if you're curious about why they wouldn't ship MTE in the Tensor G6: probably because the entire memory subsystem has to accommodate tag accesses - that seems like an expensive opt-in feature
i wonder if there's a weird hypertransport race thing involved in this (is it reasonable to expect that the MMIO writes are nonposted, and that the CPU cannot start the posted [aliasing] load/store before it completes?)
haven't tried anything myself so I'm not 100% sure either. i would not be surprised if UMC SMN accesses from x86 are simply disallowed by policy after the PSP boots