Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
===================================================================
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/hw/xen_blktap.c
@@ -360,6 +360,15 @@ static void qemu_send_responses(void* op
 }
 
 /**
+ * Callback function for AIO flush
+ */
+static void qemu_flush_response(void* opaque, int ret) {
+	if (ret != 0) {
+		DPRINTF("aio_flush: ret = %d (%s)\n", ret, strerror(-ret));
+	}
+}
+
+/**
  * Callback function for the IO message pipe. Reads requests from the ring
  * and processes them (call qemu read/write functions).
  *
@@ -378,6 +387,7 @@ static void handle_blktap_iomsg(void* pr
 	blkif_t *blkif = s->blkif;
 	tapdev_info_t *info = s->ring_info;
 	int page_size = getpagesize();
+	int sync;
 
 	struct aiocb_info *aiocb_info;
 
@@ -410,7 +420,7 @@ static void handle_blktap_iomsg(void* pr
 
 		/* Don't allow writes on readonly devices */
 		if ((s->flags & TD_RDONLY) && 
-		    (req->operation == BLKIF_OP_WRITE)) {
+		    (req->operation != BLKIF_OP_READ)) {
 			blkif->pending_list[idx].status = BLKIF_RSP_ERROR;
 			goto send_response;
 		}
@@ -431,7 +441,7 @@ static void handle_blktap_iomsg(void* pr
 				DPRINTF("Sector request failed:\n");
 				DPRINTF("%s request, idx [%d,%d] size [%llu], "
 					"sector [%llu,%llu]\n",
-					(req->operation == BLKIF_OP_WRITE ? 
+					(req->operation != BLKIF_OP_READ ?
 					 "WRITE" : "READ"),
 					idx,i,
 					(long long unsigned) 
@@ -444,8 +454,14 @@ static void handle_blktap_iomsg(void* pr
 
 			blkif->pending_list[idx].secs_pending += nsects;
 
-			switch (req->operation) 
+			sync = 0;
+			switch (req->operation)
 			{
+			case BLKIF_OP_WRITE_BARRIER:
+				sync = 1;
+				bdrv_aio_flush(s->bs, qemu_flush_response, NULL);
+				/* fall through */
+
 			case BLKIF_OP_WRITE:
 				aiocb_info = malloc(sizeof(*aiocb_info));
 
@@ -465,6 +481,10 @@ static void handle_blktap_iomsg(void* pr
 					DPRINTF("ERROR: bdrv_write() == NULL\n");
 					goto send_response;
 				}
+
+				if (sync)
+					bdrv_aio_flush(s->bs, qemu_flush_response, NULL);
+
 				break;
 
 			case BLKIF_OP_READ: