diff --git a/tools/python/xen/xend/server/blkif.py b/tools/python/xen/xend/server/blkif.py
index 886cc5610d..927e062e11 100644
--- a/tools/python/xen/xend/server/blkif.py
+++ b/tools/python/xen/xend/server/blkif.py
@@ -64,10 +64,14 @@ class BlkifController(DevController):
             except ValueError:
                 (typ, params) = ("", "")
 
+        mode = sxp.child_value(config, 'mode', 'r')
+        if mode not in ('r', 'w', 'w!'):
+            raise VmError('Invalid mode')
+
         back = { 'dev'    : dev,
                  'type'   : typ,
                  'params' : params,
-                 'mode'   : sxp.child_value(config, 'mode', 'r')
+                 'mode'   : mode
                }
 
         if security.on():