Question about memory protected between user-space and kernel-space

In general, virtual address above 3GB could be only accessible by
kernel-domain itself, and be blocked by user-domain.

Could you please give a brief introduction how to implement it?

In my scene, the protected above rely to the DAC register (CP15 C3
register). But in kernel code, the domain value in PTE of user mapping
and kernel mapping are the same.