WOLFSSL MICROCHIP PolarFire SUPPORT
wolfSSL provides embedded security software for Microchip PolarFire SoC and PolarFire FPGA designs. Support includes wolfSSL and wolfCrypt on RISC-V, wolfBoot secure boot for PolarFire SoC, and wolfTPM firmware TPM examples on dedicated RISC-V cores and FPGA soft cores.
wolfSSL and wolfCrypt for PolarFire SoC
wolfSSL provides TLS 1.3 and DTLS 1.3 for embedded applications, with wolfCrypt providing the underlying cryptography. wolfSSL supports the Microchip PolarFire SoC MPFS250 RISC-V platform.
wolfBoot Secure Boot for PolarFire SoC
wolfBoot supports authenticated boot on PolarFire SoC MPFS250. It can run under Microchip Hart Software Services (HSS) or use its M-mode implementation to replace HSS.
In the HSS-replacement configuration, wolfBoot starts on the E51 monitor core, initializes clocks and LPDDR4, verifies the next-stage image, and boots SMP Linux on the four U54 application cores. FIT image support includes compressed kernels and device-tree fixups.
After handoff, wolfBoot's SBI runtime remains resident, with M-mode trap handling on the application harts. The E51 monitor core maintains a watchdog monitoring loop.
Example Configurations
The polarFire configurations are located in config/examples/ in the wolfBoot repository.
| Configuration | Boot path | Application |
|---|---|---|
| polarfire_mpfs250_m.config | Replaces HSS | Linux boot from SD/eMMC with DDR initialization |
| polarfire_mpfs250_m_qspi.config | Replaces HSS | Bare-metal application from QSPI into L2 Scratch, without DDR |
| polarfire_mpfs250.config | Runs under HSS | Verified S-mode payload from SD/eMMC |
| polarfire_mpfs250_qspi.config | Runs under HSS | Verified S-mode payload from QSPI into DDR |
| polarfire_mpfs250_hss_l2lim.config | Runs under HSS | Verified S-mode payload from QSPI into L2-LIM |
The documented configurations use ECC P-384 and SHA-384 by default. wolfBoot also supports post-quantum signature algorithms, including ML-DSA, LMS, and XMSS, with configurable hybrid schemes.
Build and deployment instructions are available in the PolarFire SoC target documentation.
wolfTPM Firmware TPM for PolarFire SoC
The MPFS250T Video Kit example runs wolfTPM's firmware TPM bare-metal in M-mode on a dedicated U54 hart. HSS AMP partitioning assigns Linux to harts 1 through 3 and the TPM service to hart 4.
On this platform, Linux communicates with the firmware TPM through shared memory. The example includes tools to check startup and communication, and uses the PolarFire System Controller nonce service to seed random number generation.
The example is located in Microchip/fwtpm-polarfire-miv in the wolfTPM examples repository. Despite the directory name, it runs on a hard U54 core.
Post-Quantum Firmware TPM for PolarFire FPGA
The MPF300 Splash Kit example runs wolfTPM's firmware TPM on a Mi-V MIV_RV32 RISC-V soft core. It operates without a hardened CPU or a discrete TPM chip.
The host sends TPM commands over UART. The firmware TPM uses the PolarFire System Controller nonce service to seed wolfCrypt's Hash-DRBG and stores persistent TPM state in on-die secure NVM (sNVM). On MPF300T, the nonce service uses an SRAM-PUF-seeded iRNG; the security-enabled MPF300TS variant provides a hardware TRNG.
TPM 2.0 Library Specification v1.85 support includes native ML-DSA signing and verification and ML-KEM encapsulation and decapsulation. The example also includes wolfCrypt tests, performance benchmarks, and memory-footprint results for different algorithm configurations.
The example is located in Microchip/miv-mpf300-splash in the wolfTPM examples repository, with hardware setup, build, and programming instructions.
FIPS 140-3 and DO-178C Support
wolfSSL offers FIPS 140-3 validated cryptography and DO-178C support packages. Applicability to a PolarFire design depends on the selected module, target configuration, and project requirements.
About Microchip
Microchip Technology Inc. is a leading provider of microcontroller, mixed-signal, analog and Flash-IP solutions, providing low-risk product development, lower total system cost and faster time to market for thousands of diverse customer applications worldwide. Headquartered in Chandler, Arizona, Microchip offers outstanding technical support along with dependable delivery and quality. For more information, visit the Microchip website at www.microchip.com.