Query regarding Linux Arm pagetable setup

Hi,

I am trying to understand the linux arm memory management and
I have some questions regarding the linux's arm pagetables.

I am looking at the kernel 4.1.0 execution with Arm-v7 architecture
and LPAE enabled.

I am not able to understand what is the use of TTBR1 page table mappings.
The settings in TTBCR register are T0SZ - 0 and T1SZ - 2, which indicate a
3G-1G split but if I look at the TTBR1 page table then it doesn't
contains some of the
actual required high address (1G range) mappings while they are
present in the TTBR0 page table.

Can someone explain how the kernel is using both the TTBR0 and TTBR1
and how some
mappings which should've been present in TTBR1 are actually used
through the TTBR0 register?

Also, another thing which I noticed is that kernel is mapping the high
interrupt vectors (addr 0xFFFF0000)
in the user process's page table with read only permissions and user
bit enabled.
Can you also explain why kernel is mapping the kernel's pages with the
user bit? Also are there any other
kernel pages which are marked with similar user bit and read only
permissions in the pagetables
with possible aliasing in the kernel's address space too?

Thanks,
Dushyant