The armv7 specific __mmu_cache_on function accidently sets
the page table pointer with the unitialized value of r3. It seems
that often enough r3 still held the correct value from a previous
call to mmu_init allowing this bug to remain uncovered for longer.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>