[plug] System.map

[Bernard Blackham]

On Wed, May 19, 2004 at 11:28:05AM +0000, Senectus - wrote:
> This might seem like a silly question.. but what is the file "System.map" 
> used for ?

It tells various programs on your machine what the addresses of
symbols (functions and variables) are in kernel space. Why would
they need to know? Programs like ps can find out what system call a
process is currently stuck in (see ps -o wchan) - it does this by
looking in /proc/<pid>/stat for the address of the system call, and
then looks that up in System.map. This is why ps often complains
when System.map isn't about or up to date.

If you're doing kernel debugging and you have an Oops, Panic, or
other random part of the kernel that prints out a stack trace,
ksymoops will use System.map to find out in exactly which function
in kernel space that things went awry. If you want to submit an oops
to any kernel hacker, the first thing they'll do is ask you to pass
it through ksymoops. The oops is meaningless otherwise, as the
values are highly dependent on precisely how you compiled your
kernel.  Hence even ksymoops's output is meaningless if your
System.map is not the exact same one for the kernel that generated
the oops.

In short, it's probably not much use in day to day work, but for
debugging, or for finding out where a process is hanging or what
it's doing, it's very useful! You could use strace to do the latter,
but not if you don't own the process ;)

*deep breath*

Hope this sheds some light and hasn't confused you entirely :)

Bernard.

-- 
 Bernard Blackham <bernard at blackham dot com dot au>