Imagine you bought a powerful car. A massive engine, a great transmission, a full tank. You slam the accelerator, the car starts speeding up, and suddenly the electronics say:

"Stop. You're not allowed to go faster."

Not because the engine can't handle it. Not because it's overheating. Simply because somewhere inside the control unit, there is a limiter.

Now imagine that years later, someone manages to get into that control unit, changes a few protected settings, and discovers: the car could have been driving significantly faster this whole time.

Roughly speaking, this is what is currently happening with certain NVIDIA graphics cards.

Researchers from the gpu-unlock project have breached the protected part of the Ampere-family GPU boot chain and figured out how to modify the internal registers that control the execution speed of certain compute instructions.

On the RTX 3090 and related cards, the performance boost in specific matrix computations reaches dozens of percent. On the RTX 4090, a separate project showed some FP16/BF16 tensor operations achieving nearly double the instruction throughput.

And the most interesting part:

this isn't your average overclock.

The core clock wasn't cranked up to madness. Voltage wasn't shoveled in by the bucket. NVIDIA's stock driver kept right on working after the procedure.

The researchers simply found a door that wasn't supposed to be opened.

If You’re Already Rushing Out to Buy an RTX 3090

Stop.

If you decided that Cyberpunk is now going to give you +80% FPS, you can close this tab and go about your day.

That didn't happen.

The RTX 3090 didn't magically become 80% faster across all workloads. Games didn't suddenly get a second graphics card for free. Memory bandwidth didn't double.

What has been unlocked is a very specific mechanism tied primarily to the throughput rate of certain FP16/BF16 tensor instructions with FP32 accumulation.

Because of this, real-world applications experience varying effects.

LLM prefill and heavy matrix operations can experience noticeable speedups. In published results for Ampere, the LLM prefill speedup sits roughly between 14% and 36%.

LLM decode, however, frequently runs into memory bottlenecks, so don't expect any miracles there.

If you just want the bottom line—"the card got faster"—there you go.

It's going to get worse from here.

We still have SEC2, the Booter, ROPs, PLMs, and protected registers to get through.

Normal people usually leave at this point.

For some reason, engineers keep reading.

Fine. Let’s Close the Door

Inside an NVIDIA GPU, there is a lot more than just a massive number-crunching engine.

It houses its own trusted boot chain, microcontrollers, secure firmware, and distinct privilege levels.

One of the participants in this process is called SEC2—Security Engine 2.

When the GPU boots up, it executes an NVIDIA-signed Booter. This component participates in verifying, decrypting, and launching subsequent firmware components.

Think of it as a security guard living right inside the graphics card.

And it's precisely this guard that had a problem.

Inside the Booter being used, researchers found a classic buffer overflow that allows the stack to be corrupted.

A buffer overflow on its own doesn't equal complete control. But that's where the good old art of memory exploitation begins.

The researchers built a ROP chain (Return-Oriented Programming).

Instead of loading their own unsigned code, they forced the processor to sequentially execute existing fragments of legitimate, signed NVIDIA firmware.

The result is an almost mockingly elegant architecture:

the secure firmware itself executes the actions that the security measures were meant to forbid.

And Exactly What Was Locked Down?

This is where the story gets especially interesting.

Inside the GPU, there are SM Speed Select registers that dictate the issuance pace of various computing instructions.

For a subset of operations, the card was operating well below its full available tempo.

The researcher's dilemma is obvious: you can't just take a Linux driver and write new values into these registers.

Write attempts are simply ignored.

Because standing in front of them is another lock—the Privilege Level Mask, or PLM.

Regular hosts aren't allowed in there.

However, signed firmware executing inside the secure SEC2 context possesses the necessary privileges.

And that is why the Booter vulnerability was needed.

The ROP chain is used to modify the protected PLM. Once that's done, the previously inaccessible Speed Select registers become writable.

From there, the module sets the full-speed values, executes a Function Level Reset, and...

exits stage left.

After that, the standard, unmodified NVIDIA driver loads up.

It sees the graphics card.

CUDA works.

And the modified register state persists.

No constantly running "magic driver" tricking the system every second is required to maintain the effect.

The limiter has already been lifted.

So What Are the Real Numbers?

This is where TikTok ends and telemetry begins.

For the RTX 30 family, published user benchmarks show varying outcomes depending on the specific model and power limits.

Published reports indicate the RTX 3090 delivers roughly +25–67% BF16 GEMM performance.

The RTX 3090 Ti shows up to +68–80%.

The RTX 3080 hits around +70%.

The RTX 3070 reaches up to +73–81%.

So the core narrative of a massive performance leap is not a fabrication.

However, turning that into a headline reading, "NVIDIA Was Hiding 80% of the RTX 3090's Power," would be incorrect.

That would be a lie.

The limitation applies to specific classes of instructions, and your final application speedup depends entirely on what your code is actually doing.

And then the RTX 4090 enters the picture.

A separate research branch has already reached the Ada architecture.

In benchmarks, RTX 4090 FP16 performance with FP32 accumulation scaled from roughly 165.6 to 331.6 TFLOPS.

BF16/FP32 jumped from roughly 165.5 to 330.6 TFLOPS.

Practically an exact double.

Later independent runs yielded a similar outcome: roughly 160 → 320 TFLOPS.

Meanwhile, INT8 and standard scalar FP32 remained virtually unchanged.

This last point is critically important.

It clearly demonstrates that the researchers didn't find a mystical button labeled "MAKE GPU TWICE AS FAST."

They found a specific hardware limiter constraining specific computational pathways.

And This Is Where It Gets Genuinely Interesting

This story is not really about free RTX overclocking at all.

It's about the boundary between hardware and software policy.

We are conditioned to view a processor's or graphics card's specifications as a fixed physical property of the device.

So many cores.

This much memory.

So many TFLOPS.

That's the limit.

Yet, a modern accelerator has long ceased to be just a hunk of silicon.

It is silicon plus microcode plus firmware plus fuse configuration plus capability tables plus protected registers plus drivers plus manufacturer policy.

And sometimes, the space between the phrases:

"the hardware can't do it"

and

"the hardware wasn't allowed to do it"

comes down to just a few bits.

In the case of gpu-unlock, the researchers didn't break out a soldering iron on an RTX 3090.

They altered the rules by which pre-existing hardware was permitted to utilize its own computing blocks.

And they managed to bypass those rules thanks to a vulnerability in the secure boot chain.

That is why, to me, this is first and foremost a security story.

Protection That Guards More Than Just You

Secure Boot is usually explained simply:

it protects the device from running unauthorized code.

True.

At the same time, a trusted computing environment also protects the manufacturer's policy from the device owner.

As long as the chain of trust remains intact, certain hardware configurations sit right there on your desk, yet you are powerless to change them.

You own the graphics card.

You just don't own all the decisions the graphics card makes.

And it only takes a single flaw in a trusted component for that boundary to abruptly shift.

In this instance, that flaw turned out to be the Booter.

By gaining the ability to execute within a privileged context, the researchers didn't uncover "secret extra Tensor Cores."

No hidden cores magically appeared.

They gained access to capabilities already built into the silicon.

What Comes Next

Right now, the most fascinating part isn't even the 3090.

The RTX 30 series has long been a favorite for home AI servers precisely because of its price-to-performance ratio, the 3090's 24GB of VRAM, and a massive supply of used cards.

If further testing confirms stability, compatibility, and real-world gains in LLMs, diffusion models, FlashAttention, and other matrix-heavy workloads, older Ampere cards might receive an unexpected second wind.

For now, though, this remains a research project.

Different boards, different firmware variants, different power limits, and different workloads are in play. You cannot automatically extrapolate a successful test to mean any random RTX card will transform into a professional accelerator tomorrow.

And you certainly shouldn't turn your expensive production GPU into a lab rat simply because someone on Reddit typed "+80%."

Let the people who actually know how to read kernel logs be the lab rats first.

The Glass Bridge

There is a wonderful paradox to this story.

For years, engineers built increasingly complex walls of trust inside GPUs: signed firmware, secure memory regions, privilege masks, security processors.

And the researchers didn't bother breaking down the wall.

They found a bug on the security guard.

The guard unlocked the service door.

Behind that door, they found a switch.

And it turned out that a portion of the massive computing machine's power wasn't constrained by a physical silicon limit this whole time.

It was constrained by a single word:

"forbidden."

Sometimes, the distance between "impossible" and "unlocked" really does come down to a single bit.

And one person who simply wondered why that bit existed in the first place.