cd /news/ai-agents/qualcomm-x1e-dsp-firmware-reverse-en… · home › topics › ai-agents › article
[ARTICLE · art-154651] src=reversedwithai.com ↗ pub= topic=ai-agents verified=true sentiment=· neutral

Qualcomm X1e DSP firmware reverse engineered

A 12-patch Linux kernel series by developer justririll brings the ADSP and CDSP of an X1E80100 Snapdragon laptop up under Linux without a signing pass, using the stock qcom_q6v5_adsp remoteproc driver. On the single ASUS Vivobook S15 tested, both DSPs start and stop, battery service and speakers work over the audio DSP, and llama.cpp runs on the NPU over the compute DSP; the README labels the work "slopware written largely by AI agents" (Claude Code and Codex) and warns it may hard reset the machine. The boot sequences were bisected group by group against shipped hypervisor behavior, and the compute DSP's 103 IOMMU apertures were bisected individually, with every patch flagged Assisted-by rather than Signed-off-by to keep AI work out of the kernel sign-off chain.

by read2 min views5 publishedOct 21, 2026
Qualcomm X1e DSP firmware reverse engineered
Image: source

What was done #

justririll 12-patch series brings the ADSP and CDSP of an X1E80100 laptop up under Linux without a signing pass, then boots battery, speakers and the NPU. Written largely by AI agents from hypervisor analysis.

justririll patch series starts and stops the audio and compute digital signal processors of an X1E80100 Snapdragon laptop running Linux directly below the shipped hypervisor layer, using the kernel stock qcom_q6v5_adsp remoteproc driver and no signing pass. The README opens by calling the work slopware written largely by AI agents, Claude Code and Codex, from reverse-engineered Qualcomm firmware, tested on exactly one laptop, and warns it may hard reset your machine.

How it was done

The boot sequences were bisected group by group against the shipped hypervisor behaviour: each section of the boot sequence was switched off one at a time and only the groups whose removal stopped a DSP from starting were kept. The compute DSP 103 IOMMU apertures were then bisected one by one, with names taken from the hardware directory inside the DSP firmware rather than guessed. Clock programming lives in the remoteproc driver, moving into the kernel clock framework as a 17-patch alternative, and every patch is flagged Assisted-by rather than Signed-off-by because kernel process rules keep AI work out of the sign-off chain.

Results

On the ASUS Vivobook S15 tested, both DSPs boot and stop, the battery service and speakers work over the audio DSP, and llama.cpp runs on the NPU over the compute DSP with the firmware the device already shipped. A suspend test cycle resumes with both DSPs running, though an overnight sleep is untested. Starting and stopping the compute DSP works through the standard kernel control; a restart of the audio DSP with the audio stack loaded still needs a helper script. No firmware files ship; the work only reads what is on the machine.

── more in #ai-agents 4 stories · sorted by recency
── more on @qualcomm 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/qualcomm-x1e-dsp-fir…] indexed:0 read:2min 2026-10-21 · —