How GPU Unlock works

GPU Unlock combines two earlier community techniques: the CMP card unlocker’s firmware payload, and running before the driver like the UEFI approach. This is a plain-language summary of the project’s own write-up.

The speed selectors

Two registers on Ampere GPUs set how fast different instruction types issue. They hold eight 4-bit fields covering double precision, FFMA, FP16 and FP32 matrix multiply-accumulate and the integer equivalents, plus one more field. On GeForce cards the FP16/BF16-into-FP32 fields are set to half rate. Writing 0x88888888 and 0x8 sets them all to full rate.

Why the driver cannot just write them

The registers are protected by a privilege level mask that only allows writes from the GPU’s most trusted “heavy secure” mode. Writes from the host driver are silently ignored.

The firmware flaw

During boot, the driver sends a signed “booter” firmware to the GPU’s security processor, which checks and starts NVIDIA’s main GPU firmware. That booter has a buffer overflow. Researchers decrypted a debug version that NVIDIA had published, found reusable code fragments in it, and built a payload (called V67) that performs one memory write while running in heavy-secure mode.

One write is not enough for both registers, so the payload instead opens the privilege mask that guards them. After that, the host can write the speed selectors directly.

What the module does at boot

Runs from the initramfs, before the NVIDIA driver can bind the card.
Runs the payload so the speed-select registers become writable.
Writes full-rate values to both selectors.
Performs a function-level reset (FLR) of the card.
Lets the unmodified NVIDIA driver bind as usual, now at full rate.

Because it does not patch the NVIDIA driver, new driver releases do not need re-patching. The Ada fork uses a different published payload for the AD102 chip in the RTX 4090.

The full technical write-up is in the project’s How Ampere was unlocked document.

Back to the GPU Unlock guide.