Fix race condition causing ADCs to read stale values

This was a *fun* bug to track down. Initially, it appeared as an out of
order read of multiple ADC channels (the second would read the first
channel, the third from the second, and so on). This only happened with
a prescaler value of `8`, for other values, the corect behaviour was
observed.

`git bisect` traced the issue back to a version bump of the `pac` crate
which shouldn't have affected things. Further git bisection hinted at
the commit bumping version number in the PAC was the issue. This is of
course nonsensical, and the key change that caused the **symptoms** was
a bump of the svd2rust crate, from 0.14 to 0.15.

Dumping the memory in the ADC and RCC peripherals showed barely any
difference, apart from the newer `pac` version randomly having the
`swstart` and `eoc` bits set after the second line of the convert
function. After further single stepping, those bits were set after a
write of `0001e0001` to `cr2`. This was the value that was already in
the register, so why would that start a conversion?

Well, someone decided that it would be a good idea to make one way of
starting the ADC conversion to write a `1` to the `adon` bit if the
`adon` bit is already one. But that might trigger a read when you want
to modify other parts of the register, so this behaviour only happens if
no other bits are modified. Thus, `modify` on the `cr2` register will
start a conversion unless at least one bit is *actually* modified.

This was accidentally done as the first part of the `convert` function,
which started a conversion which would be ready roughly by the time the
CPU starts checking for `eoc` bits.

The race condition occurs if the CPU gets to the `EOC` check, before the
ADC has time to reset the bit as a result of the `swstart` trigger. This
relies on the CPU being faster than the ADC clock which explains the
behaviour at high prescalers.

Finally, it seems like the line
```rust
while self.rb.cr2.read().swstart().bit_is_set() {}
```
*should* have prevented this as the ADC should have taken care of the
`swstart` and reset the `EOC` before that line. For whatever reason,
that did not happen

Co-authored-by: Adam Greig <adam@adamgreig.com>

Author: TheZoq2

CHANGELOG.md

@@ -27,6 +27,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 ### Fixed
 
 - Fix PWM on `TIM1`
+- Fix ADC race condition causing incorrect reads at certain frequencies
 
 ## [v0.5.3] - 2020-01-20
 

src/adc.rs

@@ -349,13 +349,34 @@ macro_rules! adc_hal {
                     self.rb.sqr1.modify(|_, w| w.l().bits((len-1) as u8));
                 }
 
+                /**
+                  Performs an ADC conversion
+
+                  NOTE: Conversions can be started by writing a 1 to the ADON
+                  bit in the `CR2` while it is already 1, and no other bits
+                  are being written in the same operation. This means that
+                  the EOC bit *might* be set already when entering this function
+                  which can cause a read of stale values
+
+                  The check for `cr2.swstart.bit_is_set` *should* fix it, but
+                  does not. Therefore, ensure you do not do any no-op modifications
+                  to `cr2` just before calling this function
+                */
                 fn convert(&mut self, chan: u8) -> u16 {
-                    self.rb.cr2.modify(|_, w| w.align().bit(self.align.into()));
+                    // Dummy read in case something accidentally triggered
+                    // a conversion by writing to CR2 without changing any
+                    // of the bits
+                    self.rb.dr.read().data().bits();
+
                     self.set_channel_sample_time(chan, self.sample_time);
                     self.rb.sqr3.modify(|_, w| unsafe { w.sq1().bits(chan) });
 
                     // ADC start conversion of regular sequence
-                    self.rb.cr2.modify(|_, w| w.swstart().set_bit());
+                    self.rb.cr2.modify(|_, w|
+                        w
+                            .swstart().set_bit()
+                            .align().bit(self.align.into())
+                    );
                     while self.rb.cr2.read().swstart().bit_is_set() {}
                     // ADC wait for conversion results
                     while self.rb.sr.read().eoc().bit_is_clear() {}