Nvidia RTX 20, 30, and 40-series GPUs hacked to remove a half-speed AI throttle

Modders have discovered a way to remove imposed half-speed AI performance limits on Nvidia RTX 20, 30, and 40-series GPUs with a firmware exploit, VideoCardz reports. Without the limitation, the RTX 4090 can achieve double its peak tensor rate, and matrix math can improve by up to 80% for the RTX 3090 Ti, with gains on other cards varying. Real workloads gain significantly less than the RTX 4090’s doubled peak would imply, and chatbot token speeds remain about the same, as that performance is dependent on memory bandwidth.

For all impacted GeForce generations, Nvidia imposed a limit that, per its own published specs, runs FP32-accumulate math at half each card’s FP16-accumulate rate. That does not apply to its Turing and Ampere pro cards. The unlock returns native matrix-math throughput to owners of the cards, which can speed up prompt processing and image generation.

Three separate projects offer generation unlocks, each with its own unofficial Linux module, while experimental Windows builds pursue a different approach. Card coverage varies by generation, with gpu-unlock handling Ampere and listing the GA102/GA103/GA104/GA106 series IDs. An Ada fork, gpu-unlock-ada, covers the RTX 4090 and, experimentally, the 4090 D, 4070 Ti Super, and the 4060 Ti 16GB. The turing-unlock project, adapted from gpu-unlock, works with the RTX 2080 Ti. See Table 1 for a breakdown.

How much faster the cards get

The peak doubling is for tensor rates, with the Ada fork developer’s RTX 4090 moving from 165.6 to 331.6 TFLOPS on FP16 and 165.5 to 330.6 TFLOPS on BF16. The gpu-unlock-ada README states that, in one independent owner’s matrix-multiply benchmark, cuBLAS GEMM medians only saw improvements of 12–34% and up to 20%, respectively. A separate data point, for an RTX 4070 Ti on Windows, saw larger matrix-multiply gains of +80.1% and +76.4%, the difference possibly caused by power limits.

In the matrix-multiply benchmark, a tested RTX 3090 Ti scored +35% for FP16, +80% for BF16, and +94% for TF32, based on a user’s test with a modified Nvidia driver. The gpu-unlock README lists BF16 matrix-multiply gains from user reports of +25–67% for the RTX 3090, +70–73% for the 3080 10GB, +56–59% for a memory-modded 20GB version, +73–81% for the 3070, and around +80% for the 3060 12GB, though it notes they are not directly comparable. The power limit “matters a lot”: the lowest figure, +25%, came from cards capped at 225 W. For Ampere, LLM prefill improved 14–36%, with diffusion and FlashAttention speeding up, but LLM decode and INT8 stayed “about the same.”

An RTX 2080 Ti with a 22GB memory mod, a Dell OEM card limited to 250 W, saw FP16 matrix-multiply improvements of +36% to +64% depending on size; BF16 is unaffected, since Turing has no BF16 hardware. A user’s variant of the card at 260 W saw a +59% improvement. A separate project, KohakUnlock, on a Leadtek 2080 Ti 22GB saw an 85% improvement on an instruction rate test, with a best matrix-multiply median of +53% against a second, locked card of the same model.

There is “not a claim of a 2× application/game speedup,” says KohakUnlock’s README. See Table 2 for a rundown of the numbers for all three generations. The turing-unlock README notes that the mod “may damage your hardware,” while KohakUnlock adds that it “can hang a GPU or host, prevent boot, corrupt data, or damage hardware,” so caution is advised.

How the exploit works

The explainer for gpu-unlock states that the rate limits are in two “speed selector” registers that the host driver can’t write, but Nvidia’s signed SEC2 “Booter” firmware has a stack buffer overflow which can be exploited to run code in “heavy secure” mode. This was discovered after Nvidia published a debug Booter encrypted with a known public test key. A single 4-byte write with the V67 payload opens the privilege mask so the host can set the full rate, and the module then resets the card before Nvidia’s driver binds it.

The underlying bug is described in Jon Pry’s “A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor,” published on Zenodo in June. The stack overflow was found on the CMP 170HX in the Heavy Secure Falcon, and the V67 constants come from WildFlash1st/cmp90hx-unlock. The pre-driver timing gpu-unlock uses appear to come from WildFlash1st’s separate Windows EFI bootloader, cmp90hx-unlock-for-windows, while the best-known use of the exploit is the CMP Unlocker for the CMP 170HX. Zagitta, the maintainer of gpu-unlock, said on Hacker News that the project is their work but “the exploits … aren’t my ideas by any means” and that the unlock “just flips the 2 bits” needed.

Zagitta said that RTX 40 support is in progress and that forks are already unlocking those cards. Zagitta added that Hopper and Blackwell cards are “out of scope for this approach” at least.

The Ada fork says other boards “remain unverified” and that shared firmware “does not establish support for untested cards.” The turing-unlock project, likewise, has a list of untested Turing IDs. Gaps remain for GA103 and most Ada and Turing cards. None of the projects contains a roadmap, but data is being gathered, as gpu-unlock is asking GPU owners for compatibility reports.

Follow Tom’s Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.