Index: xen-4.1.2-testing/tools/ioemu-qemu-xen/hw/xen_blktap.c
===================================================================
--- xen-4.1.2-testing.orig/tools/ioemu-qemu-xen/hw/xen_blktap.c
+++ xen-4.1.2-testing/tools/ioemu-qemu-xen/hw/xen_blktap.c
@@ -237,6 +237,7 @@ static int open_disk(struct td_state *s,
 	BlockDriver* drv;
 	char* devname;
 	static int devnumber = 0;
+	int flags = readonly ? BDRV_O_RDONLY : BDRV_O_RDWR;
 	int i;
 
 	DPRINTF("Opening %s as blktap%d\n", path, devnumber);
@@ -259,7 +260,7 @@ static int open_disk(struct td_state *s,
 	DPRINTF("%s driver specified\n", drv ? drv->format_name : "No");
 
 	/* Open the image */
-	if (bdrv_open2(bs, path, 0, drv) != 0) {
+	if (bdrv_open2(bs, path, flags, drv) != 0) {
 		fprintf(stderr, "Could not open image file %s\n", path);
 		return -ENOMEM;
 	}
Index: xen-4.1.2-testing/tools/ioemu-qemu-xen/xenstore.c
===================================================================
--- xen-4.1.2-testing.orig/tools/ioemu-qemu-xen/xenstore.c
+++ xen-4.1.2-testing/tools/ioemu-qemu-xen/xenstore.c
@@ -136,7 +136,8 @@ static void insert_media(void *opaque)
             else 
                 format = &bdrv_raw;
 
-            bdrv_open2(bs, media_filename[i], 0, format);
+            /* Temporary BDRV_O_RDWR */
+            bdrv_open2(bs, media_filename[i], BDRV_O_RDWR, format);
 #ifdef CONFIG_STUBDOM
             {
                 char *buf, *backend, *params_path, *params;
@@ -511,7 +512,8 @@ void xenstore_parse_domain_config(int hv
     }
         
     for (i = 0; i < num; i++) {
-	format = NULL; /* don't know what the format is yet */
+        flags = 0;
+        format = NULL; /* don't know what the format is yet */
         /* read the backend path */
         xenstore_get_backend_path(&bpath, "vbd", danger_path, hvm_domid, e_danger[i]);
         if (bpath == NULL)
@@ -597,6 +599,17 @@ void xenstore_parse_domain_config(int hv
 	    format = &bdrv_raw;
         }
 
+        /* read the mode of the device */
+        if (pasprintf(&buf, "%s/mode", bpath) == -1)
+            continue;
+        free(mode);
+        mode = xs_read(xsh, XBT_NULL, buf, &len);
+
+        if (!strcmp(mode, "r") || !strcmp(mode, "ro"))
+            flags |= BDRV_O_RDONLY;
+        if (!strcmp(mode, "w") || !strcmp(mode, "rw"))
+            flags |= BDRV_O_RDWR;
+
 #if 0
 	/* Phantom VBDs are disabled because the use of paths
 	 * from guest-controlled areas in xenstore is unsafe.
@@ -664,7 +677,7 @@ void xenstore_parse_domain_config(int hv
 #ifdef CONFIG_STUBDOM
         if (pasprintf(&danger_buf, "%s/device/vbd/%s", danger_path, e_danger[i]) == -1)
             continue;
-	if (bdrv_open2(bs, danger_buf, BDRV_O_CACHE_WB /* snapshot and write-back */, &bdrv_raw) == 0) {
+	if (bdrv_open2(bs, danger_buf, flags|BDRV_O_CACHE_WB /* snapshot and write-back */, &bdrv_raw) == 0) {
 	    pstrcpy(bs->filename, sizeof(bs->filename), params);
 	}
 #else
@@ -716,7 +729,7 @@ void xenstore_parse_domain_config(int hv
 
             fprintf(stderr, "Using file %s in read-%s mode\n", bs->filename, is_readonly ? "only" : "write");
 
-            if (bdrv_open2(bs, params, BDRV_O_CACHE_WB /* snapshot and write-back */, format) < 0) {
+            if (bdrv_open2(bs, params, flags|BDRV_O_CACHE_WB /* snapshot and write-back */, format) < 0) {
                 fprintf(stderr, "qemu: could not open vbd '%s' or hard disk image '%s' (drv '%s' format '%s')\n", buf, params, drv ? drv : "?", format ? format->format_name : "0");
             } else {
                 char* snapshot = get_snapshot_name(atoi(e_danger[i]));