If you enjoy this article, subscribe (via RSS or e-mail) and follow me on twitter.

A few days ago, Aman (@tmm1) was complaining to me about a slow running process:

I want to see what is happening in userland and trace calls to extensions. Why doesn’t ltrace work for Ruby processes? I want to figure out which MySQL queries are causing my app to be slow.

It turns out that ltrace did not have support for libraries loaded with libdl. This is a problem for languages like Ruby, Python, PHP, Perl, and others because in many cases extensions, libraries, and plugins for these languages are loaded by the VM using libdl. This means that ltrace is somewhat useless for tracking down performance issues in dynamic languages.

A couple late nights of hacking and I managed to finagle libdl support in ltrace. Since most people probably don’t care about the technical details of how it was implemented, I’ll start with showing how to use the patch I wrote and what sort of output you can expect. This patch has made tracking down slow queries (among other things) really easy and I hope others will find this useful.

How to use ltrace:

After you’ve applied my patch (below) and rebuilt ltrace, let’s say you’d like to trace MySQL queries and have ltrace tell you when the query was executed and how long it took. There are two steps:

Give ltrace info so it can pretty print – echo “int mysql_real_query(addr,string,ulong);” > custom.conf Tell ltrace you want to hear about mysql_real_query : ltrace -F custom.conf -ttTgx mysql_real_query -p <pid>

Here’s what those arguments mean:

-F use a custom config file when pretty-printing (default: /etc/ltrace.conf, add your stuff there to avoid -F if you wish).

use a custom config file when pretty-printing (default: /etc/ltrace.conf, add your stuff there to avoid -F if you wish). -tt print the time (including microseconds) when the call was executed

print the time (including microseconds) when the call was executed -T time the call and print how long it took

time the call and print how long it took -x tells ltrace the name of the function you care about

tells ltrace the name of the function you care about -g avoid placing breakpoints on all library calls except the ones you specify with -x. This is optional, but it makes ltrace produce much less output and is a lot easier to read if you only care about your one function.

PHP

Test script

mysql_connect("localhost", "root"); while(true){ mysql_query("SELECT sleep(1)"); }

ltrace output

22:31:50.507523 zend_hash_find(0x025dc3a0, "mysql_query", 12) = 0 <0.000029> 22:31:50.507781 mysql_real_query(0x027bc540, "SELECT sleep(1)", 15) = 0 <1.000600> 22:31:51.508531 zend_hash_find(0x025dc3a0, "mysql_query", 12) = 0 <0.000025> 22:31:51.508675 mysql_real_query(0x027bc540, "SELECT sleep(1)", 15) = 0 <1.000926>

ltrace command

ltrace -ttTg -x zend_hash_find -x mysql_real_query -p [pid of script above]

Python

Test script

import MySQLdb db = MySQLdb.connect("localhost", "root", "", "test") cursor = db.cursor() sql = """SELECT sleep(1)""" while True: cursor.execute(sql) data = cursor.fetchone() db.close()

ltrace output

22:24:39.104786 PyEval_SaveThread() = 0x21222e0 <0.000029> 22:24:39.105020 PyEval_SaveThread() = 0x21222e0 <0.000024> 22:24:39.105210 PyEval_SaveThread() = 0x21222e0 <0.000024> 22:24:39.105303 mysql_real_query(0x021d01d0, "SELECT sleep(1)", 15) = 0 <1.002083> 22:24:40.107553 PyEval_SaveThread() = 0x21222e0 <0.000026> 22:24:40.107713 PyEval_SaveThread()= 0x21222e0 <0.000024> 22:24:40.107909 PyEval_SaveThread() = 0x21222e0 <0.000025> 22:24:40.108013 mysql_real_query(0x021d01d0, "SELECT sleep(1)", 15) = 0 <1.001821>

ltrace command

ltrace -ttTg -x PyEval_SaveThread -x mysql_real_query -p [pid of script above]

Perl

Test script

#!/usr/bin/perl use DBI; $dsn = "DBI:mysql:database=test;host=localhost"; $dbh = DBI->connect($dsn, "root", ""); $drh = DBI->install_driver("mysql"); @databases = DBI->data_sources("mysql"); $sth = $dbh->prepare("SELECT SLEEP(1)"); while (1) { $sth->execute; }

ltrace output

22:42:11.194073 Perl_push_scope(0x01bd3010) = <0.000028> 22:42:11.194299 mysql_real_query(0x01bfbf40, "SELECT SLEEP(1)", 15) = 0 <1.000876> 22:42:12.195302 Perl_push_scope(0x01bd3010) = <0.000024> 22:42:12.195408 mysql_real_query(0x01bfbf40, "SELECT SLEEP(1)", 15) = 0 <1.000967>

ltrace command

ltrace -ttTg -x mysql_real_query -x Perl_push_scope -p [pid of script above]

Ruby

Test script

require 'rubygems' require 'sequel' DB = Sequel.connect('mysql://root@localhost/test') while true p DB['select sleep(1)'].select.first GC.start end

snip of ltrace output

22:10:00.195814 garbage_collect() = 0 <0.022194> 22:10:00.218438 mysql_real_query(0x02740000, "select sleep(1)", 15) = 0 <1.001100> 22:10:01.219884 garbage_collect() = 0 <0.021401> 22:10:01.241679 mysql_real_query(0x02740000, "select sleep(1)", 15) = 0 <1.000812>

ltrace command used:

ltrace -ttTg -x garbage_collect -x mysql_real_query -p [pid of script above]

Where to get it

On github: http://github.com/ice799/ltrace/tree/libdl

Raw patch (NOTE: This should apply cleanly against ltrace 0.5.3): ltrace.patch

How ltrace works normally

ltrace works by setting software breakpoints on entries in a process’ Procedure Linkage Table (PLT).

What is a software breakpoint

A software breakpoint is just a series of bytes ( 0xcc on the x86 and x86_64) that raise a debug interrupt (interrupt 3 on the x86 and x86_64). When interrupt 3 is raised, the CPU executes a handler installed by the kernel. The kernel then sends a signal to the process that generated the interrupt. (Want to know more about how signals and interrupts work? Check out an earlier blog post: here)

What is a PLT and how does it work?

A PLT is a table of absolute addresses to functions. It is used because the link editor doesn’t know where functions in shared objects will be located. Instead, a table is created so that the program and the dynamic linker can work together to find and execute functions in shared objects. I’ve simplified the explanation a bit, but at a high level:

Program calls a function in a shared object, the link editor makes sure that the program jumps to a slot in the PLT. The program sets some data up for the dynamic linker and then hands control over to it. The dynamic linker looks at the info set up by the program and fills in the absolute address of the function that was called in the PLT. Then the dynamic linker calls the function. Subsequent calls to the same function jump to the same slot in the PLT, but every time after the first call the absolute address is already in the PLT (because when the dynamic linker is invoked the first time, it fills in the absolute address in the PLT).

Since all calls to library functions occur via the PLT, ltrace sets breakpoints on each PLT entry in a program.

Why ltrace didn’t work with libdl loaded libraries

Libraries loaded with libdl are loaded at run time and functions (and other symbols) are accessed by querying the dynamic linker (by calling dlsym() ). The compiler and link editor don’t know anything about libraries loaded this way (they may not even exist!) and as such no PLT entries are created for them.

Since no PLT entries exist, ltrace can’t trace these functions.

What needed to be done to make ltrace libdl-aware

OK, so we understand the problem. ltrace only sets breakpoints on PLT entries and libdl loaded libraries don’t have PLT entries. How can this be fixed?

Luckily, the dynamic linker and ELF all work together to save your ass.

Executable and Linking Format (ELF) is a file format for executables, shared libraries, and more. The file format can get a bit complicated, but all you really need to know is: ELF consists of different sections which hold different types of entries. There is a section called .dynamic which has an entry named DT_DEBUG . This entry stores the address of a debugging structure in the address space of the process. In Linux, this struct has type struct r_debug .

How to use struct r_debug to win the game

The debug structure is updated by the dynamic linker at runtime to reflect the current state of shared object loading. The structure contains 3 things that will help us in our quest:

state – the current state of the mapping change taking place (begin add, begin delete, consistent) brk – the address of a function internal to the dynamic linker that will be called when the linker maps, unmaps, or has completed mapping a shared object. link map – Pointer to the start of a list of currently loaded objects. This list is called the link map and is represented as a struct link_map in Linux.

Tie it all together and bring it home

To add support for libdl loaded libraries to ltrace , the steps are:

Find the address of the debug structure in the .dynamic section of the program. Set a software breakpoint on brk . When the dynamic linker updates the link map, it will trigger the software breakpoint. When the breakpoint is triggered, check state in the debug structure. If a new library has been added, walk the link map and figure out what was added. Search the added library’s symbol table for the symbols we care about. Set a software breakpoints on whatever is found. Steps 3-8 repeat.

That isn’t too hard all thanks to the dynamic linker providing a way for us to hook into its internal events.

Conclusion

Read the System V ABI for your CPU. It is filled with insanely useful information that can help you be a better programmer.

Use the source. A few times while hacking on this patch I looked through the source for GDB and glibc to help me figure out what was going on.

Understanding how things work at a low-level can help you build tools to solve your high-level problems.

Thanks for reading and don’t forget to subscribe (via RSS or e-mail) and follow me on twitter.

References