kvm: move do_remove_write_access() up