GCIS Plugin System

GCIS (GameStream Cloud Infrastructure Services) is NVIDIA's server-side framework powering GeForce NOW cloud gaming sessions. Each streaming rig runs a set of plugins loaded by the GCIS service, each responsible for a different domain.

Architecture

All plugins are native C++ DLLs (x64) that export a single entry point:

NvPluginGetInfo() // Returns plugin metadata to the GCIS host

They communicate over NVIDIA's Bifrost message bus and serialize data with Protocol Buffers.

Plugin Overview

Plugin	File	Size	Primary Role	Docs
ElmPlugin	ElmPlugin.dll	15,162,912 bytes	Session lifecycle, security violations, streaming events	/plugins/elmplugin
GciPlugin	GciPlugin.dll	23,769,120 bytes	Kernel-level monitoring (files, processes, drivers, registry) via GFNMON	/plugins/gciplugin
GcpPlugin	GcpPlugin.dll	14,361,120 bytes	Security-control/event messaging layer (incl. on-seat patching and game-start notifications)	/plugins/gcpplugin
GssmPlugin	GssmPlugin.dll	22,280,736 bytes	Session/plugin guard; enforces mandatory plugin join/leave constraints	/plugins/gssmplugin
LkmPlugin	LkmPlugin.dll	15,868,448 bytes	Game session management, app launching, VM allocation	/plugins/lkmplugin
UadMLPlugin	UadMLPlugin.dll	29,284,896 bytes	ML-based anomaly detection (LightGBM + SageMaker)	/plugins/uadmlplugin
UadPlugin	UadPlugin.dll	14,990,368 bytes	Legacy user-activity/network anomaly rules engine	/plugins/uadplugin

Additional model asset in plugin folder:

File	Size	Notes
UadMLPlugin.dat	3,937,176 bytes	Local model/config payload for UadML runtime

Replacement and Deprecation Notes

WARNING

UadPlugin is legacy in newer stacks. Current snapshots ship both UadPlugin.dll and UadMLPlugin.dll, but UadML is the modern ML path. Keep Uad docs for compatibility and historical seats.

WARNING

NvGridSvc-centric legacy flows still appear in binaries/scripts. Keep legacy docs available, but treat GS2 + newer GCIS plugin set as the primary path in latest releases.

GCIS Host Context

Plugins are loaded by the GCIS host (NvContainerGcis.exe) and communicate over Bifrost/MessageBus. In this snapshot the plugin folder is:

C:\Asgard\services\GCIS\plugins\

Shared Dependencies

All plugins share a common set of libraries:

• Poco C++ Libraries v1.10.1 — networking, threading, JSON
• Protocol Buffers v2.6.1 — message serialization
• MessageBusClient (Bifrost) — inter-plugin communication
• NvTelemetry — NVIDIA telemetry framework
• spdlog — structured logging
• Windows APIs: KERNEL32, ADVAPI32, WS2_32, CRYPT32, etc.

Build Environment

All plugins were built from NVIDIA's internal Perforce depot:

C:\dvs\p4\build\sw\gcomp\dev\src\GCIS\
├── _out\x86_64\release\
│   ├── ElmPlugin\
│   ├── GciPlugin\
│   ├── LkmPlugin\
│   └── UadMLPlugin\
└── Common\
    └── GciTelemetry.cpp

Communication Flow

Loaded plugin set in this snapshot:

• ElmPlugin
• GciPlugin
• GcpPlugin
• GssmPlugin
• LkmPlugin
• UadMLPlugin
• UadPlugin (legacy compatibility)

                 Bifrost MessageBus
┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ ElmPlugin│ │GciPlugin │ │GcpPlugin │ │GssmPlugin│
└────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘
     │            │            │            │
     └──────┬─────┴─────┬──────┴─────┬──────┘
            │           │            │
         ┌──▼───┐   ┌───▼────┐   ┌───▼────┐
         │Lkm   │   │UadML   │   │Uad     │
         │Plugin│   │Plugin  │   │Plugin* │
         └──────┘   └───┬────┘   └────────┘
                        │
                  AWS SageMaker

* Legacy/compatibility path

Each plugin can emit SecurityTerminationInitiated events that flow through the message bus to terminate sessions when violations are detected.