diff --git a/sys/dev/cpuctl/cpuctl.c b/sys/dev/cpuctl/cpuctl.c
--- a/sys/dev/cpuctl/cpuctl.c
+++ b/sys/dev/cpuctl/cpuctl.c
@@ -344,7 +344,7 @@
 
 	d = arg;
 	if (PCPU_GET(cpuid) == d->cpu)
-		d->ret = ucode_intel_load(d->ptr, true, NULL, NULL);
+		d->ret = ucode_intel_load(d->ptr, SAFE, NULL, NULL);
 }
 
 static int
diff --git a/sys/x86/include/ucode.h b/sys/x86/include/ucode.h
--- a/sys/x86/include/ucode.h
+++ b/sys/x86/include/ucode.h
@@ -62,12 +62,14 @@
 	} entries[0];
 };
 
+typedef enum { SAFE, UNSAFE, EARLY } ucode_load_how;
+
 const void *ucode_amd_find(const char *path, uint32_t signature,
 	    uint32_t *revision, const uint8_t *fw_data, size_t fw_size,
 	    size_t *selected_sizep);
-int	ucode_intel_load(const void *data, bool unsafe,
+int	ucode_intel_load(const void *data, ucode_load_how unsafe,
 	    uint64_t *nrevp, uint64_t *orevp);
-int	ucode_amd_load(const void *data, bool unsafe,
+int	ucode_amd_load(const void *data, ucode_load_how how,
 	    uint64_t *nrevp, uint64_t *orevp);
 size_t	ucode_load_bsp(uintptr_t free);
 void	ucode_load_ap(int cpu);
diff --git a/sys/x86/x86/ucode.c b/sys/x86/x86/ucode.c
--- a/sys/x86/x86/ucode.c
+++ b/sys/x86/x86/ucode.c
@@ -40,6 +40,7 @@
 
 #include <machine/atomic.h>
 #include <machine/cpufunc.h>
+#include <machine/md_var.h>
 #include <x86/specialreg.h>
 #include <x86/ucode.h>
 #include <x86/x86_smp.h>
@@ -58,7 +59,7 @@
 
 static struct ucode_ops {
 	const char *vendor;
-	int (*load)(const void *, bool, uint64_t *, uint64_t *);
+	int (*load)(const void *, ucode_load_how how, uint64_t *, uint64_t *);
 	const void *(*match)(const uint8_t *, size_t *);
 } loaders[] = {
 	{
@@ -83,6 +84,7 @@
 	NO_ERROR,
 	NO_MATCH,
 	VERIFICATION_FAILED,
+	LOAD_FAILED,
 } ucode_error = NO_ERROR;
 static uint64_t ucode_nrev, ucode_orev;
 
@@ -103,6 +105,9 @@
 	case VERIFICATION_FAILED:
 		printf("CPU microcode: microcode verification failed\n");
 		break;
+	case	LOAD_FAILED:
+		printf("CPU microcode: load failed. BIOS updated advised\n");
+		break;
 	default:
 		break;
 	}
@@ -110,7 +115,8 @@
 SYSINIT(ucode_log, SI_SUB_CPU, SI_ORDER_FIRST, log_msg, NULL);
 
 int
-ucode_intel_load(const void *data, bool unsafe, uint64_t *nrevp, uint64_t *orevp)
+ucode_intel_load(const void *data, ucode_load_how how, uint64_t *nrevp,
+    uint64_t *orevp)
 {
 	uint64_t nrev, orev;
 	uint32_t cpuid[4];
@@ -122,10 +128,15 @@
 	 * undocumented errata applying to some Broadwell CPUs.
 	 */
 	wbinvd();
-	if (unsafe)
+	switch (how) {
+	case UNSAFE:
+	case EARLY:
 		wrmsr_safe(MSR_BIOS_UPDT_TRIG, (uint64_t)(uintptr_t)data);
-	else
+		break;
+	case SAFE:
 		wrmsr(MSR_BIOS_UPDT_TRIG, (uint64_t)(uintptr_t)data);
+		break;
+	}
 	wrmsr(MSR_BIOS_SIGN, 0);
 
 	/*
@@ -233,20 +244,29 @@
 }
 
 int
-ucode_amd_load(const void *data, bool unsafe, uint64_t *nrevp, uint64_t *orevp)
+ucode_amd_load(const void *data, ucode_load_how how, uint64_t *nrevp,
+    uint64_t *orevp)
 {
 	uint64_t nrev, orev;
 	uint32_t cpuid[4];
 
 	orev = rdmsr(MSR_BIOS_SIGN);
 
-	/*
-	 * Perform update.
-	 */
-	if (unsafe)
+	switch (how) {
+	case SAFE:
 		wrmsr_safe(MSR_K8_UCODE_UPDATE, (uint64_t)(uintptr_t)data);
-	else
+		break;
+	case UNSAFE:
 		wrmsr(MSR_K8_UCODE_UPDATE, (uint64_t)(uintptr_t)data);
+		break;
+	case EARLY:
+		wrmsr_early_safe_start();
+		if (wrmsr_early_safe(MSR_K8_UCODE_UPDATE,
+		    (uint64_t)(uintptr_t)data) != 0)
+			ucode_error = LOAD_FAILED;
+		wrmsr_early_safe_end();
+		break;
+	}
 
 	/*
 	 * Serialize instruction flow.
@@ -327,8 +347,8 @@
 		return;
 #endif
 
-	if (ucode_data != NULL)
-		(void)ucode_loader->load(ucode_data, false, NULL, NULL);
+	if (ucode_data != NULL && ucode_error != LOAD_FAILED)
+		(void)ucode_loader->load(ucode_data, UNSAFE, NULL, NULL);
 }
 
 static void *
@@ -415,7 +435,7 @@
 			memcpy_early(addr, match, len);
 			match = addr;
 
-			error = ucode_loader->load(match, false, &nrev, &orev);
+			error = ucode_loader->load(match, EARLY, &nrev, &orev);
 			if (error == 0) {
 				ucode_data = early_ucode_data = match;
 				ucode_nrev = nrev;