time: Revise state abstraction

Make abstract state `State` of HW.Time.Timer, that's used to derive the
Hz value for instance, External. This helps to fix flow issues in the
mutime implementation and also matches real hardware better: The clock
rate may be derived from the hardware state.

HW.Time.Timer.Hz had to be made a volatile function, therefore.

Change-Id: I35af2d0db1acbf9652ea00763aa288545746bb79
Signed-off-by: Nico Huber <nico.huber@secunet.com>
Reviewed-on: https://review.coreboot.org/c/libhwbase/+/26838
Tested-by: Nico Huber <nico.h@gmx.de>
Reviewed-by: Reto Buerki <reet@codelabs.ch>
diff --git a/common/hw-time.adb b/common/hw-time.adb
index 28db95d..b81d343 100644
--- a/common/hw-time.adb
+++ b/common/hw-time.adb
@@ -34,25 +34,28 @@
    with
       Refined_Global => (Input => (Timer.Abstract_Time, Timer.Timer_State))
    is
+      Hz : constant T := Timer.Hz;
       Current : constant T := Timer.Raw_Value_Max;
    begin
-      return Current + (T (US) * Timer.Hz + 999_999) / 1_000_000;
+      return Current + (T (US) * Hz + 999_999) / 1_000_000;
    end US_From_Now;
 
    function MS_From_Now (MS : Natural) return T
    with
       Refined_Global => (Input => (Timer.Abstract_Time, Timer.Timer_State))
    is
+      Hz : constant T := Timer.Hz;
       Current : constant T := Timer.Raw_Value_Max;
    begin
-      return Current + (T (MS) * Timer.Hz + 999) / 1_000;
+      return Current + (T (MS) * Hz + 999) / 1_000;
    end MS_From_Now;
 
    function Now_US return Int64
    with
       Refined_Global => (Input => (Timer.Abstract_Time, Timer.Timer_State))
    is
-      MHz : constant T := Timer.Hz / 1_000_000;
+      Hz : constant T := Timer.Hz;
+      MHz : constant T := Hz / 1_000_000;
       Current : constant T := Timer.Raw_Value_Min;
    begin
       return Int64 (Current and (2 ** 63 - 1))
@@ -65,7 +68,7 @@
    with
       Refined_Global => (Input => (Timer.Abstract_Time))
    is
-      Current: T;
+      Current : T;
    begin
       loop
          Current := Timer.Raw_Value_Min;