[PATCH] Add a new format letter to dump instructions backward

[PATCH] Add a new format letter to dump instructions backward

[Toshihito Kikuchi]

[-- Attachment #1: Type: text/plain, Size: 2017 bytes --]

Hi all,

With the attached patch, I'd like to add a new format letter "j" to
the "x" command to dump instructions in backward direction.
This feature is basically equal to "ub" command in Windows debugger.

Below is the sample output:

(gdb) disas main
Dump of assembler code for function main(int, char**):
   0x4040a7 <+0>: push   %rbp
   0x4040a8 <+1>: mov    %rsp,%rbp
   0x4040ab <+4>: sub    $0x10,%rsp
   0x4040af <+8>: mov    %edi,-0x4(%rbp)
   0x4040b2 <+11>:  mov    %rsi,-0x10(%rbp)
=> 0x4040b6 <+15>:  lea    0x116(%rip),%rdi        # 0x4041d3
   0x4040bd <+22>:  callq  0x400e30 <puts@plt>
   0x4040c2 <+27>:  mov    $0x0,%eax
   0x4040c7 <+32>:  leaveq 
   0x4040c8 <+33>:  retq   
End of assembler dump.
(gdb) x/6j $rip
   0x4040a6 <previous_function(...)+119>:  retq   
   0x4040a7 <main(int, char**)>:  push   %rbp
   0x4040a8 <main(int, char**)+1>:  mov    %rsp,%rbp
   0x4040ab <main(int, char**)+4>:  sub    $0x10,%rsp
   0x4040af <main(int, char**)+8>:  mov    %edi,-0x4(%rbp)
   0x4040b2 <main(int, char**)+11>: mov    %rsi,-0x10(%rbp)
(gdb) x/2j
   0x4040a2 <previous_function(...)+115>:  add    %rdx,%rax
   0x4040a5 <previous_function(...)+118>:  leaveq 

Unlike forward disassemble, theoretically it's impossible to
solve a correct frame only using the code. In the example below, we cannot
decide whether the instruction before "pop" is "nop" or "mov".

<correct frame>
   0x4045bb <+89>:  eb b4  jmp    0x404571
   0x4045bd <+91>:  90     nop
   0x4045be <+92>:  5d     pop    %rbp
   0x4045bf <+93>:  c3     retq   

<incorrect frame>
   0x4045bc <+90>:  b4 90  mov    $0x90,%ah
   0x4045be <+92>:  5d     pop    %rbp
   0x4045bf <+93>:  c3     retq 

To solve this, the change takes the help of line number information.

I introduced a new function "disassemble_backward" which goes backward
by referring the start address of each line.If we go out of the symbol range, we cancel backtrack and dump
the smallest address with the message.

Tested on x86_64 GNU/Linux.


Thanks,
Toshihito

[-- Attachment #2: ChangeLog --]
[-- Type: application/octet-stream, Size: 286 bytes --]

gdb/ChangeLog:
2016-01-24  Toshihito Kikuchi  <k.toshihito@yahoo.de>

    * printcmd.c (disassemble_backward): New function.
    (null_fprintf) New function.
    (null_print_address) New function.
    (do_examine): Use new function.
    (_initialize_printcmd) Adjust new format letter.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: gdb-ub.diff --]
[-- Type: text/x-patch, Size: 5209 bytes --]

diff --git a/gdb/printcmd.c b/gdb/printcmd.c
index f5c4211..a6cf141 100644
--- a/gdb/printcmd.c
+++ b/gdb/printcmd.c
@@ -47,6 +47,7 @@
 #include "cli/cli-utils.h"
 #include "format.h"
 #include "source.h"
+#include "linespec.h"
 
 #ifdef TUI
 #include "tui/tui.h"		/* For tui_active et al.   */
@@ -785,6 +786,97 @@ print_address_demangle (const struct value_print_options *opts,
 }
 \f
 
+/* These empty functions are used in disassemble_backward to
+   suppress standard output during the call to gdbarch_print_insn. */
+
+static int
+null_fprintf (void *stream, const char *format ATTRIBUTE_UNUSED, ...)
+{
+  return 0;
+}
+
+static void
+null_print_address (bfd_vma addr, struct disassemble_info *info)
+{
+  return;
+}
+
+/* Rewind assembly from addr and return the start address after the given
+   number of lines are disassembled. To avoid disassembling in a wrong frame,
+   we get addresses in a correct frame using line information.
+   If we go out of the symbol range during disassembling, we return
+   the smallest address we've got so far. */
+
+static CORE_ADDR
+disassemble_backward(struct gdbarch *gdbarch, CORE_ADDR addr,
+                     int count, int *linesread)
+{
+  char addrstr[64];
+  struct symtabs_and_lines sals;
+  CORE_ADDR start_pc, end_pc, ret;
+
+  start_pc = end_pc = ret = 0;
+  *linesread = 0;
+
+  sprintf (addrstr, "*%p", (void *) (addr - 1));
+  sals = decode_line_with_last_displayed (addrstr, DECODE_LINE_FUNFIRSTLINE);
+  if (sals.nelts >= 1)
+    {
+      if ((!sals.sals[0].line)
+          || (!find_line_pc_range (sals.sals[0], &start_pc, &end_pc)))
+        {
+          printf_filtered (_("No line number information available "
+            "for address "));
+          wrap_here ("  ");
+          print_address (gdbarch, addr - 1, gdb_stdout);
+          printf_filtered ("\n");
+          start_pc = end_pc = 0;
+        }
+      xfree (sals.sals);
+    }
+
+  if (start_pc)
+    {
+      VEC (CORE_ADDR) *pcs = NULL;
+      struct disassemble_info di;
+      CORE_ADDR p;
+      int i;
+
+      VEC_reserve (CORE_ADDR, pcs, count);
+
+      di = gdb_disassemble_info (gdbarch, NULL);
+      di.fprintf_func = null_fprintf;
+      di.print_address_func = null_print_address;
+
+      p = start_pc;
+      for (i = 0; p < addr; ++i)
+        {
+          VEC_safe_push (CORE_ADDR, pcs, p);
+          p += gdbarch_print_insn (gdbarch, (CORE_ADDR)p, &di);
+        }
+
+      if (i >= count)
+        {
+          ret = VEC_index (CORE_ADDR, pcs, i - count);
+          *linesread = count;
+        }
+        else
+        {
+          int linesread_internal = 0;
+          ret = disassemble_backward (gdbarch, VEC_index (CORE_ADDR, pcs, 0),
+               count - i, &linesread_internal);
+          *linesread = i + linesread_internal;
+
+          /* Return the smallest valid address we've got
+             if the recursive call above failed. */
+          if (!ret)
+            ret = VEC_index (CORE_ADDR, pcs, 0);
+        }
+      VEC_free (CORE_ADDR, pcs);
+    }
+  return ret;
+}
+
 /* Examine data at address ADDR in format FMT.
    Fetch it from memory and print on gdb_stdout.  */
 
@@ -798,6 +890,7 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
   int i;
   int maxelts;
   struct value_print_options opts;
+  CORE_ADDR addr_rewound = 0;
 
   format = fmt.format;
   size = fmt.size;
@@ -805,6 +898,24 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
   next_gdbarch = gdbarch;
   next_address = addr;
 
+  if (format == 'j')
+    {
+      /* If 'j' is given, we get the address after going back
+         by 'count' instructions from addr and dump instructions
+         from it by setting format to 'i'.
+         At the end of this function, we adjust next_address
+         for subsequent command calls. */
+      int linesread = 0;
+      addr_rewound = next_address = disassemble_backward (gdbarch,
+           addr, count, &linesread);
+      if (!next_address)
+        {
+          return;
+        }
+      count = linesread;
+      format = 'i';
+    }
+
   /* Instruction format implies fetch single bytes
      regardless of the specified size.
      The case of strings is handled in decode_format, only explicit
@@ -913,6 +1024,9 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
       printf_filtered ("\n");
       gdb_flush (gdb_stdout);
     }
+
+  if (addr_rewound)
+    next_address = addr_rewound;
 }
 \f
 static void
@@ -2518,8 +2632,8 @@ Examine memory: x/FMT ADDRESS.\n\
 ADDRESS is an expression for the memory address to examine.\n\
 FMT is a repeat count followed by a format letter and a size letter.\n\
 Format letters are o(octal), x(hex), d(decimal), u(unsigned decimal),\n\
-  t(binary), f(float), a(address), i(instruction), c(char), s(string)\n\
-  and z(hex, zero padded on the left).\n\
+  t(binary), f(float), a(address), i(instruction), j(instruction backward),\n\
+  c(char), s(string) and z(hex, zero padded on the left).\n\
 Size letters are b(byte), h(halfword), w(word), g(giant, 8 bytes).\n\
 The specified number of objects of the specified size are printed\n\
 according to the format.\n\n\

Re: [PATCH] Add a new format letter to dump instructions backward

[Pedro Alves]

On 01/24/2016 09:28 PM, Toshihito Kikuchi wrote:
> Hi all,
> 

Hi there.

> With the attached patch, I'd like to add a new format letter "j" to
> the "x" command to dump instructions in backward direction.

Thanks.

What's the rationale for making this a format letter though?
It seems orthogonal to the other format letters to me.

Example, say I dump raw opcodes in hex, with:

 (gdb) x /4x main
 0x400766 <main>:        0x55    0x48    0x89    0xe5
 (gdb) x /4x
 0x40076a <main+4>:      0x48    0x83    0xec    0x30
 (gdb) x
 0x40076e <main+8>:      0x48
 (gdb)
 0x40076f <main+9>:      0xc7

but then I can't go backwards in hex, as /j overrides it,
and always prints like /i:

 (gdb) x /4xj
    0x400766 <main>:     push   %rbp
    0x400767 <main+1>:   mov    %rsp,%rbp
    0x40076a <main+4>:   sub    $0x30,%rsp
 => 0x40076e <main+8>:   movq   $0x0,-0x8(%rbp)


Seems to me that some other UI would be better.  E.g.,:

 #1 - a different switch, like "x -back /i " ?

 #2 - a different command, like "bx" ?

 #3 - negative repeat counts ?

   (gdb) x /4i    // next 4 instructions
   (gdb) x /-4i   // previous 4 instructions

   (gdb) x /4bx    // next 4 bytes, in hex
   (gdb) x /-4bx   // previous 4 bytes, in hex


Added #1 just for completeness, I don't find it very convenient.

#3 feels natural to me.  What do you (and others) think?

Adding some tests would be great.  Also, the documentation
will need to be updated.

If you haven't yet, please take a look at:
 https://sourceware.org/gdb/wiki/ContributionChecklist

Thanks,
Pedro Alves

Re: [PATCH] Add a new format letter to dump instructions backward

[John Baldwin]

On Monday, January 25, 2016 11:41:27 AM Pedro Alves wrote:
> On 01/24/2016 09:28 PM, Toshihito Kikuchi wrote:
> Seems to me that some other UI would be better.  E.g.,:
> 
>  #1 - a different switch, like "x -back /i " ?
> 
>  #2 - a different command, like "bx" ?
> 
>  #3 - negative repeat counts ?
> 
>    (gdb) x /4i    // next 4 instructions
>    (gdb) x /-4i   // previous 4 instructions
> 
>    (gdb) x /4bx    // next 4 bytes, in hex
>    (gdb) x /-4bx   // previous 4 bytes, in hex
> 
> 
> Added #1 just for completeness, I don't find it very convenient.
> 
> #3 feels natural to me.  What do you (and others) think?

I think #3 is the most natural as well.  I also think this is a
very useful feature.

-- 
John Baldwin

Re: [PATCH] Add a new format letter to dump instructions backward

[Paul_Koning]

> On Jan 25, 2016, at 12:52 PM, John Baldwin <jhb@freebsd.org> wrote:
> 
> On Monday, January 25, 2016 11:41:27 AM Pedro Alves wrote:
>> On 01/24/2016 09:28 PM, Toshihito Kikuchi wrote:
>> ...
>> #3 - negative repeat counts ?
>> 
>>   (gdb) x /4i    // next 4 instructions
>>   (gdb) x /-4i   // previous 4 instructions
>> ...
>> #3 feels natural to me.  What do you (and others) think?
> 
> I think #3 is the most natural as well.  I also think this is a
> very useful feature.

Yes, but how do you do instructions backwards if the instruction length is variable?  It is entirely possible that there will be multiple possible answers, and no way to tell which one (if any) is "correct".

	paul

Re: [PATCH] Add a new format letter to dump instructions backward

[Pedro Alves]

On 01/25/2016 06:22 PM, Paul_Koning@Dell.com wrote:
> 
>> On Jan 25, 2016, at 12:52 PM, John Baldwin <jhb@freebsd.org> wrote:
>>
>> On Monday, January 25, 2016 11:41:27 AM Pedro Alves wrote:
>>> On 01/24/2016 09:28 PM, Toshihito Kikuchi wrote:
>>> ...
>>> #3 - negative repeat counts ?
>>>
>>>   (gdb) x /4i    // next 4 instructions
>>>   (gdb) x /-4i   // previous 4 instructions
>>> ...
>>> #3 feels natural to me.  What do you (and others) think?
>>
>> I think #3 is the most natural as well.  I also think this is a
>> very useful feature.
> 
> Yes, but how do you do instructions backwards if the instruction length is variable?  It is entirely possible that there will be multiple possible answers, and no way to tell which one (if any) is "correct".

You disassemble forward starting from the previous known
instruction boundary, based on symbol/line info.  I haven't looked
at the implementation in detail, but from the patch description, that's
what I assume the patch is doing.

Thanks,
Pedro Alves

Re: [PATCH] Add a new format letter to dump instructions backward

[Paul_Koning]

> On Jan 25, 2016, at 1:27 PM, Pedro Alves <palves@redhat.com> wrote:
> 
> On 01/25/2016 06:22 PM, Paul_Koning@Dell.com wrote:
>> 
>>> On Jan 25, 2016, at 12:52 PM, John Baldwin <jhb@freebsd.org> wrote:
>>> 
>>> On Monday, January 25, 2016 11:41:27 AM Pedro Alves wrote:
>>>> On 01/24/2016 09:28 PM, Toshihito Kikuchi wrote:
>>>> ...
>>>> #3 - negative repeat counts ?
>>>> 
>>>>  (gdb) x /4i    // next 4 instructions
>>>>  (gdb) x /-4i   // previous 4 instructions
>>>> ...
>>>> #3 feels natural to me.  What do you (and others) think?
>>> 
>>> I think #3 is the most natural as well.  I also think this is a
>>> very useful feature.
>> 
>> Yes, but how do you do instructions backwards if the instruction length is variable?  It is entirely possible that there will be multiple possible answers, and no way to tell which one (if any) is "correct".
> 
> You disassemble forward starting from the previous known
> instruction boundary, based on symbol/line info.  I haven't looked
> at the implementation in detail, but from the patch description, that's
> what I assume the patch is doing.

So unlike the existing x commands this would depend on debug information.  It would be nice if it worked without, on machines where instruction length is fixed (most RISC machines).

	paul

Re: [PATCH] Add a new format letter to dump instructions backward

[Toshihito Kikuchi]

Thank you for the great suggestion.

I also agree that #3, adding the support for a negative number, looks reasonable. I'll get back to this thread when the code is ready.

To answer the question from Paul, Pedro's guess is correct. I used symbol's line info to solve a correct frame. And yes, this feature does not work without debug information unfortunately. Since I'm not familiar with architectures other than x86, let me finish this work in the current approach first. If there are architectures where instruction length is fixed, I think I can add them later.


> Adding some tests would be great.  Also, the documentation
> will need to be updated.
> 
> If you haven't yet, please take a look at:
> https://sourceware.org/gdb/wiki/ContributionChecklist
Thank you for pointing to this. I looked at only gdb/CONTRIBUTE and didn't reach this. Tests and doc updates will be included in next patch.


Thanks,
Toshihito

Re: [PATCH] Add a new format letter to dump instructions backward

[Andrew Burgess]

* Toshihito Kikuchi <k.toshihito@yahoo.de> [2016-01-26 05:36:58 +0000]:

> To answer the question from Paul, Pedro's guess is correct. I used
> symbol's line info to solve a correct frame. And yes, this feature
> does not work without debug information unfortunately.

If there's no debug information then just looking for symbols in the
same section would also be a reasonable guess. Most symbols appear
between instructions, not part way through an instruction.

Sounds like a useful feature.

Thanks,
Andrew

Re: [PATCH] Add a new format letter to dump instructions backward

[Paul_Koning]

> On Jan 27, 2016, at 11:04 AM, Andrew Burgess <andrew.burgess@embecosm.com> wrote:
> 
> * Toshihito Kikuchi <k.toshihito@yahoo.de> [2016-01-26 05:36:58 +0000]:
> 
>> To answer the question from Paul, Pedro's guess is correct. I used
>> symbol's line info to solve a correct frame. And yes, this feature
>> does not work without debug information unfortunately.
> 
> If there's no debug information then just looking for symbols in the
> same section would also be a reasonable guess. Most symbols appear
> between instructions, not part way through an instruction.

Yes.  But if you have no symbols either, it can still work on Alpha, or on MIPS if you disregard the Thumb instruction set, or on any number of other RISC machines where every instruction is the same size

	paul

Re: [PATCH] Add a new format letter to dump instructions backward

[Pedro Alves]

On 01/27/2016 07:49 PM, Paul_Koning@Dell.com wrote:
> 
>> On Jan 27, 2016, at 11:04 AM, Andrew Burgess <andrew.burgess@embecosm.com> wrote:
>>
>> * Toshihito Kikuchi <k.toshihito@yahoo.de> [2016-01-26 05:36:58 +0000]:
>>
>>> To answer the question from Paul, Pedro's guess is correct. I used
>>> symbol's line info to solve a correct frame. And yes, this feature
>>> does not work without debug information unfortunately.
>>
>> If there's no debug information then just looking for symbols in the
>> same section would also be a reasonable guess. Most symbols appear
>> between instructions, not part way through an instruction.
> 
> Yes.  But if you have no symbols either, it can still work on Alpha, or on MIPS if you disregard the Thumb instruction set, or on any number of other RISC machines where every instruction is the same size

Agreed.  We'd probably need to add a gdbarch hook to know whether
the target architecture has variable or fixed length instruction set.
That can always be done as a follow up incremental enhancement, though.

Thanks,
Pedro Alves

[PATCH] Negative repeat count for 'x' command

[Toshihito Kikuchi]

[-- Attachment #1: Type: text/plain, Size: 1924 bytes --]

Thank you for the feedbacks.  I updated the patch adding negative repeat count
support to the 'x' command instead of a new format letter.  Also, this patch
includes the update of document and NEWS file.

With this, we can specify a negative repeat count for all the formats in the 'x'
command to examine memory backward.

Here's the example output:
(gdb) bt
#0  Func1 (n=42, p=0x40432e "hogehoge") at main.cpp:5
#1  0x00000000004041fa in main (argc=1, argv=0x7fffffffdff8) at main.cpp:19
(gdb) x/-4i 0x4041fa
   0x4041e5 <main(int, char**)+11>:	mov    %rsi,-0x10(%rbp)
   0x4041e9 <main(int, char**)+15>:	lea    0x13e(%rip),%rsi        # 0x40432e
   0x4041f0 <main(int, char**)+22>:	mov    $0x2a,%edi
   0x4041f5 <main(int, char**)+27>:	callq  0x404147 <Func1(int, char const*)>
(gdb) x/-4xw 0x404200
0x4041f0 <main(int, char**)+22>:	0x00002abf	0xff4de800	0x76e8ffff	0xb8ffffff
(gdb) x/-4
0x4041e0 <main(int, char**)+6>:	0x7d8910ec	0x758948fc	0x358d48f0	0x0000013e

Tested on i386-linux and amd64-linux. I wrote a new testcase 'examine-backward'
under gdb.base.  It mainly focuses on x/-#s and x/-#i.  For disassembler
testing, the new testcase covers only i386 and amd64, which are skipped onother
platforms.

gdb/ChangeLog:

	* NEWS: Mention that GDB now supports a negative repeat count in
	the 'x' command.
	* printcmd.c (decode_format): Allow '-' in the parameter
	"string_ptr" to accept a negative repeat count.
	(null_fprintf): New function.
	(null_print_address): New function.
	(find_instruction_backward): New function.
	(read_memory_backward): New function.
	(integer_is_zero): New function.
	(find_string_backward): New function.
	(do_examine): Use new functions to examine memory backward.

gdb/doc/ChangeLog:

	* gdb.texinfo (Examining Memory): Document negative repeat
	count in the 'x' command.

gdb/testsuite/ChangeLog:

	* gdb.base/examine-backward.c: New file.
	* gdb.base/examine-backward.exp: New file.

[-- Attachment #2: 0001-Add-negative-repeat-count-to-x-command.patch --]
[-- Type: text/x-patch, Size: 26236 bytes --]

From aa4363c9cf6ad3c6ebcef3b7ea1c72e4180e89f2 Mon Sep 17 00:00:00 2001
From: tokikuch <k.toshihito@yahoo.de>
Date: Sun, 7 Feb 2016 13:24:53 -0800
Subject: [PATCH] Add negative repeat count to 'x' command

---
 gdb/NEWS                                    |  14 ++
 gdb/doc/gdb.texinfo                         |  14 +-
 gdb/printcmd.c                              | 259 +++++++++++++++++++++++++++-
 gdb/testsuite/gdb.base/examine-backward.c   | 143 +++++++++++++++
 gdb/testsuite/gdb.base/examine-backward.exp | 219 +++++++++++++++++++++++
 5 files changed, 646 insertions(+), 3 deletions(-)
 create mode 100644 gdb/testsuite/gdb.base/examine-backward.c
 create mode 100644 gdb/testsuite/gdb.base/examine-backward.exp

diff --git a/gdb/NEWS b/gdb/NEWS
index 962eae4..072c11a 100644
--- a/gdb/NEWS
+++ b/gdb/NEWS
@@ -3,6 +3,20 @@
 
 *** Changes since GDB 7.10
 
+* GDB now supports a negative repeat count in the 'x' command to examine
+  memory backward from the given address.  For example:
+
+    (gdb) bt
+    #0  Func1 (n=42, p=0x40061c "hogehoge") at main.cpp:4
+    #1  0x0000000000400580 in main (argc=1, argv=0x7fffffffe5c8) at main.cpp:8
+    (gdb) x/-5i 0x0000000000400580
+       0x40056a <main(int, char**)+8>:      mov    %edi,-0x4(%rbp)
+       0x40056d <main(int, char**)+11>:     mov    %rsi,-0x10(%rbp)
+       0x400571 <main(int, char**)+15>:     mov    $0x40061c,%esi
+       0x400576 <main(int, char**)+20>:     mov    $0x2a,%edi
+       0x40057b <main(int, char**)+25>:
+        callq  0x400536 <Func1(int, char const*)>
+
 * GDB now supports debugging kernel-based threads on FreeBSD.
 
 * Per-inferior thread numbers
diff --git a/gdb/doc/gdb.texinfo b/gdb/doc/gdb.texinfo
index 2d09d13..887eaa8 100644
--- a/gdb/doc/gdb.texinfo
+++ b/gdb/doc/gdb.texinfo
@@ -9199,7 +9199,8 @@ Several commands set convenient defaults for @var{addr}.
 @table @r
 @item @var{n}, the repeat count
 The repeat count is a decimal integer; the default is 1.  It specifies
-how much memory (counting by units @var{u}) to display.
+how much memory (counting by units @var{u}) to display.  If a negative
+number is specified, memory is examined backward from @var{addr}.
 @c This really is **decimal**; unaffected by 'set radix' as of GDB
 @c 4.1.2.
 
@@ -9254,6 +9255,10 @@ starting at address @code{0x54320}.  @samp{x/4xw $sp} prints the four
 words (@samp{w}) of memory above the stack pointer (here, @samp{$sp};
 @pxref{Registers, ,Registers}) in hexadecimal (@samp{x}).
 
+You can also specify a negative repeat count to examine memory backward
+from the given address.  For example, @samp{x/-3uh 0x54320} prints three
+halfwords (@code{h}) at @code{0x54314}, @code{0x54328}, and @code{0x5431c}.
+
 Since the letters indicating unit sizes are all distinct from the
 letters specifying output formats, you do not have to remember whether
 unit size or format comes first; either order works.  The output
@@ -9270,6 +9275,13 @@ follow the last instruction that is within the count.  The command
 @code{disassemble} gives an alternative way of inspecting machine
 instructions; see @ref{Machine Code,,Source and Machine Code}.
 
+If a negative repeat count is specified for the formats @samp{s} or @samp{i},
+the absolute value of the given number of null-terminated strings or
+instructions before the address are displayed.  For the @samp{i} format,
+we use line number information in the debug info to resolve a correct frame
+while dissasembling backward.  If line info is not available, the command
+stops examining memory with the error message.
+
 All the defaults for the arguments to @code{x} are designed to make it
 easy to continue scanning memory with minimal specifications each time
 you use @code{x}.  For example, after you have inspected three machine
diff --git a/gdb/printcmd.c b/gdb/printcmd.c
index f5c4211..e0ffcc0 100644
--- a/gdb/printcmd.c
+++ b/gdb/printcmd.c
@@ -47,6 +47,7 @@
 #include "cli/cli-utils.h"
 #include "format.h"
 #include "source.h"
+#include "linespec.h"
 
 #ifdef TUI
 #include "tui/tui.h"		/* For tui_active et al.   */
@@ -186,8 +187,13 @@ decode_format (const char **string_ptr, int oformat, int osize)
   val.count = 1;
   val.raw = 0;
 
+  if (*p == '-')
+    {
+      val.count = -1;
+      p++;
+    }
   if (*p >= '0' && *p <= '9')
-    val.count = atoi (p);
+    val.count *= atoi (p);
   while (*p >= '0' && *p <= '9')
     p++;
 
@@ -785,6 +791,221 @@ print_address_demangle (const struct value_print_options *opts,
 }
 \f
 
+/* These empty functions are used in find_instruction_backward to
+   suppress standard output during the call to gdbarch_print_insn.  */
+
+static int
+null_fprintf (void *stream, const char *format ATTRIBUTE_UNUSED, ...)
+{
+  return 0;
+}
+
+static void
+null_print_address (bfd_vma addr, struct disassemble_info *info)
+{
+  return;
+}
+
+/* Rewind assembly from ADDR and return the start address after the given
+   number of lines are disassembled. To avoid disassembling in a wrong frame,
+   we get addresses in a correct frame using line information.
+   If we go out of the symbol range during disassembling, we return
+   the smallest address we've got so far and set the number of lines read
+   to lines_read.  */
+
+static CORE_ADDR
+find_instruction_backward (struct gdbarch *gdbarch, CORE_ADDR addr,
+          int count, int *lines_read)
+{
+  char addrstr[64];
+  struct symtabs_and_lines sals;
+  CORE_ADDR start_pc, end_pc, ret;
+
+  start_pc = end_pc = 0;
+  ret = addr;
+  *lines_read = 0;
+
+  /* Get the start address of a line which includes the address (addr - 1).  */
+  sprintf (addrstr, "*%p", (void *) (addr - 1));
+  sals = decode_line_with_last_displayed (addrstr, DECODE_LINE_FUNFIRSTLINE);
+  if (sals.nelts >= 1)
+    {
+      if ((!sals.sals[0].line)
+          || (!find_line_pc_range (sals.sals[0], &start_pc, &end_pc)))
+        {
+          printf_filtered (_("No line number information available "
+            "for address "));
+          wrap_here ("  ");
+          print_address (gdbarch, addr - 1, gdb_stdout);
+          printf_filtered ("\n");
+          start_pc = end_pc = 0;
+        }
+      xfree (sals.sals);
+    }
+
+  if (start_pc)
+    {
+      VEC (CORE_ADDR) *pcs = NULL;
+      struct disassemble_info di;
+      CORE_ADDR p;
+      int i;
+
+      VEC_reserve (CORE_ADDR, pcs, count);
+
+      di = gdb_disassemble_info (gdbarch, NULL);
+      di.fprintf_func = null_fprintf;
+      di.print_address_func = null_print_address;
+
+      /* Record each instruction address from START_PC to ADDR.  */
+      p = start_pc;
+      for (i = 0; p < addr; ++i)
+        {
+          VEC_safe_push (CORE_ADDR, pcs, p);
+          p += gdbarch_print_insn (gdbarch, (CORE_ADDR) p, &di);
+        }
+
+      /* If we reach COUNT instructions, return the address recorded in
+         VECTOR. Otherwise, make a recursive call to disassemble
+         the previoius line.  */
+      if (i >= count)
+        {
+          ret = VEC_index (CORE_ADDR, pcs, i - count);
+          *lines_read = count;
+        }
+        else
+        {
+          int linesread_internal = 0;
+          ret = find_instruction_backward (gdbarch,
+               VEC_index (CORE_ADDR, pcs, 0), count - i,
+               &linesread_internal);
+          *lines_read = i + linesread_internal;
+
+          /* Return the smallest valid address we've got
+             if the recursive call above failed.  */
+          if (!ret)
+            ret = VEC_index (CORE_ADDR, pcs, 0);
+        }
+      VEC_free (CORE_ADDR, pcs);
+    }
+  return ret;
+}
+
+/* This is backward version of partial_memory_read in valprint.c.
+   Read LEN bytes of target memory at address MEMADDR, placing the
+   results in GDB's memory at MYADDR.  Returns a count of the bytes
+   actually read.  */
+
+static int
+read_memory_backward (struct gdbarch *gdbarch,
+          CORE_ADDR memaddr, gdb_byte *myaddr, int len)
+{
+  int errcode;
+  int nread;      /* Number of bytes actually read.  */
+
+  /* First try a complete read.  */
+  errcode = target_read_memory (memaddr, myaddr, len);
+  if (errcode == 0)
+    {
+      /* Got it all.  */
+      nread = len;
+    }
+  else
+    {
+      /* Loop, reading one byte at a time until we get as much as we can.  */
+      for (errcode = 0, nread = 0, memaddr += len, myaddr += len;
+           len > 0 && errcode == 0;
+           ++nread, --len)
+        {
+          errcode = target_read_memory (--memaddr, --myaddr, 1);
+        }
+      /* If an error, the last read was unsuccessful, so adjust count.  */
+      if (errcode != 0)
+        {
+          --nread;
+          printf_filtered (_("Cannot access memory at address "));
+          wrap_here ("  ");
+          print_address (gdbarch, memaddr, gdb_stdout);
+          printf_filtered ("\n");
+        }
+    }
+  return (nread);
+}
+
+/* This is integer version of decimal_is_zero in dfp.c.
+   Returns true if X (which is LEN bytes wide) is the number zero.  */
+
+static int
+integer_is_zero (const gdb_byte *x, int len)
+{
+  int i = 0;
+  while (i < len && x[i] == 0)
+    ++i;
+  return (i == len);
+}
+
+/* Find the start address of a string in which ADDR is included.
+   Basically we search for '\0' and return the next address,
+   but if OPTIONS->PRINT_MAX is smaller than the length of a string,
+   we stop searching and return the address to print PRINT_MAX of
+   characters from the string.  */
+
+static CORE_ADDR
+find_string_backward (struct gdbarch *gdbarch,
+          CORE_ADDR addr, int count, int char_size,
+          const struct value_print_options *options,
+          int *strings_counted)
+{
+  const int chunk_size = 0x20;
+  gdb_byte *buffer = NULL;
+  int read_error = 0;
+  int chars_read = 0;
+  int chars_to_read = chunk_size;
+  int chars_counted = 0;
+  int count_original = count;
+  CORE_ADDR string_start_addr = addr;
+
+  gdb_assert (char_size == 1 || char_size == 2 || char_size == 4);
+
+  buffer = (gdb_byte *) xmalloc (chars_to_read * char_size);
+  while (count > 0 && read_error == 0)
+    {
+      int i;
+      addr -= (chars_to_read * char_size);
+      chars_read = read_memory_backward (gdbarch,
+           addr, buffer, chars_to_read * char_size) / char_size;
+      read_error = (chars_read == chars_to_read) ? 0 : 1;
+
+      /* Searching for '\0' from the end of buffer in backward direction.  */
+      for (i = 0; i < chars_read && count > 0 ; ++i, ++chars_counted)
+        {
+          int offset = (chars_to_read - i - 1) * char_size;
+          if (integer_is_zero (buffer + offset, char_size)
+              || (chars_counted == options->print_max))
+            {
+              /* Found '\0' or reached print_max.  As OFFSET is the offset to
+                 '\0', we add CHAR_SIZE to return the start address of
+                 a string.  */
+              --count;
+              string_start_addr = addr + offset + char_size;
+              chars_counted = 0;
+            }
+        }
+    }
+  xfree(buffer);
+
+  /* Update STRINGS_COUNTED with the actual number of loaded strings.  */
+  *strings_counted = count_original - count;
+
+  if (read_error != 0)
+    {
+      /* In error case, STRING_START_ADDR is pointing to the string which
+         is last successfully loaded.  Rewind the partially loaded string.  */
+      string_start_addr -= (chars_counted * char_size);
+    }
+
+  return string_start_addr;
+}
+
 /* Examine data at address ADDR in format FMT.
    Fetch it from memory and print on gdb_stdout.  */
 
@@ -798,6 +1019,7 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
   int i;
   int maxelts;
   struct value_print_options opts;
+  CORE_ADDR addr_rewound = 0;
 
   format = fmt.format;
   size = fmt.size;
@@ -868,6 +1090,35 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
 
   get_formatted_print_options (&opts, format);
 
+  if (count < 0)
+    {
+      /* This is the negative repeat count case.
+         We rewind the address based on the given repeat count and format,
+         then examine memory from there in forward direction.  */
+
+      count = -count;
+      if (format == 'i')
+        {
+          next_address = find_instruction_backward (gdbarch,
+               addr, count, &count);
+        }
+      else if (format == 's')
+        {
+          next_address = find_string_backward (gdbarch,
+               addr, count, val_type->length, &opts, &count);
+        }
+      else
+        {
+          next_address = addr - count * val_type->length;
+        }
+
+      /* The following call to print_formatted updates next_address in every
+         iteration. In backward case, we store the start address here
+         and update next_address with it before exiting the function.  */
+      addr_rewound = (format == 's') ?
+        (next_address - val_type->length) : next_address;
+    }
+
   /* Print as many objects as specified in COUNT, at most maxelts per line,
      with the address of the next one at the start of each line.  */
 
@@ -913,6 +1164,9 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
       printf_filtered ("\n");
       gdb_flush (gdb_stdout);
     }
+
+  if (addr_rewound)
+    next_address = addr_rewound;
 }
 \f
 static void
@@ -2522,7 +2776,8 @@ Format letters are o(octal), x(hex), d(decimal), u(unsigned decimal),\n\
   and z(hex, zero padded on the left).\n\
 Size letters are b(byte), h(halfword), w(word), g(giant, 8 bytes).\n\
 The specified number of objects of the specified size are printed\n\
-according to the format.\n\n\
+according to the format.  If a negative number is specified, memory is\n\
+examined backward from the address.\n\n\
 Defaults for format and size letters are those previously used.\n\
 Default count is 1.  Default address is following last thing printed\n\
 with this command or \"print\"."));
diff --git a/gdb/testsuite/gdb.base/examine-backward.c b/gdb/testsuite/gdb.base/examine-backward.c
new file mode 100644
index 0000000..3ce77d8
--- /dev/null
+++ b/gdb/testsuite/gdb.base/examine-backward.c
@@ -0,0 +1,143 @@
+/* This testcase is part of GDB, the GNU debugger.
+
+   Copyright 2015 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+
+/*
+Define TestStrings, TestStringsH, and TestStringsW to test utf8, utf16,
+and utf32 strings respectively.
+To avoid compile error due to old compiler mode, we don't use string
+literals. The content of each array is the same as followings:
+
+  const char TestStrings[] = {
+      "ABCD"
+      "EFGHIJKLMNOPQRSTUVWXYZ\0"
+      "\0"
+      "\0"
+      "\u307B\u3052\u307B\u3052\0"
+      "012345678901234567890123456789\0"
+      "!!!!!!\0"
+  };
+*/
+
+const char TestStrings[] = {
+  0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,
+  0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50,
+  0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58,
+  0x59, 0x5a, 0x00, 0x00, 0x00, 0xe3, 0x81, 0xbb,
+  0xe3, 0x81, 0x92, 0xe3, 0x81, 0xbb, 0xe3, 0x81,
+  0x92, 0x00, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35,
+  0x36, 0x37, 0x38, 0x39, 0x30, 0x31, 0x32, 0x33,
+  0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x31,
+  0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39,
+  0x00, 0x21, 0x21, 0x21, 0x21, 0x21, 0x21, 0x00,
+  0x00
+};
+
+const short TestStringsH[] = {
+  0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047, 0x0048,
+  0x0049, 0x004a, 0x004b, 0x004c, 0x004d, 0x004e, 0x004f, 0x0050,
+  0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057, 0x0058,
+  0x0059, 0x005a, 0x0000, 0x0000, 0x0000, 0x307b, 0x3052, 0x307b,
+  0x3052, 0x0000, 0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035,
+  0x0036, 0x0037, 0x0038, 0x0039, 0x0030, 0x0031, 0x0032, 0x0033,
+  0x0034, 0x0035, 0x0036, 0x0037, 0x0038, 0x0039, 0x0030, 0x0031,
+  0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037, 0x0038, 0x0039,
+  0x0000, 0x0021, 0x0021, 0x0021, 0x0021, 0x0021, 0x0021, 0x0000,
+  0x0000
+};
+
+const int TestStringsW[] = {
+  0x00000041, 0x00000042, 0x00000043, 0x00000044,
+  0x00000045, 0x00000046, 0x00000047, 0x00000048,
+  0x00000049, 0x0000004a, 0x0000004b, 0x0000004c,
+  0x0000004d, 0x0000004e, 0x0000004f, 0x00000050,
+  0x00000051, 0x00000052, 0x00000053, 0x00000054,
+  0x00000055, 0x00000056, 0x00000057, 0x00000058,
+  0x00000059, 0x0000005a, 0x00000000, 0x00000000,
+  0x00000000, 0x0000307b, 0x00003052, 0x0000307b,
+  0x00003052, 0x00000000, 0x00000030, 0x00000031,
+  0x00000032, 0x00000033, 0x00000034, 0x00000035,
+  0x00000036, 0x00000037, 0x00000038, 0x00000039,
+  0x00000030, 0x00000031, 0x00000032, 0x00000033,
+  0x00000034, 0x00000035, 0x00000036, 0x00000037,
+  0x00000038, 0x00000039, 0x00000030, 0x00000031,
+  0x00000032, 0x00000033, 0x00000034, 0x00000035,
+  0x00000036, 0x00000037, 0x00000038, 0x00000039,
+  0x00000000, 0x00000021, 0x00000021, 0x00000021,
+  0x00000021, 0x00000021, 0x00000021, 0x00000000,
+  0x00000000
+};
+
+static __attribute__((noinline)) void
+TestFunction() {
+
+#if (defined __x86_64__)
+  asm ("mov    %rdi,-0x18(%rbp)");
+  asm ("movl   $0x0,-0x4(%rbp)");
+  asm ("label1:");
+  asm ("mov    -0x18(%rbp),%rax");
+  asm ("mov    0x10(%rax),%eax");
+  asm ("cmp    -0x4(%rbp),%eax");
+  asm ("jle    label2");
+  asm ("mov    -0x18(%rbp),%rax");
+  asm ("mov    0x8(%rax),%rax");
+  asm ("mov    -0x18(%rbp),%rdx");
+  asm ("mov    0x8(%rdx),%rdx");
+  asm ("vmovsd (%rdx),%xmm2");
+  asm ("mov    -0x4(%rbp),%edx");
+  asm ("add    $0x1,%edx");
+  asm ("vxorpd %xmm0,%xmm0,%xmm0");
+  asm ("vcvtsi2sd %edx,%xmm0,%xmm0");
+  asm ("vmovsd 0x725(%rip),%xmm1");
+  asm ("vdivsd %xmm0,%xmm1,%xmm0");
+  asm ("vaddsd %xmm0,%xmm2,%xmm0");
+  asm ("vmovsd %xmm0,(%rax)");
+  asm ("addl   $0x1,-0x4(%rbp)");
+  asm ("jmp    label1");
+  asm ("label2:");
+  asm ("nop");
+#elif (defined __i386__)
+  asm ("sub    $0x18,%esp");
+  asm ("add    $0x327b,%edx");
+  asm ("movl   $0x0,-0x4(%ebp)");
+  asm ("label1:");
+  asm ("mov    0x8(%ebp),%eax");
+  asm ("mov    0x8(%eax),%eax");
+  asm ("cmp    -0x4(%ebp),%eax");
+  asm ("jle    label2");
+  asm ("mov    0x8(%ebp),%eax");
+  asm ("mov    0x4(%eax),%eax");
+  asm ("mov    0x8(%ebp),%ecx");
+  asm ("mov    0x4(%ecx),%ecx");
+  asm ("fldl   (%ecx)");
+  asm ("mov    -0x4(%ebp),%ecx");
+  asm ("add    $0x1,%ecx");
+  asm ("mov    %ecx,-0x14(%ebp)");
+  asm ("fildl  -0x14(%ebp)");
+  asm ("fld1   ");
+  asm ("fdivp  %st,%st(1)");
+  asm ("faddp  %st,%st(1)");
+  asm ("fstpl  (%eax)");
+  asm ("addl   $0x1,-0x4(%ebp)");
+  asm ("jmp    label1");
+  asm ("label2:");
+  asm ("nop");
+#endif
+};
+
+int main () {
+    return 42;
+}
diff --git a/gdb/testsuite/gdb.base/examine-backward.exp b/gdb/testsuite/gdb.base/examine-backward.exp
new file mode 100644
index 0000000..a3ee008
--- /dev/null
+++ b/gdb/testsuite/gdb.base/examine-backward.exp
@@ -0,0 +1,219 @@
+# Copyright 2015 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+standard_testfile
+if { [prepare_for_testing "failed to prepare for examine-backward" \
+        ${testfile} ${srcfile}] } {
+    return -1
+}
+
+if ![runto_main] {
+    untested "could not run to main"
+    return -1
+}
+
+proc get_first_mapped_address {} {
+    global gdb_prompt
+    set addr "0"
+    gdb_test_multiple "info proc mappings" "info proc mappings" {
+    -re "objfile\[\r\n\t \]+(0x\[0-9a-fA-F\]+).*\[\r\n\]*$gdb_prompt $" {
+        set addr $expect_out(1,string)
+    }
+    timeout {
+        fail "Fail to get process address spaces (timeout)."
+    }
+    }
+    return ${addr}
+}
+
+# invalid format (# of tests = 5)
+
+gdb_test "x/- 10xb main" "Invalid number \"10xb\"\."
+gdb_test "x/--10xb main" "Invalid number \"10xb\"\."
+gdb_test "x/-a10xb main" "Invalid number \"10xb\"\."
+gdb_test_no_output "x/-0i main"
+gdb_test_no_output "x/-0sh main"
+
+# memory page boundary test (# of tests = 5)
+
+gdb_test_no_output "set print elements 0"
+set boundary [get_first_mapped_address]
+gdb_test "x/3s ${boundary}"
+gdb_test_sequence "x/-4s" "memory page boundary test" {
+    "Cannot access memory at address 0x"
+    "0x"
+    "0x"
+    "0x"
+}
+gdb_test "x/3s ${boundary}"
+gdb_test_sequence "x/-3s" "memory page boundary test" {
+    "Cannot access memory at address 0x"
+    "0x"
+    "0x"
+    "0x"
+}
+
+# char-width=1, print-max=20 (# of tests = 12)
+
+gdb_test_no_output "set print elements 20"
+gdb_test "x/6s &TestStrings"
+gdb_test "x/-1xb" "0x39"
+gdb_test_sequence "x/-6s" "examine multiple strings backward" {
+    "\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
+    "\"UVWXYZ\""
+    "\"\""
+    "\"\""
+    "\"[^\"]+\""
+    "\"01234567890123456789\"\.\.\."
+}
+gdb_test "x/6s &TestStrings"
+gdb_test "x/-xb" "0x39"
+gdb_test "x/-s" "\"01234567890123456789\"\.\.\."
+gdb_test "x/-s" "\".+\""
+gdb_test "x/-s" "\"\""
+gdb_test "x/-s" "\"\""
+gdb_test "x/-s" "\"GHIJKLMNOPQRSTUVWXYZ\""
+gdb_test "x/-s" "\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
+
+# char-width=2, print-max=20 (# of tests = 12)
+
+gdb_test_no_output "set print elements 20"
+gdb_test "x/6sh &TestStringsH"
+gdb_test "x/-1xh" "0x0039"
+gdb_test_sequence "x/-6sh" "examine multiple strings backward" {
+    "u\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
+    "u\"UVWXYZ\""
+    "u\"\""
+    "u\"\""
+    "u\"[^\"]+\""
+    "u\"01234567890123456789\"\.\.\."
+}
+gdb_test "x/6sh &TestStringsH"
+gdb_test "x/-xh" "0x0039"
+gdb_test "x/-sh" "u\"01234567890123456789\"\.\.\."
+gdb_test "x/-sh" "u\".+\""
+gdb_test "x/-sh" "u\"\""
+gdb_test "x/-sh" "u\"\""
+gdb_test "x/-sh" "u\"GHIJKLMNOPQRSTUVWXYZ\""
+gdb_test "x/-sh" "u\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
+
+# char-width=4, print-max=20 (# of tests = 12)
+
+gdb_test_no_output "set print elements 20"
+gdb_test "x/6sw &TestStringsW"
+gdb_test "x/-1xw" "0x00000039"
+gdb_test_sequence "x/-6sw" "examine multiple strings backward" {
+    "U\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
+    "U\"UVWXYZ\""
+    "U\"\""
+    "U\"\""
+    "U\"[^\"]+\""
+    "U\"01234567890123456789\"\.\.\."
+}
+gdb_test "x/6sw &TestStringsW"
+gdb_test "x/-xw" "0x00000039"
+gdb_test "x/-sw" "U\"01234567890123456789\"\.\.\."
+gdb_test "x/-sw" "U\".+\""
+gdb_test "x/-sw" "U\"\""
+gdb_test "x/-sw" "U\"\""
+gdb_test "x/-sw" "U\"GHIJKLMNOPQRSTUVWXYZ\""
+gdb_test "x/-sw" "U\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
+
+# char-width=2, print-max=0 (# of tests = 12)
+
+gdb_test_no_output "set print elements 0"
+gdb_test "x/6sh &TestStringsH"
+gdb_test "x/-4xh" "0x0021\[\t \]+0x0021\[\t \]+0x0021\[\t \]+0x0000"
+gdb_test_sequence "x/-6sh" "examine multiple strings backward" {
+    "u\"ABCDEFGHIJKLMNOPQRSTUVWXYZ\""
+    "u\"\""
+    "u\"\""
+    "u\"[^\"]+\""
+    "u\"012345678901234567890123456789\""
+    "u\"!!!!!!\""
+}
+gdb_test "x/6sh &TestStringsH"
+gdb_test "x/-xh"
+gdb_test "x/-sh" "u\"!!!!!!\""
+gdb_test "x/-sh" "u\"012345678901234567890123456789\""
+gdb_test "x/-sh" "u\".+\""
+gdb_test "x/-sh" "u\"\""
+gdb_test "x/-sh" "u\"\""
+gdb_test "x/-sh" "u\"ABCDEFGHIJKLMNOPQRSTUVWXYZ\""
+
+# char-width=1, print-max=4 (# of tests = 5)
+
+gdb_test_no_output "set print elements 4"
+gdb_test "x/9s &TestStrings"
+gdb_test "x/-xb" "0x00"
+gdb_test_sequence "x/-4s" "examine multiple strings backward" {
+    "\"TUVW\"\.\.\."
+    "\"XYZ\""
+    "\"\""
+    "\"\""
+}
+gdb_test_sequence "x/-4s" "examine multiple strings backward" {
+    "\"CDEF\"\.\.\."
+    "\"GHIJ\"\.\.\."
+    "\"KLMN\"\.\.\."
+    "\"OPQR\"\.\.\."
+}
+
+# Disassemle backward test (# of tests = 10)
+
+gdb_test_no_output "set print elements 200"
+if { [istarget x86_64-*-* ] } {
+    gdb_test "x/20i TestFunction"
+    gdb_test "x/-1i"
+    gdb_test "x/-19i"
+    gdb_test "x/i" "push\[\t \]+%rbp"
+    gdb_test "x/17i TestFunction"
+    gdb_test "x/-2xb"
+    gdb_test_sequence "x/-6i" "examine multiple instructions backward" {
+        "mov\[\t \]+0x8\\(%rdx\\),%rdx\[\t \]*"
+        "vmovsd\[\t \]+\\(%rdx\\),%xmm2\[\t \]*"
+        "mov\[\t \]+-0x4\\(%rbp\\),%edx\[\t \]*"
+        "add\[\t \]+\\$0x1,%edx\[\t \]*"
+        "vxorpd\[\t \]+%xmm0,%xmm0,%xmm0\[\t \]*"
+        "vcvtsi2sd\[\t \]+%edx,%xmm0,%xmm0\[\t \]*"
+    }
+    gdb_test "x/2i TestFunction"
+    gdb_test_sequence "x/-3i" "examine multiple instructions backward" {
+        "No line number information available for address"
+        "push\[\t \]+%rbp"
+        "mov\[\t \]+%rsp\,%rbp"
+    }
+} elseif { [istarget i\[34567\]86-*-*] } {
+    gdb_test "x/20i TestFunction"
+    gdb_test "x/-1i"
+    gdb_test "x/-19i"
+    gdb_test "x/i" "push\[\t \]+%ebp"
+    gdb_test "x/18i TestFunction"
+    gdb_test "x/-2xb"
+    gdb_test_sequence "x/-6i" "examine multiple instructions backward" {
+        "mov\[\t \]+0x4\\(%ecx\\),%ecx\[\t \]*"
+        "fldl\[\t \]+\\(%ecx\\)\[\t \]*"
+        "mov\[\t \]+-0x4\\(%ebp\\),%ecx\[\t \]*"
+        "add\[\t \]+\\$0x1,%ecx\[\t \]*"
+        "mov\[\t \]+%ecx,-0x14\\(%ebp\\)\[\t \]*"
+        "fildl\[\t \]+-0x14\\(%ebp\\)\[\t \]*"
+    }
+    gdb_test "x/2i TestFunction"
+    gdb_test_sequence "x/-3i" "examine multiple instructions backward" {
+        "No line number information available for address"
+        "push\[\t \]+%ebp"
+        "mov\[\t \]+%esp\,%ebp"
+    }
+}
-- 
2.5.0

Re: [PATCH] Negative repeat count for 'x' command

[Pedro Alves]

On 02/07/2016 11:18 PM, Toshihito Kikuchi wrote:
> Thank you for the feedbacks.  I updated the patch adding negative repeat count
> support to the 'x' command instead of a new format letter.  Also, this patch
> includes the update of document and NEWS file.

Thank you very much!  Sounds quite promising, though I haven't done an in dept
review yet.  I was going to, but noticed that I couldn't seem to find an
FSF copyright in the records.  Do you have one that I'm missing?
Feel free to contact me off list to get that process started.

Thanks,
Pedro Alves

Re: [PATCH] Negative repeat count for 'x' command

[Toshihito Kikuchi]

Hello,

Let me bring up this thread as I've finished the copyright process with FSF.

@Pedro, I pinged you in another thread two weeks ago. Please let me know if
there are any other action items on my side to go forward.

Thanks,
Toshihito

On 2016-02-17 03:38 AM, Pedro Alves wrote:
> On 02/07/2016 11:18 PM, Toshihito Kikuchi wrote:
>> Thank you for the feedbacks.  I updated the patch adding negative repeat count
>> support to the 'x' command instead of a new format letter.  Also, this patch
>> includes the update of document and NEWS file.
> 
> Thank you very much!  Sounds quite promising, though I haven't done an in dept
> review yet.  I was going to, but noticed that I couldn't seem to find an
> FSF copyright in the records.  Do you have one that I'm missing?
> Feel free to contact me off list to get that process started.
> 
> Thanks,
> Pedro Alves
> 

Re: [PATCH] Negative repeat count for 'x' command

[Pedro Alves]

Hi Toshihito,

Many thanks again for following through with this, and my
apologies for taking so long to get to it.  I'm impressed on
how you made the patch cover alls kinds of formats, including
strings, and on the extend of test coverage you added.  Kudos.

See review comments below.

On 02/07/2016 11:18 PM, Toshihito Kikuchi wrote:
> Thank you for the feedbacks.  I updated the patch adding negative repeat count
> support to the 'x' command instead of a new format letter.  Also, this patch
> includes the update of document and NEWS file.
>
> With this, we can specify a negative repeat count for all the formats in the 'x'
> command to examine memory backward.
>
> Here's the example output:
> (gdb) bt
> #0  Func1 (n=42, p=0x40432e "hogehoge") at main.cpp:5
> #1  0x00000000004041fa in main (argc=1, argv=0x7fffffffdff8) at main.cpp:19
> (gdb) x/-4i 0x4041fa
>     0x4041e5 <main(int, char**)+11>:	mov    %rsi,-0x10(%rbp)
>     0x4041e9 <main(int, char**)+15>:	lea    0x13e(%rip),%rsi        # 0x40432e
>     0x4041f0 <main(int, char**)+22>:	mov    $0x2a,%edi
>     0x4041f5 <main(int, char**)+27>:	callq  0x404147 <Func1(int, char const*)>
> (gdb) x/-4xw 0x404200
> 0x4041f0 <main(int, char**)+22>:	0x00002abf	0xff4de800	0x76e8ffff	0xb8ffffff
> (gdb) x/-4
> 0x4041e0 <main(int, char**)+6>:	0x7d8910ec	0x758948fc	0x358d48f0	0x0000013e
>
> Tested on i386-linux and amd64-linux. I wrote a new testcase 'examine-backward'
> under gdb.base.  It mainly focuses on x/-#s and x/-#i.

Can we have something for e.g., x/x as well?  That one at least
could be tested on all archs.

> For disassembler
> testing, the new testcase covers only i386 and amd64, which are skipped onother
> platforms.
>
> gdb/ChangeLog:
>
> 	* NEWS: Mention that GDB now supports a negative repeat count in
> 	the 'x' command.
> 	* printcmd.c (decode_format): Allow '-' in the parameter
> 	"string_ptr" to accept a negative repeat count.
> 	(null_fprintf): New function.
> 	(null_print_address): New function.
> 	(find_instruction_backward): New function.
> 	(read_memory_backward): New function.
> 	(integer_is_zero): New function.
> 	(find_string_backward): New function.
> 	(do_examine): Use new functions to examine memory backward.
>
> gdb/doc/ChangeLog:
>
> 	* gdb.texinfo (Examining Memory): Document negative repeat
> 	count in the 'x' command.
>
> gdb/testsuite/ChangeLog:
>
> 	* gdb.base/examine-backward.c: New file.
> 	* gdb.base/examine-backward.exp: New file.
>
>
> 0001-Add-negative-repeat-count-to-x-command.patch
>
>
>  From aa4363c9cf6ad3c6ebcef3b7ea1c72e4180e89f2 Mon Sep 17 00:00:00 2001
> From: tokikuch<k.toshihito@yahoo.de>
> Date: Sun, 7 Feb 2016 13:24:53 -0800
> Subject: [PATCH] Add negative repeat count to 'x' command
>
> ---

Please maintain the patch description in the git log, as that's
what we'll end up pushing to the repo.


>   gdb/NEWS                                    |  14 ++
>   gdb/doc/gdb.texinfo                         |  14 +-
>   gdb/printcmd.c                              | 259 +++++++++++++++++++++++++++-
>   gdb/testsuite/gdb.base/examine-backward.c   | 143 +++++++++++++++
>   gdb/testsuite/gdb.base/examine-backward.exp | 219 +++++++++++++++++++++++
>   5 files changed, 646 insertions(+), 3 deletions(-)
>   create mode 100644 gdb/testsuite/gdb.base/examine-backward.c
>   create mode 100644 gdb/testsuite/gdb.base/examine-backward.exp
>
> diff --git a/gdb/NEWS b/gdb/NEWS
> index 962eae4..072c11a 100644
> --- a/gdb/NEWS
> +++ b/gdb/NEWS
> @@ -3,6 +3,20 @@
>
>   *** Changes since GDB 7.10
>
> +* GDB now supports a negative repeat count in the 'x' command to examine
> +  memory backward from the given address.  For example:

Please move this to the "since 7.11" section.

>
> +If a negative repeat count is specified for the formats @samp{s} or @samp{i},
> +the absolute value of the given number of null-terminated strings or
> +instructions before the address are displayed.  For the @samp{i} format,
> +we use line number information in the debug info to resolve a correct frame
> +while dissasembling backward. 

What does "a correct frame" mean?

> If line info is not available, the command
> +stops examining memory with the error message.

"with the error message" -> "with an error message".

> +
>   All the defaults for the arguments to @code{x} are designed to make it
>   easy to continue scanning memory with minimal specifications each time
>   you use @code{x}.  For example, after you have inspected three machine
> diff --git a/gdb/printcmd.c b/gdb/printcmd.c
> index f5c4211..e0ffcc0 100644
> --- a/gdb/printcmd.c
> +++ b/gdb/printcmd.c
> @@ -47,6 +47,7 @@
>   #include "cli/cli-utils.h"
>   #include "format.h"
>   #include "source.h"
> +#include "linespec.h"
>
>   #ifdef TUI
>   #include "tui/tui.h"		/* For tui_active et al.   */
> @@ -186,8 +187,13 @@ decode_format (const char **string_ptr, int oformat, int osize)
>     val.count = 1;
>     val.raw = 0;
>
> +  if (*p == '-')
> +    {
> +      val.count = -1;
> +      p++;
> +    }
>     if (*p >= '0' && *p <= '9')
> -    val.count = atoi (p);
> +    val.count *= atoi (p);
>     while (*p >= '0' && *p <= '9')
>       p++;
>
> @@ -785,6 +791,221 @@ print_address_demangle (const struct value_print_options *opts,
>   }
>
>
> +/* These empty functions are used in find_instruction_backward to
> +   suppress standard output during the call to gdbarch_print_insn.  */
> +
> +static int
> +null_fprintf (void *stream, const char *format ATTRIBUTE_UNUSED, ...)
> +{
> +  return 0;
> +}
> +
> +static void
> +null_print_address (bfd_vma addr, struct disassemble_info *info)
> +{
> +  return;

Unnecessary return.  But see below.

> +}
> +
> +/* Rewind assembly from ADDR and return the start address after the given
> +   number of lines are disassembled. To avoid disassembling in a wrong frame,
> +   we get addresses in a correct frame using line information.

References to "wrong frame" here again.  What does this mean?  Also,
double-space after periods.

> +   If we go out of the symbol range during disassembling, we return
> +   the smallest address we've got so far and set the number of lines read
> +   to lines_read.  */

s/smallest/lowest.

> +
> +static CORE_ADDR
> +find_instruction_backward (struct gdbarch *gdbarch, CORE_ADDR addr,
> +          int count, int *lines_read)

"int count" should line up below "struct gdbarch".

> +{
> +  char addrstr[64];
> +  struct symtabs_and_lines sals;
> +  CORE_ADDR start_pc, end_pc, ret;
> +
> +  start_pc = end_pc = 0;
> +  ret = addr;
> +  *lines_read = 0;
> +
> +  /* Get the start address of a line which includes the address (addr - 1).  */
> +  sprintf (addrstr, "*%p", (void *) (addr - 1));

Use paddress for target addresses.  %p is for host addresses (and we don't
use it, as it requires C99).

> +  sals = decode_line_with_last_displayed (addrstr, DECODE_LINE_FUNFIRSTLINE);

But in any case, why do we want to use ..._with_last_displayed here?
We have an address already, so shouldn't we use find_pc_sect_line or 
some such?

> +  if (sals.nelts >= 1)
> +    {
> +      if ((!sals.sals[0].line)
> +          || (!find_line_pc_range (sals.sals[0], &start_pc, &end_pc)))

Remove unnecessary parentheses. No implicit boolean conversion:

  if (sals.sals[0].line == 0
      || !find_line_pc_range (sals.sals[0], &start_pc, &end_pc))



> +        {
> +          printf_filtered (_("No line number information available "
> +            "for address "));

Align the "for" under "No".

> +          wrap_here ("  ");
> +          print_address (gdbarch, addr - 1, gdb_stdout);
> +          printf_filtered ("\n");
> +          start_pc = end_pc = 0;
> +        }
> +      xfree (sals.sals);

Should be released with a cleanup instead.

> +    }
> +
> +  if (start_pc)


  if (start_pc != 0)


> +    {
> +      VEC (CORE_ADDR) *pcs = NULL;
> +      struct disassemble_info di;
> +      CORE_ADDR p;
> +      int i;
> +
> +      VEC_reserve (CORE_ADDR, pcs, count);

Use a VEC_cleanup cleanup to release this.  But what's the
idea behind the VEC?  Should have a leading comment.
Looks like it can grow big if you try to disassemble a large
region.  Do we really need it?

> +
> +      di = gdb_disassemble_info (gdbarch, NULL);
> +      di.fprintf_func = null_fprintf;
> +      di.print_address_func = null_print_address;

Seems like you could just use gdb_insn_length instead.

> +
> +      /* Record each instruction address from START_PC to ADDR.  */
> +      p = start_pc;
> +      for (i = 0; p < addr; ++i)
> +        {
> +          VEC_safe_push (CORE_ADDR, pcs, p);
> +          p += gdbarch_print_insn (gdbarch, (CORE_ADDR) p, &di);
> +        }

Seems like you don't need 'i' -- use VEC_length instead ?

> +
> +      /* If we reach COUNT instructions, return the address recorded in
> +         VECTOR. Otherwise, make a recursive call to disassemble
> +         the previoius line.  */

Typo "previoius".  Double-space after periods.  This recursion sounds
nasty -- sounds like if you request a high number of addresses, crossing
many lines, we'll hit stack limits.  Can we do without recursion?


> +      if (i >= count)
> +        {
> +          ret = VEC_index (CORE_ADDR, pcs, i - count);
> +          *lines_read = count;
> +        }
> +        else
> +        {
> +          int linesread_internal = 0;
> +          ret = find_instruction_backward (gdbarch,
> +               VEC_index (CORE_ADDR, pcs, 0), count - i,
> +               &linesread_internal);

Alignment.

> +          *lines_read = i + linesread_internal;
> +
> +          /* Return the smallest valid address we've got

"lowest".

> +             if the recursive call above failed.  */
> +          if (!ret)
> +            ret = VEC_index (CORE_ADDR, pcs, 0);
> +        }
> +      VEC_free (CORE_ADDR, pcs);

Replace with cleanup.

> +    }
> +  return ret;
> +}
> +
> +/* This is backward version of partial_memory_read in valprint.c.
> +   Read LEN bytes of target memory at address MEMADDR, placing the
> +   results in GDB's memory at MYADDR.  Returns a count of the bytes
> +   actually read.  */
> +
> +static int
> +read_memory_backward (struct gdbarch *gdbarch,
> +          CORE_ADDR memaddr, gdb_byte *myaddr, int len)

Alignment.

> +{
> +  int errcode;
> +  int nread;      /* Number of bytes actually read.  */
> +
> +  /* First try a complete read.  */
> +  errcode = target_read_memory (memaddr, myaddr, len);
> +  if (errcode == 0)
> +    {
> +      /* Got it all.  */
> +      nread = len;
> +    }
> +  else
> +    {
> +      /* Loop, reading one byte at a time until we get as much as we can.  */
> +      for (errcode = 0, nread = 0, memaddr += len, myaddr += len;
> +           len > 0 && errcode == 0;
> +           ++nread, --len)
> +        {
> +          errcode = target_read_memory (--memaddr, --myaddr, 1);
> +        }
> +      /* If an error, the last read was unsuccessful, so adjust count.  */
> +      if (errcode != 0)
> +        {
> +          --nread;
> +          printf_filtered (_("Cannot access memory at address "));
> +          wrap_here ("  ");
> +          print_address (gdbarch, memaddr, gdb_stdout);
> +          printf_filtered ("\n");

Do we need that wrap_here ?  You could make this a single printf_filtered
with %s and paddress instead of print_address instead.

> +        }
> +    }
> +  return (nread);

Unnecessary parens.

> +}
> +
> +/* This is integer version of decimal_is_zero in dfp.c.
> +   Returns true if X (which is LEN bytes wide) is the number zero.  */
> +
> +static int
> +integer_is_zero (const gdb_byte *x, int len)
> +{
> +  int i = 0;

Empty line after decl.

> +  while (i < len && x[i] == 0)
> +    ++i;
> +  return (i == len);
> +}
> +
> +/* Find the start address of a string in which ADDR is included.
> +   Basically we search for '\0' and return the next address,
> +   but if OPTIONS->PRINT_MAX is smaller than the length of a string,
> +   we stop searching and return the address to print PRINT_MAX of
> +   characters from the string.  */
> +
> +static CORE_ADDR
> +find_string_backward (struct gdbarch *gdbarch,
> +          CORE_ADDR addr, int count, int char_size,
> +          const struct value_print_options *options,
> +          int *strings_counted)

Alignment.

> +{
> +  const int chunk_size = 0x20;
> +  gdb_byte *buffer = NULL;
> +  int read_error = 0;
> +  int chars_read = 0;
> +  int chars_to_read = chunk_size;
> +  int chars_counted = 0;
> +  int count_original = count;
> +  CORE_ADDR string_start_addr = addr;
> +
> +  gdb_assert (char_size == 1 || char_size == 2 || char_size == 4);
> +
> +  buffer = (gdb_byte *) xmalloc (chars_to_read * char_size);
> +  while (count > 0 && read_error == 0)
> +    {
> +      int i;

Empty line.

> +      addr -= (chars_to_read * char_size);

Unnecessary parens.

> +      chars_read = read_memory_backward (gdbarch,
> +           addr, buffer, chars_to_read * char_size) / char_size;

Alignment.

> +      read_error = (chars_read == chars_to_read) ? 0 : 1;
> +
> +      /* Searching for '\0' from the end of buffer in backward direction.  */
> +      for (i = 0; i < chars_read && count > 0 ; ++i, ++chars_counted)
> +        {
> +          int offset = (chars_to_read - i - 1) * char_size;

Empty line.

> +          if (integer_is_zero (buffer + offset, char_size)
> +              || (chars_counted == options->print_max))

Parens.

> +            {
> +              /* Found '\0' or reached print_max.  As OFFSET is the offset to
> +                 '\0', we add CHAR_SIZE to return the start address of
> +                 a string.  */
> +              --count;
> +              string_start_addr = addr + offset + char_size;
> +              chars_counted = 0;
> +            }
> +        }
> +    }
> +  xfree(buffer);

Free with a cleanup instead.

> +
> +  /* Update STRINGS_COUNTED with the actual number of loaded strings.  */
> +  *strings_counted = count_original - count;
> +
> +  if (read_error != 0)
> +    {
> +      /* In error case, STRING_START_ADDR is pointing to the string which
> +         is last successfully loaded.  Rewind the partially loaded string.  */
> +      string_start_addr -= (chars_counted * char_size);

Parens.

> +    }
> +
> +  return string_start_addr;
> +}
> +
>   /* Examine data at address ADDR in format FMT.
>      Fetch it from memory and print on gdb_stdout.  */
>
> @@ -798,6 +1019,7 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
>     int i;
>     int maxelts;
>     struct value_print_options opts;
> +  CORE_ADDR addr_rewound = 0;
>
>     format = fmt.format;
>     size = fmt.size;
> @@ -868,6 +1090,35 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
>
>     get_formatted_print_options (&opts, format);
>
> +  if (count < 0)
> +    {
> +      /* This is the negative repeat count case.
> +         We rewind the address based on the given repeat count and format,
> +         then examine memory from there in forward direction.  */
> +
> +      count = -count;
> +      if (format == 'i')
> +        {
> +          next_address = find_instruction_backward (gdbarch,
> +               addr, count, &count);

Alignment.

> +        }
> +      else if (format == 's')
> +        {
> +          next_address = find_string_backward (gdbarch,
> +               addr, count, val_type->length, &opts, &count);

Alignment.

> +        }
> +      else
> +        {
> +          next_address = addr - count * val_type->length;
> +        }
> +
> +      /* The following call to print_formatted updates next_address in every
> +         iteration. In backward case, we store the start address here
> +         and update next_address with it before exiting the function.  */
> +      addr_rewound = (format == 's') ?
> +        (next_address - val_type->length) : next_address;

Alignment -- remove unnecessary precedence-related parens, but wrap the
whole rhs expression in an extra set of parens for alignment:

      addr_rewound = (format == 's'
		      ? next_address - val_type->length
		      : next_address);

> +    }
> +
>     /* Print as many objects as specified in COUNT, at most maxelts per line,
>        with the address of the next one at the start of each line.  */
>
> @@ -913,6 +1164,9 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
>         printf_filtered ("\n");
>         gdb_flush (gdb_stdout);
>       }
> +
> +  if (addr_rewound)

addr_rewound != 0

But actually, please make sure that "address == 0" is treated as a
valid address (not just here, but in the whole patch), as it is valid
on non-MMU machines.  That may suggest using a separate boolean variable
to represent "have address".

> +    next_address = addr_rewound;
>   }
>
>   static void
> @@ -2522,7 +2776,8 @@ Format letters are o(octal), x(hex), d(decimal), u(unsigned decimal),\n\
>     and z(hex, zero padded on the left).\n\
>   Size letters are b(byte), h(halfword), w(word), g(giant, 8 bytes).\n\
>   The specified number of objects of the specified size are printed\n\
> -according to the format.\n\n\
> +according to the format.  If a negative number is specified, memory is\n\
> +examined backward from the address.\n\n\
>   Defaults for format and size letters are those previously used.\n\
>   Default count is 1.  Default address is following last thing printed\n\
>   with this command or \"print\"."));
> diff --git a/gdb/testsuite/gdb.base/examine-backward.c b/gdb/testsuite/gdb.base/examine-backward.c
> new file mode 100644
> index 0000000..3ce77d8
> --- /dev/null
> +++ b/gdb/testsuite/gdb.base/examine-backward.c
> @@ -0,0 +1,143 @@
> +/* This testcase is part of GDB, the GNU debugger.
> +
> +   Copyright 2015 Free Software Foundation, Inc.

2015-2016

> +
> +   This program is free software; you can redistribute it and/or modify
> +   it under the terms of the GNU General Public License as published by
> +   the Free Software Foundation; either version 3 of the License, or
> +   (at your option) any later version.
> +
> +   This program is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +   GNU General Public License for more details.
> +
> +   You should have received a copy of the GNU General Public License
> +   along with this program.  If not, see<http://www.gnu.org/licenses/>.  */
> +
> +/*
> +Define TestStrings, TestStringsH, and TestStringsW to test utf8, utf16,
> +and utf32 strings respectively.
> +To avoid compile error due to old compiler mode, we don't use string
> +literals. The content of each array is the same as followings:

Double-space after periods.

> +
> +  const char TestStrings[] = {
> +      "ABCD"
> +      "EFGHIJKLMNOPQRSTUVWXYZ\0"
> +      "\0"
> +      "\0"
> +      "\u307B\u3052\u307B\u3052\0"
> +      "012345678901234567890123456789\0"
> +      "!!!!!!\0"
> +  };
> +*/
> +
> +const char TestStrings[] = {
> +  0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,

I wonder whether 'A', 'B', etc. would work?

> +
> +static __attribute__((noinline)) void
> +TestFunction() {

static __attribute__((noinline)) void 
TestFunction (void)
{

> +
> +#if (defined __x86_64__)
> +  asm ("mov    %rdi,-0x18(%rbp)");
> +  asm ("movl   $0x0,-0x4(%rbp)");
> +  asm ("label1:");
> +  asm ("mov    -0x18(%rbp),%rax");
> +  asm ("mov    0x10(%rax),%eax");
> +  asm ("cmp    -0x4(%rbp),%eax");
> +  asm ("jle    label2");
> +  asm ("mov    -0x18(%rbp),%rax");
> +  asm ("mov    0x8(%rax),%rax");
> +  asm ("mov    -0x18(%rbp),%rdx");
> +  asm ("mov    0x8(%rdx),%rdx");
> +  asm ("vmovsd (%rdx),%xmm2");
> +  asm ("mov    -0x4(%rbp),%edx");
> +  asm ("add    $0x1,%edx");
> +  asm ("vxorpd %xmm0,%xmm0,%xmm0");
> +  asm ("vcvtsi2sd %edx,%xmm0,%xmm0");
> +  asm ("vmovsd 0x725(%rip),%xmm1");
> +  asm ("vdivsd %xmm0,%xmm1,%xmm0");
> +  asm ("vaddsd %xmm0,%xmm2,%xmm0");
> +  asm ("vmovsd %xmm0,(%rax)");
> +  asm ("addl   $0x1,-0x4(%rbp)");
> +  asm ("jmp    label1");
> +  asm ("label2:");
> +  asm ("nop");
> +#elif (defined __i386__)
> +  asm ("sub    $0x18,%esp");
> +  asm ("add    $0x327b,%edx");
> +  asm ("movl   $0x0,-0x4(%ebp)");
> +  asm ("label1:");
> +  asm ("mov    0x8(%ebp),%eax");
> +  asm ("mov    0x8(%eax),%eax");
> +  asm ("cmp    -0x4(%ebp),%eax");
> +  asm ("jle    label2");
> +  asm ("mov    0x8(%ebp),%eax");
> +  asm ("mov    0x4(%eax),%eax");
> +  asm ("mov    0x8(%ebp),%ecx");
> +  asm ("mov    0x4(%ecx),%ecx");
> +  asm ("fldl   (%ecx)");
> +  asm ("mov    -0x4(%ebp),%ecx");
> +  asm ("add    $0x1,%ecx");
> +  asm ("mov    %ecx,-0x14(%ebp)");
> +  asm ("fildl  -0x14(%ebp)");
> +  asm ("fld1   ");
> +  asm ("fdivp  %st,%st(1)");
> +  asm ("faddp  %st,%st(1)");
> +  asm ("fstpl  (%eax)");
> +  asm ("addl   $0x1,-0x4(%ebp)");
> +  asm ("jmp    label1");
> +  asm ("label2:");
> +  asm ("nop");
> +#endif
> +};
> +
> +int main () {
> +    return 42;
> +}
> diff --git a/gdb/testsuite/gdb.base/examine-backward.exp b/gdb/testsuite/gdb.base/examine-backward.exp
> new file mode 100644
> index 0000000..a3ee008
> --- /dev/null
> +++ b/gdb/testsuite/gdb.base/examine-backward.exp
> @@ -0,0 +1,219 @@
> +# Copyright 2015 Free Software Foundation, Inc.

2015-2016

> +
> +# This program is free software; you can redistribute it and/or modify
> +# it under the terms of the GNU General Public License as published by
> +# the Free Software Foundation; either version 3 of the License, or
> +# (at your option) any later version.
> +#
> +# This program is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +# GNU General Public License for more details.
> +#
> +# You should have received a copy of the GNU General Public License
> +# along with this program.  If not, see<http://www.gnu.org/licenses/>.

Missing space in "see<http" ?

> +
> +standard_testfile
> +if { [prepare_for_testing "failed to prepare for examine-backward" \
> +        ${testfile} ${srcfile}] } {
> +    return -1
> +}
> +
> +if ![runto_main] {
> +    untested "could not run to main"
> +    return -1
> +}
> +
> +proc get_first_mapped_address {} {

Needs intro comment.  Use of "info proc mappings" limits the
test to some ports only.  Why do we need this?  Etc.

> +    global gdb_prompt

Empty line after.

> +    set addr "0"
> +    gdb_test_multiple "info proc mappings" "info proc mappings" {
> +    -re "objfile\[\r\n\t \]+(0x\[0-9a-fA-F\]+).*\[\r\n\]*$gdb_prompt $" {
> +        set addr $expect_out(1,string)
> +    }
> +    timeout {
> +        fail "Fail to get process address spaces (timeout)."
> +    }

gdb_test_multiple already issues a FAIL on timeout, internally.

> +    }
> +    return ${addr}
> +}
> +
> +# invalid format (# of tests = 5)
> +
> +gdb_test "x/- 10xb main" "Invalid number \"10xb\"\."
> +gdb_test "x/--10xb main" "Invalid number \"10xb\"\."
> +gdb_test "x/-a10xb main" "Invalid number \"10xb\"\."
> +gdb_test_no_output "x/-0i main"
> +gdb_test_no_output "x/-0sh main"
> +
> +# memory page boundary test (# of tests = 5)
> +
> +gdb_test_no_output "set print elements 0"
> +set boundary [get_first_mapped_address]

> +gdb_test "x/3s ${boundary}"

This always passes; it is on purpose?  I see many of those
in the file.  Also, this one puts a program address in a gdb.sum
test message, but program addresses are not stable, so this
call should get an explicit test message.

> +gdb_test_sequence "x/-4s" "memory page boundary test" {
> +    "Cannot access memory at address 0x"
> +    "0x"
> +    "0x"
> +    "0x"
> +}

Please also consider:

- Ports that don't support "info proc mappings", and thus
${boundary} is 0.  May need to skip parts of the test on those.

- Non-MMU ports that can actually access any address, including 0.
You can use is_address_zero_readable to detect these.

Speaking of address 0, it'd be nice to test that these
scenarios behave as intended:

 - examining backwards from address 0.
 - examining M bytes from address N, where M > N.

The idea being to catch potential wraparound bugs in gdb
resulting in huge memory allocations.

> +gdb_test "x/3s ${boundary}"

Ditto re. always passing and address in gdb.sum.

> +gdb_test_sequence "x/-3s" "memory page boundary test" {
> +    "Cannot access memory at address 0x"
> +    "0x"
> +    "0x"
> +    "0x"
> +}
> +
> +# char-width=1, print-max=20 (# of tests = 12)

Please drop the "# of tests" bits.  They'll tend to end up
stale as the testcase evolves in the future.

> +
> +gdb_test_no_output "set print elements 20"
> +gdb_test "x/6s &TestStrings"
> +gdb_test "x/-1xb" "0x39"
> +gdb_test_sequence "x/-6s" "examine multiple strings backward" {
> +    "\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
> +    "\"UVWXYZ\""
> +    "\"\""
> +    "\"\""
> +    "\"[^\"]+\""
> +    "\"01234567890123456789\"\.\.\."
> +}
> +gdb_test "x/6s &TestStrings"
> +gdb_test "x/-xb" "0x39"
> +gdb_test "x/-s" "\"01234567890123456789\"\.\.\."
> +gdb_test "x/-s" "\".+\""
> +gdb_test "x/-s" "\"\""
> +gdb_test "x/-s" "\"\""
> +gdb_test "x/-s" "\"GHIJKLMNOPQRSTUVWXYZ\""
> +gdb_test "x/-s" "\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
> +
> +# char-width=2, print-max=20 (# of tests = 12)
> +
> +gdb_test_no_output "set print elements 20"
> +gdb_test "x/6sh &TestStringsH"
> +gdb_test "x/-1xh" "0x0039"
> +gdb_test_sequence "x/-6sh" "examine multiple strings backward" {
> +    "u\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
> +    "u\"UVWXYZ\""
> +    "u\"\""
> +    "u\"\""
> +    "u\"[^\"]+\""
> +    "u\"01234567890123456789\"\.\.\."
> +}
> +gdb_test "x/6sh &TestStringsH"
> +gdb_test "x/-xh" "0x0039"
> +gdb_test "x/-sh" "u\"01234567890123456789\"\.\.\."
> +gdb_test "x/-sh" "u\".+\""
> +gdb_test "x/-sh" "u\"\""
> +gdb_test "x/-sh" "u\"\""
> +gdb_test "x/-sh" "u\"GHIJKLMNOPQRSTUVWXYZ\""
> +gdb_test "x/-sh" "u\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
> +
> +# char-width=4, print-max=20 (# of tests = 12)
> +
> +gdb_test_no_output "set print elements 20"
> +gdb_test "x/6sw &TestStringsW"
> +gdb_test "x/-1xw" "0x00000039"
> +gdb_test_sequence "x/-6sw" "examine multiple strings backward" {
> +    "U\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
> +    "U\"UVWXYZ\""
> +    "U\"\""
> +    "U\"\""
> +    "U\"[^\"]+\""
> +    "U\"01234567890123456789\"\.\.\."
> +}
> +gdb_test "x/6sw &TestStringsW"
> +gdb_test "x/-xw" "0x00000039"
> +gdb_test "x/-sw" "U\"01234567890123456789\"\.\.\."
> +gdb_test "x/-sw" "U\".+\""
> +gdb_test "x/-sw" "U\"\""
> +gdb_test "x/-sw" "U\"\""
> +gdb_test "x/-sw" "U\"GHIJKLMNOPQRSTUVWXYZ\""
> +gdb_test "x/-sw" "U\"ABCDEFGHIJKLMNOPQRST\"\.\.\."
> +
> +# char-width=2, print-max=0 (# of tests = 12)
> +
> +gdb_test_no_output "set print elements 0"
> +gdb_test "x/6sh &TestStringsH"
> +gdb_test "x/-4xh" "0x0021\[\t \]+0x0021\[\t \]+0x0021\[\t \]+0x0000"
> +gdb_test_sequence "x/-6sh" "examine multiple strings backward" {
> +    "u\"ABCDEFGHIJKLMNOPQRSTUVWXYZ\""
> +    "u\"\""
> +    "u\"\""
> +    "u\"[^\"]+\""
> +    "u\"012345678901234567890123456789\""
> +    "u\"!!!!!!\""
> +}
> +gdb_test "x/6sh &TestStringsH"
> +gdb_test "x/-xh"
> +gdb_test "x/-sh" "u\"!!!!!!\""
> +gdb_test "x/-sh" "u\"012345678901234567890123456789\""
> +gdb_test "x/-sh" "u\".+\""
> +gdb_test "x/-sh" "u\"\""
> +gdb_test "x/-sh" "u\"\""
> +gdb_test "x/-sh" "u\"ABCDEFGHIJKLMNOPQRSTUVWXYZ\""
> +
> +# char-width=1, print-max=4 (# of tests = 5)
> +
> +gdb_test_no_output "set print elements 4"
> +gdb_test "x/9s &TestStrings"
> +gdb_test "x/-xb" "0x00"
> +gdb_test_sequence "x/-4s" "examine multiple strings backward" {
> +    "\"TUVW\"\.\.\."
> +    "\"XYZ\""
> +    "\"\""
> +    "\"\""
> +}
> +gdb_test_sequence "x/-4s" "examine multiple strings backward" {
> +    "\"CDEF\"\.\.\."
> +    "\"GHIJ\"\.\.\."
> +    "\"KLMN\"\.\.\."
> +    "\"OPQR\"\.\.\."
> +}
> +
> +# Disassemle backward test (# of tests = 10)
> +
> +gdb_test_no_output "set print elements 200"
> +if { [istarget x86_64-*-* ] } {

Please use is_amd64_regs_target / is_x86_like_target.

Finally, the test has several non-unique test messages.  Take a look
at:

  https://sourceware.org/gdb/wiki/GDBTestcaseCookbook#Make_sure_test_messages_are_unique

You'll probably need something like:

with_test_prefix "char-width=4, print-max=20" {
  ...
}

etc.

Thanks,
Pedro Alves

Re: [PATCH] Negative repeat count for 'x' command

[Toshihito Kikuchi]

Hi Pedro,

We know we all are busy with our main work :).

I walked through all of your comments. Thank you for the thorough review.
Especially your suggestion for find_pc_sect_line gdb_insn_length is really
helpful. These functions are what I was looking for.

Well, I was not a patient person, so I've started a V2 thread two weeks ago.
(https://sourceware.org/ml/gdb-patches/2016-04/msg00023.html)
The difference between V1 and V2 was only NEWS file.  Please ignore it.  Once I
address all of the comments, I'll start a V3 thread.

Let me answer a couple of non-trivial questions.  Otherwise fixes will be
included in V3.

>> +If a negative repeat count is specified for the formats @samp{s} or @samp{i},
>> +the absolute value of the given number of null-terminated strings or
>> +instructions before the address are displayed.  For the @samp{i} format,
>> +we use line number information in the debug info to resolve a correct frame
>> +while dissasembling backward. 
> 
> What does "a correct frame" mean?

It seems that I was using a wrong term. Instead of 'frame', does 'procedure
boundary' make sense?

> Typo "previoius".  Double-space after periods.  This recursion sounds
> nasty -- sounds like if you request a high number of addresses, crossing
> many lines, we'll hit stack limits.  Can we do without recursion?

Yeah, actually this was a painful part. Let me rethink a better algorithm
without using recursive calls (and VEC if possible).

>> +    }
>> +
>>     /* Print as many objects as specified in COUNT, at most maxelts per line,
>>        with the address of the next one at the start of each line.  */
>>
>> @@ -913,6 +1164,9 @@ do_examine (struct format_data fmt, struct gdbarch *gdbarch, CORE_ADDR addr)
>>         printf_filtered ("\n");
>>         gdb_flush (gdb_stdout);
>>       }
>> +
>> +  if (addr_rewound)
> 
> addr_rewound != 0
> 
> But actually, please make sure that "address == 0" is treated as a
> valid address (not just here, but in the whole patch), as it is valid
> on non-MMU machines.  That may suggest using a separate boolean variable
> to represent "have address".

Thank you for the insightful comment! I never thought non-MMU architectures..

>> +
>> +  const char TestStrings[] = {
>> +      "ABCD"
>> +      "EFGHIJKLMNOPQRSTUVWXYZ\0"
>> +      "\0"
>> +      "\0"
>> +      "\u307B\u3052\u307B\u3052\0"
>> +      "012345678901234567890123456789\0"
>> +      "!!!!!!\0"
>> +  };
>> +*/
>> +
>> +const char TestStrings[] = {
>> +  0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,
> 
> I wonder whether 'A', 'B', etc. would work?

These test strings contain non-alphabetical characters shown as
"\u307B\u3052\u307B\u3052\0" above, and that syntax is not allowed without C99.
 Also,
I want to keep the same style for 1-byte, 2-bytes, and 4-bytes test strings.
That's why I didn't use a character literals here. Do you have any thoughts?

Thanks,
Toshihito

Re: [PATCH] Negative repeat count for 'x' command

[Pedro Alves]

On 04/15/2016 01:29 AM, Toshihito Kikuchi wrote:

> Let me answer a couple of non-trivial questions.  Otherwise fixes will be
> included in V3.
> 
>>> +If a negative repeat count is specified for the formats @samp{s} or @samp{i},
>>> +the absolute value of the given number of null-terminated strings or
>>> +instructions before the address are displayed.  For the @samp{i} format,
>>> +we use line number information in the debug info to resolve a correct frame
>>> +while dissasembling backward. 
>>
>> What does "a correct frame" mean?
> 
> It seems that I was using a wrong term. Instead of 'frame', does 'procedure
> boundary' make sense?

Yes, that'd make sense.

>>> +const char TestStrings[] = {
>>> +  0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48,
>>
>> I wonder whether 'A', 'B', etc. would work?
> 
> These test strings contain non-alphabetical characters shown as
> "\u307B\u3052\u307B\u3052\0" above, and that syntax is not allowed without C99.
>  Also,
> I want to keep the same style for 1-byte, 2-bytes, and 4-bytes test strings.
> That's why I didn't use a character literals here. 

...

> Do you have any thoughts?

Nope.

BTW, aren't these tests dependent on the host's charset?  (show host-charset)

An idea to generalize the x/i tests to all archs would be to
let go of the asm, and instead write the test function in C.  Then
you'd first use forward x/i to store a few line's instructions in
a list/array, and afterwards you'd disassemble backwards, comparing
with the expected instructions stored in the stored list/array.
I wonder whether that'd work.

Thanks,
Pedro Alves

Re: [PATCH] Negative repeat count for 'x' command

[Toshihito Kikuchi]

Hi Pedro,

I've sent V3 patch today.

> BTW, aren't these tests dependent on the host's charset?  (show host-charset)

Thank you for pointing this out. Yes, then I added 'set host-charset ASCII'
before running string testcases.

> An idea to generalize the x/i tests to all archs would be to
> let go of the asm, and instead write the test function in C.  Then
> you'd first use forward x/i to store a few line's instructions in
> a list/array, and afterwards you'd disassemble backwards, comparing
> with the expected instructions stored in the stored list/array.
> I wonder whether that'd work.

This was great suggestion.  I realized .exp test scripts can support complex
logics more than expected.  I added a new section 'backward disassemble general'
to do that.

A new section "address zero boundary" is also added to test around address zero.
 Since I don't have non-MMU machines, I verified it using by setting
/proc/sys/vm/mmap_min_addr to 0.

Thanks,
Toshihito