{
  "id": 6152600,
  "title": "What every kernel programmer should know about Jump Labels",
  "url": "https://urgent.news/2026/09/07/what-every-kernel-programmer-should-know-about-jump-labels",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-07T15:11:27.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://walac.github.io/jumplabels/"
  },
  "original_language": "en",
  "account": "Jump labels are a crucial concept for kernel programmers working with the Linux kernel. Jump labels, also known as static keys, allow patchable sites in the .text section to be modified while the kernel is running. This self-modifying code is executed by CPUs that were not designed with this capability in mind. To understand jump labels, it is necessary to comprehend the underlying hardware and instruction encoding mechanisms.\n\nOne of the key benefits of jump labels is their performance advantages over traditional conditional branching techniques. In a typical if (feature_enabled) check, the CPU must load the feature_enabled flag and evaluate the condition each time the branch is encountered. This can be costly, especially under cache pressure or when other CPUs modify the flag. In contrast, using a jump label allows an unconditional nop or jmp to bypass the entire branch prediction and load process, resulting in significant performance improvements.\n\nTo implement jump labels, the kernel must carefully consider the variable-length instruction set architecture (ISA) of the x86_64 architecture. The jump labels use specific instruction encodings, such as JMP8_INSN_*, JMP32_INSN_*, and INT3_INSN_*, along with nop instructions to create the desired effect. These encodings are defined in the text-patching.h and nops.h header files. The relative displacement of the jump label is measured from the byte after the instruction, allowing for precise in-place swapping of equal-length instructions.\n\nHowever, patching kernel text comes with challenges due to the concurrent execution of instructions by multiple CPUs. A store operation to patch a 5-byte instruction may be issued as multiple bus-width writes, which can be partially visible to other CPUs during the write sequence. This can lead to torn instruction fetches, where CPU B observes a mix of old and new bytes, resulting in an invalid instruction. To address this issue, the kernel employs a three-step process using the smp_text_poke_batch_finish() function, which temporarily adds a writable, non-executable mapping to the same physical page. This allows the patching CPU to make atomic and safe modifications without affecting other CPUs.\n\nIn modern kernels, jump labels have become a preferred method for patching kernel text due to their performance benefits and reduced risk of memory corruption. By understanding the underlying hardware, encoding mechanisms, and atomicity challenges, kernel programmers can effectively utilize jump labels to optimize and modify kernel code at runtime.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}