The Nvidia Hook

A host-observable model of GPU behavior, built by correlating four signals — ioctl traffic to /dev/nvidia*, libcuda uprobes, NVML device state, and /proc process metadata.

The Hook attaches in the host kernel via a Rust eBPF runtime. A uprobe on libcuda.so:cudaLaunchKernel and cudaMalloc records host-side call sites with kernel symbol resolution. The syscalls:sys_enter_ioctl tracepoint, filtered to /dev/nvidia*, records the driver-bound request stream. NVML reports per-PID device state; /proc anchors the process context. The four signals correlate into one continuously-attributed record. What we don't claim: SM-level execution traces, hardware command-queue state, or L1/L2 telemetry — those require GPU-vendor instrumentation (CUPTI / Nsight) and are orthogonal to the security, compliance, and cost use cases this product addresses.