diff --git a/qa/rbd/krbd_blkroset.t b/qa/rbd/krbd_blkroset.t
index 5343584229f..cbbd06ce2ae 100644
--- a/qa/rbd/krbd_blkroset.t
+++ b/qa/rbd/krbd_blkroset.t
@@ -2,8 +2,11 @@
 Setup
 =====
 
+  $ RO_KEY=$(ceph auth get-or-create-key client.ro mon 'profile rbd' mgr 'profile rbd' osd 'profile rbd-read-only')
   $ rbd create --size 10 img
   $ rbd snap create img@snap
+  $ rbd snap protect img@snap
+  $ rbd clone img@snap cloneimg
   $ rbd create --size 1 imgpart
   $ DEV=$(sudo rbd map imgpart)
   $ cat <<EOF | sudo sfdisk $DEV >/dev/null 2>&1
@@ -144,10 +147,16 @@ R/O, unpartitioned:
   .*BLKROSET: Permission denied (re)
   [1]
   $ sudo blockdev --setrw $DEV
+  .*BLKROSET: Read-only file system (re)
+  [1]
   $ blockdev --getro $DEV
-  0
+  1
   $ dd if=/dev/urandom of=$DEV bs=1k seek=1 count=1 status=none
+  dd: error writing '/dev/rbd?': Operation not permitted (glob)
+  [1]
   $ blkdiscard $DEV
+  blkdiscard: /dev/rbd?: BLKDISCARD ioctl failed: Operation not permitted (glob)
+  [1]
   $ sudo rbd unmap $DEV
 
 R/O, partitioned:
@@ -174,18 +183,30 @@ R/O, partitioned:
   .*BLKROSET: Permission denied (re)
   [1]
   $ sudo blockdev --setrw ${DEV}p1
+  .*BLKROSET: Read-only file system (re)
+  [1]
   $ blockdev --setrw ${DEV}p2
   .*BLKROSET: Permission denied (re)
   [1]
   $ sudo blockdev --setrw ${DEV}p2
+  .*BLKROSET: Read-only file system (re)
+  [1]
   $ blockdev --getro ${DEV}p1
-  0
+  1
   $ blockdev --getro ${DEV}p2
-  0
+  1
   $ dd if=/dev/urandom of=${DEV}p1 bs=1k seek=1 count=1 status=none
+  dd: error writing '/dev/rbd?p1': Operation not permitted (glob)
+  [1]
   $ blkdiscard ${DEV}p1
+  blkdiscard: /dev/rbd?p1: BLKDISCARD ioctl failed: Operation not permitted (glob)
+  [1]
   $ dd if=/dev/urandom of=${DEV}p2 bs=1k seek=1 count=1 status=none
+  dd: error writing '/dev/rbd?p2': Operation not permitted (glob)
+  [1]
   $ blkdiscard ${DEV}p2
+  blkdiscard: /dev/rbd?p2: BLKDISCARD ioctl failed: Operation not permitted (glob)
+  [1]
   $ sudo rbd unmap $DEV
 
 
@@ -270,6 +291,45 @@ Partitioned:
   $ sudo rbd unmap $DEV
 
 
+read-only OSD caps
+==================
+
+R/W:
+
+  $ DEV=$(sudo rbd map --id ro --key $(echo $RO_KEY) img)
+  rbd: sysfs write failed
+  rbd: map failed: (1) Operation not permitted
+  [1]
+
+R/O:
+
+  $ DEV=$(sudo rbd map --id ro --key $(echo $RO_KEY) --read-only img)
+  $ blockdev --getro $DEV
+  1
+  $ sudo rbd unmap $DEV
+
+Snapshot:
+
+  $ DEV=$(sudo rbd map --id ro --key $(echo $RO_KEY) img@snap)
+  $ blockdev --getro $DEV
+  1
+  $ sudo rbd unmap $DEV
+
+R/W, clone:
+
+  $ DEV=$(sudo rbd map --id ro --key $(echo $RO_KEY) cloneimg)
+  rbd: sysfs write failed
+  rbd: map failed: (1) Operation not permitted
+  [1]
+
+R/O, clone:
+
+  $ DEV=$(sudo rbd map --id ro --key $(echo $RO_KEY) --read-only cloneimg)
+  $ blockdev --getro $DEV
+  1
+  $ sudo rbd unmap $DEV
+
+
 rw -> ro with open_count > 0
 ============================
 
@@ -288,6 +348,8 @@ Teardown
 
   $ rbd snap purge imgpart >/dev/null 2>&1
   $ rbd rm imgpart >/dev/null 2>&1
+  $ rbd rm cloneimg >/dev/null 2>&1
+  $ rbd snap unprotect img@snap
   $ rbd snap purge img >/dev/null 2>&1
   $ rbd rm img >/dev/null 2>&1
 
diff --git a/qa/rbd/krbd_get_features.t b/qa/rbd/krbd_get_features.t
new file mode 100644
index 00000000000..b3abf3ce7c0
--- /dev/null
+++ b/qa/rbd/krbd_get_features.t
@@ -0,0 +1,31 @@
+
+journaling makes the image only unwritable, rather than both unreadable
+and unwritable:
+
+  $ rbd create --size 1 --image-feature layering,exclusive-lock,journaling img
+  $ rbd snap create img@snap
+  $ rbd snap protect img@snap
+  $ rbd clone --image-feature layering,exclusive-lock,journaling img@snap cloneimg
+
+  $ DEV=$(sudo rbd map img)
+  rbd: sysfs write failed
+  rbd: map failed: (6) No such device or address
+  [6]
+  $ DEV=$(sudo rbd map --read-only img)
+  $ blockdev --getro $DEV
+  1
+  $ sudo rbd unmap $DEV
+
+  $ DEV=$(sudo rbd map cloneimg)
+  rbd: sysfs write failed
+  rbd: map failed: (6) No such device or address
+  [6]
+  $ DEV=$(sudo rbd map --read-only cloneimg)
+  $ blockdev --getro $DEV
+  1
+  $ sudo rbd unmap $DEV
+
+  $ rbd rm --no-progress cloneimg
+  $ rbd snap unprotect img@snap
+  $ rbd snap rm --no-progress img@snap
+  $ rbd rm --no-progress img
diff --git a/qa/suites/krbd/basic/tasks/krbd_blkroset.yaml b/qa/suites/krbd/basic/tasks/krbd_read_only.yaml
similarity index 68%
rename from qa/suites/krbd/basic/tasks/krbd_blkroset.yaml
rename to qa/suites/krbd/basic/tasks/krbd_read_only.yaml
index ac311874bed..8194b89ceab 100644
--- a/qa/suites/krbd/basic/tasks/krbd_blkroset.yaml
+++ b/qa/suites/krbd/basic/tasks/krbd_read_only.yaml
@@ -3,3 +3,4 @@ tasks:
     clients:
       client.0:
       - qa/rbd/krbd_blkroset.t
+      - qa/rbd/krbd_get_features.t