Boot-args catalogue

Every mp_ boot-argument the kernel, the loader and the shim read, with its default.

Open Mapple’s boot-arguments start with mp_. They are words on the kernel’s command line: the shared line of common.conf, then device.conf’s cmdline and the layout’s own line (see device.conf keys), then the boot-args record when it applies. Every hardware step is behind its own argument and does nothing without it. A name that appears twice on the line is read at its first occurrence.

Most arguments also accept an older name (viva..., sweet... or a plain name such as ufsroot), shown in the last column. XNU’s own arguments that the shared line sets (debug, serial, rd, wdt, cpus) and unentitled_ios_sim_launch, ignition_level and launchd_unsecure_cache, which device.conf adds, are not repeated here.

An argument that a driver reads is only meaningful where that driver is built in and its device-tree node exists. device.conf’s line for spaced also contains mp_bootrec_nowrite, which nothing in these repositories reads at these commits.

Boot, memory and the record

Argument	Default	What it does	Read in	Old name
`mp_mem4g`	1	`0`: the 2 GB layout. Otherwise XNU gets DRAM from `0x40000000` minus the holes the shim lists. The shim, and the kernel, which panics with all of DRAM and no list.	shim/loader.c, arm_vm_init.c
`mp_bootrec`	1	`0`: the shim ignores the boot-args record, and the line is read as a safe boot’s: `mp_audio_steps`, `mp_vib_steps`, `mp_torch_steps`, `mp_cam_steps` and `mp_hidres` default to off, `mp_poweroff` is 0, and the ADT’s `mapple-resize` flag is not read.	shim/bootrec.c, mapple_sysctl.c, mtk_audio.c, mtk_torch.c, mtk_cam.c, IOHIDResource.cpp, MapplePlatformExpert.cpp, MappleLetterbox.h	`vivabootfile (shim)`
`mp_ufsroot`	none	the GPT name of the root partition (`userdata` or `xnusys`). The loader and the shim use it to find the root and the record; the kernel exposes it as `ufsroot0`.	mtkloader.c, shim/bootrec.c, mtk_ufs.c	`ufsroot`
`mp_ufslun`	2 in the shim; the kernel searches LUNs 0 to 7	the UFS logical unit whose GPT holds the root partition (`0` to `7`).	shim/bootrec.c, mtk_ufs.c	`ufslun`
`mp_ufsrw`	0	`1`: writes to the UFS are allowed (every write is checked against the partition’s bounds). The record, the persistent log and a read-write root need it.	mtk_ufs.c	`ufsrw`
`mp_ufscache`	0	`1`: cache maintenance cleans only what a command dirtied instead of syncing whole buffers.	mtk_ufs.c	`ufscache`
`mp_ufswait`	0	`1`: after a short spin the driver sleeps between polls of a command instead of spinning.	mtk_ufs.c	`ufswait`
`mp_rootrw`	0	`1`: the root is mounted read-write from the start.	vfs_subr.c	`rootrw`
`mp_conlog`	1	`0`: no persistent console log. On, a 4 MiB ring of the console is copied to the last 4 MiB + 4 KiB of the root partition, which is where the installer’s tail log area and the boot-args record’s block lie; `device.conf` sets `mp_conlog=0`.	mtk_ufs.c	`sweetlog`
`mp_ufslogsecs`	10	seconds between flushes of that log; `0` or over 60 is taken as 10.	mtk_ufs.c	`ufslogsecs`
`mp_iokitd`	0	`1`: the kernel waits for `kextd` as stock XNU does; by default it does not.	OSKext.cpp	`sweetiokitd`

These are written by mtkloader, not set by hand: a safe boot adds mp_bootrec=0 mp_mem4g=0 to the payload’s line and turns mp_gpu=2 into 1 and mp_wifi_steps, mp_bt_steps into 0, each in place.

Argument	Default	What it does	Read in
`mp_menu_default`	android	`android` or `ios`: what the split layout’s boot menu starts when nobody chooses.	splitmenu.h
`mp_menu_secs`	(menu default)	seconds the menu waits, clamped to the menu’s minimum and maximum.	splitmenu.h
`mp_menu_pmic`	1	`0`: the menu does not read volume up and power (the PMIC keys).	splitmenu.h

Console, link and logs

Argument	Default	What it does	Read in	Old name
`mp_usblink`	0 (DEVELOPMENT and DEBUG kernels only)	`1` probe the USB controller; `2` probe, then panic with the summary; `3` probe, then start the Mapple link. A RELEASE kernel has no link.	usb_link.c	`vivausb`
`mp_usblink_std`	1	`0`: the link never leaves its own USB persona (no iPhone-like composite device for `mapple-usbd`).	usb_link.c	`vivausbstd`
`mp_fb_noconsole`	0	`1`: the kernel console is not drawn from the first swap on; the log still gets it and a panic still draws.	MappleFramebuffer.cpp	`sweetfb_noconsole`
`mp_null_tee`	backboardd,SpringBoard,assetsd	comma-separated process names whose writes to `/dev/null` are echoed to the console as `\|name\| text`; `-` turns it off.	mem.c	`sweetnull`
`mp_iokit_log`	backboardd,SpringBoard	process names whose IOKit registry and matching calls are printed as `IOK name: ...`, at most 400 lines a boot; `-` turns it off.	IOUserClient.cpp	`sweetiolog`
`mp_crash_strings`	backboardd,SpringBoard	processes that die with SIGABRT or SIGTRAP get the printable text runs of their malloc heap printed as `STR text`, at most 700 lines; `-` turns it off.	exception.c	`sweetscan`
`mp_proc_sample`	SpringBoard,backboardd	processes whose threads a kernel thread samples (pc, lr, sp and a backtrace) 90 s after start, then every 120 s, 40 samples at most; `-` turns it off.	proc_sampler.c	`sweetsample`
`mp_gpuprobe`	0	`1`: report what LK leaves of the GPU; `2`: power it as LK left its supply and read GPU_ID and SHADER_PRESENT.	mtk_gpu_probe.c	`gpuprobe`

CPU, thermal

The OPP tables and the thermal calibration are passed by mtkloader (mp_dvfs_tbl, mp_lvts_golden, mp_lvts_r); without them DVFS does not start (LVTS uses a built-in calibration).

Argument	Default	What it does	Read in	Old name
`mp_cpufreq`	1	`0` never touches clocks or rails; `1` the governor; `2` manual, through the link only.	mt6781_cpufreq.c	`vivacpufreq`
`mp_cpufreq_ll`, `mp_cpufreq_big`, `mp_cpufreq_cci`	2000, 2050, 1400	MHz ceilings of the A55 cluster, the A76 cluster and the CCI.	mt6781_cpufreq.c	`vivacpull`, `vivacpubig`, `vivacpucci`
`mp_cpufreq_fast`	1	`0`: no scheduler preference for the A76s.	mt6781_cpufreq.c	`vivacpufast`
`mp_cpufreq_boost`	fastest OPP	MHz that LL and big run at least at while the UI boost is on.	mt6781_cpufreq.c	`vivacpuboost`
`mp_cpufreq_boost_ms`	250	how long the boost lasts after the last display or touch signal; `0` turns it off.	mt6781_cpufreq.c	`vivacpuboostms`
`mp_lpm_cpu`	1530	MHz ceiling of the A76 cluster in Low Power Mode (LL 1500, CCI 1050).	mt6781_cpufreq.c	`vivalpmcpu`
`mp_dvfs_tbl`	none	physical address of LK’s OPP tables, passed by `mtkloader`; it must lie between `0x40000000` and `0xc0000000`.	mt6781_cpufreq.c	`dvfs_tbl`
`mp_therm`	1	`0`: no LVTS; the clusters are capped at OPP 6. With `mp_cpufreq=0` and `1`: readings only.	mt6781_cpufreq.c	`vivatherm`
`mp_therm_trip`	85	degrees C at which the governor steps both clusters down; clamped to 60 to 100.	mt6781_cpufreq.c	`vivathermtrip`
`mp_therm_hwreset`	off	degrees C at which the hardware thermal reset is armed before any DVFS write; DVFS does not start if arming fails.	mt6781_cpufreq.c	`vivathermhw`
`mp_lvts_golden`, `mp_lvts_r`	built in	the efuse calibration (`golden` 1 to 255, and `r<hex>.<hex>...`, the nine count values), passed by `mtkloader`.	mt6781_cpufreq.c	`lvts_golden`, `lvts_r`

GPU

mp_gpu is read first; with it off none of the others matter.

Argument	Default	What it does	Read in	Old name
`mp_gpu`	0	`0` off, `1` bring-up, `2` power at boot and publish the accelerator.	MappleGPU.cpp	`vivagpu`
`mp_gpu_freq`	300	MHz floor of the GPU clock.	MappleGPU.cpp	`vivagpufreq`
`mp_gpu_freqmax`	950	MHz ceiling of the governor, never below the floor.	MappleGPU.cpp	`vivagpufreqmax`
`mp_gpu_mv`	50	voltage margin in mV, clamped to 0 to 100.	MappleGPU.cpp	`vivagpumv`
`mp_gpu_lkrails`	0	`1`: stay at LK’s 300 MHz and rails: no PMIC write, DVFS off.	MappleGPU.cpp	`vivagpulkrails`
`mp_gpu_dvfs`	1	`0`: no frequency governor.	MappleGPU.cpp	`vivagpudvfs`
`mp_gpu_boost`	1	`0`: no boost to the fastest OPP while the display waits for frames.	MappleGPU.cpp	`vivagpuboost`
`mp_gpu_fastkick`	1	`0`: the fast-kick path off; the link’s `gpu` command switches it at run time.	MappleGPU.cpp	`vivagpufastkick`
`mp_gpu_cache`	1	buffer cache mode: `0` turns the lazy and write-combined options off; `2` is a diagnosis mode in which every CPU-maintained buffer of a connection goes with the job.	MappleGPU.cpp, MappleGPUUserClient.cpp	`vivagpucache`
`mp_gpu_lazy`	1	`1` (and a non-zero cache mode): CPU-maintained buffers the GPU used are invalidated lazily, when the CPU next touches them.	MappleGPU.cpp	`vivagpulazy`
`mp_gpu_wc`	1	`0`: cacheable buffers maintained by the kernel instead of write-combined.	MappleGPU.cpp	`vivagpuwc`
`mp_gpu_flushid`	1	`0`: no flush reduction (`JS_FLUSH_ID_NEXT` is not set to `GPU_LATEST_FLUSH` at submit).	MappleGPU.cpp	`vivagpuflushid`
`mp_gpu_footprint`	1	`0`: the GPU’s memory is not counted in its process’s `phys_footprint`.	MappleGPU.cpp, MappleSurface.cpp
`mp_gpu_jobms`	3000	a job’s time in ms before its hard stop, clamped to 1000 to 30000.	MappleGPU.cpp
`mp_gpu_lostirq`	1	`0`: a lost GPU, MMU or job interrupt line is only logged; otherwise it is handled and the line switched off and on.	MappleGPU.cpp
`mp_gpu_memtotal`, `mp_gpu_mem`	(compile-time)	MiB the GPU may hold in all, and per process.	MappleGPU.cpp	`vivagpumemtotal`, `vivagpumem`
`mp_gpu_probeclient`	1	`0`: an unknown user client of the GPU is refused; otherwise it gets a probe client whose calls are counted and dropped.	MappleGPU.cpp	`vivagpuprobe`
`mp_lpm_gpu`	550	MHz ceiling of the GPU in Low Power Mode (applies where the battery service above is present).	BQ27Z561Battery.cpp	`vivalpmgpu`
`mp_surface_pitch64`	0	`1`: new surfaces get rounded rows; `2`: also explicit sizes, with the allocation grown to the rounded rows; `0`: as the client asked.	MappleSurface.cpp, MappleFramebuffer.cpp	`vivasurfpitch`

Display

The display driver is shared with the viva port: the mp_panel_* arguments are written for that phone’s Xiaomi panel, whose refresh and backlight commands they drive.

Argument	Default	What it does	Read in	Old name
`mp_fb_native`	0	`1`: present the real panel size; otherwise the display is presented as the iPhone X’s 1125 x 2436 and its centre is shown.	MappleFramebuffer.cpp, MappleHID.cpp	`sweetfb_native`
`mp_fb_rsz`	from the ADT	the display pipe’s resizer: `1` read only, `2` on. The ADT’s `mapple-resize` (`device.conf`’s `resize`) sets the default.	MappleLetterbox.h
`mp_fb_letterbox`	0	scale the whole presented picture onto the panel under a black strip (`MappleLetterbox.h`).	MappleFramebuffer.cpp, MappleHID.cpp
`mp_fb_early`	1	`0`: a finished frame is not also presented when a swap arrives or a GPU job on IOSurfaces completes, only at the next tick.	MappleFramebuffer.cpp	`sweetfb_early`
`mp_fb_onelayer`	1 if the resizer is on, else 0	`1`: use one overlay layer (the resizer needs it).	MappleFramebuffer.cpp	`sweetfb_onelayer`
`mp_fb_hz`	(off)	flush rate; given, `0` or 60 or more means every tick, else every `60 / hz` ticks.	MappleFramebuffer.cpp	`sweetfb_hz`
`mp_fb_duty`	25	percent of a CPU panel copies may use, clamped to 1 to 100.	MappleFramebuffer.cpp	`sweetfb_duty`
`mp_fb_gpuwait`	12	ticks (200 ms) to wait for a frame’s GPU job before the newest frame is shown anyway; `0` turns the wait off.	MappleFramebuffer.cpp	`sweetfb_gpuwait`
`mp_fb_flip`	1	`0`: no double buffering; the copy goes to the buffer on screen (a frame may tear).	MappleFramebuffer.cpp	`sweetfb_flip`
`mp_fb_lead`	1000	microseconds before the predicted frame end at which each vsync tick fires, clamped to 200 to 4000.	MappleFramebuffer.cpp	`sweetfb_lead`
`mp_fb_scanout`	0	`1`: display-sized surfaces are physically contiguous and a full-screen BGRA swap only moves the overlay layer’s address and pitch, with no CPU copy.	MappleFramebuffer.cpp	`vivascanout`
`mp_fb_pool`	4	size of the pool taken at boot for CoreAnimation’s pages; `0` none.	MappleFramebuffer.cpp	`vivafbpool`
`mp_panel_hz`	60	`60`, `120` or `1` (auto: 120 Hz from the first swap, 60 Hz after `mp_panel_idle` ms without one). Written for viva’s Xiaomi panel: the switch is its DCS packet sequence.	MappleFramebuffer.cpp	`vivapanelhz`
`mp_panel_nits`	500	the nits of backlight level 2047, clamped to 50 to 2000.	MappleFramebuffer.cpp	`vivapanelnits`
`mp_panel_idle`	500	ms without a swap before the auto refresh drops to 60 Hz, clamped to 100 to 60000.	MappleFramebuffer.cpp	`vivapanelidle`
`mp_panel_seq`	0	where the porch goes relative to the refresh switch’s commands, at most 2.	MappleFramebuffer.cpp	`vivapanelseq`
`mp_fb_bloff`	1	`0`: leave the backlight alone; otherwise it is turned off while the display is off.	MappleFramebuffer.cpp
`mp_fb_blmin`	0	iOS’s backlight levels 1 to 2047 are sent as N to 2047.	MappleFramebuffer.cpp
`mp_fb_blcal`	0	`1`: give CoreBrightness the panel’s nits range; only with the light sensor published.	MappleFramebuffer.cpp
`mp_scaler`, `mp_scaler_formats`, `mp_scaler_cpumax`	2, 3, unlimited	the scaler: mode (`2` the MDP engines, `0` off), the formats it takes, and the largest size the CPU path takes.	MTKScaler.cpp	`vivascaler`, `vivascalerformats`, `vivascalercpumax`
`mp_mdp_max`, `mp_mdp_rgb`	1125 x 2448 pixels, 1	largest frame for the MDP’s bounce buffers, and its RGB mode.	MTKMDP.cpp	`vivamdpmax`, `vivamdprgb`
`mp_jpeg`	0	`1` or more starts the JPEG engine’s driver.	MTKJPEG.cpp	`vivajpeg`

Touch, keys and sensors

Argument	Default	What it does	Read in	Old name
`mp_touch`	1	`0`: no touch backend.	MappleHID.cpp	`sweettouch`
`mp_ili_touch`	1	`0`: leave the ILI7807S alone.	ILI7807S.cpp	`mappletouch`
`mp_ili_fw`	none	physical address of the firmware table `mtkloader` left, so the driver can send it again when the chip loses it.	ILI7807S.cpp	`ili_fw`
`mp_touchlog`	0	`1`: log every landing and lifting.	ILI7807S.cpp	`touchlog`
`mp_ili_quiet`	1	`0`: leave a quiet chip alone. Otherwise, after a quiet spell with the screen on and no interrupt, the firmware’s version is asked for and, with still no interrupt, the firmware is sent again (a host-download firmware only, at most twice a boot, at most every 2 s).	ILI7807S.cpp
`mp_hidres`	1	`0`: no IOHIDResource (the Bluetooth keyboard path); off on a safe boot.	IOHIDResource.cpp
`mp_hid_test`	0	seconds of the buttons’ test timer.	MappleHID.cpp	`sweethidtest`
`mp_sensor_steps`	5	`0` leaves the SCP alone; `1` status, read only; `2` the IPI handshake and the hub’s start; `3` the accelerometer; `4` the plain sensors; `5` also steps and activity, raise to wake and device motion.	mtk_scp.c
`mp_scp_unmask`	1	`0`: do not unmask the hub’s non-wakeup interrupt once it is up.	mtk_scp.c
`mp_scp_ring_max`	none	physical address: the hub’s ring is taken from blocks that end at or below it.	MappleSPU.cpp
`mp_scp_accel_us`	50 Hz	the accelerometer’s period at step 3, in microseconds.	mtk_scp.c
`mp_scp_clk26m`	0	`1`: switch the SCP’s clock to the 26 MHz crystal at step 2 if it is not there.	mtk_scp.c
`mp_imu_axes`, `mp_mag_axes`	0x123	a nibble per output axis (x, y, z): the hub’s axis 1 to 3, plus 8 to flip it.	MappleSPU.cpp
`mp_als_div`	1	divisor of the hub’s light value; at 1 the value is taken as lux.	MappleSPU.cpp
`mp_als_default`	100	lux reported before the first reading; `0` none.	MappleSPU.cpp
`mp_spu_off`	0x7de	a bit per HID service left out (accel 0, gyro 1, compass 2, proximity 3, light 4, orientation 5, steps 6, gesture 7, device motion 8, 9 and 10): the default publishes only accelerometer and orientation; `0` publishes all.	MappleSPU.cpp
`mp_spu_prox`	(on)	`0`: leave proximity out (bit 3 of `mp_spu_off`).	MappleSPU.cpp
`mp_stride_cm`	70	stride length in centimetres for the step counter’s distance.	MappleSPU.cpp

Wi-Fi, Bluetooth

Argument	Default	What it does	Read in	Old name
`mp_wifi`	1	`0`: do not reserve the Wi-Fi window at boot (`wifi on` may then fail later).	MT6631WiFi.cpp	`vivawifi`
`mp_wifi_emi`	none	physical address of the Wi-Fi window, 64 KiB aligned and inside a memory hole (on spaced `0xbf000000`).	MT6631WiFi.cpp
`mp_wlan`	1	`0`: no WLAN layer for iOS.	MT6631WLAN.cpp	`vivawlan`
`mp_wifi_steps`	0	how far Wi-Fi may go: `1` detect, `2` on and off (rails, power domain, RAM patches), `3` firmware and capabilities, `4` init, up, scan (and power from Settings), `5` join, leave (and joins from Settings).	mt6631_wifi.c
`mp_wifi_rx`	6	bit 0: status words read after the line is cleaned and invalidated; bit 1: log every resync skip; bit 2: RX entries returned to the DMA four at a time.	mt6631_wifi.c
`mp_bt_steps`	0	`1` Bluetooth on and the six HCI commands, nothing shown to iOS; `2` the registry service, nodes and bridge, started at boot.	mtk_bt.c

Audio, haptics, torch, camera

mp_bootrec=0 (safe boot) makes the four step arguments default to 0.

Argument	Default	What it does	Read in
`mp_audio_steps`	5 (0 on a safe boot)	`0` status; `1` clocks and the codec up, then down; `2` line-out and a 1 kHz tone; `3` the amplifier on, the tone through the guard; `4` iOS plays through the guard; `5` the microphone too.	mtk_audio.c
`mp_audio_below`	160	how far under Android’s level the speaker stays, in 1/8 dB (160 = 20 dB), at most 90 dB.	mtk_audio.c
`mp_audio_gain`	0	the guard’s gain, at most 12 dB.	mtk_audio.c
`mp_audio_secs`	5	seconds steps 1 to 3 hold.	mtk_audio.c
`mp_vib_steps`	2 (0 on a safe boot)	`0` status; `1` one 100 ms buzz at Android’s voltage; `2` iOS’s haptics run the motor.	mtk_audio.c
`mp_torch_steps`	1 (0 on a safe boot)	`0` status, read only; `1` the torch at levels 1 to 3, with its heat and fault limits.	mtk_torch.c
`mp_cam_steps`	0 (0 on a safe boot)	`0` nothing; `1` step 0, read only (the pins, the LDO chip, the SoC side); `2` also step 1, taken only on the link’s `cam power`: the main sensor powered up in realme’s sequence, its chip ID read, all off again. More than 2 is taken as 2.	mtk_cam.c

Battery and charger

The first four apply to the TI gauge and Silergy charger driver, which needs a battery node in the ADT; spaced’s ADT has none, and its gauge is mp_gauge.

Argument	Default	What it does	Read in	Old name
`mp_gauge`	0	`1` the realme 8i’s gauge, published as the battery; `2` also every reading in the log, every 2 s instead of 10; `3` the percentage from the voltage alone.	mt6358_gauge.c	`mtkbatt`
`mp_battery`	1	`0`: leave the static power source.	BQ27Z561Battery.cpp	`vivabattery`
`mp_charge`	1	`0`: never write the charger; `1`: keep it at the gauge’s request.	BQ27Z561Battery.cpp	`vivacharge`
`mp_charge_input`	2000	mA input limit with a wall charger; `0` never sets it; clamped to 500 to 3000.	BQ27Z561Battery.cpp	`vivachargein`
`mp_charge_limit`	100	percent at which charging stops (back on 5 below); clamped to 50 to 100.	BQ27Z561Battery.cpp	`vivachargelimit`
`mp_lpm_duty`	10	percent of a CPU panel copies get in Low Power Mode, clamped to 1 to 100.	BQ27Z561Battery.cpp	`vivalpmduty`
`mp_poweroff`	0 (and 0 on a safe boot)	`1`: Power off has the PMIC cut the power; otherwise, and when that fails, it restarts through the watchdog’s software reset.	MapplePlatformExpert.cpp

Security and compatibility

Argument	Default	What it does	Read in
`mp_sbx_container`	1	`0`: the sandbox’s container-path call fails with ENOENT again.	amfi_stub.c
`mp_sbx_ext`	1	`0`: the sandbox’s extension calls fail with ENOENT.	amfi_stub.c
`mp_inject`	0	`1`: the tweak loader for programs inside an `.app` (the Mapple app’s jailbreak switch).	amfi_stub.c, kern_exec.c
`mp_inject_debugged`	0	`1` with `mp_inject=1`: a process the tweak loader went into is marked debugged.	amfi_stub.c

Source: bsd/dev/, bsd/kern/, iokit/Kernel/ and osfmk/ of the kernel at dcb77a0; osfmk/arm64/ and iokit/Kernel/arm/ of the MT6781 layer at 426b4f6; mtk/loader/ and shim/ of mapple_loader at 415612e. Defaults and clamps are the code’s.

Applies to realme 8i (spaced), release 1 · Updated 15 November 2026