diff --git a/configure b/configure
index b367224093369..b2ad199da7873 100755
--- a/configure
+++ b/configure
@@ -5,6 +5,7 @@ kerneldir=/lib/modules/$(uname -r)/build
 cc=gcc
 ld=ld
 objcopy=objcopy
+objdump=objdump
 ar=ar
 arch=`uname -m | sed -e s/i.86/i386/ | sed -e 's/arm.*/arm/'`
 host=$arch
@@ -132,6 +133,7 @@ PROCESSOR=$processor
 CC=$cross_prefix$cc
 LD=$cross_prefix$ld
 OBJCOPY=$cross_prefix$objcopy
+OBJDUMP=$cross_prefix$objdump
 AR=$cross_prefix$ar
 API=$api
 TEST_DIR=$testdir
diff --git a/powerpc/Makefile.common b/powerpc/Makefile.common
index de4d1ef3ac816..9654bce1752eb 100644
--- a/powerpc/Makefile.common
+++ b/powerpc/Makefile.common
@@ -22,6 +22,7 @@ CFLAGS += -Wextra
 CFLAGS += -O2
 CFLAGS += -I lib -I lib/libfdt
 CFLAGS += -Wa,-mregnames
+CFLAGS += -fpie
 
 asm-offsets = lib/$(ARCH)/asm-offsets.h
 include scripts/asm-offsets.mak
@@ -37,11 +38,17 @@ libgcc := $(shell $(CC) $(machine) --print-libgcc-file-name)
 start_addr := $(shell printf "%x\n" $$(( $(phys_base) + $(kernel_offset) )))
 
 FLATLIBS = $(libcflat) $(LIBFDT_archive) $(libgcc)
-%.elf: LDFLAGS = $(CFLAGS) -nostdlib
+%.elf: LDFLAGS = $(CFLAGS) -nostdlib -pie
 %.elf: %.o $(FLATLIBS) powerpc/flat.lds
 	$(CC) $(LDFLAGS) -o $@ \
 		-Wl,-T,powerpc/flat.lds,--build-id=none,-Ttext=$(start_addr) \
 		$(filter %.o, $^) $(FLATLIBS)
+	@echo -n Checking $@ for unsupported reloc types...
+	@if $(OBJDUMP) -R $@ | grep R_ | grep -v R_PPC64_RELATIVE; then	\
+		false;							\
+	else								\
+		echo " looks good.";					\
+	fi
 
 $(TEST_DIR)/boot_rom.bin: $(TEST_DIR)/boot_rom.elf
 	dd if=/dev/zero of=$@ bs=256 count=1
@@ -60,4 +67,4 @@ generated_files = $(asm-offsets)
 
 test_cases: $(generated_files) $(tests-common) $(tests)
 
-$(TEST_DIR)/selftest.elf: $(cstart.o) $(TEST_DIR)/selftest.o
+$(TEST_DIR)/selftest.elf: $(cstart.o) $(reloc.o) $(TEST_DIR)/selftest.o
diff --git a/powerpc/Makefile.ppc64 b/powerpc/Makefile.ppc64
index 95bf6772d65ed..e965627991916 100644
--- a/powerpc/Makefile.ppc64
+++ b/powerpc/Makefile.ppc64
@@ -8,6 +8,7 @@ ldarch = elf64-powerpc
 kernel_offset = 0x0
 
 cstart.o = $(TEST_DIR)/cstart64.o
+reloc.o  = $(TEST_DIR)/reloc64.o
 cflatobjs += lib/ppc64/spinlock.o
 
 # ppc64 specific tests
diff --git a/powerpc/cstart64.S b/powerpc/cstart64.S
index 6d47eb59bb53e..d1a5531eb1c44 100644
--- a/powerpc/cstart64.S
+++ b/powerpc/cstart64.S
@@ -24,12 +24,33 @@
  */
 .globl start
 start:
-	LOAD_REG_IMMEDIATE(r1, stackptr)
-	LOAD_REG_IMMEDIATE(r2, tocptr)
+	/*
+	 * We were loaded at QEMU's kernel load address, but we're not
+	 * allowed to link there due to how QEMU deals with linker VMAs,
+	 * so we just linked at zero. This means the first thing to do is
+	 * to find our stack and toc, and then do a relocate.
+	 */
+	bl	0f
+0:	mflr	r31
+	subi	r31, r31, 0b - start    /* QEMU's kernel load address */
+	ld	r1, (p_stack - start)(r31)
+	ld	r2, (p_toc - start)(r31)
+	add	r1, r1, r31
+	add	r2, r2, r31
 
 	/* save DTB pointer */
 	std	r3, 56(r1)
 
+	/*
+	 * Call relocate. relocate is C code, but careful to not use
+	 * any global references, as they may use absolute addresses,
+	 * which are, obviously, not yet relocated.
+	 */
+	mr	r3, r31
+	ld	r4, (p_dyn - start)(r31)
+	add	r4, r4, r31
+	bl	relocate
+
 	bl	hcall_patch_broken_sc1
 
 	/* complete setup */
@@ -37,13 +58,18 @@ start:
 	bl	setup
 
 	/* run the test */
-	LOAD_REG_IMMEDIATE(r5, __argc)
-	LOAD_REG_IMMEDIATE(r4, __argv)
+	LOAD_REG_ADDR(r5, __argc)
+	LOAD_REG_ADDR(r4, __argv)
 	lwz	r3, 0(r5)
 	bl	main
 	bl	exit
 	b	halt
 
+.align 3
+p_stack:	.llong  stackptr
+p_toc:		.llong  tocptr
+p_dyn:		.llong  dynamic_start
+
 .text
 .align 3
 
diff --git a/powerpc/flat.lds b/powerpc/flat.lds
index 84087057c0ce2..53221e8b4211c 100644
--- a/powerpc/flat.lds
+++ b/powerpc/flat.lds
@@ -6,11 +6,22 @@ SECTIONS
     etext = .;
     .opd : { *(.opd) }
     . = ALIGN(16);
+    .dynamic : {
+        dynamic_start = .;
+        *(.dynamic)
+    }
+    .dynsym : {
+        dynsym_start = .;
+        *(.dynsym)
+    }
+    .rela.dyn : { *(.rela*) }
+    . = ALIGN(16);
     .data : {
         *(.data)
+        *(.data.rel*)
     }
     . = ALIGN(16);
-    .rodata : { *(.rodata) }
+    .rodata : { *(.rodata) *(.rodata.*) }
     . = ALIGN(16);
     .bss : { *(.bss) }
     . = ALIGN(256);
diff --git a/powerpc/reloc64.c b/powerpc/reloc64.c
new file mode 100644
index 0000000000000..d919372bf9288
--- /dev/null
+++ b/powerpc/reloc64.c
@@ -0,0 +1,55 @@
+/*
+ * relocate R_PPC_RELATIVE RELA entries. Normally this is done in
+ * assembly code to avoid the risk of using absolute addresses before
+ * they're relocated. We use C, but cautiously (no global references).
+ *
+ * Copyright (C) 2016, Red Hat Inc, Andrew Jones <drjones@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.
+ */
+#define DT_NULL		0
+#define DT_RELA 	7
+#define DT_RELACOUNT	0x6ffffff9
+#define R_PPC_RELATIVE	22
+
+struct elf64_dyn {
+	signed long long tag;
+	unsigned long long val;
+};
+
+#define RELA_GET_TYPE(rela_ptr) ((rela_ptr)->info & 0xffffffff)
+struct elf64_rela {
+	unsigned long long offset;
+	unsigned long long info;
+	signed long long addend;
+};
+
+void relocate(unsigned long load_addr, struct elf64_dyn *dyn_table)
+{
+	unsigned long long rela_addr = 0, rela_count = 0, *addr;
+	struct elf64_dyn *d = dyn_table;
+	struct elf64_rela *r;
+
+	while (d && d->tag != DT_NULL) {
+		if (d->tag == DT_RELA)
+			rela_addr = d->val;
+		else if (d->tag == DT_RELACOUNT)
+			rela_count = d->val;
+		if (rela_addr && rela_count)
+			break;
+		++d;
+	}
+
+	if (!rela_addr || !rela_count)
+		return;
+
+	r = (void *)(rela_addr + load_addr);
+
+	while (rela_count--) {
+		if (RELA_GET_TYPE(r) == R_PPC_RELATIVE) {
+			addr = (void *)(r->offset + load_addr);
+			*addr = r->addend + load_addr;
+		}
+		++r;
+	}
+}
