static void Help(void)
{
    PR_fprintf(err, "Usage: [-S] [-K <n>] [-h] <filename>\n");
    PR_fprintf(err, "\t-c   Nuber of iterations     (default: 10)\n");
    PR_fprintf(err, "\t-S   Sync the file           (default: FALSE)\n");
    PR_fprintf(err, "\t-K   Size of file (K bytes)  (default: 10)\n");
    PR_fprintf(err, "\t     Name of file to write   (default: /usr/tmp/sync.dat)\n");
    PR_fprintf(err, "\t-h   This message and nothing else\n");
}  /* Help */

/**************************************************************************
 *
 * G e n e r a t e S e l f S i g n e d O b j e c t S i g n i n g C e r t
 *														   		  *phew*^
 *
 */
static CERTCertificate*
GenerateSelfSignedObjectSigningCert(char *nickname, CERTCertDBHandle *db,
 	char *subject, unsigned long serial, int keysize, char *token)
{
    CERTCertificate * cert, *temp_cert;
    SECItem * derCert;
    CERTCertificateRequest * req;

    PK11SlotInfo * slot = NULL;
    SECKEYPrivateKey * privk = NULL;
    SECKEYPublicKey * pubk = NULL;

    if ( token ) {
	slot = PK11_FindSlotByName(token);
    } else {
	slot = PK11_GetInternalKeySlot();
    }

    if (slot == NULL) {
	PR_fprintf(errorFD, "Can't find PKCS11 slot %s\n",
	    token ? token : "");
	errorCount++;
	exit (ERRX);
    }

    if ( GenerateKeyPair(slot, &pubk, &privk, keysize) != SECSuccess) {
	FatalError("Error generating keypair.");
    }
    req = make_cert_request (subject, pubk);
    temp_cert = make_cert (req, serial, &req->subject);
    if (set_cert_type(temp_cert,
        NS_CERT_TYPE_OBJECT_SIGNING | NS_CERT_TYPE_OBJECT_SIGNING_CA)
         != SECSuccess) {
	FatalError("Unable to set cert type");
    }

    derCert = sign_cert (temp_cert, privk);
    cert = install_cert(db, derCert, nickname);
    if (ChangeTrustAttributes(db, cert, ",,uC") != SECSuccess) {
	FatalError("Unable to change trust on generated certificate");
    }

    /* !!! Free memory ? !!! */
    PK11_FreeSlot(slot);
    SECKEY_DestroyPrivateKey(privk);
    SECKEY_DestroyPublicKey(pubk);

    return cert;
}

PRStatus TimelineInit(void)
{
    char *timeStr;
    char *fileName;
    PRInt32 secs, msecs;
    PRFileDesc *fd;
    PRInt64 tmp1, tmp2;

    PRStatus status = PR_NewThreadPrivateIndex( &gTLSIndex, ThreadDestruct );
    NS_WARN_IF_FALSE(status==0, "TimelineService could not allocate TLS storage.");

    timeStr = PR_GetEnv("NS_TIMELINE_INIT_TIME");
#ifdef XP_MAC    
    initInterval = PR_IntervalNow();
#endif
    // NS_TIMELINE_INIT_TIME only makes sense for the main thread, so if it
    // exists, set it there.  If not, let normal thread management code take
    // care of setting the init time.
    if (timeStr != NULL && 2 == PR_sscanf(timeStr, "%d.%d", &secs, &msecs)) {
        PRTime &initTime = GetThisThreadData()->initTime;
        LL_MUL(tmp1, (PRInt64)secs, 1000000);
        LL_MUL(tmp2, (PRInt64)msecs, 1000);
        LL_ADD(initTime, tmp1, tmp2);
#ifdef XP_MAC
        initInterval -= PR_MicrosecondsToInterval(
            (PRUint32)(PR_Now() - initTime));
#endif
    }
    // Get the log file.
#ifdef XP_MAC
    fileName = "timeline.txt";
#else
    fileName = PR_GetEnv("NS_TIMELINE_LOG_FILE");
#endif
    if (fileName != NULL
        && (fd = PR_Open(fileName, PR_WRONLY | PR_CREATE_FILE | PR_TRUNCATE,
                         0666)) != NULL) {
        timelineFD = fd;
        PR_fprintf(fd,
                   "NOTE: due to asynchrony, the indentation that you see does"
                   " not necessarily correspond to nesting in the code.\n\n");
    }

    // Runtime disable of timeline
    if (PR_GetEnv("NS_TIMELINE_ENABLE"))
        gTimelineDisabled = PR_FALSE;
    return PR_SUCCESS;
}

static void PR_CALLBACK Notified(void *arg)
{
    Shared *shared = (Shared*)arg;
    PRStatus status = PR_SUCCESS;
    while (PR_SUCCESS == status)
    {
        PR_Lock(shared->ml);
        while (shared->twiddle && (PR_SUCCESS == status))
            status = PR_WaitCondVar(shared->cv, PR_INTERVAL_NO_TIMEOUT);
		if (verbosity) PR_fprintf(debug_out, "+");
        shared->twiddle = PR_TRUE;
        shared->next->twiddle = PR_FALSE;
        PR_NotifyCondVar(shared->next->cv);
        PR_Unlock(shared->ml);
    }
}  /* Notified */

static void PrintProgress(PRIntn line)
{
    failed = failed || (should && !did);
    failed = failed || (!should && did);
    if (debug > 0)
    {
#if defined(WIN16)
        printf(
            "@ line %d destructor should%s have been called and was%s\n",
            line, ((should) ? "" : " NOT"), ((did) ? "" : " NOT"));
#else    
        PR_fprintf(
            fout, "@ line %d destructor should%s have been called and was%s\n",
            line, ((should) ? "" : " NOT"), ((did) ? "" : " NOT"));
#endif
    }
}  /* PrintProgress */

static void Help(void)
{
    debug_out = PR_STDOUT;

    PR_fprintf(
		debug_out, "Usage: >./switch [-c n] [-t n] [-d] [-v] [-G] [-C n]\n");
    PR_fprintf(
		debug_out, "-c n\tloops at thread level (default: %d)\n", DEFAULT_LOOPS);
    PR_fprintf(
		debug_out, "-t n\tnumber of threads (default: %d)\n", DEFAULT_THREADS);
    PR_fprintf(debug_out, "-d\tturn on debugging output (default: FALSE)\n");
    PR_fprintf(debug_out, "-v\tturn on verbose output (default: FALSE)\n");
    PR_fprintf(debug_out, "-G\tglobal threads only (default: FALSE)\n");
    PR_fprintf(debug_out, "-C n\tconcurrency setting (default: 1)\n");
}  /* Help */

int Usage(void)
{
    PRFileDesc *pr_stderr = PR_STDERR;
    PR_fprintf (pr_stderr, "ocspresp runs an internal selftest for OCSP response creation");
    PR_fprintf (pr_stderr, "Usage:");
    PR_fprintf (pr_stderr,
                "\tocspresp <dbdir> <CA-nick> <EE-nick> [-p <pass>] [-f <file>]\n");
    PR_fprintf (pr_stderr,
                "\tdbdir:   Find security databases in \"dbdir\"\n");
    PR_fprintf (pr_stderr,
                "\tCA-nick: nickname of a trusted CA certificate with private key\n");
    PR_fprintf (pr_stderr,
                "\tEE-nick: nickname of a entity cert issued by CA\n");
    PR_fprintf (pr_stderr,
                "\t-p:      a password for db\n");
    PR_fprintf (pr_stderr,
                "\t-f:      a filename containing the password for db\n");
    return -1;
}

/************************************************************************
 *
 * g e t F l a g s F r o m S t r i n g
 *
 * Parses a mechanism list passed on the command line and converts it
 * to an unsigned long bitmask.
 * string is a colon-separated string of constants
 * array is an array of MaskStrings.
 * elements is the number of elements in array.
 */
static unsigned long
getFlagsFromString(char *string, const MaskString array[], int elements)
{
    unsigned long ret = 0;
    short i = 0;
    char *cp;
    char *buf;
    char *end;

    if (!string || !string[0]) {
        return ret;
    }

    /* Make a temporary copy of the string */
    buf = PR_Malloc(strlen(string) + 1);
    if (!buf) {
        out_of_memory();
    }
    strcpy(buf, string);

    /* Look at each element of the list passed in */
    for (cp = buf; cp && *cp; cp = (end ? end + 1 : NULL)) {
        /* Look at the string up to the next colon */
        end = strchr(cp, ':');
        if (end) {
            *end = '\0';
        }

        /* Find which element this is */
        for (i = 0; i < elements; i++) {
            if (!PORT_Strcasecmp(cp, array[i].name)) {
                break;
            }
        }
        if (i == elements) {
            /* Skip a bogus string, but print a warning message */
            PR_fprintf(PR_STDERR, errStrings[INVALID_CONSTANT_ERR], cp);
            continue;
        }
        ret |= array[i].mask;
    }

    PR_Free(buf);
    return ret;
}

static PRIntn PR_CALLBACK RealMain(PRIntn argc, char **argv)
{
    Overlay_i si;
    Overlay_u ui;
    PLOptStatus os;
    PRBool bsi = PR_FALSE, bui = PR_FALSE;
    PLOptState *opt = PL_CreateOptState(argc, argv, "hi:u:");
    err = PR_GetSpecialFD(PR_StandardError);

    while (PL_OPT_EOL != (os = PL_GetNextOpt(opt)))
    {
        if (PL_OPT_BAD == os) continue;
        switch (opt->option)
        {
        case 'i':  /* signed integer */
            si.i = (PRInt32)atoi(opt->value);
            bsi = PR_TRUE;
            break;
        case 'u':  /* unsigned */
            ui.i = (PRUint32)atoi(opt->value);
            bui = PR_TRUE;
            break;
        case 'h':  /* user wants some guidance */
         default:
            Help();  /* so give him an earful */
            return 2;  /* but not a lot else */
        }
    }
    PL_DestroyOptState(opt);

#if defined(HAVE_LONG_LONG)
    PR_fprintf(err, "We have long long\n");
#else
    PR_fprintf(err, "We don't have long long\n");
#endif

    if (bsi)
    {
        PR_fprintf(err, "Converting %ld: ", si.i);
        LL_I2L(si.l, si.i);
        PR_fprintf(err, "%lld\n", si.l);
    }

    if (bui)
    {
        PR_fprintf(err, "Converting %lu: ", ui.i);
        LL_I2L(ui.l, ui.i);
        PR_fprintf(err, "%llu\n", ui.l);
    }
    return 0;

}  /* main */

/*
 *  j a r _ f i n d _ k e y _ t y p e
 * 
 *  Determine the key type for a given cert, which 
 * should be rsaKey or dsaKey. Any error return 0.
 *
 */
static int	
jar_find_key_type (CERTCertificate *cert)
{
    SECKEYPrivateKey * privk = NULL;
    KeyType keyType;

    /* determine its type */
    privk = PK11_FindKeyByAnyCert (cert, &pwdata);
    if (privk == NULL) {
	PR_fprintf(errorFD, "warning - can't find private key for this cert\n");
	warningCount++;
	return 0;
    }

    keyType = privk->keyType;
    SECKEY_DestroyPrivateKey (privk);
    return keyType;
}

/*
 * Prints the contents of a PRHostEnt structure
 */
void PrintHostent(const PRHostEnt *he)
{
    int i;
    int j;

    PR_fprintf(outFile, "h_name: %s\n", he->h_name);
    for (i = 0; he->h_aliases[i]; i++) {
        PR_fprintf(outFile, "h_aliases[%d]: %s\n", i, he->h_aliases[i]);
    }
    PR_fprintf(outFile, "h_addrtype: %d\n", he->h_addrtype);
    PR_fprintf(outFile, "h_length: %d\n", he->h_length);
    for (i = 0; he->h_addr_list[i]; i++) {
        PR_fprintf(outFile, "h_addr_list[%d]: ", i);
        for (j = 0; j < he->h_length; j++) {
            if (j != 0) PR_fprintf(outFile, ".");
            PR_fprintf(outFile, "%u", (unsigned char)he->h_addr_list[i][j]);
        }
        PR_fprintf(outFile, "\n");
    }
}

static PRIntn PR_CALLBACK RealMain( PRIntn argc, char **argv )
{
	PLOptStatus os;
  	PLOptState *opt = PL_CreateOptState(argc, argv, "dhlmc");
	PRBool locks = PR_FALSE, monitors = PR_FALSE, cmonitors = PR_FALSE;

    err = PR_GetSpecialFD(PR_StandardError);

	while (PL_OPT_EOL != (os = PL_GetNextOpt(opt)))
    {
		if (PL_OPT_BAD == os) continue;
        switch (opt->option)
        {
        case 'd':  /* debug mode (noop) */
            break;
        case 'l':  /* locks */
			locks = PR_TRUE;
            break;
        case 'm':  /* monitors */
			monitors = PR_TRUE;
            break;
        case 'c':  /* cached monitors */
			cmonitors = PR_TRUE;
            break;
        case 'h':  /* needs guidance */
         default:
            Help();
            return 2;
        }
    }
	PL_DestroyOptState(opt);

    ml = PR_NewLock();
    if (locks) T1Lock();
    if (monitors) T1Mon();
    if (cmonitors) T1CMon();

    PR_DestroyLock(ml);

    PR_fprintf(err, "Done!\n");    
    return 0;
}  /* main */

static PRUint32 ContentiousMonitor(PRUint32 loops)
{
    PRStatus status;
    PRThread *thread = NULL;
    MonitorContentious_t * contention;
    PRIntervalTime rv, overhead, timein = PR_IntervalNow();

    contention = PR_NEWZAP(MonitorContentious_t);
    contention->loops = loops;
    contention->overhead = 0;
    contention->ml = PR_NewMonitor();
    contention->interval = contention_interval;
    thread = PR_CreateThread(
        PR_USER_THREAD, MonitorContender, contention,
        PR_PRIORITY_LOW, PR_LOCAL_THREAD, PR_JOINABLE_THREAD, 0);
    PR_ASSERT(thread != NULL);

    overhead = PR_IntervalNow() - timein;

    while (contention->loops-- > 0)
    {
        PR_EnterMonitor(contention->ml);
        PR_ASSERT_CURRENT_THREAD_IN_MONITOR(contention->ml);
        contention->contentious+= 1;
        contention->overhead += contention->interval;
        PR_Sleep(contention->interval);
        PR_ASSERT_CURRENT_THREAD_IN_MONITOR(contention->ml);
        PR_ExitMonitor(contention->ml);
    }

    timein = PR_IntervalNow();
    status = PR_JoinThread(thread);
    PR_DestroyMonitor(contention->ml);
    overhead += (PR_IntervalNow() - timein);
    rv = overhead + contention->overhead;
    if (verbosity)
        PR_fprintf(
            std_err, "Access ratio: %u to %u\n",
            contention->contentious, contention->contender);
    PR_Free(contention);
    return rv;
}  /* ContentiousMonitor */

static void TestNowOverhead(void)
{
    PRTime timeout, timein;
    PRInt32 overhead, loops = 1000000;
    PRInt64 elapsed, per_call, ten23rd, ten26th;

    LL_I2L(ten23rd, 1000);
    LL_I2L(ten26th, 1000000);

    timein = PR_Now();
    while (--loops > 0)
        timeout = PR_Now();

    LL_SUB(elapsed, timeout, timein);
    LL_MUL(elapsed, elapsed, ten23rd);
    LL_DIV(per_call, elapsed, ten26th);
    LL_L2I(overhead, per_call);
    PR_fprintf(
        output, "Overhead of 'PR_Now()' is %u nsecs\n\n", overhead);
}  /* TestNowOverhead */

static PRInt16 PR_CALLBACK MyPoll(
    PRFileDesc *fd, PRInt16 in_flags, PRInt16 *out_flags)
{
    PRInt16 my_flags, new_flags;
    PRFilePrivate *mine = (PRFilePrivate*)fd->secret;
    if (0 != (PR_POLL_READ & in_flags))
    {
        /* client thinks he's reading */
        switch (mine->rcvstate)
        {
            case rcv_send_credit:
                my_flags = (in_flags & ~PR_POLL_READ) | PR_POLL_WRITE;
                break;
            case rcv_data:
            case rcv_get_debit:
                my_flags = in_flags;
            default: break;
        }
    }
    else if (0 != (PR_POLL_WRITE & in_flags))
    {
        /* client thinks he's writing */
        switch (mine->xmtstate)
        {
            case xmt_recv_credit:
                my_flags = (in_flags & ~PR_POLL_WRITE) | PR_POLL_READ;
                break;
            case xmt_send_debit:
            case xmt_data:
                my_flags = in_flags;
            default: break;
        }
    }
    else PR_NOT_REACHED("How'd I get here?");
    new_flags = (fd->lower->methods->poll)(fd->lower, my_flags, out_flags);
    if (verbosity > chatty)
        PR_fprintf(
            logFile, "Poll [i: 0x%x, m: 0x%x, o: 0x%x, n: 0x%x]\n",
            in_flags, my_flags, *out_flags, new_flags);
    return new_flags;
}  /* MyPoll */

static PRBool
MakeConfFile(const char *regfile, const nsCString &greHome,
             const GREProperty *aProperties, PRUint32 aPropertiesLen)
{
  // If the file exists, don't create it again!
  if (access(regfile, R_OK) == 0)
    return PR_FALSE;

  PRBool ok = PR_TRUE;

  { // scope "fd" so that we can delete the file if something goes wrong
    AutoFDClose fd = PR_Open(regfile, PR_CREATE_FILE | PR_WRONLY | PR_TRUNCATE,
                             0664);
    if (!fd)
      return PR_FALSE;

    static const char kHeader[] =
      "# Registration file generated by xulrunner. Do not edit.\n\n"
      "[" GRE_BUILD_ID "]\n"
      "GRE_PATH=";

    if (PR_Write(fd, kHeader, sizeof(kHeader) - 1) != sizeof(kHeader) - 1)
      ok = PR_FALSE;

    if (PR_Write(fd, greHome.get(), greHome.Length()) != greHome.Length())
      ok = PR_FALSE;

    for (PRUint32 i = 0; i < aPropertiesLen; ++i) {
      if (PR_fprintf(fd, "\n%s=%s",
                     aProperties[i].property, aProperties[i].value) <= 0)
        ok = PR_FALSE;
    }

    PR_Write(fd, "\n", 1);
  }

  if (!ok)
    PR_Delete(regfile);

  return ok;
}

xpti_InterfaceWriter(PLDHashTable *table, PLDHashEntryHdr *hdr,
                     PRUint32 number, void *arg)
{
    xptiInterfaceEntry* entry = ((xptiHashEntry*)hdr)->value;
    PRFileDesc* fd = (PRFileDesc*)  arg;

    char iidStr[NSID_LENGTH];
    entry->GetTheIID()->ToProvidedString(iidStr);

    const xptiTypelib& typelib = entry->GetTypelibRecord();

    PRBool success =  !!PR_fprintf(fd, "%d,%s,%s,%d,%d,%d\n",
                                   (int) number,
                                   entry->GetTheName(),
                                   iidStr,
                                   (int) typelib.GetFileIndex(),
                                   (int) (typelib.IsZip() ?
                                          typelib.GetZipItemIndex() : -1),
                                   (int) entry->GetScriptableFlag());

    return success ? PL_DHASH_NEXT : PL_DHASH_STOP;
}

/*
 *  m a n i f e s t o _ x p i _ f n
 *
 *  Called by pointer from SignArchive(), once for
 *  each file within the directory. This function
 *  is only used for adding to XPI compatible archive
 *
 */
static int	manifesto_xpi_fn 
(char *relpath, char *basedir, char *reldir, char *filename, void *arg)
{
    char	fullname [FNSIZE];

    if (verbosity >= 0) {
	PR_fprintf(outputFD, "--> %s\n", relpath);
    }

    /* extension matching */
    if (extensionsGiven) {
	char	*ext = PL_strrchr(relpath, '.');
	if (!ext) 
	    return 0;
	if (!PL_HashTableLookup(extensions, ext)) 
	    return 0;
    }
    sprintf (fullname, "%s/%s", basedir, relpath);
    JzipAdd(fullname, relpath, zipfile, compression_level);

    return 0;
}

static void
long_usage (char *program_name)
{
    PRFileDesc *pr_stderr;

    pr_stderr = PR_STDERR;
    synopsis (program_name);
    PR_fprintf (pr_stderr, "\nDecode encrypted passwords (and other data).\n");
    PR_fprintf (pr_stderr,
                "This program reads in standard configuration files looking\n"
                "for base 64 encoded data. Data that looks like it's base 64 encode\n"
                "is decoded an passed to the NSS SDR code. If the decode and decrypt\n"
                "is successful, then decrypted data is outputted in place of the\n"
                "original base 64 data. If the decode or decrypt fails, the original\n"
                "data is written and the reason for failure is logged to the \n"
                "optional logfile.\n");
    PR_fprintf (pr_stderr,
                "  %-13s Read stream including encrypted data from "
                "\"read_file\"\n",
                "-i read_file");
    PR_fprintf (pr_stderr,
                "  %-13s Write results to \"write_file\"\n",
                "-o write_file");
    PR_fprintf (pr_stderr,
                "  %-13s Find security databases in \"dbdir\"\n",
                "-d dbdir");
    PR_fprintf (pr_stderr,
                "  %-13s Log failed decrypt/decode attempts to \"log_file\"\n",
                "-l log_file");
    PR_fprintf (pr_stderr,
                "  %-13s Token password\n",
                "-p pwd");
    PR_fprintf (pr_stderr,
                "  %-13s Password file\n",
                "-f pwfile");
}

/******************************************************************
 *
 * m a k e _ c e r t _ r e q u e s t
 */
static CERTCertificateRequest*
make_cert_request(char *subject, SECKEYPublicKey *pubk)
{
    CERTName * subj;
    CERTSubjectPublicKeyInfo * spki;

    CERTCertificateRequest * req;

    /* Create info about public key */
    spki = SECKEY_CreateSubjectPublicKeyInfo(pubk);
    if (!spki) {
	SECU_PrintError(progName, "unable to create subject public key");
	exit (ERRX);
    }

    subj = CERT_AsciiToName (subject);
    if (subj == NULL) {
	FatalError("Invalid data in certificate description");
    }

    /* Generate certificate request */
    req = CERT_CreateCertificateRequest(subj, spki, 0);
    if (!req) {
	SECU_PrintError(progName, "unable to make certificate request");
	exit (ERRX);
    }

    SECKEY_DestroySubjectPublicKeyInfo(spki);
    CERT_DestroyName(subj);

    if (verbosity >= 0) {
	PR_fprintf(outputFD, "certificate request generated\n");
    }

    return req;
}