[RFC] Compiler-derived Tile regions and assembly sessions

[zhoubot]

Status

Proposed for RFC review. Not implemented and not compatible with the currently locked LinxISA/PTO 0.58.3 toolchain.

The architecture/compiler contract is under review in LinxISA/linx-isa#187. Staged implementation is tracked by LinxISA/linx-isa#188.

PTO candidate closure is blocked by PTO-ISA/pto-spec#166, which must reconcile the Local B.IOT SizeCode-12 contract/ASL/AVS contradiction.

Problem

The current range surface exposes raw encoding protocol in ordinary C++ templates:

Subview<Parent, SizeCode, Offset, RegSrc>
Assemble<Parent, ParentSizeCode, INIT, LAST, Offset, RegSrc>

This makes users supply values that LLVM can derive from semantic Tile def-use:

• SrcSelect from the binder-local operand role;
• RegSrc from normal GPR allocation;
• uimm11 from affine offset decomposition;
• SizeCode from the frozen parent/fragment descriptor;
• INIT/MIDDLE/LAST/INIT_LAST from one assembly session and its commit boundary;
• modifier adjacency and B.IOT.L from Blockify.

The current implementation is also not a general programming model: Subview is consumed only by TSTORE, Assemble only by TLOAD, and ordinary TileOPs such as TROWMAX/TEXP/TROWEXPAND*/TMATMUL do not accept range operands.

Proposal

C++17 source model

Ordinary users work with source view proxies and destination assembly sessions:

using namespace pto;
using namespace pto::region;

auto src = view(t2)[slice2d{
    all,
    span{4 * g, 4}  // begin, extent
}];

auto out = make_local_assembly<ParentTile>(scope::all_pes);

TROWMAX(
    out[slice2d{all, index{g}}],
    src
);

auto whole = out.commit();

C++ cannot express Python [:, a:b] tokens inside operator[]; the public spelling uses:

struct all_t {};
struct index { uint64_t value; };            // i == [i:i+1]
struct span  { uint64_t begin, extent; };    // half-open [begin, begin+extent)

template<class RowSelector, class ColSelector>
struct slice2d { RowSelector row; ColSelector col; };

Each operand has an independent region expression:

TROWEXPANDMUL(
    out[slice2d{all, span{2 * k, 2}}],
    view(t20)[slice2d{all, span{2 * i, 2}}],
    view(t16)[slice2d{all, index{j}}]
);

There is no implicit equality between i, j, and k.

Local and Shared assembly

Local assembly may use an implicit session only when LLVM proves a unique non-escaping SSA lifetime. The explicit form is always available:

auto out = make_local_assembly<WholeTile>(scope::all_pes);
TADD(out[slice0], view(a)[slice1], view(b)[slice2]);
auto whole = out.commit();

Shared assembly is always explicit:

auto shared_out =
    make_shared_assembly<WholeTile>(shared_parent, producer_scope);

TADD(shared_out[dst_region], lhs, rhs);
auto published = shared_out.commit();

auto consumer = view(published, consumer_scope)[src_region];

Shared object identity, producer mask, and consumer mask are distinct. Allocation freezes the descriptor but not a participant mask. commit() is a compiler marker that derives LAST; it is not a READY instruction. Shared reads still wait for whole_parent_ready && published.

Compiler-facing model

The frontend lowers source views to a non-storable region token and destination writes to a linear assembly session:

%r0 = tile.subview.local %parent, region
%s0 = tile.assembly.begin.local %destination_parent, scope
%s1 = TILEOP ... %r0 -> %s0[region]
%whole = tile.assembly.commit.local %s1

LLVM, not the API user, derives:

Derived field	Compiler source
Local vs Shared binder	parent type
source0/source1	binder-local generated operation schema
RegSrc/uimm11	affine CELL offset and GPR allocation
writer SizeCode	fragment carrier descriptor
ParentSizeCode	frozen parent capacity
INIT/LAST	linear session order plus commit
modifier adjacency	atomic Blockify lowering unit
Shared per-PE offset	per-PE GPR evaluation in one convergence domain

All session operations, Shared source views, and region-aware TileOP consumers are convergent/noduplicate and carry one LLVM convergence domain.

V1 restrictions

The first version intentionally stays narrow:

• rank-2 regions;
• dynamic affine origin is allowed;
• extent, dtype, layout, physical/valid shape, parent capacity, scope kind, and participant mask are compile-time constants;
• straight-line or fully unrolled fixed contribution count;
• structured session PHI only when parent/scope/descriptor/generation/coverage agree;
• no session escape, storage, address-taking, select/freeze, unknown call, or cross-function ABI;
• every executable path from begin reaches exactly one commit.

128-byte CELL rule

A logical result smaller than 128 B is not a direct B.ASSEMBLE writer.

This must be rejected:

TROWMAX(out[slice2d{all, index{g}}], src); // logical result is 64 B

when successive g values would overlap one architectural CELL.

Legalization must first create one real, fully defined 128 B carrier, for example through an exact reviewed TINSERT/packing sequence:

%f0 = TROWMAX ...       // logical 64 B
%f1 = TROWMAX ...       // logical 64 B
%f128 = PACK128 %f0, %f1
%s1 = ASSEMBLY.WRITE %s0[combined_region], %f128

PACK128 is compiler semantic notation, not a proposed PTO instruction. If no assigned operation can prove the packing semantics, compilation fails closed.

Plain C surface

Plain C uses Clang-only opaque builtin types, not linkable C ABI symbols:

linx_tile_region_token_t part =
    __builtin_linx_tile_subview_local(tile, region);

linx_tile_t fragment =
    __builtin_linx_sfu_trowmax_region(part);

linx_tile_assembly_t next =
    __builtin_linx_tile_assembly_write(session, dst_region, fragment);

linx_tile_t whole =
    __builtin_linx_tile_assembly_commit_local(next);

Parent, region-token, and assembly-session types are non-addressable and cannot be stored, copied through ABI, cast, placed in aggregates, or passed through varargs.

Raw compatibility layer

Raw Subview<..., SizeCode, Offset, RegSrc> and Assemble<..., INIT, LAST, ...> forms may remain temporarily under an explicit pto::raw_range or test-only namespace.

They are not the ordinary API and must never be selected as a silent fallback when semantic lowering fails.

Required compiler/API split

This RFC is not implementable as a cosmetic header wrapper over current inline asm. It requires:

1. exact PTO candidate release/SizeCode closure;
2. LLVM MC support for B.SUBVIEW/B.ASSEMBLE;
3. region/session target types and verifier;
4. generated operation-role/effect-class schema;
5. phase/coverage analysis;
6. MachineIR operands preserved through Tile SSA balance;
7. per-binder contiguous modifier emission in Blockify;
8. typed Clang builtins;
9. C++17 zero-semantics wrappers in this repository.

Validation requirements

• every accepted Tile operation × operand role × generated effect class;
• Local and Shared parent descriptor legality;
• binder-local source role, including Shared operation ordinal != SrcSelect;
• single/first/middle/last and multi-output atomic sessions;
• B.IOT.L and modifier adjacency;
• optimizer PHI/clone/CSE/DCE/convergence negatives;
• sub-CELL pack and rejection cases, including issues [TROWSUM] physical Columns=1 reduction vector is rejected by Tile alignment check #29 and [TROWSUM] Columns=1 full RMSNorm path fails on dtype modifier and sub-128B TSize #32;
• per-PE Shared source offsets and prior-generation visibility;
• plain-C and C++17 CodeGen;
• linx32/linx64 MC, integrated assembler, object, and disassembly;
• QEMU/model parity and maintained SuperNPUBench softmax/matmul evidence;
• exact pin/external SHA manifests and LTO/LLD mixed-version rejection.

Review questions

1. Is view(tile)[slice2d{...}] the preferred source spelling?
2. Should Local implicit sessions be supported in v1, or require explicit make_local_assembly everywhere?
3. Should raw range wrappers remain public under pto::raw_range, or become tests-only immediately?
4. Is rank-2 plus constant extent the right first implementation boundary?
5. Which existing TileOP should be the first end-to-end region sentinel: TROWMAX, TADD, TLOAD/TSTORE, or TMATMUL?
6. What is the exact private/deleted LLVM level-one SHA, if different from public bisheng-linx commit 631961c3?

Decision requested

Please review the programming model and answer the questions above. No implementation or TileOP merge should begin until:

• this RFC has an accepted API direction;
• [0.58.4.1 blocker] Reconcile Local B.IOT SizeCode 12 across contract, ASL, and AVS PTO-ISA/pto-spec#166 is closed with exact-head evidence;
• the matching Linx LLVM semantic/MC design in docs: define compiler-derived Tile regions linx-isa#187 is approved.

[zhoubot]

Superseded: The Tile Array partition revision is now the active worked example: #36 (comment)

RFC addendum: worked FlashAttention Tile example

The following is proposed C++17 TileOP syntax, not code that compiles with the current header. It is intended to be the first end-to-end RFC sentinel.

This example deliberately chooses region sizes that map to complete architectural CELLs:

Value	Logical shape/type	Logical bytes
Q	32 x 64 BF16	4 KiB
K	64 x 64 BF16	8 KiB
complete score parent	32 x 64 FP32	8 KiB
score subtile	32 x 16 FP32	2 KiB
row max/sum	32 x 1 FP32	128 B
probability fragment	32 x 16 BF16	1 KiB
assembled probability parent	32 x 64 BF16	4 KiB
V	64 x 64 BF16	8 KiB
output accumulator	32 x 64 FP32	8 KiB

Therefore:

• every score source subview is at least 2 KiB;
• every row statistic has an exact 128 B logical payload;
• every probability contribution is a real 1 KiB writer;
• the four destination contributions are non-overlapping and cover the complete 4 KiB probability parent;
• no sub-128B B.ASSEMBLE legalization is required.

Proposed code

#include <pto_tileop.hpp>

using namespace pto;
using namespace pto::region;

using BF16 = bfloat16_t;

constexpr int M = 32;
constexpr int N = 64;
constexpr int K = 64;
constexpr int SubN = 16;
constexpr int NumSubtiles = N / SubN;

// Matrix/CUBE parents used by the two large matrix multiplications.
using QTile = TileLeft<BF16, M, K>;
using KTile = TileRight<BF16, N, K>;
using VTile = TileRight<BF16, N, N>;

using ScoreParent = TileAcc<float, M, N>;
using ProbParent = TileLeft<BF16, M, N>;
using OutputAcc = TileAcc<float, M, N>;

// Ordinary Local fragments used by the SFU/VEC softmax passes.
using ScoreFragment =
    Tile<Location::Vec, float, M, SubN, BLayout::RowMajor>;

// Physical columns are padded to 8 while valid shape remains M x 1.
// The logical row-state payload is M * 1 * sizeof(float) = 128 B.
using RowState =
    Tile<Location::Vec, float, M, 8, BLayout::RowMajor, M, 1>;

using ProbFragment = TileLeft<BF16, M, SubN>;

template<class QGlobal, class KGlobal, class VGlobal, class OGlobal>
void flash_attention_tile(
    QGlobal q_global,
    KGlobal k_global,
    VGlobal v_global,
    OGlobal o_global) {

  QTile q;
  KTile k;
  VTile v;

  TLOAD(q, q_global);
  TLOAD(k, k_global);
  TLOAD(v, v_global);

  // First large matrix multiplication:
  //   scores = Q * K^T
  // ScoreParent retains the complete Local Matrix/CUBE parent identity so
  // source views can lower to B.SUBVIEW without creating another Tile namespace.
  ScoreParent scores;
  TMATMUL(scores, q, k);

  constexpr float scale = 1.0f / 8.0f; // 1 / sqrt(K), K = 64.

  // Pass 1: global row max over four score subtiles.
  RowState row_max;
  TEXPANDS(row_max, -3.402823466e+38F);

  #pragma clang loop unroll(full)
  for (int j = 0; j < NumSubtiles; ++j) {
    const auto score_region = slice2d{
        all,
        span{static_cast<uint64_t>(j * SubN),
             static_cast<uint64_t>(SubN)}};

    // Borrow one 32x16 region of the complete score parent.
    auto score_view = view(scores)[score_region];

    ScoreFragment scaled_score;
    RowState local_max;

    TMULS(scaled_score, score_view, scale);
    TROWMAX(local_max, scaled_score);
    TMAX(row_max, row_max, local_max);
  }

  // Pass 2: global denominator = sum(exp(score - row_max)).
  RowState row_sum;
  TEXPANDS(row_sum, 0.0f);

  #pragma clang loop unroll(full)
  for (int j = 0; j < NumSubtiles; ++j) {
    const auto score_region = slice2d{
        all,
        span{static_cast<uint64_t>(j * SubN),
             static_cast<uint64_t>(SubN)}};

    auto score_view = view(scores)[score_region];

    ScoreFragment scaled_score;
    ScoreFragment exp_score;
    RowState local_sum;

    TMULS(scaled_score, score_view, scale);
    TROWEXPANDSUB(exp_score, scaled_score, row_max);
    TEXP(exp_score, exp_score);
    TROWSUM(local_sum, exp_score);
    TADD(row_sum, row_sum, local_sum);
  }

  RowState inv_sum;
  TRECIP(inv_sum, row_sum);

  // The BF16 parent is the left operand of the second large TMATMUL.
  // The session owns its descriptor and generation identity.
  auto probabilities =
      make_local_assembly<ProbParent>(scope::all_pes);

  // Pass 3: recompute each normalized probability subtile and contribute one
  // real 1KiB fragment to the complete 4KiB probability parent.
  #pragma clang loop unroll(full)
  for (int j = 0; j < NumSubtiles; ++j) {
    const auto region = slice2d{
        all,
        span{static_cast<uint64_t>(j * SubN),
             static_cast<uint64_t>(SubN)}};

    auto score_view = view(scores)[region];

    ScoreFragment scaled_score;
    ScoreFragment exp_score;
    ScoreFragment normalized;
    ProbFragment probability_fragment;

    TMULS(scaled_score, score_view, scale);
    TROWEXPANDSUB(exp_score, scaled_score, row_max);
    TEXP(exp_score, exp_score);
    TROWEXPANDMUL(normalized, exp_score, inv_sum);
    TCVT(probability_fragment, normalized);

    // Proposed destination-region operation. The frontend may expose this as
    // either an explicit write or a destination proxy accepted by TCVT.
    probabilities.write(region, probability_fragment);

    // Equivalent fused spelling under review:
    // TCVT(probabilities[region], normalized);
  }

  // Compiler-derived phases for the unrolled loop:
  //   j=0: INIT=1, LAST=0, ParentSizeCode=derived from ProbParent
  //   j=1: INIT=0, LAST=0, ParentSizeCode=0
  //   j=2: INIT=0, LAST=0, ParentSizeCode=0
  //   j=3: INIT=0, LAST=1, ParentSizeCode=0
  //
  // commit() is an IR marker. It emits no READY instruction.
  ProbParent probability_parent = probabilities.commit();

  // Second large matrix multiplication:
  //   output = softmax(Q * K^T) * V
  // The committed whole parent is directly operation-consumable as TileLeft.
  OutputAcc output;
  TMATMUL(output, probability_parent, v);

  TSTORE(o_global, output);
}

Compiler-facing lowering shape

Conceptually, the source loop becomes:

%score_view_j = tile.subview.local %scores,
    rows=[0:32], cols=[16*j:16*j+16]
%local_max_j = TROWMAX(TSCALE(%score_view_j))

The assembly loop becomes:

%s0 = tile.assembly.begin.local %probability_parent
%s1 = tile.assembly.write %s0, region=[0:32, 0:16],  %prob0
%s2 = tile.assembly.write %s1, region=[0:32,16:32],  %prob1
%s3 = tile.assembly.write %s2, region=[0:32,32:48],  %prob2
%s4 = tile.assembly.write %s3, region=[0:32,48:64],  %prob3
%probability_parent = tile.assembly.commit.local %s4
%output = TMATMUL %probability_parent, %v

After fixed-loop unrolling and descriptor/layout proof, Blockify emits for each softmax source binder its immediately contiguous B.SUBVIEW, and for each probability destination binder its immediately contiguous B.ASSEMBLE.

Required legality proofs

This example is accepted only if LLVM proves:

1. ScoreParent is a Local Matrix/CUBE parent accepted by PTO subview descriptor rules.
2. Each 32 x 16 FP32 logical column region maps to one contiguous, CELL-aligned interval in the selected parent layout.
3. Each ProbFragment is a real 32 x 16 BF16 = 1024 B carrier compatible with the frozen ProbParent descriptor.
4. The four writer intervals are CELL-aligned, pairwise non-overlapping, and cover the complete 4096 B parent at commit.
5. The session does not escape, and the loop is fully unrolled to four statically ordered contributions.
6. TROWMAX/TROWSUM/TROWEXPAND*/TCVT/TMATMUL keep their operation-specific dtype/layout/shape/definedness legality.
7. The selected producer effect classes are rollback-safe or atomic-auxiliary.

If the chosen CUBE layout makes [:, 16*j:16*j+16] discontiguous in CELL order, this source spelling must be rejected or changed to the layout's contiguous region decomposition. The API must not silently reinterpret a logical rectangle as one encoded range.

Suggested RFC sentinel

Use this exact M=32, N=64, K=64, SubN=16 kernel as the first full-stack acceptance test because it covers:

• large TMATMUL result as a subview parent;
• four independent dynamic-origin/constant-extent source regions;
• TROWMAX, TMAX, TROWEXPANDSUB, TEXP, TROWSUM, TADD, TRECIP, TROWEXPANDMUL, and TCVT with region-derived operands;
• four compiler-derived assembly phases;
• commit-to-whole-parent typing;
• a second large TMATMUL consuming the assembled parent;
• no sub-CELL destination writers.

[zhoubot]

Superseded: Final TPARTITION/TASSEMBLY semantics are defined here: #36 (comment)

RFC revision: FlashAttention using aligned Tile Array partitions

This revision supersedes the earlier slice2d FlashAttention example. The parent is exposed as a homogeneous aligned SubTile array, and the probability destination is an assembly array with the same partition.

The arrays below are compiler-only borrowed/output proxies. They are not C++ arrays of independent Tile objects and must not lower to alloca, GEP, stack storage, or dynamic Tile-register selection.

Exact partition

ScoreParent  : 32 x 64 FP32 = 8 KiB
ScoreSubTile : 32 x 16 FP32 = 2 KiB
ScoreParts   : [1][4]

ProbParent   : 32 x 64 BF16 = 4 KiB
ProbSubTile  : 32 x 16 BF16 = 1 KiB
ProbParts    : [1][4]

RowState     : 32 x 1 FP32 = 128 B logical payload

Every SubTile is an assigned, CELL-aligned range. Four SubTiles exactly cover each parent without gaps or overlap.

Revised proposed C++17 algorithm

#include <pto_tileop.hpp>

using namespace pto;
using namespace pto::region;

using BF16 = bfloat16_t;

constexpr int M = 32;
constexpr int N = 64;
constexpr int K = 64;
constexpr int SubN = 16;
constexpr int NumSubtiles = N / SubN;

using QTile = TileLeft<BF16, M, K>;
using KTile = TileRight<BF16, N, K>;
using VTile = TileRight<BF16, N, N>;

using ScoreParent = TileAcc<float, M, N>;
using ScoreSubTile =
    Tile<Location::Vec, float, M, SubN, BLayout::RowMajor>;

using ProbParent = TileLeft<BF16, M, N>;
using ProbSubTile = TileLeft<BF16, M, SubN>;

using OutputAcc = TileAcc<float, M, N>;

// Physical columns are padded while the valid shape is M x 1.
// The logical payload is exactly 32 * 1 * 4 = 128 B.
using RowState =
    Tile<Location::Vec, float, M, 8, BLayout::RowMajor, M, 1>;

template<class QGlobal, class KGlobal, class VGlobal, class OGlobal>
void flash_attention_tile_array(
    QGlobal q_global,
    KGlobal k_global,
    VGlobal v_global,
    OGlobal o_global) {

  QTile q;
  KTile k;
  VTile v;

  TLOAD(q, q_global);
  TLOAD(k, k_global);
  TLOAD(v, v_global);

  // Large matrix multiplication: scores = Q * K^T.
  ScoreParent scores;
  TMATMUL(scores, q, k);

  // Borrow one architectural parent as an aligned [1][4] SubTile array.
  // No Tile payload is copied and no new Local Tile identity is allocated.
  auto score =
      as_subtiles<ScoreSubTile, 1, NumSubtiles>(scores);

  static_assert(decltype(score)::rows == 1);
  static_assert(decltype(score)::cols == NumSubtiles);
  static_assert(decltype(score)::exact_cell_partition);

  constexpr float scale = 1.0f / 8.0f;

  // Pass 1: global row maximum over score[0][0..3].
  RowState row_max;
  TEXPANDS(row_max, -3.402823466e+38F);

  for (int j = 0; j < NumSubtiles; ++j) {
    ScoreSubTile scaled;
    RowState local_max;

    TMULS(scaled, score[0][j], scale);
    TROWMAX(local_max, scaled);
    TMAX(row_max, row_max, local_max);
  }

  // Pass 2: denominator = sum_j rowsum(exp(score[j] - row_max)).
  RowState row_sum;
  TEXPANDS(row_sum, 0.0f);

  for (int j = 0; j < NumSubtiles; ++j) {
    ScoreSubTile scaled;
    ScoreSubTile exp_score;
    RowState local_sum;

    TMULS(scaled, score[0][j], scale);
    TROWEXPANDSUB(exp_score, scaled, row_max);
    TEXP(exp_score, exp_score);
    TROWSUM(local_sum, exp_score);
    TADD(row_sum, row_sum, local_sum);
  }

  RowState inv_sum;
  TRECIP(inv_sum, row_sum);

  // Create a linear assembly session exposed as an aligned [1][4] output array.
  auto probability =
      make_subtile_assembly<ProbParent, ProbSubTile, 1, NumSubtiles>(
          scope::all_pes);

  // Pass 3: normalize each score SubTile and write one 1 KiB probability slot.
  for (int j = 0; j < NumSubtiles; ++j) {
    ScoreSubTile scaled;
    ScoreSubTile exp_score;
    ScoreSubTile normalized;

    TMULS(scaled, score[0][j], scale);
    TROWEXPANDSUB(exp_score, scaled, row_max);
    TEXP(exp_score, exp_score);
    TROWEXPANDMUL(normalized, exp_score, inv_sum);

    // Destination proxy consumes the current session and replaces it with the
    // successor session. TCVT is the single producer of this contribution.
    TCVT(probability[0][j], normalized);
  }

  // No READY instruction. commit marks the complete generation boundary.
  ProbParent complete_probability = probability.commit();

  // Second large matrix multiplication:
  // output = softmax(Q * K^T) * V.
  OutputAcc output;
  TMATMUL(output, complete_probability, v);
  TSTORE(o_global, output);
}

C++ meaning

auto score = as_subtiles<ScoreSubTile, 1, 4>(scores);

returns a non-addressable tile_partition_view<ScoreParent, ScoreSubTile,1,4>.

score[i][j]

returns subtile_ref<ScoreParent,ScoreSubTile> containing only:

• the original parent identity;
• SSA indices i and j;
• the compile-time partition descriptor.

It is not ScoreSubTile&, has no data(), cannot be stored, and cannot escape.

Similarly:

auto probability =
    make_subtile_assembly<ProbParent,ProbSubTile,1,4>(scope);

owns one linear assembly session. probability[i][j] is an output-region proxy, not a Tile lvalue. A destination-aware TileOP consumes the old session and installs the successor session inside the compiler-recognized proxy.

LLVM shape

LLVM must not create [4 x target("linx.tile")]. The source access is:

%part = call target("linx.tile.region")
    @llvm.linx.tile.partition.get(
        target("linx.tile") %scores,
        i32 0,
        i32 %j,
        i32 1, i32 4,
        i32 <constant-subtile-descriptor>)

The layout-specific lowering computes:

ordinal = partition_linear_index(0, j)
SubviewOffsetCells = ordinal * ScoreSubTileCells
SubviewSizeCode = constant ScoreSubTile SizeCode

The destination operation is represented as a session-consuming producer, for example:

%next = call target("linx.tile.assembly")
    @llvm.linx.tileop.tcvt.write.indexed(
        target("linx.tile.assembly") %session,
        target("linx.tile") %normalized,
        i32 0,
        i32 %j,
        i32 <constant-probability-partition>)

Loop lowering

B.SUBVIEW has no first/last phase, so the source loops may retain a runtime affine %j when bounds and layout are proved.

B.ASSEMBLE carries encoded INIT/LAST bits. For the fixed four-slot probability loop, LLVM must either fully unroll or produce:

j=0       -> INIT
j=1..2    -> MIDDLE loop
j=3       -> LAST
commit    -> no independent ISA instruction

For a one-slot partition it emits INIT_LAST. The source API never passes these phases.

Required static proof

The cast/partition is legal only when all of the following are true:

1. SubTileBytes >= 128 and maps to an assigned SizeCode.
2. ParentBytes == Rows * Cols * SubTileBytes.
3. Parent and SubTile dtype, layout, location, role, and valid-shape contracts are compatible.
4. Every [i][j] maps to one contiguous CELL interval in PTO layout order.
5. The partition is a bijection over parent CELL coverage: no gap, duplicate, or overlap.
6. ScalarEvolution or equivalent proves 0 <= i < Rows and 0 <= j < Cols.
7. Assembly visits every slot exactly once before commit.
8. Shared source/assembly variants retain convergence and producer/consumer scope rules.

Failure of any proof is a stable compile-time diagnostic. There is no fallback to a real Tile array, stack storage, raw Subview/Assemble, or opaque inline assembly.

Why this replaces arbitrary slicing for v1

The aligned Tile Array surface makes all non-origin facts static:

• SubTile extent and SizeCode;
• parent capacity;
• partition count;
• complete assembly coverage;
• CELL alignment;
• destination writer size.

Only the array index remains an SSA value. This is a smaller and more testable first compiler contract than arbitrary rectangle slicing.

[zhoubot]

Final terminology and semantics: TPARTVIEW / TASSEMBLY

This comment supersedes the earlier naming in the worked examples.

The public programming-model algebra is now:

TPARTVIEW : ParentTile -> BorrowedTileArray<SubTile, R, C>
TASSEMBLY  : TileArray<SubTile, R, C> -> ParentTile

TPARTVIEW

TPARTVIEW exposes one aligned large parent Tile as an indexable array of aligned SubTile views:

auto score =
    TPARTVIEW<ScoreSubTile, 1, 4>(score_parent);

TROWMAX(local_max, score[0][j]);

The returned object behaves like a Tile array in C++, but its elements are borrowed region handles:

score[0][j] : SubTileView<ScoreParent, ScoreSubTile>

It does not allocate four independent Tiles and does not copy the parent payload.

TASSEMBLY

TASSEMBLY consumes a completely initialized Tile array and produces one complete parent Tile:

TileArray<ProbSubTile, 1, 4> probability;

for (int j = 0; j < 4; ++j)
    TCVT(probability[0][j], normalized);

ProbParent whole =
    TASSEMBLY<ProbParent>(std::move(probability));

TileArray is a compiler-only linear value. It is not addressable storage. Every slot must be initialized exactly once before TASSEMBLY consumes it.

TASSEMBLY replaces the earlier public commit() spelling. It is the semantic finalization marker; it does not emit an independent ISA instruction.

Revised FlashAttention shape

using ScoreParent = TileAcc<float, 32, 64>;
using ScoreSubTile =
    Tile<Location::Vec, float, 32, 16, BLayout::RowMajor>;

using ProbParent = TileLeft<BF16, 32, 64>;
using ProbSubTile = TileLeft<BF16, 32, 16>;

ScoreParent scores;
TMATMUL(scores, q, k);

// Tile -> borrowed [1][4] Tile array.
auto score_array =
    TPARTVIEW<ScoreSubTile, 1, 4>(scores);

RowState row_max;
TEXPANDS(row_max, -3.402823466e+38F);

for (int j = 0; j < 4; ++j) {
    ScoreSubTile scaled;
    RowState local_max;

    TMULS(scaled, score_array[0][j], scale);
    TROWMAX(local_max, scaled);
    TMAX(row_max, row_max, local_max);
}

RowState row_sum;
TEXPANDS(row_sum, 0.0f);

for (int j = 0; j < 4; ++j) {
    ScoreSubTile scaled;
    ScoreSubTile exp_score;
    RowState local_sum;

    TMULS(scaled, score_array[0][j], scale);
    TROWEXPANDSUB(exp_score, scaled, row_max);
    TEXP(exp_score, exp_score);
    TROWSUM(local_sum, exp_score);
    TADD(row_sum, row_sum, local_sum);
}

RowState inv_sum;
TRECIP(inv_sum, row_sum);

// Linear, compiler-only Tile array under construction.
TileArray<ProbSubTile, 1, 4> probability_array;

for (int j = 0; j < 4; ++j) {
    ScoreSubTile scaled;
    ScoreSubTile exp_score;
    ScoreSubTile normalized;

    TMULS(scaled, score_array[0][j], scale);
    TROWEXPANDSUB(exp_score, scaled, row_max);
    TEXP(exp_score, exp_score);
    TROWEXPANDMUL(normalized, exp_score, inv_sum);

    TCVT(probability_array[0][j], normalized);
}

// Tile array -> one complete parent Tile.
ProbParent probability =
    TASSEMBLY<ProbParent>(std::move(probability_array));

TMATMUL(output, probability, v);

C++ type rules

Borrowed array returned by TPARTVIEW

template<class Parent, class SubTile, int R, int C>
class BorrowedTileArray;

• copyable only as a compiler borrow token if parent identity remains unique;
• no data(), pointer conversion, address-taking, load/store, or ABI escape;
• operator[] returns another proxy; the final element is a region token;
• parent remains the only architectural Tile identity.

Constructed array consumed by TASSEMBLY

template<class SubTile, int R, int C>
class TileArray;

• linear and non-copyable;
• every slot starts uninitialized;
• a destination TileOP initializes one slot and returns the successor array state;
• duplicate writes, missing slots, escape, address-taking, or use after move are errors;
• TASSEMBLY<Parent>(std::move(array)) consumes the final array.

LLVM semantic model

The compiler IR should expose the same algebra.

Partition

%array = call target("linx.tile.array.borrowed")
    @llvm.linx.tpartition(
        target("linx.tile") %parent,
        i32 immRows,
        i32 immCols,
        i32 immSubTileDescriptor,
        i32 immLayoutOrder)

%part = call target("linx.tile.region")
    @llvm.linx.tile.array.get(
        target("linx.tile.array.borrowed") %array,
        i32 %i,
        i32 %j)

tile.array.get computes a layout-specific affine CELL origin and a constant SubTile extent. It folds into the consuming binder's B.SUBVIEW.

Assembly array

%array0 = call target("linx.tile.array.assembly")
    @llvm.linx.tile.array.empty(
        i32 immRows,
        i32 immCols,
        i32 immSubTileDescriptor,
        i32 immParentDescriptor)

%array1 = call target("linx.tile.array.assembly")
    @llvm.linx.tileop.tcvt.array.insert(
        target("linx.tile.array.assembly") %array0,
        target("linx.tile") %normalized,
        i32 %i,
        i32 %j,
        <semantic TCVT attributes>)

%parent = call target("linx.tile")
    @llvm.linx.tassembly(
        target("linx.tile.array.assembly") %arrayN)

The array.insert operation is fused into the producing TileOP destination binder and lowers to B.ASSEMBLE. llvm.linx.tassembly is a finalization marker and emits no separate command.

For Shared parents, the result is the same Shared identity with a new generation dependency rather than a Local payload copy.

Architectural lowering

Programming model	LLVM semantic operation	Final PTO command
TPARTVIEW(parent)	llvm.linx.tpartition	none
array[i][j] source	llvm.linx.tile.array.get	B.SUBVIEW on consumer binder
TileOP writes array[i][j]	llvm.linx.tileop.*.array.insert	B.ASSEMBLE on producer binder
TASSEMBLY(array)	llvm.linx.tassembly	none; marks final generation

For a four-slot canonical loop, array insertion is lowered by full unrolling or first/middle/last peeling:

slot 0      -> INIT
slot 1..2   -> MIDDLE
slot 3      -> LAST
TASSEMBLY   -> no instruction

Naming boundary

• Public/compiler semantic handle: TPARTVIEW
• Public/compiler semantic finalizer: TASSEMBLY
• Final architecture commands: B.SUBVIEW / B.ASSEMBLE
• Existing legacy TASSEMBLE_Impl remains a separate old concatenate-like implementation and must not define the new API. Its modern architectural replacement is closer to TCONCAT.