diff --git a/TODO b/TODO
index 1a2b92800283d7bafc97d8443661c7f82525a485..ac43e2c7c0c6c8650d108ef5c8057f717b8ac6a0 100644
--- a/TODO
+++ b/TODO
@@ -117,10 +117,16 @@ https://lists.berlios.de/pipermail/openocd-development/2009-July/009206.html
 - ARM923EJS:
   - reset run/halt/step is not robust; needs testing to map out problems.
 - ARM11 improvements (MB?)
-  - fix single stepping  (reported by ØH). Michael Bruck explained
-  that what's required is to emulate the current instruction(just like the
-  arm7 code) to know what address to set the breakpoint at for single
-  stepping an instruction.
+  - fix single stepping  (reported by ØH). Need to automatically
+  use hardware stepping if available.
+  - hunt down and add timeouts to all infinite loops, e.g. arm11_run_instr_no_data would
+    lock up in infinite loop if e.g. an "mdh" command tries to read memory from invalid memory location.
+    Try mdh 0x40000000 on i.MX31 PDK
+  - mdb can return garbage data if read byte operation fails for
+  a memory region(16 & 32 byte access modes may be supported). Is this
+  a bug in the .MX31 PDK init script? Try on i.MX31 PDK: 
+  mdw 0xb80005f0 0x8, mdh 0xb80005f0 0x10, mdb 0xb80005f0 0x20. mdb returns
+  garabage.
   - implement missing functionality (grep FNC_INFO_NOTIMPLEMENTED ...)
   - thumb support is missing: ISTR ARMv6 requires Thumb.
   ARM1156 has Thumb2; ARM1136 doesn't.
diff --git a/src/target/arm11.c b/src/target/arm11.c
index 7f92ce470d690cbb6ce6401aca69e476c683361d..0f8faba33132b4f76a46d3411e767a6b06a0f57b 100644
--- a/src/target/arm11.c
+++ b/src/target/arm11.c
@@ -2,7 +2,7 @@
  *   Copyright (C) 2008 digenius technology GmbH.                          *
  *   Michael Bruck                                                         *
  *                                                                         *
- *   Copyright (C) 2008 Oyvind Harboe oyvind.harboe@zylin.com              *
+ *   Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com         *
  *                                                                         *
  *   Copyright (C) 2008 Georg Acher <acher@in.tum.de>                      *
  *                                                                         *
@@ -374,6 +374,7 @@ int arm11_check_init(arm11_common_t * arm11, uint32_t * dscr)
   */
 static int arm11_on_enter_debug_state(arm11_common_t * arm11)
 {
+	int retval;
 	FNC_INFO;
 
 	for (size_t i = 0; i < asizeof(arm11->reg_values); i++)
@@ -459,7 +460,9 @@ static int arm11_on_enter_debug_state(arm11_common_t * arm11)
 	for (size_t i = 0; i < 15; i++)
 	{
 		/* MCR p14,0,R?,c0,c5,0 */
-		arm11_run_instr_data_from_core(arm11, 0xEE000E15 | (i << 12), &R(RX + i), 1);
+		retval = arm11_run_instr_data_from_core(arm11, 0xEE000E15 | (i << 12), &R(RX + i), 1);
+		if (retval != ERROR_OK)
+			return retval;
 	}
 
 	/* save rDTR */
@@ -484,7 +487,9 @@ static int arm11_on_enter_debug_state(arm11_common_t * arm11)
 	/* save PC */
 
 	/* MOV R0,PC (move PC -> r0 (-> wDTR -> local var)) */
-	arm11_run_instr_data_from_core_via_r0(arm11, 0xE1A0000F, &R(PC));
+	retval = arm11_run_instr_data_from_core_via_r0(arm11, 0xE1A0000F, &R(PC));
+	if (retval != ERROR_OK)
+		return retval;
 
 	/* adjust PC depending on ARM state */
 
@@ -665,6 +670,7 @@ void arm11_record_register_history(arm11_common_t * arm11)
 int arm11_poll(struct target_s *target)
 {
 	FNC_INFO;
+	int retval;
 
 	arm11_common_t * arm11 = target->arch_info;
 
@@ -688,7 +694,9 @@ int arm11_poll(struct target_s *target)
 			LOG_DEBUG("enter TARGET_HALTED");
 			target->state			= TARGET_HALTED;
 			target->debug_reason	= arm11_get_DSCR_debug_reason(dscr);
-			arm11_on_enter_debug_state(arm11);
+			retval = arm11_on_enter_debug_state(arm11);
+			if (retval != ERROR_OK)
+				return retval;
 
 			target_call_event_callbacks(target,
 				old_state == TARGET_DEBUG_RUNNING ? TARGET_EVENT_DEBUG_HALTED : TARGET_EVENT_HALTED);
diff --git a/src/target/arm11.h b/src/target/arm11.h
index d5071b20641717979d81e8c4cd4872a8baac3b8e..aa36b2934d74e1735ab13681cc5778a0042a8595 100644
--- a/src/target/arm11.h
+++ b/src/target/arm11.h
@@ -257,12 +257,12 @@ enum target_debug_reason arm11_get_DSCR_debug_reason(uint32_t dscr);
 void arm11_run_instr_data_prepare			(arm11_common_t * arm11);
 void arm11_run_instr_data_finish			(arm11_common_t * arm11);
 int arm11_run_instr_no_data					(arm11_common_t * arm11, uint32_t * opcode, size_t count);
-void arm11_run_instr_no_data1				(arm11_common_t * arm11, uint32_t opcode);
+int arm11_run_instr_no_data1				(arm11_common_t * arm11, uint32_t opcode);
 int arm11_run_instr_data_to_core			(arm11_common_t * arm11, uint32_t opcode, uint32_t * data, size_t count);
 int arm11_run_instr_data_to_core_noack		(arm11_common_t * arm11, uint32_t opcode, uint32_t * data, size_t count);
 int arm11_run_instr_data_to_core1			(arm11_common_t * arm11, uint32_t opcode, uint32_t data);
 int arm11_run_instr_data_from_core			(arm11_common_t * arm11, uint32_t opcode, uint32_t * data, size_t count);
-void arm11_run_instr_data_from_core_via_r0	(arm11_common_t * arm11, uint32_t opcode, uint32_t * data);
+int arm11_run_instr_data_from_core_via_r0	(arm11_common_t * arm11, uint32_t opcode, uint32_t * data);
 void arm11_run_instr_data_to_core_via_r0	(arm11_common_t * arm11, uint32_t opcode, uint32_t data);
 
 int arm11_add_dr_scan_vc(int num_fields, scan_field_t *fields, tap_state_t state);
diff --git a/src/target/arm11_dbgtap.c b/src/target/arm11_dbgtap.c
index 9e8be889c17320309cbb98bab6f3afb72a71d680..82612598d29fef0f60c877a91ca2fd252d8dcf2d 100644
--- a/src/target/arm11_dbgtap.c
+++ b/src/target/arm11_dbgtap.c
@@ -2,7 +2,7 @@
  *   Copyright (C) 2008 digenius technology GmbH.                          *
  *   Michael Bruck                                                         *
  *                                                                         *
- *   Copyright (C) 2008 Oyvind Harboe oyvind.harboe@zylin.com              *
+ *   Copyright (C) 2008,2009 Oyvind Harboe oyvind.harboe@zylin.com         *
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
  *   it under the terms of the GNU General Public License as published by  *
@@ -26,6 +26,7 @@
 
 #include "arm11.h"
 
+#include "time_support.h"
 
 #if 0
 #define JTAG_DEBUG(expr ...)	DEBUG(expr)
@@ -355,6 +356,7 @@ void arm11_run_instr_data_finish(arm11_common_t * arm11)
 }
 
 
+
 /** Execute one or multiple instructions via ITR
  *
  * \pre arm11_run_instr_data_prepare() /  arm11_run_instr_data_finish() block
@@ -372,6 +374,7 @@ int arm11_run_instr_no_data(arm11_common_t * arm11, uint32_t * opcode, size_t co
 	{
 		arm11_add_debug_INST(arm11, *opcode++, NULL, TAP_IDLE);
 
+		int i = 0;
 		while (1)
 		{
 			uint8_t flag;
@@ -382,6 +385,22 @@ int arm11_run_instr_no_data(arm11_common_t * arm11, uint32_t * opcode, size_t co
 
 			if (flag)
 				break;
+
+			long long then;
+			if (i == 1000)
+			{
+				then = timeval_ms();
+			}
+			if (i >= 1000)
+			{
+				if ((timeval_ms()-then) > 1000)
+				{
+					LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+					return ERROR_FAIL;
+				}
+			}
+
+			i++;
 		}
 	}
 
@@ -396,9 +415,9 @@ int arm11_run_instr_no_data(arm11_common_t * arm11, uint32_t * opcode, size_t co
  * \param opcode	ARM opcode
  *
  */
-void arm11_run_instr_no_data1(arm11_common_t * arm11, uint32_t opcode)
+int arm11_run_instr_no_data1(arm11_common_t * arm11, uint32_t opcode)
 {
-	arm11_run_instr_no_data(arm11, &opcode, 1);
+	return arm11_run_instr_no_data(arm11, &opcode, 1);
 }
 
 
@@ -435,6 +454,7 @@ int arm11_run_instr_data_to_core(arm11_common_t * arm11, uint32_t opcode, uint32
 
 	while (count--)
 	{
+		int i = 0;
 		do
 		{
 			Data	    = *data;
@@ -444,6 +464,22 @@ int arm11_run_instr_data_to_core(arm11_common_t * arm11, uint32_t opcode, uint32
 			CHECK_RETVAL(jtag_execute_queue());
 
 			JTAG_DEBUG("DTR  Ready %d  nRetry %d", Ready, nRetry);
+
+			long long then;
+			if (i == 1000)
+			{
+				then = timeval_ms();
+			}
+			if (i >= 1000)
+			{
+				if ((timeval_ms()-then) > 1000)
+				{
+					LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+					return ERROR_FAIL;
+				}
+			}
+
+			i++;
 		}
 		while (!Ready);
 
@@ -452,6 +488,7 @@ int arm11_run_instr_data_to_core(arm11_common_t * arm11, uint32_t opcode, uint32
 
 	arm11_add_IR(arm11, ARM11_INTEST, ARM11_TAP_DEFAULT);
 
+	int i = 0;
 	do
 	{
 		Data	    = 0;
@@ -461,6 +498,22 @@ int arm11_run_instr_data_to_core(arm11_common_t * arm11, uint32_t opcode, uint32
 		CHECK_RETVAL(jtag_execute_queue());
 
 		JTAG_DEBUG("DTR  Data %08x  Ready %d  nRetry %d", Data, Ready, nRetry);
+
+		long long then;
+		if (i == 1000)
+		{
+			then = timeval_ms();
+		}
+		if (i >= 1000)
+		{
+			if ((timeval_ms()-then) > 1000)
+			{
+				LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+				return ERROR_FAIL;
+			}
+		}
+
+		i++;
 	}
 	while (!Ready);
 
@@ -616,6 +669,7 @@ int arm11_run_instr_data_from_core(arm11_common_t * arm11, uint32_t opcode, uint
 
 	while (count--)
 	{
+		int i = 0;
 		do
 		{
 			arm11_add_dr_scan_vc(asizeof(chain5_fields), chain5_fields, count ? TAP_IDLE : TAP_DRPAUSE);
@@ -623,6 +677,22 @@ int arm11_run_instr_data_from_core(arm11_common_t * arm11, uint32_t opcode, uint
 			CHECK_RETVAL(jtag_execute_queue());
 
 			JTAG_DEBUG("DTR  Data %08x  Ready %d  nRetry %d", Data, Ready, nRetry);
+
+			long long then;
+			if (i == 1000)
+			{
+				then = timeval_ms();
+			}
+			if (i >= 1000)
+			{
+				if ((timeval_ms()-then) > 1000)
+				{
+					LOG_WARNING("Timeout (1000ms) waiting for instructions to complete");
+					return ERROR_FAIL;
+				}
+			}
+
+			i++;
 		}
 		while (!Ready);
 
@@ -644,12 +714,17 @@ int arm11_run_instr_data_from_core(arm11_common_t * arm11, uint32_t opcode, uint
  * \param data		Pointer to a data word that receives the value from r0 after \p opcode was executed.
  *
  */
-void arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, uint32_t opcode, uint32_t * data)
+int arm11_run_instr_data_from_core_via_r0(arm11_common_t * arm11, uint32_t opcode, uint32_t * data)
 {
-	arm11_run_instr_no_data1(arm11, opcode);
+	int retval;
+	retval = arm11_run_instr_no_data1(arm11, opcode);
+	if (retval != ERROR_OK)
+		return retval;
 
 	/* MCR p14,0,R0,c0,c5,0 (move r0 -> wDTR -> local var) */
 	arm11_run_instr_data_from_core(arm11, 0xEE000E15, data, 1);
+
+	return ERROR_OK;
 }
 
 /** Load data into core via DTR then move it to r0 then