Skip to contentSkip to navigationSkip to topbar
Rate this page:
On this page

The Microvisor Manufacturing Process


Microvisor Public Beta

Microvisor is in a pre-release phase and the information contained in this document is subject to change. Some features referenced below may not be fully available until Microvisor's General Availability (GA) release.

This guide will walk your through the Microvisor Factory Process, the procedure by which a 'raw' STM32U585-based device is provisioned first with Microvisor and then your production application firmware.

The procedure we will follow below is also the one we ourselves use to install Microvisor onto new Microvisor Nucleo Development Boards for beta program participants.

The PC set up at the start of the process is the assembly line station at which Microvisor and your application are securely installed into each device under test (DUT). Tests are run to verify the operation of the hardware that Microvisor requires, and the hardware used by your application.



We recommend that your acclimatize yourself to the Microvisor Factory Process before you designing and developing your connected product. You can try out the flow using a standard Microvisor Nucleo Development Board (NDB) in place of the DUT.

When you come to the Program your DUT section, you will need to perform a few extra steps in this case. Specifically, the NDB has already been programmed with Microvisor, so must be inlocked before the factory installer can provision Microvisor to it. The Program your DUT section includes instructions to show you how this can be achieved.


requirements page anchor

VirtualBox installation

virtualbox-installation page anchor

To install Virtual Box, please download version 6.1.50 and its Extension Pack from the Virtual Box downloads page(link takes you to an external page) and follow these instructions(link takes you to an external page). Once the install has completed, run the following commands in a terminal:

  1. sudo usermod -a -G vboxusers $USER
  2. sudo shutdown -r now

The Microvisor factory flow.

Prepare your SPI flash image

prepare-your-spi-flash-image page anchor

Unlike regular application deployments, factory-provisioned application firmware is delivered via the SPI flash image copied to the DUT during the provisioning process. Your application test code is also incorporated into the image, along with Microvisor itself and the Microvisor hardware test code, both of which you can obtain from the links below.



If you are assessing the factory process and using a Nucleo development board as your DUT, you can download, build, and bundle our FreeRTOS demo(link takes you to an external page) as your application firmware.

You will also need to create an application test bundle, but this is straightforward: clone our App Test Demo repo(link takes you to an external page), which will build a suitable (but of limited functionality) app test bundle that can be consumed in step 2, below.

Now use the Twilio CLI Microvisor plugin to build your SPI flash image. You will need to be signed in to the Twilio CLI on the computer used to generate the image:

  1. Create an app bundle:

    twilio microvisor:apps:bundle /path/to/compiled/app/bin \

  2. Sign the app bundle:

    twilio microvisor:apps:create /path/to/app/bundle/zip \
    --bundle-out /path/to/signed/app/bundle/zip

  3. Create an app test bundle:

    twilio microvisor:apps:bundle /path/to/compiled/app/test/bin \

  4. Sign the app test bundle:

    twilio microvisor:apps:create /path/to/app/test/bundle/zip \
    --bundle-out /path/to/signed/app/test/bundle/zip

  5. Assemble the image:

    twilio microvisor:factory:image \
    --application /path/to/signed/app/bundle \
    --application-test /path/to/signed/app/test/bundle \
    --microvisor /path/to/downloaded/kernel \
    --microvisor-test /path/to/downloaded/test \

You now need to send your spiflash.img.bin file to your manufacturer for use when they reach step 5 of Configure the Assembly Line PC.

Set up the Assembly Line PC

set-up-the-assembly-line-pc page anchor

This needs to be performed only once. The PC can then be used to prime multiple DUTs one after the other, across multiple production runs.

  1. Connect the smartcard reader to the PC.
  2. Insert the smartcard into the reader.
  3. Connect the STLINK-V3MINIE to the PC via the male USB-C adapter.
  4. Connect the Micro USB cable to the PC.

Configure the Assembly Line PC

configure-the-assembly-line-pc page anchor

Steps 1 through 8 need to be performed only once. Steps 9 and up will need to be followed every time the PC is power-cycled.

  1. Start up PC and log in to Ubuntu.
  2. Open the Terminal application (press ctrl-alt-t ).
  3. In the Terminal, run:

    mkdir $HOME/factory

  4. In the Terminal, run:

    cd $HOME/factory

  5. Download the Microvisor VM(link takes you to an external page) , which will be of the form microvisor_factory.tar.gz .
  6. Download the accompanying Vagrantfile(link takes you to an external page) .
  7. Copy the SPI flash image spiflash.img.bin to the $HOME/factory directory.
  8. In the Terminal, run:

    vagrant box add --name microvisor_factory microvisor_factory.tar.gz

  9. In the Terminal, run:


    Locate the HSM reader's two ID values and note them down.

  10. Open Virtual Box and navigate to Settings > USB > USB Device Filters . There should be four devices listed, including the HSM reader. Make sure its HID/VID match the two values you noted down in step 8. If they are not, change the values to match those you noted down. IMPORTANT Restart Virtual Box to make sure the changes take effect.
  11. In the Terminal, run:

    vagrant up

  12. Open Firefox and enter localhost:8080 into the address field, then hit Enter .
  13. Under API Credentials , enter your Twilio account's restricted API key and secret, and click Save .
  14. Under SPIFlash Image , click Browse... , locate the SPI flash image spiflash.img.bin on the PC, and click Upload .
  15. If smartcard not present is shown under HSM Status , check that the smartcard reader is connected to the PC and that the smartcard is inserted, then click the first Refresh button. When the HSM is ready, you will see its state, firmware version and the number of remaining device licenses it contains.

This sequence will need to be followed for each DUT being provisioned.



Make sure you connect power last. The other connections must already be in place when you do.

  1. Insert the Super SIM into the DUT's SIM slot.
  2. Connect the STLINK-V3MINIE to the DUT's J5 header using the gray ribbon cable supplied with the STLINK-V3MINIE. On the Nucleo development board the header is also labelled SWD .
  3. Join the router and the DUT with the Ethernet cable.
  4. Connect the Micro USB cable to the DUT's provisioning port. This is marked as CONTROL on the Nucleo, but may be marked differently on your own product.
  5. Connect the cellular antenna.
  6. Connect the DUT's POWER port to the supplied USB-C power adapter.
  7. Check the STLINK/Device Status section in the web browser UI. If there is no information listed, check the STLINK's connections to the PC and the DUT, and click the second Refresh button.
The Factory Layout.

The sequence must be followed for every DUT being provisioned.

  1. In the web browser UI click PROGRAM DEVICE .


If the PROGRAM DEVICE button is deactivated, it means that the DUT has already been programmed. This will likely be the case if you are using a Nucleo development board as a DUT to test the factory process. You will need to unlock the DUT before proceeding. Unlocking the DUT temporarily removes the STM32U585's RDP (Readout Protection) control; it will be re-enabled when the DUT is re-programmed.

  1. Click UNLOCK DEVICE in the web browser UI.
  2. The progress of the unlock operation will appear on the screen.
  3. When you are prompted to power-cycle the DUT, remove the USB-C power cable from the DUT (not the AC adapter), wait a moment and then re-connect it.
  4. Click CONTINUE .
  5. When the process completes, the DUT is ready to program.

The installer will check that it can contact the Microvisor cloud and verify your Twilio API credentials. If these checks fail, installation will halt, the cause will be reported in the web browser UI. If the checks pass, the SPI flash image will be copied to the DUT.

Now reconnect the USB-C power cable.

An on-board hardware test will now take place, checking the cellular modem, the SIM card, and WiFi and Ethernet connectivity.

The provisioning script will communicate with the Microvisor Cloud to receive a valid device-specific certificate which will be stored on the DUT.

Next, an on-board application test will take place.

The DUT is now programmed with Microvisor and ready for packaging, shipment and use.

The assembly line operator can now pass the DUT on to the next stage of assembly and place a new DUT in the station: start again at Set up the DUT.


Microvisor Help and Support

We welcome all inquiries you may have about Microvisor and its implementation, and any support questions that arise once you've begun developing with Microvisor. Please submit your queries via a KORE Wireless ticket: log in to the Kore console(link takes you to an external page) and click the Contact Support button in the left-hand navbar.

Rate this page: