diff --git a/providers/hns/hns_roce_u.c b/providers/hns/hns_roce_u.c
index e5b9488c4..e93f82560 100644
--- a/providers/hns/hns_roce_u.c
+++ b/providers/hns/hns_roce_u.c
@@ -90,12 +90,13 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev,
 						    int cmd_fd,
 						    void *private_data)
 {
-	int i;
-	struct ibv_get_context cmd;
+	struct hns_roce_device *hr_dev = to_hr_dev(ibdev);
+	struct hns_roce_alloc_ucontext_resp resp = {};
 	struct ibv_device_attr dev_attrs;
 	struct hns_roce_context *context;
-	struct hns_roce_alloc_ucontext_resp resp = {};
-	struct hns_roce_device *hr_dev = to_hr_dev(ibdev);
+	struct ibv_get_context cmd;
+	int offset = 0;
+	int i;
 
 	context = verbs_init_and_alloc_context(ibdev, cmd_fd, context, ibv_ctx,
 					       RDMA_DRIVER_HNS);
@@ -115,12 +116,12 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev,
 	for (i = 0; i < HNS_ROCE_QP_TABLE_SIZE; ++i)
 		context->qp_table[i].refcnt = 0;
 
-	context->uar = mmap(NULL, hr_dev->page_size,
-			    PROT_READ | PROT_WRITE, MAP_SHARED, cmd_fd, 0);
-	if (context->uar == MAP_FAILED) {
-		fprintf(stderr, PFX "Warning: failed to mmap() uar page.\n");
+	context->uar = mmap(NULL, hr_dev->page_size, PROT_READ | PROT_WRITE,
+			    MAP_SHARED, cmd_fd, offset);
+	if (context->uar == MAP_FAILED)
 		goto err_free;
-	}
+
+	offset += hr_dev->page_size;
 
 	if (hr_dev->hw_version == HNS_ROCE_HW_VER1) {
 		/*
@@ -129,12 +130,9 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev,
 		 */
 		context->cq_tptr_base = mmap(NULL, HNS_ROCE_CQ_DB_BUF_SIZE,
 					     PROT_READ | PROT_WRITE, MAP_SHARED,
-					     cmd_fd, HNS_ROCE_TPTR_OFFSET);
-		if (context->cq_tptr_base == MAP_FAILED) {
-			fprintf(stderr,
-				PFX "Warning: Failed to mmap cq_tptr page.\n");
+					     cmd_fd, offset);
+		if (context->cq_tptr_base == MAP_FAILED)
 			goto db_free;
-		}
 	}
 
 	pthread_spin_init(&context->uar_lock, PTHREAD_PROCESS_PRIVATE);
diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h
index e39642fce..dc8935d42 100644
--- a/providers/hns/hns_roce_u.h
+++ b/providers/hns/hns_roce_u.h
@@ -71,7 +71,6 @@
 #define HNS_ROCE_GID_SIZE		16
 
 #define HNS_ROCE_CQ_DB_BUF_SIZE		((HNS_ROCE_MAX_CQ_NUM >> 11) << 12)
-#define HNS_ROCE_TPTR_OFFSET		0x1000
 #define HNS_ROCE_STATIC_RATE		3 /* Gbps */
 
 #define HNS_ROCE_ADDRESS_MASK 0xFFFFFFFF
diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c
index b95017def..198b9ffa3 100644
--- a/providers/hns/hns_roce_u_hw_v2.c
+++ b/providers/hns/hns_roce_u_hw_v2.c
@@ -84,6 +84,10 @@ static int set_atomic_seg(struct hns_roce_qp *qp, struct ibv_send_wr *wr,
 		ext_sg_num = msg_len * DATA_TYPE_NUM >> HNS_ROCE_SGE_SHIFT;
 		aseg->fetchadd_swap_data = 0;
 		aseg->cmp_data = 0;
+
+		if (ext_sg_num + HNS_ROCE_SGE_IN_WQE > qp->sq.max_gs)
+			return EINVAL;
+
 		if (wr->opcode == IBV_WR_ATOMIC_CMP_AND_SWP) {
 			if (!wr->wr.atomic.swap || !wr->wr.atomic.compare_add)
 				return EINVAL;
diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c
index 2020f555b..803fe61e7 100644
--- a/providers/hns/hns_roce_u_verbs.c
+++ b/providers/hns/hns_roce_u_verbs.c
@@ -390,7 +390,7 @@ int hns_roce_u_destroy_cq(struct ibv_cq *cq)
 	return ret;
 }
 
-static int hns_roce_create_idx_que(struct ibv_pd *pd, struct hns_roce_srq *srq)
+static int hns_roce_create_idx_que(struct hns_roce_srq *srq)
 {
 	struct hns_roce_idx_que	*idx_que = &srq->idx_que;
 	unsigned int buf_size;
@@ -417,8 +417,7 @@ static int hns_roce_create_idx_que(struct ibv_pd *pd, struct hns_roce_srq *srq)
 	return 0;
 }
 
-static int hns_roce_alloc_srq_buf(struct ibv_pd *pd, struct ibv_srq_attr *attr,
-				  struct hns_roce_srq *srq)
+static int hns_roce_alloc_srq_buf(struct hns_roce_srq *srq)
 {
 	int srq_buf_size;
 
@@ -464,16 +463,13 @@ struct ibv_srq *hns_roce_u_create_srq(struct ibv_pd *pd,
 	srq->wqe_cnt = roundup_pow_of_two(init_attr->attr.max_wr + 1);
 	srq->max_gs = init_attr->attr.max_sge;
 
-	ret = hns_roce_create_idx_que(pd, srq);
-	if (ret) {
-		fprintf(stderr, "hns_roce_create_idx_que failed!\n");
+	ret = hns_roce_create_idx_que(srq);
+	if (ret)
 		goto out;
-	}
 
-	if (hns_roce_alloc_srq_buf(pd, &init_attr->attr, srq)) {
-		fprintf(stderr, "hns_roce_alloc_srq_buf failed!\n");
+	ret = hns_roce_alloc_srq_buf(srq);
+	if (ret)
 		goto err_idx_que;
-	}
 
 	srq->db = hns_roce_alloc_db(to_hr_ctx(pd->context),
 				    HNS_ROCE_QP_TYPE_DB);