The Linux kernel is riddled with optional features: tracepoints, KASAN checks, cgroup accounting, scheduler stats. Each is guarded by a runtime flag. A naive if (feature_enabled) costs a load, a compare, and a branch on every call — cheap alone, but tracepoints alone appear millions of times per second across the kernel. The kernel's answer: static keys, built on jump labels, which patch the kernel's own text at runtime so a disabled feature compiles down to literally nothing.

The trick is runtime code patching. A static key defines a branch site. The compiler emits either a 5-byte NOP or a 5-byte JMP to the slow path. When you toggle the key, the kernel walks a table of every branch site tied to it and rewrites the instructions in place, using text_poke() — which handles the cache-coherence dance (stop_machine or INT3 breakpoint trick to catch any CPU mid-execution) so no core sees a half-written instruction.

• Fast path (disabled): a 5-byte NOP. Zero branch predictor pressure, zero memory load, no I-cache pollution beyond the NOP itself.
• Slow path (enabled): an unconditional JMP to out-of-line code that does the actual work. The branch predictor learns it as always-taken.

Real-world example: every kernel tracepoint uses this. trace_sched_switch() is called on every context switch — millions per second on a busy server. With tracing off, the site is a NOP: the CPU literally does not know a hook exists. Turn on perf trace, and the kernel patches every tracepoint site live, without a reboot, without a recompile, without stopping your workload. Ftrace, KASAN, memcg accounting, and even Meltdown's KPTI toggle all use the same machinery.

The API: DEFINE_STATIC_KEY_FALSE(my_key) declares one defaulting off; static_branch_unlikely(&my_key) is the branch site; static_branch_enable(&my_key) patches every site enabled at once.

Rule of thumb: use a static key when the check runs more than ~1000 times per second and flips less than once per second. The patching itself is expensive — it can require an IPI to every core and an I-cache flush — but amortized over billions of executions, the cost is invisible. Below that ratio, a plain READ_ONCE(flag) is simpler and fast enough.

You can inspect them: /sys/kernel/debug/tracing/events/*/enable flips real static keys under the hood.