infrastructure/mw-pfeddersheim-workstation
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(chrome): NVIDIA Wayland GPU acceleration for Chrome 148

Browse Source 
Replace obsolete WebGPU flags with state-of-the-art NVIDIA VA-API
hardware decode config for Chrome 148 on Wayland/Hyprland.

- Disable seccomp sandbox to fix NVIDIA GBM "Permission denied" error
- Disable VulkanFromANGLE/DefaultANGLEVulkan (incompatible with Wayland)
- Force ANGLE->OpenGL backend to avoid Vulkan/Wayland conflicts
- Enable modern VA-API flags: VaapiOnNvidiaGPUs, AcceleratedVideoDecodeLinux*
- Add gnome-libsecret password store for gnome-keyring integration
- Install libva-utils and libva-nvidia-driver packages
- Update driver version to 580.159.03 in hardware inventory

WebGPU remains hardware accelerated via ANGLE+OpenGL. Chrome verified
working with full video decode acceleration (H.264, VP9, HEVC) via NVDEC.
This commit is contained in:
ja
2026-05-21 16:02:11 +02:00
parent 7d8760592e
commit 2487aa5749
3 changed files with 99 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/dev-tools/tasks/main.yml
+11 -6
View File
@@ -64,6 +64,9 @@
- f3d - f3d
# Terminal # Terminal
- kitty - kitty
# NVIDIA VA-API video decode for Chrome on Wayland
- libva-utils
- libva-nvidia-driver
state: present state: present
- name: Ensure Node.js global CLI tools are installed - name: Ensure Node.js global CLI tools are installed
@@ -116,18 +119,20 @@
- code-marketplace - code-marketplace
state: absent state: absent
- name: Configure Chrome flags for WebGPU - name: Configure Chrome flags for NVIDIA Wayland acceleration
copy: copy:
dest: "/home/{{ system_user }}/.config/chrome-flags.conf" dest: "/home/{{ system_user }}/.config/chrome-flags.conf"
content: | content: |
--enable-unsafe-webgpu --ozone-platform=wayland
--enable-vulkan --disable-seccomp-filter-sandbox
--enable-features=Vulkan --disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan
--ignore-gpu-blocklist --use-angle=gl
--enable-features=VaapiOnNvidiaGPUs,VaapiIgnoreDriverChecks,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoDecodeLinuxGL
--password-store=gnome-libsecret
owner: "{{ system_user }}" owner: "{{ system_user }}"
group: "{{ system_user }}" group: "{{ system_user }}"
mode: '0644' mode: '0644'
tags: [chrome, webgpu] tags: [chrome, nvidia, wayland]
- name: Fix kitty cursor keys by removing TERM override in .bashrc - name: Fix kitty cursor keys by removing TERM override in .bashrc
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
docs/learnings/2026-03-11-enable-webgpu-chrome-linux.md
+87 -23
View File
@@ -1,33 +1,97 @@
# Learning: Enable WebGPU in Chrome on Linux (Manjaro) ---
description: >-
Chrome 148 on NVIDIA Wayland (Hyprland) — full GPU/video acceleration config.
Replaced the 2026-03-11 WebGPU flags with state-of-the-art NVIDIA VA-API setup.
tags: [chrome, nvidia, wayland, vaapi, gpu, acceleration]
last_updated: '2026-05-21'
---
Date: 2026-03-11 # Chrome 148 — NVIDIA Wayland Hardware Acceleration
Date: 2026-05-21 (updated from 2026-03-11)
## Context ## Context
WebGPU was reported as unavailable in Chrome despite the API being detected. On Linux, WebGPU support is often experimental and requires specific hardware acceleration flags.
## Challenge Chrome on NVIDIA + Wayland has three known issues:
- The Google Chrome binary on Manjaro (`/usr/bin/google-chrome-stable`) is a wrapper script that supports a custom flag file at `~/.config/chrome-flags.conf`. 1. **GBM "Permission denied"**: Chrome's seccomp sandbox blocks NVIDIA's `nvidia-drm_gbm.so` on Wayland.
- Enabling WebGPU requires not just the WebGPU flag, but also Vulkan support. 2. **Vulkan/Wayland incompatibility**: `--ozone-platform=wayland` is not compatible with Vulkan rendering (Chromium issue 334275637).
3. **NVIDIA VA-API allowlist**: Hardware video decode is blocked on NVIDIA without explicit flags.
## Solution The old WebGPU config (`--enable-unsafe-webgpu`, `--enable-vulkan`) is obsolete —
Implemented a persistent configuration via Ansible to manage `~/.config/chrome-flags.conf` with the following flags: WebGPU works natively in Chrome 148 via ANGLE+OpenGL on Wayland without Vulkan flags.
```text ## Required Packages
--enable-unsafe-webgpu
--enable-vulkan | Package | Reason |
--enable-features=Vulkan |---------|--------|
--ignore-gpu-blocklist | `libva-utils` | Verification: `vainfo` |
| `libva-nvidia-driver` | VA-API NVDEC bridge (already installed, was `nvidia-vaapi-driver`) |
Note: `libva-utils` was installed 2026-05-21. `libva-nvidia-driver` (0.0.17-1) was already present.
## Configuration: `~/.config/chrome-flags.conf`
```
--ozone-platform=wayland
--disable-seccomp-filter-sandbox
--disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan
--use-angle=gl
--enable-features=VaapiOnNvidiaGPUs,VaapiIgnoreDriverChecks,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoDecodeLinuxGL
--password-store=gnome-libsecret
``` ```
## Key Learnings ### Flag Rationale
1. **Persistent Flags**: On Arch-based systems (like Manjaro), use `~/.config/chrome-flags.conf` instead of modifying `.desktop` files, as it survives package updates and is automatically loaded by the Chrome wrapper script.
2. **WebGPU Dependencies**: WebGPU on Linux currently relies on the Vulkan backend. Enabling `--enable-unsafe-webgpu` alone is often insufficient; `--enable-vulkan` and `--enable-features=Vulkan` are required. | Flag | Purpose |
3. **GPU Blocklist**: Linux GPUs are often blocklisted for experimental features. `--ignore-gpu-blocklist` helps override these safety checks for development. |------|---------|
| `--ozone-platform=wayland` | Force Wayland; auto-detect unreliable on Hyprland |
| `--disable-seccomp-filter-sandbox` | Fixes GBM `Permission denied` (Chrome sandbox blocks NVIDIA GBM on Wayland) |
| `--disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan` | Vulkan incompatible with Ozone Wayland; all three must be disabled |
| `--use-angle=gl` | Force ANGLE→OpenGL backend; prevents auto-selection of Vulkan |
| `--enable-features=VaapiOnNvidiaGPUs,...` | Bypass NVIDIA video decode allowlist; modern flags (replaced deprecated `VaapiVideoDecoder`) |
| `--password-store=gnome-libsecret` | gnome-keyring integration (not auto-detected outside GNOME DE) |
## Verification ## Verification
- Applied changes via Ansible role `dev-tools`.
- Verified file existence and content. ```bash
- Verified flag application by inspecting running processes (`ps aux`). vainfo # Shows VA-API NVDEC decoder capabilities
- Used Playwright (via MCP) to navigate to `https://webgpureport.org/`. LIBVA_DRIVER_NAME=nvidia vainfo # Explicit NVIDIA VA-API check
- Confirmed that while `navigator.gpu` is detected, `requestAdapter()` may still return null in headless/remote-controlled environments due to GPU access limitations. ```
- **SUCCESS**: Verified that the user's running Chrome instance successfully initializes WebGPU on the actual workstation hardware after the flag application, as confirmed by `https://webgpureport.org/`.
Expected `chrome://gpu` results:
- Canvas: **Hardware accelerated**
- Compositing: **Hardware accelerated**
- Video Decode: **Hardware accelerated** (H.264, VP9, HEVC)
- WebGL: **Hardware accelerated**
- WebGPU: **Hardware accelerated**
- GPU: GTX 1050 Ti / NVIDIA 580.159.03
- GL implementation: `gl=egl-angle,angle=opengl`
- GPU process crash count: **0**
- Ozone platform: **wayland**
## Known Warnings
Three log lines persist despite correct config — these are upstream Chromium warnings:
```
ERROR:ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc:252: '--ozone-platform=wayland' is not compatible with Vulkan
WARNING:sandbox/policy/linux/sandbox_linux.cc:404: InitializeSandbox() called with multiple threads in process gpu-process
ERROR:ui/gl/egl_util.cc:92: EGL Driver message (Error) eglCreateContext: Requested version is not supported
```
These are cosmetic. Chrome falls back to ANGLE+OpenGL before they print.
No fix exists upstream yet (Chromium issue 334275637).
## Key Learnings
1. **Deprecated flags**: `VaapiVideoDecoder`, `VaapiVideoDecodeLinuxGL` replaced by `AcceleratedVideoDecodeLinuxZeroCopyGL`, `AcceleratedVideoDecodeLinuxGL` since Chrome ≥131.
2. **Vulkan is opt-in, not opt-out**: `--disable-features=Vulkan` alone is insufficient; `VulkanFromANGLE` and `DefaultANGLEVulkan` are auto-enabled and must be listed.
3. **GBM "Permission denied" is not file perms**: It's seccomp sandbox + NVIDIA GBM. `--disable-seccomp-filter-sandbox` is the confirmed workaround.
4. **Password store**: Hyprland ≠ GNOME, so `--password-store=gnome-libsecret` explicit flag needed.
5. **`--ignore-gpu-blocklist` no longer needed**: Chrome 148 recognizes the GTX 1050 Ti + current driver without it.
## Ansible Integration
The `dev-tools` role manages this file. Update both:
- `ansible/roles/dev-tools/tasks/main.yml` (the copy task content)
- This learning doc (the rationale)
docs/tech/hardware-inventory.md
+1 -1
View File
@@ -100,7 +100,7 @@ last_updated: '2026-04-02'
|-------|-------| |-------|-------|
| Model | NVIDIA GeForce GTX 1050 Ti | | Model | NVIDIA GeForce GTX 1050 Ti |
| VRAM | 4096 MiB | | VRAM | 4096 MiB |
| Driver | 575.64.05 (migrating to 595.71.05 — see [ADR 0002](../adr/0002-kernel-and-nvidia-strategy.md)) | | Driver | 580.159.03 (Wayland-compatible mainline — NVIDIA VA-API for Chrome H.264/HEVC/VP9 decode via libva-nvidia-driver) |
| GPU Temp (idle) | 47°C | | GPU Temp (idle) | 47°C |
| PCI Address | 08:00.0 | | PCI Address | 08:00.0 |