diff --git a/xen/common/ioreq.c b/xen/common/ioreq.c
index 7cb717f7a2..62b907f4c4 100644
--- a/xen/common/ioreq.c
+++ b/xen/common/ioreq.c
@@ -1182,7 +1182,7 @@ static int ioreq_send_buffered(struct ioreq_server *s, ioreq_t *p)
      *  - the count field is usually used with data_is_ptr and since we don't
      *    support data_is_ptr we do not waste space for the count field either
      */
-    if ( (p->addr > 0xffffful) || p->data_is_ptr || (p->count != 1) )
+    if ( (p->addr > 0xfffffUL) || p->data_is_ptr || (p->count != 1) )
         return 0;
 
     switch ( p->size )
diff --git a/xen/include/xen/ioreq.h b/xen/include/xen/ioreq.h
index a26614d331..cd399adf17 100644
--- a/xen/include/xen/ioreq.h
+++ b/xen/include/xen/ioreq.h
@@ -60,7 +60,7 @@ struct ioreq_server {
 static inline paddr_t ioreq_mmio_first_byte(const ioreq_t *p)
 {
     return unlikely(p->df) ?
-           p->addr - (p->count - 1ul) * p->size :
+           p->addr - (p->count - 1UL) * p->size :
            p->addr;
 }