question about mmu.

[cs-jerry**]

hi all,
     if gpte in guest table was set write protection , the corresponding spte 
in shadow will set be write protection. so any operation in guest trying to
modify guest page will generate page fault to stop the opetation except on 
condition that the guest set  wp bit in cr0. so  my question is, how to make 
sure the guest is not able  to modify  specified page,considering the condition 
that wp bit in cr0 will be set to 0? 
thanks.