/dev/usb/ven

/dev/usb/ven is an IOS resource manager that is used to interact with USB devices. This device is implemented only in IOS57, 58 and 59 by the USB_VEN module, which is a thin wrapper around /dev/usb/usb. It replaces /dev/usb/oh0, which is repurposed as an internal USB backend in these versions.

VEN is often used by official games to communicate with USB cameras (such as Your Shape) and microphones (in the newer singing games). It is also used by libogc for USB2 support.

All buffers must be in MEM2 (addr > 0x10000000) and aligned to a 32-byte boundary. For all of the ioctlvs, the first buffer must be 64 bytes long.

Only IOS_OPEN, IOS_CLOSE, IOS_IOCTL and IOS_IOCTLV are valid commands. The other commands immediately return IPC_EINVAL (-4).

Handles

Up to 16 handles can be opened, each with their own device change hook. The handle ID is specified in the open request as the "mode". IPC_EINVAL will be returned if an ID that is in use is passed.

Ioctls

Ioctl	Name	Input	Output	Notes
0	GetVersion	None	32 bytes 0-4: version (0x50001)
1	GetDeviceChange	None	Entry[32] (0x180 bytes) For each entry: 0-1: IPC request address >> 8 1-2: Device index (0 to 31) 2-4: Device number 4-6: VID 6-8: PID 8-10: Device number 10-11: Interface number 11-12: Number of alternate settings	Set up a device insertion/removal callback. Returns the number of entries. Note that this ioctl immediately returns on the first call. Behind the scenes, VEN keeps track of the device list (which can handle up to 32 devices) by issuing (async) ioctl 1 to /dev/usb/usb and updating its internal list on reply.
2	Shutdown	None	None	Releases the device change callback with 0 as return code.
3	GetDeviceInfo	0x20 bytes 1-2: Device index 2-4: Device number (0-4 is considered as a whole as the device ID, but IOS only cares about these two values.)	0xc0 bytes (memset to 0) 20-40: Device descriptor 40-52: Config descriptor 52-64: Interface descriptor 64-72: Endpoint descriptors (interface.bNumEndpoints times)	Get USB descriptors for a device. Behind the scenes, calls /dev/usb/usb ioctl 2 (input: internal ID, output: descriptors) and copies information to the output buffer and the internal device struct. The descriptor structures match the ones used by libusb (with padding).
4	?	0x20 bytes 1-2: Device index 2-4: Device number	None	? (related to callbacks) [check]
5	?	0x20 bytes 1-2: Device index 2-4: Device number	None	? (related to callbacks) [check] The caller handle must match a stored ID (?) May trigger change callbacks and reissue /dev/usb/usb ioctl 1 in some conditions.
6	AttachFinish	None	None	The caller handle must match a stored ID (?) If it does, IPC_SUCCESS is returned, change callbacks are triggered and /dev/usb/usb ioctl 1 is issued.
7	SetAlternateSetting	0x20 bytes 1-2: Device index 2-4: Device number 8-12: Alternate setting	None	Set the active alternate setting for a device. Internally, this issues /dev/usb/usb ioctl 2 to get descriptors, loops over all endpoints and calls /dev/usb/usb ioctl 5 if (bmAttributes & 3) == 1. If all ioctls succeed, VEN calls /dev/usb/usb ioctl 0x11 with the device ID, alt setting and bInterfaceNumber (+ other unknown values).
8	?	0x20 bytes 1-2: Device index 2-4: Device number	None	calls /dev/usb/usb ioctl 3
0x10	SuspendResume	0x20 bytes 1-2: Device index 2-4: Device number 11-12: State (1 to resume, 0 to suspend)	None	Suspend or resume a device. Calls /dev/usb/usb ioctl 4. If the call was successful, updates the internal device struct to reflect the state change. The new state must not be the same as the current one; otherwise IPC_EINVAL will be returned.
0x11	CancelEndpoint	0x20	None	calls /dev/usb/usb ioctl 0x10
0x12 (ioctlv)	CtrlTransfer	1 in / 1 io or 2 in / 0 io		calls /dev/usb/usb ioctl 0x11
0x13 (ioctlv)	IntrTransfer	1 in / 1 io or 2 in / 0 io		calls /dev/usb/usb ioctl 0x12
0x14 (ioctlv)	IsoTransfer	2 in / 2 io or 3 in / 1 io		calls /dev/usb/usb ioctl 0x13
0x15 (ioctlv)	BulkTransfer	?		calls /dev/usb/usb ioctl 0x14