CMP 40HX - Compute, PCIe, ReBAR & Vulkan Pipeline Unlocks (Linux + Windows)

Hardware-research project for the NVIDIA CMP 40HX (TU106, PCI device ID 10de:1f0b), covering both Linux and Windows.

• Linux (repository root) — three open-kernel-module patches for NVIDIA 610.57.04 plus one optional proprietary-userspace patch, installed by install.sh.
• Windows / UEFI (windows/) — a UEFI unlock application and Go installer/checker/uninstaller tools. See windows/README.md.

The two halves are independent: they unlock the same hardware by different means and share no code. Pick the one matching your OS.

What it unlocks

• Compute / SM configuration unlock — changes the protected GSP/SEC2 initialization state used by the tested compute paths.
• PCIe Gen2 x16 unlock — raises the link from the stock PCIe Gen1 x16 (2.5 GT/s) to Gen2 x16 (5 GT/s) using the GSP/RM policy path plus a real link retrain.
• Resizable BAR unlock — enables an 8 GiB BAR1 aperture.
• Pipeline bind / MME throttle unlock (Linux, optional) — removes the artificial delay executed on classic vkCmdBindPipeline paths by patching the NVIDIA userspace libnvidia-glcore.so emitter.

None of these modifications changes the VBIOS or video memory. The compute, PCIe and ReBAR unlocks patch the NVIDIA open kernel module (Linux) or run from a UEFI application (Windows). The pipeline unlock is separate and patches a local copy of a proprietary userspace library. The unlocks are volatile and must be reapplied after a full GPU reset or power cycle.

Results

Measured with the independent clpeak (CUDA backend) on one Windows system, NVIDIA driver 617.14:

Before unlock

After unlock

The unlock restores Tensor Core throughput (about 63x), INT8 dp4a (about 33x) and PCIe Gen2 (2x), plus clpeak's plain CUDA FP32/FP16 loops (about 3x). It is not a global FP32 lock removal: FP32 through cuBLASLt, OpenCL and Vulkan runs at about 8.3 to 9 TFLOPS before and after. Earlier versions of this README claimed a ~0.39 TFLOPS FP32 figure; that was wrong. Details in docs/how-it-works.md.

The full tables (including OpenCL and Vulkan), PCIe Gen2, ReBAR and pipeline measurements, and how to reproduce the screenshots are in docs/results.md.

Quick start

Linux

Requires the NVIDIA open kernel module stack and userspace/firmware version exactly 610.57.04, a matching kernel headers package, and a C toolchain. Per-distribution package lists and all installer options are in the Linux installation guide.

lspci -nn | grep -i nvidia   # expected: 10de:1f0b
sudo ./install.sh            # download -> SHA256 check -> patch -> build -> install
sudo shutdown -h now         # full cold power-off, not a warm reboot
sudo dmesg | grep CMP40      # expect SS0=0x88888888 SS1=0x00000008 FECS_PLM=0xffffff8f

The optional pipeline unlock is separate: see cmp_glcore_patch/README.md.

Windows

Download the latest build from the Releases page (each release includes SHA256SUMS.txt; prebuilt executables are no longer committed to the repository), then follow windows/README.md for firmware prerequisites, installation, verification and recovery. The EFI application is unsigned, so Secure Boot must be off or you must sign it yourself.

Compatibility at a glance

• Linux: NVIDIA 610.57.04 only; other versions need porting and revalidation. Secure Boot must be disabled or the modules signed. Rebuild after a kernel update.
• Windows: UEFI/GPT, Above 4G Decoding on, Secure Boot and CSM off.
• PCIe Gen2 x16 is verified; Gen3 and RT-core unlocks are not implemented.
• The CMP 40HX has no display outputs; graphics use needs a headless, secondary-GPU or remote-display setup.

Full list: docs/compatibility.md.

Documentation

Document	Contents
docs/linux-install.md	Linux prerequisites, installer options, verification, removal
windows/README.md	Windows/UEFI guide: prerequisites, installation, Secure Boot, recovery
docs/how-it-works.md	Technical description of the four unlocks
docs/results.md	Benchmark screenshots and measured results
docs/compatibility.md	Supported versions, platform notes, known issues
docs/file-structure.md	What each file and directory is
docs/licensing.md	Per-component licenses and attribution
cmp_glcore_patch/README.md	Userspace pipeline-throttle patch usage and rollback
docs/research/	Research notes and evidence: PCIe Gen2 diagnostics, Gen3 investigation, Link Disable audit, pipeline throttle findings
ROADMAP.md	Research directions and plans

Origin and attribution. This tree is a fork of PZH1gdmu/CMP40HX-Unlock, whose UEFI unlock is in turn built on the Windows CMP90HX codebase from WildFlash1st/cmp90hx-unlock-for-windows, while its CMP40HX-specific boot flow, register state, and cleanup logic substantially build on the CMP40HX research and implementation published in this repository. Changes made in this fork — hardware-bound GSP matching, correct Windows command-line quoting under UAC elevation, the runtime --return-to-bootloader EFI handoff, the 8 GiB ReBAR path with a GPU-Z-style ReBAR readout in the checker, and a reproducible packaging/verification flow — are documented in windows/FORK_CHANGES.md. See Licensing and docs/licensing.md for the third-party components it redistributes.

Disclaimer

• This project is intended for hardware research and experimentation.
• Use it at your own risk.
• Modified kernel modules or NVIDIA userspace libraries may cause driver initialization failures, application crashes, or system instability.
• The pipeline throttle unlock creates a modified local copy of libnvidia-glcore.so.610.57.04; never overwrite the original system library, so rollback stays trivial.
• NVIDIA licensing, warranty, and support terms may be affected.
• Keep a way to boot without the patched modules so the official driver can be restored.
• On Windows, the unlock runs from a UEFI application and the Gen2 helper loads signed low-level drivers with known vulnerabilities. Keep a Windows installer or recovery USB available before installing the EFI entry, and review the Secure Boot / HVCI / vulnerable-driver-blocklist notes in windows/README.md.

Licensing

The repository's own license is the MIT License in LICENSE. The repository also contains code derived from other authors and redistributes third-party components (a GPL-3.0 driver, a proprietary signed driver, NVIDIA firmware images) that keep their original terms, so the repository as a whole is not distributable under MIT alone. See docs/licensing.md for the per-component list.