Comment 5 for bug 1386257

You will want the newer intel-microcode packages, then. This means a resync with Debian is highly advised.

Exactly due to the issue brought to the front by the Intel Haswell microcode update that disabled TSX, Debian has switched to enforcing that automated microcode updates be done only through the early initramfs. This, in fact, requires a reboot to apply the microcode update (just like a kernel update).

While I did blacklist the offending Haswell microcode updates in the Debian packages so that they will not be applied by accident using the late microcode driver (which results in an unusable system as described in #1370352), this kind of blacklisting is reactive, so the switch to early microcode updates is the only safe way forward right now.

Of course, it took ~10 years for the first Intel microcode update that had visible effects at the ISA level to show up, so it might be another 10 years before the next one...