<cpu mode='custom' match='exact'>
  <model fallback='allow'>core2duo</model>
  <feature policy='disable' name='nx'/>
</cpu>