Index: xen-3.4.1-testing/tools/ioemu-remote/hw/xen_blktap.c
===================================================================
--- xen-3.4.1-testing.orig/tools/ioemu-remote/hw/xen_blktap.c
+++ xen-3.4.1-testing/tools/ioemu-remote/hw/xen_blktap.c
@@ -227,6 +227,7 @@ static int open_disk(struct td_state *s,
 	BlockDriver* drv;
 	char* devname;
 	static int devnumber = 0;
+	int flags = readonly ? BDRV_O_RDONLY : BDRV_O_RDWR;
 	int i;
 
 	DPRINTF("Opening %s as blktap%d\n", path, devnumber);
@@ -249,7 +250,7 @@ static int open_disk(struct td_state *s,
 	DPRINTF("%s driver specified\n", drv ? drv->format_name : "No");
 
 	/* Open the image */
-	if (bdrv_open2(bs, path, 0, drv) != 0) {
+	if (bdrv_open2(bs, path, flags, drv) != 0) {
 		fprintf(stderr, "Could not open image file %s\n", path);
 		return -ENOMEM;
 	}
Index: xen-3.4.1-testing/tools/ioemu-remote/xenstore.c
===================================================================
--- xen-3.4.1-testing.orig/tools/ioemu-remote/xenstore.c
+++ xen-3.4.1-testing/tools/ioemu-remote/xenstore.c
@@ -64,7 +64,8 @@ static void insert_media(void *opaque)
     for (i = 0; i < MAX_DRIVES + 1; i++) {
         bs = drives_table[i].bdrv;
         if (media_filename[i] && bs && bs->filename[0] == '\0') {
-            bdrv_open2(bs, media_filename[i], 0, &bdrv_raw);
+            /* Temporary BDRV_O_RDWR */
+            bdrv_open2(bs, media_filename[i], BDRV_O_RDWR, &bdrv_raw);
             pstrcpy(bs->filename, sizeof(bs->filename), media_filename[i]);
             free(media_filename[i]);
             media_filename[i] = NULL;
@@ -314,9 +315,9 @@ void xenstore_parse_domain_config(int hv
 {
     char **e_danger = NULL;
     char *buf = NULL;
-    char *fpath = NULL, *bpath = NULL, *btype = NULL,
+    char *fpath = NULL, *bpath = NULL, *btype = NULL, *mode = NULL,
         *dev = NULL, *params = NULL, *drv = NULL;
-    int i, j, any_hdN = 0, ret, is_tap;
+    int i, j, any_hdN = 0, ret, is_tap, flags;
     unsigned int len, num, hd_index, pci_devid = 0;
     BlockDriverState *bs;
     BlockDriver *format;
@@ -378,7 +379,8 @@ void xenstore_parse_domain_config(int hv
     }
         
     for (i = 0; i < num; i++) {
-	format = NULL; /* don't know what the format is yet */
+        flags = 0; 
+        format = NULL; /* don't know what the format is yet */
         /* read the backend path */
         xenstore_get_backend_path(&bpath, "vbd", danger_path, hvm_domid, e_danger[i]);
         if (bpath == NULL)
@@ -464,6 +466,17 @@ void xenstore_parse_domain_config(int hv
 	    format = &bdrv_raw;
         }
 
+        /* read the mode of the device */
+        if (pasprintf(&buf, "%s/mode", bpath) == -1)
+            continue;
+        free(mode);
+        mode = xs_read(xsh, XBT_NULL, buf, &len);
+
+        if (!strcmp(mode, "r") || !strcmp(mode, "ro"))
+            flags |= BDRV_O_RDONLY;
+        if (!strcmp(mode, "w") || !strcmp(mode, "rw"))
+            flags |= BDRV_O_RDWR;
+
 #if 0
 	/* Phantom VBDs are disabled because the use of paths
 	 * from guest-controlled areas in xenstore is unsafe.
@@ -509,7 +522,7 @@ void xenstore_parse_domain_config(int hv
 #ifdef CONFIG_STUBDOM
         if (pasprintf(&danger_buf, "%s/device/vbd/%s", danger_path, e_danger[i]) == -1)
             continue;
-	if (bdrv_open2(bs, danger_buf, BDRV_O_CACHE_WB /* snapshot and write-back */, &bdrv_raw) == 0) {
+	if (bdrv_open2(bs, danger_buf, flags|BDRV_O_CACHE_WB /* snapshot and write-back */, &bdrv_raw) == 0) {
 	    pstrcpy(bs->filename, sizeof(bs->filename), params);
 	} else
 #endif
@@ -535,7 +548,7 @@ void xenstore_parse_domain_config(int hv
 		}
 	    }
             pstrcpy(bs->filename, sizeof(bs->filename), params);
-            if (bdrv_open2(bs, params, BDRV_O_CACHE_WB /* snapshot and write-back */, format) < 0) {
+            if (bdrv_open2(bs, params, flags|BDRV_O_CACHE_WB /* snapshot and write-back */, format) < 0) {
                 fprintf(stderr, "qemu: could not open vbd '%s' or hard disk image '%s' (drv '%s' format '%s')\n", buf, params, drv ? drv : "?", format ? format->format_name : "0");
             } else {
                 char* snapshot = get_snapshot_name(atoi(e_danger[i]));