The Bitcoin Open Ledger Operating System (BOLOS) is Ledger platform allowing developers to create pluggable applications on their Hardware Wallets.

BOLOS Trusted Execution Environment is an implementation for third party security hardware such as GlobalPlatform TEE, SGX or HSMs exposing a common API similar to the native Hardware Wallet API with a few specific extensions

BOLOS TEE offers a minimal common set of features for all platforms including Hardware Wallets :

Basic cryptographic APIs (symmetric and asymmetric ciphers, hashes) in bolos_crypto.h
Methods to verify the authenticity of the first level issuer in bolos_attestation.h, when applicable
Methods to verify the authenticity of the platform and running code code in bolos_endorsement.h
Methods to share transient memory between different applications in bolos_sharedmemory.h
Methods to perform low level BIP 32 derivations in bolos_bip32.h

The implementation of BOLOS for a Trusted Execution Environment also features dedicated APIs :

Methods to exchange data between sessions and bind data to applications in bolos_wrapping.h
Specific interface calls for a virtualized platform in bolos_core.h and bolos_utils.h
New generation cryptographic primitives with NaCl / libsodium in bolos_sodium.h
Implementation of anti replay counters in bolos_antireplay.h
Methods to access an optionally secure time source in bolos_time.h
Methods to temporarily halt the execution of an application until an I/O event occurs in bolos_continuation.h

On platforms already exposing a Bitcoin wallet to the user, a few APIs are offered to interact with it :

Access to the main Hierarchical Deterministic wallet of the user in bolos_wallet.h
Simple User Interface (when a Trusted User Interface is available) in bolos_ui.h

On third party devices, BOLOS isolation is achieved by running a Moxie Virtual CPU - for more details about setting up the environment, refer to https://github.com/LedgerHQ/bolos-enclave