Comment 28 for bug 1350522

Ok, finally it seems I found the problem. It seems Xen setup code is accidentally setting up the kernel page tables in a way that causes the last 2G of memory to be identically mapped (kernel mappings). This would just work normally because the page table that covers the first 1G would correctly be clean for the second 512M (which started the module space before). If modules ever reached more than 512M of memory this just would have happened with the old layout, too.
But now that the kernel image is increased to 1G, we start to use the bad page table immediately.

Sent this patch upstream (right now only tested with the new layout)