Duplicate from TOTORONG/AD103_win_unlocker

e95a646 2 days ago

5.11 kB

---
language:
- en
- ko
tags:
- uefi
- ad103
- rtx4080
- research
---
# AD103_win_unlocker — RTX 4080 32GB modded-card experiment

**TOTORONG's public release announcement — prepared October 23, 2026.** This refers to this project's first public release, not a verified world-first or industry-first claim. The actual publication date is the Hugging Face commit timestamp.

Repository: [TOTORONG/AD103_win_unlocker](https://huggingface.co/TOTORONG/AD103_win_unlocker)
[한국어](README.ko.md) · [Installation/extraction](docs/INSTALL.en.md) · [Register/disassembly notes](docs/ANALYSIS.en.md) · [License policy](LICENSE-POLICY.md)

## Demonstrated configuration
This is a compute-selector modification case on **one non-SUPER RTX 4080 AD103 modified to 32GB**, not a 4080 SUPER.
The hardware test used **Windows 11, no iGPU, and no secondary/external GPU or eGPU**. The same RTX 4080 provided display output and compute. The UEFI application preloaded Windows Boot Manager, disconnected the GPU firmware driver, performed the transaction, and handed control to Windows.
Performance was measured in WSL2 on that Windows host with PyTorch 2.8.0+cu128 / CUDA 12.8. The reported power limit was 320W and memory was 32760 MiB.

## Observed results
v0.4.18 / RUN19 recorded successful selector writes/readbacks and persistence through PCIe FLR and GOP reconnection; the user confirmed Windows boot. FBPA did not reach its requested value.

| Name | BAR0 offset | Before | Requested | Observed after fire |
|---|---|---|---|---|
| WPR_CFG | `0x001fa7cc` | `0x0004cb8f` | `0xfffff0ff` | `0xfffff0ff` |
| FBPA | `0x009a0148` | `0xffffff0f` | `0xffffffff` | `0xffffff0f` |
| WPR | `0x001fa7c4` | `0x0004cb8f` | `0xffffffff` | `0xffffffff` |
| FEAT | `0x00823804` | `0xffffff8f` | `0xffffffff` | `0xffffffff` |
| SS0 | `0x0082381c` | `0x31322012` | `0x88888888` | `0x88888888` |
| SS1 | `0x00823820` | `0x00000007` | `0x00000008` | `0x00000008` |
| GEMM | N | Baseline TFLOPS | Unlocked TFLOPS | Increase |
|---|---:|---:|---:|---:|
| FP32 | 4096 | 34.55 | 35.07 | 1.52% |
| FP16 → FP32 accumulation/output | 4096 | 91.54 | 182.80 | 99.71% |
| BF16 → FP32 accumulation/output | 4096 | 91.91 | 184.49 | 100.73% |
| FP32 | 8192 | 33.42 | 33.69 | 0.80% |
| FP16 → FP32 accumulation/output | 8192 | 97.77 | 156.28 | 59.85% |
| BF16 → FP32 accumulation/output | 8192 | 97.76 | 167.64 | 71.48% |
 correctness=True covers a sampled FP64 comparison and a whole-output NaN/Inf check, not exhaustive numerical or long-term stability certification. No DLSS, RT, FP8 or application-level LLM speedup is claimed.
## Transaction outline
- Validate device, ROM mapping and asset hashes; preload Windows Boot Manager.
- Manual U; disconnect GPU firmware driver; prepare FWSEC/WPR2.
- One SEC2 START attempts WPR_CFG → FBPA → WPR → FEAT.
- Check marker, HALT, DEBUGINFO and required PLM readbacks; record FBPA mismatch as nonfatal.
- Attempt/read back SS0 and SS1 separately; clear BME; FLR; verify PCI/GFW/WPR2 recovery.
- Release DMA resources; reconnect GOP; observe selectors; start Windows.

An earlier multi-START attempt timed out on the second execution. Residual internal mutex state is a hypothesis, not an established diagnosis. A single START reached three target PLMs; treating FBPA mismatch as nonfatal enabled the final selector stage. This release presents the procedure and observations without verbose raw runtime logs.

## Contents and scope
Includes buildable source, BOOTX64.EFI, generated payload, local stock-asset extraction tools, a ROM checker, selected disassembly material, register tables and benchmark tooling. **No ROM/PROM dumps, NVIDIA firmware binaries, full debug plaintext images or verbose runtime logs are distributed.** Obtain stock assets locally.
The distributed EFI is pinned to `10de:2704 / 10de:1795` and a specific ROM hash. Another card with the same product name may be rejected. Editing identity/hash constants alone is not a validated port. Other 40X0 research can use the annotated material, but compatibility is not claimed.

## Responsibility and licensing
**You assume the risk of deciding to use and run this software.** Boot failure, loss of display, data corruption, hardware damage and other losses are possible. It is provided AS IS without warranty. Authors/contributors disclaim liability to the extent permitted by applicable law; this does not purport to exclude mandatory legal liability.
Code retains **GPL-2.0-only and applicable third-party licenses**. No extra noncommercial or lawful-integration prohibition is imposed on GPL code. Newly written explanatory/analytical documents are **CC BY-NC 4.0**, attributed to TOTORONG. Do not remove original attribution or falsely present others' work as your original creation. See LICENSE-POLICY.md for precise boundaries.

## Acknowledgments
Built on Zagitta/gpu-unlock, Ampere/CMP research, NVIDIA open kernel modules and envytools. TOTORONG does not claim original authorship of upstream research/code. Retained notices are in UPSTREAM-THIRD_PARTY_NOTICES.md and source/firmware-tools/NOTICE.md.

	---
	language:
	- en
	- ko
	tags:
	- uefi
	- ad103
	- rtx4080
	- research
	---
	# AD103_win_unlocker — RTX 4080 32GB modded-card experiment

	TOTORONG's public release announcement — prepared October 23, 2026. This refers to this project's first public release, not a verified world-first or industry-first claim. The actual publication date is the Hugging Face commit timestamp.

	Repository: [TOTORONG/AD103_win_unlocker](https://huggingface.co/TOTORONG/AD103_win_unlocker)
	[한국어](README.ko.md) · [Installation/extraction](docs/INSTALL.en.md) · [Register/disassembly notes](docs/ANALYSIS.en.md) · [License policy](LICENSE-POLICY.md)

	## Demonstrated configuration
	This is a compute-selector modification case on one non-SUPER RTX 4080 AD103 modified to 32GB, not a 4080 SUPER.
	The hardware test used Windows 11, no iGPU, and no secondary/external GPU or eGPU. The same RTX 4080 provided display output and compute. The UEFI application preloaded Windows Boot Manager, disconnected the GPU firmware driver, performed the transaction, and handed control to Windows.
	Performance was measured in WSL2 on that Windows host with PyTorch 2.8.0+cu128 / CUDA 12.8. The reported power limit was 320W and memory was 32760 MiB.

	## Observed results
	v0.4.18 / RUN19 recorded successful selector writes/readbacks and persistence through PCIe FLR and GOP reconnection; the user confirmed Windows boot. FBPA did not reach its requested value.

	\| Name \| BAR0 offset \| Before \| Requested \| Observed after fire \|
	\|---\|---\|---\|---\|---\|
	\| WPR_CFG \| `0x001fa7cc` \| `0x0004cb8f` \| `0xfffff0ff` \| `0xfffff0ff` \|
	\| FBPA \| `0x009a0148` \| `0xffffff0f` \| `0xffffffff` \| `0xffffff0f` \|
	\| WPR \| `0x001fa7c4` \| `0x0004cb8f` \| `0xffffffff` \| `0xffffffff` \|
	\| FEAT \| `0x00823804` \| `0xffffff8f` \| `0xffffffff` \| `0xffffffff` \|
	\| SS0 \| `0x0082381c` \| `0x31322012` \| `0x88888888` \| `0x88888888` \|
	\| SS1 \| `0x00823820` \| `0x00000007` \| `0x00000008` \| `0x00000008` \|

	\| GEMM \| N \| Baseline TFLOPS \| Unlocked TFLOPS \| Increase \|
	\|---\|---:\|---:\|---:\|---:\|
	\| FP32 \| 4096 \| 34.55 \| 35.07 \| 1.52% \|
	\| FP16 → FP32 accumulation/output \| 4096 \| 91.54 \| 182.80 \| 99.71% \|
	\| BF16 → FP32 accumulation/output \| 4096 \| 91.91 \| 184.49 \| 100.73% \|
	\| FP32 \| 8192 \| 33.42 \| 33.69 \| 0.80% \|
	\| FP16 → FP32 accumulation/output \| 8192 \| 97.77 \| 156.28 \| 59.85% \|
	\| BF16 → FP32 accumulation/output \| 8192 \| 97.76 \| 167.64 \| 71.48% \|

	correctness=True covers a sampled FP64 comparison and a whole-output NaN/Inf check, not exhaustive numerical or long-term stability certification. No DLSS, RT, FP8 or application-level LLM speedup is claimed.

	## Transaction outline
	- Validate device, ROM mapping and asset hashes; preload Windows Boot Manager.
	- Manual U; disconnect GPU firmware driver; prepare FWSEC/WPR2.
	- One SEC2 START attempts WPR_CFG → FBPA → WPR → FEAT.
	- Check marker, HALT, DEBUGINFO and required PLM readbacks; record FBPA mismatch as nonfatal.
	- Attempt/read back SS0 and SS1 separately; clear BME; FLR; verify PCI/GFW/WPR2 recovery.
	- Release DMA resources; reconnect GOP; observe selectors; start Windows.

	An earlier multi-START attempt timed out on the second execution. Residual internal mutex state is a hypothesis, not an established diagnosis. A single START reached three target PLMs; treating FBPA mismatch as nonfatal enabled the final selector stage. This release presents the procedure and observations without verbose raw runtime logs.

	## Contents and scope
	Includes buildable source, BOOTX64.EFI, generated payload, local stock-asset extraction tools, a ROM checker, selected disassembly material, register tables and benchmark tooling. No ROM/PROM dumps, NVIDIA firmware binaries, full debug plaintext images or verbose runtime logs are distributed. Obtain stock assets locally.
	The distributed EFI is pinned to `10de:2704 / 10de:1795` and a specific ROM hash. Another card with the same product name may be rejected. Editing identity/hash constants alone is not a validated port. Other 40X0 research can use the annotated material, but compatibility is not claimed.

	## Responsibility and licensing
	You assume the risk of deciding to use and run this software. Boot failure, loss of display, data corruption, hardware damage and other losses are possible. It is provided AS IS without warranty. Authors/contributors disclaim liability to the extent permitted by applicable law; this does not purport to exclude mandatory legal liability.
	Code retains GPL-2.0-only and applicable third-party licenses. No extra noncommercial or lawful-integration prohibition is imposed on GPL code. Newly written explanatory/analytical documents are CC BY-NC 4.0, attributed to TOTORONG. Do not remove original attribution or falsely present others' work as your original creation. See LICENSE-POLICY.md for precise boundaries.

	## Acknowledgments
	Built on Zagitta/gpu-unlock, Ampere/CMP research, NVIDIA open kernel modules and envytools. TOTORONG does not claim original authorship of upstream research/code. Retained notices are in UPSTREAM-THIRD_PARTY_NOTICES.md and source/firmware-tools/NOTICE.md.