> crash> rd -u 0x400000
> rd: invalid user virtual address: 400000  type: "64-bit UVADDR"

Ah, damn it -- it would also be printed later on in
readmem() if uvtop() fails:

        while (size > 0) {
                switch (memtype)
                {
                case UVADDR:
                        if (!uvtop(CURRENT_CONTEXT(), addr, &paddr, 0)) {
                                if (PRINT_ERROR_MESSAGE)
                                        error(INFO, INVALID_UVADDR, addr, type);
                                goto readmem_error;
                        }
                        break;

That's probably where it's happening...

I would guess that x86_64_uvtop() needs to immediately
recognize if the new VM scheme is in place, and if so
it should veer off to a new "x86_64_uvtop_lev4()" routine.

We definitely want to keep the current one untouched, while
the new one must need a 4th layer of page table translation.
Note that x86_64_kvtop() has the extra FILL_PML4() stuff
before the 3-level breakdown -- I guess that's why vmalloc
addresses still translate.  But there must be another layer
user virtual addresses need to go through.

Dave