Hardware · Local AI · Security research

CMP 170HX Canary Unlock

Reliability of the Falcon stack-canary break that unmasks A100-class compute and memory on a mining card - what the paper measured, what the community replicated, and what still is not documented for local LLMs.

July 2026 Research window: last ~30 days Sources: paper · Reddit · X · GitHub · HN Audience: local-AI builders

1. What the CMP 170HX actually is

The NVIDIA CMP 170HX is a GA100 mining SKU from the late-Ethereum era: same die family as the A100, deliberately fuse-crippled so it was unattractive for gaming and general CUDA work. Stock characteristics that matter for local AI:

Pre-unlock, the only local-AI niche was memory-bandwidth-bound decode on small quants: HBM width was always there, so token generation could look “okay” while prefill and training were terrible. Application-level workarounds (e.g. routing around FMA in CUDA source, Xing arXiv:2505.03782) recovered some FP32 / quant inference without touching firmware - but could not restore full capacity or PCIe.

GA100 / Ampere PCI 10de:20c2 (8GB) PCI 10de:2082 (10GB) HBM2e ~1.5 TB/s class bus CC 8.0 when unlocked

2. What the canary paper actually defeated

Jon Pry, A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor (June 2026). Lab work on a single card; responsible disclosure concurrent with public release - deliberately without embargo, because the “fix” for this class of defect is fuse-burn that hurts owners first.

The break (plain language)

  1. Load signed booter - signature check still passes; no forged keys.
  2. Unbounded DMA into a signature buffer inside Heavy Secure (HS) Falcon code - a regression in newer open-kernel-modules-era booters.
  3. Canary is random but useless - the master guard sits in writable data memory on the overflow path. Uniform fill sets guard = saved copy = return address = V; check becomes V==V.
  4. HS code exec - open PLMs (privilege level masks) that normally block host writes to fuse-override registers.
  5. Host writes overrides - SM speed, framebuffer geometry, PCIe Gen2. Values can persist across FLR/driver reload until power clears the always-on island.

Measured gains (paper)

Axis Native Unlocked Notes
FP32 SGEMM ~393 Gflop/s ~12.2 Tflop/s (~31×) Safe temps (~67°C) in paper runs
FP64 / tensor paths ~191–197 Gflop/s ~11.7–11.8 Tflop/s (~59–62×) Rate fuse is a software shadow, not a physical gate
TF32 tensor ~6.2 Tflop/s ~94 Tflop/s (~15×) Full-capability part throttles only above ~85°C
Memory capacity 10 GB stock (paper part) 80 GB addressable Stability is the catch - see next section
PCIe Gen1 ×4 Gen2 ×4 (firmware) ×16 requires soldering caps; Gen3 not found
What resisted the paper’s attempts: PCIe Gen3, on-die ECC, runtime HBM mode-register programming. “We found no path” is effort-limited, not a proof of impossibility - but for buyers today, treat those as unavailable.

3. Reliability: the 64 / 40 / 80 decision

Stable memory ≠ maximum advertised memory.

This is the load-bearing fact for anyone buying a card for local AI. Community consensus in r/LocalLLaMA (mid–late July 2026) and the cmpunlocker profiles line up with the paper’s stress results:

Stock label Typical vendor Practical unlock Stability signal
8 GB (0x20C2) Hynix 64 GB at default clocks Best local-AI buy; 5th stack disabled in geometry (no bypass yet)
10 GB (0x2082) Samsung 40 GB full speed, or 80 GB unstable 80 GB often needs ~40% clock cut or refresh tradeoff

Paper stress (80 GB)

  • Hash pattern across full 80 GB read back intact → memory is real, not aliased.
  • gpu-burn at full speed: 2,796 errors at stock refresh.
  • Same card clean at 40 GB.
  • Higher refresh interval → 0 errors, ~32% throughput cost (64.6 vs 94.6 TFLOPS).

Community (July 2026)

  • u/bSun0000: 8GB Hynix → 64GB all usable at default clocks.
  • 10GB Samsung → 80GB present but unstable; lock to 40GB or drop clocks ~40%.
  • cmpunlocker encodes profiles: --profile=8gb → 64GB; --profile=10gb → 40GB.
  • Guides show nvidia-smi at 65536 MiB as the success criterion for 8GB cards.
Do not buy on “80GB A100 for cheap” headlines alone. That is the marketing frame. The reliable day-to-day envelope is 40–64 GB usable HBM with restored SM rate - still extraordinary for the price history, not a warranty A100.

4. Tooling & install shape

Early PoC repos came and went; the path people are actually running is in-driver, not a fragile userspace ROP dance every boot.

Project Role Notes (as of 2026-07-21)
amoghmunikote/cmpunlocker Primary unlocker ~74★, v0.1; 6 patches for nvidia-open 610.43.0x; Discord linked
abobasixseven/unlock-cmp-170hx Step-by-step runbook Wraps cmpunlocker; register checklist; cold power-off ritual
dartraiden/NVIDIA-patcher Legacy mining-GPU graph/CUDA path Pre-Falcon era; issue #73 is the long CMP thread history

Install shape (cmpunlocker)

  1. Linux x86-64, root, Secure Boot off (patched modules are unsigned).
  2. nvidia-open 610.43.0x userspace + firmware already installed; kernel headers match running kernel.
  3. sudo ./install.sh (auto-detect 8GB/10GB) or force --profile=8gb / --profile=10gb.
  4. Cold reboot - full power off, ~60s unplugged so WPR/always-on state clears; hot reload often lies.
  5. Verify: nvidia-smi memory, dmesg | grep SEC2_DEBUG, BAR0 register checklist, cuInit + total mem.
Why in-driver matters: PLM-open happens in kgspPrepareForBootstrap before GSP-RM. Earlier attempts that opened PLMs in the same cycle as GSP boot often left VRAM still looking like 8GB. Opening all four PLMs (not one) is called out as critical in the community guide. 
nvidia-smi --query-gpu=memory.total,clocks.max.sm --format=csv
# 8GB card success: ~65536 MiB
# 10GB card success (stable profile): ~40960 MiB

sudo dmesg | grep SEC2_DEBUG | tail -40
# Expect PLMs → 0xffffffff, SS0/SS1/CFG1/LMR writes, late PMA

5. LLMs: what is documented (and what is not)

High attention, thin long-form evidence. That is the honest state of the corpus as of late July 2026.

What exists

What is still missing (the gap)

Nvidia sold a 64gb card and labeled it 8gb. the best local ai card of 2026 was sitting in an e-waste bin wearing a label nvidia wrote to hide it. — @knowix_eth on X (July 2026 window)
For content / local-AI guides: the market already re-rated the silicon (~$200–300 → ~$1k+ in about a week; mining pools reported hashrate spikes from unlock news). Practitioners still need someone to publish boring, reproducible benches at full unlocked VRAM and large context. That is the high-attention hole.

6. Buy / build checklist

  1. Prefer 8GB Hynix (0x20C2) if the goal is stable 64GB at full clocks. Confirm PCB / memory where possible; post-news sellers will claim anything.
  2. Budget the new floor - FOMO pricing is live; Alibaba/eBay cancelations after stock evaporates are a recurring complaint.
  3. Host: Linux, Secure Boot off, plan for nvidia-open 610.43.x pin (or whatever branch the unlocker supports when you install).
  4. I/O expectations: Gen2 ×4 unless you solder. Fine for single-user inference; less ideal for multi-GPU host PCIe saturation stories.
  5. Day-one verify: registers + nvidia-smi capacity + CUDA device mem + matmul sanity.
  6. Day-two stress before trust: gpu-burn / memory stress at full unlocked size; only then load models that fill VRAM.
  7. Inference stack: start llama.cpp for simplicity; add vLLM when you need concurrent serving and want A100-class software paths.

Good fit

  • Local agent / long-context single-user box
  • 70B-class Q4–Q5 if 64GB holds
  • Builders who will stress-test and document
  • Price/perf hunters comfortable with driver pins

Bad fit

  • Need ECC / multi-tenant trust
  • Need Gen4/Gen5 PCIe or display out
  • Want plug-and-play Windows WDDM gaming
  • Expect warranty A100 behavior at full 80GB

7. Residual risks (read before you spend)

Ethics note from the paper: Pry declined coordinated-disclosure embargo because the vendor’s “fix” for product differentiation defects is often irreversible fuse revocation that strips capability from owners. Public simultaneous disclosure was framed as the user-protective choice. Different products (confidential multi-tenant GPUs) may deserve different handling for the same memory-safety class.

8. What I’ll document next

If I end up buying and building, the posts people still need are not more “unlock is crazy” screenshots. They need:

Until those exist, treat this page as a reliability briefing, not a green light to max out credit cards on every Alibaba listing labeled “unlockable GA100.”

9. Sources