[Bug] UFS I/O failure on Pixel 10 Pro XL (Android 16 / Build cp1a.260405.005)

[fjexynos-debug]

Please check before submitting an issue

• I have searched the issues and haven't found anything relevant
• I will upload bugreport file in KernelSU Manager - Settings - Report log
• I know how to reproduce the issue which may not be specific to my device

Describe the bug

After rooting the device by patching init_boot.img, the system experiences severe I/O hangs and freezes during basic file operations (e.g., deleting or moving files in Google Files). The UFS controller seems to crash when attempting to update file timestamps. I have confirmed the hardware is healthy by flashing the stock unpatched init_boot.img, which works perfectly without any dmesg errors or latency.

To Reproduce

1. Flash the patched init_boot.img via fastboot.

2. Boot the device and grant root permissions to a file manager.

3. Attempt to delete any file from the internal storage.

4. The system will hang or the operation will be extremely slow.

Expected behavior

The file should be deleted instantly, and the kernel should not report UFS command completion errors or timestamp failures.

Screenshots

No response

Logs

The following errors are consistently reported in dmesg during the I/O hang:

google-ufshcd 3c400000.ufs: ufshcd_dev_cmd_completion: unexpected response in Query RSP: fd

google-ufshcd 3c400000.ufs: ufshcd_set_timestamp_attr: failed to set timestamp -22

google-cpm-irq-chip cpm_irq: Send write request failed (-22)

dmesg_kernelsu_pixel10proxl.txt

Device info

Model: Pixel 10 Pro XL (mustang)

Android Version: 16

Build Number: cp1a.260405.005

KernelSU Version: 3.2.4_32457-release

Additional context

I have tested this issue with both KernelSU and Magisk (v30.7), and both produce identical UFS/F2FS kernel errors. This suggests a fundamental conflict between the current root patching methods and the Google UFS driver implementation on Android 16 for the Tensor architecture. Latency on stock (unpatched) boot is 0.03s, while patched boot shows continuous kernel flooding.

"I am providing a manual dmesg dump instead of the Manager's internal log because the Manager was uninstalled during testing. The attached log contains the identical UFS/F2FS error trace."

[5ec1cff]

Could you please send me the init_boot.img files before and after the patch?

[fjexynos-debug]

images.zip
Inside the zip file is the init_boot original and the init_boot patched. Before and after.

[fjexynos-debug]

"I closed the issue by mistake. That was an error. Please, could you check it?"

images.zip
Inside the zip file are the init_boot.img

[5ec1cff]

Can you provide the full dmesg?

[5ec1cff]

Considering you encountered the same issue using both Magisk and Kernelsu, I first checked init_boot, as both modify it. However, modifications to init_boot are unlikely to affect the ufs driver layer, so I don't think the problem lies there. If the problem only occurred with Kernelsu, it could indeed be due to kernel modifications, but it's illogical for Magisk to have the same issue, since Magisk doesn't involve kernel modifications. Therefore, you should confirm whether using Magisk actually causes the problem (make sure you're not using init_boot that has been patched by both Magisk and Kernelsu). Also, please check if you only modified the init_boot partition and whether you're using a custom kernel.

Furthermore, I don't think the dmesg logs you provided are necessarily the root cause of the problem. First, ufshcd_set_timestamp_attr is unrelated to setting file timestamps, and second, based on the current information, it's impossible to confirm whether these logs appear when you use the stock boot image; perhaps they are just "normal" error logs.

If the system hangs due to deleting or writing files, it's best to check the ANR logs (which are included in the logs exported by the kernelsu app, and you can also find them in /data/anr).

[positiveway]

I experience the same behavior (Extreme I/O slowdown and overall system sluggishness due to it).
Device: Xiaomi Pad 7 Pro
ROM: CrDroid 12.7
Android: 16 QPR2
Kernel: android_14_6.1.118
Root type: Wild GKI with SUSFS flashed (repacked boot.img from PC)

What's interesting it all works fine unless I install KernelSU app itself. Removing all modules didn't help. Kernel by its own doesn't cause issues. I first started experiencing issues when free space on builtin storage came close to 20GB from 256GB. Severe lagging started. I have and use external cooling, powerful fan. Device may be connected to a charger or not, doesn't matter. Freeing up more space (50Gb free) improved the situation dramatically but not completely. Uninstalling the app solved the issue.

Very weird issue. Did something fundamentally change with QPR2? I have custom module that forces UFS controller to max performance, disables throttling (thermal, power, Bus). With or without it it doesn't help.

AFAIK due to how F2FS works it needs a lot of extra space to operate properly otherwise UFS controller has to do a lot of extra work to satisfy basic write operations (when there are not many free blocks left). So it may be UFS issue, may be F2FS issue. Maybe exposing shell to root breaks F2FS permissions or metadata writing.

[positiveway]

@fjexynos-debug Let's find what's common between our systems. What ROM do you use? Is your Android 16 updated to QPR2? I use MicroG + Companion + Aurora Store instead of GAPPS and play services. Do you? What's strange I started to notice the issue just recently. Maybe it was not so severe until system started running out of space. I haven't updated ROM in past 1.5 months. Only change was switching from Magisk to KernelSU and Wild Kernel in past 1 or 2 weeks. I used Magisk 30.7 before, same as you. In Magisk and KernelSU I gave Root to "Shell" so I can execute commands as root via ADB.

More info about my device:
RAM: 8GB
Chipset: Qualcomm SM8635 Snapdragon 8s Gen 3
UFS: 4.0 256GB

If severity of the issue depends on the amount of free space it must be File system related issue first that stresses out UFS controller as a consequence.

[fjexynos-debug]

@tiann Here are the requested files. I have attached a .zip containing the full evidence:

1. The full dmesg log (starting from boot 0.000000).

2. The KernelSU Manager log.

3. The ANR trace logs.

dmesg_full.zip

To rule out any environment issues, I want to clarify that:

The filesystem is completely healthy. I have performed multiple clean installs using flash-all.bat followed by factory resets.

The init_boot.img used for patching was always a fresh stock image. I have never cross-patched the same image with Magisk and KernelSU.

The logs clearly show a severe I/O deadlock with the google-ufshcd driver. The kernel is flooded with unexpected response in Query RSP: fd and failed to set timestamp -22 (EINVAL).

This hardware/driver desynchronization prevents the device from entering suspend mode (alarmtimer.4.auto failed to suspend: error -16), leading to system hangs and the system_server ANRs.

Let me know if you need any further tests on this Pixel 10 Pro XL.

P.S: Shoutout to my AI co-pilot, Gemini, for helping me ensure these logs are exactly what you need! Jejeje.

[positiveway]

@fjexynos-debug I think I finally fixed it. And the cause was interesting. After heavy research turned out Android 16 QPR2 changed SELinux Policies, added stricter rules, new hooks, etc which conflicts with root. Root tries to access some necessary paths on file systems but SELinux rejects. This causes a loop and significantly degrades performance overwhelming Filesystem.
The fix is to disable and spoof SELinux. In Magisk I achieved this with:
https://github.com/evdenis/selinux_permissive

@5ec1cff Do you have ideas how can this be fixed in KernelSU? Update SELinux handling?

I've tried different solutions via writing a custom module. For example Android QPR2 introduced new GC mechanism which can conflict with F2FS own GC. Tried to disable it, didn't help. Tried remounting partition with different options because I thought my default mounting options for /data (user data) were unusually aggressive. Didn't help.

Module:

setprop dalvik.vm.usegenerational-cmc false

# Remount userdata with gc_merge and discard enabled
mount -o remount,atgc,gc_merge,discard,checkpoint_merge,extent_cache /data

F2FS_NODE=$(ls /sys/fs/f2fs/ | grep -v "userdata" | head -n 1)
F2FS_PATH="/sys/fs/f2fs/$F2FS_NODE"

# Enable background GC thread specifically (value 1 = on)
write_value "$F2FS_PATH/background_gc" "1"

# Optional: Adjust the age threshold for ATGC if node is available
# High value = more aggressive at targeting older data
# 1 week in seconds
write_value "$F2FS_PATH/atgc_age_threshold" "604800"

write_value "$F2FS_PATH/gc_urgent" "0"
# Set idle interval to 2 minutes to ensure true idleness
write_value "$F2FS_PATH/gc_idle_interval" "120000"

# Reserve roughly 5% of blocks for the system to ensure GC health
# You can calculate a specific number of blocks based on your storage size
# write_value "$F2FS_PATH/resblks" "20480"

My fstab.qcom

#<src>                                                 <mnt_point>            <type>  <mnt_flags and options>                            <fs_mgr_flags>
system                                                  /system                erofs   ro                                                   wait,slotselect,avb=vbmeta_system,logical,first_stage_mount,avb_keys=/avb/q-gsi.avbpubkey:/avb/r-gsi.avbpubkey:/avb/s-gsi.avbpubkey:/avb/t-gsi.avbpubkey:/avb/u-gsi.avbpubkey
system                                                  /system                ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta_system,logical,first_stage_mount,avb_keys=/avb/q-gsi.avbpubkey:/avb/r-gsi.avbpubkey:/avb/s-gsi.avbpubkey:/avb/t-gsi.avbpubkey:/avb/u-gsi.avbpubkey
system_ext                                              /system_ext            erofs   ro                                                   wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
system_ext                                              /system_ext            ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
product                                                 /product               erofs   ro                                                   wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
product                                                 /product               ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
vendor                                                  /vendor                erofs   ro                                                   wait,slotselect,avb=vbmeta,logical,first_stage_mount
vendor                                                  /vendor                ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta,logical,first_stage_mount
vendor_dlkm                                             /vendor_dlkm           erofs   ro                                                   wait,slotselect,avb=vbmeta,logical,first_stage_mount
vendor_dlkm                                             /vendor_dlkm           ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta,logical,first_stage_mount
system_dlkm                                             /system_dlkm           erofs   ro                                                   wait,slotselect,avb=vbmeta,logical,first_stage_mount
system_dlkm                                             /system_dlkm           ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta,logical,first_stage_mount
odm                                                     /odm                   erofs   ro                                                   wait,slotselect,avb=vbmeta,logical,first_stage_mount
odm                                                     /odm                   ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta,logical,first_stage_mount
/dev/block/by-name/boot                                 /boot                  emmc    defaults                                             slotselect,avb=vbmeta,first_stage_mount
/dev/block/by-name/init_boot                            /init_boot             emmc    defaults                                             slotselect,avb=vbmeta,first_stage_mount
/dev/block/by-name/vendor_boot                          /vendor_boot           emmc    defaults                                             slotselect,avb=vbmeta,first_stage_mount
/dev/block/by-name/dtbo                                 /dtbo                  emmc    defaults                                             slotselect,avb=vbmeta,first_stage_mount
/dev/block/by-name/recovery                             /recovery              emmc    defaults                                             slotselect,avb=vbmeta,first_stage_mount
/dev/block/by-name/metadata                             /metadata              f2fs    noatime,nosuid,nodev,discard                         wait,check,formattable,first_stage_mount
/dev/block/bootdevice/by-name/persist                   /mnt/vendor/persist    ext4    noatime,nosuid,nodev,barrier=1                       wait,check
/dev/block/bootdevice/by-name/userdata                  /data                  f2fs    noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,inlinecrypt,gc_merge,compress_mode=user,compress_cache,atgc,age_extent_cache   latemount,wait,check,formattable,fileencryption=aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized+wrappedkey_v0,keydirectory=/metadata/vold/metadata_encryption,metadata_encryption=aes-256-xts:wrappedkey_v0,quota,reservedsize=128M,sysfs_path=/sys/devices/platform/soc/1d84000.ufshc,checkpoint=fs
/dev/block/bootdevice/by-name/misc                      /misc                  emmc    defaults                                             defaults
/devices/platform/soc/8804000.sdhci/mmc_host*           /storage/sdcard1       vfat    nosuid,nodev                                         wait,voldmanaged=sdcard1:auto,encryptable=footer
/devices/platform/soc/*.ssusb/*.dwc3/xhci-hcd.*.auto*   /storage/usbotg        vfat    nosuid,nodev                                         wait,voldmanaged=usbotg:auto
/dev/block/bootdevice/by-name/modem                     /vendor/firmware_mnt   vfat    ro,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0 wait,slotselect
/dev/block/bootdevice/by-name/dsp                       /vendor/dsp            ext4    ro,nosuid,nodev,barrier=1                            wait,slotselect
/dev/block/bootdevice/by-name/bluetooth                 /vendor/bt_firmware    vfat    ro,shortname=lower,uid=1002,gid=3002,dmask=227,fmask=337,context=u:object_r:bt_firmware_file:s0 wait,slotselect
/dev/block/bootdevice/by-name/qmcs                      /mnt/vendor/qmcs       vfat    noatime,nosuid,nodev,context=u:object_r:vendor_qmcs_file:s0   wait,check,formattable
/dev/block/bootdevice/by-name/spunvm                    /mnt/vendor/spunvm     vfat    noatime,nosuid,nodev,context=u:object_r:vendor_spunvm_file:s0   wait,check,formattable

Especially /userdata

f2fs    noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,inlinecrypt,gc_merge,compress_mode=user,compress_cache,atgc,age_extent_cache   latemount,wait,check,formattable,fileencryption=aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized+wrappedkey_v0,keydirectory=/metadata/vold/metadata_encryption,metadata_encryption=aes-256-xts:wrappedkey_v0,quota,reservedsize=128M,sysfs_path=/sys/devices/platform/soc/1d84000.ufshc,checkpoint=fs

[positiveway]

Also for some reason "Set SELinux to Permissive" option in KernelSU didn't work on my system. No matter how many times I've tried. So that's the clue as well. Something with SELinux Policies that KernelSU (and Next) can't handle.