Unlock internals: status and what is next

Developer status

Status · Next steps · Contribute · Registers · Research notes

New hardware result: Kate reports 80 GiB on nine of ten 8 GB cards and about 120-126 SMs after voltage glitching and permanent FF fuse programming. See the GA100VFI results and limits. The lab's eight cards remain at the software-unlocked baseline of 64 GiB and 74 SMs; GA100VFI has not been reproduced by the lab. For software installation, use Driver unlock; for feature availability, Unlocks. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

Status board

Card names mean original capacity. The lab has eight 8 GB cards and has not tested 10 GB cards. GA100VFI and the 10 GB entries are community reports, separate from the lab's measurements. GA100VFI requires hardware work and irreversible fuse changes; these results do not imply new software-only capability. Details and sources follow below.

Target	8 GB card	10 GB card
Memory baseline (8 GB / 10 GB)	64 GiB reported by all eight	40 GB
More memory	GA100VFI: 80 GiB usable on nine of ten examined cards; one stayed at 64 GiB	48 GB reported, card-dependent; 80 GB lacks validated distinct-storage evidence in the reviewed reports
Compute	74 SMs in the lab; about 120-126 reported with GA100VFI	74 mainline; 80 reported by software; up to 128 reported after RIR burn, card-dependent
ECC / recovery	Enabled reporting; function unverified; GA100VFI ECC untested	Mixed ECC results; boot failures
PCIe Gen2 / Gen3/Gen4	Gen2 by software; Gen4 reported with GA100VFI, x16 needs capacitor mod	Gen2; Gen3 after RIR burn; conditional Gen4 report
NVLink	GA100VFI: two cards shown as NV12, with further hardware/software changes	No demonstrated trained link in the reviewed 10 GB reports

Next research steps

More usable memory is the first priority, followed by more working compute. Kate's November 10 write-up establishes a reported hardware avenue beyond the prior software-only limits. These are evidence milestones, not instructions to write registers or program fuses.

Independently reproduce GA100VFI results. Preserve per-card before/after evidence, defect masks, memory-test coverage, working-SM checks and failed-card outcomes. Nine of ten is the author's sample, not a guarantee for other cards. The lab has not performed this hardware procedure.
Find a route without permanent fuse changes. Continue tracing inactive-site transport, initialization and reversible mapping. Success needs distinct storage across both the original and added regions; the recovered frequency handler alone is not a partition-enable mechanism.
Validate compute and link performance. Keep OpenCL FMA results separate from Tensor Core and inference performance. Confirm working units, negotiated PCIe speed/width, NVLink traffic, sustained correctness and exact builds.
Test correction and recovery separately. Establish encoding and initialization before controlled tests. Success needs repeatable ECC off/on faults, separate row-repair and containment results, and restoration of register, driver and firmware state.
Reproduce 10 GB results. Document card eligibility and link prerequisites. Success needs exact builds, capacity/compute/link validation, independent reproduction and failed-card results.

Recent lab evidence

The eight-card pass used driver/GSP 615.71.09: register observations, capability/RRL queries, offline analysis and synthetic checks. It was not a fresh memory/performance qualification and demonstrated no additional usable VRAM, SMs, throughput or fault recovery. Source: @darkmaniac7, 2026-11-10 (lab notes)

Offline analysis traced the normal GA100 PMU path through sequencer acquisition/release into queued clock-domain work and an FB Falcon frequency-request handler. Static method selection identifies package image 20; runtime activation and the full transition effects remain unresolved. No memory-training or partition-activation command is qualified. A new live read-only map found 16 responsive configuration apertures on each of eight cards and temperature-polling control/echo at one sampled aperture per card. No inactive-site identity or additional capacity was established. See the November 11 findings for the measurements, firmware limits and next discriminators. Source: @darkmaniac7, 2026-11-11 (lab notes)

Findings by area

Fuses and floorsweep

The reviewed extended 10 GB unlocks use a permanent RIR burn to permit volatile overrides. The recorded 8 GB layout has no free RIR slot; factory-record reuse is untested and rated no-go. Ordinary control-mask clearing did not restore the lab's fused-off units. See Fuses and floorsweep maps and RIR fuse burn. Source: @scallion_9883, 2026-07-21
Source: repo github.com/ahnguyen17/ga100-fuse-re by ahnguyen17 on GitHub, posted by @darkmaniac7, 2026-10-18 (lab notes)

GA100VFI takes a different route on 8 GB cards: a temporary voltage-fault state permits software overrides and permanent FF fuse records that change effective disable masks while retaining defect exclusions. It does not require an unused RIR slot. Per-die fuse contents, defect masks, physical work and driver configuration remain essential; this is not a reversible register-only unlock. Reported 8 GB Kate's mechanism and limitations. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

Use reviewed read allowlists and keep the driver bound for gpcprobe. Reads can advance state; driver unbind on the lab's armed passthrough setup required a cold power cycle. The register reference is not a write recipe. See tool boundaries. Source: @darkmaniac7, 2026-11-05 (lab notes) Source: @darkmaniac7, 2026-11-10 (lab notes)

8 GB memory

Kate reports 80 GiB usable on nine of ten examined 8 GB cards after GA100VFI; one remained at 64 GiB. The report describes full-framebuffer pseudorandom writes and read-back after L2 invalidation plus inference workloads. This is author-reported functional validation, not merely a capacity screenshot. See the GA100VFI results and limits. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

Each lab card has 8 active FBPs / 16 FBPAs, 2 FBPs / 4 FBPAs disabled but not marked defective, and 2 FBPs / 4 FBPAs marked defective. Masks differ. Inactive-site presence and health remain untested on this lab sample, so the new report does not guarantee 80 GiB on these cards. The geometry already selects 16 banks; the lab has qualified no software-only extra-partition enable path. Source: @darkmaniac7, 2026-11-10 (lab notes)

Selected training-policy and StateLoad paths lead to software/cache/performance gating, with no recovered inactive-partition selector. See the census and the next evidence needed. Source: @darkmaniac7, 2026-11-11 (lab notes)

10 GB memory

The 40 GB baseline leaves about 37-38 GiB usable. A sixth stack gives 48 GB on some cards after the RIR burn: one report counted 6 of 30. See Memory unlock on the 10 GB card. Source: @cuddylac997, 2026-08-13
Source: @djpandaman, 2026-10-17

Upper-region writes in the 80 GB geometry have overwritten the lower 40 GB; GSP crashes are also reported. The reports reviewed here do not establish distinct storage across the full range. Causes and alternatives remain unresolved; newer capacity claims still need reproducible address-uniqueness evidence. See The 10 GB card: provenance and the 80 GB question. Source: @jovial_dolphin_29796, 2026-07-27
Source: @lxtend, 2026-08-10

GPCs and SMs

GA100VFI reports about 120-126 functional SMs on 8 GB cards, varying by die; the published OpenCL output shows 124 at 1,410 MHz. Its roughly 85.9 TFLOP/s result is FP16 half2 FMA, versus 50.1 software-unlocked and 72.5 on the listed retail A100. These are specific OpenCL results, not Tensor Core or general inference speedups. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

Mainline's 70-to-74 SM step uses RECONFIG. All eight lab cards have effective TPC disable equal to fused disable; ordinary overrides are exhausted. PD/DS tables agree on 37 TPCs (74 SMs); cached issue rates use the full-speed encoding. This establishes neither a universal 74 SM ceiling nor a new throughput gain. Source: @akuchen_66498, 2026-09-26
Source: @darkmaniac7, 2026-11-10 (lab notes)

10 GB results reach 80 SMs by software and up to 128 after RIR burn; some stop at 80 for disputed reasons. Use per-card masks and working-unit tests. See Full SM unlock and the detailed SM evidence and disputed claims. Source: @djpandaman, 2026-10-10
Source: @lxtend, 2026-10-17
Source: @_orrorin, 2026-10-25

ECC

ECC status: 8 GB enablement Proven; 10 GB enablement Reported, with GSP boot failures on some cards. Error correction remains Contested. The 2026-11-10 error-reduction result is one person's result on one 10 GB card and has not been independently repeated. Read the measurements and limits.

Evidence: lab enablement test 2026-10-19; 10 GB report 2026-11-10. Summary reviewed: 2026-11-10. A review is not a new hardware test. Source: @darkmaniac7, 2026-10-19 (lab notes) Source: repo github.com/AlexBrandes/cmpunlocker by AlexBrandes on GitHub

GA100VFI lists ECC, MIG, NVDEC and NVJPG as unlock opportunities but explicitly leaves them untested. Its memory and compute results do not establish these features. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

ECC-enabled reporting and zero counters do not prove correction. The lab has no functional correction result. Source: @darkmaniac7, 2026-11-10 (lab notes)

A faulty card showed no correction with ECC enabled. Source: @zombielurker, 2026-10-05
PR #68 reports fewer errors on one 10 GB card, plus card-dependent boot failures. Source: repo github.com/AlexBrandes/cmpunlocker by AlexBrandes on GitHub

Contested 8 GB and 10 GB See ECC and Memory errors and ECC.

PR #68: the 10 GB ECC boot-failure proposal was closed without merging on 2026-11-10 UTC. Its proposed per-card opt-in remains fork work; this pull request did not change mainline. The reported hardware results still need independent confirmation. See the tested versions and card limits.

Upstream state checked: 2026-11-10. Hardware report date: 2026-11-10. Source: repo github.com/AlexBrandes/cmpunlocker by AlexBrandes on GitHub Source: repo github.com/amoghmunikote/cmpunlocker by amoghmunikote on GitHub

Row remapping and fault recovery

All eight cards expose supported RRL metadata version 1.0, but the initialization gate is clear. Raw override 1 on three cards is not proof of enablement. Post-loader processing handles rows within the current topology, not inactive-partition activation. Cached global-poison recovery capability is disabled. Correction, row repair and containment need separate tests. Source: @darkmaniac7, 2026-11-10 (lab notes)

PCIe Gen2

Mainline supports Gen2 on both variants; rejected bootstrap writes leave some cards at Gen1. See Gen2 link retrain and Gen2 by platform. Source: @kmike84, 2026-09-01
Source: repo github.com/amoghmunikote/cmpunlocker by amoghmunikote on GitHub

PCIe Gen3 and Gen4

On 8 GB cards, Kate reports functional Gen3/Gen4 after GA100VFI changes the effective PCIe restrictions. Full Gen4 x16 additionally needs the capacitor modification and a compatible host. The displayed OpenCL bandwidth run is Gen3 x16; it is not a Gen4 benchmark. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

The reviewed 10 GB Gen3 route uses an RIR burn. Gen4 is reported with the capacitor modification behind a PLX switch; independent Gen4-host validation remains open. Measure negotiated speed/width, transfer rate and stability. See PCIe Gen3 on the 10 GB card. Source: @djpandaman, 2026-10-09
Source: @lxtend, 2026-10-12
Source: @cute_sc2, 2026-11-05

Warning Forcing Gen3 while the card advertised only Gen2 took a lab card off the bus; recovery needed a chassis power cycle. Follow the variant-specific prerequisites. Source: @darkmaniac7, 2026-10-14 (lab notes)

NVLink

Kate shows two 8 GB cards with NV12 topology after GA100VFI. NVLink also needs power for the bridge clock through the missing U11 footprint and a host-side ROM-check bypass. The reported solder bridge bypasses whatever regulation or protection the missing component would provide and can join +3.3 V rails across separate supplies; the author says modifying one board of a pair is sufficient. No separate NVLink bandwidth result is supplied. Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10

The cited earlier 10 GB rework reports did not establish a trained link. Independent reproduction still needs verified two-card traffic and exact hardware/software prerequisites. See NVLink for hardware and disputed firmware prerequisites. Source: @lia_oc, 2026-10-22
Source: @ghostinthedatacenter_87281, 2026-11-07

VBIOS and loaders

In-memory loader results do not establish access past fuse-gated limits. A 10 GB power-limit result is reported. See VBIOS and firmware and the loader reports and abandoned custom-image route. Source: @lxtend, 2026-10-20

How to contribute a finding

Setup: variant, device ID, VBIOS, driver/GSP versions and hashes, unlock commit, topology and settings.
Evidence type: hardware, cached query, source analysis, synthetic fixture or hypothesis; selected chip path for RE.
Reproduction: command/patch, before/after values, coverage, errors, duration and restoration. Meet the criteria above; screenshots alone are insufficient.
Credit: post to cmpunlocker Discord, then add a dated Source and status per Contributing and Status taxonomy. Use a confirmation for reproduction; do not type Proven by hand.
Next test: question and success criterion on the board. Link long write-ups. Omit serial numbers, private infrastructure, keys and signing material.

Register reference

Register map

Addresses in this table are BAR0 offsets. Values belong to the named card sample and build. The driver treats the broader 0xBADxxxxx prefix as a possible PRI error; checking only 0xBADFxxxx misses other error encodings. Historical 0xbadf2010 decodes as FECS_PRI_ORPHAN in the GA100-selected public decoder. That category alone does not establish floorsweeping, absent DRAM or the cause of an inaccessible window. Source: @darkmaniac7, 2026-11-10 (lab notes)

Address	Name	What it is and what was read	Source
`0x820040` Link to entry	EN_SW_OVERRIDE	the software fuse override enable; 0 on stock cards of both kinds	Source: @darkmaniac7, 2026-10-21 (lab notes)
`0x820084` Link to entry	DISABLE_SW_OVERRIDE_STATUS	bit 0 = 1: software override is disabled in the lab captures. GA100VFI reports a temporary zero on 8 GB cards; distinct from the permanent 10 GB RIR gate change	Source: repo github.com/kate-land/ga100vfi by kate-land on GitHub, 2026-11-10 Source: @darkmaniac7, 2026-10-21 (lab notes) Source: @darkshad03, 2026-10-04
`0x820050` Link to entry	IFF_RECORD pointer	`0x01fb01e8` on 8 GB and 10 GB cards	Source: @darkmaniac7, 2026-10-22 (lab notes) Source: @darkshad03, 2026-10-04
`0x820060` Link to entry	DEBUGCTRL	the fuse controller's debug control. The RIR tools latch a bit here; "debugctrl rwl bit cannot be latched" means the controller is not reachable	Source: @lycorascence, 2026-10-20
`0x820228` Link to entry	OPT_ECC_EN	0 on four 8 GB cards (the fuse says ECC is not enabled)	Source: @darkmaniac7, 2026-10-21 (lab notes)
`0x82022C` Link to entry	OPT_GPC_DISABLE_CP	named as the register to read on a 10 GB card that would not boot with a bad GPC6; that thread is unresolved	Source: @djpandaman, 2026-10-11
`0x820250` Link to entry	OPT_DISABLE_GEN3_SPEED	bit 0 = 1 clamps the link capability to Gen2. 1 on every stock card read	Source: @djpandaman, 2026-09-29 Source: @matstatman, 2026-09-06 Source: @darkmaniac7, 2026-10-18 (lab notes)
`0x82057c` Link to entry	FUSE_PCIE_GEN23_DIS (OPT_GEN23)	1 on stock cards	Source: @matstatman, 2026-09-06 Source: @darkmaniac7, 2026-10-18 (lab notes)
`0x820580` Link to entry	FUSE_PCIE_GEN3_DIS (OPT_PCIE_BOOT_GEN3_DIS)	1 on stock cards; a different register from `0x820250`, and the 10 GB Gen3 route needs both cleared	Source: @matstatman, 2026-09-06 Source: @darkmaniac7, 2026-10-18 (lab notes)
`0x820520` Link to entry	FUSE_PCIE_MAGIC_D	`0x16680000` on the 170HX against `0x00200000` on an A100; bit 25 is the Gen4 disable	Source: @darkmaniac7, 2026-10-18 (lab notes) Source: @darkshad03, 2026-10-04
`0x820584` Link to entry	FUSE_DEVID_SW_OVR_DIS	1: the device ID cannot be overridden in software	Source: @darkmaniac7, 2026-10-18 (lab notes)
`0x8203f0` Link to entry	FUSE_FEAT_OVR_DIS	0 on the 8 GB cards read (1 would mean the feature-override class is dead)	Source: @darkmaniac7, 2026-10-18 (lab notes)
`0x8205c4` Link to entry	OPT_GPC_DEFECTIVE	0 on Zagitta's card (no GPC marked defective)	Source: @zagitta, 2026-10-17
`0x820760` + 4 x GPC Link to entry	OPT_TPC_DISABLE rows	the fused TPC disable row of each GPC	Source: @darkmaniac7, 2026-10-22 (lab notes)
`0x820c38` + 4 x GPC Link to entry	RECONFIG STATUS rows	equal to fused TPC disable on every GPC of all eight unlocked lab cards; the tested ordinary override path has no remaining soft-disabled TPC candidate	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x823804` Link to entry	feature-override PLM (SS0 and SS1)	`0xffffffff` once the unlock has opened it	Source: @darkmaniac7, 2026-10-22 (lab notes)
`0x82381c`, `0x823820` Link to entry	SM speed selectors SS0, SS1	`0x88888888` and `0x00000008` after the compute unlock; written every boot by cmpunlocker	Source: @darkmaniac7, 2026-10-22 (lab notes)
`0x82380c`, `0x823810`, `0x82382c` Link to entry	ECC feature overrides	stock `0x00888888`, `0x002aaaaa`, `0x0000000a`; with the v0.5 ECC patch `0x00999999`, `0x003ffebf`, `0x0000000f`	Source: @darkmaniac7, 2026-10-18 (lab notes) Source: repo github.com/amoghmunikote/cmpunlocker by amoghmunikote on GitHub
`0x823814` Link to entry	FEATURE_READOUT	`0x00000233` stock, `0xec8ff233` with ECC on; bit16 is DRAM ECC. In the selected GSP recovery path, bit9 participates in the global-poison query, with a conditional fallback to `0x82039c` bit0. These fields do not prove functional correction	Source: @darkmaniac7, 2026-10-19 (lab notes) Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x9a038c` Link to entry	HBM_CFG0	`0xa7` on all eight cards; the selected firmware decoder interprets bit1 as 16 banks. Configuration evidence, not physical-density or address-uniqueness proof	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x823828` Link to entry	HBM row-remap initialization gate readout (reverse-engineered)	`0x6` on all eight cards: bit0 is clear. The selected GSP initializer skips RRL initialization on zero. Separate from ECC-enabled reporting	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x823824` Link to entry	HBM row-remap override candidate; encoding unresolved	`1` on three cards and `0` on five, while the readout gate is clear on all eight. Neither value is a demonstrated enable recipe for row repair; ECC-enabled status is separate	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x82033c` Link to entry	Global-poison override prerequisite; field name unresolved	Low nibble is `0x2` on all eight; the selected override routine requires a nonzero value. Passing this prerequisite does not establish activation or rollback	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x1373a0` Link to entry	JTAG-related clock readout	`0x9` on all eight; bit3 is already set; the GA100-selected callback reads that bit. This does not establish working scan transport or access to fuse/configuration chains	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x406028` Link to entry	PD TPC-count table base	Four words; the nibble counts total 37 TPCs on every card, matching the DS table at `0x405870`. Logical topology data, not a physical-enable control	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x405870` Link to entry	DS TPC-count table base	Four words; the nibble counts total 37 TPCs on every card. Table positions are not established physical fuse GPC indices	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x820840` Link to entry	TPC-control index2; separate MIG attribution unresolved	Overlaps the GA100-selected `0x820838 + 4*i` TPC-control writer. Do not treat a community MIG association as a validated dedicated MIG register	Source: @darkmaniac7, 2026-11-10 (lab notes)
`0x9a0148` Link to entry	FBPA PLM	`0xffffffff` (open) on an unlocked card	Source: @darkmaniac7, 2026-10-25 (lab notes)
`0x9a0168` Link to entry	FBPA_MEM PLM	`0xffffffcf` (host write bit clear) unless the driver carries the HBM-control opens	Source: @darkmaniac7, 2026-10-25 (lab notes)
`0x9a3c7c`, `0x9a3c80`, `0x9a3c84` Link to entry	broadcast FBPA_PLL0, 1, 2 PLMs	`0xffffffcf` unless opened; these carry the multicast HBM clock write	Source: @darkmaniac7, 2026-10-25 (lab notes)
`0x903c7c` Link to entry	unicast FBPA0_PLL PLM	a PRI error on a card whose FBP0 is floor-swept, and orphaned on the 10 GB card. Do not put it in a boot-time PLM table	Source: @darkmaniac7, 2026-10-25 (lab notes) Source: @rh3dai, 2026-10-04
`0x9a0204` Link to entry	FBPA_CFG1	memory geometry: `0x02779000` for 64 GB on the 8 GB card, `0x02669000` for 40 GB on the 10 GB card	Source: @darkmaniac7, 2026-11-05 (lab notes) Source: @programmerboi, 2026-10-25
`0x100ce0` Link to entry	MMU LMR (local memory range)	`0x0000020B` for 64 GB, `0x0000028A` for 40 GB, `0x0000028B` for the 80 GB geometry	Source: @darkmaniac7, 2026-10-22 (lab notes) Source: @programmerboi, 2026-10-25 Source: @_j3ns, 2026-07-20
`0x9a0470` Link to entry	FBPA_ECC_CTRL	0 stock, `0x41` with ECC on	Source: @darkmaniac7, 2026-10-19 (lab notes)
`0x8872c` Link to entry	NV_XVE_FUSE_OVERRIDE	`0x6` with the Gen2 patch. `0xA` (the Gen3 pair) eventually wedged a card under VFIO	Source: @darkmaniac7, 2026-10-18 (lab notes) Source: @ropuls, 2026-10-08
`0x8c040` Link to entry	XP link config, maximum rate field	reverse-encoded: 3 = Gen1, 2 = Gen2, 1 = Gen3	Source: @darkmaniac7, 2026-10-19 (lab notes)

Floorsweep control shadows: CTRL_OPT_FBP and CTRL_OPT_FBPA read 0 on all eight unlocked lab cards, and effective status equals the fused disable values. Source: @darkmaniac7, 2026-11-10 (lab notes)

Tools that read

Use reviewed read allowlists and keep the driver bound for gpcprobe. Only --status in 170hx-rir-tool is pure register reads; dump operations drive the fuse controller. Tool details and sources.

HBM identity: the reviewed hbmmon protocol writes control state and advances a data stream on reads. Its read-only label does not establish non-affecting hardware access. Inactive-site transport and restoration remain unqualified. Pinned source review and limitations.

Host2JTAG: open access masks and an enabled clock are prerequisites, not demonstrated scan-chain access. Prior attempts include GSP hangs; a GA100 transport and capture/update semantics remain missing. Prior experiments and missing pieces.

For the full record, see fuse/control attempts and unresolved fuse and mapping questions.