+#if (defined(__i386__) || defined(__x86_64__)) && NCOPY_WINDOWS > 0
+ /*
+ * Create and initialize the copy window for processor 0
+ * This also allocates window space for all other processors.
+ * However, this is dependent on the number of processors - so this call
+ * must be after IOKit has been started because IOKit performs processor
+ * discovery.
+ */
+ cpu_userwindow_init(0);
+#endif
+
+#if (!defined(__i386__) && !defined(__x86_64__))
+ if (turn_on_log_leaks && !new_nkdbufs)
+ new_nkdbufs = 200000;
+ if (trace_typefilter)
+ start_kern_tracing_with_typefilter(new_nkdbufs, FALSE, trace_typefilter);
+ else
+ start_kern_tracing(new_nkdbufs, FALSE);
+ if (turn_on_log_leaks)
+ log_leaks = 1;
+#endif
+
+ /*
+ * Initialize the shared region module.
+ */
+ vm_shared_region_init();
+ vm_commpage_init();
+ vm_commpage_text_init();
+
+
+#if CONFIG_MACF
+ kernel_bootstrap_log("mac_policy_initmach");
+ mac_policy_initmach();
+#endif
+
+#if CONFIG_SCHED_SFI
+ kernel_bootstrap_log("sfi_init");
+ sfi_init();
+#endif
+
+ /*
+ * Initialize the globals used for permuting kernel
+ * addresses that may be exported to userland as tokens
+ * using VM_KERNEL_ADDRPERM()/VM_KERNEL_ADDRPERM_EXTERNAL().
+ * Force the random number to be odd to avoid mapping a non-zero
+ * word-aligned address to zero via addition.
+ * Note: at this stage we can use the cryptographically secure PRNG
+ * rather than early_random().
+ */
+ read_random(&vm_kernel_addrperm, sizeof(vm_kernel_addrperm));
+ vm_kernel_addrperm |= 1;
+ read_random(&buf_kernel_addrperm, sizeof(buf_kernel_addrperm));
+ buf_kernel_addrperm |= 1;
+ read_random(&vm_kernel_addrperm_ext, sizeof(vm_kernel_addrperm_ext));
+ vm_kernel_addrperm_ext |= 1;
+
+ vm_set_restrictions();
+
+