illegal instruction on arm

[gabor-lbl]

to reproduce. run this on an arm machine (eg. M4 mac):

docker run -ti python:3.14 /bin/bash
pip install cryptography
python -c "import cryptography.hazmat.bindings._rust"

Here is the output:

# uname -a
Linux bdbdf3618a2c 6.12.5-linuxkit #1 SMP Tue Jan 21 10:23:32 UTC 2025 aarch64 GNU/Linux

# pip show cryptography
Name: cryptography
Version: 47.0.0
Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers.
Home-page: https://github.com/pyca/cryptography
Author:
Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>
License-Expression: Apache-2.0 OR BSD-3-Clause
Location: /usr/local/lib/python3.14/site-packages
Requires: cffi
Required-by:

# python -c "import cryptography.hazmat.bindings._rust"
Illegal instruction

Thank you!

[alex]

I'm not able to reproduce on an M1 Max:

~/p/rust-asn1 ❯❯❯ container run --rm -it python:3.14 /bin/bash
root@16fb3f4c-8b48-4307-b692-ad78f849d73a:/# pip install cryptography
python -c "import cryptography.hazmat.bindings._rust"
Collecting cryptography
  Downloading cryptography-47.0.0-cp311-abi3-manylinux_2_34_aarch64.whl.metadata (4.5 kB)
Collecting cffi>=2.0.0 (from cryptography)
  Downloading cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl.metadata (2.6 kB)
Collecting pycparser (from cffi>=2.0.0->cryptography)
  Downloading pycparser-3.0-py3-none-any.whl.metadata (8.2 kB)
Downloading cryptography-47.0.0-cp311-abi3-manylinux_2_34_aarch64.whl (4.7 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4.7/4.7 MB 7.9 MB/s  0:00:00
Downloading cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl (220 kB)
Downloading pycparser-3.0-py3-none-any.whl (48 kB)
Installing collected packages: pycparser, cffi, cryptography
Successfully installed cffi-2.0.0 cryptography-47.0.0 pycparser-3.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
root@16fb3f4c-8b48-4307-b692-ad78f849d73a:/# python -c "import cryptography.hazmat.bindings._rust"
root@16fb3f4c-8b48-4307-b692-ad78f849d73a:/# 

[alex]

Can you provide the full output from the pip install command?

[gabor-lbl]

# pip install cryptography
Collecting cryptography
  Downloading cryptography-47.0.0-cp311-abi3-manylinux_2_34_aarch64.whl.metadata (4.5 kB)
Collecting cffi>=2.0.0 (from cryptography)
  Downloading cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl.metadata (2.6 kB)
Collecting pycparser (from cffi>=2.0.0->cryptography)
  Downloading pycparser-3.0-py3-none-any.whl.metadata (8.2 kB)
Downloading cryptography-47.0.0-cp311-abi3-manylinux_2_34_aarch64.whl (4.7 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 4.7/4.7 MB 98.1 MB/s  0:00:00
Downloading cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl (220 kB)
Downloading pycparser-3.0-py3-none-any.whl (48 kB)
Installing collected packages: pycparser, cffi, cryptography
Successfully installed cffi-2.0.0 cryptography-47.0.0 pycparser-3.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
root@b3364ecad859:/# python -c "import cryptography.hazmat.bindings._rust"
Illegal instruction

[reaperhulk]

I also can't reproduce on an M5 Max or an M3 Pro. However, I'm not using official Docker (just like Alex I'm using Apple's container).

Does this problem occur for you on <47?

[gabor-lbl]

I'm able to run version 46.0.7

[gabor-lbl]

I've never heard of container. version 47 does run in container but not in docker. Thanks!

[gabor-lbl]

It also works in colima so I think I'm switching to that instead of docker-desktop.

[alex]

How fun! Current best theory is "docker has a bug related to exposing ARM CPU features". I suppose plausibly "docker correctly exposes some CPU features and therefore hits this bug".

Can you capture which instruction we're SIGILLing at? running under gdb should do it

[gabor-lbl]

gdb --args python3 -c "import cryptography.hazmat.bindings._rust"

GNU gdb (Debian 16.3-1) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from python3...
(gdb) run
Starting program: /usr/local/bin/python3 -c import\ cryptography.hazmat.bindings._rust
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".

Program received signal SIGILL, Illegal instruction.
0x0000fffff6e67d98 in _armv8_sve_get_vl_bytes () from /usr/local/lib/python3.14/site-packages/cryptography/hazmat/bindings/_rust.abi3.so
(gdb)

[alex]

x/i $pc should get you the instruction, I think.

[gabor-lbl]

(gdb) x/i $pc
=> 0xfffff6e67d98 <_armv8_sve_get_vl_bytes>:	cntb	x0

[alex]

Can you run bt?

[alex]

Also cat /proc/cpuinfo | grep -i sve in the VM?

[gabor-lbl]

(gdb) bt
#0  0x0000fffff6e67d98 in _armv8_sve_get_vl_bytes () from /usr/local/lib/python3.14/site-packages/cryptography/hazmat/bindings/_rust.abi3.so
#1  0x0000fffff6a7fe68 in OPENSSL_cpuid_setup () from /usr/local/lib/python3.14/site-packages/cryptography/hazmat/bindings/_rust.abi3.so
#2  0x0000fffff7fc2a6c in ?? () from /lib/ld-linux-aarch64.so.1
#3  0x0000fffff7fc2b80 [PAC] in ?? () from /lib/ld-linux-aarch64.so.1
#4  0x0000fffff7fbf2bc [PAC] in _dl_catch_exception () from /lib/ld-linux-aarch64.so.1
#5  0x0000fffff7fc8af4 [PAC] in ?? () from /lib/ld-linux-aarch64.so.1
#6  0x0000fffff7fbf244 [PAC] in _dl_catch_exception () from /lib/ld-linux-aarch64.so.1
#7  0x0000fffff7fc8ebc [PAC] in ?? () from /lib/ld-linux-aarch64.so.1
#8  0x0000fffff78720c8 [PAC] in ?? () from /lib/aarch64-linux-gnu/libc.so.6
#9  0x0000fffff7fbf244 [PAC] in _dl_catch_exception () from /lib/ld-linux-aarch64.so.1
#10 0x0000fffff7fbf370 [PAC] in ?? () from /lib/ld-linux-aarch64.so.1
#11 0x0000fffff7871ae0 [PAC] in ?? () from /lib/aarch64-linux-gnu/libc.so.6
#12 0x0000fffff78721c0 [PAC] in dlopen () from /lib/aarch64-linux-gnu/libc.so.6
#13 0x0000fffff7c04c48 [PAC] in _PyImport_FindSharedFuncptr (prefix=0xfffff7cd5508 "PyInit", shortname=0xfffff7553ad0 "_rust",
    pathname=0xfffff74c37d0 "/usr/local/lib/python3.14/site-packages/cryptography/hazmat/bindings/_rust.abi3.so", fp=<optimized out>) at ./Python/dynload_shlib.c:82
#14 _PyImport_GetModInitFunc (info=0xffffffffe9d8, fp=<optimized out>) at ./Python/importdl.c:391
#15 _imp_create_dynamic_impl (module=<optimized out>,
    spec=<ModuleSpec(_cached=None, _set_fileattr=True, _uninitialized_submodules=[], loader=<ExtensionFileLoader(name='cryptography.hazmat.bindings._rust', path='/usr/local/lib/python3.14/site-packages/cryptography/hazmat/bindings/_rust.abi3.so') at remote 0xfffff7511400>, loader_state=None, name='cryptography.hazmat.bindings._rust', origin='/usr/local/lib/python3.14/site-packages/cryptography/hazmat/bindings/_rust.abi3.so', submodule_search_locations=None) at remote 0xfffff7382df0>, file=0x0) at Python/import.c:4796
#16 _imp_create_dynamic (module=<optimized out>, args=<optimized out>, nargs=<optimized out>) at Python/clinic/import.c.h:488
#17 0x0000fffff7ae07f0 [PAC] in PyObject_Call (callable=<optimized out>, args=<optimized out>, kwargs=<optimized out>) at Objects/call.c:373
#18 PyCFunction_Call (callable=<optimized out>, args=<optimized out>, kwargs=<optimized out>) at Objects/call.c:381
#19 _PyEval_EvalFrameDefault (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, frame=0xfffff7fe7398, throwflag=97) at Python/generated_cases.c.h:2656
#20 0x0000fffff7ad9ebc [PAC] in _PyEval_EvalFrame (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, frame=<optimized out>, throwflag=0) at ./Include/internal/pycore_ceval.h:120
#21 _PyEval_Vector (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, func=<optimized out>, locals=0x0, args=<optimized out>, argcount=2, kwnames=0x0) at Python/ceval.c:2110
#22 0x0000fffff7afeca0 [PAC] in _PyObject_VectorcallTstate (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, callable=<function at remote 0xfffff7673d70>, args=0xfffffffff110, nargsf=2,
    kwnames=0x0) at ./Include/internal/pycore_call.h:177
#23 object_vacall (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, base=<optimized out>, callable=<function at remote 0xfffff7673d70>, vargs=...) at Objects/call.c:820
#24 0x0000fffff7b30170 [PAC] in PyObject_CallMethodObjArgs (obj=<optimized out>, name=<optimized out>) at Objects/call.c:957
--Type <RET> for more, q to quit, c to continue without paging--
#25 0x0000fffff7bc7f74 [PAC] in import_find_and_load (tstate=tstate@entry=0xfffff7f3b5e0 <_PyRuntime+315672>, abs_name=abs_name@entry='cryptography.hazmat.bindings._rust')
    at Python/import.c:3772
#26 0x0000fffff7b2ed80 [PAC] in PyImport_ImportModuleLevelObject (name=name@entry='cryptography.hazmat.bindings._rust', globals=<optimized out>,
    locals=locals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>}, fromlist=fromlist@entry=None, level=0) at Python/import.c:3875
#27 0x0000fffff7ba2230 [PAC] in _PyEval_ImportName (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, frame=0xfffff7fe7020, name='cryptography.hazmat.bindings._rust', fromlist=None, level=0)
    at Python/ceval.c:3139
#28 0x0000fffff7ae3a48 [PAC] in _PyEval_EvalFrameDefault (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, frame=0xfffff7fe7020, throwflag=97) at ./Include/internal/pycore_stackref.h:521
#29 0x0000fffff7ad9ebc [PAC] in _PyEval_EvalFrame (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, frame=<optimized out>, throwflag=0) at ./Include/internal/pycore_ceval.h:120
#30 _PyEval_Vector (tstate=0xfffff7f3b5e0 <_PyRuntime+315672>, func=<optimized out>,
    locals={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>}, args=<optimized out>, argcount=0, kwnames=0x0) at Python/ceval.c:2110
#31 0x0000fffff7ba0e54 [PAC] in PyEval_EvalCode (co=<code at remote 0xfffff74bc570>, globals=<optimized out>,
    locals={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>}) at Python/ceval.c:982
#32 0x0000fffff7c04520 [PAC] in run_mod (mod=<optimized out>, filename=<optimized out>,
    globals={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>}, locals={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>},
    flags=<optimized out>, arena=<optimized out>, interactive_src=<optimized out>, generate_new_source=<optimized out>) at Python/pythonrun.c:1460
#33 0x0000fffff7bfc5d4 [PAC] in _PyRun_StringFlagsWithName.constprop.0 (str=str@entry=0xfffff74ad9a0 "import cryptography.hazmat.bindings._rust\n", name=name@entry='<string>',
    start=start@entry=257,
    globals=globals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>},
    locals=locals@entry={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <type at remote 0xaaaaaaaff880>, '__spec__': None, '__builtins__': <module at remote 0xfffff768b830>}, flags=flags@entry=0xfffffffff9d0, generate_new_source=0) at Python/pythonrun.c:1260
#34 0x0000fffff7bfc470 [PAC] in _PyRun_SimpleStringFlagsWithName (command=0xfffff74ad9a0 "import cryptography.hazmat.bindings._rust\n", name=<optimized out>, flags=0xfffffffff9d0)
    at Python/pythonrun.c:578
#35 0x0000fffff7b8e900 [PAC] in pymain_run_command (command=<optimized out>) at Modules/main.c:261
#36 pymain_run_python (exitcode=0xfffffffff9c4) at Modules/main.c:686
#37 Py_RunMain () at Modules/main.c:776
--Type <RET> for more, q to quit, c to continue without paging--
#38 0x0000fffff7b85864 [PAC] in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:830
#39 0x0000fffff781225c [PAC] in ?? () from /lib/aarch64-linux-gnu/libc.so.6
#40 0x0000fffff781233c [PAC] in __libc_start_main () from /lib/aarch64-linux-gnu/libc.so.6
#41 0x0000aaaaaaaa0930 [PAC] in _start ()
(gdb)

[gabor-lbl]

# cat /proc/cpuinfo | grep -i sve
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 asimddp sha512 asimdfhm dit uscat ilrcpc flagm sb paca pacg dcpodp sve2 flagm2 frint svei8mm svebf16 bf16 afp