Index: ELF/Writer.cpp
===================================================================
--- ELF/Writer.cpp
+++ ELF/Writer.cpp
@@ -729,15 +729,16 @@
 // * It is easy to check if a give branch was taken.
 // * It is easy two see how similar two ranks are (see getRankProximity).
 enum RankFlags {
-  RF_NOT_ADDR_SET = 1 << 18,
-  RF_NOT_ALLOC = 1 << 17,
-  RF_NOT_INTERP = 1 << 16,
-  RF_NOT_NOTE = 1 << 15,
-  RF_WRITE = 1 << 14,
-  RF_EXEC_WRITE = 1 << 13,
-  RF_EXEC = 1 << 12,
-  RF_RODATA = 1 << 11,
-  RF_NON_TLS_BSS = 1 << 10,
+  RF_NOT_ADDR_SET = 1 << 19,
+  RF_NOT_ALLOC = 1 << 18,
+  RF_NOT_INTERP = 1 << 17,
+  RF_NOT_NOTE = 1 << 16,
+  RF_WRITE = 1 << 15,
+  RF_EXEC_WRITE = 1 << 14,
+  RF_EXEC = 1 << 13,
+  RF_RODATA = 1 << 12,
+  RF_NON_TLS_BSS = 1 << 11,
+  RF_NON_RELRO = 1 << 10,
   RF_NON_TLS_BSS_RO = 1 << 9,
   RF_NOT_TLS = 1 << 8,
   RF_BSS = 1 << 7,
@@ -820,6 +821,12 @@
   if (IsNonTlsNoBits)
     Rank |= RF_NON_TLS_BSS;
 
+  // Place writable non-RELRO sections first so that the PT_LOAD starts with
+  // PT_GNU_RELRO sections, which ensures the PT_LOAD splits into at most 2
+  // maps at runtime.
+  if (IsWrite && !isRelroSection(Sec))
+    Rank |= RF_NON_RELRO;
+
   // We place nobits RelRo sections before plain r/w ones, and non-nobits RelRo
   // sections after r/w ones, so that the RelRo sections are contiguous.
   bool IsRelRo = isRelroSection(Sec);