# DF-3986 — drm/radeon ni.c: port dropped the CP1/CP2 compute-ring `r600_ring_init` from `cayman_init` — `order_base_2(0)` UB (`1UL << 64`) and garbage compute-ring MMIO programming at every Cayman/Aruba boot

## Where
`sys/dev/drm/radeon/ni.c:2434-2443` (`cayman_init`):

```c
	ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX];
	ring->ring_obj = NULL;
	r600_ring_init(rdev, ring, 1024 * 1024);

	ring = &rdev->ring[R600_RING_TYPE_DMA_INDEX];      /* CP1/CP2 inits MISSING */
	ring->ring_obj = NULL;
	r600_ring_init(rdev, ring, 64 * 1024);
	...
```

Upstream Linux `ni.c` (`cayman_init`) initializes **five** rings — GFX,
CP1, CP2 (1 MB each), DMA0, DMA1. In-tree corroboration that compute rings
must be initialized: `si.c:6876-6894` (SI) and `cik.c:8655-8679` (CIK) both
call `r600_ring_init` for `CAYMAN_RING_TYPE_CP1/2_INDEX`. The DFly port
kept the consumers but dropped the producers:

- `cayman_cp_resume` (ni.c:1698-1734) loops over
  `{GFX, CP1, CP2}` and computes `rb_cntl = order_base_2(ring->ring_size / 8)`
  (ni.c:1704) — with `ring_size == 0` this evaluates
  `ilog2(roundup_pow_of_two(0))` → `1UL << flsl(ULONG_MAX)` → **`1UL << 64`**
  (C-standard undefined shift; sys/dev/drm/include/linux/log2.h:33-36,
  100). It then programs `CP_RB1_CNTL/CP_RB2_CNTL` with the resulting
  RB size field and `CP_RB1/2_BASE = ring->gpu_addr >> 8` = 0 (ni.c:1713-1721)
  — garbage compute-ring configuration written to real silicon at every
  Cayman/Aruba boot.
- `radeon_fence_driver_start_ring(CP1/CP2)` is still called
  (ni.c:2225-2235) and `cayman_cp_resume` explicitly leaves the rings
  `ready = false` (ni.c:1739-1740).

## Why impact stays Info
- Userspace cannot select CP1/CP2 on this family: `radeon_cs_get_ring`
  maps `RADEON_CS_RING_COMPUTE` to `CAYMAN_RING_TYPE_CP{1,2}_INDEX` only
  for `family >= CHIP_TAHITI` (radeon_cs.c:218-224); CAYMAN/ARUBA map
  COMPUTE to the GFX ring.
- Even if something queued to an uninitialized ring,
  `radeon_ring_alloc` rejects `ndw > ring->ring_size/4` (radeon_ring.c:109-111),
  so no ring-buffer OOB write is reachable.
- Residual impact: standards-UB executed in the boot path (currently
  benign `0` on x86 `shl` semantics) + wrong MMIO config for the compute
  rings (functional: compute unusable on Cayman/Aruba in this port).

Hardware-gated (needs a Cayman/Aruba GPU; the audit guest has none — see
`../DF-3981/env.txt`). Info severity, source-certain.

## Fix
`fix.diff` — restore the two dropped blocks (verbatim upstream shape):
`r600_ring_init(rdev, &rdev->ring[CAYMAN_RING_TYPE_CP{1,2}_INDEX], 1024*1024)`.