[PATCH 1/6] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage

[PATCH 1/6] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage

[Aurelien Jarno]

On the Banana Pi BPI-F3 board, the buck1 and buck2 voltage regulators,
which supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.

Set the maximum regulator voltage to 1.050V instead.

Fixes: 09a412d39748 ("riscv: dts: spacemit: define regulator constraints")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---
 arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts b/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
index e2961b7e0a3eb..58035d886bf67 100644
--- a/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
@@ -237,14 +237,14 @@ pmic@41 {
 		regulators {
 			buck1_0v9: buck1 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
 
 			buck2 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
-- 
2.53.0

Re: [PATCH 1/6] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Incomplete fix leaves other K1 boards vulnerable to permanent CPU damage due to dangerous regulator limits.
- [High] buck2 is orphaned from the CPU scaling topology, risking undervoltage crashes or hardware damage.
--

--- Patch [1]: [PATCH 1/6] riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage ---
commit 7fc7f69c1396ecd57da9622a68f4d3d15ff81423
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Wed Jul 29 15:02:18 2026 +0000

riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage

This patch lowers the maximum CPU core voltage on the Banana Pi BPI-F3 from
3.45V to 1.050V. This prevents potential permanent CPU damage that could
occur if a bug or privileged user requests a voltage above the safe limit.

Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net

> diff --git a/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts b/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
> index e2961b7e0a3eb..58035d886bf67 100644
> --- a/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
> +++ b/arch/riscv/boot/dts/spacemit/k1-bananapi-f3.dts
> @@ -237,14 +237,14 @@ pmic@41 {
>  		regulators {
>  			buck1_0v9: buck1 {
>  				regulator-min-microvolt = <500000>;
> -				regulator-max-microvolt = <3450000>;
> +				regulator-max-microvolt = <1050000>;

[Severity: Critical]
This is a pre-existing issue, but since this patch correctly identifies that
setting regulator-max-microvolt to 3.45V for the K1 CPU core regulators
can cause permanent physical damage, should this fix also be applied to
the other boards using the same K1 SoC?

Looking at the other device trees like k1-milkv-jupiter.dts and
k1-orangepi-rv2.dts, they still permit 3.45V on the buck1 and buck2 rails:

arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts:
    buck1 {
        regulator-max-microvolt = <3450000>;

arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts:
    buck1 {
        regulator-max-microvolt = <3450000>;

Could this incomplete fix leave these other boards vulnerable to the same
hardware damage from an OPP misconfiguration or privileged userspace request?

>  				regulator-ramp-delay = <5000>;
>  				regulator-always-on;
>  			};
>  
>  			buck2 {
>  				regulator-min-microvolt = <500000>;
> -				regulator-max-microvolt = <3450000>;
> +				regulator-max-microvolt = <1050000>;

[Severity: High]
This is a pre-existing issue, but since this commit confirms both buck1 and
buck2 supply the CPU core voltage, does the current CPU scaling topology
properly manage buck2?

In k1-bananapi-f3.dts, all eight CPUs currently point to buck1:

    cpu_4: cpu@4 {
        ...
        cpu-supply = <&buck1_0v9>;

If buck2 powers cluster 1, will scaling cluster 1 erroneously scale buck1
instead, leaving buck2 at a low boot voltage and causing cluster 1 to crash?

Alternatively, if buck1 and buck2 are physically tied together to share the
load, would leaving buck2 unmanaged while scaling buck1 cause severe
cross-conduction current between the regulators?

>  				regulator-ramp-delay = <5000>;
>  				regulator-always-on;
>  			};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729150722.1598630-1-aurelien@aurel32.net?part=1

[PATCH 2/6] riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage

[Aurelien Jarno]

On the Milk-V Jupiter board, the buck1 and buck2 voltage regulators,
which supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.

Set the maximum regulator voltage to 1.050V instead.

Fixes: 7d307daa12b1 ("riscv: dts: spacemit: Define the P1 PMIC regulators for Milk-V Jupiter")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---
 arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts b/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
index b61f5995ec771..c76b91ecb914d 100644
--- a/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
@@ -211,14 +211,14 @@ pmic@41 {
 		regulators {
 			buck1 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
 
 			buck2 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
-- 
2.53.0

Re: [PATCH 2/6] riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The unsafe maximum voltage limit (3.45V) for CPU core regulators `buck1` and `buck2` remains unpatched on several other SpacemiT K1 boards.
--

--- Patch [2]: [PATCH 2/6] riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage ---
commit 2f0408a9b68518bed697666281e9fbe48abb583b
Author: Aurelien Jarno <aurelien@aurel32.net>
Subject: riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage

This commit lowers the maximum regulator voltage for buck1 and buck2 on the
Milk-V Jupiter board from 3.45V to 1.050V. This prevents potential permanent
CPU damage from accidental overvoltage requests.

Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net

> diff --git a/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts b/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
> index b61f5995ec771..c76b91ecb914d 100644
> --- a/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
> +++ b/arch/riscv/boot/dts/spacemit/k1-milkv-jupiter.dts
> @@ -211,14 +211,14 @@ pmic@41 {
>  		regulators {
>  			buck1 {
>  				regulator-min-microvolt = <500000>;
> -				regulator-max-microvolt = <3450000>;
> +				regulator-max-microvolt = <1050000>;
>  				regulator-ramp-delay = <5000>;
>  				regulator-always-on;
>  			};
>  
>  			buck2 {
>  				regulator-min-microvolt = <500000>;
> -				regulator-max-microvolt = <3450000>;
> +				regulator-max-microvolt = <1050000>;

[Severity: High]
This is a pre-existing issue, but this commit only fixes the maximum voltage
for the Milk-V Jupiter board. Does this same CPU core overvoltage risk
exist on the other SpacemiT K1 boards?

The unsafe regulator-max-microvolt = <3450000> limit for buck1 and buck2 is
still present in several other device trees that share the same SoC and PMIC
layout:

- arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi
- arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
- arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
- arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts

Should these boards also have their limits updated to 1050000 to prevent
potential CPU damage from kernel misconfigurations or a privileged userspace
writing to the regulator sysfs interface?

>  				regulator-ramp-delay = <5000>;
>  				regulator-always-on;
>  			};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729150722.1598630-1-aurelien@aurel32.net?part=2

[PATCH 3/6] riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage

[Aurelien Jarno]

On the OrangePi RV2 board, the buck1 and buck2 voltage regulators, which
supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.

Set the maximum regulator voltage to 1.050V instead.

Fixes: c02c047b925c ("riscv: dts: spacemit: Define the P1 PMIC regulators for OrangePi RV2")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---
 arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts b/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts
index 7c49bce427f30..b907a1396b21f 100644
--- a/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-orangepi-rv2.dts
@@ -164,14 +164,14 @@ pmic@41 {
 		regulators {
 			buck1 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
 
 			buck2 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
-- 
2.53.0

[PATCH 4/6] riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage

[Aurelien Jarno]

On the MusePi Pro board, the buck1 and buck2 voltage regulators, which
supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.

Set the maximum regulator voltage to 1.050V instead.

Fixes: e2dac7c7a3a8 ("riscv: dts: spacemit: k1-musepi-pro: add PMIC and power infrastructure")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---
 arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts b/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
index 3078ffb5cb878..246f8f2ab62b9 100644
--- a/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-musepi-pro.dts
@@ -180,14 +180,14 @@ pmic@41 {
 		regulators {
 			buck1 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
 
 			buck2 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
-- 
2.53.0

[PATCH 5/6] riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage

[Aurelien Jarno]

On the OrangePi R2S board, the buck1 and buck2 voltage regulators, which
supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.

Set the maximum regulator voltage to 1.050V instead.

Fixes: 793cc54475b4 ("riscv: dts: spacemit: enable PMIC on OrangePi R2S")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Cc: stable@vger.kernel.org
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---
 arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts b/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
index 24591f7c3d236..2d1ba34cb00e2 100644
--- a/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
+++ b/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
@@ -134,14 +134,14 @@ pmic@41 {
 		regulators {
 			buck1 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
 
 			buck2 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
-- 
2.53.0

Re: [PATCH 5/6] riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The CPU core voltage limit in the Banana Pi CM6 devicetree remains at a dangerously high 3.45V, risking permanent hardware damage.
--

--- Patch [5]: [PATCH 5/6] riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage ---
commit e89342d2210b8ee4353584159b6747437181135a
Author: Aurelien Jarno <aurelien@aurel32.net>
Subject: riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage

This commit lowers the maximum output voltage of the buck1 and buck2
regulators on the OrangePi R2S board from 3.45V to 1.050V. This prevents
potential permanent CPU damage from misconfigurations or privileged userspace
requests.

Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net

> diff --git a/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts b/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
> index 24591f7c3d236..2d1ba34cb00e2 100644
> --- a/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
> +++ b/arch/riscv/boot/dts/spacemit/k1-orangepi-r2s.dts
[ ... ]
>  			buck2 {
>  				regulator-min-microvolt = <500000>;
> -				regulator-max-microvolt = <3450000>;
> +				regulator-max-microvolt = <1050000>;
>  				regulator-ramp-delay = <5000>;
>  				regulator-always-on;
>  			};

[Severity: High]
This is a pre-existing issue, but I noticed the Banana Pi CM6 devicetree
appears to retain the same 3.45V maximum voltage limit for its CPU core 
regulators.

Should arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi also be updated
to prevent similar hardware damage risks?

arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi:
			buck1 {
				regulator-min-microvolt = <500000>;
				regulator-max-microvolt = <3450000>;
				regulator-ramp-delay = <5000>;
				regulator-always-on;
			};

			buck2 {
				regulator-min-microvolt = <500000>;
				regulator-max-microvolt = <3450000>;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729150722.1598630-1-aurelien@aurel32.net?part=5

[PATCH 6/6] riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage

[Aurelien Jarno]

On the Banana Pi BPI-CM6 module, the buck1 and buck2 voltage regulators,
which supply the CPU core voltage, are configured with a maximum output
voltage of 3.45V, while the highest operating point requires only
1.050V. This means that a kernel bug, OPP misconfiguration, or
privileged userspace could request a voltage above the safe operating
limit, causing possible permanent CPU damage.

Set the maximum regulator voltage to 1.050V instead.

Fixes: 46a8c01700ac ("riscv: dts: spacemit: k1: Add Banana Pi BPI-CM6 IO board")
Link: https://sashiko.dev/#/message/20260728211020.1248676-2-aurelien%40aurel32.net
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
---
 arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi b/arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi
index bf502c87040a3..81c40df2a3663 100644
--- a/arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi
+++ b/arch/riscv/boot/dts/spacemit/k1-bananapi-cm6.dtsi
@@ -114,14 +114,14 @@ pmic@41 {
 		regulators {
 			buck1 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
 
 			buck2 {
 				regulator-min-microvolt = <500000>;
-				regulator-max-microvolt = <3450000>;
+				regulator-max-microvolt = <1050000>;
 				regulator-ramp-delay = <5000>;
 				regulator-always-on;
 			};
-- 
2.53.0