From WiiBrew
< /dev‎ | usb
Jump to navigation Jump to search

/dev/usb/ven is an IOS resource manager that is used to interact with USB devices. This device is implemented only in IOS57, 58 and 59 by the USB_VEN module, which is a thin wrapper around /dev/usb/usb. It replaces /dev/usb/oh0, which is repurposed as an internal USB backend in these versions.

VEN is often used by official games to communicate with USB cameras (such as Your Shape) and microphones (in the newer singing games). It is also used by libogc for USB2 support.

All buffers must be in MEM2 (addr > 0x10000000) and aligned to a 32-byte boundary. For all of the ioctlvs, the first buffer must be 64 bytes long.

Only IOS_OPEN, IOS_CLOSE, IOS_IOCTL and IOS_IOCTLV are valid commands. The other commands immediately return IPC_EINVAL (-4).


Up to 16 handles can be opened, each with their own device change hook. The handle ID is specified in the open request as the "mode". IPC_EINVAL will be returned if an ID that is in use is passed.


Ioctl Name Input Output Notes
0 GetVersion None

32 bytes

0-4: version (0x50001)

1 GetDeviceChange None

Entry[32] (0x180 bytes)

For each entry:

0-1: IPC request address >> 8
1-2: Device index (0 to 31)
2-4: Device number
4-6: VID
6-8: PID
8-10: Device number
10-11: Interface number
11-12: Number of alternate settings

Set up a device insertion/removal callback. Returns the number of entries.

Note that this ioctl immediately returns on the first call.

Behind the scenes, VEN keeps track of the device list (which can handle up to 32 devices) by issuing (async) ioctl 1 to /dev/usb/usb and updating its internal list on reply.

2 Shutdown None None Releases the device change callback with 0 as return code.
3 GetDeviceInfo

0x20 bytes

1-2: Device index
2-4: Device number

(0-4 is considered as a whole as the device ID, but IOS only cares about these two values.)

0xc0 bytes (memset to 0)

20-40: Device descriptor
40-52: Config descriptor
52-64: Interface descriptor
64-72: Endpoint descriptors (interface.bNumEndpoints times)

Get USB descriptors for a device. Behind the scenes, calls /dev/usb/usb ioctl 2 (input: internal ID, output: descriptors) and copies information to the output buffer and the internal device struct.

The descriptor structures match the ones used by libusb (with padding).

4 ? 0x20 bytes

1-2: Device index
2-4: Device number

None ? (related to callbacks) [check]
5 ? 0x20 bytes

1-2: Device index
2-4: Device number

None ? (related to callbacks) [check]

The caller handle must match a stored ID (?)

May trigger change callbacks and reissue /dev/usb/usb ioctl 1 in some conditions.

6 AttachFinish None None The caller handle must match a stored ID (?)

If it does, IPC_SUCCESS is returned, change callbacks are triggered and /dev/usb/usb ioctl 1 is issued.

7 SetAlternateSetting 0x20 bytes

1-2: Device index
2-4: Device number
8-12: Alternate setting

None Set the active alternate setting for a device.

Internally, this issues /dev/usb/usb ioctl 2 to get descriptors, loops over all endpoints and calls /dev/usb/usb ioctl 5 if (bmAttributes & 3) == 1. If all ioctls succeed, VEN calls /dev/usb/usb ioctl 0x11 with the device ID, alt setting and bInterfaceNumber (+ other unknown values).

8 ? 0x20 None calls /dev/usb/usb ioctl 3
0x10 SuspendResume 0x20 None calls /dev/usb/usb ioctl 4
0x11 CancelEndpoint 0x20 None calls /dev/usb/usb ioctl 0x10
0x12 (ioctlv) CtrlTransfer 1 in / 1 io or 2 in / 0 io calls /dev/usb/usb ioctl 0x11
0x13 (ioctlv) IntrTransfer 1 in / 1 io or 2 in / 0 io calls /dev/usb/usb ioctl 0x12
0x14 (ioctlv) IsoTransfer 2 in / 2 io or 3 in / 1 io calls /dev/usb/usb ioctl 0x13
0x15 (ioctlv) BulkTransfer ? calls /dev/usb/usb ioctl 0x14