infrastructure/mw-pfeddersheim-workstation

Files

T

ja 2487aa5749 feat(chrome): NVIDIA Wayland GPU acceleration for Chrome 148

Replace obsolete WebGPU flags with state-of-the-art NVIDIA VA-API
hardware decode config for Chrome 148 on Wayland/Hyprland.

- Disable seccomp sandbox to fix NVIDIA GBM "Permission denied" error
- Disable VulkanFromANGLE/DefaultANGLEVulkan (incompatible with Wayland)
- Force ANGLE->OpenGL backend to avoid Vulkan/Wayland conflicts
- Enable modern VA-API flags: VaapiOnNvidiaGPUs, AcceleratedVideoDecodeLinux*
- Add gnome-libsecret password store for gnome-keyring integration
- Install libva-utils and libva-nvidia-driver packages
- Update driver version to 580.159.03 in hardware inventory

WebGPU remains hardware accelerated via ANGLE+OpenGL. Chrome verified
working with full video decode acceleration (H.264, VP9, HEVC) via NVDEC.

2026-05-21 16:02:11 +02:00

4.3 KiB

Raw Blame History

description, tags, last_updated

description

Chrome 148 — NVIDIA Wayland Hardware Acceleration

Date: 2026-05-21 (updated from 2026-03-11)

Context

Chrome on NVIDIA + Wayland has three known issues:

GBM "Permission denied": Chrome's seccomp sandbox blocks NVIDIA's nvidia-drm_gbm.so on Wayland.
Vulkan/Wayland incompatibility: --ozone-platform=wayland is not compatible with Vulkan rendering (Chromium issue 334275637).
NVIDIA VA-API allowlist: Hardware video decode is blocked on NVIDIA without explicit flags.

The old WebGPU config (--enable-unsafe-webgpu, --enable-vulkan) is obsolete — WebGPU works natively in Chrome 148 via ANGLE+OpenGL on Wayland without Vulkan flags.

Required Packages

Package	Reason
`libva-utils`	Verification: `vainfo`
`libva-nvidia-driver`	VA-API NVDEC bridge (already installed, was `nvidia-vaapi-driver`)

Note: libva-utils was installed 2026-05-21. libva-nvidia-driver (0.0.17-1) was already present.

Configuration: `~/.config/chrome-flags.conf`

--ozone-platform=wayland
--disable-seccomp-filter-sandbox
--disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan
--use-angle=gl
--enable-features=VaapiOnNvidiaGPUs,VaapiIgnoreDriverChecks,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoDecodeLinuxGL
--password-store=gnome-libsecret

Flag Rationale

Flag	Purpose
`--ozone-platform=wayland`	Force Wayland; auto-detect unreliable on Hyprland
`--disable-seccomp-filter-sandbox`	Fixes GBM `Permission denied` (Chrome sandbox blocks NVIDIA GBM on Wayland)
`--disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan`	Vulkan incompatible with Ozone Wayland; all three must be disabled
`--use-angle=gl`	Force ANGLE→OpenGL backend; prevents auto-selection of Vulkan
`--enable-features=VaapiOnNvidiaGPUs,...`	Bypass NVIDIA video decode allowlist; modern flags (replaced deprecated `VaapiVideoDecoder`)
`--password-store=gnome-libsecret`	gnome-keyring integration (not auto-detected outside GNOME DE)

Verification

vainfo                              # Shows VA-API NVDEC decoder capabilities
LIBVA_DRIVER_NAME=nvidia vainfo     # Explicit NVIDIA VA-API check

Expected chrome://gpu results:

Canvas: Hardware accelerated
Compositing: Hardware accelerated
Video Decode: Hardware accelerated (H.264, VP9, HEVC)
WebGL: Hardware accelerated
WebGPU: Hardware accelerated
GPU: GTX 1050 Ti / NVIDIA 580.159.03
GL implementation: gl=egl-angle,angle=opengl
GPU process crash count: 0
Ozone platform: wayland

Known Warnings

Three log lines persist despite correct config — these are upstream Chromium warnings:

ERROR:ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc:252: '--ozone-platform=wayland' is not compatible with Vulkan
WARNING:sandbox/policy/linux/sandbox_linux.cc:404: InitializeSandbox() called with multiple threads in process gpu-process
ERROR:ui/gl/egl_util.cc:92: EGL Driver message (Error) eglCreateContext: Requested version is not supported

These are cosmetic. Chrome falls back to ANGLE+OpenGL before they print. No fix exists upstream yet (Chromium issue 334275637).

Key Learnings

Deprecated flags: VaapiVideoDecoder, VaapiVideoDecodeLinuxGL replaced by AcceleratedVideoDecodeLinuxZeroCopyGL, AcceleratedVideoDecodeLinuxGL since Chrome ≥131.
Vulkan is opt-in, not opt-out: --disable-features=Vulkan alone is insufficient; VulkanFromANGLE and DefaultANGLEVulkan are auto-enabled and must be listed.
GBM "Permission denied" is not file perms: It's seccomp sandbox + NVIDIA GBM. --disable-seccomp-filter-sandbox is the confirmed workaround.
Password store: Hyprland ≠ GNOME, so --password-store=gnome-libsecret explicit flag needed.
--ignore-gpu-blocklist no longer needed: Chrome 148 recognizes the GTX 1050 Ti + current driver without it.

Ansible Integration

The dev-tools role manages this file. Update both:

ansible/roles/dev-tools/tasks/main.yml (the copy task content)
This learning doc (the rationale)

4.3 KiB Raw Blame History