Using kvm_mmu_remove_write_access to write-protect pages

Hello ,

I want to capture all the writes taking place in a guest os and tried to write-protect the pages using a hypercall in this way ( host with ept , guest & host 64 bit linux) :

case 0x99999996 :

                {
                struct kvm *kvm=vcpu->kvm;
                spin_lock(&kvm->mmu_lock);
                struct kvm_memslots *slots = kvm->memslots;
                int i = 0;
                for (i = 0; i < KVM_MEM_SLOTS_NUM; i++){
                        kvm_mmu_slot_remove_write_access(kvm, 
slots->id_to_index[i]);
                }
                spin_unlock(&kvm->mmu_lock);
                }
                break;
guest kernel module ( to test ) :
        unsigned long addr = __get_free_page(GFP_KERNEL);
        wrmsrl(0x99999996, 0);
        strcpy((char *)addr, "K");
        strcpy((char *)addr, "V");
        strcpy((char *)addr, "M");

How do I mark the ept entries as write-protect again after the first strcpy from within kvm itself so that I can catch it in kvm_mmu_page_fault with an error_code = 3 ( write + page present ) ? Also , is it correct to say that shadow page tables are in fact the ept tables and shadow page cache , the ept tlb ( where the x86 hardware searches for the gva<--> hva translations ) ?

Thanks ,
Jaspal