Unfortunately the RK3399 supports only 1.8V and 3.0V I/O. Most of the GPIOs on the GPIO header are 3.0V as stated in the Wiki. I’ve read the RK3399 TRM, Data sheet, and Design Guide but I have not found any information on how robust the GPIO drivers are.
As stated in this wiki page some pins have pull ups to 3.3V. However, the maximum voltage is 3.15V according to the RK3399 data sheet. Why did you choose to pull the pins up to 3V3 instead of 3V0? The internal body diodes will clamp the voltage to ~3V15 anyway. A pull up to 3V0 would at least be within specification. Or do you have any indication from Rockchip that pull-up resistors to 3V3 are ok?
If over-voltage on those pins is ok, how much current is allowed to flow? With 4k7 to 3V3 I would estimate somewhere between 64 to 32 µA (depending on whether you take the difference to 3V15 or 3V0).
The spi-install wiki page even suggests shorting the SPICLK GPIO to GND.
The Design Guide states that in boot mode the SPI GPIOs are configured for 7mA drive strength. None of the documents state that a continuous short to GND is ok. Do you have any more information on this?
If there is ever a 1.5 revision of the Rock Pi I would suggest putting 3.0V on the 3.3V GPIO header pins 1 and 17. I’d also change the pull-ups for I2C to the 3V0 rail (or maybe require external pull-ups?). Any 2.7 - 3.6V-device powered from the GPIO pins 1 and 17 will work with 3.0V and it will have the correct voltage on the GPIOs.
As it is you either require:
(1) external 3.0V power supply
(2) series resistors on the GPIO lines to at least limit the current into the GPIO pins of the RK3399
(3) level shifter IC on the GPIO
(4) risk damaging the GPIO pins - or even the whole chip by applying 3V3 without protection