xen: set IO permission early (before early_cpu_init())