Initial Commit

18 files changed, 1977 insertions, 0 deletions

diff --git a/stap_tutorial-1.0/SystemTap-Tutorial-OLS2007.pdf b/stap_tutorial-1.0/SystemTap-Tutorial-OLS2007.pdf
new file mode 100644
index 0000000..15c0f57
--- /dev/null
+++ b/stap_tutorial-1.0/SystemTap-Tutorial-OLS2007.pdf
diff --git a/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-futexes.stp b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-futexes.stp
new file mode 100755
index 0000000..8f2b414
--- /dev/null
+++ b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-futexes.stp
@@ -0,0 +1,44 @@
+#!/usr/bin/env stap
+
+global target_pids, target_execs
+global thread_thislock, thread_blocktime 
+global FUTEX_WAIT = 0, FUTEX_WAKE = 1
+global lock_waits
+
+probe process.exec_complete {
+	if (success && (ppid() in target_pids || pid() == target()))
+		target_pids[pid()] = kernel_string($filename)
+}
+
+probe syscall.futex {
+	if (!(pid() in target_pids)) next
+
+	if (op != FUTEX_WAIT) next  # ignore originators of WAKE events
+
+	t = tid()
+	thread_thislock[t] = $uaddr
+	thread_blocktime[t] = gettimeofday_us()
+}
+
+probe syscall.futex.return {
+	if (!(pid() in target_pids)) next
+
+	if (op != FUTEX_WAIT) next  # ignore originators of WAKE events
+
+	t = tid()
+	ts = thread_blocktime[t]
+	if (ts) {
+		elapsed = gettimeofday_us() - ts
+		lock_waits[pid(), thread_thislock[t]] <<< elapsed
+		delete thread_blocktime[t]
+		delete thread_thislock[t]
+	}
+}
+
+probe end {
+	foreach ([pid, lock] in lock_waits)
+		printf ("%s[%d] lock %p contended %5d times, %9d avg us\n",
+		        target_pids[pid], pid, lock,
+		        @count(lock_waits[pid, lock]),
+		        @avg(lock_waits[pid, lock]))
+}
diff --git a/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-opens.stp b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-opens.stp
new file mode 100755
index 0000000..a040059
--- /dev/null
+++ b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-opens.stp
@@ -0,0 +1,73 @@
+#!/usr/bin/env stap
+
+global target_pids, target_execs
+global opens_by_file_success, opens_by_exec_success, total_opens_success
+global opens_by_file_fail, opens_by_exec_fail, total_opens_fail
+global closes_by_exec, total_closes
+global open_failure_by_type
+
+probe process.exec_complete {
+	if (success && (ppid() in target_pids || pid() == target())) {
+		target_pids[pid()] = kernel_string($filename)
+		target_execs[kernel_string($filename)] ++
+	}
+}
+
+probe syscall.open.return {
+	if (!(pid() in target_pids)) next
+
+	if ($return >= 0) {
+		opens_by_exec_success[target_pids[pid()]] ++
+		opens_by_file_success[user_string($filename)] ++
+		total_opens_success ++
+	} else {
+		opens_by_exec_fail[target_pids[pid()]] ++
+		opens_by_file_fail[user_string($filename)] ++
+		open_failure_by_type[retstr] ++
+		total_opens_fail ++
+	}
+}
+
+probe syscall.close {
+	if (!(pid() in target_pids)) next
+
+	closes_by_exec[target_pids[pid()]] ++
+	total_closes ++
+}
+
+probe end {
+	prt_limit = 10
+	
+	printf ("Total opens: %d (%d succeeded, %d failed)\n", 
+	         total_opens_success + total_opens_fail,
+	         total_opens_success, total_opens_fail)
+	printf ("Total closes: %d\n\n", total_closes)
+
+	printf ("# Binary Instances:\n")
+	foreach(name in target_execs)
+		printf("%d\t%s\n", target_execs[name], name)
+
+	printf("\n# Successful Opens by Binary:\n")
+	foreach (name in opens_by_exec_success-)
+		printf("%d\t%s\n", opens_by_exec_success[name], name)
+
+	printf("\n# Failed Opens by Binary:\n")
+	foreach (name in opens_by_exec_fail-)
+		printf("%d\t%s\n", opens_by_exec_fail[name], name)
+
+	printf("\n# Successful Opens by File (top %d):\n", prt_limit)
+	foreach (name in opens_by_file_success- limit prt_limit)
+		printf("%d\t%s\n", opens_by_file_success[name], name)
+
+	printf("\n# Failed Opens by File: (top %d)\n", prt_limit)
+	foreach (name in opens_by_file_fail- limit prt_limit)
+		printf("%d\t%s\n", opens_by_file_fail[name], name)
+
+	printf("\n# Closes by Binary:\n")
+	foreach (name in closes_by_exec-)
+		printf("%d\t%s\n", closes_by_exec[name], name)
+
+	printf("\n# Open Failures by Type:\n")
+	foreach (type in open_failure_by_type-)
+		printf("%d\t%s\n", open_failure_by_type[type], type)
+}
diff --git a/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-rw.stp b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-rw.stp
new file mode 100755
index 0000000..f5107ff
--- /dev/null
+++ b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-rw.stp
@@ -0,0 +1,104 @@
+#!/usr/bin/env stap
+
+global target_pids, target_execs
+global reads_by_file, reads_by_exec
+global writes_by_file, writes_by_exec
+global files, execs
+
+%{
+#include <linux/file.h>
+%}
+
+function fd2name:string (fd:long)
+%{
+	char *start = NULL, buf[MAXSTRINGLEN];
+	struct file *file = NULL;
+	struct vfsmount *mnt = NULL;
+	struct dentry *dentry = NULL;
+
+	file = fget(THIS->fd);
+	if (file) {
+		mnt = (struct vfsmount *) kread(&(file->f_path.mnt));
+		dentry = (struct dentry *) kread(&(file->f_path.dentry));
+		if (mnt && dentry)
+			start = d_path(dentry, mnt, buf, MAXSTRINGLEN);
+		if (start > 0)
+			strlcpy(THIS->__retvalue, start, MAXSTRINGLEN);
+		fput(file);
+	}
+	CATCH_DEREF_FAULT();
+%}
+
+probe process.exec_complete {
+	if (success && (ppid() in target_pids || pid() == target())) {
+		target_pids[pid()] = kernel_string($filename)
+		target_execs[kernel_string($filename)] ++
+	}
+}
+
+probe syscall.read.return, syscall.readv.return {
+	if (!(pid() in target_pids)) next
+
+	if ($return >= 0) {
+		fn = fd2name($fd)
+		exec = execname()
+		reads_by_file[fn] <<< $return
+		reads_by_exec[exec] <<< $return
+		files[fn] ++
+		execs[exec] ++
+	}
+}
+
+probe syscall.write.return, syscall.writev.return {
+	if (!(pid() in target_pids)) next
+
+	if ($return >= 0) {
+		fn = fd2name($fd)
+		exec = execname()
+		writes_by_file[fn] <<< $return
+		writes_by_exec[exec] <<< $return
+		files[fn] ++
+		execs[exec] ++
+	}
+}
+
+probe end {
+	foreach (file in reads_by_file) {
+		total_read_cnt += @count(reads_by_file[file])
+		total_read_bytes += @sum(reads_by_file[file])
+	}
+
+	foreach (file in writes_by_file) {
+		total_write_cnt += @count(writes_by_file[file])
+		total_write_bytes += @sum(writes_by_file[file])
+	}
+
+	printf ("Total reads : %d cnt, %d KB\n",
+		total_read_cnt, total_read_bytes/1024)
+	printf ("Total writes: %d cnt, %d KB\n",
+		total_write_cnt, total_write_bytes/1024)
+
+	printf ("\n# Binary Instances:\n")
+	foreach (name in target_execs)
+		printf("%d\t%s\n", target_execs[name], name)
+
+	printf ("\nIO by Process:\n")
+	foreach (name in execs-) {
+		rd_cnt = @count(reads_by_exec[name])
+		rd_sum = (rd_cnt > 0 ? @sum(reads_by_exec[name])/1024 : 0)
+		wr_cnt = @count(writes_by_exec[name])
+		wr_sum = (wr_cnt > 0 ? @sum(writes_by_exec[name])/1024 : 0)
+		printf("%5d rds, %5d KB rd, %5d wrs, %5d KB wr: %s\n",
+		        rd_cnt, rd_sum, wr_cnt, wr_sum, name)
+	}
+
+	printf ("\nIO by File:\n")
+	foreach (name in files-) {
+		rd_cnt = @count(reads_by_file[name])
+		rd_sum = (rd_cnt > 0 ? @sum(reads_by_file[name])/1024 : 0)
+		wr_cnt = @count(writes_by_file[name])
+		wr_sum = (wr_cnt > 0 ? @sum(writes_by_file[name])/1024 : 0)
+		printf("%5d rds, %5d KB rd, %5d wrs, %5d KB wr: %s\n",
+		        rd_cnt, rd_sum, wr_cnt, wr_sum, name)
+	}
+}
diff --git a/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-syscalls.stp b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-syscalls.stp
new file mode 100755
index 0000000..17e7d95
--- /dev/null
+++ b/stap_tutorial-1.0/examples/cmd-eval/cmd-eval-syscalls.stp
@@ -0,0 +1,33 @@
+#!/usr/bin/env stap
+
+global target_pids, target_execs
+global syscalls_per_exec, syscalls_by_exec, syscalls
+
+probe process.exec_complete {
+        if (success && (ppid() in target_pids || pid() == target())) {
+                target_pids[pid()] = kernel_string($filename)
+                target_execs[kernel_string($filename)] ++
+        }
+}
+
+probe syscall.* {
+	if (!(pid() in target_pids)) next
+
+	syscalls_by_exec[name, target_pids[pid()]] ++
+	syscalls_per_exec[target_pids[pid()]] ++
+	syscalls[name] ++
+}
+
+probe end {
+	printf("\nIndividual System Calls by Binary:\n" )
+	foreach ([name, exec] in syscalls_by_exec-)
+		printf("%8d %-20s\t%s\n", syscalls_by_exec[name, exec], name, exec) 
+
+	printf("\nTotal System Calls by Binary:\n" )
+	foreach (exec in syscalls_per_exec-)
+		printf("%8d %-20s\n", syscalls_per_exec[exec], exec) 
+
+	printf("\nSystem Calls over all:\n")
+	foreach (name in syscalls-)
+		printf("%8d %-20s\n", syscalls[name], name)
+}
diff --git a/stap_tutorial-1.0/examples/fs-io-1.stp b/stap_tutorial-1.0/examples/fs-io-1.stp
new file mode 100755
index 0000000..83462e9
--- /dev/null
+++ b/stap_tutorial-1.0/examples/fs-io-1.stp
@@ -0,0 +1,26 @@
+#!/usr/bin/env stap 
+
+global reads, writes, total_io
+
+probe fs.read.return {
+	pname = execname()
+	reads[pname] += bytes 
+	total_io[pname] += bytes
+}
+
+probe fs.write.return {
+	pname = execname()
+	writes[pname] += bytes
+	total_io[pname] += bytes
+}
+
+probe timer.s(10) {
+	foreach(pname in total_io- limit 10)
+		printf("%15s r: %8d KB w: %8d KB\n",
+		       pname, reads[pname]/1024, writes[pname]/1024)
+	printf("\n")
+	delete reads
+	delete writes
+	delete total_io
+}
+
diff --git a/stap_tutorial-1.0/examples/fs-io-2.stp b/stap_tutorial-1.0/examples/fs-io-2.stp
new file mode 100755
index 0000000..09036b2
--- /dev/null
+++ b/stap_tutorial-1.0/examples/fs-io-2.stp
@@ -0,0 +1,26 @@
+#!/usr/bin/env stap
+
+global reads, writes, total_io
+
+probe fs.read.return {
+	fn = file2name($file)
+	reads[fn] += bytes 
+	total_io[fn] += bytes
+}
+
+probe fs.write.return {
+	fn = file2name($file)
+	writes[fn] += bytes 
+	total_io[fn] += bytes
+}
+
+probe timer.s(10) {
+	foreach(fname in total_io- limit 20) {
+		printf("r: %8d KB w: %8d KB %s\n",
+		       reads[fname]/1024, writes[fname]/1024, fname)
+	}
+	printf("\n")
+	delete reads
+	delete writes
+	delete total_io
+}
diff --git a/stap_tutorial-1.0/examples/helloworld.stp b/stap_tutorial-1.0/examples/helloworld.stp
new file mode 100755
index 0000000..e08ecb8
--- /dev/null
+++ b/stap_tutorial-1.0/examples/helloworld.stp
@@ -0,0 +1,6 @@
+#!/usr/bin/env stap
+
+probe begin {
+	printf("Hello World!\n")
+	exit()
+}
diff --git a/stap_tutorial-1.0/examples/probe-types.stp b/stap_tutorial-1.0/examples/probe-types.stp
new file mode 100755
index 0000000..08da226
--- /dev/null
+++ b/stap_tutorial-1.0/examples/probe-types.stp
@@ -0,0 +1,38 @@
+#!/usr/bin/env stap
+
+global reads, writes
+global sema_contentions
+global ext3_releases
+
+probe begin {
+	printf("Collecting data... ")
+}
+
+probe kernel.function("sys_read") {
+	reads++
+}
+
+probe syscall.write {
+	writes++
+}
+
+probe timer.s (20) {
+	exit()
+}
+
+probe module("ext3").function("ext3_release_file") {
+	ext3_releases++
+}
+
+probe kernel.statement("*@lib/semaphore-sleepers.c:82") {
+	sema_contentions++
+}
+
+probe end {
+	printf("done\n")
+	printf("# ext3 file releases = %d\n", ext3_releases)
+	printf("# semaphore contentions = %d\n", sema_contentions)
+	printf("# reads = %d\n", reads)
+	printf("# writes = %d\n", writes)
+}
+
diff --git a/stap_tutorial-1.0/examples/read-write-1.stp b/stap_tutorial-1.0/examples/read-write-1.stp
new file mode 100755
index 0000000..5abd35f
--- /dev/null
+++ b/stap_tutorial-1.0/examples/read-write-1.stp
@@ -0,0 +1,25 @@
+#!/usr/bin/env stap
+
+global reads, writes
+
+probe begin {
+	printf("Collecting data...\n")
+}
+
+probe syscall.read {
+	reads[execname()]++
+}
+
+probe syscall.write {
+	writes[execname()]++
+}
+
+probe end {
+	printf("Reads by process name:\n")
+	foreach (name in reads-)
+		printf("%d\t%s\n", reads[name], name)
+
+	printf("Writes by process name:\n")
+	foreach (name in writes-)
+		printf("%d\t%s\n", writes[name], name)
+}
diff --git a/stap_tutorial-1.0/examples/read-write-2.stp b/stap_tutorial-1.0/examples/read-write-2.stp
new file mode 100755
index 0000000..d6a647b
--- /dev/null
+++ b/stap_tutorial-1.0/examples/read-write-2.stp
@@ -0,0 +1,27 @@
+#!/usr/bin/env stap
+
+global reads, writes
+
+probe begin {
+	printf("Collecting data...\n")
+}
+
+probe syscall.read.return {
+	if ($return > 0)
+		reads[execname()] += $return
+}
+
+probe syscall.write.return {
+	if ($return > 0)
+		writes[execname()] += $return
+}
+
+probe end {
+	printf("Bytes read by process name:\n")
+	foreach (name in reads-)
+		printf("%10d %s\n", reads[name], name)
+
+	printf("Bytes written by process name:\n")
+	foreach (name in writes-)
+		printf("%10d %s\n", writes[name], name)
+}
diff --git a/stap_tutorial-1.0/examples/read-write-3.stp b/stap_tutorial-1.0/examples/read-write-3.stp
new file mode 100755
index 0000000..fef85a5
--- /dev/null
+++ b/stap_tutorial-1.0/examples/read-write-3.stp
@@ -0,0 +1,35 @@
+#!/usr/bin/env stap
+
+global reads, writes
+
+probe begin {
+	printf("Collecting data...\n")
+}
+
+probe syscall.read.return {
+	if ($return > 0)
+		reads <<< $return
+}
+
+probe syscall.write.return {
+	if ($return > 0)
+		writes <<< $return
+}
+
+probe end {
+	printf("Read sizes summary:\n")
+
+	printf("\tcount:%d, sum:%d, avg:%d, min:%d, max:%d\n",
+	       @count(reads), @sum(reads), @avg(reads),
+	       @min(reads), @max(reads)) 
+
+	print(@hist_log(reads))
+
+	printf("Write sizes summary:\n")
+
+	printf("\tcount:%d, sum:%d, avg:%d, min:%d, max:%d\n",
+	       @count(writes), @sum(writes), @avg(writes),
+	       @min(writes), @max(writes)) 
+
+	print(@hist_log(writes))
+}
diff --git a/stap_tutorial-1.0/examples/socktop b/stap_tutorial-1.0/examples/socktop
new file mode 100755
index 0000000..123e37e
--- /dev/null
+++ b/stap_tutorial-1.0/examples/socktop
@@ -0,0 +1,318 @@
+#!/bin/bash
+
+# Socktop systemtap script
+# Copyright (C) 2006 IBM Corp.
+#
+# This file is part of systemtap, and is free software.  You can
+# redistribute it and/or modify it under the terms of the GNU General
+# Public License (GPL); either version 2, or (at your option) any
+# later version.
+
+###
+### socktop - Combination shell/systemtap script to track reads and writes
+###           on sockets by process.  Can be filtered by process IDs and
+###           names, protocols, protocol families, users and socket type.
+###
+
+# Filter options
+F_PROTSTR=""; F_PROT=0  # Filter by protocol
+F_FAMSTR=""; F_FAM=0    # Filter by protocol family
+F_TYPESTR=""; F_TYPE=0  # Filter by socket type
+F_PIDSTR=""; F_PID=0    # Filter by process ID
+F_NAMESTR=""; F_NAME=0  # Filter by process name
+F_UIDSTR=""; F_UID=0    # Filter by user
+FILTER=0                # Any filters specified?
+
+# Print options
+P_INTERVAL=5 # default interval between output
+P_DEVICES=0  # default is don't display network device traffic
+P_NUMTOP=10  # default number of processes and network devices to print
+
+DELIM=","
+
+function usage {
+	echo "USAGE: socktop [-d] [-i interval] [-N num] [-P protocol]... [-f family]..."
+	echo "               [-t stype]... [-n pname]... [-p pid]... [-u username]... [-h]"
+	echo "    -d           # print network device traffic (default: off)"
+	echo "    -i interval  # interval in seconds between printing (default: $P_INTERVAL)"
+	echo "    -N num       # number of top processes and devices to print (default: $P_NUMTOP)"
+	echo "    -f family    # this protocol family only (default: all)"
+	echo "    -P protocol  # this protocol only (default: all)"
+	echo "    -t stype     # this socket type only (default: all)"
+	echo "    -n pname     # this process name only (default: all)"
+	echo "    -p pid       # this process ID only (default: all)"
+	echo "    -u username  # this user only (default: all)"
+	echo "    -h           # print this help text"
+	echo ""
+	echo "Protocol Families:"
+	echo "    LOCAL, INET, INET6, IPX, NETLINK, X25, AX25, ATMPVC, APPLETALK, PACKET"
+	echo ""
+	echo "Protocols:"
+	echo "    TCP, UDP, SCTP, IP, FC, ... (see /etc/protocols for complete list)"
+	echo ""
+	echo "Socket Types:"
+	echo "    STREAM, DGRAM, RAW, RDM, SEQPACKET, DCCP, PACKET"
+}
+
+# Process options
+while getopts df:i:n:N:P:p:t:u:h option; do
+	case $option in
+	d)      P_DEVICES=1 ;;
+	i)      P_INTERVAL=$OPTARG ;;
+	N)      P_NUMTOP=$OPTARG ;;
+	f)      let "F_FAM++"
+	        F_FAMSTR=$OPTARG$DELIM$F_FAMSTR ;;
+	n)      let "F_NAME++"
+	        F_NAMESTR=$OPTARG$DELIM$F_NAMESTR ;;
+	p)      let "F_PID++"
+	        F_PIDSTR=$OPTARG$DELIM$F_PIDSTR ;;
+	P)      let "F_PROT++"
+	        F_PROTSTR=$OPTARG$DELIM$F_PROTSTR ;;
+	t)      let "F_TYPE++"
+	        F_TYPESTR=$OPTARG$DELIM$F_TYPESTR ;;
+	u)      uid=`awk -F: '$1 == name {print $3}' name=$OPTARG /etc/passwd`
+	        if [[ $uid != "" ]]; then
+	            let "F_UID++"
+	            F_UIDSTR=$uid$DELIM$F_UIDSTR
+	        else
+	            echo "ERROR: Unknown user:" $OPTARG
+	            let "ERROR++"
+	        fi ;;
+	h|?|*)  usage
+	        exit 1 ;;
+	esac
+done
+
+if [[ $ERROR > 0 ]]; then
+	exit 1
+fi
+
+if [[ $F_FAM  > 0 || $F_NAME > 0 || $F_PID > 0 || 
+	  $F_PROT > 0 || $F_TYPE > 0 || $F_UID > 0 ]]; then
+	FILTER=1
+fi
+
+#
+# Pass a timezone adjustment value to the stap script
+#
+TZ=`date "+%z"`
+TZ_SIGN=`echo $TZ | cut -c1`
+TZ_HOURS=`echo $TZ | cut -c2-3`
+TZ_MINS=`echo $TZ | cut -c4-5`
+TZ_ADJUST=$TZ_SIGN$((10#$TZ_HOURS*60*60+10#$TZ_MINS*60))
+
+#
+# Start the systemtap script
+#
+stap -e '
+global execname, user, if_tx, if_rx, if_dev
+global sk_tx, sk_rx, sk_pid
+global f_name_str, f_pid_str, f_prot_str, f_fam_str, f_type_str, f_uid_str
+global f_name, f_pid, f_prot, f_fam, f_type, f_uid
+
+probe begin
+{
+	# If no filters specified, skip filter processing
+	if ('$FILTER' == 0) next
+
+	f_name_str   = "'$F_NAMESTR'"
+	f_pid_str    = "'$F_PIDSTR'"
+	f_prot_str   = "'$F_PROTSTR'"
+	f_fam_str    = "'$F_FAMSTR'"
+	f_type_str   = "'$F_TYPESTR'"
+	f_uid_str    = "'$F_UIDSTR'"
+
+	delim = "'$DELIM'"
+	error = 0
+
+	# Protocols
+	if ('$F_PROT') {
+		prot = tokenize(f_prot_str, delim)
+		while (prot != "") {
+			p = sock_prot_str2num(prot)
+			if (p < 0) {
+				printf("ERROR: Unknown protocol: %s\n", prot)
+				error++
+			} else
+				f_prot[p] = 1
+			prot = tokenize("", delim)
+		}
+	}
+
+	# Protocol families
+	if ('$F_FAM') {
+		fam = tokenize(f_fam_str, delim)
+		while (fam != "") {
+			f = sock_fam_str2num(fam)
+			if (f < 0) {
+				printf("ERROR: Unknown protocol family: %s\n", fam)
+				error++
+			} else
+				f_fam[f] = 1
+			fam = tokenize("", delim)
+		}
+	}
+
+	# Process names
+	if ('$F_NAME') {
+		pname = tokenize(f_name_str, delim)
+		while (pname != "") {
+			f_name[pname] = 1
+			pname = tokenize("", delim)
+		}
+	}
+
+	# Process IDs
+	if ('$F_PID') {
+		pid = tokenize(f_pid_str, delim)
+		while (pid != "") {
+			f_pid[strtol(pid, 10)] = 1
+			pid = tokenize("", delim)
+		}
+	}
+
+	# Socket types
+	if ('$F_TYPE') {
+		stype = tokenize(f_type_str, delim)
+		while (stype != "") {
+			t = sock_type_str2num(stype)
+			if (t < 0) {
+				printf("ERROR: Unknown socket type: %s\n", stype)
+				error++
+			} else
+				f_type[t] = 1
+			stype = tokenize("", delim)
+		}
+	}
+
+	# User IDs
+	if ('$F_UID') {
+		uid = tokenize(f_uid_str, delim)
+		while (uid != "") {
+			f_uid[strtol(uid, 10)] = 1
+			uid = tokenize("", delim)
+		}
+	}
+
+	if (error) exit()
+}
+
+probe netdev.transmit
+{
+	if ('$P_DEVICES') {
+		if_tx[dev_name] <<< length
+		if_dev[dev_name] ++
+	}
+}
+
+probe netdev.receive
+{
+	if ('$P_DEVICES') {
+		if_rx[dev_name] <<< length
+		if_dev[dev_name] ++
+	}
+}
+
+probe socket.send
+{
+	if (!success) next
+
+	pid = pid()
+	uid = uid()
+	ename = execname()
+
+	# Check filters
+	if ('$FILTER') {
+		if ('$F_PROT' && !(protocol in f_prot)) next
+		if ('$F_FAM'  && !(family   in f_fam))  next
+		if ('$F_PID'  && !(pid      in f_pid))  next
+		if ('$F_NAME' && !(ename    in f_name)) next
+		if ('$F_UID'  && !(uid      in f_uid))  next
+		if ('$F_TYPE' && !(type     in f_type)) next
+	}
+
+	execname[pid] = ename
+	user[pid] = uid
+	sk_tx[pid, protocol, family] <<< size
+	sk_pid[pid, protocol, family] += size
+}
+
+probe socket.receive
+{
+	if (!success) next
+
+	pid = pid()
+	uid = uid()
+	ename = execname()
+
+	# Check filters
+	if ('$FILTER') {
+		if ('$F_PROT' && !(protocol in f_prot)) next
+		if ('$F_FAM'  && !(family   in f_fam))  next
+		if ('$F_PID'  && !(pid      in f_pid))  next
+		if ('$F_NAME' && !(ename    in f_name)) next
+		if ('$F_UID'  && !(uid      in f_uid))  next
+		if ('$F_TYPE' && !(type     in f_type)) next
+	}
+
+	execname[pid] = ename
+	user[pid] = uid
+	sk_rx[pid, protocol, family] <<< size
+	sk_pid[pid, protocol, family] += size
+}
+
+function print_activity()
+{
+	# Print top processes
+	max = '$P_NUMTOP'
+	time = gettimeofday_s() + '$TZ_ADJUST'
+
+	printf("======================= %s ========================\n", ctime(time))
+	printf("------------------------------- PROCESSES -------------------------------\n")
+	printf("%-5s %-5s %7s %7s %7s %7s %-4s %-8s %-15s\n",
+	       "PID", "UID", "#SEND", "#RECV", "SEND_KB",
+	       "RECV_KB", "PROT", "FAMILY", "COMMAND")
+	foreach ([pid, prot, fam] in sk_pid- limit max) {
+		n_sk_tx = @count(sk_tx[pid, prot, fam])
+		n_sk_rx = @count(sk_rx[pid, prot, fam])
+		printf("%-5d %-5d %7d %7d %7d %7d %-4s %-8s %-15s\n",
+		       pid, user[pid], n_sk_tx, n_sk_rx,
+		       n_sk_tx ? @sum(sk_tx[pid, prot, fam])/1024 : 0,
+		       n_sk_rx ? @sum(sk_rx[pid, prot, fam])/1024 : 0,
+		       sock_prot_num2str(prot), sock_fam_num2str(fam),
+		       execname[pid])
+	}
+
+	# Print top network devices
+	if ('$P_DEVICES') {
+		max = '$P_NUMTOP'
+		printf("-------------------------------- DEVICES --------------------------------\n")
+		printf("%-7s %13s %13s %15s %15s\n",
+		       "DEV", "#XMIT", "#RECV", "XMIT_KB", "RECV_KB")
+		foreach ([dev] in if_dev- limit max) {
+			n_if_tx = @count(if_tx[dev])
+			n_if_rx = @count(if_rx[dev])
+			printf("%-7s %13d %13d %15d %15d\n", dev, n_if_tx, n_if_rx,
+			       n_if_tx ? @sum(if_tx[dev])/1024 : 0,
+			       n_if_rx ? @sum(if_rx[dev])/1024 : 0)
+		}
+	}
+	
+	printf("=========================================================================\n\n")
+
+	delete execname
+	delete user
+	delete sk_tx
+	delete sk_rx
+	delete sk_pid
+	delete if_tx
+	delete if_rx
+	delete if_dev
+}
+
+
+probe timer.s('$P_INTERVAL')
+{
+	print_activity()
+}
+'
diff --git a/stap_tutorial-1.0/examples/tapset/fs.stp b/stap_tutorial-1.0/examples/tapset/fs.stp
new file mode 100644
index 0000000..1ed9afa
--- /dev/null
+++ b/stap_tutorial-1.0/examples/tapset/fs.stp
@@ -0,0 +1,27 @@
+
+probe fs.read.return = kernel.function("vfs_read").return {
+	bytes = ($return > 0 ? $return : 0)
+}
+
+probe fs.write.return = kernel.function("vfs_write").return {
+	bytes = ($return > 0 ? $return : 0)
+}
+
+function file2name:string(filep:long) 
+%{
+	char *start = NULL, buf[MAXSTRINGLEN];
+	struct dentry *dentry = NULL;
+	struct vfsmount *mnt = NULL;
+	struct file *file = (struct file *)(long) kread(&(THIS->filep));
+
+	if (file) {
+		mnt = (struct vfsmount *) kread(&(file->f_path.mnt));
+		dentry = (struct dentry *) kread(&(file->f_path.dentry));
+	}
+	if (mnt && dentry)
+		start = d_path(dentry, mnt, buf, MAXSTRINGLEN);
+	if (start > 0)
+		strlcpy(THIS->__retvalue, start, MAXSTRINGLEN);
+
+	CATCH_DEREF_FAULT();
+%}
diff --git a/stap_tutorial-1.0/examples/top-cs.stp b/stap_tutorial-1.0/examples/top-cs.stp
new file mode 100755
index 0000000..efe5769
--- /dev/null
+++ b/stap_tutorial-1.0/examples/top-cs.stp
@@ -0,0 +1,29 @@
+#!/usr/bin/env stap 
+#
+# Continuously list the top context switchers  
+#
+
+global processes
+
+probe begin {
+	printf("Collecting data...\n")
+}
+
+function print_top () {
+	printf("Process\t\t\t\tCount\n")
+	printf("--------------------------------------\n")
+	foreach (name in processes- limit 20)
+		printf("%-20s\t\t%5d\n",name, processes[name])
+	printf("--------------------------------------\n\n")
+	delete processes
+}
+
+probe scheduler.cpu_on {
+	processes[execname()]++
+}
+
+# print top context switchers every 10 seconds
+probe timer.s(10) {
+	print_top ()
+}
+
diff --git a/stap_tutorial-1.0/examples/top-ext3calls.stp b/stap_tutorial-1.0/examples/top-ext3calls.stp
new file mode 100755
index 0000000..039e6a1
--- /dev/null
+++ b/stap_tutorial-1.0/examples/top-ext3calls.stp
@@ -0,0 +1,19 @@
+#!/usr/bin/env stap
+
+global ext3calls
+
+probe begin {
+	printf("Collecting data...\n")
+}
+
+probe kernel.function("*@fs/ext3") ?,
+      module("ext3").function("*@fs/ext3/*") ?
+{
+	ext3calls[probefunc()]++
+}
+
+probe end {
+        foreach (name in ext3calls- limit 20)
+                printf("%10d %s\n", ext3calls[name], name)
+}
+
diff --git a/stap_tutorial-1.0/examples/top-syscalls.stp b/stap_tutorial-1.0/examples/top-syscalls.stp
new file mode 100755
index 0000000..a5288c6
--- /dev/null
+++ b/stap_tutorial-1.0/examples/top-syscalls.stp
@@ -0,0 +1,16 @@
+#!/usr/bin/env stap
+
+global syscalls
+
+probe begin {
+	printf("Collecting data...\n")
+}
+
+probe syscall.* {
+	syscalls[name]++
+}
+
+probe end {
+	foreach (name in syscalls- limit 10)
+		printf("%10d %s\n", syscalls[name], name)
+}
diff --git a/stap_tutorial-1.0/tapset/socket.stp b/stap_tutorial-1.0/tapset/socket.stp
new file mode 100644
index 0000000..9591408
--- /dev/null
+++ b/stap_tutorial-1.0/tapset/socket.stp
@@ -0,0 +1,1131 @@
+// Socket tapset
+// Copyright (C) 2006 IBM Corp.
+//
+// This file is part of systemtap, and is free software.  You can
+// redistribute it and/or modify it under the terms of the GNU General
+// Public License (GPL); either version 2, or (at your option) any
+// later version.
+
+%{
+#include <net/sock.h>
+#include <asm/bitops.h>
+%}
+
+#################
+# PROBE ALIASES #
+#################
+
+### GENERAL SEND/RECEIVE PROBES ###
+
+/*
+ * probe socket.send
+ *
+ * Fires when a message is sent on a socket.
+ *
+ * Context:
+ *  The message sender
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message sent (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was send successful? (1 = yes, 0 = no)
+ */
+probe socket.send = socket.sendmsg.return,
+%( kernel_v < "2.6.19" %?
+                    socket.writev.return,
+%)
+                    socket.aio_write.return
+{
+	name = "socket.send"
+}
+
+/*
+ * probe socket.receive
+ *
+ * Fires when a message is received on a socket.
+ *
+ * Context:
+ *  The message receiver
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message received (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was send successful? (1 = yes, 0 = no)
+ */
+probe socket.receive = socket.recvmsg.return,
+%( kernel_v < "2.6.19" %?
+                       socket.readv.return,
+%)
+                       socket.aio_read.return
+{
+	name = "socket.receive"
+}
+
+### FUNCTION SPECIFIC SEND/RECEIVE PROBES ###
+
+/*
+ * probe socket.sendmsg
+ *
+ * Fires at the beginning of sending a message on a socket
+ * via the the sock_sendmsg() function
+ *
+ * Context:
+ *  The message sender
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Message size in bytes
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.sendmsg = kernel.function ("sock_sendmsg")
+{
+	name = "socket.sendmsg"
+	size = $size
+	protocol = $sock->sk->sk_protocol
+	family = $sock->ops->family
+	state = $sock->state
+	flags = $sock->flags
+	type = $sock->type
+}
+
+/*
+ * probe socket.sendmsg.return
+ *
+ * Fires at the conclusion of sending a message on a socket
+ * via the sock_sendmsg() function
+ *
+ * Context:
+ *  The message sender.
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message sent (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was send successful? (1 = yes, 0 = no)
+ */
+probe socket.sendmsg.return = kernel.function ("sock_sendmsg").return
+{
+	name = "socket.sendmsg.return"
+	size = $return
+	protocol = $sock->sk->sk_protocol
+	family = $sock->ops->family
+	state = $sock->state
+	flags = $sock->flags
+	type = $sock->type
+	success = _success_check($return)
+}
+
+/*
+ * probe socket.recvmsg
+ *
+ * Fires at the beginning of receiving a message on a socket
+ * via the sock_recvmsg() function
+ *
+ * Context:
+ *  The message receiver.
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Message size in bytes
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.recvmsg = kernel.function ("sock_recvmsg")
+{
+	name = "socket.recvmsg"
+	size = $size
+	protocol = $sock->sk->sk_protocol
+	family = $sock->ops->family
+	state = $sock->state
+	flags = $sock->flags
+	type = $sock->type
+}
+
+/*
+ * probe socket.recvmsg.return
+ *
+ * Fires at the conclusion of receiving a message on a socket
+ * via the sock_recvmsg() function.
+ *
+ * Context:
+ *  The message receiver.
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message received (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was receive successful? (1 = yes, 0 = no)
+ */
+probe socket.recvmsg.return = kernel.function ("sock_recvmsg").return
+{
+	name = "socket.recvmsg.return"
+	size = $return
+	protocol = $sock->sk->sk_protocol
+	family = $sock->ops->family
+	state = $sock->state
+	flags = $sock->flags
+	type = $sock->type
+	success = _success_check($return)
+}
+
+/*
+ * probe socket.aio_write
+ *
+ * Fires at the beginning of sending a message on a socket
+ * via the sock_aio_write() function
+ *
+ * Context:
+ *  The message sender
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Message size in bytes
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.aio_write = kernel.function ("sock_aio_write")
+{
+	name = "socket.aio_write"
+	_sock = _get_sock_addr ($iocb->ki_filp)
+	size = _get_sock_size ($iov, $nr_segs)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+}
+
+/*
+ * probe socket.aio_write.return
+ * 
+ * Fires at the conclusion of sending a message on a socket
+ * via the sock_aio_write() function
+ *
+ * Context:
+ *  The message receiver.
+ *
+ * Variables: 
+ *  name      Name of this probe
+ *  size      Size of message received (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was receive successful? (1 = yes, 0 = no)
+ */
+probe socket.aio_write.return = kernel.function ("sock_aio_write").return
+{
+	name = "socket.aio_write.return"
+	size = $return
+	_sock = _get_sock_addr ($iocb->ki_filp)
+	size = _get_sock_size ($iov, $nr_segs)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+	success = _success_check($return)
+}
+
+/*
+ * probe socket.aio_read
+ *
+ * Fires at the beginning of receiving a message on a socket
+ * via the sock_aio_read() function
+ *
+ * Context:
+ *  The message sender
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Message size in bytes
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.aio_read = kernel.function ("sock_aio_read")
+{
+	name = "socket.aio_read"
+	_sock = _get_sock_addr ($iocb->ki_filp)
+	size = _get_sock_size ($iov, $nr_segs)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+}
+
+/*
+ * probe socket.aio_read.return
+ * 
+ * Fires at the conclusion of receiving a message on a socket
+ * via the sock_aio_read() function
+ *
+ * Context:
+ *  The message receiver.
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message received (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was receive successful? (1 = yes, 0 = no)
+ */
+probe socket.aio_read.return = kernel.function ("sock_aio_read").return
+{
+	name = "socket.aio_read.return"
+	size = $return
+	_sock = _get_sock_addr ($iocb->ki_filp)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+	success = _success_check($return)
+}
+
+// readv and writev were removed in 2.6.19
+%( kernel_v < "2.6.19" %?
+/*
+ * probe socket.writev
+ *
+ * Fires at the beginning of sending a message on a socket
+ * via the sock_writev() function
+ *
+ * Context:
+ *  The message sender
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Message size in bytes
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.writev = kernel.function ("sock_writev")
+{
+	name = "socket.writev"
+	_sock = _get_sock_addr ($file)
+	size = _get_sock_size ($iov, $nr_segs)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+}
+
+/*
+ * probe socket.writev.return
+ *
+ * Fires at the conclusion of sending a message on a socket
+ * via the sock_writev() function
+ *
+ * Context:
+ *  The message receiver.
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message sent (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was send successful? (1 = yes, 0 = no)
+ */
+probe socket.writev.return = kernel.function ("sock_writev").return
+{
+	name = "socket.writev.return"
+	size = $return
+	_sock = _get_sock_addr ($file)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+	success = _success_check($return)
+}
+
+/*
+ * probe socket.readv
+ *
+ * Fires at the beginning of receiving a message on a socket
+ * via the sock_readv() function
+ *
+ * Context:
+ *  The message sender
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Message size in bytes
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.readv = kernel.function ("sock_readv")
+{
+	name = "socket.readv"
+	_sock = _get_sock_addr ($file)
+	size = _get_sock_size ($iov, $nr_segs)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+}
+
+/*
+ * probe socket.readv.return
+ *
+ * Fires at the conclusion of receiving a message on a socket
+ * via the sock_readv() function
+ *
+ * Context:
+ *  The message receiver.
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  size      Size of message received (in bytes) or
+ *            error code if success = 0
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ *  success   Was receive successful? (1 = yes, 0 = no)
+ */
+probe socket.readv.return = kernel.function ("sock_readv").return
+{
+	name = "socket.readv.return"
+	size = $return
+	_sock = _get_sock_addr ($file)
+	protocol = _sock_prot_num (_sock)
+	family = _sock_fam_num (_sock)
+	state = _sock_state_num (_sock)
+	flags = _sock_flags_num (_sock)
+	type = _sock_type_num (_sock)
+	success = _success_check($return)
+}
+%)
+
+/*
+ * probe socket.create
+ *
+ * Fires at the beginning of creating a socket.
+ *
+ * Context:
+ *  The requester (see requester variable)
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  type      Socket type value
+ *  requester Requested by user process or the kernel (1 = kernel, 0 = user)
+ */
+probe socket.create = kernel.function("__sock_create")
+{
+	name = "socket.create"
+	protocol = $protocol
+	family = $family
+	type = $type
+	requester =$kern
+}
+
+/*
+ * probe socket.create.return
+ *
+ * Fires at the conclusion of creating a socket.
+ *
+ * Context:
+ *  The requester (user process or kernel)
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  type      Socket type value
+ *  requester Requested by user process or the kernel (1 = kernel, 0 = user)
+ *  err       Error code if success == 0
+ *  success   Was socket creation successful? (1 = yes, 0 = no)
+ */
+probe socket.create.return = kernel.function("__sock_create").return
+{
+	name = "socket.create.return"
+	protocol = $protocol
+	family = $family
+	type = $type
+	requester =$kern
+	err = $return
+	success = _success_check($return)
+}
+
+/*
+ * probe socket.close
+ *
+ * Fires at the beginning of closing a socket.
+ *
+ * Context:
+ *  The requester (user process or kernel)
+ *
+ * Variables:
+ *  name      Name of this probe
+ *  protocol  Protocol value
+ *  family    Protocol family value
+ *  state     Socket state value
+ *  flags     Socket flags value
+ *  type      Socket type value
+ */
+probe socket.close = kernel.function ("sock_release")
+{
+	name = "socket.close"
+	protocol = $sock->sk->sk_protocol
+	family = $sock->ops->family
+	state = $sock->state
+	flags = $sock->flags
+	type = $sock->type
+}
+
+/*
+ * probe socket.close.return
+ *
+ * Fires at the conclusion of closing a socket.
+ *
+ * Context:
+ *  The requester (user process or kernel)
+ */
+probe socket.close.return = kernel.function ("sock_release").return
+{
+	name = "socket.close.return"
+	/* void return */
+}
+
+
+##################
+# USER FUNCTIONS #
+##################
+
+####### PROTOCOL HELPER FUNCTIONS ########
+
+/*
+ * sock_prot_num2str
+ * Given a protocol number, return a string representation.
+ */
+function sock_prot_num2str:string (proto:long)
+{
+	return (proto in _prot_num2str ? _prot_num2str[proto] : "UNDEF")
+}
+
+/*
+ * sock_prot_str2num
+ * Given a protocol name (string), return the corresponding protocol number.
+ */
+function sock_prot_str2num:long (proto:string)
+{
+	return (proto in _prot_str2num ? _prot_str2num[proto] : -1)
+}
+
+######### PROTOCOL FAMILY HELPER FUNCTIONS ###########
+
+/*
+ * sock_fam_num2str
+ * Given a protocol family number, return a string representation.
+ */
+function sock_fam_num2str:string (family:long)
+{
+	return (family in _fam_num2str ? _fam_num2str[family] : "UNDEF")
+}
+
+/*
+ * sock_fam_str2num
+ * Given a protocol family name (string), return the corresponding
+ * protocol family number.
+ */
+function sock_fam_str2num:long (family:string)
+{
+	return (family in _fam_str2num ? _fam_str2num[family] : -1)
+}
+
+######### SOCKET STATE HELPER FUNCTIONS ##########
+
+/*
+ * sock_state_num2str
+ * Given a socket state number, return a string representation.
+ */
+function sock_state_num2str:string (state:long)
+{
+	return (state in _state_num2str ? _state_num2str[state] : "UNDEF")
+}
+
+/*
+ * sock_state_str2num
+ * Given a socket state string, return the corresponding state number.
+ */
+function sock_state_str2num:long (state:string)
+{
+	return (state in _state_str2num ? _state_str2num[state] : -1)
+}
+
+######## SOCKET TYPE HELPER FUNCTIONS ########
+
+function sock_type_num2str:string (type:long)
+{
+	return (type in _type_num2str ? _type_num2str[type] : "UNDEF")
+}
+
+function sock_type_str2num:long (type:string)
+{
+	return (type in _type_str2num ? _type_str2num[type] : -1)
+}
+
+######### SOCKET FLAGS HELPER FUNCTIONS #########
+
+function sock_flags_num2str:string (flags:long)
+%{
+#ifndef SOCK_PASSSEC
+#define SOCK_PASSSEC 4   /* introduced in 2.6.18 */
+#endif
+	char str[60];
+	unsigned long flags = THIS->flags;
+
+	str[0] = '\0';
+	if (test_bit (SOCK_ASYNC_NOSPACE, &flags))
+		strcat (str, "ASYNC_NOSPACE|");
+	if (test_bit (SOCK_ASYNC_WAITDATA, &flags))
+		strcat (str, "ASYNC_WAITDATA|");
+	if (test_bit (SOCK_NOSPACE, &flags))
+		strcat (str, "NOSPACE|");
+	if (test_bit (SOCK_PASSCRED, &flags))
+		strcat (str, "PASSCRED|");
+	if (test_bit (SOCK_PASSSEC, &flags))
+		strcat (str, "PASSSEC|");
+	if (str[0] != '\0') str[strlen(str)-1] = '\0';
+	strlcpy (THIS->__retvalue, str, MAXSTRINGLEN);
+%}
+
+######### MESSAGE FLAGS HELPER FUNCTIONS #########
+
+function msg_flags_num2str:string (flags:long)
+%{
+	char str[256];
+
+	str[0] = '\0';
+
+	if (THIS->flags & MSG_OOB) strcat (str, "OOB|");
+	if (THIS->flags & MSG_PEEK) strcat (str, "PEEK|");
+	if (THIS->flags & MSG_DONTROUTE) strcat (str, "DONTROUTE|");
+	if (THIS->flags & MSG_TRYHARD) strcat (str, "TRYHARD|");
+	if (THIS->flags & MSG_CTRUNC) strcat (str, "CTRUNC|");
+	if (THIS->flags & MSG_PROBE) strcat (str, "PROBE|");
+	if (THIS->flags & MSG_TRUNC) strcat (str, "TRUNC|");
+	if (THIS->flags & MSG_DONTWAIT) strcat (str, "DONTWAIT|");
+	if (THIS->flags & MSG_EOR) strcat (str, "EOR|");
+	if (THIS->flags & MSG_WAITALL) strcat (str, "WAITALL|");
+	if (THIS->flags & MSG_FIN) strcat (str, "FIN|");
+	if (THIS->flags & MSG_SYN) strcat (str, "SYN|");
+	if (THIS->flags & MSG_CONFIRM) strcat (str, "CONFIRM|");
+	if (THIS->flags & MSG_RST) strcat (str, "RST|");
+	if (THIS->flags & MSG_ERRQUEUE) strcat (str, "ERRQUEUE|");
+	if (THIS->flags & MSG_NOSIGNAL) strcat (str, "NOSIGNAL|");
+	if (THIS->flags & MSG_MORE) strcat (str, "MORE|");
+
+	if (str[0] != '\0') str[strlen(str)-1] = '\0';
+	strlcpy (THIS->__retvalue, str, MAXSTRINGLEN);
+%}
+
+###########################
+# INTERNAL MAPPING ARRAYS #
+###########################
+
+global _prot_num2str[134], _prot_str2num[134]
+global _fam_num2str[32],   _fam_str2num[32]
+global _state_num2str[5],  _state_str2num[5]
+global _type_num2str[11],  _type_str2num[11]
+
+probe begin(-1001)
+{
+	/* From /etc/protocols.
+	 * Many of these protocols aren't currently used over
+	 * sockets, but are included for completeness 
+	 */
+	_prot_num2str[0] = "IP"
+	_prot_num2str[1] = "ICMP"
+	_prot_num2str[2] = "IGMP"
+	_prot_num2str[3] = "GGP"
+	_prot_num2str[4] = "IPENCAP"
+	_prot_num2str[5] = "ST"
+	_prot_num2str[6] = "TCP"
+	_prot_num2str[7] = "CBT"
+	_prot_num2str[8] = "EGP"
+	_prot_num2str[9] = "IGP"
+	_prot_num2str[10] = "BBN-RCC"
+	_prot_num2str[11] = "NVP"
+	_prot_num2str[12] = "PUP"
+	_prot_num2str[13] = "ARGUS"
+	_prot_num2str[14] = "EMCON"
+	_prot_num2str[15] = "XNET"
+	_prot_num2str[16] = "CHAOS"
+	_prot_num2str[17] = "UDP"
+	_prot_num2str[18] = "MUX"
+	_prot_num2str[19] = "DCN"
+	_prot_num2str[20] = "HMP"
+	_prot_num2str[21] = "PRM"
+	_prot_num2str[22] = "XNS-IDP"
+	_prot_num2str[23] = "TRUNK-1"
+	_prot_num2str[24] = "TRUNK-2"
+	_prot_num2str[25] = "LEAF-1"
+	_prot_num2str[26] = "LEAF-2"
+	_prot_num2str[27] = "RDP"
+	_prot_num2str[28] = "IRTP"
+	_prot_num2str[29] = "ISO-TP4"
+	_prot_num2str[30] = "NETBLT"
+	_prot_num2str[31] = "MFE-NSP"
+	_prot_num2str[32] = "MERIT-INP"
+	_prot_num2str[33] = "SEP"
+	_prot_num2str[34] = "3PC"
+	_prot_num2str[35] = "IDPR"
+	_prot_num2str[36] = "XTP"
+	_prot_num2str[37] = "DDP"
+	_prot_num2str[38] = "IDPR-CMTP"
+	_prot_num2str[39] = "TP++"
+	_prot_num2str[40] = "IL"
+	_prot_num2str[41] = "IPV6"
+	_prot_num2str[42] = "SDRP"
+	_prot_num2str[43] = "IPV6-ROUTE"
+	_prot_num2str[44] = "IPV6-FRAG"
+	_prot_num2str[45] = "IDRP"
+	_prot_num2str[46] = "RSVP"
+	_prot_num2str[47] = "GRE"
+	_prot_num2str[48] = "MHRP"
+	_prot_num2str[49] = "BNA"
+	_prot_num2str[50] = "IPV6-CRYPT"
+	_prot_num2str[51] = "IPV6-AUTH"
+	_prot_num2str[52] = "I-NLSP"
+	_prot_num2str[53] = "SWIPE"
+	_prot_num2str[54] = "NARP"
+	_prot_num2str[55] = "MOBILE"
+	_prot_num2str[56] = "TLSP"
+	_prot_num2str[57] = "SKIP"
+	_prot_num2str[58] = "IPV6-ICMP"
+	_prot_num2str[59] = "IPV6-NONXT"
+	_prot_num2str[60] = "IPV6-OPTS"
+	_prot_num2str[62] = "CFTP"
+	_prot_num2str[64] = "SAT-EXPAK"
+	_prot_num2str[65] = "KRYPTOLAN"
+	_prot_num2str[66] = "RVD"
+	_prot_num2str[67] = "IPPC"
+	_prot_num2str[69] = "SAT-MON"
+	_prot_num2str[70] = "VISA"
+	_prot_num2str[71] = "IPCV"
+	_prot_num2str[72] = "CPNX"
+	_prot_num2str[73] = "CPHB"
+	_prot_num2str[74] = "WSN"
+	_prot_num2str[75] = "PVP"
+	_prot_num2str[76] = "BR-SAT-MON"
+	_prot_num2str[77] = "SUN-ND"
+	_prot_num2str[78] = "WB-MON"
+	_prot_num2str[79] = "WB-EXPAK"
+	_prot_num2str[80] = "ISO-IP"
+	_prot_num2str[81] = "VMTP"
+	_prot_num2str[82] = "SECURE-VMTP"
+	_prot_num2str[83] = "VINES"
+	_prot_num2str[84] = "TTP"
+	_prot_num2str[85] = "NSFNET-IGP"
+	_prot_num2str[86] = "DGP"
+	_prot_num2str[87] = "TCF"
+	_prot_num2str[88] = "EIGRP"
+	_prot_num2str[89] = "OSPF"
+	_prot_num2str[90] = "SPRITE-RPC"
+	_prot_num2str[91] = "LARP"
+	_prot_num2str[92] = "MTP"
+	_prot_num2str[93] = "AX.25"
+	_prot_num2str[94] = "IPIP"
+	_prot_num2str[95] = "MICP"
+	_prot_num2str[96] = "SCC-SP"
+	_prot_num2str[97] = "ETHERIP"
+	_prot_num2str[98] = "ENCAP"
+	_prot_num2str[100] = "GMTP"
+	_prot_num2str[101] = "IFMP"
+	_prot_num2str[102] = "PNNI"
+	_prot_num2str[103] = "PIM"
+	_prot_num2str[104] = "ARIS"
+	_prot_num2str[105] = "SCPS"
+	_prot_num2str[106] = "QNX"
+	_prot_num2str[107] = "A/N"
+	_prot_num2str[108] = "IPCOMP"
+	_prot_num2str[109] = "SNP"
+	_prot_num2str[110] = "COMPAQ-PEER"
+	_prot_num2str[111] = "IPX-IN-IP"
+	_prot_num2str[112] = "VRRP"
+	_prot_num2str[113] = "PGM"
+	_prot_num2str[115] = "L2TP"
+	_prot_num2str[116] = "DDX"
+	_prot_num2str[117] = "IATP"
+	_prot_num2str[118] = "STP"
+	_prot_num2str[119] = "SRP"
+	_prot_num2str[120] = "UTI"
+	_prot_num2str[121] = "SMP"
+	_prot_num2str[122] = "SM"
+	_prot_num2str[123] = "PTP"
+	_prot_num2str[124] = "ISIS"
+	_prot_num2str[125] = "FIRE"
+	_prot_num2str[126] = "CRTP"
+	_prot_num2str[127] = "CRDUP"
+	_prot_num2str[128] = "SSCOPMCE"
+	_prot_num2str[129] = "IPLT"
+	_prot_num2str[130] = "SPS"
+	_prot_num2str[131] = "PIPE"
+	_prot_num2str[132] = "SCTP"
+	_prot_num2str[133] = "FC"
+
+	_prot_str2num["IP"]          = 0
+	_prot_str2num["ICMP"]        = 1
+	_prot_str2num["IGMP"]        = 2
+	_prot_str2num["GGP"]         = 3
+	_prot_str2num["IPENCAP"]     = 4
+	_prot_str2num["ST"]          = 5
+	_prot_str2num["TCP"]         = 6
+	_prot_str2num["CBT"]         = 7
+	_prot_str2num["EGP"]         = 8
+	_prot_str2num["IGP"]         = 9
+	_prot_str2num["BBN-RCC"]     = 10
+	_prot_str2num["NVP"]         = 11
+	_prot_str2num["PUP"]         = 12
+	_prot_str2num["ARGUS"]       = 13
+	_prot_str2num["EMCON"]       = 14
+	_prot_str2num["XNET"]        = 15
+	_prot_str2num["CHAOS"]       = 16
+	_prot_str2num["UDP"]         = 17
+	_prot_str2num["MUX"]         = 18
+	_prot_str2num["DCN"]         = 19
+	_prot_str2num["HMP"]         = 20
+	_prot_str2num["PRM"]         = 21
+	_prot_str2num["XNS-IDP"]     = 22
+	_prot_str2num["TRUNK-1"]     = 23
+	_prot_str2num["TRUNK-2"]     = 24
+	_prot_str2num["LEAF-1"]      = 25
+	_prot_str2num["LEAF-2"]      = 26
+	_prot_str2num["RDP"]         = 27
+	_prot_str2num["IRTP"]        = 28
+	_prot_str2num["ISO-TP4"]     = 29
+	_prot_str2num["NETBLT"]      = 30
+	_prot_str2num["MFE-NSP"]     = 31
+	_prot_str2num["MERIT-INP"]   = 32
+	_prot_str2num["SEP"]         = 33
+	_prot_str2num["3PC"]         = 34
+	_prot_str2num["IDPR"]        = 35
+	_prot_str2num["XTP"]         = 36
+	_prot_str2num["DDP"]         = 37
+	_prot_str2num["IDPR-CMTP"]   = 38
+	_prot_str2num["TP++"]        = 39
+	_prot_str2num["IL"]          = 40
+	_prot_str2num["IPV6"]        = 41
+	_prot_str2num["SDRP"]        = 42
+	_prot_str2num["IPV6-ROUTE"]  = 43
+	_prot_str2num["IPV6-FRAG"]   = 44
+	_prot_str2num["IDRP"]        = 45
+	_prot_str2num["RSVP"]        = 46
+	_prot_str2num["GRE"]         = 47
+	_prot_str2num["MHRP"]        = 48
+	_prot_str2num["BNA"]         = 49
+	_prot_str2num["IPV6-CRYPT"]  = 50
+	_prot_str2num["IPV6-AUTH"]   = 51
+	_prot_str2num["I-NLSP"]      = 52
+	_prot_str2num["SWIPE"]       = 53
+	_prot_str2num["NARP"]        = 54
+	_prot_str2num["MOBILE"]      = 55
+	_prot_str2num["TLSP"]        = 56
+	_prot_str2num["SKIP"]        = 57
+	_prot_str2num["IPV6-ICMP"]   = 58
+	_prot_str2num["IPV6-NONXT"]  = 59
+	_prot_str2num["IPV6-OPTS"]   = 60
+	_prot_str2num["CFTP"]        = 62
+	_prot_str2num["SAT-EXPAK"]   = 64
+	_prot_str2num["KRYPTOLAN"]   = 65
+	_prot_str2num["RVD"]         = 66
+	_prot_str2num["IPPC"]        = 67
+	_prot_str2num["SAT-MON"]     = 69
+	_prot_str2num["VISA"]        = 70
+	_prot_str2num["IPCV"]        = 71
+	_prot_str2num["CPNX"]        = 72
+	_prot_str2num["CPHB"]        = 73
+	_prot_str2num["WSN"]         = 74
+	_prot_str2num["PVP"]         = 75
+	_prot_str2num["BR-SAT-MON"]  = 76
+	_prot_str2num["SUN-ND"]      = 77
+	_prot_str2num["WB-MON"]      = 78
+	_prot_str2num["WB-EXPAK"]    = 79
+	_prot_str2num["ISO-IP"]      = 80
+	_prot_str2num["VMTP"]        = 81
+	_prot_str2num["SECURE-VMTP"] = 82
+	_prot_str2num["VINES"]       = 83
+	_prot_str2num["TTP"]         = 84
+	_prot_str2num["NSFNET-IGP"]  = 85
+	_prot_str2num["DGP"]         = 86
+	_prot_str2num["TCF"]         = 87
+	_prot_str2num["EIGRP"]       = 88
+	_prot_str2num["OSPF"]        = 89
+	_prot_str2num["SPRITE-RPC"]  = 90
+	_prot_str2num["LARP"]        = 91
+	_prot_str2num["MTP"]         = 92
+	_prot_str2num["AX.25"]       = 93
+	_prot_str2num["IPIP"]        = 94
+	_prot_str2num["MICP"]        = 95
+	_prot_str2num["SCC-SP"]      = 96
+	_prot_str2num["ETHERIP"]     = 97
+	_prot_str2num["ENCAP"]       = 98
+	_prot_str2num["GMTP"]        = 100
+	_prot_str2num["IFMP"]        = 101
+	_prot_str2num["PNNI"]        = 102
+	_prot_str2num["PIM"]         = 103
+	_prot_str2num["ARIS"]        = 104
+	_prot_str2num["SCPS"]        = 105
+	_prot_str2num["QNX"]         = 106
+	_prot_str2num["A/N"]         = 107
+	_prot_str2num["IPCOMP"]      = 108
+	_prot_str2num["SNP"]         = 109
+	_prot_str2num["COMPAQ-PEER"] = 110
+	_prot_str2num["IPX-IN-IP"]   = 111
+	_prot_str2num["VRRP"]        = 112
+	_prot_str2num["PGM"]         = 113
+	_prot_str2num["L2TP"]        = 115
+	_prot_str2num["DDX"]         = 116
+	_prot_str2num["IATP"]        = 117
+	_prot_str2num["STP"]         = 118
+	_prot_str2num["SRP"]         = 119
+	_prot_str2num["UTI"]         = 120
+	_prot_str2num["SMP"]         = 121
+	_prot_str2num["SM"]          = 122
+	_prot_str2num["PTP"]         = 123
+	_prot_str2num["ISIS"]        = 124
+	_prot_str2num["FIRE"]        = 125
+	_prot_str2num["CRTP"]        = 126
+	_prot_str2num["CRDUP"]       = 127
+	_prot_str2num["SSCOPMCE"]    = 128
+	_prot_str2num["IPLT"]        = 129
+	_prot_str2num["SPS"]         = 130
+	_prot_str2num["PIPE"]        = 131
+	_prot_str2num["SCTP"]        = 132
+	_prot_str2num["FC"]          = 133
+
+	/* from include/linux/socket.h */
+	_fam_num2str[0]  = "UNSPEC"
+	_fam_num2str[1]  = "LOCAL"
+	_fam_num2str[2]  = "INET"
+	_fam_num2str[3]  = "AX25"
+	_fam_num2str[4]  = "IPX"
+	_fam_num2str[5]  = "APPLETALK"
+	_fam_num2str[6]  = "NETROM"
+	_fam_num2str[7]  = "BRIDGE"
+	_fam_num2str[8]  = "ATMPVC"
+	_fam_num2str[9]  = "X25"
+	_fam_num2str[10] = "INET6"
+	_fam_num2str[11] = "ROSE"
+	_fam_num2str[12] = "DECNET"
+	_fam_num2str[13] = "NETBEUI"
+	_fam_num2str[14] = "SECURITY"
+	_fam_num2str[15] = "KEY"
+	_fam_num2str[16] = "NETLINK"
+	_fam_num2str[17] = "PACKET"
+	_fam_num2str[18] = "ASH"
+	_fam_num2str[19] = "ECONET"
+	_fam_num2str[20] = "ATMSVC"
+	_fam_num2str[22] = "SNA"
+	_fam_num2str[23] = "IRDA"
+	_fam_num2str[24] = "PPPOX"
+	_fam_num2str[25] = "WANPIPE"
+	_fam_num2str[26] = "LLC"
+	_fam_num2str[30] = "TIPC"
+	_fam_num2str[31] = "BLUETOOTH"
+
+	_fam_str2num["UNSPEC"]    = 0
+	_fam_str2num["LOCAL"]     = 1
+	_fam_str2num["INET"]      = 2
+	_fam_str2num["AX25"]      = 3
+	_fam_str2num["IPX"]       = 4
+	_fam_str2num["APPLETALK"] = 5
+	_fam_str2num["NETROM"]    = 6
+	_fam_str2num["BRIDGE"]    = 7
+	_fam_str2num["ATMPVC"]    = 8
+	_fam_str2num["X25"]       = 9
+	_fam_str2num["INET6"]     = 10
+	_fam_str2num["ROSE"]      = 11
+	_fam_str2num["DECNET"]    = 12
+	_fam_str2num["NETBEUI"]   = 13
+	_fam_str2num["SECURITY"]  = 14
+	_fam_str2num["KEY"]       = 15
+	_fam_str2num["NETLINK"]   = 16
+	_fam_str2num["PACKET"]    = 17
+	_fam_str2num["ASH"]       = 18
+	_fam_str2num["ECONET"]    = 19
+	_fam_str2num["ATMSVC"]    = 20
+	_fam_str2num["SNA"]       = 22
+	_fam_str2num["IRDA"]      = 23
+	_fam_str2num["PPPOX"]     = 24
+	_fam_str2num["WANPIPE"]   = 25
+	_fam_str2num["LLC"]       = 26
+	_fam_str2num["TIPC"]      = 30
+	_fam_str2num["BLUETOOTH"] = 31
+
+	/* from include/linux/net.h */
+	_state_num2str[0] = "FREE"
+	_state_num2str[1] = "UNCONNECTED"
+	_state_num2str[2] = "CONNECTING"
+	_state_num2str[3] = "CONNECTED" 
+	_state_num2str[4] = "DISCONNECTING"
+
+	_state_str2num["FREE"]          = 0
+	_state_str2num["UNCONNECTED"]   = 1
+	_state_str2num["CONNECTING"]    = 2
+	_state_str2num["CONNECTED"]     = 3
+	_state_str2num["DISCONNECTING"] = 4
+
+	/* from include/linux/net.h */
+	_type_num2str[1]  = "STREAM"
+	_type_num2str[2]  = "DGRAM"
+	_type_num2str[3]  = "RAW"
+	_type_num2str[4]  = "RDM"
+	_type_num2str[5]  = "SEQPACKET"
+	_type_num2str[6]  = "DCCP"
+	_type_num2str[10] = "PACKET"
+
+	_type_str2num["STREAM"]    = 1
+	_type_str2num["DGRAM"]     = 2
+	_type_str2num["RAW"]       = 3
+	_type_str2num["RDM"]       = 4
+	_type_str2num["SEQPACKET"] = 5
+	_type_str2num["DCCP"]      = 6
+	_type_str2num["PACKET"]    = 10
+}
+
+######################
+# INTERNAL FUNCTIONS #
+######################
+
+function _success_check(ret:long)
+{
+        return (ret > 0 && ret < 2147483648 ? 1 : 0)
+//	return (ret > 0 ? 1 : 0)
+}
+
+function _get_sock_addr:long (file:long)
+%{
+	struct file *filep = (struct file *)(long)(THIS->file);
+	struct socket *sockp = filep? kread(&(filep->private_data)) : NULL;
+	if (sockp == NULL)
+		THIS->__retvalue = -1;
+	else
+		THIS->__retvalue = (long) sockp;
+	CATCH_DEREF_FAULT();
+%}
+
+function _get_sock_size:long (iov:long, nr_segs:long)
+%{
+	struct iovec *iovp = (struct iovec *)(long)(THIS->iov);
+	if (iovp == NULL)
+		THIS->__retvalue = -1;
+	else {
+		int i;
+		THIS->__retvalue = 0;
+		for (i = 0 ; i < THIS->nr_segs ; i++)
+			THIS->__retvalue += kread(&(iovp[i].iov_len));
+	}
+	CATCH_DEREF_FAULT();
+%}
+
+function _sock_prot_num:long (sock:long)
+%{
+	struct socket *sktp = (struct socket *)(long)(THIS->sock);
+	struct sock *skp = sktp? kread(&(sktp->sk)) : NULL;
+	if (skp == NULL)
+		THIS->__retvalue = -1;
+	else
+		THIS->__retvalue = kread(&(skp->sk_protocol));
+	CATCH_DEREF_FAULT();
+%}
+
+function _sock_fam_num:long (sock:long)
+%{
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	const struct proto_ops *ops = sockp? kread(&(sockp->ops)) : NULL;
+	if (ops == NULL)
+		THIS->__retvalue = -1;
+	else
+		THIS->__retvalue = kread(&(ops->family));
+	CATCH_DEREF_FAULT();
+%}
+
+function _sock_state_num:long (sock:long)
+%{
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	if (sockp == NULL)
+		THIS->__retvalue = -1;
+	else
+		THIS->__retvalue = kread(&(sockp->state));
+	CATCH_DEREF_FAULT();
+%}
+
+function _sock_type_num:long (sock:long)
+%{
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	if (sockp == NULL)
+		THIS->__retvalue = -1;
+	else
+		THIS->__retvalue = kread(&(sockp->type));
+	CATCH_DEREF_FAULT();
+%}
+
+function _sock_flags_num:long (sock:long)
+%{
+	struct socket *sockp = (struct socket *)(long)(THIS->sock);
+	if (sockp == NULL)
+		THIS->__retvalue = -1;
+	else
+		THIS->__retvalue = kread(&(sockp->flags));
+	CATCH_DEREF_FAULT();
+%}