On Wed, Dec 30, 2015 at 08:04:19PM +0800, hitmoon wrote:

Thank you mike! so ，after the first instruction ，rbp contains the offset of actually loaded address, which equals the physical address.

yes, comment above says that at that point "someone has loaded an identity mapped page table", so it should be equal to the physical address.

$_text - __START_KERNEL_map contains the expected physical address . Right ?

yes, as far as i can tell.