A hardware hacker has turned one of Nvidia’s deliberately crippled cryptocurrency mining cards into a powerful datacentre accelerator, exposing embarrassing secrets about the chipmaker’s product restrictions.
The researcher, known as Kate, discovered that Nvidia’s CMP 170HX mining card contained far more working hardware than customers were allowed to use. According to Kate’s original technical report and Tom’s Hardware, she used clever electrical manipulation to unlock 80GB of memory and enough processing power to outperform a standard A100 accelerator in one benchmark.
The CMP 170HX was originally sold to cryptocurrency miners with either 8GB or 10GB of accessible memory. However, the 8GB version actually has around 80GB of expensive HBM2e memory installed, with Nvidia’s internal restrictions preventing customers from using most of it. Apparently, the company believed that customers should be grateful for the privilege of ignoring memory they had already purchased.
Kate’s breakthrough involved attacking the GA100 processor’s internal fuse controller, which determines which parts of the chip can operate. Nvidia uses these electronic fuses to disable hardware features and divide essentially similar silicon into products serving different markets.
The controller manages 16,384 fuses, controlling everything from memory access to processing units and high-speed connections. Some restrictions protect customers from defective silicon, while others appear to exist because Nvidia would prefer to sell them a more expensive product.
Previous researchers had already found software methods to unlock additional memory on the mining cards. Those techniques could expose as much as 64GB on some models, although significant processing capabilities and other features remained inaccessible.
Kate went further by exploiting a weakness in the controller’s security mechanisms. She used voltage fault injection, which briefly disturbs the chip’s electrical supply at the right moment to make its protection circuitry misbehave.
The equipment included an inexpensive STM32G4 microcontroller board costing less than $10. A carefully timed voltage glitch allowed Kate to bypass restrictions preventing changes to protected fuse settings, making it possible to activate previously disabled hardware.
The process required considerably more care than randomly applying electricity until something caught fire. Kate examined the disabled processing units and deliberately preserved restrictions covering genuinely defective components, avoiding the unfortunate consequences of asking broken silicon to perform miracles.
The results were impressive. Nine of the ten 8GB cards tested exposed their full 80GB of memory, while the remaining card managed 64GB. The modification could restore PCIe 4.0 connectivity and NVLink support, giving the former mining hardware capabilities associated with Nvidia’s professional accelerators.
The biggest embarrassment came from the processing benchmarks. One unlocked card delivered 85.86 TFLOPS in an FP16 fused multiply-add test, compared with 72.49 TFLOPS for a standard A100. That represents an improvement of approximately 18 per cent, thanks to more functioning streaming multiprocessors being enabled.
Nvidia’s commercial A100 uses 108 streaming multiprocessors, although the underlying GA100 design contains 128. Kate found that some mining chips had considerably more usable units than Nvidia permitted its expensive data centre customers to access. The discovery suggests that the silicon lottery can be surprisingly generous when somebody manages to persuade the manufacturer to stop interfering.
The economics make the exercise especially entertaining. CMP 170HX cards have been available for a few thousand dollars, while an A100 80GB accelerator commanded prices exceeding $20,000 during its commercial life. However, an experimental conversion carries obvious risks and lacks the support associated with a commercial data centre product.
Kate disclosed the vulnerability to Nvidia before publishing her findings on 10 November. Another researcher had independently discovered the same weakness, which influenced her decision to release the work publicly. Nvidia has yet to demonstrate that its product segmentation is particularly happy about this development.
