Microsoft-Windows-USB-USBXHCI

52 events across 5 channels

Event	Title	Channel	Sample
1	Start Rundown	Microsoft-Windows-USB-USBXHCI-Analytic	N
2	Complete Rundown	Microsoft-Windows-USB-USBXHCI-Analytic	N
3	USBXHCI Controller Information	Microsoft-Windows-USB-USBXHCI-Analytic	N
4	USBXHCI Device Information	Microsoft-Windows-USB-USBXHCI-Analytic	N
5	USBXHCI Endpoint Information	Microsoft-Windows-USB-USBXHCI-Analytic	N
6	USBXHCI Controller Create	Microsoft-Windows-USB-USBXHCI-Analytic	N
7	USBXHCI Controller Delete	Microsoft-Windows-USB-USBXHCI-Analytic	N
8	USBXHCI Device Create	Microsoft-Windows-USB-USBXHCI-Analytic	N
9	USBXHCI Device Update	Microsoft-Windows-USB-USBXHCI-Analytic	N
10	USBXHCI Device Delete	Microsoft-Windows-USB-USBXHCI-Analytic	N
11	USBXHCI Endpoint Create	Microsoft-Windows-USB-USBXHCI-Analytic	N
12	USBXHCI Endpoint Update	Microsoft-Windows-USB-USBXHCI-Analytic	N
13	USBXHCI Endpoint Delete	Microsoft-Windows-USB-USBXHCI-Analytic	N
14	Windows failed to start the DeviceDescription for the following reason.	System	N
15	USBXHCI Controller Firmware Version Update	Microsoft-Windows-USB-USBXHCI-Analytic	N
16	USBXHCI Controller EvtDeviceD0Entry Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
17	USBXHCI Controller EvtDeviceD0Entry Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
18	USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
19	USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
20	USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
21	USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
22	USBXHCI Controller EvtDeviceD0Exit Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
23	USBXHCI Controller EvtDeviceD0Exit Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
24	USBXHCI Controller Save State Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
25	USBXHCI Controller Save State Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
26	USBXHCI Controller Restore State Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
27	USBXHCI Controller Restore State Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
28	USBXHCI Controller Internal Reset Start	Microsoft-Windows-USB-USBXHCI-Analytic	N
29	USBXHCI Controller Internal Reset Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
30	USBXHCI Controller Error detected.	Microsoft-Windows-USB-USBXHCI-Analytic	N
31	xHCI Command sent to Controller	Microsoft-Windows-USB-USBXHCI-Analytic	N
32	xHCI Command waitlisted due to Command Ring full or Command Serialization	Microsoft-Windows-USB-USBXHCI-Analytic	N
33	xHCI Command Complete	Microsoft-Windows-USB-USBXHCI-Analytic	N
34	xHCI Command Complete with Error	Microsoft-Windows-USB-USBXHCI-Analytic	N
35	Query USB capability for controller	Microsoft-Windows-USB-USBXHCI-Analytic	N
36	Wdf Power Reference acquired or released because controller is shared with …	Microsoft-Windows-USB-USBXHCI-Analytic	N
37	Request to VTL1 IUM trustlet	Microsoft-Windows-USB-USBXHCI-Analytic	N
38	Request to VTL1 IUM trustlet	Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic	N
39	Request to VTL1 IUM trustlet	Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic	N
40	Request to VTL1 IUM trustlet	Microsoft-Windows-USB-USBXHCI-Analytic	N
41	USB transfer	Microsoft-Windows-USB-USBXHCI-Analytic	N
42	task_042_V1	Microsoft-Windows-USB-USBXHCI-Analytic	N
43	Deferred work (DPC/WorkItem)	Microsoft-Windows-USB-USBXHCI-Analytic	N
44	Deferred work (DPC/WorkItem)	Microsoft-Windows-USB-USBXHCI-Analytic	N
45	task_045_V1	Microsoft-Windows-USB-USBXHCI-Analytic	N
46	Start Tracking For Time Sync	Microsoft-Windows-USB-USBXHCI-Analytic	N
47	Stop Tracking For Time Sync	Microsoft-Windows-USB-USBXHCI-Analytic	N
48	Configure Endpoint	Microsoft-Windows-USB-USBXHCI-Analytic	N
49	USBXHCI Controller Health Information	Microsoft-Windows-USB-USBXHCI-Analytic	N
50	USBXHCI Controller Error Encountered.	Microsoft-Windows-USB-USBXHCI-Operational	N
51	task_051	Operational	N
52	task_052	Operational	N

Event ID 1: Start Rundown

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIDriverRundown
Opcode: Start

Description

Start Rundown.

Message #

Start Rundown

Event ID 2: Complete Rundown

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIDriverRundown
Opcode: Stop

Description

Complete Rundown.

Message #

Complete Rundown

Event ID 3: USBXHCI Controller Information

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControlerRundown
Opcode: Information

Description

USBXHCI Controller Information.

Message #

USBXHCI Controller Information

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_ParentBusType` UInt32
`fid_MajorVersion` UInt8
`fid_MinorVersion` UInt8
`fid_PciBus` UInt32
`fid_PciDevice` UInt32
`fid_PciFunction` UInt32
`fid_PciVendorId` UInt32
`fid_PciDeviceId` UInt32
`fid_PciRevisionId` UInt32
`fid_AcpiVendorId` AnsiString
`fid_AcpiDeviceId` AnsiString
`fid_AcpiRevisionId` AnsiString
`fid_FirmwareVersion` UInt64
`fid_S0IdleStatus` UInt32
`fid_WdfDevicePowerState` UInt32
`fid_InstanceNumber` UInt32
`fid_WdfPowerReferenceForDebuggerAcquired` Boolean
`fid_IsSecureDevice` Boolean
`fid_DMAModeInVSM` UInt32
`fid_NumberOfDMATargetsInVSM` UInt32
`fid_VTIOProgrammingMethod` UInt32
`fid_UsbEndpointOffloadMode` UInt32
`fid_IsTimeTrackingEnabled` Boolean
`fid_DeviceFlags_0` UInt64
`fid_DeviceFlags_1` UInt64
`fid_CachedHcsParams1` UInt32
`fid_CachedHcsParams2` UInt32
`fid_CachedHcsParams3` UInt32
`fid_CachedHccParams1` UInt32
`fid_CachedHccParams2` UInt32
`fid_MapRegisterCount` UInt32
`fid_SecondaryInterrupterCount` UInt32
`fid_InterruptMechanism` UInt32
`fid_SupportedNumberOfStreams` UInt32
`fid_ControllerSuspendResumeCount` UInt32
`fid_Controller_Counters` 38
`fid_Device_Capabilities` 62

Event ID 4: USBXHCI Device Information

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIDeviceRundown
Opcode: Information

Description

USBXHCI Device Information.

Message #

USBXHCI Device Information

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbTtHubDevice` Pointer
`fid_UsbDevice` Pointer
`DeviceSpeed` UInt32
`PortPathDepth` UInt32
`PortPath` UInt32
`fid_SlotId` UInt32
`fid_DeviceIsHub` UInt32
`fid_NumberOfPorts` UInt32
`fid_NumberOfTTs` UInt32
`fid_USB_Device_Descriptor` Struct
`fid_IsSecureUSBDevice` Boolean
`fid_IsProxyUSBDevice` Boolean
`fid_IsDeviceContextLocal` Boolean
`fid_ConfigurationValue` UInt8
`fid_InterfaceNumber` UInt8
`fid_AlternateSetting` UInt8
`fid_LastConfigureEndpointStatus` UInt32
`fid_IsFirmwareHashValid` Boolean
`fid_IsFirmwareHashQueried` Boolean
`fid_IsFirmwareHashFromDevicePresent` Boolean
`fid_IsFirmwareHashFromSDEVEntryPresent` Boolean
`FirmwareHashFromDevice` UInt8
`FirmwareHashFromSDEVEntry` UInt8

Event ID 5: USBXHCI Endpoint Information

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIEndpointRundown
Opcode: Information

Description

USBXHCI Endpoint Information.

Message #

USBXHCI Endpoint Information

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbDevice` Pointer
`fid_Endpoint` Pointer
`fid_USB_Endpoint_Descriptor` UInt16
`fid_USB_SuperSpeed_Endpoint_Companion_Descriptor` Double
`fid_USB_SuperSpeedPlus_Isoch_Endpoint_Companion_Descriptor` FILETIME

Event ID 6: USBXHCI Controller Create

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerCreate
Opcode: Information

Description

USBXHCI Controller Create.

Message #

USBXHCI Controller Create

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_ParentBusType` UInt32
`fid_PciBus` UInt32
`fid_PciDevice` UInt32
`fid_PciFunction` UInt32
`fid_PciVendorId` UInt32
`fid_PciDeviceId` UInt32
`fid_PciRevisionId` UInt32
`fid_AcpiVendorId` AnsiString
`fid_AcpiDeviceId` AnsiString
`fid_AcpiRevisionId` AnsiString
`fid_FirmwareVersion` UInt64
`fid_S0IdleStatus` UInt32
`fid_WdfDevicePowerState` UInt32
`fid_InstanceNumber` UInt32
`fid_WdfPowerReferenceForDebuggerAcquired` Boolean
`fid_Device_Capabilities` FILETIME

Event ID 7: USBXHCI Controller Delete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerDelete
Opcode: Information

Description

USBXHCI Controller Delete.

Message #

USBXHCI Controller Delete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_ParentBusType` UInt32
`fid_PciBus` UInt32
`fid_PciDevice` UInt32
`fid_PciFunction` UInt32
`fid_PciVendorId` UInt32
`fid_PciDeviceId` UInt32
`fid_PciRevisionId` UInt32
`fid_AcpiVendorId` AnsiString
`fid_AcpiDeviceId` AnsiString
`fid_AcpiRevisionId` AnsiString
`fid_FirmwareVersion` UInt64
`fid_S0IdleStatus` UInt32
`fid_WdfDevicePowerState` UInt32
`fid_InstanceNumber` UInt32
`fid_WdfPowerReferenceForDebuggerAcquired` Boolean

Event ID 8: USBXHCI Device Create

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIDeviceCreate
Opcode: Information

Description

USBXHCI Device Create.

Message #

USBXHCI Device Create

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbTtHubDevice` Pointer
`fid_UsbDevice` Pointer
`DeviceSpeed` UInt32
`PortPathDepth` UInt32
`PortPath` UInt32
`fid_SlotId` UInt32
`fid_DeviceIsHub` UInt32
`fid_NumberOfPorts` UInt32
`fid_NumberOfTTs` UInt32
`fid_USB_Device_Descriptor` Struct
`fid_IsSecureUSBDevice` Boolean
`fid_IsProxyUSBDevice` Boolean
`fid_IsDeviceContextLocal` Boolean
`fid_ConfigurationValue` UInt8
`fid_InterfaceNumber` UInt8
`fid_AlternateSetting` UInt8
`fid_LastConfigureEndpointStatus` UInt32
`fid_IsFirmwareHashValid` Boolean
`fid_IsFirmwareHashQueried` Boolean
`fid_IsFirmwareHashFromDevicePresent` Boolean
`fid_IsFirmwareHashFromSDEVEntryPresent` Boolean
`FirmwareHashFromDevice` UInt8
`FirmwareHashFromSDEVEntry` UInt8

Event ID 9: USBXHCI Device Update

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIDeviceUpdate
Opcode: Information

Description

USBXHCI Device Update.

Message #

USBXHCI Device Update

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbTtHubDevice` Pointer
`fid_UsbDevice` Pointer
`DeviceSpeed` UInt32
`PortPathDepth` UInt32
`PortPath` UInt32
`fid_SlotId` UInt32
`fid_DeviceIsHub` UInt32
`fid_NumberOfPorts` UInt32
`fid_NumberOfTTs` UInt32
`fid_USB_Device_Descriptor` Struct
`fid_IsSecureUSBDevice` Boolean
`fid_IsProxyUSBDevice` Boolean
`fid_IsDeviceContextLocal` Boolean
`fid_ConfigurationValue` UInt8
`fid_InterfaceNumber` UInt8
`fid_AlternateSetting` UInt8
`fid_LastConfigureEndpointStatus` UInt32
`fid_IsFirmwareHashValid` Boolean
`fid_IsFirmwareHashQueried` Boolean
`fid_IsFirmwareHashFromDevicePresent` Boolean
`fid_IsFirmwareHashFromSDEVEntryPresent` Boolean
`FirmwareHashFromDevice` UInt8
`FirmwareHashFromSDEVEntry` UInt8

Event ID 10: USBXHCI Device Delete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIDeviceDelete
Opcode: Information

Description

USBXHCI Device Delete.

Message #

USBXHCI Device Delete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbTtHubDevice` Pointer
`fid_UsbDevice` Pointer
`DeviceSpeed` UInt32
`PortPathDepth` UInt32
`PortPath` UInt32
`fid_SlotId` UInt32
`fid_DeviceIsHub` UInt32
`fid_NumberOfPorts` UInt32
`fid_NumberOfTTs` UInt32
`fid_USB_Device_Descriptor` Struct
`fid_IsSecureUSBDevice` Boolean
`fid_IsProxyUSBDevice` Boolean
`fid_IsDeviceContextLocal` Boolean
`fid_ConfigurationValue` UInt8
`fid_InterfaceNumber` UInt8
`fid_AlternateSetting` UInt8
`fid_LastConfigureEndpointStatus` UInt32
`fid_IsFirmwareHashValid` Boolean
`fid_IsFirmwareHashQueried` Boolean
`fid_IsFirmwareHashFromDevicePresent` Boolean
`fid_IsFirmwareHashFromSDEVEntryPresent` Boolean
`FirmwareHashFromDevice` UInt8
`FirmwareHashFromSDEVEntry` UInt8

Event ID 11: USBXHCI Endpoint Create

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIEndpointCreate
Opcode: Information

Description

USBXHCI Endpoint Create.

Message #

USBXHCI Endpoint Create

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbDevice` Pointer
`fid_Endpoint` Pointer
`fid_USB_Endpoint_Descriptor` UInt16
`fid_USB_SuperSpeed_Endpoint_Companion_Descriptor` Double
`fid_USB_SuperSpeedPlus_Isoch_Endpoint_Companion_Descriptor` FILETIME

Event ID 12: USBXHCI Endpoint Update

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIEndpointUpdate
Opcode: Information

Description

USBXHCI Endpoint Update.

Message #

USBXHCI Endpoint Update

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbDevice` Pointer
`fid_Endpoint` Pointer
`fid_USB_Endpoint_Descriptor` UInt16
`fid_USB_SuperSpeed_Endpoint_Companion_Descriptor` Double
`fid_USB_SuperSpeedPlus_Isoch_Endpoint_Companion_Descriptor` FILETIME

Event ID 13: USBXHCI Endpoint Delete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIEndpointDelete
Opcode: Information

Description

USBXHCI Endpoint Delete.

Message #

USBXHCI Endpoint Delete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbDevice` Pointer
`fid_Endpoint` Pointer
`fid_USB_Endpoint_Descriptor` UInt16
`fid_USB_SuperSpeed_Endpoint_Companion_Descriptor` Double
`fid_USB_SuperSpeedPlus_Isoch_Endpoint_Companion_Descriptor` FILETIME

Event ID 14: Windows failed to start the DeviceDescription for the following reason.

Provider: Microsoft-Windows-USB-USBXHCI
Channel: System

Description

Windows failed to start the DeviceDescription for the following reason.

Message #

Windows failed to start the %3 for the following reason:
%4

Fields #

Name	Description
`fid_UcxController` Pointer
`DeviceDescLength` UInt32
`DeviceDescription` UnicodeString
`StartDeviceFailReason` UInt32

Event ID 15: USBXHCI Controller Firmware Version Update

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerFirmwareVersionUpdate
Opcode: Information

Description

USBXHCI Controller Firmware Version Update.

Message #

USBXHCI Controller Firmware Version Update

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_ParentBusType` UInt32
`fid_PciBus` UInt32
`fid_PciDevice` UInt32
`fid_PciFunction` UInt32
`fid_PciVendorId` UInt32
`fid_PciDeviceId` UInt32
`fid_PciRevisionId` UInt32
`fid_AcpiVendorId` AnsiString
`fid_AcpiDeviceId` AnsiString
`fid_AcpiRevisionId` AnsiString
`fid_FirmwareVersion` UInt64
`fid_S0IdleStatus` UInt32
`fid_WdfDevicePowerState` UInt32
`fid_InstanceNumber` UInt32
`fid_WdfPowerReferenceForDebuggerAcquired` Boolean

Event ID 16: USBXHCI Controller EvtDeviceD0Entry Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0Entry
Opcode: Start

Description

USBXHCI Controller EvtDeviceD0Entry Start.

Message #

USBXHCI Controller EvtDeviceD0Entry Start

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_WaitWakePending` UInt16
`fid_PreProcessedSystemPowerAction` UInt32

Event ID 17: USBXHCI Controller EvtDeviceD0Entry Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0Entry
Opcode: Stop

Description

USBXHCI Controller EvtDeviceD0Entry Complete.

Message #

USBXHCI Controller EvtDeviceD0Entry Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_NtStatus` UInt32

Event ID 18: USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0EntryPostInterruptsEnabled
Opcode: Start

Description

USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Start.

Message #

USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Start

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_WaitWakePending` UInt16

Event ID 19: USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0EntryPostInterruptsEnabled
Opcode: Stop

Description

USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Complete.

Message #

USBXHCI Controller EvtDeviceD0EntryPostInterruptsEnabled Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_NtStatus` UInt32

Event ID 20: USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0ExitPreInterruptsDisabled
Opcode: Start

Description

USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Start.

Message #

USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Start

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_WaitWakePending` UInt16

Event ID 21: USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0ExitPreInterruptsDisabled
Opcode: Stop

Description

USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Complete.

Message #

USBXHCI Controller EvtDeviceD0ExitPreInterruptsDisabled Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_NtStatus` UInt32

Event ID 22: USBXHCI Controller EvtDeviceD0Exit Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0Exit
Opcode: Start

Description

USBXHCI Controller EvtDeviceD0Exit Start.

Message #

USBXHCI Controller EvtDeviceD0Exit Start

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_WaitWakePending` UInt16
`fid_PreProcessedSystemPowerAction` UInt32

Event ID 23: USBXHCI Controller EvtDeviceD0Exit Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerD0Exit
Opcode: Stop

Description

USBXHCI Controller EvtDeviceD0Exit Complete.

Message #

USBXHCI Controller EvtDeviceD0Exit Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceState` UInt32
`fid_PowerAction` UInt32
`fid_NtStatus` UInt32

Event ID 24: USBXHCI Controller Save State Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerSaveState
Opcode: Start

Description

USBXHCI Controller Save State Start.

Message #

USBXHCI Controller Save State Start

Fields #

Name	Description
`fid_UcxController` Pointer

Event ID 25: USBXHCI Controller Save State Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerSaveState
Opcode: Stop

Description

USBXHCI Controller Save State Complete.

Message #

USBXHCI Controller Save State Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_NtStatus` UInt32

Event ID 26: USBXHCI Controller Restore State Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerRestoreState
Opcode: Start

Description

USBXHCI Controller Restore State Start.

Message #

USBXHCI Controller Restore State Start

Fields #

Name	Description
`fid_UcxController` Pointer

Event ID 27: USBXHCI Controller Restore State Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerRestoreState
Opcode: Stop

Description

USBXHCI Controller Restore State Complete.

Message #

USBXHCI Controller Restore State Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_NtStatus` UInt32

Event ID 28: USBXHCI Controller Internal Reset Start

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerInternalReset
Opcode: Start

Description

USBXHCI Controller Internal Reset Start.

Message #

USBXHCI Controller Internal Reset Start

Fields #

Name	Description
`fid_UcxController` Pointer

Event ID 29: USBXHCI Controller Internal Reset Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerInternalReset
Opcode: Stop

Description

USBXHCI Controller Internal Reset Complete.

Message #

USBXHCI Controller Internal Reset Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_NtStatus` UInt32

Event ID 30: USBXHCI Controller Error detected.

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerError
Opcode: Information

Description

USBXHCI Controller Error detected. To recover from this Error, Windows may need to reset the Controller and re-enumerate USB devices downstream of the Controller. Please refer Event Properties for more contextual information about this Error. Hardware Verifier Flag: fid_HWVerifierFlag. Detailed description: fid_Description

Message #

USBXHCI Controller Error detected. To recover from this Error, Windows may need to reset the Controller and re-enumerate USB devices downstream of the Controller. Please refer Event Properties for more contextual information about this Error.
Hardware Verifier Flag: %4.
Detailed description: %5

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UcxDevice` Pointer
`fid_UcxEndpoint` Pointer
`fid_HWVerifierFlag` UInt64
`fid_Description` AnsiString
`fid_CommandTRB` Binary
`fid_EventTRB` Binary

Event ID 31: xHCI Command sent to Controller

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCICommand
Opcode: Information

Description

xHCI Command sent to Controller.

Message #

xHCI Command sent to Controller

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_CrbPointer` Pointer
`fid_Command_TRB` Binary

Event ID 32: xHCI Command waitlisted due to Command Ring full or Command Serialization

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCICommand
Opcode: Information

Description

xHCI Command waitlisted due to Command Ring full or Command Serialization.

Message #

xHCI Command waitlisted due to Command Ring full or Command Serialization

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_CrbPointer` Pointer
`fid_Command_TRB` Binary
`fid_CommandWaitlistReason` UInt8

Event ID 33: xHCI Command Complete

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCICommand
Opcode: Information

Description

xHCI Command Complete.

Message #

xHCI Command Complete

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_CrbPointer` Pointer
`fid_Command_TRB` Binary
`fid_CompletionStatus` UInt32
`fid_CompletionCode` UInt8

Event ID 34: xHCI Command Complete with Error

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCICommand
Opcode: Information

Description

xHCI Command Complete with Error.

Message #

xHCI Command Complete with Error

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_CrbPointer` Pointer
`fid_Command_TRB` Binary
`fid_CompletionStatus` UInt32
`fid_CompletionCode` UInt8

Event ID 35: Query USB capability for controller

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCICommand
Opcode: Information

Description

Query USB capability for controller.

Message #

Query USB capability for controller

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_Capability` GUID
`fid_NtStatus` UInt32
`fid_NumStaticStreams` UInt32

Event ID 36: Wdf Power Reference acquired or released because controller is shared with debugger

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Opcode: Information

Description

Wdf Power Reference acquired or released because controller is shared with debugger.

Message #

Wdf Power Reference acquired or released because controller is shared with debugger

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_WdfPowerReferenceForDebuggerAcquired` Boolean

Event ID 37: Request to VTL1 IUM trustlet

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: RequesttoVTL1IUMtrustlet
Opcode: Start

Fields #

Name	Description
`fid_TrustletRequestOpCode` UInt32
`fid_InputBufferLength` UInt32
`fid_OutputBufferLength` UInt32
`fid_OutstandingRequestsAtSendTime` UInt32

Event ID 38: Request to VTL1 IUM trustlet

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic
Task: RequesttoVTL1IUMtrustlet
Opcode: RequestfromVTL0driverreceivedintrustlet

Fields #

Name	Description
`fid_TrustletRequestOpCode` UInt32
`fid_OutstandingRequestsAtSendTime` UInt32

Event ID 39: Request to VTL1 IUM trustlet

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic
Task: RequesttoVTL1IUMtrustlet
Opcode: RequestfromVTL0drivercompletedintrustlet

Fields #

Name	Description
`fid_TrustletRequestOpCode` UInt32
`fid_OutstandingRequestsAtSendTime` UInt32

Event ID 40: Request to VTL1 IUM trustlet

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: RequesttoVTL1IUMtrustlet
Opcode: Stop

Fields #

Name	Description
`fid_TrustletRequestOpCode` UInt32
`fid_OutstandingRequestsAtSendTime` UInt32
`fid_TimeInNs` UInt64

Event ID 41: USB transfer

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBtransfer
Opcode: USBtransferinitialized

Fields #

Name	Description
`fid_SlotId` UInt8
`fid_EndpointContextIndex` UInt32
`fid_StreamId` UInt32
`fid_BytesTotal` UInt32

Event ID 42: task_042_V1

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_InterrupterNumber` UInt32

Event ID 43: Deferred work (DPC/WorkItem)

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: Deferredwork(DPC/WorkItem)
Opcode: Start

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_InterrupterNumber` UInt32

Event ID 44: Deferred work (DPC/WorkItem)

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: Deferredwork(DPC/WorkItem)
Opcode: Stop

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_InterrupterNumber` UInt32
`fid_EventsProcessed` UInt32
`fid_isEventRingEmpty` Boolean

Event ID 45: task_045_V1

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic

Fields #

Name	Description
`fid_SlotId` UInt8
`fid_EndpointContextIndex` UInt32
`fid_StreamId` UInt32

Event ID 46: Start Tracking For Time Sync

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: StartTrackingForTimeSync
Opcode: Information

Description

Start Tracking For Time Sync.

Message #

Start Tracking For Time Sync

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_IsStartupDelayTolerable` Boolean
`fid_RequestorMode` UInt32
`fid_NtStatus` UInt32
`fid_TimeTrackingHandle` Pointer

Event ID 47: Stop Tracking For Time Sync

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: StopTrackingForTimeSync
Opcode: Information

Description

Stop Tracking For Time Sync.

Message #

Stop Tracking For Time Sync

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_TimeTrackingHandle` Pointer
`fid_IsCloseHandleFromClient` Boolean
`fid_RequestorMode` UInt32
`fid_NtStatus` UInt32
`fid_NumberOfGetFrameQpcCalls` UInt32
`fid_NumberOfFrameQpcTranslations` UInt32

Event ID 48: Configure Endpoint

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: ConfigureEndpoint
Opcode: Information

Description

Configure Endpoint.

Message #

Configure Endpoint

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_UsbDevice` Pointer
`fid_ConfigurationValue` UInt32
`fid_InterfaceNumber` UInt32
`fid_AlternateSetting` UInt32
`fid_LastConfigureEndpointStatus` UInt32

Event ID 49: USBXHCI Controller Health Information

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Analytic
Task: USBXHCIControllerHealthInformation
Opcode: Information

Description

USBXHCI Controller Health Information.

Message #

USBXHCI Controller Health Information

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_ParentBusType` UInt32
`fid_MajorVersion` UInt8
`fid_MinorVersion` UInt8
`fid_PciBus` UInt32
`fid_PciDevice` UInt32
`fid_PciFunction` UInt32
`fid_PciVendorId` UInt32
`fid_PciDeviceId` UInt32
`fid_PciRevisionId` UInt32
`fid_AcpiVendorId` AnsiString
`fid_AcpiDeviceId` AnsiString
`fid_AcpiRevisionId` AnsiString
`fid_FirmwareVersion` UInt64
`fid_S0IdleStatus` UInt32
`fid_WdfDevicePowerState` UInt32
`fid_InstanceNumber` UInt32
`fid_WdfPowerReferenceForDebuggerAcquired` Boolean
`fid_IsSecureDevice` Boolean
`fid_DMAModeInVSM` UInt32
`fid_NumberOfDMATargetsInVSM` UInt32
`fid_UsbEndpointOffloadMode` UInt32
`fid_IsTimeTrackingEnabled` Boolean
`fid_DeviceFlags_0` UInt64
`fid_DeviceFlags_1` UInt64
`fid_CachedHcsParams1` UInt32
`fid_CachedHcsParams2` UInt32
`fid_CachedHcsParams3` UInt32
`fid_CachedHccParams1` UInt32
`fid_CachedHccParams2` UInt32
`fid_MapRegisterCount` UInt32
`fid_SecondaryInterrupterCount` UInt32
`fid_InterruptMechanism` UInt32
`fid_SupportedNumberOfStreams` UInt32
`fid_ControllerSuspendResumeCount` UInt32
`fid_Controller_Counters` 42
`fid_Device_Capabilities` 53
`fid_ErrorPortNumber` UInt32
`fid_PortStatusAndControl` UInt32
`fid_IsPortErrorRecovered` Boolean
`fid_WasPortErrorReported` Boolean
`fid_WasPortRecoveryAssisted` Boolean

Event ID 50: USBXHCI Controller Error Encountered.

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Microsoft-Windows-USB-USBXHCI-Operational
Task: USBXHCIControllerErrorEncountered
Opcode: Error

Description

USBXHCI Controller Error Encountered.

Message #

USBXHCI Controller Error Encountered                     
Device Instance ID: %2                     
Failure Reason: %17                     
Recovery Action: %18                     
Bus Type: %3                     
Major Version: %4                     
Minor Version: %5                     
PCI b.d.f: %6.%7.%8                     
PCI Vendor ID: %9                     
PCI Device ID: %10                     
PCI Revision ID: %11                     
ACPI Vendor ID: %12                     
ACPI Device ID: %13                     
ACPI Revision ID: %14                     
Firmware Version: %15                     
Instance Number: %16                     
Failure Parameter 3: %19                     
Failure Parameter 4: %20

Fields #

Name	Description
`fid_UcxController` Pointer
`fid_DeviceInstanceId` UnicodeString
`fid_ParentBusType` UInt32
`fid_MajorVersion` UInt8
`fid_MinorVersion` UInt8
`fid_PciBus` UInt32
`fid_PciDevice` UInt32
`fid_PciFunction` UInt32
`fid_PciVendorId` UInt32
`fid_PciDeviceId` UInt32
`fid_PciRevisionId` UInt32
`fid_AcpiVendorId` AnsiString
`fid_AcpiDeviceId` AnsiString
`fid_AcpiRevisionId` AnsiString
`fid_FirmwareVersion` UInt64
`fid_InstanceNumber` UInt32
`fid_ReasonCode` UInt32
`fid_RecoveryAction` UInt32
`fid_Parameter3` UInt64
`fid_Parameter4` UInt64

Event ID 51: task_051

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Operational

Fields #

Name	Description
`EventType` UInt32

Event ID 52: task_052

Provider: Microsoft-Windows-USB-USBXHCI
Channel: Operational

Fields #

Name	Description
`EventType` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 30e1d284-5d88-459c-83fd-6345b39b19ec

Defined in usbxhci.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.2454, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)