diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index eb70523031edd4081a22cfe3bbdbe8e3a45908b3..640f29d3ed8a0160c8c5230ea8f4b1dbac52dfde 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -22804,10 +22804,9 @@ virDomainNetDefFormat(virBufferPtr buf,
 /* Assumes that "<device" has already been generated, and starts
  * output at " type='type'>". */
 static int
-virDomainChrSourceDefFormat(virBufferPtr buf,
-                            virDomainChrSourceDefPtr def,
-                            bool tty_compat,
-                            unsigned int flags)
+virDomainChrAttrsDefFormat(virBufferPtr buf,
+                           virDomainChrSourceDefPtr def,
+                           bool tty_compat)
 {
     const char *type = virDomainChrTypeToString(def->type);
 
@@ -22823,7 +22822,14 @@ virDomainChrSourceDefFormat(virBufferPtr buf,
         virBufferEscapeString(buf, " tty='%s'",
                               def->data.file.path);
     }
-    virBufferAddLit(buf, ">\n");
+    return 0;
+}
+
+static void
+virDomainChrSourceDefFormat(virBufferPtr buf,
+                            virDomainChrSourceDefPtr def,
+                            unsigned int flags)
+{
 
     switch ((virDomainChrType)def->type) {
     case VIR_DOMAIN_CHR_TYPE_NULL:
@@ -22924,7 +22930,7 @@ virDomainChrSourceDefFormat(virBufferPtr buf,
         virBufferAddLit(buf, "/>\n");
     }
 
-    return 0;
+    return;
 }
 
 static int
@@ -22953,8 +22959,10 @@ virDomainChrDefFormat(virBufferPtr buf,
                   def->source->type == VIR_DOMAIN_CHR_TYPE_PTY &&
                   !(flags & VIR_DOMAIN_DEF_FORMAT_INACTIVE) &&
                   def->source->data.file.path);
-    if (virDomainChrSourceDefFormat(buf, def->source, tty_compat, flags) < 0)
+    if (virDomainChrAttrsDefFormat(buf, def->source, tty_compat) < 0)
         return -1;
+    virBufferAddLit(buf, ">\n");
+    virDomainChrSourceDefFormat(buf, def->source, flags);
 
     /* Format <target> block */
     switch (def->deviceType) {
@@ -23067,9 +23075,7 @@ virDomainSmartcardDefFormat(virBufferPtr buf,
         break;
 
     case VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH:
-        if (virDomainChrSourceDefFormat(&childBuf, def->data.passthru, false,
-                                        flags) < 0)
-            return -1;
+        virDomainChrSourceDefFormat(&childBuf, def->data.passthru, flags);
         break;
 
     default:
@@ -23083,6 +23089,10 @@ virDomainSmartcardDefFormat(virBufferPtr buf,
         return -1;
 
     virBufferAsprintf(buf, "<smartcard mode='%s'", mode);
+    if (def->type == VIR_DOMAIN_SMARTCARD_TYPE_PASSTHROUGH &&
+        virDomainChrAttrsDefFormat(buf, def->data.passthru, false) < 0)
+        return -1;
+
     if (virBufferUse(&childBuf)) {
         virBufferAddLit(buf, ">\n");
         virBufferAddBuffer(buf, &childBuf);
@@ -23390,10 +23400,11 @@ virDomainRNGDefFormat(virBufferPtr buf,
         break;
 
     case VIR_DOMAIN_RNG_BACKEND_EGD:
-        virBufferAdjustIndent(buf, 2);
-        if (virDomainChrSourceDefFormat(buf, def->source.chardev,
-                                        false, flags) < 0)
+        if (virDomainChrAttrsDefFormat(buf, def->source.chardev, false) < 0)
             return -1;
+        virBufferAddLit(buf, ">\n");
+        virBufferAdjustIndent(buf, 2);
+        virDomainChrSourceDefFormat(buf, def->source.chardev, flags);
         virBufferAdjustIndent(buf, -2);
         virBufferAddLit(buf, "</backend>\n");
 
@@ -24234,9 +24245,11 @@ virDomainRedirdevDefFormat(virBufferPtr buf,
     bus = virDomainRedirdevBusTypeToString(def->bus);
 
     virBufferAsprintf(buf, "<redirdev bus='%s'", bus);
-    virBufferAdjustIndent(buf, 2);
-    if (virDomainChrSourceDefFormat(buf, def->source, false, flags) < 0)
+    if (virDomainChrAttrsDefFormat(buf, def->source, false) < 0)
         return -1;
+    virBufferAddLit(buf, ">\n");
+    virBufferAdjustIndent(buf, 2);
+    virDomainChrSourceDefFormat(buf, def->source, flags);
     virDomainDeviceInfoFormat(buf, &def->info,
                               flags | VIR_DOMAIN_DEF_FORMAT_ALLOW_BOOT);
     virBufferAdjustIndent(buf, -2);
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-controller.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-controller.xml
new file mode 100644
index 0000000000000000000000000000000000000000..dc7365b0b6075b2bc11563170b7aff914827f1a7
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-controller.xml
@@ -0,0 +1,31 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-i686</emulator>
+    <controller type='ccid' index='0'/>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <smartcard mode='host'>
+      <address type='ccid' controller='0' slot='0'/>
+    </smartcard>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-host-certificates.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-host-certificates.xml
new file mode 100644
index 0000000000000000000000000000000000000000..e0835f6c05474fc96a75a8e11aa80f56d7fe34a0
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-host-certificates.xml
@@ -0,0 +1,34 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-i686</emulator>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <controller type='ccid' index='0'/>
+    <smartcard mode='host-certificates'>
+      <certificate>cert1</certificate>
+      <certificate>cert2</certificate>
+      <certificate>cert3</certificate>
+      <address type='ccid' controller='0' slot='0'/>
+    </smartcard>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-host.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-host.xml
new file mode 100644
index 0000000000000000000000000000000000000000..abb2c4b6ec48514f8e9e676419ebc2b7c5dc80c2
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-host.xml
@@ -0,0 +1,31 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-i686</emulator>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <controller type='ccid' index='0'/>
+    <smartcard mode='host'>
+      <address type='ccid' controller='0' slot='0'/>
+    </smartcard>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-passthrough-spicevmc.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-passthrough-spicevmc.xml
new file mode 100644
index 0000000000000000000000000000000000000000..38755e2d7b38207f1446f4f65600f548173da580
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-passthrough-spicevmc.xml
@@ -0,0 +1,31 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-i686</emulator>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <controller type='ccid' index='0'/>
+    <smartcard mode='passthrough' type='spicevmc'>
+      <address type='ccid' controller='0' slot='0'/>
+    </smartcard>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-passthrough-tcp.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-passthrough-tcp.xml
new file mode 100644
index 0000000000000000000000000000000000000000..2232daa3595ee6fb7568058236a6ebfa05d6e994
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-smartcard-passthrough-tcp.xml
@@ -0,0 +1,33 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-i686</emulator>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <controller type='ccid' index='0'/>
+    <smartcard mode='passthrough' type='tcp'>
+      <source mode='bind' host='127.0.0.1' service='2001'/>
+      <protocol type='raw'/>
+      <address type='ccid' controller='0' slot='0'/>
+    </smartcard>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
index bf4d507f66731b2bd8a7a2abd5e6f7a3ab4a2629..0d549adecf93e50f9374bdd7e477f1202d1981da 100644
--- a/tests/qemuxml2xmltest.c
+++ b/tests/qemuxml2xmltest.c
@@ -1199,6 +1199,12 @@ mymain(void)
     DO_TEST("cpu-check-default-partial", NONE);
     DO_TEST("cpu-check-default-partial2", NONE);
 
+    DO_TEST("smartcard-host", NONE);
+    DO_TEST("smartcard-host-certificates", NONE);
+    DO_TEST("smartcard-passthrough-tcp", NONE);
+    DO_TEST("smartcard-passthrough-spicevmc", NONE);
+    DO_TEST("smartcard-controller", NONE);
+
     if (getenv("LIBVIRT_SKIP_CLEANUP") == NULL)
         virFileDeleteTree(fakerootdir);