Qualcomm X1e DSP firmware reverse engineered

A 12-patch Linux kernel series by developer justririll brings the ADSP and CDSP of an X1E80100 Snapdragon laptop up under Linux without a signing pass, using the stock qcom_q6v5_adsp remoteproc driver. On the single ASUS Vivobook S15 tested, both DSPs start and stop, battery service and speakers work over the audio DSP, and llama.cpp runs on the NPU over the compute DSP; the README labels the work "slopware written largely by AI agents" (Claude Code and Codex) and warns it may hard reset the machine. The boot sequences were bisected group by group against shipped hypervisor behavior, and the compute DSP's 103 IOMMU apertures were bisected individually, with every patch flagged Assisted-by rather than Signed-off-by to keep AI work out of the kernel sign-off chain.

What was done justririll 12-patch series brings the ADSP and CDSP of an X1E80100 laptop up under Linux without a signing pass, then boots battery, speakers and the NPU. Written largely by AI agents from hypervisor analysis. justririll patch series starts and stops the audio and compute digital signal processors of an X1E80100 Snapdragon laptop running Linux directly below the shipped hypervisor layer, using the kernel stock qcom q6v5 adsp remoteproc driver and no signing pass. The README opens by calling the work slopware written largely by AI agents, Claude Code and Codex, from reverse-engineered Qualcomm firmware, tested on exactly one laptop, and warns it may hard reset your machine. How it was done The boot sequences were bisected group by group against the shipped hypervisor behaviour: each section of the boot sequence was switched off one at a time and only the groups whose removal stopped a DSP from starting were kept. The compute DSP 103 IOMMU apertures were then bisected one by one, with names taken from the hardware directory inside the DSP firmware rather than guessed. Clock programming lives in the remoteproc driver, moving into the kernel clock framework as a 17-patch alternative, and every patch is flagged Assisted-by rather than Signed-off-by because kernel process rules keep AI work out of the sign-off chain. Results On the ASUS Vivobook S15 tested, both DSPs boot and stop, the battery service and speakers work over the audio DSP, and llama.cpp runs on the NPU over the compute DSP with the firmware the device already shipped. A suspend test cycle resumes with both DSPs running, though an overnight sleep is untested. Starting and stopping the compute DSP works through the standard kernel control; a restart of the audio DSP with the audio stack loaded still needs a helper script. No firmware files ship; the work only reads what is on the machine.