Description of problem:
When creating a guest by xl command with "type=netfront" in cfg file on xen version larger than 4.6 host, it will reports warning "Invalid parameter `type'" and check the guest NIC after created, the network device uses rtl8139 model. But creating guest by virsh command with "<model type='netfront'/>" in XML file, it doesn't add an emulated NIC to VM. There is difference between xl and libvirt with the same configuration.


Version-Release number of selected component (if applicable):
Host Fedora Rawhide with latest libvirt, xen and kernel:
libvirt-2.1.0-1.fc26.x86_64
xen-4.7.0-2.fc26.x86_64
kernel-4.7.0-0.rc7.git4.1.fc25.x86_64

Guest RHEL7.2 with kernel (Actually this bug isn't related to guest version, it also ca be reproduced with RHEL7.3 guest):
kernel-3.10.0-327.el7.x86_64

How reproducible: Always

Steps to Reproduce:
1. Create a guest on Fedora Rawhide xen-4.7 host using command "xl create xen-hvm-guest.cfg" with below configuration:
[root@dhcp-9-56 ~]# cat xen-hvm-guest.cfg
name = "xen-hvm-a"
memory = 1024
vcpus = 2
builder = "hvm"
kernel = "/usr/lib/xen/boot/hvmloader"
boot = "c"
pae = 1
acpi = 1
apic = 1
sdl = 0
vnc = 1
vncunused = 1
vnclisten = "0.0.0.0"
localtime = 0
on_poweroff = "destroy"
on_reboot = "restart"
on_crash = "restart"
device_model = "/usr/lib64/xen/bin/qemu-dm"
disk = [ "file:/home/RHEL-Server-7.2-64-20151030.0-hvm.raw,xvda,w" ]
vif = [ "type=netfront,mac=00:16:36:43:72:c9,script=vif-bridge,bridge=xenbr0" ]
serial = "pty"

[root@dhcp-9-56 ~]# xl create xen-hvm-guest.cfg
Parsing config from xen-hvm-guest.cfg
WARNING: you seem to be using "kernel" directive to override HVM guest firmware. Ignore that. Use "firmware_override" instead if you really want a non-default firmware
Invalid parameter `type'.
WARNING: ignoring device_model directive.
WARNING: Use "device_model_override" instead if you really want a non-default device_model

Check the dm-qemu process, we can see that the network device use rtl8139 model.
[root@dhcp-9-56 ~]# ps ax | grep qemu
30963 ?        SLsl   0:12 /usr/bin/qemu-system-i386 -xen-domid 135 -chardev socket,id=libxl-cmd,path=/var/run/xen/qmp-libxl-135,server,nowait -no-shutdown -mon chardev=libxl-cmd,mode=control -chardev socket,id=libxenstat-cmd,path=/var/run/xen/qmp-libxenstat-135,server,nowait -mon chardev=libxenstat-cmd,mode=control -nodefaults -no-user-config -name xen-hvm-a -vnc 0.0.0.0:0,to=99 -display none -serial pty -device cirrus-vga,vgamem_mb=8 -boot order=c -smp 2,maxcpus=2 -device rtl8139,id=nic0,netdev=net0,mac=00:16:36:43:72:c9 -netdev type=tap,id=net0,ifname=vif135.0-emu,script=no,downscript=no -machine xenfv -m 1016 -drive file=/home/RHEL-Server-7.2-64-20151030.0-hvm.raw,if=ide,index=0,media=disk,format=raw,cache=writeback

We can see that the network device use rtl8139 model.

2. Create guest with xml file with "<model type='netfront'/>":
[root@dhcp-9-56 ~]# cat xen-hvm-guest.xml
<domain type='xen'>
  <name>xen-hvm-guest</name>
  <memory unit='KiB'>5120000</memory>
  <currentMemory unit='KiB'>5120000</currentMemory>
<vcpu placement='static' current='4'>4</vcpu>  
<os>
    <type arch='x86_64' machine='xenfv'>hvm</type>
    <loader type='rom'>/usr/lib/xen/boot/hvmloader</loader>
    <boot dev='hd'/>
  </os>
  <features>
    <acpi/>
    <apic/>
    <pae/>
  </features>
  <clock offset='variable' adjustment='0' basis='utc'/>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>preserve</on_crash>
  <devices>
<emulator>/usr/bin/qemu-system-i386</emulator>    
<disk type='file' device='disk'>
      <driver name='file'/>
      <source file='/home/RHEL-Server-7.3-64-hvm.raw'/>
      <target dev='hda' bus='ide'/>
    </disk>
<interface type='bridge'>
<mac address='00:16:3e:fc:e5:46'/>
<model type='netfront'/>
<source bridge='xenbr0'/>
</interface>
<serial type='pty'>
      <target port='0'/>
    </serial>
    <console type='pty'>
      <target type='serial' port='0'/>
    </console>
    <input type='mouse' bus='ps2'/>
    <input type='keyboard' bus='ps2'/>
    <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0'>
      <listen type='address' address='0.0.0.0'/>
    </graphics>
    <video>
      <model type='cirrus' vram='8096' heads='1' primary='yes'/>
    </video>
  </devices>
</domain>



Actual results:
Guest is created without warning about netfront model.
And check the qemu-dm process, it doesn't add an emulated NIC to guest as the xl does.
[root@dhcp-9-56 ~]# ps ax | grep qemu
  470 pts/0    S+     0:00 grep --color=auto qemu
32751 ?        SLsl   0:10 /usr/bin/qemu-system-i386 -xen-domid 140 -chardev socket,id=libxl-cmd,path=/var/run/xen/qmp-libxl-140,server,nowait -no-shutdown -mon chardev=libxl-cmd,mode=control -chardev socket,id=libxenstat-cmd,path=/var/run/xen/qmp-libxenstat-140,server,nowait -mon chardev=libxenstat-cmd,mode=control -nodefaults -no-user-config -name xen-hvm-guest -vnc 0.0.0.0:1 -display none -serial pty -device cirrus-vga,vgamem_mb=8 -boot order=c -usb -smp 4,maxcpus=4 -net none -machine xenfv -m 4992 -drive file=/home/RHEL-Server-7.3-64-hvm.raw,if=ide,index=0,media=disk,format=raw,cache=writeback

Expected results:
Libvirt should perform the same as xl that ommit netfront type.