Skip to content

Fix hard faults when handling large MSP responses over CRSF#11369

Open
KeithCoreDumped wants to merge 3 commits intoiNavFlight:maintenance-9.xfrom
HumpbackLab:fix/msp-crsf-communication
Open

Fix hard faults when handling large MSP responses over CRSF#11369
KeithCoreDumped wants to merge 3 commits intoiNavFlight:maintenance-9.xfrom
HumpbackLab:fix/msp-crsf-communication

Conversation

@KeithCoreDumped
Copy link

Description

Resolves hard faults and connection hangs when the INAV Configurator requests large datasets (e.g., Mixer configuration on the Mixer tab) via an ELRS WiFi TCP connection.

System Architecture

graph LR
    A["INAV<br/>Configurator<br/>(TCP Client)"] -->|MSP Request| B["ELRS WiFi<br/>TCP Server<br/>:5761"]
    B -->|MSP in CRSF Req| C
    C -->|MSP in CRSF Res| B
    B -->|MSP Response| A

    subgraph FC["INAV Flight Controller"]
        C["CRSF<br/>Handler"] -->|MSP Request| D["MSP<br/>Handler"]
        D -->|MSP Response| C
    end
Loading

Root Cause

The original MSP-over-CRSF implementation assumed small payloads. When requesting large datasets (like the 432-byte Mixer config), this caused:

  1. Buffer overflows in CRSF_MSP_RX_BUF_SIZE (128 bytes), leading to hard faults.
  2. uint8_t overflows in size and bufferBytesRemaining, corrupting MSP headers and packet tracking.
  3. Incorrect buffer boundary initialization in initSharedMsp().

Investigation

  • CRSF Packet captures: Confirmed the ELRS receiver correctly fragments, sequences, and forwards complete MSP frames via the CRSF tunnel.
  • Direct UART test: Forwarding TCP packets directly to the FC's MSP UART works perfectly, isolating the bug to INAV's MSP-over-CRSF handling.

Fixes & Memory Impact

  • Increased CRSF_MSP_RX_BUF_SIZE and CRSF_MSP_TX_BUF_SIZE to 512 bytes (safely accommodates max known payloads).
  • Widened size and bufferBytesRemaining from uint8_t to uint16_t.
  • Fixed buffer boundaries in initSharedMsp() and pointer resets in processMspPacket().
  • Memory Impact: Adds 768 bytes total SRAM usage (~0.3% on AT32F435). A negligible tradeoff for wireless configuration stability.

Expected Behavior & Verification

  • Behavior: All Configurator tabs load reliably over ELRS WiFi TCP without freezing. Enables in-field wireless tuning. (Note: CLI uses a raw text protocol unsupported by ELRS tunneling).
  • Verification: Tested on NEUTRONRCF435MINI with an ESP8285 ELRS RX (v3.6.2). MSP2_INAV_SERVO_MIXER loads successfully with a valid CRC.

@github-actions
Copy link

Branch Targeting Suggestion

You've targeted the master branch with this PR. Please consider if a version branch might be more appropriate:

  • maintenance-9.x - If your change is backward-compatible and won't create compatibility issues between INAV firmware and Configurator 9.x versions. This will allow your PR to be included in the next 9.x release.

  • maintenance-10.x - If your change introduces compatibility requirements between firmware and configurator that would break 9.x compatibility. This is for PRs which will be included in INAV 10.x

If master is the correct target for this change, no action is needed.


This is an automated suggestion to help route contributions to the appropriate branch.

@KeithCoreDumped KeithCoreDumped marked this pull request as ready for review February 27, 2026 18:26
@KeithCoreDumped KeithCoreDumped changed the base branch from master to maintenance-9.x February 27, 2026 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant