error: Host injected malicious signal 2

[thempp66]

from diffusers import DiffusionPipeline

pipeline = DiffusionPipeline.from_pretrained("fluently/Fluently-XL-v2")
pipeline.load_lora_weights("ehristoforu/dalle-3-xl-v2")

prompt = "An astronaut riding a green horse"
start_time = time.time()
images = pipeline(prompt=prompt).images[0]
print("ehristoforu/dalle-3-xl-v2 timecost(ms) : ", (time.time() - start_time) * 1000)

# Copyright (C) 2023 Gramine contributors
# SPDX-License-Identifier: BSD-3-Clause

# Python3 manifest example

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "{{ entrypoint }}"

#loader.log_level = "{{ log_level }}"
loader.log_level = "all"

loader.env.LD_LIBRARY_PATH = "/lib:/lib:{{ arch_libdir }}:/usr/{{ arch_libdir }}"

# Python's NumPy spawns as many threads as there are CPU cores, and each thread
# consumes a chunk of memory, so on large machines 1G enclave size may be not enough.
# We limit the number of spawned threads via OMP_NUM_THREADS env variable.
loader.env.OMP_NUM_THREADS = "4"

loader.env.PATH= "/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
loader.env.https_proxy= "http://10.100.117.28:1080"
loader.env.http_proxy= "http://10.100.117.28:1080"
loader.env.HF_HOME="/root/.cache/huggingface/"
loader.env.HOME= "/root"

loader.insecure__use_cmdline_argv = true

sys.enable_sigterm_injection = true
sys.experimental__enable_flock = true

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr/{{ arch_libdir }}", uri = "file:/usr/{{ arch_libdir }}" },
{% for path in python.get_sys_path(entrypoint) %}
  { path = "{{ path }}", uri = "file:{{ path }}" },
{% endfor %}
  { path = "{{ entrypoint }}", uri = "file:{{ entrypoint }}" },
  { path = "/etc/hosts", uri = "file:helper-files/hosts" },

  { path = "/usr/local/lib/python3.8/dist-packages/concrete_python.libs" , uri = "file:/usr/local/lib/python3.8/dist-packages/concrete_python.libs" },
  { path = "/bin" , uri = "file:/bin" },
  { path = "/usr/local/lib/python3.8" , uri = "file:/usr/local/lib/python3.8" },
  { path = "/usr/lib/python3.8" , uri = "file:/usr/lib/python3.8" },
  { path = "/usr/lib/python3" , uri = "file:/usr/lib/python3" },
  { path = "/usr/lib/python3" , uri = "file:/usr/lib/python3" },
  { path = "/tmp", uri = "file:/tmp" },
  { type = "tmpfs", path = "/dev/shm" },
  { path = "/root/.cache/huggingface/", uri = "file:/root/.cache/huggingface/" },
  { path = "/root/.config/matplotlib", uri = "file:/root/.config/matplotlib" },
  { path = "/root/.cache/matplotlib", uri = "file:/root/.cache/matplotlib" }
  
]

sys.stack.size = "2M"
sys.enable_extra_runtime_domain_names_conf = true

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.enclave_size = "32G"
#sgx.max_threads = {{ '1' if env.get('EDMM', '0') == '1' else '32' }}
sgx.max_threads = 256

sgx.remote_attestation = "{{ ra_type }}"
sgx.ra_client_spid = "{{ ra_client_spid }}"
sgx.ra_client_linkable = {{ 'true' if ra_client_linkable == '1' else 'false' }}

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ entrypoint }}",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:/usr/{{ arch_libdir }}/",
{% for path in python.get_sys_path(entrypoint) %}
  "file:{{ path }}{{ '/' if path.is_dir() else '' }}",
{% endfor %}
  "file:scripts/",
  "file:helper-files/",
  "file:/bin/"
]

sgx.allowed_files = [
  "file:test.onnx",
  "file:.artifacts/",
  "file:/usr/local/lib/python3.8/dist-packages/concrete_python.libs",
  "file:/usr/local/lib/python3.8/",
  "file:/usr/lib/python3.8/",
  "file:/usr/lib/python3/",
  "file:/tmp/",
  "file:/root/.cache/huggingface/",
  "file:zidane.jpg",
  "file:/root/.config/matplotlib",
  "file:/root/.cache/matplotlib"
]

When I was doing my experiment and found the error error: Host injected malicious signal 2. Is there any solution to solved the error? Looking forward to anyone's reply. Thanks!

log.zip

[kailun-qin]

Hi @thempp66!

Have you tried adding sgx.use_exinfo = true or sgx.insecure__allow_memfaults_without_exinfo = true in the manifest? Pls see https://gramine.readthedocs.io/en/stable/manifest-syntax.html#sgx-exinfo for details.