Finally figured it out ...
The bsc9131 image was linked against the runtime startup routines for the sc3850 instead of the msc8156. Since the sc3850 wouldn't have an MMU, there was probably no external reference to the .att_mmu section, so the linker didn't generate one.
Retargeting the image to the msc8156 runtime startup routines solved the problem.