# Build the Debian image with full firmware

The full firmware path builds firmware components from source and then assembles the Debian image. It requires an authorized Qualcomm developer account, which you register for at the Qualcomm support portal.

Complete all of the following steps in order.

1. Install the Qualcomm Software Center command-line interface (QSC CLI).
2. Set up the build host.
3. Sync the firmware.
4. Install the build tools.
5. Build the firmware components.
6. Build the Debian image.

## Prerequisites

See [Host requirements](https://docs.qualcomm.com/doc/SP80-A0399-4/topic/host-requirements.html#host-requirements).

## Install the QSC CLI

Install curl and download the QSC CLI package for your host architecture. Install it and sign in. Use the x64 package on an Intel or AMD host and the ARM64 package on an ARM64 host.

1. Install `curl`.

sudo apt install curl
        Copy to clipboard
2. Download the QSC CLI (x64).

curl -L "https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Software_Center/Linux/Debian/latest.deb" -o qsc_installer.deb
        Copy to clipboard
3. Download the QSC CLI (ARM64).

curl -L "https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Software_Center/Linux/ARM64/Debian/latest.deb" -o qsc_installer.deb
        Copy to clipboard
4. Install the package and sign in.

sudo apt update && sudo apt install ./qsc_installer.deb
        qsc-cli login -u <username>
        Copy to clipboard

## Set up the build host

Install the firmware build dependencies, configure credentials, set the locale, and configure git. Run these steps on the Ubuntu host that builds firmware.

1. Install the host packages.

sudo apt update
        sudo apt install build-essential chrpath cpio debianutils diffstat \
          file gawk gcc git iputils-ping libacl1 locales python3 \
          python3-git python3-jinja2 python3-pexpect python3-pip \
          python3-subunit socat texinfo unzip wget xz-utils zstd
        sudo apt-get install lib32stdc++6 libncurses5 libssl-dev curl
        Copy to clipboard
2. Configure `~/.netrc` with your Qualcomm credentials. First generate a personal access token (PAT).

qsc-cli login -u <username>
        qsc-cli show-access-token
        Copy to clipboard
3. Add the following lines to `~/.netrc`, using your Qualcomm login ID and the personal access token as the password.

machine chipmaster2.qti.qualcomm.com
        login <qualcomm-login-id>
        password <PAT-token>
        
        machine qpm-git.qualcomm.com
        login <qualcomm-login-id>
        password <PAT-token>
        Copy to clipboard
4. Set the locale.

sudo locale-gen en_US.UTF-8
        sudo update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
        export LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
        Copy to clipboard
5. Configure git.

git config --global user.email <email>
        git config --global user.name "<name>"
        git config --global http.postBuffer 1048576000
        git config --global http.maxRequestBuffer 1048576000
        git config --global http.lowSpeedLimit 0
        git config --global http.lowSpeedTime 999999
        git config --global http.https://chipmaster2.qti.qualcomm.com.followRedirects true
        git config --global http.https://qpm-git.qualcomm.com.followRedirects true
        Copy to clipboard

## Sync the firmware

Create the firmware root directory and clone the firmware source at the release tag. Check the release notes for the latest firmware release tag.

> 
> 
> mkdir -p <FIRMWARE_ROOT> && cd <FIRMWARE_ROOT>
>     git clone -b <firmware-release-tag> --depth 1 \
>     https://qpm-git.qualcomm.com/home2/git/qualcomm/glymur-lnx-1-0_ap_standard_oem.git
>     # Example release tag: r00065.1
>     Copy to clipboard

## Install the build tools

Install the toolchains and utilities that the firmware components require. Always check the release notes for the exact versions your build needs, because versions differ per component. Set the common environment variables at the end before you build any component.

1. Set up Python 3.12.10. Install the version the specific component requires. Skip if Python 3.12.10 or later is already installed.

python3 --version   # check current version
        wget https://www.python.org/ftp/python/3.12.10/Python-3.12.10.tgz
        tar -xvf Python-3.12.10.tgz
        cd Python-3.12.10
        ./configure --prefix=/opt/python3 --enable-optimizations
        make && make install
        export PATH=$(dirname $(which python3)):$PATH
        export PYTHONPATH=<python_install_path>/lib:$PYTHONPATH
        Copy to clipboard
2. Set up Snapdragon LLVM compiler. The Qualcomm package manager (QPM) is the distribution channel for Snapdragon LLVM. Download QPM from the [Qualcomm Package Manager (QPM3) download page](https://qpm.qualcomm.com/#/main/tools/details/QPM3) and copy it to the Ubuntu machine.

    1. Install with qpm-cli.

sudo dpkg -i QualcommPackageManager3*.Linux-x86.deb
            qpm-cli --login
            qpm-cli --install sdllvm_arm --version <version>
            # Example:
            qpm-cli --install sdllvm_arm --version 18.0.1
            Copy to clipboard
    2. Install with qsc-cli.

cd <FIRMWARE_ROOT>
            mkdir llvm
            qsc-cli login
            qsc-cli tool activate-license --name sdllvm_arm
            # LLVM 18.0.1 — required for XBL, TZ, aDSP
            qsc-cli tool install --name sdllvm_arm --required-version 18.0.1 \
            --path <FIRMWARE_ROOT>/llvm/18.0.1
            chmod -R 777 <FIRMWARE_ROOT>/llvm/18.0.1
            Copy to clipboard

    The expected install path is `<FIRMWARE_ROOT>/llvm/18.0.1/bin or /pkg/qct/software/llvm/release/arm/18.0.1/bin`.
3. Set up Qualcomm Hexagon DSP toolchain. Building non-HLOS (high-level operating system) images requires a specific Hexagon toolchain version. For more information, see the Hexagon Tools Installation Guide (80-N2040-32).

qsc-cli tool extract --name hexagon --required-version 19.0.02
        export HEXAGON_ROOT=$HOME/Qualcomm/HEXAGON_Tools
        Copy to clipboard
4. Set up device tree compiler (DTC). Install from APT or build from source. For more information, see XBL Customization Using DeviceTree (80-PE663-2).

    1. Option A - APT (recommended).

sudo apt-get install device-tree-compiler
            dtc --version
            Copy to clipboard
    2. Option B - Build from source.

git clone https://git.kernel.org/pub/scm/utils/dtc/dtc.git
            cd dtc
            git tag -l   # list available tags
            git reset --hard v1.7.2   # or latest tag
            make
            export DTC_PATH=$(pwd)
            Copy to clipboard
5. Set up SCons. This is required to build TrustZone (TZ) Trusted Applications (TAs). It provides faster builds and the ability to rebuild individual libraries without a full rebuild. For more information, see the [SCons documentation](https://scons.org).

python3 -m pip install \
          --trusted-host=pypi.org \
          --trusted-host=files.pythonhosted.org \
          --user scons==4.0.1
        export PATH=$PATH:<path_to_scons>
        Copy to clipboard
6. Set the common environment variables before any firmware build.

export SECTOOLS=<target_root>/common/sectoolsv2/ext/Linux/sectools
        export SECTOOLS_DIR=<target_root>/common/sectoolsv2/
        export LLVM_ROOT=<FIRMWARE_ROOT>/llvm/18.0.1
        export HEXAGON_ROOT=<path-to-hexagon-tools>
        export DTC_PATH=<path-to-dtc>
        Copy to clipboard

## Build the firmware components

Build each firmware component with its required toolchain versions. Confirm the versions against the release notes before you start, because each component pins different tool versions. Build the components in the following order.

1. XBL (boot) - Tools: Snapdragon LLVM 18.0.1, Python 3.12.0, DTC. Host: Ubuntu 22.04 or later.

cd <XBL_root>
        sudo apt-get install iasl
        python -m pip install -r boot_images/boot_tools/dtschema_tools/oss/requirements.txt
        Copy to clipboard

    Build:

> 
> 
> python boot_images/boot_tools/buildex.py --variant WP -r RELEASE -t glymur
>         Copy to clipboard

    Clean:

> 
> 
> python boot_images/boot_tools/buildex.py --variant WP -r RELEASE -t glymur --build_flags=cleanall
>         Copy to clipboard
2. UEFI - Tools: Snapdragon LLVM 18.0.1, Python 3.12.0, DTC. Host: Ubuntu 22.04 or later. Build instructions are available at `<target root>/uefi_images/Docs/uefi_doc/Build/HowToBuildReadme.html`.

export PATH=/pkg/qct/software/ubuntu/python/3.12.0/bin:$PATH
        cd <UEFI_root>
        python ./uefi_images/edk2-non-oss-qualcomm/Platform/Qualcomm/build_qc.py \
        -t GlymurDefaultPkg,GlymurToolsPkg,GlymurTestPkg -r RELEASE -i UEFI,GlymurTools,GlymurTest
        Copy to clipboard
3. AOP (Always on processor) - Tools: Snapdragon LLVM 18.0.0, Python 3.12.10, DTC. Host: Ubuntu 22.04 or later.

cd <AOP_root>
        python aop_proc/build/ms/build_variant.py glymur.gen.prod bparams=-k
        Copy to clipboard
4. TrustZone, Devcfg, and secure apps - Tools: Snapdragon LLVM 18.0.0, Python 3.6 to 3.9, SCons 4.0.1. Host: Ubuntu 22.04 or later. Qualcomm provides the TrustZone binary; only Devcfg (OEM device configuration) is recompilable. TrustZone and secure apps ship as TZ.XF (tz\_root) and TZ.APPS (tzapps\_root).

cd <tz_root>
        export SECTOOLS=<target_root>/common/sectoolsv2/ext/Linux/sectools
        python3 trustzone_images/build/ms/build_all.py CHIPSET=glymur \
        --config=build_config_deploy_glymur.xml
        Copy to clipboard

    1. Build all TrustZone Devcfgs.

python3 trustzone_images/build/ms/build_all.py CHIPSET=glymur --config=build_config_deploy_glymur.xml
            Copy to clipboard

        Clean all.

python3 trustzone_images/build/ms/build_all.py CHIPSET=glymur --clean
            Copy to clipboard
    2. Build only Devcfg.

python3 trustzone_images/build/ms/build_all.py CHIPSET=glymur devcfg --config=build_config_deploy_glymur.xml
            Copy to clipboard

        Clean only Devcfg.

python3 trustzone_images/build/ms/build_all.py CHIPSET=glymur --clean devcfg
            Copy to clipboard
    3. Build one secure app (TrustZone trusted application).

scons -C [path to TA SConstruct] CHIPSET=[CHIPSET] [target name] qtee_sdk_version=[SDK Version] [OPTION]
            # example
            scons -C qtee_tas/apps/securemsm/trustzone/qsapps/sample_ta/ CHIPSET=glymur sample_ta64 qtee_sdk_version=latest verbose=1
            Copy to clipboard

7. SOCCP - Tools: Snapdragon LLVM 18.0.2, Python 3.12.10, Zephyr 3.7 LTS, Zephyr SDK 0.16.x, DTC. Host: Ubuntu 22.04 or later.

    1. Install the host packages.

sudo apt install --no-install-recommends \
             git cmake ninja-build gperf ccache dfu-util device-tree-compiler wget \
             python3-dev python3-pip python3-setuptools python3-tk python3-wheel \
             python3-venv xz-utils file make gcc gcc-multilib g++-multilib \
             libsdl2-dev libmagic1 libyaml-dev flex bison
            Copy to clipboard
    2. Install the Python packages.

pip install pyelftools pyyaml colorama anytree packaging
            Copy to clipboard
    3. Set up the Zephyr environment (one-time).

mkdir -p <local_path>/zephyrproject
            python3 -m venv <local_path>/zephyrproject/.venv
            source <local_path>/zephyrproject/.venv/bin/activate
            pip install west
            west init <local_path>/zephyrproject
            cd <local_path>/zephyrproject
            west update
            west zephyr-export
            west packages pip --install
            Copy to clipboard
    4. Install the Zephyr SDK.

mkdir -p <local_path>/zephyr_sdk && cd <local_path>/zephyr_sdk
            wget https://github.com/zephyrproject-rtos/sdk-ng/releases/download/v0.16.0/zephyr-sdk-0.16.0_linux-x86_64.tar.xz
            tar xvf zephyr-sdk-0.16.0_linux-x86_64.tar.xz
            cd zephyr-sdk-0.16.0 && ./setup.sh
            export ZEPHYR_SDK_INSTALL_DIR=<local_path>/zephyr_sdk/zephyr-sdk-0.16.0
            export RISCV_TOOLS_ROOT=/opt/qcom/Qualcomm_Snapdragon_RISCV_Toolchain_OEM/18.0.2
            Copy to clipboard
    5. Build from inside the Python virtual environment.

source <local_path>/zephyrproject/.venv/bin/activate
            cd <SOCCP_root>/soccp_proc/build/ms
            python ./build_variant.py glymur.soccp.prod
            Copy to clipboard

        Clean:

> 
> 
> python ./build_variant.py glymur.soccp.prod --clean
>             Copy to clipboard
8. aDSP (applications digital signal processor) - Tools: Snapdragon LLVM 18.0.2, Python 3.12.7, DTC. Host: Ubuntu 22.04 or later. Download the Nanopb Linux package version specified in the release notes (for example, 0.4.8) from the [Nanopb download page](https://jpa.kapsi.fi/nanopb/download/).

    1. Copy the Nanopb package into the `adsp_proc/qsh_api` directory and run the dependency configuration.

cp -v nanopb-<version>-linux-x86.tar.gz adsp_proc/qsh_api/
            cd adsp_proc
            python ./qsh_api/build/config_nanopb_dependency.py -f nanopb-<version>-linux-x86
            Copy to clipboard
    2. Verify the expected output structure.

qsh_api/nanopb-<version>-linux-x86.tar.gz
            qsh_api/nanopb/nanopb-<version>-linux-x86/
            qsh_api/nanopb/inc/
              pb.h
              pb_common.h
              pb_decode.h
              pb_encode.h
            qsh_api/nanopb/src/
              pb_common.c
              pb_encode.c
              pb_decode.c
            Copy to clipboard

        Build:

> 
> 
> export HEXAGON_ROOT=<path-to-hexagon-tools>
>             cd adsp_proc/build/ms
>             python ./build_variant.py glymur.adsp.prod
>             Copy to clipboard
9. cDSP (compute digital signal processor) - Tools: Hexagon compiler 19.0.02, Python 3.12.7, DTC. Host: Ubuntu 22.04 or later.

pip install -r <target_root>/cdsp_proc/core/dt_settings/tools/dtschema_tools/oss/requirements.txt
        cd cdsp_proc/build/ms
        python ./build_variant.py glymur.cdsp.prod
        Copy to clipboard
10. Meta (aggregate all subsystems) - Qualcomm releases CPUCP, PDP, BTFM, and WLAN firmware as binaries, so you don’t compile them. Generate the firmware prebuilt binaries and create an integrated firmware binary from the components you compiled.

> 
> 
> cd <target_root>/common/build
>     python build.py
>     Copy to clipboard

## Build the Debian image

Build the Debian image the same way as the prebuilt path, and pin the repository, kernel, and Debian snapshot to the release tags from the release notes. After the build, replace the customized boot chain files in `<workspace>/qcom-deb-images/flash_glymur-crd_nvme/spinor/`.

1. Install the required packages.

sudo apt -y install \
         git crossbuild-essential-arm64 make fakemachine flex bison bc \
         libdw-dev libelf-dev libssl-dev libssl-dev:arm64 \
         dpkg-dev debhelper-compat kmod python3 rsync coreutils
        Copy to clipboard
2. Clone the repository at the release tag.

git clone https://github.com/qualcomm-linux/qcom-deb-images.git -b <release-tag>
        cd qcom-deb-images
        Copy to clipboard
3. Build the `debos` container image with the Dockerfile.

> 
> 
> cat > Dockerfile <<'EOF'
>         FROM ghcr.io/go-debos/debos:latest
>         RUN apt-get update && \
>          apt-get install -y --no-install-recommends \
>            debian-archive-keyring \
>            debos \
>            file \
>            make \
>            mmdebstrap \
>            mtools \
>            python3-pexpect \
>            python3-pytest \
>            python3-defusedxml \
>            qemu-efi-aarch64 \
>            qemu-system-arm \
>            xmlstarlet \
>            device-tree-compiler \
>            u-boot-tools \
>          && rm -rf /var/lib/apt/lists/*
>         EOF
>         Copy to clipboard

sudo docker build -t qcom-deb-images-debos .
        Copy to clipboard
4. Build the kernel with one of the two source options, then copy the `.deb` files.

    1. Option A - qcom-next branch.

scripts/build-linux-deb.py --qcom-next --ref <kernel-release-tag> \
            prune.config qcom.config kernel-configs/*.config
            Copy to clipboard
    2. Option B - local kernel source.

git clone https://github.com/qualcomm-linux/kernel.git -b <branch-name> linux
            scripts/build-linux-deb.py --local-dir linux prune.config qcom.config kernel-configs/*.config
            Copy to clipboard
5. Copy the kernel `.deb` files.

ls *.deb | grep -v dbg | xargs cp -t debos-recipes/local-debs/
        Copy to clipboard
6. Build the root file system with the Debian snapshot tag.

make rootfs.tar \
         CONTAINER_IMAGE=qcom-deb-images-debos \
         EXTRA_DEBOS_OPTS="-t localdebs:local-debs \
         -t kernelpackage:none \
         -t xfcedesktop:true \
         -t snapshot:<debian-snapshot> \
         -t buildid:local-$(date +%Y%m%d)"
        Copy to clipboard
7. Build the flash images.

make disk-sdcard.img \
         CONTAINER_IMAGE=qcom-deb-images-debos \
         EXTRA_DEBOS_OPTS="-t snapshot:<debian-snapshot>"
        Copy to clipboard

make flash \
         CONTAINER_IMAGE=qcom-deb-images-debos \
         EXTRA_DEBOS_OPTS="-t snapshot:<debian-snapshot>"
        Copy to clipboard

If you hit permission errors, prepend sudo to the commands. After the build, replace the customized boot chain files in `<workspace>/qcom-deb-images/flash_glymur-crd_nvme/spinor/`.

Last Published: Sep 29, 2026

[Previous Topic
Build the Debian image with prebuilt firmware](https://docs.qualcomm.com/bundle/publicresource/SP80-A0399-4/topics/build-the-debian-image-with-prebuilt-firmware.md) [Next Topic
Flash the software images](https://docs.qualcomm.com/bundle/publicresource/SP80-A0399-4/topics/flash-the-software-images.md)