To perform SECCFG programming of an HS-KP or HS-SE device, compile the CP_APP build configuration of the project. This can be done by right-clicking the project, hovering over Build Configurations, and selecting CP_APP.

To program a new image to SECCFG on an HS-KP or HS-SE device, the following events occur:

1. BootROM in UART boot mode receives the UART lash kernel and boots the kernel.
2. The kernel in CPU1 receives a command packet to receive the HSMRt image.
3. The kernel prepares to receive an X.509 certificate as part of the combined image from the host.
4. The kernel verifies that the incoming certificate is of the proper size and format and derives the size of the incoming image. For now, the certificate is stored in RAM.
5. The kernel stores HSMRt image in shared LDAx RAM and requested HSM to authenticate.
6. Upon successful authentication, the HSM begins executing the HSMRt in shared LDAx RAM.
7. The kernel receives a command packet to receive Sec Cfg image.
8. Kernel receives the X.509 image certificate and shares the same with HSMRt.
9. After successful authentication of the image, HSMRt responds with an acknowledgment, after which flash kernel starts importing the Sec Cfg data via UART into the LDAx memory.
10. After all the SecCfg data are received and programmed, the HSMRt is requested to verify the SecCfg programmed in the dormant banks with valid counter values. When the HSMRt authenticates the programmed image against the certificate, the certificate is further programmed to make sure successful boot in the subsequent power cycles
    1. Note in the case of HS-SE device, the decision of programming of the certificate is made on the swap value of the SSU registers.

Refer to Section 5.6 on steps to perform on the host application.