How to Install Nvidia Drivers in Linux Mint

The graphics card I have is a 1050ti. It's not a bad card, but it isn't a very good one either, nor is it very new. It's possible you'll have more trouble with a more recent card or a less popular one.

Installing Proprietary Nvidia Drivers

Context: by default, Linux Mint, and many other distros, doesn't come with the official Nvidia drivers from Nvidia installed. This is because they only ship libreware, and Nvidia's software is proprietary. Instead, what comes installed is an open source project called Nouveau. It's an unofficial driver created by Linux enthusiasts who appear to have reverse engineered how the proprietary driver worked and then wrote their own driver to match the proprietary driver's functionality. Nouveau developers don't have access to the proprietary driver's source code, although Nvidia did provide them with some documentation, it seems there was less help than what AMD provided (according to discussion on Hacker News, from 2019¹). While extremely impressive, there are many cases Nouveau will fail to work or have inferior performance. For example, DaVinci Resolve won't run with Nouveau². There are some reasons why AMD cards are often said to work better than Nvidia cards on Linux, specially on less-tested technologies such as Wayland. In 2022, Nvidia released some open-source GPU kernel modules³, and in 2024, they transitioned to fully open-sourced kernel modules⁴. Which means things are getting better, and you probably won't need a tutorial in the future.

Goal: you must make sure you're using the proprietary Nvidia driver instead of Nouveau.

There is an easy way to do this with Linux Mint, and a slightly harder way to do it if you're on a different distro like Fedora.

Method 1: Using Mint's Driver manager

Video: youtube.com/watch?v=qRqCsQI7p2I (not mine, see below for extra steps).

On Linux Mint:

1: open Cinnamon's start menu and search for "driver." You should see "Driver Manager" in the results. Click to open it.

This requires superuser privileges (you'll be prompted for your password).

It seems to connect to the Internet at start up, which may take a while. If you click on it, Cinnamon will tell you it stopped responding. Just wait. Cinnamon seems to be very aggressive about responsiveness, compared to other desktop environments.

2: the driver manager will allow you to switch from Nouveau to Nvidia drivers, which it should tell you are the "recommended" drivers. Select them.

3: click Apply Changes.

This will download and install the drivers automatically. You may need to restart for them to start working, and you may need to do some extra things.

Installing Newer Driver Versions

In some cases, the drivers available through the driver manager are too old for what you want to do, in which case you'll need to install a newer version through the Aptitude package manager.

Anecdote: for example, DaVinci Resolve 19 requires CUDA version 12.3. The driver 535 only provides CUDA 12.2, I think? So even though it's the same graphics card, and DaVinci Resolve 18 worked just fine, 19 won't work unless you install 545 or 550, or something more recent. Something similar could happen if you're trying to run particularly GPU-intensive programs, such as machine learning or even Stable Diffusion, which depends on CUDA technology to paralelize computations. By the way, after I installed 550, Cinnamon stopped working right, because the driver thought I had two monitors connected side by side, when I hadn't. This means my mouse cursor could go too far to the right, off the screen, beyond the scrollbars, which made everything on the right side hard to click. The workspaces on the taskbar also became twice as wide. It seems to happen randomly.

Method 2: Using Sudo Apt Install

If we want to install the latest drivers, or we are in a different distro, we need to use Aptitude or that distro's package manager. For this, follow the following steps:

1: open the terminal. [how?]

2: check what are the latest drivers you can install. We can do this with the command:

apt search nvidia-driver-*

Warning: the command we're running is search, not install.

The asterisk matches anything, so you'll see a list with results like:

nvidia-driver-535
nvidia-driver-535-open
nvidia-driver-535-open-server
nvidia-driver-535-server
nvidia-driver-550
nvidia-driver-550-open
nvidia-driver-550-open-server
nvidia-driver-550-server

And so on. As you can see there are various versions for each. I'm not sure what's the difference between them, so I'll just install the least qualified one (without the open or server qualifiers). Each of these is a metapackage, which means the package doesn't have anything in it except dependencies, i.e. it just tells Aptitude which other, more specific packages it should install.

3: install the most recent driver you can find. In my case that was nvidia-driver-550. So I'd run the command:

sudo apt install nvidia-driver-550

You'll be prompted for your sudoer password.

Aptitude will automatically install the driver.

You can confirm they were installed by listing which Nvidia drivers you have installed.

apt list --installed nvidia-driver-*

After this you may need to restart to apply the changes.

Troubleshooting

There is some trouble you may run into even if you followed the steps above correctly. In this section, I'll share some ways to troubleshoot problems in the Nvidia installation.

Ensuring Nvidia Drivers are Running

The first thing you want to do is make sure the Nvidia drivers are actually working. When the Nvidia drivers metapackage was installed, one of the programs that was installed with it was a command line utility called System Manager Interface [developer.nvidia.com/system-management-interface]. We can use it to check if the Nvidia drivers are running.

1: open the terminal, and run the following command:

nvidia-smi

If the drivers are running properly, you should a table drawn with ASCII on the terminal window showing all sort of information, such as what is the Driver Version (e.g. 550.90.07), what is the CUDA Version (e.g. 12.4), and even how much video memory (VRAM) is being used by Cinnamon and other programs running in your system.

If the drivers aren't running, an error will be displayed instead.

Fixing Secure Boot

So far, the only problem I ran into installing Nvidia drivers was with Secure Boot, so this is the only thing I can help you with.

1: open a terminal window and run the following command to check whether Secure Boot is enabled or not.

mokutil --sb-state

If it says "SecureBoot enabled," then the following steps may help you. Otherwise, I'm sorry but I can't help you.

I'll explain bit how Secure Boot works and why it breaks things. If you're in a hurry, you can skip to the commands below.

If you have Secure Boot enabled, the proprietary Nvidia driver may not activate, which means the system will use the Nouveau drivers as a fallback. Some tutorials will tell you to blacklist Nouveau drivers to ensure they don't run. I'm not sure what happens if Nvidia doesn't load, and Nouveau doesn't load either. Maybe there is a more basic generic fallback for video, maybe you won't have video at all and you'll need to boot into recovery mode somehow. In any case, blacklisting Nouveau isn't necessary, but you do need to fix Secure Boot.

Secure Boot may be necessary for booting into Windows. I'm not sure. If you're dual-booting into Windows, it may not be an option to disable Secure Boot. Some claim Secure Boot isn't really useful, and can be disabled without much problem, but, in any case, disabling it isn't necessary in order to make Nvidia drivers work on Linux.

When you installed Linux Mint, you were prompted for a password for Secure Boot. You probably completely forgot about it. Don't worry because it won't be necessary.

Secure Boot is a technology that ensures only critical software that can be recognized can be run by the operating system. To be able to "recognize" the software, it must be signed with a cryptographic key that is known. This is what "signing" software means generally. I'm not very sure how it works or what attack vectors it tries to protect you from exactly, but in practice it seems to act as a layer between the operating system and the hardware. Although the operating system can run, the Nvidia drivers can't, and the system system can't tell Secure Boot the drivers are trusted. This means is that even if the entire operating system was infected with malware, it still wouldn't be able to influence Secure Boot. Again, I'm still not sure what is the point of this when the rest of the system could be infected, but let's assume it's useful for something.

What we need to do is give Secure Boot Linux Mint's key so that it will allow software signed by Linux Mint to run, including the Nvidia's drivers. Linux Mint can't do automatically it by itself, so how do we do it? Essentially, we run a program in Linux Mint that sends the key to an area accessible by Secure Boot (by the firmware). Then, when we reboot the computer, before the operating system loads, the firmware will notice that a key was given to it, and will ask you to manually select to enroll this key in an interface called MOK Manager (MOK means Machine Owner Key). You also need to set up a password when you generate the key in the system that you will need to type again in the firmware interface to make sure you're enrolling the correct key. This means it requires human interaction and physical access to the computer to do this, which is, uh, secure, I guess? And also a massive inconvenience. I imagine a lot of less-technical people will have trouble because their expensive PCs will work badly or not work at all on Linux unless they follow such technical steps.

By the way, you don't need to do this for Windows because Microsoft has the resources to make every motherboard manufacturer include Microsoft's keys into Secure Boot by default.

Commands

1: send Linux Mint's key to Secure Boot by running the following command⁵:

sudo update-secureboot-policy --enroll-key

You'll be asked to type a password. I'm not very sure, but it seems this is an one-time password, so it could be something simple like hunter2 just to make sure it's the right key. Considering you need physical access to the computer to use this, it's really nothing to worry about.

At next reboot, the device firmware should launch it's MOK manager and prompt the user to review the new key and confirm it's enrollment, using the one-time password. Any kernel modules (or kernels) that have been signed with this MOK should now be loadable.

https://wiki.debian.org/SecureBoot (accessed 2024-08-27)

MokManager allows any user present at the system console to enroll keys, remove trusted keys, enroll binary hashes and toggle Secure Boot validation at the shim level, but most tasks require a previously set password to be entered to confirm that the user at console is indeed the person who requested changes. Such passwords only survive across a single run of shim / MokManager; and are cleared as soon as the process is completed or cancelled.

https://wiki.ubuntu.com/UEFI/SecureBoot (accessed 2024-08-27)

2: after this, you need to reboot. You should read the rest of this tutorial before doing that as you may not be able to view it otherwise.

If it worked properly, you should see some screen during boot that lets you enroll keys. I'm not exactly sure what this screen looks like, it could vary from motherboard to motherboard, but it seems many firmwares use the same MOK Manager interface. In my case, it was a blue screen with white text, and you could navigate through the menus using the arrow keys on the keyboard.

3: using the arrow keys, find and select the option to "Enroll MOK," then press the Enter key to activate it. A list of keys will be displayed.

4: select the key to enroll and press Enter. There should be only one. If there are multiple, it shouldn't matter since you only know the password of one of them. If you get it wrong just try a different key until you find the right one.

5: when prompted, type the same password you typed before.

6: after the key is successfully enrolled, find and select an option to exit the firmware interface. It could be "Continue boot."

7: if you were successful, the Nvidia drivers should be working properly. Test it by running the command-line utility again:

nvidia-smi

This time it should work. If it doesn't, I wouldn't know what to do if I were you. Good luck!

Fixing the Secure Boot, Again

After you finish the steps above, you shouldn't have any problems with Secure Boot ever again on Linux.

Until you distro-hop, then you have to do it again. So if you switch from Fedora to Linux Mint (like I did), or from Linux Mint to Ubuntu, you'll need to enroll your new operating system key following steps similar to the above. It could be that the update-secureboot-policy utility installed in that case, which means you'll need to generate the key some other way and enroll them some other way, but in general the steps should be the same.

I suppose there is a limit to how many keys can fit into the firmware's memory, but I don't want to find out.

References

1. https://news.ycombinator.com/item?id=18834991 (accessed 2024-08-27) ↩︎
2. Anecdote: perhaps due to a bug, the latest version I tried at the time, DaVinci Resolve 19, requires a very high CUDA version available only on the latest proprietary Nvidia drivers. ↩︎
3. https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/ (accessed 2024-08-27) ↩︎
4. https://developer.nvidia.com/blog/nvidia-transitions-fully-towards-open-source-gpu-kernel-modules/ (accessed 2024-08-27) ↩︎
5. https://forums.linuxmint.com/viewtopic.php?t=397115 (accessed 2024-08-27) ↩︎