I would like to call something like nanosleep from assembly, using only SVC calls. But it is not obvious how to do it using only the limited information I have, this list of macos syscall call signatures: https://opensource.apple.com/source/xnu/xnu-1504.3.12/bsd/kern/syscalls.master
I tried to figure out what C does when calling nanosleep and I was able to reduce it to this:
struct timespec { long tv_sec; long tv_nsec; };
int nanosleep(const struct timespec *__rqtp, struct timespec *__rmtp)
__asm("_" "nanosleep" );
int main() {
struct timespec remaining, request = { 3, 1 };
int response = nanosleep(&request, &remaining); }
I am not sure what that __asm does as that does not look like assembly. Anyway I found an implementation of nanosleep in Apples libc source code. It relies on a call to clock_get_time though and that isn't defined in libc. I found a mention of clock_get_time in the XNU source code, but this is in a .defs file, which I don't know what is and it doesn't seem have an implementation.
In any case, is there some better documentation on the SVC calls, or some place I can find the assembly for the libc SVC implementation?
Any information or ideas are much appreciated.
CodePudding user response：
First off, let's get the title of your question out of the way. The way you call nanosleep from assembly is like this:
mov x8, 3
stp x8, xzr, [sp, -0x10]! // 3 seconds, 0 nanoseconds
mov x0, sp
mov x1, 0
bl _nanosleep
add sp, sp, 0x10
You just use the libc implementation. For most purposes, you really shouldn't go to a deeper level, since a) on arm64 you're forced by the OS to link against libSystem (and thus libc) anyway, and b) because the Darwin kernel ABI(s) are not stable.
That said, let's look at how it works under the hood.
In the latest Libc source drop, we find that there's actually two implementations of nanosleep in gen/nanosleep.c: one for #if __DARWIN_UNIX03, which uses clock_get_time, and one for the other case, which uses mach_absolute_time and mach_wait_until. The one actually used in production is the former:
int nanosleep(const struct timespec *requested_time, struct timespec *remaining_time) {
kern_return_t kret;
int ret;
mach_timespec_t current;
mach_timespec_t completion;
if (__unix_conforming == 0)
__unix_conforming = 1;
#ifdef VARIANT_CANCELABLE
pthread_testcancel();
#endif /* VARIANT_CANCELABLE */
if ((requested_time == NULL) || (requested_time->tv_sec < 0) || (requested_time->tv_nsec >= NSEC_PER_SEC)) {
errno = EINVAL;
return -1;
}
if (remaining_time != NULL) {
/* once we add requested_time, this will be the completion time */
kret = clock_get_time(clock_port, &completion);
if (kret != KERN_SUCCESS) {
fprintf(stderr, "clock_get_time() failed: %s\n", mach_error_string(kret));
errno = EINVAL;
return -1;
}
}
ret = SEMWAIT_SIGNAL(clock_sem, MACH_PORT_NULL, 1, 1, (int64_t)requested_time->tv_sec, (int32_t)requested_time->tv_nsec);
if (ret < 0) {
if (errno == ETIMEDOUT) {
return 0;
} else if (errno == EINTR) {
if (remaining_time != NULL) {
ret = clock_get_time(clock_port, ¤t);
if (ret != KERN_SUCCESS) {
fprintf(stderr, "clock_get_time() failed: %s\n", mach_error_string(ret));
return -1;
}
/* This depends on the layout of a mach_timespec_t and timespec_t being equivalent */
ADD_MACH_TIMESPEC(&completion, requested_time);
/* We have to compare first, since mach_timespect_t contains unsigned integers */
if(CMP_MACH_TIMESPEC(&completion, ¤t) > 0) {
SUB_MACH_TIMESPEC(&completion, ¤t);
remaining_time->tv_sec = completion.tv_sec;
remaining_time->tv_nsec = completion.tv_nsec;
} else {
bzero(remaining_time, sizeof(*remaining_time));
}
}
} else {
errno = EINVAL;
}
}
return -1;
}
This ends up in /usr/lib/system/libsystem_c.dylib (re-exported by /usr/lib/libSystem.B.dylib). We can look at the assembly by either using dlopen/dlsym to dump the bytes, extracting the dylib from the dyld_shared_cache, or grabbing it from the ramdisk:
;-- _nanosleep:
0x0000e4d4 7f2303d5 pacibsp
0x0000e4d8 ff0301d1 sub sp, sp, 0x40
0x0000e4dc f44f02a9 stp x20, x19, [sp, 0x20]
0x0000e4e0 fd7b03a9 stp x29, x30, [sp, 0x30]
0x0000e4e4 fdc30091 add x29, sp, 0x30
0x0000e4e8 f30301aa mov x19, x1
0x0000e4ec f40300aa mov x20, x0
0x0000e4f0 ff7f01a9 stp xzr, xzr, [sp, 0x10]
0x0000e4f4 a80300d0 adrp x8, reloc.__unix_conforming
0x0000e4f8 080140f9 ldr x8, [x8]
0x0000e4fc 090140b9 ldr w9, [x8]
0x0000e500 69000035 cbnz w9, 0xe50c
0x0000e504 29008052 mov w9, 1
0x0000e508 090100b9 str w9, [x8]
0x0000e50c e5b00194 bl sym.imp.pthread_testcancel
0x0000e510 140300b4 cbz x20, 0xe570
0x0000e514 840240f9 ldr x4, [x20]
0x0000e518 c402f8b7 tbnz x4, 0x3f, 0xe570
0x0000e51c 850640f9 ldr x5, [x20, 8]
0x0000e520 08409952 mov w8, 0xca00
0x0000e524 4873a772 movk w8, 0x3b9a, lsl 16
0x0000e528 bf0008eb cmp x5, x8
0x0000e52c 22020054 b.hs 0xe570
0x0000e530 330300b4 cbz x19, 0xe594
0x0000e534 48040090 adrp x8, 0x96000
0x0000e538 08112c91 add x8, x8, 0xb04
0x0000e53c 000140b9 ldr w0, [x8]
0x0000e540 e1430091 add x1, sp, 0x10
0x0000e544 c7ae0194 bl sym.imp.clock_get_time
0x0000e548 40020034 cbz w0, 0xe590
0x0000e54c 080400d0 adrp x8, sym._gCRAnnotations
0x0000e550 08210f91 add x8, x8, 0x3c8
0x0000e554 130140f9 ldr x19, [x8]
0x0000e558 c2af0194 bl sym.imp.mach_error_string
0x0000e55c e00300f9 str x0, [sp]
0x0000e560 610300f0 adrp x1, 0x7d000
0x0000e564 21682b91 add x1, x1, 0xada
0x0000e568 e00313aa mov x0, x19
0x0000e56c 73100094 bl sym._fprintf
0x0000e570 84ad0194 bl sym.imp.__error
0x0000e574 c8028052 mov w8, 0x16
0x0000e578 080000b9 str w8, [x0]
0x0000e57c 00008012 mov w0, -1
0x0000e580 fd7b43a9 ldp x29, x30, [sp, 0x30]
0x0000e584 f44f42a9 ldp x20, x19, [sp, 0x20]
0x0000e588 ff030191 add sp, sp, 0x40
0x0000e58c ff0f5fd6 retab
0x0000e590 841640a9 ldp x4, x5, [x20]
0x0000e594 48040090 adrp x8, 0x96000
0x0000e598 08012c91 add x8, x8, 0xb00
0x0000e59c 000140b9 ldr w0, [x8]
0x0000e5a0 01008052 mov w1, 0
0x0000e5a4 22008052 mov w2, 1
0x0000e5a8 23008052 mov w3, 1
0x0000e5ac d1ad0194 bl sym.imp.__semwait_signal
0x0000e5b0 60feff36 tbz w0, 0x1f, 0xe57c
0x0000e5b4 73ad0194 bl sym.imp.__error
0x0000e5b8 080040b9 ldr w8, [x0]
0x0000e5bc 1ff10071 cmp w8, 0x3c
0x0000e5c0 61000054 b.ne 0xe5cc
0x0000e5c4 00008052 mov w0, 0
0x0000e5c8 eeffff17 b 0xe580
0x0000e5cc 6dad0194 bl sym.imp.__error
0x0000e5d0 080040b9 ldr w8, [x0]
0x0000e5d4 1f110071 cmp w8, 4
0x0000e5d8 c1fcff54 b.ne 0xe570
0x0000e5dc 13fdffb4 cbz x19, 0xe57c
0x0000e5e0 48040090 adrp x8, 0x96000
0x0000e5e4 08112c91 add x8, x8, 0xb04
0x0000e5e8 000140b9 ldr w0, [x8]
0x0000e5ec e1630091 add x1, sp, 0x18
0x0000e5f0 9cae0194 bl sym.imp.clock_get_time
0x0000e5f4 60010034 cbz w0, 0xe620
0x0000e5f8 080400d0 adrp x8, sym._gCRAnnotations
0x0000e5fc 08210f91 add x8, x8, 0x3c8
0x0000e600 130140f9 ldr x19, [x8]
0x0000e604 97af0194 bl sym.imp.mach_error_string
0x0000e608 e00300f9 str x0, [sp]
0x0000e60c 610300f0 adrp x1, 0x7d000
0x0000e610 21682b91 add x1, x1, 0xada
0x0000e614 e00313aa mov x0, x19
0x0000e618 48100094 bl sym._fprintf
0x0000e61c d8ffff17 b 0xe57c
0x0000e620 ea3f9952 mov w10, 0xc9ff
0x0000e624 4a73a772 movk w10, 0x3b9a, lsl 16
0x0000e628 880a40b9 ldr w8, [x20, 8]
0x0000e62c ec274229 ldp w12, w9, [sp, 0x10]
0x0000e630 0bc08652 mov w11, 0x3600
0x0000e634 ab8cb872 movk w11, 0xc465, lsl 16
0x0000e638 2801080b add w8, w9, w8
0x0000e63c 09010b0b add w9, w8, w11
0x0000e640 1f010a6b cmp w8, w10
0x0000e644 2bc1881a csel w11, w9, w8, gt
0x0000e648 89d58c1a cinc w9, w12, gt
0x0000e64c 8c0240b9 ldr w12, [x20]
0x0000e650 e81b40b9 ldr w8, [sp, 0x18]
0x0000e654 29010c0b add w9, w9, w12
0x0000e658 3f01086b cmp w9, w8
0x0000e65c 69000054 b.ls 0xe668
0x0000e660 ec1f40b9 ldr w12, [sp, 0x1c]
0x0000e664 05000014 b 0xe678
0x0000e668 c3010054 b.lo 0xe6a0
0x0000e66c ec1f40b9 ldr w12, [sp, 0x1c]
0x0000e670 7f010c6b cmp w11, w12
0x0000e674 6d010054 b.le 0xe6a0
0x0000e678 6b010c6b subs w11, w11, w12
0x0000e67c a5000054 b.pl 0xe690
0x0000e680 4a010b0b add w10, w10, w11
0x0000e684 4b050011 add w11, w10, 1
0x0000e688 29050051 sub w9, w9, 1
0x0000e68c e92f0229 stp w9, w11, [sp, 0x10]
0x0000e690 2801084b sub w8, w9, w8
0x0000e694 697d4093 sxtw x9, w11
0x0000e698 682600a9 stp x8, x9, [x19]
0x0000e69c b8ffff17 b 0xe57c
0x0000e6a0 7f7e00a9 stp xzr, xzr, [x19]
0x0000e6a4 b6ffff17 b 0xe57c
I don't think this is something you really want to implement yourself.
But either way, you noticed that it uses clock_get_time, which is not defined in that library. Indeed clock_get_time is in /usr/lib/system/libsystem_kernel.dylib:
;-- _clock_get_time:
0x00006440 7f2303d5 pacibsp
0x00006444 ff8301d1 sub sp, sp, 0x60
0x00006448 f44f04a9 stp x20, x19, [sp, 0x40]
0x0000644c fd7b05a9 stp x29, x30, [sp, 0x50]
0x00006450 fd430191 add x29, sp, 0x50
0x00006454 f30301aa mov x19, x1
0x00006458 f40300aa mov x20, x0
0x0000645c ff7f02a9 stp xzr, xzr, [sp, 0x20]
0x00006460 ff3b00b9 str wzr, [sp, 0x38]
0x00006464 ff1b00f9 str xzr, [sp, 0x30]
0x00006468 f5eaff97 bl sym._mig_get_reply_port
0x0000646c 480100f0 adrp x8, 0x31000
0x00006470 008547fd ldr d0, [x8, 0xf08]
0x00006474 e00700fd str d0, [sp, 8]
0x00006478 f4030229 stp w20, w0, [sp, 0x10]
0x0000647c 480100f0 adrp x8, 0x31000
0x00006480 008947fd ldr d0, [x8, 0xf10]
0x00006484 e00f00fd str d0, [sp, 0x18]
0x00006488 057c60d3 lsl x5, x0, 0x20
0x0000648c e303142a mov w3, w20
0x00006490 037c60b3 bfi x3, x0, 0x20, 0x20
0x00006494 e0230091 add x0, sp, 8
0x00006498 610080d2 mov x1, 3
0x0000649c 4100c0f2 movk x1, 2, lsl 32
0x000064a0 62a282d2 mov x2, 0x1513
0x000064a4 0203c0f2 movk x2, 0x18, lsl 32
0x000064a8 047dc0d2 mov x4, 0x3e800000000
0x000064ac 86068052 mov w6, 0x34
0x000064b0 070080d2 mov x7, 0
0x000064b4 e8300094 bl sym._mach_msg2_internal
0x000064b8 f40300aa mov x20, x0
0x000064bc c8ff9f52 mov w8, 0xfffe
0x000064c0 e8ffbd72 movk w8, 0xefff, lsl 16
0x000064c4 0800080b add w8, w0, w8
0x000064c8 1f390071 cmp w8, 0xe
0x000064cc 29008052 mov w9, 1
0x000064d0 2821c81a lsl w8, w9, w8
0x000064d4 69008852 mov w9, 0x4003
0x000064d8 0801090a and w8, w8, w9
0x000064dc 0499407a ccmp w8, 0, 4, ls
0x000064e0 21040054 b.ne 0x6564
0x000064e4 94020035 cbnz w20, 0x6534
0x000064e8 e81f40b9 ldr w8, [sp, 0x1c]
0x000064ec 1f1d0171 cmp w8, 0x47
0x000064f0 80020054 b.eq 0x6540
0x000064f4 1f311171 cmp w8, 0x44c
0x000064f8 81020054 b.ne 0x6548
0x000064fc e80b40b9 ldr w8, [sp, 8]
0x00006500 c802f837 tbnz w8, 0x1f, 0x6558
0x00006504 e80f40b9 ldr w8, [sp, 0xc]
0x00006508 1fb10071 cmp w8, 0x2c
0x0000650c 20020054 b.eq 0x6550
0x00006510 1f910071 cmp w8, 0x24
0x00006514 21020054 b.ne 0x6558
0x00006518 e82b40b9 ldr w8, [sp, 0x28]
0x0000651c e91340b9 ldr w9, [sp, 0x10]
0x00006520 3f010071 cmp w9, 0
0x00006524 0409407a ccmp w8, 0, 4, eq
0x00006528 69258012 mov w9, -0x12c
0x0000652c 1411891a csel w20, w8, w9, ne
0x00006530 0b000014 b 0x655c
0x00006534 e01740b9 ldr w0, [sp, 0x14]
0x00006538 9bf6ff97 bl sym._mig_dealloc_reply_port
0x0000653c 0a000014 b 0x6564
0x00006540 74268012 mov w20, -0x134
0x00006544 06000014 b 0x655c
0x00006548 94258012 mov w20, -0x12d
0x0000654c 04000014 b 0x655c
0x00006550 e81340b9 ldr w8, [sp, 0x10]
0x00006554 28010034 cbz w8, 0x6578
0x00006558 74258012 mov w20, -0x12c
0x0000655c e0230091 add x0, sp, 8
0x00006560 9dedff97 bl sym._mach_msg_destroy
0x00006564 e00314aa mov x0, x20
0x00006568 fd7b45a9 ldp x29, x30, [sp, 0x50]
0x0000656c f44f44a9 ldp x20, x19, [sp, 0x40]
0x00006570 ff830191 add sp, sp, 0x60
0x00006574 ff0f5fd6 retab
0x00006578 f42b40b9 ldr w20, [sp, 0x28]
0x0000657c 14ffff35 cbnz w20, 0x655c
0x00006580 e8c342f8 ldur x8, [sp, 0x2c]
0x00006584 680200f9 str x8, [x19]
0x00006588 f7ffff17 b 0x6564
Again, likely something you wouldn't want to implement by yourself in assembly.
But where does this implementation come from? You already discovered that XNU only contains a .defs file. That file is a MIG (Mach Interface Generator) definitions file, which can be used to generate both client- and server-side code. To do that, you use the mig utility shipped with Xcode (also open source). For the clocks file, the invocation would look something like this:
mig -novouchers -DLIBSYSCALL_INTERFACE=1 -DPRIVATE=1 -DKERNEL_SERVER=1 -arch arm64e xnu-8792.61.2/osfmk/mach/clock.defs
That will generate a clock.h, clockServer.c and clockUser.c. We only care about the last one, as it contains the userland code for clock_get_time:
/* Routine clock_get_time */
mig_external kern_return_t clock_get_time
(
clock_serv_t clock_serv,
mach_timespec_t *cur_time
)
{
#ifdef __MigPackStructs
#pragma pack(push, 4)
#endif
typedef struct {
mach_msg_header_t Head;
} Request __attribute__((unused));
#ifdef __MigPackStructs
#pragma pack(pop)
#endif
#ifdef __MigPackStructs
#pragma pack(push, 4)
#endif
typedef struct {
mach_msg_header_t Head;
NDR_record_t NDR;
kern_return_t RetCode;
mach_timespec_t cur_time;
mach_msg_trailer_t trailer;
} Reply __attribute__((unused));
#ifdef __MigPackStructs
#pragma pack(pop)
#endif
#ifdef __MigPackStructs
#pragma pack(push, 4)
#endif
typedef struct {
mach_msg_header_t Head;
NDR_record_t NDR;
kern_return_t RetCode;
mach_timespec_t cur_time;
} __Reply __attribute__((unused));
#ifdef __MigPackStructs
#pragma pack(pop)
#endif
/*
* typedef struct {
* mach_msg_header_t Head;
* NDR_record_t NDR;
* kern_return_t RetCode;
* } mig_reply_error_t;
*/
union {
Request In;
Reply Out;
} Mess;
Request *InP = &Mess.In;
Reply *Out0P = &Mess.Out;
mach_msg_return_t msg_result;
#ifdef __MIG_check__Reply__clock_get_time_t__defined
kern_return_t check_result;
#endif /* __MIG_check__Reply__clock_get_time_t__defined */
__DeclareSendRpc(1000, "clock_get_time")
InP->Head.msgh_reply_port = mig_get_reply_port();
InP->Head.msgh_bits =
MACH_MSGH_BITS(19, MACH_MSG_TYPE_MAKE_SEND_ONCE);
InP->Head.msgh_size = (mach_msg_size_t)sizeof(Request);
InP->Head.msgh_request_port = clock_serv;
InP->Head.msgh_id = 1000;
InP->Head.msgh_reserved = 0;
__BeforeSendRpc(1000, "clock_get_time")
msg_result = mach_msg(&InP->Head, MACH_SEND_MSG|MACH_RCV_MSG|MACH_MSG_OPTION_NONE, (mach_msg_size_t)sizeof(Request), (mach_msg_size_t)sizeof(Reply), InP->Head.msgh_reply_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
__AfterSendRpc(1000, "clock_get_time")
if (msg_result != MACH_MSG_SUCCESS) {
__MachMsgErrorWithoutTimeout(msg_result);
}
if (msg_result != MACH_MSG_SUCCESS) {
{ return msg_result; }
}
#if defined(__MIG_check__Reply__clock_get_time_t__defined)
check_result = __MIG_check__Reply__clock_get_time_t((__Reply__clock_get_time_t *)Out0P);
if (check_result != MACH_MSG_SUCCESS) {
mach_msg_destroy(&Out0P->Head);
{ return check_result; }
}
#endif /* defined(__MIG_check__Reply__clock_get_time_t__defined) */
*cur_time = Out0P->cur_time;
return KERN_SUCCESS;
}
(I omitted __MIG_check__Reply__clock_get_time_t here, but it is generated in the same file, right above that function.)
One thing of note here is the call to mach_msg though. In the assembly, we can see mach_msg2_internal being invoked, but the generated code simply calls mach_msg. If you took that code as-is and tried to run it on macOS 13 or iOS 16, it would not work. The reasons for this tie deeply into the security internals of Darwin and into a mitigation shipped in the most recent major release of Apple OSes. If you're interested in the story behind that, Luca Todesco covered that in hix Hexacon presentation not long ago.
But by passing -DKERNEL_SERVER=1 to mig, we actually made it generate a little stub for us at the beginning of the file:
#include <TargetConditionals.h>
#if defined(MACH_SEND_AUX_TOO_SMALL) && (defined(__arm64__) || defined(__LP64__))
#undef mach_msg
#define mach_msg mig_mach_msg
static inline mach_msg_return_t
mig_mach_msg(
mach_msg_header_t *msg,
mach_msg_option_t option,
mach_msg_size_t send_size,
mach_msg_size_t rcv_size,
mach_port_name_t rcv_name,
mach_msg_timeout_t timeout,
mach_port_name_t notify)
{
(void)notify;
return mach_msg2(msg, option | MACH64_SEND_KOBJECT_CALL,
*msg, send_size, rcv_size, rcv_name, timeout, 0);
}
#endif
mach_msg2 isn't defined in the public SDK either (and is not a symbol in any library), but we can steal it together from osfmk/mach/message.h in XNU source:
typedef uint64_t mach_msg_option64_t;
#define MACH64_SEND_MSG MACH_SEND_MSG
#define MACH64_MSG_VECTOR 0x0000000100000000ull
#define MACH64_SEND_KOBJECT_CALL 0x0000000200000000ull
#if defined(__LP64__) || defined(__arm64__)
__API_AVAILABLE(macos(13.0), ios(16.0), tvos(16.0), watchos(9.0))
__IOS_PROHIBITED __WATCHOS_PROHIBITED __TVOS_PROHIBITED
extern mach_msg_return_t mach_msg2_internal(
void *data,
mach_msg_option64_t option64,
uint64_t msgh_bits_and_send_size,
uint64_t msgh_remote_and_local_port,
uint64_t msgh_voucher_and_id,
uint64_t desc_count_and_rcv_name,
uint64_t rcv_size_and_priority,
uint64_t timeout);
__API_AVAILABLE(macos(13.0), ios(16.0), tvos(16.0), watchos(9.0))
__IOS_PROHIBITED __WATCHOS_PROHIBITED __TVOS_PROHIBITED
static inline mach_msg_return_t
mach_msg2(
void *data,
mach_msg_option64_t option64,
mach_msg_header_t header,
mach_msg_size_t send_size,
mach_msg_size_t rcv_size,
mach_port_t rcv_name,
uint64_t timeout,
uint32_t priority)
{
mach_msg_base_t *base;
mach_msg_size_t descriptors;
if (option64 & MACH64_MSG_VECTOR) {
base = (mach_msg_base_t *)((mach_msg_vector_t *)data)->msgv_data;
} else {
base = (mach_msg_base_t *)data;
}
if ((option64 & MACH64_SEND_MSG) &&
(base->header.msgh_bits & MACH_MSGH_BITS_COMPLEX)) {
descriptors = base->body.msgh_descriptor_count;
} else {
descriptors = 0;
}
#define MACH_MSG2_SHIFT_ARGS(lo, hi) ((uint64_t)hi << 32 | (uint32_t)lo)
return mach_msg2_internal(data, option64,
MACH_MSG2_SHIFT_ARGS(header.msgh_bits, send_size),
MACH_MSG2_SHIFT_ARGS(header.msgh_remote_port, header.msgh_local_port),
MACH_MSG2_SHIFT_ARGS(header.msgh_voucher_port, header.msgh_id),
MACH_MSG2_SHIFT_ARGS(descriptors, rcv_name),
MACH_MSG2_SHIFT_ARGS(rcv_size, priority), timeout);
#undef MACH_MSG2_SHIFT_ARGS
}
#endif
This then goes through mach_msg2_internal, which is defined in libsyscall/mach/mach_msg.c and compiled into libsystem_kernel.dylib, and that calls down to mach_msg2_trap, which, at long long last, is where the svc happens:
;-- _mach_msg2_trap:
0x00000d68 d0058092 mov x16, -0x2f
0x00000d6c 011000d4 svc 0x80
0x00000d70 c0035fd6 ret
I guess with this you could build your own nanosleep on macOS 13 or iOS 16 now. It wouldn't work on versions before those though (you'd have to use plain mach_msg there), and an implementation that did work on those wouldn't work on macOS 13 and iOS 16, so you probably really shouldn't. Just call the libc implementation.