Index: head/sysutils/cpupdate/distinfo
===================================================================
--- head/sysutils/cpupdate/distinfo	(revision 466702)
+++ head/sysutils/cpupdate/distinfo	(revision 466703)
@@ -1,7 +1,7 @@
-TIMESTAMP = 1522754487
+TIMESTAMP = 1523034276
 SHA256 (microcode-20180312.tgz) = 0b381face2df1b0a829dc4fa8fa93f47f39e11b1c9c22ebd44f8614657c1e779
 SIZE (microcode-20180312.tgz) = 3789662
 SHA256 (kernschmelze-cpupdate-g20180323-7633a43_GH0.tar.gz) = b6a595223b7e70fbdf170b51d6aee4d907b36e080c18d076b6a17ae16bd63d28
 SIZE (kernschmelze-cpupdate-g20180323-7633a43_GH0.tar.gz) = 4566592
-SHA256 (platomav-CPUMicrocodes-8f56a62_GH0.tar.gz) = bb65515816b7c255b8b3f0d052c2d63e4cc244723d2c81b5a5e3c504ad80886b
-SIZE (platomav-CPUMicrocodes-8f56a62_GH0.tar.gz) = 4602379
+SHA256 (platomav-CPUMicrocodes-079248c_GH0.tar.gz) = 89c875f5467409af543b83abe069a00bc29a7933a64a30450a5b06ab0cfa0c7c
+SIZE (platomav-CPUMicrocodes-079248c_GH0.tar.gz) = 4602296
Index: head/sysutils/cpupdate/files/cpupdate.in
===================================================================
--- head/sysutils/cpupdate/files/cpupdate.in	(revision 466702)
+++ head/sysutils/cpupdate/files/cpupdate.in	(revision 466703)
@@ -1,29 +1,39 @@
 #!/bin/sh
 
 # $FreeBSD$
 #
 # PROVIDE: cpupdate
 # REQUIRE: FILESYSTEMS kldxref
 # BEFORE:  netif
 # KEYWORD: nojail
 
 # Add these lines to /etc/rc.conf.local or /etc/rc.conf
 # to enable this service:
 #
 # cpupdate_enable (bool):		Set to NO by default.
 #					Set it to YES to enable cpupdate.
+# cpupdate_irbs_enable (bool):		Enable Indirect Branch Restricted
+#					Speculation after start of cpupdate.
+#					Default is YES.
 # cpupdate_flags (string):		Command line flags for cpupdate.
 #					Default is "-w -u".
 
 . /etc/rc.subr
 
 name=cpupdate
 rcvar=cpupdate_enable
+start_postcmd="cpupdate_poststart"
 
 load_rc_config $name
 
 : ${cpupdate_enable:="NO"}
 : ${cpupdate_flags="-w -u"}
+: ${cpupdate_irbs_enable="YES"}
 command=%%PREFIX%%/sbin/${name}
+
+cpupdate_poststart() {
+  checkyesno cpupdate_irbs_enable && sysctl -i hw.ibrs_disable=0
+  return 0
+}
 
 run_rc_command "$1"