Abstract
Hello guys, hoping you're doing fine. Wall of text next I know, but I want to get this info out of my chest, all hand written lol. I wanted to make this post explaining some things about GPU unlocks that have been going on lately. What are these GPU unlocks doing? NVIDIA on purpose neuters tensor core performance when using FP32 accumulation (FP16, BF16, FP8 and TF32 inputs accumulating in FP32, which is what most AI/LLM/ML tasks use), for market segmentation. Normal FP32 on the CUDA cores (no tensor cores) is NOT affected. Consumer and prosumer GPUs use the exact same die (like GB202 between the 5090 and 6000 PRO, AD102 between the 4090 and 6000 Ada, or even literally 1:1 with the 3090 Ti vs A6000, both with the same core amounts and 84 SMs). How it works: the speed of each kind of tensor operation is set by fuses burned at the factory. On consumer cards, the fuse for "FP16/BF16 with FP32 accumulation" says HALF_SPEED, on the pro cards it says FULL_SPEED. These fuses don't cut any circuit, the GPU just reads them at boot and runs at that speed. The GPU also has an override register that can set them back to FULL_SPEED, but it's locked so only NVIDIA's most privileged firmware can write to it, not your PC. The unlocks open that lock and write FULL_SPEED on the override. With that, the consumer cards gain all the neutered performance imposed by NVIDIA. It doesn't give you more SMs, VRAM or anything like that, a 4090 is still a 4090, it just runs those instructions at the same rate a pro card does. Why can Turing, Ampere and Ada be unlocked? And what is unlocked on these cards? On these generations, the NVIDIA driver itself loads a small NVIDIA-signed firmware called the "Booter" onto a security microcontroller inside the GPU (SEC2, a "Falcon"), to start the GSP. The Booter runs in the highest privilege mode of the GPU (Heavy Secure, HS), which is exactly the one allowed to open the lock. In June 2026, Jon Pry published a paper ("A Canary in the Crypto Mine") showing that the Booter of the newer drivers has a buffer overflow: it copies its "signature" data using a length that you control, so you can overflow its stack (including the stack canary that is supposed to stop exactly this) and take control of the Booter while it is running in HS mode. The signature check still passes, because it is NVIDIA's own signed code running, the bug is inside it. With that, the unlock reuses instructions from NVIDIA's own Booter to open the lock, writes FULL_SPEED on the override, resets the card and lets the normal NVIDIA driver load. The unlock survives resets and driver reloads, but it's lost when you power off, which is why it runs on every boot before the NVIDIA driver loads. This was first done on mining cards (CMP 170HX: FP32 from 1/32 to full speed, and 10GB to 80GB of VRAM), and then ported to GeForce: Turing: https://github.com/haohervchb/Turing-unlock (UEFI, Linux) Ampere: https://github.com/Zagitta/gpu-unlock (Linux kernel module) Ada: https://github.com/JustAResearcher/gpu-unlock-ada (Linux with kernel module) What gets unlocked: FP16 with FP32 accumulation (Turing, Ampere, Ada) BF16 with FP32 accumulation (Ampere, Ada; Turing has no BF16) TF32 (Ampere, Ada) FP8 with FP32 accumulation (Ada; Turing and Ampere have no FP8) Some numbers from those repos: 4090 FP16/BF16 with FP32 acc goes from 165 to 331 TFLOPS (raw instruction rate), 3090 Ti BF16 GEMM from 87 to 157 TFLOPS, 2080 Ti FP16 with FP32 acc from 47 to 94 TFLOPS. Real-world GEMMs gain less than 2x because the cards then hit their power limit (more on that below). Why can't consumer Blackwell be unlocked? The funny part is that on Blackwell the limitation is EXACTLY the same thing: same fuses, same override registers. I checked on my own cards: the 5090/5080/5070 Ti have the FP32 accumulation fuses set, and the 6000 PRO/4000 PRO don't. So it's not a hardware difference there either. What changed is the door. Starting with Hopper, and consumer Blackwell too, the root of trust of the GPU is the FSP (Foundation Security Processor), a RISC-V core that boots from its own ROM as soon as the GPU powers on, before the driver even loads. On Blackwell: There's no Booter to abuse. The driver just sends the FSP a message with a hash + RSA-3K signature of the next firmware, and the FSP verifies and boots it. The Linux kernel docs literally say: "There is no SEC2 involvement, no Booter ucode, and no FWSEC-FRTS stage". I also checked it myself: in NVIDIA's 615 driver source the Booter only exists for Turing, Ampere and Ada (TU102, TU116, GA100, GA102, AD102), and the RTX 50 VBIOSes don't carry the Falcon firmware (FWSEC) that older cards did. The firmware the driver ships for Blackwell is encrypted, and the debug and production images are the exact same encrypted bytes. The Ada payload was built from analysis of the decrypted debug Booter, on Blackwell there's no such shortcut. NVIDIA has said it uses SPARK (a formally verifiable programming language) to prove its most critical RISC-V firmware free of runtime errors, and a buffer overflow like the one used on the older cards is exactly that kind of error. So, with what is known today, it can't be done. It isn't "impossible forever", but someone would need a brand new vulnerability in a way harder target. And if someone ever gets there, the unlock itself would very likely be the same couple of register writes. FP4 is not affected, but all the rest is (FP16/BF16/FP8/TF32 with FP32 accumulation). In which tasks is the unlock has most of the effect? I will put some examples on my 6000 PRO vs 5090s, former using 400W and latter 600W, at how much is the impact in performance because the NVIDIA neutering. Training: Like LoRAs, finetuning, etc. Example: Using the same batch size for 25GB VRAM to train a diffusion LoRA, my 6000 PRO is 70-90% faster than my 5090. Diffusion: Models that do txt2img, txt2vid, img2img, img2vid, txt2aud, etc. Example: My 6000 PRO not using fp16 accumulation is about 30-40% faster than my 5090. If using fp16 accumulation, it is 15% faster. Prefill on LLMs: Heavily affected as well, since even when a model is marked as "int8" or "mixed precision" etc, the inference parts that the GPU uses include FP32 accumulation parts, except if explicitly set to not use them. Example: My 6000 PRO on vLLM on a model that fits on a 5090 as well, it's 50-70% faster. On llamacpp, instead is about 30-40% faster. TG with big batching: TG with a single batch is mostly bandwidth bound, and it uses FP32 acc instructions, but since it is so little in comparison with the need of bandwidth, it isn't a limitation. On the other hand, when you use batches with batch size 2, 4, 8, etc, compute again starts to being a bottleneck and then you have a performance impact. Example: Same results as previous point. In which tasks the unlocks makes no difference: TG with batch size 1: almost entirely bandwidth bound. CUDA compute without tensor cores (normal FP32). INT4/INT8 tensor operations. FP4 on Blackwell (not neutered to begin with). GEMM operations with FP16 accumulation instead, but those aren't very used. Gaming. Is there a risk by unlocking the cards, like burning the card, crashes, etc? Short answer: NO. And again, NO. For the love of god guys, stop repeating this nonsense. The cards are still limited by their max power limit. They won't magically use 200% of your power budget with an unlock, they will just use the cores more efficiently. Let me explain: if you have a 3090 power limited at 300W, and without the unlock you were seeing only 250W in use, but after the unlock it uses 300W, it's not because the unlock did malicious things to your card. It's because the card can NOW stretch its legs and use the power to do more work. Real example from the Ada repo: an unlocked 4090 doing the same GEMMs peaked at 346W vs 313W stock, still under its 450W limit. If you were getting X performance at Y < max TDP, and now you get more than X performance at max TDP, obviously the card will be hotter, but that's still inside the POWER LIMIT YOU SET, not above it. Power spikes: those are normal on every card, and if you're using it to the full extent of its capabilities they can be more common. Are they risky? No, assuming you have a PSU with the wattage NVIDIA recommends per GPU. So what ARE the actual risks then? They're about the unlock process, not your card: It runs an exploit on NVIDIA's firmware before the driver loads. If something fails mid-way, the tools stop and you need a full power off before trying again (a reboot isn't enough). Read the repo instructions, especially on laptops and multi-GPU setups. NVIDIA could patch it in future drivers, or even burn anti-rollback fuses so the old Booter stops being accepted. That wouldn't damage your card, it would just close the door for good. "But, NVIDIA bins the dies to make these work 24/7 on the prosumer side but not on consumer, that's why they're locked!!!11" Also incorrect. NVIDIA uses the EXACT SAME dies for their consumer GPUs and their prosumer GPUs, and the FP32 accumulation speed has nothing to do with binning: the 3090 Ti and the A6000 have the exact same specs. The half speed is just a value written in a fuse that the firmware reads. Unlocking a card will not make it die sooner, nor will it crack the die or something. Sorry I have to repeat this again and again, but the amount of pure fury I get from reading comments like these made me do this. Does affect gaming performance? None known at the moment, except if somehow NVIDIA uses FP32 accumulation for DLSS or FG, which I doubt. I'm almost sure they use FP16 accumulation (or lower precisions) there, because if they used FP32 accumulation the perf hit would be insane on consumer cards. The model I run says it is Q8, or FP6, or 4bit, or INT4, or anything that doesn't mention FP32, am I affected? It depends on how the GPU actually does the math, not on the name of the quant: If the kernel dequantizes the weights to FP16/BF16 and multiplies on the tensor cores with FP32 accumulation, you're affected. That's the case for FP16/BF16 models and most vLLM paths, including AWQ/GPTQ with Marlin kernels (the weights are INT4, but the math is FP16 with FP32 accumulation). FP8 (W8A8) also accumulates in FP32, so it's affected too (Ada and Blackwell). If the kernel uses integer tensor math (INT8 x INT8), it isn't affected. A lot of llama.cpp's quantized matmuls work like this, which is one reason llama.cpp sees a smaller gap than vLLM. Attention (like FlashAttention) almost always uses FP16/BF16 with FP32 accumulation, so long contexts get hit even on quantized models. FP4 (NVFP4/MXFP4) on Blackwell: not affected. Example: on a modded 48GB 4090, a quantized MoE model on an inference server got no gain at all after the unlock (0.98x on 8K prefill), while the FP16/BF16 matmuls doubled. That's what I have for now, if you guys have any more questions, let me know! submitted by /u/panchovix to r/StableDiffusion [link] [comments]