Answer by kenorb for Is there a list of available boot-args for darwin / OS X

There is no official list, the common one are compiled into kernel it-self, other can be parsed by kernel extensions. Here is the list which I've found so far.

General boot options:

• -v: Always boot the system in Verbose mode without needing to hold CMD-V at startup.
• -x: Always boot system into Safe Mode without needing to hold Shift at startup.
• f: Old Safe Mode.
• -s: Boot the system into Single User mode without needing to hold CMD-S at startup.
• -F - Ignore Boot File.

• iog (e.g. iog=0x0)

  This reverses the "Clamshell" mode for Apple's laptop systems, where when you close the display but connect the system to an external monitor and keyboard the system will stay awake. After running this command, when connecting an external monitor, the internal display will be disabled, which can be beneficial in some situations such as those where you are mirroring your desktop but wish to run the external display at a higher resolution than your laptop can run.^CNET

• arch

  Changes how the system boots, either to the 32-bit (i386) or 64-bit (x86_64) kernel. Note that third-party kernel extensions might be 32-bit or 64-bit only.

• Graphics Mode: VESA Graphics Mode Dimensions.

• Text Mode: VGA Text Mode Dimensions.
• Boot Graphics: Graphics or Text Mode.
• Quiet Boot: Quiet Bootmode.
• MKext Cache: Mkext cache file.
• Kernel Cache: Kernel Cache file.
• rd: Root Device.
• boot-uuid: Boot UUID.
• platform: Platform Expert {ACPI}.

• config: Load alternate config plist (e.g. config=foobar will load /Library/Preferences/SystemConfiguration/foobar.plist instead of com.apple.Boot.plist)^x86osx.

• serverperfmode=1

  On OS X El Capitan 10.11 and later, this enables the performance mode to dedicate additional system resources for server applications.

DTrace:

• dtrace_dof_mode: Set DTrace DOF modes {0/1/2/3}.
• DisableFBT: Disable FBT {1}.
• IgnoreFBTBlacklist: Ignore blacklist of certain critical modules {1}.

BSD:

• -b: Don't run /etc/rc.boot.
• -l: Memory leaks logging (osfmk/kern/startup.c).
• srv: Boot as server {1}.
• ncl: Number of clusters.
• nbuf: Number of buffers for BSD.
• kmem: Kernel memory access {1}.
• trace: Kernel trace buffer size.
• msgbuf: Message Buffer.
• rp: Root path.
• mcache_flags: Memory cache flags.
• mbuf_debug: MBuf Debug {1}.
• initmcl: Init mbuf clusters.
• socket_debug: Socket debug (net).
• net_affinity: Net Affinity (net).
• rte_debug: Route debug (net) {flags}.
• -rwroot_hack: Mount root read/write.

IOKit:

• mseg: Max segment.
• dart: Remove mapper present.
• io: IO Kit Debug.

Mach:

• keepsyms: Do not unload KLD/Address-symbol translation {1}.

• debug: Kernel debug {flags} (e.g. debug=0x14e).

  Enables kernel debugging features that will show you extra information. E.g.

  • 0x01 - Stop at boot time and wait for the debugger to attach
  • 0x02 - Send kernel debugging output to the console
  • 0x04 - Drop into debugger on a nonmaskable interrupt
  • 0x08 - Send kernel debugging information to a serial port
  • 0x10 - Make ddb the default debugger
  • 0x20 - Output diagnostics information to the system log
  • 0x40 - Allow the debugger to ARP and route
  • 0x80 - Support old versions of gdb on newer systems
  • 0x100 - Disable the graphical panic dialog screen

• nvram_paniclog: commit paniclog to NVRAM {1}.

• pmsafe_debug: Put CPUs into "safe" power mode {1}.
• preempt: Set default preemption rate.
• unsafe: Max unsafe quanta.
• poll: Max poll quanta.
• yield: Schedule poll yield shift.
• idlehalt: Halt idle thread to allow cpu into lowpower mode {1}.
• panic_io_port: In a panic read from this I/O port {0x0 to 0xffff}.
• _fpu: Limit boot-time cpu features {387/mmx/sse}.
• disable high mem/2: prefer high mem}.
• immediate_NMI: Force immediate NMI debugger {1}.
• -legacy: Force legacy 32bit mode.
• lcks: Lock statistics.
• novmx: No altivec emulation in Rosetta {1}.
• max_valid_dma_addr: Max valid DMA address.
• maxbouncepool: Max bounce pool size.
• maxloreserve: Max low reserve.
• npvhash: Physical to virtual mapping hash.
• wpkernel: Write protect kernel {1}.
• -no_shared_cr3: Disable shared kernel address space for 64 bit users.
• -pmap_trace: Enable kernel traces for pmap.
• _panicd_ip: IP of panic server.
• _router_ip: IP of router.
• panicd_port: Port of panic server.
• -zc: Free zone element checking.
• mtxspin: Mutex spin (ppc).
• vmmforce: VMM force (ppc).
• fn: Force nap (ppc) (acpi) {0/1/2}.
• pmsx: Experimental power management stepper mode (ppc) {1}.
• ctrc: Set tracing to specific cpu (ppc).
• tb: Non-default trace buffer size (ppc).
• wcte: Write combine timer enable (ppc).
• mcklog: Clear machine check flag (ppc).
• mcksoft: Machine check software recovery (ppc).
• ht_shift: Non-default hash table size (ppc) {1}.
• zsize: Target zone size.
• colors: Set VM colors.
• fill: Fill pages.
• serialbaud: Set serial baud rate.

Boot options from xnu/osfmk/i386/i386_init.c:

• diag: Diagnostic output.

• serial: Serial diagnostic console. Support for a serial keyboard and/or console.

• maxmem

  Maximum memory to use. It limits the addressable memory to the specified amount (e.g. maxmem=32).

• cpus=1

  Limits the number of active processors in the system to the set level. This might help preserve power, not likely useful for much else unless you are testing and programming.

• himemory_mode

  It is used to debug large physical memory configurations for over 4GB systems. Modes: 0 - all pages available, 1 - disable high mem, 2 - prefer high mem.

• immediate_NMI

  Debug support for over 4GB systems by forcing immediate NMI debugger.

• urgency_notification_abstime

Other:

• bluetoothHostControllerSwitchBehavior (never/always)

  Tell Bluetooth driver whether to switch to the dongle that you plugged in. To make the external dongle the default even after reboot, use always.

• smbios: Verbose SMBIOS (AppleSMBIOS.kext) {1}

• acpi: Debug AppleACPIPlatform {1-8}
• acpi_level: ACPI Debug Level
• acpi_layer: ACPI Debug Layer
• acpi_sleep: ACPI Sleep
• nvdebug: NVDAResman debug
• nvrm: NVDAResman
• ndrv_debug_level: NDRV Debug Level (NVDAResman)
• pstep: Power Step Debug (ACPI_SMC)
• hpet: AppleHPET
• busratio (e.g. busratio=20): It used i7 cpu in 10.5.6, after 10.5.7 it does not need^x86osx.

Source: xnu-1228 / Boot Arguments

Usage

For example when you're in Single Mode (CMD-S after the sound at startup), to run into safe mode and verbosely with extra kernel debugging output to the console, try:

sudo nvram boot-args="-x -v debug=0x14e"

To add the argument into existing (without overriding), try:

sudo nvram boot-args="-v $(nvram boot-args 2>/dev/null | cut -f 2-)"

To remove boot arguments, run:

sudo nvram boot-args=""sudo nvram -d boot-args

Other non-official parameters can be found in kernel binary it-self, e.g.

$ strings /System/Library/Kernels/kernel | grep -C7 maxmemkernel_early_bootstrapdiagserialSerial mode specified: %08XPE_init_printfversion_variant = %sversion         = %smaxmemhimemory_modehimemory_mode: %dimmediate_NMIurgency_notification_abstimei386_vm_initpower_management_initmachine_startup

Or check either in Apple source files or on GitHub by searching for PE_parse_boot_argn (which is used to parse the kernel boot arguments).