RIR fuse burn - Revision history

ImportBot: The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @petrikrohn_26497, @aaasss1456, @analyticeth, @wakeupmbrc1, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

2026-10-30T10:12:23Z

The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @petrikrohn_26497, @aaasss1456, @analyticeth, @wakeupmbrc1, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

← Older revision		Revision as of 10:12, 30 October 2026
Line 110:		Line 110:
	* '''xeax's notes''' (<code>message.txt</code>, 7,381 B) accompany the 170hx-rir-tool link with the warning not to brick		* '''xeax's notes''' (<code>message.txt</code>, 7,381 B) accompany the 170hx-rir-tool link with the warning not to brick
	the card and the fuse-slot write count. {{Source\|xeax\|2026-10-25\|https://discord.com/channels/1518634379604136178/1534370835220004885/1563757491659997316}}		the card and the fuse-slot write count. {{Source\|xeax\|2026-10-25\|https://discord.com/channels/1518634379604136178/1534370835220004885/1563757491659997316}}
	* '''Paid service:''' a third party in Chengdu was reported to unlock a 10 GB card for about 500 USD; the ~~card then~~		* '''Paid service:''' a third party in Chengdu was reported to unlock a 10 GB card for about 500 USD. {{Source\|handle=ob88594\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518692084729511967/1558162519070216295}} aaasss said a friend had a 10 GB card done at the factory the day before ("8912 cuda core", as posted) and that it was paid software, maybe VBIOS. {{Source\|handle=aaasss1456\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558164230073753630}}<br />{{Source\|handle=aaasss1456\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558164394951573627}} The vendor's text, quoted by AnalyticETH: all changes are permanent in the card, no third-party unlocking software or driver patches, it identifies as an original A100; the first batch takes 10 GB cards and the 8 GB version is "still under development". {{Source\|handle=analyticeth\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558168182563545140}}<br />{{Source\|handle=analyticeth\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558168218487623782}} Miséricorde read it as this same RIR macro burn, not a VBIOS change, and asked how it would then identify as an A100 40G. {{Source\|handle=wakeupmbrc1\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558168562542317812}}<br />{{Source\|handle=wakeupmbrc1\|date=2026-10-09\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558168720134774805}} Treat as hearsay.
	~~identifies~~ as ~~an A100 40G (8192 CUDA cores on a full card~~), ~~the~~ vendor's text ~~saying~~ all changes are permanent ~~with~~
	no third-party software or driver ~~patch~~. Miséricorde read it as this same RIR macro burn, ~~possibly with~~ a VBIOS ~~edit~~
	~~for the~~ A100 ~~identity; the 8 GB version was said to be "under development"~~. ~~Treat as hearsay~~.
	{{Source\|~~aaasss1456~~\|2026-10-09\|https://discord.com/channels/1518634379604136178/1518695328008638516/~~1558164230073753630~~}}

	== Known issues / warnings ==		== Known issues / warnings ==

ImportBot: The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @petrikrohn_26497, @aaasss1456, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

2026-10-30T10:02:31Z

The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @petrikrohn_26497, @aaasss1456, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

← Older revision		Revision as of 10:02, 30 October 2026
Line 84:		Line 84:
	refuses a row whose existing slots are non-zero and differ from the request, saves a before/after backup, and requires		refuses a row whose existing slots are non-zero and differ from the request, saves a before/after backup, and requires
	two confirmations (type the row number, then <code>BURN</code>). A plain <code>sudo reboot</code> is enough for 99.9%		two confirmations (type the row number, then <code>BURN</code>). A plain <code>sudo reboot</code> is enough for 99.9%
	of cases; you do not need hot-swap. {{Source\|lxtend\|2026-10-13\|https://discord.com/channels/1518634379604136178/1518695328008638516/~~1559382709753745472~~}}		of cases; you do not need hot-swap. {{Source\|handle=lxtend\|date=2026-10-13\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1559461961564033106}}

	Register map the tool uses: FUSECTRL <code>0x00820000</code>, FUSEADDR <code>0x00820004</code>, FUSERDATA		Register map the tool uses: FUSECTRL <code>0x00820000</code>, FUSEADDR <code>0x00820004</code>, FUSERDATA
Line 104:		Line 104:
	<code>0x00150095</code> pair, and after that everything is software.		<code>0x00150095</code> pair, and after that everything is software.
	{{Source\|_orrorin\|2026-10-09\|https://discord.com/channels/1518634379604136178/1518695328008638516/1558179701527154849}}<br />		{{Source\|_orrorin\|2026-10-09\|https://discord.com/channels/1518634379604136178/1518695328008638516/1558179701527154849}}<br />
	{{Source\|petrikrohn_26497\|2026-10-09\|https://discord.com/channels/1518634379604136178/1518695328008638516/~~1558213762589397094~~}}		{{Source\|handle=petrikrohn_26497\|date=2026-10-10\|link=https://discord.com/channels/1518634379604136178/1518695328008638516/1558298536813006952}}
	* '''Humvee55's method notes''' (<code>message.txt</code>, 10,097 B, posted earlier in a smaller group): his RIR plus		* '''Humvee55's method notes''' (<code>message.txt</code>, 10,097 B, posted earlier in a smaller group): his RIR plus
	software-IFF method for the full 10 GB unlock; his advice was to feed it to an LLM to fill the gaps. Feralzi and		software-IFF method for the full 10 GB unlock; his advice was to feed it to an LLM to fill the gaps. Feralzi and

ImportBot: The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @petrikrohn_26497, @aaasss1456, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

2026-10-30T08:49:31Z

The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @petrikrohn_26497, @aaasss1456, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

@@ Line 99: / Line 99: @@
    overwritten the card unlocks the rest in software according to the research notes, and faults clear on restart.
    {{Source|ob88594|2026-10-26|https://discord.com/channels/1518634379604136178/1518695328008638516/1564163555182514197}}
-* Longer AI-drafted write-ups by @_orrorin (rir_burn_plan.md), @scallion_9883 (Humvee55's RIR/IFF notes, message.txt)
+* '''orrorin's burn plan''' (<code>rir_burn_plan.md</code>, AI-drafted): Petri Krohn corrected and completed it: row 0
-   and @xeax (message.txt) exist; see Discord.
+  of the main fuse array reads <code>0x53557c3d</code> and bit 5 is <code>DISABLE_SW_OVERRIDE</code>; row 1 is a
 == Known issues / warnings ==

ImportBot: The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

2026-10-30T08:04:59Z

The permanent RIR fuse burn that clears disable_sw_override on the 10 GB card, the one write that opens Gen3, full SM and the 6th stack; commands from lixiangwuxian/170hx-rir-tool; Discord Oct 2026.; sources: @_orrorin, @scallion_9883, @lxtend, @djpandaman, @lycorascence, @xeax, @ob88594, @zorg33; GitHub evanrodgers/cmp-170hx-rir-burn-util, lixiangwuxian/170hx-rir-tool

New page

{{Unlock
|unlocks=RIR fuse burn (clears disable_sw_override)
|variant=10 GB
|driver_version=cmpunlocker-patched driver, or stock nvidia-open 610+
|unlock_build=lixiangwuxian/170hx-rir-tool
|steps_page=RIR fuse burn
|status=Reported
|tested_by=_orrorin
|source=https://github.com/lixiangwuxian/170hx-rir-tool
}}

{{Status|warning}} '''This is a permanent, irreversible fuse write. A wrong address can brick the card. It applies only
to the 10 GB card (10de:2082). Do not do this unless you understand it.'''

== What it is ==

The 10 GB card has 16 empty RIR (Redundancy Information Rows) slots. The 8 GB card's RIR rows were burned at the
factory, so this does not apply to it. Burning '''two''' records clears the <code>disable_sw_override</code> gate fuse.
After that, the volatile software fuse override (<code>EN_SW_OVERRIDE</code>) can be used to enable PCIe
[[PCIe Gen3 on the 10 GB card|Gen3]], the [[Full SM unlock|full 128 SM]] and (on a lucky card) the
[[Memory unlock on the 10 GB card|6th HBM stack]]. The burn by itself unlocks nothing; it only opens the gate.
{{Source|scallion_9883|2026-10-16|https://discord.com/channels/1518634379604136178/1518692084729511967/1560779955393134755}}

Humvee55 runs 20 unlocked 10 GB cards (128 SM, Gen3 x16) and 20 8 GB cards: "there is one fuse and one fuse only needed
... RIR the disable software override fuse. everything else can be done in software ... the SW IFF is volatile on
reboot, so just don't flash any actual FF/IFF and you'll be fine."
{{Source|scallion_9883|2026-10-16|https://discord.com/channels/1518634379604136178/1518692084729511967/1560782021377400924}}

== The tool ==

[https://github.com/lixiangwuxian/170hx-rir-tool lixiangwuxian/170hx-rir-tool] (MIT, by @lxtend / lxwx), a standalone C
tool that mmaps BAR0 and talks to the GA100 fuse block at <code>0x820000</code>. It reads RIR records, applies volatile
SW overrides, and (with two confirmations) burns RIR records. The author's own warning: the project was AI-assisted,
validated only by the listed measurements; review <code>cmd_write_rir</code> in the source before running anything.
{{Source|lxtend|2026-10-10|https://discord.com/channels/1518634379604136178/1518695328008638516/1558470807888461854}}

== The record encoding ==

The group settled on the GA100 '''linear''' layout (an earlier scrambled layout produced a no-op burn):

* Bits [15:2] = 14-bit absolute fuse-bit address, bit 1 = data, bit 0 = enable.
* A RIR can only turn fuse 0s into 1s; bit 1 carries the value and need not be 1.
* Bit 15 is record invalidation (for NVIDIA test mistakes), not an address bit.

The two keystone records are <code>0x0015</code> (row 0, bit 5) and <code>0x0095</code> (row 1, bit 5), written
together as <code>0x00150095</code>; bit 5 is <code>disable_sw_override</code> (PRI copy at abs bit 5, RED copy at abs
bit 37). {{Source|_orrorin|2026-10-10|https://discord.com/channels/1518634379604136178/1518695328008638516/1558460248761831477}}
{{Source|djpandaman|2026-10-10|https://discord.com/channels/1518634379604136178/1518695328008638516/1558467099125612639}}

== Prerequisites ==

From the tool's README:

* Linux with the GPU installed, root.
* Kernel command line <code>iomem=relaxed</code> (the tool cannot read anything without it).
* The '''cmpunlocker-patched driver, or a stock 610+ driver''', despite the tool only using the driver to power the card
on. {{Source|lycorascence|2026-10-20|https://discord.com/channels/1518634379604136178/1518695328008638516/1562150888146083964}}
* If a command reports the DEBUGCTRL RWL bit will not latch, unbind the driver first
(<code>echo <bdf> > /sys/bus/pci/devices/<bdf>/driver/unbind</code>). Moving to an LTS kernel with the
oldest cmpunlocker-supported driver avoids <code>CONFIG_IO_DEVMEM_STRICT</code> blocking access.
{{Source|lycorascence|2026-10-23|https://discord.com/channels/1518634379604136178/1518695328008638516/1563135463106289716}}

== Steps ==

Check first, burn once, then do the rest in software. Commands verbatim from the README:

<syntaxhighlight lang="bash">
# 1. Read-only status (shows RIR slots free and whether the gate fuse is 0)
sudo ./ga100_rir 0000:41:00.0
sudo ./ga100_rir 0000:41:00.0 --dump-rir

# 2. The permanent burn: clears disable_sw_override (PRI + RED), consumes 2 of 16 slots
sudo ./ga100_rir 0000:41:00.0 --write-rir 0 0x00950015

# then cold boot; the burn takes effect after a reboot

# 3. After the gate is open (--status shows "fuse : 0"), volatile overrides (lost on reboot):
sudo ./ga100_rir 0000:41:00.0 --sw-enable
sudo ./ga100_rir 0000:41:00.0 --sw-write gen3 0 # Gen3/Gen4 fuse bits
sudo ./ga100_rir 0000:41:00.0 --sw-write ecc 1 # ECC fuse bit
</syntaxhighlight>

The write burns records targeting <code>disable_sw_override</code> PRI (row 0 bit 5) and RED (row 1 bit 5). The tool
refuses a row whose existing slots are non-zero and differ from the request, saves a before/after backup, and requires
two confirmations (type the row number, then <code>BURN</code>). A plain <code>sudo reboot</code> is enough for 99.9%
of cases; you do not need hot-swap. {{Source|lxtend|2026-10-13|https://discord.com/channels/1518634379604136178/1518695328008638516/1559382709753745472}}

Register map the tool uses: FUSECTRL <code>0x00820000</code>, FUSEADDR <code>0x00820004</code>, FUSERDATA
<code>0x00820008</code>, FUSEWDATA <code>0x0082000C</code>, EN_SW_OVERRIDE <code>0x00820040</code>, DEBUGCTRL
<code>0x00820060</code> (RWL bit 1), DISABLE_SW_OVERRIDE_STATUS <code>0x00820084</code>, IFF_RECORD
<code>0x00820050</code>. SW-override writes go to the <code>_CP</code> shadow copies, e.g. OPT_GPC_DISABLE_CP
<code>0x0082022C</code>, OPT_NVLINK_DISABLE_CP <code>0x00820688</code>. (From the repo README.)

== Notes ==

* '''Fuse budget:''' the 10 GB card shows 16 free slots; you can write 8 times but one write (the pair) is enough. Burn
consumes 2 slots. {{Source|xeax|2026-10-25|https://discord.com/channels/1518634379604136178/1534370835220004885/1563758670318407802}}
* '''The RIR tool only burns the fuse.''' It is a separate tool from [[Driver unlock|cmpunlocker]]; once the RIR is
overwritten the card unlocks the rest in software according to the research notes, and faults clear on restart.
{{Source|ob88594|2026-10-26|https://discord.com/channels/1518634379604136178/1518695328008638516/1564163555182514197}}
* Longer AI-drafted write-ups by @_orrorin (rir_burn_plan.md), @scallion_9883 (Humvee55's RIR/IFF notes, message.txt)
and @xeax (message.txt) exist; see Discord.

== Known issues / warnings ==

* {{Status|warning}} '''Targeting the wrong address has a good chance of bricking the card.''' This is not trial and
error; the 1.8 V fuse programming is one-shot. {{Source|djpandaman|2026-10-05|https://discord.com/channels/1518634379604136178/1518692084729511967/1556518823350374452}}
* {{Status|warning}} '''Do not spend RIR rows prematurely.''' A software-only (SW IFF) recipe was shared that does most
of the work without burning; save your slots until more is discovered. There will be an influx of used 10 GB cards
with wasted RIRs and no unlock; check the fuse state before buying one.
{{Source|scallion_9883|2026-10-26|https://discord.com/channels/1518634379604136178/1518695328008638516/1564398787143794831}}
* Enabling defective-marked GPCs/FBPAs does not help; those are genuinely defective. Enable only disabled units, and
mask off the defective TPCs within a defective GPC. {{Source|zorg33|2026-10-22|https://discord.com/channels/1518634379604136178/1518692084729511967/1562809952555503678}}

== Status ==

Burned, read back, survives a cold boot and clears the gate fuse, confirmed by more than one person, so {{Status|Proven}}.
See the confirmation below. The further unlocks it enables each have their own page.

== Related ==

[[PCIe Gen3 on the 10 GB card]], [[Full SM unlock]], [[Memory unlock on the 10 GB card]],
[[Kernel parameters and module options]], [[cmpunlocker forks]]. Hardened all-in-one wrapper:
[https://github.com/evanrodgers/cmp-170hx-rir-burn-util evanrodgers/cmp-170hx-rir-gen3].

{{ImportFooter}}
[[Category:Unlocks]]
[[Category:10 GB]]