unsigned long *rmapp;
 
        while (mask) {
-               rmapp = &slot->rmap[gfn_offset + __ffs(mask)];
+               rmapp = __gfn_to_rmap(slot->base_gfn + gfn_offset + __ffs(mask),
+                                     PT_PAGE_TABLE_LEVEL, slot);
                __rmap_write_protect(kvm, rmapp, PT_PAGE_TABLE_LEVEL, false);
 
                /* clear the first set bit */
 
 
 static void audit_write_protection(struct kvm *kvm, struct kvm_mmu_page *sp)
 {
-       struct kvm_memory_slot *slot;
        unsigned long *rmapp;
        u64 *sptep;
        struct rmap_iterator iter;
        if (sp->role.direct || sp->unsync || sp->role.invalid)
                return;
 
-       slot = gfn_to_memslot(kvm, sp->gfn);
-       rmapp = &slot->rmap[sp->gfn - slot->base_gfn];
+       rmapp = gfn_to_rmap(kvm, sp->gfn, PT_PAGE_TABLE_LEVEL);
 
        for (sptep = rmap_get_first(*rmapp, &iter); sptep;
             sptep = rmap_get_next(&iter)) {