Any user mode code runs before invoking default entry point of ELF?

Question

Many documents say program entry point (_start as default) does initialization like prepare command line, etc. How is the control been past to _start and any user-mode code was run before this for the new process?

Answer 1

How is the control been past to _start and any user-mode code was run before this for the new process?

There are two cases to consider: a fully static, and a dynamically linked executable.

In the fully static case, the instruction at _start is very first user-mode instruction that is executed, i.e. the process is born with instruction pointer set at that instruction by the kernel.

In the dynamically linked case, the picture is much more complicated, and there are 1000s of user-mode instructions that run long before _start: the dynamic linker initializes itself, mmaps all required shared libraries, initializes them, and only then passes control to _start.

On glibc-based systems, you can observe this by running e.g.

LD_DEBUG=files /bin/date

See also this answer.