1 files changed, 243 insertions, 318 deletions

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 1aad34ea61a4..0b73cd45a06d 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1,6 +1,6 @@
 /*
- *  fs/eventpoll.c ( Efficent event polling implementation )
- *  Copyright (C) 2001,...,2006  Davide Libenzi
+ *  fs/eventpoll.c (Efficent event polling implementation)
+ *  Copyright (C) 2001,...,2007  Davide Libenzi
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -26,7 +26,6 @@
 #include <linux/hash.h>
 #include <linux/spinlock.h>
 #include <linux/syscalls.h>
-#include <linux/rwsem.h>
 #include <linux/rbtree.h>
 #include <linux/wait.h>
 #include <linux/eventpoll.h>
@@ -39,15 +38,14 @@
 #include <asm/io.h>
 #include <asm/mman.h>
 #include <asm/atomic.h>
-#include <asm/semaphore.h>
 
 /*
  * LOCKING:
  * There are three level of locking required by epoll :
  *
  * 1) epmutex (mutex)
- * 2) ep->sem (rw_semaphore)
- * 3) ep->lock (rw_lock)
+ * 2) ep->mtx (mutex)
+ * 3) ep->lock (spinlock)
  *
  * The acquire order is the one listed above, from 1 to 3.
  * We need a spinlock (ep->lock) because we manipulate objects
@@ -57,20 +55,20 @@
  * a spinlock. During the event transfer loop (from kernel to
  * user space) we could end up sleeping due a copy_to_user(), so
  * we need a lock that will allow us to sleep. This lock is a
- * read-write semaphore (ep->sem). It is acquired on read during
- * the event transfer loop and in write during epoll_ctl(EPOLL_CTL_DEL)
- * and during eventpoll_release_file(). Then we also need a global
- * semaphore to serialize eventpoll_release_file() and ep_free().
- * This semaphore is acquired by ep_free() during the epoll file
+ * mutex (ep->mtx). It is acquired during the event transfer loop,
+ * during epoll_ctl(EPOLL_CTL_DEL) and during eventpoll_release_file().
+ * Then we also need a global mutex to serialize eventpoll_release_file()
+ * and ep_free().
+ * This mutex is acquired by ep_free() during the epoll file
  * cleanup path and it is also acquired by eventpoll_release_file()
  * if a file has been pushed inside an epoll set and it is then
  * close()d without a previous call toepoll_ctl(EPOLL_CTL_DEL).
- * It is possible to drop the "ep->sem" and to use the global
- * semaphore "epmutex" (together with "ep->lock") to have it working,
- * but having "ep->sem" will make the interface more scalable.
+ * It is possible to drop the "ep->mtx" and to use the global
+ * mutex "epmutex" (together with "ep->lock") to have it working,
+ * but having "ep->mtx" will make the interface more scalable.
  * Events that require holding "epmutex" are very rare, while for
- * normal operations the epoll private "ep->sem" will guarantee
- * a greater scalability.
+ * normal operations the epoll private "ep->mtx" will guarantee
+ * a better scalability.
  */
 
 #define DEBUG_EPOLL 0
@@ -102,6 +100,8 @@
 
 #define EP_MAX_EVENTS (INT_MAX / sizeof(struct epoll_event))
 
+#define EP_UNACTIVE_PTR ((void *) -1L)
+
 struct epoll_filefd {
         struct file *file;
         int fd;
@@ -111,7 +111,7 @@ struct epoll_filefd {
  * Node that is linked into the "wake_task_list" member of the "struct poll_safewake".
  * It is used to keep track on all tasks that are currently inside the wake_up() code
  * to 1) short-circuit the one coming from the same task and same wait queue head
- * ( loop ) 2) allow a maximum number of epoll descriptors inclusion nesting
+ * (loop) 2) allow a maximum number of epoll descriptors inclusion nesting
  * 3) let go the ones coming from other tasks.
  */
 struct wake_task_node {
@@ -130,21 +130,57 @@ struct poll_safewake {
 };
 
 /*
+ * Each file descriptor added to the eventpoll interface will
+ * have an entry of this type linked to the "rbr" RB tree.
+ */
+struct epitem {
+        /* RB tree node used to link this structure to the eventpoll RB tree */
+        struct rb_node rbn;
+
+        /* List header used to link this structure to the eventpoll ready list */
+        struct list_head rdllink;
+
+        /*
+         * Works together "struct eventpoll"->ovflist in keeping the
+         * single linked chain of items.
+         */
+        struct epitem *next;
+
+        /* The file descriptor information this item refers to */
+        struct epoll_filefd ffd;
+
+        /* Number of active wait queue attached to poll operations */
+        int nwait;
+
+        /* List containing poll wait queues */
+        struct list_head pwqlist;
+
+        /* The "container" of this item */
+        struct eventpoll *ep;
+
+        /* List header used to link this item to the "struct file" items list */
+        struct list_head fllink;
+
+        /* The structure that describe the interested events and the source fd */
+        struct epoll_event event;
+};
+
+/*
  * This structure is stored inside the "private_data" member of the file
  * structure and rapresent the main data sructure for the eventpoll
  * interface.
  */
 struct eventpoll {
         /* Protect the this structure access */
-        rwlock_t lock;
+        spinlock_t lock;
 
         /*
-         * This semaphore is used to ensure that files are not removed
-         * while epoll is using them. This is read-held during the event
-         * collection loop and it is write-held during the file cleanup
-         * path, the epoll file exit code and the ctl operations.
+         * This mutex is used to ensure that files are not removed
+         * while epoll is using them. This is held during the event
+         * collection loop, the file cleanup path, the epoll file exit
+         * code and the ctl operations.
          */
-        struct rw_semaphore sem;
+        struct mutex mtx;
 
         /* Wait queue used by sys_epoll_wait() */
         wait_queue_head_t wq;
@@ -155,8 +191,15 @@ struct eventpoll {
         /* List of ready file descriptors */
         struct list_head rdllist;
 
-        /* RB-Tree root used to store monitored fd structs */
+        /* RB tree root used to store monitored fd structs */
         struct rb_root rbr;
+
+        /*
+         * This is a single linked list that chains all the "struct epitem" that
+         * happened while transfering ready events to userspace w/out
+         * holding ->lock.
+         */
+        struct epitem *ovflist;
 };
 
 /* Wait structure used by the poll hooks */
@@ -177,42 +220,6 @@ struct eppoll_entry {
         wait_queue_head_t *whead;
 };
 
-/*
- * Each file descriptor added to the eventpoll interface will
- * have an entry of this type linked to the "rbr" RB tree.
- */
-struct epitem {
-        /* RB-Tree node used to link this structure to the eventpoll rb-tree */
-        struct rb_node rbn;
-
-        /* List header used to link this structure to the eventpoll ready list */
-        struct list_head rdllink;
-
-        /* The file descriptor information this item refers to */
-        struct epoll_filefd ffd;
-
-        /* Number of active wait queue attached to poll operations */
-        int nwait;
-
-        /* List containing poll wait queues */
-        struct list_head pwqlist;
-
-        /* The "container" of this item */
-        struct eventpoll *ep;
-
-        /* The structure that describe the interested events and the source fd */
-        struct epoll_event event;
-
-        /*
-         * Used to keep track of the usage count of the structure. This avoids
-         * that the structure will desappear from underneath our processing.
-         */
-        atomic_t usecnt;
-
-        /* List header used to link this item to the "struct file" items list */
-        struct list_head fllink;
-};
-
 /* Wrapper struct used by poll queueing */
 struct ep_pqueue {
         poll_table pt;
@@ -220,7 +227,7 @@ struct ep_pqueue {
 };
 
 /*
- * This semaphore is used to serialize ep_free() and eventpoll_release_file().
+ * This mutex is used to serialize ep_free() and eventpoll_release_file().
  */
 static struct mutex epmutex;
 
@@ -234,7 +241,7 @@ static struct kmem_cache *epi_cache __read_mostly;
 static struct kmem_cache *pwq_cache __read_mostly;
 
 
-/* Setup the structure that is used as key for the rb-tree */
+/* Setup the structure that is used as key for the RB tree */
 static inline void ep_set_ffd(struct epoll_filefd *ffd,
                               struct file *file, int fd)
 {
@@ -242,7 +249,7 @@ static inline void ep_set_ffd(struct epoll_filefd *ffd,
         ffd->fd = fd;
 }
 
-/* Compare rb-tree keys */
+/* Compare RB tree keys */
 static inline int ep_cmp_ffd(struct epoll_filefd *p1,
                              struct epoll_filefd *p2)
 {
@@ -250,20 +257,20 @@ static inline int ep_cmp_ffd(struct epoll_filefd *p1,
                 (p1->file < p2->file ? -1 : p1->fd - p2->fd));
 }
 
-/* Special initialization for the rb-tree node to detect linkage */
+/* Special initialization for the RB tree node to detect linkage */
 static inline void ep_rb_initnode(struct rb_node *n)
 {
         rb_set_parent(n, n);
 }
 
-/* Removes a node from the rb-tree and marks it for a fast is-linked check */
+/* Removes a node from the RB tree and marks it for a fast is-linked check */
 static inline void ep_rb_erase(struct rb_node *n, struct rb_root *r)
 {
         rb_erase(n, r);
         rb_set_parent(n, n);
 }
 
-/* Fast check to verify that the item is linked to the main rb-tree */
+/* Fast check to verify that the item is linked to the main RB tree */
 static inline int ep_rb_linked(struct rb_node *n)
 {
         return rb_parent(n) != n;
@@ -381,78 +388,11 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
 }
 
 /*
- * Unlink the "struct epitem" from all places it might have been hooked up.
- * This function must be called with write IRQ lock on "ep->lock".
- */
-static int ep_unlink(struct eventpoll *ep, struct epitem *epi)
-{
-        int error;
-
-        /*
-         * It can happen that this one is called for an item already unlinked.
-         * The check protect us from doing a double unlink ( crash ).
-         */
-        error = -ENOENT;
-        if (!ep_rb_linked(&epi->rbn))
-                goto error_return;
-
-        /*
-         * Clear the event mask for the unlinked item. This will avoid item
-         * notifications to be sent after the unlink operation from inside
-         * the kernel->userspace event transfer loop.
-         */
-        epi->event.events = 0;
-
-        /*
-         * At this point is safe to do the job, unlink the item from our rb-tree.
-         * This operation togheter with the above check closes the door to
-         * double unlinks.
-         */
-        ep_rb_erase(&epi->rbn, &ep->rbr);
-
-        /*
-         * If the item we are going to remove is inside the ready file descriptors
-         * we want to remove it from this list to avoid stale events.
-         */
-        if (ep_is_linked(&epi->rdllink))
-                list_del_init(&epi->rdllink);
-
-        error = 0;
-error_return:
-
-        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: ep_unlink(%p, %p) = %d\n",
-                     current, ep, epi->ffd.file, error));
-
-        return error;
-}
-
-/*
- * Increment the usage count of the "struct epitem" making it sure
- * that the user will have a valid pointer to reference.
- */
-static void ep_use_epitem(struct epitem *epi)
-{
-        atomic_inc(&epi->usecnt);
-}
-
-/*
- * Decrement ( release ) the usage count by signaling that the user
- * has finished using the structure. It might lead to freeing the
- * structure itself if the count goes to zero.
- */
-static void ep_release_epitem(struct epitem *epi)
-{
-        if (atomic_dec_and_test(&epi->usecnt))
-                kmem_cache_free(epi_cache, epi);
-}
-
-/*
  * Removes a "struct epitem" from the eventpoll RB tree and deallocates
- * all the associated resources.
+ * all the associated resources. Must be called with "mtx" held.
  */
 static int ep_remove(struct eventpoll *ep, struct epitem *epi)
 {
-        int error;
         unsigned long flags;
         struct file *file = epi->ffd.file;
 
@@ -472,26 +412,21 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
                 list_del_init(&epi->fllink);
         spin_unlock(&file->f_ep_lock);
 
-        /* We need to acquire the write IRQ lock before calling ep_unlink() */
-        write_lock_irqsave(&ep->lock, flags);
-
-        /* Really unlink the item from the RB tree */
-        error = ep_unlink(ep, epi);
-
-        write_unlock_irqrestore(&ep->lock, flags);
+        if (ep_rb_linked(&epi->rbn))
+                ep_rb_erase(&epi->rbn, &ep->rbr);
 
-        if (error)
-                goto error_return;
+        spin_lock_irqsave(&ep->lock, flags);
+        if (ep_is_linked(&epi->rdllink))
+                list_del_init(&epi->rdllink);
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         /* At this point it is safe to free the eventpoll item */
-        ep_release_epitem(epi);
+        kmem_cache_free(epi_cache, epi);
 
-        error = 0;
-error_return:
-        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: ep_remove(%p, %p) = %d\n",
-                     current, ep, file, error));
+        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: ep_remove(%p, %p)\n",
+                     current, ep, file));
 
-        return error;
+        return 0;
 }
 
 static void ep_free(struct eventpoll *ep)
@@ -506,7 +441,7 @@ static void ep_free(struct eventpoll *ep)
         /*
          * We need to lock this because we could be hit by
          * eventpoll_release_file() while we're freeing the "struct eventpoll".
-         * We do not need to hold "ep->sem" here because the epoll file
+         * We do not need to hold "ep->mtx" here because the epoll file
          * is on the way to be removed and no one has references to it
          * anymore. The only hit might come from eventpoll_release_file() but
          * holding "epmutex" is sufficent here.
@@ -525,7 +460,7 @@ static void ep_free(struct eventpoll *ep)
         /*
          * Walks through the whole tree by freeing each "struct epitem". At this
          * point we are sure no poll callbacks will be lingering around, and also by
-         * write-holding "sem" we can be sure that no file cleanup code will hit
+         * holding "epmutex" we can be sure that no file cleanup code will hit
          * us during this operation. So we can avoid the lock on "ep->lock".
          */
         while ((rbp = rb_first(&ep->rbr)) != 0) {
@@ -534,16 +469,16 @@ static void ep_free(struct eventpoll *ep)
         }
 
         mutex_unlock(&epmutex);
+        mutex_destroy(&ep->mtx);
+        kfree(ep);
 }
 
 static int ep_eventpoll_release(struct inode *inode, struct file *file)
 {
         struct eventpoll *ep = file->private_data;
 
-        if (ep) {
+        if (ep)
                 ep_free(ep);
-                kfree(ep);
-        }
 
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: close() ep=%p\n", current, ep));
         return 0;
@@ -559,10 +494,10 @@ static unsigned int ep_eventpoll_poll(struct file *file, poll_table *wait)
         poll_wait(file, &ep->poll_wait, wait);
 
         /* Check our condition */
-        read_lock_irqsave(&ep->lock, flags);
+        spin_lock_irqsave(&ep->lock, flags);
         if (!list_empty(&ep->rdllist))
                 pollflags = POLLIN | POLLRDNORM;
-        read_unlock_irqrestore(&ep->lock, flags);
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         return pollflags;
 }
@@ -594,9 +529,11 @@ void eventpoll_release_file(struct file *file)
          * We don't want to get "file->f_ep_lock" because it is not
          * necessary. It is not necessary because we're in the "struct file"
          * cleanup path, and this means that noone is using this file anymore.
-         * The only hit might come from ep_free() but by holding the semaphore
+         * So, for example, epoll_ctl() cannot hit here sicne if we reach this
+         * point, the file counter already went to zero and fget() would fail.
+         * The only hit might come from ep_free() but by holding the mutex
          * will correctly serialize the operation. We do need to acquire
-         * "ep->sem" after "epmutex" because ep_remove() requires it when called
+         * "ep->mtx" after "epmutex" because ep_remove() requires it when called
          * from anywhere but ep_free().
          */
         mutex_lock(&epmutex);
@@ -606,9 +543,9 @@ void eventpoll_release_file(struct file *file)
 
                 ep = epi->ep;
                 list_del_init(&epi->fllink);
-                down_write(&ep->sem);
+                mutex_lock(&ep->mtx);
                 ep_remove(ep, epi);
-                up_write(&ep->sem);
+                mutex_unlock(&ep->mtx);
         }
 
         mutex_unlock(&epmutex);
@@ -621,12 +558,13 @@ static int ep_alloc(struct eventpoll **pep)
         if (!ep)
                 return -ENOMEM;
 
-        rwlock_init(&ep->lock);
-        init_rwsem(&ep->sem);
+        spin_lock_init(&ep->lock);
+        mutex_init(&ep->mtx);
         init_waitqueue_head(&ep->wq);
         init_waitqueue_head(&ep->poll_wait);
         INIT_LIST_HEAD(&ep->rdllist);
         ep->rbr = RB_ROOT;
+        ep->ovflist = EP_UNACTIVE_PTR;
 
         *pep = ep;
 
@@ -636,20 +574,18 @@ static int ep_alloc(struct eventpoll **pep)
 }
 
 /*
- * Search the file inside the eventpoll tree. It add usage count to
- * the returned item, so the caller must call ep_release_epitem()
- * after finished using the "struct epitem".
+ * Search the file inside the eventpoll tree. The RB tree operations
+ * are protected by the "mtx" mutex, and ep_find() must be called with
+ * "mtx" held.
  */
 static struct epitem *ep_find(struct eventpoll *ep, struct file *file, int fd)
 {
         int kcmp;
-        unsigned long flags;
         struct rb_node *rbp;
         struct epitem *epi, *epir = NULL;
         struct epoll_filefd ffd;
 
         ep_set_ffd(&ffd, file, fd);
-        read_lock_irqsave(&ep->lock, flags);
         for (rbp = ep->rbr.rb_node; rbp; ) {
                 epi = rb_entry(rbp, struct epitem, rbn);
                 kcmp = ep_cmp_ffd(&ffd, &epi->ffd);
@@ -658,12 +594,10 @@ static struct epitem *ep_find(struct eventpoll *ep, struct file *file, int fd)
                 else if (kcmp < 0)
                         rbp = rbp->rb_left;
                 else {
-                        ep_use_epitem(epi);
                         epir = epi;
                         break;
                 }
         }
-        read_unlock_irqrestore(&ep->lock, flags);
 
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: ep_find(%p) -> %p\n",
                      current, file, epir));
@@ -686,7 +620,7 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: poll_callback(%p) epi=%p ep=%p\n",
                      current, epi->ffd.file, epi, ep));
 
-        write_lock_irqsave(&ep->lock, flags);
+        spin_lock_irqsave(&ep->lock, flags);
 
         /*
          * If the event mask does not contain any poll(2) event, we consider the
@@ -695,7 +629,21 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
          * until the next EPOLL_CTL_MOD will be issued.
          */
         if (!(epi->event.events & ~EP_PRIVATE_BITS))
-                goto is_disabled;
+                goto out_unlock;
+
+        /*
+         * If we are trasfering events to userspace, we can hold no locks
+         * (because we're accessing user memory, and because of linux f_op->poll()
+         * semantics). All the events that happens during that period of time are
+         * chained in ep->ovflist and requeued later on.
+         */
+        if (unlikely(ep->ovflist != EP_UNACTIVE_PTR)) {
+                if (epi->next == EP_UNACTIVE_PTR) {
+                        epi->next = ep->ovflist;
+                        ep->ovflist = epi;
+                }
+                goto out_unlock;
+        }
 
         /* If this file is already in the ready list we exit soon */
         if (ep_is_linked(&epi->rdllink))
@@ -714,8 +662,8 @@ is_linked:
         if (waitqueue_active(&ep->poll_wait))
                 pwake++;
 
-is_disabled:
-        write_unlock_irqrestore(&ep->lock, flags);
+out_unlock:
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         /* We have to call this outside the lock */
         if (pwake)
@@ -766,6 +714,9 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
         rb_insert_color(&epi->rbn, &ep->rbr);
 }
 
+/*
+ * Must be called with "mtx" held.
+ */
 static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
                      struct file *tfile, int fd)
 {
@@ -786,8 +737,8 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
         epi->ep = ep;
         ep_set_ffd(&epi->ffd, tfile, fd);
         epi->event = *event;
-        atomic_set(&epi->usecnt, 1);
         epi->nwait = 0;
+        epi->next = EP_UNACTIVE_PTR;
 
         /* Initialize the poll table using the queue callback */
         epq.epi = epi;
@@ -796,7 +747,9 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
         /*
          * Attach the item to the poll hooks and get current event bits.
          * We can safely use the file* here because its usage count has
-         * been increased by the caller of this function.
+         * been increased by the caller of this function. Note that after
+         * this operation completes, the poll callback can start hitting
+         * the new item.
          */
         revents = tfile->f_op->poll(tfile, &epq.pt);
 
@@ -813,12 +766,15 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
         list_add_tail(&epi->fllink, &tfile->f_ep_links);
         spin_unlock(&tfile->f_ep_lock);
 
-        /* We have to drop the new item inside our item list to keep track of it */
-        write_lock_irqsave(&ep->lock, flags);
-
-        /* Add the current item to the rb-tree */
+        /*
+         * Add the current item to the RB tree. All RB tree operations are
+         * protected by "mtx", and ep_insert() is called with "mtx" held.
+         */
         ep_rbtree_insert(ep, epi);
 
+        /* We have to drop the new item inside our item list to keep track of it */
+        spin_lock_irqsave(&ep->lock, flags);
+
         /* If the file is already "ready" we drop it inside the ready list */
         if ((revents & event->events) && !ep_is_linked(&epi->rdllink)) {
                 list_add_tail(&epi->rdllink, &ep->rdllist);
@@ -830,7 +786,7 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
                         pwake++;
         }
 
-        write_unlock_irqrestore(&ep->lock, flags);
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         /* We have to call this outside the lock */
         if (pwake)
@@ -846,12 +802,14 @@ error_unregister:
 
         /*
          * We need to do this because an event could have been arrived on some
-         * allocated wait queue.
+         * allocated wait queue. Note that we don't care about the ep->ovflist
+         * list, since that is used/cleaned only inside a section bound by "mtx".
+         * And ep_insert() is called with "mtx" held.
          */
-        write_lock_irqsave(&ep->lock, flags);
+        spin_lock_irqsave(&ep->lock, flags);
         if (ep_is_linked(&epi->rdllink))
                 list_del_init(&epi->rdllink);
-        write_unlock_irqrestore(&ep->lock, flags);
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         kmem_cache_free(epi_cache, epi);
 error_return:
@@ -860,7 +818,7 @@ error_return:
 
 /*
  * Modify the interest event mask by dropping an event if the new mask
- * has a match in the current file status.
+ * has a match in the current file status. Must be called with "mtx" held.
  */
 static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_event *event)
 {
@@ -882,36 +840,28 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
          */
         revents = epi->ffd.file->f_op->poll(epi->ffd.file, NULL);
 
-        write_lock_irqsave(&ep->lock, flags);
+        spin_lock_irqsave(&ep->lock, flags);
 
         /* Copy the data member from inside the lock */
         epi->event.data = event->data;
 
         /*
-         * If the item is not linked to the RB tree it means that it's on its
-         * way toward the removal. Do nothing in this case.
+         * If the item is "hot" and it is not registered inside the ready
+         * list, push it inside.
          */
-        if (ep_rb_linked(&epi->rbn)) {
-                /*
-                 * If the item is "hot" and it is not registered inside the ready
-                 * list, push it inside. If the item is not "hot" and it is currently
-                 * registered inside the ready list, unlink it.
-                 */
-                if (revents & event->events) {
-                        if (!ep_is_linked(&epi->rdllink)) {
-                                list_add_tail(&epi->rdllink, &ep->rdllist);
-
-                                /* Notify waiting tasks that events are available */
-                                if (waitqueue_active(&ep->wq))
-                                        __wake_up_locked(&ep->wq, TASK_UNINTERRUPTIBLE |
-                                                         TASK_INTERRUPTIBLE);
-                                if (waitqueue_active(&ep->poll_wait))
-                                        pwake++;
-                        }
+        if (revents & event->events) {
+                if (!ep_is_linked(&epi->rdllink)) {
+                        list_add_tail(&epi->rdllink, &ep->rdllist);
+
+                        /* Notify waiting tasks that events are available */
+                        if (waitqueue_active(&ep->wq))
+                                __wake_up_locked(&ep->wq, TASK_UNINTERRUPTIBLE |
+                                                 TASK_INTERRUPTIBLE);
+                        if (waitqueue_active(&ep->poll_wait))
+                                pwake++;
                 }
         }
-
-        write_unlock_irqrestore(&ep->lock, flags);
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         /* We have to call this outside the lock */
         if (pwake)
@@ -920,36 +870,50 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
         return 0;
 }
 
-/*
- * This function is called without holding the "ep->lock" since the call to
- * __copy_to_user() might sleep, and also f_op->poll() might reenable the IRQ
- * because of the way poll() is traditionally implemented in Linux.
- */
-static int ep_send_events(struct eventpoll *ep, struct list_head *txlist,
-                          struct epoll_event __user *events, int maxevents)
+static int ep_send_events(struct eventpoll *ep, struct epoll_event __user *events,
+                          int maxevents)
 {
         int eventcnt, error = -EFAULT, pwake = 0;
         unsigned int revents;
         unsigned long flags;
-        struct epitem *epi;
-        struct list_head injlist;
+        struct epitem *epi, *nepi;
+        struct list_head txlist;
+
+        INIT_LIST_HEAD(&txlist);
+
+        /*
+         * We need to lock this because we could be hit by
+         * eventpoll_release_file() and epoll_ctl(EPOLL_CTL_DEL).
+         */
+        mutex_lock(&ep->mtx);
 
-        INIT_LIST_HEAD(&injlist);
+        /*
+         * Steal the ready list, and re-init the original one to the
+         * empty list. Also, set ep->ovflist to NULL so that events
+         * happening while looping w/out locks, are not lost. We cannot
+         * have the poll callback to queue directly on ep->rdllist,
+         * because we are doing it in the loop below, in a lockless way.
+         */
+        spin_lock_irqsave(&ep->lock, flags);
+        list_splice(&ep->rdllist, &txlist);
+        INIT_LIST_HEAD(&ep->rdllist);
+        ep->ovflist = NULL;
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         /*
          * We can loop without lock because this is a task private list.
          * We just splice'd out the ep->rdllist in ep_collect_ready_items().
-         * Items cannot vanish during the loop because we are holding "sem" in
-         * read.
+         * Items cannot vanish during the loop because we are holding "mtx".
          */
-        for (eventcnt = 0; !list_empty(txlist) && eventcnt < maxevents;) {
-                epi = list_first_entry(txlist, struct epitem, rdllink);
-                prefetch(epi->rdllink.next);
+        for (eventcnt = 0; !list_empty(&txlist) && eventcnt < maxevents;) {
+                epi = list_first_entry(&txlist, struct epitem, rdllink);
+
+                list_del_init(&epi->rdllink);
 
                 /*
                  * Get the ready file event set. We can safely use the file
-                 * because we are holding the "sem" in read and this will
-                 * guarantee that both the file and the item will not vanish.
+                 * because we are holding the "mtx" and this will guarantee
+                 * that both the file and the item will not vanish.
                  */
                 revents = epi->ffd.file->f_op->poll(epi->ffd.file, NULL);
                 revents &= epi->event.events;
@@ -957,8 +921,8 @@ static int ep_send_events(struct eventpoll *ep, struct list_head *txlist,
                 /*
                  * Is the event mask intersect the caller-requested one,
                  * deliver the event to userspace. Again, we are holding
-                 * "sem" in read, so no operations coming from userspace
-                 * can change the item.
+                 * "mtx", so no operations coming from userspace can change
+                 * the item.
                  */
                 if (revents) {
                         if (__put_user(revents,
@@ -970,59 +934,59 @@ static int ep_send_events(struct eventpoll *ep, struct list_head *txlist,
                                 epi->event.events &= EP_PRIVATE_BITS;
                         eventcnt++;
                 }
-
                 /*
-                 * This is tricky. We are holding the "sem" in read, and this
-                 * means that the operations that can change the "linked" status
-                 * of the epoll item (epi->rbn and epi->rdllink), cannot touch
-                 * them.  Also, since we are "linked" from a epi->rdllink POV
-                 * (the item is linked to our transmission list we just
-                 * spliced), the ep_poll_callback() cannot touch us either,
-                 * because of the check present in there. Another parallel
-                 * epoll_wait() will not get the same result set, since we
-                 * spliced the ready list before.  Note that list_del() still
-                 * shows the item as linked to the test in ep_poll_callback().
+                 * At this point, noone can insert into ep->rdllist besides
+                 * us. The epoll_ctl() callers are locked out by us holding
+                 * "mtx" and the poll callback will queue them in ep->ovflist.
                  */
-                list_del(&epi->rdllink);
                 if (!(epi->event.events & EPOLLET) &&
-                                (revents & epi->event.events))
-                        list_add_tail(&epi->rdllink, &injlist);
-                else {
-                        /*
-                         * Be sure the item is totally detached before re-init
-                         * the list_head. After INIT_LIST_HEAD() is committed,
-                         * the ep_poll_callback() can requeue the item again,
-                         * but we don't care since we are already past it.
-                         */
-                        smp_mb();
-                        INIT_LIST_HEAD(&epi->rdllink);
-                }
+                    (revents & epi->event.events))
+                        list_add_tail(&epi->rdllink, &ep->rdllist);
         }
         error = 0;
 
-        errxit:
+errxit:
 
+        spin_lock_irqsave(&ep->lock, flags);
         /*
-         * If the re-injection list or the txlist are not empty, re-splice
-         * them to the ready list and do proper wakeups.
+         * During the time we spent in the loop above, some other events
+         * might have been queued by the poll callback. We re-insert them
+         * here (in case they are not already queued, or they're one-shot).
          */
-        if (!list_empty(&injlist) || !list_empty(txlist)) {
-                write_lock_irqsave(&ep->lock, flags);
+        for (nepi = ep->ovflist; (epi = nepi) != NULL;
+             nepi = epi->next, epi->next = EP_UNACTIVE_PTR) {
+                if (!ep_is_linked(&epi->rdllink) &&
+                    (epi->event.events & ~EP_PRIVATE_BITS))
+                        list_add_tail(&epi->rdllink, &ep->rdllist);
+        }
+        /*
+         * We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after
+         * releasing the lock, events will be queued in the normal way inside
+         * ep->rdllist.
+         */
+        ep->ovflist = EP_UNACTIVE_PTR;
+
+        /*
+         * In case of error in the event-send loop, or in case the number of
+         * ready events exceeds the userspace limit, we need to splice the
+         * "txlist" back inside ep->rdllist.
+         */
+        list_splice(&txlist, &ep->rdllist);
 
-                list_splice(txlist, &ep->rdllist);
-                list_splice(&injlist, &ep->rdllist);
+        if (!list_empty(&ep->rdllist)) {
                 /*
-                 * Wake up ( if active ) both the eventpoll wait list and the ->poll()
-                 * wait list.
+                 * Wake up (if active) both the eventpoll wait list and the ->poll()
+                 * wait list (delayed after we release the lock).
                  */
                 if (waitqueue_active(&ep->wq))
                         __wake_up_locked(&ep->wq, TASK_UNINTERRUPTIBLE |
                                          TASK_INTERRUPTIBLE);
                 if (waitqueue_active(&ep->poll_wait))
                         pwake++;
-
-                write_unlock_irqrestore(&ep->lock, flags);
         }
+        spin_unlock_irqrestore(&ep->lock, flags);
+
+        mutex_unlock(&ep->mtx);
 
         /* We have to call this outside the lock */
         if (pwake)
@@ -1031,41 +995,6 @@ static int ep_send_events(struct eventpoll *ep, struct list_head *txlist,
         return eventcnt == 0 ? error: eventcnt;
 }
 
-/*
- * Perform the transfer of events to user space.
- */
-static int ep_events_transfer(struct eventpoll *ep,
-                              struct epoll_event __user *events, int maxevents)
-{
-        int eventcnt;
-        unsigned long flags;
-        struct list_head txlist;
-
-        INIT_LIST_HEAD(&txlist);
-
-        /*
-         * We need to lock this because we could be hit by
-         * eventpoll_release_file() and epoll_ctl(EPOLL_CTL_DEL).
-         */
-        down_read(&ep->sem);
-
-        /*
-         * Steal the ready list, and re-init the original one to the
-         * empty list.
-         */
-        write_lock_irqsave(&ep->lock, flags);
-        list_splice(&ep->rdllist, &txlist);
-        INIT_LIST_HEAD(&ep->rdllist);
-        write_unlock_irqrestore(&ep->lock, flags);
-
-        /* Build result set in userspace */
-        eventcnt = ep_send_events(ep, &txlist, events, maxevents);
-
-        up_read(&ep->sem);
-
-        return eventcnt;
-}
-
 static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
                    int maxevents, long timeout)
 {
@@ -1083,7 +1012,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
                 MAX_SCHEDULE_TIMEOUT : (timeout * HZ + 999) / 1000;
 
 retry:
-        write_lock_irqsave(&ep->lock, flags);
+        spin_lock_irqsave(&ep->lock, flags);
 
         res = 0;
         if (list_empty(&ep->rdllist)) {
@@ -1093,6 +1022,7 @@ retry:
                  * ep_poll_callback() when events will become available.
                  */
                 init_waitqueue_entry(&wait, current);
+                wait.flags |= WQ_FLAG_EXCLUSIVE;
                 __add_wait_queue(&ep->wq, &wait);
 
                 for (;;) {
@@ -1109,9 +1039,9 @@ retry:
                                 break;
                         }
 
-                        write_unlock_irqrestore(&ep->lock, flags);
+                        spin_unlock_irqrestore(&ep->lock, flags);
                         jtimeout = schedule_timeout(jtimeout);
-                        write_lock_irqsave(&ep->lock, flags);
+                        spin_lock_irqsave(&ep->lock, flags);
                 }
                 __remove_wait_queue(&ep->wq, &wait);
 
@@ -1121,7 +1051,7 @@ retry:
         /* Is it worth to try to dig for events ? */
         eavail = !list_empty(&ep->rdllist);
 
-        write_unlock_irqrestore(&ep->lock, flags);
+        spin_unlock_irqrestore(&ep->lock, flags);
 
         /*
          * Try to transfer events to user space. In case we get 0 events and
@@ -1129,18 +1059,17 @@ retry:
          * more luck.
          */
         if (!res && eavail &&
-            !(res = ep_events_transfer(ep, events, maxevents)) && jtimeout)
+            !(res = ep_send_events(ep, events, maxevents)) && jtimeout)
                 goto retry;
 
         return res;
 }
 
 /*
- * It opens an eventpoll file descriptor by suggesting a storage of "size"
- * file descriptors. The size parameter is just an hint about how to size
- * data structures. It won't prevent the user to store more than "size"
- * file descriptors inside the epoll interface. It is the kernel part of
- * the userspace epoll_create(2).
+ * It opens an eventpoll file descriptor. The "size" parameter is there
+ * for historical reasons, when epoll was using an hash instead of an
+ * RB tree. With the current implementation, the "size" parameter is ignored
+ * (besides sanity checks).
  */
 asmlinkage long sys_epoll_create(int size)
 {
@@ -1176,7 +1105,6 @@ asmlinkage long sys_epoll_create(int size)
 
 error_free:
         ep_free(ep);
-        kfree(ep);
 error_return:
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
                      current, size, error));
@@ -1186,8 +1114,7 @@ error_return:
 /*
  * The following function implements the controller interface for
  * the eventpoll file that enables the insertion/removal/change of
- * file descriptors inside the interest set.  It represents
- * the kernel part of the user space epoll_ctl(2).
+ * file descriptors inside the interest set.
  */
 asmlinkage long sys_epoll_ctl(int epfd, int op, int fd,
                               struct epoll_event __user *event)
@@ -1237,9 +1164,13 @@ asmlinkage long sys_epoll_ctl(int epfd, int op, int fd,
          */
         ep = file->private_data;
 
-        down_write(&ep->sem);
+        mutex_lock(&ep->mtx);
 
-        /* Try to lookup the file inside our RB tree */
+        /*
+         * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
+         * above, we can be sure to be able to use the item looked up by
+         * ep_find() till we release the mutex.
+         */
         epi = ep_find(ep, tfile, fd);
 
         error = -EINVAL;
@@ -1266,13 +1197,7 @@ asmlinkage long sys_epoll_ctl(int epfd, int op, int fd,
                         error = -ENOENT;
                 break;
         }
-        /*
-         * The function ep_find() increments the usage count of the structure
-         * so, if this is not NULL, we need to release it.
-         */
-        if (epi)
-                ep_release_epitem(epi);
-        up_write(&ep->sem);
+        mutex_unlock(&ep->mtx);
 
 error_tgt_fput:
         fput(tfile);
@@ -1378,7 +1303,7 @@ asmlinkage long sys_epoll_pwait(int epfd, struct epoll_event __user *events,
         if (sigmask) {
                 if (error == -EINTR) {
                         memcpy(&current->saved_sigmask, &sigsaved,
-                                sizeof(sigsaved));
+                               sizeof(sigsaved));
                         set_thread_flag(TIF_RESTORE_SIGMASK);
                 } else
                         sigprocmask(SIG_SETMASK, &sigsaved, NULL);