detection.wiki

Microsoft-Windows-Sdbus

27 events across 3 channels

Event IDTitleChannel
100Interrupt detected in ISR.Analytic
101Entering callback routine.Analytic
102Exiting callback routine.Analytic
103Retuning Sequence detected.Analytic
104Error in bus transfer.Debug
105Hpi IO detected.Analytic
106P-State change requested.Analytic
107P-State change requested.Analytic
108Command issued.Analytic
109Command completed.Analytic
110Hpi CMD sent to the hardware.Analytic
111Hpi CMD was accepted by the hardware.Analytic
112Hpi CMD worker started.Analytic
113Hpi CMD worker exited.Analytic
114P-State change requested.Analytic
115SdbusWorkerDpcEnter: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …Analytic
116SdbusWorkerDpcExit: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …Analytic
117SdbusRequestStart: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: …Analytic
118SdbusRequestComplete: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …Analytic
119Scheduled callback routine.Analytic
120Interrupt DPC scheduled.Analytic
121Interrupt DPC entered.Analytic
122Interrupt DPC exited.Analytic
123SdbusRequestStartV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …Analytic
123Operational
124SdbusRequestCompleteV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp …Analytic
124Operational

Event ID 100 — Interrupt detected in ISR.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
Interrupt

Description

Interrupt detected in ISR.

Message #

Interrupt detected in ISR.
SD Host Physical Address: %1
Events (masked): %2

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
Events_masked HexInt32Events (masked).
SDHostPhysicalAddress HexInt64—
EventMask HexInt32—

Event ID 101 — Entering callback routine.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
CallbackRoutine
Opcode
Start

Description

Entering callback routine.

Message #

Entering callback routine.
SD Host Physical Address: %1

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
SDHostPhysicalAddress HexInt64—

Event ID 102 — Exiting callback routine.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
CallbackRoutine
Opcode
Stop

Description

Exiting callback routine.

Message #

Exiting callback routine.
SD Host Physical Address: %1

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
SDHostPhysicalAddress HexInt64—

Event ID 103 — Retuning Sequence detected.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
Retune

Description

Retuning Sequence detected.

Message #

Retuning Sequence detected.
SD Host Physical Address: %1
Retuning Count: %2

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
Retuning_Count UInt64—
SDHostPhysicalAddress HexInt64—
RetuneCount UInt64—

Event ID 104 — Error in bus transfer.

Provider
Microsoft-Windows-Sdbus
Channel
Debug
Task
Error

Description

Error in bus transfer.

Message #

Error in bus transfer.
SD Host Physical Address: %1
Error Code: %2
Error Count: %3

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
Error_Code HexInt32—
Error_Count UInt32—
SDHostPhysicalAddress HexInt64—
ErrorCode HexInt32—
ErrorCount UInt32—

Event ID 105 — Hpi IO detected.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
HPIIO

Description

Hpi IO detected.

Message #

Hpi IO detected.
SD Host Physical Address: %1
Hpi Count: %2

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
Hpi_Count UInt64—
SDHostPhysicalAddress HexInt64—
HpiIoCount UInt64—

Event ID 106 — P-State change requested.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
P_StateRequest

Description

P-State change requested.

Message #

P-State change requested.
PoFx Device Handle: %1
P-State Requested: %2
P-State Request Count: %3

Fields #

NameDescription
PoFx_Device_Handle HexInt64—
PState_Requested UInt32P-State Requested.
PState_Request_Count UInt64—
PoFxDeviceHandle HexInt64—
PStateRequested UInt32—
PStateRequestCount UInt64—

Event ID 107 — P-State change requested.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
P_StateCompletion

Description

P-State change requested.

Message #

P-State change requested.
PoFx Device Handle: %1
P-State Completed: %2
P-State Completion Count: %3

Fields #

NameDescription
PoFx_Device_Handle HexInt64—
PState_Completed UInt32P-State Completed.
PState_Completion_Count UInt64—
PoFxDeviceHandle HexInt64—
PStateCompleted UInt32—
PStateCompletionCount UInt64—

Event ID 108 — Command issued.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
CommandIssued

Description

Command issued.

Message #

Command issued.
SD Host Physical Address: %1
Command: %2
Argument: %3
Size: %4

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
Command UInt8—
Argument HexInt64—
Size UInt64—
SDHostPhysicalAddress HexInt64—

Event ID 109 — Command completed.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
CommandCompleted

Description

Command completed.

Message #

Command completed.
SD Host Physical Address: %1
Command: %2
Argument: %3
Size: %4

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
Command UInt8—
Argument HexInt64—
Size UInt64—
SDHostPhysicalAddress HexInt64—

Event ID 110 — Hpi CMD sent to the hardware.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
HPICMDIssued

Description

Hpi CMD sent to the hardware. IRP Irp.

Message #

Hpi CMD sent to the hardware. IRP %1

Fields #

NameDescription
Irp HexInt64—

Event ID 111 — Hpi CMD was accepted by the hardware.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
HPICMDIssued

Description

Hpi CMD was accepted by the hardware. IRP Irp.

Message #

Hpi CMD was accepted by the hardware. IRP %1

Fields #

NameDescription
Irp HexInt64—

Event ID 112 — Hpi CMD worker started.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
HPIWorkerProcess

Description

Hpi CMD worker started. IRP Irp.

Message #

Hpi CMD worker started. IRP %1

Fields #

NameDescription
Irp HexInt64—

Event ID 113 — Hpi CMD worker exited.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
HPIWorkerProcess

Description

Hpi CMD worker exited. IRP Irp Reason: HpiExitReason.

Message #

Hpi CMD worker exited. IRP %1 Reason: %2

Fields #

NameDescription
Irp HexInt64—
HpiExitReason UInt32—

Event ID 114 — P-State change requested.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
P_StateUtilization

Description

P-State change requested.

Message #

P-State change requested.
PoFx Device Handle: %1
P-State Active Percentage: %2
P-State Active Duration: %3
P-State Sample Duration: %4
P-State Current Frequency: %5
P-State Requested Frequency: %6

Fields #

NameDescription
PoFx_Device_Handle HexInt64—
PState_Active_Percentage UInt32P-State Active Percentage.
PState_Active_Duration UInt32P-State Active Duration.
PState_Sample_Duration UInt32P-State Sample Duration.
PState_Current_Frequency UInt32P-State Current Frequency.
PState_Requested_Frequency UInt32P-State Requested Frequency.
PoFxDeviceHandle HexInt64—
PStateActivePercent UInt32—
PStateActiveDuration UInt32—
PStateSampleDuration UInt32—
PStateCurrentFrequency UInt32—
PStateRequestedFrequency UInt32—

Event ID 115 — SdbusWorkerDpcEnter: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunctio...

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
SdbusWorkerDpc

Description

SdbusWorkerDpcEnter: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunctionPhase.

Message #

SdbusWorkerDpcEnter: SD Host Physical Address: %1 Irp: %2 Workpacket Function: %3 CurrentState: %4 FunctionPhase: %5

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkPacketWorkerProcFunction UInt32—
WorkEngineCurrentState HexInt32—
WorkEngineFunctionPhase HexInt32—

Event ID 116 — SdbusWorkerDpcExit: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunction...

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
SdbusWorkerDpc

Description

SdbusWorkerDpcExit: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Workpacket Function: WorkPacketWorkerProcFunction CurrentState: WorkEngineCurrentState FunctionPhase: WorkEngineFunctionPhase.

Message #

SdbusWorkerDpcExit: SD Host Physical Address: %1 Irp: %2 Workpacket Function: %3 CurrentState: %4 FunctionPhase: %5

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkPacketWorkerProcFunction UInt32—
WorkEngineCurrentState HexInt32—
WorkEngineFunctionPhase HexInt32—

Event ID 117 — SdbusRequestStart: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
SdbusRequest

Description

SdbusRequestStart: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status.

Message #

SdbusRequestStart: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg: %4 Status: %5

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkEngineCommand HexInt32—
WorkEngineArgument HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 118 — SdbusRequestComplete: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
SdbusRequest

Description

SdbusRequestComplete: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status.

Message #

SdbusRequestComplete: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg %4 Status %5

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkEngineCommand HexInt32—
WorkEngineArgument HexInt32—
Status HexInt32— NTSTATUS reference

Event ID 119 — Scheduled callback routine.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
CallbackRoutine
Opcode
Start

Description

Scheduled callback routine.

Message #

Scheduled callback routine.
SD Host Physical Address: %1

Fields #

NameDescription
SD_Host_Physical_Address HexInt64—
SDHostPhysicalAddress HexInt64—

Event ID 120 — Interrupt DPC scheduled.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
Interrupt
Opcode
Start

Description

Interrupt DPC scheduled.

Message #

Interrupt DPC scheduled.

Event ID 121 — Interrupt DPC entered.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
Interrupt
Opcode
Start

Description

Interrupt DPC entered.

Message #

Interrupt DPC entered.

Event ID 122 — Interrupt DPC exited.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
Interrupt
Opcode
Start

Description

Interrupt DPC exited.

Message #

Interrupt DPC exited.

Event ID 123 — SdbusRequestStartV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status UpperArg: WorkEngineArgument64.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
SdbusRequest

Description

SdbusRequestStartV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg: WorkEngineArgument Status: Status UpperArg: WorkEngineArgument64.

Message #

SdbusRequestStartV2: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg: %4 Status: %5 UpperArg: %6

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkEngineCommand HexInt32—
WorkEngineArgument HexInt32—
Status HexInt32— NTSTATUS reference
WorkEngineArgument64 HexInt64—

Event ID 123 —

Provider
Microsoft-Windows-Sdbus
Channel
Operational
Task
SdbusRequest

Description

SdbusRequestStartV2: SD Host Physical Address: Irp: Cmd: Arg: Status: UpperArg.

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkEngineCommand HexInt32—
WorkEngineArgument HexInt32—
Status HexInt32— NTSTATUS reference
WorkEngineArgument64 HexInt64—

Event ID 124 — SdbusRequestCompleteV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status UpperArg: WorkEngineArgument64.

Provider
Microsoft-Windows-Sdbus
Channel
Analytic
Task
SdbusRequest

Description

SdbusRequestCompleteV2: SD Host Physical Address: SDHostPhysicalAddress Irp: Irp Cmd: WorkEngineCommand Arg WorkEngineArgument Status Status UpperArg: WorkEngineArgument64.

Message #

SdbusRequestCompleteV2: SD Host Physical Address: %1 Irp: %2 Cmd: %3 Arg %4 Status %5 UpperArg: %6

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkEngineCommand HexInt32—
WorkEngineArgument HexInt32—
Status HexInt32— NTSTATUS reference
WorkEngineArgument64 HexInt64—

Event ID 124 —

Provider
Microsoft-Windows-Sdbus
Channel
Operational
Task
SdbusRequest

Description

SdbusRequestCompleteV2: SD Host Physical Address: Irp: Cmd: Arg Status UpperArg.

Fields #

NameDescription
SDHostPhysicalAddress HexInt64—
Irp Pointer—
WorkEngineCommand HexInt32—
WorkEngineArgument HexInt32—
Status HexInt32— NTSTATUS reference
WorkEngineArgument64 HexInt64—