CMP 40HX - Compute, PCIe, ReBAR & Vulkan Pipeline Unlocks (Linux + Windows)

Hardware-research project for the NVIDIA CMP 40HX (TU106, PCI device ID 10de:1f0b), covering both Linux and Windows.

• Linux — open-kernel-module patches for NVIDIA 580.173.02, 610.57.04 and 615.78.08 (default), installed by install.sh; a separate proprietary CPU-RM unlock validated on 610.43.03 and 615.78.08 with GSP OFF; and an optional proprietary-userspace pipeline patch.
• Windows / UEFI (windows/) — a UEFI unlock application and Go installer/checker/uninstaller tools. See windows/README.md.

Choose the path matching your driver and OS. The proprietary Linux and Windows CPU-RM paths share the published CMP40HX selector payload and small-WPR strategy.

What it unlocks

• Compute / SM configuration unlock — changes the protected GSP/SEC2 initialization state used by the tested compute paths.
• PCIe Gen2 x16 unlock — raises the link from the stock PCIe Gen1 x16 (2.5 GT/s) to Gen2 x16 (5 GT/s) using the GSP/RM policy path plus a real link retrain.
• Resizable BAR unlock — enables an 8 GiB BAR1 aperture.
• Pipeline bind / MME throttle unlock (Linux, optional) — removes the artificial delay executed on classic vkCmdBindPipeline paths by patching the NVIDIA userspace libnvidia-glcore.so emitter.

None of these modifications flashes the VBIOS. Compute can be unlocked by patched open modules, the Linux pre-driver CPU-RM module, or the Windows EFI. The proprietary Linux path currently covers compute; PCIe/ReBAR/profiling remain features of the other paths. The pipeline unlock patches a local copy of a proprietary userspace library. Hardware unlocks are volatile and must be reapplied after a full GPU reset or power cycle.

Results

GSP OFF is now supported. Proprietary Linux 615.78.08 at a verified 150 W reached FP16 WMMA 1.0440 → 66.1629 TFLOPS and INT8 WMMA 2.0724 → 131.0379 TOPS; a numerical WMMA check matched 163,840 outputs with zero error. I confirmed successful Windows ZERO/FULL initialization, FULL unlock, and the installer's GSP-OFF upgrade. See CPU-RM results. The screenshots below describe the earlier Windows GSP-ON setup.

Measured with the independent clpeak (CUDA backend) on one Windows system, NVIDIA driver 617.14:

Before unlock

After unlock

The unlock restores Tensor Core throughput (about 63x), INT8 dp4a (about 33x) and PCIe Gen2 (2x), plus clpeak's plain CUDA FP32/FP16 loops (about 3x). It is not a global FP32 lock removal: FP32 through cuBLASLt, OpenCL and Vulkan runs at about 8.3 to 9 TFLOPS before and after. Earlier versions of this README claimed a ~0.39 TFLOPS FP32 figure; that was wrong. Details in docs/how-it-works.md.

The full tables (including OpenCL and Vulkan), PCIe Gen2, ReBAR and pipeline measurements, and how to reproduce the screenshots are in docs/results.md.

Quick start

Linux

For the proprietary driver with GSP OFF, follow linux/cpu-rm/README.md. Compute unlock runs before NVIDIA loads; the optional CPU-RM Gen2 helper runs after native initialization and was validated with 615.78.08. The commands below are for the open kernel modules.

Requires the NVIDIA open kernel module stack and matching userspace/firmware for one of the supported versions (580.173.02, 610.57.04, 615.78.08 default), a matching kernel headers package, and a C toolchain. Select the version with --driver-version=VER; per-distribution package lists and all installer options are in the Linux installation guide.

lspci -nn | grep -i nvidia   # expected: 10de:1f0b
sudo ./install.sh            # download -> SHA256 check -> patch -> build -> install
sudo shutdown -h now         # full cold power-off, not a warm reboot
sudo dmesg | grep CMP40      # expect SS0=0x88888888 SS1=0x00000008 FECS_PLM=0xffffff8f

The optional pipeline unlock is separate, selects the library version automatically, and has runtime confirmation on 610.57.04 and 615.78.08. See cmp_glcore_patch/README.md.

An optional profiling unlock for 615.78.08 is available with sudo ./install.sh --profiling. It ports CMP170HX's CMP SKU query mask; the CUPTI support gate is hardware-confirmed on 40HX; counter collection still needs a separate test. See CMP40_PROFILING.md.

Windows

Download the Windows ZIP from the Releases page, verify its checksum against the attached SHA256SUMS.txt, and extract the entire archive. Then follow windows/README.md for firmware prerequisites, installation, verification and recovery. The EFI application is unsigned, so Secure Boot must be off or you must sign it yourself.

Compatibility at a glance

• Linux: open-gpu-kernel-modules 580.173.02, 610.57.04 and 615.78.08 (default); other versions need porting and revalidation. Secure Boot must be disabled or the modules signed. Rebuild after a kernel update.
• Proprietary Linux CPU-RM: 610.43.03 and 615.78.08, GSP OFF, 8 GiB TU106; GRID/vGPU is not independently validated.
• Windows: UEFI/GPT, Above 4G Decoding on, Secure Boot and CSM off.
• Windows GSP OFF: the installer now recommends EnableGpuFirmware=0; upgrade both the EFI and installer. Gen2 no longer changes GSP.
• PCIe Gen2 x16 is verified; Gen3 and RT-core unlocks are not implemented.
• The CMP 40HX has no display outputs; graphics use needs a headless, secondary-GPU or remote-display setup.

Full list: docs/compatibility.md.

Documentation

Document	Contents
docs/linux-install.md	Linux prerequisites, installer options, verification, removal
linux/cpu-rm/README.md	Proprietary Linux driver, GSP OFF: firmware, pre-driver module, guarded handoff
windows/README.md	Windows/UEFI guide: prerequisites, installation, Secure Boot, recovery
docs/how-it-works.md	Technical description of the four unlocks
docs/results.md	Benchmark screenshots and measured results
docs/compatibility.md	Supported versions, platform notes, known issues
docs/file-structure.md	What each file and directory is
docs/licensing.md	Per-component licenses and attribution
cmp_glcore_patch/README.md	Userspace pipeline-throttle patch usage and rollback
docs/research/	Research conclusions and validation: Booter compatibility, PCIe Gen2/Gen3, profiling and pipeline throttle
ROADMAP.md	Research directions and plans

Origin and attribution. This tree is a fork of PZH1gdmu/CMP40HX-Unlock, whose UEFI unlock is in turn built on the Windows CMP90HX codebase from WildFlash1st/cmp90hx-unlock-for-windows, while its CMP40HX-specific boot flow, register state, and cleanup logic substantially build on the CMP40HX research and implementation published in this repository. Changes made in this fork — hardware-bound GSP matching, correct Windows command-line quoting under UAC elevation, the runtime --return-to-bootloader EFI handoff, the 8 GiB ReBAR path with a GPU-Z-style ReBAR readout in the checker, and a reproducible packaging/verification flow — are documented in windows/FORK_CHANGES.md. See Licensing and docs/licensing.md for the third-party components it redistributes.

Disclaimer

• This project is intended for hardware research and experimentation.
• Use it at your own risk.
• Modified kernel modules or NVIDIA userspace libraries may cause driver initialization failures, application crashes, or system instability.
• The pipeline throttle unlock creates a modified local copy of the matching libnvidia-glcore.so.<version>; never overwrite the original system library, so rollback stays trivial.
• NVIDIA licensing, warranty, and support terms may be affected.
• Keep a way to boot without the patched modules so the official driver can be restored.
• On Windows, the unlock runs from a UEFI application and the Gen2 helper loads signed low-level drivers with known vulnerabilities. Keep a Windows installer or recovery USB available before installing the EFI entry, and review the Secure Boot / HVCI / vulnerable-driver-blocklist notes in windows/README.md.

Licensing

The repository's own license is the MIT License in LICENSE. The repository also contains code derived from other projects and redistributes third-party components (a GPL-3.0 driver, a proprietary signed driver, NVIDIA firmware images) that keep their original terms, so the repository as a whole is not distributable under MIT alone. See docs/licensing.md for the per-component list.