Diagnosing Persistent Performance Degradation and Sudden Shutdowns

Gold95

I’m running GrapheneOS on a Pixel 8 (2023). I've generally followed good operational security practices except for F-Droid (OsmAnd~) and Play Services (Camera + Play Store). No root. No attestation alerts. My biggest threats are using Browsers (Brave, Firefox and Vanadium each for different purposes) and using Bluetooth daily.

Over the past couple of months, I've noticed consistent performance degradation:

After reboot, performance is normal, but it slows down significantly within minutes.
The lag worsens over time and sometimes spontaneously improves or improves after a reboot.
This month, the device has powered off twice spontaneously while in this degraded state. Not thermal shutdown, and not related to low battery. Battery was well above 50% both times.
Battery used to last a good 28 hours or so, and now it's more like 16.
I don't remember installing new apps or changes to user behavior around the time this began.
I do remember a bunch of GrapheneOS updates in a row around the time this began.
Nothing obvious shows up at the battery monitor, except for pretty quick battery level drop.

I understand that GrapheneOS does not recommend traditional anti-malware, and that user-space scanners are likely to reduce overall security. That said, GrapheneOS is not immune to zero days and I want to see if there are additional possibilities to detect any persistent compromise or unexpected resource-heavy background activity (e.g. crypto miner or other anomaly) or confirm if this is more likely a hardware fault.

I’ve seen reports of hardware issues on some units (including spontaneous shutdowns) that were resolved via RMA. However, those often appeared immediately post-purchase, whereas this started more than a dozen months in.

Questions:

Are there additional recommended ways to monitor or audit system performance within the security model of GrapheneOS to isolate potential rogue processes, high CPU use, or abnormal wake locks?
Can remote attestation or another mechanism help validate system integrity beyond verified boot?
Is there a trusted approach to log or profile resource usage that doesn’t compromise the security model?

Appreciate any guidance on narrowing this down before considering hardware RMA, factory reset or re-flashing.

23Sha-ger

Gold95 GrapheneOS is not immune to zero days and I want to see if there are additional possibilities to detect any persistent compromise or unexpected resource-heavy background activity (e.g. crypto miner or other anomaly)

Zero chance of that happening. An adversary capable of weaponizing a zero day, zero click against GOS will
not install some low key malware or crypto junk, Pixel 8 has MTE which makes the process even harder.
Try a factory reset to a clean state if you can't find the issue in the battery manager.

ryrona

Gold95 Not thermal shutdown

Are you certain? The CPU or GPU getting heavily down throttled in speed so that things get laggy, and even abruptly powers off sounds like CPU or GPU is getting overheated, possibly by being poorly connected to the heat sink and thus not able to dissipate heat properly. What I say is, it might happen even if your phone feels rather cool.

Even if you have heavy background activity like crypto miner or such, it shouldn't cause abrupt power offs like that, so it does sound like a hardware issue for me. And if you had, your phone would get really really hot.

I would have factory reset the phone, just to rule out such issues, and if issue persist, send it in on warranty / RMA.

OutbackJack

Gold95
https://play.google.com/store/apps/details?id=flar2.devcheck

Gold95

Thanks for the reply. So you're saying the likelihood of a sophisticated compromise is extremely low, thanks to modern hardening like MTE on the Pixel 8.

At the same time though, a factory reset is not a trivial action. It involves days of reinstalling and configuring secure apps, self-hosted clouds and calendars, re-establishing encrypted backups, etc.

I've used multiple smartphones with /e/OS and LineageOS over the years. Maintained one LOS device for a while. And I haven't seen this kind of persistent and considerable degradation in speed before, which is why I'm exploring whether there's more targeted diagnostic tools available that work with GrapheneOS. If the only viable path to troubleshooting is a factory reset "gamble" even though the problem may return because my usage pattern hasn't changed (without understanding why this is necessary or resetting only a single system app in stead), then the cost in terms of time and usability starts to outweigh the security benefit for me. In the same time spent reconfiguring the phone, I can earn and purchase a Murena or Fairphone with /e/OS, and with those I know the issue won't return with my set of apps.

In other words, I'm looking for a way to diagnose the performance bottlenecks in a more granular way. If the time comes to do a factory reset without knowing what happened, I will sell the phone.

Gold95

ryrona

Are you certain? The CPU or GPU getting heavily down throttled (...) sounds like CPU or GPU is getting overheated

I am certain insofar as that I have not seen the message you see when your phone is overheating. Something along the lines of "Your phone is getting warm. You can still use your phone, but it may run slower."

Although I have not seen the spontaneous reboot anymore (count = 2), it's still intermittently lagging. I have noticed it seems to wait for I/O sometimes. Like opening VLC and in the most extreme case waiting 20 seconds before the media shows, or taking a photograph and waiting for the photo to "exist" for sharing purposes.

I agree, this can also be faulty hardware. Although it's unusual to have this 18 months in. I have searched thoroughly for similar issues and any such problem is reported directly after purchase.

As to the factory reset that's proposed, I'd like to understand what type of issue would be solved with a factory reset? Is it distinctly different from clearing app data and cache for individual apps one at a time?

ryrona

Gold95 As to the factory reset that's proposed, I'd like to understand what type of issue would be solved with a factory reset?

Well, you were worried it might be an app, or that your device has been compromised. A factory reset will reformat all partitions that holds user data, creating them anew. All that remains is OS and firmware data that is verified with verified boot. So after a factory reset, the software on your device can no longer be compromised, and any faulty app will be gone. If for whatever reason what you are seeing is because of a file system error, a factory reset should solve that too, as the file system should be recreated a new.

I just generally think it is good to try a factory reset of a device before sending it in on warranty / RMA, ie do a serious attempt at fixing the problem yourself first.

Gold95

ryrona ah yes I understand. I meant what (other) issue would be solved considering there is "zero chance of [compromise] happening", which was commented by a different user. So it could be a file system error. Worth a shot. Although if this was a PC, I would really like to run some badblocks or SMART type test on the SD storage, because that would give hard data in stead of taking an educated guess.