merge in klp-release history after reset to master
diff --git a/libc/bionic/libc_logging.cpp b/libc/bionic/libc_logging.cpp
index ffc5335..6bf7415 100644
--- a/libc/bionic/libc_logging.cpp
+++ b/libc/bionic/libc_logging.cpp
@@ -42,7 +42,6 @@
 #include <unistd.h>
 
 static pthread_mutex_t gAbortMsgLock = PTHREAD_MUTEX_INITIALIZER;
-static pthread_mutex_t gLogInitializationLock = PTHREAD_MUTEX_INITIALIZER;
 
 __LIBC_HIDDEN__ abort_msg_t** __abort_message_ptr; // Accessible to __libc_init_common.
 
@@ -421,13 +420,9 @@
 }
 
 static int __libc_write_log(int priority, const char* tag, const char* msg) {
-  static int main_log_fd = -1;
+  int main_log_fd = TEMP_FAILURE_RETRY(open("/dev/log/main", O_CLOEXEC | O_WRONLY));
   if (main_log_fd == -1) {
-    ScopedPthreadMutexLocker locker(&gLogInitializationLock);
-    main_log_fd = TEMP_FAILURE_RETRY(open("/dev/log/main", O_CLOEXEC | O_WRONLY));
-    if (main_log_fd == -1) {
-      return -1;
-    }
+    return -1;
   }
 
   iovec vec[3];
@@ -438,7 +433,9 @@
   vec[2].iov_base = const_cast<char*>(msg);
   vec[2].iov_len = strlen(msg) + 1;
 
-  return TEMP_FAILURE_RETRY(writev(main_log_fd, vec, 3));
+  int result = TEMP_FAILURE_RETRY(writev(main_log_fd, vec, 3));
+  close(main_log_fd);
+  return result;
 }
 
 int __libc_format_log_va_list(int priority, const char* tag, const char* format, va_list args) {
@@ -465,12 +462,13 @@
   vec[2].iov_base = const_cast<void*>(payload);
   vec[2].iov_len = len;
 
-  static int event_log_fd = -1;
+  int event_log_fd = TEMP_FAILURE_RETRY(open("/dev/log/events", O_CLOEXEC | O_WRONLY));
   if (event_log_fd == -1) {
-    ScopedPthreadMutexLocker locker(&gLogInitializationLock);
-    event_log_fd = TEMP_FAILURE_RETRY(open("/dev/log/events", O_CLOEXEC | O_WRONLY));
+    return -1;
   }
-  return TEMP_FAILURE_RETRY(writev(event_log_fd, vec, 3));
+  int result = TEMP_FAILURE_RETRY(writev(event_log_fd, vec, 3));
+  close(event_log_fd);
+  return result;
 }
 
 void __libc_android_log_event_int(int32_t tag, int value) {
diff --git a/libc/bionic/system_properties.c b/libc/bionic/system_properties.c
index 5197ef3..800c8b8 100644
--- a/libc/bionic/system_properties.c
+++ b/libc/bionic/system_properties.c
@@ -55,7 +55,6 @@
     unsigned volatile serial;
     unsigned magic;
     unsigned version;
-    unsigned reserved[4];
     unsigned toc[1];
 };
 
@@ -70,10 +69,9 @@
 typedef struct prop_info prop_info;
 
 static const char property_service_socket[] = "/dev/socket/" PROP_SERVICE_NAME;
+static char property_filename[PATH_MAX] = PROP_FILENAME;
 
-static unsigned dummy_props = 0;
-
-prop_area *__system_property_area__ = (void*) &dummy_props;
+prop_area *__system_property_regions__[PA_REGION_COUNT] = { NULL, };
 
 static int get_fd_from_env(void)
 {
@@ -86,27 +84,79 @@
     return atoi(env);
 }
 
-void __system_property_area_init(void *data)
+static int map_prop_region_rw(size_t region)
 {
-    prop_area *pa = data;
+    prop_area *pa;
+    int fd;
+    size_t offset = region * PA_SIZE;
+
+    if (__system_property_regions__[region]) {
+        return 0;
+    }
+
+    /* dev is a tmpfs that we can use to carve a shared workspace
+     * out of, so let's do that...
+     */
+    fd = open(property_filename, O_RDWR | O_CREAT | O_NOFOLLOW, 0644);
+    if (fd < 0) {
+        if (errno == EACCES) {
+            /* for consistency with the case where the process has already
+             * mapped the page in and segfaults when trying to write to it
+             */
+            abort();
+        }
+        return -1;
+    }
+
+    if (ftruncate(fd, offset + PA_SIZE) < 0)
+        goto out;
+
+    pa = mmap(NULL, PA_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, offset);
+    if(pa == MAP_FAILED)
+        goto out;
+
     memset(pa, 0, PA_SIZE);
     pa->magic = PROP_AREA_MAGIC;
     pa->version = PROP_AREA_VERSION;
 
     /* plug into the lib property services */
-    __system_property_area__ = pa;
+    __system_property_regions__[region] = pa;
+
+    close(fd);
+    return 0;
+
+out:
+    close(fd);
+    return -1;
 }
 
-int __system_properties_init(void)
+int __system_property_set_filename(const char *filename)
+{
+    size_t len = strlen(filename);
+    if (len >= sizeof(property_filename))
+        return -1;
+
+    strcpy(property_filename, filename);
+    return 0;
+}
+
+int __system_property_area_init()
+{
+    return map_prop_region_rw(0);
+}
+
+static int map_prop_region(size_t region)
 {
     bool fromFile = true;
+    bool swapped;
+    size_t offset = region * PA_SIZE;
     int result = -1;
 
-    if(__system_property_area__ != ((void*) &dummy_props)) {
+    if(__system_property_regions__[region]) {
         return 0;
     }
 
-    int fd = open(PROP_FILENAME, O_RDONLY | O_NOFOLLOW);
+    int fd = open(property_filename, O_RDONLY | O_NOFOLLOW);
 
     if ((fd < 0) && (errno == ENOENT)) {
         /*
@@ -133,23 +183,33 @@
 
     if ((fd_stat.st_uid != 0)
             || (fd_stat.st_gid != 0)
-            || ((fd_stat.st_mode & (S_IWGRP | S_IWOTH)) != 0)) {
+            || ((fd_stat.st_mode & (S_IWGRP | S_IWOTH)) != 0)
+            || (fd_stat.st_size < offset + PA_SIZE) ) {
         goto cleanup;
     }
 
-    prop_area *pa = mmap(NULL, fd_stat.st_size, PROT_READ, MAP_SHARED, fd, 0);
+    prop_area *pa = mmap(NULL, PA_SIZE, PROT_READ, MAP_SHARED, fd, offset);
 
     if (pa == MAP_FAILED) {
         goto cleanup;
     }
 
     if((pa->magic != PROP_AREA_MAGIC) || (pa->version != PROP_AREA_VERSION)) {
-        munmap(pa, fd_stat.st_size);
+        munmap(pa, PA_SIZE);
         goto cleanup;
     }
 
-    __system_property_area__ = pa;
     result = 0;
+    swapped = __sync_bool_compare_and_swap(&__system_property_regions__[region],
+            NULL, pa);
+    if (!swapped) {
+        /**
+         * In the event of a race either mapping is equally good, so
+         * the thread that lost can just throw its mapping away and proceed as
+         * normal.
+         */
+        munmap(pa, PA_SIZE);
+    }
 
 cleanup:
     if (fromFile) {
@@ -159,17 +219,31 @@
     return result;
 }
 
+int __system_properties_init()
+{
+    return map_prop_region(0);
+}
+
 int __system_property_foreach(
         void (*propfn)(const prop_info *pi, void *cookie),
         void *cookie)
 {
-    prop_area *pa = __system_property_area__;
-    unsigned i;
+    size_t region;
 
-    for (i = 0; i < pa->count; i++) {
-        unsigned entry = pa->toc[i];
-        prop_info *pi = TOC_TO_INFO(pa, entry);
-        propfn(pi, cookie);
+    for (region = 0; region < PA_REGION_COUNT; region++) {
+        prop_area *pa;
+        unsigned i;
+
+        int err = map_prop_region(region);
+        if (err < 0)
+            break;
+        pa = __system_property_regions__[region];
+
+        for (i = 0; i < pa->count; i++) {
+            unsigned entry = pa->toc[i];
+            prop_info *pi = TOC_TO_INFO(pa, entry);
+            propfn(pi, cookie);
+        }
     }
 
     return 0;
@@ -177,9 +251,15 @@
 
 const prop_info *__system_property_find_nth(unsigned n)
 {
-    prop_area *pa = __system_property_area__;
+    size_t region = n / PA_COUNT_MAX;
+    prop_area *pa;
 
-    if(n >= pa->count) {
+    int err = map_prop_region(region);
+    if (err < 0)
+        return NULL;
+    pa = __system_property_regions__[region];
+
+    if((n % PA_COUNT_MAX) >= pa->count) {
         return 0;
     } else {
         return TOC_TO_INFO(pa, pa->toc[n]);
@@ -188,25 +268,36 @@
 
 const prop_info *__system_property_find(const char *name)
 {
-    prop_area *pa = __system_property_area__;
-    unsigned count = pa->count;
-    unsigned *toc = pa->toc;
     unsigned len = strlen(name);
-    prop_info *pi;
+    size_t region;
 
     if (len >= PROP_NAME_MAX)
         return 0;
     if (len < 1)
         return 0;
 
-    while(count--) {
-        unsigned entry = *toc++;
-        if(TOC_NAME_LEN(entry) != len) continue;
+    for (region = 0; region < PA_REGION_COUNT; region++) {
+        prop_area *pa;
+        unsigned count;
+        unsigned *toc;
+        prop_info *pi;
 
-        pi = TOC_TO_INFO(pa, entry);
-        if(memcmp(name, pi->name, len)) continue;
+        int err = map_prop_region(region);
+        if (err < 0)
+            return 0;
+        pa = __system_property_regions__[region];
+        count = pa->count;
+        toc = pa->toc;
 
-        return pi;
+        while(count--) {
+            unsigned entry = *toc++;
+            if(TOC_NAME_LEN(entry) != len) continue;
+
+            pi = TOC_TO_INFO(pa, entry);
+            if(memcmp(name, pi->name, len)) continue;
+
+            return pi;
+        }
     }
 
     return 0;
@@ -333,7 +424,7 @@
 {
     unsigned n;
     if(pi == 0) {
-        prop_area *pa = __system_property_area__;
+        prop_area *pa = __system_property_regions__[0];
         n = pa->serial;
         do {
             __futex_wait(&pa->serial, n, 0);
@@ -349,7 +440,7 @@
 
 int __system_property_update(prop_info *pi, const char *value, unsigned int len)
 {
-    prop_area *pa = __system_property_area__;
+    prop_area *pa = __system_property_regions__[0];
 
     if (len >= PROP_VALUE_MAX)
         return -1;
@@ -368,12 +459,11 @@
 int __system_property_add(const char *name, unsigned int namelen,
             const char *value, unsigned int valuelen)
 {
-    prop_area *pa = __system_property_area__;
-    prop_info *pa_info_array = (void*) (((char*) pa) + PA_INFO_START);
+    prop_area *pa;
+    prop_info *pa_info_array;
     prop_info *pi;
+    size_t region;
 
-    if (pa->count == PA_COUNT_MAX)
-        return -1;
     if (namelen >= PROP_NAME_MAX)
         return -1;
     if (valuelen >= PROP_VALUE_MAX)
@@ -381,13 +471,28 @@
     if (namelen < 1)
         return -1;
 
+    for (region = 0; region < PA_REGION_COUNT; region++)
+    {
+        int err = map_prop_region_rw(region);
+        if (err < 0)
+            return -1;
+
+        pa = __system_property_regions__[region];
+
+        if (pa->count < PA_COUNT_MAX)
+            break;
+    }
+
+    if (region == PA_REGION_COUNT)
+        return -1;
+
+    pa_info_array = (void*) (((char*) pa) + PA_INFO_START);
     pi = pa_info_array + pa->count;
     pi->serial = (valuelen << 24);
     memcpy(pi->name, name, namelen + 1);
     memcpy(pi->value, value, valuelen + 1);
 
-    pa->toc[pa->count] =
-        (namelen << 24) | (((unsigned) pi) - ((unsigned) pa));
+    pa->toc[pa->count] = (namelen << 24) | (((unsigned) pi) - ((unsigned) pa));
 
     pa->count++;
     pa->serial++;
@@ -403,7 +508,7 @@
 
 unsigned int __system_property_wait_any(unsigned int serial)
 {
-    prop_area *pa = __system_property_area__;
+    prop_area *pa = __system_property_regions__[0];
 
     do {
         __futex_wait(&pa->serial, serial, 0);
diff --git a/libc/include/stdint.h b/libc/include/stdint.h
index 293fb03..8e2f99e 100644
--- a/libc/include/stdint.h
+++ b/libc/include/stdint.h
@@ -66,7 +66,7 @@
 #  define INT_FAST8_MIN    INT8_MIN
 #  define INT_FAST8_MAX    INT8_MAX
 
-#  define UINT8_MAX           (255U)
+#  define UINT8_MAX           (255)
 #  define UINT_LEAST8_MAX     UINT8_MAX
 #  define UINT_FAST8_MAX      UINT8_MAX
 #endif
@@ -76,7 +76,7 @@
 #  define INT_LEAST8_C(c)	 INT8_C(c)
 #  define INT_FAST8_C(c)	INT8_C(c)
 
-#  define UINT8_C(c)	c ## U
+#  define UINT8_C(c)	c
 #  define UINT_LEAST8_C(c)  UINT8_C(c)
 #  define UINT_FAST8_C(c)  UINT8_C(c)
 #endif
@@ -99,7 +99,7 @@
 #  define INT_FAST16_MIN	INT32_MIN
 #  define INT_FAST16_MAX	INT32_MAX
 
-#  define UINT16_MAX	(65535U)
+#  define UINT16_MAX	(65535)
 #  define UINT_LEAST16_MAX UINT16_MAX
 #  define UINT_FAST16_MAX UINT32_MAX
 #endif
@@ -109,7 +109,7 @@
 #  define INT_LEAST16_C(c) INT16_C(c)
 #  define INT_FAST16_C(c)	 INT32_C(c)
 
-#  define UINT16_C(c)	c ## U
+#  define UINT16_C(c)	c
 #  define UINT_LEAST16_C(c) UINT16_C(c)
 #  define UINT_FAST16_C(c) UINT32_C(c)
 #endif
diff --git a/libc/include/string.h b/libc/include/string.h
index ac31f7d..2b7d47c 100644
--- a/libc/include/string.h
+++ b/libc/include/string.h
@@ -144,7 +144,6 @@
     return __builtin___memset_chk(s, c, n, __builtin_object_size (s, 0));
 }
 
-#if !defined(__clang__)
 extern size_t __strlcpy_real(char* __restrict, const char* __restrict, size_t)
     __asm__(__USER_LABEL_PREFIX__ "strlcpy");
 __errordecl(__strlcpy_error, "strlcpy called with size bigger than buffer");
@@ -154,6 +153,7 @@
 size_t strlcpy(char* __restrict dest, const char* __restrict src, size_t size) {
     size_t bos = __bos(dest);
 
+#if !defined(__clang__)
     // Compiler doesn't know destination size. Don't call __strlcpy_chk
     if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
         return __strlcpy_real(dest, src, size);
@@ -170,10 +170,10 @@
     if (__builtin_constant_p(size) && (size > bos)) {
         __strlcpy_error();
     }
+#endif /* !defined(__clang__) */
 
     return __strlcpy_chk(dest, src, size, bos);
 }
-#endif /* !defined(__clang__) */
 
 #if !defined(__clang__)
 extern size_t __strlcat_real(char* __restrict, const char* __restrict, size_t)
diff --git a/libc/include/sys/_system_properties.h b/libc/include/sys/_system_properties.h
index c5bc223..4971a4c 100644
--- a/libc/include/sys/_system_properties.h
+++ b/libc/include/sys/_system_properties.h
@@ -42,12 +42,13 @@
 #define PROP_SERVICE_NAME "property_service"
 #define PROP_FILENAME "/dev/__properties__"
 
-/* (8 header words + 247 toc words) = 1020 bytes */
-/* 1024 bytes header and toc + 247 prop_infos @ 128 bytes = 32640 bytes */
+/* (4 header words + 28 toc words) = 128 bytes */
+/* 128 bytes header and toc + 28 prop_infos @ 128 bytes = 3712 bytes */
 
-#define PA_COUNT_MAX  247
-#define PA_INFO_START 1024
-#define PA_SIZE       32768
+#define PA_COUNT_MAX    28
+#define PA_REGION_COUNT 128
+#define PA_INFO_START   128
+#define PA_SIZE         4096
 
 #define TOC_NAME_LEN(toc)       ((toc) >> 24)
 #define TOC_TO_INFO(area, toc)  ((prop_info*) (((char*) area) + ((toc) & 0xFFFFFF)))
@@ -97,11 +98,17 @@
 #define PROP_PATH_FACTORY          "/factory/factory.prop"
 
 /*
+** Map the property area from the specified filename.  This
+** method is for testing only.
+*/
+int __system_property_set_filename(const char *filename);
+
+/*
 ** Initialize the area to be used to store properties.  Can
 ** only be done by a single process that has write access to
 ** the property area.
 */
-void __system_property_area_init(void *data);
+int __system_property_area_init();
 
 /* Add a new system property.  Can only be done by a single
 ** process that has write access to the property area, and
diff --git a/linker/linker.cpp b/linker/linker.cpp
index c53d52f..9c35cfc 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -1533,6 +1533,8 @@
          * phdr_table_protect_segments() after all of them are applied
          * and all constructors are run.
          */
+        DL_WARN("%s has text relocations. This is wasting memory and is "
+                "a security risk. Please fix.", si->name);
         if (phdr_table_unprotect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
             DL_ERR("can't unprotect loadable segments for \"%s\": %s",
                    si->name, strerror(errno));
diff --git a/tests/fortify1_test.cpp b/tests/fortify1_test.cpp
index be59a18..b8751bb 100644
--- a/tests/fortify1_test.cpp
+++ b/tests/fortify1_test.cpp
@@ -80,6 +80,16 @@
   memcpy(buf, "0123456789", sizeof(buf));
   ASSERT_EXIT(printf("%s", strrchr(buf, 'a')), testing::KilledBySignal(SIGABRT), "");
 }
+
+TEST(Fortify1_DeathTest, strlcpy_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  char bufa[15];
+  char bufb[10];
+  strcpy(bufa, "01234567890123");
+  size_t n = strlen(bufa);
+  ASSERT_EXIT(strlcpy(bufb, bufa, n), testing::KilledBySignal(SIGABRT), "");
+}
+
 #endif
 
 TEST(Fortify1_DeathTest, sprintf_fortified) {
diff --git a/tests/fortify1_test_clang.cpp b/tests/fortify1_test_clang.cpp
index 2a1b8a7..fed9f13 100644
--- a/tests/fortify1_test_clang.cpp
+++ b/tests/fortify1_test_clang.cpp
@@ -80,6 +80,16 @@
   memcpy(buf, "0123456789", sizeof(buf));
   ASSERT_EXIT(printf("%s", strrchr(buf, 'a')), testing::KilledBySignal(SIGABRT), "");
 }
+
+TEST(Fortify1_Clang_DeathTest, strlcpy_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  char bufa[15];
+  char bufb[10];
+  strcpy(bufa, "01234567890123");
+  size_t n = strlen(bufa);
+  ASSERT_EXIT(strlcpy(bufb, bufa, n), testing::KilledBySignal(SIGABRT), "");
+}
+
 #endif
 
 TEST(Fortify1_Clang_DeathTest, strncat_fortified) {
@@ -289,10 +299,14 @@
 
 __BIONIC_FORTIFY_INLINE
 size_t test_fortify_inline(char* buf) {
-    return __bos(buf);
+  return __bos(buf);
 }
 
 TEST(Fortify1_Clang, fortify_inline) {
   char buf[1024];
-  ASSERT_EQ(test_fortify_inline(buf), sizeof(buf));
+  // no-op. Prints nothing. Needed to prevent the compiler
+  // from optimizing out buf.
+  buf[0] = '\0';
+  printf("%s", buf);
+  ASSERT_EQ(sizeof(buf), test_fortify_inline(buf));
 }
diff --git a/tests/fortify2_test.cpp b/tests/fortify2_test.cpp
index b48a077..b6f6661 100644
--- a/tests/fortify2_test.cpp
+++ b/tests/fortify2_test.cpp
@@ -94,6 +94,16 @@
   ASSERT_EXIT(printf("%s", strrchr(myfoo.a, 'a')),
               testing::KilledBySignal(SIGABRT), "");
 }
+
+TEST(Fortify2_DeathTest, strlcpy_fortified2) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  foo myfoo;
+  strcpy(myfoo.a, "01");
+  size_t n = strlen(myfoo.a);
+  ASSERT_EXIT(strlcpy(myfoo.one, myfoo.a, n),
+              testing::KilledBySignal(SIGABRT), "");
+}
+
 #endif
 
 TEST(Fortify2_DeathTest, strncat_fortified2) {
@@ -199,6 +209,16 @@
   memcpy(buf, "0123456789", sizeof(buf));
   ASSERT_EXIT(printf("%s", strrchr(buf, 'a')), testing::KilledBySignal(SIGABRT), "");
 }
+
+TEST(Fortify2_DeathTest, strlcpy_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  char bufa[15];
+  char bufb[10];
+  strcpy(bufa, "01234567890123");
+  size_t n = strlen(bufa);
+  ASSERT_EXIT(strlcpy(bufb, bufa, n), testing::KilledBySignal(SIGABRT), "");
+}
+
 #endif
 
 TEST(Fortify2_DeathTest, sprintf_fortified) {
diff --git a/tests/fortify2_test_clang.cpp b/tests/fortify2_test_clang.cpp
index 2abf85a..d8a0ba6 100644
--- a/tests/fortify2_test_clang.cpp
+++ b/tests/fortify2_test_clang.cpp
@@ -162,10 +162,14 @@
 
 __BIONIC_FORTIFY_INLINE
 size_t test_fortify2_inline(char* buf) {
-    return __bos(buf);
+  return __bos(buf);
 }
 
 TEST(Fortify2_Clang, fortify_inline) {
   char buf[1024];
-  ASSERT_EQ(test_fortify2_inline(buf), sizeof(buf));
+  // no-op. Prints nothing. Needed to prevent the compiler
+  // from optimizing out buf.
+  buf[0] = '\0';
+  printf("%s", buf);
+  ASSERT_EQ(sizeof(buf), test_fortify2_inline(buf));
 }
diff --git a/tests/property_benchmark.cpp b/tests/property_benchmark.cpp
index 2c8e2a1..7266bd0 100644
--- a/tests/property_benchmark.cpp
+++ b/tests/property_benchmark.cpp
@@ -15,23 +15,40 @@
  */
 
 #include "benchmark.h"
+#include <unistd.h>
 
 #define _REALLY_INCLUDE_SYS__SYSTEM_PROPERTIES_H_
 #include <sys/_system_properties.h>
 
 #include <vector>
+#include <string>
 
-extern void *__system_property_area__;
+extern void *__system_property_regions__[PA_REGION_COUNT];
 
 #define TEST_NUM_PROPS \
-    Arg(1)->Arg(4)->Arg(16)->Arg(64)->Arg(128)->Arg(247)
+    Arg(1)->Arg(4)->Arg(16)->Arg(64)->Arg(128)->Arg(256)->Arg(512)->Arg(1024)
 
 struct LocalPropertyTestState {
-    LocalPropertyTestState(int nprops) : nprops(nprops) {
+    LocalPropertyTestState(int nprops) : nprops(nprops), valid(false) {
         static const char prop_name_chars[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-_";
-        old_pa = __system_property_area__;
-        pa = malloc(PA_SIZE);
-        __system_property_area_init(pa);
+
+        char dir_template[] = "/data/nativetest/prop-XXXXXX";
+        char *dirname = mkdtemp(dir_template);
+        if (!dirname) {
+            perror("making temp file for test state failed (is /data/nativetest writable?)");
+            return;
+        }
+
+        for (size_t i = 0; i < PA_REGION_COUNT; i++) {
+            old_pa[i] = __system_property_regions__[i];
+            __system_property_regions__[i] = NULL;
+        }
+
+        pa_dirname = dirname;
+        pa_filename = pa_dirname + "/__properties__";
+
+        __system_property_set_filename(pa_filename.c_str());
+        __system_property_area_init();
 
         names = new char* [nprops];
         name_lens = new int[nprops];
@@ -54,10 +71,22 @@
             }
             __system_property_add(names[i], name_lens[i], values[i], value_lens[i]);
         }
+
+        valid = true;
     }
 
     ~LocalPropertyTestState() {
-        __system_property_area__ = old_pa;
+        if (!valid)
+            return;
+
+        for (size_t i = 0; i < PA_REGION_COUNT; i++) {
+            __system_property_regions__[i] = old_pa[i];
+        }
+
+        __system_property_set_filename(PROP_FILENAME);
+        unlink(pa_filename.c_str());
+        rmdir(pa_dirname.c_str());
+
         for (int i = 0; i < nprops; i++) {
             delete names[i];
             delete values[i];
@@ -66,7 +95,6 @@
         delete[] name_lens;
         delete[] values;
         delete[] value_lens;
-        free(pa);
     }
 public:
     const int nprops;
@@ -74,10 +102,12 @@
     int *name_lens;
     char **values;
     int *value_lens;
+    bool valid;
 
 private:
-    void *pa;
-    void *old_pa;
+    std::string pa_dirname;
+    std::string pa_filename;
+    void *old_pa[PA_REGION_COUNT];
 };
 
 static void BM_property_get(int iters, int nprops)
@@ -87,6 +117,9 @@
     LocalPropertyTestState pa(nprops);
     char value[PROP_VALUE_MAX];
 
+    if (!pa.valid)
+        return;
+
     srandom(iters * nprops);
 
     StartBenchmarkTiming();
@@ -104,6 +137,9 @@
 
     LocalPropertyTestState pa(nprops);
 
+    if (!pa.valid)
+        return;
+
     srandom(iters * nprops);
 
     StartBenchmarkTiming();
diff --git a/tests/system_properties_test.cpp b/tests/system_properties_test.cpp
index 70ff1d6..50bdfdf 100644
--- a/tests/system_properties_test.cpp
+++ b/tests/system_properties_test.cpp
@@ -16,32 +16,61 @@
 
 #include <gtest/gtest.h>
 #include <sys/wait.h>
+#include <unistd.h>
+#include <string>
 
 #if __BIONIC__
 
 #define _REALLY_INCLUDE_SYS__SYSTEM_PROPERTIES_H_
 #include <sys/_system_properties.h>
 
-extern void *__system_property_area__;
+extern void *__system_property_regions__[PA_REGION_COUNT];
 
 struct LocalPropertyTestState {
-    LocalPropertyTestState() {
-        old_pa = __system_property_area__;
-        pa = malloc(PA_SIZE);
-        __system_property_area_init(pa);
+    LocalPropertyTestState() : valid(false) {
+        char dir_template[] = "/data/nativetest/prop-XXXXXX";
+        char *dirname = mkdtemp(dir_template);
+        if (!dirname) {
+            perror("making temp file for test state failed (is /data/nativetest writable?)");
+            return;
+        }
+
+        for (size_t i = 0; i < PA_REGION_COUNT; i++) {
+            old_pa[i] = __system_property_regions__[i];
+            __system_property_regions__[i] = NULL;
+        }
+
+        pa_dirname = dirname;
+        pa_filename = pa_dirname + "/__properties__";
+
+        __system_property_set_filename(pa_filename.c_str());
+        __system_property_area_init();
+        valid = true;
     }
 
     ~LocalPropertyTestState() {
-        __system_property_area__ = old_pa;
-        free(pa);
+        if (!valid)
+            return;
+
+        for (size_t i = 0; i < PA_REGION_COUNT; i++) {
+            __system_property_regions__[i] = old_pa[i];
+        }
+
+        __system_property_set_filename(PROP_FILENAME);
+        unlink(pa_filename.c_str());
+        rmdir(pa_dirname.c_str());
     }
+public:
+    bool valid;
 private:
-    void *pa;
-    void *old_pa;
+    std::string pa_dirname;
+    std::string pa_filename;
+    void *old_pa[PA_REGION_COUNT];
 };
 
 TEST(properties, add) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
 
     char propvalue[PROP_VALUE_MAX];
 
@@ -61,6 +90,7 @@
 
 TEST(properties, update) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
 
     char propvalue[PROP_VALUE_MAX];
     prop_info *pi;
@@ -91,27 +121,34 @@
     ASSERT_STREQ(propvalue, "value6");
 }
 
-// 247 = max # of properties supported by current implementation
-// (this should never go down)
-TEST(properties, fill_247) {
+TEST(properties, fill) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
     char prop_name[PROP_NAME_MAX];
     char prop_value[PROP_VALUE_MAX];
     char prop_value_ret[PROP_VALUE_MAX];
+    int count = 0;
     int ret;
 
-    for (int i = 0; i < 247; i++) {
-        ret = snprintf(prop_name, PROP_NAME_MAX - 1, "property_%d", i);
+    while (true) {
+        ret = snprintf(prop_name, PROP_NAME_MAX - 1, "property_%d", count);
         memset(prop_name + ret, 'a', PROP_NAME_MAX - 1 - ret);
-        ret = snprintf(prop_value, PROP_VALUE_MAX - 1, "value_%d", i);
+        ret = snprintf(prop_value, PROP_VALUE_MAX - 1, "value_%d", count);
         memset(prop_value + ret, 'b', PROP_VALUE_MAX - 1 - ret);
         prop_name[PROP_NAME_MAX - 1] = 0;
         prop_value[PROP_VALUE_MAX - 1] = 0;
 
-        ASSERT_EQ(0, __system_property_add(prop_name, PROP_NAME_MAX - 1, prop_value, PROP_VALUE_MAX - 1));
+        ret = __system_property_add(prop_name, PROP_NAME_MAX - 1, prop_value, PROP_VALUE_MAX - 1);
+        if (ret < 0)
+            break;
+
+        count++;
     }
 
-    for (int i = 0; i < 247; i++) {
+    // For historical reasons at least 247 properties must be supported
+    ASSERT_GE(count, 247);
+
+    for (int i = 0; i < count; i++) {
         ret = snprintf(prop_name, PROP_NAME_MAX - 1, "property_%d", i);
         memset(prop_name + ret, 'a', PROP_NAME_MAX - 1 - ret);
         ret = snprintf(prop_value, PROP_VALUE_MAX - 1, "value_%d", i);
@@ -134,6 +171,7 @@
 
 TEST(properties, foreach) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
     size_t count = 0;
 
     ASSERT_EQ(0, __system_property_add("property", 8, "value1", 6));
@@ -146,6 +184,7 @@
 
 TEST(properties, find_nth) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
 
     ASSERT_EQ(0, __system_property_add("property", 8, "value1", 6));
     ASSERT_EQ(0, __system_property_add("other_property", 14, "value2", 6));
@@ -165,6 +204,7 @@
 
 TEST(properties, errors) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
     char prop_value[PROP_NAME_MAX];
 
     ASSERT_EQ(0, __system_property_add("property", 8, "value1", 6));
@@ -181,6 +221,7 @@
 
 TEST(properties, serial) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
     const prop_info *pi;
     unsigned int serial;
 
@@ -206,6 +247,7 @@
 
 TEST(properties, wait) {
     LocalPropertyTestState pa;
+    ASSERT_TRUE(pa.valid);
     unsigned int serial;
     prop_info *pi;
     pthread_t t;