diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c
index dcf560513205b135f0588d915f854e59d78f9484..c3bb89811088ee67e0f1c07d0632d4d61fba7e4d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_dca.c
+++ b/drivers/infiniband/hw/hns/hns_roce_dca.c
@@ -1142,7 +1142,7 @@ static void load_kdca_param(struct hns_roce_dca_ctx *ctx)
 	else
 		ctx->max_size = roundup(dca_max_size, unit_size);
 
-	if (dca_min_size == DCA_MAX_MEM_SIZE)
+	if (dca_min_size == DCA_MAX_MEM_SIZE || dca_min_size > dca_max_size)
 		ctx->min_size = ctx->max_size;
 	else
 		ctx->min_size = roundup(dca_min_size, unit_size);
@@ -1327,7 +1327,8 @@ static int add_dca_mem(struct hns_roce_dev *hr_dev, u32 new_size)
 	if (!mem)
 		return -ENOMEM;
 
-	attr.key = (u64)mem;
+	attr.key = siphash_1u64((u64)mem, &hr_dev->dca_safe_hash_key);
+
 	attr.size = roundup(new_size, ctx->unit_size);
 	ret = register_dca_mem(hr_dev, NULL, mem, &attr);
 	if (ret) {
diff --git a/drivers/infiniband/hw/hns/hns_roce_debugfs.c b/drivers/infiniband/hw/hns/hns_roce_debugfs.c
index 270282521306f8dd0833faf655687a4ca7ce17fd..068de09c292df4c963ed507d7457c57bcc2a525d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_debugfs.c
+++ b/drivers/infiniband/hw/hns/hns_roce_debugfs.c
@@ -250,6 +250,12 @@ static u64 calc_loading_percent(size_t total, size_t free, u32 *out_rem)
 
 	all_pages = total >> HNS_HW_PAGE_SHIFT;
 	free_pages = free >> HNS_HW_PAGE_SHIFT;
+
+	if (!all_pages) {
+		percent = 0;
+		goto out;
+	}
+
 	if (all_pages >= free_pages) {
 		used_pages = all_pages - free_pages;
 		scale = LOADING_PERCENT_SCALE * LOADING_PERCENT_SCALE;
@@ -257,6 +263,7 @@ static u64 calc_loading_percent(size_t total, size_t free, u32 *out_rem)
 		percent = div_u64_rem(percent, LOADING_PERCENT_SCALE, &rem);
 	}
 
+out:
 	if (out_rem)
 		*out_rem = rem;
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
index 35724e00557522ce905ffa0c51a34dd7af95529b..48dcdbb08831ba5650c1553811f84129cfeed864 100644
--- a/drivers/infiniband/hw/hns/hns_roce_device.h
+++ b/drivers/infiniband/hw/hns/hns_roce_device.h
@@ -34,6 +34,7 @@
 #define _HNS_ROCE_DEVICE_H
 
 #include <linux/pci.h>
+#include <linux/siphash.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/hns-abi.h>
 #include "hns_roce_bond.h"
@@ -1233,6 +1234,7 @@ struct hns_roce_dev {
 
 	void *dca_safe_buf;
 	dma_addr_t dca_safe_page;
+	siphash_key_t dca_safe_hash_key;
 };
 
 static inline struct hns_roce_dev *to_hr_dev(struct ib_device *ib_dev)
diff --git a/drivers/infiniband/hw/hns/hns_roce_ext.h b/drivers/infiniband/hw/hns/hns_roce_ext.h
index 603e51cbf29a6f903e98867f320114ac2fe88107..c5148e0116d1a6e13222cb9a734b43875358bdff 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ext.h
+++ b/drivers/infiniband/hw/hns/hns_roce_ext.h
@@ -8,15 +8,27 @@
 #include <linux/types.h>
 
 /**
- * rdma_register_notify_addr - Register an POE channel for this RDMA device.
+ * rdma_register_poe_channel - Register an POE channel for this RDMA device.
  * @channel - POE channel index.
  * @poe_addr - POE channel address.
  *
  * If the current POE device is not associated with CQ, then it will be
  * allowed to be re-registered. Otherwise, re-registration or
  * de-registration will report an EBUSY error.
+ *
+ * This function is not allowed to be called concurrently.
  */
 int rdma_register_poe_channel(struct ib_device *ib_dev, u8 channel, u64 poe_addr);
+
+/**
+ * rdma_unregister_poe_channel - Unregister an POE channel for this RDMA device.
+ * @channel - POE channel index.
+ *
+ * If the current POE device is still associated with CQ, de-registration
+ * will report an EBUSY error.
+ *
+ * This function is not allowed to be called concurrently.
+ */
 int rdma_unregister_poe_channel(struct ib_device *ib_dev, u8 channel);
 
 /**
@@ -58,9 +70,17 @@ struct rdma_notify_mem {
  *
  * If notify_mem has already been registered, re-registration
  * will not be allowed.
+ *
+ * This function is not allowed to be called concurrently.
  */
 int rdma_register_notify_addr(struct ib_device *ib_dev,
 			      size_t num, struct rdma_notify_mem *notify_mem);
+/**
+ * rdma_unregister_notify_addr - Unregister the memory regions for write with
+ * notify operation.
+ *
+ * This function is not allowed to be called concurrently.
+ */
 int rdma_unregister_notify_addr(struct ib_device *ib_dev);
 
 #endif
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 962f6332bc7ab99b6309523c91cf6e883b00e5fc..b91400e2bd5aa448a057d295ad9894b636a37bc8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -2967,7 +2967,7 @@ static int hns_roce_v2_get_reset_page(struct hns_roce_dev *hr_dev)
 	return 0;
 
 err_with_vmap:
-	put_page(hr_dev->reset_page);
+	__free_page(hr_dev->reset_page);
 	return -ENOMEM;
 }
 
@@ -2975,7 +2975,7 @@ static void hns_roce_v2_put_reset_page(struct hns_roce_dev *hr_dev)
 {
 	vunmap(hr_dev->reset_kaddr);
 	hr_dev->reset_kaddr = NULL;
-	put_page(hr_dev->reset_page);
+	__free_page(hr_dev->reset_page);
 	hr_dev->reset_page = NULL;
 }
 
@@ -3357,11 +3357,20 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev)
 {
 	int ret;
 
+	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
+		ret = free_mr_init(hr_dev);
+		if (ret) {
+			dev_err(hr_dev->dev, "failed to init free mr!\n");
+			return ret;
+		}
+	}
+
+
 	ret = hns_roce_v2_get_reset_page(hr_dev);
 	if (ret) {
 		dev_err(hr_dev->dev,
 			"reset state init failed, ret = %d.\n", ret);
-		return ret;
+		goto error_get_reset_page_failed;
 	}
 
 	/* The hns ROCEE requires the extdb info to be cleared before using */
@@ -3390,6 +3399,9 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev)
 	put_hem_table(hr_dev);
 err_clear_extdb_failed:
 	hns_roce_v2_put_reset_page(hr_dev);
+error_get_reset_page_failed:
+	if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
+		free_mr_exit(hr_dev);
 
 	return ret;
 }
@@ -6364,6 +6376,9 @@ static void put_dip_ctx_idx(struct hns_roce_dev *hr_dev,
 {
 	struct hns_roce_dip *hr_dip = hr_qp->dip;
 
+	if (!hr_dip)
+		return;
+
 	xa_lock(&hr_dev->qp_table.dip_xa);
 
 	hr_dip->qp_cnt--;
@@ -7694,6 +7709,8 @@ static int hns_roce_v2_config_scc_param(struct hns_roce_dev *hr_dev,
 		ibdev_err_ratelimited(&hr_dev->ib_dev,
 				      "failed to configure scc param, opcode: 0x%x, ret = %d.\n",
 			le16_to_cpu(desc.opcode), ret);
+		memcpy(scc_param->param, scc_param->latest_param,
+			sizeof(scc_param->param));
 		mutex_unlock(&scc_param->scc_mutex);
 		return ret;
 	}
@@ -8008,21 +8025,10 @@ static int __hns_roce_hw_v2_init_instance(struct hnae3_handle *handle)
 		goto error_failed_roce_init;
 	}
 
-	if (pdev->revision == PCI_REVISION_ID_HIP08) {
-		ret = free_mr_init(hr_dev);
-		if (ret) {
-			dev_err(hr_dev->dev, "failed to init free mr!\n");
-			goto error_failed_free_mr_init;
-		}
-	}
-
 	handle->priv = hr_dev;
 
 	return 0;
 
-error_failed_free_mr_init:
-	hns_roce_exit(hr_dev, true);
-
 error_failed_roce_init:
 	kfree(hr_dev->priv);
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
index b98d2d11bb3f8afd583c75578ed02d3e52ab7b0b..e1fddb2f7db196eca2ffb336619165cb286c33b0 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
@@ -1590,7 +1590,7 @@ struct hns_roce_wqe_atomic_seg {
 #define HNS_ROCE_DCQCN_F_MAX ((u8)(~0U))
 #define HNS_ROCE_DCQCN_TKP_OFS (HNS_ROCE_DCQCN_F_OFS + HNS_ROCE_DCQCN_F_SZ)
 #define HNS_ROCE_DCQCN_TKP_SZ sizeof(u8)
-#define HNS_ROCE_DCQCN_TKP_MAX 15
+#define HNS_ROCE_DCQCN_TKP_MAX 10
 #define HNS_ROCE_DCQCN_TMP_OFS (HNS_ROCE_DCQCN_TKP_OFS + HNS_ROCE_DCQCN_TKP_SZ)
 #define HNS_ROCE_DCQCN_TMP_SZ sizeof(u16)
 #define HNS_ROCE_DCQCN_TMP_MAX 15
@@ -1630,47 +1630,55 @@ struct hns_roce_wqe_atomic_seg {
 #define HNS_ROCE_LDCP_GAMMA_OFS (HNS_ROCE_LDCP_ALPHA_OFS + \
 					HNS_ROCE_LDCP_ALPHA_SZ)
 #define HNS_ROCE_LDCP_GAMMA_SZ sizeof(u8)
-#define HNS_ROCE_LDCP_GAMMA_MAX ((u8)(~0U))
+#define HNS_ROCE_LDCP_GAMMA_MAX 7
 #define HNS_ROCE_LDCP_BETA_OFS (HNS_ROCE_LDCP_GAMMA_OFS + \
 					HNS_ROCE_LDCP_GAMMA_SZ)
 #define HNS_ROCE_LDCP_BETA_SZ sizeof(u8)
-#define HNS_ROCE_LDCP_BETA_MAX ((u8)(~0U))
+#define HNS_ROCE_LDCP_BETA_MAX 7
 #define HNS_ROCE_LDCP_ETA_OFS (HNS_ROCE_LDCP_BETA_OFS + HNS_ROCE_LDCP_BETA_SZ)
 #define HNS_ROCE_LDCP_ETA_SZ sizeof(u8)
-#define HNS_ROCE_LDCP_ETA_MAX ((u8)(~0U))
+#define HNS_ROCE_LDCP_ETA_MAX 7
 #define HNS_ROCE_LDCP_LIFESPAN_OFS (4 * sizeof(u32))
 #define HNS_ROCE_LDCP_LIFESPAN_SZ sizeof(u32)
 #define HNS_ROCE_LDCP_LIFESPAN_MAX 1000
 
 #define HNS_ROCE_HC3_INITIAL_WINDOW_OFS 0
 #define HNS_ROCE_HC3_INITIAL_WINDOW_SZ sizeof(u32)
+#define HNS_ROCE_HC3_INITIAL_WINDOW_MIN 0
 #define HNS_ROCE_HC3_INITIAL_WINDOW_MAX ((u32)(~0U))
 #define HNS_ROCE_HC3_BANDWIDTH_OFS (HNS_ROCE_HC3_INITIAL_WINDOW_OFS + \
 					HNS_ROCE_HC3_INITIAL_WINDOW_SZ)
 #define HNS_ROCE_HC3_BANDWIDTH_SZ sizeof(u32)
+#define HNS_ROCE_HC3_BANDWIDTH_MIN 1000
 #define HNS_ROCE_HC3_BANDWIDTH_MAX ((u32)(~0U))
 #define HNS_ROCE_HC3_QLEN_SHIFT_OFS (HNS_ROCE_HC3_BANDWIDTH_OFS + \
 					HNS_ROCE_HC3_BANDWIDTH_SZ)
 #define HNS_ROCE_HC3_QLEN_SHIFT_SZ sizeof(u8)
-#define HNS_ROCE_HC3_QLEN_SHIFT_MAX ((u8)(~0U))
+#define HNS_ROCE_HC3_QLEN_SHIFT_MIN 0
+#define HNS_ROCE_HC3_QLEN_SHIFT_MAX 31
 #define HNS_ROCE_HC3_PORT_USAGE_SHIFT_OFS (HNS_ROCE_HC3_QLEN_SHIFT_OFS + \
 						HNS_ROCE_HC3_QLEN_SHIFT_SZ)
 #define HNS_ROCE_HC3_PORT_USAGE_SHIFT_SZ sizeof(u8)
-#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_MAX ((u8)(~0U))
+#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_MIN 0
+#define HNS_ROCE_HC3_PORT_USAGE_SHIFT_MAX 100
 #define HNS_ROCE_HC3_OVER_PERIOD_OFS (HNS_ROCE_HC3_PORT_USAGE_SHIFT_OFS + \
 					HNS_ROCE_HC3_PORT_USAGE_SHIFT_SZ)
 #define HNS_ROCE_HC3_OVER_PERIOD_SZ sizeof(u8)
+#define HNS_ROCE_HC3_OVER_PERIOD_MIN 0
 #define HNS_ROCE_HC3_OVER_PERIOD_MAX ((u8)(~0U))
 #define HNS_ROCE_HC3_MAX_STAGE_OFS (HNS_ROCE_HC3_OVER_PERIOD_OFS + \
 					HNS_ROCE_HC3_OVER_PERIOD_SZ)
 #define HNS_ROCE_HC3_MAX_STAGE_SZ sizeof(u8)
+#define HNS_ROCE_HC3_MAX_STAGE_MIN 0
 #define HNS_ROCE_HC3_MAX_STAGE_MAX ((u8)(~0U))
 #define HNS_ROCE_HC3_GAMMA_SHIFT_OFS (HNS_ROCE_HC3_MAX_STAGE_OFS + \
 					HNS_ROCE_HC3_MAX_STAGE_SZ)
 #define HNS_ROCE_HC3_GAMMA_SHIFT_SZ sizeof(u8)
+#define HNS_ROCE_HC3_GAMMA_SHIFT_MIN 0
 #define HNS_ROCE_HC3_GAMMA_SHIFT_MAX 15
 #define HNS_ROCE_HC3_LIFESPAN_OFS (4 * sizeof(u32))
 #define HNS_ROCE_HC3_LIFESPAN_SZ sizeof(u32)
+#define HNS_ROCE_HC3_LIFESPAN_MIN 0
 #define HNS_ROCE_HC3_LIFESPAN_MAX 1000
 
 #define HNS_ROCE_DIP_AI_OFS 0
@@ -1681,7 +1689,7 @@ struct hns_roce_wqe_atomic_seg {
 #define HNS_ROCE_DIP_F_MAX ((u8)(~0U))
 #define HNS_ROCE_DIP_TKP_OFS (HNS_ROCE_DIP_F_OFS + HNS_ROCE_DIP_F_SZ)
 #define HNS_ROCE_DIP_TKP_SZ sizeof(u8)
-#define HNS_ROCE_DIP_TKP_MAX 15
+#define HNS_ROCE_DIP_TKP_MAX 10
 #define HNS_ROCE_DIP_TMP_OFS (HNS_ROCE_DIP_TKP_OFS + HNS_ROCE_DIP_TKP_SZ)
 #define HNS_ROCE_DIP_TMP_SZ sizeof(u16)
 #define HNS_ROCE_DIP_TMP_MAX 15
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index 720e463ccea40e52c12f6aeb2e41fca6ce68ed36..b57105e92877d65e87559e9b4550eec671fb0459 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -1299,10 +1299,7 @@ static void hns_roce_teardown_hca(struct hns_roce_dev *hr_dev)
 	mutex_destroy(&hr_dev->db_unfree_list_mutex);
 	mutex_destroy(&hr_dev->mtr_unfree_list_mutex);
 	mutex_destroy(&hr_dev->uctx_list_mutex);
-
-	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_CQ_RECORD_DB ||
-	    hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_RECORD_DB)
-		mutex_destroy(&hr_dev->pgdir_mutex);
+	mutex_destroy(&hr_dev->pgdir_mutex);
 }
 
 /**
@@ -1329,11 +1326,8 @@ static int hns_roce_setup_hca(struct hns_roce_dev *hr_dev)
 	INIT_LIST_HEAD(&hr_dev->db_unfree_list);
 	mutex_init(&hr_dev->db_unfree_list_mutex);
 
-	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_CQ_RECORD_DB ||
-	    hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_RECORD_DB) {
-		INIT_LIST_HEAD(&hr_dev->pgdir_list);
-		mutex_init(&hr_dev->pgdir_mutex);
-	}
+	INIT_LIST_HEAD(&hr_dev->pgdir_list);
+	mutex_init(&hr_dev->pgdir_mutex);
 
 	hns_roce_init_uar_table(hr_dev);
 
@@ -1373,9 +1367,7 @@ static int hns_roce_setup_hca(struct hns_roce_dev *hr_dev)
 	mutex_destroy(&hr_dev->mtr_unfree_list_mutex);
 	mutex_destroy(&hr_dev->uctx_list_mutex);
 
-	if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_CQ_RECORD_DB ||
-	    hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_QP_RECORD_DB)
-		mutex_destroy(&hr_dev->pgdir_mutex);
+	mutex_destroy(&hr_dev->pgdir_mutex);
 
 	return ret;
 }
@@ -1478,6 +1470,8 @@ static void hns_roce_free_dca_safe_buf(struct hns_roce_dev *hr_dev)
 			  hr_dev->dca_safe_page);
 	hr_dev->dca_safe_page = 0;
 	hr_dev->dca_safe_buf = NULL;
+
+	memzero_explicit(&hr_dev->dca_safe_hash_key, sizeof(siphash_key_t));
 }
 
 int hns_roce_init(struct hns_roce_dev *hr_dev)
@@ -1557,6 +1551,7 @@ int hns_roce_init(struct hns_roce_dev *hr_dev)
 	return 0;
 
 error_failed_register_device:
+	hns_roce_unregister_poe_ch(hr_dev);
 	if (hr_dev->hw->hw_exit)
 		hr_dev->hw->hw_exit(hr_dev);
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 8f4ca0f53af20bc50cd68734f306c0804a889194..8da03d8ddc5674eddd1871d1367c62f5413ab9e7 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -900,6 +900,8 @@ static int alloc_dca_safe_page(struct hns_roce_dev *hr_dev)
 		return -ENOMEM;
 	}
 
+	get_random_bytes(&hr_dev->dca_safe_hash_key, sizeof(siphash_key_t));
+
 	return 0;
 }
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_sysfs.c b/drivers/infiniband/hw/hns/hns_roce_sysfs.c
index ec266136d038d4a68dde2f067d2945f67c02436f..ab618480970899cd5171dca9e6ba9aab2ddc3ed3 100644
--- a/drivers/infiniband/hw/hns/hns_roce_sysfs.c
+++ b/drivers/infiniband/hw/hns/hns_roce_sysfs.c
@@ -417,7 +417,8 @@ static const struct attribute_group ldcp_cc_param_group = {
 	__HNS_SCC_ATTR(_name, HNS_ROCE_SCC_ALGO_HC3,			\
 			HNS_ROCE_HC3_##NAME##_OFS,			\
 			HNS_ROCE_HC3_##NAME##_SZ,			\
-			0, HNS_ROCE_HC3_##NAME##_MAX)
+			HNS_ROCE_HC3_##NAME##_MIN,			\
+			HNS_ROCE_HC3_##NAME##_MAX)
 
 HNS_PORT_HC3_CC_ATTR_RW(initial_window, INITIAL_WINDOW);
 HNS_PORT_HC3_CC_ATTR_RW(bandwidth, BANDWIDTH);