Linus Walleij continues
his exploration of the boot process for the 32-bit Arm kernel.
“BAM! The MMU is on. The next instruction (which is incidentally an
instruction cache flush) will be executed from virtual memory. We don’t
notice anything at first, but we are executing in virtual memory. When we
return by jumping to the address passed in r13, we enter
__mmap_switched at the virtual memory address of this function,
somewhere below PAGE_OFFSET (typically 0xC0nnnnnn). We
can now facilitate absolute addressing: the kernel is executing as
intended.“

Source: LWN.net – Walleij: How the ARM32 kernel starts