That is, given a physical address, can I tell whether this address is from userspace or not?
As far as I know, in virtual address space, the kernel will use the upp
No.
Almost any physical page frame can be mapped to a userspace virtual address or a kernel virtual address, or even both at the same time.