/dev/usb/ven

From WiiBrew
< /dev‎ | usb
Jump to navigation Jump to search

/dev/usb/ven is an IOS resource manager that is used to interact with USB devices. This device is implemented only in IOS57, 58 and 59 by the USB_VEN module, which is a thin wrapper around /dev/usb/usb. It replaces /dev/usb/oh0, which is repurposed as an internal USB backend in these versions.

VEN is often used by official games to communicate with USB cameras (such as Your Shape) and microphones (in the newer singing games). It is also used by libogc for USB2 support.

All buffers must be in MEM2 (addr > 0x10000000) and aligned to a 32-byte boundary. For all of the ioctlvs, the first buffer must be 64 bytes long.

Only IOS_OPEN, IOS_CLOSE, IOS_IOCTL and IOS_IOCTLV are valid commands. The other commands immediately return IPC_EINVAL (-4).

Note: The device needs to be "resumed" (ioctl 0x10 SuspendResume) before data can be sent/received, or even before ioctl 3 GetDeviceInfo can be used (at least for /dev/usb/hid).

Handles

Up to 16 handles can be opened, each with their own device change hook. The handle ID is specified in the open request as the "mode". IPC_EINVAL will be returned if an ID that is in use is passed.

For devices with multiple interfaces, each interface is presented as a unique device with its own handle.

Ioctls

Ioctl Name Input Output Notes
0 GetVersion None

32 bytes

0-4: version (0x50001)

1 GetDeviceChange None

Entry[32] (0x180 bytes)

For each entry:

0-1: IPC request address >> 8
1-2: Device index (0 to 31)
2-4: Device number
4-6: VID
6-8: PID
8-10: Device number
10-11: Interface number
11-12: Number of alternate settings

Set up a device insertion/removal callback. Returns the number of entries.

When a callback is triggered, the manager is locked to the caller handle and will not trigger other callbacks until AttachFinish is called. Other handlers will receive an IOS_EINVAL when attempting to modify device information.

Note that this ioctl immediately returns on the first call.

Behind the scenes, VEN keeps track of the device list (which can handle up to 32 devices) by issuing (async) ioctl 1 to /dev/usb/usb and updating its internal list on reply.

2 Shutdown None None Releases the device change callback with 0 as return code.
3 GetDeviceInfo

0x20 bytes

1-2: Device index
2-4: Device number

(0-4 is considered as a whole as the device ID, but IOS only cares about these two values.)

0xc0 bytes (memset to 0)

0-4: Device ID
4-8: Unknown byte from ioctl_2_out_buffer[5]
20-40: Device descriptor
40-52: Config descriptor
52-64: Interface descriptor
64-72: Endpoint descriptors (interface.bNumEndpoints times)

Get USB descriptors for a device. Behind the scenes, calls /dev/usb/usb ioctl 2 (input: internal ID, output: descriptors) and copies information to the output buffer and the internal device struct (must be called before a device can be used).

The descriptor structures match the ones used by libusb (with padding).

4 Attach 0x20 bytes

1-2: Device index
2-4: Device number

None Attaches the provided device to the current handle.
5 Release 0x20 bytes

1-2: Device index
2-4: Device number

None Releases the provided device from the current handle. IPC_EINVAL is returned if a device does not belong to the caller handle.

May trigger change callbacks and reissue /dev/usb/usb ioctl 1 in some conditions.

6 AttachFinish None None Unlocks the manager from the current handle, triggers change callbacks for the other active handles and issues /dev/usb/usb ioctl 1 in some cases.

If the caller handle does not match the one that locked the manager, IOS_EINVAL is returned.

7 SetAlternateSetting 0x20 bytes

1-2: Device index
2-4: Device number
8-9: Alternate setting

None Set the active alternate setting for a device.

Internally, this issues /dev/usb/usb ioctl 2 to get descriptors, loops over all endpoints and calls OHCI0/EHC ioctl 5 if (bmAttributes & 3) == 1 (if this is an isochronous endpoint?). If all ioctls succeed, VEN calls OHCI0/EHC ioctl 0x11 with the device ID, alt setting and bInterfaceNumber (+ other unknown values).

8 ? 0x20 bytes

1-2: Device index
2-4: Device number

None calls /dev/usb/usb ioctl 3
0x10 SuspendResume 0x20 bytes

1-2: Device index
2-4: Device number
11-12: State (1 to resume, 0 to suspend)

None Suspend or resume a device.

Calls /dev/usb/usb ioctl 4. If the call was successful, updates the internal device struct to reflect the state change. The device must belong to the caller handle and the new state must not be the same as the current one; otherwise IPC_EINVAL will be returned.

0x11 CancelEndpoint 0x20 bytes

1-2: Device index
2-4: Device number
8-9: Endpoint [check]

None calls USB backend (EHC or OHCI0) ioctl 0x10
0x12 (ioctlv) CtrlTransfer 1 in / 1 io or 2 in / 0 io Submit a control transfer to a device.

calls USB backend (EHC or OHCI0) ioctl 0x11

0x13 (ioctlv) IntrTransfer 1 in / 1 io or 2 in / 0 io Submit an interrupt transfer to a device.

calls USB backend (EHC or OHCI0) ioctl 0x12

0x14 (ioctlv) IsoTransfer 2 in / 2 io or 3 in / 1 io Submit an isochronous transfer to a device.

calls USB backend (EHC or OHCI0) ioctl 0x13

0x15 (ioctlv) BulkTransfer ? Submit a bulk transfer to a device.

calls USB backend (EHC or OHCI0) ioctl 0x14