F28M35H52C: How to reset and arm M3 DCSM

Part Number:F28M35H52C

Hello, I struggle with the M3 DCSM unlock sequence...

What I would like to do is reset the security to a clean state with CSM-ARMED (bit-11) being set.

I try to get to this state by first setting the FORCESEC bit, and then performing a dummy read to the password locations. This seems to work when performed using the JTAG emulator, but when I run the same sequence from non-secure RAM in the MCU, I cannot get the CSM to arm. Below is the test code and debug output. I must be missing something fundamental.

Debug terminal:

CSM status before forcesec: 0x00001F80
CSM status after forcesec: 0x00000460
OTPSECLOCK: 0x00FFFFFF
CSM status after OTPSECLOCK read : 0x00000460
CSM status after password read : 0x00000440

Code:

volatile unsigned long status, temp;

// disable Protection
HWREG(SYSCTL_MWRALLOW) =  0xA5A5A5A5;

status = HWREG(CSM_BASE + DCSM_O_Z1_CR);
DEBUG_WRITE_STRING("CSM status before forcesec: 0x");
DEBUG_WRITE_LONG(status);
DEBUG_WRITE_STRING("\n\r");

// start clean
HWREG(CSM_BASE + DCSM_O_Z1_CR) |= DCSM_CR_FORCESEC; // FORCESEC = 1

status = HWREG(CSM_BASE + DCSM_O_Z1_CR);
DEBUG_WRITE_STRING("CSM status after forcesec: 0x");
DEBUG_WRITE_LONG(status);
DEBUG_WRITE_STRING("\n\r");

status = HWREG(0x680800); //  OTPSECLOCK in OPT
status = HWREG(CSM_BASE + 0x120); // OTPSECLOCK register

DEBUG_WRITE_STRING("OTPSECLOCK: 0x");
DEBUG_WRITE_LONG(status);
DEBUG_WRITE_STRING("\n\r");

status = HWREG(CSM_BASE + DCSM_O_Z1_CR);
DEBUG_WRITE_STRING("CSM status after OTPSECLOCK read : 0x");
DEBUG_WRITE_LONG(status);
DEBUG_WRITE_STRING("\n\r");

temp = HWREG(FLASH_BASE + ZONE1_CSMPSWD0_OFFSET);
temp = HWREG(FLASH_BASE + ZONE1_CSMPSWD1_OFFSET);
temp = HWREG(FLASH_BASE + ZONE1_CSMPSWD2_OFFSET);
temp = HWREG(FLASH_BASE + ZONE1_CSMPSWD3_OFFSET);

status = HWREG(CSM_BASE + DCSM_O_Z1_CR);
DEBUG_WRITE_STRING("CSM status after password read : 0x");
DEBUG_WRITE_LONG(status);
DEBUG_WRITE_STRING("\n\r");