diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index cb8db727edad..6e1de374ac5b 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1796,10 +1796,6 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
 	hva_t reg_end = hva + mem->memory_size;
 	int ret = 0;
 
-	if (change != KVM_MR_CREATE && change != KVM_MR_MOVE &&
-			change != KVM_MR_FLAGS_ONLY)
-		return 0;
-
 	/* In protected mode, cannot modify memslots once a VM has run. */
 	if (is_protected_kvm_enabled() &&
 	    (change == KVM_MR_DELETE || change == KVM_MR_MOVE) &&
@@ -1807,6 +1803,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
 		return -EPERM;
 	}
 
+	if (change != KVM_MR_CREATE && change != KVM_MR_MOVE &&
+			change != KVM_MR_FLAGS_ONLY)
+		return 0;
+
 	/*
 	 * Prevent userspace from creating a memory region outside of the IPA
 	 * space addressable by the KVM guest IPA space.