What's the advantage of using epoll_create1() instead of epoll_create()

With epoll_wait(), maxevents tells you you maximum number of events that will be returned to you. It has nothing to do with how many are maintained within the kernel.

Older versions of epoll_create() used the size to set certain limits but that's no longer done, hence the comment that the size argument is obsolete. This is made evident by the source code (in fs/eventpoll.c as at the time of this answer):

SYSCALL_DEFINE1(epoll_create1, int, flags) {
    return do_epoll_create(flags);
}
SYSCALL_DEFINE1(epoll_create, int, size) {
    if (size <= 0) return -EINVAL;
    return do_epoll_create(0);
}

You can see that they're almost identical except that:

• epoll_create1() accepts flags, passing them on to do_epoll_create();
• epoll_create() accepts size, checking it, but otherwise ignoring it;
• epoll_create() passes default flags (none) to do_epoll_create().

Hence the advantage of using epoll_create1() is that it allows you to specify the flags, which I think are currently limited to close-on-exec (so that the file descriptor is automatically closed when exec-ing another program).

the epoll_create1() supply a way to set a flag. Needless to set the size now.

actually in the kernel source code: /fs/eventpoll.c

SYSCALL_DEFINE1(epoll_create, int, size)
{
    if (size <= 0)
        return -EINVAL;

    return sys_epoll_create1(0);
}

the epoll_wait() paramete max_events is for controlling return fd count not the total fd count in the whole eventpoll struct