rk35xx: isolate ttyGS0 getty in a private device namespace

[Mkiring]

On reComputer RK35xx boards the USB gadget serial console (ttyGS0) is provided by usbdevice.service and consumed by serial-getty@ttyGS0. Under heavy firstlogin / console traffic the getty has been observed to lock up: the unit shows active but the login prompt stops responding and only a reboot recovers it.

Add PrivateDevices=yes plus an explicit DeviceAllow list (/dev/ttyGS0 and the char-tty class) to the existing serial-getty@ttyGS0 override, so the getty runs in a private /dev namespace exposing only the tty devices it actually needs. This makes restarts across gadget re-bind cycles reliable and resolves the observed hang.

Tested on reComputer RK3576 and RK3588 DevKit.

Summary by CodeRabbit

• Bug Fixes
  • Improved USB serial console access by allowing the serial-getty service to interact with the connected device.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• Needs review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: dce3404d-6781-4bf5-a375-83e838fa3826

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

📝 Walkthrough

Walkthrough

The serial-getty@ttyGS0 systemd drop-in enables private device isolation and permits read/write access to /dev/ttyGS0.

Changes

Serial device access

Layer / File(s)	Summary
Configure serial-getty device access config/sources/vendors/seeed-studio/recomputer-rk35xx-common.inc	The serial-getty@ttyGS0 drop-in sets PrivateDevices=yes and permits read/write access to /dev/ttyGS0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: isolating the RK35xx ttyGS0 getty in a private device namespace.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Hey @Mkiring! 👋

Thanks for submitting your first pull request to the Armbian project — we're excited to have you contributing! 🧡
Your effort doesn’t just improve Armbian — it benefits the entire community of users and developers.

If you'd like to stay informed about project updates or collaborate more closely with the team,
you can optionally share some personal contact preferences at armbian.com/update-data.
This helps us keep in touch without relying solely on GitHub notifications.

Also, don’t forget to ⭐ star the repo if you haven’t already — and welcome aboard! 🚀

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@config/sources/vendors/seeed-studio/recomputer-rk35xx-common.inc`:
- Around line 296-298: Update the service sandbox configuration around
PrivateDevices=yes so /dev/ttyGS0 is available to serial-getty@ttyGS0.service by
adding a BindPaths entry for /dev/ttyGS0, or disable private devices and apply
the exact device policy instead; preserve access for the existing tty device
rules.
- Line 298: Remove the broad DeviceAllow=char-tty rule and retain only
DeviceAllow=/dev/ttyGS0 rw in the relevant systemd service configuration; add
another specific device rule only if target-device inspection requires it.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 45f37948-92ba-4caf-838e-9e17d2062d4c

📥 Commits

Reviewing files that changed from the base of the PR and between 587b6f2 and d0da443.

📒 Files selected for processing (1)

• config/sources/vendors/seeed-studio/recomputer-rk35xx-common.inc

[github-actions]

✅ This PR has been reviewed and approved — all set for merge!