diff --git a/study/debug/tools/systemtap/00-code/1-systemtap_overview/1.4.1-odd_even.stp b/study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.4.1-odd_even.stp
similarity index 100%
rename from study/debug/tools/systemtap/00-code/1-systemtap_overview/1.4.1-odd_even.stp
rename to study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.4.1-odd_even.stp
diff --git a/study/debug/tools/systemtap/00-code/1-systemtap_overview/1.4.2-prime.stp b/study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.4.2-prime.stp
similarity index 100%
rename from study/debug/tools/systemtap/00-code/1-systemtap_overview/1.4.2-prime.stp
rename to study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.4.2-prime.stp
diff --git a/study/debug/tools/systemtap/00-code/1-systemtap_overview/1.4.3-fibonacci.stp b/study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.4.3-fibonacci.stp
similarity index 100%
rename from study/debug/tools/systemtap/00-code/1-systemtap_overview/1.4.3-fibonacci.stp
rename to study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.4.3-fibonacci.stp
diff --git a/study/debug/tools/systemtap/00-code/1-systemtap_overview/1.6-safety_security.stp b/study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.6-safety_security.stp
similarity index 100%
rename from study/debug/tools/systemtap/00-code/1-systemtap_overview/1.6-safety_security.stp
rename to study/debug/tools/systemtap/00-code/language_reference/1-systemtap_overview/1.6-safety_security.stp
diff --git a/study/debug/tools/systemtap/00-code/3-components_of_a_systemTap_script/show_all_kernel_func.sh b/study/debug/tools/systemtap/00-code/language_reference/3-components_of_a_systemTap_script/show_all_kernel_func.sh
similarity index 100%
rename from study/debug/tools/systemtap/00-code/3-components_of_a_systemTap_script/show_all_kernel_func.sh
rename to study/debug/tools/systemtap/00-code/language_reference/3-components_of_a_systemTap_script/show_all_kernel_func.sh
diff --git a/study/debug/tools/systemtap/00-code/3-components_of_a_systemTap_script/test_mkdir.stp b/study/debug/tools/systemtap/00-code/language_reference/3-components_of_a_systemTap_script/test_mkdir.stp
similarity index 100%
rename from study/debug/tools/systemtap/00-code/3-components_of_a_systemTap_script/test_mkdir.stp
rename to study/debug/tools/systemtap/00-code/language_reference/3-components_of_a_systemTap_script/test_mkdir.stp
diff --git a/study/debug/tools/systemtap/00-code/language_reference/hello-world.stp b/study/debug/tools/systemtap/00-code/language_reference/hello-world.stp
new file mode 100644
index 0000000..9e7e024
--- /dev/null
+++ b/study/debug/tools/systemtap/00-code/language_reference/hello-world.stp
@@ -0,0 +1,15 @@
+#  http://blog.csdn.net/justlinux2010/article/details/10050265
+function print_value()
+{
+    printf("probefunc = %s, ppfunc = %s", probefunc( ), ppfunc( ));
+    printf("pid = %d, tid = %d, common = %s\n", pid( ), tid( ), execname( ));
+    printf("cpu = %d, probefunc = %s", cpu( ), probefunc( ));
+    
+}
+
+probe begin
+{
+    print("Hello World\n")
+    exit()
+}
+
diff --git a/study/debug/tools/systemtap/README.md b/study/debug/tools/systemtap/README.md
index 215486a..7a4495b 100644
--- a/study/debug/tools/systemtap/README.md
+++ b/study/debug/tools/systemtap/README.md
@@ -1,8 +1,7 @@
-http://www.cnblogs.com/hazir/p/systemtap_introduction.html
-
 http://ddebs.ubuntu.com/pool/main/l/linux/
-
 http://www.ibm.com/developerworks/cn/linux/l-cn-systemtap3/
+https://www.ibm.com/developerworks/cn/linux/l-systemtap/
+
 
 [内核探测工具systemtap简介](http://www.cnblogs.com/hazir/p/systemtap_introduction.html)
 
@@ -26,3 +25,7 @@ http://blog.csdn.net/trochiluses/article/details/9698449
 
 [如何在ubuntu上基于自定义内核安装systemtap](http://blog.csdn.net/trochiluses/article/details/9698449)
 [Optional: Installing on a custom kernel](https://www.ibm.com/support/knowledgecenter/linuxonibm/liaai.systemTap/liaaisystapcustom.htm)
+
+
+[SystemTap----常用变量、宏、函数和技巧](http://blog.csdn.net/justlinux2010/article/details/10050265)
+[systemtap常用内置函数](http://zhengheng.me/2015/02/11/systemtap-useful-functions/)
diff --git a/study/debug/tools/systemtap/print_top.stp b/study/debug/tools/systemtap/print_top.stp
new file mode 100644
index 0000000..6958ace
--- /dev/null
+++ b/study/debug/tools/systemtap/print_top.stp
@@ -0,0 +1,29 @@
+#!/usr/bin/env stap    #Systemtap脚本的标志
+#
+#  显示在最后5秒内调用最后10个系统调用
+#  display the top 10 syscalls called in last 5 seconds
+#
+global syscalls         #  定义全局变量
+function print_top( )    #  定义函数
+{
+        cnt = 0         #  局部变量
+        log ("SYSCALL\t\t\t\tCOUNT")      #  打印表头标题“SYSCALL COUNT”
+
+        foreach ([name] in syscalls-) {   #  查询每个系统调用的计数值
+                printf("%-20s\t\t%5d\n",name, syscalls[name])  #  按格式打印
+                if (cnt++ == 10)
+                        break
+        }
+        printf("--------------------------------------\n")
+        delete syscalls                 #删除全局变量
+}
+
+probe syscall.*     #  在系统调用探测点
+{
+        syscalls[probefunc( )]++      #  系统调用计数
+}
+
+probe timer.ms(5000)
+{
+    print_top( )         #调用函数
+}