BASELINE: Update Chromium to 83.0.4103.122

Change-Id: Ie3a82f5bb0076eec2a7c6a6162326b4301ee291e
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

10 files changed, 179 insertions, 130 deletions

diff --git a/chromium/content/gpu/BUILD.gn b/chromium/content/gpu/BUILD.gn
index 47088030448..64ebb18c5f6 100644
--- a/chromium/content/gpu/BUILD.gn
+++ b/chromium/content/gpu/BUILD.gn
@@ -13,13 +13,9 @@ group("gpu") {
   visibility = [ "//content/*" ]  # This is an internal content API.
 
   if (is_component_build) {
-    public_deps = [
-      "//content",
-    ]
+    public_deps = [ "//content" ]
   } else {
-    public_deps = [
-      ":gpu_sources",
-    ]
+    public_deps = [ ":gpu_sources" ]
   }
 }
 
@@ -56,7 +52,6 @@ target(link_target_type, "gpu_sources") {
   deps = [
     "//base",
     "//base/third_party/dynamic_annotations",
-    "//components/tracing",
     "//components/viz/service",
     "//content:export",
     "//content/child",
@@ -78,7 +73,6 @@ target(link_target_type, "gpu_sources") {
     "//components/viz/service/main",
     "//media/gpu/ipc/service",
     "//media/mojo/clients:clients",
-    "//media/mojo/mojom:constants",
     "//services/service_manager/embedder",
     "//services/service_manager/public/cpp",
     "//services/service_manager/public/mojom",
@@ -96,7 +90,10 @@ target(link_target_type, "gpu_sources") {
   ]
 
   if (is_android) {
-    deps += [ "//media" ]
+    deps += [
+      "//components/tracing:graphics_provider",
+      "//media",
+    ]
   }
 
   if (is_linux) {
@@ -118,6 +115,7 @@ target(link_target_type, "gpu_sources") {
   if (use_x11) {
     deps += [
       "//ui/events/platform/x11",
+      "//ui/gfx/linux:gpu_memory_buffer_support_x11",
       "//ui/gfx/x",
     ]
   }
diff --git a/chromium/content/gpu/OWNERS b/chromium/content/gpu/OWNERS
index 934c7f6ee72..5fd65297302 100644
--- a/chromium/content/gpu/OWNERS
+++ b/chromium/content/gpu/OWNERS
@@ -2,9 +2,9 @@ kbr@chromium.org
 zmo@chromium.org
 
 # For security review.
-per-file browser_exposed_gpu_interfaces.cc=set noparent
-per-file browser_exposed_gpu_interfaces.cc=file://ipc/SECURITY_OWNERS
-per-file gpu_child_thread_receiver_bindings.cc=set noparent
-per-file gpu_child_thread_receiver_bindings.cc=file://ipc/SECURITY_OWNERS
+per-file browser_exposed_gpu_interfaces.*=set noparent
+per-file browser_exposed_gpu_interfaces.*=file://ipc/SECURITY_OWNERS
+per-file gpu_child_thread_receiver_bindings.*=set noparent
+per-file gpu_child_thread_receiver_bindings.*=file://ipc/SECURITY_OWNERS
 
 # COMPONENT: Internals>GPU>Internals
diff --git a/chromium/content/gpu/gpu_child_thread.cc b/chromium/content/gpu/gpu_child_thread.cc
index 24d5759915b..066531c62e2 100644
--- a/chromium/content/gpu/gpu_child_thread.cc
+++ b/chromium/content/gpu/gpu_child_thread.cc
@@ -13,11 +13,12 @@
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/memory/weak_ptr.h"
+#include "base/power_monitor/power_monitor.h"
+#include "base/power_monitor/power_monitor_device_source.h"
 #include "base/run_loop.h"
 #include "base/sequenced_task_runner.h"
 #include "base/threading/thread_checker.h"
 #include "build/build_config.h"
-#include "components/viz/common/features.h"
 #include "content/child/child_process.h"
 #include "content/gpu/browser_exposed_gpu_interfaces.h"
 #include "content/gpu/gpu_service_factory.h"
@@ -71,7 +72,10 @@ ChildThreadImpl::Options GetOptions() {
 
 viz::VizMainImpl::ExternalDependencies CreateVizMainDependencies() {
   viz::VizMainImpl::ExternalDependencies deps;
-  deps.create_display_compositor = features::IsVizDisplayCompositorEnabled();
+  if (!base::PowerMonitor::IsInitialized()) {
+    deps.power_monitor_source =
+        std::make_unique<base::PowerMonitorDeviceSource>();
+  }
   if (GetContentClient()->gpu()) {
     deps.sync_point_manager = GetContentClient()->gpu()->GetSyncPointManager();
     deps.shared_image_manager =
@@ -94,13 +98,10 @@ viz::VizMainImpl::ExternalDependencies CreateVizMainDependencies() {
 }  // namespace
 
 GpuChildThread::GpuChildThread(base::RepeatingClosure quit_closure,
-                               std::unique_ptr<gpu::GpuInit> gpu_init,
-                               viz::VizMainImpl::LogMessages log_messages)
+                               std::unique_ptr<gpu::GpuInit> gpu_init)
     : GpuChildThread(std::move(quit_closure),
                      GetOptions(),
-                     std::move(gpu_init)) {
-  viz_main_.SetLogMessagesForHost(std::move(log_messages));
-}
+                     std::move(gpu_init)) {}
 
 GpuChildThread::GpuChildThread(const InProcessChildThreadParams& params,
                                std::unique_ptr<gpu::GpuInit> gpu_init)
@@ -167,18 +168,6 @@ bool GpuChildThread::Send(IPC::Message* msg) {
   return ChildThreadImpl::Send(msg);
 }
 
-void GpuChildThread::RunService(
-    const std::string& service_name,
-    mojo::PendingReceiver<service_manager::mojom::Service> receiver) {
-  if (!service_factory_) {
-    pending_service_requests_.emplace_back(service_name, std::move(receiver));
-    return;
-  }
-
-  DVLOG(1) << "GPU: Handling RunService request for " << service_name;
-  service_factory_->RunService(service_name, std::move(receiver));
-}
-
 void GpuChildThread::OnAssociatedInterfaceRequest(
     const std::string& name,
     mojo::ScopedInterfaceEndpointHandle handle) {
@@ -207,6 +196,9 @@ void GpuChildThread::OnGpuServiceConnection(viz::GpuServiceImpl* gpu_service) {
       gpu_service->gpu_feature_info(),
       gpu_service->media_gpu_channel_manager()->AsWeakPtr(),
       gpu_service->gpu_memory_buffer_factory(), std::move(overlay_factory_cb)));
+  for (auto& receiver : pending_service_receivers_)
+    BindServiceInterface(std::move(receiver));
+  pending_service_receivers_.clear();
 
   if (GetContentClient()->gpu())  // Null in tests.
     GetContentClient()->gpu()->GpuServiceInitialized();
@@ -220,10 +212,6 @@ void GpuChildThread::OnGpuServiceConnection(viz::GpuServiceImpl* gpu_service) {
   content::ExposeGpuInterfacesToBrowser(gpu_service->gpu_preferences(),
                                         &binders);
   ExposeInterfacesToBrowser(std::move(binders));
-
-  for (auto& request : pending_service_requests_)
-    RunService(request.service_name, std::move(request.receiver));
-  pending_service_requests_.clear();
 }
 
 void GpuChildThread::PostCompositorThreadCreated(
@@ -296,14 +284,4 @@ std::unique_ptr<media::AndroidOverlay> GpuChildThread::CreateAndroidOverlay(
 }
 #endif
 
-GpuChildThread::PendingServiceRequest::PendingServiceRequest(
-    const std::string& service_name,
-    mojo::PendingReceiver<service_manager::mojom::Service> receiver)
-    : service_name(service_name), receiver(std::move(receiver)) {}
-
-GpuChildThread::PendingServiceRequest::PendingServiceRequest(
-    PendingServiceRequest&&) = default;
-
-GpuChildThread::PendingServiceRequest::~PendingServiceRequest() = default;
-
 }  // namespace content
diff --git a/chromium/content/gpu/gpu_child_thread.h b/chromium/content/gpu/gpu_child_thread.h
index eb181a5840c..53974cc5dbe 100644
--- a/chromium/content/gpu/gpu_child_thread.h
+++ b/chromium/content/gpu/gpu_child_thread.h
@@ -48,8 +48,7 @@ class GpuChildThread : public ChildThreadImpl,
                        public viz::VizMainImpl::Delegate {
  public:
   GpuChildThread(base::RepeatingClosure quit_closure,
-                 std::unique_ptr<gpu::GpuInit> gpu_init,
-                 viz::VizMainImpl::LogMessages deferred_messages);
+                 std::unique_ptr<gpu::GpuInit> gpu_init);
 
   GpuChildThread(const InProcessChildThreadParams& params,
                  std::unique_ptr<gpu::GpuInit> gpu_init);
@@ -70,9 +69,6 @@ class GpuChildThread : public ChildThreadImpl,
 
   // ChildThreadImpl:
   bool Send(IPC::Message* msg) override;
-  void RunService(
-      const std::string& service_name,
-      mojo::PendingReceiver<service_manager::mojom::Service> receiver) override;
   void BindServiceInterface(mojo::GenericPendingReceiver receiver) override;
 
   // IPC::Listener implementation via ChildThreadImpl:
@@ -105,9 +101,13 @@ class GpuChildThread : public ChildThreadImpl,
 
   viz::VizMainImpl viz_main_;
 
-  // ServiceFactory for service_manager::Service hosting.
+  // ServiceFactory for Mojo service hosting.
   std::unique_ptr<GpuServiceFactory> service_factory_;
 
+  // A queue of incoming service interface requests received prior to
+  // |service_factory_| initialization.
+  std::vector<mojo::GenericPendingReceiver> pending_service_receivers_;
+
   blink::AssociatedInterfaceRegistry associated_interfaces_;
 
   // A closure which quits the main message loop.
@@ -115,20 +115,6 @@ class GpuChildThread : public ChildThreadImpl,
 
   std::unique_ptr<base::MemoryPressureListener> memory_pressure_listener_;
 
-  // Retains pending GPU-process service startup requests (i.e. RunService
-  // invocations from the browser) until the process is fully initialized.
-  struct PendingServiceRequest {
-    PendingServiceRequest(
-        const std::string& service_name,
-        mojo::PendingReceiver<service_manager::mojom::Service> receiver);
-    PendingServiceRequest(PendingServiceRequest&&);
-    ~PendingServiceRequest();
-
-    std::string service_name;
-    mojo::PendingReceiver<service_manager::mojom::Service> receiver;
-  };
-  std::vector<PendingServiceRequest> pending_service_requests_;
-
   base::WeakPtrFactory<GpuChildThread> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(GpuChildThread);
diff --git a/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc b/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc
index ff7a472f32c..5248ec80e34 100644
--- a/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc
+++ b/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc
@@ -7,19 +7,37 @@
 #include "content/gpu/gpu_child_thread.h"
 
 #include "base/no_destructor.h"
+#include "media/mojo/buildflags.h"
 #include "services/shape_detection/public/mojom/shape_detection_service.mojom.h"
 #include "services/shape_detection/shape_detection_service.h"
 
+#if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
+#include "content/gpu/gpu_service_factory.h"
+#include "media/mojo/mojom/media_service.mojom.h"
+#endif
+
 namespace content {
 
 void GpuChildThread::BindServiceInterface(
     mojo::GenericPendingReceiver receiver) {
+  if (!service_factory_) {
+    pending_service_receivers_.push_back(std::move(receiver));
+    return;
+  }
+
   if (auto shape_detection_receiver =
           receiver.As<shape_detection::mojom::ShapeDetectionService>()) {
     static base::NoDestructor<shape_detection::ShapeDetectionService> service{
         std::move(shape_detection_receiver)};
     return;
   }
+
+#if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
+  if (auto r = receiver.As<media::mojom::MediaService>()) {
+    service_factory_->RunMediaService(std::move(r));
+    return;
+  }
+#endif
 }
 
 }  // namespace content
diff --git a/chromium/content/gpu/gpu_main.cc b/chromium/content/gpu/gpu_main.cc
index 35b450a41a9..0a96d09d0de 100644
--- a/chromium/content/gpu/gpu_main.cc
+++ b/chromium/content/gpu/gpu_main.cc
@@ -10,7 +10,6 @@
 
 #include "base/bind.h"
 #include "base/feature_list.h"
-#include "base/lazy_instance.h"
 #include "base/message_loop/message_pump_type.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/rand_util.h"
@@ -18,6 +17,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/system/sys_info.h"
+#include "base/task/post_task.h"
 #include "base/task/single_thread_task_executor.h"
 #include "base/threading/platform_thread.h"
 #include "base/timer/hi_res_timer_manager.h"
@@ -47,6 +47,7 @@
 #include "gpu/ipc/service/gpu_watchdog_thread.h"
 #include "media/gpu/buildflags.h"
 #include "services/tracing/public/cpp/stack_sampling/tracing_sampler_profiler.h"
+#include "services/tracing/public/cpp/trace_startup.h"
 #include "third_party/angle/src/gpu_info_util/SystemInfo.h"
 #include "ui/events/platform/platform_event_source.h"
 #include "ui/gfx/switches.h"
@@ -77,9 +78,10 @@
 #endif
 
 #if defined(USE_X11)
-#include "ui/base/x/x11_util.h"       // nogncheck
-#include "ui/gfx/x/x11_connection.h"  // nogncheck
-#include "ui/gfx/x/x11_switches.h"    // nogncheck
+#include "ui/base/x/x11_util.h"                          // nogncheck
+#include "ui/gfx/linux/gpu_memory_buffer_support_x11.h"  // nogncheck
+#include "ui/gfx/x/x11_connection.h"                     // nogncheck
+#include "ui/gfx/x/x11_switches.h"                       // nogncheck
 #endif
 
 #if defined(OS_LINUX)
@@ -91,6 +93,7 @@
 
 #if defined(OS_MACOSX)
 #include "base/message_loop/message_pump_mac.h"
+#include "components/metal_util/device_removal.h"
 #include "components/metal_util/test_shader.h"
 #include "content/public/common/content_features.h"
 #include "media/gpu/mac/vt_video_decode_accelerator_mac.h"
@@ -114,21 +117,6 @@ bool StartSandboxLinux(gpu::GpuWatchdogThread*,
 bool StartSandboxWindows(const sandbox::SandboxInterfaceInfo*);
 #endif
 
-base::LazyInstance<viz::VizMainImpl::LogMessages>::DestructorAtExit
-    deferred_messages = LAZY_INSTANCE_INITIALIZER;
-
-bool GpuProcessLogMessageHandler(int severity,
-                                 const char* file, int line,
-                                 size_t message_start,
-                                 const std::string& str) {
-  viz::VizMainImpl::LogMessage log;
-  log.severity = severity;
-  log.header = str.substr(0, message_start);
-  log.message = str.substr(message_start);
-  deferred_messages.Get().push_back(std::move(log));
-  return false;
-}
-
 class ContentSandboxHelper : public gpu::GpuSandboxHelper {
  public:
   ContentSandboxHelper() {}
@@ -256,7 +244,9 @@ int GpuMain(const MainFunctionParams& parameters) {
     ::SetPriorityClass(::GetCurrentProcess(), ABOVE_NORMAL_PRIORITY_CLASS);
 #endif
 
-  logging::SetLogMessageHandler(GpuProcessLogMessageHandler);
+  // Installs a base::LogMessageHandlerFunction which ensures messages are sent
+  // to the GpuProcessHost once the GpuServiceImpl has started.
+  viz::GpuServiceImpl::InstallPreInitializeLogHandler();
 
   // We are experiencing what appear to be memory-stomp issues in the GPU
   // process. These issues seem to be impacting the task executor and listeners
@@ -307,6 +297,10 @@ int GpuMain(const MainFunctionParams& parameters) {
     main_thread_task_executor =
         std::make_unique<base::SingleThreadTaskExecutor>(
             base::MessagePumpType::NS_RUNLOOP);
+    // As part of the migration to DoWork(), this policy is required to keep
+    // previous behavior and avoid regressions.
+    // TODO(crbug.com/1041853): Consider updating the policy.
+    main_thread_task_executor->SetWorkBatchSize(2);
 #else
     main_thread_task_executor =
         std::make_unique<base::SingleThreadTaskExecutor>(
@@ -348,7 +342,6 @@ int GpuMain(const MainFunctionParams& parameters) {
       const_cast<base::CommandLine*>(&command_line), gpu_preferences);
   const bool dead_on_arrival = !init_success;
 
-  logging::SetLogMessageHandler(nullptr);
   GetContentClient()->SetGpuInfo(gpu_init->gpu_info());
 
   const base::ThreadPriority io_thread_priority =
@@ -366,25 +359,57 @@ int GpuMain(const MainFunctionParams& parameters) {
   GpuProcess gpu_process(io_thread_priority);
 #endif
 
+#if defined(USE_X11)
+  // ui::GbmDevice() takes >50ms with amdgpu, so kick off
+  // GpuMemoryBufferSupportX11 creation on another thread now.
+  base::PostTask(
+      FROM_HERE, base::BindOnce([]() {
+        SCOPED_UMA_HISTOGRAM_TIMER("Linux.X11.GbmSupportX11CreationTime");
+        ui::GpuMemoryBufferSupportX11::GetInstance();
+      }));
+#endif
+
   auto* client = GetContentClient()->gpu();
   if (client)
     client->PostIOThreadCreated(gpu_process.io_task_runner());
 
   base::RunLoop run_loop;
   GpuChildThread* child_thread =
-      new GpuChildThread(run_loop.QuitClosure(), std::move(gpu_init),
-                         std::move(deferred_messages.Get()));
-  deferred_messages.Get().clear();
-
+      new GpuChildThread(run_loop.QuitClosure(), std::move(gpu_init));
   child_thread->Init(start_time);
 
   gpu_process.set_main_thread(child_thread);
 
+#if defined(OS_POSIX) && !defined(OS_ANDROID) && !defined(OS_MACOSX)
+  // Startup tracing is usually enabled earlier, but if we forked from a zygote,
+  // we can only enable it after mojo IPC support is brought up initialized by
+  // GpuChildThread, because the mojo broker has to create the tracing SMB on
+  // our behalf due to the zygote sandbox.
+  if (parameters.zygote_child)
+    tracing::EnableStartupTracingIfNeeded();
+#endif  // OS_POSIX && !OS_ANDROID && !!OS_MACOSX
+
   // Setup tracing sampler profiler as early as possible.
   std::unique_ptr<tracing::TracingSamplerProfiler> tracing_sampler_profiler =
       tracing::TracingSamplerProfiler::CreateOnMainThread();
 
 #if defined(OS_MACOSX)
+  // A GPUEjectPolicy of 'wait' is set in the Info.plist of the browser
+  // process, meaning it is "responsible" for making sure it and its
+  // subordinate processes (i.e. the GPU process) drop references to the
+  // external GPU. Despite this, the system still sends the device removal
+  // notifications to the GPU process, so the GPU process handles its own
+  // graceful shutdown without help from the browser process.
+  //
+  // Using the "SafeEjectGPU" tool, we can see that when the browser process
+  // has a policy of 'wait', the GPU process gets the 'rwait' policy: "Eject
+  // actions apply to the responsible process, who in turn deals with
+  // subordinates to eliminate their ejecting eGPU references" [man 8
+  // SafeEjectGPU]. Empirically, the browser does not relaunch. Once the GPU
+  // process exits, it appears that the browser process is no longer considered
+  // to be using the GPU, so it "succeeds" the 'wait'.
+  metal::RegisterGracefulExitOnDeviceRemoval();
+
   // Launch a test metal shader compile to see how long it takes to complete (if
   // it ever completes).
   // https://crbug.com/974219
@@ -426,6 +451,8 @@ bool StartSandboxLinux(gpu::GpuWatchdogThread* watchdog_thread,
   service_manager::SandboxLinux::Options sandbox_options;
   sandbox_options.use_amd_specific_policies =
       gpu_info && angle::IsAMD(gpu_info->active_gpu().vendor_id);
+  sandbox_options.use_intel_specific_policies =
+      gpu_info && angle::IsIntel(gpu_info->active_gpu().vendor_id);
   sandbox_options.accelerated_video_decode_enabled =
       !gpu_prefs.disable_accelerated_video_decode;
   sandbox_options.accelerated_video_encode_enabled =
diff --git a/chromium/content/gpu/gpu_sandbox_hook_linux.cc b/chromium/content/gpu/gpu_sandbox_hook_linux.cc
index 078b93be5e5..6cacc8af640 100644
--- a/chromium/content/gpu/gpu_sandbox_hook_linux.cc
+++ b/chromium/content/gpu/gpu_sandbox_hook_linux.cc
@@ -6,6 +6,7 @@
 
 #include <dlfcn.h>
 #include <errno.h>
+#include <sys/stat.h>
 
 #include <memory>
 #include <sstream>
@@ -196,6 +197,29 @@ void AddAmdGpuWhitelist(std::vector<BrokerFilePermission>* permissions) {
   }
 }
 
+void AddIntelGpuWhitelist(std::vector<BrokerFilePermission>* permissions) {
+  static const char* const kReadOnlyList[] = {
+      "/dev/dri",
+      "/usr/share/vulkan/icd.d",
+      "/usr/share/vulkan/icd.d/intel_icd.x86_64.json"};
+  for (const char* item : kReadOnlyList)
+    permissions->push_back(BrokerFilePermission::ReadOnly(item));
+
+  // TODO(hob): Whitelist all valid render node paths.
+  static const char kRenderNodePath[] = "/dev/dri/renderD128";
+  struct stat st;
+  if (stat(kRenderNodePath, &st) == 0) {
+    permissions->push_back(BrokerFilePermission::ReadWrite(kRenderNodePath));
+
+    uint32_t major = (static_cast<uint32_t>(st.st_rdev) >> 8) & 0xff;
+    uint32_t minor = static_cast<uint32_t>(st.st_rdev) & 0xff;
+    std::string char_device_path =
+        base::StringPrintf("/sys/dev/char/%u:%u/", major, minor);
+    permissions->push_back(
+        BrokerFilePermission::ReadOnlyRecursive(char_device_path));
+  }
+}
+
 void AddArmGpuWhitelist(std::vector<BrokerFilePermission>* permissions) {
   // On ARM we're enabling the sandbox before the X connection is made,
   // so we need to allow access to |.Xauthority|.
@@ -243,6 +267,9 @@ void AddStandardGpuWhiteList(std::vector<BrokerFilePermission>* permissions) {
   static const char kNvidiaDeviceModeSetPath[] = "/dev/nvidia-modeset";
   static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params";
   static const char kDevShm[] = "/dev/shm/";
+  static const char kVulkanIcdPath[] = "/usr/share/vulkan/icd.d";
+  static const char kNvidiaVulkanIcd[] =
+      "/usr/share/vulkan/icd.d/nvidia_icd.json";
 
   // For shared memory.
   permissions->push_back(
@@ -263,6 +290,9 @@ void AddStandardGpuWhiteList(std::vector<BrokerFilePermission>* permissions) {
   permissions->push_back(
       BrokerFilePermission::ReadWrite(kNvidiaDeviceModeSetPath));
   permissions->push_back(BrokerFilePermission::ReadOnly(kNvidiaParamsPath));
+
+  permissions->push_back(BrokerFilePermission::ReadOnly(kVulkanIcdPath));
+  permissions->push_back(BrokerFilePermission::ReadOnly(kNvidiaVulkanIcd));
 }
 
 std::vector<BrokerFilePermission> FilePermissionsForGpu(
@@ -284,6 +314,10 @@ std::vector<BrokerFilePermission> FilePermissionsForGpu(
       AddAmdGpuWhitelist(&permissions);
       return permissions;
     }
+    if (options.use_intel_specific_policies) {
+      AddIntelGpuWhitelist(&permissions);
+      return permissions;
+    }
   }
 
   if (UseChromecastSandboxWhitelist()) {
@@ -376,7 +410,8 @@ sandbox::syscall_broker::BrokerCommandSet CommandSetForGPU(
   command_set.set(sandbox::syscall_broker::COMMAND_ACCESS);
   command_set.set(sandbox::syscall_broker::COMMAND_OPEN);
   command_set.set(sandbox::syscall_broker::COMMAND_STAT);
-  if (IsChromeOS() && options.use_amd_specific_policies) {
+  if (IsChromeOS() && (options.use_amd_specific_policies ||
+                       options.use_intel_specific_policies)) {
     command_set.set(sandbox::syscall_broker::COMMAND_READLINK);
   }
   return command_set;
diff --git a/chromium/content/gpu/gpu_service_factory.cc b/chromium/content/gpu/gpu_service_factory.cc
index db5688aff8a..21d9d6db69b 100644
--- a/chromium/content/gpu/gpu_service_factory.cc
+++ b/chromium/content/gpu/gpu_service_factory.cc
@@ -6,14 +6,15 @@
 
 #include <memory>
 
+#include "base/no_destructor.h"
 #include "base/task/post_task.h"
+#include "base/task/thread_pool.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
 #include "media/media_buildflags.h"
 
 #if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
 #include "base/bind.h"
-#include "media/mojo/mojom/constants.mojom.h"      // nogncheck
 #include "media/mojo/services/media_service_factory.h"  // nogncheck
 #if BUILDFLAG(ENABLE_CDM_PROXY)
 #include "content/public/gpu/content_gpu_client.h"
@@ -42,48 +43,45 @@ GpuServiceFactory::GpuServiceFactory(
 
 GpuServiceFactory::~GpuServiceFactory() {}
 
-void GpuServiceFactory::RunService(
-    const std::string& service_name,
-    mojo::PendingReceiver<service_manager::mojom::Service> receiver) {
-  auto request = service_manager::mojom::ServiceRequest(std::move(receiver));
+void GpuServiceFactory::RunMediaService(
+    mojo::PendingReceiver<media::mojom::MediaService> receiver) {
 #if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
-  if (service_name == media::mojom::kMediaServiceName) {
-    media::CdmProxyFactoryCB cdm_proxy_factory_cb;
+  media::CdmProxyFactoryCB cdm_proxy_factory_cb;
 #if BUILDFLAG(ENABLE_CDM_PROXY)
-    cdm_proxy_factory_cb =
-        base::BindRepeating(&ContentGpuClient::CreateCdmProxy,
-                            base::Unretained(GetContentClient()->gpu()));
+  cdm_proxy_factory_cb =
+      base::BindRepeating(&ContentGpuClient::CreateCdmProxy,
+                          base::Unretained(GetContentClient()->gpu()));
 #endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 
-    // This service will host audio/video decoders, and if these decoding
-    // operations are blocked, user may hear audio glitch or see video freezing,
-    // hence "user blocking".
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner;
+  // This service will host audio/video decoders, and if these decoding
+  // operations are blocked, user may hear audio glitch or see video freezing,
+  // hence "user blocking".
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner;
 #if defined(OS_WIN)
-    // Run everything on the gpu main thread, since that's where the CDM runs.
-    task_runner = task_runner_;
+  // Run everything on the gpu main thread, since that's where the CDM runs.
+  task_runner = task_runner_;
 #else
-    // TODO(crbug.com/786169): Check whether this needs to be single threaded.
-    task_runner = base::CreateSingleThreadTaskRunner(
-        {base::ThreadPool(), base::TaskPriority::USER_BLOCKING});
+  // TODO(crbug.com/786169): Check whether this needs to be single threaded.
+  task_runner = base::ThreadPool::CreateSingleThreadTaskRunner(
+      {base::TaskPriority::USER_BLOCKING});
 #endif  // defined(OS_WIN)
 
-    using FactoryCallback =
-        base::OnceCallback<std::unique_ptr<service_manager::Service>()>;
-    FactoryCallback factory = base::BindOnce(
-        &media::CreateGpuMediaService, std::move(request), gpu_preferences_,
-        gpu_workarounds_, gpu_feature_info_, task_runner_,
-        media_gpu_channel_manager_, gpu_memory_buffer_factory_,
-        android_overlay_factory_cb_, std::move(cdm_proxy_factory_cb));
-    task_runner->PostTask(
-        FROM_HERE, base::BindOnce(
-                       [](FactoryCallback factory) {
-                         service_manager::Service::RunAsyncUntilTermination(
-                             std::move(factory).Run());
-                       },
-                       std::move(factory)));
-    return;
-  }
+  using FactoryCallback =
+      base::OnceCallback<std::unique_ptr<media::MediaService>()>;
+  FactoryCallback factory = base::BindOnce(
+      &media::CreateGpuMediaService, std::move(receiver), gpu_preferences_,
+      gpu_workarounds_, gpu_feature_info_, task_runner_,
+      media_gpu_channel_manager_, gpu_memory_buffer_factory_,
+      android_overlay_factory_cb_, std::move(cdm_proxy_factory_cb));
+  task_runner->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          [](FactoryCallback factory) {
+            static base::NoDestructor<std::unique_ptr<media::MediaService>>
+                service{std::move(factory).Run()};
+          },
+          std::move(factory)));
+  return;
 #endif  // BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
 }
 
diff --git a/chromium/content/gpu/gpu_service_factory.h b/chromium/content/gpu/gpu_service_factory.h
index 1c15091d8fd..fc174fedfdb 100644
--- a/chromium/content/gpu/gpu_service_factory.h
+++ b/chromium/content/gpu/gpu_service_factory.h
@@ -14,6 +14,7 @@
 #include "gpu/config/gpu_preferences.h"
 #include "media/base/android_overlay_mojo_factory.h"
 #include "media/mojo/buildflags.h"
+#include "media/mojo/mojom/media_service.mojom.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
 
 namespace gpu {
@@ -38,9 +39,8 @@ class GpuServiceFactory {
       media::AndroidOverlayMojoFactoryCB android_overlay_factory_cb);
   ~GpuServiceFactory();
 
-  void RunService(
-      const std::string& service_name,
-      mojo::PendingReceiver<service_manager::mojom::Service> receiver);
+  void RunMediaService(
+      mojo::PendingReceiver<media::mojom::MediaService> receiver);
 
  private:
 #if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
diff --git a/chromium/content/gpu/in_process_gpu_thread.cc b/chromium/content/gpu/in_process_gpu_thread.cc
index 8c83f439f58..146ee6a9325 100644
--- a/chromium/content/gpu/in_process_gpu_thread.cc
+++ b/chromium/content/gpu/in_process_gpu_thread.cc
@@ -13,6 +13,11 @@
 #include "content/public/common/content_switches.h"
 #include "gpu/config/gpu_preferences.h"
 #include "gpu/ipc/service/gpu_init.h"
+#include "media/gpu/buildflags.h"
+
+#if BUILDFLAG(USE_VAAPI)
+#include "media/gpu/vaapi/vaapi_wrapper.h"
+#endif
 
 #if defined(OS_ANDROID)
 #include "base/android/jni_android.h"
@@ -51,6 +56,10 @@ void InProcessGpuThread::Init() {
   gpu_init->InitializeInProcess(base::CommandLine::ForCurrentProcess(),
                                 gpu_preferences_);
 
+#if BUILDFLAG(USE_VAAPI)
+  media::VaapiWrapper::PreSandboxInitialization();
+#endif
+
   GetContentClient()->SetGpuInfo(gpu_init->gpu_info());
 
   // The process object takes ownership of the thread object, so do not