vhost: protect vring access done by application