Merge ~racb/ubuntu/+source/memcached:upstream-bump-1.5.6 into ubuntu/+source/memcached:ubuntu/devel

[Robie Basak]

[Christian Ehrhardt  (paelzer)]

available in ppa:racb/experimental

[Christian Ehrhardt  (paelzer)]

1. verified the upstream delta between version - ok

[Christian Ehrhardt  (paelzer)]

2. is it really a bugfix release - ok
https://github.com/memcached/memcached/wiki/ReleaseNotes155 - ok
https://github.com/memcached/memcached/wiki/ReleaseNotes156 - special cases
  - UDP - we had disabled that already before, so ok
  - ##secure## in service file - handled by you (will check in detail) - ok
Also their git log looks sane.

[Christian Ehrhardt  (paelzer)]

3. changelog - unsure
   That could have followed the usual "merge with X, remaining changes .., Dropped changes",
   but it is short and complete

For example we still have:
  - debian/NEWS: add explanation and document how to re-enable UDP if necessary.
  - rules: Disable tests on armhf, they hang the build.
  - added patch to show distribution on version
  - Force alignment on in configure.ac
  - disable unreliable test.

I think it would be good to have the usual "merge" changelog structure in this case as well.
This is not a hard nack, but I want to hear your opinion on it.

review: Needs Information

[Robie Basak (racb)]

It's not a merge. It's a pure upstream release bump. I haven't pulled in any changes from Debian. So the previous changes from 1.5.4-1 in the changelog are current and read correctly as linear history.

[Christian Ehrhardt  (paelzer)]

4. checked all new commits - ok

   Thanks for the pre-discussion on the sandboxing, certainly better to underatand.
   The check seems good if they add more.
   If they remove some the patch will not apply.
   So in both cases a packager will consciously decide then - that is good.

[Robie Basak (racb)]

IOW, it's as if I'm uploading a 1.5.4-1ubuntu4 - but since I also update the upstream version, the package version string becomes 1.5.6-0ubuntu1.

[Christian Ehrhardt  (paelzer)]

5. Commit structure - ok
   I'd have preferred to have
   1. Latest Debian
   2. Upstream diff
   3. old Ubuntu changes as-is
   4. new Ubuntu changes by you
But that is a matter of personal taste I assume, fine as it is.

[Christian Ehrhardt  (paelzer)]

6. Did an upgrade and install from the ppa - all ok
   Service still seems started the same way (checked as there were the upstream changes)

[Christian Ehrhardt  (paelzer)]

7. ran the 11 tests of qa-regression-testing
   One fail, but that it had with the former version as well.

[Christian Ehrhardt  (paelzer)]

Thanks for the explanations on the changelog structure btw.

Overall this LGTM +1.

review: Approve

diff --git a/assoc.c b/assoc.c
index 8cdf581..8e7a810 100644
--- a/assoc.c
+++ b/assoc.c
@@ -27,7 +27,6 @@
 
 static pthread_cond_t maintenance_cond = PTHREAD_COND_INITIALIZER;
 static pthread_mutex_t maintenance_lock = PTHREAD_MUTEX_INITIALIZER;
-static pthread_mutex_t hash_items_counter_lock = PTHREAD_MUTEX_INITIALIZER;
 
 typedef  unsigned long  int  ub4;   /* unsigned 4-byte quantities */
 typedef  unsigned       char ub1;   /* unsigned 1-byte quantities */
@@ -47,9 +46,6 @@ static item** primary_hashtable = 0;
  */
 static item** old_hashtable = 0;
 
-/* Number of items in the hash table. */
-static unsigned int hash_items = 0;
-
 /* Flag: Are we in the middle of expanding now? */
 static bool expanding = false;
 static bool started_expanding = false;
@@ -144,12 +140,15 @@ static void assoc_expand(void) {
     }
 }
 
-static void assoc_start_expand(void) {
+void assoc_start_expand(uint64_t curr_items) {
     if (started_expanding)
         return;
 
-    started_expanding = true;
-    pthread_cond_signal(&maintenance_cond);
+    if (curr_items > (hashsize(hashpower) * 3) / 2 &&
+          hashpower < HASHPOWER_MAX) {
+        started_expanding = true;
+        pthread_cond_signal(&maintenance_cond);
+    }
 }
 
 /* Note: this isn't an assoc_update.  The key must not already exist to call this */
@@ -168,15 +167,7 @@ int assoc_insert(item *it, const uint32_t hv) {
         primary_hashtable[hv & hashmask(hashpower)] = it;
     }
 
-    pthread_mutex_lock(&hash_items_counter_lock);
-    hash_items++;
-    if (! expanding && hash_items > (hashsize(hashpower) * 3) / 2 &&
-          hashpower < HASHPOWER_MAX) {
-        assoc_start_expand();
-    }
-    pthread_mutex_unlock(&hash_items_counter_lock);
-
-    MEMCACHED_ASSOC_INSERT(ITEM_key(it), it->nkey, hash_items);
+    MEMCACHED_ASSOC_INSERT(ITEM_key(it), it->nkey);
     return 1;
 }
 
@@ -185,13 +176,10 @@ void assoc_delete(const char *key, const size_t nkey, const uint32_t hv) {
 
     if (*before) {
         item *nxt;
-        pthread_mutex_lock(&hash_items_counter_lock);
-        hash_items--;
-        pthread_mutex_unlock(&hash_items_counter_lock);
         /* The DTrace probe cannot be triggered as the last instruction
          * due to possible tail-optimization by the compiler
          */
-        MEMCACHED_ASSOC_DELETE(key, nkey, hash_items);
+        MEMCACHED_ASSOC_DELETE(key, nkey);
         nxt = (*before)->h_next;
         (*before)->h_next = 0;   /* probably pointless, but whatever. */
         *before = nxt;
diff --git a/assoc.h b/assoc.h
index dda39a0..fb2c922 100644
--- a/assoc.h
+++ b/assoc.h
@@ -6,5 +6,6 @@ void assoc_delete(const char *key, const size_t nkey, const uint32_t hv);
 void do_assoc_move_next_bucket(void);
 int start_assoc_maintenance_thread(void);
 void stop_assoc_maintenance_thread(void);
+void assoc_start_expand(uint64_t curr_items);
 extern unsigned int hashpower;
 extern unsigned int item_lock_hashpower;
diff --git a/configure b/configure
index f1e61ff..e479e60 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for memcached 1.5.4.
+# Generated by GNU Autoconf 2.69 for memcached 1.5.6.
 #
 # Report bugs to <[e-mail]>.
 #
@@ -580,8 +580,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='memcached'
 PACKAGE_TARNAME='memcached'
-PACKAGE_VERSION='1.5.4'
-PACKAGE_STRING='memcached 1.5.4'
+PACKAGE_VERSION='1.5.6'
+PACKAGE_STRING='memcached 1.5.6'
 PACKAGE_BUGREPORT='[e-mail]'
 PACKAGE_URL=''
 
@@ -1320,7 +1320,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures memcached 1.5.4 to adapt to many kinds of systems.
+\`configure' configures memcached 1.5.6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1391,7 +1391,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of memcached 1.5.4:";;
+     short | recursive ) echo "Configuration of memcached 1.5.6:";;
    esac
   cat <<\_ACEOF
 
@@ -1495,7 +1495,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-memcached configure 1.5.4
+memcached configure 1.5.6
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1964,7 +1964,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by memcached $as_me 1.5.4, which was
+It was created by memcached $as_me 1.5.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2899,7 +2899,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='memcached'
- VERSION='1.5.4'
+ VERSION='1.5.6'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -7156,7 +7156,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by memcached $as_me 1.5.4, which was
+This file was extended by memcached $as_me 1.5.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -7222,7 +7222,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-memcached config.status 1.5.4
+memcached config.status 1.5.6
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/crawler.c b/crawler.c
index 56e967a..9c81bba 100644
--- a/crawler.c
+++ b/crawler.c
@@ -252,8 +252,8 @@ static void crawler_metadump_eval(crawler_module_t *cm, item *it, uint32_t hv, i
     int total = snprintf(cm->c.cbuf, 4096,
             "key=%s exp=%ld la=%llu cas=%llu fetch=%s cls=%u size=%lu\n",
             keybuf,
-            (it->exptime == 0) ? -1 : (long)it->exptime + process_started,
-            (unsigned long long)it->time + process_started,
+            (it->exptime == 0) ? -1 : (long)(it->exptime + process_started),
+            (unsigned long long)(it->time + process_started),
             (unsigned long long)ITEM_get_cas(it),
             (it->it_flags & ITEM_FETCHED) ? "yes" : "no",
             ITEM_clsid(it),
@@ -530,6 +530,9 @@ static int do_lru_crawler_start(uint32_t id, uint32_t remaining) {
         crawlers[sid].next = 0;
         crawlers[sid].prev = 0;
         crawlers[sid].time = 0;
+        if (remaining == LRU_CRAWLER_CAP_REMAINING) {
+            remaining = do_get_lru_size(sid);
+        }
         crawlers[sid].remaining = remaining;
         crawlers[sid].slabs_clsid = sid;
         crawlers[sid].reclaimed = 0;
@@ -622,7 +625,7 @@ int lru_crawler_start(uint8_t *ids, uint32_t remaining,
  * Also only clear the crawlerstats once per sid.
  */
 enum crawler_result_type lru_crawler_crawl(char *slabs, const enum crawler_run_type type,
-        void *c, const int sfd) {
+        void *c, const int sfd, unsigned int remaining) {
     char *b = NULL;
     uint32_t sid = 0;
     int starts = 0;
@@ -651,8 +654,7 @@ enum crawler_result_type lru_crawler_crawl(char *slabs, const enum crawler_run_t
         }
     }
 
-    starts = lru_crawler_start(tocrawl, settings.lru_crawler_tocrawl,
-            type, NULL, c, sfd);
+    starts = lru_crawler_start(tocrawl, remaining, type, NULL, c, sfd);
     if (starts == -1) {
         return CRAWLER_RUNNING;
     } else if (starts == -2) {
diff --git a/crawler.h b/crawler.h
index e009548..f7ebba2 100644
--- a/crawler.h
+++ b/crawler.h
@@ -1,6 +1,8 @@
 #ifndef CRAWLER_H
 #define CRAWLER_H
 
+#define LRU_CRAWLER_CAP_REMAINING -1
+
 typedef struct {
     uint64_t histo[61];
     uint64_t ttl_hourplus;
@@ -28,7 +30,8 @@ enum crawler_result_type {
 int start_item_crawler_thread(void);
 int stop_item_crawler_thread(void);
 int init_lru_crawler(void *arg);
-enum crawler_result_type lru_crawler_crawl(char *slabs, enum crawler_run_type, void *c, const int sfd);
+enum crawler_result_type lru_crawler_crawl(char *slabs, enum crawler_run_type,
+        void *c, const int sfd, unsigned int remaining);
 int lru_crawler_start(uint8_t *ids, uint32_t remaining,
                              const enum crawler_run_type type, void *data,
                              void *c, const int sfd);
diff --git a/debian/changelog b/debian/changelog
index 9914ad2..f1ae7d9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+memcached (1.5.6-0ubuntu1) bionic; urgency=medium
+
+  * New upstream bugfix release (LP: #1753839).
+  * d/p/disable-udp-by-default.patch: drop (now upstream).
+  * d/p/02_service_wrapper.patch: refresh to remove fuzz.
+  * d/p/restore-systemd-sandboxing: restore sandboxing in memcached.service
+    removed by upstream in 1.5.6 to avoid feature regression (LP: #1755460).
+
+ -- Robie Basak <[e-mail]>  Tue, 13 Mar 2018 09:59:06 +0000
+
 memcached (1.5.4-1ubuntu3) bionic; urgency=medium
 
   * SECURITY UPDATE: disable listening on UDP port by default due to
diff --git a/debian/patches/02_service_wrapper.patch b/debian/patches/02_service_wrapper.patch
index a81bd06..355e194 100644
--- a/debian/patches/02_service_wrapper.patch
+++ b/debian/patches/02_service_wrapper.patch
@@ -7,10 +7,8 @@ Description: Additions for service unit file
 Last-Update: 2017-09-13
 Forwarded: not-needed
 
-Index: memcached/scripts/memcached.service
-===================================================================
---- memcached.orig/scripts/memcached.service
-+++ memcached/scripts/memcached.service
+--- a/scripts/memcached.service
++++ b/scripts/memcached.service
 @@ -12,10 +12,10 @@
  [Unit]
  Description=memcached daemon
@@ -22,11 +20,11 @@ Index: memcached/scripts/memcached.service
 -ExecStart=/usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS
 +ExecStart=/usr/share/memcached/scripts/systemd-memcached-wrapper /etc/memcached.conf
  
- # Set up a new file system namespace and mounts private /tmp and /var/tmp directories
- # so this service cannot access the global directories and other processes cannot
-@@ -68,5 +68,10 @@ RestrictAddressFamilies=AF_INET AF_INET6
+ # Set up a new file system namespace and mounts private /tmp and /var/tmp
+ # directories so this service cannot access the global directories and
+@@ -80,5 +80,10 @@
  # Takes away the ability to create or manage any kind of namespace
- RestrictNamespaces=true
+ ##safer##RestrictNamespaces=true
  
 +PIDFile=/var/run/memcached/memcached.pid
 +
diff --git a/debian/patches/disable-udp-by-default.patch b/debian/patches/disable-udp-by-default.patch
deleted file mode 100644
index 7ca2d13..0000000
--- a/debian/patches/disable-udp-by-default.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From dbb7a8af90054bf4ef51f5814ef7ceb17d83d974 Mon Sep 17 00:00:00 2001
-From: dormando <[e-mail]>
-Date: Tue, 27 Feb 2018 10:50:45 -0800
-Subject: [PATCH] disable UDP port by default
-
-As reported, UDP amplification attacks have started to use insecure
-internet-exposed memcached instances. UDP used to be a lot more popular as a
-transport for memcached many years ago, but I'm not aware of many recent
-users.
-
-Ten years ago, the TCP connection overhead from many clients was relatively
-high (dozens or hundreds per client server), but these days many clients are
-batched, or user fewer processes, or simply anre't worried about it.
-
-While changing the default to listen on localhost only would also help, the
-true culprit is UDP. There are many more use cases for using memcached over
-the network than there are for using the UDP protocol.
----
- memcached.c  | 6 ++----
- t/issue_67.t | 4 ++--
- 2 files changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/memcached.c b/memcached.c
-index 88a5f2ebe..7178666e2 100644
---- a/memcached.c
-+++ b/memcached.c
-@@ -222,7 +222,7 @@ static void settings_init(void) {
-     settings.use_cas = true;
-     settings.access = 0700;
-     settings.port = 11211;
--    settings.udpport = 11211;
-+    settings.udpport = 0;
-     /* By default this string should be NULL for getaddrinfo() */
-     settings.inter = NULL;
-     settings.maxbytes = 64 * 1024 * 1024; /* default is 64MB */
-@@ -7479,9 +7479,7 @@ int main (int argc, char **argv) {
-         }
-     }
- 
--    if (tcp_specified && settings.port != 0 && !udp_specified) {
--        settings.udpport = settings.port;
--    } else if (udp_specified && settings.udpport != 0 && !tcp_specified) {
-+    if (udp_specified && settings.udpport != 0 && !tcp_specified) {
-         settings.port = settings.udpport;
-     }
- 
-diff --git a/t/issue_67.t b/t/issue_67.t
-index 69c869f4c..b2d374fa5 100644
---- a/t/issue_67.t
-+++ b/t/issue_67.t
-@@ -77,11 +77,11 @@ sub when {
- 
- # Disabling the defaults since it conflicts with a running instance.
- # when('no arguments', '', 11211, 11211);
--when('specifying tcp port', '-p 11212', 11212, 11212);
-+when('specifying tcp port', '-p 11212', 11212, -1);
- when('specifying udp port', '-U 11222', 11222, 11222);
- when('specifying tcp ephemeral port', '-p -1', 0, 0);
- when('specifying udp ephemeral port', '-U -1', 0, 0);
--when('tcp port disabled', '-p 0', -1, 11211);
-+when('tcp port disabled', '-p 0', -1, -1);
- when('udp port disabled', '-U 0', 11211, -1);
- when('specifying tcp and udp ports', '-p 11232 -U 11233', 11232, 11233);
- when('specifying tcp and disabling udp', '-p 11242 -U 0', 11242, -1);
diff --git a/debian/patches/restore-systemd-sandboxing b/debian/patches/restore-systemd-sandboxing
new file mode 100644
index 0000000..584e774
--- /dev/null
+++ b/debian/patches/restore-systemd-sandboxing
@@ -0,0 +1,61 @@
+Author: Robie Basak <[e-mail]>
+Description: Restore systemd sandboxing
+ Upstream regressed systemd sandboxing for everyone by default because RHEL
+ cannot support it. Put it back again to avoid this functional regression.
+Bug: https://github.com/memcached/memcached/issues/359
+Bug-Ubuntu: https://bugs.launchpad.net/memcached/+bug/1755460
+Forwarded: not-needed
+Last-Update: 2018-03-13
+
+--- a/scripts/memcached.service
++++ b/scripts/memcached.service
+@@ -42,21 +42,16 @@
+ # of this unit. Protects against vulnerabilities such as CVE-2016-8655
+ RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+ 
+-
+-# Some security features are not in the older versions of systemd used by
+-# e.g. RHEL7/CentOS 7. The below settings are automatically edited at package
+-# build time to uncomment them if the target platform supports them.
+-
+ # Attempts to create memory mappings that are writable and executable at
+ # the same time, or to change existing memory mappings to become executable
+ # are prohibited.
+-##safer##MemoryDenyWriteExecute=true
++MemoryDenyWriteExecute=true
+ 
+ # Explicit module loading will be denied. This allows to turn off module
+ # load and unload operations on modular kernels. It is recommended to turn
+ # this on for most services that do not need special file systems or extra
+ # kernel modules to work.
+-##safer##ProtectKernelModules=true
++ProtectKernelModules=true
+ 
+ # Kernel variables accessible through /proc/sys, /sys, /proc/sysrq-trigger,
+ # /proc/latency_stats, /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq
+@@ -64,21 +59,21 @@
+ # kernel variables should only be written at boot-time, with the sysctl.d(5)
+ # mechanism. Almost no services need to write to these at runtime; it is hence
+ # recommended to turn this on for most services.
+-##safer##ProtectKernelTunables=true
++ProtectKernelTunables=true
+ 
+ # The Linux Control Groups (cgroups(7)) hierarchies accessible through
+ # /sys/fs/cgroup will be made read-only to all processes of the unit.
+ # Except for container managers no services should require write access
+ # to the control groups hierarchies; it is hence recommended to turn this
+ # on for most services
+-##safer##ProtectControlGroups=true
++ProtectControlGroups=true
+ 
+ # Any attempts to enable realtime scheduling in a process of the unit are
+ # refused.
+-##safer##RestrictRealtime=true
++RestrictRealtime=true
+ 
+ # Takes away the ability to create or manage any kind of namespace
+-##safer##RestrictNamespaces=true
++RestrictNamespaces=true
+ 
+ PIDFile=/var/run/memcached/memcached.pid
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 4e08bec..bb9c45b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -5,4 +5,4 @@
 fix-distribution.patch
 always_enable_alignment.patch
 disable_watcher_test.patch
-disable-udp-by-default.patch
+restore-systemd-sandboxing
diff --git a/debian/rules b/debian/rules
index ccd01ec..9fc8d04 100755
--- a/debian/rules
+++ b/debian/rules
@@ -26,6 +26,8 @@ override_dh_auto_install:
 		$(CURDIR)/debian/memcached.init
 	install -m 755 $(CURDIR)/scripts/memcached.service \
 		$(CURDIR)/debian/memcached.service
+	# Check for LP: #1755460
+	if grep -i '##safer##' $(CURDIR)/debian/memcached.service >/dev/null 2>&1; then echo "ERROR: debian/patches/restore-systemd-sandboxing is incomplete; please see LP: #1755460" >&2; exit 1; fi
 	install -m 755 $(CURDIR)/scripts/damemtop $(SCRIPTS)
 	install -m 644 $(CURDIR)/scripts/damemtop.yaml $(SCRIPTS)
 	install -m 644 $(CURDIR)/scripts/README.damemtop $(SCRIPTS)
diff --git a/doc/Makefile b/doc/Makefile
index 881c525..0337680 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -191,10 +191,10 @@ OBJEXT = o
 PACKAGE = memcached
 PACKAGE_BUGREPORT = [e-mail]
 PACKAGE_NAME = memcached
-PACKAGE_STRING = memcached 1.5.4
+PACKAGE_STRING = memcached 1.5.6
 PACKAGE_TARNAME = memcached
 PACKAGE_URL = 
-PACKAGE_VERSION = 1.5.4
+PACKAGE_VERSION = 1.5.6
 PATH_SEPARATOR = :
 PROFILER = /usr/bin/gcov
 PROFILER_FLAGS = -fprofile-arcs -ftest-coverage
@@ -202,7 +202,7 @@ PROFILER_LDFLAGS = -lgcov
 SET_MAKE = 
 SHELL = /bin/bash
 STRIP = 
-VERSION = 1.5.4
+VERSION = 1.5.6
 XML2RFC = /usr/bin/xml2rfc
 XSLTPROC = no
 abs_builddir = /home/dormando/d/p/danga/git/memcached/doc
diff --git a/items.c b/items.c
index 400048b..0aefaf0 100644
--- a/items.c
+++ b/items.c
@@ -138,6 +138,11 @@ static unsigned int temp_lru_size(int slabs_clsid) {
     return ret;
 }
 
+/* must be locked before call */
+unsigned int do_get_lru_size(uint32_t id) {
+    return sizes[id];
+}
+
 /* Enable this for reference-count debugging. */
 #if 0
 # define DEBUG_REFCNT(it,op) \
@@ -925,7 +930,7 @@ void item_stats_sizes(ADD_STAT add_stats, void *c) {
         int i;
         for (i = 0; i < stats_sizes_buckets; i++) {
             if (stats_sizes_hist[i] != 0) {
-                char key[8];
+                char key[12];
                 snprintf(key, sizeof(key), "%d", i * 32);
                 APPEND_STAT(key, "%u", stats_sizes_hist[i]);
             }
diff --git a/items.h b/items.h
index bf126d7..3b99c66 100644
--- a/items.h
+++ b/items.h
@@ -25,6 +25,7 @@ void do_item_update_nolock(item *it);
 int  do_item_replace(item *it, item *new_it, const uint32_t hv);
 
 int item_is_flushed(item *it);
+unsigned int do_get_lru_size(uint32_t id);
 
 void do_item_linktail_q(item *it);
 void do_item_unlinktail_q(item *it);
diff --git a/memcached.c b/memcached.c
index a8a724c..7178666 100644
--- a/memcached.c
+++ b/memcached.c
@@ -222,7 +222,7 @@ static void settings_init(void) {
     settings.use_cas = true;
     settings.access = 0700;
     settings.port = 11211;
-    settings.udpport = 11211;
+    settings.udpport = 0;
     /* By default this string should be NULL for getaddrinfo() */
     settings.inter = NULL;
     settings.maxbytes = 64 * 1024 * 1024; /* default is 64MB */
@@ -3338,7 +3338,7 @@ static void process_stats_conns(ADD_STAT add_stats, void *c) {
     int i;
     char key_str[STAT_KEY_LEN];
     char val_str[STAT_VAL_LEN];
-    char conn_name[MAXPATHLEN + sizeof("unix:")];
+    char conn_name[MAXPATHLEN + sizeof("unix:") + sizeof("65535")];
     int klen = 0, vlen = 0;
 
     assert(add_stats);
@@ -4525,7 +4525,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens) 
 static void process_extstore_command(conn *c, token_t *tokens, const size_t ntokens) {
     set_noreply_maybe(c, tokens, ntokens);
     bool ok = true;
-    if (ntokens < 3) {
+    if (ntokens < 4) {
         ok = false;
     } else if (strcmp(tokens[1].value, "free_memchunks") == 0 && ntokens > 4) {
         /* per-slab-class free chunk setting. */
@@ -4770,7 +4770,8 @@ static void process_command(conn *c, char *command) {
                 return;
             }
 
-            rv = lru_crawler_crawl(tokens[2].value, CRAWLER_EXPIRED, NULL, 0);
+            rv = lru_crawler_crawl(tokens[2].value, CRAWLER_EXPIRED, NULL, 0,
+                    settings.lru_crawler_tocrawl);
             switch(rv) {
             case CRAWLER_OK:
                 out_string(c, "OK");
@@ -4800,7 +4801,7 @@ static void process_command(conn *c, char *command) {
             }
 
             int rv = lru_crawler_crawl(tokens[2].value, CRAWLER_METADUMP,
-                    c, c->sfd);
+                    c, c->sfd, LRU_CRAWLER_CAP_REMAINING);
             switch(rv) {
                 case CRAWLER_OK:
                     out_string(c, "OK");
@@ -5973,6 +5974,7 @@ static int server_sockets(int port, enum network_transport transport,
                 char *e = strchr(p, ']');
                 if (e == NULL) {
                     fprintf(stderr, "Invalid IPV6 address: \"%s\"", p);
+                    free(list);
                     return 1;
                 }
                 h = ++p; // skip the opening '['
@@ -5991,6 +5993,7 @@ static int server_sockets(int port, enum network_transport transport,
                     ++s;
                     if (!safe_strtol(s, &the_port)) {
                         fprintf(stderr, "Invalid port number: \"%s\"", s);
+                        free(list);
                         return 1;
                     }
                 }
@@ -6126,6 +6129,10 @@ static void clock_handler(const int fd, const short which, void *arg) {
 #endif
     }
 
+    // While we're here, check for hash table expansion.
+    // This function should be quick to avoid delaying the timer.
+    assoc_start_expand(stats_state.curr_items);
+
     evtimer_set(&clockevent, clock_handler, 0);
     event_base_set(main_base, &clockevent);
     evtimer_add(&clockevent, &t);
@@ -7472,9 +7479,7 @@ int main (int argc, char **argv) {
         }
     }
 
-    if (tcp_specified && settings.port != 0 && !udp_specified) {
-        settings.udpport = settings.port;
-    } else if (udp_specified && settings.udpport != 0 && !tcp_specified) {
+    if (udp_specified && settings.udpport != 0 && !tcp_specified) {
         settings.port = settings.udpport;
     }
 
@@ -7568,7 +7573,17 @@ int main (int argc, char **argv) {
     }
 
     /* initialize main thread libevent instance */
+#if defined(LIBEVENT_VERSION_NUMBER) && LIBEVENT_VERSION_NUMBER >= 0x02000101
+    /* If libevent version is larger/equal to 2.0.2-alpha, use newer version */
+    struct event_config *ev_config;
+    ev_config = event_config_new();
+    event_config_set_flag(ev_config, EVENT_BASE_FLAG_NOLOCK);
+    main_base = event_base_new_with_config(ev_config);
+    event_config_free(ev_config);
+#else
+    /* Otherwise, use older API */
     main_base = event_init();
+#endif
 
     /* initialize other stuff */
     logger_init();
@@ -7710,8 +7725,9 @@ int main (int argc, char **argv) {
         if (portnumber_file) {
             fclose(portnumber_file);
             rename(temp_portnumber_filename, portnumber_filename);
-            free(temp_portnumber_filename);
         }
+        if (temp_portnumber_filename)
+            free(temp_portnumber_filename);
     }
 
     /* Give the sockets a moment to open. I know this is dumb, but the error
@@ -7753,5 +7769,8 @@ int main (int argc, char **argv) {
     if (u_socket)
       free(u_socket);
 
+    /* cleanup base */
+    event_base_free(main_base);
+
     return retval;
 }
diff --git a/memcached.spec b/memcached.spec
index a149db3..697c38f 100644
--- a/memcached.spec
+++ b/memcached.spec
@@ -1,21 +1,48 @@
+# Set with_systemd on distros that use it, so we can install the service
+# file, otherwise the sysvinit script will be installed
+%if 0%{?fedora} >= 14 || 0%{?rhel} >= 7 || 0%{?suse_version} >= 1210
+%global with_systemd 1
+BuildRequires: systemd-units
+
+# Disable some systemd safety features on OSes without a new enough systemd
+# (new enough is systemd >= 233)
+%if 0%{?fedora} < 26 || 0%{?rhel} > 0
+%global safer_systemd 0
+%else
+%global safer_systemd 1
+%endif
+
+%else
+%global with_systemd 0
+%endif
+
 Name:           memcached
-Version:        1.5.4
+Version:        1.5.6
 Release:        1%{?dist}
 Summary:        High Performance, Distributed Memory Object Cache
 
 Group:          System Environment/Daemons
 License:        BSD
 URL:            http://memcached.org
-Source0:        http://memcached.org/files/%{name}-1.5.4.tar.gz
+Source0:        http://memcached.org/files/%{name}-%{version}.tar.gz
+Source1:        memcached.sysconfig
+Source2:        memcached.service
+Source3:        memcached@.service
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 BuildRequires:  libevent-devel
 BuildRequires:  perl(Test::More)
 BuildRequires:  /usr/bin/prove
 Requires: initscripts
+%if %{with_systemd}
+Requires(post):   systemd-units
+Requires(preun):  systemd-units
+Requires(postun): systemd-units
+%else
 Requires(post): /sbin/chkconfig
 Requires(preun): /sbin/chkconfig, /sbin/service
 Requires(postun): /sbin/service
+%endif
 
 %description
 memcached is a high-performance, distributed memory object caching
@@ -23,7 +50,7 @@ system, generic in nature, but intended for use in speeding up dynamic
 web applications by alleviating database load.
 
 %prep
-%setup -q -n %{name}-1.5.4
+%setup -q -n %{name}-%{version}
 
 
 %build
@@ -31,53 +58,90 @@ web applications by alleviating database load.
 
 make %{?_smp_mflags}
 
+
 %check
 make test
 
+
 %install
 rm -rf %{buildroot}
 make install DESTDIR=%{buildroot}
 
 # remove memcached-debug
-rm -f %{buildroot}/%{_bindir}/memcached-debug
+rm -f %{buildroot}/%{_bindir}/%{name}-debug
 
 # Perl script for monitoring memcached
-install -Dp -m0755 scripts/memcached-tool %{buildroot}%{_bindir}/memcached-tool
+install -Dp -m0755 scripts/memcached-tool %{buildroot}%{_bindir}/%{name}-tool
 
 # Init script
-install -Dp -m0755 scripts/memcached.sysv %{buildroot}%{_initrddir}/memcached
+%if %{with_systemd}
+install -Dp -m0755 scripts/memcached.service %{buildroot}%{_unitdir}/%{name}.service
+install -Dp -m0755 scripts/memcached@.service %{buildroot}%{_unitdir}/%{name}@.service
+
+if [ %{safer_systemd} -gt 0 ]; then
+    sed -e -i 's/^##safer##//g' %{buildroot}%{_unitdir}/%{name}.service %{buildroot}%{_unitdir}/%{name}@.service
+else
+    sed -e -i 's/^##safer##/#/g' %{buildroot}%{_unitdir}/%{name}.service %{buildroot}%{_unitdir}/%{name}@.service
+fi
+%else
+install -Dp -m0755 scripts/memcached.sysv %{buildroot}%{_initrddir}/%{name}
+%endif
 
 # Default configs
-mkdir -p %{buildroot}/%{_sysconfdir}/sysconfig
-cat <<EOF >%{buildroot}/%{_sysconfdir}/sysconfig/%{name}
-PORT="11211"
-USER="nobody"
-MAXCONN="1024"
-CACHESIZE="64"
-OPTIONS=""
-EOF
+install -Dp -m0644 scripts/memcached.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/%{name}
 
 # pid directory
-mkdir -p %{buildroot}/%{_localstatedir}/run/memcached
+mkdir -p %{buildroot}/%{_localstatedir}/run/%{name}
+
 
 %clean
 rm -rf %{buildroot}
 
 
 %post
-/sbin/chkconfig --add %{name}
+if [ $1 -eq 1 ]; then
+    # Initial install
+%if %{with_systemd}
+    /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+%else
+    /sbin/chkconfig --add %{name}
+%endif
+fi
+
 
 %preun
 if [ "$1" = 0 ] ; then
-    /sbin/service %{name} stop > /dev/null 2>&1
+    # Removal, not upgrade
+%if %{with_systemd}
+    /bin/systemctl --no-reload disable %{name}.service > /dev/null 2>&1 || :
+    /bin/systemctl --no-reload disable %{name}@\*.service > /dev/null 2>&1 || :
+    /bin/systemctl stop %{name}.service > /dev/null 2>&1 || :
+    /bin/systemctl stop %{name}@\*.service > /dev/null 2>&1 || :
+%else
+    /sbin/service %{name} stop > /dev/null 2&>1 || :
     /sbin/chkconfig --del %{name}
+%endif
 fi
+
 exit 0
 
+
 %postun
-if [ "$1" -ge 1 ]; then
-    /sbin/service %{name} condrestart > /dev/null 2>&1
-fi
+%if %{with_systemd}
+    /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+%endif
+
+# Don't auto-restart memcached on upgrade -- let user control when cache flushes
+# if [ "$1" -ge 1 ]; then
+#    # upgrade, not install
+#    %if %{with_systemd}
+#        /bin/systemctl try-restart %{name}.service
+#        /bin/systemctl try-restart %{name}@\*.service
+#    %else
+#        /sbin/service %named condrestart 2>/dev/null || :
+#    %endif
+#fi
+
 exit 0
 
 
@@ -86,14 +150,24 @@ exit 0
 %doc AUTHORS ChangeLog COPYING NEWS README.md doc/CONTRIBUTORS doc/*.txt
 %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
 
-%dir %attr(750,nobody,nobody) %{_localstatedir}/run/memcached
-%{_bindir}/memcached-tool
-%{_bindir}/memcached
-%{_mandir}/man1/memcached.1*
-%{_initrddir}/memcached
-%{_includedir}/memcached
+%dir %attr(750,nobody,nobody) %{_localstatedir}/run/%{name}
+%{_bindir}/%{name}-tool
+%{_bindir}/%{name}
+%{_mandir}/man1/%{name}.1*
+%{_includedir}/%{name}
+
+%if %{with_systemd}
+%{_unitdir}/%{name}.service
+%{_unitdir}/%{name}@.service
+%else
+%{_initrddir}/%{name}
+%endif
 
 %changelog
+* Wed Jul  5 2017 J. Grizzard <[e-mail]> - 1.4.39
+- Add systemd-aware build
+- Add both static and instanced versions of memcached unit files
+
 * Mon Nov  2 2009 Dormando <[e-mail]> - 1.4.3-1
 - Fix autogen more.
 
@@ -113,7 +187,7 @@ exit 0
 - above suggestions from Bernard Johnson
 
 * Mon May  7 2007 Paul Lindner <[e-mail]> - 1.2.2-2
-- Tidiness improvements suggested by Ruben Kerkhof in bugzilla #238994
+- Tidyness improvements suggested by Ruben Kerkhof in bugzilla #238994
 
 * Fri May  4 2007 Paul Lindner <[e-mail]> - 1.2.2-1
 - Initial spec file created via rpmdev-newspec
diff --git a/memcached_dtrace.d b/memcached_dtrace.d
index 41617ff..3443795 100644
--- a/memcached_dtrace.d
+++ b/memcached_dtrace.d
@@ -111,19 +111,15 @@ provider memcached {
     * Fired when a new item has been inserted.
     * @param key the key just inserted
     * @param keylen length of the key
-    * @param nokeys the total number of keys currently stored,
-    *               including the key for which insert was called.
     */
-   probe assoc__insert(const char *key, int keylen, int nokeys);
+   probe assoc__insert(const char *key, int keylen);
 
    /**
     * Fired when a new item has been removed.
     * @param key the key just deleted
     * @param keylen length of the key
-    * @param nokeys the total number of keys currently stored,
-    *               excluding the key for which delete was called.
     */
-   probe assoc__delete(const char *key, int keylen, int nokeys);
+   probe assoc__delete(const char *key, int keylen);
 
    /**
     * Fired when an item is linked into the cache.
diff --git a/scripts/memcached-automove-extstore b/scripts/memcached-automove-extstore
index fa7a11c..db66d8c 100755
--- a/scripts/memcached-automove-extstore
+++ b/scripts/memcached-automove-extstore
@@ -55,17 +55,17 @@ def window_key_check(history, key):
 def determine_move(history, stats, diffs, memfree):
     """ Figure out of a page move is in order.
 
-    - we should use as much memory as possible to buffer items, reducing
-      the load on flash.
+    - Use as much memory as possible to hold items, reducing the load on
+      flash.
     - tries to keep the global free page pool inbetween poolmin/poolmax.
     - avoids flapping as much as possible:
       - only pull pages off of a class if it hasn't recently evicted or allocated pages.
-      - only pull pages off if a sufficient number of chunks are available.
+      - only pull pages off if a sufficient number of free chunks are available.
       - if global pool is below minimum remove pages from oldest large class.
       - if global pool is above maximum, move pages to youngest large class.
-    - re-adjusts number of free chunks once per minute, based on usage.
-    - age balancing should move memory around large classes, which then
-      adjusts the per-class free chunk minimums.
+    - extstore manages a desired number of free chunks in each slab class.
+    - autmover adjusts above limits once per minute based on current sizes.
+    - if youngest is below the age ratio limit of oldest, move a page to it.
     """
     # rotate windows
     history['w'].append({})
@@ -88,6 +88,7 @@ def determine_move(history, stats, diffs, memfree):
     pool_high = window_key_check(history, 'slab_pool_high')
     for sid, slab in diffs.items():
         small_slab = False
+        free_enough = False
         # Only balance larger slab classes
         if slab['chunk_size'] < args.size:
             small_slab = True
@@ -102,7 +103,9 @@ def determine_move(history, stats, diffs, memfree):
         if slab['evicted_d'] > 0:
             w[sid]['dirty'] = 1
             w[sid]['ev'] = 1
-        if slab['free_chunks'] > memfree[sid] and memfree[sid] > 0:
+        if slab['free_chunks'] > memfree[sid]:
+            free_enough = True
+        if memfree[sid] > 0 and slab['free_chunks'] > (memfree[sid] * 2):
             w[sid]['excess_free'] = 1
         w[sid]['age'] = slab['age']
         age = window_check(history, sid, 'age') / len(history['w'])
@@ -121,24 +124,25 @@ def determine_move(history, stats, diffs, memfree):
                 too_free = True
 
         # are we the oldest slab class? (and a valid target)
+        # don't consider for young if we've recently given it unused memory
         if small_slab == False:
             if age > oldest[1] and slab['total_pages'] > MIN_PAGES_FOR_SOURCE:
                 oldest = (sid, age)
             if age < youngest[1] and slab['total_pages'] > 0 \
-                    and window_check(history, sid, 'excess_free') < len(history['w']):
+                    and window_check(history, sid, 'excess_free') < len(history['w']) \
+                    and not (window_check(history, sid, 'relaxed') and free_enough):
                 youngest = (sid, age)
 
 
     if w.get('slab_pool_high') and youngest[0] != -1:
         # if global pool is too high, feed youngest large class.
-        # decision = (0, youngest[0])
-        # No current way to assign directly from global to a class.
-        # minimize the free chunks limiter and re-check.
-        decision = (youngest[0], -2)
+        if slab['free_chunks'] <= memfree[youngest[0]]:
+            decision = (0, youngest[0])
+        w[youngest[0]]['relaxed'] = 1
     elif too_free == False and pool_low and oldest[0] != -1:
         # if pool is too low, take from oldest large class.
         if args.verbose:
-            print("oldest:  [class: {}] [age: {}]".format(int(oldest[0]), oldest[1]))
+            print("oldest:  [class: {}] [age: {:.2f}]".format(int(oldest[0]), oldest[1]))
         decision = (oldest[0], 0)
     elif too_free == False and youngest[0] != -1 and oldest[0] != -1 and youngest[0] != oldest[0]:
         # youngest is outside of the tolerance ratio, move a page around.
@@ -148,8 +152,10 @@ def determine_move(history, stats, diffs, memfree):
 
         slab = diffs[youngest[0]]
         #print("F:{} L:{} Y:{} R:{}".format(slab['free_chunks'], memfree[youngest[0]], int(youngest[1]), int(oldest[1] * args.ratio)))
-        if (slab['free_chunks'] <= memfree[youngest[0]]) and (youngest[1] < oldest[1] * args.ratio):
-            decision = (oldest[0], youngest[0])
+        if youngest[1] < oldest[1] * args.ratio:
+            w[youngest[0]]['relaxed'] = 1
+            if slab['free_chunks'] <= memfree[youngest[0]]:
+                decision = (0, youngest[0])
 
     if (len(history['w']) >= args.window):
         return decision
@@ -289,27 +295,16 @@ while True:
                 (diffs, totals) = diff_stats(stats_pre, stats_post)
                 #if args.verbose:
                 #    show_detail(diffs, totals)
-                if (last_memfree_check < time() - 60) and totals.get('total_pages'):
-                    memfree = memfree_check(s, diffs, totals)
-                    last_memfree_check = time()
-                decision = (-1, -1)
                 if int(stats['evictions']) > 0:
+                    if (last_memfree_check < time() - 60) and totals.get('total_pages'):
+                        memfree = memfree_check(s, diffs, totals)
+                        last_memfree_check = time()
+                    decision = (-1, -1)
                     decision = determine_move(history, stats, diffs, memfree)
                     if int(decision[0]) > 0 and int(decision[1]) >= 0:
                         print("moving page from, to:", decision)
                         if args.automove:
                             run_move(s, decision)
-                    elif int(decision[0]) > 0 and decision[1] == -2:
-                        # we've been told to zero out the memory limit.
-                        # let the memfree check run "soon".
-                        # this (purposefully) can slowly remove limits on
-                        # multiple classes if global pool stays too high.
-                        last_memfree_check = time() - 58
-                        s.write("extstore free_memchunks {} {}\r\n".format(decision[0], 0))
-                        s.readline()
-                        if args.verbose:
-                            print("relaxing free:", decision[0])
-
 
                 # Minimize sleeping if we just moved a page to global pool.
                 # Improves responsiveness during flushes/quick changes.
diff --git a/scripts/memcached.service b/scripts/memcached.service
index 2bfbb67..88a4b8a 100644
--- a/scripts/memcached.service
+++ b/scripts/memcached.service
@@ -1,10 +1,10 @@
 # It's not recommended to modify this file in-place, because it will be
 # overwritten during upgrades.  If you want to customize, the best
 # way is to use the "systemctl edit" command to create an override unit.
-
+#
 # For example, to pass additional options, create an override unit
 # (as is done by systemctl edit) and enter the following:
-
+#
 #     [Service]
 #     Environment=OPTIONS="-l 127.0.0.1,::1"
 
@@ -17,56 +17,68 @@ After=network.target
 EnvironmentFile=/etc/sysconfig/memcached
 ExecStart=/usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS
 
-# Set up a new file system namespace and mounts private /tmp and /var/tmp directories
-# so this service cannot access the global directories and other processes cannot
-# access this service's directories.
+# Set up a new file system namespace and mounts private /tmp and /var/tmp
+# directories so this service cannot access the global directories and
+# other processes cannot access this service's directories.
 PrivateTmp=true
 
-# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
+# Mounts the /usr, /boot, and /etc directories read-only for processes
+# invoked by this unit.
 ProtectSystem=full
 
-# Ensures that the service process and all its children can never gain new privileges
+# Ensures that the service process and all its children can never gain new
+# privileges
 NoNewPrivileges=true
 
-# Sets up a new /dev namespace for the executed processes and only adds API pseudo devices
-# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it,
-# but no physical devices such as /dev/sda.
+# Sets up a new /dev namespace for the executed processes and only adds API
+# pseudo devices such as /dev/null, /dev/zero or /dev/random (as well as
+# the pseudo TTY subsystem) to it, but no physical devices such as /dev/sda.
 PrivateDevices=true
 
 # Required for dropping privileges and running as a different user
 CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
 
-# Attempts to create memory mappings that are writable and executable at the same time,
-# or to change existing memory mappings to become executable are prohibited.
-MemoryDenyWriteExecute=true
+# Restricts the set of socket address families accessible to the processes
+# of this unit. Protects against vulnerabilities such as CVE-2016-8655
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 
-# Explicit module loading will be denied. This allows to turn off module load and unload
-# operations on modular kernels. It is recommended to turn this on for most services that
-# do not need special file systems or extra kernel modules to work.
-ProtectKernelModules=true
 
-# Kernel variables accessible through /proc/sys, /sys, /proc/sysrq-trigger, /proc/latency_stats,
-# /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq will be made read-only to all processes
-# of the unit. Usually, tunable kernel variables should only be written at boot-time, with the
-# sysctl.d(5) mechanism. Almost no services need to write to these at runtime; it is hence
-# recommended to turn this on for most services.
-ProtectKernelTunables=true
+# Some security features are not in the older versions of systemd used by
+# e.g. RHEL7/CentOS 7. The below settings are automatically edited at package
+# build time to uncomment them if the target platform supports them.
 
-# The Linux Control Groups (cgroups(7)) hierarchies accessible through /sys/fs/cgroup will be
-# made read-only to all processes of the unit. Except for container managers no services should
-# require write access to the control groups hierarchies; it is hence recommended to turn this on
-# for most services
-ProtectControlGroups=true
+# Attempts to create memory mappings that are writable and executable at
+# the same time, or to change existing memory mappings to become executable
+# are prohibited.
+##safer##MemoryDenyWriteExecute=true
 
-# Any attempts to enable realtime scheduling in a process of the unit are refused.
-RestrictRealtime=true
+# Explicit module loading will be denied. This allows to turn off module
+# load and unload operations on modular kernels. It is recommended to turn
+# this on for most services that do not need special file systems or extra
+# kernel modules to work.
+##safer##ProtectKernelModules=true
 
-# Restricts the set of socket address families accessible to the processes of this unit.
-# Protects against vulnerabilities such as CVE-2016-8655
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+# Kernel variables accessible through /proc/sys, /sys, /proc/sysrq-trigger,
+# /proc/latency_stats, /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq
+# will be made read-only to all processes of the unit. Usually, tunable
+# kernel variables should only be written at boot-time, with the sysctl.d(5)
+# mechanism. Almost no services need to write to these at runtime; it is hence
+# recommended to turn this on for most services.
+##safer##ProtectKernelTunables=true
+
+# The Linux Control Groups (cgroups(7)) hierarchies accessible through
+# /sys/fs/cgroup will be made read-only to all processes of the unit.
+# Except for container managers no services should require write access
+# to the control groups hierarchies; it is hence recommended to turn this
+# on for most services
+##safer##ProtectControlGroups=true
+
+# Any attempts to enable realtime scheduling in a process of the unit are
+# refused.
+##safer##RestrictRealtime=true
 
 # Takes away the ability to create or manage any kind of namespace
-RestrictNamespaces=true
+##safer##RestrictNamespaces=true
 
 [Install]
 WantedBy=multi-user.target
diff --git a/scripts/memcached.sysconfig b/scripts/memcached.sysconfig
new file mode 100644
index 0000000..bd46483
--- /dev/null
+++ b/scripts/memcached.sysconfig
@@ -0,0 +1,10 @@
+# These defaults will be used by every memcached instance, unless overridden
+# by values in /etc/sysconfig/memcached.<port>
+USER="nobody"
+MAXCONN="1024"
+CACHESIZE="64"
+OPTIONS=""
+
+# The PORT variable will only be used by memcached.service, not by
+# memcached@xxxxx services, which will use the xxxxx
+PORT="11211"
diff --git a/scripts/memcached@.service b/scripts/memcached@.service
new file mode 100644
index 0000000..4e9f1d7
--- /dev/null
+++ b/scripts/memcached@.service
@@ -0,0 +1,89 @@
+# It's not recommended to modify this file in-place, because it will be
+# overwritten during upgrades.  If you want to customize, the best
+# way is to use the "systemctl edit" command to create an override unit.
+#
+# For example, to pass additional options, create an override unit
+# (as is done by systemctl edit) and enter the following:
+#
+#     [Service]
+#     Environment=OPTIONS="-l 127.0.0.1,::1"
+#
+# To use the "instanced" version of this, just start 'memcached@11211' or
+# whatever port you'd like. If /etc/sysconfig/memcached.<port> exists, it
+# will be read first, so you can set different parameters for a given
+# instance.
+
+[Unit]
+Description=memcached daemon
+After=network.target
+
+[Service]
+EnvironmentFile=/etc/sysconfig/memcached
+EnvironmentFile=-/etc/sysconfig/memcached.%i
+ExecStart=/usr/bin/memcached -p %i -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS
+
+# Set up a new file system namespace and mounts private /tmp and /var/tmp
+# directories so this service cannot access the global directories and
+# other processes cannot access this service's directories.
+PrivateTmp=true
+
+# Mounts the /usr, /boot, and /etc directories read-only for processes
+# invoked by this unit.
+ProtectSystem=full
+
+# Ensures that the service process and all its children can never gain new
+# privileges
+NoNewPrivileges=true
+
+# Sets up a new /dev namespace for the executed processes and only adds API
+# pseudo devices such as /dev/null, /dev/zero or /dev/random (as well as
+# the pseudo TTY subsystem) to it, but no physical devices such as /dev/sda.
+PrivateDevices=true
+
+# Required for dropping privileges and running as a different user
+CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE
+
+# Restricts the set of socket address families accessible to the processes
+# of this unit. Protects against vulnerabilities such as CVE-2016-8655
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+
+
+# Some security features are not in the older versions of systemd used by
+# e.g. RHEL7/CentOS 7. The below settings are automatically edited at package
+# build time to uncomment them if the target platform supports them.
+
+# Attempts to create memory mappings that are writable and executable at
+# the same time, or to change existing memory mappings to become executable
+# are prohibited.
+##safer##MemoryDenyWriteExecute=true
+
+# Explicit module loading will be denied. This allows to turn off module
+# load and unload operations on modular kernels. It is recommended to turn
+# this on for most services that do not need special file systems or extra
+# kernel modules to work.
+##safer##ProtectKernelModules=true
+
+# Kernel variables accessible through /proc/sys, /sys, /proc/sysrq-trigger,
+# /proc/latency_stats, /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq
+# will be made read-only to all processes of the unit. Usually, tunable
+# kernel variables should only be written at boot-time, with the sysctl.d(5)
+# mechanism. Almost no services need to write to these at runtime; it is hence
+# recommended to turn this on for most services.
+##safer##ProtectKernelTunables=true
+
+# The Linux Control Groups (cgroups(7)) hierarchies accessible through
+# /sys/fs/cgroup will be made read-only to all processes of the unit.
+# Except for container managers no services should require write access
+# to the control groups hierarchies; it is hence recommended to turn this
+# on for most services
+##safer##ProtectControlGroups=true
+
+# Any attempts to enable realtime scheduling in a process of the unit are
+# refused.
+##safer##RestrictRealtime=true
+
+# Takes away the ability to create or manage any kind of namespace
+##safer##RestrictNamespaces=true
+
+[Install]
+WantedBy=multi-user.target
diff --git a/slab_automove_extstore.c b/slab_automove_extstore.c
index d9b62b9..a3012d7 100644
--- a/slab_automove_extstore.c
+++ b/slab_automove_extstore.c
@@ -20,6 +20,7 @@ struct window_data {
     uint64_t dirty;
     uint64_t evicted;
     unsigned int excess_free;
+    unsigned int relaxed;
 };
 
 struct window_global {
@@ -90,6 +91,7 @@ static void window_sum(struct window_data *wd, struct window_data *w,
         w->dirty += d->dirty;
         w->evicted += d->evicted;
         w->excess_free += d->excess_free;
+        w->relaxed += d->relaxed;
     }
 }
 
@@ -121,6 +123,15 @@ static void global_pool_check(slab_automove *a) {
     }
 }
 
+/* A percentage of memory is configured to be held "free" as buffers for the
+ * external storage system.
+ * % of global memory is desired in the global page pool
+ * each slab class has a % of free chunks desired based on how much memory is
+ * currently in the class. This allows time for extstore to flush data when
+ * spikes or waves of set data arrive.
+ * The global page pool reserve acts as a secondary buffer for any slab class,
+ * which helps absorb shifts in which class is active.
+ */
 static void memcheck(slab_automove *a) {
     unsigned int total_pages = 0;
     if (current_time < a->last_memcheck_run + MEMCHECK_PERIOD)
@@ -143,6 +154,11 @@ static void memcheck(slab_automove *a) {
     a->free_mem[0] = total_pages * a->free_ratio;
 }
 
+static struct window_data *get_window_data(slab_automove *a, int class) {
+    int w_offset = class * a->window_size;
+    return &a->window_data[w_offset + (a->window_cur % a->window_size)];
+}
+
 void slab_automove_extstore_run(void *arg, int *src, int *dst) {
     slab_automove *a = (slab_automove *)arg;
     int n;
@@ -170,15 +186,16 @@ void slab_automove_extstore_run(void *arg, int *src, int *dst) {
     for (n = POWER_SMALLEST; n < MAX_NUMBER_OF_SLAB_CLASSES; n++) {
         bool small_slab = a->sam_before[n].chunk_size < a->item_size
             ? true : false;
-        int w_offset = n * a->window_size;
-        struct window_data *wd = &a->window_data[w_offset + (a->window_cur % a->window_size)];
+        bool free_enough = false;
+        struct window_data *wd = get_window_data(a, n);
         // summarize the window-up-to-now.
         memset(&w_sum, 0, sizeof(struct window_data));
+        int w_offset = n * a->window_size;
         window_sum(&a->window_data[w_offset], &w_sum, a->window_size);
         memset(wd, 0, sizeof(struct window_data));
 
-        // if page delta, or evicted delta, mark window dirty
-        // (or outofmemory)
+        // if page delta, oom, or evicted delta, mark window dirty
+        // classes marked dirty cannot donate memory back to global pool.
         if (a->iam_after[n].evicted - a->iam_before[n].evicted > 0 ||
             a->iam_after[n].outofmemory - a->iam_before[n].outofmemory > 0) {
             wd->evicted = 1;
@@ -188,7 +205,14 @@ void slab_automove_extstore_run(void *arg, int *src, int *dst) {
             wd->dirty = 1;
         }
         // Mark excess free if we're over the free mem limit for too long.
-        if (a->sam_after[n].free_chunks > a->free_mem[n] && a->free_mem[n] > 0) {
+        // "free_enough" means it is either wobbling, recently received a new
+        // page of memory, or the crawler is freeing memory.
+        if (a->sam_after[n].free_chunks > a->free_mem[n]) {
+            free_enough = true;
+        }
+        // double the free requirements means we may have memory we can
+        // reclaim to global, if it stays this way for the whole window.
+        if (a->sam_after[n].free_chunks > (a->free_mem[n] * 2) && a->free_mem[n] > 0) {
             wd->excess_free = 1;
         }
 
@@ -198,7 +222,9 @@ void slab_automove_extstore_run(void *arg, int *src, int *dst) {
         // grab age as average of window total
         uint64_t age = w_sum.age / a->window_size;
 
-        // if > N free chunks and not dirty, make decision.
+        // if > N free chunks and not dirty, reclaim memory
+        // small slab classes aren't age balanced and rely more on global
+        // pool. reclaim them more aggressively.
         if (a->sam_after[n].free_chunks > a->sam_after[n].chunks_per_page * MIN_PAGES_FOR_RECLAIM
                 && w_sum.dirty == 0) {
             if (small_slab) {
@@ -214,19 +240,22 @@ void slab_automove_extstore_run(void *arg, int *src, int *dst) {
             }
         }
 
-        // if oldest and have enough pages, is oldest
-        if (!small_slab
-                && age > oldest_age
-                && a->sam_after[n].total_pages > MIN_PAGES_FOR_SOURCE) {
-            oldest = n;
-            oldest_age = age;
-        }
+        if (!small_slab) {
+            // if oldest and have enough pages, is oldest
+            if (age > oldest_age
+                    && a->sam_after[n].total_pages > MIN_PAGES_FOR_SOURCE) {
+                oldest = n;
+                oldest_age = age;
+            }
 
-        // don't count as youngest if it hasn't been using new chunks.
-        if (!small_slab && age < youngest_age && a->sam_after[n].total_pages != 0
-                && w_sum.excess_free < a->window_size) {
-            youngest = n;
-            youngest_age = age;
+            // don't count as youngest if it hasn't been using new chunks.
+            // (if it was relaxed recently, and is currently "free enough")
+            if (age < youngest_age && a->sam_after[n].total_pages != 0
+                    && w_sum.excess_free < a->window_size
+                    && !(w_sum.relaxed && free_enough)) {
+                youngest = n;
+                youngest_age = age;
+            }
         }
     }
 
@@ -239,28 +268,29 @@ void slab_automove_extstore_run(void *arg, int *src, int *dst) {
         return;
 
     if (wg_sum.pool_high >= a->window_size && !wg_sum.pool_low && youngest != -1) {
-        /**src = 0;
-        *dst = youngest;*/
-        /* TODO: No current way to directly assign page from 0 to elsewhere.
-         * Do a hack by setting the youngest's free mem limiter to
-         * zero and re-running memcheck in the next second.
-         * If set rates are very high and the pool is too low, this can bottom
-         * out...
-         */
-        // schedule a memcheck run for "soon" to keep the limit zeroed out
-        // while the pool stays too high. This will also allow multiple
-        // classes to zero out over time.
-        a->last_memcheck_run = current_time - (MEMCHECK_PERIOD - 2);
-        a->settings->ext_free_memchunks[youngest] = 0;
+        if (a->sam_after[youngest].free_chunks <= a->free_mem[youngest]) {
+            *src = 0;
+            *dst = youngest;
+        }
+        struct window_data *wd = get_window_data(a, youngest);
+        // "relaxing" here and below allows us to skip classes which will
+        // never grow or are growing slowly, more quickly finding other
+        // classes which violate the age ratio.
+        wd->relaxed = 1;
     } else if (!too_free && wg_sum.pool_low && oldest != -1) {
         *src = oldest;
         *dst = 0;
     } else if (!too_free && youngest != -1 && oldest != -1 && youngest != oldest) {
         // if we have a youngest and oldest, and oldest is outside the ratio.
-        if (a->sam_after[youngest].free_chunks <= a->free_mem[youngest]
-                && youngest_age < ((double)oldest_age * a->max_age_ratio)) {
-            *src = oldest;
-            *dst = youngest;
+        if (youngest_age < ((double)oldest_age * a->max_age_ratio)) {
+            struct window_data *wd = get_window_data(a, youngest);
+            wd->relaxed = 1;
+            // only actually assign more memory if it's absorbed what it has
+            if (a->sam_after[youngest].free_chunks <= a->free_mem[youngest]) {
+                *src = 0;
+                *dst = youngest;
+
+            }
         }
     }
     return;
diff --git a/slabs.c b/slabs.c
index cedb1e8..200d575 100644
--- a/slabs.c
+++ b/slabs.c
@@ -678,7 +678,7 @@ static int slab_rebalance_start(void) {
 
     pthread_mutex_lock(&slabs_lock);
 
-    if (slab_rebal.s_clsid < POWER_SMALLEST ||
+    if (slab_rebal.s_clsid < SLAB_GLOBAL_PAGE_POOL ||
         slab_rebal.s_clsid > power_largest  ||
         slab_rebal.d_clsid < SLAB_GLOBAL_PAGE_POOL ||
         slab_rebal.d_clsid > power_largest  ||
@@ -707,8 +707,11 @@ static int slab_rebalance_start(void) {
         (s_cls->size * s_cls->perslab);
     slab_rebal.slab_pos   = slab_rebal.slab_start;
     slab_rebal.done       = 0;
+    // Don't need to do chunk move work if page is in global pool.
+    if (slab_rebal.s_clsid == SLAB_GLOBAL_PAGE_POOL) {
+        slab_rebal.done = 1;
+    }
 
-    /* Also tells do_item_get to search for items in this slab */
     slab_rebalance_signal = 2;
 
     if (settings.verbose > 1) {
@@ -862,7 +865,9 @@ static int slab_rebalance_move(void) {
                             // Only safe to hold slabs lock because refcount
                             // can't drop to 0 until we release item lock.
                             STORAGE_delete(storage, it);
+                            pthread_mutex_unlock(&slabs_lock);
                             do_item_unlink(it, hv);
+                            pthread_mutex_lock(&slabs_lock);
                         }
                         status = MOVE_BUSY;
                     } else {
@@ -1187,7 +1192,7 @@ static enum reassign_result_type do_slabs_reassign(int src, int dst) {
         /* TODO: If we end up back at -1, return a new error type */
     }
 
-    if (src < POWER_SMALLEST        || src > power_largest ||
+    if (src < SLAB_GLOBAL_PAGE_POOL || src > power_largest ||
         dst < SLAB_GLOBAL_PAGE_POOL || dst > power_largest)
         return REASSIGN_BADCLASS;
 
diff --git a/t/issue_67.t b/t/issue_67.t
index 69c869f..b2d374f 100644
--- a/t/issue_67.t
+++ b/t/issue_67.t
@@ -77,11 +77,11 @@ sub when {
 
 # Disabling the defaults since it conflicts with a running instance.
 # when('no arguments', '', 11211, 11211);
-when('specifying tcp port', '-p 11212', 11212, 11212);
+when('specifying tcp port', '-p 11212', 11212, -1);
 when('specifying udp port', '-U 11222', 11222, 11222);
 when('specifying tcp ephemeral port', '-p -1', 0, 0);
 when('specifying udp ephemeral port', '-U -1', 0, 0);
-when('tcp port disabled', '-p 0', -1, 11211);
+when('tcp port disabled', '-p 0', -1, -1);
 when('udp port disabled', '-U 0', 11211, -1);
 when('specifying tcp and udp ports', '-p 11232 -U 11233', 11232, 11233);
 when('specifying tcp and disabling udp', '-p 11242 -U 0', 11242, -1);
diff --git a/thread.c b/thread.c
index df05d5f..d17a387 100644
--- a/thread.c
+++ b/thread.c
@@ -309,7 +309,16 @@ void accept_new_conns(const bool do_accept) {
  * Set up a thread's information.
  */
 static void setup_thread(LIBEVENT_THREAD *me) {
+#if defined(LIBEVENT_VERSION_NUMBER) && LIBEVENT_VERSION_NUMBER >= 0x02000101
+    struct event_config *ev_config;
+    ev_config = event_config_new();
+    event_config_set_flag(ev_config, EVENT_BASE_FLAG_NOLOCK);
+    me->base = event_base_new_with_config(ev_config);
+    event_config_free(ev_config);
+#else
     me->base = event_init();
+#endif
+
     if (! me->base) {
         fprintf(stderr, "Can't allocate event base\n");
         exit(1);
@@ -374,6 +383,8 @@ static void *worker_libevent(void *arg) {
     register_thread_initialized();
 
     event_base_loop(me->base, 0);
+
+    event_base_free(me->base);
     return NULL;
 }
 
diff --git a/timedrun.c b/timedrun.c
index 6d7afb3..6888453 100644
--- a/timedrun.c
+++ b/timedrun.c
@@ -17,7 +17,7 @@ static void caught_signal(int which)
 static int wait_for_process(pid_t pid)
 {
     int rv = EX_SOFTWARE;
-    int stats = 0;
+    int status = 0;
     int i = 0;
     struct sigaction sig_handler;
 
@@ -32,12 +32,12 @@ static int wait_for_process(pid_t pid)
 
     /* Loop forever waiting for the process to quit */
     for (i = 0; ;i++) {
-        pid_t p = waitpid(pid, &stats, 0);
+        pid_t p = waitpid(pid, &status, 0);
         if (p == pid) {
             /* child exited.  Let's get out of here */
-            rv = WIFEXITED(stats) ?
-                WEXITSTATUS(stats) :
-                (0x80 | WTERMSIG(stats));
+            rv = WIFEXITED(status) ?
+                WEXITSTATUS(status) :
+                (0x80 | WTERMSIG(status));
             break;
         } else {
             int sig = 0;
diff --git a/trace.h b/trace.h
index dc792a0..94e585d 100644
--- a/trace.h
+++ b/trace.h
@@ -4,11 +4,11 @@
 #ifdef ENABLE_DTRACE
 #include "memcached_dtrace.h"
 #else
-#define MEMCACHED_ASSOC_DELETE(arg0, arg1, arg2)
+#define MEMCACHED_ASSOC_DELETE(arg0, arg1)
 #define MEMCACHED_ASSOC_DELETE_ENABLED() (0)
 #define MEMCACHED_ASSOC_FIND(arg0, arg1, arg2)
 #define MEMCACHED_ASSOC_FIND_ENABLED() (0)
-#define MEMCACHED_ASSOC_INSERT(arg0, arg1, arg2)
+#define MEMCACHED_ASSOC_INSERT(arg0, arg1)
 #define MEMCACHED_ASSOC_INSERT_ENABLED() (0)
 #define MEMCACHED_COMMAND_ADD(arg0, arg1, arg2, arg3, arg4)
 #define MEMCACHED_COMMAND_ADD_ENABLED() (0)
diff --git a/version.m4 b/version.m4
index d763a82..4a02156 100644
--- a/version.m4
+++ b/version.m4
@@ -1 +1 @@
-m4_define([VERSION_NUMBER], [1.5.4])
+m4_define([VERSION_NUMBER], [1.5.6])