System.map contains a symbol table, i.e. a list of function names in the Linux kernel, with for each function the address at which its code is loaded in memory (the addresses are not physical addresses, they're in the kernel's address space, like any executable symbol table is in the loaded process address space). This isn't limited to system calls (the interfaces exposed to user processes): the file also lists functions that might be called by a loaded module, and even internal functions. The system calls are the symbols whose name begins with
The addresses are associated to a particular kernel binary (
bzImage or other format; the image format doesn't change the addresses, it's just an encoding); they are reproducible for a given kernel source, configuration and compiler. The file is generated by
scripts/mksysmap near the end of the kernel build process; it is the output of the
The file is used mainly for debugging, but it's also read when compiling some third-party modules that use unstable kernel interfaces (unstable as in changing from one version to the next).