Claude review: rust: gpu: Add GPU buddy allocator bindings

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Critical API Design Issue - Arc Return Type:**
```rust
+    pub fn alloc_blocks(&self, params: &GpuBuddyAllocParams) -> Result<Arc<AllocatedBlocks>> {
```

**Problem:** Forcing `Arc<AllocatedBlocks>` prevents drivers from embedding allocation metadata in larger structures, requiring two allocations where one should suffice (identified by Danilo Krummrich, acknowledged by author).

**Recommendation:** Change to:
```rust
pub fn alloc_blocks(&self, params: &GpuBuddyAllocParams) -> impl PinInit<AllocatedBlocks, Error>
```

This allows drivers to choose their container (Box, Arc, or embedded).

**Parameter Passing Pattern:**
```rust
+    fn new(params: &GpuBuddyParams) -> impl PinInit<Self, Error> {
```

**Problem:** `GpuBuddyParams` is constructed inline and never reused in examples. Passing by reference is unnecessarily restrictive.

**Recommendation:** Pass by value for better ownership semantics:
```rust
fn new(params: GpuBuddyParams) -> impl PinInit<Self, Error>
```

**Mutex Placement Question:**
```rust
+#[pin_data(PinnedDrop)]
+struct GpuBuddyInner {
+    #[pin]
+    inner: Opaque<bindings::gpu_buddy>,
+    #[pin]
+    lock: Mutex<()>,
```

**Question:** Why isn't the mutex wrapping the `Opaque<gpu_buddy>` instead of being a sibling? Author confirms it's because `Mutex` doesn't take `impl PinInit`.

**Recommendation:** Add TODO comment:
```rust
/// TODO: Ideally `lock` should wrap `inner` as `Mutex<Opaque<bindings::gpu_buddy>>`,
/// but `Mutex::new()` doesn't accept `impl PinInit` yet.
lock: Mutex<()>,
```

**Excellent Flags Validation:**
```rust
+        // `TOPDOWN_ALLOCATION` only works without `RANGE_ALLOCATION`. When both are
+        // set, `TOPDOWN_ALLOCATION` is silently ignored by the allocator. Reject this.
+        if (flags & Self::RANGE_ALLOCATION) != 0 && (flags & Self::TOPDOWN_ALLOCATION) != 0 {
+            return Err(EINVAL);
+        }
```

**Assessment:** This is exactly the kind of safety improvement Rust bindings should provide - catching incompatible combinations the C API would silently ignore.

**Synchronization Correctness:**
```rust
+    fn lock(&self) -> GpuBuddyGuard<'_> {
+        GpuBuddyGuard {
+            inner: self,
+            _guard: self.lock.lock(),
+        }
+    }
```
Guard pattern correctly ensures mutex is held for all C allocator access.

**Cleanup Correctness:**
```rust
+#[pinned_drop]
+impl PinnedDrop for AllocatedBlocks {
+    fn drop(self: Pin<&mut Self>) {
+        let guard = self.buddy.lock();
+        unsafe {
+            bindings::gpu_buddy_free_list(
+                guard.as_raw(),
+                self.list.as_raw(),
+                self.flags.as_raw() as u32,
+            );
+        }
+    }
+}
```
Correct - lock held during free, cast safe due to validation in `try_new()`.

**Verdict:** Core implementation is sound, but needs API design changes (return type, parameter passing) acknowledged by author.

---

---
Generated by Claude Code Patch Reviewer