From 83dbdba2c196d893f10722e5dd07a4655a48dfb3 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 10 Jul 2026 23:42:50 -0700
Subject: [PATCH 01/38] Stabilize live tfork source freezing

---
 crun/src/libcrun/criu.c                       |  32 +++-
 .../pkg/domain/infra/abi/container_tfork.go   | 154 +++++++++++++++++-
 2 files changed, 182 insertions(+), 4 deletions(-)

diff --git a/crun/src/libcrun/criu.c b/crun/src/libcrun/criu.c
index 8bf068d03..29feeee70 100644
--- a/crun/src/libcrun/criu.c
+++ b/crun/src/libcrun/criu.c
@@ -1353,12 +1353,13 @@ libcrun_container_restore_linux_criu (libcrun_container_status_t *status, libcru
 #  define CRIU_TFORK_LOG_FILE "tfork.log"
 
 static int
-read_source_state_pid (const char *path, pid_t *pid_out, libcrun_error_t *err)
+read_source_state_pid_cgroup (const char *path, pid_t *pid_out, char **cgroup_path_out, libcrun_error_t *err)
 {
   cleanup_free char *buffer = NULL;
   char err_buffer[256];
   yajl_val tree, tmp;
   const char *pid_path[] = { "pid", NULL };
+  const char *cgroup_path[] = { "cgroup-path", NULL };
   int ret;
 
   ret = read_all_file (path, &buffer, NULL, err);
@@ -1377,6 +1378,15 @@ read_source_state_pid (const char *path, pid_t *pid_out, libcrun_error_t *err)
     }
 
   *pid_out = (pid_t) strtoull (YAJL_GET_NUMBER (tmp), NULL, 10);
+
+  tmp = yajl_tree_get (tree, cgroup_path, yajl_t_string);
+  if (UNLIKELY (tmp == NULL))
+    {
+      yajl_tree_free (tree);
+      return crun_make_error (err, 0, "`cgroup-path` missing in source state.json `%s`", path);
+    }
+
+  *cgroup_path_out = xstrdup (YAJL_GET_STRING (tmp));
   yajl_tree_free (tree);
   return 0;
 }
@@ -1439,10 +1449,13 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
 {
   runtime_spec_schema_config_schema *def = container->container_def;
   cleanup_wrapper struct libcriu_wrapper_s *wrapper = NULL;
+  cleanup_free char *freezer_path = NULL;
   cleanup_free char *rootfs_path = NULL;
+  cleanup_free char *source_cgroup_path = NULL;
   cleanup_close int image_fd = -1;
   cleanup_close int work_fd = -1;
   pid_t source_pid = 0;
+  int cgroup_mode;
   int ret;
 
   ret = load_wrapper (&wrapper, err);
@@ -1470,7 +1483,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
   if (UNLIKELY (cr_options->image_path == NULL))
     return crun_make_error (err, 0, "--image-path is required");
 
-  ret = read_source_state_pid (cr_options->source_state, &source_pid, err);
+  ret = read_source_state_pid_cgroup (cr_options->source_state, &source_pid, &source_cgroup_path, err);
   if (UNLIKELY (ret < 0))
     return ret;
   if (UNLIKELY (source_pid <= 0))
@@ -1516,6 +1529,21 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
   libcriu_wrapper->criu_set_leave_running (true);
   libcriu_wrapper->criu_set_file_locks (true);
 
+  cgroup_mode = libcrun_get_cgroup_mode (err);
+  if (UNLIKELY (cgroup_mode < 0))
+    return cgroup_mode;
+
+  if (cgroup_mode == CGROUP_MODE_UNIFIED)
+    ret = append_paths (&freezer_path, err, CGROUP_ROOT, source_cgroup_path, NULL);
+  else
+    ret = append_paths (&freezer_path, err, CGROUP_ROOT "/freezer", source_cgroup_path, NULL);
+  if (UNLIKELY (ret < 0))
+    return ret;
+
+  ret = libcriu_wrapper->criu_set_freeze_cgroup (freezer_path);
+  if (UNLIKELY (ret < 0))
+    return crun_make_error (err, -ret, "CRIU: failed setting tfork freezer %d", ret);
+
   if (def->root != NULL && def->root->path != NULL)
     {
       ret = append_paths (&rootfs_path, err, container->context ? container->context->bundle : ".",
diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index 8aa6926d5..a14fd6208 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -69,6 +69,20 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 
 	snapRO := filepath.Join(bundleDir, "snap-ro")
 
+	thawSource, err := tforkFreezeSourceCgroup(src, 10*time.Second)
+	if err != nil {
+		return nil, fmt.Errorf("freeze source cgroup before tfork snapshot: %w", err)
+	}
+	sourceThawed := false
+	defer func() {
+		if sourceThawed {
+			return
+		}
+		if err := thawSource(); err != nil {
+			logrus.Warnf("tfork: thaw source cgroup after clone setup: %v", err)
+		}
+	}()
+
 	if out, err := exec.Command("sync").CombinedOutput(); err != nil {
 		return nil, fmt.Errorf("sync: %s: %w", out, err)
 	}
@@ -497,6 +511,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			logF.Close()
 			return nil, fmt.Errorf("start crun tfork: %w", err)
 		}
+		crunDone := make(chan error, 1)
 		var crunAborted bool
 		defer func() {
 			if !crunAborted && retErr != nil {
@@ -507,7 +522,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			_ = f.Close()
 		}
 		go func() {
-			_ = crunCmd.Wait()
+			crunDone <- crunCmd.Wait()
 			logF.Close()
 		}()
 		perCopyAttachSocks := make([]*os.File, copies)
@@ -559,7 +574,16 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		deadline := time.Now().Add(60 * time.Second)
 		readyCopies := 0
 		stateReady := !needState
+		crunExited := false
+		var crunErr error
 		for readyCopies < copies || !stateReady {
+			if !crunExited {
+				select {
+				case crunErr = <-crunDone:
+					crunExited = true
+				default:
+				}
+			}
 			readyCopies = 0
 			for i := 0; i < copies; i++ {
 				if _, err := os.Stat(pidFileFor(i)); err == nil {
@@ -574,7 +598,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			if readyCopies >= copies && stateReady {
 				break
 			}
-			if crunCmd.ProcessState != nil && crunCmd.ProcessState.Exited() && readyCopies < copies {
+			if crunExited && readyCopies < copies {
 				tforkAbortCrunCmd(crunCmd, src, bundleDir, copies)
 				crunAborted = true
 				return nil, fmt.Errorf("crun tfork exited before %d clones came up (got %d); see %s",
@@ -588,9 +612,31 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			}
 			time.Sleep(200 * time.Millisecond)
 		}
+		if !crunExited {
+			select {
+			case crunErr = <-crunDone:
+				crunExited = true
+			case <-time.After(10 * time.Second):
+				tforkAbortCrunCmd(crunCmd, src, bundleDir, copies)
+				crunAborted = true
+				return nil, fmt.Errorf("timeout waiting for crun tfork to finish after %d clones came up; see %s",
+					copies, logPath)
+			}
+		}
+		if crunErr != nil {
+			tforkAbortCrunCmd(crunCmd, src, bundleDir, copies)
+			crunAborted = true
+			return nil, fmt.Errorf("crun tfork failed after %d clones came up: %w; see %s",
+				copies, crunErr, logPath)
+		}
 		logrus.Infof("tfork: batch %s up (N=%d); crun-tfork.log at %s", batchID, copies, logPath)
 	}
 
+	if err := thawSource(); err != nil {
+		return nil, fmt.Errorf("thaw source cgroup after tfork restore: %w", err)
+	}
+	sourceThawed = true
+
 	srcCfg := src.Config()
 	if srcCfg == nil {
 		return nil, fmt.Errorf("source %q: could not read libpod config", src.ID())
@@ -666,6 +712,110 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	return &entities.ContainerCreateReport{Id: strings.Join(cloneIDs, "\n")}, nil
 }
 
+func tforkFreezeSourceCgroup(src *libpod.Container, timeout time.Duration) (func() error, error) {
+	if src == nil {
+		return nil, fmt.Errorf("source container is nil")
+	}
+	cgPath, err := src.CgroupPath()
+	if err != nil {
+		return nil, fmt.Errorf("read source cgroup path: %w", err)
+	}
+	cgPath = strings.TrimPrefix(filepath.Clean(cgPath), string(os.PathSeparator))
+	if cgPath == "" || cgPath == "." {
+		return nil, fmt.Errorf("source cgroup path is empty")
+	}
+	cgFS := filepath.Join("/sys/fs/cgroup", cgPath)
+	freezePath := filepath.Join(cgFS, "cgroup.freeze")
+	eventsPath := filepath.Join(cgFS, "cgroup.events")
+
+	originalFrozen, err := tforkCgroupFrozen(freezePath)
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", freezePath, err)
+	}
+	if err := os.WriteFile(freezePath, []byte("1"), 0o644); err != nil {
+		return nil, fmt.Errorf("write %s=1: %w", freezePath, err)
+	}
+	if err := tforkWaitCgroupFrozen(eventsPath, timeout); err != nil {
+		_ = os.WriteFile(freezePath, []byte("0"), 0o644)
+		return nil, err
+	}
+	logrus.Infof("tfork: froze source cgroup for snapshot consistency: %s", cgFS)
+
+	thaw := func() error {
+		if originalFrozen {
+			if err := os.WriteFile(freezePath, []byte("1"), 0o644); err != nil {
+				return fmt.Errorf("restore %s=1: %w", freezePath, err)
+			}
+			return nil
+		}
+		if err := os.WriteFile(freezePath, []byte("0"), 0o644); err != nil {
+			return fmt.Errorf("write %s=0: %w", freezePath, err)
+		}
+		if err := tforkWaitCgroupThawed(eventsPath, 10*time.Second); err != nil {
+			return err
+		}
+		logrus.Infof("tfork: thawed source cgroup after clone restore: %s", cgFS)
+		return nil
+	}
+	return thaw, nil
+}
+
+func tforkCgroupFrozen(freezePath string) (bool, error) {
+	data, err := os.ReadFile(freezePath)
+	if err != nil {
+		return false, err
+	}
+	return strings.TrimSpace(string(data)) == "1", nil
+}
+
+func tforkWaitCgroupFrozen(eventsPath string, timeout time.Duration) error {
+	return tforkWaitCgroupFrozenState(eventsPath, true, timeout)
+}
+
+func tforkWaitCgroupThawed(eventsPath string, timeout time.Duration) error {
+	return tforkWaitCgroupFrozenState(eventsPath, false, timeout)
+}
+
+func tforkWaitCgroupFrozenState(eventsPath string, wantFrozen bool, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	for {
+		data, err := os.ReadFile(eventsPath)
+		if err != nil {
+			return fmt.Errorf("read %s: %w", eventsPath, err)
+		}
+		frozen, ok := tforkCgroupEventsFrozen(data)
+		if ok && frozen == wantFrozen {
+			return nil
+		}
+		if time.Now().After(deadline) {
+			return fmt.Errorf("timeout waiting for %s to report frozen %d", eventsPath, tforkBoolInt(wantFrozen))
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+}
+
+func tforkCgroupEventsFrozen(data []byte) (bool, bool) {
+	for _, line := range strings.Split(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 2 && fields[0] == "frozen" {
+			switch fields[1] {
+			case "0":
+				return false, true
+			case "1":
+				return true, true
+			}
+		}
+	}
+	return false, false
+}
+
+func tforkBoolInt(v bool) int {
+	if v {
+		return 1
+	}
+	return 0
+}
+
 func spawnTforkDumpdHolder() (int, uint64, error) {
 	cmd := exec.Command("setsid", "bash", "-c",
 		"sleep infinity & while wait -n 2>/dev/null; do :; done")

From c7cd34888c9fc93521d59dbe084ae15077a10b5c Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 11 Jul 2026 11:09:19 -0700
Subject: [PATCH 02/38] Harden tfork source cgroup synchronization

---
 .../pkg/domain/infra/abi/container_tfork.go   | 158 +++++++++++++-----
 1 file changed, 119 insertions(+), 39 deletions(-)

diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index a14fd6208..a3bc98e5a 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -27,6 +27,15 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const (
+	tforkSourceFreezeTimeout = 10 * time.Second
+	tforkSourceThawTimeout   = 10 * time.Second
+	tforkCloneReadyTimeout   = 60 * time.Second
+	tforkCrunFinishTimeout   = tforkCloneReadyTimeout
+	tforkCgroupPollInterval  = 50 * time.Millisecond
+	tforkClonePollInterval   = 200 * time.Millisecond
+)
+
 func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities.ContainerCloneOptions) (rep *entities.ContainerCreateReport, retErr error) {
 	src, err := ic.Libpod.LookupContainer(opts.ID)
 	if err != nil {
@@ -69,7 +78,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 
 	snapRO := filepath.Join(bundleDir, "snap-ro")
 
-	thawSource, err := tforkFreezeSourceCgroup(src, 10*time.Second)
+	thawSource, err := tforkFreezeSourceCgroup(src, tforkSourceFreezeTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("freeze source cgroup before tfork snapshot: %w", err)
 	}
@@ -571,7 +580,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		}
 		statePath := fmt.Sprintf("/run/crun/%s/status", cloneIDs[0])
 		needState := copies == 1
-		deadline := time.Now().Add(60 * time.Second)
+		deadline := time.Now().Add(tforkCloneReadyTimeout)
 		readyCopies := 0
 		stateReady := !needState
 		crunExited := false
@@ -610,17 +619,17 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 				return nil, fmt.Errorf("timeout waiting for %d tfork.pid* files in %s (got %d, stateReady=%v); see %s",
 					copies, imgDir, readyCopies, stateReady, logPath)
 			}
-			time.Sleep(200 * time.Millisecond)
+			time.Sleep(tforkClonePollInterval)
 		}
 		if !crunExited {
 			select {
 			case crunErr = <-crunDone:
 				crunExited = true
-			case <-time.After(10 * time.Second):
+			case <-time.After(tforkCrunFinishTimeout):
 				tforkAbortCrunCmd(crunCmd, src, bundleDir, copies)
 				crunAborted = true
-				return nil, fmt.Errorf("timeout waiting for crun tfork to finish after %d clones came up; see %s",
-					copies, logPath)
+				return nil, fmt.Errorf("timeout waiting %s for crun tfork to finish after %d clones came up; see %s",
+					tforkCrunFinishTimeout, copies, logPath)
 			}
 		}
 		if crunErr != nil {
@@ -633,6 +642,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	}
 
 	if err := thawSource(); err != nil {
+		logrus.Warnf("tfork: clones are up, but thawing source cgroup after restore failed: %v", err)
 		return nil, fmt.Errorf("thaw source cgroup after tfork restore: %w", err)
 	}
 	sourceThawed = true
@@ -712,6 +722,13 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	return &entities.ContainerCreateReport{Id: strings.Join(cloneIDs, "\n")}, nil
 }
 
+type tforkCgroupFreezer struct {
+	root       string
+	statePath  string
+	eventsPath string
+	version    string
+}
+
 func tforkFreezeSourceCgroup(src *libpod.Container, timeout time.Duration) (func() error, error) {
 	if src == nil {
 		return nil, fmt.Errorf("source container is nil")
@@ -724,77 +741,140 @@ func tforkFreezeSourceCgroup(src *libpod.Container, timeout time.Duration) (func
 	if cgPath == "" || cgPath == "." {
 		return nil, fmt.Errorf("source cgroup path is empty")
 	}
-	cgFS := filepath.Join("/sys/fs/cgroup", cgPath)
-	freezePath := filepath.Join(cgFS, "cgroup.freeze")
-	eventsPath := filepath.Join(cgFS, "cgroup.events")
+	freezer, err := tforkSourceCgroupFreezer(cgPath)
+	if err != nil {
+		return nil, err
+	}
 
-	originalFrozen, err := tforkCgroupFrozen(freezePath)
+	originalFrozen, err := freezer.frozen()
 	if err != nil {
-		return nil, fmt.Errorf("read %s: %w", freezePath, err)
+		return nil, err
 	}
-	if err := os.WriteFile(freezePath, []byte("1"), 0o644); err != nil {
-		return nil, fmt.Errorf("write %s=1: %w", freezePath, err)
+	if err := freezer.freeze(); err != nil {
+		return nil, err
 	}
-	if err := tforkWaitCgroupFrozen(eventsPath, timeout); err != nil {
-		_ = os.WriteFile(freezePath, []byte("0"), 0o644)
+	if err := freezer.waitFrozen(true, timeout); err != nil {
+		if !originalFrozen {
+			_ = freezer.thaw()
+		}
 		return nil, err
 	}
-	logrus.Infof("tfork: froze source cgroup for snapshot consistency: %s", cgFS)
+	logrus.Infof("tfork: froze source cgroup for snapshot consistency: %s (%s)", freezer.root, freezer.version)
 
 	thaw := func() error {
 		if originalFrozen {
-			if err := os.WriteFile(freezePath, []byte("1"), 0o644); err != nil {
-				return fmt.Errorf("restore %s=1: %w", freezePath, err)
-			}
-			return nil
+			return freezer.freeze()
 		}
-		if err := os.WriteFile(freezePath, []byte("0"), 0o644); err != nil {
-			return fmt.Errorf("write %s=0: %w", freezePath, err)
+		if err := freezer.thaw(); err != nil {
+			return err
 		}
-		if err := tforkWaitCgroupThawed(eventsPath, 10*time.Second); err != nil {
+		if err := freezer.waitFrozen(false, tforkSourceThawTimeout); err != nil {
 			return err
 		}
-		logrus.Infof("tfork: thawed source cgroup after clone restore: %s", cgFS)
+		logrus.Infof("tfork: thawed source cgroup after clone restore: %s (%s)", freezer.root, freezer.version)
 		return nil
 	}
 	return thaw, nil
 }
 
-func tforkCgroupFrozen(freezePath string) (bool, error) {
-	data, err := os.ReadFile(freezePath)
+func tforkSourceCgroupFreezer(cgPath string) (*tforkCgroupFreezer, error) {
+	v2Root := filepath.Join("/sys/fs/cgroup", cgPath)
+	v2FreezePath := filepath.Join(v2Root, "cgroup.freeze")
+	v2EventsPath := filepath.Join(v2Root, "cgroup.events")
+	if _, err := os.Stat(v2FreezePath); err == nil {
+		return &tforkCgroupFreezer{
+			root:       v2Root,
+			statePath:  v2FreezePath,
+			eventsPath: v2EventsPath,
+			version:    "cgroup v2",
+		}, nil
+	} else if !os.IsNotExist(err) {
+		return nil, fmt.Errorf("stat %s: %w", v2FreezePath, err)
+	}
+
+	v1Root := filepath.Join("/sys/fs/cgroup/freezer", cgPath)
+	v1StatePath := filepath.Join(v1Root, "freezer.state")
+	if _, err := os.Stat(v1StatePath); err == nil {
+		return &tforkCgroupFreezer{
+			root:      v1Root,
+			statePath: v1StatePath,
+			version:   "cgroup v1 freezer",
+		}, nil
+	} else if !os.IsNotExist(err) {
+		return nil, fmt.Errorf("stat %s: %w", v1StatePath, err)
+	}
+
+	return nil, fmt.Errorf("source cgroup freezer not found for %q; expected cgroup v2 %s or cgroup v1 %s",
+		cgPath, v2FreezePath, v1StatePath)
+}
+
+func (f *tforkCgroupFreezer) frozen() (bool, error) {
+	data, err := os.ReadFile(f.statePath)
 	if err != nil {
-		return false, err
+		return false, fmt.Errorf("read %s: %w", f.statePath, err)
 	}
-	return strings.TrimSpace(string(data)) == "1", nil
+	frozen, ok := f.parseFrozen(data)
+	if !ok {
+		return false, fmt.Errorf("could not parse frozen state from %s", f.statePath)
+	}
+	return frozen, nil
 }
 
-func tforkWaitCgroupFrozen(eventsPath string, timeout time.Duration) error {
-	return tforkWaitCgroupFrozenState(eventsPath, true, timeout)
+func (f *tforkCgroupFreezer) freeze() error {
+	value := []byte("1")
+	if f.version == "cgroup v1 freezer" {
+		value = []byte("FROZEN")
+	}
+	if err := os.WriteFile(f.statePath, value, 0o644); err != nil {
+		return fmt.Errorf("write %s=%s: %w", f.statePath, value, err)
+	}
+	return nil
 }
 
-func tforkWaitCgroupThawed(eventsPath string, timeout time.Duration) error {
-	return tforkWaitCgroupFrozenState(eventsPath, false, timeout)
+func (f *tforkCgroupFreezer) thaw() error {
+	value := []byte("0")
+	if f.version == "cgroup v1 freezer" {
+		value = []byte("THAWED")
+	}
+	if err := os.WriteFile(f.statePath, value, 0o644); err != nil {
+		return fmt.Errorf("write %s=%s: %w", f.statePath, value, err)
+	}
+	return nil
 }
 
-func tforkWaitCgroupFrozenState(eventsPath string, wantFrozen bool, timeout time.Duration) error {
+func (f *tforkCgroupFreezer) waitFrozen(wantFrozen bool, timeout time.Duration) error {
 	deadline := time.Now().Add(timeout)
 	for {
-		data, err := os.ReadFile(eventsPath)
+		path := f.statePath
+		if f.eventsPath != "" {
+			path = f.eventsPath
+		}
+		data, err := os.ReadFile(path)
 		if err != nil {
-			return fmt.Errorf("read %s: %w", eventsPath, err)
+			return fmt.Errorf("read %s: %w", path, err)
 		}
-		frozen, ok := tforkCgroupEventsFrozen(data)
+		frozen, ok := f.parseFrozen(data)
 		if ok && frozen == wantFrozen {
 			return nil
 		}
 		if time.Now().After(deadline) {
-			return fmt.Errorf("timeout waiting for %s to report frozen %d", eventsPath, tforkBoolInt(wantFrozen))
+			return fmt.Errorf("timeout waiting %s for %s to report frozen %d", timeout, path, tforkBoolInt(wantFrozen))
 		}
-		time.Sleep(50 * time.Millisecond)
+		time.Sleep(tforkCgroupPollInterval)
 	}
 }
 
-func tforkCgroupEventsFrozen(data []byte) (bool, bool) {
+func (f *tforkCgroupFreezer) parseFrozen(data []byte) (bool, bool) {
+	if f.version == "cgroup v1 freezer" {
+		switch strings.TrimSpace(string(data)) {
+		case "FROZEN":
+			return true, true
+		case "THAWED":
+			return false, true
+		}
+		return false, false
+	}
+
 	for _, line := range strings.Split(string(data), "\n") {
 		fields := strings.Fields(line)
 		if len(fields) == 2 && fields[0] == "frozen" {

From 156dcfab91bfe35d429ff9368b058483f77a4af6 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 11 Jul 2026 11:31:13 -0700
Subject: [PATCH 03/38] Fix cgroup v2 freeze-state parsing

---
 podman/pkg/domain/infra/abi/container_tfork.go | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index a3bc98e5a..734a3fcec 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -858,7 +858,7 @@ func (f *tforkCgroupFreezer) waitFrozen(wantFrozen bool, timeout time.Duration)
 			return nil
 		}
 		if time.Now().After(deadline) {
-			return fmt.Errorf("timeout waiting %s for %s to report frozen %d", timeout, path, tforkBoolInt(wantFrozen))
+			return fmt.Errorf("timeout waiting %s for %s to report frozen=%t", timeout, path, wantFrozen)
 		}
 		time.Sleep(tforkCgroupPollInterval)
 	}
@@ -875,6 +875,13 @@ func (f *tforkCgroupFreezer) parseFrozen(data []byte) (bool, bool) {
 		return false, false
 	}
 
+	switch strings.TrimSpace(string(data)) {
+	case "0":
+		return false, true
+	case "1":
+		return true, true
+	}
+
 	for _, line := range strings.Split(string(data), "\n") {
 		fields := strings.Fields(line)
 		if len(fields) == 2 && fields[0] == "frozen" {
@@ -889,13 +896,6 @@ func (f *tforkCgroupFreezer) parseFrozen(data []byte) (bool, bool) {
 	return false, false
 }
 
-func tforkBoolInt(v bool) int {
-	if v {
-		return 1
-	}
-	return 0
-}
-
 func spawnTforkDumpdHolder() (int, uint64, error) {
 	cmd := exec.Command("setsid", "bash", "-c",
 		"sleep infinity & while wait -n 2>/dev/null; do :; done")

From c422f42ea2fad21d2a69d356b103dc45f4537bac Mon Sep 17 00:00:00 2001
From: Yiying Zhang <14881222+yiying-zhang@users.noreply.github.com>
Date: Sat, 11 Jul 2026 12:42:44 -0700
Subject: [PATCH 04/38] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 95ca25692..0b4845d72 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# Tclone
+# Tclone: Low-Latency Full-Workspace Forking for AI Agents
 
 Tclone is a workspace-versioning substrate built for computer-use agents. Tclone provides a versioned personal workspace that can be quickly forked, snapshotted, and rolledback.
 It forks a live, running container in milliseconds: clones share

From 3f989ff42e4cdd99be79ca5e614971d014f5ac68 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 08:06:12 -0700
Subject: [PATCH 05/38] Use direct crun path for single-copy tfork

---
 .../pkg/domain/infra/abi/container_tfork.go   | 40 +++++++++++++++++--
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index 734a3fcec..331838c7d 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -54,6 +54,15 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	if copies <= 0 {
 		copies = 1
 	}
+	requestedCopies := copies
+	useSingleCopyConmon := requestedCopies == 1 && os.Getenv("PODMAN_TFORK_SINGLE_COPY_CONMON") == "1"
+	if requestedCopies == 1 && !useSingleCopyConmon {
+		// The CRIU/crun single-copy tfork path can abort before producing a
+		// clone PID (`free(): invalid pointer`). Run a two-copy batch internally
+		// to use the known-good batch path, then remove the hidden spare clone
+		// before returning to the caller.
+		copies = 2
+	}
 
 	var srcRootfs string
 	if cfg := src.Config(); cfg != nil && cfg.ExternalSetup && cfg.Rootfs != "" {
@@ -219,7 +228,11 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			baseName = src.Name() + "-clone"
 		}
 		cloneName := baseName
-		if copies > 1 {
+		if requestedCopies == 1 && copies > 1 {
+			if i > 0 {
+				cloneName = fmt.Sprintf("%s-tfork-spare-%d", baseName, i)
+			}
+		} else if copies > 1 {
 			cloneName = fmt.Sprintf("%s-%d", baseName, i)
 		}
 		cloneNames[i] = cloneName
@@ -423,7 +436,9 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		}
 	}()
 	hasTTY := len(ttySrcFds) > 0
-	useConmon := copies == 1
+	// Keep the legacy single-copy conmon bootstrap opt-in because it can fail
+	// before crun starts and report only `conmon reported pid=-1`.
+	useConmon := copies == 1 && useSingleCopyConmon
 
 	if useConmon {
 		conmonInheritFds := inheritFds
@@ -651,6 +666,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	if srcCfg == nil {
 		return nil, fmt.Errorf("source %q: could not read libpod config", src.ID())
 	}
+	visibleCloneIDs := make([]string, 0, requestedCopies)
 	for i, cloneID := range cloneIDs {
 		clonePID, err := readTforkClonePID(cloneID, imgDir, i, copies)
 		if err != nil {
@@ -717,9 +733,27 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			}
 		}
 		logrus.Infof("tfork: clone %s (%s) registered in libpod state, pid=%d", cloneID, cloneNames[i], clonePID)
+		if i >= requestedCopies {
+			if err := removeHiddenTforkClone(ctx, ic, ctr); err != nil {
+				logrus.Warnf("tfork: hidden spare clone %s cleanup failed: %v", cloneID, err)
+			} else {
+				logrus.Infof("tfork: hidden spare clone %s removed", cloneID)
+			}
+			continue
+		}
+		visibleCloneIDs = append(visibleCloneIDs, cloneID)
 	}
 
-	return &entities.ContainerCreateReport{Id: strings.Join(cloneIDs, "\n")}, nil
+	return &entities.ContainerCreateReport{Id: strings.Join(visibleCloneIDs, "\n")}, nil
+}
+
+func removeHiddenTforkClone(ctx context.Context, ic *ContainerEngine, ctr *libpod.Container) error {
+	oldNoReap, hadNoReap := os.LookupEnv("PODMAN_TFORK_NO_REAP")
+	if hadNoReap {
+		_ = os.Unsetenv("PODMAN_TFORK_NO_REAP")
+		defer os.Setenv("PODMAN_TFORK_NO_REAP", oldNoReap)
+	}
+	return ic.Libpod.RemoveContainer(ctx, ctr, true, true, nil)
 }
 
 type tforkCgroupFreezer struct {

From 8001ff4090ba98d83f416f2da50d32f259096b7d Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 10:32:38 -0700
Subject: [PATCH 06/38] Expand tfork CRIU failure logs

---
 crun/src/libcrun/criu.c | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/crun/src/libcrun/criu.c b/crun/src/libcrun/criu.c
index 29feeee70..6a9a04ecc 100644
--- a/crun/src/libcrun/criu.c
+++ b/crun/src/libcrun/criu.c
@@ -545,6 +545,9 @@ show_criu_log (const char *work_path, const char *log)
   cleanup_free char *log_path = NULL;
   libcrun_error_t *tmp_err = NULL;
   char line[1024];
+  char tail[200][1024];
+  size_t tail_index = 0;
+  size_t tail_count = 0;
   FILE *f;
 
   if (UNLIKELY (append_paths (&log_path, tmp_err, work_path, log, NULL)) < 0)
@@ -564,11 +567,34 @@ show_criu_log (const char *work_path, const char *log)
   /* Log with error verbosity as this is the default. */
   libcrun_error (0, "--- excerpt from CRIU log `%s`", log_path);
   while (fgets (line, sizeof (line), f) != NULL)
-    if (strstr (line, "Error ") != NULL)
-      {
-        line[strcspn (line, "\n")] = '\0';
-        libcrun_error (0, "%s", line);
-      }
+    {
+      strncpy (tail[tail_index], line, sizeof (tail[tail_index]) - 1);
+      tail[tail_index][sizeof (tail[tail_index]) - 1] = '\0';
+      tail_index = (tail_index + 1) % 200;
+      if (tail_count < 200)
+        tail_count++;
+
+      if (strstr (line, "Error ") != NULL || strstr (line, "Warn ") != NULL
+          || strstr (line, "failed") != NULL || strstr (line, "FAILED") != NULL
+          || strstr (line, "Unable") != NULL || strstr (line, "Can't") != NULL
+          || strstr (line, "No such") != NULL)
+        {
+          line[strcspn (line, "\n")] = '\0';
+          libcrun_error (0, "%s", line);
+        }
+    }
+
+  if (tail_count > 0)
+    {
+      size_t start = (tail_count == 200) ? tail_index : 0;
+      libcrun_error (0, "--- last %zu CRIU log lines", tail_count);
+      for (size_t i = 0; i < tail_count; i++)
+        {
+          char *entry = tail[(start + i) % 200];
+          entry[strcspn (entry, "\n")] = '\0';
+          libcrun_error (0, "%s", entry);
+        }
+    }
 
   fclose (f);
   libcrun_error (0, "--- end of excerpt");

From d682a64399c42fdc5129cd85fe131a17a16de7d9 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 12:15:25 -0700
Subject: [PATCH 07/38] Include tfork restore log on CRIU failure

---
 crun/src/libcrun/criu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crun/src/libcrun/criu.c b/crun/src/libcrun/criu.c
index 6a9a04ecc..b6a2c86ae 100644
--- a/crun/src/libcrun/criu.c
+++ b/crun/src/libcrun/criu.c
@@ -1377,6 +1377,7 @@ libcrun_container_restore_linux_criu (libcrun_container_status_t *status, libcru
 }
 
 #  define CRIU_TFORK_LOG_FILE "tfork.log"
+#  define CRIU_TFORK_RESTORE_LOG_FILE "tfork-restore.log"
 
 static int
 read_source_state_pid_cgroup (const char *path, pid_t *pid_out, char **cgroup_path_out, libcrun_error_t *err)
@@ -1835,6 +1836,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
   if (UNLIKELY (ret != 0))
     {
       show_criu_log (cr_options->work_path, CRIU_TFORK_LOG_FILE);
+      show_criu_log (cr_options->image_path, CRIU_TFORK_RESTORE_LOG_FILE);
       return crun_make_error (err, 0, "criu_tfork failed: %d", ret);
     }
 

From f9400ac64529c7dcf475e1a8673c4b59e6e4766b Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 12:22:03 -0700
Subject: [PATCH 08/38] Avoid PID namespace collision in tfork ncopy

---
 criu/criu/crtools.c     |  3 +--
 crun/src/libcrun/criu.c | 13 +++++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/criu/criu/crtools.c b/criu/criu/crtools.c
index df40ec14f..48ff7a2c5 100644
--- a/criu/criu/crtools.c
+++ b/criu/criu/crtools.c
@@ -339,8 +339,7 @@ int main(int argc, char *argv[], char *envp[])
 			int failed = 0;
 			const char *base_log = opts.output;
 
-			const int ns_flags =
-				CLONE_NEWPID | CLONE_NEWNS;
+			const int ns_flags = CLONE_NEWNS;
 
 			if (!opts.tfork.active) {
 				pr_err("--tfork-copies>1 requires --tfork-restore "
diff --git a/crun/src/libcrun/criu.c b/crun/src/libcrun/criu.c
index b6a2c86ae..112f21f6b 100644
--- a/crun/src/libcrun/criu.c
+++ b/crun/src/libcrun/criu.c
@@ -1378,6 +1378,18 @@ libcrun_container_restore_linux_criu (libcrun_container_status_t *status, libcru
 
 #  define CRIU_TFORK_LOG_FILE "tfork.log"
 #  define CRIU_TFORK_RESTORE_LOG_FILE "tfork-restore.log"
+#  define CRIU_TFORK_MAX_COPY_LOGS 16
+
+static void
+show_criu_tfork_restore_copy_logs (const char *image_path)
+{
+  for (int i = 0; i < CRIU_TFORK_MAX_COPY_LOGS; i++)
+    {
+      char log[64];
+      snprintf (log, sizeof (log), "%s.copy%d", CRIU_TFORK_RESTORE_LOG_FILE, i);
+      show_criu_log (image_path, log);
+    }
+}
 
 static int
 read_source_state_pid_cgroup (const char *path, pid_t *pid_out, char **cgroup_path_out, libcrun_error_t *err)
@@ -1837,6 +1849,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
     {
       show_criu_log (cr_options->work_path, CRIU_TFORK_LOG_FILE);
       show_criu_log (cr_options->image_path, CRIU_TFORK_RESTORE_LOG_FILE);
+      show_criu_tfork_restore_copy_logs (cr_options->image_path);
       return crun_make_error (err, 0, "criu_tfork failed: %d", ret);
     }
 

From 71a23f1c49d8fb440d56dde17ca5428c8d0a49ed Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 12:28:27 -0700
Subject: [PATCH 09/38] Preserve PID hierarchy during tfork restore

---
 criu/criu/cr-tfork.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/criu/criu/cr-tfork.c b/criu/criu/cr-tfork.c
index ea64d6627..07e697b80 100644
--- a/criu/criu/cr-tfork.c
+++ b/criu/criu/cr-tfork.c
@@ -1078,7 +1078,7 @@ int cr_tfork_tasks(pid_t pid)
 			list_for_each_entry(cgo_iter, &opts.new_cgroup_roots, node)
 				rpc_n_cg_root++;
 
-			rpc_max = 32 + 2 * (rpc_n_ifd + rpc_n_ext + rpc_n_cg_root
+			rpc_max = 33 + 2 * (rpc_n_ifd + rpc_n_ext + rpc_n_cg_root
 					    + opts.tfork.snap_mount_n)
 				+ rpc_n_copy_args + 2;
 			rpc_argv = calloc(rpc_max, sizeof(*rpc_argv));
@@ -1098,6 +1098,7 @@ int cr_tfork_tasks(pid_t pid)
 			rpc_argv[rpc_n++] = "-o";
 			rpc_argv[rpc_n++] = restore_log_arg;
 			rpc_argv[rpc_n++] = "-v2";
+			rpc_argv[rpc_n++] = "--keep-pid-hierarchy";
 
 			if (opts.root) {
 				rpc_argv[rpc_n++] = "--root";
@@ -1267,7 +1268,7 @@ int cr_tfork_tasks(pid_t pid)
 		buf[off] = '\0';
 		end = buf + off;
 
-		argv_max = 8 + 2;
+		argv_max = 8 + 3;
 		for (p = buf; p < end; p++)
 			if (*p == '\0')
 				argv_max++;
@@ -1312,6 +1313,7 @@ int cr_tfork_tasks(pid_t pid)
 			argv_new[argc_new++] = "--pidfile";
 			argv_new[argc_new++] = pidfile_arg;
 		}
+		argv_new[argc_new++] = "--keep-pid-hierarchy";
 		argv_new[argc_new] = NULL;
 
 		execv("/proc/self/exe", argv_new);

From ead824f0cc80ded6a7408e35b5223685406f08c5 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 12:46:03 -0700
Subject: [PATCH 10/38] Insert pstree PIDs after loading namespace IDs

---
 criu/criu/pstree.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/criu/criu/pstree.c b/criu/criu/pstree.c
index c448c9516..576efb600 100644
--- a/criu/criu/pstree.c
+++ b/criu/criu/pstree.c
@@ -745,9 +745,8 @@ static struct pstree_item *get_or_create_pstree_item(pid_t real, pid_t local, in
 {
     struct pid *found;
     struct pstree_item *item;
-    struct rb_node **root_link, *root_parent;
 
-    found = __lookup_pid_root(&pid_root_rb[ALL_PID_NS_ID], real, &root_parent, &root_link);
+    found = __lookup_pid_root(&pid_root_rb[ALL_PID_NS_ID], real, NULL, NULL);
     if (found) {
         if (pidns_id != ALL_PID_NS_ID) {
             BUG_ON(found->leaf_ns_id != pidns_id || found->local != local);
@@ -763,11 +762,6 @@ static struct pstree_item *get_or_create_pstree_item(pid_t real, pid_t local, in
     item->pid->local = local;
     item->pid->leaf_ns_id = pidns_id;
 
-    if (__pstree_insert_pid(item->pid, root_parent, root_link) < 0) {
-        xfree(item);
-        return NULL;
-    }
-
     return item;
 }
 
@@ -916,6 +910,16 @@ static int read_one_pstree_item(PstreeEntry *e)
 	pi->pid->state = TASK_ALIVE;
 	pi->pid->uid = e->uid;
 
+	/* note: we don't fail if we have empty ids */
+	if (read_pstree_ids(pi) < 0)
+		goto err;
+
+	if (pi->ids && pi->ids->has_pid_ns_id)
+		pi->pid->leaf_ns_id = pi->ids->pid_ns_id;
+
+	if (__pstree_insert_pid(pi->pid, NULL, NULL) < 0)
+		goto err;
+
 	if (e->ppid == 0) {
 		if (root_item) {
 			pr_err("Parent missed on non-root task "
@@ -977,10 +981,6 @@ static int read_one_pstree_item(PstreeEntry *e)
 	task_entries->nr_threads += e->n_threads;
 	task_entries->nr_tasks++;
 
-	/* note: we don't fail if we have empty ids */
-	if (read_pstree_ids(pi) < 0)
-		goto err;
-
 	ret = 1;
 err:
 	return ret;

From bac21f94da0d7b92754eac2563c885ccbe9731e6 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 13:50:53 -0700
Subject: [PATCH 11/38] Fix tfork nested pid namespace ids

---
 criu/criu/crtools.c              |  3 +-
 criu/criu/namespaces.c           | 63 +++++++++++++++++++++++++++++++-
 criu/lib/pycriu/images/images.py |  2 +-
 3 files changed, 65 insertions(+), 3 deletions(-)

diff --git a/criu/criu/crtools.c b/criu/criu/crtools.c
index 48ff7a2c5..df40ec14f 100644
--- a/criu/criu/crtools.c
+++ b/criu/criu/crtools.c
@@ -339,7 +339,8 @@ int main(int argc, char *argv[], char *envp[])
 			int failed = 0;
 			const char *base_log = opts.output;
 
-			const int ns_flags = CLONE_NEWNS;
+			const int ns_flags =
+				CLONE_NEWPID | CLONE_NEWNS;
 
 			if (!opts.tfork.active) {
 				pr_err("--tfork-copies>1 requires --tfork-restore "
diff --git a/criu/criu/namespaces.c b/criu/criu/namespaces.c
index df224db68..e428741d7 100644
--- a/criu/criu/namespaces.c
+++ b/criu/criu/namespaces.c
@@ -592,6 +592,67 @@ static unsigned int get_ns_id(int pid, struct ns_desc *nd, protobuf_c_boolean *s
 	return __get_ns_id(pid, nd, supported, NULL);
 }
 
+static unsigned int add_nested_pid_leaf_ns_id(struct pstree_item *item)
+{
+	struct ns_id *nsid;
+
+	nsid = xzalloc(sizeof(*nsid));
+	if (!nsid)
+		return 0;
+
+	nsid->type = NS_OTHER;
+	nsid->kid = 0;
+	nsid->ns_populated = true;
+	nsid_add(nsid, &pid_ns_desc, ns_next_id++, localpid(item));
+
+	pr_info("Add nested pid leaf ns %d for task %d(%d), level %d\n",
+		nsid->id, localpid(item), realpid(item), item->pid->ns_level);
+	return nsid->id;
+}
+
+static unsigned int ensure_task_leaf_pid_ns_id(struct pstree_item *item);
+
+static unsigned int task_leaf_pid_ns_id(struct pstree_item *item, unsigned int proc_pid_ns_id)
+{
+	struct pstree_item *parent = item->parent;
+
+	/*
+	 * os4agent stores localpid as the innermost NSpid (pid->ns[0]).
+	 * Keep pstree_entry.nsid at the same namespace level. Otherwise a
+	 * nested pid namespace init such as bwrap can become (nsid=N,
+	 * localpid=1) and collide with the container init in the same nsid.
+	 */
+	if (parent && ensure_task_leaf_pid_ns_id(parent) == 0)
+		return 0;
+
+	if (parent && parent->pid->leaf_ns_id != ALL_PID_NS_ID) {
+		if (item->pid->ns_level == parent->pid->ns_level)
+			return parent->pid->leaf_ns_id;
+		if (item->pid->ns_level > parent->pid->ns_level &&
+		    proc_pid_ns_id != parent->pid->leaf_ns_id)
+			return proc_pid_ns_id;
+		if (item->pid->ns_level > parent->pid->ns_level)
+			return add_nested_pid_leaf_ns_id(item);
+	}
+
+	return proc_pid_ns_id;
+}
+
+static unsigned int ensure_task_leaf_pid_ns_id(struct pstree_item *item)
+{
+	unsigned int proc_pid_ns_id;
+
+	if (item->pid->leaf_ns_id != ALL_PID_NS_ID)
+		return item->pid->leaf_ns_id;
+
+	proc_pid_ns_id = get_ns_id(item->pid->real, &pid_ns_desc, NULL);
+	if (!proc_pid_ns_id)
+		return 0;
+
+	item->pid->leaf_ns_id = task_leaf_pid_ns_id(item, proc_pid_ns_id);
+	return item->pid->leaf_ns_id;
+}
+
 int dump_one_ns_file(int lfd, u32 id, const struct fd_parms *p)
 {
 	struct cr_img *img;
@@ -773,7 +834,7 @@ int dump_task_ns_ids(struct pstree_item *item)
 	TaskKobjIdsEntry *ids = item->ids;
 
 	ids->has_pid_ns_id = true;
-	ids->pid_ns_id = get_ns_id(pid, &pid_ns_desc, NULL);
+	ids->pid_ns_id = ensure_task_leaf_pid_ns_id(item);
 	if (!ids->pid_ns_id) {
 		pr_err("Can't make pidns id\n");
 		return -1;
diff --git a/criu/lib/pycriu/images/images.py b/criu/lib/pycriu/images/images.py
index 9db506e1e..927eee972 100644
--- a/criu/lib/pycriu/images/images.py
+++ b/criu/lib/pycriu/images/images.py
@@ -502,7 +502,7 @@ def skip(self, f, pbuff):
                                 tcp_stream_extra_handler()),
     'STATS': entry_handler(pb.stats_entry),
     'PAGEMAP': pagemap_handler(),  # Special one
-    'PSTREE': entry_handler(pb.pstree_entry),
+    'PSTREE': entry_handler(pb.pstree_file_entry),
     'REG_FILES': entry_handler(pb.reg_file_entry),
     'NS_FILES': entry_handler(pb.ns_file_entry),
     'EVENTFD_FILE': entry_handler(pb.eventfd_file_entry),

From c952db921ed149225f348181913c92f45f6d4556 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 14:10:38 -0700
Subject: [PATCH 12/38] Avoid tfork freezer wait timeout on transient tasks

---
 criu/criu/seize.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/criu/criu/seize.c b/criu/criu/seize.c
index f5cde74e9..5fc7c850e 100644
--- a/criu/criu/seize.c
+++ b/criu/criu/seize.c
@@ -379,7 +379,7 @@ static int seize_cgroup_tree(char *root_path, enum freezer_state state)
  */
 static int freezer_wait_processes(void)
 {
-	int i;
+	int i, collected = 0;
 
 	processes_to_wait_pids = xmalloc(sizeof(pid_t) * processes_to_wait);
 	if (processes_to_wait_pids == NULL)
@@ -388,23 +388,37 @@ static int freezer_wait_processes(void)
 	for (i = 0; i < processes_to_wait; i++) {
 		int status;
 		pid_t pid;
+		int waited_ms = 0;
 
 		/*
 		 * Here we are going to skip tasks which are already traced.
 		 * Ptraced tasks looks like children for us, so if
 		 * a task isn't ptraced yet, waitpid() will return a error.
 		 */
-		pid = waitpid(-1, &status, 0);
-		if (pid < 0) {
-			pr_perror("Unable to wait processes");
-			xfree(processes_to_wait_pids);
-			processes_to_wait_pids = NULL;
-			return -1;
+		while (1) {
+			pid = waitpid(-1, &status, opts.tfork.active ? WNOHANG : 0);
+			if (pid > 0)
+				break;
+			if (!opts.tfork.active || (pid < 0 && errno != ECHILD && errno != EINTR)) {
+				pr_perror("Unable to wait processes");
+				xfree(processes_to_wait_pids);
+				processes_to_wait_pids = NULL;
+				return -1;
+			}
+			if (pid < 0 || waited_ms >= 500) {
+				pr_warn("tfork: collected %d/%d unexpected freezer processes; continuing\n",
+					collected, processes_to_wait);
+				processes_to_wait = collected;
+				return 0;
+			}
+			usleep(10 * 1000);
+			waited_ms += 10;
 		}
 		pr_warn("Unexpected process %d in the freezer cgroup (status 0x%x)\n", pid, status);
 
-		processes_to_wait_pids[i] = pid;
+		processes_to_wait_pids[collected++] = pid;
 	}
+	processes_to_wait = collected;
 
 	return 0;
 }

From 3dea3a743d83a7683acc94be95fba5f842058af4 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 14:21:24 -0700
Subject: [PATCH 13/38] Recompute invalid tfork nested pid namespace cache

---
 criu/criu/namespaces.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/criu/criu/namespaces.c b/criu/criu/namespaces.c
index e428741d7..0edb0d664 100644
--- a/criu/criu/namespaces.c
+++ b/criu/criu/namespaces.c
@@ -640,10 +640,22 @@ static unsigned int task_leaf_pid_ns_id(struct pstree_item *item, unsigned int p
 
 static unsigned int ensure_task_leaf_pid_ns_id(struct pstree_item *item)
 {
+	struct pstree_item *parent = item->parent;
 	unsigned int proc_pid_ns_id;
 
-	if (item->pid->leaf_ns_id != ALL_PID_NS_ID)
-		return item->pid->leaf_ns_id;
+	if (parent && ensure_task_leaf_pid_ns_id(parent) == 0)
+		return 0;
+
+	if (item->pid->leaf_ns_id != ALL_PID_NS_ID) {
+		if (!parent)
+			return item->pid->leaf_ns_id;
+		if (item->pid->ns_level == parent->pid->ns_level &&
+		    item->pid->leaf_ns_id == parent->pid->leaf_ns_id)
+			return item->pid->leaf_ns_id;
+		if (item->pid->ns_level > parent->pid->ns_level &&
+		    item->pid->leaf_ns_id != parent->pid->leaf_ns_id)
+			return item->pid->leaf_ns_id;
+	}
 
 	proc_pid_ns_id = get_ns_id(item->pid->real, &pid_ns_desc, NULL);
 	if (!proc_pid_ns_id)

From 88fef5e0b5288930300bca43d065e37e7f99e64c Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 14:39:07 -0700
Subject: [PATCH 14/38] Force nested pid leaf ids during tfork dump

---
 criu/criu/cr-tfork.c   |  5 ++--
 criu/criu/namespaces.c | 52 +++++++++++++++++++++++++++++++++++-------
 criu/criu/pstree.c     |  5 +++-
 3 files changed, 51 insertions(+), 11 deletions(-)

diff --git a/criu/criu/cr-tfork.c b/criu/criu/cr-tfork.c
index 07e697b80..ca5a5c61c 100644
--- a/criu/criu/cr-tfork.c
+++ b/criu/criu/cr-tfork.c
@@ -966,8 +966,9 @@ int cr_tfork_tasks(pid_t pid)
 		opts.tfork.pidfd_map[opts.tfork.pidfd_map_nr].pidfd = pidfd;
 		opts.tfork.pidfd_map[opts.tfork.pidfd_map_nr].memfd = -1;
 		opts.tfork.pidfd_map_nr++;
-		pr_info("tfork: pidfd %d for pid %d (vpid %d uid %d)\n",
-			pidfd, item->pid->real, localpid(item), uid(item));
+		pr_info("tfork: pidfd %d for pid %d (vpid %d uid %d nsid %d level %d)\n",
+			pidfd, item->pid->real, localpid(item), uid(item),
+			item->pid->leaf_ns_id, item->pid->ns_level);
 	}
 
 	ret = run_scripts(ACT_PRE_TFORK_RESTORE);
diff --git a/criu/criu/namespaces.c b/criu/criu/namespaces.c
index 0edb0d664..3cdf30c8b 100644
--- a/criu/criu/namespaces.c
+++ b/criu/criu/namespaces.c
@@ -615,6 +615,7 @@ static unsigned int ensure_task_leaf_pid_ns_id(struct pstree_item *item);
 static unsigned int task_leaf_pid_ns_id(struct pstree_item *item, unsigned int proc_pid_ns_id)
 {
 	struct pstree_item *parent = item->parent;
+	unsigned int selected;
 
 	/*
 	 * os4agent stores localpid as the innermost NSpid (pid->ns[0]).
@@ -626,16 +627,29 @@ static unsigned int task_leaf_pid_ns_id(struct pstree_item *item, unsigned int p
 		return 0;
 
 	if (parent && parent->pid->leaf_ns_id != ALL_PID_NS_ID) {
-		if (item->pid->ns_level == parent->pid->ns_level)
-			return parent->pid->leaf_ns_id;
+		if (item->pid->ns_level == parent->pid->ns_level) {
+			selected = parent->pid->leaf_ns_id;
+			goto out;
+		}
 		if (item->pid->ns_level > parent->pid->ns_level &&
-		    proc_pid_ns_id != parent->pid->leaf_ns_id)
-			return proc_pid_ns_id;
-		if (item->pid->ns_level > parent->pid->ns_level)
-			return add_nested_pid_leaf_ns_id(item);
+		    proc_pid_ns_id != parent->pid->leaf_ns_id) {
+			selected = proc_pid_ns_id;
+			goto out;
+		}
+		if (item->pid->ns_level > parent->pid->ns_level) {
+			selected = add_nested_pid_leaf_ns_id(item);
+			goto out;
+		}
 	}
 
-	return proc_pid_ns_id;
+	selected = proc_pid_ns_id;
+
+out:
+	pr_info("pid leaf ns task=%d(%d) uid=%d level=%d parent_level=%d proc_nsid=%u parent_nsid=%d selected=%u\n",
+		localpid(item), realpid(item), uid(item), item->pid->ns_level,
+		parent ? parent->pid->ns_level : -1, proc_pid_ns_id,
+		parent ? parent->pid->leaf_ns_id : -1, selected);
+	return selected;
 }
 
 static unsigned int ensure_task_leaf_pid_ns_id(struct pstree_item *item)
@@ -844,15 +858,37 @@ int dump_task_ns_ids(struct pstree_item *item)
 	int i;
 	int pid = item->pid->real;
 	TaskKobjIdsEntry *ids = item->ids;
+	struct pstree_item *parent = item->parent;
+	unsigned int proc_pid_ns_id;
 
 	ids->has_pid_ns_id = true;
-	ids->pid_ns_id = ensure_task_leaf_pid_ns_id(item);
+	proc_pid_ns_id = get_ns_id(pid, &pid_ns_desc, NULL);
+	if (!proc_pid_ns_id) {
+		pr_err("Can't make pidns id\n");
+		return -1;
+	}
+
+	if (parent && ensure_task_leaf_pid_ns_id(parent) == 0)
+		return -1;
+
+	ids->pid_ns_id = proc_pid_ns_id;
+	if (parent && item->pid->ns_level == parent->pid->ns_level)
+		ids->pid_ns_id = parent->pid->leaf_ns_id;
+	else if (parent && item->pid->ns_level > parent->pid->ns_level &&
+		 ids->pid_ns_id == parent->pid->leaf_ns_id)
+		ids->pid_ns_id = add_nested_pid_leaf_ns_id(item);
+
 	if (!ids->pid_ns_id) {
 		pr_err("Can't make pidns id\n");
 		return -1;
 	}
 	item->pid->leaf_ns_id = ids->pid_ns_id;
 
+	pr_info("dump pid ns task=%d(%d) uid=%d level=%d parent_level=%d proc_nsid=%u parent_nsid=%d selected=%u\n",
+		localpid(item), realpid(item), uid(item), item->pid->ns_level,
+		parent ? parent->pid->ns_level : -1, proc_pid_ns_id,
+		parent ? parent->pid->leaf_ns_id : -1, ids->pid_ns_id);
+
 	for (i = 0; i < item->nr_threads; i++)
 		item->threads[i].leaf_ns_id = ids->pid_ns_id;
 
diff --git a/criu/criu/pstree.c b/criu/criu/pstree.c
index 576efb600..2420c76bb 100644
--- a/criu/criu/pstree.c
+++ b/criu/criu/pstree.c
@@ -436,7 +436,10 @@ int dump_pstree(struct pstree_item *root_item)
 		pstree_entry__init(e);
 		tree_entries[nr_items++] = e;
 
-		pr_info("Process: %d(%d)\n", localpid(item), realpid(item));
+		pr_info("Process: %d(%d) uid=%d nsid=%d level=%d parent=%d parent_nsid=%d\n",
+			localpid(item), realpid(item), uid(item), item->pid->leaf_ns_id,
+			item->pid->ns_level, item->parent ? realpid(item->parent) : 0,
+			item->parent ? item->parent->pid->leaf_ns_id : -1);
 
 		e->realpid = realpid(item);
 		e->ppid = item->parent ? realpid(item->parent) : 0;

From d838fca8069d61ac7fe22fa4b54986f90cddc544 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 16:40:39 -0700
Subject: [PATCH 15/38] Finalize nested pid namespace ids before pstree dump

---
 criu/criu/cr-dump.c            |  3 +++
 criu/criu/include/namespaces.h |  1 +
 criu/criu/namespaces.c         | 34 ++++++++++++++++++++++++++++++++++
 criu/criu/pstree.c             |  9 +++++++--
 4 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/criu/criu/cr-dump.c b/criu/criu/cr-dump.c
index d196521fc..6728b8625 100644
--- a/criu/criu/cr-dump.c
+++ b/criu/criu/cr-dump.c
@@ -2360,6 +2360,9 @@ int cr_dump_tasks(pid_t pid)
 	if (dump_zombies())
 		goto err;
 
+	if (finalize_nested_pid_ns_ids())
+		goto err;
+
 	if (dump_pstree(root_item))
 		goto err;
 
diff --git a/criu/criu/include/namespaces.h b/criu/criu/include/namespaces.h
index e442e0a39..7a5aa6437 100644
--- a/criu/criu/include/namespaces.h
+++ b/criu/criu/include/namespaces.h
@@ -187,6 +187,7 @@ extern int restore_mnt_ns(int rst, int *cwd_fd);
 
 extern int dump_task_ns_ids(struct pstree_item *);
 extern int predump_task_ns_ids(struct pstree_item *);
+extern int finalize_nested_pid_ns_ids(void);
 extern int rst_add_ns_id(unsigned int id, struct pstree_item *, struct ns_desc *nd);
 extern struct ns_id *lookup_ns_by_id(unsigned int id, struct ns_desc *nd);
 
diff --git a/criu/criu/namespaces.c b/criu/criu/namespaces.c
index 3cdf30c8b..11909cea2 100644
--- a/criu/criu/namespaces.c
+++ b/criu/criu/namespaces.c
@@ -974,6 +974,40 @@ int dump_task_ns_ids(struct pstree_item *item)
 	return 0;
 }
 
+int finalize_nested_pid_ns_ids(void)
+{
+	struct pstree_item *item;
+
+	for_each_pstree_item(item) {
+		struct pstree_item *parent = item->parent;
+		unsigned int nsid;
+		int i;
+
+		if (!parent)
+			continue;
+		if (item->pid->ns_level <= parent->pid->ns_level)
+			continue;
+		if (item->pid->leaf_ns_id != parent->pid->leaf_ns_id)
+			continue;
+
+		nsid = add_nested_pid_leaf_ns_id(item);
+		if (!nsid)
+			return -1;
+
+		item->pid->leaf_ns_id = nsid;
+		for (i = 0; i < item->nr_threads; i++)
+			item->threads[i].leaf_ns_id = nsid;
+		if (item->ids && item->ids->has_pid_ns_id)
+			item->ids->pid_ns_id = nsid;
+
+		pr_info("finalize nested pid ns task=%d(%d) uid=%d level=%d parent_nsid=%d selected=%u\n",
+			localpid(item), realpid(item), uid(item), item->pid->ns_level,
+			parent->pid->leaf_ns_id, nsid);
+	}
+
+	return 0;
+}
+
 static UsernsEntry userns_entry = USERNS_ENTRY__INIT;
 #define INVALID_ID (~0U)
 
diff --git a/criu/criu/pstree.c b/criu/criu/pstree.c
index 2420c76bb..de7f45b3f 100644
--- a/criu/criu/pstree.c
+++ b/criu/criu/pstree.c
@@ -917,8 +917,13 @@ static int read_one_pstree_item(PstreeEntry *e)
 	if (read_pstree_ids(pi) < 0)
 		goto err;
 
-	if (pi->ids && pi->ids->has_pid_ns_id)
-		pi->pid->leaf_ns_id = pi->ids->pid_ns_id;
+	if (pi->ids && pi->ids->has_pid_ns_id) {
+		if (pi->ids->pid_ns_id != pi->pid->leaf_ns_id) {
+			pr_warn("PID namespace id mismatch for uid %d: pstree=%d ids=%d, keeping pstree\n",
+				uid(pi), pi->pid->leaf_ns_id, pi->ids->pid_ns_id);
+			pi->ids->pid_ns_id = pi->pid->leaf_ns_id;
+		}
+	}
 
 	if (__pstree_insert_pid(pi->pid, NULL, NULL) < 0)
 		goto err;

From 852c991466cecd0d4f9a71d81baa72df03683a8e Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 16:48:12 -0700
Subject: [PATCH 16/38] Avoid ncopy helper consuming restored pid 1

---
 criu/criu/crtools.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/criu/criu/crtools.c b/criu/criu/crtools.c
index df40ec14f..8951acbe2 100644
--- a/criu/criu/crtools.c
+++ b/criu/criu/crtools.c
@@ -339,8 +339,13 @@ int main(int argc, char *argv[], char *envp[])
 			int failed = 0;
 			const char *base_log = opts.output;
 
-			const int ns_flags =
-				CLONE_NEWPID | CLONE_NEWNS;
+			/*
+			 * The n-copy helper must not create/occupy PID 1 in a new
+			 * PID namespace. CRIU restores the real root task as PID 1
+			 * from the image; if the helper has already consumed it,
+			 * restore fails with EEXIST ("Can't fork for 1").
+			 */
+			const int ns_flags = CLONE_NEWNS;
 
 			if (!opts.tfork.active) {
 				pr_err("--tfork-copies>1 requires --tfork-restore "

From 9f2fb9fd8555cb2d78b2f88025d196f79dc295b1 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 16:55:28 -0700
Subject: [PATCH 17/38] Drop source pid chain for tfork restore copies

---
 criu/criu/cr-restore.c | 9 ++++++++-
 criu/criu/crtools.c    | 2 ++
 criu/criu/pstree.c     | 8 ++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index d85279a82..788d64187 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -1434,7 +1434,14 @@ static inline int fork_with_pid(struct pstree_item *item)
 		strip |= CLONE_NEWUSER;
 
 	if (kdat.has_clone3_set_tid) {
-		if (item->pid->ns_level == 1)
+		if (opts.tfork.active && item == root_item &&
+		    (ca.clone_flags & CLONE_NEWPID) &&
+		    item->pid->ns_level > 1) {
+			pr_info("tfork: restore root with local pid %d, dropping dumped outer pid chain level=%d\n",
+				pid, item->pid->ns_level);
+			ret = clone3_with_pid_noasan(restore_task_with_children, &ca,
+						     ca.clone_flags & ~strip, SIGCHLD, pid);
+		} else if (item->pid->ns_level == 1)
 			ret = clone3_with_pid_noasan(restore_task_with_children, &ca,
 						     ca.clone_flags & ~strip, SIGCHLD, pid);
 		else
diff --git a/criu/criu/crtools.c b/criu/criu/crtools.c
index 8951acbe2..8f9067364 100644
--- a/criu/criu/crtools.c
+++ b/criu/criu/crtools.c
@@ -450,6 +450,8 @@ int main(int argc, char *argv[], char *envp[])
 					if (opts.tfork.snap_roots_n > 0)
 						opts.root = opts.tfork.snap_roots[i];
 
+					opts.keep_pid_hierarchy = 0;
+
 					if (tfork_load_ncopy_fabric(i)) {
 						pr_err("tfork-ncopy: copy %d fabric load failed\n",
 						       i);
diff --git a/criu/criu/pstree.c b/criu/criu/pstree.c
index de7f45b3f..d903958c6 100644
--- a/criu/criu/pstree.c
+++ b/criu/criu/pstree.c
@@ -1280,6 +1280,8 @@ static int new_pid_ns_truncate_pid_hierarchy(pid_t *pid_max)
 	}
 
 	ns_level_to_truncate = root_item->pid->ns_level - 1;
+	pr_info("pidns: truncating %u outer pid namespace level(s) for new root pid namespace\n",
+		ns_level_to_truncate);
 
 	for (node = rb_first(&pid_root_rb[ALL_PID_NS_ID]); node; ) {
 		next = rb_next(node);
@@ -1287,9 +1289,15 @@ static int new_pid_ns_truncate_pid_hierarchy(pid_t *pid_max)
 		pid_node = rb_entry(node, struct pid, root_ns_node);
 		rb_erase(node, &pid_root_rb[ALL_PID_NS_ID]);
 
+		pr_info("pidns: truncate before uid=%d real=%d local=%d level=%d\n",
+			pid_node->uid, pid_node->real, pid_node->local,
+			pid_node->ns_level);
 		pid_node->ns_level -= ns_level_to_truncate;
 		BUG_ON(pid_node->ns_level <= 0);
 		pid_node->real = pid_node->ns[pid_node->ns_level - 1].ns_pid;
+		pr_info("pidns: truncate after uid=%d real=%d local=%d level=%d\n",
+			pid_node->uid, pid_node->real, pid_node->local,
+			pid_node->ns_level);
 
 		found = __lookup_pid_root(&new_real_rbtree, pid_node->real, &parent, &link);
 		if (found) {

From 7d87562cbc2895c4b99f53a809bfbf29278b26d8 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 17:03:11 -0700
Subject: [PATCH 18/38] Rebase nested tfork restore pid chains

---
 criu/criu/cr-restore.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index 788d64187..b93a3404a 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -1444,10 +1444,24 @@ static inline int fork_with_pid(struct pstree_item *item)
 		} else if (item->pid->ns_level == 1)
 			ret = clone3_with_pid_noasan(restore_task_with_children, &ca,
 						     ca.clone_flags & ~strip, SIGCHLD, pid);
-		else
+		else {
+			struct pid tfork_pid = {};
+			struct pid *restore_pid = item->pid;
+
+			if (opts.tfork.active && (root_ns_mask & CLONE_NEWPID) &&
+			    root_item && root_item->pid->ns_level > 1 &&
+			    item->pid->ns_level > 1) {
+				tfork_pid = *item->pid;
+				tfork_pid.ns_level--;
+				restore_pid = &tfork_pid;
+				pr_info("tfork: restore pid uid=%d local=%d with rebased pid chain level %d -> %d\n",
+					uid(item), pid, item->pid->ns_level,
+					restore_pid->ns_level);
+			}
 			ret = clone3_with_nested_pid_noasan(restore_task_with_children, &ca,
 							    ca.clone_flags & ~strip,
-							    SIGCHLD, item->pid);
+							    SIGCHLD, restore_pid);
+		}
 	} else {
 		BUG_ON(item->pid->ns_level >= 1);
 		close_pid_proc();

From 98c236093b66d1c2980800407ebae742cbd7d121 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 19:29:52 -0700
Subject: [PATCH 19/38] Force pid hierarchy truncation for tfork restores

---
 criu/criu/pstree.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/criu/criu/pstree.c b/criu/criu/pstree.c
index d903958c6..b773b6d8c 100644
--- a/criu/criu/pstree.c
+++ b/criu/criu/pstree.c
@@ -1270,8 +1270,12 @@ static int new_pid_ns_truncate_pid_hierarchy(pid_t *pid_max)
 	unsigned int ns_level_to_truncate;
 
 	clone_flags = get_clone_mask(root_item->ids, root_ids);
-	if (!(clone_flags & CLONE_NEWPID))
+	if (!(clone_flags & CLONE_NEWPID) &&
+	    !(opts.tfork.active && root_item->pid->ns_level > 1))
 		return 0;
+	if (!(clone_flags & CLONE_NEWPID))
+		pr_info("pidns: forcing tfork pid hierarchy truncation for root level=%d\n",
+			root_item->pid->ns_level);
 
 	if (root_item->pid->ns_level <= 1) {
 		pr_err("only 1 level of pid namespace, but CLONE_NEWPID is set, "

From d35c69386d602047ccf7ca8da1b7a142828836ef Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 19:41:57 -0700
Subject: [PATCH 20/38] Use fresh parent pids for tfork pidns inits

---
 criu/criu/clone-noasan.c | 16 ++++++++++++++++
 criu/criu/cr-restore.c   | 23 +++++++++++++++++------
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/criu/criu/clone-noasan.c b/criu/criu/clone-noasan.c
index 4ba7f6f31..368f6aa1e 100644
--- a/criu/criu/clone-noasan.c
+++ b/criu/criu/clone-noasan.c
@@ -78,7 +78,10 @@ int clone3_with_pid_noasan(int (*fn)(void *), void *arg, int flags, int exit_sig
 	c_args.flags = flags;
 	c_args.set_tid = ptr_to_u64(&pid);
 	c_args.set_tid_size = 1;
+	pr_info("clone3 set_tid pid=%d flags=0x%x size=1\n", pid, flags);
 	pid = syscall(__NR_clone3, &c_args, sizeof(c_args));
+	if (pid < 0)
+		pr_perror("clone3 set_tid failed flags=0x%x size=1", flags);
 	if (pid == 0)
 		exit(fn(arg));
 	return pid;
@@ -99,6 +102,12 @@ int clone3_with_nested_pid_noasan(int (*fn)(void *), void *arg, int flags, int e
 	BUG_ON(pid->ns_level > MAX_PID_NS_LEVEL || pid->ns_level <= 1);
 	for (i = 0; i < pid->ns_level; i++)
 		tids[i] = pid->ns[i].ns_pid;
+	pr_info("clone3 nested set_tid flags=0x%x size=%d tids=%d/%d/%d/%d\n",
+		flags, pid->ns_level,
+		tids[0],
+		pid->ns_level > 1 ? tids[1] : -1,
+		pid->ns_level > 2 ? tids[2] : -1,
+		pid->ns_level > 3 ? tids[3] : -1);
 
 	if (!(flags & CLONE_PARENT)) {
 		if (exit_signal != SIGCHLD) {
@@ -112,6 +121,13 @@ int clone3_with_nested_pid_noasan(int (*fn)(void *), void *arg, int flags, int e
 	c_args.set_tid = ptr_to_u64(tids);
 	c_args.set_tid_size = pid->ns_level;
 	pid_ret = syscall(__NR_clone3, &c_args, sizeof(c_args));
+	if (pid_ret < 0)
+		pr_perror("clone3 nested set_tid failed flags=0x%x size=%d tids=%d/%d/%d/%d",
+			  flags, pid->ns_level,
+			  tids[0],
+			  pid->ns_level > 1 ? tids[1] : -1,
+			  pid->ns_level > 2 ? tids[2] : -1,
+			  pid->ns_level > 3 ? tids[3] : -1);
 	if (pid_ret == 0)
 		exit(fn(arg));
 	return pid_ret;
diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index b93a3404a..1cfe390e4 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -1434,11 +1434,9 @@ static inline int fork_with_pid(struct pstree_item *item)
 		strip |= CLONE_NEWUSER;
 
 	if (kdat.has_clone3_set_tid) {
-		if (opts.tfork.active && item == root_item &&
-		    (ca.clone_flags & CLONE_NEWPID) &&
-		    item->pid->ns_level > 1) {
-			pr_info("tfork: restore root with local pid %d, dropping dumped outer pid chain level=%d\n",
-				pid, item->pid->ns_level);
+		if (opts.tfork.active && (ca.clone_flags & CLONE_NEWPID)) {
+			pr_info("tfork: restore pidns init uid=%d local pid %d with fresh parent pid, dumped chain level=%d\n",
+				uid(item), pid, item->pid->ns_level);
 			ret = clone3_with_pid_noasan(restore_task_with_children, &ca,
 						     ca.clone_flags & ~strip, SIGCHLD, pid);
 		} else if (item->pid->ns_level == 1)
@@ -1469,13 +1467,26 @@ static inline int fork_with_pid(struct pstree_item *item)
 				   (ca.clone_flags & ~strip) | SIGCHLD, &ca);
 	}
 	if (ret < 0) {
+		pr_err("fork_with_pid failed item uid=%d local=%d real=%d parent_local=%d flags=0x%lx stripped_flags=0x%lx ns_level=%d root_ns_mask=0x%lx tfork=%d\n",
+		       uid(item), pid, realpid(item),
+		       item->parent ? localpid(item->parent) : -1,
+		       ca.clone_flags, ca.clone_flags & ~strip,
+		       item->pid->ns_level, root_ns_mask,
+		       opts.tfork.active ? 1 : 0);
+		if (item->pid->ns_level > 0)
+			pr_err("fork_with_pid pid chain uid=%d ns=%d/%d/%d/%d\n",
+			       uid(item),
+			       item->pid->ns[0].ns_pid,
+			       item->pid->ns_level > 1 ? item->pid->ns[1].ns_pid : -1,
+			       item->pid->ns_level > 2 ? item->pid->ns[2].ns_pid : -1,
+			       item->pid->ns_level > 3 ? item->pid->ns[3].ns_pid : -1);
 		pr_perror("Can't fork for %d", pid);
 		if (errno == EEXIST)
 			set_cr_errno(EEXIST);
 		goto err_unlock;
 	}
 
-	if (item == root_item) {
+	if (opts.tfork.active || item == root_item) {
 		item->pid->real = ret;
 		pr_debug("PID: real %d virt %d\n", item->pid->real, localpid(item));
 	}

From 3d108b0380c39438e96b164928ce08ad0a545df7 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 19:48:46 -0700
Subject: [PATCH 21/38] Repair tfork pidns init clone flags

---
 criu/criu/cr-restore.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index 1cfe390e4..36aa08c42 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -1395,6 +1395,16 @@ static inline int fork_with_pid(struct pstree_item *item)
 
 	ca.item = item;
 	ca.clone_flags = rsti(item)->clone_flags;
+	if (opts.tfork.active && item != root_item &&
+	    !(ca.clone_flags & CLONE_NEWPID) &&
+	    item->pid->ns_level > 1 &&
+	    item->pid->ns[0].ns_pid == INIT_PID) {
+		pr_info("tfork: repairing missing CLONE_NEWPID for pidns init uid=%d local=%d parent_local=%d level=%d\n",
+			uid(item), pid,
+			item->parent ? localpid(item->parent) : -1,
+			item->pid->ns_level);
+		ca.clone_flags |= CLONE_NEWPID;
+	}
 
 	BUG_ON(ca.clone_flags & CLONE_VM);
 

From 13767add655165d6b23d6d6f0640a7fcf74eac22 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 19:59:16 -0700
Subject: [PATCH 22/38] Use fresh parent tids for tfork thread restore

---
 criu/criu/cr-restore.c       |  1 +
 criu/criu/include/restorer.h |  1 +
 criu/criu/pie/restorer.c     | 17 ++++++++++++++++-
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index 36aa08c42..b2cfbf03a 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -4087,6 +4087,7 @@ static int sigreturn_restore(struct task_restore_args *task_args, unsigned long
 	task_args->vdso_rt_size = vdso_rt_size;
 	task_args->can_map_vdso = kdat.can_map_vdso;
 	task_args->has_clone3_set_tid = kdat.has_clone3_set_tid;
+	task_args->tfork_active = opts.tfork.active;
 
 	new_sp = restorer_stack(task_args->t->mz);
 
diff --git a/criu/criu/include/restorer.h b/criu/criu/include/restorer.h
index 73e27caa3..40bb132d1 100644
--- a/criu/criu/include/restorer.h
+++ b/criu/criu/include/restorer.h
@@ -242,6 +242,7 @@ struct task_restore_args {
 	int child_subreaper;
 	int membarrier_registration_mask;
 	bool has_clone3_set_tid;
+	bool tfork_active;
 
 	/*
 	 * info about rseq from libc used to
diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index 9aaefe502..a5e89a5c8 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -2465,6 +2465,14 @@ __visible long __export_restore_task(struct task_restore_args *args)
 				c_args.set_tid = ptr_to_u64(thread_args[i].tid_in_ns);
 				c_args.flags = clone_flags;
 				c_args.set_tid_size = thread_args[i].ns_level;
+				if (args->tfork_active && thread_args[i].ns_level > 1) {
+					pr_info("tfork: restore thread pid=%d with fresh parent tid, set_tid_size %d -> 1 tids=%d/%d\n",
+						thread_args[i].pid,
+						thread_args[i].ns_level,
+						thread_args[i].tid_in_ns[0],
+						thread_args[i].tid_in_ns[1]);
+					c_args.set_tid_size = 1;
+				}
 				/* The kernel does stack + stack_size. */
 				c_args.stack = new_sp - RESTORE_STACK_SIZE;
 				c_args.stack_size = RESTORE_STACK_SIZE;
@@ -2495,7 +2503,14 @@ __visible long __export_restore_task(struct task_restore_args *args)
 						     args->clone_restore_fn);
 			}
 			if (ret != thread_args[i].pid) {
-				pr_err("Unable to create a thread: %ld\n", ret);
+				pr_err("Unable to create a thread: %ld expected=%d ns_level=%d tids=%d/%d/%d/%d tfork=%d\n",
+				       ret, thread_args[i].pid,
+				       thread_args[i].ns_level,
+				       thread_args[i].tid_in_ns[0],
+				       thread_args[i].ns_level > 1 ? thread_args[i].tid_in_ns[1] : -1,
+				       thread_args[i].ns_level > 2 ? thread_args[i].tid_in_ns[2] : -1,
+				       thread_args[i].ns_level > 3 ? thread_args[i].tid_in_ns[3] : -1,
+				       args->tfork_active ? 1 : 0);
 				sys_close(fd);
 				mutex_unlock(&task_entries_local->last_pid_mutex);
 				goto core_restore_end;

From d2b35f3950fff3fd862dd8f3028b59ef23abd1ff Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 20:18:35 -0700
Subject: [PATCH 23/38] Allow fresh tfork thread tids

---
 criu/criu/pie/restorer.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index a5e89a5c8..103b1102e 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -761,8 +761,16 @@ __visible long __export_restore_thread(struct thread_restore_args *args)
 	int ret;
 
 	if (my_pid != args->pid) {
-		pr_err("Thread pid mismatch %d/%d\n", my_pid, args->pid);
-		goto core_restore_end;
+		if (args->ta && args->ta->tfork_active) {
+			pr_info("tfork: accepting fresh thread tid %d instead of dumped tid %d\n",
+				my_pid, args->pid);
+			args->pid = my_pid;
+			if (args->ns_level > 0)
+				args->tid_in_ns[args->ns_level - 1] = my_pid;
+		} else {
+			pr_err("Thread pid mismatch %d/%d\n", my_pid, args->pid);
+			goto core_restore_end;
+		}
 	}
 
 	/* restore original shadow stack */
@@ -2465,13 +2473,14 @@ __visible long __export_restore_task(struct task_restore_args *args)
 				c_args.set_tid = ptr_to_u64(thread_args[i].tid_in_ns);
 				c_args.flags = clone_flags;
 				c_args.set_tid_size = thread_args[i].ns_level;
-				if (args->tfork_active && thread_args[i].ns_level > 1) {
-					pr_info("tfork: restore thread pid=%d with fresh parent tid, set_tid_size %d -> 1 tids=%d/%d\n",
+				if (args->tfork_active) {
+					pr_info("tfork: restore thread pid=%d with fresh tid, set_tid_size %d -> 0 tids=%d/%d\n",
 						thread_args[i].pid,
 						thread_args[i].ns_level,
 						thread_args[i].tid_in_ns[0],
-						thread_args[i].tid_in_ns[1]);
-					c_args.set_tid_size = 1;
+						thread_args[i].ns_level > 1 ? thread_args[i].tid_in_ns[1] : -1);
+					c_args.set_tid = 0;
+					c_args.set_tid_size = 0;
 				}
 				/* The kernel does stack + stack_size. */
 				c_args.stack = new_sp - RESTORE_STACK_SIZE;
@@ -2502,6 +2511,13 @@ __visible long __export_restore_task(struct task_restore_args *args)
 				RUN_CLONE_RESTORE_FN(ret, clone_flags, new_sp, parent_tid, thread_args,
 						     args->clone_restore_fn);
 			}
+			if (args->tfork_active && ret > 0 && ret != thread_args[i].pid) {
+				pr_info("tfork: thread tid remapped %d -> %ld\n",
+					thread_args[i].pid, ret);
+				thread_args[i].pid = ret;
+				if (thread_args[i].ns_level > 0)
+					thread_args[i].tid_in_ns[thread_args[i].ns_level - 1] = ret;
+			}
 			if (ret != thread_args[i].pid) {
 				pr_err("Unable to create a thread: %ld expected=%d ns_level=%d tids=%d/%d/%d/%d tfork=%d\n",
 				       ret, thread_args[i].pid,

From 7ee5852753ae8333d97d515ced91df523fe66b3e Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 21:07:47 -0700
Subject: [PATCH 24/38] Log tfork restore stage aborts

---
 criu/criu/cr-restore.c   | 6 ++++++
 criu/criu/pie/restorer.c | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index b2cfbf03a..a4f6141f8 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -189,6 +189,9 @@ static int __restore_wait_inprogress_tasks(int participants)
 	futex_wait_while_gt(np, participants);
 	ret = (int)futex_get(np);
 	if (ret < 0) {
+		pr_err("restore wait aborted: participants=%d nr_in_progress=%d start_stage=%d cr_err=%d task_cr_err=%d\n",
+		       participants, ret, (int)futex_get(&task_entries->start),
+		       (int)futex_get(&task_entries->cr_err), get_task_cr_err());
 		set_cr_errno(get_task_cr_err());
 		return ret;
 	}
@@ -227,6 +230,9 @@ static inline void __restore_switch_stage(int next_stage)
 
 static int restore_switch_stage(int next_stage)
 {
+	pr_info("restore_switch_stage %d participants=%d nr_tasks=%d nr_threads=%d nr_helpers=%d\n",
+		next_stage, stage_participants(next_stage), task_entries->nr_tasks,
+		task_entries->nr_threads, task_entries->nr_helpers);
 	__restore_switch_stage(next_stage);
 	return restore_wait_inprogress_tasks();
 }
diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index 103b1102e..08392f38a 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -162,7 +162,8 @@ static void sigchld_handler(int signal, siginfo_t *siginfo, void *data)
 	else
 		r = "disappeared with";
 
-	pr_info("Task %d %s %d\n", siginfo->si_pid, r, siginfo->si_status);
+	pr_err("SIGCHLD during restore: task %d %s %d\n",
+	       siginfo->si_pid, r, siginfo->si_status);
 
 	futex_abort_and_wake(&task_entries_local->nr_in_progress);
 	/* sa_restorer may be unmaped, so we can't go back to userspace*/

From 2ced506cd4e86e47e9f941a3668fa8324378492b Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 21:12:46 -0700
Subject: [PATCH 25/38] Fix restore abort diagnostic build

---
 criu/criu/cr-restore.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index a4f6141f8..6b240f66d 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -189,9 +189,9 @@ static int __restore_wait_inprogress_tasks(int participants)
 	futex_wait_while_gt(np, participants);
 	ret = (int)futex_get(np);
 	if (ret < 0) {
-		pr_err("restore wait aborted: participants=%d nr_in_progress=%d start_stage=%d cr_err=%d task_cr_err=%d\n",
+		pr_err("restore wait aborted: participants=%d nr_in_progress=%d start_stage=%d task_cr_err=%d\n",
 		       participants, ret, (int)futex_get(&task_entries->start),
-		       (int)futex_get(&task_entries->cr_err), get_task_cr_err());
+		       get_task_cr_err());
 		set_cr_errno(get_task_cr_err());
 		return ret;
 	}

From e04c1d7db398e67da075b14661c9f14e77ecabba Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 21:21:35 -0700
Subject: [PATCH 26/38] Tolerate clean child exits during tfork restore

---
 criu/criu/pie/restorer.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index 08392f38a..0af84e431 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -97,6 +97,7 @@ static pid_t *helpers;
 static int n_helpers;
 static pid_t *zombies;
 static int n_zombies;
+static bool tfork_active_local;
 static enum faults fi_strategy;
 bool fault_injected(enum faults f)
 {
@@ -164,6 +165,13 @@ static void sigchld_handler(int signal, siginfo_t *siginfo, void *data)
 
 	pr_err("SIGCHLD during restore: task %d %s %d\n",
 	       siginfo->si_pid, r, siginfo->si_status);
+	if (tfork_active_local &&
+	    siginfo->si_code == CLD_EXITED &&
+	    siginfo->si_status == 0) {
+		pr_info("tfork: ignoring clean child exit during restore: task %d\n",
+			siginfo->si_pid);
+		return;
+	}
 
 	futex_abort_and_wake(&task_entries_local->nr_in_progress);
 	/* sa_restorer may be unmaped, so we can't go back to userspace*/
@@ -1761,6 +1769,7 @@ __visible long __export_restore_task(struct task_restore_args *args)
 	fi_strategy = args->fault_strategy;
 
 	task_entries_local = args->task_entries;
+	tfork_active_local = args->tfork_active;
 	helpers = args->helpers;
 	n_helpers = args->helpers_n;
 	zombies = args->zombies;

From c1d28a77e0d182621022668324701b3ce6cc4c80 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 21:34:41 -0700
Subject: [PATCH 27/38] Make CRIU module loading idempotent

---
 criu/build.sh | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/criu/build.sh b/criu/build.sh
index cb1d9966c..58cb6d15c 100755
--- a/criu/build.sh
+++ b/criu/build.sh
@@ -93,12 +93,22 @@ for mod in "${ACTIVE_MODULES[@]}"; do
     fi
 
     if lsmod | awk '{print $1}' | grep -qx "${mod}"; then
-        echo "  -- ${mod}: already loaded, rmmod then insmod"
+        echo "  -- ${mod}: already loaded, trying reload"
         rmmod "${mod}" 2>/dev/null || true
-    else
-        echo "  -- ${mod}: insmod"
+        if lsmod | awk '{print $1}' | grep -qx "${mod}"; then
+            echo "  -- ${mod}: still loaded; keeping existing module"
+            continue
+        fi
+    fi
+
+    echo "  -- ${mod}: insmod"
+    if ! insmod "${ko_path}"; then
+        if lsmod | awk '{print $1}' | grep -qx "${mod}"; then
+            echo "  -- ${mod}: insmod reported already loaded; keeping existing module"
+            continue
+        fi
+        exit 1
     fi
-    insmod "${ko_path}"
 done
 
 echo "  -- verify all modules loaded"

From c862f96356029fdacf968b305952fce02b885ccd Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 21:37:48 -0700
Subject: [PATCH 28/38] Avoid fatal log for clean tfork child exits

---
 criu/criu/pie/restorer.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index 0af84e431..556927505 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -150,6 +150,14 @@ static void sigchld_handler(int signal, siginfo_t *siginfo, void *data)
 		if (siginfo->si_pid == zombies[i])
 			return;
 
+	if (tfork_active_local &&
+	    siginfo->si_code == CLD_EXITED &&
+	    siginfo->si_status == 0) {
+		pr_info("tfork: ignoring clean child exit during restore: task %d\n",
+			siginfo->si_pid);
+		return;
+	}
+
 	if (siginfo->si_code == CLD_EXITED)
 		r = "exited, status=";
 	else if (siginfo->si_code == CLD_KILLED)
@@ -165,13 +173,6 @@ static void sigchld_handler(int signal, siginfo_t *siginfo, void *data)
 
 	pr_err("SIGCHLD during restore: task %d %s %d\n",
 	       siginfo->si_pid, r, siginfo->si_status);
-	if (tfork_active_local &&
-	    siginfo->si_code == CLD_EXITED &&
-	    siginfo->si_status == 0) {
-		pr_info("tfork: ignoring clean child exit during restore: task %d\n",
-			siginfo->si_pid);
-		return;
-	}
 
 	futex_abort_and_wake(&task_entries_local->nr_in_progress);
 	/* sa_restorer may be unmaped, so we can't go back to userspace*/

From 235832517965e574140f386ffb9ccc6384425ee9 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 22:08:38 -0700
Subject: [PATCH 29/38] Default tfork single-copy to direct crun

---
 podman/pkg/domain/infra/abi/container_tfork.go | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index 331838c7d..dd5130c9e 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -56,11 +56,12 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	}
 	requestedCopies := copies
 	useSingleCopyConmon := requestedCopies == 1 && os.Getenv("PODMAN_TFORK_SINGLE_COPY_CONMON") == "1"
-	if requestedCopies == 1 && !useSingleCopyConmon {
-		// The CRIU/crun single-copy tfork path can abort before producing a
-		// clone PID (`free(): invalid pointer`). Run a two-copy batch internally
-		// to use the known-good batch path, then remove the hidden spare clone
-		// before returning to the caller.
+	useHiddenSpareCopy := requestedCopies == 1 && os.Getenv("PODMAN_TFORK_HIDDEN_SPARE_COPY") == "1"
+	if useHiddenSpareCopy && !useSingleCopyConmon {
+		// Older tfork experiments used a two-copy batch internally to avoid
+		// single-copy restore bugs, then removed the hidden spare. Keep that
+		// path available for diagnostics, but make the requested single-copy
+		// direct-crun path the default.
 		copies = 2
 	}
 

From 6363d892c2704a12121cdbe802dff2b780272d4c Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 22:25:19 -0700
Subject: [PATCH 30/38] Make tfork clone readiness timeout configurable

---
 .../pkg/domain/infra/abi/container_tfork.go   | 23 +++++++++++++++----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index dd5130c9e..180843715 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -16,7 +17,6 @@ import (
 
 	"github.com/containers/podman/v5/libpod"
 	"github.com/containers/podman/v5/libpod/define"
-	"strconv"
 
 	"github.com/containers/podman/v5/pkg/domain/entities"
 	"github.com/containers/podman/v5/utils"
@@ -31,11 +31,23 @@ const (
 	tforkSourceFreezeTimeout = 10 * time.Second
 	tforkSourceThawTimeout   = 10 * time.Second
 	tforkCloneReadyTimeout   = 60 * time.Second
-	tforkCrunFinishTimeout   = tforkCloneReadyTimeout
 	tforkCgroupPollInterval  = 50 * time.Millisecond
 	tforkClonePollInterval   = 200 * time.Millisecond
 )
 
+func tforkCloneReadyTimeoutFromEnv() time.Duration {
+	value := strings.TrimSpace(os.Getenv("PODMAN_TFORK_CLONE_READY_TIMEOUT_SECS"))
+	if value == "" {
+		return tforkCloneReadyTimeout
+	}
+	seconds, err := strconv.Atoi(value)
+	if err != nil || seconds <= 0 {
+		logrus.Warnf("tfork: ignoring invalid PODMAN_TFORK_CLONE_READY_TIMEOUT_SECS=%q", value)
+		return tforkCloneReadyTimeout
+	}
+	return time.Duration(seconds) * time.Second
+}
+
 func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities.ContainerCloneOptions) (rep *entities.ContainerCreateReport, retErr error) {
 	src, err := ic.Libpod.LookupContainer(opts.ID)
 	if err != nil {
@@ -596,7 +608,8 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		}
 		statePath := fmt.Sprintf("/run/crun/%s/status", cloneIDs[0])
 		needState := copies == 1
-		deadline := time.Now().Add(tforkCloneReadyTimeout)
+		cloneReadyTimeout := tforkCloneReadyTimeoutFromEnv()
+		deadline := time.Now().Add(cloneReadyTimeout)
 		readyCopies := 0
 		stateReady := !needState
 		crunExited := false
@@ -641,11 +654,11 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			select {
 			case crunErr = <-crunDone:
 				crunExited = true
-			case <-time.After(tforkCrunFinishTimeout):
+			case <-time.After(cloneReadyTimeout):
 				tforkAbortCrunCmd(crunCmd, src, bundleDir, copies)
 				crunAborted = true
 				return nil, fmt.Errorf("timeout waiting %s for crun tfork to finish after %d clones came up; see %s",
-					tforkCrunFinishTimeout, copies, logPath)
+					cloneReadyTimeout, copies, logPath)
 			}
 		}
 		if crunErr != nil {

From 8b0cbd9fa50a34f47e3d646e5e6670d42e1c4763 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 22:57:56 -0700
Subject: [PATCH 31/38] Use n-copy restore for single-copy tfork clones

---
 criu/criu/cr-tfork.c                          |  4 +-
 criu/criu/crtools.c                           |  6 +--
 crun/src/libcrun/criu.c                       |  8 +--
 crun/src/tfork.c                              |  4 +-
 .../pkg/domain/infra/abi/container_tfork.go   | 51 +++++--------------
 5 files changed, 23 insertions(+), 50 deletions(-)

diff --git a/criu/criu/cr-tfork.c b/criu/criu/cr-tfork.c
index ca5a5c61c..aa33b0a04 100644
--- a/criu/criu/cr-tfork.c
+++ b/criu/criu/cr-tfork.c
@@ -271,7 +271,7 @@ int tfork_read_cropt(void)
 		return 0;
 
 	snap_path = opts.tfork.snap_root;
-	if (!snap_path && opts.tfork.copies > 1 && opts.tfork.snap_roots &&
+	if (!snap_path && opts.tfork.copies >= 1 && opts.tfork.snap_roots &&
 	    opts.tfork.copy_idx < opts.tfork.snap_roots_n)
 		snap_path = opts.tfork.snap_roots[opts.tfork.copy_idx];
 
@@ -1173,7 +1173,7 @@ int cr_tfork_tasks(pid_t pid)
 				rpc_argv[rpc_n++] = "--tfork-snap-mounts";
 				rpc_argv[rpc_n++] = snap_mounts_csv;
 			}
-			if (opts.tfork.copies > 1) {
+			if (opts.tfork.copies >= 1) {
 				snprintf(copies_arg, sizeof(copies_arg),
 					 "%d", opts.tfork.copies);
 				rpc_argv[rpc_n++] = "--tfork-copies";
diff --git a/criu/criu/crtools.c b/criu/criu/crtools.c
index 8f9067364..1243c8087 100644
--- a/criu/criu/crtools.c
+++ b/criu/criu/crtools.c
@@ -332,7 +332,7 @@ int main(int argc, char *argv[], char *envp[])
 		if (opts.tree_id)
 			pr_warn("Using -t with criu restore is obsoleted\n");
 
-		if (opts.tfork.copies > 1) {
+		if (opts.tfork.active && opts.tfork.copies >= 1) {
 			int n = opts.tfork.copies, i;
 			pid_t *children;
 			int (*ready_pipes)[2];
@@ -348,14 +348,14 @@ int main(int argc, char *argv[], char *envp[])
 			const int ns_flags = CLONE_NEWNS;
 
 			if (!opts.tfork.active) {
-				pr_err("--tfork-copies>1 requires --tfork-restore "
+				pr_err("--tfork-copies requires --tfork-restore "
 				       "(use 'criu tfork --tfork-copies=N', not "
 				       "'criu restore --tfork-copies=N')\n");
 				return 1;
 			}
 
 			if (!opts.restore_detach) {
-				pr_err("--tfork-copies>1 requires --restore-detached\n");
+				pr_err("--tfork-copies requires --restore-detached\n");
 				return 1;
 			}
 
diff --git a/crun/src/libcrun/criu.c b/crun/src/libcrun/criu.c
index 112f21f6b..174288d20 100644
--- a/crun/src/libcrun/criu.c
+++ b/crun/src/libcrun/criu.c
@@ -1513,7 +1513,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
     return crun_make_error (err, 0,
                             "--tfork-snap-root, --tfork-snap-roots, or --tfork-copy=<i>::--tfork-snap-root=PATH is required");
 
-  if (cr_options->tfork_copies > 1 && cr_options->tfork_snap_roots_n > 0
+  if (cr_options->tfork_copies >= 1 && cr_options->tfork_snap_roots_n > 0
       && (size_t) cr_options->tfork_copies != cr_options->tfork_snap_roots_n)
     return crun_make_error (err, 0,
                             "--tfork-copies=%d but --tfork-snap-roots has %zu entries",
@@ -1631,7 +1631,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
         }
     }
 
-  if (cr_options->tfork_copies > 1)
+  if (cr_options->tfork_copies >= 1)
     libcriu_wrapper->criu_set_tfork_copies (cr_options->tfork_copies);
 
   if (cr_options->tfork_memdump_async)
@@ -1860,7 +1860,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
       pid_t clone_pid;
       const char *pidfile_name = "tfork.pid";
 
-      if (cr_options->tfork_copies > 1)
+      if (cr_options->tfork_copies >= 1)
         pidfile_name = "tfork.pid.copy0";
 
       ret = append_paths (&pidfile_path, err, cr_options->image_path, pidfile_name, NULL);
@@ -1875,7 +1875,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
       if (UNLIKELY (clone_pid <= 0))
         return crun_make_error (err, 0, "invalid clone PID %d in `%s`", (int) clone_pid, pidfile_path);
 
-      if (cr_options->tfork_copies > 1)
+      if (cr_options->tfork_copies >= 1)
         {
           char children_path[64];
           cleanup_free char *children_buf = NULL;
diff --git a/crun/src/tfork.c b/crun/src/tfork.c
index 31db969ef..a5a25af89 100644
--- a/crun/src/tfork.c
+++ b/crun/src/tfork.c
@@ -83,7 +83,7 @@ static struct argp_option options[]
         { "parent-path", OPTION_PARENT_PATH, "DIR", 0, "previous criu images dir, for incremental memdump chains", 0 },
         { "tfork-memdump", OPTION_TFORK_MEMDUMP, 0, 0, "dump pages-*.img to image-path during tfork", 0 },
         { "tfork-memdump-async", OPTION_TFORK_MEMDUMP_ASYNC, 0, 0, "async page dump (implies --tfork-memdump)", 0 },
-        { "tfork-copies", OPTION_TFORK_COPIES, "N", 0, "produce N parallel clones (default 1)", 0 },
+        { "tfork-copies", OPTION_TFORK_COPIES, "N", 0, "produce N clones through the n-copy helper (omitted: legacy direct single-copy)", 0 },
         { "track-mem", OPTION_TRACK_MEM, 0, 0, "arm soft-dirty for chained incremental dumps", 0 },
         { "manage-cgroups-mode", OPTION_MANAGE_CGROUPS_MODE, "MODE", 0,
           "cgroups mode: 'soft' (default), 'ignore', 'full' and 'strict'", 0 },
@@ -359,7 +359,7 @@ int
 crun_command_tfork (struct crun_global_arguments *global_args, int argc, char **argv, libcrun_error_t *err)
 {
   cr_options.manage_cgroups_mode = -1;
-  cr_options.tfork_copies = 1;
+  cr_options.tfork_copies = 0;
   cr_options.leave_running = true;
 
   return crun_run_create_internal (global_args, argc, argv, container_tfork, get_options, &crun_context, &run_argp,
diff --git a/podman/pkg/domain/infra/abi/container_tfork.go b/podman/pkg/domain/infra/abi/container_tfork.go
index 180843715..2a14b9d0c 100644
--- a/podman/pkg/domain/infra/abi/container_tfork.go
+++ b/podman/pkg/domain/infra/abi/container_tfork.go
@@ -68,14 +68,8 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	}
 	requestedCopies := copies
 	useSingleCopyConmon := requestedCopies == 1 && os.Getenv("PODMAN_TFORK_SINGLE_COPY_CONMON") == "1"
-	useHiddenSpareCopy := requestedCopies == 1 && os.Getenv("PODMAN_TFORK_HIDDEN_SPARE_COPY") == "1"
-	if useHiddenSpareCopy && !useSingleCopyConmon {
-		// Older tfork experiments used a two-copy batch internally to avoid
-		// single-copy restore bugs, then removed the hidden spare. Keep that
-		// path available for diagnostics, but make the requested single-copy
-		// direct-crun path the default.
-		copies = 2
-	}
+	useSingleCopyDirect := requestedCopies == 1 && os.Getenv("PODMAN_TFORK_SINGLE_COPY_DIRECT") == "1"
+	useNcopyRestore := copies > 1 || (requestedCopies == 1 && !useSingleCopyConmon && !useSingleCopyDirect)
 
 	var srcRootfs string
 	if cfg := src.Config(); cfg != nil && cfg.ExternalSetup && cfg.Rootfs != "" {
@@ -241,11 +235,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			baseName = src.Name() + "-clone"
 		}
 		cloneName := baseName
-		if requestedCopies == 1 && copies > 1 {
-			if i > 0 {
-				cloneName = fmt.Sprintf("%s-tfork-spare-%d", baseName, i)
-			}
-		} else if copies > 1 {
+		if copies > 1 {
 			cloneName = fmt.Sprintf("%s-%d", baseName, i)
 		}
 		cloneNames[i] = cloneName
@@ -329,7 +319,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		"--source-state", srcStatePath,
 		"--image-path", imgDir,
 	}
-	if copies == 1 {
+	if !useNcopyRestore {
 		crunArgs = append(crunArgs, "--tfork-snap-root", cloneRootfsList[0])
 		crunArgs = append(crunArgs, "--tfork-snap-mount", "/")
 		if cloneCgroupPaths[0] != "" {
@@ -494,8 +484,8 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		var perCopyExtraFiles []*os.File
 		var perCopyReadEnds []*os.File
 		var perCopyArgs []string
-		skipTtySrcFds := copies > 1 && hasTTY
-		if copies > 1 {
+		skipTtySrcFds := useNcopyRestore && hasTTY
+		if useNcopyRestore {
 			ifdsForPerCopy, stdioKeys := splitStdioInheritFds(inheritFds)
 			inheritFds = ifdsForPerCopy
 			extraFDBase := 3
@@ -601,13 +591,13 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 		}
 
 		pidFileFor := func(i int) string {
-			if copies == 1 {
+			if !useNcopyRestore {
 				return filepath.Join(imgDir, "tfork.pid")
 			}
 			return filepath.Join(imgDir, fmt.Sprintf("tfork.pid.copy%d", i))
 		}
 		statePath := fmt.Sprintf("/run/crun/%s/status", cloneIDs[0])
-		needState := copies == 1
+		needState := !useNcopyRestore && copies == 1
 		cloneReadyTimeout := tforkCloneReadyTimeoutFromEnv()
 		deadline := time.Now().Add(cloneReadyTimeout)
 		readyCopies := 0
@@ -682,7 +672,7 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 	}
 	visibleCloneIDs := make([]string, 0, requestedCopies)
 	for i, cloneID := range cloneIDs {
-		clonePID, err := readTforkClonePID(cloneID, imgDir, i, copies)
+		clonePID, err := readTforkClonePID(cloneID, imgDir, i, copies, useNcopyRestore)
 		if err != nil {
 			return nil, fmt.Errorf("read clone %d PID: %w", i, err)
 		}
@@ -747,29 +737,12 @@ func (ic *ContainerEngine) containerCloneLive(ctx context.Context, opts entities
 			}
 		}
 		logrus.Infof("tfork: clone %s (%s) registered in libpod state, pid=%d", cloneID, cloneNames[i], clonePID)
-		if i >= requestedCopies {
-			if err := removeHiddenTforkClone(ctx, ic, ctr); err != nil {
-				logrus.Warnf("tfork: hidden spare clone %s cleanup failed: %v", cloneID, err)
-			} else {
-				logrus.Infof("tfork: hidden spare clone %s removed", cloneID)
-			}
-			continue
-		}
 		visibleCloneIDs = append(visibleCloneIDs, cloneID)
 	}
 
 	return &entities.ContainerCreateReport{Id: strings.Join(visibleCloneIDs, "\n")}, nil
 }
 
-func removeHiddenTforkClone(ctx context.Context, ic *ContainerEngine, ctr *libpod.Container) error {
-	oldNoReap, hadNoReap := os.LookupEnv("PODMAN_TFORK_NO_REAP")
-	if hadNoReap {
-		_ = os.Unsetenv("PODMAN_TFORK_NO_REAP")
-		defer os.Setenv("PODMAN_TFORK_NO_REAP", oldNoReap)
-	}
-	return ic.Libpod.RemoveContainer(ctx, ctr, true, true, nil)
-}
-
 type tforkCgroupFreezer struct {
 	root       string
 	statePath  string
@@ -1324,7 +1297,7 @@ func spawnTforkExitWatcher(ctx context.Context, rt *libpod.Runtime, ctr *libpod.
 	return nil
 }
 
-func readTforkClonePID(cloneID string, imgDir string, copyIdx, copies int) (int, error) {
+func readTforkClonePID(cloneID string, imgDir string, copyIdx, copies int, useNcopyRestore bool) (int, error) {
 	statePath := fmt.Sprintf("/run/crun/%s/status", cloneID)
 	if data, err := os.ReadFile(statePath); err == nil {
 		var st struct {
@@ -1335,7 +1308,7 @@ func readTforkClonePID(cloneID string, imgDir string, copyIdx, copies int) (int,
 		}
 	}
 	var pidFile string
-	if copies == 1 {
+	if !useNcopyRestore {
 		pidFile = filepath.Join(imgDir, "tfork.pid")
 	} else {
 		pidFile = filepath.Join(imgDir, fmt.Sprintf("tfork.pid.copy%d", copyIdx))
@@ -1348,7 +1321,7 @@ func readTforkClonePID(cloneID string, imgDir string, copyIdx, copies int) (int,
 	if err != nil {
 		return 0, err
 	}
-	if copies == 1 {
+	if !useNcopyRestore {
 		return rcPID, nil
 	}
 	initPID, err := readFirstChildPID(rcPID)

From 5b778142e16fec2138a054934a4d3bc605e5a848 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 23:26:54 -0700
Subject: [PATCH 32/38] Allow external unix sockets during tfork

---
 crun/src/tfork.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/crun/src/tfork.c b/crun/src/tfork.c
index a5a25af89..2c1d3438e 100644
--- a/crun/src/tfork.c
+++ b/crun/src/tfork.c
@@ -360,6 +360,12 @@ crun_command_tfork (struct crun_global_arguments *global_args, int argc, char **
 {
   cr_options.manage_cgroups_mode = -1;
   cr_options.tfork_copies = 0;
+  /*
+   * Agent runtimes commonly keep Unix sockets connected to helpers outside the
+   * dumped process subtree (tmux/Codex hooks, host-control bridges, etc.).
+   * Without this CRIU rejects the dump before restore begins.
+   */
+  cr_options.ext_unix_sk = true;
   cr_options.leave_running = true;
 
   return crun_run_create_internal (global_args, argc, argv, container_tfork, get_options, &crun_context, &run_argp,

From ba9488780b92d48246a8bfca848d76ecf6e1bd07 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Fri, 17 Jul 2026 23:39:22 -0700
Subject: [PATCH 33/38] Propagate ext unix socket option to tfork

---
 crun/src/libcrun/criu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crun/src/libcrun/criu.c b/crun/src/libcrun/criu.c
index 174288d20..1e1dbbed2 100644
--- a/crun/src/libcrun/criu.c
+++ b/crun/src/libcrun/criu.c
@@ -1566,6 +1566,7 @@ libcrun_container_tfork_linux_criu (libcrun_container_t *container, libcrun_chec
 
   libcriu_wrapper->criu_set_pid (source_pid);
   libcriu_wrapper->criu_set_leave_running (true);
+  libcriu_wrapper->criu_set_ext_unix_sk (cr_options->ext_unix_sk);
   libcriu_wrapper->criu_set_file_locks (true);
 
   cgroup_mode = libcrun_get_cgroup_mode (err);

From 7693c326bd119adb3c3b3f21f644f7ea21cec808 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 18 Jul 2026 08:39:26 -0700
Subject: [PATCH 34/38] Skip inotify mark replay for tfork restores

---
 criu/criu/fsnotify.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/criu/criu/fsnotify.c b/criu/criu/fsnotify.c
index ab8a29dd6..2aac52d0b 100644
--- a/criu/criu/fsnotify.c
+++ b/criu/criu/fsnotify.c
@@ -1037,6 +1037,23 @@ static int open_inotify_fd(struct file_desc *d, int *new_fd)
 		return -1;
 	}
 
+	if (opts.tfork.active) {
+		unsigned int skipped = 0;
+
+		list_for_each_entry(wd_info, &info->marks, list)
+			skipped++;
+
+		if (skipped)
+			pr_warn("tfork: restored inotify fd %#08x without %u watch mark(s)\n",
+				info->ife->id, skipped);
+
+		if (restore_fown(tmp, info->ife->fown))
+			close_safe(&tmp);
+
+		*new_fd = tmp;
+		return tmp < 0 ? -1 : 0;
+	}
+
 	list_for_each_entry(wd_info, &info->marks, list) {
 		pr_info("\tRestore 0x%x wd for %#08x\n", wd_info->iwe->wd, wd_info->iwe->id);
 		if (restore_one_inotify(tmp, wd_info)) {

From 6a14400201bb7bdb6d0c5473178f2292102b3e96 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 18 Jul 2026 08:46:46 -0700
Subject: [PATCH 35/38] Add tfork restore stage timeout diagnostics

---
 criu/criu/cr-restore.c | 36 ++++++++++++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/criu/criu/cr-restore.c b/criu/criu/cr-restore.c
index 6b240f66d..fc1f089c7 100644
--- a/criu/criu/cr-restore.c
+++ b/criu/criu/cr-restore.c
@@ -186,7 +186,27 @@ static int __restore_wait_inprogress_tasks(int participants)
 	int ret;
 	futex_t *np = &task_entries->nr_in_progress;
 
-	futex_wait_while_gt(np, participants);
+	if (opts.tfork.active) {
+		int waited;
+
+		for (waited = 0; waited < 100; waited++) {
+			if ((int)futex_get(np) <= participants)
+				break;
+			usleep(100000);
+		}
+
+		if ((int)futex_get(np) > participants) {
+			pr_err("tfork restore wait timed out: participants=%d nr_in_progress=%d start_stage=%d nr_tasks=%d nr_threads=%d nr_helpers=%d\n",
+			       participants, (int)futex_get(np),
+			       (int)futex_get(&task_entries->start),
+			       task_entries->nr_tasks, task_entries->nr_threads,
+			       task_entries->nr_helpers);
+			return -ETIMEDOUT;
+		}
+	} else {
+		futex_wait_while_gt(np, participants);
+	}
+
 	ret = (int)futex_get(np);
 	if (ret < 0) {
 		pr_err("restore wait aborted: participants=%d nr_in_progress=%d start_stage=%d task_cr_err=%d\n",
@@ -230,9 +250,17 @@ static inline void __restore_switch_stage(int next_stage)
 
 static int restore_switch_stage(int next_stage)
 {
-	pr_info("restore_switch_stage %d participants=%d nr_tasks=%d nr_threads=%d nr_helpers=%d\n",
-		next_stage, stage_participants(next_stage), task_entries->nr_tasks,
-		task_entries->nr_threads, task_entries->nr_helpers);
+	if (opts.tfork.active)
+		pr_warn("tfork: restore_switch_stage %d participants=%d nr_tasks=%d nr_threads=%d nr_helpers=%d\n",
+			next_stage, stage_participants(next_stage),
+			task_entries->nr_tasks, task_entries->nr_threads,
+			task_entries->nr_helpers);
+	else
+		pr_info("restore_switch_stage %d participants=%d nr_tasks=%d nr_threads=%d nr_helpers=%d\n",
+			next_stage, stage_participants(next_stage),
+			task_entries->nr_tasks, task_entries->nr_threads,
+			task_entries->nr_helpers);
+
 	__restore_switch_stage(next_stage);
 	return restore_wait_inprogress_tasks();
 }

From 176d7f2055553b2f5c770725705c4ee3fa2e4c5c Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 18 Jul 2026 10:08:13 -0700
Subject: [PATCH 36/38] Log tfork restore stage participants

---
 criu/criu/pie/restorer.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index 556927505..1357ccfbc 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -825,11 +825,17 @@ __visible long __export_restore_thread(struct thread_restore_args *args)
 	}
 
 	pr_info("%ld: Restored\n", sys_gettid());
+	if (args->ta->tfork_active)
+		pr_warn("tfork: thread restore stage complete pid=%d tid=%ld comm=%s ns_level=%d\n",
+			args->pid, sys_gettid(), args->comm, args->ns_level);
 	restore_finish_stage(task_entries_local, CR_STATE_RESTORE);
 
 	if (restore_signals(args->siginfo, args->siginfo_n, false)){
 		goto core_restore_end;
 	}
+	if (args->ta->tfork_active)
+		pr_warn("tfork: thread sigchld stage complete pid=%d tid=%ld comm=%s ns_level=%d\n",
+			args->pid, sys_gettid(), args->comm, args->ns_level);
 	restore_finish_stage(task_entries_local, CR_STATE_RESTORE_SIGCHLD);
 
 	/*
@@ -2566,6 +2572,10 @@ __visible long __export_restore_task(struct task_restore_args *args)
 	if (restore_membarrier_registrations(args->membarrier_registration_mask) < 0)
 		goto core_restore_end;
 	pr_info("%ld: Restored\n", sys_getpid());
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore stage complete pid=%d tid=%ld comm=%s threads=%d ns_level=%d\n",
+			args->t->pid, sys_getpid(), args->comm, args->nr_threads,
+			args->t->ns_level);
 
 	restore_finish_stage(task_entries_local, CR_STATE_RESTORE);
 
@@ -2609,6 +2619,10 @@ __visible long __export_restore_task(struct task_restore_args *args)
 	if (ret)
 		goto core_restore_end;
 
+	if (args->tfork_active)
+		pr_warn("tfork: leader sigchld stage complete pid=%d tid=%ld comm=%s threads=%d ns_level=%d\n",
+			args->t->pid, sys_getpid(), args->comm, args->nr_threads,
+			args->t->ns_level);
 	restore_finish_stage(task_entries_local, CR_STATE_RESTORE_SIGCHLD);
 
 	rst_tcp_socks_all(args);

From e8426fd9c543d7fd465fae2a724af5a1e9a60150 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 18 Jul 2026 10:31:05 -0700
Subject: [PATCH 37/38] Trace tfork leader restore stalls

---
 criu/criu/pie/restorer.c | 57 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 53 insertions(+), 4 deletions(-)

diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index 1357ccfbc..c32075572 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -828,7 +828,10 @@ __visible long __export_restore_thread(struct thread_restore_args *args)
 	if (args->ta->tfork_active)
 		pr_warn("tfork: thread restore stage complete pid=%d tid=%ld comm=%s ns_level=%d\n",
 			args->pid, sys_gettid(), args->comm, args->ns_level);
-	restore_finish_stage(task_entries_local, CR_STATE_RESTORE);
+	ret = restore_finish_stage(task_entries_local, CR_STATE_RESTORE);
+	if (args->ta->tfork_active)
+		pr_warn("tfork: thread restore barrier returned pid=%d tid=%ld comm=%s stage=%d\n",
+			args->pid, sys_gettid(), args->comm, ret);
 
 	if (restore_signals(args->siginfo, args->siginfo_n, false)){
 		goto core_restore_end;
@@ -836,7 +839,10 @@ __visible long __export_restore_thread(struct thread_restore_args *args)
 	if (args->ta->tfork_active)
 		pr_warn("tfork: thread sigchld stage complete pid=%d tid=%ld comm=%s ns_level=%d\n",
 			args->pid, sys_gettid(), args->comm, args->ns_level);
-	restore_finish_stage(task_entries_local, CR_STATE_RESTORE_SIGCHLD);
+	ret = restore_finish_stage(task_entries_local, CR_STATE_RESTORE_SIGCHLD);
+	if (args->ta->tfork_active)
+		pr_warn("tfork: thread sigchld barrier returned pid=%d tid=%ld comm=%s stage=%d\n",
+			args->pid, sys_gettid(), args->comm, ret);
 
 	/*
 	 * Make sure it's before creds, since it's privileged
@@ -2577,12 +2583,28 @@ __visible long __export_restore_task(struct task_restore_args *args)
 			args->t->pid, sys_getpid(), args->comm, args->nr_threads,
 			args->t->ns_level);
 
-	restore_finish_stage(task_entries_local, CR_STATE_RESTORE);
+	ret = restore_finish_stage(task_entries_local, CR_STATE_RESTORE);
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore barrier returned pid=%d tid=%ld comm=%s stage=%ld helpers=%u zombies=%u inotify=%u\n",
+			args->t->pid, sys_getpid(), args->comm, ret,
+			args->helpers_n, args->zombies_n, args->inotify_fds_n);
 
+	if (args->tfork_active)
+		pr_warn("tfork: leader wait_helpers start pid=%d tid=%ld comm=%s helpers=%u\n",
+			args->t->pid, sys_getpid(), args->comm, args->helpers_n);
 	if (wait_helpers(args) < 0)
 		goto core_restore_end;
+	if (args->tfork_active)
+		pr_warn("tfork: leader wait_helpers done pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
+	if (args->tfork_active)
+		pr_warn("tfork: leader wait_zombies start pid=%d tid=%ld comm=%s zombies=%u\n",
+			args->t->pid, sys_getpid(), args->comm, args->zombies_n);
 	if (wait_zombies(args) < 0)
 		goto core_restore_end;
+	if (args->tfork_active)
+		pr_warn("tfork: leader wait_zombies done pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 
 	ksigfillset(&to_block);
 	ret = sys_sigprocmask(SIG_SETMASK, &to_block, NULL, sizeof(k_rtsigset_t));
@@ -2591,9 +2613,18 @@ __visible long __export_restore_task(struct task_restore_args *args)
 		goto core_restore_end;
 	}
 
+	if (args->tfork_active)
+		pr_warn("tfork: leader cleanup_inotify start pid=%d tid=%ld comm=%s inotify=%u\n",
+			args->t->pid, sys_getpid(), args->comm, args->inotify_fds_n);
 	if (cleanup_current_inotify_events(args))
 		goto core_restore_end;
+	if (args->tfork_active)
+		pr_warn("tfork: leader cleanup_inotify done pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore sigaction start pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 	if (!args->compatible_mode) {
 		ret = sys_sigaction(SIGCHLD, &args->sigchld_act, NULL, sizeof(k_rtsigset_t));
 	} else {
@@ -2610,20 +2641,38 @@ __visible long __export_restore_task(struct task_restore_args *args)
 		pr_err("Failed to restore SIGCHLD: %ld\n", ret);
 		goto core_restore_end;
 	}
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore sigaction done pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore shared signals start pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 	ret = restore_signals(args->siginfo, args->siginfo_n, true);
 	if (ret)
 		goto core_restore_end;
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore shared signals done pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore private signals start pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 	ret = restore_signals(args->t->siginfo, args->t->siginfo_n, false);
 	if (ret)
 		goto core_restore_end;
+	if (args->tfork_active)
+		pr_warn("tfork: leader restore private signals done pid=%d tid=%ld comm=%s\n",
+			args->t->pid, sys_getpid(), args->comm);
 
 	if (args->tfork_active)
 		pr_warn("tfork: leader sigchld stage complete pid=%d tid=%ld comm=%s threads=%d ns_level=%d\n",
 			args->t->pid, sys_getpid(), args->comm, args->nr_threads,
 			args->t->ns_level);
-	restore_finish_stage(task_entries_local, CR_STATE_RESTORE_SIGCHLD);
+	ret = restore_finish_stage(task_entries_local, CR_STATE_RESTORE_SIGCHLD);
+	if (args->tfork_active)
+		pr_warn("tfork: leader sigchld barrier returned pid=%d tid=%ld comm=%s stage=%ld\n",
+			args->t->pid, sys_getpid(), args->comm, ret);
 
 	rst_tcp_socks_all(args);
 

From eb724fdb28413e22119da94887bc6b97d82a2757 Mon Sep 17 00:00:00 2001
From: yiying-zhang <yzggroup@gmail.com>
Date: Sat, 18 Jul 2026 18:30:30 -0700
Subject: [PATCH 38/38] Avoid tfork zombie wait deadlock

---
 criu/criu/pie/restorer.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/criu/criu/pie/restorer.c b/criu/criu/pie/restorer.c
index c32075572..a58ae5ed5 100644
--- a/criu/criu/pie/restorer.c
+++ b/criu/criu/pie/restorer.c
@@ -1506,6 +1506,11 @@ static int wait_zombies(struct task_restore_args *task_args)
 
 		ret = sys_waitid(P_PID, task_args->zombies[i], NULL, WNOWAIT | WEXITED, NULL);
 		if (ret == -ECHILD) {
+			if (task_args->tfork_active) {
+				pr_warn("tfork: zombie pid %d is not reparented to task %ld; skipping wait to avoid restore barrier deadlock\n",
+					task_args->zombies[i], sys_getpid());
+				continue;
+			}
 			/* A process isn't reparented to this task yet.
 			 * Let's wait when someone complete this stage
 			 * and try again.