diff --git a/src/flash/arm_nandio.c b/src/flash/arm_nandio.c
index 81697fa5c..20a76f43c 100644
--- a/src/flash/arm_nandio.c
+++ b/src/flash/arm_nandio.c
@@ -131,5 +131,94 @@ int arm_nandwrite(struct arm_nand_data *nand, uint8_t *data, int size)
 	return retval;
 }
 
-/* REVISIT do the same for bulk *read* too ... */
+/**
+ * Uses an on-chip algorithm for an ARM device to read from a NAND device and
+ * store the data into the host machine's memory.
+ *
+ * @param nand Pointer to the arm_nand_data struct that defines the I/O
+ * @param data Pointer to the data buffer to store the read data
+ * @param size Amount of data to be stored to the buffer.
+ */
+int arm_nandread(struct arm_nand_data *nand, uint8_t *data, uint32_t size) {
+	struct target *target = nand->target;
+	struct armv4_5_algorithm algo;
+	struct arm *armv4_5 = target->arch_info;
+	struct reg_param reg_params[3];
+	uint32_t target_buf;
+	uint32_t exit = 0;
+	int retval;
+
+	/* Inputs:
+	 *  r0	buffer address
+	 *  r1	NAND data address (byte wide)
+	 *  r2	buffer length
+	 */
+	static const uint32_t code[] = {
+		0xe5d13000,	/* s: ldrb  r3, [r1]     */
+		0xe4c03001,	/*    strb  r3, [r0], #1 */
+		0xe2522001,	/*    subs  r2, r2, #1   */
+		0x1afffffb,	/*    bne   s            */
+
+		/* exit: ARMv4 needs hardware breakpoint */
+		0xe1200070,	/* e: bkpt  #0           */
+	};
+
+	/* create the copy area if not yet available */
+	if (!nand->copy_area) {
+		uint8_t code_buf[sizeof(code)];
+		unsigned i;
+
+		/* make sure we have a working area */
+		retval = target_alloc_working_area(target, sizeof(code) + nand->chunk_size, &nand->copy_area);
+		if (retval != ERROR_OK) {
+			LOG_DEBUG("%s: no %d byte buffer", __FUNCTION__, (int) sizeof(code) + nand->chunk_size);
+			return ERROR_NAND_NO_BUFFER;
+		}
+
+		/* buffer code in target endianness */
+		for (i = 0; i < sizeof(code) / 4; i++) {
+			target_buffer_set_u32(target, code_buf + i * 4, code[i]);
+		}
+
+		/* copy code to work area */
+        retval = target_write_memory(target, nand->copy_area->address, 4, sizeof(code) / 4, code_buf);
+		if (retval != ERROR_OK) {
+			return retval;
+		}
+	}
+
+	target_buf = nand->copy_area->address + sizeof(code);
+
+	/* set up algorithm and parameters */
+	algo.common_magic = ARMV4_5_COMMON_MAGIC;
+	algo.core_mode = ARMV4_5_MODE_SVC;
+	algo.core_state = ARMV4_5_STATE_ARM;
+
+	init_reg_param(&reg_params[0], "r0", 32, PARAM_IN);
+	init_reg_param(&reg_params[1], "r1", 32, PARAM_IN);
+	init_reg_param(&reg_params[2], "r2", 32, PARAM_IN);
+
+	buf_set_u32(reg_params[0].value, 0, 32, target_buf);
+	buf_set_u32(reg_params[1].value, 0, 32, nand->data);
+	buf_set_u32(reg_params[2].value, 0, 32, size);
+
+	/* armv4 must exit using a hardware breakpoint */
+	if (armv4_5->is_armv4)
+		exit = nand->copy_area->address + sizeof(code) - 4;
+
+	/* use alg to write data from NAND chip to work area */
+	retval = target_run_algorithm(target, 0, NULL, 3, reg_params,
+			nand->copy_area->address, exit, 1000, &algo);
+	if (retval != ERROR_OK)
+		LOG_ERROR("error executing hosted NAND write");
+
+	destroy_reg_param(&reg_params[0]);
+	destroy_reg_param(&reg_params[1]);
+	destroy_reg_param(&reg_params[2]);
+
+	/* read from work area to the host's memory */
+	retval = target_read_buffer(target, target_buf, size, data);
+
+	return retval;
+}
 
diff --git a/src/flash/arm_nandio.h b/src/flash/arm_nandio.h
index a1bed326d..fbe1f8871 100644
--- a/src/flash/arm_nandio.h
+++ b/src/flash/arm_nandio.h
@@ -21,5 +21,6 @@ struct arm_nand_data {
 };
 
 int arm_nandwrite(struct arm_nand_data *nand, uint8_t *data, int size);
+int arm_nandread(struct arm_nand_data *nand, uint8_t *data, uint32_t size);
 
 #endif  /* __ARM_NANDIO_H */