I know of at least 2 conditions on a PQIII core which can produce this effect (elf is not in expected halted mode):
1. The core is caught in a recursive exception loop. Something has caused an exception, and the first instruction of the exception handler also causes an exception, etc. Some possible causes: local access window for exception handlers is corrupted, TLB entry for exception handlers is corrupted, exception handler location is changed before setting up local access window or TLB entry, or handler code or associated i-cache is corrupted.
2. The core is waiting for a DDR transaction that will never complete. This can happen when a local access window for DDR is enabled before DDR is initialized. Any attempted access to DDR memory in this state can cause a hang.
For PQ3 devices it is essential that the Debug Exception vector, IVOR15, be defined and point to a valid address that contains a valid instruction or hardware breakpoints won't work. And it's a good idea to have the Program Exception vector, IVOR6, also defined this way so software breakpoints will work.
In our 8548 target-initialization files we include lines like these:
# set interrupt vectors
writereg IVPR 0xFFFF0000 # IVPR (compatible to the Flash)
writereg IVOR15 0x0000F000 # debug - (a valid instruction should exist to be fetched)
writereg IVOR6 0x0000F700 # program
# put a valid opcode at debug and progrm exception vector address
writemem.l 0x00000700 0x48000000
writemem.l 0x00001500 0x48000000
I suggest adding these lines to your .cfg file if they are not already there. Or at least verify the values of IVPR, IVOR6 and IVOR15 before you try stepping.