simd_int_ops, hpc: AMX TDPBUSD arm for gemm_u8_i8 slice surface

[AdaWorldAPI]

Summary

Extends the u8 × i8 → i32 dispatch chain from PR #182's compile-time cascade by adding a top-tier AMX runtime check. Brings the SPR/GNR TDPBUSD path (16 384 MACs per instruction) to the slice-level surface that downstream consumers use, completing the symmetry with PR #184's matmul_i8_to_i32 wiring.

gemm_u8_i8 is u8×i8 natively — no sign-shift bias trick needed (unlike matmul_i8_to_i32 which is i8×i8 and has to convert via +128 then subtract 128·colsum(B)). The AMX path here is a direct call with no bias correction.

New helper hpc::int8_tile_gemm::int8_gemm_amx_tiled

Factors out the tile-decomposition logic that was previously inlined in matmul_i8_to_i32. Both consumers now share the same helper:

matmul_i8_to_i32:
  1. shift A: i8 → u8 (+128)
  2. int8_gemm_amx_tiled(a_u8, b, c, m, n, k)
  3. subtract_i8_to_u8_bias(c, b, m, n, k)

gemm_u8_i8 (AMX tier added in this PR):
  1. int8_gemm_amx_tiled(a, b, c, m, n, k)  ← no shift, no bias

Handles arbitrary 16/16/64-aligned shapes via a j_tile × i_tile loop calling int8_tile_gemm_16x16 per (16, 16) block. B sub-block extracted into K × 16 scratch once per j-tile, reused across all M i-tiles. Overwrite semantics: c is written not accumulated.

Dispatch in gemm_u8_i8

• Tier 0 (this PR): runtime amx_available() check at the top (AMX requires CPUID + XCR0 + Linux prctl — can't fit a target_feature compile-time gate).
• Tiers 1-3 (PR simd: agnostic gemm_u8_i8 surface, integer-slice-op lift, per-CPU matrix, BF16 AMX wiring #182, unchanged): compile-time cfg-cascade (avx512vnni zmm → avxvnni ymm → scalar int8_gemm_i32).

Misaligned shapes or non-AMX hosts fall through to the compile-time cascade.

Drive-by clippy fix

Pre-existing clippy::manual_is_multiple_of warnings surfaced in the new alignment check — switched from % 16 == 0 to .is_multiple_of(16) per the clippy hint (Rust 1.95 promoted this from pedantic to active warn).

Test plan

• gemm_u8_i8_amx_aligned_32x32x128 — new test, exercises the AMX arm with a 32×32×128 shape that hits the AMX tier on this host's amx_int8 silicon.
• Full lib sweep: 2095 tests pass (was 2094, +1 new test).
• 11 amx_matmul tests pass (refactor to call the shared helper kept the same behavior).
• 4 existing gemm_u8_i8 tests pass (their shapes aren't AMX-aligned so they fall through to the compile-time cascade as before).
• cargo clippy --lib --tests --features rayon,native -- -D warnings clean.
• cargo fmt --all --check clean.

Per-CPU dispatch state after this PR

Op	SPR/GNR	CPL/Zen4	ARL/MtL-U	Scalar
matmul_bf16_to_f32	✅ TDPBF16PS	✅ VDPBF16PS	scalar	scalar
matmul_f32 (BF16 compute)	✅ TDPBF16PS	✅ VDPBF16PS	scalar	scalar
matmul_i8_to_i32	✅ TDPBUSD	✅ VPDPBUSD-zmm	⏳ ymm	scalar
gemm_u8_i8 (slice)	✅ TDPBUSD (this PR)	✅ VPDPBUSD-zmm	✅ AVX-VNNI ymm	scalar

Out of scope (separate PRs)

• AVX-VNNI ymm arm for matmul_i8_to_i32 — the vnni2_* helpers exist in simd_amx.rs but need assembling into an m×n×k GEMM. Same shape as the avx512vnni arm just with ymm width.
• NEON BFMMLA / SDOT on aarch64 via asm-byte — Phase 3b.

https://claude.ai/code/session_01HbqooFZHAjaUtFEzhA1R2u

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f8e94531ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate slice lengths before unchecked B-tile reads

int8_gemm_amx_tiled is a safe public function but it reads b_i8 via from_raw_parts(b_i8.as_ptr().add(row), 16) without any length checks, so callers that pass mismatched (m,n,k) and slice lengths can trigger out-of-bounds reads/UB instead of a panic. This was previously only in a private call path with shape checks, but the new helper is now reusable from other call sites; adding explicit a_u8/b_i8/c length assertions (like gemm_u8_i8 does) or avoiding unchecked raw slices would keep the API memory-safe.

Useful? React with 👍 / 👎.

[AdaWorldAPI]

Fixed in e8f9ce0. The concern is valid — int8_gemm_amx_tiled is a safe pub fn but its inner loop reached for b_i8 via raw core::slice::from_raw_parts(...) arithmetic without any length check, so mismatched (m, n, k) vs slice lengths could trigger out-of-bounds reads / UB instead of a clean panic. The function lived as a private call path inside matmul_i8_to_i32 before being factored out for gemm_u8_i8 in this PR; the public refactor inherited the missing boundary check.

The fix mirrors gemm_u8_i8's contract — three boundary assertions at function entry:

assert!(a_u8.len() >= m * k, "int8_gemm_amx_tiled: a_u8.len()={} < m*k={}", a_u8.len(), m * k);
assert!(b_i8.len() >= k * n, "int8_gemm_amx_tiled: b_i8.len()={} < k*n={}", b_i8.len(), k * n);
assert!(c.len() >= m * n,    "int8_gemm_amx_tiled: c.len()={} < m*n={}",    c.len(),    m * n);

— plus replacing the unsafe { core::slice::from_raw_parts(b_i8.as_ptr().add(row), 16) } line with safe &b_i8[row..row + 16] slicing. The inner-loop bounds check should fold away once the entry-level asserts prove the invariant, but either way the public surface is now panicking-safe rather than UB-on-misuse.

New regression test amx_tiled_panics_on_undersized_b constructs a b: Vec<i8> half a j-tile shorter than what (m, n, k) claims, calls the helper, and asserts the expected panic message via #[should_panic(expected = "b_i8.len()")]. Works on any host since the boundary check fires before the debug_assert!(amx_available()), so non-AMX CI runners catch the same regression. The matmul_i8_to_i32 call site inherits the assertions transparently — its existing tests continue to pass on valid input with no behavior change.

The # Panics docstring was updated to list the boundary panics alongside the existing debug-only AMX / alignment assertions.

---

Generated by Claude Code