TOE brain dump

Answer is "No".

I'm running expensive workstation - and I'm _NOT_ using
LSM/IPSec/IPv6. I do not care what I _*can*_ do - I care about what I _*need*_ to do.
Point is here that 3k of code is all what we need. Not 'what every
one does need', not Linux kernel.

P.S.
printk() is absolutely renundant since there is no display at all ;-) And can you imagine Linux without printk, bug_on & panic?-)))

I'm on a workstation right now that needs IPv6 sometime in the next few months. There have been several instances where IPSec would have resolved internal problems (it's not easily available for Solaris yet.. soon).

So why should I buy another interface every time I need to change networks?

And who said it was a workstation target? If you are going to offload TCP/IP in a TOE, it should be where it might be useful - large (and saturated) compute servers, file servers. Not workstations. High bandwidth workstation requirements are rare. And large servers will require IPSec eventually (personally, I think it should be required already). And if the server requires IPSec, then the workstation will too.

So you have programmed your way into a small market. And a likely shrinking one at that.

So? It's called "embeded Linux". No MM, no printk (for production anyway). Display not required.

I gave example of my personal WS just as an example that not every
one needs all features, even having capacities.

TOE for IPsec/IPv6/iptables/routing? take a look at www.cisco.com,
this guys are doing exactly this with IOS. And take a look then at prices.
They are not cheap.

Take a look at prices of SMP/AMP systems. Multi-threaded software?
like Oracle or Sybase for example? which can utilize fully SMP/AMP resources.
They are not cheap.

If you will try to make a pice of hardware to put Linux on, you will
simultaneously get headaches of both TOE designers/programmers and SMP/AMP designers/programmers.
This is not going to simple nor cheap.

But you are encouraged to try ;-)

Rare? IMHO servers are rare too. Compare number of PCs/devices and
compare the number of servers. 1000s to 1s.
And devices are different and for most of them ipv4 is just more than
enough, since not of them has capacity even to handle 10MB Ethernet. I'm not talking about ipv4/ipsec/lsm. So servers for servers? Security for security?

I wanted to make a simple point: every piece should do a few of
things, but should do it good. [1]
Putting OS kernel into the device makes not that much sense, if you
can achive the same with simple 3k firmware.

[1] "The Unix Philosophy in One Lesson", http://www.catb.org/~esr/writings/taoup/html/ch01s07.html

P.S. Gone to offtopic. Sorry. Leaving.