We can disable CD unconditionally when there is no assigned device.
KVM now forces guest PAT to all-writeback in that case, so it makes
sense to also force CR0.CD=0.
When there are assigned devices, emulate cache-disabled operation
through the page tables. This behavior is consistent with VMX,
where CD/NW are not touched by vmentry/vmexit.
Note that buggy firmware that does not clear CD/NW is _seriously_
old: SeaBIOS for example has been doing it since October 2008.