Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found that System.map file contains addresses of symbols. Does it involve system calls? I read that it is only updated when a new kernel is newly compiled.

So does that means that except for a new kernel compilation, these are always stored in the same address?

share|improve this question
up vote 2 down vote accepted

System.map contains a symbol table, i.e. a list of function names in the Linux kernel, with for each function the address at which its code is loaded in memory (the addresses are not physical addresses, they're in the kernel's address space, like any executable symbol table is in the loaded process address space). This isn't limited to system calls (the interfaces exposed to user processes): the file also lists functions that might be called by a loaded module, and even internal functions. The system calls are the symbols whose name begins with sys_.

The addresses are associated to a particular kernel binary (vmlinux, bzImage or other format; the image format doesn't change the addresses, it's just an encoding); they are reproducible for a given kernel source, configuration and compiler. The file is generated by scripts/mksysmap near the end of the kernel build process; it is the output of the nm command.

The file is used mainly for debugging, but it's also read when compiling some third-party modules that use unstable kernel interfaces (unstable as in changing from one version to the next).

share|improve this answer
What does the address there meant actually? – user3539 Jan 10 '11 at 9:54
ps and klogd do use System.map (but not necessarily). – wag Jan 10 '11 at 15:59
@wag: It looks like ps used to need System.map, but no longer does with kernels ≥2.6. – Gilles Jan 10 '11 at 18:57
ok, then it's like lsof which used to consult System.map too. – wag Jan 10 '11 at 19:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.