Linux Mint 20.2 and Secure Boot

[Todd Sauve]

I am dual booting Windows 10 and Mint 20.2. If I "upgrade" (I use the term loosely) to Windows 11 it requires me to use Secure Boot in the BIOS.

What problems or hurdles does this present with Mint 20.2 64bit? Will there be video driver problems with my RTX 3060Ti because of loading irregularities this poses?

Anyone who has done this and knows the ins and outs of it, please tell me what to do or not do.

[Petermint]

There are posts about running Linux with and without secure boot. It appears to depend on your BIOS. Post the results of command inxi -Fxxxrz.

Do you switch between both operating systems frequently? What is your use? If secure boot becomes a problem for you, there are alternatives including running one OS in a VM and it depends on your usage.

I currently do not use Windows. I used dual boot for some projects where the customers demanded and supplied Microsoft products. Booting back and forth was a waste of my time. Today I would run Windows on a spare notebook. No rebooting.

[Todd Sauve]

Thanks for your reply Peter.

I don't use Mint nearly as often as Win 10. But when Win 10 screws up it is nice to have Mint to fall back on and find solutions to my PC problems. My PC is OK for now, but as I said I might upgrade it to Win 11 once it is past its current abomination stage. What a nightmare it is!

I "upgraded" to Win 11 about 3 weeks ago, when M$ claimed it was ready for prime time. It was and still is NOT! (And I have thoroughly new gear, so that is not the problem.) But Win 11 requires you to turn on both TPM2 and Secure Boot.

But when I booted into Mint the OS told me I had to make changes to something as I rebooted the next time. I don't know what they were but I received an info screen with an OK to press, so I pressed OK. Then Mint did not like what was happening at all, and I got repeated problems with error messages saying the video driver did not load correctly.

E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem.
E: _cache->open() failed, please report.

So I went into Driver Manager and it told me the driver was loaded correctly. But it would do this on every reboot and Driver Manager would take several minutes just to open. The day before yesterday the Update Manager would no longer update and gave me the same error messages.

Another user on the forums here gave me a command line that cleared the entire mess up:

sudo dpkg --configure -a

But I turned Secure Boot off after I deleted Win 11 and went back to Win 10 several weeks ago.

Thus my questions. What does one do to keep Mint running when Secure Boot is turned on in the BIOS?

[Todd Sauve]

Here is what the command line shows:

Code: Select all

todd@todd-System-Product-Name:~$ inxi -Fxxxrz
System:
  Kernel: 5.11.0-37-generic x86_64 bits: 64 compiler: N/A 
  Desktop: Cinnamon 5.0.6 wm: muffin 5.0.2 dm: LightDM 1.30.0 
  Distro: Linux Mint 20.2 Uma base: Ubuntu 20.04 focal 
Machine:
  Type: Desktop Mobo: ASUSTeK model: TUF GAMING X570-PLUS v: Rev X.0x 
  serial: <filter> UEFI: American Megatrends v: 4021 date: 08/09/2021 
Battery:
  Device-1: hidpp_battery_0 model: Logitech Wireless Mouse M510 
  serial: <filter> charge: 55% (should be ignored) rechargeable: yes 
  status: Discharging 
  Device-2: hidpp_battery_1 model: Logitech Wireless Keyboard K360 
  serial: <filter> charge: 55% (should be ignored) rechargeable: yes 
  status: Discharging 
CPU:
  Topology: 8-Core model: AMD Ryzen 7 3700X bits: 64 type: MT MCP arch: Zen 
  L2 cache: 4096 KiB 
  flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm 
  bogomips: 115204 
  Speed: 2122 MHz min/max: 2200/3600 MHz boost: enabled Core speeds (MHz): 
  1: 2122 2: 2499 3: 2061 4: 2203 5: 3716 6: 2258 7: 3667 8: 2382 9: 2067 
  10: 3699 11: 2291 12: 2709 13: 3024 14: 2205 15: 2486 16: 2887 
Graphics:
  Device-1: NVIDIA vendor: Gigabyte driver: nvidia v: 460.91.03 
  bus ID: 09:00.0 chip ID: 10de:2486 
  Display: x11 server: X.Org 1.20.11 driver: nvidia 
  resolution: 1920x1080~60Hz 
  OpenGL: renderer: GeForce RTX 3060 Ti/PCIe/SSE2 v: 4.6.0 NVIDIA 460.91.03 
  direct render: Yes 
Audio:
  Device-1: NVIDIA vendor: Gigabyte driver: snd_hda_intel v: kernel 
  bus ID: 09:00.1 chip ID: 10de:228b 
  Device-2: AMD Starship/Matisse HD Audio vendor: ASUSTeK 
  driver: snd_hda_intel v: kernel bus ID: 0b:00.4 chip ID: 1022:1487 
  Device-3: Razer USA Razer Kiyo Pro type: USB 
  driver: snd-usb-audio,uvcvideo bus ID: 2-1:3 chip ID: 1532:0e05 
  Sound Server: ALSA v: k5.11.0-37-generic 
Network:
  Device-1: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet 
  vendor: ASUSTeK driver: r8169 v: kernel port: f000 bus ID: 05:00.0 
  chip ID: 10ec:8168 
  IF: enp5s0 state: up speed: 1000 Mbps duplex: full mac: <filter> 
Drives:
  Local Storage: total: 4.55 TiB used: 38.23 GiB (0.8%) 
  ID-1: /dev/nvme0n1 vendor: Western Digital model: WDS100T3X0C-00SJG0 
  size: 931.51 GiB speed: 31.6 Gb/s lanes: 4 serial: <filter> rev: 111110WD 
  scheme: GPT 
  ID-2: /dev/nvme1n1 vendor: A-Data model: SX8200PNP size: 476.94 GiB 
  speed: 31.6 Gb/s lanes: 4 serial: <filter> rev: R0906I scheme: GPT 
  ID-3: /dev/sda vendor: Samsung model: SSD 840 EVO 250GB size: 232.89 GiB 
  speed: 6.0 Gb/s serial: <filter> rev: DB6Q scheme: GPT 
  ID-4: /dev/sdb vendor: Kingston model: SH103S3240G size: 223.57 GiB 
  speed: 6.0 Gb/s serial: <filter> rev: BBF0 scheme: GPT 
  ID-5: /dev/sdc vendor: Seagate model: ST2000DM001-1CH164 size: 1.82 TiB 
  speed: 6.0 Gb/s rotation: 7200 rpm serial: <filter> rev: CC27 scheme: GPT 
  ID-6: /dev/sdd vendor: Seagate model: ST2000DM001-1CH164 size: 1.82 TiB 
  speed: 1.5 Gb/s rotation: 7200 rpm serial: <filter> rev: CC29 scheme: GPT 
Partition:
  ID-1: / size: 93.78 GiB used: 38.20 GiB (40.7%) fs: ext4 
  dev: /dev/nvme0n1p4 
Sensors:
  System Temperatures: cpu: 46.2 C mobo: N/A gpu: nvidia temp: 45 C 
  Fan Speeds (RPM): N/A gpu: nvidia fan: 0% 
Repos:
  No active apt repos in: /etc/apt/sources.list 
  Active apt repos in: /etc/apt/sources.list.d/microsoft-edge-beta.list 
  1: deb [arch=amd64] http://packages.microsoft.com/repos/edge/ stable main
  Active apt repos in: /etc/apt/sources.list.d/official-package-repositories.list 
  1: deb https://mirrors.gigenet.com/linuxmint/repo uma main upstream import backport
  2: deb https://mirrors.switch.ca/ubuntu focal main restricted universe multiverse
  3: deb https://mirrors.switch.ca/ubuntu focal-updates main restricted universe multiverse
  4: deb https://mirrors.switch.ca/ubuntu focal-backports main restricted universe multiverse
  5: deb http://security.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse
  6: deb http://archive.canonical.com/ubuntu/ focal partner
  Active apt repos in: /etc/apt/sources.list.d/teejee2008-ppa-focal.list 
  1: deb http://ppa.launchpad.net/teejee2008/ppa/ubuntu focal main
  Active apt repos in: /etc/apt/sources.list.d/ubuntuhandbook1-apps-focal.list 
  1: deb http://ppa.launchpad.net/ubuntuhandbook1/apps/ubuntu focal main
Info:
  Processes: 344 Uptime: 5m Memory: 31.27 GiB used: 2.13 GiB (6.8%) 
  Init: systemd v: 245 runlevel: 5 Compilers: gcc: 9.3.0 alt: 9 Shell: bash 
  v: 5.0.17 running in: gnome-terminal inxi: 3.0.38 
todd@todd-System-Product-Name:~$

[AndyMH]

As far as I am aware nvidia's drivers are not signed which is why you need secure boot off.

[SMG]

But when I booted into Mint the OS told me I had to make changes to something as I rebooted the next time. I don't know what they were but I received an info screen with an OK to press, so I pressed OK. Then Mint did not like what was happening at all, and I got repeated problems with error messages saying the video driver did not load correctly. So I went into Driver Manager and it told me the driver was loaded correctly. But it would do this on every reboot and Driver Manager would take several minutes just to open.
...
Thus my questions. What does one do to keep Mint running when Secure Boot is turned on in the BIOS?

Secure Boot does not need to be turned off when installing Mint because the MOK are there to be enrolled and loaded. I'm not sure if that was your info screen with MOK or not because you did not let us know if you originally installed Mint with Secure Boot enabled or disabled.

When you have third-party software drivers, such as Nvidia drivers, then your firmware says, "Whoa, these unknown entities are trying to install themselves on your system. We will protect you and stop that from happening." Okay, firmware does not talk, but if it did that is what it would say.

However, if you tell the firmware ahead of time that you are going to want to install these drivers when you boot the computer and you give the firmware the MOK "password" that the Nvidia drivers will whisper in the firmware's ear when it comes in to install, then the Nvidia drivers will be permitted to install.

Not all hardware manufacturer's handle creating MOK the same way. It is possible to create keys for Nvidia so it will load. The key that is created will be matched set between the specific Nvidia driver version and the specific kernel version. If either one of those two versions changes (such as with an update), new keys will need to be created.

The day before yesterday the Update Manager would no longer up date and gave me the same error messages. Another user on the forums here gave me a command line that cleared the entire mess up, but I turned Secure Boot off after I deleted Win 11 and went back to Win 10 several weeks ago.

It would be helpful if you provided a link to the command line so we know to what you refer.

Edited to fix typo.

[Todd Sauve]

OK, I edited my previous message and included the relevant info you asked for. Hopefully that will help you get some idea of what was going on so when I turn on Secure Boot again I don't get a ton of grief from Min 20.2. Here is the error message Mint kept giving me:

E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem.
E: _cache->open() failed, please report.

This is the command line that fixed it. I tried this command myself but Mint demanded my super user password, which I gave it but it told me it was incorrect! This line circumvented that problem for some reason:

sudo dpkg --configure -a

Mint is currently installed and working great since I ran the command line that reinstalled the Nvida driver correctly. No more "Video driver did not load" or "Update Manager can't run" error messages.

I just want Mint to be happy once I turn on the Secure Boot option when I finally upgrade to Windows 11. I have an Asus X570 Tuf Gaming Plus motherboard with the latest BIOS.

PS I installed Mint without Secure Boot on, so I never ran into any problems until I turned Secure Boot on to install Windows 11. Am I ever glad I do a daily backup of both Mint and Windows with Macrium Reflect!!!

[Todd Sauve]

Even now in Driver Manager it offers Nvidia driver 460 and 470. It Recommends the latter but won't install it. It just gives me the same error message it gave me earlier. So what actually is the problem with Nvidia drivers that they are so fussy? Is it this signature business? Why would any driver be offered within Mint's Diver Manager that is not signed? This seems like someone at Mint doesn't know what they are doing when they include driver options that gimp your machine!

I have my machine running the 460 drivers and am not going to mess with it until I know why Mint itself is so screwy!

[SMG]

Why would any driver be offered within Mint's Diver Manager that is not signed? This seems like someone at Mint doesn't know what they are doing when they include driver options that gimp your machine!

Driver Manager only offers third-party closed-source proprietary drivers. Just because you are using one offered there with Linux Mint does not mean it suddenly becomes an open-source driver. It is still a closed-source proprietary driver.

Nvidia drivers are the private intellectual property of Nvidia. Mint can not sign Nvidia's drivers because Mint (nor Ubuntu or any other open-source entity) does not have access to the driver code in order to sign it.

If you want to not have to worry about signing the Nvidia driver, then you have the option of using the open-source nouveau driver. No one is forcing you to use the proprietary Nvidia driver. Using the Nvidia driver is a choice you are making.

I will not have a chance until later today to look at the specifics of your issue, but I will and will post later.

[Todd Sauve]

Thank you for your reply SMG! Hopefully we can sort out whatever little bug is hanging around in the background.

[Petermint]

How do you like the Tuf? I have the F15. The keyboard is the only thing I would change. The backlit keyboard is difficult to read when not backlit. My previous notebook had both backlit and really good contrast when not backlit. There is enough room for a decent keyboard layout but they used a small keyboard and left a huge empty boarder. No separate page up, down, or end.

[SMG]

But when I booted into Mint the OS told me I had to make changes to something as I rebooted the next time. I don't know what they were but I received an info screen with an OK to press, so I pressed OK.

The screenshot in this post is one from an Acer desktop and was part of the messages which came up when that person was enrolling their Nvidia driver so they could boot with Secure Boot enabled.

Secure Boot is enable by the manufacturer, so the process for one manufacturer may not be exactly the same for another manufacturer. That person had Secure Boot enabled when they installed Mint and left it on after installing the Nvidia driver. The hardware prompted the person to create the MOK.

Then Mint did not like what was happening at all, and I got repeated problems with error messages saying the video driver did not load correctly.

You are running Cinnamon. Cinnamon checks for hardware acceleration, so it is common to get a message indicating one is running without hardware acceleration and to check one's video drivers. Does that sound like the message you saw? I am not aware of a message which tells someone the video driver did not load correctly (but I learn of new stuff all the time so maybe there is one).

This post [SOLVED] NVIDIA driver failing sometimes on boot ("no hardware acceleration") has a solution for the "now hardware acceleration/check your video drivers" message. It's a very common issue, especially with the most recent Nvidia drivers.

The day before yesterday the Update Manager would no longer update and gave me the same error messages.

From time to time, I've seen others who post the error messages you posted (below).

Code: Select all

E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem.
E: _cache->open() failed, please report.

and they were not having video driver issues. Following the instruction in the message "run 'dpkg --configure -a' to correct the problem" usually clears the issue.

This is the command line that fixed it. I tried this command myself but Mint demanded my super user password, which I gave it but it told me it was incorrect! This line circumvented that problem for some reason:

sudo dpkg --configure -a

I'm not sure what you mean by a super user password, because the last line of this quote requires you to type in your admin password before it will run. The sudo command means you want to use a higher level of authority to execute the statement, and that higher level of authority requires you to give the password. For reference, here is the topic [SOLVED] Can't Install Updates. That is not a new version of the Nvidia driver, so I do not know why you received an error message about installing it unless the modules did not rebuild properly when you installed the new kernel. Usually, just rebooting again clears the issue.

Nvidia modules must be rebuilt any time a new kernel is installed or a new Nvidia driver version is installed. When you switch from 5.11.0-36 to 5.11.0-37, that is a new kernel. I am specifically emphasizing this point because when Nvidia modules have to be rebuilt, you will need to make sure they have the proper MOK "password" enrolled if you have Secure Boot enabled or else the Nvidia modules will not load.

Even now in Driver Manager it offers Nvidia driver 460 and 470. It Recommends the latter but won't install it. It just gives me the same error message it gave me earlier. So what actually is the problem with Nvidia drivers that they are so fussy? Is it this signature business?

The "signature business" is related to Secure Boot. Unless you currently have Secure Boot turned on, then the issue you are seeing has absolutely nothing to do with the "signature business".

So let's go back to the error message you received and I will break down what it means.

Code: Select all

E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem.

• E = Error
• dpkg was interrupted = The downloading of the packages was interrupted so everything did not download properly. That can happen with any package. If there are missing parts, do you really want Mint to install it with missing parts? Or would you rather get an error message telling you something isn't quite right? Developers assume you want the latter.
• you must manually run 'dpkg --configure -a' to correct the problem = Open a terminal and type dpkg --configure -a which is a way to "fix" packages to make sure all the missing parts are downloaded and available and then the install moves forward.

This post is already quite long, so I will stop here to see if you have any questions before moving on to discuss what happened when you turned on Secure Boot to install Windows 11.

[Todd Sauve]

How do you like the Tuf? I have the F15. The keyboard is the only thing I would change. The backlit keyboard is difficult to read when not backlit. My previous notebook had both backlit and really good contrast when not backlit. There is enough room for a decent keyboard layout but they used a small keyboard and left a huge empty boarder. No separate page up, down, or end.

I generally like Asus gear. It is usually pretty good quality, especially their motherboards. The Tuf basically has everything a person could want, except a BIOS reset button. If you get down to the point where you must reset the BIOS manually, you have to get in there and short a pair of jumpers with a screwdriver. Also, like every X570 board the chipset has a small fan cooling it and I just have to wonder how long it will be until the fans start making noise on everyone's boards? I had a board back in the 2000s where they used a fan for the same purpose and two years after I bought it the fan started to making itself known. Rather annoying and replacing the fan didn't seem possible. So, hopefully it will last without problems ...

I also have an Asus notebook with an i3 from back in 2014 and it has never given me any problems. I suppose they like to cut corners where they can and it is too bad they skimped on the keyboard on your laptop. But I bet it will last a good long time for you.

[Todd Sauve]

SMG, thank you for your reply. It must take a long time to help people with these odd sort of problems we have with Mint, and I appreciate your help!

The only thing I would use Secure Boot for is if I move up to Windows 11, which requires it. I am currently going to stick with Win 10 because having tried Win 11 TWICE NOW (a month apart) I have found it to be an absolute bug-fest and not ready for prime time at all!

The screenshot you referred to doesn't look like the message I received. Mine seemed similar to a DOS screenshot and could not be dismissed with a mouse click. It had to use the keyboard to find and click the OK button. I can't remember if it showed up before I had to reboot or after. That's all I can remember about it.

Yes, the error message told me I was running without hardware acceleration and to check Driver Manager. Which I did and it would either tell me it had the proper Nvidia driver loaded or it wouldn't open Driver Manager at all. It would just present that spinning circle as it tried to open it, and the spinning circle was circling much faster than normal and took much longer to finally open. On occasion it just wouldn't open at all but would spin at fast speeds until I stopped it and gave up.

The error message from Update Manager looked exactly like the one that said the driver hadn't loaded. The command line that Petermint gave me cleared up everything. This is what he gave me and it worked perfectly. sudo dpkg --configure -a

It seems to me that the Secure Boot setting in the BIOS set this whole ball of wax in motion, and wouldn't go away until I used the command line above. I am not expert with command lines and using it without the sudo at the start is what prompted the Super User password prompt. But why it kept telling me my password was wrong is a mystery. That left me with a gimped Mint install for about a month, so I will be careful about installing new Nvidia drivers in the future.

I downloaded the 470 driver from Nvidia itself and installed it but that had no effect on Mint not loading the hardware accelerated driver error message. My installation of the 470 driver from Nvidia may be the root of these problems and maybe if it gets uninstalled Mint will be happy again? I just don't know. And as I say, Mint will still not install the 470 driver from Driver Manager and gives me the "hardware accelerated driver did not install correctly and check Driver Manager" error when I reboot. I feel like I'm chasing my tail in circles when it does this.

Is there a command line that will uninstall the 470 driver and make the kernel rebuild it? Or is this just too weird to understand what is going on in the background of the OS?

As I said, the 460 driver works just dandy and I don't want to mess with it now unless a pro like you can sort of hand hold me through the process.

Yes, this has been a long session, so I don't want to take up more of your time now that Mint is working properly. Thank you so much for taking the time to explain what Mint has been doing with Secure Boot and the various error messages. Update manager is working fine now, as well.

Is the best idea to move to the open source Nvidia driver before I activate Secure Boot and try to run Windows 11 again?

[SMG]

The screenshot you referred to doesn't look like the message I received. Mine seemed similar to a DOS screenshot and could not be dismissed with a mouse click. It had to use the keyboard to find and click the OK button. I can't remember if it showed up before I had to reboot or after. That's all I can remember about it.

That sounds like it might have been a message from your firmware rather than from the operating system.

Yes, the error message told me I was running without hardware acceleration and to check Driver Manager. Which I did and it would either tell me it had the proper Nvidia driver loaded or it wouldn't open Driver Manager at all. It would just present that spinning circle as it tried to open it, and the spinning circle was circling much faster than normal and took much longer to finally open. On occasion it just wouldn't open at all but would spin at fast speeds until I stopped it and gave up.

Driver Manager needs internet access and must connect to an external database to get the information it gives you. Sometimes there seem to be issues with that database connection.

I downloaded the 470 driver from Nvidia itself and installed it but that had no effect on Mint not loading the hardware accelerated driver error message. My installation of the 470 driver from Nvidia may be the root of these problems and maybe if it gets uninstalled Mint will be happy again?

That is entirely possible. We do not recommend downloading from the Nvidia website and even Nvidia's release notes recommend getting the driver from one's package management system instead of downloading it from their website.

If that driver from the website had been installed properly, you should not have gotten the lack of hardware acceleration message. If you then attempted to additionally install the driver from Driver Manager then that could create problems. However, it is possible the driver from the website never installed so conflict between the two drivers may not be happening.

Unless things have recently changed (and they might have), if you install a driver from the Nvidia website, Driver Manager will not show that driver is installed. Running inxi -Gx will let you know what driver is installed.

Is there a command line that will uninstall the 470 driver and make the kernel rebuild it?

Installing the driver and then having the driver modules build are two separate events and both must happen for the driver to be used.

Yes, there is a command to uninstall the 470 driver. However, if the driver is not installed, then the kernel can not rebuild drivers. And you can only have one driver installed and in use at a time.

Is the best idea to move to the open source Nvidia driver before I activate Secure Boot and try to run Windows 11 again?

I suppose that could be an option to try. I honestly do not know at this point what might be best. Windows 11 is new enough there has not been much feedback as to what might be the best way to handle that situation. (Windows 11 is still figuring out how to work!)

[Todd Sauve]

Thank you for your reply and help SMG!

I think I understand Mint a little better now. And it is working properly as long as I don't change video drivers. So I ain't gonna!

For now I think it is better to just let sleeping dogs lie.

I'll confront this again once Windows 11 matures a bit, like in maybe six months time!

Ha, ha!

[Petermint]

once Windows 11 matures a bit

Will be some time after they release Windows 12. (Windows 12 will require Secure Boot as a neural implant!)