disabling REPL...revisited Cross posting from discord

[littlegreenbean33]

Please Help. I am using an industrial device based on esp32s3. I am using micropython 1.22.2. My code is freeze or in mpy format. I need to disable REPL. I only have access to UART0 via USB and I need it for my application.

However, by no means can a REPL appear if a connection to UART0/USB happens. Eitherwise all encryption protections are off.

I have already tried, as per the forums with MICROPY_ENABLE_REPL 1/0, MICROPY_HW_ENABLE_UART_REPL 1/0 to no success.

If I disable MICROPY_HW_ENABLE_UART_REPL, my SW no longer automatically starts (main.mpy --> app.mpy) and UART0 becomes unresponsive. I presume this is a recurring problems when MP is used in a secure context. ChatGPT nor Google provided a working answer. Any help really appreciated. I am stuck on this for days.

[andrewleech]

You will most likely need to update your base micropython to v1.24.1 or latest master as there has been a lot of change recently around the ability to enable/disable usb repl on the esp32 port.

MICROPY_ENABLE_REPL isn't a valid config, it doesn't appear in the code for micropython at all.

One config that should work everywhere is #define MICROPY_ENABLE_COMPILER (0) which will completely remove the ability for the board to compile python into bytecode; this indirectly disables repl as the repl requires the compiler to execute any entered code.

The configuration for handling whether repl is connected to usb / uart is implemented with the stdin / stdout functions in https://github.com/micropython/micropython/blob/master/ports/esp32/mphalport.c

A quick scan of that file (from latest master) looks like #define MICROPY_HW_ENABLE_UART_REPL (0) should work on the current version to disconnect stdio / repl from the uart.

[littlegreenbean33]

define MICROPY_ENABLE_COMPILER (0) does not work on my end. Setting this to 0 in my build directory does nothing. My original design trusted that this was working as expected. But it is not for 1.22.2

[littlegreenbean33]

#define MICROPY_HW_ENABLE_UART_REPL (0) bricks my device. Boot.py/main.py will not even start. I need to stay on 1.22.2 due to some changes in the TLS libraries that were affecting my code. I may need to refactor and move to 1.24. Need to think about it.

[projectgus]

(Copying my reply from Discord here with some edits.)

If you want sys.stdin/sys.stdout and no REPL, then the other option is to use a normal build config and structure your main.py so it absolutely can't drop to the REPL.

Something like this in main.py:

import machine, app
try:
    app.main()
finally:
   machine.reset()

Note that if you do want a REPL sometimes for debugging or analysis then you'll need to add some logic for a way to not trigger the reset.

If you're worried about security then there is maybe some additional risk here as the REPL is compiled into the binary, but a hypothetical attacker who already has the ability to modify running code or the filesystem (to get out of the finally block) probably already has full access to your system, REPL or not.

[littlegreenbean33]

I am eventually testing this, modifying main.c

You can still ctrl-break while the program is running, but it will take you nowhere. Which is pretty much what I need. It is either rest or run. No REPL by any type of accident.

//  for (;;) {
152 //      if (pyexec_mode_kind == PYEXEC_MODE_RAW_REPL) {
153 //          vprintf_like_t vprintf_log = esp_log_set_vprintf(vprintf_null);
154 //          if (pyexec_raw_repl() != 0) {
155 //              break;
156 //          }
157 //          esp_log_set_vprintf(vprintf_log);
158 //      } else {
159 //          if (pyexec_friendly_repl() != 0) {
160 //              break;
161 //          }
162 //      }
163 //  }
164 //
165         for (;;) {
166                 // Wait indefinitely to prevent reaching soft_reset_exit
167                 vTaskDelay(portMAX_DELAY);
168             }```