diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6651d5b41c..e7747d2802 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,11 +5,9 @@ find_package(PkgConfig REQUIRED)
 
 set(EXTERNAL_DIR ${PROJECT_SOURCE_DIR}/external)
 
-# libia2 needs to be first so it defines ${libia2_BINARY_DIR}
-add_subdirectory(libia2)
+# runtime needs to be first so it defines libia2_BINARY_DIR
+add_subdirectory(runtime)
 
 add_subdirectory(examples)
-add_subdirectory(rewriter)
-add_subdirectory(partition-alloc)
-add_subdirectory(pad-tls)
-add_subdirectory(runtime)
+add_subdirectory(tests)
+add_subdirectory(tools)
diff --git a/README.md b/README.md
index 8054b1abbc..f6524f7f61 100644
--- a/README.md
+++ b/README.md
@@ -1,81 +1,21 @@
-# IA2 Phase 2
+# IA2 Sandboxing Runtime
 
-This repo provides tools for compartmentalizing an application and its dependencies using Intel's memory protection keys (MPK) for userspace. The repo includes a tool that rewrites headers to create call gate wrappers as well as the runtime to initialize the protection keys for trusted compartments.
+IA2 (or Intent-capturing Annotations for Isolation and Assurance) is a runtime and set of tools for compartmentalizing C/C++ applications to provide coarse spatial memory-safety.
 
-## Setup
+Applications typically use many third-party C/C++ libraries that may introduce memory-safety vulnerabilities if developers don't have the resources to exhaustively audit them. Putting everything in a single process means that a vulnerability in one library can compromise another and that's a problem for programs that handle security-sensitive information. The IA2 sandbox splits applications into isolated compartments and uses CPU hardware features (Memory Protection Keys on x86-64) to forbid cross-compartment memory accesses. Compartments are delineated along pre-existing boundaries (at the shared library level) avoiding the need to rearchitect a codebase and source-code annotations are used to mark variables that are intentionally shared between compartments. The runtime also ensures that each set of shared libraries in a compartment uses a distinct region of memory for its stack, heap, static and thread-local variables.
 
-Ubuntu 20.04 is used for testing. Other Linux distributions may or may not work. Adjust the commands below accordingly.
+## Sandboxing workflow
 
-### Install the package prerequisites.
+IA2 uses source-code transformations as part of the build process to sandbox programs. Our [rewriter tool](docs/source_rewriter.md) processes a codebase's source files before each build to produce a set of intermediate sources with annotations for compartment transitions at cross-DSO calls. These intermediate sources are then passed on to a build system using off-the-shelf compilers with some additional flags and the IA2 runtime is linked in to create the compartmentalized program. See the [design doc](docs/design.md) for details.
 
-```
-sudo apt install -y libusb-1.0-0-dev libclang-dev llvm-dev \
-            ninja-build zlib1g-dev python3-pip cmake \
-            libavformat-dev libavutil-dev pcregrep patchelf
-pip install lit
-rustup install nightly
-```
+This workflow treats intermediate sources as build artifacts so the only annotations that need to be checked-in are those that can't be inferred. These are primarily annotations for shared variables and cross-library indirect calls when round-tripping function pointers through `void *`. For the latter the rewriter also does type-system transformations to turn missing annotations into compiler errors and avoid accidental miscompartmentalization. In compartmentalized programs cross-compartment memory accesses kill the process, but they also support a permissive mode which just logs the accesses to aid developers adding shared variable annotations.
 
-### Configure with CMake
+## Features
 
-*Note*: Adjust paths to your version of Clang/LLVM
-
-```
-mkdir build && pushd build
-cmake ..                                        \
-            -DClang_DIR=/usr/lib/cmake/clang-12 \
-            -DLLVM_DIR=/usr/lib/llvm-12/cmake   \
-            -DLLVM_EXTERNAL_LIT=`which lit`     \
-            -G Ninja
-```
-
-### Build and run the tests
-
-*Note*: Pass `-v` to ninja to see build commands and output from failing tests.
-
-```
-ninja check-ia2
-```
+- **Hardware checks** Coarse spatial memory safety enforced using CPU hardware features to reduce the runtime cost of bounds checking. On x86-64 this means Memory Protection Keys ([`wrpkru`](https://www.kernel.org/doc/html/next/core-api/protection-keys.html)) for memory permissions and Control-flow Enforcement Technology (`endbr` and [SHSTK](https://docs.kernel.org/next/x86/shstk.html)) to prevent call gate misuse. Support for Aarch64 using Memory Tagging Extensions is in-progress.
+- **Minimal developer-facing annotations** Compartment transition annotations that can be inferred are automatically added by the rewriter and only appear in build artifacts. This reduces the developer-facing annotations while allowing developers to audit source-code changes made by the rewriter if necessary.
+- **Toolchain-independent** Compartmentalized programs are built with off-the shelf compilers and linkers.
 
 ## Usage
 
-### Defining compartments
-
-First invoke the [`INIT_RUNTIME`](https://github.com/immunant/IA2-Phase2/blob/5cdb743d3a42e8df8e4d8cf61fb3551656001c73/libia2/include/ia2.h#L204) macro once in any binary or shared library to define the number of protection keys that need to be allocated. The argument passed to `INIT_RUNTIME` must be a number between 1 and 15. Then the [`IA2_COMPARTMENT`](https://github.com/immunant/IA2-Phase2/blob/4a3a0c8d2a2b1881e0e41c89db070db3da187f9e/libia2/include/ia2_compartment_init.inc#L3) `#define` is used to define trusted compartments at the shared object level. This can be the main executable ELF or any dynamically-linked shared libraries. Memory belonging to a trusted compartment is assigned one of the [15 protection keys](https://man7.org/linux/man-pages/man7/pkeys.7.html) and can only be accessed by the shared object itself. Objects that don't explicitly define a compartment are treated as untrusted by default.
-
-To assign a protection key to a trusted compartment, insert `#define IA2_COMPARTMENT n` with an argument between 1-15 specifying the index of the protection key, and include `ia2_compartment_init.inc`:
-
-```c
-#define IA2_COMPARTMENT 1
-#include <ia2_compartment_init.inc>
-```
-
-This argument must differ from the other trusted compartments. Trusted compartments must also be aligned and padded properly by using the `padding.ld` script in `libia2/`. In CMake this is done automatically for executables built with `define_test` while libraries built with `define_shared_lib` must add `LINK_OPTS "-Wl,-T${libia2_BINARY_DIR}/padding.ld"`. To use in manual builds just include `-Wl,-T/path/to/padding.ld` in the final compilation step. Manual builds also require disabling lazy binding with `-Wl,-z,now`.
-
-### Wrapping calls
-
-Calls between compartments must have call gates to toggle the PKRU permissions at each transition. For direct calls, this is done by rewriting headers to generate the source for a wrapper that provides versions of every function with call gates. These wrappers are specific to both the wrapped library and caller. This means that the generated source must be compiled once per compartment that links against the wrapped library. Each caller's wrapper must define the `CALLER_PKEY` macro with the appropriate value for the caller.
-
-#### From CMake
-
-We provide a CMake rule to wrap a library or the main executable. This rule builds a wrapper and provides its dependency information to consumers of its outputs. Specifically, wrapper libs also depend on libia2 and have additional required compilation flags (-fno-omit-frame-pointer) for application code.
-
-[Usage from CMake](https://github.com/immunant/IA2-Phase2/blob/main/cmake/define-ia2-wrapper.cmake#L10-L32) looks like this (wrapping `myunsafelib` which is used by your existing `my_prog` target):
-```diff
-+define_ia2_wrapper(
-+    WRAPPER my_wrapper_target
-+    WRAPPED_LIB myunsafelib-1.0
-+    HEADERS myunsafelib.h myunsafelib_config.h
-+    CALLER_PKEY 0
-+)
-+
- add_executable(my_prog main.c)
--target_link_libraries(my_prog PRIVATE myunsafelib-1.0)
-+target_link_libraries(my_prog PRIVATE my_wrapper_target)
-```
-
-Wrapped libraries are treated as untrusted by default. If the library being wrapped defined a trusted compartment, `COMPARTMENT_PKEY n` must be specified in define_ia2_wrapper. Here `n` is the argument used in `IA2_COMPARTMENT` to define the compartment. If the caller is an untrusted compartment, set `CALLER_PKEY UNTRUSTED`. To create a wrapper for the main binary (i.e. if shared libraries call it directly) the `WRAP_MAIN` option must be specified.
-
-#### Manual usage
-
-See [this doc](https://github.com/immunant/IA2-Phase2/blob/main/docs/usage.md) for notes on manual usage.
+See [this doc](docs/build_instructions.md) for instructions on building the tools and tests in this repo. For more detailed instructions on the compartmentalization process see the [usage doc](docs/usage.md).
diff --git a/cmake/define-test.cmake b/cmake/define-test.cmake
index f83f221469..91be09e052 100644
--- a/cmake/define-test.cmake
+++ b/cmake/define-test.cmake
@@ -192,7 +192,7 @@ function(define_test)
             if (DEFINE_TEST_WITHOUT_SANDBOX)
                 add_test(${TEST_NAME} ${WRAPPED_MAIN})
             else()
-                add_test(NAME ${TEST_NAME} COMMAND ${CMAKE_BINARY_DIR}/runtime/ia2-sandbox ${CMAKE_CURRENT_BINARY_DIR}/${WRAPPED_MAIN} WORKING_DIRECTORY ${CMAKE_BINARY_DIR})
+                add_test(NAME ${TEST_NAME} COMMAND ${CMAKE_BINARY_DIR}/runtime/tracer/ia2-sandbox ${CMAKE_CURRENT_BINARY_DIR}/${WRAPPED_MAIN} WORKING_DIRECTORY ${CMAKE_BINARY_DIR})
                 add_dependencies(${WRAPPED_MAIN} ia2-sandbox)
             endif()
             add_dependencies(check ${WRAPPED_MAIN})
diff --git a/docs/build_instructions.md b/docs/build_instructions.md
new file mode 100644
index 0000000000..bba03ee6b8
--- /dev/null
+++ b/docs/build_instructions.md
@@ -0,0 +1,43 @@
+# Setup
+
+Ubuntu 20.04 is used for testing. Other Linux distributions may or may not work. Adjust the commands below accordingly.
+
+## Install the package prerequisites.
+
+```
+sudo apt install -y libusb-1.0-0-dev libclang-dev llvm-dev \
+            ninja-build zlib1g-dev python3-pip cmake \
+            libavformat-dev libavutil-dev pcregrep patchelf
+pip install lit
+rustup install nightly
+```
+
+## Configure with CMake
+
+*Note*: Adjust paths to your version of Clang/LLVM or using `llvm-config --cmakedir`
+
+```
+mkdir build && pushd build
+cmake ..                                        \
+            -DClang_DIR=/usr/lib/cmake/clang-15 \
+            -DLLVM_DIR=/usr/lib/cmake/llvm-15   \
+            -DLLVM_EXTERNAL_LIT=`which lit`     \
+            -G Ninja
+```
+
+### Notable CMake variables
+
+- `LIBIA2_DEBUG` - Adds additional runtime assertions to validate control-flow.
+- `LIBIA2_AARCH64` - Builds the runtime and tests for Aarch64 using MTE instead of x86-64 with MPK. Tools are still built for the host.
+- `CMAKE_TOOLCHAIN_FILE` - Typically set to `cmake/aarch64-toolchain.cmake` to build for Aarch64 using GCC. This also sets LIBIA2_AARCH64.
+
+## CMake targets
+
+- `check` - builds and runs the test suite. Pass `-v` to ninja to see build commands and output from failing tests.
+- `ia2-rewriter` - builds the source-code rewriter. Depends on libclang-dev and llvm-dev.
+- `pad-tls` - builds a script for padding ELF headers for TLS segments. Only required for compartmentalized DSOs that use thread-local storage.
+- `libia2` - builds the runtime as a static library. This does not include call gate transitions as those are program-specific and generated by the rewriter. 
+- `partition-alloc` - builds the compartment-aware shim for Chromium's PartitionAlloc allocator.
+- `ia2-sandbox` - builds the syscall tracer.
+
+Tests are enumerated in `tests/CMakeLists.txt`. To build a specific test use `$TEST_main_wrapped` as the target. See the [`directory structure doc`](docs/directory_structure.md) for an overview of the rest of the repo's contents.
diff --git a/docs/design.md b/docs/design.md
index 34aedcfabc..36f450f5cb 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -1,68 +1,84 @@
-# Source-to-Source Header Rewriting Design
-
-In Phase 1 we relied on compiler instrumentation to insert call gates at
-inter-compartment calls and for rewriting object allocations for shared values.
-For Phase II we plan to instead use source rewriting and standard linking to
-interpose between compartments, removing the requirement for a customized
-compiler.
-
-## Design Structure
-
-Our goal is to compartmentalize library(s) at the dynamic linking interface
-between shared libraries. These libraries generally use the C ABI and declare
-their API using C headers. Our rewriter will take these header declarations as
-input and produce a new, drop-in replacement library that exposes the same API
-but includes compartment transitions when entering and exiting the original
-library code. This replacement library will only contain call-gate wrappers for
-each exported function and will dynamically link against the original library
-for the actual implementations of the API.
-
-By replacing the original library with our wrapper in the application build
-system, users can be sure that they cannot inadvertently call functions in the
-compartmentalized library directly, bypassing the compartment transition. This
-also handles `dlopen` calls, as long as the applications `dlopen`s the wrapper
-library rather than the original.
-
-The rewriter will produce C files with inline call gates and stack transitions
-that users can audit if desired and can build using their existing toolchain.
-When we change types of function declarations (e.g. char* -> SharedCharPtr) to
-indicate that a type needs to be allocated in the shared memory region, we will
-need to produce a replacement header with these rewritten types for users to
-include instead of the original library's header. Again, these headers will be
-standard C and auditable after creation.
-
-Using a C API is the lowest common denominator for FFI interop between
-languages. Even C++ and Rust usually use the C ABI to interop with other
-external libraries. We may need a different design if we want to support
-compartmentalizing, e.g., pure Rust crates rather than external C libraries.
-
-## Compartment Transitions
-
-### Trusted -> Untrusted direct calls
-
-Our wrapper library will contain wrappers for every exported function. Each
-wrapper will save and clear callee-saved registers to the caller stack, save an
-identifier or address to the stack to validate the return site, copy any
-parameters on the stack to the callee stack, switch compartments, make a direct
-call to the callee. On returning the wrapper will transition back to the
-original compartment, check the stack cookie/return address to ensure that the
-program returned to the corresponding wrapper, switch to the caller stack, and
-return.
-
-### Untrusted -> Trusted direct calls
-
-Rare case. During wrapper creation we may be able to scan the target library for
-unresolved symbols and provide reverse wrappers for these symbols.
-
-### Trusted -> Untrusted indirect calls
-
-Indirect calls to exported functions will go through our wrappers, as taking the
-address of an exported function in the target library will give the address of
-the wrapper. Private callbacks that aren't exported are trickier. We will
-probably need to replace function pointer types in the headers with special
-opaque structures that capture the function pointer and redirect it to a call
-gate transition.
-
-### Untrusted -> Trusted indirect calls
-
-Same as trusted -> untrusted in the wrapper paradigm.
\ No newline at end of file
+# Compartmentalization design
+
+IA2 is a sandboxing framework with the following goals:
+
+1. Allow sandboxing individual processes at the dynamic shared object (DSO) granularity
+2. Allow inspection of code inserted by the framework
+3. Avoid changes to existing compilers and linkers
+4. Avoid changes to the operating system or dynamic linker
+
+IA2 can be used in conjunction with multi-process sandboxing and is particularly
+suitable for processes that can't feasibly be split into more processes. The x86
+implementation relies on Memory Protection Keys (MPK) for protecting pages and
+control-flow integrity (e.g. as provided by Intel's CET). It currently only
+supports Linux, but its design does not preclude porting it to other operating
+systems that provide access to the previously mentioned hardware primitives.
+
+# Protected memory
+
+Compartmentalization protects applications against spatial memory-safety
+vulnerabilities in dependencies by placing sets of DSOs in separate
+compartments. Memory belonging to each set of DSOs can only be accessed from its
+compartment by default. This includes stack variables, static and
+dynamically-allocated data and thread-local storage. The on-disk application
+and libraries are assumed to be accessible to attackers, so read-only static
+data is not protected from other compartments since it can just be read from the
+binaries.
+
+# Building compartmentalized applications
+
+The following diagram shows the workflow for building compartmentalized
+applications.
+
+![compartmentalization workflow](img/workflow.png)
+
+The build process works by adding a source code rewriting step before each
+build. This creates new source files which are then passed on to an existing
+build system with some additional standard compiler flags. The rewriter also
+generates a source file with application-specific call-gate code and the
+framework provides a static library that must also be linked in.
+
+## Supported compilers and linkers
+
+The framework is routinely tested with gcc and clang as compilers and LLVM's lld
+and GNU ld as linkers. The gold linker is currently not supported due to its
+minimal support for linker scripts. Other compilers may be added as the need
+arises.
+
+# Runtime Initialization
+
+The runtime initialization happens by interposing `main` using `ld --wrap=main`.
+The `main` wrapper switches from the stack initialized by the loader to a
+protected stack for the main binary's compartment, initializes the PKRU
+register to set memory access permissions for the initial compartment then calls
+the real `main` provided by the application. Once the real `main` returns the
+wrapper undos these operations before returning control to the C runtime. This
+implies protecting against vulnerabilities in the C runtime is out of scope.
+
+The `INIT_RUNTIME` macro must also be invoked to initialize the stacks and
+thread-local storage used by each compartment. Applications require one stack
+per (compartment * thread), so to minimize memory usage only one stack per
+compartment is initially created and further sets of compartment stacks are
+allocated on-demand as new threads are created.
+
+# Compartment initialization
+
+When DSOs are loaded, their statically-allocated memory is protected using
+`pkey_mprotect`. This happens by including `ia2_compartment_init.inc` in one DSO
+per compartment. This inserts a constructor (called automatically) that uses
+`dl_iterate_phdr` to find the writeable ELF segments for the DSO and its
+dependencies declared using `IA2_COMPARTMENT_LIBRARIES`.
+
+# Framework code interposition
+
+Calls to DSOs in different compartments are interposed using call gates. To
+provide build-time assurance that call gates cannot be misused, they are
+application-specific and generated by the rewriter. Direct cross-compartment
+calls are identified by the `__wrap_` prefix. To ensure that compartments can be
+mutually distrusting, indirect cross-compartment calls are split into sets of
+two half call gates that uses an intermediate PKRU value without access to any
+compartment. For each potential indirect call, the rewriter inserts the first
+half call gate at the callsite and replaces the function pointer expression with
+the second half call gate. To ensure that roundtrip casts between `void *` and
+function pointers do not lead to missing call gates, the rewriter also changes
+function pointer types in the rewritten sources to ABI-compatible structs.
diff --git a/docs/directory_structure.md b/docs/directory_structure.md
new file mode 100644
index 0000000000..3389412787
--- /dev/null
+++ b/docs/directory_structure.md
@@ -0,0 +1,59 @@
+# Repo directory structure
+
+## cmake
+CMake files for writing automated tests
+
+
+## docs
+Contains documentation on usage, design and technical details
+
+
+## examples
+Compartmentalized demo applications (not tested as part of the automated test
+suite)
+
+
+## external
+Third-party code. These are git subtrees of upstream codebases and each commit
+may only modify one subtree or the main repository.
+
+#### chromium
+The subset of chromium needed to build PartitionAlloc. See
+runtime/partition-alloc for subtree's latest upstream commit and details on
+pulling upstream changes.
+
+#### nginx
+Nginx web server pulled from github.com/nginx/nginx mirror. Used with the RTMP
+module to demo compartmentalizing Nginx plugins.
+
+#### nginx-rtmp-module
+Nginx media streaming RTMP module from github.com/arut/nginx-rtmp-module
+
+
+## runtime 
+The compartmentalization runtime, including code for both the target process
+itself and for tracing the process.
+
+#### libia2
+The main compartmentalization library. Includes code for interposing libc and
+the API for compartmentalizing codebases where manual changes are required.
+
+#### partition-alloc
+A compartment-aware shim for PartitionAlloc.
+
+#### tracer
+A program for restricting syscalls and tracking memory ownership changes as a result of syscalls in compartmentalized programs.
+
+
+## tests
+The automated tests that are run as part of the `check` CMake target.
+
+
+## tools
+Host tools required to build compartmentalized programs.
+
+#### rewriter
+Source rewriter and code generator for call gates.
+
+#### pad-tls
+Script to patch TLS segments in compartmentalized ELFs.
diff --git a/docs/img/workflow.png b/docs/img/workflow.png
new file mode 100644
index 0000000000..ddd3adbbc6
Binary files /dev/null and b/docs/img/workflow.png differ
diff --git a/external/nginx/auto/make b/external/nginx/auto/make
index dd0eb57197..f98cac815b 100644
--- a/external/nginx/auto/make
+++ b/external/nginx/auto/make
@@ -27,14 +27,23 @@ LINK =	$LINK
 
 C_SYSTEM_INCLUDE = `$CC -print-file-name=include`
 C_SYSTEM_INCLUDE_FIXED = `$CC -print-file-name=include-fixed`
+
+# Directory for IA2 build artifacts
 IA2_ROOT = $NGX_OBJS/../ia2
-PAD_TLS = \$(IA2_ROOT)/pad-tls/pad-tls
+
+LIBIA2_DIR = $REPO_ROOT/runtime/libia2
+LIBIA2_BUILD_DIR = \$(IA2_ROOT)/runtime/libia2
+
+PA_DIR = $REPO_ROOT/runtime/partition-alloc
+PA_BUILD_DIR = \$(IA2_ROOT)/runtime/partition-alloc
+
+PAD_TLS = \$(IA2_ROOT)/tools/pad-tls/pad-tls
 
 IA2_ENABLE = 1
 
 IA2_CALLGATES_TARGET = $NGX_OBJS/libia2_callgates.so
 ifneq (\$(IA2_ENABLE),0)
-IA2_LIBS = $NGX_OBJS/libia2_callgates.so \$(IA2_ROOT)/libia2/liblibia2.a
+IA2_LIBS = $NGX_OBJS/libia2_callgates.so \$(LIBIA2_BUILD_DIR)/liblibia2.a
 else
 IA2_LIBS =
 endif
@@ -50,8 +59,8 @@ IA2_CFLAGS = \\
 	-Wno-error \\
 	-Werror=incompatible-pointer-types \\
 	\$(IA2_EXTRA_CFLAGS) \\
-	-I $REPO_ROOT/libia2/include \\
-	-I $REPO_ROOT/partition-alloc/include
+	-I \$(LIBIA2_DIR)/include \\
+	-I \$(PA_DIR)/include
 
 IA2_PREREWRITER_LDFLAGS = \\
 	-Wl,--wrap=pthread_create
@@ -61,10 +70,10 @@ IA2_LDFLAGS = \\
 	-Wl,--wrap=main \\
 	-Wl,-z,now \\
 	-Wl,-z,relro \\
-	-Wl,-T\$(IA2_ROOT)/libia2/padding.ld \\
-	-Wl,--dynamic-list=\$(IA2_ROOT)/libia2/dynsym.syms \\
+	-Wl,-T\$(LIBIA2_BUILD_DIR)/padding.ld \\
+	-Wl,--dynamic-list=\$(LIBIA2_BUILD_DIR)/dynsym.syms \\
 	-Wl,--export-dynamic \\
-    -Wl,--rpath=\$(IA2_ROOT)/partition-alloc/
+    -Wl,--rpath=\$(PA_BUILD_DIR)/
 
 ifneq (\$(IA2_ENABLE),0)
 IA2_LDFLAGS += \\
@@ -88,8 +97,8 @@ IA2_MODULE_CFLAGS = \\
 	-Wno-error \\
 	-Werror=incompatible-pointer-types \\
 	\$(IA2_EXTRA_CFLAGS) \\
-	-I $REPO_ROOT/libia2/include \\
-	-I $REPO_ROOT/partition-alloc/include
+	-I \$(LIBIA2_DIR)/include \\
+	-I \$(PA_DIR)/include
 
 IA2_MODULE_LDFLAGS = \\
 	-Wl,-z,now \\
@@ -97,11 +106,11 @@ IA2_MODULE_LDFLAGS = \\
 	-pthread \\
 	-Wl,--wrap=pthread_create \\
 	-Wl,@$NGX_OBJS/../wrapper_2.ld \\
-	-Wl,-T\$(IA2_ROOT)/libia2/padding.ld
+	-Wl,-T\$(LIBIA2_BUILD_DIR)/padding.ld
 
 END
 
-CORE_LIBS="$CORE_LIBS \$(IA2_ROOT)/partition-alloc/libpartition-alloc.so"
+CORE_LIBS="$CORE_LIBS \$(PA_BUILD_DIR)/libpartition-alloc.so"
 
 if test -n "$NGX_PERL_CFLAGS"; then
     echo NGX_PERL_CFLAGS = $NGX_PERL_CFLAGS                   >> $NGX_MAKEFILE
@@ -305,7 +314,7 @@ binary:	$NGX_OBJS${ngx_dirsep}nginx$ngx_binext
 
 \$(IA2_CALLGATES_TARGET):
 	\$(CC) -shared -fPIC -Wl,-z,now $NGX_OBJS/../wrapper.c \
-		-I $REPO_ROOT/libia2/include -o \$(IA2_CALLGATES_TARGET)
+		-I \$(LIBIA2_DIR)/include -o \$(IA2_CALLGATES_TARGET)
 
 $NGX_OBJS/ngx_rtmp_module_tls_padded.so: $NGX_OBJS/ngx_rtmp_module.so
 	cp $NGX_OBJS/ngx_rtmp_module.so $NGX_OBJS/ngx_rtmp_module_tls_padded.so
diff --git a/external/nginx/auto/sources b/external/nginx/auto/sources
index 3a5877a7a9..ad73ef7eb3 100644
--- a/external/nginx/auto/sources
+++ b/external/nginx/auto/sources
@@ -42,7 +42,7 @@ CORE_DEPS="src/core/nginx.h \
            src/core/ngx_crypt.h \
            src/core/ngx_proxy_protocol.h \
            src/core/ngx_syslog.h \
-           $REPO_ROOT/libia2/include/permissive_mode.h"
+           $REPO_ROOT/runtime/libia2/include/permissive_mode.h"
 
 
 CORE_SRCS="src/core/nginx.c \
diff --git a/external/nginx/reconfigure b/external/nginx/reconfigure
index a1a74b8825..da8ffbf66e 100755
--- a/external/nginx/reconfigure
+++ b/external/nginx/reconfigure
@@ -7,8 +7,8 @@ IA2_BUILD_DIR=${BUILD_DIR}/ia2
 NGINX_BUILD_DIR=${BUILD_DIR}/nginx
 NGINX_ROOT=${EXTERNAL_ROOT}/nginx
 NGINX_RTMP_ROOT=${EXTERNAL_ROOT}/nginx-rtmp-module
-SRC_REWRITER=$IA2_BUILD_DIR/rewriter/ia2-rewriter
-LIBIA2=$IA2_BUILD_DIR/libia2/liblibia2.a
+SRC_REWRITER=$IA2_BUILD_DIR/tools/rewriter/ia2-rewriter
+LIBIA2=$IA2_BUILD_DIR/runtime/libia2/liblibia2.a
 TEMP_FILES=(
     nginx.pid
     err.log
diff --git a/runtime/CMakeLists.txt b/runtime/CMakeLists.txt
index 2d927e75f6..da60ba1487 100644
--- a/runtime/CMakeLists.txt
+++ b/runtime/CMakeLists.txt
@@ -1,50 +1,6 @@
 cmake_minimum_required(VERSION 3.12)
-project(IA2Runtime)
+project(runtime)
 
-add_custom_command(
-  OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/release/libmemory_map.so
-  COMMAND CARGO_TARGET_DIR=${CMAKE_CURRENT_BINARY_DIR} cargo build --manifest-path ${CMAKE_CURRENT_SOURCE_DIR}/memory-map/Cargo.toml --release
-  DEPENDS memory-map/Cargo.toml memory-map/src/lib.rs
-)
-
-add_library(memory-map STATIC IMPORTED)
-set_property(TARGET memory-map PROPERTY IMPORTED_LOCATION ${CMAKE_CURRENT_BINARY_DIR}/release/libmemory_map.so)
-add_custom_target(memory-map-tgt DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/release/libmemory_map.so)
-add_dependencies(memory-map memory-map-tgt)
-
-add_executable(read-pkru
-  read_pkru_demo.c
-  get_inferior_pkru.c
-)
-
-add_executable(track-memory-map
-  track_memory_map_demo.c
-  track_memory_map.c
-  mmap_event.c
-  get_inferior_pkru.c
-)
-target_link_libraries(track-memory-map PRIVATE memory-map)
-
-add_executable(seccomp-filter
-  seccomp_filter_demo.c
-  seccomp_filter.c
-)
-
-add_executable(landlock
-  landlock_demo.c
-  landlock.c
-  strv.c
-  forbid_paths.c
-)
-
-add_executable(ia2-sandbox
-  start.c
-  seccomp_filter.c
-  track_memory_map.c
-  mmap_event.c
-  get_inferior_pkru.c
-  landlock.c
-  strv.c
-  forbid_paths.c
-)
-target_link_libraries(ia2-sandbox PRIVATE memory-map)
+add_subdirectory(libia2)
+add_subdirectory(partition-alloc)
+add_subdirectory(tracer)
diff --git a/libia2/CMakeLists.txt b/runtime/libia2/CMakeLists.txt
similarity index 100%
rename from libia2/CMakeLists.txt
rename to runtime/libia2/CMakeLists.txt
diff --git a/libia2/dynsym.syms b/runtime/libia2/dynsym.syms
similarity index 100%
rename from libia2/dynsym.syms
rename to runtime/libia2/dynsym.syms
diff --git a/libia2/exit.c b/runtime/libia2/exit.c
similarity index 100%
rename from libia2/exit.c
rename to runtime/libia2/exit.c
diff --git a/libia2/ia2.c b/runtime/libia2/ia2.c
similarity index 100%
rename from libia2/ia2.c
rename to runtime/libia2/ia2.c
diff --git a/libia2/include/ia2.h b/runtime/libia2/include/ia2.h
similarity index 100%
rename from libia2/include/ia2.h
rename to runtime/libia2/include/ia2.h
diff --git a/libia2/include/ia2_compartment_init.inc b/runtime/libia2/include/ia2_compartment_init.inc
similarity index 100%
rename from libia2/include/ia2_compartment_init.inc
rename to runtime/libia2/include/ia2_compartment_init.inc
diff --git a/libia2/include/ia2_get_pkey.h b/runtime/libia2/include/ia2_get_pkey.h
similarity index 100%
rename from libia2/include/ia2_get_pkey.h
rename to runtime/libia2/include/ia2_get_pkey.h
diff --git a/libia2/include/ia2_internal.h b/runtime/libia2/include/ia2_internal.h
similarity index 100%
rename from libia2/include/ia2_internal.h
rename to runtime/libia2/include/ia2_internal.h
diff --git a/libia2/include/permissive_mode.h b/runtime/libia2/include/permissive_mode.h
similarity index 100%
rename from libia2/include/permissive_mode.h
rename to runtime/libia2/include/permissive_mode.h
diff --git a/libia2/include/scrub_registers.h b/runtime/libia2/include/scrub_registers.h
similarity index 100%
rename from libia2/include/scrub_registers.h
rename to runtime/libia2/include/scrub_registers.h
diff --git a/libia2/include/test_fault_handler.h b/runtime/libia2/include/test_fault_handler.h
similarity index 100%
rename from libia2/include/test_fault_handler.h
rename to runtime/libia2/include/test_fault_handler.h
diff --git a/libia2/main.c b/runtime/libia2/main.c
similarity index 100%
rename from libia2/main.c
rename to runtime/libia2/main.c
diff --git a/libia2/padding.ld b/runtime/libia2/padding.ld
similarity index 100%
rename from libia2/padding.ld
rename to runtime/libia2/padding.ld
diff --git a/libia2/threads.c b/runtime/libia2/threads.c
similarity index 100%
rename from libia2/threads.c
rename to runtime/libia2/threads.c
diff --git a/partition-alloc/CMakeLists.txt b/runtime/partition-alloc/CMakeLists.txt
similarity index 100%
rename from partition-alloc/CMakeLists.txt
rename to runtime/partition-alloc/CMakeLists.txt
diff --git a/partition-alloc/README.md b/runtime/partition-alloc/README.md
similarity index 100%
rename from partition-alloc/README.md
rename to runtime/partition-alloc/README.md
diff --git a/chromium_commit b/runtime/partition-alloc/chromium_commit
similarity index 100%
rename from chromium_commit
rename to runtime/partition-alloc/chromium_commit
diff --git a/partition-alloc/include/ia2_allocator.h b/runtime/partition-alloc/include/ia2_allocator.h
similarity index 100%
rename from partition-alloc/include/ia2_allocator.h
rename to runtime/partition-alloc/include/ia2_allocator.h
diff --git a/scripts/partition_alloc/partition_alloc.diff b/runtime/partition-alloc/partition_alloc.diff
similarity index 100%
rename from scripts/partition_alloc/partition_alloc.diff
rename to runtime/partition-alloc/partition_alloc.diff
diff --git a/partition-alloc/src/allocator_shim_default_dispatch_to_partition_alloc.cc b/runtime/partition-alloc/src/allocator_shim_default_dispatch_to_partition_alloc.cc
similarity index 100%
rename from partition-alloc/src/allocator_shim_default_dispatch_to_partition_alloc.cc
rename to runtime/partition-alloc/src/allocator_shim_default_dispatch_to_partition_alloc.cc
diff --git a/partition-alloc/src/get_pkey.cc b/runtime/partition-alloc/src/get_pkey.cc
similarity index 100%
rename from partition-alloc/src/get_pkey.cc
rename to runtime/partition-alloc/src/get_pkey.cc
diff --git a/partition-alloc/src/get_pkey.h b/runtime/partition-alloc/src/get_pkey.h
similarity index 100%
rename from partition-alloc/src/get_pkey.h
rename to runtime/partition-alloc/src/get_pkey.h
diff --git a/partition-alloc/src/shared_allocator.cc b/runtime/partition-alloc/src/shared_allocator.cc
similarity index 100%
rename from partition-alloc/src/shared_allocator.cc
rename to runtime/partition-alloc/src/shared_allocator.cc
diff --git a/scripts/partition_alloc/update.sh b/runtime/partition-alloc/update.sh
similarity index 100%
rename from scripts/partition_alloc/update.sh
rename to runtime/partition-alloc/update.sh
diff --git a/runtime/tracer/CMakeLists.txt b/runtime/tracer/CMakeLists.txt
new file mode 100644
index 0000000000..67be2b5fce
--- /dev/null
+++ b/runtime/tracer/CMakeLists.txt
@@ -0,0 +1,50 @@
+cmake_minimum_required(VERSION 3.12)
+project(tracer)
+
+add_custom_command(
+  OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/release/libmemory_map.so
+  COMMAND CARGO_TARGET_DIR=${CMAKE_CURRENT_BINARY_DIR} cargo build --manifest-path ${CMAKE_CURRENT_SOURCE_DIR}/memory-map/Cargo.toml --release
+  DEPENDS memory-map/Cargo.toml memory-map/src/lib.rs
+)
+
+add_library(memory-map STATIC IMPORTED)
+set_property(TARGET memory-map PROPERTY IMPORTED_LOCATION ${CMAKE_CURRENT_BINARY_DIR}/release/libmemory_map.so)
+add_custom_target(memory-map-tgt DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/release/libmemory_map.so)
+add_dependencies(memory-map memory-map-tgt)
+
+add_executable(read-pkru
+  read_pkru_demo.c
+  get_inferior_pkru.c
+)
+
+add_executable(track-memory-map
+  track_memory_map_demo.c
+  track_memory_map.c
+  mmap_event.c
+  get_inferior_pkru.c
+)
+target_link_libraries(track-memory-map PRIVATE memory-map)
+
+add_executable(seccomp-filter
+  seccomp_filter_demo.c
+  seccomp_filter.c
+)
+
+add_executable(landlock
+  landlock_demo.c
+  landlock.c
+  strv.c
+  forbid_paths.c
+)
+
+add_executable(ia2-sandbox
+  start.c
+  seccomp_filter.c
+  track_memory_map.c
+  mmap_event.c
+  get_inferior_pkru.c
+  landlock.c
+  strv.c
+  forbid_paths.c
+)
+target_link_libraries(ia2-sandbox PRIVATE memory-map)
diff --git a/runtime/forbid_paths.c b/runtime/tracer/forbid_paths.c
similarity index 100%
rename from runtime/forbid_paths.c
rename to runtime/tracer/forbid_paths.c
diff --git a/runtime/forbid_paths.h b/runtime/tracer/forbid_paths.h
similarity index 100%
rename from runtime/forbid_paths.h
rename to runtime/tracer/forbid_paths.h
diff --git a/runtime/get_inferior_pkru.c b/runtime/tracer/get_inferior_pkru.c
similarity index 100%
rename from runtime/get_inferior_pkru.c
rename to runtime/tracer/get_inferior_pkru.c
diff --git a/runtime/get_inferior_pkru.h b/runtime/tracer/get_inferior_pkru.h
similarity index 100%
rename from runtime/get_inferior_pkru.h
rename to runtime/tracer/get_inferior_pkru.h
diff --git a/runtime/landlock.c b/runtime/tracer/landlock.c
similarity index 100%
rename from runtime/landlock.c
rename to runtime/tracer/landlock.c
diff --git a/runtime/landlock.h b/runtime/tracer/landlock.h
similarity index 100%
rename from runtime/landlock.h
rename to runtime/tracer/landlock.h
diff --git a/runtime/landlock_demo.c b/runtime/tracer/landlock_demo.c
similarity index 100%
rename from runtime/landlock_demo.c
rename to runtime/tracer/landlock_demo.c
diff --git a/runtime/landlock_syscall.h b/runtime/tracer/landlock_syscall.h
similarity index 100%
rename from runtime/landlock_syscall.h
rename to runtime/tracer/landlock_syscall.h
diff --git a/runtime/mem_region.h b/runtime/tracer/mem_region.h
similarity index 100%
rename from runtime/mem_region.h
rename to runtime/tracer/mem_region.h
diff --git a/runtime/memory-map/Cargo.toml b/runtime/tracer/memory-map/Cargo.toml
similarity index 100%
rename from runtime/memory-map/Cargo.toml
rename to runtime/tracer/memory-map/Cargo.toml
diff --git a/runtime/memory-map/cbindgen.toml b/runtime/tracer/memory-map/cbindgen.toml
similarity index 100%
rename from runtime/memory-map/cbindgen.toml
rename to runtime/tracer/memory-map/cbindgen.toml
diff --git a/runtime/memory-map/src/lib.rs b/runtime/tracer/memory-map/src/lib.rs
similarity index 100%
rename from runtime/memory-map/src/lib.rs
rename to runtime/tracer/memory-map/src/lib.rs
diff --git a/runtime/memory_map.h b/runtime/tracer/memory_map.h
similarity index 100%
rename from runtime/memory_map.h
rename to runtime/tracer/memory_map.h
diff --git a/runtime/mmap_event.c b/runtime/tracer/mmap_event.c
similarity index 100%
rename from runtime/mmap_event.c
rename to runtime/tracer/mmap_event.c
diff --git a/runtime/mmap_event.h b/runtime/tracer/mmap_event.h
similarity index 100%
rename from runtime/mmap_event.h
rename to runtime/tracer/mmap_event.h
diff --git a/runtime/read_pkru_demo.c b/runtime/tracer/read_pkru_demo.c
similarity index 100%
rename from runtime/read_pkru_demo.c
rename to runtime/tracer/read_pkru_demo.c
diff --git a/runtime/seccomp_filter.c b/runtime/tracer/seccomp_filter.c
similarity index 100%
rename from runtime/seccomp_filter.c
rename to runtime/tracer/seccomp_filter.c
diff --git a/runtime/seccomp_filter.h b/runtime/tracer/seccomp_filter.h
similarity index 100%
rename from runtime/seccomp_filter.h
rename to runtime/tracer/seccomp_filter.h
diff --git a/runtime/seccomp_filter_demo.c b/runtime/tracer/seccomp_filter_demo.c
similarity index 100%
rename from runtime/seccomp_filter_demo.c
rename to runtime/tracer/seccomp_filter_demo.c
diff --git a/runtime/start.c b/runtime/tracer/start.c
similarity index 100%
rename from runtime/start.c
rename to runtime/tracer/start.c
diff --git a/runtime/strv.c b/runtime/tracer/strv.c
similarity index 100%
rename from runtime/strv.c
rename to runtime/tracer/strv.c
diff --git a/runtime/strv.h b/runtime/tracer/strv.h
similarity index 100%
rename from runtime/strv.h
rename to runtime/tracer/strv.h
diff --git a/runtime/track_memory_map.c b/runtime/tracer/track_memory_map.c
similarity index 100%
rename from runtime/track_memory_map.c
rename to runtime/tracer/track_memory_map.c
diff --git a/runtime/track_memory_map.h b/runtime/tracer/track_memory_map.h
similarity index 100%
rename from runtime/track_memory_map.h
rename to runtime/tracer/track_memory_map.h
diff --git a/runtime/track_memory_map_demo.c b/runtime/tracer/track_memory_map_demo.c
similarity index 100%
rename from runtime/track_memory_map_demo.c
rename to runtime/tracer/track_memory_map_demo.c
diff --git a/rewriter/tests/CMakeLists.txt b/tests/CMakeLists.txt
similarity index 79%
rename from rewriter/tests/CMakeLists.txt
rename to tests/CMakeLists.txt
index 802688a520..f946f4a57c 100644
--- a/rewriter/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -2,9 +2,18 @@ include(CTest)
 
 enable_testing()
 
-include("../../cmake/define-ia2-wrapper.cmake")
-include("../../cmake/define-test.cmake")
-include("../../cmake/add-tls-padded-library.cmake")
+include("../cmake/define-ia2-wrapper.cmake")
+include("../cmake/define-test.cmake")
+include("../cmake/add-tls-padded-library.cmake")
+
+find_package(LLVM REQUIRED CONFIG)
+message(STATUS "Found LLVM: ${LLVM_DIR} (found version \"${LLVM_PACKAGE_VERSION}\")")
+find_package(Clang REQUIRED CONFIG)
+message(STATUS "Found Clang: ${Clang_DIR}")
+
+# We use the lit CMake functions from LLVM
+list(APPEND CMAKE_MODULE_PATH "${LLVM_CMAKE_DIR}")
+include(AddLLVM)
 
 configure_lit_site_cfg(
   ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.py.in
diff --git a/rewriter/tests/destructors/CMakeLists.txt b/tests/destructors/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/destructors/CMakeLists.txt
rename to tests/destructors/CMakeLists.txt
diff --git a/rewriter/tests/destructors/include/main/exported_fn.h b/tests/destructors/include/main/exported_fn.h
similarity index 100%
rename from rewriter/tests/destructors/include/main/exported_fn.h
rename to tests/destructors/include/main/exported_fn.h
diff --git a/rewriter/tests/destructors/include/plugin/plugin.h b/tests/destructors/include/plugin/plugin.h
similarity index 100%
rename from rewriter/tests/destructors/include/plugin/plugin.h
rename to tests/destructors/include/plugin/plugin.h
diff --git a/rewriter/tests/destructors/main.c b/tests/destructors/main.c
similarity index 100%
rename from rewriter/tests/destructors/main.c
rename to tests/destructors/main.c
diff --git a/rewriter/tests/destructors/plugin.c b/tests/destructors/plugin.c
similarity index 100%
rename from rewriter/tests/destructors/plugin.c
rename to tests/destructors/plugin.c
diff --git a/rewriter/tests/ffmpeg/CMakeLists.txt b/tests/ffmpeg/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/ffmpeg/CMakeLists.txt
rename to tests/ffmpeg/CMakeLists.txt
diff --git a/rewriter/tests/ffmpeg/ffmpeg.test b/tests/ffmpeg/ffmpeg.test
similarity index 100%
rename from rewriter/tests/ffmpeg/ffmpeg.test
rename to tests/ffmpeg/ffmpeg.test
diff --git a/rewriter/tests/ffmpeg/lit.local.cfg.py b/tests/ffmpeg/lit.local.cfg.py
similarity index 100%
rename from rewriter/tests/ffmpeg/lit.local.cfg.py
rename to tests/ffmpeg/lit.local.cfg.py
diff --git a/rewriter/tests/ffmpeg/main.c b/tests/ffmpeg/main.c
similarity index 100%
rename from rewriter/tests/ffmpeg/main.c
rename to tests/ffmpeg/main.c
diff --git a/rewriter/tests/global_fn_ptr/CMakeLists.txt b/tests/global_fn_ptr/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/global_fn_ptr/CMakeLists.txt
rename to tests/global_fn_ptr/CMakeLists.txt
diff --git a/rewriter/tests/global_fn_ptr/Output/operations.out b/tests/global_fn_ptr/Output/operations.out
similarity index 100%
rename from rewriter/tests/global_fn_ptr/Output/operations.out
rename to tests/global_fn_ptr/Output/operations.out
diff --git a/rewriter/tests/global_fn_ptr/include/operations.h b/tests/global_fn_ptr/include/operations.h
similarity index 100%
rename from rewriter/tests/global_fn_ptr/include/operations.h
rename to tests/global_fn_ptr/include/operations.h
diff --git a/rewriter/tests/global_fn_ptr/main.c b/tests/global_fn_ptr/main.c
similarity index 100%
rename from rewriter/tests/global_fn_ptr/main.c
rename to tests/global_fn_ptr/main.c
diff --git a/rewriter/tests/global_fn_ptr/operations.c b/tests/global_fn_ptr/operations.c
similarity index 100%
rename from rewriter/tests/global_fn_ptr/operations.c
rename to tests/global_fn_ptr/operations.c
diff --git a/rewriter/tests/header_includes/CMakeLists.txt b/tests/header_includes/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/header_includes/CMakeLists.txt
rename to tests/header_includes/CMakeLists.txt
diff --git a/rewriter/tests/header_includes/impl.c b/tests/header_includes/impl.c
similarity index 100%
rename from rewriter/tests/header_includes/impl.c
rename to tests/header_includes/impl.c
diff --git a/rewriter/tests/header_includes/include/impl.h b/tests/header_includes/include/impl.h
similarity index 100%
rename from rewriter/tests/header_includes/include/impl.h
rename to tests/header_includes/include/impl.h
diff --git a/rewriter/tests/header_includes/include/liboption.h b/tests/header_includes/include/liboption.h
similarity index 100%
rename from rewriter/tests/header_includes/include/liboption.h
rename to tests/header_includes/include/liboption.h
diff --git a/rewriter/tests/header_includes/include/types.h b/tests/header_includes/include/types.h
similarity index 100%
rename from rewriter/tests/header_includes/include/types.h
rename to tests/header_includes/include/types.h
diff --git a/rewriter/tests/header_includes/liboption.c b/tests/header_includes/liboption.c
similarity index 100%
rename from rewriter/tests/header_includes/liboption.c
rename to tests/header_includes/liboption.c
diff --git a/rewriter/tests/header_includes/lit.local.cfg b/tests/header_includes/lit.local.cfg
similarity index 100%
rename from rewriter/tests/header_includes/lit.local.cfg
rename to tests/header_includes/lit.local.cfg
diff --git a/rewriter/tests/header_includes/main.c b/tests/header_includes/main.c
similarity index 100%
rename from rewriter/tests/header_includes/main.c
rename to tests/header_includes/main.c
diff --git a/rewriter/tests/heap_two_keys/CMakeLists.txt b/tests/heap_two_keys/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/heap_two_keys/CMakeLists.txt
rename to tests/heap_two_keys/CMakeLists.txt
diff --git a/rewriter/tests/heap_two_keys/Output/clean_exit.out b/tests/heap_two_keys/Output/clean_exit.out
similarity index 100%
rename from rewriter/tests/heap_two_keys/Output/clean_exit.out
rename to tests/heap_two_keys/Output/clean_exit.out
diff --git a/rewriter/tests/heap_two_keys/Output/fault.out b/tests/heap_two_keys/Output/fault.out
similarity index 100%
rename from rewriter/tests/heap_two_keys/Output/fault.out
rename to tests/heap_two_keys/Output/fault.out
diff --git a/rewriter/tests/heap_two_keys/include/main/exported_fn.h b/tests/heap_two_keys/include/main/exported_fn.h
similarity index 100%
rename from rewriter/tests/heap_two_keys/include/main/exported_fn.h
rename to tests/heap_two_keys/include/main/exported_fn.h
diff --git a/rewriter/tests/heap_two_keys/include/plugin/plugin.h b/tests/heap_two_keys/include/plugin/plugin.h
similarity index 100%
rename from rewriter/tests/heap_two_keys/include/plugin/plugin.h
rename to tests/heap_two_keys/include/plugin/plugin.h
diff --git a/rewriter/tests/heap_two_keys/main.c b/tests/heap_two_keys/main.c
similarity index 100%
rename from rewriter/tests/heap_two_keys/main.c
rename to tests/heap_two_keys/main.c
diff --git a/rewriter/tests/heap_two_keys/plugin.c b/tests/heap_two_keys/plugin.c
similarity index 100%
rename from rewriter/tests/heap_two_keys/plugin.c
rename to tests/heap_two_keys/plugin.c
diff --git a/rewriter/tests/libusb/CMakeLists.txt b/tests/libusb/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/libusb/CMakeLists.txt
rename to tests/libusb/CMakeLists.txt
diff --git a/rewriter/tests/libusb/include/libusb.h.head b/tests/libusb/include/libusb.h.head
similarity index 100%
rename from rewriter/tests/libusb/include/libusb.h.head
rename to tests/libusb/include/libusb.h.head
diff --git a/rewriter/tests/libusb/include/libusb.h.typedef-checks b/tests/libusb/include/libusb.h.typedef-checks
similarity index 100%
rename from rewriter/tests/libusb/include/libusb.h.typedef-checks
rename to tests/libusb/include/libusb.h.typedef-checks
diff --git a/rewriter/tests/libusb/libusb.test b/tests/libusb/libusb.test
similarity index 100%
rename from rewriter/tests/libusb/libusb.test
rename to tests/libusb/libusb.test
diff --git a/rewriter/tests/libusb/lit.local.cfg.py b/tests/libusb/lit.local.cfg.py
similarity index 100%
rename from rewriter/tests/libusb/lit.local.cfg.py
rename to tests/libusb/lit.local.cfg.py
diff --git a/rewriter/tests/libusb/main.c b/tests/libusb/main.c
similarity index 100%
rename from rewriter/tests/libusb/main.c
rename to tests/libusb/main.c
diff --git a/rewriter/tests/lit.cfg.py b/tests/lit.cfg.py
similarity index 93%
rename from rewriter/tests/lit.cfg.py
rename to tests/lit.cfg.py
index 0c38818cd5..6a35ad020b 100644
--- a/rewriter/tests/lit.cfg.py
+++ b/tests/lit.cfg.py
@@ -49,14 +49,14 @@
 # test_source_root: The root path where tests are located.
 config.test_source_root = os.path.dirname(__file__)
 
-llvm_config.add_tool_substitutions([ToolSubst('ia2-rewriter')], search_dirs=config.ia2_obj_root)
+llvm_config.add_tool_substitutions([ToolSubst('ia2-rewriter')], search_dirs=os.path.join(config.ia2_obj_root, "tools", "rewriter"))
 
 llvm_config.use_default_substitutions()
 llvm_config.use_clang()
 
 config.substitutions.extend([
     ('%ia2_generate_checks', '%s/tests/generate-checks.sh' % config.ia2_src_root),
-    ('%ia2_include', '%s/../include' % config.ia2_src_root),
+    ('%ia2_include', '%s/libia2/include' % config.ia2_src_root),
     ('%binary_dir', config.ia2_obj_root),
     ('%source_dir', config.ia2_src_root)
 ])
diff --git a/rewriter/tests/lit.site.cfg.py.in b/tests/lit.site.cfg.py.in
similarity index 94%
rename from rewriter/tests/lit.site.cfg.py.in
rename to tests/lit.site.cfg.py.in
index 0143b5db0b..1c3295f7b5 100644
--- a/rewriter/tests/lit.site.cfg.py.in
+++ b/tests/lit.site.cfg.py.in
@@ -4,8 +4,8 @@ import sys
 
 config.host_triple = "@LLVM_HOST_TRIPLE@"
 config.target_triple = "@LLVM_TARGET_TRIPLE@" or "@TARGET_TRIPLE@"
-config.ia2_src_root = r"@IA2_SOURCE_DIR@"
-config.ia2_obj_root = r"@IA2_BINARY_DIR@"
+config.ia2_src_root = r"@CMAKE_SOURCE_DIR@"
+config.ia2_obj_root = r"@CMAKE_BINARY_DIR@"
 config.llvm_tools_dir = r"@LLVM_TOOLS_DIR@"
 config.llvm_lib_dir = r"@LLVM_LIBS_DIR@"
 config.llvm_shlib_dir = r"@SHLIBDIR@"
diff --git a/rewriter/tests/macro_attr/CMakeLists.txt b/tests/macro_attr/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/macro_attr/CMakeLists.txt
rename to tests/macro_attr/CMakeLists.txt
diff --git a/rewriter/tests/macro_attr/functions.c b/tests/macro_attr/functions.c
similarity index 100%
rename from rewriter/tests/macro_attr/functions.c
rename to tests/macro_attr/functions.c
diff --git a/rewriter/tests/macro_attr/include/functions.h b/tests/macro_attr/include/functions.h
similarity index 100%
rename from rewriter/tests/macro_attr/include/functions.h
rename to tests/macro_attr/include/functions.h
diff --git a/rewriter/tests/macro_attr/main.c b/tests/macro_attr/main.c
similarity index 100%
rename from rewriter/tests/macro_attr/main.c
rename to tests/macro_attr/main.c
diff --git a/rewriter/tests/minimal/CMakeLists.txt b/tests/minimal/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/minimal/CMakeLists.txt
rename to tests/minimal/CMakeLists.txt
diff --git a/rewriter/tests/minimal/Output/minimal.out b/tests/minimal/Output/minimal.out
similarity index 100%
rename from rewriter/tests/minimal/Output/minimal.out
rename to tests/minimal/Output/minimal.out
diff --git a/rewriter/tests/minimal/include/minimal.h b/tests/minimal/include/minimal.h
similarity index 100%
rename from rewriter/tests/minimal/include/minimal.h
rename to tests/minimal/include/minimal.h
diff --git a/rewriter/tests/minimal/main.c b/tests/minimal/main.c
similarity index 100%
rename from rewriter/tests/minimal/main.c
rename to tests/minimal/main.c
diff --git a/rewriter/tests/minimal/minimal.c b/tests/minimal/minimal.c
similarity index 100%
rename from rewriter/tests/minimal/minimal.c
rename to tests/minimal/minimal.c
diff --git a/rewriter/tests/mmap_loop/CMakeLists.txt b/tests/mmap_loop/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/mmap_loop/CMakeLists.txt
rename to tests/mmap_loop/CMakeLists.txt
diff --git a/rewriter/tests/mmap_loop/Output/mmap_loop.out b/tests/mmap_loop/Output/mmap_loop.out
similarity index 100%
rename from rewriter/tests/mmap_loop/Output/mmap_loop.out
rename to tests/mmap_loop/Output/mmap_loop.out
diff --git a/rewriter/tests/mmap_loop/include/mmap_loop.h b/tests/mmap_loop/include/mmap_loop.h
similarity index 100%
rename from rewriter/tests/mmap_loop/include/mmap_loop.h
rename to tests/mmap_loop/include/mmap_loop.h
diff --git a/rewriter/tests/mmap_loop/main.c b/tests/mmap_loop/main.c
similarity index 100%
rename from rewriter/tests/mmap_loop/main.c
rename to tests/mmap_loop/main.c
diff --git a/rewriter/tests/mmap_loop/mmap_loop.c b/tests/mmap_loop/mmap_loop.c
similarity index 100%
rename from rewriter/tests/mmap_loop/mmap_loop.c
rename to tests/mmap_loop/mmap_loop.c
diff --git a/rewriter/tests/namespaces/CMakeLists.txt b/tests/namespaces/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/namespaces/CMakeLists.txt
rename to tests/namespaces/CMakeLists.txt
diff --git a/rewriter/tests/namespaces/main.cpp b/tests/namespaces/main.cpp
similarity index 100%
rename from rewriter/tests/namespaces/main.cpp
rename to tests/namespaces/main.cpp
diff --git a/rewriter/tests/namespaces/random.cpp b/tests/namespaces/random.cpp
similarity index 100%
rename from rewriter/tests/namespaces/random.cpp
rename to tests/namespaces/random.cpp
diff --git a/rewriter/tests/namespaces/random.hpp b/tests/namespaces/random.hpp
similarity index 100%
rename from rewriter/tests/namespaces/random.hpp
rename to tests/namespaces/random.hpp
diff --git a/rewriter/tests/omit_wrappers/library.h b/tests/omit_wrappers/library.h
similarity index 100%
rename from rewriter/tests/omit_wrappers/library.h
rename to tests/omit_wrappers/library.h
diff --git a/rewriter/tests/permissive_mode/CMakeLists.txt b/tests/permissive_mode/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/permissive_mode/CMakeLists.txt
rename to tests/permissive_mode/CMakeLists.txt
diff --git a/rewriter/tests/permissive_mode/permissive_mode.c b/tests/permissive_mode/permissive_mode.c
similarity index 100%
rename from rewriter/tests/permissive_mode/permissive_mode.c
rename to tests/permissive_mode/permissive_mode.c
diff --git a/rewriter/tests/protected_threads/CMakeLists.txt b/tests/protected_threads/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/protected_threads/CMakeLists.txt
rename to tests/protected_threads/CMakeLists.txt
diff --git a/rewriter/tests/protected_threads/include/library.h b/tests/protected_threads/include/library.h
similarity index 100%
rename from rewriter/tests/protected_threads/include/library.h
rename to tests/protected_threads/include/library.h
diff --git a/rewriter/tests/protected_threads/library.c b/tests/protected_threads/library.c
similarity index 100%
rename from rewriter/tests/protected_threads/library.c
rename to tests/protected_threads/library.c
diff --git a/rewriter/tests/protected_threads/main.c b/tests/protected_threads/main.c
similarity index 100%
rename from rewriter/tests/protected_threads/main.c
rename to tests/protected_threads/main.c
diff --git a/rewriter/tests/read_config/CMakeLists.txt b/tests/read_config/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/read_config/CMakeLists.txt
rename to tests/read_config/CMakeLists.txt
diff --git a/rewriter/tests/read_config/Output/read_config.out b/tests/read_config/Output/read_config.out
similarity index 100%
rename from rewriter/tests/read_config/Output/read_config.out
rename to tests/read_config/Output/read_config.out
diff --git a/rewriter/tests/read_config/builtin.c b/tests/read_config/builtin.c
similarity index 100%
rename from rewriter/tests/read_config/builtin.c
rename to tests/read_config/builtin.c
diff --git a/rewriter/tests/read_config/include/core.h b/tests/read_config/include/core.h
similarity index 100%
rename from rewriter/tests/read_config/include/core.h
rename to tests/read_config/include/core.h
diff --git a/rewriter/tests/read_config/include/plugin.h b/tests/read_config/include/plugin.h
similarity index 100%
rename from rewriter/tests/read_config/include/plugin.h
rename to tests/read_config/include/plugin.h
diff --git a/rewriter/tests/read_config/lit.local.cfg b/tests/read_config/lit.local.cfg
similarity index 100%
rename from rewriter/tests/read_config/lit.local.cfg
rename to tests/read_config/lit.local.cfg
diff --git a/rewriter/tests/read_config/main.c b/tests/read_config/main.c
similarity index 100%
rename from rewriter/tests/read_config/main.c
rename to tests/read_config/main.c
diff --git a/rewriter/tests/read_config/plugin.c b/tests/read_config/plugin.c
similarity index 100%
rename from rewriter/tests/read_config/plugin.c
rename to tests/read_config/plugin.c
diff --git a/rewriter/tests/recursion/CMakeLists.txt b/tests/recursion/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/recursion/CMakeLists.txt
rename to tests/recursion/CMakeLists.txt
diff --git a/rewriter/tests/recursion/Output/recursion.out b/tests/recursion/Output/recursion.out
similarity index 100%
rename from rewriter/tests/recursion/Output/recursion.out
rename to tests/recursion/Output/recursion.out
diff --git a/rewriter/tests/recursion/dso.c b/tests/recursion/dso.c
similarity index 100%
rename from rewriter/tests/recursion/dso.c
rename to tests/recursion/dso.c
diff --git a/rewriter/tests/recursion/include/dso/recursion_dso.h b/tests/recursion/include/dso/recursion_dso.h
similarity index 100%
rename from rewriter/tests/recursion/include/dso/recursion_dso.h
rename to tests/recursion/include/dso/recursion_dso.h
diff --git a/rewriter/tests/recursion/include/main/recursion_main.h b/tests/recursion/include/main/recursion_main.h
similarity index 100%
rename from rewriter/tests/recursion/include/main/recursion_main.h
rename to tests/recursion/include/main/recursion_main.h
diff --git a/rewriter/tests/recursion/main.c b/tests/recursion/main.c
similarity index 100%
rename from rewriter/tests/recursion/main.c
rename to tests/recursion/main.c
diff --git a/rewriter/tests/rewrite_fn_ptr_eq/CMakeLists.txt b/tests/rewrite_fn_ptr_eq/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/rewrite_fn_ptr_eq/CMakeLists.txt
rename to tests/rewrite_fn_ptr_eq/CMakeLists.txt
diff --git a/rewriter/tests/rewrite_fn_ptr_eq/include/lib.h b/tests/rewrite_fn_ptr_eq/include/lib.h
similarity index 100%
rename from rewriter/tests/rewrite_fn_ptr_eq/include/lib.h
rename to tests/rewrite_fn_ptr_eq/include/lib.h
diff --git a/rewriter/tests/rewrite_fn_ptr_eq/lib.c b/tests/rewrite_fn_ptr_eq/lib.c
similarity index 100%
rename from rewriter/tests/rewrite_fn_ptr_eq/lib.c
rename to tests/rewrite_fn_ptr_eq/lib.c
diff --git a/rewriter/tests/rewrite_fn_ptr_eq/main.c b/tests/rewrite_fn_ptr_eq/main.c
similarity index 100%
rename from rewriter/tests/rewrite_fn_ptr_eq/main.c
rename to tests/rewrite_fn_ptr_eq/main.c
diff --git a/rewriter/tests/rewrite_macros/CMakeLists.txt b/tests/rewrite_macros/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/rewrite_macros/CMakeLists.txt
rename to tests/rewrite_macros/CMakeLists.txt
diff --git a/rewriter/tests/rewrite_macros/include/lib.h b/tests/rewrite_macros/include/lib.h
similarity index 100%
rename from rewriter/tests/rewrite_macros/include/lib.h
rename to tests/rewrite_macros/include/lib.h
diff --git a/rewriter/tests/rewrite_macros/lib.c b/tests/rewrite_macros/lib.c
similarity index 100%
rename from rewriter/tests/rewrite_macros/lib.c
rename to tests/rewrite_macros/lib.c
diff --git a/rewriter/tests/rewrite_macros/main.c b/tests/rewrite_macros/main.c
similarity index 100%
rename from rewriter/tests/rewrite_macros/main.c
rename to tests/rewrite_macros/main.c
diff --git a/rewriter/tests/ro_sharing/CMakeLists.txt b/tests/ro_sharing/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/ro_sharing/CMakeLists.txt
rename to tests/ro_sharing/CMakeLists.txt
diff --git a/rewriter/tests/ro_sharing/Output/main.out b/tests/ro_sharing/Output/main.out
similarity index 100%
rename from rewriter/tests/ro_sharing/Output/main.out
rename to tests/ro_sharing/Output/main.out
diff --git a/rewriter/tests/ro_sharing/Output/plugin.out b/tests/ro_sharing/Output/plugin.out
similarity index 100%
rename from rewriter/tests/ro_sharing/Output/plugin.out
rename to tests/ro_sharing/Output/plugin.out
diff --git a/rewriter/tests/ro_sharing/include/plugin.h b/tests/ro_sharing/include/plugin.h
similarity index 100%
rename from rewriter/tests/ro_sharing/include/plugin.h
rename to tests/ro_sharing/include/plugin.h
diff --git a/rewriter/tests/ro_sharing/main.c b/tests/ro_sharing/main.c
similarity index 100%
rename from rewriter/tests/ro_sharing/main.c
rename to tests/ro_sharing/main.c
diff --git a/rewriter/tests/ro_sharing/plugin.c b/tests/ro_sharing/plugin.c
similarity index 100%
rename from rewriter/tests/ro_sharing/plugin.c
rename to tests/ro_sharing/plugin.c
diff --git a/rewriter/tests/shared_data/CMakeLists.txt b/tests/shared_data/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/shared_data/CMakeLists.txt
rename to tests/shared_data/CMakeLists.txt
diff --git a/rewriter/tests/shared_data/Output/shared_data.out b/tests/shared_data/Output/shared_data.out
similarity index 100%
rename from rewriter/tests/shared_data/Output/shared_data.out
rename to tests/shared_data/Output/shared_data.out
diff --git a/rewriter/tests/shared_data/access_shared.c b/tests/shared_data/access_shared.c
similarity index 100%
rename from rewriter/tests/shared_data/access_shared.c
rename to tests/shared_data/access_shared.c
diff --git a/rewriter/tests/shared_data/include/access_shared.h b/tests/shared_data/include/access_shared.h
similarity index 100%
rename from rewriter/tests/shared_data/include/access_shared.h
rename to tests/shared_data/include/access_shared.h
diff --git a/rewriter/tests/shared_data/main.c b/tests/shared_data/main.c
similarity index 100%
rename from rewriter/tests/shared_data/main.c
rename to tests/shared_data/main.c
diff --git a/rewriter/tests/should_segfault/CMakeLists.txt b/tests/should_segfault/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/should_segfault/CMakeLists.txt
rename to tests/should_segfault/CMakeLists.txt
diff --git a/rewriter/tests/should_segfault/Output/early_segfault.out b/tests/should_segfault/Output/early_segfault.out
similarity index 100%
rename from rewriter/tests/should_segfault/Output/early_segfault.out
rename to tests/should_segfault/Output/early_segfault.out
diff --git a/rewriter/tests/should_segfault/Output/should_segfault.out b/tests/should_segfault/Output/should_segfault.out
similarity index 100%
rename from rewriter/tests/should_segfault/Output/should_segfault.out
rename to tests/should_segfault/Output/should_segfault.out
diff --git a/rewriter/tests/should_segfault/include/print_secret.h b/tests/should_segfault/include/print_secret.h
similarity index 100%
rename from rewriter/tests/should_segfault/include/print_secret.h
rename to tests/should_segfault/include/print_secret.h
diff --git a/rewriter/tests/should_segfault/main.c b/tests/should_segfault/main.c
similarity index 100%
rename from rewriter/tests/should_segfault/main.c
rename to tests/should_segfault/main.c
diff --git a/rewriter/tests/should_segfault/print_secret.c b/tests/should_segfault/print_secret.c
similarity index 100%
rename from rewriter/tests/should_segfault/print_secret.c
rename to tests/should_segfault/print_secret.c
diff --git a/rewriter/tests/sighandler/CMakeLists.txt b/tests/sighandler/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/sighandler/CMakeLists.txt
rename to tests/sighandler/CMakeLists.txt
diff --git a/rewriter/tests/sighandler/Output/main.out b/tests/sighandler/Output/main.out
similarity index 100%
rename from rewriter/tests/sighandler/Output/main.out
rename to tests/sighandler/Output/main.out
diff --git a/rewriter/tests/sighandler/include/lib.h b/tests/sighandler/include/lib.h
similarity index 100%
rename from rewriter/tests/sighandler/include/lib.h
rename to tests/sighandler/include/lib.h
diff --git a/rewriter/tests/sighandler/lib.c b/tests/sighandler/lib.c
similarity index 100%
rename from rewriter/tests/sighandler/lib.c
rename to tests/sighandler/lib.c
diff --git a/rewriter/tests/sighandler/main.c b/tests/sighandler/main.c
similarity index 100%
rename from rewriter/tests/sighandler/main.c
rename to tests/sighandler/main.c
diff --git a/rewriter/tests/simple1/CMakeLists.txt b/tests/simple1/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/simple1/CMakeLists.txt
rename to tests/simple1/CMakeLists.txt
diff --git a/rewriter/tests/simple1/include/hooks.h b/tests/simple1/include/hooks.h
similarity index 100%
rename from rewriter/tests/simple1/include/hooks.h
rename to tests/simple1/include/hooks.h
diff --git a/rewriter/tests/simple1/include/simple1.h b/tests/simple1/include/simple1.h
similarity index 100%
rename from rewriter/tests/simple1/include/simple1.h
rename to tests/simple1/include/simple1.h
diff --git a/rewriter/tests/simple1/main.c b/tests/simple1/main.c
similarity index 100%
rename from rewriter/tests/simple1/main.c
rename to tests/simple1/main.c
diff --git a/rewriter/tests/simple1/simple1.c b/tests/simple1/simple1.c
similarity index 100%
rename from rewriter/tests/simple1/simple1.c
rename to tests/simple1/simple1.c
diff --git a/rewriter/tests/structs/CMakeLists.txt b/tests/structs/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/structs/CMakeLists.txt
rename to tests/structs/CMakeLists.txt
diff --git a/rewriter/tests/structs/Output/structs.out b/tests/structs/Output/structs.out
similarity index 100%
rename from rewriter/tests/structs/Output/structs.out
rename to tests/structs/Output/structs.out
diff --git a/rewriter/tests/structs/include/structs.h b/tests/structs/include/structs.h
similarity index 100%
rename from rewriter/tests/structs/include/structs.h
rename to tests/structs/include/structs.h
diff --git a/rewriter/tests/structs/main.c b/tests/structs/main.c
similarity index 100%
rename from rewriter/tests/structs/main.c
rename to tests/structs/main.c
diff --git a/rewriter/tests/structs/structs.c b/tests/structs/structs.c
similarity index 100%
rename from rewriter/tests/structs/structs.c
rename to tests/structs/structs.c
diff --git a/rewriter/tests/threads/CMakeLists.txt b/tests/threads/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/threads/CMakeLists.txt
rename to tests/threads/CMakeLists.txt
diff --git a/rewriter/tests/threads/Output/threads.out b/tests/threads/Output/threads.out
similarity index 100%
rename from rewriter/tests/threads/Output/threads.out
rename to tests/threads/Output/threads.out
diff --git a/rewriter/tests/threads/include/library.h b/tests/threads/include/library.h
similarity index 100%
rename from rewriter/tests/threads/include/library.h
rename to tests/threads/include/library.h
diff --git a/rewriter/tests/threads/library.c b/tests/threads/library.c
similarity index 100%
rename from rewriter/tests/threads/library.c
rename to tests/threads/library.c
diff --git a/rewriter/tests/threads/main.c b/tests/threads/main.c
similarity index 100%
rename from rewriter/tests/threads/main.c
rename to tests/threads/main.c
diff --git a/rewriter/tests/tls_protected/CMakeLists.txt b/tests/tls_protected/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/tls_protected/CMakeLists.txt
rename to tests/tls_protected/CMakeLists.txt
diff --git a/rewriter/tests/tls_protected/Output/tls_protected_lib.out b/tests/tls_protected/Output/tls_protected_lib.out
similarity index 100%
rename from rewriter/tests/tls_protected/Output/tls_protected_lib.out
rename to tests/tls_protected/Output/tls_protected_lib.out
diff --git a/rewriter/tests/tls_protected/Output/tls_protected_main.out b/tests/tls_protected/Output/tls_protected_main.out
similarity index 100%
rename from rewriter/tests/tls_protected/Output/tls_protected_main.out
rename to tests/tls_protected/Output/tls_protected_main.out
diff --git a/rewriter/tests/tls_protected/include/library.h b/tests/tls_protected/include/library.h
similarity index 100%
rename from rewriter/tests/tls_protected/include/library.h
rename to tests/tls_protected/include/library.h
diff --git a/rewriter/tests/tls_protected/library.c b/tests/tls_protected/library.c
similarity index 100%
rename from rewriter/tests/tls_protected/library.c
rename to tests/tls_protected/library.c
diff --git a/rewriter/tests/tls_protected/main.c b/tests/tls_protected/main.c
similarity index 100%
rename from rewriter/tests/tls_protected/main.c
rename to tests/tls_protected/main.c
diff --git a/rewriter/tests/trusted_direct/CMakeLists.txt b/tests/trusted_direct/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/trusted_direct/CMakeLists.txt
rename to tests/trusted_direct/CMakeLists.txt
diff --git a/rewriter/tests/trusted_direct/Output/trusted_direct.clean_exit.out b/tests/trusted_direct/Output/trusted_direct.clean_exit.out
similarity index 100%
rename from rewriter/tests/trusted_direct/Output/trusted_direct.clean_exit.out
rename to tests/trusted_direct/Output/trusted_direct.clean_exit.out
diff --git a/rewriter/tests/trusted_direct/Output/trusted_direct.out b/tests/trusted_direct/Output/trusted_direct.out
similarity index 100%
rename from rewriter/tests/trusted_direct/Output/trusted_direct.out
rename to tests/trusted_direct/Output/trusted_direct.out
diff --git a/rewriter/tests/trusted_direct/include/main/exported_fn.h b/tests/trusted_direct/include/main/exported_fn.h
similarity index 100%
rename from rewriter/tests/trusted_direct/include/main/exported_fn.h
rename to tests/trusted_direct/include/main/exported_fn.h
diff --git a/rewriter/tests/trusted_direct/include/plugin/plugin.h b/tests/trusted_direct/include/plugin/plugin.h
similarity index 100%
rename from rewriter/tests/trusted_direct/include/plugin/plugin.h
rename to tests/trusted_direct/include/plugin/plugin.h
diff --git a/rewriter/tests/trusted_direct/main.c b/tests/trusted_direct/main.c
similarity index 100%
rename from rewriter/tests/trusted_direct/main.c
rename to tests/trusted_direct/main.c
diff --git a/rewriter/tests/trusted_direct/plugin.c b/tests/trusted_direct/plugin.c
similarity index 100%
rename from rewriter/tests/trusted_direct/plugin.c
rename to tests/trusted_direct/plugin.c
diff --git a/rewriter/tests/trusted_indirect/CMakeLists.txt b/tests/trusted_indirect/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/trusted_indirect/CMakeLists.txt
rename to tests/trusted_indirect/CMakeLists.txt
diff --git a/rewriter/tests/trusted_indirect/Output/trusted_indirect.clean_exit.out b/tests/trusted_indirect/Output/trusted_indirect.clean_exit.out
similarity index 100%
rename from rewriter/tests/trusted_indirect/Output/trusted_indirect.clean_exit.out
rename to tests/trusted_indirect/Output/trusted_indirect.clean_exit.out
diff --git a/rewriter/tests/trusted_indirect/Output/trusted_indirect.out b/tests/trusted_indirect/Output/trusted_indirect.out
similarity index 100%
rename from rewriter/tests/trusted_indirect/Output/trusted_indirect.out
rename to tests/trusted_indirect/Output/trusted_indirect.out
diff --git a/rewriter/tests/trusted_indirect/include/rand_op.h b/tests/trusted_indirect/include/rand_op.h
similarity index 100%
rename from rewriter/tests/trusted_indirect/include/rand_op.h
rename to tests/trusted_indirect/include/rand_op.h
diff --git a/rewriter/tests/trusted_indirect/main.c b/tests/trusted_indirect/main.c
similarity index 100%
rename from rewriter/tests/trusted_indirect/main.c
rename to tests/trusted_indirect/main.c
diff --git a/rewriter/tests/trusted_indirect/rand_op.c b/tests/trusted_indirect/rand_op.c
similarity index 100%
rename from rewriter/tests/trusted_indirect/rand_op.c
rename to tests/trusted_indirect/rand_op.c
diff --git a/rewriter/tests/two_keys_minimal/CMakeLists.txt b/tests/two_keys_minimal/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/two_keys_minimal/CMakeLists.txt
rename to tests/two_keys_minimal/CMakeLists.txt
diff --git a/rewriter/tests/two_keys_minimal/Output/clean_exit.out b/tests/two_keys_minimal/Output/clean_exit.out
similarity index 100%
rename from rewriter/tests/two_keys_minimal/Output/clean_exit.out
rename to tests/two_keys_minimal/Output/clean_exit.out
diff --git a/rewriter/tests/two_keys_minimal/Output/main.out b/tests/two_keys_minimal/Output/main.out
similarity index 100%
rename from rewriter/tests/two_keys_minimal/Output/main.out
rename to tests/two_keys_minimal/Output/main.out
diff --git a/rewriter/tests/two_keys_minimal/Output/plugin.out b/tests/two_keys_minimal/Output/plugin.out
similarity index 100%
rename from rewriter/tests/two_keys_minimal/Output/plugin.out
rename to tests/two_keys_minimal/Output/plugin.out
diff --git a/rewriter/tests/two_keys_minimal/include/main/exported_fn.h b/tests/two_keys_minimal/include/main/exported_fn.h
similarity index 100%
rename from rewriter/tests/two_keys_minimal/include/main/exported_fn.h
rename to tests/two_keys_minimal/include/main/exported_fn.h
diff --git a/rewriter/tests/two_keys_minimal/include/plugin/plugin.h b/tests/two_keys_minimal/include/plugin/plugin.h
similarity index 100%
rename from rewriter/tests/two_keys_minimal/include/plugin/plugin.h
rename to tests/two_keys_minimal/include/plugin/plugin.h
diff --git a/rewriter/tests/two_keys_minimal/main.c b/tests/two_keys_minimal/main.c
similarity index 100%
rename from rewriter/tests/two_keys_minimal/main.c
rename to tests/two_keys_minimal/main.c
diff --git a/rewriter/tests/two_keys_minimal/plugin.c b/tests/two_keys_minimal/plugin.c
similarity index 100%
rename from rewriter/tests/two_keys_minimal/plugin.c
rename to tests/two_keys_minimal/plugin.c
diff --git a/rewriter/tests/two_shared_ranges/CMakeLists.txt b/tests/two_shared_ranges/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/two_shared_ranges/CMakeLists.txt
rename to tests/two_shared_ranges/CMakeLists.txt
diff --git a/rewriter/tests/two_shared_ranges/Output/clean_exit.out b/tests/two_shared_ranges/Output/clean_exit.out
similarity index 100%
rename from rewriter/tests/two_shared_ranges/Output/clean_exit.out
rename to tests/two_shared_ranges/Output/clean_exit.out
diff --git a/rewriter/tests/two_shared_ranges/Output/main.out b/tests/two_shared_ranges/Output/main.out
similarity index 100%
rename from rewriter/tests/two_shared_ranges/Output/main.out
rename to tests/two_shared_ranges/Output/main.out
diff --git a/rewriter/tests/two_shared_ranges/Output/plugin.out b/tests/two_shared_ranges/Output/plugin.out
similarity index 100%
rename from rewriter/tests/two_shared_ranges/Output/plugin.out
rename to tests/two_shared_ranges/Output/plugin.out
diff --git a/rewriter/tests/two_shared_ranges/include/main/exported_fn.h b/tests/two_shared_ranges/include/main/exported_fn.h
similarity index 100%
rename from rewriter/tests/two_shared_ranges/include/main/exported_fn.h
rename to tests/two_shared_ranges/include/main/exported_fn.h
diff --git a/rewriter/tests/two_shared_ranges/include/plugin/plugin.h b/tests/two_shared_ranges/include/plugin/plugin.h
similarity index 100%
rename from rewriter/tests/two_shared_ranges/include/plugin/plugin.h
rename to tests/two_shared_ranges/include/plugin/plugin.h
diff --git a/rewriter/tests/two_shared_ranges/main.c b/tests/two_shared_ranges/main.c
similarity index 100%
rename from rewriter/tests/two_shared_ranges/main.c
rename to tests/two_shared_ranges/main.c
diff --git a/rewriter/tests/two_shared_ranges/plugin.c b/tests/two_shared_ranges/plugin.c
similarity index 100%
rename from rewriter/tests/two_shared_ranges/plugin.c
rename to tests/two_shared_ranges/plugin.c
diff --git a/rewriter/tests/untrusted_indirect/CMakeLists.txt b/tests/untrusted_indirect/CMakeLists.txt
similarity index 100%
rename from rewriter/tests/untrusted_indirect/CMakeLists.txt
rename to tests/untrusted_indirect/CMakeLists.txt
diff --git a/rewriter/tests/untrusted_indirect/Output/untrusted_indirect.clean_exit.out b/tests/untrusted_indirect/Output/untrusted_indirect.clean_exit.out
similarity index 100%
rename from rewriter/tests/untrusted_indirect/Output/untrusted_indirect.clean_exit.out
rename to tests/untrusted_indirect/Output/untrusted_indirect.clean_exit.out
diff --git a/rewriter/tests/untrusted_indirect/Output/untrusted_indirect.out b/tests/untrusted_indirect/Output/untrusted_indirect.out
similarity index 100%
rename from rewriter/tests/untrusted_indirect/Output/untrusted_indirect.out
rename to tests/untrusted_indirect/Output/untrusted_indirect.out
diff --git a/rewriter/tests/untrusted_indirect/foo.c b/tests/untrusted_indirect/foo.c
similarity index 100%
rename from rewriter/tests/untrusted_indirect/foo.c
rename to tests/untrusted_indirect/foo.c
diff --git a/rewriter/tests/untrusted_indirect/include/foo.h b/tests/untrusted_indirect/include/foo.h
similarity index 100%
rename from rewriter/tests/untrusted_indirect/include/foo.h
rename to tests/untrusted_indirect/include/foo.h
diff --git a/rewriter/tests/untrusted_indirect/main.c b/tests/untrusted_indirect/main.c
similarity index 100%
rename from rewriter/tests/untrusted_indirect/main.c
rename to tests/untrusted_indirect/main.c
diff --git a/tools/CMakeLists.txt b/tools/CMakeLists.txt
new file mode 100644
index 0000000000..bdacdc735c
--- /dev/null
+++ b/tools/CMakeLists.txt
@@ -0,0 +1,5 @@
+cmake_minimum_required(VERSION 3.12)
+project(tools)
+
+add_subdirectory(rewriter)
+add_subdirectory(pad-tls)
diff --git a/pad-tls/CMakeLists.txt b/tools/pad-tls/CMakeLists.txt
similarity index 100%
rename from pad-tls/CMakeLists.txt
rename to tools/pad-tls/CMakeLists.txt
diff --git a/pad-tls/pad-tls.c b/tools/pad-tls/pad-tls.c
similarity index 100%
rename from pad-tls/pad-tls.c
rename to tools/pad-tls/pad-tls.c
diff --git a/rewriter/CAbi.h b/tools/rewriter/CAbi.h
similarity index 100%
rename from rewriter/CAbi.h
rename to tools/rewriter/CAbi.h
diff --git a/rewriter/CMakeLists.txt b/tools/rewriter/CMakeLists.txt
similarity index 73%
rename from rewriter/CMakeLists.txt
rename to tools/rewriter/CMakeLists.txt
index 98d710c750..2fc0891fa2 100644
--- a/rewriter/CMakeLists.txt
+++ b/tools/rewriter/CMakeLists.txt
@@ -1,15 +1,11 @@
 cmake_minimum_required(VERSION 3.12)
-project(IA2Rewriter)
+project(rewriter)
 
 find_package(LLVM REQUIRED CONFIG)
 message(STATUS "Found LLVM: ${LLVM_DIR} (found version \"${LLVM_PACKAGE_VERSION}\")")
 find_package(Clang REQUIRED CONFIG)
 message(STATUS "Found Clang: ${Clang_DIR}")
 
-# We use the lit CMake functions from LLVM
-list(APPEND CMAKE_MODULE_PATH "${LLVM_CMAKE_DIR}")
-include(AddLLVM)
-
 add_definitions(${CLANG_DEFINITIONS} ${LLVM_DEFINITIONS})
 include_directories(${CLANG_INCLUDE_DIRS} ${LLVM_INCLUDE_DIRS})
 
@@ -29,8 +25,3 @@ target_link_libraries(ia2-rewriter PRIVATE
     clang-cpp
     LLVM
     )
-
-set(IA2_BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR})
-set(IA2_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
-
-add_subdirectory(tests)
diff --git a/rewriter/DetermineAbi.cpp b/tools/rewriter/DetermineAbi.cpp
similarity index 100%
rename from rewriter/DetermineAbi.cpp
rename to tools/rewriter/DetermineAbi.cpp
diff --git a/rewriter/DetermineAbi.h b/tools/rewriter/DetermineAbi.h
similarity index 100%
rename from rewriter/DetermineAbi.h
rename to tools/rewriter/DetermineAbi.h
diff --git a/rewriter/GenCallAsm.cpp b/tools/rewriter/GenCallAsm.cpp
similarity index 100%
rename from rewriter/GenCallAsm.cpp
rename to tools/rewriter/GenCallAsm.cpp
diff --git a/rewriter/GenCallAsm.h b/tools/rewriter/GenCallAsm.h
similarity index 100%
rename from rewriter/GenCallAsm.h
rename to tools/rewriter/GenCallAsm.h
diff --git a/rewriter/SourceRewriter.cpp b/tools/rewriter/SourceRewriter.cpp
similarity index 100%
rename from rewriter/SourceRewriter.cpp
rename to tools/rewriter/SourceRewriter.cpp
diff --git a/rewriter/TypeOps.cpp b/tools/rewriter/TypeOps.cpp
similarity index 100%
rename from rewriter/TypeOps.cpp
rename to tools/rewriter/TypeOps.cpp
diff --git a/rewriter/TypeOps.h b/tools/rewriter/TypeOps.h
similarity index 100%
rename from rewriter/TypeOps.h
rename to tools/rewriter/TypeOps.h