diff --git a/Documentation/devices.txt b/Documentation/devices.txt
index 4035eca..2a4242b 100644
--- a/Documentation/devices.txt
+++ b/Documentation/devices.txt
@@ -248,6 +248,8 @@
 		associated with block devices.	The binding to the
 		loop devices is handled by mount(8) or losetup(8).
 
+  8 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
+
   8 block	SCSI disk devices (0-15)
 		  0 = /dev/sda		First SCSI disk whole disk
 		 16 = /dev/sdb		Second SCSI disk whole disk
@@ -620,7 +622,7 @@
 		  2 = /dev/sbpcd2	Panasonic CD-ROM controller 0 unit 2
 		  3 = /dev/sbpcd3	Panasonic CD-ROM controller 0 unit 3
 
- 26 char
+ 26 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  26 block	Second Matsushita (Panasonic/SoundBlaster) CD-ROM
 		  0 = /dev/sbpcd4	Panasonic CD-ROM controller 1 unit 0
@@ -863,7 +865,7 @@
 		      ...
  39 block
 
- 40 char
+ 40 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  40 block
 
@@ -1127,7 +1129,7 @@
 
 		NAMING CONFLICT -- PROPOSED REVISED NAME /dev/rpda0 etc
 
- 60-63 char	LOCAL/EXPERIMENTAL USE
+ 60-63 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  60-63 block	LOCAL/EXPERIMENTAL USE
 		Allocated for local/experimental use.  For devices not
@@ -1641,7 +1643,7 @@
 		disks (see major number 3) except that the limit on
 		partitions is 15.
 
- 93 char
+ 93 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  93 block	NAND Flash Translation Layer filesystem
 		  0 = /dev/nftla	First NFTL layer
@@ -1649,7 +1651,7 @@
 		    ...
 		240 = /dev/nftlp	16th NTFL layer
 
- 94 char
+ 94 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
  94 block	IBM S/390 DASD block storage
     		  0 = /dev/dasda First DASD device, major
@@ -1742,7 +1744,7 @@
 		    ...
 		 15 = /dev/amiraid/ar?p15 15th partition
 
-102 char
+102 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
 102 block	Compressed block device
 		  0 = /dev/cbd/a	First compressed block device, whole device
@@ -2027,7 +2029,7 @@
 		  1 = /dev/vnet1	2nd virtual network
 		    ...
 
-120-127 char	LOCAL/EXPERIMENTAL USE
+120-127 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
 120-127 block	LOCAL/EXPERIMENTAL USE
 		Allocated for local/experimental use.  For devices not
@@ -2341,7 +2343,7 @@
 		  1 = /dev/gfax1	GammaLink channel 1
 		    ...
 
-159 char	RESERVED
+159 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
 
 159 block	RESERVED
 
@@ -2929,6 +2931,8 @@
 		    ...
 		196 = /dev/dvb/adapter3/video0    first video decoder of fourth card
 
+213-215 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
+
 216 char	Bluetooth RFCOMM TTY devices
 		  0 = /dev/rfcomm0		First Bluetooth RFCOMM TTY device
 		  1 = /dev/rfcomm1		Second Bluetooth RFCOMM TTY device
@@ -2971,6 +2975,8 @@
 		same interface.  For interface documentation see
 		http://www.vmelinux.org/.
 
+222-223 char	RESERVED FOR DYNAMIC ALLOCATION OF MAJOR NUMBERS
+
 224 char	A2232 serial card
 		  0 = /dev/ttyY0		First A2232 port
 		  1 = /dev/ttyY1		Second A2232 port
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 687471d..b647cc8 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -21,6 +21,8 @@
 #include <linux/mutex.h>
 #include <linux/backing-dev.h>
 #include <linux/tty.h>
+#include <linux/bitmap.h>
+#include <linux/bitops.h>
 
 #include "internal.h"
 
@@ -37,6 +39,31 @@
 	struct cdev *cdev;		/* will die */
 } *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
 
+/*
+ * A bitmap for the 255 lower device numbers. A "1" means the
+ * major number is taken, a "0" means it is available. We first
+ * need to define all the assigned devices as taken so that
+ * dynamic device allocation will not go in and steal them.
+ */
+static unsigned long majors_map[] = {
+	/* 8 and 26 are free */
+	BITS32(0, 7) | BITS32(9, 25) | BITS32(27, 31),
+	/* 40 and 60-63 are free */
+	BITS32(32, 39) | BITS32(41, 59),
+	/* 93 and 94 are free */
+	BITS32(64, 92) | BIT_MASK(95),
+	/* 102 and 120-127 are free */
+	BITS32(96, 101) | BITS32(103, 119),
+	/* 159 is free */
+	BITS32(128, 158),
+	/* No free numbers */
+	~0x0U,
+	/* 213-215 and 222-223 are free */
+	BITS32(192, 212) | BITS32(216, 221),
+	/* 234-254 are free */
+	BITS32(224, 233) | BIT_MASK(255)
+};
+
 /* index in the above */
 static inline int major_to_index(unsigned major)
 {
@@ -84,22 +111,25 @@
 
 	mutex_lock(&chrdevs_lock);
 
-	/* temporary */
 	if (major == 0) {
-		for (i = ARRAY_SIZE(chrdevs)-1; i > 0; i--) {
-			if (chrdevs[i] == NULL)
-				break;
-		}
-
-		if (i < CHRDEV_MAJOR_DYN_END)
-			pr_warn("CHRDEV \"%s\" major number %d goes below the dynamic allocation range",
-				name, i);
-
-		if (i == 0) {
+		i = find_first_zero_bit(majors_map, CHRDEV_MAJOR_HASH_SIZE);
+		if (i == CHRDEV_MAJOR_HASH_SIZE) {
+			pr_warn("CHRDEV: \"%s\" out of major numbers",
+				name);
 			ret = -EBUSY;
 			goto out;
 		}
-		major = i;
+		/* Allocate from the top (254 and down) */
+		while (i != CHRDEV_MAJOR_HASH_SIZE) {
+			major = i;
+			i++;
+			i = find_next_zero_bit(majors_map,
+					       CHRDEV_MAJOR_HASH_SIZE,
+					       i);
+		}
+		set_bit(major, majors_map);
+		pr_debug("CHRDEV: \"%s\" using major %d\n",
+			 name, major);
 	}
 
 	cd->major = major;
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 299e76b..eebd4b1 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -24,6 +24,12 @@
 #define GENMASK_ULL(h, l) \
 	(((~0ULL) << (l)) & (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
 
+/*
+ * BITS32 creates a 32-bit mask starting at bit @s and ending at bit
+ * @e, clamped to the 32-bit bitspace if exceeding 31.
+ */
+#define BITS32(s, e) GENMASK((e % BITS_PER_LONG), (s % BITS_PER_LONG))
+
 extern unsigned int __sw_hweight8(unsigned int w);
 extern unsigned int __sw_hweight16(unsigned int w);
 extern unsigned int __sw_hweight32(unsigned int w);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index b8b3c72..10d3d8f 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2427,8 +2427,6 @@
 
 /* fs/char_dev.c */
 #define CHRDEV_MAJOR_HASH_SIZE	255
-/* Marks the bottom of the first segment of free char majors */
-#define CHRDEV_MAJOR_DYN_END 234
 extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
 extern int register_chrdev_region(dev_t, unsigned, const char *);
 extern int __register_chrdev(unsigned int major, unsigned int baseminor,