Kernel self-patching

The Linux kernel rewrites its own text segment at boot to specialize a generic binary for the specific machine it landed on. Three mechanisms cooperate, each addressing a different cost:

jump_label — feature flags for free

A static_branch_unlikely(&some_key) looks like if (some_flag) in source, but the compiler emits a NOP (or a JMP) at that site and registers a patch entry. jump_label_init() walks the registered table at boot and rewrites every site according to whether the key is currently enabled.

A disabled feature costs zero CPU cycles in hot paths — no register read, no branch predictor entry, no cache miss. Switching the flag re-patches every site. The kernel uses this for tracing hooks, perf events, debug instrumentation, and anything else that wants to be invisible when off.

static_call — direct calls instead of indirect

static_call(func)(args) looks like an indirect call but gets patched at boot into a direct call to the currently-bound function. Faster than a function pointer, no Spectre/Meltdown speculative-execution concern. Scheduler dispatch, KVM, tracepoints all use it.

alternative_instructions — per-CPU instruction selection

The boldest of the three. The kernel ships with ALTERNATIVE macro sites that describe two (or more) variants of the same code — for example, an AVX-512 memcpy and a fallback. alternative_instructions() runs in Phase 4 after CPUID has discovered the actual feature set, then patches every ALTERNATIVE site to keep only the variant that fits this CPU.

The same vmlinux Debian ships boots optimally on every x86_64 chip Debian supports: the boot-time patching produces a binary tailored to AVX-512 on a Zen 5, to plain SSE on a 15-year-old Atom, to the Spectre-mitigation flavor the chip needs, all from one source.

Why three separate mechanisms

They patch the same address space but solve different problems:

jump_label and static_call can be flipped at runtime. alternative_instructions runs once at boot — once you've discarded the AVX-512 path on a chip that doesn't have it, you can't get it back without rebooting.

Prerequisites

Self-patching needs poking_init() (the machinery that lets the kernel safely rewrite its own code despite rodata and W^X), which is why mm_core_init() brings it up early. And it needs to happen before mark_readonly() in Phase 6 — once rodata is locked at the page-table level, the patching window closes.

Cross-references

• linux-kernel-startup — where these three mechanisms run in the boot sequence
• linux-boot-phases — the "lock the doors last" rule that depends on patching happening first