Just to correct the description a bit: passing 'default' requests that channels be secure by default, *unless* overridden by a request to have a specific channel insecure. libvirt doesn't implement this yet, it would require passing plaintext-channel=<channel name>.

We're currently debating between two alternative XML representations for the channel default, but will have a decision upstream before today is out.

In POST:
http://post-office.corp.redhat.com/archives/rhvirt-patches/2012-May/msg00189.html

verify with:
libvirt-0.9.10-18.el6.x86_64
spice-gtk-0.11-8.el6.x86_64
spice-server-0.10.1-7.el6.x86_64
kmod-kspiceusb-rhel60-4.9-14.el6.x86_64
usbredir-0.4.3-1.el6.x86_64

step:
   1:prepare windows guest support usb redirector and config tls
   2:edit <graphics type='spice' port='5900' tlsPort='5901' autoport='no' listen='0.0.0.0' keymap='en-us' defaultMode='secure'> in graphics elemet
   3:start the guest
   4: ps -ef | grep $guestname
qemu     16052     1 40 23:21 ?        00:00:44 /usr/libexec/qemu-kvm -S -M rhel6.2.0 -enable-kvm -m 2048 -smp 4,sockets=4,cores=1,threads=1 -name win7_64 -uuid d551e24f-1368-6ffb-02fd-01eb28301ab5 -nodefconfig -nodefaults -chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/win7_64.monitor,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x4.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x4 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x4.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x4.0x2 -drive file=/var/lib/libvirt/images/win7-64.qcow2,if=none,id=drive-ide0-0-0,format=qcow2,cache=none -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0,bootindex=1 -netdev tap,fd=25,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:38:7e:d1,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=com.redhat.spice.0 -spice port=5900,tls-port=5901,addr=0.0.0.0,disable-ticketing,x509-dir=/etc/pki/libvirt-spice,tls-channel=default,tls-channel=main,plaintext-channel=inputs,tls-channel=usbredir -k en-us -vga qxl -global qxl-vga.vram_size=67108864 -device qxl,id=video1,vram_size=67108864,bus=pci.0,addr=0x7 -device intel-hda,id=sound0,bus=pci.0,addr=0x6 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0,bus=usb.0,port=3 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=4 -chardev spicevmc,id=charredir2,name=usbredir -device usb-redir,chardev=charredir2,id=redir2,bus=usb.0,port=5 -chardev spicevmc,id=charredir3,name=usbredir -device usb-redir,chardev=charredir3,id=redir3,bus=usb.0,port=6 -chardev socket,id=charredir4,host=localhost,port=4000 -device usb-redir,chardev=charredir4,id=redir4 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8

got "tls-channel=default,tls-channel=main,plaintext-channel=inputs,tls-channel=usbredir" in qemu command line
verification passed,move to verified.

Created attachment 583708 [details]
guest xml file

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0748.html