security/vboot: Move vboot2 to security kconfig section

This commit just moves the vboot sources into
the security directory and fixes kconfig/makefile paths.

Fix vboot2 headers

Change-Id: Icd87f95640186f7a625242a3937e1dd13347eb60
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/22074
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin Roth <martinroth@google.com>

54 files changed, 64 insertions, 62 deletions

diff --git a/src/Kconfig b/src/Kconfig
index dbc92170c36e..e3323ba5c422 100644
--- a/src/Kconfig
+++ b/src/Kconfig
@@ -349,7 +349,6 @@ source "src/ec/*/*/Kconfig"
 source "src/drivers/intel/fsp1_0/Kconfig"
 
 source "src/southbridge/intel/common/firmware/Kconfig"
-source "src/vboot/Kconfig"
 source "src/vendorcode/*/Kconfig"
 
 source "src/arch/*/Kconfig"
diff --git a/src/device/pci_device.c b/src/device/pci_device.c
index f43de451d4f1..3d236719bf43 100644
--- a/src/device/pci_device.c
+++ b/src/device/pci_device.c
@@ -47,7 +47,7 @@
 #include <device/pciexp.h>
 #include <device/hypertransport.h>
 #include <pc80/i8259.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 u8 pci_moving_config8(struct device *dev, unsigned int reg)
 {
diff --git a/src/drivers/intel/fsp1_1/raminit.c b/src/drivers/intel/fsp1_1/raminit.c
index 5b6ec9e77948..2bdac0a340ca 100644
--- a/src/drivers/intel/fsp1_1/raminit.c
+++ b/src/drivers/intel/fsp1_1/raminit.c
@@ -23,7 +23,7 @@
 #include <reset.h>
 #include <string.h>
 #include <timestamp.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 void raminit(struct romstage_params *params)
 {
diff --git a/src/drivers/intel/fsp2_0/memory_init.c b/src/drivers/intel/fsp2_0/memory_init.c
index b08ee1e7686e..0aea1ad76d8e 100644
--- a/src/drivers/intel/fsp2_0/memory_init.c
+++ b/src/drivers/intel/fsp2_0/memory_init.c
@@ -32,7 +32,7 @@
 #include <symbols.h>
 #include <timestamp.h>
 #include <tpm_lite/tlcl.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 #include <vb2_api.h>
 
 static void mrc_cache_update_tpm_hash(const uint8_t *data, size_t size)
diff --git a/src/drivers/pc80/rtc/mc146818rtc.c b/src/drivers/pc80/rtc/mc146818rtc.c
index 830ff09a5985..928b403239f0 100644
--- a/src/drivers/pc80/rtc/mc146818rtc.c
+++ b/src/drivers/pc80/rtc/mc146818rtc.c
@@ -26,8 +26,8 @@
 #include <rtc.h>
 #include <string.h>
 #include <cbfs.h>
-#include <vboot/vbnv.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vbnv_layout.h>
 
 /* There's no way around this include guard. option_table.h is autogenerated */
 #if IS_ENABLED(CONFIG_USE_OPTION_TABLE)
diff --git a/src/ec/google/chromeec/ec.c b/src/ec/google/chromeec/ec.c
index 7ab9d6bdabb4..3d053b608a1b 100644
--- a/src/ec/google/chromeec/ec.c
+++ b/src/ec/google/chromeec/ec.c
@@ -26,7 +26,7 @@
 #include <reset.h>
 #include <rtc.h>
 #include <stdlib.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 #include "chip.h"
 #include "ec.h"
diff --git a/src/lib/coreboot_table.c b/src/lib/coreboot_table.c
index 131dde8b5b18..f152f341ff90 100644
--- a/src/lib/coreboot_table.c
+++ b/src/lib/coreboot_table.c
@@ -32,7 +32,7 @@
 #include <cbmem.h>
 #include <bootmem.h>
 #include <spi_flash.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv_layout.h>
 #if IS_ENABLED(CONFIG_USE_OPTION_TABLE)
 #include <option_table.h>
 #endif
diff --git a/src/mainboard/google/veyron_rialto/mainboard.c b/src/mainboard/google/veyron_rialto/mainboard.c
index 91bf46a52647..b6b25be732ce 100644
--- a/src/mainboard/google/veyron_rialto/mainboard.c
+++ b/src/mainboard/google/veyron_rialto/mainboard.c
@@ -34,7 +34,7 @@
 #include <symbols.h>
 #include <vbe.h>
 #include <vendorcode/google/chromeos/chromeos.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 #include "board.h"
 
diff --git a/src/mainboard/intel/galileo/vboot.c b/src/mainboard/intel/galileo/vboot.c
index b0fa2f2956e3..469ec4e0939c 100644
--- a/src/mainboard/intel/galileo/vboot.c
+++ b/src/mainboard/intel/galileo/vboot.c
@@ -24,8 +24,8 @@
 #include "gen1.h"
 #include "gen2.h"
 #include <spi_flash.h>
-#include <vboot/vboot_common.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vboot_common.h>
+#include <security/vboot/vbnv.h>
 
 int clear_recovery_mode_switch(void)
 {
diff --git a/src/northbridge/intel/haswell/raminit.c b/src/northbridge/intel/haswell/raminit.c
index e48cca9f6ff3..f17a374de4ea 100644
--- a/src/northbridge/intel/haswell/raminit.c
+++ b/src/northbridge/intel/haswell/raminit.c
@@ -28,7 +28,7 @@
 #include <device/dram/ddr3.h>
 #include <smbios.h>
 #include <spd.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 #include "raminit.h"
 #include "pei_data.h"
 #include "haswell.h"
diff --git a/src/northbridge/intel/sandybridge/raminit_mrc.c b/src/northbridge/intel/sandybridge/raminit_mrc.c
index 7145841ac205..901a083c2b29 100644
--- a/src/northbridge/intel/sandybridge/raminit_mrc.c
+++ b/src/northbridge/intel/sandybridge/raminit_mrc.c
@@ -31,7 +31,7 @@
 #include "raminit.h"
 #include "pei_data.h"
 #include "sandybridge.h"
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 /* Management Engine is in the southbridge */
 #include "southbridge/intel/bd82x6x/me.h"
diff --git a/src/security/Kconfig b/src/security/Kconfig
index 7ec295220c4a..7d105b8cf818 100644
--- a/src/security/Kconfig
+++ b/src/security/Kconfig
@@ -11,3 +11,5 @@
 ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ## GNU General Public License for more details.
 ##
+
+source "src/security/vboot/Kconfig"
diff --git a/src/security/Makefile.inc b/src/security/Makefile.inc
new file mode 100644
index 000000000000..d2e1e60f44cc
--- /dev/null
+++ b/src/security/Makefile.inc
@@ -0,0 +1 @@
+subdirs-y += vboot
diff --git a/src/vboot/Kconfig b/src/security/vboot/Kconfig
index d5b5de291e35..d5b5de291e35 100644
--- a/src/vboot/Kconfig
+++ b/src/security/vboot/Kconfig
diff --git a/src/vboot/Makefile.inc b/src/security/vboot/Makefile.inc
index 75ecff3b21e8..75ecff3b21e8 100644
--- a/src/vboot/Makefile.inc
+++ b/src/security/vboot/Makefile.inc
diff --git a/src/vboot/bootmode.c b/src/security/vboot/bootmode.c
index 120744837b8b..834bc481e1d8 100644
--- a/src/vboot/bootmode.c
+++ b/src/security/vboot/bootmode.c
@@ -20,9 +20,9 @@
 #include <rules.h>
 #include <string.h>
 #include <vb2_api.h>
-#include <vboot/misc.h>
-#include <vboot/vbnv.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/misc.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vboot_common.h>
 
 static int vb2_get_recovery_reason_shared_data(void)
 {
diff --git a/src/vboot/common.c b/src/security/vboot/common.c
index 3e480edbf654..72228e41d0e7 100644
--- a/src/vboot/common.c
+++ b/src/security/vboot/common.c
@@ -20,9 +20,9 @@
 #include <reset.h>
 #include <string.h>
 #include <vb2_api.h>
-#include <vboot/misc.h>
-#include <vboot/symbols.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/misc.h>
+#include <security/vboot/symbols.h>
+#include <security/vboot/vboot_common.h>
 
 struct selected_region {
 	uint32_t offset;
diff --git a/src/vboot/misc.h b/src/security/vboot/misc.h
index dc94720ea55f..b5e3fcfe94eb 100644
--- a/src/vboot/misc.h
+++ b/src/security/vboot/misc.h
@@ -16,7 +16,7 @@
 #ifndef __VBOOT_MISC_H__
 #define __VBOOT_MISC_H__
 
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 struct vb2_context;
 struct vb2_shared_data;
diff --git a/src/vboot/secdata_mock.c b/src/security/vboot/secdata_mock.c
index 72ee5b3c115e..72ee5b3c115e 100644
--- a/src/vboot/secdata_mock.c
+++ b/src/security/vboot/secdata_mock.c
diff --git a/src/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c
index be9d680cc06b..be9d680cc06b 100644
--- a/src/vboot/secdata_tpm.c
+++ b/src/security/vboot/secdata_tpm.c
diff --git a/src/vboot/symbols.h b/src/security/vboot/symbols.h
index fb3d6545f8d1..fb3d6545f8d1 100644
--- a/src/vboot/symbols.h
+++ b/src/security/vboot/symbols.h
diff --git a/src/vboot/vbnv.c b/src/security/vboot/vbnv.c
index 79bdc8e5dfbb..0fecacd4d2ed 100644
--- a/src/vboot/vbnv.c
+++ b/src/security/vboot/vbnv.c
@@ -16,8 +16,8 @@
 #include <arch/early_variables.h>
 #include <string.h>
 #include <types.h>
-#include <vboot/vbnv.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vbnv_layout.h>
 
 static int vbnv_initialized CAR_GLOBAL;
 static uint8_t vbnv[VBOOT_VBNV_BLOCK_SIZE] CAR_GLOBAL;
diff --git a/src/vboot/vbnv.h b/src/security/vboot/vbnv.h
index 0288d0df4ddc..0288d0df4ddc 100644
--- a/src/vboot/vbnv.h
+++ b/src/security/vboot/vbnv.h
diff --git a/src/vboot/vbnv_cmos.c b/src/security/vboot/vbnv_cmos.c
index a311fddbb1f0..9c801d84fe65 100644
--- a/src/vboot/vbnv_cmos.c
+++ b/src/security/vboot/vbnv_cmos.c
@@ -17,8 +17,8 @@
 #include <console/console.h>
 #include <types.h>
 #include <pc80/mc146818rtc.h>
-#include <vboot/vbnv.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vbnv_layout.h>
 
 static void clear_vbnv_battery_cutoff_flag(uint8_t *vbnv_copy)
 {
diff --git a/src/vboot/vbnv_ec.c b/src/security/vboot/vbnv_ec.c
index 99e2b82b1f7a..d73423eb7530 100644
--- a/src/vboot/vbnv_ec.c
+++ b/src/security/vboot/vbnv_ec.c
@@ -15,8 +15,8 @@
 
 #include <types.h>
 #include <ec/google/chromeec/ec.h>
-#include <vboot/vbnv.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vbnv_layout.h>
 
 void read_vbnv_ec(uint8_t *vbnv_copy)
 {
diff --git a/src/vboot/vbnv_flash.c b/src/security/vboot/vbnv_flash.c
index dd128a923527..07569fa48d88 100644
--- a/src/vboot/vbnv_flash.c
+++ b/src/security/vboot/vbnv_flash.c
@@ -20,9 +20,9 @@
 #include <string.h>
 #include <vb2_api.h>
 #include <vboot_nvstorage.h>
-#include <vboot/vboot_common.h>
-#include <vboot/vbnv.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vboot_common.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vbnv_layout.h>
 
 #define BLOB_SIZE VB2_NVDATA_SIZE
 
diff --git a/src/vboot/vbnv_layout.h b/src/security/vboot/vbnv_layout.h
index 1dc01c909a30..1dc01c909a30 100644
--- a/src/vboot/vbnv_layout.h
+++ b/src/security/vboot/vbnv_layout.h
diff --git a/src/vboot/vboot_common.c b/src/security/vboot/vboot_common.c
index 515b368f910f..3ef90706ed8e 100644
--- a/src/vboot/vboot_common.c
+++ b/src/security/vboot/vboot_common.c
@@ -23,7 +23,7 @@
 #include <rules.h>
 #include <stddef.h>
 #include <string.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 int vboot_named_region_device(const char *name, struct region_device *rdev)
 {
diff --git a/src/vboot/vboot_common.h b/src/security/vboot/vboot_common.h
index 8c92f7f131b0..8c92f7f131b0 100644
--- a/src/vboot/vboot_common.h
+++ b/src/security/vboot/vboot_common.h
diff --git a/src/vboot/vboot_handoff.c b/src/security/vboot/vboot_handoff.c
index 974fe78ec33a..9fecc1a1a8ae 100644
--- a/src/vboot/vboot_handoff.c
+++ b/src/security/vboot/vboot_handoff.c
@@ -34,8 +34,8 @@
 #include <stdlib.h>
 #include <timestamp.h>
 #include <vboot_struct.h>
-#include <vboot/vbnv.h>
-#include <vboot/misc.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/misc.h>
 
 /**
  * Sets vboot_handoff based on the information in vb2_shared_data
diff --git a/src/vboot/vboot_loader.c b/src/security/vboot/vboot_loader.c
index 6a7e28486778..17ea0a9401ba 100644
--- a/src/vboot/vboot_loader.c
+++ b/src/security/vboot/vboot_loader.c
@@ -21,9 +21,9 @@
 #include <rmodule.h>
 #include <rules.h>
 #include <string.h>
-#include <vboot/misc.h>
-#include <vboot/symbols.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/misc.h>
+#include <security/vboot/symbols.h>
+#include <security/vboot/vboot_common.h>
 
 /* Ensure vboot configuration is valid: */
 _Static_assert(IS_ENABLED(CONFIG_VBOOT_STARTS_IN_BOOTBLOCK) +
diff --git a/src/vboot/vboot_logic.c b/src/security/vboot/vboot_logic.c
index d06faa740a24..e6b97b9c2f89 100644
--- a/src/vboot/vboot_logic.c
+++ b/src/security/vboot/vboot_logic.c
@@ -23,8 +23,8 @@
 #include <string.h>
 #include <timestamp.h>
 #include <vb2_api.h>
-#include <vboot/misc.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/misc.h>
+#include <security/vboot/vbnv.h>
 
 /* The max hash size to expect is for SHA512. */
 #define VBOOT_MAX_HASH_SIZE VB2_SHA512_DIGEST_SIZE
diff --git a/src/vboot/verstage.c b/src/security/vboot/verstage.c
index aca4ab328d0f..c2441840d791 100644
--- a/src/vboot/verstage.c
+++ b/src/security/vboot/verstage.c
@@ -17,7 +17,7 @@
 #include <arch/hlt.h>
 #include <console/console.h>
 #include <program_loading.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 void __attribute__((weak)) verstage_mainboard_init(void)
 {
diff --git a/src/soc/amd/stoneyridge/pmutil.c b/src/soc/amd/stoneyridge/pmutil.c
index 5bbea2ac6b98..89d36408013e 100644
--- a/src/soc/amd/stoneyridge/pmutil.c
+++ b/src/soc/amd/stoneyridge/pmutil.c
@@ -13,7 +13,7 @@
  * GNU General Public License for more details.
  */
 
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 int vbnv_cmos_failed(void)
 {
diff --git a/src/soc/intel/apollolake/pmutil.c b/src/soc/intel/apollolake/pmutil.c
index 5fcefd761be2..162290ac17a2 100644
--- a/src/soc/intel/apollolake/pmutil.c
+++ b/src/soc/intel/apollolake/pmutil.c
@@ -34,7 +34,7 @@
 #include <soc/pci_devs.h>
 #include <soc/pm.h>
 #include <timer.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 #include "chip.h"
 
 static uintptr_t read_pmc_mmio_bar(void)
diff --git a/src/soc/intel/baytrail/pmutil.c b/src/soc/intel/baytrail/pmutil.c
index fbdea8f4daf5..ee9991759451 100644
--- a/src/soc/intel/baytrail/pmutil.c
+++ b/src/soc/intel/baytrail/pmutil.c
@@ -22,7 +22,7 @@
 #include <soc/lpc.h>
 #include <soc/pci_devs.h>
 #include <soc/pmc.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 #if defined(__SIMPLE_DEVICE__)
 
diff --git a/src/soc/intel/baytrail/romstage/raminit.c b/src/soc/intel/baytrail/romstage/raminit.c
index 44e0923b9bf4..b577a35ece89 100644
--- a/src/soc/intel/baytrail/romstage/raminit.c
+++ b/src/soc/intel/baytrail/romstage/raminit.c
@@ -30,7 +30,7 @@
 #include <soc/romstage.h>
 #include <ec/google/chromeec/ec.h>
 #include <ec/google/chromeec/ec_commands.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 static void reset_system(void)
 {
diff --git a/src/soc/intel/braswell/pmutil.c b/src/soc/intel/braswell/pmutil.c
index b5f284ff95d9..18e655c1b37b 100644
--- a/src/soc/intel/braswell/pmutil.c
+++ b/src/soc/intel/braswell/pmutil.c
@@ -23,7 +23,7 @@
 #include <soc/pci_devs.h>
 #include <soc/pm.h>
 #include <stdint.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 #if defined(__SIMPLE_DEVICE__)
 
diff --git a/src/soc/intel/broadwell/igd.c b/src/soc/intel/broadwell/igd.c
index fa1340fbcf9a..0b6e41657cb7 100644
--- a/src/soc/intel/broadwell/igd.c
+++ b/src/soc/intel/broadwell/igd.c
@@ -30,7 +30,7 @@
 #include <soc/ramstage.h>
 #include <soc/systemagent.h>
 #include <soc/intel/broadwell/chip.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 #include <soc/igd.h>
 
 #define GT_RETRY		1000
diff --git a/src/soc/intel/broadwell/pmutil.c b/src/soc/intel/broadwell/pmutil.c
index 0edcd8c3a907..25624cc60c68 100644
--- a/src/soc/intel/broadwell/pmutil.c
+++ b/src/soc/intel/broadwell/pmutil.c
@@ -28,7 +28,7 @@
 #include <soc/pci_devs.h>
 #include <soc/pm.h>
 #include <soc/gpio.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 /* Print status bits with descriptive names */
 static void print_status_bits(u32 status, const char *bit_names[])
diff --git a/src/soc/intel/cannonlake/pmc.c b/src/soc/intel/cannonlake/pmc.c
index e9972a6bd87e..a0d816ef43b4 100644
--- a/src/soc/intel/cannonlake/pmc.c
+++ b/src/soc/intel/cannonlake/pmc.c
@@ -36,8 +36,8 @@
 #include <cpu/x86/smm.h>
 #include <soc/pcr_ids.h>
 #include <soc/ramstage.h>
-#include <vboot/vbnv.h>
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vbnv_layout.h>
 
 static void pch_pmc_add_mmio_resources(device_t dev)
 {
diff --git a/src/soc/intel/cannonlake/pmutil.c b/src/soc/intel/cannonlake/pmutil.c
index ed2e3b03387e..b3fad88dd039 100644
--- a/src/soc/intel/cannonlake/pmutil.c
+++ b/src/soc/intel/cannonlake/pmutil.c
@@ -40,7 +40,7 @@
 #include <soc/pm.h>
 #include <soc/smbus.h>
 #include <timer.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 #include "chip.h"
 
 /*
diff --git a/src/soc/intel/common/block/pmc/pmclib.c b/src/soc/intel/common/block/pmc/pmclib.c
index 82ce29261f70..f653bf08a1e4 100644
--- a/src/soc/intel/common/block/pmc/pmclib.c
+++ b/src/soc/intel/common/block/pmc/pmclib.c
@@ -23,7 +23,7 @@
 #include <soc/pm.h>
 #include <string.h>
 #include <timer.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 static struct chipset_power_state power_state CAR_GLOBAL;
 
diff --git a/src/soc/intel/common/mrc_cache.c b/src/soc/intel/common/mrc_cache.c
index a4f3d3201b04..8720c9df0507 100644
--- a/src/soc/intel/common/mrc_cache.c
+++ b/src/soc/intel/common/mrc_cache.c
@@ -23,7 +23,7 @@
 #include <fmap.h>
 #include <ip_checksum.h>
 #include <region_file.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 #include "mrc_cache.h"
 #include "nvm.h"
diff --git a/src/soc/intel/skylake/igd.c b/src/soc/intel/skylake/igd.c
index e1d5bff73fae..545030f4ff41 100644
--- a/src/soc/intel/skylake/igd.c
+++ b/src/soc/intel/skylake/igd.c
@@ -32,7 +32,7 @@
 #include <soc/systemagent.h>
 #include <stdlib.h>
 #include <string.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 uintptr_t fsp_soc_get_igd_bar(void)
 {
diff --git a/src/soc/intel/skylake/pmutil.c b/src/soc/intel/skylake/pmutil.c
index 0da7fe8157be..d05c812e735f 100644
--- a/src/soc/intel/skylake/pmutil.c
+++ b/src/soc/intel/skylake/pmutil.c
@@ -40,7 +40,7 @@
 #include <soc/pmc.h>
 #include <soc/smbus.h>
 #include <timer.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 #include "chip.h"
 
 /*
diff --git a/src/soc/intel/skylake/romstage/romstage_fsp20.c b/src/soc/intel/skylake/romstage/romstage_fsp20.c
index d4a5e341991d..d6ec41f25798 100644
--- a/src/soc/intel/skylake/romstage/romstage_fsp20.c
+++ b/src/soc/intel/skylake/romstage/romstage_fsp20.c
@@ -35,7 +35,7 @@
 #include <soc/romstage.h>
 #include <string.h>
 #include <timestamp.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 #define FSP_SMBIOS_MEMORY_INFO_GUID	\
 {	\
diff --git a/src/southbridge/intel/bd82x6x/early_pch_common.c b/src/southbridge/intel/bd82x6x/early_pch_common.c
index f812247575a2..a41c2f3ee40d 100644
--- a/src/southbridge/intel/bd82x6x/early_pch_common.c
+++ b/src/southbridge/intel/bd82x6x/early_pch_common.c
@@ -22,7 +22,7 @@
 #include <arch/acpi.h>
 #include <console/console.h>
 #include <rules.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 
 #if ENV_ROMSTAGE
 uint64_t get_initial_timestamp(void)
diff --git a/src/southbridge/intel/lynxpoint/pmutil.c b/src/southbridge/intel/lynxpoint/pmutil.c
index 55fe403495e1..00a6e6587252 100644
--- a/src/southbridge/intel/lynxpoint/pmutil.c
+++ b/src/southbridge/intel/lynxpoint/pmutil.c
@@ -24,7 +24,7 @@
 #include <device/pci.h>
 #include <device/pci_def.h>
 #include <console/console.h>
-#include <vboot/vbnv.h>
+#include <security/vboot/vbnv.h>
 #include "pch.h"
 
 #if IS_ENABLED(CONFIG_INTEL_LYNXPOINT_LP)
diff --git a/src/vendorcode/google/chromeos/acpi/chromeos.asl b/src/vendorcode/google/chromeos/acpi/chromeos.asl
index 44d9d155e3f0..d813b22ac0fe 100644
--- a/src/vendorcode/google/chromeos/acpi/chromeos.asl
+++ b/src/vendorcode/google/chromeos/acpi/chromeos.asl
@@ -13,7 +13,7 @@
  * GNU General Public License for more details.
  */
 
-#include <vboot/vbnv_layout.h>
+#include <security/vboot/vbnv_layout.h>
 
 #if IS_ENABLED(CONFIG_CHROMEOS)
 
diff --git a/src/vendorcode/google/chromeos/chromeos.h b/src/vendorcode/google/chromeos/chromeos.h
index a739ab7b3766..df6159668454 100644
--- a/src/vendorcode/google/chromeos/chromeos.h
+++ b/src/vendorcode/google/chromeos/chromeos.h
@@ -21,8 +21,8 @@
 #include <bootmode.h>
 #include <device/device.h>
 #include <rules.h>
-#include <vboot/misc.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/misc.h>
+#include <security/vboot/vboot_common.h>
 
 #if IS_ENABLED(CONFIG_CHROMEOS)
 /* functions implemented in watchdog.c */
diff --git a/src/vendorcode/google/chromeos/cr50_enable_update.c b/src/vendorcode/google/chromeos/cr50_enable_update.c
index 0ec0e7086474..6e67cc2d3bf1 100644
--- a/src/vendorcode/google/chromeos/cr50_enable_update.c
+++ b/src/vendorcode/google/chromeos/cr50_enable_update.c
@@ -20,7 +20,7 @@
 #include <halt.h>
 #include <tpm_lite/tlcl.h>
 #include <vb2_api.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 static void enable_update(void *unused)
 {
diff --git a/src/vendorcode/google/chromeos/elog.c b/src/vendorcode/google/chromeos/elog.c
index f16f0add0bf6..fbbfd161965a 100644
--- a/src/vendorcode/google/chromeos/elog.c
+++ b/src/vendorcode/google/chromeos/elog.c
@@ -16,7 +16,7 @@
 #include <bootstate.h>
 #include <console/console.h>
 #include <elog.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vboot_common.h>
 
 #if IS_ENABLED(CONFIG_HAVE_ACPI_RESUME)
 #include <arch/acpi.h>
diff --git a/src/vendorcode/google/chromeos/gnvs.c b/src/vendorcode/google/chromeos/gnvs.c
index 8a5cc6418269..a278b4109cdf 100644
--- a/src/vendorcode/google/chromeos/gnvs.c
+++ b/src/vendorcode/google/chromeos/gnvs.c
@@ -20,8 +20,8 @@
 #include <cbmem.h>
 #include <console/console.h>
 #include <elog.h>
-#include <vboot/vbnv.h>
-#include <vboot/vboot_common.h>
+#include <security/vboot/vbnv.h>
+#include <security/vboot/vboot_common.h>
 #include <vboot_struct.h>
 
 #include "chromeos.h"