packaging: install kernel modules under /usr/lib/modules

debian/README.md

@@ -326,10 +326,15 @@ CI writes every orig in one builder image.
 Installed paths:
 - `/boot/vmlinuz-<KVER>` — compressed kernel image
 - `/boot/config-<KVER>` — kernel `.config`
-- `/lib/modules/<KVER>/` — stripped kernel modules
+- `/usr/lib/modules/<KVER>/` — stripped kernel modules
 - `/usr/lib/linux-image-<KVER>/` — all DTBs (vendor subdirs preserved)
-- `/lib/modules/<KVER>/build` → `/usr/src/linux-headers-<KVER>/` (symlink)
-- `/lib/modules/<KVER>/source` → `/usr/src/linux-headers-<KVER>/` (symlink)
+- `/usr/lib/modules/<KVER>/build` → `/usr/src/linux-headers-<KVER>/` (symlink)
+- `/usr/lib/modules/<KVER>/source` → `/usr/src/linux-headers-<KVER>/` (symlink)
+
+Modules ship under `/usr/lib/modules`, the merged-/usr location required by
+Debian Policy 10.1; `/lib/modules` resolves to the same directory on the
+target. kbuild installs them under `lib/modules/` in the staging tree and
+`dh_movetousr` moves them after `dh_installmodules` has run.
 
 Virtual packages provided: `linux-image`, `linux-image-arm64`
 
@@ -409,7 +414,8 @@ packages have been staged. The script:
    On failure: prints `make.log` tail (compile error) or `BUILD_EXCLUSIVE` gate
    analysis (skip), then hard-fails — a manifest entry is a presence contract.
 6. For each produced `.ko`: collision-checks against already-bundled and in-tree
-   modules; installs to `lib/modules/<KVER>/extra/`; extracts debug symbols via
+   modules; installs to `lib/modules/<KVER>/extra/` in the staging tree (shipped
+   as `/usr/lib/modules/<KVER>/extra/`); extracts debug symbols via
    `objcopy --only-keep-debug` into the `-dbg` package; strips with
    `strip --strip-debug` (required for kernel modules — a full strip drops the
    symtab and relocations needed by the module loader).
@@ -459,7 +465,7 @@ and all available options (`--arch`, `--objcopy`, `--modules-manifest`).
 
 ## The `build` and `source` symlinks
 
-`/lib/modules/<KVER>/build` and `/lib/modules/<KVER>/source` are symlinks
+`/usr/lib/modules/<KVER>/build` and `/usr/lib/modules/<KVER>/source` are symlinks
 pointing to `/usr/src/linux-headers-<KVER>/`. These are used by:
 - `make -C /lib/modules/$(uname -r)/build` — standard out-of-tree module build
 - DKMS — automatic module rebuild on kernel update

debian/control.in

@@ -4,6 +4,7 @@ Priority: optional
 Maintainer: Bjordis Collaku <bcollaku@qti.qualcomm.com>
 Standards-Version: 4.6.2
 Build-Depends: debhelper-compat (= 13),
+               debhelper (>= 13.11.9~),
                bc, bison, flex, libssl-dev, libelf-dev, dwarves,
                python3, kmod, cpio, rsync, pkg-config, gcc, make@DKMS_BUILD_DEPENDS@
 Homepage: https://kernel.org
@@ -22,7 +23,7 @@ Description: Qualcomm ARM64 Linux kernel image @KVER@
  Files installed:
   - /boot/vmlinuz-@KVER@
   - /boot/config-@KVER@
-  - /lib/modules/@KVER@/
+  - /usr/lib/modules/@KVER@/
   - /usr/lib/linux-image-@KVER@/ (DTBs)
   - /usr/lib/firmware/@KVER@/device-tree (Ubuntu flash-kernel symlink)
 
@@ -43,7 +44,7 @@ Description: Qualcomm ARM64 Linux kernel headers @KVER@
  kernel release @KVER@.
  .
  Headers are installed under /usr/src/linux-headers-@KVER@/ and the
- /lib/modules/@KVER@/build symlink is pointed there.
+ /usr/lib/modules/@KVER@/build symlink is pointed there.
 
 Package: @HDRPKG@
 Architecture: arm64

debian/rules

@@ -426,7 +426,8 @@ override_dh_auto_install:
 	cp -a -T "$$IMG_PATH" "$$PKG/boot/vmlinuz-$$BASE"; \
 	cp -a -T "$$CFG_PATH" "$$PKG/boot/config-$$BASE"; \
 	\
-	# Modules (stripped)
+	# Modules (stripped). kbuild installs them under lib/modules/ in the staging
+	# tree; execute_after_dh_installdeb moves them to /usr/lib/modules/.
 	$(MAKE) $(KBUILD_O_ARG) ARCH=$(ARCH) modules_install \
 		INSTALL_MOD_PATH=$$PKG INSTALL_MOD_STRIP=1; \
 	\
@@ -564,6 +565,23 @@ override_dh_installdeb:
 	dh_installmodules; \
 	dh_installdeb
 
+# Move everything staged under the aliased /bin, /lib and /sbin directories
+# into /usr, as Debian Policy 10.1 requires on merged-/usr systems: the
+# modules and their build/source links from modules_install, and the bundled
+# DKMS modules. kbuild hardcodes MODLIB to $(INSTALL_MOD_PATH)/lib/modules, so
+# the modules are installed there and moved afterwards, the same way Debian's
+# own linux package does it. dh_movetousr also rewrites the build/source links
+# into the form Policy 10.5 requires.
+#
+# This must run after override_dh_installdeb rather than earlier in the
+# sequence. dh_installmodules, which that override calls, only looks under
+# lib/modules/ when deciding whether to add the depmod maintainer script
+# snippet, so moving the modules first would silently drop it. The
+# dh-sequence-movetousr addon runs the helper before dh_installdeb, which is
+# still before that call, hence the explicit hook.
+execute_after_dh_installdeb:
+	dh_movetousr
+
 override_dh_auto_test:
 	@echo "Skipping dh_auto_test (no kernel test suite)."