diff --git a/tests/qemuargv2xmltest.c b/tests/qemuargv2xmltest.c
index d6df116213..ea8591366b 100644
--- a/tests/qemuargv2xmltest.c
+++ b/tests/qemuargv2xmltest.c
@@ -292,6 +292,12 @@ mymain(void)
 
     DO_TEST_FULL("qemu-ns-no-env", FLAG_EXPECT_WARNING);
 
+    DO_TEST("machine-aeskeywrap-on-argv");
+    DO_TEST("machine-aeskeywrap-off-argv");
+    DO_TEST("machine-deakeywrap-on-argv");
+    DO_TEST("machine-deakeywrap-off-argv");
+    DO_TEST("machine-keywrap-none-argv");
+
     virObjectUnref(driver.config);
     virObjectUnref(driver.caps);
     virObjectUnref(driver.xmlopt);
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args
new file mode 100644
index 0000000000..4ef9fc0f6e
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.args
@@ -0,0 +1,6 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=off \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml
new file mode 100644
index 0000000000..0975d4a251
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-argv.xml
@@ -0,0 +1,27 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='aes' state='off'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args
new file mode 100644
index 0000000000..80caba7a76
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=off \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml
new file mode 100644
index 0000000000..a0c0037ec1
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-cap.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='aes' state='off'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args
new file mode 100644
index 0000000000..80caba7a76
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=off \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml
new file mode 100644
index 0000000000..a0c0037ec1
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-off-caps.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='aes' state='off'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args
new file mode 100644
index 0000000000..2b238d500b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.args
@@ -0,0 +1,6 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml
new file mode 100644
index 0000000000..8aa8f8eea7
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-argv.xml
@@ -0,0 +1,27 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='aes' state='on'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args
new file mode 100644
index 0000000000..6f6366b69b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml
new file mode 100644
index 0000000000..768eed120c
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-cap.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='aes' state='on'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args
new file mode 100644
index 0000000000..6f6366b69b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,aes-key-wrap=on \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml
new file mode 100644
index 0000000000..1702e6ef47
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-aeskeywrap-on-caps.xml
@@ -0,0 +1,27 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='aes' state='on'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args
new file mode 100644
index 0000000000..f38c9144ab
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.args
@@ -0,0 +1,6 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=off \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml
new file mode 100644
index 0000000000..90b6d9f670
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-argv.xml
@@ -0,0 +1,27 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='dea' state='off'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args
new file mode 100644
index 0000000000..e379f15302
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=off \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml
new file mode 100644
index 0000000000..dbc22fcc1c
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-cap.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='dea' state='off'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args
new file mode 100644
index 0000000000..e379f15302
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=off \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml
new file mode 100644
index 0000000000..dbc22fcc1c
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-off-caps.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='dea' state='off'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args
new file mode 100644
index 0000000000..f64e57f751
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.args
@@ -0,0 +1,6 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=on \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml
new file mode 100644
index 0000000000..76a6a51427
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-argv.xml
@@ -0,0 +1,27 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='dea' state='on'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args
new file mode 100644
index 0000000000..9c4b51325b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=on \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml
new file mode 100644
index 0000000000..c0a063b2e3
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-cap.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='dea' state='on'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args
new file mode 100644
index 0000000000..9c4b51325b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg,dea-key-wrap=on \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml
new file mode 100644
index 0000000000..c0a063b2e3
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-deakeywrap-on-caps.xml
@@ -0,0 +1,28 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+  <keywrap>
+    <cipher name='dea' state='on'/>
+  </keywrap>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args
new file mode 100644
index 0000000000..9264ec4451
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.args
@@ -0,0 +1,6 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=virtio,index=0,id=drive-virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml
new file mode 100644
index 0000000000..0a963a1d65
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-argv.xml
@@ -0,0 +1,24 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args
new file mode 100644
index 0000000000..f4bd156d02
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml
new file mode 100644
index 0000000000..9727686b5b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none-caps.xml
@@ -0,0 +1,25 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args
new file mode 100644
index 0000000000..f4bd156d02
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.args
@@ -0,0 +1,7 @@
+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-s390x -S \
+-machine s390-ccw-virtio,accel=tcg \
+-m 214 -smp 1 -nographic -nodefaults \
+-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c \
+-drive file=/dev/HostVG/QEMUGuest1,if=none,id=drive-virtio-disk0 \
+-device virtio-blk-ccw,devno=fe.0.0000,drive=drive-virtio-disk0,id=virtio-disk0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml
new file mode 100644
index 0000000000..9727686b5b
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-machine-keywrap-none.xml
@@ -0,0 +1,25 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219100</memory>
+  <currentMemory unit='KiB'>219100</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='s390x' machine='s390-ccw-virtio'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-s390x</emulator>
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='/dev/HostVG/QEMUGuest1'/>
+      <target dev='vda' bus='virtio'/>
+      <address type='ccw' cssid='0xfe' ssid='0x0' devno='0x0000'/>
+    </disk>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index c08b3e02ef..06f0417a0b 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -1574,6 +1574,87 @@ mymain(void)
     DO_TEST("memory-hotplug-dimm-addr", QEMU_CAPS_DEVICE_PC_DIMM, QEMU_CAPS_NUMA,
             QEMU_CAPS_DEVICE, QEMU_CAPS_OBJECT_MEMORY_RAM);
 
+    DO_TEST("machine-aeskeywrap-on-caps",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP,
+            QEMU_CAPS_DEA_KEY_WRAP, QEMU_CAPS_DRIVE,
+            QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-on-caps", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-on-caps", NONE);
+
+    DO_TEST("machine-aeskeywrap-on-cap",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP,
+            QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-on-cap", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-on-cap", NONE);
+
+    DO_TEST("machine-aeskeywrap-off-caps",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP,
+            QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-off-caps", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-off-caps", NONE);
+
+    DO_TEST("machine-aeskeywrap-off-cap",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DRIVE,
+            QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-off-cap", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-aeskeywrap-off-cap", NONE);
+
+    DO_TEST("machine-deakeywrap-on-caps",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP,
+            QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-on-caps", QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_DRIVE,
+                    QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-on-caps", NONE);
+
+    DO_TEST("machine-deakeywrap-on-cap",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_DEA_KEY_WRAP, QEMU_CAPS_DRIVE,
+            QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-on-cap", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-on-cap", NONE);
+
+    DO_TEST("machine-deakeywrap-off-caps",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP,
+            QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-off-caps", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-off-caps", NONE);
+
+    DO_TEST("machine-deakeywrap-off-cap",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_DEA_KEY_WRAP, QEMU_CAPS_DRIVE,
+            QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-off-cap", QEMU_CAPS_MACHINE_OPT,
+                    QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+                    QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST_FAILURE("machine-deakeywrap-off-cap", NONE);
+
+    DO_TEST("machine-keywrap-none-caps",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_AES_KEY_WRAP, QEMU_CAPS_DEA_KEY_WRAP,
+            QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE,
+            QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+    DO_TEST("machine-keywrap-none",
+            QEMU_CAPS_MACHINE_OPT, QEMU_CAPS_DRIVE, QEMU_CAPS_VIRTIO_SCSI,
+            QEMU_CAPS_DEVICE, QEMU_CAPS_VIRTIO_CCW, QEMU_CAPS_VIRTIO_S390);
+
     virObjectUnref(driver.config);
     virObjectUnref(driver.caps);
     virObjectUnref(driver.xmlopt);