chrdev: allocate dynamic chardevs in all unused holes

This is a duct-tape-and-chewing-gum solution to the problem
with the major numbers running out when allocating major
numbers dynamically.

To avoid collisions in the major space, we supply a bitmap with
"holes" that exist in the lower range of major numbers [0-254]
and pick numbers from there, beginning with the unused char
device 8 and moving up through 26, 40, 60-63, 93-94, 102,
120-127, 159, 213-215, 222-223 and 234-254.

The algorithm will behave like the old dynamic assignment
to begin with: dynamic majors will be assigned starting with
254, 253, ... but when it reaches 234 it will make a jump
and assign 223 and so on.

It will also FAIL if we actually fill up all free major
numbers. This seems to me like the reasonable thing to do
since the other numbers are, after all, reserved.

This also deletes the comment /* temporary */ which must be
one of the biggest lies ever.

This also updates the Documentation/devices.txt document to
reflect that all these numbers are used for dynamic assignment.

Reported-by: Ying Huang <ying.huang@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
---
ChangeLog v4->v5:
- Create a new macro, BITS32() in <linux/bitops.> that allow
  us to make an intuitive bitmask for the existing major
  number. This reuses GENMASK(), clamps the arguments and
  switch them around: to me it is atleast most intuitive to
  have the lower bit before the higher one.
- Use BITS32() and BIT_MASK() to define the bitlist for
  available devices.
- Assign dynamic majors from the top down (254, 253...) like
  the old code was doing. I tried assigning bottom up
  (8, 20,...) but that gave rise to "interesting" phenomena
  on Intels test servers running random QEMU: character
  devices in the lower range would stop probing properly,
  even if they have a major number not colliding with the
  dynamic assignment. At one time IDE tape (major 37) and
  one time ISDN (major 45). No clue as to why.
ChangeLog v3->v4:
- Create the BITS() macro in a separate patch. This was
  more tangled up than I thought, as the nice build servers
  quickly told me.
ChangeLog v2->v3:
- Of course I had a dangling hunk for pr_dbg()->pr_debug()
  in my working tree. Mea culpa.
- Fix the redefinition of BITS() in select.c to use the
  more precise name FDS_BITS() over the generic plural.
ChangeLog v1->v2:
- Follow-up on the previous RFC patch, this uses Torvald's
  suggested bitmap approach to allocate devices instead of
  a list of free numbers.
- As a result of using find_first_zero_bit(), the major
  numbers are assigned from low to high instead from high
  to low. It's a bit scarier but I guess drivers using
  dynamic numbers should be all right with it, I'm more
  worried about userspaces expecting dynamic majors to
  be in the [234,254] range. Input welcome, maybe I'm
  just chicken.
- This still needs to be applied on top of the previous
  fix to start warning about going below major 234. If
  you prefer to just get this patch and get rid of the
  problem then tell me.
diff --git a/Documentation/devices.txt b/Documentation/devices.txt
index 4035eca..2a4242b 100644
--- a/Documentation/devices.txt
+++ b/Documentation/devices.txt
@@ -248,6 +248,8 @@
 		associated with block devices.	The binding to the
 		loop devices is handled by mount(8) or losetup(8).
 
+  8 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
+
   8 block	SCSI disk devices (0-15)
 		  0 = /dev/sda		First SCSI disk whole disk
 		 16 = /dev/sdb		Second SCSI disk whole disk
@@ -620,7 +622,7 @@
 		  2 = /dev/sbpcd2	Panasonic CD-ROM controller 0 unit 2
 		  3 = /dev/sbpcd3	Panasonic CD-ROM controller 0 unit 3
 
- 26 char
+ 26 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  26 block	Second Matsushita (Panasonic/SoundBlaster) CD-ROM
 		  0 = /dev/sbpcd4	Panasonic CD-ROM controller 1 unit 0
@@ -863,7 +865,7 @@
 		      ...
  39 block
 
- 40 char
+ 40 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  40 block
 
@@ -1127,7 +1129,7 @@
 
 		NAMING CONFLICT -- PROPOSED REVISED NAME /dev/rpda0 etc
 
- 60-63 char	LOCAL/EXPERIMENTAL USE
+ 60-63 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  60-63 block	LOCAL/EXPERIMENTAL USE
 		Allocated for local/experimental use.  For devices not
@@ -1641,7 +1643,7 @@
 		disks (see major number 3) except that the limit on
 		partitions is 15.
 
- 93 char
+ 93 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  93 block	NAND Flash Translation Layer filesystem
 		  0 = /dev/nftla	First NFTL layer
@@ -1649,7 +1651,7 @@
 		    ...
 		240 = /dev/nftlp	16th NTFL layer
 
- 94 char
+ 94 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  94 block	IBM S/390 DASD block storage
     		  0 = /dev/dasda First DASD device, major
@@ -1742,7 +1744,7 @@
 		    ...
 		 15 = /dev/amiraid/ar?p15 15th partition
 
-102 char
+102 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
 102 block	Compressed block device
 		  0 = /dev/cbd/a	First compressed block device, whole device
@@ -2027,7 +2029,7 @@
 		  1 = /dev/vnet1	2nd virtual network
 		    ...
 
-120-127 char	LOCAL/EXPERIMENTAL USE
+120-127 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
 120-127 block	LOCAL/EXPERIMENTAL USE
 		Allocated for local/experimental use.  For devices not
@@ -2341,7 +2343,7 @@
 		  1 = /dev/gfax1	GammaLink channel 1
 		    ...
 
-159 char	RESERVED
+159 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
 159 block	RESERVED
 
@@ -2929,6 +2931,8 @@
 		    ...
 		196 = /dev/dvb/adapter3/video0    first video decoder of fourth card
 
+213-215 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
+
 216 char	Bluetooth RFCOMM TTY devices
 		  0 = /dev/rfcomm0		First Bluetooth RFCOMM TTY device
 		  1 = /dev/rfcomm1		Second Bluetooth RFCOMM TTY device
@@ -2971,6 +2975,8 @@
 		same interface.  For interface documentation see
 		http://www.vmelinux.org/.
 
+222-223 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
+
 224 char	A2232 serial card
 		  0 = /dev/ttyY0		First A2232 port
 		  1 = /dev/ttyY1		Second A2232 port
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 687471d..b647cc8 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -21,6 +21,8 @@
 #include <linux/mutex.h>
 #include <linux/backing-dev.h>
 #include <linux/tty.h>
+#include <linux/bitmap.h>
+#include <linux/bitops.h>
 
 #include "internal.h"
 
@@ -37,6 +39,31 @@
 	struct cdev *cdev;		/* will die */
 } *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
 
+/*
+ * A bitmap for the 255 lower device numbers. A "1" means the
+ * major number is taken, a "0" means it is available. We first
+ * need to define all the assigned devices as taken so that
+ * dynamic device allocation will not go in and steal them.
+ */
+static unsigned long majors_map[] = {
+	/* 8 and 26 are free */
+	BITS32(0, 7) | BITS32(9, 25) | BITS32(27, 31),
+	/* 40 and 60-63 are free */
+	BITS32(32, 39) | BITS32(41, 59),
+	/* 93 and 94 are free */
+	BITS32(64, 92) | BIT_MASK(95),
+	/* 102 and 120-127 are free */
+	BITS32(96, 101) | BITS32(103, 119),
+	/* 159 is free */
+	BITS32(128, 158),
+	/* No free numbers */
+	~0x0U,
+	/* 213-215 and 222-223 are free */
+	BITS32(192, 212) | BITS32(216, 221),
+	/* 234-254 are free */
+	BITS32(224, 233) | BIT_MASK(255)
+};
+
 /* index in the above */
 static inline int major_to_index(unsigned major)
 {
@@ -84,22 +111,25 @@
 
 	mutex_lock(&chrdevs_lock);
 
-	/* temporary */
 	if (major == 0) {
-		for (i = ARRAY_SIZE(chrdevs)-1; i > 0; i--) {
-			if (chrdevs[i] == NULL)
-				break;
-		}
-
-		if (i < CHRDEV_MAJOR_DYN_END)
-			pr_warn("CHRDEV \"%s\" major number %d goes below the dynamic allocation range",
-				name, i);
-
-		if (i == 0) {
+		i = find_first_zero_bit(majors_map, CHRDEV_MAJOR_HASH_SIZE);
+		if (i == CHRDEV_MAJOR_HASH_SIZE) {
+			pr_warn("CHRDEV: \"%s\" out of major numbers",
+				name);
 			ret = -EBUSY;
 			goto out;
 		}
-		major = i;
+		/* Allocate from the top (254 and down) */
+		while (i != CHRDEV_MAJOR_HASH_SIZE) {
+			major = i;
+			i++;
+			i = find_next_zero_bit(majors_map,
+					       CHRDEV_MAJOR_HASH_SIZE,
+					       i);
+		}
+		set_bit(major, majors_map);
+		pr_debug("CHRDEV: \"%s\" using major %d\n",
+			 name, major);
 	}
 
 	cd->major = major;
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 299e76b..eebd4b1 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -24,6 +24,12 @@
 #define GENMASK_ULL(h, l) \
 	(((~0ULL) << (l)) & (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
 
+/*
+ * BITS32 creates a 32-bit mask starting at bit @s and ending at bit
+ * @e, clamped to the 32-bit bitspace if exceeding 31.
+ */
+#define BITS32(s, e) GENMASK((e % BITS_PER_LONG), (s % BITS_PER_LONG))
+
 extern unsigned int __sw_hweight8(unsigned int w);
 extern unsigned int __sw_hweight16(unsigned int w);
 extern unsigned int __sw_hweight32(unsigned int w);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index b8b3c72..10d3d8f 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2427,8 +2427,6 @@
 
 /* fs/char_dev.c */
 #define CHRDEV_MAJOR_HASH_SIZE	255
-/* Marks the bottom of the first segment of free char majors */
-#define CHRDEV_MAJOR_DYN_END 234
 extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
 extern int register_chrdev_region(dev_t, unsigned, const char *);
 extern int __register_chrdev(unsigned int major, unsigned int baseminor,