title: What is the application of the ARM unprivileged load store instructions like LDTR compared to LDR?
body: <p>I came across the LDTR ARMv8 instruction today for the first time.</p>
  
  <p>I read its description on the <a href="https://static.docs.arm.com/ddi0487/db/DDI0487D_b_armv8_arm.pdf" rel="nofollow noreferrer">ARMv8 DB</a> manual section C3.2.5 "Load/Store unprivileged", and from what I understood it basically allows EL1 to make memory accesses with EL0 restrictions.</p>
  
  <p>What is the application for this feature?</p>
  
  <p>Is this something along the lines of making it harder to create an attack that uses a kernel bug to make the kernel write data to the wrong address?</p>
  
  <p>How does LDTR know which page table translations to use, considering that there are generally multiple process running at the same time? Or do those restrictions refer to other types of permissions unrelated to that which is specified on page tables?</p>