseconds
+	 * following a 'jitterable' event, which should give the hand some time
+	 * stabilize itself.
+	 *
+	 * We just introduced aiptek->previousJitterable to carry forth the
+	 * notion that jitter occurs when the button state changes from on to off:
+	 * a person drawing, holding a button down is not subject to jittering.
+	 * With that in mind, changing from upper button depressed to lower button
+	 * WILL transition through a jitter delay.
+	 */
+
+	if (aiptek->previousJitterable != jitterable &&
+	    aiptek->curSetting.jitterDelay != 0 && aiptek->inDelay != 1) {
+		aiptek->endDelay = jiffies +
+		    ((aiptek->curSetting.jitterDelay * HZ) / 1000);
+		aiptek->inDelay = 1;
+	}
+	aiptek->previousJitterable = jitterable;
+
+exit:
+	retval = usb_submit_urb(urb, GFP_ATOMIC);
+	if (retval != 0) {
+		dev_err(&intf->dev,
+			"%s - usb_submit_urb failed with result %d\n",
+			__func__, retval);
+	}
+}
+
+/***********************************************************************
+ * These are the USB id's known so far. We do not identify them to
+ * specific Aiptek model numbers, because there has been overlaps,
+ * use, and reuse of id's in existing models. Certain models have
+ * been known to use more than one ID, indicative perhaps of
+ * manufacturing revisions. In any event, we consider these
+ * IDs to not be model-specific nor unique.
+ */
+static const struct usb_device_id aiptek_ids[] = {
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x01)},
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x10)},
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x20)},
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x21)},
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x22)},
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x23)},
+	{USB_DEVICE(USB_VENDOR_ID_AIPTEK, 0x24)},
+	{USB_DEVICE(USB_VENDOR_ID_KYE, 0x5003)},
+	{}
+};
+
+MODULE_DEVICE_TABLE(usb, aiptek_ids);
+
+/***********************************************************************
+ * Open an instance of the tablet driver.
+ */
+static int aiptek_open(struct input_dev *inputdev)
+{
+	struct aiptek *aiptek = input_get_drvdata(inputdev);
+
+	aiptek->urb->dev = interface_to_usbdev(aiptek->intf);
+	if (usb_submit_urb(aiptek->urb, GFP_KERNEL) != 0)
+		return -EIO;
+
+	return 0;
+}
+
+/***********************************************************************
+ * Close an instance of the tablet driver.
+ */
+static void aiptek_close(struct input_dev *inputdev)
+{
+	struct aiptek *aiptek = input_get_drvdata(inputdev);
+
+	usb_kill_urb(aiptek->urb);
+}
+
+/***********************************************************************
+ * aiptek_set_report and aiptek_get_report() are borrowed from Linux 2.4.x,
+ * where they were known as usb_set_report and usb_get_report.
+ */
+static int
+aiptek_set_report(struct aiptek *aiptek,
+		  unsigned char report_type,
+		  unsigned char report_id, void *buffer, int size)
+{
+	struct usb_device *udev = interface_to_usbdev(aiptek->intf);
+
+	return usb_control_msg(udev,
+			       usb_sndctrlpipe(udev, 0),
+			       HID_REQ_SET_REPORT,
+			       USB_TYPE_CLASS | USB_RECIP_INTERFACE |
+			       USB_DIR_OUT, (report_type << 8) + report_id,
+			       aiptek->ifnum, buffer, size, 5000);
+}
+
+static int
+aiptek_get_report(struct aiptek *aiptek,
+		  unsigned char report_type,
+		  unsigned char report_id, void *buffer, int size)
+{
+	struct usb_device *udev = interface_to_usbdev(aiptek->intf);
+
+	return usb_control_msg(udev,
+			       usb_rcvctrlpipe(udev, 0),
+			       HID_REQ_GET_REPORT,
+			       USB_TYPE_CLASS | USB_RECIP_INTERFACE |
+			       USB_DIR_IN, (report_type << 8) + report_id,
+			       aiptek->ifnum, buffer, size, 5000);
+}
+
+/***********************************************************************
+ * Send a command to the tablet.
+ */
+static int
+aiptek_command(struct aiptek *aiptek, unsigned char command, unsigned char data)
+{
+	const int sizeof_buf = 3 * sizeof(u8);
+	int ret;
+	u8 *buf;
+
+	buf = kmalloc(sizeof_buf, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	buf[0] = 2;
+	buf[1] = command;
+	buf[2] = data;
+
+	if ((ret =
+	     aiptek_set_report(aiptek, 3, 2, buf, sizeof_buf)) != sizeof_buf) {
+		dev_dbg(&aiptek->intf->dev,
+			"aiptek_program: failed, tried to send: 0x%02x 0x%02x\n",
+			command, data);
+	}
+	kfree(buf);
+	return ret < 0 ? ret : 0;
+}
+
+/***********************************************************************
+ * Retrieve information from the tablet. Querying info is defined as first
+ * sending the {command,data} sequence as a command, followed by a wait
+ * (aka, "programmaticDelay") and then a "read" request.
+ */
+static int
+aiptek_query(struct aiptek *aiptek, unsigned char command, unsigned char data)
+{
+	const int sizeof_buf = 3 * sizeof(u8);
+	int ret;
+	u8 *buf;
+
+	buf = kmalloc(sizeof_buf, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	buf[0] = 2;
+	buf[1] = command;
+	buf[2] = data;
+
+	if (aiptek_command(aiptek, command, data) != 0) {
+		kfree(buf);
+		return -EIO;
+	}
+	msleep(aiptek->curSetting.programmableDelay);
+
+	if (aiptek_get_report(aiptek, 3, 2, buf, sizeof_buf) != sizeof_buf) {
+		dev_dbg(&aiptek->intf->dev,
+			"aiptek_query failed: returned 0x%02x 0x%02x 0x%02x\n",
+			buf[0], buf[1], buf[2]);
+		ret = -EIO;
+	} else {
+		ret = get_unaligned_le16(buf + 1);
+	}
+	kfree(buf);
+	return ret;
+}
+
+/***********************************************************************
+ * Program the tablet into either absolute or relative mode.
+ * We also get information about the tablet's size.
+ */
+static int aiptek_program_tablet(struct aiptek *aiptek)
+{
+	int ret;
+	/* Execute Resolution500LPI */
+	if ((ret = aiptek_command(aiptek, 0x18, 0x04)) < 0)
+		return ret;
+
+	/* Query getModelCode */
+	if ((ret = aiptek_query(aiptek, 0x02, 0x00)) < 0)
+		return ret;
+	aiptek->features.modelCode = ret & 0xff;
+
+	/* Query getODMCode */
+	if ((ret = aiptek_query(aiptek, 0x03, 0x00)) < 0)
+		return ret;
+	aiptek->features.odmCode = ret;
+
+	/* Query getFirmwareCode */
+	if ((ret = aiptek_query(aiptek, 0x04, 0x00)) < 0)
+		return ret;
+	aiptek->features.firmwareCode = ret;
+
+	/* Query getXextension */
+	if ((ret = aiptek_query(aiptek, 0x01, 0x00)) < 0)
+		return ret;
+	input_set_abs_params(aiptek->inputdev, ABS_X, 0, ret - 1, 0, 0);
+
+	/* Query getYextension */
+	if ((ret = aiptek_query(aiptek, 0x01, 0x01)) < 0)
+		return ret;
+	input_set_abs_params(aiptek->inputdev, ABS_Y, 0, ret - 1, 0, 0);
+
+	/* Query getPressureLevels */
+	if ((ret = aiptek_query(aiptek, 0x08, 0x00)) < 0)
+		return ret;
+	input_set_abs_params(aiptek->inputdev, ABS_PRESSURE, 0, ret - 1, 0, 0);
+
+	/* Depending on whether we are in absolute or relative mode, we will
+	 * do a switchToTablet(absolute) or switchToMouse(relative) command.
+	 */
+	if (aiptek->curSetting.coordinateMode ==
+	    AIPTEK_COORDINATE_ABSOLUTE_MODE) {
+		/* Execute switchToTablet */
+		if ((ret = aiptek_command(aiptek, 0x10, 0x01)) < 0) {
+			return ret;
+		}
+	} else {
+		/* Execute switchToMouse */
+		if ((ret = aiptek_command(aiptek, 0x10, 0x00)) < 0) {
+			return ret;
+		}
+	}
+
+	/* Enable the macro keys */
+	if ((ret = aiptek_command(aiptek, 0x11, 0x02)) < 0)
+		return ret;
+#if 0
+	/* Execute FilterOn */
+	if ((ret = aiptek_command(aiptek, 0x17, 0x00)) < 0)
+		return ret;
+#endif
+
+	/* Execute AutoGainOn */
+	if ((ret = aiptek_command(aiptek, 0x12, 0xff)) < 0)
+		return ret;
+
+	/* Reset the eventCount, so we track events from last (re)programming
+	 */
+	aiptek->diagnostic = AIPTEK_DIAGNOSTIC_NA;
+	aiptek->eventCount = 0;
+
+	return 0;
+}
+
+/***********************************************************************
+ * Sysfs functions. Sysfs prefers that individually-tunable parameters
+ * exist in their separate pseudo-files. Summary data that is immutable
+ * may exist in a singular file so long as you don't define a writeable
+ * interface.
+ */
+
+/***********************************************************************
+ * support the 'size' file -- display support
+ */
+static ssize_t show_tabletSize(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%dx%d\n",
+			  input_abs_get_max(aiptek->inputdev, ABS_X) + 1,
+			  input_abs_get_max(aiptek->inputdev, ABS_Y) + 1);
+}
+
+/* These structs define the sysfs files, param #1 is the name of the
+ * file, param 2 is the file permissions, param 3 & 4 are to the
+ * output generator and input parser routines. Absence of a routine is
+ * permitted -- it only means can't either 'cat' the file, or send data
+ * to it.
+ */
+static DEVICE_ATTR(size, S_IRUGO, show_tabletSize, NULL);
+
+/***********************************************************************
+ * support routines for the 'pointer_mode' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+static struct aiptek_map pointer_mode_map[] = {
+	{ "stylus",	AIPTEK_POINTER_ONLY_STYLUS_MODE },
+	{ "mouse",	AIPTEK_POINTER_ONLY_MOUSE_MODE },
+	{ "either",	AIPTEK_POINTER_EITHER_MODE },
+	{ NULL,		AIPTEK_INVALID_VALUE }
+};
+
+static ssize_t show_tabletPointerMode(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(pointer_mode_map,
+						      aiptek->curSetting.pointerMode));
+}
+
+static ssize_t
+store_tabletPointerMode(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_mode = map_str_to_val(pointer_mode_map, buf, count);
+
+	if (new_mode == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.pointerMode = new_mode;
+	return count;
+}
+
+static DEVICE_ATTR(pointer_mode,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletPointerMode, store_tabletPointerMode);
+
+/***********************************************************************
+ * support routines for the 'coordinate_mode' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+
+static struct aiptek_map coordinate_mode_map[] = {
+	{ "absolute",	AIPTEK_COORDINATE_ABSOLUTE_MODE },
+	{ "relative",	AIPTEK_COORDINATE_RELATIVE_MODE },
+	{ NULL,		AIPTEK_INVALID_VALUE }
+};
+
+static ssize_t show_tabletCoordinateMode(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(coordinate_mode_map,
+						      aiptek->curSetting.coordinateMode));
+}
+
+static ssize_t
+store_tabletCoordinateMode(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_mode = map_str_to_val(coordinate_mode_map, buf, count);
+
+	if (new_mode == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.coordinateMode = new_mode;
+	return count;
+}
+
+static DEVICE_ATTR(coordinate_mode,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletCoordinateMode, store_tabletCoordinateMode);
+
+/***********************************************************************
+ * support routines for the 'tool_mode' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+
+static struct aiptek_map tool_mode_map[] = {
+	{ "mouse",	AIPTEK_TOOL_BUTTON_MOUSE_MODE },
+	{ "eraser",	AIPTEK_TOOL_BUTTON_ERASER_MODE },
+	{ "pencil",	AIPTEK_TOOL_BUTTON_PENCIL_MODE },
+	{ "pen",	AIPTEK_TOOL_BUTTON_PEN_MODE },
+	{ "brush",	AIPTEK_TOOL_BUTTON_BRUSH_MODE },
+	{ "airbrush",	AIPTEK_TOOL_BUTTON_AIRBRUSH_MODE },
+	{ "lens",	AIPTEK_TOOL_BUTTON_LENS_MODE },
+	{ NULL,		AIPTEK_INVALID_VALUE }
+};
+
+static ssize_t show_tabletToolMode(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(tool_mode_map,
+						      aiptek->curSetting.toolMode));
+}
+
+static ssize_t
+store_tabletToolMode(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_mode = map_str_to_val(tool_mode_map, buf, count);
+
+	if (new_mode == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.toolMode = new_mode;
+	return count;
+}
+
+static DEVICE_ATTR(tool_mode,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletToolMode, store_tabletToolMode);
+
+/***********************************************************************
+ * support routines for the 'xtilt' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+static ssize_t show_tabletXtilt(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	if (aiptek->curSetting.xTilt == AIPTEK_TILT_DISABLE) {
+		return sysfs_emit(buf, "disable\n");
+	} else {
+		return sysfs_emit(buf, "%d\n", aiptek->curSetting.xTilt);
+	}
+}
+
+static ssize_t
+store_tabletXtilt(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int x;
+
+	if (kstrtoint(buf, 10, &x)) {
+		size_t len = buf[count - 1] == '\n' ? count - 1 : count;
+
+		if (strncmp(buf, "disable", len))
+			return -EINVAL;
+
+		aiptek->newSetting.xTilt = AIPTEK_TILT_DISABLE;
+	} else {
+		if (x < AIPTEK_TILT_MIN || x > AIPTEK_TILT_MAX)
+			return -EINVAL;
+
+		aiptek->newSetting.xTilt = x;
+	}
+
+	return count;
+}
+
+static DEVICE_ATTR(xtilt,
+		   S_IRUGO | S_IWUSR, show_tabletXtilt, store_tabletXtilt);
+
+/***********************************************************************
+ * support routines for the 'ytilt' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+static ssize_t show_tabletYtilt(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	if (aiptek->curSetting.yTilt == AIPTEK_TILT_DISABLE) {
+		return sysfs_emit(buf, "disable\n");
+	} else {
+		return sysfs_emit(buf, "%d\n", aiptek->curSetting.yTilt);
+	}
+}
+
+static ssize_t
+store_tabletYtilt(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int y;
+
+	if (kstrtoint(buf, 10, &y)) {
+		size_t len = buf[count - 1] == '\n' ? count - 1 : count;
+
+		if (strncmp(buf, "disable", len))
+			return -EINVAL;
+
+		aiptek->newSetting.yTilt = AIPTEK_TILT_DISABLE;
+	} else {
+		if (y < AIPTEK_TILT_MIN || y > AIPTEK_TILT_MAX)
+			return -EINVAL;
+
+		aiptek->newSetting.yTilt = y;
+	}
+
+	return count;
+}
+
+static DEVICE_ATTR(ytilt,
+		   S_IRUGO | S_IWUSR, show_tabletYtilt, store_tabletYtilt);
+
+/***********************************************************************
+ * support routines for the 'jitter' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+static ssize_t show_tabletJitterDelay(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%d\n", aiptek->curSetting.jitterDelay);
+}
+
+static ssize_t
+store_tabletJitterDelay(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int err, j;
+
+	err = kstrtoint(buf, 10, &j);
+	if (err)
+		return err;
+
+	aiptek->newSetting.jitterDelay = j;
+	return count;
+}
+
+static DEVICE_ATTR(jitter,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletJitterDelay, store_tabletJitterDelay);
+
+/***********************************************************************
+ * support routines for the 'delay' file. Note that this file
+ * both displays current setting and allows reprogramming.
+ */
+static ssize_t show_tabletProgrammableDelay(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%d\n", aiptek->curSetting.programmableDelay);
+}
+
+static ssize_t
+store_tabletProgrammableDelay(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int err, d;
+
+	err = kstrtoint(buf, 10, &d);
+	if (err)
+		return err;
+
+	aiptek->newSetting.programmableDelay = d;
+	return count;
+}
+
+static DEVICE_ATTR(delay,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletProgrammableDelay, store_tabletProgrammableDelay);
+
+/***********************************************************************
+ * support routines for the 'event_count' file. Note that this file
+ * only displays current setting.
+ */
+static ssize_t show_tabletEventsReceived(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%ld\n", aiptek->eventCount);
+}
+
+static DEVICE_ATTR(event_count, S_IRUGO, show_tabletEventsReceived, NULL);
+
+/***********************************************************************
+ * support routines for the 'diagnostic' file. Note that this file
+ * only displays current setting.
+ */
+static ssize_t show_tabletDiagnosticMessage(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	char *retMsg;
+
+	switch (aiptek->diagnostic) {
+	case AIPTEK_DIAGNOSTIC_NA:
+		retMsg = "no errors\n";
+		break;
+
+	case AIPTEK_DIAGNOSTIC_SENDING_RELATIVE_IN_ABSOLUTE:
+		retMsg = "Error: receiving relative reports\n";
+		break;
+
+	case AIPTEK_DIAGNOSTIC_SENDING_ABSOLUTE_IN_RELATIVE:
+		retMsg = "Error: receiving absolute reports\n";
+		break;
+
+	case AIPTEK_DIAGNOSTIC_TOOL_DISALLOWED:
+		if (aiptek->curSetting.pointerMode ==
+		    AIPTEK_POINTER_ONLY_MOUSE_MODE) {
+			retMsg = "Error: receiving stylus reports\n";
+		} else {
+			retMsg = "Error: receiving mouse reports\n";
+		}
+		break;
+
+	default:
+		return 0;
+	}
+	return sysfs_emit(buf, retMsg);
+}
+
+static DEVICE_ATTR(diagnostic, S_IRUGO, show_tabletDiagnosticMessage, NULL);
+
+/***********************************************************************
+ * support routines for the 'stylus_upper' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+
+static struct aiptek_map stylus_button_map[] = {
+	{ "upper",	AIPTEK_STYLUS_UPPER_BUTTON },
+	{ "lower",	AIPTEK_STYLUS_LOWER_BUTTON },
+	{ NULL,		AIPTEK_INVALID_VALUE }
+};
+
+static ssize_t show_tabletStylusUpper(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(stylus_button_map,
+						      aiptek->curSetting.stylusButtonUpper));
+}
+
+static ssize_t
+store_tabletStylusUpper(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_button = map_str_to_val(stylus_button_map, buf, count);
+
+	if (new_button == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.stylusButtonUpper = new_button;
+	return count;
+}
+
+static DEVICE_ATTR(stylus_upper,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletStylusUpper, store_tabletStylusUpper);
+
+/***********************************************************************
+ * support routines for the 'stylus_lower' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+
+static ssize_t show_tabletStylusLower(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(stylus_button_map,
+						      aiptek->curSetting.stylusButtonLower));
+}
+
+static ssize_t
+store_tabletStylusLower(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_button = map_str_to_val(stylus_button_map, buf, count);
+
+	if (new_button == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.stylusButtonLower = new_button;
+	return count;
+}
+
+static DEVICE_ATTR(stylus_lower,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletStylusLower, store_tabletStylusLower);
+
+/***********************************************************************
+ * support routines for the 'mouse_left' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+
+static struct aiptek_map mouse_button_map[] = {
+	{ "left",	AIPTEK_MOUSE_LEFT_BUTTON },
+	{ "middle",	AIPTEK_MOUSE_MIDDLE_BUTTON },
+	{ "right",	AIPTEK_MOUSE_RIGHT_BUTTON },
+	{ NULL,		AIPTEK_INVALID_VALUE }
+};
+
+static ssize_t show_tabletMouseLeft(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(mouse_button_map,
+						      aiptek->curSetting.mouseButtonLeft));
+}
+
+static ssize_t
+store_tabletMouseLeft(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_button = map_str_to_val(mouse_button_map, buf, count);
+
+	if (new_button == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.mouseButtonLeft = new_button;
+	return count;
+}
+
+static DEVICE_ATTR(mouse_left,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletMouseLeft, store_tabletMouseLeft);
+
+/***********************************************************************
+ * support routines for the 'mouse_middle' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+static ssize_t show_tabletMouseMiddle(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(mouse_button_map,
+						      aiptek->curSetting.mouseButtonMiddle));
+}
+
+static ssize_t
+store_tabletMouseMiddle(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_button = map_str_to_val(mouse_button_map, buf, count);
+
+	if (new_button == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.mouseButtonMiddle = new_button;
+	return count;
+}
+
+static DEVICE_ATTR(mouse_middle,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletMouseMiddle, store_tabletMouseMiddle);
+
+/***********************************************************************
+ * support routines for the 'mouse_right' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+static ssize_t show_tabletMouseRight(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%s\n", map_val_to_str(mouse_button_map,
+						      aiptek->curSetting.mouseButtonRight));
+}
+
+static ssize_t
+store_tabletMouseRight(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int new_button = map_str_to_val(mouse_button_map, buf, count);
+
+	if (new_button == AIPTEK_INVALID_VALUE)
+		return -EINVAL;
+
+	aiptek->newSetting.mouseButtonRight = new_button;
+	return count;
+}
+
+static DEVICE_ATTR(mouse_right,
+		   S_IRUGO | S_IWUSR,
+		   show_tabletMouseRight, store_tabletMouseRight);
+
+/***********************************************************************
+ * support routines for the 'wheel' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+static ssize_t show_tabletWheel(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	if (aiptek->curSetting.wheel == AIPTEK_WHEEL_DISABLE) {
+		return sysfs_emit(buf, "disable\n");
+	} else {
+		return sysfs_emit(buf, "%d\n", aiptek->curSetting.wheel);
+	}
+}
+
+static ssize_t
+store_tabletWheel(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+	int err, w;
+
+	err = kstrtoint(buf, 10, &w);
+	if (err)
+		return err;
+
+	aiptek->newSetting.wheel = w;
+	return count;
+}
+
+static DEVICE_ATTR(wheel,
+		   S_IRUGO | S_IWUSR, show_tabletWheel, store_tabletWheel);
+
+/***********************************************************************
+ * support routines for the 'execute' file. Note that this file
+ * both displays current setting and allows for setting changing.
+ */
+static ssize_t show_tabletExecute(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	/* There is nothing useful to display, so a one-line manual
+	 * is in order...
+	 */
+	return sysfs_emit(buf, "Write anything to this file to program your tablet.\n");
+}
+
+static ssize_t
+store_tabletExecute(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	/* We do not care what you write to this file. Merely the action
+	 * of writing to this file triggers a tablet reprogramming.
+	 */
+	memcpy(&aiptek->curSetting, &aiptek->newSetting,
+	       sizeof(struct aiptek_settings));
+
+	if (aiptek_program_tablet(aiptek) < 0)
+		return -EIO;
+
+	return count;
+}
+
+static DEVICE_ATTR(execute,
+		   S_IRUGO | S_IWUSR, show_tabletExecute, store_tabletExecute);
+
+/***********************************************************************
+ * support routines for the 'odm_code' file. Note that this file
+ * only displays current setting.
+ */
+static ssize_t show_tabletODMCode(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "0x%04x\n", aiptek->features.odmCode);
+}
+
+static DEVICE_ATTR(odm_code, S_IRUGO, show_tabletODMCode, NULL);
+
+/***********************************************************************
+ * support routines for the 'model_code' file. Note that this file
+ * only displays current setting.
+ */
+static ssize_t show_tabletModelCode(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "0x%04x\n", aiptek->features.modelCode);
+}
+
+static DEVICE_ATTR(model_code, S_IRUGO, show_tabletModelCode, NULL);
+
+/***********************************************************************
+ * support routines for the 'firmware_code' file. Note that this file
+ * only displays current setting.
+ */
+static ssize_t show_firmwareCode(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct aiptek *aiptek = dev_get_drvdata(dev);
+
+	return sysfs_emit(buf, "%04x\n", aiptek->features.firmwareCode);
+}
+
+static DEVICE_ATTR(firmware_code, S_IRUGO, show_firmwareCode, NULL);
+
+static struct attribute *aiptek_dev_attrs[] = {
+	&dev_attr_size.attr,
+	&dev_attr_pointer_mode.attr,
+	&dev_attr_coordinate_mode.attr,
+	&dev_attr_tool_mode.attr,
+	&dev_attr_xtilt.attr,
+	&dev_attr_ytilt.attr,
+	&dev_attr_jitter.attr,
+	&dev_attr_delay.attr,
+	&dev_attr_event_count.attr,
+	&dev_attr_diagnostic.attr,
+	&dev_attr_odm_code.attr,
+	&dev_attr_model_code.attr,
+	&dev_attr_firmware_code.attr,
+	&dev_attr_stylus_lower.attr,
+	&dev_attr_stylus_upper.attr,
+	&dev_attr_mouse_left.attr,
+	&dev_attr_mouse_middle.attr,
+	&dev_attr_mouse_right.attr,
+	&dev_attr_wheel.attr,
+	&dev_attr_execute.attr,
+	NULL
+};
+
+ATTRIBUTE_GROUPS(aiptek_dev);
+
+/***********************************************************************
+ * This routine is called when a tablet has been identified. It basically
+ * sets up the tablet and the driver's internal structures.
+ */
+static int
+aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+	struct usb_device *usbdev = interface_to_usbdev(intf);
+	struct usb_endpoint_descriptor *endpoint;
+	struct aiptek *aiptek;
+	struct input_dev *inputdev;
+	int i;
+	int speeds[] = { 0,
+		AIPTEK_PROGRAMMABLE_DELAY_50,
+		AIPTEK_PROGRAMMABLE_DELAY_400,
+		AIPTEK_PROGRAMMABLE_DELAY_25,
+		AIPTEK_PROGRAMMABLE_DELAY_100,
+		AIPTEK_PROGRAMMABLE_DELAY_200,
+		AIPTEK_PROGRAMMABLE_DELAY_300
+	};
+	int err = -ENOMEM;
+
+	/* programmableDelay is where the command-line specified
+	 * delay is kept. We make it the first element of speeds[],
+	 * so therefore, your override speed is tried first, then the
+	 * remainder. Note that the default value of 400ms will be tried
+	 * if you do not specify any command line parameter.
+	 */
+	speeds[0] = programmableDelay;
+
+	aiptek = kzalloc_obj(*aiptek);
+	inputdev = input_allocate_device();
+	if (!aiptek || !inputdev) {
+		dev_warn(&intf->dev,
+			 "cannot allocate memory or input device\n");
+		goto fail1;
+        }
+
+	aiptek->data = usb_alloc_coherent(usbdev, AIPTEK_PACKET_LENGTH,
+					  GFP_KERNEL, &aiptek->data_dma);
+        if (!aiptek->data) {
+		dev_warn(&intf->dev, "cannot allocate usb buffer\n");
+		goto fail1;
+	}
+
+	aiptek->urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!aiptek->urb) {
+	        dev_warn(&intf->dev, "cannot allocate urb\n");
+		goto fail2;
+	}
+
+	aiptek->inputdev = inputdev;
+	aiptek->intf = intf;
+	aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+	aiptek->inDelay = 0;
+	aiptek->endDelay = 0;
+	aiptek->previousJitterable = 0;
+	aiptek->lastMacro = -1;
+
+	/* Set up the curSettings struct. Said struct contains the current
+	 * programmable parameters. The newSetting struct contains changes
+	 * the user makes to the settings via the sysfs interface. Those
+	 * changes are not "committed" to curSettings until the user
+	 * writes to the sysfs/.../execute file.
+	 */
+	aiptek->curSetting.pointerMode = AIPTEK_POINTER_EITHER_MODE;
+	aiptek->curSetting.coordinateMode = AIPTEK_COORDINATE_ABSOLUTE_MODE;
+	aiptek->curSetting.toolMode = AIPTEK_TOOL_BUTTON_PEN_MODE;
+	aiptek->curSetting.xTilt = AIPTEK_TILT_DISABLE;
+	aiptek->curSetting.yTilt = AIPTEK_TILT_DISABLE;
+	aiptek->curSetting.mouseButtonLeft = AIPTEK_MOUSE_LEFT_BUTTON;
+	aiptek->curSetting.mouseButtonMiddle = AIPTEK_MOUSE_MIDDLE_BUTTON;
+	aiptek->curSetting.mouseButtonRight = AIPTEK_MOUSE_RIGHT_BUTTON;
+	aiptek->curSetting.stylusButtonUpper = AIPTEK_STYLUS_UPPER_BUTTON;
+	aiptek->curSetting.stylusButtonLower = AIPTEK_STYLUS_LOWER_BUTTON;
+	aiptek->curSetting.jitterDelay = jitterDelay;
+	aiptek->curSetting.programmableDelay = programmableDelay;
+
+	/* Both structs should have equivalent settings
+	 */
+	aiptek->newSetting = aiptek->curSetting;
+
+	/* Determine the usb devices' physical path.
+	 * Asketh not why we always pretend we're using "../input0",
+	 * but I suspect this will have to be refactored one
+	 * day if a single USB device can be a keyboard & a mouse
+	 * & a tablet, and the inputX number actually will tell
+	 * us something...
+	 */
+	usb_make_path(usbdev, aiptek->features.usbPath,
+			sizeof(aiptek->features.usbPath));
+	strlcat(aiptek->features.usbPath, "/input0",
+		sizeof(aiptek->features.usbPath));
+
+	/* Set up client data, pointers to open and close routines
+	 * for the input device.
+	 */
+	inputdev->name = "Aiptek";
+	inputdev->phys = aiptek->features.usbPath;
+	usb_to_input_id(usbdev, &inputdev->id);
+	inputdev->dev.parent = &intf->dev;
+
+	input_set_drvdata(inputdev, aiptek);
+
+	inputdev->open = aiptek_open;
+	inputdev->close = aiptek_close;
+
+	/* Now program the capacities of the tablet, in terms of being
+	 * an input device.
+	 */
+	for (i = 0; i < ARRAY_SIZE(eventTypes); ++i)
+	        __set_bit(eventTypes[i], inputdev->evbit);
+
+	for (i = 0; i < ARRAY_SIZE(absEvents); ++i)
+	        __set_bit(absEvents[i], inputdev->absbit);
+
+	for (i = 0; i < ARRAY_SIZE(relEvents); ++i)
+	        __set_bit(relEvents[i], inputdev->relbit);
+
+	__set_bit(MSC_SERIAL, inputdev->mscbit);
+
+	/* Set up key and button codes */
+	for (i = 0; i < ARRAY_SIZE(buttonEvents); ++i)
+		__set_bit(buttonEvents[i], inputdev->keybit);
+
+	for (i = 0; i < ARRAY_SIZE(macroKeyEvents); ++i)
+		__set_bit(macroKeyEvents[i], inputdev->keybit);
+
+	/*
+	 * Program the input device coordinate capacities. We do not yet
+	 * know what maximum X, Y, and Z values are, so we're putting fake
+	 * values in. Later, we'll ask the tablet to put in the correct
+	 * values.
+	 */
+	input_set_abs_params(inputdev, ABS_X, 0, 2999, 0, 0);
+	input_set_abs_params(inputdev, ABS_Y, 0, 2249, 0, 0);
+	input_set_abs_params(inputdev, ABS_PRESSURE, 0, 511, 0, 0);
+	input_set_abs_params(inputdev, ABS_TILT_X, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
+	input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0);
+	input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0);
+
+	err = usb_find_common_endpoints(intf->cur_altsetting,
+					NULL, NULL, &endpoint, NULL);
+	if (err) {
+		dev_err(&intf->dev,
+			"interface has no int in endpoints, but must have minimum 1\n");
+		goto fail3;
+	}
+
+	/* Go set up our URB, which is called when the tablet receives
+	 * input.
+	 */
+	usb_fill_int_urb(aiptek->urb,
+			 usbdev,
+			 usb_rcvintpipe(usbdev,
+					endpoint->bEndpointAddress),
+			 aiptek->data, 8, aiptek_irq, aiptek,
+			 endpoint->bInterval);
+
+	aiptek->urb->transfer_dma = aiptek->data_dma;
+	aiptek->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+	/* Program the tablet. This sets the tablet up in the mode
+	 * specified in newSetting, and also queries the tablet's
+	 * physical capacities.
+	 *
+	 * Sanity check: if a tablet doesn't like the slow programmatic
+	 * delay, we often get sizes of 0x0. Let's use that as an indicator
+	 * to try faster delays, up to 25 ms. If that logic fails, well, you'll
+	 * have to explain to us how your tablet thinks it's 0x0, and yet that's
+	 * not an error :-)
+	 */
+
+	for (i = 0; i < ARRAY_SIZE(speeds); ++i) {
+		aiptek->curSetting.programmableDelay = speeds[i];
+		(void)aiptek_program_tablet(aiptek);
+		if (input_abs_get_max(aiptek->inputdev, ABS_X) > 0) {
+			dev_info(&intf->dev,
+				 "Aiptek using %d ms programming speed\n",
+				 aiptek->curSetting.programmableDelay);
+			break;
+		}
+	}
+
+	/* Murphy says that some day someone will have a tablet that fails the
+	   above test. That's you, Frederic Rodrigo */
+	if (i == ARRAY_SIZE(speeds)) {
+		dev_info(&intf->dev,
+			 "Aiptek tried all speeds, no sane response\n");
+		err = -EINVAL;
+		goto fail3;
+	}
+
+	/* Associate this driver's struct with the usb interface.
+	 */
+	usb_set_intfdata(intf, aiptek);
+
+	/* Register the tablet as an Input Device
+	 */
+	err = input_register_device(aiptek->inputdev);
+	if (err) {
+		dev_warn(&intf->dev,
+			 "input_register_device returned err: %d\n", err);
+		goto fail3;
+        }
+	return 0;
+
+ fail3: usb_free_urb(aiptek->urb);
+ fail2:	usb_free_coherent(usbdev, AIPTEK_PACKET_LENGTH, aiptek->data,
+			  aiptek->data_dma);
+ fail1: usb_set_intfdata(intf, NULL);
+	input_free_device(inputdev);
+	kfree(aiptek);
+	return err;
+}
+
+/***********************************************************************
+ * Deal with tablet disconnecting from the system.
+ */
+static void aiptek_disconnect(struct usb_interface *intf)
+{
+	struct aiptek *aiptek = usb_get_intfdata(intf);
+
+	/* Disassociate driver's struct with usb interface
+	 */
+	usb_set_intfdata(intf, NULL);
+	if (aiptek != NULL) {
+		/* Free & unhook everything from the system.
+		 */
+		usb_kill_urb(aiptek->urb);
+		input_unregister_device(aiptek->inputdev);
+		usb_free_urb(aiptek->urb);
+		usb_free_coherent(interface_to_usbdev(intf),
+				  AIPTEK_PACKET_LENGTH,
+				  aiptek->data, aiptek->data_dma);
+		kfree(aiptek);
+	}
+}
+
+static struct usb_driver aiptek_driver = {
+	.name = "aiptek",
+	.probe = aiptek_probe,
+	.disconnect = aiptek_disconnect,
+	.id_table = aiptek_ids,
+	.dev_groups = aiptek_dev_groups,
+};
+
+module_usb_driver(aiptek_driver);
+
+MODULE_AUTHOR("Bryan W. Headley/Chris Atenasio/Cedric Brun/Rene van Paassen");
+MODULE_DESCRIPTION("Aiptek HyperPen USB Tablet Driver");
+MODULE_LICENSE("GPL");
+
+module_param(programmableDelay, int, 0);
+MODULE_PARM_DESC(programmableDelay, "delay used during tablet programming");
+module_param(jitterDelay, int, 0);
+MODULE_PARM_DESC(jitterDelay, "stylus/mouse settlement delay");
diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
new file mode 100644
index 000000000..fd5a7e761
--- /dev/null
+++ b/drivers/input/tablet/hanwang.c
@@ -0,0 +1,443 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *  USB Hanwang tablet support
+ *
+ *  Copyright (c) 2010 Xing Wei <weixing@hanwang.com.cn>
+ */
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/usb/input.h>
+
+MODULE_AUTHOR("Xing Wei <weixing@hanwang.com.cn>");
+MODULE_DESCRIPTION("USB Hanwang tablet driver");
+MODULE_LICENSE("GPL");
+
+#define USB_VENDOR_ID_HANWANG		0x0b57
+#define HANWANG_TABLET_INT_CLASS	0x0003
+#define HANWANG_TABLET_INT_SUB_CLASS	0x0001
+#define HANWANG_TABLET_INT_PROTOCOL	0x0002
+
+#define ART_MASTER_PKGLEN_MAX	10
+
+/* device IDs */
+#define STYLUS_DEVICE_ID	0x02
+#define TOUCH_DEVICE_ID		0x03
+#define CURSOR_DEVICE_ID	0x06
+#define ERASER_DEVICE_ID	0x0A
+#define PAD_DEVICE_ID		0x0F
+
+/* match vendor and interface info  */
+#define HANWANG_TABLET_DEVICE(vend, cl, sc, pr) \
+	.match_flags = USB_DEVICE_ID_MATCH_VENDOR \
+		| USB_DEVICE_ID_MATCH_INT_INFO, \
+	.idVendor = (vend), \
+	.bInterfaceClass = (cl), \
+	.bInterfaceSubClass = (sc), \
+	.bInterfaceProtocol = (pr)
+
+enum hanwang_tablet_type {
+	HANWANG_ART_MASTER_III,
+	HANWANG_ART_MASTER_HD,
+	HANWANG_ART_MASTER_II,
+};
+
+struct hanwang {
+	unsigned char *data;
+	dma_addr_t data_dma;
+	struct input_dev *dev;
+	struct usb_device *usbdev;
+	struct urb *irq;
+	const struct hanwang_features *features;
+	unsigned int current_tool;
+	unsigned int current_id;
+	char name[64];
+	char phys[32];
+};
+
+struct hanwang_features {
+	unsigned short pid;
+	char *name;
+	enum hanwang_tablet_type type;
+	int pkg_len;
+	int max_x;
+	int max_y;
+	int max_tilt_x;
+	int max_tilt_y;
+	int max_pressure;
+};
+
+static const struct hanwang_features features_array[] = {
+	{ 0x8528, "Hanwang Art Master III 0906", HANWANG_ART_MASTER_III,
+	  ART_MASTER_PKGLEN_MAX, 0x5757, 0x3692, 0x3f, 0x7f, 2048 },
+	{ 0x8529, "Hanwang Art Master III 0604", HANWANG_ART_MASTER_III,
+	  ART_MASTER_PKGLEN_MAX, 0x3d84, 0x2672, 0x3f, 0x7f, 2048 },
+	{ 0x852a, "Hanwang Art Master III 1308", HANWANG_ART_MASTER_III,
+	  ART_MASTER_PKGLEN_MAX, 0x7f00, 0x4f60, 0x3f, 0x7f, 2048 },
+	{ 0x8401, "Hanwang Art Master HD 5012", HANWANG_ART_MASTER_HD,
+	  ART_MASTER_PKGLEN_MAX, 0x678e, 0x4150, 0x3f, 0x7f, 1024 },
+	{ 0x8503, "Hanwang Art Master II", HANWANG_ART_MASTER_II,
+	  ART_MASTER_PKGLEN_MAX, 0x27de, 0x1cfe, 0x3f, 0x7f, 1024 },
+};
+
+static const int hw_eventtypes[] = {
+	EV_KEY, EV_ABS, EV_MSC,
+};
+
+static const int hw_absevents[] = {
+	ABS_X, ABS_Y, ABS_TILT_X, ABS_TILT_Y, ABS_WHEEL,
+	ABS_RX, ABS_RY, ABS_PRESSURE, ABS_MISC,
+};
+
+static const int hw_btnevents[] = {
+	BTN_STYLUS, BTN_STYLUS2, BTN_TOOL_PEN, BTN_TOOL_RUBBER,
+	BTN_TOOL_MOUSE, BTN_TOOL_FINGER,
+	BTN_0, BTN_1, BTN_2, BTN_3, BTN_4, BTN_5, BTN_6, BTN_7, BTN_8,
+};
+
+static const int hw_mscevents[] = {
+	MSC_SERIAL,
+};
+
+static void hanwang_parse_packet(struct hanwang *hanwang)
+{
+	unsigned char *data = hanwang->data;
+	struct input_dev *input_dev = hanwang->dev;
+	struct usb_device *dev = hanwang->usbdev;
+	enum hanwang_tablet_type type = hanwang->features->type;
+	int i;
+	u16 p;
+
+	if (type == HANWANG_ART_MASTER_II) {
+		hanwang->current_tool = BTN_TOOL_PEN;
+		hanwang->current_id = STYLUS_DEVICE_ID;
+	}
+
+	switch (data[0]) {
+	case 0x02:	/* data packet */
+		switch (data[1]) {
+		case 0x80:	/* tool prox out */
+			if (type != HANWANG_ART_MASTER_II) {
+				hanwang->current_id = 0;
+				input_report_key(input_dev,
+						 hanwang->current_tool, 0);
+			}
+			break;
+
+		case 0x00:	/* artmaster ii pen leave */
+			if (type == HANWANG_ART_MASTER_II) {
+				hanwang->current_id = 0;
+				input_report_key(input_dev,
+						 hanwang->current_tool, 0);
+			}
+			break;
+
+		case 0xc2:	/* first time tool prox in */
+			switch (data[3] & 0xf0) {
+			case 0x20:	/* art_master III */
+			case 0x30:	/* art_master_HD */
+				hanwang->current_id = STYLUS_DEVICE_ID;
+				hanwang->current_tool = BTN_TOOL_PEN;
+				input_report_key(input_dev, BTN_TOOL_PEN, 1);
+				break;
+			case 0xa0:	/* art_master III */
+			case 0xb0:	/* art_master_HD */
+				hanwang->current_id = ERASER_DEVICE_ID;
+				hanwang->current_tool = BTN_TOOL_RUBBER;
+				input_report_key(input_dev, BTN_TOOL_RUBBER, 1);
+				break;
+			default:
+				hanwang->current_id = 0;
+				dev_dbg(&dev->dev,
+					"unknown tablet tool %02x\n", data[0]);
+				break;
+			}
+			break;
+
+		default:	/* tool data packet */
+			switch (type) {
+			case HANWANG_ART_MASTER_III:
+				p = (data[6] << 3) |
+				    ((data[7] & 0xc0) >> 5) |
+				    (data[1] & 0x01);
+				break;
+
+			case HANWANG_ART_MASTER_HD:
+			case HANWANG_ART_MASTER_II:
+				p = (data[7] >> 6) | (data[6] << 2);
+				break;
+
+			default:
+				p = 0;
+				break;
+			}
+
+			input_report_abs(input_dev, ABS_X,
+					 be16_to_cpup((__be16 *)&data[2]));
+			input_report_abs(input_dev, ABS_Y,
+					 be16_to_cpup((__be16 *)&data[4]));
+			input_report_abs(input_dev, ABS_PRESSURE, p);
+			input_report_abs(input_dev, ABS_TILT_X, data[7] & 0x3f);
+			input_report_abs(input_dev, ABS_TILT_Y, data[8] & 0x7f);
+			input_report_key(input_dev, BTN_STYLUS, data[1] & 0x02);
+
+			if (type != HANWANG_ART_MASTER_II)
+				input_report_key(input_dev, BTN_STYLUS2,
+						 data[1] & 0x04);
+			else
+				input_report_key(input_dev, BTN_TOOL_PEN, 1);
+
+			break;
+		}
+
+		input_report_abs(input_dev, ABS_MISC, hanwang->current_id);
+		input_event(input_dev, EV_MSC, MSC_SERIAL,
+				hanwang->features->pid);
+		break;
+
+	case 0x0c:
+		/* roll wheel */
+		hanwang->current_id = PAD_DEVICE_ID;
+
+		switch (type) {
+		case HANWANG_ART_MASTER_III:
+			input_report_key(input_dev, BTN_TOOL_FINGER,
+					 data[1] || data[2] || data[3]);
+			input_report_abs(input_dev, ABS_WHEEL, data[1]);
+			input_report_key(input_dev, BTN_0, data[2]);
+			for (i = 0; i < 8; i++)
+				input_report_key(input_dev,
+					 BTN_1 + i, data[3] & (1 << i));
+			break;
+
+		case HANWANG_ART_MASTER_HD:
+			input_report_key(input_dev, BTN_TOOL_FINGER, data[1] ||
+					data[2] || data[3] || data[4] ||
+					data[5] || data[6]);
+			input_report_abs(input_dev, ABS_RX,
+					((data[1] & 0x1f) << 8) | data[2]);
+			input_report_abs(input_dev, ABS_RY,
+					((data[3] & 0x1f) << 8) | data[4]);
+			input_report_key(input_dev, BTN_0, data[5] & 0x01);
+			for (i = 0; i < 4; i++) {
+				input_report_key(input_dev,
+					 BTN_1 + i, data[5] & (1 << i));
+				input_report_key(input_dev,
+					 BTN_5 + i, data[6] & (1 << i));
+			}
+			break;
+
+		case HANWANG_ART_MASTER_II:
+			dev_dbg(&dev->dev, "error packet  %02x\n", data[0]);
+			return;
+		}
+
+		input_report_abs(input_dev, ABS_MISC, hanwang->current_id);
+		input_event(input_dev, EV_MSC, MSC_SERIAL, 0xffffffff);
+		break;
+
+	default:
+		dev_dbg(&dev->dev, "error packet  %02x\n", data[0]);
+		break;
+	}
+
+	input_sync(input_dev);
+}
+
+static void hanwang_irq(struct urb *urb)
+{
+	struct hanwang *hanwang = urb->context;
+	struct usb_device *dev = hanwang->usbdev;
+	int retval;
+
+	switch (urb->status) {
+	case 0:
+		/* success */;
+		hanwang_parse_packet(hanwang);
+		break;
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* this urb is terminated, clean up */
+		dev_err(&dev->dev, "%s - urb shutting down with status: %d",
+			__func__, urb->status);
+		return;
+	default:
+		dev_err(&dev->dev, "%s - nonzero urb status received: %d",
+			__func__, urb->status);
+		break;
+	}
+
+	retval = usb_submit_urb(urb, GFP_ATOMIC);
+	if (retval)
+		dev_err(&dev->dev, "%s - usb_submit_urb failed with result %d",
+			__func__, retval);
+}
+
+static int hanwang_open(struct input_dev *dev)
+{
+	struct hanwang *hanwang = input_get_drvdata(dev);
+
+	hanwang->irq->dev = hanwang->usbdev;
+	if (usb_submit_urb(hanwang->irq, GFP_KERNEL))
+		return -EIO;
+
+	return 0;
+}
+
+static void hanwang_close(struct input_dev *dev)
+{
+	struct hanwang *hanwang = input_get_drvdata(dev);
+
+	usb_kill_urb(hanwang->irq);
+}
+
+static bool get_features(struct usb_device *dev, struct hanwang *hanwang)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(features_array); i++) {
+		if (le16_to_cpu(dev->descriptor.idProduct) ==
+				features_array[i].pid) {
+			hanwang->features = &features_array[i];
+			return true;
+		}
+	}
+
+	return false;
+}
+
+
+static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct usb_endpoint_descriptor *endpoint;
+	struct hanwang *hanwang;
+	struct input_dev *input_dev;
+	int error;
+	int i;
+
+	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
+	hanwang = kzalloc_obj(*hanwang);
+	input_dev = input_allocate_device();
+	if (!hanwang || !input_dev) {
+		error = -ENOMEM;
+		goto fail1;
+	}
+
+	if (!get_features(dev, hanwang)) {
+		error = -ENXIO;
+		goto fail1;
+	}
+
+	hanwang->data = usb_alloc_coherent(dev, hanwang->features->pkg_len,
+					GFP_KERNEL, &hanwang->data_dma);
+	if (!hanwang->data) {
+		error = -ENOMEM;
+		goto fail1;
+	}
+
+	hanwang->irq = usb_alloc_urb(0, GFP_KERNEL);
+	if (!hanwang->irq) {
+		error = -ENOMEM;
+		goto fail2;
+	}
+
+	hanwang->usbdev = dev;
+	hanwang->dev = input_dev;
+
+	usb_make_path(dev, hanwang->phys, sizeof(hanwang->phys));
+	strlcat(hanwang->phys, "/input0", sizeof(hanwang->phys));
+
+	strscpy(hanwang->name, hanwang->features->name, sizeof(hanwang->name));
+	input_dev->name = hanwang->name;
+	input_dev->phys = hanwang->phys;
+	usb_to_input_id(dev, &input_dev->id);
+	input_dev->dev.parent = &intf->dev;
+
+	input_set_drvdata(input_dev, hanwang);
+
+	input_dev->open = hanwang_open;
+	input_dev->close = hanwang_close;
+
+	for (i = 0; i < ARRAY_SIZE(hw_eventtypes); ++i)
+		__set_bit(hw_eventtypes[i], input_dev->evbit);
+
+	for (i = 0; i < ARRAY_SIZE(hw_absevents); ++i)
+		__set_bit(hw_absevents[i], input_dev->absbit);
+
+	for (i = 0; i < ARRAY_SIZE(hw_btnevents); ++i)
+		__set_bit(hw_btnevents[i], input_dev->keybit);
+
+	for (i = 0; i < ARRAY_SIZE(hw_mscevents); ++i)
+		__set_bit(hw_mscevents[i], input_dev->mscbit);
+
+	input_set_abs_params(input_dev, ABS_X,
+			     0, hanwang->features->max_x, 4, 0);
+	input_set_abs_params(input_dev, ABS_Y,
+			     0, hanwang->features->max_y, 4, 0);
+	input_set_abs_params(input_dev, ABS_TILT_X,
+			     0, hanwang->features->max_tilt_x, 0, 0);
+	input_set_abs_params(input_dev, ABS_TILT_Y,
+			     0, hanwang->features->max_tilt_y, 0, 0);
+	input_set_abs_params(input_dev, ABS_PRESSURE,
+			     0, hanwang->features->max_pressure, 0, 0);
+
+	endpoint = &intf->cur_altsetting->endpoint[0].desc;
+	usb_fill_int_urb(hanwang->irq, dev,
+			usb_rcvintpipe(dev, endpoint->bEndpointAddress),
+			hanwang->data, hanwang->features->pkg_len,
+			hanwang_irq, hanwang, endpoint->bInterval);
+	hanwang->irq->transfer_dma = hanwang->data_dma;
+	hanwang->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+	error = input_register_device(hanwang->dev);
+	if (error)
+		goto fail3;
+
+	usb_set_intfdata(intf, hanwang);
+
+	return 0;
+
+ fail3:	usb_free_urb(hanwang->irq);
+ fail2:	usb_free_coherent(dev, hanwang->features->pkg_len,
+			hanwang->data, hanwang->data_dma);
+ fail1:	input_free_device(input_dev);
+	kfree(hanwang);
+	return error;
+
+}
+
+static void hanwang_disconnect(struct usb_interface *intf)
+{
+	struct hanwang *hanwang = usb_get_intfdata(intf);
+
+	input_unregister_device(hanwang->dev);
+	usb_free_urb(hanwang->irq);
+	usb_free_coherent(interface_to_usbdev(intf),
+			hanwang->features->pkg_len, hanwang->data,
+			hanwang->data_dma);
+	kfree(hanwang);
+	usb_set_intfdata(intf, NULL);
+}
+
+static const struct usb_device_id hanwang_ids[] = {
+	{ HANWANG_TABLET_DEVICE(USB_VENDOR_ID_HANWANG, HANWANG_TABLET_INT_CLASS,
+		HANWANG_TABLET_INT_SUB_CLASS, HANWANG_TABLET_INT_PROTOCOL) },
+	{}
+};
+
+MODULE_DEVICE_TABLE(usb, hanwang_ids);
+
+static struct usb_driver hanwang_driver = {
+	.name		= "hanwang",
+	.probe		= hanwang_probe,
+	.disconnect	= hanwang_disconnect,
+	.id_table	= hanwang_ids,
+};
+
+module_usb_driver(hanwang_driver);
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
new file mode 100644
index 000000000..6ce70c8e2
--- /dev/null
+++ b/drivers/input/tablet/kbtab.c
@@ -0,0 +1,204 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/usb/input.h>
+#include <linux/unaligned.h>
+
+/*
+ * Pressure-threshold modules param code from Alex Perry <alex.perry@ieee.org>
+ */
+
+MODULE_AUTHOR("Josh Myer <josh@joshisanerd.com>");
+MODULE_DESCRIPTION("USB KB Gear JamStudio Tablet driver");
+MODULE_LICENSE("GPL");
+
+#define USB_VENDOR_ID_KBGEAR	0x084e
+
+static int kb_pressure_click = 0x10;
+module_param(kb_pressure_click, int, 0);
+MODULE_PARM_DESC(kb_pressure_click, "pressure threshold for clicks");
+
+struct kbtab {
+	unsigned char *data;
+	dma_addr_t data_dma;
+	struct input_dev *dev;
+	struct usb_interface *intf;
+	struct urb *irq;
+	char phys[32];
+};
+
+static void kbtab_irq(struct urb *urb)
+{
+	struct kbtab *kbtab = urb->context;
+	unsigned char *data = kbtab->data;
+	struct input_dev *dev = kbtab->dev;
+	int pressure;
+	int retval;
+
+	switch (urb->status) {
+	case 0:
+		/* success */
+		break;
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* this urb is terminated, clean up */
+		dev_dbg(&kbtab->intf->dev,
+			"%s - urb shutting down with status: %d\n",
+			__func__, urb->status);
+		return;
+	default:
+		dev_dbg(&kbtab->intf->dev,
+			"%s - nonzero urb status received: %d\n",
+			__func__, urb->status);
+		goto exit;
+	}
+
+
+	input_report_key(dev, BTN_TOOL_PEN, 1);
+
+	input_report_abs(dev, ABS_X, get_unaligned_le16(&data[1]));
+	input_report_abs(dev, ABS_Y, get_unaligned_le16(&data[3]));
+
+	/*input_report_key(dev, BTN_TOUCH , data[0] & 0x01);*/
+	input_report_key(dev, BTN_RIGHT, data[0] & 0x02);
+
+	pressure = data[5];
+	if (kb_pressure_click == -1)
+		input_report_abs(dev, ABS_PRESSURE, pressure);
+	else
+		input_report_key(dev, BTN_LEFT, pressure > kb_pressure_click ? 1 : 0);
+
+	input_sync(dev);
+
+ exit:
+	retval = usb_submit_urb(urb, GFP_ATOMIC);
+	if (retval)
+		dev_err(&kbtab->intf->dev,
+			"%s - usb_submit_urb failed with result %d\n",
+			__func__, retval);
+}
+
+static const struct usb_device_id kbtab_ids[] = {
+	{ USB_DEVICE(USB_VENDOR_ID_KBGEAR, 0x1001), .driver_info = 0 },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(usb, kbtab_ids);
+
+static int kbtab_open(struct input_dev *dev)
+{
+	struct kbtab *kbtab = input_get_drvdata(dev);
+	struct usb_device *udev = interface_to_usbdev(kbtab->intf);
+
+	kbtab->irq->dev = udev;
+	if (usb_submit_urb(kbtab->irq, GFP_KERNEL))
+		return -EIO;
+
+	return 0;
+}
+
+static void kbtab_close(struct input_dev *dev)
+{
+	struct kbtab *kbtab = input_get_drvdata(dev);
+
+	usb_kill_urb(kbtab->irq);
+}
+
+static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct usb_endpoint_descriptor *endpoint;
+	struct kbtab *kbtab;
+	struct input_dev *input_dev;
+	int error = -ENOMEM;
+
+	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
+	endpoint = &intf->cur_altsetting->endpoint[0].desc;
+	if (!usb_endpoint_is_int_in(endpoint))
+		return -ENODEV;
+
+	kbtab = kzalloc_obj(*kbtab);
+	input_dev = input_allocate_device();
+	if (!kbtab || !input_dev)
+		goto fail1;
+
+	kbtab->data = usb_alloc_coherent(dev, 8, GFP_KERNEL, &kbtab->data_dma);
+	if (!kbtab->data)
+		goto fail1;
+
+	kbtab->irq = usb_alloc_urb(0, GFP_KERNEL);
+	if (!kbtab->irq)
+		goto fail2;
+
+	kbtab->intf = intf;
+	kbtab->dev = input_dev;
+
+	usb_make_path(dev, kbtab->phys, sizeof(kbtab->phys));
+	strlcat(kbtab->phys, "/input0", sizeof(kbtab->phys));
+
+	input_dev->name = "KB Gear Tablet";
+	input_dev->phys = kbtab->phys;
+	usb_to_input_id(dev, &input_dev->id);
+	input_dev->dev.parent = &intf->dev;
+
+	input_set_drvdata(input_dev, kbtab);
+
+	input_dev->open = kbtab_open;
+	input_dev->close = kbtab_close;
+
+	input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+	input_dev->keybit[BIT_WORD(BTN_LEFT)] |=
+		BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_RIGHT);
+	input_dev->keybit[BIT_WORD(BTN_DIGI)] |=
+		BIT_MASK(BTN_TOOL_PEN) | BIT_MASK(BTN_TOUCH);
+	input_set_abs_params(input_dev, ABS_X, 0, 0x2000, 4, 0);
+	input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0);
+	input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0);
+
+	usb_fill_int_urb(kbtab->irq, dev,
+			 usb_rcvintpipe(dev, endpoint->bEndpointAddress),
+			 kbtab->data, 8,
+			 kbtab_irq, kbtab, endpoint->bInterval);
+	kbtab->irq->transfer_dma = kbtab->data_dma;
+	kbtab->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+	error = input_register_device(kbtab->dev);
+	if (error)
+		goto fail3;
+
+	usb_set_intfdata(intf, kbtab);
+
+	return 0;
+
+ fail3:	usb_free_urb(kbtab->irq);
+ fail2:	usb_free_coherent(dev, 8, kbtab->data, kbtab->data_dma);
+ fail1:	input_free_device(input_dev);
+	kfree(kbtab);
+	return error;
+}
+
+static void kbtab_disconnect(struct usb_interface *intf)
+{
+	struct kbtab *kbtab = usb_get_intfdata(intf);
+	struct usb_device *udev = interface_to_usbdev(intf);
+
+	usb_set_intfdata(intf, NULL);
+
+	input_unregister_device(kbtab->dev);
+	usb_free_urb(kbtab->irq);
+	usb_free_coherent(udev, 8, kbtab->data, kbtab->data_dma);
+	kfree(kbtab);
+}
+
+static struct usb_driver kbtab_driver = {
+	.name =		"kbtab",
+	.probe =	kbtab_probe,
+	.disconnect =	kbtab_disconnect,
+	.id_table =	kbtab_ids,
+};
+
+module_usb_driver(kbtab_driver);
diff --git a/drivers/input/tablet/pegasus_notetaker.c b/drivers/input/tablet/pegasus_notetaker.c
new file mode 100644
index 000000000..85390ae42
--- /dev/null
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -0,0 +1,490 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Pegasus Mobile Notetaker Pen input tablet driver
+ *
+ * Copyright (c) 2016 Martin Kepplinger <martink@posteo.de>
+ */
+
+/*
+ * request packet (control endpoint):
+ * |-------------------------------------|
+ * | Report ID | Nr of bytes | command   |
+ * | (1 byte)  | (1 byte)    | (n bytes) |
+ * |-------------------------------------|
+ * | 0x02      | n           |           |
+ * |-------------------------------------|
+ *
+ * data packet after set xy mode command, 0x80 0xb5 0x02 0x01
+ * and pen is in range:
+ *
+ * byte	byte name		value (bits)
+ * --------------------------------------------
+ * 0	status			0 1 0 0 0 0 X X
+ * 1	color			0 0 0 0 H 0 S T
+ * 2	X low
+ * 3	X high
+ * 4	Y low
+ * 5	Y high
+ *
+ * X X	battery state:
+ *	no state reported	0x00
+ *	battery low		0x01
+ *	battery good		0x02
+ *
+ * H	Hovering
+ * S	Switch 1 (pen button)
+ * T	Tip
+ */
+
+#include <linux/hid.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/input.h>
+#include <linux/usb/input.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <linux/mutex.h>
+
+#define USB_VENDOR_ID_PEGASUSTECH	0x0e20
+#define USB_DEVICE_ID_PEGASUS_NOTETAKER_EN100	0x0101
+
+/* device specific defines */
+#define NOTETAKER_REPORT_ID		0x02
+#define NOTETAKER_SET_CMD		0x80
+#define NOTETAKER_SET_MODE		0xb5
+
+#define NOTETAKER_LED_MOUSE		0x02
+#define PEN_MODE_XY			0x01
+
+#define SPECIAL_COMMAND			0x80
+#define BUTTON_PRESSED			0xb5
+#define COMMAND_VERSION			0xa9
+
+/* 1 Status + 1 Color + 2 X + 2 Y = 6 bytes */
+#define NOTETAKER_PACKET_SIZE		6
+
+/* in xy data packet */
+#define BATTERY_NO_REPORT		0x40
+#define BATTERY_LOW			0x41
+#define BATTERY_GOOD			0x42
+#define PEN_BUTTON_PRESSED		BIT(1)
+#define PEN_TIP				BIT(0)
+
+struct pegasus {
+	unsigned char *data;
+	u8 data_len;
+	dma_addr_t data_dma;
+	struct input_dev *dev;
+	struct usb_device *usbdev;
+	struct usb_interface *intf;
+	struct urb *irq;
+
+	/* serialize access to open/suspend */
+	struct mutex pm_mutex;
+	bool is_open;
+
+	char name[128];
+	char phys[64];
+	struct work_struct init;
+};
+
+static int pegasus_control_msg(struct pegasus *pegasus, u8 *data, int len)
+{
+	const int sizeof_buf = len + 2;
+	int result;
+	int error;
+	u8 *cmd_buf;
+
+	cmd_buf = kmalloc(sizeof_buf, GFP_KERNEL);
+	if (!cmd_buf)
+		return -ENOMEM;
+
+	cmd_buf[0] = NOTETAKER_REPORT_ID;
+	cmd_buf[1] = len;
+	memcpy(cmd_buf + 2, data, len);
+
+	result = usb_control_msg(pegasus->usbdev,
+				 usb_sndctrlpipe(pegasus->usbdev, 0),
+				 HID_REQ_SET_REPORT,
+				 USB_TYPE_VENDOR | USB_DIR_OUT,
+				 0, 0, cmd_buf, sizeof_buf,
+				 USB_CTRL_SET_TIMEOUT);
+
+	kfree(cmd_buf);
+
+	if (unlikely(result != sizeof_buf)) {
+		error = result < 0 ? result : -EIO;
+		dev_err(&pegasus->usbdev->dev, "control msg error: %d\n",
+			error);
+		return error;
+	}
+
+	return 0;
+}
+
+static int pegasus_set_mode(struct pegasus *pegasus, u8 mode, u8 led)
+{
+	u8 cmd[] = { NOTETAKER_SET_CMD, NOTETAKER_SET_MODE, led, mode };
+
+	return pegasus_control_msg(pegasus, cmd, sizeof(cmd));
+}
+
+static void pegasus_parse_packet(struct pegasus *pegasus)
+{
+	unsigned char *data = pegasus->data;
+	struct input_dev *dev = pegasus->dev;
+	u16 x, y;
+
+	switch (data[0]) {
+	case SPECIAL_COMMAND:
+		/* device button pressed */
+		if (data[1] == BUTTON_PRESSED)
+			schedule_work(&pegasus->init);
+
+		break;
+
+	/* xy data */
+	case BATTERY_LOW:
+		dev_warn_once(&dev->dev, "Pen battery low\n");
+		fallthrough;
+
+	case BATTERY_NO_REPORT:
+	case BATTERY_GOOD:
+		x = le16_to_cpup((__le16 *)&data[2]);
+		y = le16_to_cpup((__le16 *)&data[4]);
+
+		/* pen-up event */
+		if (x == 0 && y == 0)
+			break;
+
+		input_report_key(dev, BTN_TOUCH, data[1] & PEN_TIP);
+		input_report_key(dev, BTN_RIGHT, data[1] & PEN_BUTTON_PRESSED);
+		input_report_key(dev, BTN_TOOL_PEN, 1);
+		input_report_abs(dev, ABS_X, (s16)x);
+		input_report_abs(dev, ABS_Y, y);
+
+		input_sync(dev);
+		break;
+
+	default:
+		dev_warn_once(&pegasus->usbdev->dev,
+			      "unknown answer from device\n");
+	}
+}
+
+static void pegasus_irq(struct urb *urb)
+{
+	struct pegasus *pegasus = urb->context;
+	struct usb_device *dev = pegasus->usbdev;
+	int retval;
+
+	switch (urb->status) {
+	case 0:
+		pegasus_parse_packet(pegasus);
+		usb_mark_last_busy(pegasus->usbdev);
+		break;
+
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		dev_err(&dev->dev, "%s - urb shutting down with status: %d",
+			__func__, urb->status);
+		return;
+
+	default:
+		dev_err(&dev->dev, "%s - nonzero urb status received: %d",
+			__func__, urb->status);
+		break;
+	}
+
+	retval = usb_submit_urb(urb, GFP_ATOMIC);
+	if (retval)
+		dev_err(&dev->dev, "%s - usb_submit_urb failed with result %d",
+			__func__, retval);
+}
+
+static void pegasus_init(struct work_struct *work)
+{
+	struct pegasus *pegasus = container_of(work, struct pegasus, init);
+	int error;
+
+	error = pegasus_set_mode(pegasus, PEN_MODE_XY, NOTETAKER_LED_MOUSE);
+	if (error)
+		dev_err(&pegasus->usbdev->dev, "pegasus_set_mode error: %d\n",
+			error);
+}
+
+static int __pegasus_open(struct pegasus *pegasus)
+{
+	int error;
+
+	guard(mutex)(&pegasus->pm_mutex);
+
+	pegasus->irq->dev = pegasus->usbdev;
+	if (usb_submit_urb(pegasus->irq, GFP_KERNEL))
+		return -EIO;
+
+	error = pegasus_set_mode(pegasus, PEN_MODE_XY, NOTETAKER_LED_MOUSE);
+	if (error) {
+		usb_kill_urb(pegasus->irq);
+		cancel_work_sync(&pegasus->init);
+		return error;
+	}
+
+	pegasus->is_open = true;
+
+	return 0;
+}
+
+static int pegasus_open(struct input_dev *dev)
+{
+	struct pegasus *pegasus = input_get_drvdata(dev);
+	int error;
+
+	error = usb_autopm_get_interface(pegasus->intf);
+	if (error)
+		return error;
+
+	error = __pegasus_open(pegasus);
+	if (error) {
+		usb_autopm_put_interface(pegasus->intf);
+		return error;
+	}
+
+	return 0;
+}
+
+static void pegasus_close(struct input_dev *dev)
+{
+	struct pegasus *pegasus = input_get_drvdata(dev);
+
+	scoped_guard(mutex, &pegasus->pm_mutex) {
+		usb_kill_urb(pegasus->irq);
+		cancel_work_sync(&pegasus->init);
+
+		pegasus->is_open = false;
+	}
+
+	usb_autopm_put_interface(pegasus->intf);
+}
+
+static int pegasus_probe(struct usb_interface *intf,
+			 const struct usb_device_id *id)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct usb_endpoint_descriptor *endpoint;
+	struct pegasus *pegasus;
+	struct input_dev *input_dev;
+	int error;
+	int pipe;
+
+	/* We control interface 0 */
+	if (intf->cur_altsetting->desc.bInterfaceNumber >= 1)
+		return -ENODEV;
+
+	/* Sanity check that the device has an endpoint */
+	if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
+		dev_err(&intf->dev, "Invalid number of endpoints\n");
+		return -EINVAL;
+	}
+
+	endpoint = &intf->cur_altsetting->endpoint[0].desc;
+
+	pegasus = kzalloc_obj(*pegasus);
+	input_dev = input_allocate_device();
+	if (!pegasus || !input_dev) {
+		error = -ENOMEM;
+		goto err_free_mem;
+	}
+
+	mutex_init(&pegasus->pm_mutex);
+
+	pegasus->usbdev = dev;
+	pegasus->dev = input_dev;
+	pegasus->intf = intf;
+
+	pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
+	/* Sanity check that pipe's type matches endpoint's type */
+	if (usb_pipe_type_check(dev, pipe)) {
+		error = -EINVAL;
+		goto err_free_mem;
+	}
+
+	pegasus->data_len = usb_maxpacket(dev, pipe);
+	if (pegasus->data_len < NOTETAKER_PACKET_SIZE) {
+		dev_err(&intf->dev, "packet size is too small (%d)\n",
+			pegasus->data_len);
+		error = -EINVAL;
+		goto err_free_mem;
+	}
+
+	pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
+					   &pegasus->data_dma);
+	if (!pegasus->data) {
+		error = -ENOMEM;
+		goto err_free_mem;
+	}
+
+	pegasus->irq = usb_alloc_urb(0, GFP_KERNEL);
+	if (!pegasus->irq) {
+		error = -ENOMEM;
+		goto err_free_dma;
+	}
+
+	usb_fill_int_urb(pegasus->irq, dev, pipe,
+			 pegasus->data, pegasus->data_len,
+			 pegasus_irq, pegasus, endpoint->bInterval);
+
+	pegasus->irq->transfer_dma = pegasus->data_dma;
+	pegasus->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+	if (dev->manufacturer)
+		strscpy(pegasus->name, dev->manufacturer,
+			sizeof(pegasus->name));
+
+	if (dev->product) {
+		if (dev->manufacturer)
+			strlcat(pegasus->name, " ", sizeof(pegasus->name));
+		strlcat(pegasus->name, dev->product, sizeof(pegasus->name));
+	}
+
+	if (!strlen(pegasus->name))
+		snprintf(pegasus->name, sizeof(pegasus->name),
+			 "USB Pegasus Device %04x:%04x",
+			 le16_to_cpu(dev->descriptor.idVendor),
+			 le16_to_cpu(dev->descriptor.idProduct));
+
+	usb_make_path(dev, pegasus->phys, sizeof(pegasus->phys));
+	strlcat(pegasus->phys, "/input0", sizeof(pegasus->phys));
+
+	INIT_WORK(&pegasus->init, pegasus_init);
+
+	usb_set_intfdata(intf, pegasus);
+
+	input_dev->name = pegasus->name;
+	input_dev->phys = pegasus->phys;
+	usb_to_input_id(dev, &input_dev->id);
+	input_dev->dev.parent = &intf->dev;
+
+	input_set_drvdata(input_dev, pegasus);
+
+	input_dev->open = pegasus_open;
+	input_dev->close = pegasus_close;
+
+	__set_bit(EV_ABS, input_dev->evbit);
+	__set_bit(EV_KEY, input_dev->evbit);
+
+	__set_bit(ABS_X, input_dev->absbit);
+	__set_bit(ABS_Y, input_dev->absbit);
+
+	__set_bit(BTN_TOUCH, input_dev->keybit);
+	__set_bit(BTN_RIGHT, input_dev->keybit);
+	__set_bit(BTN_TOOL_PEN, input_dev->keybit);
+
+	__set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
+	__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
+
+	input_set_abs_params(input_dev, ABS_X, -1500, 1500, 8, 0);
+	input_set_abs_params(input_dev, ABS_Y, 1600, 3000, 8, 0);
+
+	error = input_register_device(pegasus->dev);
+	if (error)
+		goto err_free_urb;
+
+	return 0;
+
+err_free_urb:
+	usb_free_urb(pegasus->irq);
+err_free_dma:
+	usb_free_coherent(dev, pegasus->data_len,
+			  pegasus->data, pegasus->data_dma);
+err_free_mem:
+	input_free_device(input_dev);
+	kfree(pegasus);
+	usb_set_intfdata(intf, NULL);
+
+	return error;
+}
+
+static void pegasus_disconnect(struct usb_interface *intf)
+{
+	struct pegasus *pegasus = usb_get_intfdata(intf);
+
+	input_unregister_device(pegasus->dev);
+
+	usb_free_urb(pegasus->irq);
+	usb_free_coherent(interface_to_usbdev(intf),
+			  pegasus->data_len, pegasus->data,
+			  pegasus->data_dma);
+
+	kfree(pegasus);
+	usb_set_intfdata(intf, NULL);
+}
+
+static int pegasus_suspend(struct usb_interface *intf, pm_message_t message)
+{
+	struct pegasus *pegasus = usb_get_intfdata(intf);
+
+	guard(mutex)(&pegasus->pm_mutex);
+
+	usb_kill_urb(pegasus->irq);
+	cancel_work_sync(&pegasus->init);
+
+	return 0;
+}
+
+static int pegasus_resume(struct usb_interface *intf)
+{
+	struct pegasus *pegasus = usb_get_intfdata(intf);
+
+	guard(mutex)(&pegasus->pm_mutex);
+
+	if (pegasus->is_open && usb_submit_urb(pegasus->irq, GFP_NOIO) < 0)
+		return -EIO;
+
+	return 0;
+}
+
+static int pegasus_reset_resume(struct usb_interface *intf)
+{
+	struct pegasus *pegasus = usb_get_intfdata(intf);
+	int error;
+
+	guard(mutex)(&pegasus->pm_mutex);
+
+	if (pegasus->is_open) {
+		error = pegasus_set_mode(pegasus, PEN_MODE_XY,
+					  NOTETAKER_LED_MOUSE);
+		if (error)
+			return error;
+
+		if (usb_submit_urb(pegasus->irq, GFP_NOIO) < 0)
+			return -EIO;
+	}
+
+	return 0;
+}
+
+static const struct usb_device_id pegasus_ids[] = {
+	{ USB_DEVICE(USB_VENDOR_ID_PEGASUSTECH,
+		     USB_DEVICE_ID_PEGASUS_NOTETAKER_EN100) },
+	{ }
+};
+MODULE_DEVICE_TABLE(usb, pegasus_ids);
+
+static struct usb_driver pegasus_driver = {
+	.name		= "pegasus_notetaker",
+	.probe		= pegasus_probe,
+	.disconnect	= pegasus_disconnect,
+	.suspend	= pegasus_suspend,
+	.resume		= pegasus_resume,
+	.reset_resume	= pegasus_reset_resume,
+	.id_table	= pegasus_ids,
+	.supports_autosuspend = 1,
+};
+
+module_usb_driver(pegasus_driver);
+
+MODULE_AUTHOR("Martin Kepplinger <martink@posteo.de>");
+MODULE_DESCRIPTION("Pegasus Mobile Notetaker Pen tablet driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/tablet/wacom_serial4.c b/drivers/input/tablet/wacom_serial4.c
new file mode 100644
index 000000000..bc0c77e54
--- /dev/null
+++ b/drivers/input/tablet/wacom_serial4.c
@@ -0,0 +1,617 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Wacom protocol 4 serial tablet driver
+ *
+ * Copyright 2014      Hans de Goede <hdegoede@redhat.com>
+ * Copyright 2011-2012 Julian Squires <julian@cipht.net>
+ *
+ * Many thanks to Bill Seremetis, without whom PenPartner support
+ * would not have been possible. Thanks to Patrick Mahoney.
+ *
+ * This driver was developed with reference to much code written by others,
+ * particularly:
+ *  - elo, gunze drivers by Vojtech Pavlik <vojtech@ucw.cz>;
+ *  - wacom_w8001 driver by Jaya Kumar <jayakumar.lkml@gmail.com>;
+ *  - the USB wacom input driver, credited to many people
+ *    (see drivers/input/tablet/wacom.h);
+ *  - new and old versions of linuxwacom / xf86-input-wacom credited to
+ *    Frederic Lepied, France. <Lepied@XFree86.org> and
+ *    Ping Cheng, Wacom. <pingc@wacom.com>;
+ *  - and xf86wacom.c (a presumably ancient version of the linuxwacom code),
+ *    by Frederic Lepied and Raph Levien <raph@gtk.org>.
+ *
+ * To do:
+ *  - support pad buttons; (requires access to a model with pad buttons)
+ *  - support (protocol 4-style) tilt (requires access to a > 1.4 rom model)
+ */
+
+/*
+ * Wacom serial protocol 4 documentation taken from linuxwacom-0.9.9 code,
+ * protocol 4 uses 7 or 9 byte of data in the following format:
+ *
+ *	Byte 1
+ *	bit 7  Sync bit always 1
+ *	bit 6  Pointing device detected
+ *	bit 5  Cursor = 0 / Stylus = 1
+ *	bit 4  Reserved
+ *	bit 3  1 if a button on the pointing device has been pressed
+ *	bit 2  P0 (optional)
+ *	bit 1  X15
+ *	bit 0  X14
+ *
+ *	Byte 2
+ *	bit 7  Always 0
+ *	bits 6-0 = X13 - X7
+ *
+ *	Byte 3
+ *	bit 7  Always 0
+ *	bits 6-0 = X6 - X0
+ *
+ *	Byte 4
+ *	bit 7  Always 0
+ *	bit 6  B3
+ *	bit 5  B2
+ *	bit 4  B1
+ *	bit 3  B0
+ *	bit 2  P1 (optional)
+ *	bit 1  Y15
+ *	bit 0  Y14
+ *
+ *	Byte 5
+ *	bit 7  Always 0
+ *	bits 6-0 = Y13 - Y7
+ *
+ *	Byte 6
+ *	bit 7  Always 0
+ *	bits 6-0 = Y6 - Y0
+ *
+ *	Byte 7
+ *	bit 7 Always 0
+ *	bit 6  Sign of pressure data; or wheel-rel for cursor tool
+ *	bit 5  P7; or REL1 for cursor tool
+ *	bit 4  P6; or REL0 for cursor tool
+ *	bit 3  P5
+ *	bit 2  P4
+ *	bit 1  P3
+ *	bit 0  P2
+ *
+ *	byte 8 and 9 are optional and present only
+ *	in tilt mode.
+ *
+ *	Byte 8
+ *	bit 7 Always 0
+ *	bit 6 Sign of tilt X
+ *	bit 5  Xt6
+ *	bit 4  Xt5
+ *	bit 3  Xt4
+ *	bit 2  Xt3
+ *	bit 1  Xt2
+ *	bit 0  Xt1
+ *
+ *	Byte 9
+ *	bit 7 Always 0
+ *	bit 6 Sign of tilt Y
+ *	bit 5  Yt6
+ *	bit 4  Yt5
+ *	bit 3  Yt4
+ *	bit 2  Yt3
+ *	bit 1  Yt2
+ *	bit 0  Yt1
+ */
+
+#include <linux/completion.h>
+#include <linux/init.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/serio.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+
+MODULE_AUTHOR("Julian Squires <julian@cipht.net>, Hans de Goede <hdegoede@redhat.com>");
+MODULE_DESCRIPTION("Wacom protocol 4 serial tablet driver");
+MODULE_LICENSE("GPL");
+
+#define REQUEST_MODEL_AND_ROM_VERSION	"~#"
+#define REQUEST_MAX_COORDINATES		"~C\r"
+#define REQUEST_CONFIGURATION_STRING	"~R\r"
+#define REQUEST_RESET_TO_PROTOCOL_IV	"\r#"
+/*
+ * Note: sending "\r$\r" causes at least the Digitizer II to send
+ * packets in ASCII instead of binary.  "\r#" seems to undo that.
+ */
+
+#define COMMAND_START_SENDING_PACKETS		"ST\r"
+#define COMMAND_STOP_SENDING_PACKETS		"SP\r"
+#define COMMAND_MULTI_MODE_INPUT		"MU1\r"
+#define COMMAND_ORIGIN_IN_UPPER_LEFT		"OC1\r"
+#define COMMAND_ENABLE_ALL_MACRO_BUTTONS	"~M0\r"
+#define COMMAND_DISABLE_GROUP_1_MACRO_BUTTONS	"~M1\r"
+#define COMMAND_TRANSMIT_AT_MAX_RATE		"IT0\r"
+#define COMMAND_DISABLE_INCREMENTAL_MODE	"IN0\r"
+#define COMMAND_ENABLE_CONTINUOUS_MODE		"SR\r"
+#define COMMAND_ENABLE_PRESSURE_MODE		"PH1\r"
+#define COMMAND_Z_FILTER			"ZF1\r"
+
+/* Note that this is a protocol 4 packet without tilt information. */
+#define PACKET_LENGTH		7
+#define DATA_SIZE		32
+
+/* flags */
+#define F_COVERS_SCREEN		0x01
+#define F_HAS_STYLUS2		0x02
+#define F_HAS_SCROLLWHEEL	0x04
+
+/* device IDs */
+#define STYLUS_DEVICE_ID	0x02
+#define CURSOR_DEVICE_ID	0x06
+#define ERASER_DEVICE_ID	0x0A
+
+enum { STYLUS = 1, ERASER, CURSOR };
+
+static const struct {
+	int device_id;
+	int input_id;
+} tools[] = {
+	{ 0, 0 },
+	{ STYLUS_DEVICE_ID, BTN_TOOL_PEN },
+	{ ERASER_DEVICE_ID, BTN_TOOL_RUBBER },
+	{ CURSOR_DEVICE_ID, BTN_TOOL_MOUSE },
+};
+
+struct wacom {
+	struct input_dev *dev;
+	struct completion cmd_done;
+	int result;
+	u8 expect;
+	u8 eraser_mask;
+	unsigned int extra_z_bits;
+	unsigned int flags;
+	unsigned int res_x, res_y;
+	unsigned int max_x, max_y;
+	unsigned int tool;
+	unsigned int idx;
+	u8 data[DATA_SIZE];
+	char phys[32];
+};
+
+enum {
+	MODEL_CINTIQ		= 0x504C, /* PL */
+	MODEL_CINTIQ2		= 0x4454, /* DT */
+	MODEL_DIGITIZER_II	= 0x5544, /* UD */
+	MODEL_GRAPHIRE		= 0x4554, /* ET */
+	MODEL_PENPARTNER	= 0x4354, /* CT */
+	MODEL_ARTPAD_II		= 0x4B54, /* KT */
+};
+
+static void wacom_handle_model_response(struct wacom *wacom)
+{
+	int major_v, minor_v, r = 0;
+	char *p;
+
+	p = strrchr(wacom->data, 'V');
+	if (p)
+		r = sscanf(p + 1, "%u.%u", &major_v, &minor_v);
+	if (r != 2)
+		major_v = minor_v = 0;
+
+	switch (wacom->data[2] << 8 | wacom->data[3]) {
+	case MODEL_CINTIQ:	/* UNTESTED */
+	case MODEL_CINTIQ2:
+		if ((wacom->data[2] << 8 | wacom->data[3]) == MODEL_CINTIQ) {
+			wacom->dev->name = "Wacom Cintiq";
+			wacom->dev->id.version = MODEL_CINTIQ;
+		} else {
+			wacom->dev->name = "Wacom Cintiq II";
+			wacom->dev->id.version = MODEL_CINTIQ2;
+		}
+		wacom->res_x = 508;
+		wacom->res_y = 508;
+
+		switch (wacom->data[5] << 8 | wacom->data[6]) {
+		case 0x3731: /* PL-710 */
+			wacom->res_x = 2540;
+			wacom->res_y = 2540;
+			fallthrough;
+		case 0x3535: /* PL-550 */
+		case 0x3830: /* PL-800 */
+			wacom->extra_z_bits = 2;
+		}
+
+		wacom->flags = F_COVERS_SCREEN;
+		break;
+
+	case MODEL_PENPARTNER:
+		wacom->dev->name = "Wacom Penpartner";
+		wacom->dev->id.version = MODEL_PENPARTNER;
+		wacom->res_x = 1000;
+		wacom->res_y = 1000;
+		break;
+
+	case MODEL_GRAPHIRE:
+		wacom->dev->name = "Wacom Graphire";
+		wacom->dev->id.version = MODEL_GRAPHIRE;
+		wacom->res_x = 1016;
+		wacom->res_y = 1016;
+		wacom->max_x = 5103;
+		wacom->max_y = 3711;
+		wacom->extra_z_bits = 2;
+		wacom->eraser_mask = 0x08;
+		wacom->flags = F_HAS_STYLUS2 | F_HAS_SCROLLWHEEL;
+		break;
+
+	case MODEL_ARTPAD_II:
+	case MODEL_DIGITIZER_II:
+		wacom->dev->name = "Wacom Digitizer II";
+		wacom->dev->id.version = MODEL_DIGITIZER_II;
+		if (major_v == 1 && minor_v <= 2)
+			wacom->extra_z_bits = 0; /* UNTESTED */
+		break;
+
+	default:
+		dev_err(&wacom->dev->dev, "Unsupported Wacom model %s\n",
+			wacom->data);
+		wacom->result = -ENODEV;
+		return;
+	}
+
+	dev_info(&wacom->dev->dev, "%s tablet, version %u.%u\n",
+		 wacom->dev->name, major_v, minor_v);
+}
+
+static void wacom_handle_configuration_response(struct wacom *wacom)
+{
+	int r, skip;
+
+	dev_dbg(&wacom->dev->dev, "Configuration string: %s\n", wacom->data);
+	r = sscanf(wacom->data, "~R%x,%u,%u,%u,%u", &skip, &skip, &skip,
+		   &wacom->res_x, &wacom->res_y);
+	if (r != 5)
+		dev_warn(&wacom->dev->dev, "could not get resolution\n");
+}
+
+static void wacom_handle_coordinates_response(struct wacom *wacom)
+{
+	int r;
+
+	dev_dbg(&wacom->dev->dev, "Coordinates string: %s\n", wacom->data);
+	r = sscanf(wacom->data, "~C%u,%u", &wacom->max_x, &wacom->max_y);
+	if (r != 2)
+		dev_warn(&wacom->dev->dev, "could not get max coordinates\n");
+}
+
+static void wacom_handle_response(struct wacom *wacom)
+{
+	if (wacom->data[0] != '~' || wacom->data[1] != wacom->expect) {
+		dev_err(&wacom->dev->dev,
+			"Wacom got an unexpected response: %s\n", wacom->data);
+		wacom->result = -EIO;
+	} else {
+		wacom->result = 0;
+
+		switch (wacom->data[1]) {
+		case '#':
+			wacom_handle_model_response(wacom);
+			break;
+		case 'R':
+			wacom_handle_configuration_response(wacom);
+			break;
+		case 'C':
+			wacom_handle_coordinates_response(wacom);
+			break;
+		}
+	}
+
+	complete(&wacom->cmd_done);
+}
+
+static void wacom_handle_packet(struct wacom *wacom)
+{
+	u8 in_proximity_p, stylus_p, button;
+	unsigned int tool;
+	int x, y, z;
+
+	in_proximity_p = wacom->data[0] & 0x40;
+	stylus_p = wacom->data[0] & 0x20;
+	button = (wacom->data[3] & 0x78) >> 3;
+	x = (wacom->data[0] & 3) << 14 | wacom->data[1]<<7 | wacom->data[2];
+	y = (wacom->data[3] & 3) << 14 | wacom->data[4]<<7 | wacom->data[5];
+
+	if (in_proximity_p && stylus_p) {
+		z = wacom->data[6] & 0x7f;
+		if (wacom->extra_z_bits >= 1)
+			z = z << 1 | (wacom->data[3] & 0x4) >> 2;
+		if (wacom->extra_z_bits > 1)
+			z = z << 1 | (wacom->data[0] & 0x4) >> 2;
+		z = z ^ (0x40 << wacom->extra_z_bits);
+	} else {
+		z = -1;
+	}
+
+	if (stylus_p)
+		tool = (button & wacom->eraser_mask) ? ERASER : STYLUS;
+	else
+		tool = CURSOR;
+
+	if (tool != wacom->tool && wacom->tool != 0) {
+		input_report_key(wacom->dev, tools[wacom->tool].input_id, 0);
+		input_sync(wacom->dev);
+	}
+	wacom->tool = tool;
+
+	input_report_key(wacom->dev, tools[tool].input_id, in_proximity_p);
+	input_report_abs(wacom->dev, ABS_MISC,
+			 in_proximity_p ? tools[tool].device_id : 0);
+	input_report_abs(wacom->dev, ABS_X, x);
+	input_report_abs(wacom->dev, ABS_Y, y);
+	input_report_abs(wacom->dev, ABS_PRESSURE, z);
+	if (stylus_p) {
+		input_report_key(wacom->dev, BTN_TOUCH, button & 1);
+		input_report_key(wacom->dev, BTN_STYLUS, button & 2);
+		input_report_key(wacom->dev, BTN_STYLUS2, button & 4);
+	} else {
+		input_report_key(wacom->dev, BTN_LEFT, button & 1);
+		input_report_key(wacom->dev, BTN_RIGHT, button & 2);
+		input_report_key(wacom->dev, BTN_MIDDLE, button & 4);
+		/* handle relative wheel for non-stylus device */
+		z = (wacom->data[6] & 0x30) >> 4;
+		if (wacom->data[6] & 0x40)
+			z = -z;
+		input_report_rel(wacom->dev, REL_WHEEL, z);
+	}
+	input_sync(wacom->dev);
+}
+
+static void wacom_clear_data_buf(struct wacom *wacom)
+{
+	memset(wacom->data, 0, DATA_SIZE);
+	wacom->idx = 0;
+}
+
+static irqreturn_t wacom_interrupt(struct serio *serio, unsigned char data,
+				   unsigned int flags)
+{
+	struct wacom *wacom = serio_get_drvdata(serio);
+
+	if (data & 0x80)
+		wacom->idx = 0;
+
+	/*
+	 * We're either expecting a carriage return-terminated ASCII
+	 * response string, or a seven-byte packet with the MSB set on
+	 * the first byte.
+	 *
+	 * Note however that some tablets (the PenPartner, for
+	 * example) don't send a carriage return at the end of a
+	 * command.  We handle these by waiting for timeout.
+	 */
+	if (data == '\r' && !(wacom->data[0] & 0x80)) {
+		wacom_handle_response(wacom);
+		wacom_clear_data_buf(wacom);
+		return IRQ_HANDLED;
+	}
+
+	/* Leave place for 0 termination */
+	if (wacom->idx > (DATA_SIZE - 2)) {
+		dev_dbg(&wacom->dev->dev,
+			"throwing away %d bytes of garbage\n", wacom->idx);
+		wacom_clear_data_buf(wacom);
+	}
+	wacom->data[wacom->idx++] = data;
+
+	if (wacom->idx == PACKET_LENGTH && (wacom->data[0] & 0x80)) {
+		wacom_handle_packet(wacom);
+		wacom_clear_data_buf(wacom);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static void wacom_disconnect(struct serio *serio)
+{
+	struct wacom *wacom = serio_get_drvdata(serio);
+
+	serio_close(serio);
+	serio_set_drvdata(serio, NULL);
+	input_unregister_device(wacom->dev);
+	kfree(wacom);
+}
+
+static int wacom_send(struct serio *serio, const u8 *command)
+{
+	int err = 0;
+
+	for (; !err && *command; command++)
+		err = serio_write(serio, *command);
+
+	return err;
+}
+
+static int wacom_send_setup_string(struct wacom *wacom, struct serio *serio)
+{
+	const u8 *cmd;
+
+	switch (wacom->dev->id.version) {
+	case MODEL_CINTIQ:	/* UNTESTED */
+		cmd = COMMAND_ORIGIN_IN_UPPER_LEFT
+			COMMAND_TRANSMIT_AT_MAX_RATE
+			COMMAND_ENABLE_CONTINUOUS_MODE
+			COMMAND_START_SENDING_PACKETS;
+		break;
+
+	case MODEL_PENPARTNER:
+		cmd = COMMAND_ENABLE_PRESSURE_MODE
+			COMMAND_START_SENDING_PACKETS;
+		break;
+
+	default:
+		cmd = COMMAND_MULTI_MODE_INPUT
+			COMMAND_ORIGIN_IN_UPPER_LEFT
+			COMMAND_ENABLE_ALL_MACRO_BUTTONS
+			COMMAND_DISABLE_GROUP_1_MACRO_BUTTONS
+			COMMAND_TRANSMIT_AT_MAX_RATE
+			COMMAND_DISABLE_INCREMENTAL_MODE
+			COMMAND_ENABLE_CONTINUOUS_MODE
+			COMMAND_Z_FILTER
+			COMMAND_START_SENDING_PACKETS;
+		break;
+	}
+
+	return wacom_send(serio, cmd);
+}
+
+static int wacom_send_and_wait(struct wacom *wacom, struct serio *serio,
+			       const u8 *cmd, const char *desc)
+{
+	int err;
+	unsigned long u;
+
+	wacom->expect = cmd[1];
+	init_completion(&wacom->cmd_done);
+
+	err = wacom_send(serio, cmd);
+	if (err)
+		return err;
+
+	u = wait_for_completion_timeout(&wacom->cmd_done, HZ);
+	if (u == 0) {
+		/* Timeout, process what we've received. */
+		wacom_handle_response(wacom);
+	}
+
+	wacom->expect = 0;
+	return wacom->result;
+}
+
+static int wacom_setup(struct wacom *wacom, struct serio *serio)
+{
+	int err;
+
+	/* Note that setting the link speed is the job of inputattach.
+	 * We assume that reset negotiation has already happened,
+	 * here. */
+	err = wacom_send_and_wait(wacom, serio, REQUEST_MODEL_AND_ROM_VERSION,
+				  "model and version");
+	if (err)
+		return err;
+
+	if (!(wacom->res_x && wacom->res_y)) {
+		err = wacom_send_and_wait(wacom, serio,
+					  REQUEST_CONFIGURATION_STRING,
+					  "configuration string");
+		if (err)
+			return err;
+	}
+
+	if (!(wacom->max_x && wacom->max_y)) {
+		err = wacom_send_and_wait(wacom, serio,
+					  REQUEST_MAX_COORDINATES,
+					  "coordinates string");
+		if (err)
+			return err;
+	}
+
+	return wacom_send_setup_string(wacom, serio);
+}
+
+static int wacom_connect(struct serio *serio, struct serio_driver *drv)
+{
+	struct wacom *wacom;
+	struct input_dev *input_dev;
+	int err = -ENOMEM;
+
+	wacom = kzalloc_obj(*wacom);
+	input_dev = input_allocate_device();
+	if (!wacom || !input_dev)
+		goto free_device;
+
+	wacom->dev = input_dev;
+	wacom->extra_z_bits = 1;
+	wacom->eraser_mask = 0x04;
+	wacom->tool = wacom->idx = 0;
+	snprintf(wacom->phys, sizeof(wacom->phys), "%s/input0", serio->phys);
+	input_dev->phys = wacom->phys;
+	input_dev->id.bustype = BUS_RS232;
+	input_dev->id.vendor  = SERIO_WACOM_IV;
+	input_dev->id.product = serio->id.extra;
+	input_dev->dev.parent = &serio->dev;
+
+	input_dev->evbit[0] =
+		BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS) | BIT_MASK(EV_REL);
+	set_bit(ABS_MISC, input_dev->absbit);
+	set_bit(BTN_TOOL_PEN, input_dev->keybit);
+	set_bit(BTN_TOOL_RUBBER, input_dev->keybit);
+	set_bit(BTN_TOOL_MOUSE, input_dev->keybit);
+	set_bit(BTN_TOUCH, input_dev->keybit);
+	set_bit(BTN_STYLUS, input_dev->keybit);
+	set_bit(BTN_LEFT, input_dev->keybit);
+	set_bit(BTN_RIGHT, input_dev->keybit);
+	set_bit(BTN_MIDDLE, input_dev->keybit);
+
+	serio_set_drvdata(serio, wacom);
+
+	err = serio_open(serio, drv);
+	if (err)
+		goto free_device;
+
+	err = wacom_setup(wacom, serio);
+	if (err)
+		goto close_serio;
+
+	set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
+	if (!(wacom->flags & F_COVERS_SCREEN))
+		__set_bit(INPUT_PROP_POINTER, input_dev->propbit);
+
+	if (wacom->flags & F_HAS_STYLUS2)
+		__set_bit(BTN_STYLUS2, input_dev->keybit);
+
+	if (wacom->flags & F_HAS_SCROLLWHEEL)
+		__set_bit(REL_WHEEL, input_dev->relbit);
+
+	input_abs_set_res(wacom->dev, ABS_X, wacom->res_x);
+	input_abs_set_res(wacom->dev, ABS_Y, wacom->res_y);
+	input_set_abs_params(wacom->dev, ABS_X, 0, wacom->max_x, 0, 0);
+	input_set_abs_params(wacom->dev, ABS_Y, 0, wacom->max_y, 0, 0);
+	input_set_abs_params(wacom->dev, ABS_PRESSURE, -1,
+			     (1 << (7 + wacom->extra_z_bits)) - 1, 0, 0);
+
+	err = input_register_device(wacom->dev);
+	if (err)
+		goto close_serio;
+
+	return 0;
+
+close_serio:
+	serio_close(serio);
+free_device:
+	serio_set_drvdata(serio, NULL);
+	input_free_device(input_dev);
+	kfree(wacom);
+	return err;
+}
+
+static const struct serio_device_id wacom_serio_ids[] = {
+	{
+		.type	= SERIO_RS232,
+		.proto	= SERIO_WACOM_IV,
+		.id	= SERIO_ANY,
+		.extra	= SERIO_ANY,
+	},
+	{ 0 }
+};
+
+MODULE_DEVICE_TABLE(serio, wacom_serio_ids);
+
+static struct serio_driver wacom_drv = {
+	.driver		= {
+		.name	= "wacom_serial4",
+	},
+	.description	= "Wacom protocol 4 serial tablet driver",
+	.id_table	= wacom_serio_ids,
+	.interrupt	= wacom_interrupt,
+	.connect	= wacom_connect,
+	.disconnect	= wacom_disconnect,
+};
+
+module_serio_driver(wacom_drv);