KVM: MMU: update 'root_hpa' out of loop in PAE shadow path