gpu-unlock lifts RTX 3090 Ti BF16 GEMM from 87 to 157 TFLOPS with a firmware exploit

The project is published as GPU unlock 1.0.0 by Zagitta under GPL-2.0-only. It runs before the NVIDIA driver loads, so it works with the stock driver and does not need re-patching for each driver release. For anyone serving matmul-heavy inference on these cards, that removes the per-release driver-patching work earlier unlocks required. The trade is that the module gets there through a firmware exploit, which is a different kind of risk from a driver patch.

The README describes the module as combining the CMP unlocker's V67/PLM technique with the pre-driver timing of the UEFI approach. It runs the unlock and writes two speed selectors: SS0 to 0x88888888, which selects the full BF16 rate, and the 4-bit SS1 to 0x8 (IMLA4). It then performs FLR before the unmodified NVIDIA driver binds the card.

One Hacker News commenter argued the headline was wrong and that the unlock only removes a halving of FP32. The README says the effect is on FP/BF16 FMA into FP32 operations, meaning 16-bit inputs with FP32 accumulation, which is the configuration in the benchmark. The commenter who identified as the author gave the same answer. The README's 3090 Ti table also lists TF32 rising from 42.58 to 82.61 TFLOPS. The README does not explain which selector controls TF32.

The headline numbers come from a single RTX 3090 Ti running dense 8192-cubed GEMM at 450 W. Each figure is the median of five samples with FP32 accumulation.

The README also has a table of user-reported BF16 GEMM gains, each measured with the reporter's own benchmark:

There are exceptions. On the OEM RTX 3080 Ti 20 GB (GA102-250, 10de:2205), the unlock completes but BF16 stays at half rate. The RTX 3070 Ti has not been tested with this module, although the same unlock worked from a UEFI port on Windows. There are no reports for GA103. Because each report used its own benchmark, the README warns that the figures are not directly comparable. A commenter who said they had seen reports only for 3090-class cards was pointed to the issue tracker, which covers the cards above.

The gain follows arithmetic intensity. The README reports LLM prefill speedups of 14-36% across four user reports, along with faster diffusion and FlashAttention. LLM decode is limited by memory bandwidth and does not change, and neither does INT8 work. The reports that compared outputs found them bit-identical before and after the unlock.

For a serving setup on 3090s, this means time-to-first-token on long prompts improves, while per-token generation speed on a single stream does not. One Hacker News commenter reported up to a 30% prefill boost in vLLM, depending on the kernels and prefill size. Another claimed 133 tokens per second on a 27B model, about 3.2x. Nothing in the README supports a decode gain of that size, so that figure should be treated as unverified. On training, commenters disagreed: one said it is often bandwidth-bound, another said it is compute-bound if batch sizes are large enough. The sources contain no training benchmarks.

The mechanism is the main risk. A commenter quoted the project's own documentation on how the unlock gets control of the card:

The commenter who identified as the author added more detail. The production firmware is encrypted, but NVIDIA published encrypted debug images that could be decrypted with a public test key. Those images were close enough to production firmware to build the exploit from. In their words, no unsigned code is executed, but the exploit still gets code execution control. Another commenter expects future hardware to use signed firmware that locks these settings.

The build downloads pinned NVIDIA and CachyOS inputs over HTTPS, checks their SHA-256 hashes, and generates the firmware payload locally. The payload derives from the pinned CMP reference, and NVIDIA firmware remains under NVIDIA's own terms. Neither the README nor the discussion mentions warranty or NVIDIA's position. The README does say that suspend to RAM powers the cards off and resets the selectors, which suggests the change lives in volatile state, but it does not state this directly.

The 3090 Ti result was measured at 450 W, and the README says the lowest reported gain (+25%) came from cards capped at 225 W. One commenter warned that the full payoff on some cards requires raising the power limit to 450 W, which they said is beyond what stock coolers were designed for. Another commenter saw gains without changing the power limit.

The commenter who identified as the author explained that the unlock flips the bits that halve the issue rate. At a fixed power cap, the card moves down its frequency curve to stay within the limit, so how much gain remains depends on the workload, and the card runs somewhat hotter. That commenter reported running two water-cooled 3090s for a month without problems. That is one setup, not a stability study. The sources have no thermal data, failure rates or long-duration tests on air-cooled cards.

The module only acts when the kernel command line opts in. It must run from the initramfs, before nvidia binds the card. Loading it by hand after boot does nothing to a card nvidia has already bound.

According to commenters, this module can run alongside the existing P2P driver mod because it loads first. A separate port for RTX 4090 and 4070 Ti Super requires a pinned driver version.