To perform a secure firmware upgrade on CPU1 of an HS-KP or HS-SE device, compile the CP_APP build configuration of the project. This can be done by right-clicking the project, hovering over Build Configurations, and selecting CP_APP.

To perform a CPU1 secure firmware upgrade on an HS-KP or HS-SE device, the following events occur:

1. BootROM in UART boot mode receives the UART flash kernel and boots the kernel.
2. The kernel in CPU1 receives a command packet to receive the HSMRt image.
3. The kernel prepares to receive an X.509 certificate as part of the combined image from the host.
4. The kernel verifies that the incoming certificate is of the proper size and format and derives the size of the incoming image. For now, the certificate is stored in RAM.
5. The kernel stores HSMRt image in shared LDAx RAM and requested HSM to authenticate.
6. Upon successful authentication, the HSM begins executing the HSMRt in shared LDAx RAM.
7. The kernel receives a command packet to receive CPU1 flash application image.
8. Kernel receives the X.509 image certificate and shares the same with HSMRt.
9. After successful authentication of the image, HSMRt responds with an acknowledgment, after which flash kernel starts importing the chunk of data via UART into the LDAx memory.
10. After each 16KB (size of LDAx memory) of data received, the flash kernel sends an HSM requests to program the data for further processing.
11. After all chunks are received and programmed, HSMRt is requested to verify the code programmed in HSM active and dormant banks. When the HSMRt firmware authenticates the programmed image against the certificate, the certificate is further programmed to make sure of a successful boot in the subsequent power cycles.
12. Upon successful authentication, the HSM programs the firmware to CPU1 flash.
    1. If the device is previously in HS-KP, then the device is transitioned to HS-SE.

Refer to Section 5.6 on steps to perform on the host application.