diff --git a/sys/x86/acpica/madt.c b/sys/x86/acpica/madt.c
--- a/sys/x86/acpica/madt.c
+++ b/sys/x86/acpica/madt.c
@@ -196,6 +196,10 @@
 	return (NULL);
 }
 
+static int user_x2apic;
+SYSCTL_INT(_hw, OID_AUTO, x2apic_enable, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &user_x2apic, 0, "Enable x2APIC");
+
 /*
  * Initialize the local APIC on the BSP.
  */
@@ -203,7 +207,6 @@
 madt_setup_local(void)
 {
 	const char *reason;
-	int user_x2apic;
 	bool bios_x2apic;
 
 	if ((cpu_feature2 & CPUID2_X2APIC) != 0) {
diff --git a/sys/x86/iommu/intel_dmar.h b/sys/x86/iommu/intel_dmar.h
--- a/sys/x86/iommu/intel_dmar.h
+++ b/sys/x86/iommu/intel_dmar.h
@@ -35,6 +35,8 @@
 
 struct dmar_unit;
 
+SYSCTL_DECL(_hw_dmar);
+
 /*
  * Locking annotations:
  * (u) - Protected by iommu unit lock
diff --git a/sys/x86/iommu/intel_drv.c b/sys/x86/iommu/intel_drv.c
--- a/sys/x86/iommu/intel_drv.c
+++ b/sys/x86/iommu/intel_drv.c
@@ -81,6 +81,8 @@
 #define	DMAR_QI_IRQ_RID		1
 #define	DMAR_REG_RID		2
 
+SYSCTL_NODE(_hw, OID_AUTO, dmar, CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, NULL);
+
 static device_t *dmar_devs;
 static int dmar_devcnt;
 
@@ -158,6 +160,9 @@
 }
 
 static int dmar_enable = 0;
+SYSCTL_INT(_hw_dmar, OID_AUTO, enable, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &dmar_enable, 0, "Enable DMA remapping reporting");
+
 static void
 dmar_identify(driver_t *driver, device_t parent)
 {
@@ -396,13 +401,18 @@
 	    DMAR_ECAP_IRO(unit->hw_ecap));
 }
 
+static int disable_pmr;
+static SYSCTL_NODE(_hw_dmar, OID_AUTO, pmr, CTLFLAG_RD | CTLFLAG_MPSAFE,
+    NULL, NULL);
+SYSCTL_INT(_hw_dmar_pmr, OID_AUTO, disable, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &disable_pmr, 0, "Disable protected memory regions");
+
 static int
 dmar_attach(device_t dev)
 {
 	struct dmar_unit *unit;
 	ACPI_DMAR_HARDWARE_UNIT *dmaru;
 	uint64_t timeout;
-	int disable_pmr;
 	int i, error;
 
 	unit = device_get_softc(dev);
@@ -527,7 +537,6 @@
 		return (error);
 	}
 
-	disable_pmr = 0;
 	TUNABLE_INT_FETCH("hw.dmar.pmr.disable", &disable_pmr);
 	if (disable_pmr) {
 		error = dmar_disable_protected_regions(unit);
diff --git a/sys/x86/iommu/intel_fault.c b/sys/x86/iommu/intel_fault.c
--- a/sys/x86/iommu/intel_fault.c
+++ b/sys/x86/iommu/intel_fault.c
@@ -257,15 +257,19 @@
 	dmar_write4(unit, DMAR_FSTS_REG, fsts);
 }
 
+static int fault_log_size = 256; /* 128 fault log entries */
+SYSCTL_INT(_hw_dmar, OID_AUTO, fault_log_size, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &fault_log_size, 0, "DMAR fault log size (must be even)");
+
 int
 dmar_init_fault_log(struct dmar_unit *unit)
 {
 
 	mtx_init(&unit->fault_lock, "dmarflt", NULL, MTX_SPIN);
-	unit->fault_log_size = 256; /* 128 fault log entries */
-	TUNABLE_INT_FETCH("hw.dmar.fault_log_size", &unit->fault_log_size);
-	if (unit->fault_log_size % 2 != 0)
+	TUNABLE_INT_FETCH("hw.dmar.fault_log_size", &fault_log_size);
+	if (fault_log_size % 2 != 0)
 		panic("hw.dmar_fault_log_size must be even");
+	unit->fault_log_size = fault_log_size;
 	unit->fault_log = malloc(sizeof(uint64_t) * unit->fault_log_size,
 	    M_DEVBUF, M_WAITOK | M_ZERO);
 
diff --git a/sys/x86/iommu/intel_intrmap.c b/sys/x86/iommu/intel_intrmap.c
--- a/sys/x86/iommu/intel_intrmap.c
+++ b/sys/x86/iommu/intel_intrmap.c
@@ -322,23 +322,28 @@
 	return (powerof2(v) ? v : 1 << fls(v));
 }
 
+static int ir_enabled = 0;
+SYSCTL_INT(_hw_dmar, OID_AUTO, ir, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &ir_enabled, 0, "Enable DMAR IR");
+
 int
 dmar_init_irt(struct dmar_unit *unit)
 {
 
 	if ((unit->hw_ecap & DMAR_ECAP_IR) == 0)
 		return (0);
-	unit->ir_enabled = 1;
-	TUNABLE_INT_FETCH("hw.dmar.ir", &unit->ir_enabled);
-	if (!unit->ir_enabled)
+	ir_enabled = 1;
+	TUNABLE_INT_FETCH("hw.dmar.ir", &ir_enabled);
+	if (!ir_enabled)
 		return (0);
 	if (!unit->qi_enabled) {
-		unit->ir_enabled = 0;
+		ir_enabled = 0;
 		if (bootverbose)
 			device_printf(unit->dev,
 	     "QI disabled, disabling interrupt remapping\n");
 		return (0);
 	}
+	unit->ir_enabled = ir_enabled;
 	unit->irte_cnt = clp2(num_io_irqs);
 	unit->irt = kmem_alloc_contig(unit->irte_cnt * sizeof(dmar_irte_t),
 	    M_ZERO | M_WAITOK, 0, dmar_high, PAGE_SIZE, 0,
diff --git a/sys/x86/iommu/intel_qi.c b/sys/x86/iommu/intel_qi.c
--- a/sys/x86/iommu/intel_qi.c
+++ b/sys/x86/iommu/intel_qi.c
@@ -467,19 +467,27 @@
 	}
 }
 
+static int qi_enabled;
+SYSCTL_INT(_hw_dmar, OID_AUTO, qi, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &qi_enabled, 0, "Enable queued invalidation interface");
+
+static int qi_sz;
+SYSCTL_INT(_hw_dmar, OID_AUTO, qi_size, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &qi_sz, 0, "Invalidation queue size");
+
 int
 dmar_init_qi(struct dmar_unit *unit)
 {
 	uint64_t iqa;
 	uint32_t ics;
-	int qi_sz;
 
 	if (!DMAR_HAS_QI(unit) || (unit->hw_cap & DMAR_CAP_CM) != 0)
 		return (0);
-	unit->qi_enabled = 1;
-	TUNABLE_INT_FETCH("hw.dmar.qi", &unit->qi_enabled);
-	if (!unit->qi_enabled)
+	qi_enabled = 1;
+	TUNABLE_INT_FETCH("hw.dmar.qi", &qi_enabled);
+	if (!qi_enabled)
 		return (0);
+	unit->qi_enabled = qi_enabled;
 
 	unit->tlb_flush_head = unit->tlb_flush_tail =
             iommu_gas_alloc_entry(NULL, 0);
diff --git a/sys/x86/pci/qpi.c b/sys/x86/pci/qpi.c
--- a/sys/x86/pci/qpi.c
+++ b/sys/x86/pci/qpi.c
@@ -42,6 +42,7 @@
 #include <sys/module.h>
 #include <sys/rman.h>
 #include <sys/systm.h>
+#include <sys/sysctl.h>
 
 #include <machine/cputypes.h>
 #include <machine/md_var.h>
@@ -60,10 +61,13 @@
 
 static MALLOC_DEFINE(M_QPI, "qpidrv", "qpi system device");
 
+static int do_qpi;
+SYSCTL_INT(_hw, OID_AUTO, attach_intel_csr_pci, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &do_qpi, 0, NULL);
+
 static void
 qpi_identify(driver_t *driver, device_t parent)
 {
-	int do_qpi;
 
 	/* Check CPUID to ensure this is an i7 CPU of some sort. */
 	if (cpu_vendor_id != CPU_VENDOR_INTEL ||
@@ -71,7 +75,6 @@
 		return;
 
 	/* Only discover buses with configuration devices if allowed by user */
-	do_qpi = 0;
 	TUNABLE_INT_FETCH("hw.attach_intel_csr_pci", &do_qpi);
 	if (!do_qpi)
 		return;
diff --git a/sys/x86/x86/identcpu.c b/sys/x86/x86/identcpu.c
--- a/sys/x86/x86/identcpu.c
+++ b/sys/x86/x86/identcpu.c
@@ -1518,10 +1518,14 @@
 	cpu_feature2 = regs[2];
 }
 
+static u_int cpu_stdext_disable;
+SYSCTL_UINT(_hw, OID_AUTO, cpu_stdext_disable, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
+    &cpu_stdext_disable, 0, "CPU extended features to be disabled");
+
 void
 identify_cpu2(void)
 {
-	u_int regs[4], cpu_stdext_disable;
+	u_int regs[4];
 
 	if (cpu_high >= 6) {
 		cpuid_count(6, 0, regs);
@@ -1541,7 +1545,6 @@
 		 * extensions, activation of which requires setting a
 		 * bit in CR4, and which VM monitors do not support.
 		 */
-		cpu_stdext_disable = 0;
 		TUNABLE_INT_FETCH("hw.cpu_stdext_disable", &cpu_stdext_disable);
 		cpu_stdext_feature &= ~cpu_stdext_disable;