Nvidia RTX 20, 30, and 40-series GPUs hacked to remove a half-speed AI throttle

Owners of Nvidia GeForce RTX 20, 30, and 40-series graphics cards can now restore full-rate matrix math that Nvidia caps at half speed on those consumer boards, through three separate community unlock projects. Each project ships its own unofficial Linux kernel module, while experimental Windows builds take a different route. The throttle, imposed across every affected GeForce generation, limits FP32-accumulate math to half of each card's FP16-accumulate rate under Nvidia's own published specifications, and does not apply to Nvidia's Turing and Ampere professional cards. Lifting it returns native matrix throughput, which can accelerate prompt processing and image generation.

Coverage differs by generation. The gpu-unlock project handles Ampere and lists the GA102, GA103, GA104, and GA106 series IDs. A fork called gpu-unlock-ada covers the RTX 4090 and, on an experimental basis, the 4090 D, 4070 Ti Super, and 4060 Ti 16GB. The turing-unlock project, adapted from gpu-unlock, works with the RTX 2080 Ti.

The mechanism relies on a stack buffer overflow in Nvidia's signed SEC2 Booter firmware, which the gpu-unlock explainer says can be exploited to execute code in heavy secure mode after Nvidia published a debug Booter encrypted with a known public test key. A single 4-byte write using the V67 payload opens the privilege mask so the host driver can set the full rate, and the module resets the card before Nvidia's driver binds it. The underlying bug is described in Jon Pry's paper "A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor," published on Zenodo in June, with the overflow found on the CMP 170HX in the Heavy Secure Falcon. The V67 constants come from WildFlash1st/cmp90hx-unlock, and the pre-driver timing appears to come from WildFlash1st's separate Windows EFI bootloader, cmp90hx-unlock-for-windows, while the best-known use of the exploit is the CMP Unlocker for the CMP 170HX.

Performance gains vary widely. The gpu-unlock-ada developer's RTX 4090 moved from 165.6 to 331.6 TFLOPS on FP16 and 165.5 to 330.6 TFLOPS on BF16, though the fork's README says one owner's cuBLAS GEMM benchmark saw median improvements of only 12 to 34 percent, and up to 20 percent. An RTX 4070 Ti on Windows saw larger matrix-multiply gains of 80.1 and 76.4 percent, a difference the project suggests may stem from power limits. A tested RTX 3090 Ti scored 35 percent on FP16, 80 percent on BF16, and 94 percent on TF32 using a modified Nvidia driver, and the gpu-unlock README lists BF16 matrix-multiply gains of 25 to 67 percent for the RTX 3090, 70 to 73 percent for the 3080 10GB, 56 to 59 percent for a memory-modded 20GB version, 73 to 81 percent for the 3070, and around 80 percent for the 3060 12GB, while noting the figures are not directly comparable. Power limits matter a lot: the lowest figure, 25 percent, came from cards capped at 225 W. For Ampere, LLM prefill improved 14 to 36 percent, with diffusion and FlashAttention also speeding up, but LLM decode and INT8 stayed about the same.

Turing results are narrower. An RTX 2080 Ti with a 22GB memory mod, a Dell OEM card limited to 250 W, saw FP16 matrix-multiply improvements of 36 to 64 percent depending on size, with BF16 unaffected because Turing lacks BF16 hardware; a user's variant at 260 W saw 59 percent. A separate project, KohakUnlock, on a Leadtek 2080 Ti 22GB saw an 85 percent improvement on an instruction rate test and a best matrix-multiply median of 53 percent against a second, locked card of the same model. KohakUnlock's README states the work is not a claim of a twofold application or game speedup.

Zagitta, the maintainer of gpu-unlock, said on Hacker News that the project is their work but the exploits are not their ideas and that the unlock simply flips the two needed bits. Zagitta said RTX 40 support is in progress and that forks are already unlocking those cards, while Hopper and Blackwell are out of scope for this approach at least. The Ada fork says other boards remain unverified and that shared firmware does not establish support for untested cards, and turing-unlock keeps a list of untested Turing IDs. Gaps remain for GA103 and most Ada and Turing cards, no project contains a roadmap, and gpu-unlock is asking GPU owners for compatibility reports. The turing-unlock README warns the mod may damage hardware, and KohakUnlock adds that it can hang a GPU or host, prevent boot, corrupt data, or damage hardware.

More cybersecurity news from TechManNews.