Comprehensive list of kernel self-modifications?

[Yan <rottled@gmail.com>]

Hello,

I have been working on verifying kernel integrity and am trying to
differentiate
between vmlinux image on disk and the kernel loaded into memory. I understand
 that the kernel modifies itself (on x86 at least) during at least a few points:


1. It applies alternative instructions with apply_alternatives() from
check_bugs().
    The locations of all alternatives are found between __alt_instructions and
    __alt_instructions__end.
2. It also applies what looks to be relocation. I see the list of
reloc addresses at
    the end of vmlinux image and it appears that relocate_kernel in
relocate_kernel.S
    applies the relocations. I can't tell how it knows where the list
of addresses that
    need relocations is found. Nothing that I found points to that
area, and the on-
    disk data seems to live what gets mapped to as BSS when its running.
3. After manual inspection of all the relocs and alternatives, theres
still about 120
    bytes different. The data looks like groups of 3bytes+address tuples.

Most of this was found via trial and error, so I'm sure there are
other cases of
self-modification. Can anyone point me to a comprehensive list of everywhere
that a kernel can change its own text? Or if anyone knows off the top of their
head, that would be helpful too.

P.S. Please CC to me as I am not subscribed to the list.


Thank you in advance,
Yan