Re: cap exchange race with map/unmap

[Espen Skoglund]

[Jonathan S Shapiro]
> In the absence of any authority to fabricate new capabilities, the
> following chain of mappings is now in effect after the exchange:

>       RevCopy                RevCopy
>    A ----------> CapServer -----------> B

> If process A now exits, all of its capabilities are revoked. In
> consequence the Cap held by CapServer is revoked. In consequence the
> Cap held by B is revoked.

> Can somebody explain what authority or feature in the system design
> gives the CapServer sufficient power that it can create a capability
> that does not depend on A's continued existence?

If CapServer can identify that it posesses an identical capability it
can map this capability to B.

        eSk