the boot firmware (tf-a, non-eufi) for arm cortex-a has a similar concept, but without shifting quite as much into the firmware. tf-a boots a "trusted environm

the boot firmware (tf-a, non-eufi) for arm cortex-a has a similar concept, but without shifting quite as much into the firmware. tf-a boots a "trusted environment" (a secure OS, e.g. op-tee), which defers back to tf-a after initial setup. tf-a then boots the main OS (e.g. linux). apps can be loaded into the TE at runtime, the main OS can defer execution to the TE, and the main OS's scheduler can coordinate with the TE to allow pseudo-preemption. coupled with hardware modules (an SPU, TZC, and GIC) in the fabric, specific interrupts, memory regions, and hardware peripherals can be marked as "secure" (i.e. accessible only by the TE) or "non-secure" (i.e. accessible by the main OS). what's unique (i think? i may be misunderstanding.) in this case is that the TE is an OS without its own scheduler. it depends on the main OS's scheduler to defer control whenever the main OS deems appropriate. each OS has directly registered their own interrupts, so the firmware is really only handling one interrupt: when the main OS defers to the TE.