docs/mainline: Document all the mainline things

Signed-off-by: Philip Molloy <philip@philipmolloy.com>

Author: pamolloy

docs/mainline.md

@@ -0,0 +1,69 @@
+## Linux versions
+
+Linux kernel releases include major releases (e.g. 6.0, 6.1, 6.2), long-term
+support (LTS) releases (e.g. 6.1, 6.6, 6.12) and stable releases (e.g. 6.12.0,
+6.12.1, ..., 6.12.66).
+
+Additionally, the Civil Infrastructure Platform (CIP) continues to maintain LTS
+releases once mainline support ends.[^2] This is done to meet industrial grade
+requirements.
+
+The latest releases are listed on [kernel.org](https://www.kernel.org/). [Linux
+kernel version
+history](https://en.wikipedia.org/wiki/Linux_kernel_version_history) on
+Wikipedia provides helpful diagrams for understanding the various Linux kernel
+releases.
+
+### ADI support
+
+ADI follows a similar approach to that taken by mainline. It attempts to
+maintain ADI changes on top of the latest LTS release and update those changes
+with every new LTS release. That process makes it easier to upstream those
+changes into the mainline kernel.
+
+ADI can also support older LTS releases by backporting changes, but that is not
+done automatically given the burden of supporting the many LTS versions.
+
+### CVE
+
+On February 13, 2024 kernel.org was added as a CVE Numbering Authority, giving
+the Linux development community more control over how CVEs are issued.[^1] Greg
+K-H provided context to that announcement in his blog post, [Linux is a
+CNA](http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/), and it was
+covered by LWN in [A turning point for CVE
+numbers](https://lwn.net/Articles/961978/).
+
+CVEs for the Linux kernel are announced on the [linux-cve-announce mailing
+list](https://lore.kernel.org/linux-cve-announce/). A more machine readable
+version is stored in the [security/vulns git
+repository](https://git.kernel.org/pub/scm/linux/security/vulns.git/), along
+with a set of scripts to parse the data.
+
+The establishment of the kernel CNA saw an increase in the number of CVEs
+being reported.
+
+CVE [Linux Kernel](https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33) on CVEdetails.com
+
+```
+$ just summary
+ Year	Reserved	Assigned	Rejected	   A+R		Returned	 Total
+  2019:	     0		     2		     1		     3		    47		    50
+  2020:	     0		    17		     0		    17		    33		    50
+  2021:	     0		   732		    24		   756		    16		   772
+  2022:	     0		  2123		    49		  2172		    17		  2189
+  2023:	     0		  1615		    60		  1675		     0		  1675
+  2024:	     0		  3064		   101		  3165		     6		  3171
+  2025:	    19		  2570		    44		  2614		     0		  2633
+  2026:	   498		     2		     0		     2		     0		   500
+ Total:	   517		 10125		   279		 10404		   119		 11040
+```
+
+> Nobody who relies on backporting fixes to a non-mainline kernel will be able
+> to keep up with this CVE stream. Any company that is using CVE numbers to
+> select kernel patches is going to have to rethink its processes.
+
+> ... distributors will simply fall back on shipping the stable kernel updates
+> which, almost by definition, will contain fixes for every known CVE number.
+
+[^1]: https://www.cve.org/Media/News/item/news/2024/02/13/kernel-org-Added-as-CNA
+[^2]: https://wiki.linuxfoundation.org/civilinfrastructureplatform/cipkernelmaintenance