Re: [PATCH 1/2] rust: time: Implement Add<Delta>/Sub<Delta> for Instant

[Alice Ryhl <aliceryhl@google.com>]

On Thu, Jul 24, 2025 at 02:54:06PM -0400, Lyude Paul wrote:
> In order to maintain the invariants of Instant, we use saturating
> addition/subtraction that is clamped to the valid value range for a
> non-negative Ktime.
> 
> Signed-off-by: Lyude Paul <lyude@redhat.com>
> +impl<T: ClockSource> ops::Add<Delta> for Instant<T> {
> +    type Output = Self;
> +
> +    #[inline]
> +    fn add(self, rhs: Delta) -> Self::Output {
> +        // INVARIANT: We clamp the resulting value to be between `0` and `KTIME_MAX`.
> +        Self {
> +            inner: self.inner.saturating_add(rhs.nanos).clamp(0, i64::MAX),
> +            _c: PhantomData,
> +        }
> +    }
> +}
> +
> +impl<T: ClockSource> ops::Sub<Delta> for Instant<T> {
> +    type Output = Self;
> +
> +    #[inline]
> +    fn sub(self, rhs: Delta) -> Self::Output {
> +        // INVARIANT: We clamp the resulting value to be between `0` and `KTIME_MAX`.
> +        Self {
> +            inner: self.inner.saturating_sub(rhs.nanos).clamp(0, i64::MAX),
> +            _c: PhantomData,
> +        }
> +    }
> +}

I'm not so sure what to think about this clamp logic. Maybe it is the
best way to go ...

Alice