Make hardware protection optional

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

OS failed boot + metadata requirements redirection to DEN0118

The metadata requirements are listed in the DEN0118, we're directing the
reader there.

1. OS tests deem FW bad: OS asks for FW revert
2. OS fails to boot: NWd FW must request FW revert

+ intro text retouches about how the rollback counters are updated.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

If the first bootloader cant boot from multiple locations, explicitly
define the secondary boot loader characteristics

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

- 'Note:' is now bold
- Reword watchdog requirements

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Remove TF-A related nomenclature from the spec.

The following substitutions were made:
- BL1  -> Immutable stage
- BL2  -> Secondary stage
- BL31 -> Monitor firmware
- BL32 -> Secure firmware
- BL33 -> Non-secure firmware

- mandate a watchdog
- Prohibit simultaneous update of firmware/OS
- Strongly advise dual bank updates in case of a rollback bump

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Specify that the UUID appended to the acceptance capsule is the image
type UUID.

Also correct minor capitalisation typo (flags->Flags).

auth hollow capsule + max Trial state boots + fixes

The UEFI implementation must track the platform boots in the Trial state
and revert to the previously working bank once the maximum threshold is
crossed.

We need to discuss the details -- thus left as TBD.

state that the image acceptance is performed for all the images.

multiple fixes

The flows had superfluous reboots. We've removed those.

The term img_uuid in the FW directory (DEN0118) can induce confusion
when compared to the Metadata. A more proper term is img_type_uuid.
We are making the change in the Dependable Boot and commiting to making
the same change in the DEN0118.

Correct OS triggered reset - should call RT.ResetSystem

reword FW authorization -- NIST 800-193

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Add the 2 missing steps of updating the meta-data and bumping the rollback
counters

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

Add FW image acceptance details.

This follows from NIST 800-193.
May require some iteration so that we're aligned on the different
coceptes.