How does the Linux kernel determine ld.so's load address? -

i know dynamic linker uses mmap() load libraries. guess kernel loads both executable , .interpreter same address space, how determine where? noticed ld.so's load address aslr disabled 0x555555554000 (on x86_64) — address come from? tried following do_execve()'s code path, ramified me not confused hell.

read more elf, in particular elf(5), , execve(2) syscall.

an elf file may contain interpreter. elf(5) mentions:

pt_interp array element specifies location , size of null-terminated pathname invoke interpreter. segment type meaningful executable files (though may occur shared objects). may not occur more once in file. if present, must precede loadable segment entry.

that interpreter practically ld-linux(8) (e.g. gnu glibc), more precisely (on debian/sid) /lib64/ld-linux-x86-64.so.2. if compile musl-libc build software you'll different interpreter, /lib/ld-musl-x86_64.so.1. elf interpreter dynamic linker.

the execve(2) syscall using interpreter:

if executable dynamically linked elf executable, interpreter named in pt_interp segment used load needed shared libraries. interpreter typically /lib/ld-linux.so.2 binaries linked glibc.

see levine's book on linkers , loaders, , drepper's paper: how write shared libraries

notice execve handling shebang (i.e. first line starting #!); see interpreter scripts section of execve(2). btw, elf binaries, execve doing equivalent of mmap(2) on segments.

read vdso(7), proc(5) & aslr. type cat /proc/self/maps in shell.

^{(i guess, not sure, 0x555555554000 address in elf program header of executable, or perhaps of ld-linux.so; might come kernel, since 0x55555555 seems appear in kernel source code)}