A hardware researcher has turned an Nvidia CMP 170HX mining card, sold with 8GB of usable memory, into what she calls “effectively an A100-80G.” In one FP16 benchmark, the modified card beat a retail A100 by about 18 percent.
The researcher, who publishes as Kate, described the method in a detailed write-up on voltage glitching the GA100 chip on November 10. She also released her tools as the GA100VFI project on GitHub under the MIT license.
The work is not a simple driver hack. It needs soldering, a custom control board and up to two days of trial and error per card. Still, it exposes a design flaw in how Nvidia locks features inside the chip.
What the CMP 170HX was meant to be
Nvidia built the CMP 170HX for Ethereum mining. Tom’s Hardware reported in September 2021 that the card uses the same GA100 chip as the A100 data center accelerator. At the time, it listed 8GB of HBM2e memory, no display outputs, a 250W power envelope and a heavily cut PCIe link. The outlet said the card mined Ethereum at about 165 MH/s.
Kate’s findings tell a different story about the memory. Her post says the 8GB model actually carries about 80GB of HBM on board. The 10GB model carries about 40GB. The rest is switched off through fuses inside the chip.
Three levels of unlock compared
A software tool called cmpunlocker had already raised the usable memory on the 8GB card to 64GB. Kate credits Amogh Munikote for that tool. However, it could not get past PCIe Gen 2 or restore disabled compute units. The table below uses the figures from Kate’s post.
| Feature | Out of the box | Software unlock (cmpunlocker) | Voltage glitch unlock |
|---|---|---|---|
| Usable memory (8GB model) | 8GB | 64GB | About 80GB on most cards tested |
| Streaming multiprocessors (SMs) | 70 | 70 | 120 to 128, depending on the chip |
| PCIe generation | Gen 1 | Gen 2 | Gen 4 |
| NVLink | No | No | Yes, with an extra board mod |
| ECC and MIG | No | No | Enabled, but untested |
| NVDEC video decoders | 0 | 0 | 5, untested |
| FP16 FMA benchmark | Not listed | 50.129 TFLOPS | About 85.86 TFLOPS |
For comparison, Kate measured a retail A100 at 72.488 TFLOPS in the same FP16 test. That test was the ProjectPhysX OpenCL-Benchmark. One benchmark does not cover every AI workload, so the 18 percent lead applies only to that test.
Kate examined 10 of the 8GB cards. Nine had about 80GB of working memory. One had only 64GB intact, so the hardware unlock added no memory on that card. She checked the unlocked memory with synthetic tests and ran the vLLM and SGLang inference engines on the 80GB setup.
What changes for you
If you own or plan to buy a CMP 170HX
Don’t expect a download that turns your card into an A100. The method requires removing a tiny resistor, soldering two wires and running an external glitch board. Kate says a successful unlock took between 1 hour and 48 hours of glitching. Each chip also needs fuse values tailored to its own defects.
Results vary from card to card. Kate calls the SM count “die-lottery dependent.” Some failed glitch states left a card “basically unusable.” Kate also notes that a blown regular fuse basically cannot be reversed.
If you buy the 10GB model
Kate warns that a stable 80GB result is rare on the 10GB card. Most “unstable” 80GB readings there come from caching and memory aliasing over a true 40GB of memory.
Why it matters for chip security
The bigger issue is security design. Kate writes that “a blown fuse should always induce a more restrictive state” in a secure chip. On GA100, she found the reverse: blowing more fuses can relax restrictions. She says she disclosed the findings to Nvidia’s product security team before publishing.
How the voltage glitch works
This section covers the technical details for readers who want them.
The GA100 holds 16,384 one-time electronic fuses, called eFuses, arranged in 512 rows. These fuses tell the chip which memory, compute blocks and interfaces to enable. One group, known as fuseless or FF fuses, works like a script. Newer rows override older ones, so writing new rows can change a setting.
Production cards block these writes through a security option called SBFE. Kate’s board briefly disturbs the chip’s supply voltage during startup. The board uses an STM32G4 microcontroller. It taps the PWMVID signal and feeds its own waveform to the card’s MP2888B voltage regulator controller.
A comparator starts the timing once the core voltage reaches 225 mV. The working glitch used three pulses of about 2 ms each, starting roughly 980 ms after that trigger. In this state, the fuse controller misreads its protection settings. Kate then switches off the write protection and burns new FF rows for that specific chip.
A small Radxa single-board computer manages the loop. It can press the PC’s power and reset buttons if the host freezes. Kate also builds on earlier work by Jon Pry, and she notes that another researcher found the same flaw independently.
NVLink and PCIe extras
PCIe Gen 3 and Gen 4 links train once the right fuse bits are cleared. A full Gen 4 x16 link needs a capacitor mod. NVLink also needs a bridge across two pins on an empty board footprint and a bypass for a firmware ROM check. Kate warns that linking cards on different power supplies connects their 3.3V rails.
What remains unclear
Kate’s post gives no date for the disclosure and does not describe any response from Nvidia. Her post also flags several unknowns. The fuse map is inferred by comparing cards, not taken from official documents. She does not know whether a software-only path exists on locked cards.
Features such as MIG, ECC, NVDEC and NVJPG remain untested. Kate says her next step is to find deeper glitch states that could expose more security-sensitive fuses. She also plans a follow-up post on NVLink.
For now, the attack needs physical access and hands-on board work. That limits who can use it. Even so, it shows that hardware fuse locks on GPUs can fail under a voltage attack.
