The actual page size (region size for MPU) of armv7m may smaller than TARGET_PAGE_SIZE (2^5 vs 2^10). So we should use the actual virtual address to get the phys page address.
Since address_space_rw do not check the region protection, so if we have some region like [0x0020 ~ 0x003F rw], [0x0040 ~ 0x007F --], we will be able to read out the whole [0x0020 ~ 0x007F] region. As a debug function, this seems acceptable. I have make a minimal reproducible demo here: https://gist.github.com/xndcn/3c534818b6486ecd2414d1cc7925c372 after building main.elf, run: qemu-system-arm -machine stm32vldiscovery -kernel main.elf -s & gdb-multiarch main.elf (gdb) target remote :1234 (gdb) disas main Dump of assembler code for function main: 0x08000040 <+0>: Cannot access memory at address 0x8000040
