Firmware Hack Strips Nvidia's Half-Speed AI Throttle From GeForce Cards

A firmware exploit doubles the RTX 4090's peak tensor rate from 165.6 to 331.6 TFLOPS FP16 by stripping a limit Nvidia imposed on its GeForce cards, modders reported via VideoCardz. The hack applies to RTX 20, 30 and 40-series GPUs, and an RTX 3090 Ti gained up to 94 percent on TF32 matrix math. Real applications gain far less, and chatbot token speeds barely move.

The throttle itself is simple. Across three GeForce generations, Nvidia's published specs run FP32-accumulate math at half each card's FP16-accumulate rate. The restriction does not apply to Turing and Ampere professional cards. Removing it restores native matrix-math throughput, which speeds up prompt processing and image generation. LLM decode stays put because it depends on memory bandwidth, not compute.

What does the unlock cover?

Three projects distribute the exploit, each with its own unofficial Linux module, while experimental Windows builds take a different route. Coverage varies by generation:

• turing-unlock (adapted from gpu-unlock): RTX 2080 Ti, including 22GB memory-modded cards. FP16 only, since Turing lacks BF16 hardware.
• gpu-unlock: Ampere, listing GA102, GA103, GA104 and GA106 series IDs. Confirmed on the 3090 Ti, 3090, 3080 10GB, memory-modded 3080 20GB, 3070 and 3060 12GB. The 3070 Ti and GA103 remain untested; one 3080 Ti 20GB OEM card stays at half rate.
• gpu-unlock-ada: the RTX 4090, with experimental support for the 4090 D, 4070 Ti Super and 4060 Ti 16GB.

Nothing supports RTX 50. Blackwell, like Hopper, is "out of scope for this approach" according to Zagitta, gpu-unlock's maintainer.

How large are the real gains?

Peak numbers flatter the mod. In one owner's cuBLAS GEMM benchmark cited in the gpu-unlock-ada README, an RTX 4090 at 450 W gained only 12-34 percent on FP16 and up to 20 percent on BF16. A separate Windows port on an MSI RTX 4070 Ti did better: +80.1 percent FP16 and +76.4 percent BF16, possibly a power-limit effect.

Ampere results, from user reports collected by gpu-unlock, cluster high but unevenly:

• RTX 3090: +25-67 percent BF16; the low end came from cards capped at 225 W. Power limit "matters a lot," the README notes.
• RTX 3080 10GB: +70-73 percent.
• Memory-modded 3080 20GB: +56-59 percent.
• RTX 3070: +73-81 percent.
• RTX 3060 12GB: around +80 percent.

The reports are not directly comparable, the project cautions. On Ampere, LLM prefill improved 14-36 percent, diffusion and FlashAttention sped up, while LLM decode and INT8 stayed "about the same."

Turing tells a similar story. A Dell OEM 2080 Ti with a 22GB memory mod, capped at 250 W, gained 36-64 percent FP16 depending on matrix size. A 260 W user variant gained 59 percent. The separate KohakUnlock project, on a Leadtek 2080 Ti 22GB, hit 85 percent on an instruction-rate test and a best matrix-multiply median of +53 percent against a locked twin card. An ASUS stock 2080 Ti 11GB gained 77 percent via a pre-boot loader.

The numbers are honest about their limits. KohakUnlock's README states there is "not a claim of a 2x application/game speedup." The turing-unlock README warns the mod "may damage your hardware"; KohakUnlock adds it "can hang a GPU or host, prevent boot, corrupt data, or damage hardware."

How does the exploit work?

The rate limits sit in two "speed selector" registers the host driver cannot write. Nvidia's signed SEC2 Booter firmware, however, carries a stack buffer overflow exploitable to run code in "heavy secure" mode. The opening appeared after Nvidia published a debug Booter encrypted with a known public test key. A single 4-byte write with the V67 payload opens the privilege mask so the host can set the full rate; the module then resets the card before Nvidia's driver binds it.

Jon Pry documented the underlying bug in "A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor," published on Zenodo in June. The overflow was found on the CMP 170HX in the Heavy Secure Falcon, and the V67 constants come from WildFlash1st's cmp90hx-unlock. The best-known application is the CMP Unlocker for the CMP 170HX.

Zagitta credits predecessors on Hacker News: the exploits "aren't my ideas by any means," and the unlock "just flips the 2 bits" needed. RTX 40 support is in progress, with forks already unlocking those cards. Other Ada and Turing boards "remain unverified," and none of the projects offers a roadmap, though gpu-unlock is collecting compatibility reports from owners. For now, Nvidia has said nothing, and the gap between its silicon and its shipping firmware remains the story's engine.