Clock adjustment holdover

Abstract

In one embodiment, a clock synchronization system includes clock circuitry to maintain a clock running at a clock frequency, a clock controller, and a processor to execute software to generate clock update commands and provide the clock update commands to the clock controller, wherein the clock controller is configured to apply the clock update commands to the clock, store a holdover frequency command to maintain the clock during a failure of the clock update commands, apply the holdover frequency command to the clock responsively to detecting the failure.

Description

FIELD OF THE INVENTION

The present invention relates to computer systems, and in particular, but not exclusively, to clock frequency adjustment.

BACKGROUND

In some systems, a local clock running on a network interface controller (NIC) may be adjusted based on frequency updates provided by a software application running on a processor, for example, in a host device.

The software managing the clock (sometimes referred to as “servo”) disciplines the clock by measuring the clock's error against some clock synchronization leader and issues adjustment commands to correct the clock errors. The software generally simultaneously corrects for different types of errors including: (a) long-term errors (which are typically measured over time periods of days), for example, oscillator aging, (b) medium-term errors (typically measured over time periods of minutes), for example, ambient/oscillator temperature changes, (c) short-term errors (typically measured over time periods of milliseconds), for example, oscillator frequency instabilities, jitter due to hardware limitations (e.g., clock quantization and inaccuracies).

SUMMARY

There is provided in accordance with an embodiment of the present disclosure, a clock synchronization system, including clock circuitry to maintain a clock running at a clock frequency, a clock controller, and a processor to execute software to generate clock update commands and provide the clock update commands to the clock controller, wherein the clock controller is configured to apply the clock update commands to the clock, store a holdover frequency command to maintain the clock during a failure of the clock update commands, and apply the holdover frequency command to the clock responsively to detecting the failure.

Further in accordance with an embodiment of the present disclosure the software is configured to generate the holdover frequency command, and provide the holdover frequency command to the clock controller.

Still further in accordance with an embodiment of the present disclosure the clock controller is configured to generate the holdover frequency command.

Additionally in accordance with an embodiment of the present disclosure the clock controller is configured to apply the holdover frequency command to the clock in the absence of the clock controller receiving any clock update command within a time period derived from timing criteria.

Moreover, in accordance with an embodiment of the present disclosure the software is configured to generate the timing criteria, which indicates when the controller applies the holdover frequency command, and provide the timing criteria to the clock controller.

Further in accordance with an embodiment of the present disclosure the software is configured to provide a message including the holdover frequency command and the timing criteria to the clock controller.

Still further in accordance with an embodiment of the present disclosure the timing criteria specifies a deadline of the time period.

Additionally in accordance with an embodiment of the present disclosure the timing criteria defines the deadline as any of the following a given time value, a time relative to when the timing criteria was received by the clock controller, a time relative to when the clock controller applied a given previous frequency adjustment, or a time relative to when the clock controller applied a latest frequency adjustment.

Moreover, in accordance with an embodiment of the present disclosure the software is configured to generate the holdover frequency command responsively to clock updates.

Further in accordance with an embodiment of the present disclosure the software is configured to generate the holdover frequency command responsively to any one or more of the following an average of clock updates, a mean of clock updates, a median of clock updates, and a mode of clock updates.

Still further in accordance with an embodiment of the present disclosure the clock controller is configured to generate the holdover frequency command responsively to clock updates.

Additionally in accordance with an embodiment of the present disclosure the clock controller is configured to generate the holdover frequency command responsively to any one or more of the following an average of clock updates, a mean of clock updates, a median of clock updates, and a mode of clock updates.

Moreover in accordance with an embodiment of the present disclosure the software is configured to provide a message to the clock controller to cancel the holdover frequency command.

Further in accordance with an embodiment of the present disclosure the software is configured to provide another holdover frequency command to the clock controller to override the previously provided holdover frequency command.

Still further in accordance with an embodiment of the present disclosure the clock controller is included in a processor configured to execute driver software, which is configured responsively to detecting the failure to apply the holdover frequency command to the clock.

Additionally in accordance with an embodiment of the present disclosure the clock controller includes an application specific integrated circuit, which is configured responsively to detecting the failure to apply the holdover frequency command to the clock.

Moreover, in accordance with an embodiment of the present disclosure the clock circuitry maintains the clock for at least one of a network interface controller, a data processing unit (DPU), a central processing unit (CPU), or a graphics processing unit (GPU).

There is also provided in accordance with another embodiment of the present disclosure, a clock synchronization method, including maintaining a clock running at a clock frequency, generating clock update commands, applying by a clock controller the clock update commands to the clock, storing a holdover frequency command to maintain the clock during a failure of the clock update commands, and applying by the clock controller the holdover frequency command to the clock responsively to detecting the failure.

Further in accordance with an embodiment of the present disclosure, the method includes generating the holdover frequency command.

Still further in accordance with an embodiment of the present disclosure the applying includes applying the holdover frequency command to the clock in the absence of the clock controller receiving any clock update command within a time period derived from timing criteria.

Additionally in accordance with an embodiment of the present disclosure, the method includes generating the timing criteria, which indicates when the clock controller applies the holdover frequency command, and providing the timing criteria to the clock controller.

Moreover, in accordance with an embodiment of the present disclosure, the method includes providing a message including the holdover frequency command and the timing criteria to the clock controller.

Further in accordance with an embodiment of the present disclosure the timing criteria specifies a deadline of the time period.

Still further in accordance with an embodiment of the present disclosure the timing criteria defines the deadline as any of the following a given time value, a time relative to when the timing criteria was received by the clock controller, a time relative to when the clock controller applied a given previous frequency adjustment, or a time relative to when the clock controller applied a latest frequency adjustment.

Additionally in accordance with an embodiment of the present disclosure the generating the holdover frequency command includes generating the holdover frequency command responsively to frequency updates.

Moreover, in accordance with an embodiment of the present disclosure the generating the holdover frequency command includes generating the holdover frequency command responsively to any one or more of the following an average of frequency updates, a mean of frequency updates, a median of frequency updates, and a mode of frequency updates.

Further in accordance with an embodiment of the present disclosure, the method includes providing a message to the clock controller to cancel the holdover frequency command.

Still further in accordance with an embodiment of the present disclosure, the method includes providing another holdover frequency command to the clock controller to override the previously provided holdover frequency command.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood from the following detailed description, taken in conjunction with the drawings in which:

FIG. 1 is a block diagram view of a clock synchronization system constructed and operative in accordance with an embodiment of the present invention;

FIG. 2 is a flowchart including steps in a clock synchronization method for use in the system of FIG. 1;

FIGS. 3-5 are flowcharts including steps in a method of holdover frequency management for use in the system of FIG. 1;

FIG. 6 is a graph illustrating holdover time synchronization in the system of FIG. 1; and

FIG. 7 is a block diagram view of a clock synchronization system constructed and operative in accordance with an alternative embodiment of the present invention.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

As previously mentioned, a local clock running on a device (such as peripheral device (e.g., a network interface controller (NIC)), or a device including a graphics processing unit (GPU), data processing unit (DPU), or central processing unit (CPU)), may be adjusted based on frequency updates provided by a software application running on a processor, for example, in a host device. The software managing the clock (sometimes referred to as “servo”) disciplines the clock by measuring the clock's error against some clock synchronization leader and issues adjustment commands to correct the clock errors.

A clock is described as being in state of “holdover” if it is no longer being disciplined according to measurements of the clock's error against some reference (e.g., a clock synchronization leader). Holdover may be a result of some failure to receive clock updates such as connectivity loss, failure of the reference, or failure of software managing the clock. The corrections applied to the clock by the software are persistent even if the software no longer controls the clock, such as when the software crashes. This means that if the software crashes or there is some other failure, the clock will be “dead reckoning” with the last adjustment the clock received from the software and the clock accuracy in the state of holdover is entirely decided by the last adjustment. This is not generally a satisfactory solution as the previous software correction corrects for short-term, medium-term, and long-term errors. Additionally, using the last adjustment in the long term generally leads to a large clock drift.

Using the last adjustment while the software has failed (or some other failure) may be problematic in at least two cases in particular: (1) if a clock control loop uses frequency adjustments to compensate for time error leading to relatively high-amplitude frequency adjustments in regular operation; and (2) the clock control loop is currently responding to a transient timing error (e.g., due to network congestion or network reconfiguration).

Therefore, in embodiments of the present invention, clock management software is programmed to provide a clock controller with a holdover frequency command to be used in the future by the clock controller to maintain the clock when there is a failure to receive clock updates (e.g., when the software crashes or is killed or does not provide clock updates commands on a regular basis for any reason). In some embodiments, the clock controller generates the holdover frequency command.

While the software is active and is still sending clock update commands to the clock controller, the clock controller maintains the clock and applies the clock update commands to the clock. The clock update commands may be frequency update commands (i.e., to update a frequency of the clock) or clock value update commands (i.e., to update the value of the clock). The clock may be updated by updating a frequency of the clock and/or updating the clock value, e.g., by stepping the clock value from one value to another value such as moving the clock by 10 nanoseconds forward or backward. However, when the software fails or similar failure occurs and the clock controller no longer receives clock update commands (e.g., within a timeout), the clock controller maintains and updates the clock (e.g., by updating the clock frequency and/or the clock value) based on the previously provided holdover frequency command.

The holdover frequency command may be generated to maintain the clock over the medium to long term. In some embodiments, the holdover frequency command may be computed based on two or more (e.g., 1000) (previous) frequency updates applied to the clock.

In some embodiments, the clock controller may determine that a failure has occurred based on the absence of the clock controller receiving any clock update commands within a time period derived from timing criteria (e.g., previously provided by the software). The timing criteria may specify a deadline of the time period over which absence of receiving any clock update command is determined. The time period may have any suitable duration for example in the order of microseconds to minutes. The timing criteria may define the deadline as any of the following: a given time value, a time relative to when the timing criteria was received by the clock controller, a time relative to when the clock controller applied a given previous frequency adjustment, or a time relative to when the clock controller applied a latest frequency adjustment.

In some embodiments, the software or the clock controller may generate the holdover frequency command based on one or more of the following: an average of (previous) frequency updates, a mean of (previous) frequency updates, a median of (previous) frequency updates, a mode of (previous) frequency updates.

The software may provide a message to the clock controller to cancel the holdover frequency command. The software may provide another holdover frequency command to the clock controller thereby overriding a previously provided holdover frequency command.

In some embodiments, the clock controller may be implemented using driver software which is executed by a processor in the host device. The driver detects the failure of the software and applies the holdover frequency command to the clock frequency. In other embodiments, the clock controller may include an application specific integrated circuit (ASIC), which responsively to detecting the failure of the software applies the holdover frequency command to the clock frequency.

System Description

Reference is now made to FIG. 1, which is a block diagram view of a clock synchronization system 10 constructed and operative in accordance with an embodiment of the present invention. The system 10 comprises a host device 12 and a peripheral device 14 connected to each other via a suitable interface, for example, a peripheral data bus interface, such as Peripheral Component Interconnect Express (PCIe). In some embodiments, the host device 12 and the peripheral device 14 may be combined into a single processing device. In other embodiments, the host device 12 and/or peripheral device 14 may be any suitable processing devices connected via a suitable data connection.

The host device 12 includes: a processor 16 configured to execute software 18; and an interface 20 configured to share data with the peripheral device 14. The software 18 is described in more detail with reference to FIGS. 2-7.

The peripheral device 14 includes: an interface 38 configured to share data with the host device 12; a clock controller 22; clock circuitry 24; and one or more of the following: a network interface controller (NIC) 26; a data processing unit (DPU) 28; a central processing unit (CPU) 30; and/or a graphics processing unit (GPU) 32. In some embodiments, the central processing unit 30 and the processor 16 may be the same element.

The clock controller 22 includes an application specific integrated circuit (ASIC) 36. The functionality of the application specific integrated circuit 36 is described in more detail with reference to FIGS. 3 and 5. The clock controller 22 is described in more detail with reference to FIGS. 2-7. In some embodiments, the clock controller 22 is implemented by a driver run by the processor 16 of the host device 12, described in more detail with reference to FIG. 7.

The clock circuitry 24 is configured to maintain a clock 34 running at a clock frequency. The clock circuitry 24 may include a hardware clock (e.g., Precision Time Protocol (PTP) hardware clock) which maintains a clock time (e.g., Coordinated Universal Time or UTC) and runs at the clock frequency. In some embodiments, the clock circuitry 24 may include a free running counter and the time of the clock is obtained by applying some computation to the value of the counter. The clock 34 may be adjusted by adjusting the frequency of the running hardware clock or counter, or by adjusting a time value of the clock or a value of the counter, or by applying an adjustment to the computation used to compute the clock time from the value of the counter. In some embodiments, the clock circuitry 24 is configured to maintain the clock 34 for one or more of: the network interface controller 26; the data processing unit 28; the central processing unit 30; and/or the graphics processing unit 32.

Reference is now made to FIG. 2, which is a flowchart 200 including steps in a clock synchronization method for use in the system 10 of FIG. 1. The software 18 is configured to generate clock update commands and provide the clock update commands to the clock controller 22 to apply the clock update commands to the clock maintained by the clock circuitry 24. The clock update commands may be frequency update commands (i.e., to update a frequency of the clock) or clock value update commands (i.e., to update the value of the clock). The clock may be updated by updating a frequency of the clock and/or updating the clock value, e.g., by stepping the clock value from one value to another value. A frequency update command may be used to update a frequency of the clock or to update the clock value by stepping the clock intermittently according to the frequency update command. A clock update command may be used to update the clock value by changing the clock value or by changing the clock frequency which leads to changing the clock value over time.

In more detail, the software 18 is configured to generate a clock (frequency) update command (block 202), and provide the generated clock (frequency) update command to the clock controller 22 (block 204) to apply the clock (frequency) update command to the clock and/or clock frequency. The steps of blocks 202 and 204 are repeated intermittently, for example, every millisecond or second etc. The above process is used to correct the frequency and/or value of the clock 34 on a regular basis based on time synchronization with a remote clock (not shown).

FIGS. 3-5 are flowcharts including steps in a method of holdover frequency management for use in the system 10 of FIG. 1. Reference is now made to FIG. 3, which is a flowchart 300 in a method performed by the application specific integrated circuit 36 of the clock controller 22. The application specific integrated circuit 36 of the clock controller 22 is configured to start a timer (block 302), which is used to determine if the software 18 has failed or if there is another failure of receiving clock (frequency) update commands (e.g., due to leader failure or connection failure), as will be described in more detail with reference to FIG. 5. Using a timer is one way to determine if the software has failed or if there is another failure of receiving clock (frequency) update commands. Other methods may also be applied to determine if the software has failed or if there is another failure of receiving clock (frequency) update commands. The application specific integrated circuit 36 of the clock controller 22 is configured to receive a clock (frequency) update command from the software 18 (block 304). The application specific integrated circuit 36 of the clock controller 22 is configured to reset the timer, upon receiving the clock (frequency) update command (block 306) and the timer then continues to run from its reset value (e.g., zero). The application specific integrated circuit 36 of the clock controller 22 is configured to apply the received clock (frequency) update command to the value of the clock 34 and/or clock frequency of the clock 34 (block 308). The steps of blocks 304-308 are repeated upon receiving a new clock (frequency) update command.

Reference is now made to FIG. 4, which is a flowchart 400 in a method performed by the software 18 to generate and provide a holdover frequency command to the clock controller 22. In some embodiments, the software 18 is configured to generate timing criteria, which indicates when the clock controller 22 applies the holdover frequency command to the value of the clock and/or frequency of the clock (block 402). The timing criteria is provided to the clock controller 22 as described in more detail below. The timing criteria generally specifies a deadline (or a length) of a time period after which the clock controller 22 applies the holdover frequency command to the clock value and/or frequency in the absence of receiving a clock (frequency) update command during the time period. The time period and/or the deadline may be tracked using the timer (which is reset when a clock (frequency) update command is received) described with reference to FIG. 3 or a timer which is managed according to any suitable method depending on the timing criteria. The timing criteria may define the deadline as any of the following: a given time value; a time relative to when the timing criteria was received by the clock controller 22; a time relative to when the clock controller 22 applied a given previous frequency adjustment; or a time relative to when the clock controller 22 applied a latest frequency adjustment.

The software 18 is configured to generate the holdover frequency command to maintain the clock frequency during a failure of the software 18 or other failure to receive clock (frequency) update commands (as described above) for future use by the clock controller 22 (block 404) The software 18 may be configured to generate the holdover frequency command responsively to two or more previously applied or computed clock (frequency) updates to the frequency of the clock 34. For example, the holdover frequency command may be computed using any suitable function from the X previous frequency updates, where X may have any suitable value, such as 2, 5, 1,000, 10,000, etc. By way of another example, the holdover frequency command may be computed by summing the amount of nanoseconds the clock was stepped over a certain period of time and divided by the duration of that period.

The software 18 is configured to generate the holdover frequency command responsively to one or more of the following: an average of frequency updates; a mean of frequency updates; a median of frequency updates; and/or a mode of frequency updates.

In other embodiments, the holdover frequency command and/or the timing criteria may be generated by the clock controller 22 instead of by the software 18 according to the methods described above. The clock controller 22 may be manufactured or otherwise configured to generate the holdover frequency command and/or the timing criteria. Alternatively, the software 18 may signal the clock controller 22 to generate the holdover frequency command and/or the timing criteria.

In some embodiments, the software 18 is configured to provide the timing criteria to the clock controller 22 (block 406). The software 18 is configured to provide the holdover frequency command to the clock controller 22 (block 408). In some embodiments, the steps of blocks 406-408 may be performed by the software 18 being configured to provide a message including the holdover frequency command and the timing criteria to the clock controller 22 (block 410).

The software 18 may be configured to provide a message to the clock controller 22 to cancel the provided holdover frequency command (block 412). The software 18 may be configured to intermittently perform the steps of blocks 402-412 again with a new holdover frequency command and optionally new timing criteria. Therefore, the software 18 may be configured to provide another holdover frequency command to the clock controller 22 to override the previously provided holdover frequency command.

Reference is now made to FIG. 5, which is a flowchart 500 including steps in a method in which the clock controller 22 applies the provided holdover frequency command to the clock value and/or frequency of the clock 34.

The application specific integrated circuit 36 of the clock controller 22 is configured to receive the holdover frequency command from the software 18 (block 502) (optionally overwriting a previous holdover frequency command). In some embodiments, the application specific integrated circuit 36 of the clock controller 22 is configured to receive a cancellation message canceling the provided holdover frequency command (block 504) and cancel the holdover frequency command (block 506), which may include deleting the provided holdover frequency command (from memory) or preventing use of the provided holdover frequency command. In other embodiments, the application specific integrated circuit 36 is configured to generate the holdover frequency command.

The application specific integrated circuit 36 of the clock controller 22 is configured to store the holdover frequency command for future use (block 507).

Assuming the holdover frequency command has not cancelled, the application specific integrated circuit 36 of the clock controller 22 is configured to apply the holdover frequency command to the clock frequency responsively to detecting the failure of the software 18 or other failure to receive the clock (frequency) update commands, as described in more detail below.

The application specific integrated circuit 36 is configured to detecting failure of the software 18 or other failure to receive the clock (frequency) update commands (block 508). The step of block 508 may include the application specific integrated circuit 36 being configured to check a value of the timer (block 510) and at decision block 512 determine if the value of the timer fulfills the timing criteria, for example, determine if the value of the timer has exceeded a given time value thereby indicating that the time period over which a clock (frequency) update command should have been received by the clock controller 22 has expired without receipt of any clock (frequency) update command by the clock controller 22.

If the value of the timer does not fulfill the criteria (e.g., the timer has not expired) the step of block 510 is repeated. If the value of the timer does fulfill the criteria (e.g., the timer has expired) the application specific integrated circuit 36 of the clock controller 22 is configured to apply the holdover frequency command to the clock value and/or frequency to maintain the clock 34 (block 514) until further clock (frequency) update commands are received by the clock controller 22 from the software 18. Therefore, in some embodiments, the clock controller 22 is configured to apply the holdover frequency command to the clock value and/or frequency in the absence of the clock controller 22 receiving any clock (frequency) update command within the time period derived from timing criteria.

Reference is now made to FIG. 6, which is a graph 600 illustrating holdover time synchronization in the system 10 of FIG. 1. The graph 600 shows a line 602 which would be followed if the follower is exactly following the time on the leader all the time (without the need for corrections). A line 604 shows how the follower's time drifts from the time of the leader and is corrected based on the clock (frequency) update commands. At a certain time, the software 18 crashes (icon 608). If the clock controller 22 would continue to maintain the clock based on the latest clock (frequency) update command, the time on the follower would continue to drift from the time of the leader as shown by a line 606 which is a continuation of the last section of the line 604 before the crash. If the clock controller 22 maintains the clock based on the holdover frequency command, the time on the follower (shown by a line 610) does not drift as much as shown by the line 606.

Reference is now made to FIG. 7, which is a block diagram view of a clock synchronization system 700 constructed and operative in accordance with an alternative embodiment of the present invention. The clock synchronization system 700 is substantially the same as the system 10 of FIG. 1 except for the following differences. The clock controller 22 is comprised in the processor 16 and is typically at least partially implemented by driver software 702 running on the processor 16 of the host device 12. The steps performed by the application specific integrated circuit 36 in the system 10 (as described above with reference to FIGS. 3, 4 and 5) are generally performed by the driver software 702 in the clock synchronization system 700.

In practice, some or all of the functions of the clock controller 22 may be combined in a single physical component or, alternatively, implemented using multiple physical components. These physical components may comprise hard-wired or programmable devices, or a combination of the two. In some embodiments, at least some of the functions of the clock controller 22 may be carried out by a programmable processor under the control of suitable software. This software may be downloaded to a device in electronic form, over a network, for example. Alternatively, or additionally, the software may be stored in tangible, non-transitory computer-readable storage media, such as optical, magnetic, or electronic memory.

Various features of the invention which are, for clarity, described in the contexts of separate embodiments may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment may also be provided separately or in any suitable sub-combination.

The embodiments described above are cited by way of example, and the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the invention includes both combinations and sub-combinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.

Claims

1. A clock synchronization system, comprising: clock circuitry to maintain a clock running at a clock frequency;a clock controller; anda processor to execute software to generate clock update commands and provide the clock update commands to the clock controller, wherein the clock controller is configured to:apply the clock update commands to the clock;store a holdover frequency command to maintain the clock during a failure of the clock update commands;apply the holdover frequency command to the clock responsively to detecting the failure, wherein the clock controller or the software is configured to generate the holdover frequency command responsively to any one or more of the following: an average of clock updates; a mean of clock updates; a median of clock updates; and a mode of clock updates; andapply the holdover frequency command to the clock in the absence of the clock controller receiving any clock update command within a time period derived from timing criteria.

2. The system according to claim 1, wherein the software is configured to: generate the holdover frequency command; and provide the holdover frequency command to the clock controller.

3. The system according to claim 1, wherein the clock controller is configured to generate the holdover frequency command.

4. The system according to claim 1, wherein the software is configured to: generate the timing criteria, which indicates when the controller applies the holdover frequency command; andprovide the timing criteria to the clock controller.

5. The system according to claim 4, wherein the software is configured to provide a message including the holdover frequency command and the timing criteria to the clock controller.

6. The system according to claim 1, wherein the timing criteria specifies a deadline of the time period.

7. The system according to claim 6, wherein the timing criteria defines the deadline as any of the following: a given time value; a time relative to when the timing criteria was received by the clock controller; a time relative to when the clock controller applied a given previous frequency adjustment; or a time relative to when the clock controller applied a latest frequency adjustment.

8. The system according to claim 1, wherein the software is configured to generate the holdover frequency command responsively to clock updates.

9. The system according to claim 1, wherein the clock controller is configured to generate the holdover frequency command responsively to clock updates.

10. A clock synchronization system, comprising: clock circuitry to maintain a clock running at a clock frequency;a clock controller; anda processor to execute software to generate clock update commands and provide the clock update commands to the clock controller, wherein the clock controller is configured to:apply the clock update commands to the clock;store a holdover frequency command to maintain the clock during a failure of the clock update commands;apply the holdover frequency command to the clock responsively to detecting the failure, wherein the software is configured to: provide a message to the clock controller to cancel the holdover frequency command; and provide another holdover frequency command to the clock controller to override the previously provided holdover frequency command; andapply the holdover frequency command to the clock in the absence of the clock controller receiving any clock update command within a time period derived from timing criteria.

11. The system according to claim 1, wherein the clock controller is comprised in a processor configured to execute driver software, which is configured responsively to detecting the failure to apply the holdover frequency command to the clock.

12. The system according to claim 1, wherein the clock controller includes an application specific integrated circuit, which is configured responsively to detecting the failure to apply the holdover frequency command to the clock.

13. The system according to claim 1, wherein the clock circuitry maintains the clock for at least one of: a network interface controller; a data processing unit (DPU); a central processing unit (CPU); or a graphics processing unit (GPU).

14. A clock synchronization method, comprising: maintaining a clock running at a clock frequency;generating clock update commands;applying by a clock controller the clock update commands to the clock;storing a holdover frequency command to maintain the clock during a failure of the clock update commands; andapplying by the clock controller the holdover frequency command to the clock responsively to detecting the failure, wherein the generating the holdover frequency command includes generating the holdover frequency command responsively to any one or more of the following: an average of frequency updates; a mean of frequency updates; a median of frequency updates; and a mode of frequency updates, wherein the applying includes applying the holdover frequency command to the clock in the absence of the clock controller receiving any clock update command within a time period derived from timing criteria.

15. The method according to claim 14, further comprising generating the holdover frequency command.

16. The method according to claim 14, further comprising: generating the timing criteria, which indicates when the clock controller applies the holdover frequency command; andproviding the timing criteria to the clock controller.

17. The method according to claim 16, further comprising providing a message including the holdover frequency command and the timing criteria to the clock controller.

18. The method according to claim 14, wherein the timing criteria specifies a deadline of the time period.

19. The method according to claim 18, wherein the timing criteria defines the deadline as any of the following: a given time value; a time relative to when the timing criteria was received by the clock controller; a time relative to when the clock controller applied a given previous frequency adjustment; or a time relative to when the clock controller applied a latest frequency adjustment.

20. The method according to claim 14, wherein the generating the holdover frequency command includes generating the holdover frequency command responsively to frequency updates.

21. The method according to claim 14, further comprising providing a message to the clock controller to cancel the holdover frequency command.

22. The method according to claim 14, further comprising providing another holdover frequency command to the clock controller to override the previously provided holdover frequency command.