diff --git a/Examples/.gitignore b/Examples/.gitignore
new file mode 100644
index 00000000..128c6a9c
--- /dev/null
+++ b/Examples/.gitignore
@@ -0,0 +1,9 @@
+*.manifest
+*.manifest.sgx
+*.sig
+*.token
+pal_loader
+*.o
+*~
+*.swp
+__pycache__
diff --git a/Examples/README.md b/Examples/README.md
new file mode 100644
index 00000000..7b50e9ae
--- /dev/null
+++ b/Examples/README.md
@@ -0,0 +1,66 @@
+# Graphene Applications
+
+This repository contains application samples for
+[Graphene Library OS](https://github.com/oscarlab/graphene).
+For how to build and run the Graphene Library OS,
+please see the README in the Graphene repository.
+
+For instructions how to build and run each application under Graphene,
+please see the README or README.md in each subdirectory.
+
+## How to Contribute?
+
+If you are interested in submitting an application sample for Graphene,
+please submit a pull request to this GitHub repository.
+
+Please put your application sample in a subdirectory with a
+comprehensible name. Ideally, the subdirectory name should be the same
+as your application. In addition, your application sample should
+have the following elements:
+
+- `README.md`:
+  Please document the tested environment and instructions for
+  building and running the application. If your application sample
+  has any known issues or requirements, please also specify them in
+  the documentation.
+
+- `Makefile`:
+  Users should be able to build your application sample by running
+  the `make` command. If your application needs extra building steps,
+  please document them in the `README.md`. In addition, we ask you
+  to provide sufficient comments in the `Makefile` to help users
+  understand the build process. If your application also runs on
+  Graphene-SGX, please include the commands for signing and retrieving
+  the token in the `Makefile`.
+
+- Manifest(s):
+  Please provide all the manifests needed for running your application
+  sample. Do not hard-code any user-specific path or personal info
+  in the manifests. The ideal way is to create manifest templates that
+  contain variables to be replaced by runtime options in `Makefile`.
+  See other subdirectories for examples of the manifest templates.
+  We also ask you to provide sufficient comments in all the manifests
+  to help users understand the environment.
+
+- Sample inputs and test suites:
+  If you have any inputs and test suites for testing the application,
+  please provide them in the same subdirectory, too.
+
+Please do not include any tarball of source code or binaries in the
+application samples. If an application requires downloading the source
+code or binaries, please provide instructions in the `README.md`, or
+download them automatically and verify the checksums as part of the
+build process.
+
+## Contact
+
+For any questions or bug reports, please send an email to
+<support@graphene-project.io> or report an issue in the following
+GitHub repositories:
+
+- Graphene issues: <https://github.com/oscarlab/graphene/issues>
+- Application sample issues (manifest, configuration, scripts):
+  <https://github.com/oscarlab/graphene-tests/issues>
+
+Our mailing list is publicly archived
+[here](https://groups.google.com/forum/#!forum/graphene-support).
diff --git a/Examples/apache/.gitignore b/Examples/apache/.gitignore
new file mode 100644
index 00000000..00ddab3d
--- /dev/null
+++ b/Examples/apache/.gitignore
@@ -0,0 +1,7 @@
+/httpd-*/*
+/*.tar.gz
+/install/*
+/result-*
+/OUTPUT
+/ssl/server.*
+/ssl/ca.*
diff --git a/Examples/apache/Makefile b/Examples/apache/Makefile
new file mode 100644
index 00000000..91b68ce9
--- /dev/null
+++ b/Examples/apache/Makefile
@@ -0,0 +1,279 @@
+# Build the manifest for Apache (httpd):
+#
+# - make                  Building for Linux
+# - make DEBUG=1          Building for Linux, with Graphene debug output
+# - make SGX=1            Building for SGX
+# - make SGX=1 DEBUG=1    Building for SGX
+#
+# Use `make clean` to remove Graphene-generated files.
+#
+# Use `make distclean` to further remove the Apache tarball, source code,
+# and installation.
+
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+INSTALL_DIR ?= $(THIS_DIR)install
+HTTPD_SRC ?= $(THIS_DIR)httpd-2.4.41
+HTTPD_CHECKSUM ?= 3c0f9663240beb0f008acf3b4501c4f339d7467ee345a36c86c46b4d6f3a5461
+
+# Mirros for downloading the Apache source code
+HTTPD_MIRRORS ?= \
+	https://www-eu.apache.org/dist/ \
+	https://www-us.apache.org/dist/ \
+	https://ftp.fau.de/apache/ \
+	https://archive.apache.org/dist/
+
+# Address and port for the Apache server to listen
+LISTEN_HOST ?= 127.0.0.1
+LISTEN_PORT ?= 8001
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= $(THIS_DIR)../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: $(INSTALL_DIR)/bin/httpd httpd.manifest pal_loader config testdata ssldata
+ifeq ($(SGX),1)
+all: httpd.manifest.sgx httpd.sig httpd.token
+endif
+
+# The make targets for downloading and compiling the Apache source code, and
+# installing the binaries.
+
+$(INSTALL_DIR)/bin/httpd: $(HTTPD_SRC)/configure
+	cd $(HTTPD_SRC) && ./configure --prefix=$(abspath $(INSTALL_DIR)) \
+		--with-mpm=prefork --enable-mpms-shared='prefork worker event' \
+		--enable-ssl
+	cd $(HTTPD_SRC) && $(MAKE)
+	cd $(HTTPD_SRC) && $(MAKE) install
+
+$(HTTPD_SRC)/configure: $(HTTPD_SRC).tar.gz
+	tar -mxzf $<
+
+$(HTTPD_SRC).tar.gz:
+	$(GRAPHENEDIR)/Scripts/download --output $@ --sha256 $(HTTPD_CHECKSUM) $(foreach mirror,$(HTTPD_MIRRORS),--url $(mirror)httpd/$(HTTPD_SRC).tar.gz)
+
+# Apache dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libpthread
+
+$(INSTALL_DIR)/conf/httpd.conf: $(INSTALL_DIR)
+
+# Listing all the enabled modules in Apache, by greping httpd.conf
+.INTERMEDIATE: httpd-modules
+httpd-modules: $(INSTALL_DIR)/conf/httpd.conf
+	@grep "^LoadModule" $(INSTALL_DIR)/conf/httpd.conf | \
+		awk '{print "$(INSTALL_DIR)/" $$3}' > $@
+	@echo $(INSTALL_DIR)/modules/mod_mpm_worker.so >> $@
+	@echo $(INSTALL_DIR)/modules/mod_mpm_event.so  >> $@
+	@echo $(INSTALL_DIR)/modules/mod_ssl.so        >> $@
+
+# Listing all the Apache dependencies, besides Glibc libraries
+.INTERMEDIATE: httpd-ldd
+httpd-ldd: httpd-modules
+	@for F in $(INSTALL_DIR)/bin/httpd `cat httpd-modules`; do \
+		ldd $$F >> $@ || exit 1; done
+
+.INTERMEDIATE: httpd-deps
+httpd-deps: httpd-ldd
+	@cat $< | awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' \
+		| sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generating manifest rules for Apache modules
+.INTERMEDIATE: httpd-trusted-mods
+httpd-trusted-mods: httpd-modules
+	@for F in `cat httpd-modules`; do \
+		N=`echo $$F | awk '{n=split($$1,s,/\/|\./); print s[n-1]}'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$F\\\\n"; \
+	done > $@
+
+# Generating manifest rules for Apache dependencies
+.INTERMEDIATE: httpd-trusted-libs
+httpd-trusted-libs: httpd-deps httpd-modules
+	@HTTPD_LIBS="$(INSTALL_DIR)/bin/httpd `cat httpd-modules`" && \
+	for F in `cat httpd-deps`; do \
+		P=`ldd $$HTTPD_LIBS | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+httpd.manifest: httpd.manifest.template httpd-trusted-mods httpd-trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(INSTALL_DIR)|'"$(INSTALL_DIR)"'|g' \
+		-e 's|$$(INSTALL_DIR_ABSPATH)|'"$(abspath $(INSTALL_DIR))"'|g' \
+		-e 's|$$(HTTPD_TRUSTED_MODS)|'"`cat httpd-trusted-mods`"'|g' \
+		-e 's|$$(HTTPD_TRUSTED_LIBS)|'"`cat httpd-trusted-libs`"'|g' \
+		$< > $@
+
+# Generating the SGX-specific manifest (httpd.manifest.sgx), the enclave signature,
+# and the token for enclave initialization.
+httpd.manifest.sgx: httpd.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+httpd.sig: httpd.manifest.sgx
+
+httpd.token: httpd.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output httpd.token -sig httpd.sig
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+# Apache configuration and test data
+
+.PHONY: config
+config: $(INSTALL_DIR)/conf/httpd-graphene.conf $(INSTALL_DIR)/conf/extra/httpd-ssl-graphene.conf
+
+$(INSTALL_DIR)/conf/httpd-graphene.conf: $(INSTALL_DIR)/conf/httpd.conf
+	sed -e "s|^Listen |#Listen |g" \
+		-e "s|^User |#User |g" \
+		-e "s|^Group |#Group |g" \
+		-e "s|^LoadModule mpm_prefork|#LoadModule mpm_prefork|g" \
+		-e "s|^#LoadModule ssl_module|LoadModule ssl_module|g" \
+		-e "s|^#Include conf/extra/httpd-ssl.conf|Include conf/extra/httpd-ssl-graphene.conf|g" \
+		-e "s|#EnableMMAP off|EnableMMAP off|g" \
+		-e "s|#EnableSendfile on|EnableSendfile on|g" \
+	$< > $@
+	echo "\n\
+<IfModule mpm_prefork_module>\n\
+    StartServers             4\n\
+    MinSpareServers          1\n\
+    MaxSpareServers          4\n\
+    MaxConnectionsPerChild   0\n\
+</IfModule>\n" >> $@
+	echo "\n\
+<IfModule mpm_worker_module>\n\
+    StartServers             1\n\
+    MinSpareThreads          25\n\
+    MaxSpareThreads          75\n\
+    ThreadsPerChild          25\n\
+</IfModule>\n" >> $@
+
+$(INSTALL_DIR)/conf/extra/httpd-ssl-graphene.conf: $(INSTALL_DIR)/conf/extra/httpd-ssl.conf
+	sed -e "s|^Listen 443|Listen 127.0.0.1:8443|g" \
+		-e "s|^<VirtualHost _default_:443>|<VirtualHost 127.0.0.1:8443>|g" \
+		-e "s|^ServerName www.example.com:443|ServerName www.example.com:8443|g" \
+		-e "s|^SSLSessionCache|#SSLSessionCache|g" \
+	$< > $@
+
+# HTTP docs:
+# Generating random HTML files in $(INSTALL_DIR)/htdocs/random
+
+RANDOM_DIR = $(INSTALL_DIR)/htdocs/random
+RANDOM_FILES = \
+	$(foreach n,1 2 3 4 5 6 7 8 9 10,2K.$n.html) \
+	$(foreach n,1 2 3 4 5,10K.$n.html) \
+	$(foreach n,1 2 3 4 5,100K.$n.html) \
+	$(foreach n,1 2 3,1M.$n.html) \
+	$(foreach n,1 2 3,10M.$n.html) \
+	$(foreach n,1 2 3,100.$n.html)
+
+TEST_DATA = $(addprefix $(RANDOM_DIR)/,$(RANDOM_FILES))
+
+$(RANDOM_DIR)/%.html:
+	mkdir -p $(RANDOM_DIR)
+	dd if=/dev/urandom of=$@ count=1 bs=$(basename $(basename $(notdir $@)))
+
+.PHONY: testdata
+testdata: $(TEST_DATA)
+
+# SSL data: key and x.509 self-signed certificate (to test SSL/TLS)
+
+$(INSTALL_DIR)/conf/server.crt: ssl/ca_config.conf
+	openssl genrsa -out ssl/ca.key 2048
+	openssl req -x509 -new -nodes -key ssl/ca.key -sha256 -days 1024 -out ssl/ca.crt -config ssl/ca_config.conf
+	openssl genrsa -out ssl/server.key 2048
+	openssl req -new -key ssl/server.key -out ssl/server.csr -config ssl/ca_config.conf
+	openssl x509 -req -days 360 -in ssl/server.csr -CA ssl/ca.crt -CAkey ssl/ca.key -CAcreateserial -out ssl/server.crt
+	cp -f ssl/* $(INSTALL_DIR)/conf/
+
+.PHONY: ssldata
+ssldata: $(INSTALL_DIR)/conf/server.crt
+
+# Commands for running Apache
+#
+# - make start-native-server:
+#     Start the Apache server natively in the foreground (using the Prefork MPM)
+#
+# - make start-graphene-server:
+#     Start the Apache server under Graphene in the foreground (using the Prefork MPM)
+#
+# - make start-native-multithreaded-server:
+#     Start the Apache server natively in the foreground (using the Worker MPM)
+#
+# - make start-graphene-multithreaded-server:
+#     Start the Apache server under Graphene in the foreground (using the Worker MPM)
+#
+# - make clean-server:
+#      Clean up the PID files generated by Apache
+
+.PHONY: clean-server
+clean-server:
+	$(RM) $(INSTALL_DIR)/logs/httpd-$(LISTEN_HOST)-$(LISTEN_PORT).pid
+
+.PHONY: start-native-server
+start-native-server: all clean-server
+	@echo "Listen on $(LISTEN_HOST):$(LISTEN_PORT)"
+	$(PREFIX) $(INSTALL_DIR)/bin/httpd -D FOREGROUND \
+		-f conf/httpd-graphene.conf \
+		-C "LoadModule mpm_prefork_module modules/mod_mpm_prefork.so" \
+		-C "Listen $(LISTEN_HOST):$(LISTEN_PORT)" \
+		-C "ServerName $(LISTEN_HOST)" \
+		-C "PidFile logs/httpd-$(LISTEN_HOST)-$(LISTEN_PORT).pid"
+
+.PHONY: start-graphene-server
+start-graphene-server: all clean-server
+	@echo "Listen on $(LISTEN_HOST):$(LISTEN_PORT)"
+	$(PREFIX) ./pal_loader httpd.manifest -D FOREGROUND \
+		-f conf/httpd-graphene.conf \
+		-C "LoadModule mpm_prefork_module modules/mod_mpm_prefork.so" \
+		-C "Listen $(LISTEN_HOST):$(LISTEN_PORT)" \
+		-C "ServerName $(LISTEN_HOST)" \
+		-C "PidFile logs/httpd-$(LISTEN_HOST)-$(LISTEN_PORT).pid"
+
+.PHONY: start-native-multithreaded-server
+start-native-multithreaded-server: all clean-server
+	@echo "Listen on $(LISTEN_HOST):$(LISTEN_PORT)"
+	$(PREFIX) $(INSTALL_DIR)/bin/httpd -D FOREGROUND \
+		-f conf/httpd-graphene.conf \
+		-C "LoadModule mpm_worker_module modules/mod_mpm_worker.so" \
+		-C "Listen $(LISTEN_HOST):$(LISTEN_PORT)" \
+		-C "ServerName $(LISTEN_HOST)" \
+		-C "PidFile logs/httpd-$(LISTEN_HOST)-$(LISTEN_PORT).pid"
+
+.PHONY: start-graphene-multithreaded-server
+start-graphene-multithreaded-server: all clean-server
+	@echo "Listen on $(LISTEN_HOST):$(LISTEN_PORT)"
+	$(PREFIX) ./pal_loader httpd.manifest -D FOREGROUND \
+		-f conf/httpd-graphene.conf \
+		-C "LoadModule mpm_worker_module modules/mod_mpm_worker.so" \
+		-C "Listen $(LISTEN_HOST):$(LISTEN_PORT)" \
+		-C "ServerName $(LISTEN_HOST)" \
+		-C "PidFile logs/httpd-$(LISTEN_HOST)-$(LISTEN_PORT).pid"
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT result-* httpd-ldd httpd-modules tmp
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(HTTPD_SRC).tar.gz $(HTTPD_SRC) $(INSTALL_DIR)
+	$(RM) ssl/server.* ssl/ca.*
diff --git a/Examples/apache/README.md b/Examples/apache/README.md
new file mode 100644
index 00000000..6e336c9f
--- /dev/null
+++ b/Examples/apache/README.md
@@ -0,0 +1,61 @@
+# Apache
+
+This directory contains the Makefile and the template manifest for the most
+recent version of Apache web server (as of this writing, version 2.4.41). This
+was tested on a machine with SGX v1 and Ubuntu 16.04.
+
+The Makefile and the template manifest contain extensive comments. Please review
+them to understand the requirements for Apache running under Graphene-SGX.
+
+We build Apache from the source code instead of using an existing installation.
+On Ubuntu 16.04, please make sure that the following packages are installed:
+```sh
+sudo apt-get install -y build-essential flex libapr1-dev libaprutil1-dev libpcre2-dev \
+                        apache2-utils libssl-dev
+```
+
+# Quick Start
+
+```sh
+# build Apache and the final manifest
+make SGX=1
+
+# run original Apache against HTTP and HTTPS benchmarks (benchmark-http.sh, uses ab)
+make start-native-server &
+./benchmark-http.sh 127.0.0.1:8001
+./benchmark-http.sh https://127.0.0.1:8443
+kill -SIGINT %%
+
+# run Apache in non-SGX Graphene against HTTP and HTTPS benchmarks
+make start-graphene-server &
+./benchmark-http.sh 127.0.0.1:8001
+./benchmark-http.sh https://127.0.0.1:8443
+kill -SIGINT %%
+
+# run Apache in Graphene-SGX against HTTP and HTTPS benchmarks
+SGX=1 make start-graphene-server &
+./benchmark-http.sh 127.0.0.1:8001
+./benchmark-http.sh https://127.0.0.1:8443
+kill -SIGINT %%
+
+# you can also test the server using other utilities like wget
+wget http://127.0.0.1:8001/random/10K.1.html
+wget https://127.0.0.1:8443/random/10K.1.html
+```
+
+# Running Apache with Different MPMs
+
+The Apache server can run with several different multi-processing modules
+(MPMs). The two popular ones are *Prefork* and *Worker* MPMs. The Prefork
+MPM uses multiple child processes with one thread each, and each process
+handles one connection at a time. The Worker MPM uses multiple child processes
+with many threads each, and each thread handles one connection at a time.
+
+The supplied Makefile allows to run Apache in both configurations:
+```sh
+make start-native-server                  # run with Prefork MPM
+make start-graphene-server                # run with Prefork MPM
+
+make start-native-multithreaded-server    # run with Worker MPM
+make start-graphene-multithreaded-server  # run with Worker MPM
+```
diff --git a/Examples/apache/benchmark-http.sh b/Examples/apache/benchmark-http.sh
new file mode 120000
index 00000000..38087f85
--- /dev/null
+++ b/Examples/apache/benchmark-http.sh
@@ -0,0 +1 @@
+../common_tools/benchmark-http.sh
\ No newline at end of file
diff --git a/Examples/apache/httpd.manifest.template b/Examples/apache/httpd.manifest.template
new file mode 100644
index 00000000..acb1ff4d
--- /dev/null
+++ b/Examples/apache/httpd.manifest.template
@@ -0,0 +1,114 @@
+# Apache manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# Apache must be run with the pal_loader:
+#
+# ./pal_loader httpd.manifest <script>
+
+# The executable to load in Graphene.
+loader.exec = file:$(INSTALL_DIR)/bin/httpd
+loader.execname = httpd
+
+# Graphene environment, including the path to the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by Apache 
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Host-level directory (/usr) required by Apache (needed for libaprutil-1.so)
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+# Host-level directory (/etc) required by Apache (needed mostly for SSL/TLS)
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# Mount the current working directory
+fs.mount.cwd.type = chroot
+fs.mount.cwd.path = $(INSTALL_DIR_ABSPATH)
+fs.mount.cwd.uri = file:$(INSTALL_DIR)
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If Apache needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+#
+# We (somewhat arbitrarily) specify 32 threads since mpm_worker_module can create
+# up to 25 threads/process.
+sgx.thread_num = 32
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Other libraries required by Apache
+sgx.trusted_files.libgcc_s = file:/lib/x86_64-linux-gnu/libgcc_s.so.1
+sgx.trusted_files.nss_files = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssnis  = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+# Apache modules and dependencies
+$(HTTPD_TRUSTED_MODS)
+$(HTTPD_TRUSTED_LIBS)
+
+# Apache configuration (trusted)
+sgx.trusted_files.conf1 = file:$(INSTALL_DIR)/conf/httpd-graphene.conf
+sgx.trusted_files.conf2 = file:$(INSTALL_DIR)/conf/extra/httpd-ssl-graphene.conf
+sgx.trusted_files.conf3 = file:$(INSTALL_DIR)/conf/mime.types
+
+# Apache SSL/TLS files (trusted)
+sgx.trusted_files.server_cert = file:$(INSTALL_DIR)/conf/server.crt
+sgx.trusted_files.server_key  = file:$(INSTALL_DIR)/conf/server.key
+
+# Apache HTTP documents (trusted)
+# We only specify those documents used in our tests/benchmarks.
+sgx.trusted_files.htdocs1 = file:$(INSTALL_DIR)/htdocs/index.html
+sgx.trusted_files.htdocs2 = file:$(INSTALL_DIR)/htdocs/random/10K.1.html
+
+# Apache logs directory (untrusted and allowed, since log files are not security-critical)
+sgx.allowed_files.logs = file:$(INSTALL_DIR)/logs
+
+# Name Service Switch (NSS) files, see 'man nsswitch.conf'
+sgx.allowed_files.nsswitch  = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers    = file:/etc/ethers
+sgx.allowed_files.hosts     = file:/etc/hosts
+sgx.allowed_files.group     = file:/etc/group
+sgx.allowed_files.passwd    = file:/etc/passwd
+
+# getaddrinfo(3) configuration file, see 'man gai.conf'
+sgx.allowed_files.gaiconf   = file:/etc/gai.conf
diff --git a/Examples/apache/ssl/ca_config.conf b/Examples/apache/ssl/ca_config.conf
new file mode 100644
index 00000000..999f4579
--- /dev/null
+++ b/Examples/apache/ssl/ca_config.conf
@@ -0,0 +1,16 @@
+[ req ]
+default_bits       = 4096
+default_md         = sha512
+default_keyfile    = example.com.key
+prompt             = no
+encrypt_key        = no
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+countryName            = "XX"             # C=
+localityName           = "XXXXX"          # L=
+organizationName       = "My Company"     # O=
+organizationalUnitName = "Department"     # OU=
+commonName             = "*.example.com"  # CN=
+emailAddress           = "me@example.com" # email
+
diff --git a/Examples/bash/.gitignore b/Examples/bash/.gitignore
new file mode 100644
index 00000000..15506e6d
--- /dev/null
+++ b/Examples/bash/.gitignore
@@ -0,0 +1,2 @@
+/scripts/testdir/*
+/OUTPUT
diff --git a/Examples/bash/Makefile b/Examples/bash/Makefile
new file mode 100644
index 00000000..6cff05dc
--- /dev/null
+++ b/Examples/bash/Makefile
@@ -0,0 +1,140 @@
+# Use one of these commands to build the manifest for Bash:
+#
+# - make
+# - make DEBUG=1
+# - make SGX=1
+# - make SGX=1 DEBUG=1
+#
+# Use `make clean` to remove Graphene-generated files.
+
+# Listing the programs to be run inside the bash script
+PROGRAMS = ls cat rm cp date
+
+# Relative path to Graphene root and key for enclave signing
+GRAPHENEDIR ?= ../../../../..
+GRAPHENEKEY ?= $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: bash.manifest $(addsuffix .manifest,$(PROGRAMS)) pal_loader
+ifeq ($(SGX),1)
+all: bash.token $(addsuffix .token,$(PROGRAMS))
+endif
+
+# Program dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results. This list also contains some runtime deps of Bash.
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libutil libpthread \
+             libselinux libpcre libacl libattr
+
+# Listing all Bash dependencies, besides Glibc libraries
+.INTERMEDIATE: $(addsuffix .deps,bash $(PROGRAMS))
+%.deps:
+	ldd $(shell which $(basename $@)) | \
+		awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' | \
+		sort | uniq | (grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) || true) > $@
+
+# Generating manifest rules for Bash dependencies
+.INTERMEDIATE: $(addsuffix .trusted-libs,bash $(PROGRAMS))
+%.trusted-libs: %.deps
+	for F in `cat $<`; do \
+		P=`ldd $(shell which $(basename $@)) | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+.INTERMEDIATE: trusted-children
+trusted-children:
+	@for F in $(PROGRAMS); do \
+		echo -n "sgx.trusted_children.$$F = file:$$F.sig\\\\n"; \
+		echo -n "sgx.trusted_files.$$F    = file:`which $$F`\\\\n"; \
+		done > $@
+
+bash.manifest: manifest.template trusted-children bash.trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(EXECNAME)|bash|g' \
+		-e 's|$$(EXECPATH)|'"$(shell which bash)"'|g' \
+		-e 's|$$(TRUSTED_LIBS)|'"`cat bash.trusted-libs`"'|g' \
+		-e 's|$$(TRUSTED_CHILDREN)|'"`cat trusted-children`"'|g' \
+		$< > $@
+
+$(addsuffix .manifest,$(PROGRAMS)): %.manifest: manifest.template %.trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(EXECNAME)|'"$(basename $@)"'|g' \
+		-e 's|$$(EXECPATH)|'"$(shell which $(basename $@))"'|g' \
+		-e 's|$$(TRUSTED_LIBS)|'"`cat $(basename $@).trusted-libs`"'|g' \
+		-e 's|$$(TRUSTED_CHILDREN)||g' \
+		$< > $@
+
+# Generating the SGX-specific manifest (*.manifest.sgx), the enclave signature,
+# and the token for enclave initialization.
+bash.manifest.sgx: bash.manifest $(addsuffix .manifest.sgx,$(PROGRAMS))
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEKEY) \
+		-manifest $< -output $@
+
+bash.sig: bash.manifest.sgx
+
+bash.token: bash.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output bash.token -sig bash.sig
+
+$(addsuffix .manifest.sgx,$(PROGRAMS)): %.manifest.sgx: %.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEKEY) \
+		-manifest $< -output $@
+
+$(addsuffix .sig,$(PROGRAMS)): %.sig: %.manifest.sgx
+
+$(addsuffix .token,$(PROGRAMS)): %.token: %.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $(basename $<).token -sig $(basename $<).sig
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: regression
+regression: all
+	@mkdir -p scripts/testdir
+
+	./pal_loader bash.manifest -c "ls" > OUTPUT
+	@grep -q "Makefile" OUTPUT && echo "[ Success 1/6 ]"
+	@rm OUTPUT
+
+	./pal_loader bash.manifest -c "cd scripts && bash bash_test.sh 1" > OUTPUT
+	@grep -q "hello 1" OUTPUT      && echo "[ Success 2/6 ]"
+	@grep -q "createdfile" OUTPUT  && echo "[ Success 3/6 ]"
+	@grep -q "somefile" OUTPUT     && echo "[ Success 4/6 ]"
+	@grep -q "current date" OUTPUT && echo "[ Success 5/6 ]"
+	@rm OUTPUT
+
+	./pal_loader bash.manifest -c "cd scripts && bash bash_test.sh 3" > OUTPUT
+	@grep -q "hello 3" OUTPUT      && echo "[ Success 6/6 ]"
+	@rm OUTPUT
+
+	@rm -rf scripts/testdir
+
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT scripts/testdir/*
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/bash/README.md b/Examples/bash/README.md
new file mode 100644
index 00000000..7d68ee83
--- /dev/null
+++ b/Examples/bash/README.md
@@ -0,0 +1,31 @@
+# Bash example
+
+This directory contains an example for running Bash in Graphene, including
+the Makefile and a template for generating the manifest. The application is
+tested on Ubuntu 16.04, with both normal Linux and SGX platforms.
+
+# Generating the manifest
+
+## Building for Linux
+
+Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
+
+## Building for SGX
+
+Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory.
+
+# Running Bash with Graphene
+
+Here's an example of running Bash scripts under Graphene:
+
+Without SGX:
+```
+./pal_loader bash.manifest -c "ls"
+./pal_loader bash.manifest -c "cd scripts && bash bash_test.sh 2"
+```
+
+With SGX:
+```
+SGX=1 ./pal_loader bash.manifest -c "ls"
+SGX=1 ./pal_loader bash.manifest -c "cd scripts && bash bash_test.sh 2"
+```
diff --git a/Examples/bash/manifest.template b/Examples/bash/manifest.template
new file mode 100644
index 00000000..905d25fa
--- /dev/null
+++ b/Examples/bash/manifest.template
@@ -0,0 +1,80 @@
+# This is a general manifest template for running Bash and core utility programs,
+# including ls, cat, cp, date, and rm.
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+# The executable to load in Graphene. We replace EXECPATH and EXECNAME for
+# each program that a manifest is generated for.
+loader.exec = file:$(EXECPATH)
+loader.execname = file:$(EXECNAME)
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by Bash
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Mount /bin
+fs.mount.bin.type = chroot
+fs.mount.bin.path = /bin
+fs.mount.bin.uri = file:/bin
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If the program needs more virtual
+# memory than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 4
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Name Service Switch (NSS) libraries (Glibc dependencies)
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+
+# Additional libs opened by Bash at runtime
+sgx.trusted_files.libselinux1 = file:/lib/x86_64-linux-gnu/libselinux.so.1
+sgx.trusted_files.libpcre = file:/lib/x86_64-linux-gnu/libpcre.so.3
+sgx.trusted_files.libacl = file:/lib/x86_64-linux-gnu/libacl.so.1
+sgx.trusted_files.libattr = file:/lib/x86_64-linux-gnu/libattr.so.1
+
+# Other required libraries
+$(TRUSTED_LIBS)
+
+# Signatures of child enclaves
+$(TRUSTED_CHILDREN)
+
+sgx.allowed_files.scripts = file:scripts
diff --git a/Examples/bash/scripts/bash_test.sh b/Examples/bash/scripts/bash_test.sh
new file mode 100755
index 00000000..e3396596
--- /dev/null
+++ b/Examples/bash/scripts/bash_test.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+times=$1
+[ $times -gt 0 2> /dev/null ] || times=300
+
+for (( c=1; c<=$times; c++ ))
+do
+	echo "hello $c"
+	cp somefile testdir/somefile
+	cat somefile > testdir/createdfile
+	ls testdir/
+	rm -rf testdir/somefile testdir/createdfile
+	date +"current date is %D"
+done
diff --git a/Examples/bash/scripts/somefile b/Examples/bash/scripts/somefile
new file mode 100644
index 00000000..421376db
--- /dev/null
+++ b/Examples/bash/scripts/somefile
@@ -0,0 +1 @@
+dummy
diff --git a/Examples/blender/.gitignore b/Examples/blender/.gitignore
new file mode 100644
index 00000000..ce6cb4b1
--- /dev/null
+++ b/Examples/blender/.gitignore
@@ -0,0 +1,3 @@
+blender_dir/
+blender.tar.xz
+run_dir/
diff --git a/Examples/blender/Makefile b/Examples/blender/Makefile
new file mode 100644
index 00000000..495ca8d9
--- /dev/null
+++ b/Examples/blender/Makefile
@@ -0,0 +1,81 @@
+# assumes this makefile lies in cwd
+PWD := $(shell pwd)
+
+GRAPHENE_DIR = $(PWD)/../../../../..
+
+BLENDER_DIR = $(PWD)/blender_dir
+BLENDER_URL ?= https://ftp.nluug.nl/pub/graphics/blender/release/Blender2.82/blender-2.82-linux64.tar.xz
+BLENDER_SHA256 ?= b13600fa2ca23ea1bba511e3a6599b6792acde80b180707c3ea75db592a9b916
+BLENDER_VER = 2.82
+
+DATA_DIR = $(PWD)/data
+RUN_DIR = $(PWD)/run_dir
+
+UBUNTU_VER = $(shell lsb_release --short --id)$(shell lsb_release --short --release)
+
+ifeq ($(UBUNTU_VER), Ubuntu18.04)
+else ifeq ($(UBUNTU_VER), Ubuntu16.04)
+else
+$(error This example requires Ubuntu 16.04 or 18.04)
+endif
+
+ifeq ($(DEBUG),1)
+GRAPHENE_DEBUG = inline
+else
+GRAPHENE_DEBUG = none
+endif
+
+
+.PHONY: all
+all: $(BLENDER_DIR)/blender $(RUN_DIR)/blender.manifest $(RUN_DIR)/pal_loader $(DATA_DIR)/images
+ifeq ($(SGX),1)
+all: $(RUN_DIR)/blender.manifest.sgx
+endif
+
+$(BLENDER_DIR)/blender:
+	$(GRAPHENE_DIR)/Scripts/download --output blender.tar.xz \
+		--sha256 $(BLENDER_SHA256) --url $(BLENDER_URL)
+	mkdir $(BLENDER_DIR)
+	tar -C $(BLENDER_DIR) --strip-components=1 -xf blender.tar.xz
+
+$(RUN_DIR):
+	mkdir -p $@
+
+$(RUN_DIR)/blender.manifest: blender.manifest.template $(RUN_DIR)
+	sed -e 's|$$(GRAPHENE_DIR)|'"$(GRAPHENE_DIR)"'|g' \
+		-e 's|$$(GRAPHENE_DEBUG)|'"$(GRAPHENE_DEBUG)"'|g' \
+		-e 's|$$(DATA_DIR)|'"$(DATA_DIR)"'|g' \
+		-e 's|$$(BLENDER_DIR)|'"$(BLENDER_DIR)"'|g' \
+		-e 's|$$(BLENDER_VER)|'"$(BLENDER_VER)"'|g' \
+		-e 's|# \['"$(UBUNTU_VER)"'\] ||g' \
+		$< > $@
+
+$(RUN_DIR)/blender.manifest.sgx: $(BLENDER_DIR)/blender $(RUN_DIR)/blender.manifest $(GRAPHENE_DIR)/Runtime/libpal-Linux-SGX.so $(RUN_DIR)
+	$(GRAPHENE_DIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-output $@ \
+		-libpal $(GRAPHENE_DIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENE_DIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $(RUN_DIR)/blender.manifest \
+		-exec $<
+	$(GRAPHENE_DIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $(RUN_DIR)/blender.token \
+		-sig $(RUN_DIR)/blender.sig
+
+$(RUN_DIR)/pal_loader:
+	ln -s $(GRAPHENE_DIR)/Runtime/pal_loader $@
+
+$(DATA_DIR)/images:
+	mkdir -p $@
+
+.PHONY: check
+check: all
+	cd $(RUN_DIR) && DATA_DIR=$(DATA_DIR) sh $(PWD)/test_all_scenes.sh
+
+.PHONY: clean
+clean:
+	$(RM) -r $(RUN_DIR) $(DATA_DIR)/images
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(BLENDER_DIR) blender.tar.xz
+
diff --git a/Examples/blender/blender.manifest.template b/Examples/blender/blender.manifest.template
new file mode 100644
index 00000000..09bfb732
--- /dev/null
+++ b/Examples/blender/blender.manifest.template
@@ -0,0 +1,82 @@
+# INSECURE!!!
+# These 3 lines are insecure by design and should never be used in production environments.
+# There is a lot of files that Blender uses (e.g. bundled Python) and listing them here would
+# be counter productive, as they may change between Blender releases and this is just a testing
+# manifest.
+# Additionally, Blender scenes could allow for code execution (e.g. via bundled scripts), so
+# running untrusted scenes should not be allowed. This can be achieved for example by adding scenes
+# to trusted files or uploading them to a running and attested enclave via secured connection.
+sgx.allowed_files.blender_dir = file:$(BLENDER_DIR)/$(BLENDER_VER)/
+sgx.allowed_files.blender_input = file:$(DATA_DIR)/scenes/
+sgx.allowed_files.blender_output = file:$(DATA_DIR)/images/
+
+
+loader.exec = file:$(BLENDER_DIR)/blender
+loader.execname = blender
+
+loader.preload = file:$(GRAPHENE_DIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENE_DEBUG)
+
+loader.env.LD_LIBRARY_PATH = /graphene_lib:/blender_lib:/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu
+# Graphene implicitly copies host environment variables - overwriting troublesome one
+loader.env.PWD =
+
+fs.mount.graphene_lib.type = chroot
+fs.mount.graphene_lib.path = /graphene_lib
+fs.mount.graphene_lib.uri = file:$(GRAPHENE_DIR)/Runtime
+
+fs.mount.blender_lib.type = chroot
+fs.mount.blender_lib.path = /blender_lib
+fs.mount.blender_lib.uri = file:$(BLENDER_DIR)/lib
+
+fs.mount.usr_lib.type = chroot
+fs.mount.usr_lib.path = /usr/lib/x86_64-linux-gnu
+fs.mount.usr_lib.uri = file:/usr/lib/x86_64-linux-gnu
+
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib/x86_64-linux-gnu
+fs.mount.lib.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.scenes.type = chroot
+fs.mount.scenes.path = /data
+fs.mount.scenes.uri = file:$(DATA_DIR)
+
+fs.mount.blender.type = chroot
+fs.mount.blender.path = /blender
+fs.mount.blender.uri = file:$(BLENDER_DIR)
+
+
+sys.stack.size = 8M
+
+
+sgx.enclave_size = 2048M
+sgx.thread_num = 28
+
+
+sgx.trusted_files.ld = file:$(GRAPHENE_DIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENE_DIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENE_DIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENE_DIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENE_DIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libutil = file:$(GRAPHENE_DIR)/Runtime/libutil.so.1
+sgx.trusted_files.librt = file:$(GRAPHENE_DIR)/Runtime/librt.so.1
+
+sgx.trusted_files.libGL = file:$(BLENDER_DIR)/lib/libGL.so.1
+sgx.trusted_files.libglapi = file:$(BLENDER_DIR)/lib/libglapi.so.0
+
+sgx.trusted_files.libX11 = file:/usr/lib/x86_64-linux-gnu/libX11.so.6
+sgx.trusted_files.libXi = file:/usr/lib/x86_64-linux-gnu/libXi.so.6
+sgx.trusted_files.libXxf86vm = file:/usr/lib/x86_64-linux-gnu/libXxf86vm.so.1
+sgx.trusted_files.libXfixes = file:/usr/lib/x86_64-linux-gnu/libXfixes.so.3
+sgx.trusted_files.libXrender = file:/usr/lib/x86_64-linux-gnu/libXrender.so.1
+sgx.trusted_files.libgcc_s = file:/lib/x86_64-linux-gnu/libgcc_s.so.1
+sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1
+sgx.trusted_files.libXext = file:/usr/lib/x86_64-linux-gnu/libXext.so.6
+sgx.trusted_files.libxcb = file:/usr/lib/x86_64-linux-gnu/libxcb.so.1
+sgx.trusted_files.libXau = file:/usr/lib/x86_64-linux-gnu/libXau.so.6
+sgx.trusted_files.libXdmcp = file:/usr/lib/x86_64-linux-gnu/libXdmcp.so.6
+sgx.trusted_files.libstdcpp = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6
+sgx.trusted_files.libnuma = file:/usr/lib/x86_64-linux-gnu/libnuma.so.1
+
+# Ubuntu version specific files
+# [Ubuntu18.04] sgx.trusted_files.libbsd = file:/lib/x86_64-linux-gnu/libbsd.so.0
diff --git a/Examples/blender/data/.gitignore b/Examples/blender/data/.gitignore
new file mode 100644
index 00000000..47241b6e
--- /dev/null
+++ b/Examples/blender/data/.gitignore
@@ -0,0 +1 @@
+images/
diff --git a/Examples/blender/data/scenes/simple_scene.blend b/Examples/blender/data/scenes/simple_scene.blend
new file mode 100644
index 00000000..12757d04
Binary files /dev/null and b/Examples/blender/data/scenes/simple_scene.blend differ
diff --git a/Examples/blender/test_all_scenes.sh b/Examples/blender/test_all_scenes.sh
new file mode 100644
index 00000000..ea70d25d
--- /dev/null
+++ b/Examples/blender/test_all_scenes.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+for i in `ls "$DATA_DIR"/scenes/`;
+do
+    rm -f "$DATA_DIR"/images/"$i"0001.png
+    ./pal_loader ./blender.manifest -b /data/scenes/$i -t 4 -F PNG -o /data/images/$i -f 1
+    # TODO add a better test, probably some diff with a precomputed image
+    [ -f "$DATA_DIR"/images/"$i"0001.png ]
+done
diff --git a/Examples/busybox/.gitignore b/Examples/busybox/.gitignore
new file mode 100644
index 00000000..c8777d73
--- /dev/null
+++ b/Examples/busybox/.gitignore
@@ -0,0 +1,3 @@
+/src
+/busybox
+/busybox.tar.bz2
diff --git a/Examples/busybox/Makefile b/Examples/busybox/Makefile
new file mode 100644
index 00000000..39380a7b
--- /dev/null
+++ b/Examples/busybox/Makefile
@@ -0,0 +1,112 @@
+# Build Busybox as follows:
+#
+# - make               -- create non-SGX no-debug-log manifest
+# - make DEBUG=1       -- create non-SGX debug-log manifest
+# - make SGX=1         -- create SGX no-debug-log manifest
+# - make SGX=1 DEBUG=1 -- create SGX debug-log manifest
+#
+# Any of these invocations downloads Busybox and builds it.
+#
+# Use `make clean` to remove Graphene-generated files and `make distclean` to
+# additionally remove the Busybox source.
+
+################################# CONSTANTS ###################################
+
+# Relative path to Graphene root
+GRAPHENEDIR = ../../../../..
+
+SRCDIR = src
+BUSYBOX_URL ?= https://busybox.net/downloads/busybox-1.31.1.tar.bz2
+BUSYBOX_SHA256 ?= d0f940a72f648943c1f2211e0e3117387c31d765137d92bd8284a3fb9752a998
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+
+.PHONY: all
+all: busybox busybox.manifest pal_loader
+ifeq ($(SGX),1)
+all: busybox.manifest.sgx
+endif
+
+############################ BUSYBOX EXECUTABLE ###############################
+
+# Busybox is built as usual, without any changes to the build process. The
+# source is downloaded and then built via classic make. The result of this
+# build process is the final executable "src/busybox".
+
+$(SRCDIR)/Makefile:
+	$(GRAPHENEDIR)/Scripts/download --output busybox.tar.bz2 \
+		--sha256 $(BUSYBOX_SHA256) --url $(BUSYBOX_URL)
+	mkdir $(SRCDIR)
+	tar -C $(SRCDIR) --strip-components=1 -xf busybox.tar.bz2
+
+$(SRCDIR)/.config: $(SRCDIR)/Makefile
+	cd $(SRCDIR) && make clean && make defconfig
+	# Enable usage of Busybox's built-in applets
+	sed -e 's/.*CONFIG_FEATURE_SH_STANDALONE.*/CONFIG_FEATURE_SH_STANDALONE=y/' \
+		-i $(SRCDIR)/.config
+	# Currently '/proc/self/exe' is bugged in graphene, so manually set path
+	# to the Busybox binary
+	sed -e 's/.*CONFIG_BUSYBOX_EXEC_PATH.*/CONFIG_BUSYBOX_EXEC_PATH="\/busybox"/' \
+		-i $(SRCDIR)/.config
+
+$(SRCDIR)/busybox: $(SRCDIR)/.config
+	cd $(SRCDIR) && make
+
+############################## BUSYBOX MANIFEST ###############################
+
+# The template file contains almost all necessary information to run Busybox
+# under Graphene / Graphene-SGX. We create busybox.manifest (to be run under
+# non-SGX Graphene) by simply replacing variables in the template file via sed.
+
+busybox.manifest: busybox.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		$< > $@
+
+# Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This
+# procedure measures all Busybox dependencies (shared libraries and trusted
+# files), measures Busybox code/data pages, and adds measurements into the
+# resulting manifest.sgx file (among other, less important SGX options).
+#
+# Additionally, Graphene-SGX requires EINITTOKEN and SIGSTRUCT objects (see
+# SGX hardware ABI, in particular EINIT instruction). The "pal-sgx-get-token"
+# script generates these objects and puts them in files .token and .sig
+# respectively. Note that filenames must be the same as the executable/manifest
+# name (i.e., "busybox").
+
+busybox.manifest.sgx: busybox.manifest busybox
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@ \
+		-exec busybox
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output busybox.token -sig busybox.sig
+
+########################### COPIES OF EXECUTABLES #############################
+
+# Busybox build process creates the final executable as "src/busybox".
+# Copy Busybox binary to our root directory and create a link to pal_loader for
+# simplicity.
+
+busybox: $(SRCDIR)/busybox
+	cp $(SRCDIR)/busybox busybox
+
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+################################## CLEANUP ####################################
+
+.PHONY: clean
+clean:
+	$(RM) *.token *.sig *.manifest.sgx *.manifest pal_loader busybox
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(SRCDIR) busybox.tar.bz2
+
diff --git a/Examples/busybox/README.md b/Examples/busybox/README.md
new file mode 100644
index 00000000..1d91f617
--- /dev/null
+++ b/Examples/busybox/README.md
@@ -0,0 +1,33 @@
+# Busybox
+
+This directory contains the Makefile and the template manifest for the most
+recent version of Busybox (as of this writing, commit ac78f2ac96). This was
+tested on a machine with SGX v1 and Ubuntu 16.04.
+
+The Makefile and the template manifest contain extensive comments and are made
+self-explanatory. Please review them to gain understanding in Graphene-SGX
+and requirements for applications running under Graphene-SGX.
+
+# Quick Start
+
+```sh
+# build Busybox and the final manifest
+make SGX=1
+
+# run Busybox shell in non-SGX Graphene
+./pal_loader busybox sh
+# or
+./pal_loader busybox.manifest sh
+
+# run Busybox shell in Graphene-SGX
+SGX=1 ./pal_loader busybox sh
+# or
+SGX=1 ./pal_loader busybox.manifest.sgx sh
+
+# now a shell session should be running e.g. typing:
+ls
+# should run program `ls` which lists current working directory
+```
+
+Note that busybox can be started via manifest file (which contains path to
+the busybox binary). More about this can be read [here](https://github.com/oscarlab/graphene/wiki#run-an-application-in-the-graphene-library-os).
diff --git a/Examples/busybox/busybox.manifest.template b/Examples/busybox/busybox.manifest.template
new file mode 100644
index 00000000..5ca686ec
--- /dev/null
+++ b/Examples/busybox/busybox.manifest.template
@@ -0,0 +1,139 @@
+# Busybox manifest file example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+################################## GRAPHENE ###################################
+
+# Executable to load into Graphene and run.
+loader.exec = file:busybox
+
+# Name of the executable e.g. as visible through argv[0] when ran as manifest
+# file (`./pal_loader busybox.manifest`).
+loader.execname = busybox
+
+# LibOS layer library of Graphene. There is currently only one implementation,
+# so it is always set to libsysdb.so. Note that GRAPHENEDIR macro is expanded
+# to relative path to Graphene repository in the Makefile as part of the
+# build process.
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively). Note that
+# GRAPHENEDEBUG macro is expanded to inline/none in the Makefile as part of the
+# build process.
+loader.debug_type = $(GRAPHENEDEBUG)
+
+################################# ENV VARS  ###################################
+
+# Specify paths to search for libraries. Since there might be no
+# '/etc/ld.so.cache' inside Graphene, any non-standard paths need to be added
+# - LD_LIBRARY_PATH is used and the usual syntax applies. Paths must be
+# in-Graphene visible paths, not host-OS paths (i.e. paths must be taken from
+# fs.mount.xxx.path, not fs.mount.xxx.uri).
+#
+# In case of Busybox:
+# - /lib is searched for Glibc libraries (ld, libc, libresolv) provided by
+#   graphene,
+# - /lib/x86_64-linux-gnu is searched for libcrypt, NSS libraries.
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu
+
+# Explicitly set some environment variables used by Busybox.
+loader.env.PATH = /:/usr/sbin:/usr/bin:/sbin:/bin
+loader.env.USERNAME =
+loader.env.HOME =
+loader.env.PWD =
+loader.env.HOSTNAME = test
+
+################################# MOUNT FS  ###################################
+
+# General notes:
+# - There is only one supported type of mount points: 'chroot'.
+# - Directory names are (somewhat confusingly) prepended by 'file:'.
+# - Names of mount entries (lib1, lib2) are irrelevant but must be unique.
+# - In-Graphene visible path names may be arbitrary.
+
+# Mount host-OS directory containing Graphene glibc/runtime libraries
+# (specified as 'uri', GRAPHENEDIR macro is expanded in the Makefile as part
+# of the build process) into in-Graphene visible directory /lib (specified
+# as 'path').
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Mount host-OS directory contanining libcrypt and NSS libraries.
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to NSS files required by Glibc + NSS libraries.
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+############################# SGX: TRUSTED LIBS ###############################
+
+# Specify all libraries used by Busybox and its dependencies (including all
+# libraries which can be loaded at runtime via dlopen). The paths to libraries
+# are host-OS paths. These libraries will be searched for in in-Graphene
+# visible paths according to mount points above.
+#
+# As part of the build process, Graphene-SGX script (`pal-sgx-sign`) finds each
+# specified library, measures its hash and outputs the hash in auto-generated
+# entry 'sgx.trusted_checksum.xxx' in auto-generated 'busybox.manifest.sgx'
+# file. Note that this happens on the developer's machine.
+#
+# At runtime, during loading of this library, Graphene-SGX measures its hash
+# and compares it with the one specified in 'sgx.trusted_checksum.xxx'. If both
+# hashes match, this library is trusted and allowed to be loaded and used. Note
+# that this happens on the client machine.
+
+# Glibc libraries.
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libresolv = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+
+# libcrypt is an explicit dependency of Busybox. We choose to install it on
+# host OS instead of downloading the sources, building, and linking Busybox
+# against the built library (which is possible but would require more effort).
+sgx.trusted_files.libcrypt = file:/lib/x86_64-linux-gnu/libcrypt.so.1
+
+# Name Service Switch (NSS) libraries. Glibc calls these libraries as part of
+# name-service information gathering. libnss_{compat,files,nis} are the
+# most widely used libraries, at least on Ubuntu.
+# For more info, see 'man nsswitch.conf'.
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssfiles  = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssnis  = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+
+# libNSL is a dependency of libnss_compat above. It is a good example of nested
+# library dependencies required by Graphene-SGX.
+sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+############################ SGX: TRUSTED FILES ###############################
+
+# Trusted no-library files include configuration files, read-only files, and
+# other static files. It is useful to specify such files here to make sure
+# they are not maliciously modified (modifications will be detected as hash
+# mismatch by Graphene-SGX).
+#
+# Busybox does not have any configuration files, so this section is empty.
+# sgx.trusted_files.config = file:<important-configuration-file>
+
+############################# SGX: ALLOWED FILES ##############################
+
+# Specify all non-static files used by app. These files may be opened by
+# Graphene-SGX but modifications to them are not detected (Graphene-SGX does
+# not measure their hashes). This may pose a security risk!
+
+# Name Service Switch (NSS) files. Glibc reads these files as part of name-
+# service information gathering. For more info, see 'man nsswitch.conf'.
+sgx.allowed_files.nsswitch  = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers    = file:/etc/ethers
+sgx.allowed_files.hosts     = file:/etc/hosts
+sgx.allowed_files.group     = file:/etc/group
+sgx.allowed_files.passwd    = file:/etc/passwd
+
+# Busybox uses timezone settings, which are located in /etc/localtime for
+# glibc-based host systems.
+sgx.allowed_files.localtime = file:/etc/localtime
+
diff --git a/Examples/capnproto/.gitignore b/Examples/capnproto/.gitignore
new file mode 100644
index 00000000..a713479b
--- /dev/null
+++ b/Examples/capnproto/.gitignore
@@ -0,0 +1,2 @@
+/src
+/addressbook
diff --git a/Examples/capnproto/Makefile b/Examples/capnproto/Makefile
new file mode 100644
index 00000000..eef5a951
--- /dev/null
+++ b/Examples/capnproto/Makefile
@@ -0,0 +1,108 @@
+# Build Addressbook (official example of Cap'n Proto) as follows:
+#
+# - make               -- create non-SGX no-debug-log manifest
+# - make SGX=1         -- create SGX no-debug-log manifest
+# - make SGX=1 DEBUG=1 -- create SGX debug-log manifest
+#
+# Any of these invocations downloads the sample from the official GitHub repo
+# (version 0.7.0) and builds it per official instructions. Note that capnproto
+# and libcapnp.so must be already installed on the system.
+#
+# Use `make clean` to remove Graphene-generated files and `make distclean` to
+# additionally remove the Addressbook sources.
+
+# Relative path to Graphene root and key for enclave signing
+GRAPHENEDIR ?= ../../../../..
+GRAPHENEKEY ?= $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
+
+SRCDIR = src
+CAPNPROTO_SRC_URL ?= https://raw.githubusercontent.com/capnproto/capnproto/v0.7.0
+
+ADDRESSBOOK_SRC_URL    ?= $(CAPNPROTO_SRC_URL)/c%2B%2B/samples/addressbook.c%2B%2B
+ADDRESSBOOK_SRC_SHA256 ?= d01f6d40b27aab93b53c7e58a81aa4eab927331e4390e5a7e778c163d30def82
+
+ADDRESSBOOK_CAP_URL    ?= $(CAPNPROTO_SRC_URL)/c%2B%2B/samples/addressbook.capnp
+ADDRESSBOOK_CAP_SHA256 ?= cf309b8b277881c95aaa785f4d0154f46f82575fdb9dea49fb10ee072b7c3ae6
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY=all
+all: addressbook addressbook.manifest pal_loader
+ifeq ($(SGX),1)
+all: addressbook.token
+endif
+
+$(SRCDIR)/addressbook.c++:
+	mkdir -p $(SRCDIR)
+	$(GRAPHENEDIR)/Scripts/download --output $(SRCDIR)/addressbook.c++ \
+		--sha256 $(ADDRESSBOOK_SRC_SHA256) --url $(ADDRESSBOOK_SRC_URL)
+
+$(SRCDIR)/addressbook.capnp:
+	mkdir -p $(SRCDIR)
+	$(GRAPHENEDIR)/Scripts/download --output $(SRCDIR)/addressbook.capnp \
+		--sha256 $(ADDRESSBOOK_CAP_SHA256) --url $(ADDRESSBOOK_CAP_URL)
+
+$(SRCDIR)/addressbook: $(SRCDIR)/addressbook.c++ $(SRCDIR)/addressbook.capnp
+	cd $(SRCDIR) && capnp compile -oc++ addressbook.capnp
+	cd $(SRCDIR) && c++ -std=c++14 -Wall addressbook.c++ addressbook.capnp.c++ \
+	                    `pkg-config --cflags --libs capnp` -o addressbook
+
+# Addressbook dependencies (from ldd); needed for concrete versions of libcapnp.so and libkj.so
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc binaries are
+# already listed in the manifest template, so we can skip them from the ldd results.
+GLIBC_DEPS = linux-vdso.so.1 /lib64/ld-linux-x86-64.so.2 libc.so.6 libm.so.6 librt.so.1 \
+             libdl.so.2 libpthread.so.0 libutil.so.1 libresolv.so.2 libnss_dns.so.2
+
+# List all Addressbook dependencies, besides Glibc libraries
+.INTERMEDIATE: addressbook-deps
+addressbook-deps: $(SRCDIR)/addressbook
+	@ldd $(SRCDIR)/addressbook | \
+		awk '{if ($$2 =="=>") {print $$1}}' | \
+		sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generate manifest rules for Addressbook dependencies
+.INTERMEDIATE: addressbook-trusted-libs
+addressbook-trusted-libs: addressbook-deps
+	@for F in `cat addressbook-deps`; do \
+		P=`ldd $(SRCDIR)/addressbook | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '.' | tr --delete '-' | tr --delete '+'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+addressbook.manifest: addressbook.manifest.template addressbook-trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(TRUSTEDLIBS)|'"`cat addressbook-trusted-libs`"'|g' \
+		$< > $@
+
+addressbook.manifest.sgx: addressbook.manifest $(SRCDIR)/addressbook
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEKEY) \
+		-manifest $< -output $@ \
+		-exec $(SRCDIR)/addressbook
+
+addressbook.sig: addressbook.manifest.sgx
+
+addressbook.token: addressbook.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $@ -sig $^
+
+addressbook: $(SRCDIR)/addressbook
+	cp $< $@
+
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY=clean
+clean:
+	$(RM) *.token *.sig *.manifest.sgx *.manifest pal_loader addressbook
+
+.PHONY=distclean
+distclean: clean
+	$(RM) -r $(SRCDIR)
diff --git a/Examples/capnproto/README b/Examples/capnproto/README
new file mode 100644
index 00000000..15a8ce0c
--- /dev/null
+++ b/Examples/capnproto/README
@@ -0,0 +1,26 @@
+# Cap'n Proto and Addressbook example
+
+This directory contains the Makefile and the template manifest for the Addressbook example of the
+Cap'n Proto protocol. Addressbook is the sample application that uses Cap'n Proto from the official
+documentation (copied from the official GitHub repo, v0.7.0). We use the preinstalled libcapnp
+library on the host OS instead of downloading the sources, building, and linking Addressbook against
+the built library (which is possible but would require more effort). This was tested on machines
+with SGX v1 and Ubuntu 16.04/18.04.
+
+Please install the following prerequisites: `sudo apt install -y libcapnp-dev capnproto`.
+
+# Quick Start
+
+```sh
+# build Addressbook and the final manifest
+make SGX=1
+
+# run original Addressbook
+./addressbook write
+
+# run Addressbook in non-SGX Graphene
+./pal_loader addressbook write
+
+# run Addressbook in Graphene-SGX
+SGX=1 ./pal_loader addressbook write
+```
diff --git a/Examples/capnproto/addressbook.manifest.template b/Examples/capnproto/addressbook.manifest.template
new file mode 100644
index 00000000..7c732561
--- /dev/null
+++ b/Examples/capnproto/addressbook.manifest.template
@@ -0,0 +1,53 @@
+# Cap'n Proto sample (Addressbook) manifest file
+#
+# This manifest was prepared and tested on Ubuntu 16.04 and Ubuntu 18.04.
+
+# Addressbook is the sample application that uses Cap'n Proto from the official
+# documentation (copied from the official GitHub repo). Must be run like this:
+#
+# ./pal_loader ./addressbook [write | dwrite]
+
+# Executable to load into Graphene and run
+loader.exec = file:addressbook
+
+# LibOS layer library of Graphene (currently only one implementation, libsysdb)
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively)
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Specify paths to search for libraries (usual LD_LIBRARY_PATH syntax)
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to Graphene glibc/runtime libraries
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Mount host-OS directory to Name Service Switch (NSS) libraries
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to libcapnp lib required by Addressbook
+fs.mount.lib3.type = chroot
+fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu
+fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to NSS files required by Glibc + NSS libs
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# Set enclave size (somewhat arbitrarily) to 256MB.
+sgx.enclave_size = 256M
+
+# Set maximum number of in-enclave threads (somewhat arbitrarily) to 8
+sgx.thread_num = 8
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+$(TRUSTEDLIBS)
diff --git a/Examples/common_tools/benchmark-http.sh b/Examples/common_tools/benchmark-http.sh
new file mode 100755
index 00000000..1e2c9761
--- /dev/null
+++ b/Examples/common_tools/benchmark-http.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+# On Ubuntu, this script requires apache2-utils for the ab binary.
+#
+# Run like: ./benchmark-http.sh host:port
+#
+# It also works with HTTPS, e.g., ./benchmark-http.sh https://localhost:8443
+
+declare -A THROUGHPUTS
+declare -A LATENCIES
+LOOP=${LOOP:-1}
+DOWNLOAD_HOST=$1
+DOWNLOAD_FILE=random/10K.1.html
+REQUESTS=10000
+CONCURRENCY_LIST=${CONCURRENCY_LIST:-"1 2 4 8 16 32 64 128 256"}
+OPTIONS="-k"
+RESULT=result-$(date +%y%m%d-%H%M%S)
+
+touch $RESULT
+
+RUN=0
+while [ $RUN -lt $LOOP ]
+do
+    for CONCURRENCY in $CONCURRENCY_LIST
+    do
+        rm -f OUTPUT
+        echo "ab $OPTIONS -n $REQUESTS -c $CONCURRENCY $DOWNLOAD_HOST/$DOWNLOAD_FILE"
+        ab $OPTIONS -n $REQUESTS -c $CONCURRENCY $DOWNLOAD_HOST/$DOWNLOAD_FILE > OUTPUT || exit $?
+
+        sleep 5
+
+        THROUGHPUT=$(grep -m1 "Requests per second:" OUTPUT | awk '{ print $4 }')
+        LATENCY=$(grep -m1 "Time per request:" OUTPUT | awk '{ print $4 }')
+        FAILED=$(grep -m1 "Failed requests:" OUTPUT | awk '{print $3 }')
+        THROUGHPUTS[$CONCURRENCY]="${THROUGHPUTS[$CONCURRENCY]} $THROUGHPUT"
+        LATENCIES[$CONCURRENCY]="${LATENCIES[$CONCURRENCY]} $LATENCY"
+        echo "concurrency=$CONCURRENCY, throughput=$THROUGHPUT, latency=$LATENCY, failed=$FAILED"
+    done
+    RUN=$(expr $RUN + 1)
+done
+
+for CONCURRENCY in $CONCURRENCY_LIST
+do
+    THROUGHPUT=$(echo ${THROUGHPUTS[$CONCURRENCY]} | tr " " "\n" | sort -n | awk '{a[NR]=$0}END{if(NR%2==1)print a[int(NR/2)+1];else print(a[NR/2-1]+a[NR/2])/2}')
+    LATENCY=$(echo ${LATENCIES[$CONCURRENCY]} | tr " " "\n" | sort -n | awk '{a[NR]=$0}END{if(NR%2==1)print a[int(NR/2)+1];else print(a[NR/2-1]+a[NR/2])/2}')
+    echo "$THROUGHPUT,$LATENCY" >> $RESULT
+done
+
+echo "Result file: $RESULT"
diff --git a/Examples/curl/.gitignore b/Examples/curl/.gitignore
new file mode 100644
index 00000000..32b966bc
--- /dev/null
+++ b/Examples/curl/.gitignore
@@ -0,0 +1 @@
+/OUTPUT
diff --git a/Examples/curl/Makefile b/Examples/curl/Makefile
new file mode 100644
index 00000000..b1fc3a66
--- /dev/null
+++ b/Examples/curl/Makefile
@@ -0,0 +1,92 @@
+# Use one of these commands to build the manifest for curl:
+#
+# - make
+# - make DEBUG=1
+# - make SGX=1
+# - make SGX=1 DEBUG=1
+#
+# Use `make clean` to remove Graphene-generated files.
+
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+CURL_DIR ?= /usr/bin/
+
+# Relative path to Graphene root and key for enclave signing
+GRAPHENEDIR ?= ../../../../..
+GRAPHENEKEY ?= $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: curl.manifest pal_loader
+ifeq ($(SGX),1)
+all: curl.token
+endif
+
+# curl dependencies (generated from ldd). For SGX, the manifest needs to list all the libraries
+# loaded during execution, so that the signer can include the file hashes.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc binaries are
+# already listed in the manifest template, so we can skip them from the ldd results.
+GLIBC_DEPS = linux-vdso.so.1 /lib64/ld-linux-x86-64.so.2 libc.so.6 libm.so.6 librt.so.1 \
+			 libdl.so.2 libpthread.so.0 libutil.so.1 libresolv.so.2 libnss_dns.so.2
+
+# List all the curl dependencies, besides Glibc libraries
+.INTERMEDIATE: curl-deps
+curl-deps:
+	@ldd $(CURL_DIR)curl | \
+		awk '{if ($$2 =="=>") {print $$1}}' | \
+		sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generate manifest rules for curl dependencies
+.INTERMEDIATE: curl-trusted-libs
+curl-trusted-libs: curl-deps
+	@for F in `cat curl-deps`; do \
+		P=`ldd $(CURL_DIR)curl | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '.' | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+curl.manifest: curl.manifest.template curl-trusted-libs
+	@sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(CURL_DIR)|'"$(CURL_DIR)"'|g' \
+		-e 's|$$(CURL_TRUSTED_LIBS)|'"`cat curl-trusted-libs`"'|g' \
+		$< > $@
+
+# Generate SGX-specific manifest, enclave signature, and token for enclave initialization
+curl.manifest.sgx: curl.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEKEY) \
+		-manifest $< -output $@
+
+curl.sig: curl.manifest.sgx
+
+curl.token: curl.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $@ -sig $^
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: check
+check: all
+	(cd test-docroot; exec python3 -m http.server -b 127.0.0.1 19111) & httpd_pid=$$!; \
+	sleep 1; \
+	./pal_loader curl.manifest http://127.0.0.1:19111/ > OUTPUT; rc=$$?; \
+	kill $$httpd_pid; exit $$rc
+
+	@grep -q "Hello World" OUTPUT && echo "[ Success 1/1 ]"
+	@rm OUTPUT
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/curl/README.md b/Examples/curl/README.md
new file mode 100644
index 00000000..734b0139
--- /dev/null
+++ b/Examples/curl/README.md
@@ -0,0 +1,18 @@
+# Curl
+
+This directory contains a Makefile and template manifest to run curl on Graphene. We tested it with
+curl 7.47.0 on Ubuntu 16.04 and with curl 7.58.0 on Ubuntu 18.04. This example uses curl installed
+on the system instead of compiling from source as some of the other examples do. On Ubuntu 16.04,
+please make sure that `libnss-mdns` is installed and if not, run the following command:
+
+```sh
+sudo apt-get install libnss-mdns
+```
+
+The Makefile and the template manifest contain comments to hopefully make them easier to understand.
+
+# Quick Start
+
+To run the regression test execute ```make check```. To do the same for SGX, execute ```make SGX=1
+check```. The regression test downloads the index page of `example.com`, thus it requires Internet
+connection.
diff --git a/Examples/curl/curl.manifest.template b/Examples/curl/curl.manifest.template
new file mode 100644
index 00000000..63234826
--- /dev/null
+++ b/Examples/curl/curl.manifest.template
@@ -0,0 +1,76 @@
+# Curl manifest file example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+# Executable to load into Graphene and run.
+loader.exec = file:$(CURL_DIR)curl
+loader.execname = file:curl
+
+# LibOS layer library of Graphene. There is currently only one implementation,
+# so it is always set to libsysdb.so. 
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively).
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
+# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
+# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to required libraries (in 'uri') into in-Graphene
+# visible directory /lib (in 'path').
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.lib3.type = chroot
+fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu
+fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu
+
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+fs.mount.curl.type = chroot
+fs.mount.curl.path = $(CURL_DIR)
+fs.mount.curl.uri = file:$(CURL_DIR)
+
+# Set enclave size (somewhat arbitrarily) to 256MB. Recall that SGX v1 requires
+# to specify enclave size at enclave creation time.
+sgx.enclave_size = 256M
+
+# Set maximum number of in-enclave threads (somewhat arbitrarily) to 4. Recall
+# that SGX v1 requires to specify the maximum number of simultaneous threads at
+# enclave creation time.
+sgx.thread_num = 4
+
+# Specify all libraries used by curl and its dependencies (including all libs
+# which can be loaded at runtime via dlopen).
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libresolv = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2
+sgx.trusted_files.libnssdns = file:$(GRAPHENEDIR)/Runtime/libnss_dns.so.2
+sgx.trusted_files.libnss_files = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnss_mdns4_minimal = file:/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
+$(CURL_TRUSTED_LIBS)
+
+# Name Service Switch (NSS) files. Glibc reads these files as part of name-
+# service information gathering. For more info, see 'man nsswitch.conf'.
+sgx.allowed_files.nsswitch   = file:/etc/nsswitch.conf
+sgx.allowed_files.hostconf   = file:/etc/host.conf
+sgx.allowed_files.resolvconf = file:/etc/resolv.conf
+sgx.allowed_files.ethers     = file:/etc/ethers
+sgx.allowed_files.hosts      = file:/etc/hosts
+sgx.allowed_files.group      = file:/etc/group
+sgx.allowed_files.passwd     = file:/etc/passwd
+sgx.allowed_files.gaiconf    = file:/etc/gai.conf
diff --git a/Examples/curl/test-docroot/index.html b/Examples/curl/test-docroot/index.html
new file mode 100644
index 00000000..b29f03ed
--- /dev/null
+++ b/Examples/curl/test-docroot/index.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+Hello World!
diff --git a/Examples/gcc/.gitignore b/Examples/gcc/.gitignore
new file mode 100644
index 00000000..97d3254b
--- /dev/null
+++ b/Examples/gcc/.gitignore
@@ -0,0 +1,4 @@
+/test_files/bzip2
+/test_files/gzip
+/test_files/hello
+/cc1-trusted-libs
diff --git a/Examples/gcc/Makefile b/Examples/gcc/Makefile
new file mode 100644
index 00000000..d875d66d
--- /dev/null
+++ b/Examples/gcc/Makefile
@@ -0,0 +1,126 @@
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= $(THIS_DIR)../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+# All the tools/executables required for this example (alphabetic order).
+TOOLS = as cc1 collect2 gcc ld
+
+# awk '{print $NF}' ...  print last field.
+BINUTILS_VERSION ?= $(shell ld -v | awk '{print $$NF}')
+GCC_MAJOR_VERSION ?= $(shell gcc -v 2>&1 | tail -n1 | awk '{print $$3}' | awk 'BEGIN {FS="."}{print $$1}')
+GCC_LIB_PATH ?= /usr/lib/gcc/x86_64-linux-gnu
+
+.PHONY: all
+ifeq ($(SGX),1)
+all: $(addsuffix .token, $(TOOLS)) pal_loader
+else
+all: $(addsuffix .manifest, $(TOOLS)) pal_loader
+endif
+
+%.manifest: %.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(BINUTILS_VERSION)|'"$(BINUTILS_VERSION)"'|g' \
+		-e 's|$$(GCC_MAJOR_VERSION)|'"$(GCC_MAJOR_VERSION)"'|g' \
+		-e 's|$$(GCC_LIB_PATH)|'"$(GCC_LIB_PATH)"'|g' \
+		-e 's|$$(CC1_TRUSTED_LIBS)|'"`cat cc1-trusted-libs`"'|g' \
+		-e 's|$$(LD_TRUSTED_FILES)|'"`cat ld-gcc-$(GCC_MAJOR_VERSION)-trusted-files`"'|g' \
+		$< > $@
+
+# Prevent .manifest/.manifest.sgx from automatically being deleted by make
+.SECONDARY: $(addsuffix .manifest.sgx, $(TOOLS))
+.SECONDARY: $(addsuffix .manifest, $(TOOLS))
+.SECONDARY: gcc.sig
+
+# Rules to generate the SGX-specific manifest (.manifest.sgx), the enclave signature (.sig), and the
+# enclave initialization token (.token).
+%.manifest.sgx: %.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+# .sig file is actually generated by the above target %.manifest.sgx. The %.sig target is required
+# make `make` aware of this. Also, the target must actually have at least one command, otherwise it
+# does not work as intended.
+%.sig: %.manifest.sgx
+	@echo -n ""
+
+%.token: %.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token -output $@ -sig $<
+
+# Create link to pal_loader for convenience.
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+# Dependencies between the various tools.
+gcc.manifest.sgx: as.sig cc1.sig collect2.sig
+collect2.manifest.sgx: ld.sig
+cc1.manifest: cc1-trusted-libs
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libutil libpthread
+
+# List all the cc1 dependencies, besides Glibc libraries
+.INTERMEDIATE: cc1-ldd
+cc1-ldd: $(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/cc1
+%-ldd:
+	@for F in $^; do \
+		ldd $$F >> $@ || exit 1; done
+
+%-deps: %-ldd
+	cat $< | awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' \
+		| sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generate manifest rules for trusted shared libraries
+%-trusted-libs: %-deps
+	for F in `cat $<`; do \
+		P=`cat $*-ldd | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+.PHONY: check
+check: all
+	@echo "\n\nCompile hello.c:"
+	./pal_loader gcc.manifest test_files/helloworld.c -o test_files/hello
+	@chmod 755 test_files/hello
+	-./test_files/hello
+	$(RM) test_files/hello
+
+	@echo "\n\nCompile bzip2.c:"
+	./pal_loader ./gcc.manifest test_files/bzip2.c -o test_files/bzip2
+	@chmod 755 test_files/bzip2
+	$(RM) bzip2.tmp
+	@cp -f test_files/bzip2 test_files/bzip2.copy
+	./test_files/bzip2 -z test_files/bzip2.copy
+	./test_files/bzip2 -d test_files/bzip2.copy.bz2
+	diff -q test_files/bzip2 test_files/bzip2.copy
+	$(RM) test_files/bzip2 test_file/bzip2.copy
+
+	@echo "\n\nCompile gzip.c:"
+	./pal_loader ./gcc.manifest test_files/gzip.c -o test_files/gzip
+	@chmod 755 test_files/gzip
+	@cp -f test_files/gzip test_files/gzip.copy
+	./test_files/gzip test_files/gzip.copy
+	./test_files/gzip -d test_files/gzip.copy.gz
+	diff -q test_files/gzip test_files/gzip.copy
+	$(RM) test_files/gzip test_files/gzip.copy
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.sig *.token pal_loader
+	$(RM) *-deps *-ldd *-trusted-libs
+	$(RM) test_files/bzip2.copy
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/gcc/README.md b/Examples/gcc/README.md
new file mode 100644
index 00000000..44aea16e
--- /dev/null
+++ b/Examples/gcc/README.md
@@ -0,0 +1,19 @@
+# Introduction
+
+This directory contains a Makefile and template manifests to run gcc and its related tools on
+Graphene. We tested with gcc version 5.5.0 and binutils (as, ld) version 2.26.1 on Ubuntu 16.04. We
+also tested on Ubuntu 18.04 with gcc version 7.4.0 and binutils version 2.30. This example uses the
+package version of gcc and related tools (as, cc1, collect2, ld) installed on the system instead of
+compiling them from source as some of the other examples do.
+
+The Makefile and the template manifest contain comments to hopefully make them easier to understand.
+
+# Quick Start
+
+To run the regression tests execute ```make check```. To do the same for SGX, execute ```SGX=1 make
+check```. The regression tests build three sample programs - helloworld.c, bzip2.c and gzip.c - and
+test their functionality.
+
+By looking at the Makefile "check" target you can see how gcc is invoked to compile individual
+source files under the hood. If you want to compile different and/or more complex applications, you
+would likely need to tweak the manifest files to whitelist additional files.
diff --git a/Examples/gcc/as.manifest.template b/Examples/gcc/as.manifest.template
new file mode 100644
index 00000000..902c179b
--- /dev/null
+++ b/Examples/gcc/as.manifest.template
@@ -0,0 +1,37 @@
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.exec = file:/usr/bin/as
+loader.execname = /usr/bin/as
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = /bin:/usr/bin
+loader.debug_type = $(GRAPHENEDEBUG)
+
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+sgx.enclave_size = 1G
+sgx.static_address = 1
+
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1
+sgx.trusted_files.libopcodes = file:/usr/lib/x86_64-linux-gnu/libopcodes-$(BINUTILS_VERSION)-system.so
+sgx.trusted_files.libbfd = file:/usr/lib/x86_64-linux-gnu/libbfd-$(BINUTILS_VERSION)-system.so
+
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.test_files = file:test_files
diff --git a/Examples/gcc/cc1.manifest.template b/Examples/gcc/cc1.manifest.template
new file mode 100644
index 00000000..45fe4a80
--- /dev/null
+++ b/Examples/gcc/cc1.manifest.template
@@ -0,0 +1,39 @@
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.exec = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/cc1
+loader.execname = cc1
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = /bin:/usr/bin
+loader.debug_type = $(GRAPHENEDEBUG)
+
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+sgx.enclave_size = 1G
+sgx.static_address = 1
+
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+$(CC1_TRUSTED_LIBS)
+
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.test_files = file:test_files
+sgx.allowed_files.inc = file:/usr/include
+sgx.allowed_files.gccinc = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/include
+sgx.allowed_files.gccincfixed = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/include-fixed
diff --git a/Examples/gcc/collect2.manifest.template b/Examples/gcc/collect2.manifest.template
new file mode 100644
index 00000000..56d2e249
--- /dev/null
+++ b/Examples/gcc/collect2.manifest.template
@@ -0,0 +1,38 @@
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.exec = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/collect2
+loader.execname = collect2
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = /bin:/usr/bin
+loader.debug_type = $(GRAPHENEDEBUG)
+
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+sgx.enclave_size = 1G
+sgx.static_address = 1
+
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+sgx.trusted_files.linker = file:/usr/bin/ld
+
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.test_files = file:test_files
+
+sgx.trusted_children.linker = file:ld.sig
diff --git a/Examples/gcc/gcc.manifest.template b/Examples/gcc/gcc.manifest.template
new file mode 100644
index 00000000..37d6a8f3
--- /dev/null
+++ b/Examples/gcc/gcc.manifest.template
@@ -0,0 +1,42 @@
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.exec = file:/usr/bin/gcc
+loader.execname = /usr/bin/gcc
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = /bin:/usr/bin
+loader.debug_type = $(GRAPHENEDEBUG)
+
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+sgx.enclave_size = 1G
+sgx.static_address = 1
+
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+sgx.trusted_files.cc1 = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/cc1
+sgx.trusted_files.collect2 = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/collect2
+sgx.trusted_files.as = file:/usr/bin/as
+
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.test_files = file:test_files
+
+sgx.trusted_children.cc1 = file:cc1.sig
+sgx.trusted_children.collect2 = file:collect2.sig
+sgx.trusted_children.as = file:as.sig
diff --git a/Examples/gcc/ld-gcc-5-trusted-files b/Examples/gcc/ld-gcc-5-trusted-files
new file mode 100644
index 00000000..320419e7
--- /dev/null
+++ b/Examples/gcc/ld-gcc-5-trusted-files
@@ -0,0 +1 @@
+# No additional gcc-5 specific trusted files required.
\ No newline at end of file
diff --git a/Examples/gcc/ld-gcc-7-trusted-files b/Examples/gcc/ld-gcc-7-trusted-files
new file mode 100644
index 00000000..51779154
--- /dev/null
+++ b/Examples/gcc/ld-gcc-7-trusted-files
@@ -0,0 +1 @@
+sgx.trusted_files.crtbeginSo = file:/usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o\nsgx.trusted_files.libgccsso = file:/usr/lib/gcc/x86_64-linux-gnu/7/libgcc_s.so.1\nsgx.trusted_files.crtendSo = file:/usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o
\ No newline at end of file
diff --git a/Examples/gcc/ld.manifest.template b/Examples/gcc/ld.manifest.template
new file mode 100644
index 00000000..dccff2dc
--- /dev/null
+++ b/Examples/gcc/ld.manifest.template
@@ -0,0 +1,49 @@
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.exec = file:/usr/bin/ld
+loader.execname = /usr/bin/ld
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = /bin:/usr/bin
+loader.debug_type = $(GRAPHENEDEBUG)
+
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+sgx.enclave_size = 1G
+sgx.static_address = 1
+
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1
+sgx.trusted_files.libbfd = file:/usr/lib/x86_64-linux-gnu/libbfd-$(BINUTILS_VERSION)-system.so
+
+sgx.trusted_files.liblto = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/liblto_plugin.so
+sgx.trusted_files.libgcc = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/libgcc_s.so
+sgx.trusted_files.libgcca = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/libgcc.a
+sgx.trusted_files.crtend = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/crtend.o
+sgx.trusted_files.crtbegin = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/crtbegin.o
+
+$(LD_TRUSTED_FILES)
+
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.test_files = file:test_files
+sgx.allowed_files.aout = file:a.out
+
+sgx.allowed_files.hostdebug = file:/usr/lib/debug/usr/lib/x86_64-linux-gnu
+sgx.allowed_files.hostusrlib = file:/usr/lib/x86_64-linux-gnu
+sgx.allowed_files.hostlib = file:/lib/x86_64-linux-gnu
diff --git a/Examples/gcc/test_files/.gitignore b/Examples/gcc/test_files/.gitignore
new file mode 100644
index 00000000..89a9a777
--- /dev/null
+++ b/Examples/gcc/test_files/.gitignore
@@ -0,0 +1 @@
+bzip2.copy
diff --git a/Examples/gcc/test_files/bzip2.c b/Examples/gcc/test_files/bzip2.c
new file mode 100644
index 00000000..ec8abe33
--- /dev/null
+++ b/Examples/gcc/test_files/bzip2.c
@@ -0,0 +1,6998 @@
+/*-------------------------------------------------------------*/
+/*--- Public header file for the library.                   ---*/
+/*---                                               bzlib.h ---*/
+/*-------------------------------------------------------------*/
+
+/*--
+  This file is a part of bzip2 and/or libbzip2, a program and
+  library for lossless, block-sorting data compression.
+
+  Copyright (C) 1996-2002 Julian R Seward.  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+
+  2. The origin of this software must not be misrepresented; you must 
+     not claim that you wrote the original software.  If you use this 
+     software in a product, an acknowledgment in the product 
+     documentation would be appreciated but is not required.
+
+  3. Altered source versions must be plainly marked as such, and must
+     not be misrepresented as being the original software.
+
+  4. The name of the author may not be used to endorse or promote 
+     products derived from this software without specific prior written 
+     permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
+  OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+  DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+  GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+  Julian Seward, Cambridge, UK.
+  jseward@acm.org
+  bzip2/libbzip2 version 1.0 of 21 March 2000
+
+  This program is based on (at least) the work of:
+     Mike Burrows
+     David Wheeler
+     Peter Fenwick
+     Alistair Moffat
+     Radford Neal
+     Ian H. Witten
+     Robert Sedgewick
+     Jon L. Bentley
+
+  For more information on these sources, see the manual.
+--*/
+
+
+#ifndef _BZLIB_H
+#define _BZLIB_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define BZ_RUN               0
+#define BZ_FLUSH             1
+#define BZ_FINISH            2
+
+#define BZ_OK                0
+#define BZ_RUN_OK            1
+#define BZ_FLUSH_OK          2
+#define BZ_FINISH_OK         3
+#define BZ_STREAM_END        4
+#define BZ_SEQUENCE_ERROR    (-1)
+#define BZ_PARAM_ERROR       (-2)
+#define BZ_MEM_ERROR         (-3)
+#define BZ_DATA_ERROR        (-4)
+#define BZ_DATA_ERROR_MAGIC  (-5)
+#define BZ_IO_ERROR          (-6)
+#define BZ_UNEXPECTED_EOF    (-7)
+#define BZ_OUTBUFF_FULL      (-8)
+#define BZ_CONFIG_ERROR      (-9)
+
+typedef 
+   struct {
+      char *next_in;
+      unsigned int avail_in;
+      unsigned int total_in_lo32;
+      unsigned int total_in_hi32;
+
+      char *next_out;
+      unsigned int avail_out;
+      unsigned int total_out_lo32;
+      unsigned int total_out_hi32;
+
+      void *state;
+
+      void *(*bzalloc)(void *,int,int);
+      void (*bzfree)(void *,void *);
+      void *opaque;
+   } 
+   bz_stream;
+
+
+#ifndef BZ_IMPORT
+#define BZ_EXPORT
+#endif
+
+/* Need a definitition for FILE */
+#include <stdio.h>
+
+#ifdef _WIN32
+#   include <windows.h>
+#   ifdef small
+      /* windows.h define small to char */
+#      undef small
+#   endif
+#   ifdef BZ_EXPORT
+#   define BZ_API(func) WINAPI func
+#   define BZ_EXTERN extern
+#   else
+   /* import windows dll dynamically */
+#   define BZ_API(func) (WINAPI * func)
+#   define BZ_EXTERN
+#   endif
+#else
+#   define BZ_API(func) func
+#   define BZ_EXTERN extern
+#endif
+
+
+/*-- Core (low-level) library functions --*/
+
+BZ_EXTERN int BZ_API(BZ2_bzCompressInit) ( 
+      bz_stream* strm, 
+      int        blockSize100k, 
+      int        verbosity, 
+      int        workFactor 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzCompress) ( 
+      bz_stream* strm, 
+      int action 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzCompressEnd) ( 
+      bz_stream* strm 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzDecompressInit) ( 
+      bz_stream *strm, 
+      int       verbosity, 
+      int       small
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzDecompress) ( 
+      bz_stream* strm 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzDecompressEnd) ( 
+      bz_stream *strm 
+   );
+
+
+
+/*-- High(er) level library functions --*/
+
+#ifndef BZ_NO_STDIO
+#define BZ_MAX_UNUSED 5000
+
+typedef void BZFILE;
+
+BZ_EXTERN BZFILE* BZ_API(BZ2_bzReadOpen) ( 
+      int*  bzerror,   
+      FILE* f, 
+      int   verbosity, 
+      int   small,
+      void* unused,    
+      int   nUnused 
+   );
+
+BZ_EXTERN void BZ_API(BZ2_bzReadClose) ( 
+      int*    bzerror, 
+      BZFILE* b 
+   );
+
+BZ_EXTERN void BZ_API(BZ2_bzReadGetUnused) ( 
+      int*    bzerror, 
+      BZFILE* b, 
+      void**  unused,  
+      int*    nUnused 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzRead) ( 
+      int*    bzerror, 
+      BZFILE* b, 
+      void*   buf, 
+      int     len 
+   );
+
+BZ_EXTERN BZFILE* BZ_API(BZ2_bzWriteOpen) ( 
+      int*  bzerror,      
+      FILE* f, 
+      int   blockSize100k, 
+      int   verbosity, 
+      int   workFactor 
+   );
+
+BZ_EXTERN void BZ_API(BZ2_bzWrite) ( 
+      int*    bzerror, 
+      BZFILE* b, 
+      void*   buf, 
+      int     len 
+   );
+
+BZ_EXTERN void BZ_API(BZ2_bzWriteClose) ( 
+      int*          bzerror, 
+      BZFILE*       b, 
+      int           abandon, 
+      unsigned int* nbytes_in, 
+      unsigned int* nbytes_out 
+   );
+
+BZ_EXTERN void BZ_API(BZ2_bzWriteClose64) ( 
+      int*          bzerror, 
+      BZFILE*       b, 
+      int           abandon, 
+      unsigned int* nbytes_in_lo32, 
+      unsigned int* nbytes_in_hi32, 
+      unsigned int* nbytes_out_lo32, 
+      unsigned int* nbytes_out_hi32
+   );
+#endif
+
+
+/*-- Utility functions --*/
+
+BZ_EXTERN int BZ_API(BZ2_bzBuffToBuffCompress) ( 
+      char*         dest, 
+      unsigned int* destLen,
+      char*         source, 
+      unsigned int  sourceLen,
+      int           blockSize100k, 
+      int           verbosity, 
+      int           workFactor 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzBuffToBuffDecompress) ( 
+      char*         dest, 
+      unsigned int* destLen,
+      char*         source, 
+      unsigned int  sourceLen,
+      int           small, 
+      int           verbosity 
+   );
+
+
+/*--
+   Code contributed by Yoshioka Tsuneo
+   (QWF00133@niftyserve.or.jp/tsuneo-y@is.aist-nara.ac.jp),
+   to support better zlib compatibility.
+   This code is not _officially_ part of libbzip2 (yet);
+   I haven't tested it, documented it, or considered the
+   threading-safeness of it.
+   If this code breaks, please contact both Yoshioka and me.
+--*/
+
+BZ_EXTERN const char * BZ_API(BZ2_bzlibVersion) (
+      void
+   );
+
+#ifndef BZ_NO_STDIO
+BZ_EXTERN BZFILE * BZ_API(BZ2_bzopen) (
+      const char *path,
+      const char *mode
+   );
+
+BZ_EXTERN BZFILE * BZ_API(BZ2_bzdopen) (
+      int        fd,
+      const char *mode
+   );
+         
+BZ_EXTERN int BZ_API(BZ2_bzread) (
+      BZFILE* b, 
+      void* buf, 
+      int len 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzwrite) (
+      BZFILE* b, 
+      void*   buf, 
+      int     len 
+   );
+
+BZ_EXTERN int BZ_API(BZ2_bzflush) (
+      BZFILE* b
+   );
+
+BZ_EXTERN void BZ_API(BZ2_bzclose) (
+      BZFILE* b
+   );
+
+BZ_EXTERN const char * BZ_API(BZ2_bzerror) (
+      BZFILE *b, 
+      int    *errnum
+   );
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+
+/*-------------------------------------------------------------*/
+/*--- end                                           bzlib.h ---*/
+/*-------------------------------------------------------------*/
+/*-------------------------------------------------------------*/
+/*--- Private header file for the library.                  ---*/
+/*---                                       bzlib_private.h ---*/
+/*-------------------------------------------------------------*/
+
+#ifndef _BZLIB_PRIVATE_H
+#define _BZLIB_PRIVATE_H
+
+#include <stdlib.h>
+
+#ifndef BZ_NO_STDIO
+#include <stdio.h>
+#include <ctype.h>
+#include <string.h>
+#endif
+
+
+/*-- General stuff. --*/
+
+#define BZ_VERSION  "1.0.2, 30-Dec-2001"
+
+typedef char            Char;
+typedef unsigned char   Bool;
+typedef unsigned char   UChar;
+typedef int             Int32;
+typedef unsigned int    UInt32;
+typedef short           Int16;
+typedef unsigned short  UInt16;
+
+#define True  ((Bool)1)
+#define False ((Bool)0)
+
+#ifndef __GNUC__
+#define __inline__  /* */
+#endif 
+
+#ifndef BZ_NO_STDIO
+extern void BZ2_bz__AssertH__fail ( int errcode );
+#define AssertH(cond,errcode) \
+   { if (!(cond)) BZ2_bz__AssertH__fail ( errcode ); }
+#if BZ_DEBUG
+#define AssertD(cond,msg) \
+   { if (!(cond)) {       \
+      fprintf ( stderr,   \
+        "\n\nlibbzip2(debug build): internal error\n\t%s\n", msg );\
+      exit(1); \
+   }}
+#else
+#define AssertD(cond,msg) /* */
+#endif
+#define VPrintf0(zf) \
+   fprintf(stderr,zf)
+#define VPrintf1(zf,za1) \
+   fprintf(stderr,zf,za1)
+#define VPrintf2(zf,za1,za2) \
+   fprintf(stderr,zf,za1,za2)
+#define VPrintf3(zf,za1,za2,za3) \
+   fprintf(stderr,zf,za1,za2,za3)
+#define VPrintf4(zf,za1,za2,za3,za4) \
+   fprintf(stderr,zf,za1,za2,za3,za4)
+#define VPrintf5(zf,za1,za2,za3,za4,za5) \
+   fprintf(stderr,zf,za1,za2,za3,za4,za5)
+#else
+extern void bz_internal_error ( int errcode );
+#define AssertH(cond,errcode) \
+   { if (!(cond)) bz_internal_error ( errcode ); }
+#define AssertD(cond,msg) /* */
+#define VPrintf0(zf) /* */
+#define VPrintf1(zf,za1) /* */
+#define VPrintf2(zf,za1,za2) /* */
+#define VPrintf3(zf,za1,za2,za3) /* */
+#define VPrintf4(zf,za1,za2,za3,za4) /* */
+#define VPrintf5(zf,za1,za2,za3,za4,za5) /* */
+#endif
+
+
+#define BZALLOC(nnn) (strm->bzalloc)(strm->opaque,(nnn),1)
+#define BZFREE(ppp)  (strm->bzfree)(strm->opaque,(ppp))
+
+
+/*-- Header bytes. --*/
+
+#define BZ_HDR_B 0x42   /* 'B' */
+#define BZ_HDR_Z 0x5a   /* 'Z' */
+#define BZ_HDR_h 0x68   /* 'h' */
+#define BZ_HDR_0 0x30   /* '0' */
+  
+/*-- Constants for the back end. --*/
+
+#define BZ_MAX_ALPHA_SIZE 258
+#define BZ_MAX_CODE_LEN    23
+
+#define BZ_RUNA 0
+#define BZ_RUNB 1
+
+#define BZ_N_GROUPS 6
+#define BZ_G_SIZE   50
+#define BZ_N_ITERS  4
+
+#define BZ_MAX_SELECTORS (2 + (900000 / BZ_G_SIZE))
+
+
+
+/*-- Stuff for randomising repetitive blocks. --*/
+
+extern Int32 BZ2_rNums[512];
+
+#define BZ_RAND_DECLS                          \
+   Int32 rNToGo;                               \
+   Int32 rTPos                                 \
+
+#define BZ_RAND_INIT_MASK                      \
+   s->rNToGo = 0;                              \
+   s->rTPos  = 0                               \
+
+#define BZ_RAND_MASK ((s->rNToGo == 1) ? 1 : 0)
+
+#define BZ_RAND_UPD_MASK                       \
+   if (s->rNToGo == 0) {                       \
+      s->rNToGo = BZ2_rNums[s->rTPos];         \
+      s->rTPos++;                              \
+      if (s->rTPos == 512) s->rTPos = 0;       \
+   }                                           \
+   s->rNToGo--;
+
+
+
+/*-- Stuff for doing CRCs. --*/
+
+extern UInt32 BZ2_crc32Table[256];
+
+#define BZ_INITIALISE_CRC(crcVar)              \
+{                                              \
+   crcVar = 0xffffffffL;                       \
+}
+
+#define BZ_FINALISE_CRC(crcVar)                \
+{                                              \
+   crcVar = ~(crcVar);                         \
+}
+
+#define BZ_UPDATE_CRC(crcVar,cha)              \
+{                                              \
+   crcVar = (crcVar << 8) ^                    \
+            BZ2_crc32Table[(crcVar >> 24) ^    \
+                           ((UChar)cha)];      \
+}
+
+
+
+/*-- States and modes for compression. --*/
+
+#define BZ_M_IDLE      1
+#define BZ_M_RUNNING   2
+#define BZ_M_FLUSHING  3
+#define BZ_M_FINISHING 4
+
+#define BZ_S_OUTPUT    1
+#define BZ_S_INPUT     2
+
+#define BZ_N_RADIX 2
+#define BZ_N_QSORT 12
+#define BZ_N_SHELL 18
+#define BZ_N_OVERSHOOT (BZ_N_RADIX + BZ_N_QSORT + BZ_N_SHELL + 2)
+
+
+
+
+/*-- Structure holding all the compression-side stuff. --*/
+
+typedef
+   struct {
+      /* pointer back to the struct bz_stream */
+      bz_stream* strm;
+
+      /* mode this stream is in, and whether inputting */
+      /* or outputting data */
+      Int32    mode;
+      Int32    state;
+
+      /* remembers avail_in when flush/finish requested */
+      UInt32   avail_in_expect;
+
+      /* for doing the block sorting */
+      UInt32*  arr1;
+      UInt32*  arr2;
+      UInt32*  ftab;
+      Int32    origPtr;
+
+      /* aliases for arr1 and arr2 */
+      UInt32*  ptr;
+      UChar*   block;
+      UInt16*  mtfv;
+      UChar*   zbits;
+
+      /* for deciding when to use the fallback sorting algorithm */
+      Int32    workFactor;
+
+      /* run-length-encoding of the input */
+      UInt32   state_in_ch;
+      Int32    state_in_len;
+      BZ_RAND_DECLS;
+
+      /* input and output limits and current posns */
+      Int32    nblock;
+      Int32    nblockMAX;
+      Int32    numZ;
+      Int32    state_out_pos;
+
+      /* map of bytes used in block */
+      Int32    nInUse;
+      Bool     inUse[256];
+      UChar    unseqToSeq[256];
+
+      /* the buffer for bit stream creation */
+      UInt32   bsBuff;
+      Int32    bsLive;
+
+      /* block and combined CRCs */
+      UInt32   blockCRC;
+      UInt32   combinedCRC;
+
+      /* misc administratium */
+      Int32    verbosity;
+      Int32    blockNo;
+      Int32    blockSize100k;
+
+      /* stuff for coding the MTF values */
+      Int32    nMTF;
+      Int32    mtfFreq    [BZ_MAX_ALPHA_SIZE];
+      UChar    selector   [BZ_MAX_SELECTORS];
+      UChar    selectorMtf[BZ_MAX_SELECTORS];
+
+      UChar    len     [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+      Int32    code    [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+      Int32    rfreq   [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+      /* second dimension: only 3 needed; 4 makes index calculations faster */
+      UInt32   len_pack[BZ_MAX_ALPHA_SIZE][4];
+
+   }
+   EState;
+
+
+
+/*-- externs for compression. --*/
+
+extern void 
+BZ2_blockSort ( EState* );
+
+extern void 
+BZ2_compressBlock ( EState*, Bool );
+
+extern void 
+BZ2_bsInitWrite ( EState* );
+
+extern void 
+BZ2_hbAssignCodes ( Int32*, UChar*, Int32, Int32, Int32 );
+
+extern void 
+BZ2_hbMakeCodeLengths ( UChar*, Int32*, Int32, Int32 );
+
+
+
+/*-- states for decompression. --*/
+
+#define BZ_X_IDLE        1
+#define BZ_X_OUTPUT      2
+
+#define BZ_X_MAGIC_1     10
+#define BZ_X_MAGIC_2     11
+#define BZ_X_MAGIC_3     12
+#define BZ_X_MAGIC_4     13
+#define BZ_X_BLKHDR_1    14
+#define BZ_X_BLKHDR_2    15
+#define BZ_X_BLKHDR_3    16
+#define BZ_X_BLKHDR_4    17
+#define BZ_X_BLKHDR_5    18
+#define BZ_X_BLKHDR_6    19
+#define BZ_X_BCRC_1      20
+#define BZ_X_BCRC_2      21
+#define BZ_X_BCRC_3      22
+#define BZ_X_BCRC_4      23
+#define BZ_X_RANDBIT     24
+#define BZ_X_ORIGPTR_1   25
+#define BZ_X_ORIGPTR_2   26
+#define BZ_X_ORIGPTR_3   27
+#define BZ_X_MAPPING_1   28
+#define BZ_X_MAPPING_2   29
+#define BZ_X_SELECTOR_1  30
+#define BZ_X_SELECTOR_2  31
+#define BZ_X_SELECTOR_3  32
+#define BZ_X_CODING_1    33
+#define BZ_X_CODING_2    34
+#define BZ_X_CODING_3    35
+#define BZ_X_MTF_1       36
+#define BZ_X_MTF_2       37
+#define BZ_X_MTF_3       38
+#define BZ_X_MTF_4       39
+#define BZ_X_MTF_5       40
+#define BZ_X_MTF_6       41
+#define BZ_X_ENDHDR_2    42
+#define BZ_X_ENDHDR_3    43
+#define BZ_X_ENDHDR_4    44
+#define BZ_X_ENDHDR_5    45
+#define BZ_X_ENDHDR_6    46
+#define BZ_X_CCRC_1      47
+#define BZ_X_CCRC_2      48
+#define BZ_X_CCRC_3      49
+#define BZ_X_CCRC_4      50
+
+
+
+/*-- Constants for the fast MTF decoder. --*/
+
+#define MTFA_SIZE 4096
+#define MTFL_SIZE 16
+
+
+
+/*-- Structure holding all the decompression-side stuff. --*/
+
+typedef
+   struct {
+      /* pointer back to the struct bz_stream */
+      bz_stream* strm;
+
+      /* state indicator for this stream */
+      Int32    state;
+
+      /* for doing the final run-length decoding */
+      UChar    state_out_ch;
+      Int32    state_out_len;
+      Bool     blockRandomised;
+      BZ_RAND_DECLS;
+
+      /* the buffer for bit stream reading */
+      UInt32   bsBuff;
+      Int32    bsLive;
+
+      /* misc administratium */
+      Int32    blockSize100k;
+      Bool     smallDecompress;
+      Int32    currBlockNo;
+      Int32    verbosity;
+
+      /* for undoing the Burrows-Wheeler transform */
+      Int32    origPtr;
+      UInt32   tPos;
+      Int32    k0;
+      Int32    unzftab[256];
+      Int32    nblock_used;
+      Int32    cftab[257];
+      Int32    cftabCopy[257];
+
+      /* for undoing the Burrows-Wheeler transform (FAST) */
+      UInt32   *tt;
+
+      /* for undoing the Burrows-Wheeler transform (SMALL) */
+      UInt16   *ll16;
+      UChar    *ll4;
+
+      /* stored and calculated CRCs */
+      UInt32   storedBlockCRC;
+      UInt32   storedCombinedCRC;
+      UInt32   calculatedBlockCRC;
+      UInt32   calculatedCombinedCRC;
+
+      /* map of bytes used in block */
+      Int32    nInUse;
+      Bool     inUse[256];
+      Bool     inUse16[16];
+      UChar    seqToUnseq[256];
+
+      /* for decoding the MTF values */
+      UChar    mtfa   [MTFA_SIZE];
+      Int32    mtfbase[256 / MTFL_SIZE];
+      UChar    selector   [BZ_MAX_SELECTORS];
+      UChar    selectorMtf[BZ_MAX_SELECTORS];
+      UChar    len  [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+
+      Int32    limit  [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+      Int32    base   [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+      Int32    perm   [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+      Int32    minLens[BZ_N_GROUPS];
+
+      /* save area for scalars in the main decompress code */
+      Int32    save_i;
+      Int32    save_j;
+      Int32    save_t;
+      Int32    save_alphaSize;
+      Int32    save_nGroups;
+      Int32    save_nSelectors;
+      Int32    save_EOB;
+      Int32    save_groupNo;
+      Int32    save_groupPos;
+      Int32    save_nextSym;
+      Int32    save_nblockMAX;
+      Int32    save_nblock;
+      Int32    save_es;
+      Int32    save_N;
+      Int32    save_curr;
+      Int32    save_zt;
+      Int32    save_zn; 
+      Int32    save_zvec;
+      Int32    save_zj;
+      Int32    save_gSel;
+      Int32    save_gMinlen;
+      Int32*   save_gLimit;
+      Int32*   save_gBase;
+      Int32*   save_gPerm;
+
+   }
+   DState;
+
+
+
+/*-- Macros for decompression. --*/
+
+#define BZ_GET_FAST(cccc)                     \
+    s->tPos = s->tt[s->tPos];                 \
+    cccc = (UChar)(s->tPos & 0xff);           \
+    s->tPos >>= 8;
+
+#define BZ_GET_FAST_C(cccc)                   \
+    c_tPos = c_tt[c_tPos];                    \
+    cccc = (UChar)(c_tPos & 0xff);            \
+    c_tPos >>= 8;
+
+#define SET_LL4(i,n)                                          \
+   { if (((i) & 0x1) == 0)                                    \
+        s->ll4[(i) >> 1] = (s->ll4[(i) >> 1] & 0xf0) | (n); else    \
+        s->ll4[(i) >> 1] = (s->ll4[(i) >> 1] & 0x0f) | ((n) << 4);  \
+   }
+
+#define GET_LL4(i)                             \
+   ((((UInt32)(s->ll4[(i) >> 1])) >> (((i) << 2) & 0x4)) & 0xF)
+
+#define SET_LL(i,n)                          \
+   { s->ll16[i] = (UInt16)(n & 0x0000ffff);  \
+     SET_LL4(i, n >> 16);                    \
+   }
+
+#define GET_LL(i) \
+   (((UInt32)s->ll16[i]) | (GET_LL4(i) << 16))
+
+#define BZ_GET_SMALL(cccc)                            \
+      cccc = BZ2_indexIntoF ( s->tPos, s->cftab );    \
+      s->tPos = GET_LL(s->tPos);
+
+
+/*-- externs for decompression. --*/
+
+extern Int32 
+BZ2_indexIntoF ( Int32, Int32* );
+
+extern Int32 
+BZ2_decompress ( DState* );
+
+extern void 
+BZ2_hbCreateDecodeTables ( Int32*, Int32*, Int32*, UChar*,
+                           Int32,  Int32, Int32 );
+
+
+#endif
+
+
+/*-- BZ_NO_STDIO seems to make NULL disappear on some platforms. --*/
+
+#ifdef BZ_NO_STDIO
+#ifndef NULL
+#define NULL 0
+#endif
+#endif
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                   bzlib_private.h ---*/
+/*-------------------------------------------------------------*/
+
+
+
+/*-------------------------------------------------------------*/
+/*--- Block sorting machinery                               ---*/
+/*---                                           blocksort.c ---*/
+/*-------------------------------------------------------------*/
+
+/*---------------------------------------------*/
+/*--- Fallback O(N log(N)^2) sorting        ---*/
+/*--- algorithm, for repetitive blocks      ---*/
+/*---------------------------------------------*/
+
+/*---------------------------------------------*/
+static 
+__inline__
+void fallbackSimpleSort ( UInt32* fmap, 
+                          UInt32* eclass, 
+                          Int32   lo, 
+                          Int32   hi )
+{
+   Int32 i, j, tmp;
+   UInt32 ec_tmp;
+
+   if (lo == hi) return;
+
+   if (hi - lo > 3) {
+      for ( i = hi-4; i >= lo; i-- ) {
+         tmp = fmap[i];
+         ec_tmp = eclass[tmp];
+         for ( j = i+4; j <= hi && ec_tmp > eclass[fmap[j]]; j += 4 )
+            fmap[j-4] = fmap[j];
+         fmap[j-4] = tmp;
+      }
+   }
+
+   for ( i = hi-1; i >= lo; i-- ) {
+      tmp = fmap[i];
+      ec_tmp = eclass[tmp];
+      for ( j = i+1; j <= hi && ec_tmp > eclass[fmap[j]]; j++ )
+         fmap[j-1] = fmap[j];
+      fmap[j-1] = tmp;
+   }
+}
+
+
+/*---------------------------------------------*/
+#define fswap(zz1, zz2) \
+   { Int32 zztmp = zz1; zz1 = zz2; zz2 = zztmp; }
+
+#define fvswap(zzp1, zzp2, zzn)       \
+{                                     \
+   Int32 yyp1 = (zzp1);               \
+   Int32 yyp2 = (zzp2);               \
+   Int32 yyn  = (zzn);                \
+   while (yyn > 0) {                  \
+      fswap(fmap[yyp1], fmap[yyp2]);  \
+      yyp1++; yyp2++; yyn--;          \
+   }                                  \
+}
+
+
+#define fmin(a,b) ((a) < (b)) ? (a) : (b)
+
+#define fpush(lz,hz) { stackLo[sp] = lz; \
+                       stackHi[sp] = hz; \
+                       sp++; }
+
+#define fpop(lz,hz) { sp--;              \
+                      lz = stackLo[sp];  \
+                      hz = stackHi[sp]; }
+
+#define FALLBACK_QSORT_SMALL_THRESH 10
+#define FALLBACK_QSORT_STACK_SIZE   100
+
+
+static
+void fallbackQSort3 ( UInt32* fmap, 
+                      UInt32* eclass,
+                      Int32   loSt, 
+                      Int32   hiSt )
+{
+   Int32 unLo, unHi, ltLo, gtHi, n, m;
+   Int32 sp, lo, hi;
+   UInt32 med, r, r3;
+   Int32 stackLo[FALLBACK_QSORT_STACK_SIZE];
+   Int32 stackHi[FALLBACK_QSORT_STACK_SIZE];
+
+   r = 0;
+
+   sp = 0;
+   fpush ( loSt, hiSt );
+
+   while (sp > 0) {
+
+      AssertH ( sp < FALLBACK_QSORT_STACK_SIZE, 1004 );
+
+      fpop ( lo, hi );
+      if (hi - lo < FALLBACK_QSORT_SMALL_THRESH) {
+         fallbackSimpleSort ( fmap, eclass, lo, hi );
+         continue;
+      }
+
+      /* Random partitioning.  Median of 3 sometimes fails to
+         avoid bad cases.  Median of 9 seems to help but 
+         looks rather expensive.  This too seems to work but
+         is cheaper.  Guidance for the magic constants 
+         7621 and 32768 is taken from Sedgewick's algorithms
+         book, chapter 35.
+      */
+      r = ((r * 7621) + 1) % 32768;
+      r3 = r % 3;
+      if (r3 == 0) med = eclass[fmap[lo]]; else
+      if (r3 == 1) med = eclass[fmap[(lo+hi)>>1]]; else
+                   med = eclass[fmap[hi]];
+
+      unLo = ltLo = lo;
+      unHi = gtHi = hi;
+
+      while (1) {
+         while (1) {
+            if (unLo > unHi) break;
+            n = (Int32)eclass[fmap[unLo]] - (Int32)med;
+            if (n == 0) { 
+               fswap(fmap[unLo], fmap[ltLo]); 
+               ltLo++; unLo++; 
+               continue; 
+            };
+            if (n > 0) break;
+            unLo++;
+         }
+         while (1) {
+            if (unLo > unHi) break;
+            n = (Int32)eclass[fmap[unHi]] - (Int32)med;
+            if (n == 0) { 
+               fswap(fmap[unHi], fmap[gtHi]); 
+               gtHi--; unHi--; 
+               continue; 
+            };
+            if (n < 0) break;
+            unHi--;
+         }
+         if (unLo > unHi) break;
+         fswap(fmap[unLo], fmap[unHi]); unLo++; unHi--;
+      }
+
+      AssertD ( unHi == unLo-1, "fallbackQSort3(2)" );
+
+      if (gtHi < ltLo) continue;
+
+      n = fmin(ltLo-lo, unLo-ltLo); fvswap(lo, unLo-n, n);
+      m = fmin(hi-gtHi, gtHi-unHi); fvswap(unLo, hi-m+1, m);
+
+      n = lo + unLo - ltLo - 1;
+      m = hi - (gtHi - unHi) + 1;
+
+      if (n - lo > hi - m) {
+         fpush ( lo, n );
+         fpush ( m, hi );
+      } else {
+         fpush ( m, hi );
+         fpush ( lo, n );
+      }
+   }
+}
+
+#undef fmin
+#undef fpush
+#undef fpop
+#undef fswap
+#undef fvswap
+#undef FALLBACK_QSORT_SMALL_THRESH
+#undef FALLBACK_QSORT_STACK_SIZE
+
+
+/*---------------------------------------------*/
+/* Pre:
+      nblock > 0
+      eclass exists for [0 .. nblock-1]
+      ((UChar*)eclass) [0 .. nblock-1] holds block
+      ptr exists for [0 .. nblock-1]
+
+   Post:
+      ((UChar*)eclass) [0 .. nblock-1] holds block
+      All other areas of eclass destroyed
+      fmap [0 .. nblock-1] holds sorted order
+      bhtab [ 0 .. 2+(nblock/32) ] destroyed
+*/
+
+#define       SET_BH(zz)  bhtab[(zz) >> 5] |= (1 << ((zz) & 31))
+#define     CLEAR_BH(zz)  bhtab[(zz) >> 5] &= ~(1 << ((zz) & 31))
+#define     ISSET_BH(zz)  (bhtab[(zz) >> 5] & (1 << ((zz) & 31)))
+#define      WORD_BH(zz)  bhtab[(zz) >> 5]
+#define UNALIGNED_BH(zz)  ((zz) & 0x01f)
+
+static
+void fallbackSort ( UInt32* fmap, 
+                    UInt32* eclass, 
+                    UInt32* bhtab,
+                    Int32   nblock,
+                    Int32   verb )
+{
+   Int32 ftab[257];
+   Int32 ftabCopy[256];
+   Int32 H, i, j, k, l, r, cc, cc1;
+   Int32 nNotDone;
+   Int32 nBhtab;
+   UChar* eclass8 = (UChar*)eclass;
+
+   /*--
+      Initial 1-char radix sort to generate
+      initial fmap and initial BH bits.
+   --*/
+   if (verb >= 4)
+      VPrintf0 ( "        bucket sorting ...\n" );
+   for (i = 0; i < 257;    i++) ftab[i] = 0;
+   for (i = 0; i < nblock; i++) ftab[eclass8[i]]++;
+   for (i = 0; i < 256;    i++) ftabCopy[i] = ftab[i];
+   for (i = 1; i < 257;    i++) ftab[i] += ftab[i-1];
+
+   for (i = 0; i < nblock; i++) {
+      j = eclass8[i];
+      k = ftab[j] - 1;
+      ftab[j] = k;
+      fmap[k] = i;
+   }
+
+   nBhtab = 2 + (nblock / 32);
+   for (i = 0; i < nBhtab; i++) bhtab[i] = 0;
+   for (i = 0; i < 256; i++) SET_BH(ftab[i]);
+
+   /*--
+      Inductively refine the buckets.  Kind-of an
+      "exponential radix sort" (!), inspired by the
+      Manber-Myers suffix array construction algorithm.
+   --*/
+
+   /*-- set sentinel bits for block-end detection --*/
+   for (i = 0; i < 32; i++) { 
+      SET_BH(nblock + 2*i);
+      CLEAR_BH(nblock + 2*i + 1);
+   }
+
+   /*-- the log(N) loop --*/
+   H = 1;
+   while (1) {
+
+      if (verb >= 4) 
+         VPrintf1 ( "        depth %6d has ", H );
+
+      j = 0;
+      for (i = 0; i < nblock; i++) {
+         if (ISSET_BH(i)) j = i;
+         k = fmap[i] - H; if (k < 0) k += nblock;
+         eclass[k] = j;
+      }
+
+      nNotDone = 0;
+      r = -1;
+      while (1) {
+
+	 /*-- find the next non-singleton bucket --*/
+         k = r + 1;
+         while (ISSET_BH(k) && UNALIGNED_BH(k)) k++;
+         if (ISSET_BH(k)) {
+            while (WORD_BH(k) == 0xffffffff) k += 32;
+            while (ISSET_BH(k)) k++;
+         }
+         l = k - 1;
+         if (l >= nblock) break;
+         while (!ISSET_BH(k) && UNALIGNED_BH(k)) k++;
+         if (!ISSET_BH(k)) {
+            while (WORD_BH(k) == 0x00000000) k += 32;
+            while (!ISSET_BH(k)) k++;
+         }
+         r = k - 1;
+         if (r >= nblock) break;
+
+         /*-- now [l, r] bracket current bucket --*/
+         if (r > l) {
+            nNotDone += (r - l + 1);
+            fallbackQSort3 ( fmap, eclass, l, r );
+
+            /*-- scan bucket and generate header bits-- */
+            cc = -1;
+            for (i = l; i <= r; i++) {
+               cc1 = eclass[fmap[i]];
+               if (cc != cc1) { SET_BH(i); cc = cc1; };
+            }
+         }
+      }
+
+      if (verb >= 4) 
+         VPrintf1 ( "%6d unresolved strings\n", nNotDone );
+
+      H *= 2;
+      if (H > nblock || nNotDone == 0) break;
+   }
+
+   /*-- 
+      Reconstruct the original block in
+      eclass8 [0 .. nblock-1], since the
+      previous phase destroyed it.
+   --*/
+   if (verb >= 4)
+      VPrintf0 ( "        reconstructing block ...\n" );
+   j = 0;
+   for (i = 0; i < nblock; i++) {
+      while (ftabCopy[j] == 0) j++;
+      ftabCopy[j]--;
+      eclass8[fmap[i]] = (UChar)j;
+   }
+   AssertH ( j < 256, 1005 );
+}
+
+#undef       SET_BH
+#undef     CLEAR_BH
+#undef     ISSET_BH
+#undef      WORD_BH
+#undef UNALIGNED_BH
+
+
+/*---------------------------------------------*/
+/*--- The main, O(N^2 log(N)) sorting       ---*/
+/*--- algorithm.  Faster for "normal"       ---*/
+/*--- non-repetitive blocks.                ---*/
+/*---------------------------------------------*/
+
+/*---------------------------------------------*/
+static
+__inline__
+Bool mainGtU ( UInt32  i1, 
+               UInt32  i2,
+               UChar*  block, 
+               UInt16* quadrant,
+               UInt32  nblock,
+               Int32*  budget )
+{
+   Int32  k;
+   UChar  c1, c2;
+   UInt16 s1, s2;
+
+   AssertD ( i1 != i2, "mainGtU" );
+   /* 1 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 2 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 3 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 4 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 5 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 6 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 7 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 8 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 9 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 10 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 11 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+   /* 12 */
+   c1 = block[i1]; c2 = block[i2];
+   if (c1 != c2) return (c1 > c2);
+   i1++; i2++;
+
+   k = nblock + 8;
+
+   do {
+      /* 1 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 2 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 3 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 4 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 5 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 6 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 7 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+      /* 8 */
+      c1 = block[i1]; c2 = block[i2];
+      if (c1 != c2) return (c1 > c2);
+      s1 = quadrant[i1]; s2 = quadrant[i2];
+      if (s1 != s2) return (s1 > s2);
+      i1++; i2++;
+
+      if (i1 >= nblock) i1 -= nblock;
+      if (i2 >= nblock) i2 -= nblock;
+
+      k -= 8;
+      (*budget)--;
+   }
+      while (k >= 0);
+
+   return False;
+}
+
+
+/*---------------------------------------------*/
+/*--
+   Knuth's increments seem to work better
+   than Incerpi-Sedgewick here.  Possibly
+   because the number of elems to sort is
+   usually small, typically <= 20.
+--*/
+static
+Int32 incs[14] = { 1, 4, 13, 40, 121, 364, 1093, 3280,
+                   9841, 29524, 88573, 265720,
+                   797161, 2391484 };
+
+static
+void mainSimpleSort ( UInt32* ptr,
+                      UChar*  block,
+                      UInt16* quadrant,
+                      Int32   nblock,
+                      Int32   lo, 
+                      Int32   hi, 
+                      Int32   d,
+                      Int32*  budget )
+{
+   Int32 i, j, h, bigN, hp;
+   UInt32 v;
+
+   bigN = hi - lo + 1;
+   if (bigN < 2) return;
+
+   hp = 0;
+   while (incs[hp] < bigN) hp++;
+   hp--;
+
+   for (; hp >= 0; hp--) {
+      h = incs[hp];
+
+      i = lo + h;
+      while (True) {
+
+         /*-- copy 1 --*/
+         if (i > hi) break;
+         v = ptr[i];
+         j = i;
+         while ( mainGtU ( 
+                    ptr[j-h]+d, v+d, block, quadrant, nblock, budget 
+                 ) ) {
+            ptr[j] = ptr[j-h];
+            j = j - h;
+            if (j <= (lo + h - 1)) break;
+         }
+         ptr[j] = v;
+         i++;
+
+         /*-- copy 2 --*/
+         if (i > hi) break;
+         v = ptr[i];
+         j = i;
+         while ( mainGtU ( 
+                    ptr[j-h]+d, v+d, block, quadrant, nblock, budget 
+                 ) ) {
+            ptr[j] = ptr[j-h];
+            j = j - h;
+            if (j <= (lo + h - 1)) break;
+         }
+         ptr[j] = v;
+         i++;
+
+         /*-- copy 3 --*/
+         if (i > hi) break;
+         v = ptr[i];
+         j = i;
+         while ( mainGtU ( 
+                    ptr[j-h]+d, v+d, block, quadrant, nblock, budget 
+                 ) ) {
+            ptr[j] = ptr[j-h];
+            j = j - h;
+            if (j <= (lo + h - 1)) break;
+         }
+         ptr[j] = v;
+         i++;
+
+         if (*budget < 0) return;
+      }
+   }
+}
+
+
+/*---------------------------------------------*/
+/*--
+   The following is an implementation of
+   an elegant 3-way quicksort for strings,
+   described in a paper "Fast Algorithms for
+   Sorting and Searching Strings", by Robert
+   Sedgewick and Jon L. Bentley.
+--*/
+
+#define mswap(zz1, zz2) \
+   { Int32 zztmp = zz1; zz1 = zz2; zz2 = zztmp; }
+
+#define mvswap(zzp1, zzp2, zzn)       \
+{                                     \
+   Int32 yyp1 = (zzp1);               \
+   Int32 yyp2 = (zzp2);               \
+   Int32 yyn  = (zzn);                \
+   while (yyn > 0) {                  \
+      mswap(ptr[yyp1], ptr[yyp2]);    \
+      yyp1++; yyp2++; yyn--;          \
+   }                                  \
+}
+
+static 
+__inline__
+UChar mmed3 ( UChar a, UChar b, UChar c )
+{
+   UChar t;
+   if (a > b) { t = a; a = b; b = t; };
+   if (b > c) { 
+      b = c;
+      if (a > b) b = a;
+   }
+   return b;
+}
+
+#define mmin(a,b) ((a) < (b)) ? (a) : (b)
+
+#define mpush(lz,hz,dz) { stackLo[sp] = lz; \
+                          stackHi[sp] = hz; \
+                          stackD [sp] = dz; \
+                          sp++; }
+
+#define mpop(lz,hz,dz) { sp--;             \
+                         lz = stackLo[sp]; \
+                         hz = stackHi[sp]; \
+                         dz = stackD [sp]; }
+
+
+#define mnextsize(az) (nextHi[az]-nextLo[az])
+
+#define mnextswap(az,bz)                                        \
+   { Int32 tz;                                                  \
+     tz = nextLo[az]; nextLo[az] = nextLo[bz]; nextLo[bz] = tz; \
+     tz = nextHi[az]; nextHi[az] = nextHi[bz]; nextHi[bz] = tz; \
+     tz = nextD [az]; nextD [az] = nextD [bz]; nextD [bz] = tz; }
+
+
+#define MAIN_QSORT_SMALL_THRESH 20
+#define MAIN_QSORT_DEPTH_THRESH (BZ_N_RADIX + BZ_N_QSORT)
+#define MAIN_QSORT_STACK_SIZE 100
+
+static
+void mainQSort3 ( UInt32* ptr,
+                  UChar*  block,
+                  UInt16* quadrant,
+                  Int32   nblock,
+                  Int32   loSt, 
+                  Int32   hiSt, 
+                  Int32   dSt,
+                  Int32*  budget )
+{
+   Int32 unLo, unHi, ltLo, gtHi, n, m, med;
+   Int32 sp, lo, hi, d;
+
+   Int32 stackLo[MAIN_QSORT_STACK_SIZE];
+   Int32 stackHi[MAIN_QSORT_STACK_SIZE];
+   Int32 stackD [MAIN_QSORT_STACK_SIZE];
+
+   Int32 nextLo[3];
+   Int32 nextHi[3];
+   Int32 nextD [3];
+
+   sp = 0;
+   mpush ( loSt, hiSt, dSt );
+
+   while (sp > 0) {
+
+      AssertH ( sp < MAIN_QSORT_STACK_SIZE, 1001 );
+
+      mpop ( lo, hi, d );
+      if (hi - lo < MAIN_QSORT_SMALL_THRESH || 
+          d > MAIN_QSORT_DEPTH_THRESH) {
+         mainSimpleSort ( ptr, block, quadrant, nblock, lo, hi, d, budget );
+         if (*budget < 0) return;
+         continue;
+      }
+
+      med = (Int32) 
+            mmed3 ( block[ptr[ lo         ]+d],
+                    block[ptr[ hi         ]+d],
+                    block[ptr[ (lo+hi)>>1 ]+d] );
+
+      unLo = ltLo = lo;
+      unHi = gtHi = hi;
+
+      while (True) {
+         while (True) {
+            if (unLo > unHi) break;
+            n = ((Int32)block[ptr[unLo]+d]) - med;
+            if (n == 0) { 
+               mswap(ptr[unLo], ptr[ltLo]); 
+               ltLo++; unLo++; continue; 
+            };
+            if (n >  0) break;
+            unLo++;
+         }
+         while (True) {
+            if (unLo > unHi) break;
+            n = ((Int32)block[ptr[unHi]+d]) - med;
+            if (n == 0) { 
+               mswap(ptr[unHi], ptr[gtHi]); 
+               gtHi--; unHi--; continue; 
+            };
+            if (n <  0) break;
+            unHi--;
+         }
+         if (unLo > unHi) break;
+         mswap(ptr[unLo], ptr[unHi]); unLo++; unHi--;
+      }
+
+      AssertD ( unHi == unLo-1, "mainQSort3(2)" );
+
+      if (gtHi < ltLo) {
+         mpush(lo, hi, d+1 );
+         continue;
+      }
+
+      n = mmin(ltLo-lo, unLo-ltLo); mvswap(lo, unLo-n, n);
+      m = mmin(hi-gtHi, gtHi-unHi); mvswap(unLo, hi-m+1, m);
+
+      n = lo + unLo - ltLo - 1;
+      m = hi - (gtHi - unHi) + 1;
+
+      nextLo[0] = lo;  nextHi[0] = n;   nextD[0] = d;
+      nextLo[1] = m;   nextHi[1] = hi;  nextD[1] = d;
+      nextLo[2] = n+1; nextHi[2] = m-1; nextD[2] = d+1;
+
+      if (mnextsize(0) < mnextsize(1)) mnextswap(0,1);
+      if (mnextsize(1) < mnextsize(2)) mnextswap(1,2);
+      if (mnextsize(0) < mnextsize(1)) mnextswap(0,1);
+
+      AssertD (mnextsize(0) >= mnextsize(1), "mainQSort3(8)" );
+      AssertD (mnextsize(1) >= mnextsize(2), "mainQSort3(9)" );
+
+      mpush (nextLo[0], nextHi[0], nextD[0]);
+      mpush (nextLo[1], nextHi[1], nextD[1]);
+      mpush (nextLo[2], nextHi[2], nextD[2]);
+   }
+}
+
+#undef mswap
+#undef mvswap
+#undef mpush
+#undef mpop
+#undef mmin
+#undef mnextsize
+#undef mnextswap
+#undef MAIN_QSORT_SMALL_THRESH
+#undef MAIN_QSORT_DEPTH_THRESH
+#undef MAIN_QSORT_STACK_SIZE
+
+
+/*---------------------------------------------*/
+/* Pre:
+      nblock > N_OVERSHOOT
+      block32 exists for [0 .. nblock-1 +N_OVERSHOOT]
+      ((UChar*)block32) [0 .. nblock-1] holds block
+      ptr exists for [0 .. nblock-1]
+
+   Post:
+      ((UChar*)block32) [0 .. nblock-1] holds block
+      All other areas of block32 destroyed
+      ftab [0 .. 65536 ] destroyed
+      ptr [0 .. nblock-1] holds sorted order
+      if (*budget < 0), sorting was abandoned
+*/
+
+#define BIGFREQ(b) (ftab[((b)+1) << 8] - ftab[(b) << 8])
+#define SETMASK (1 << 21)
+#define CLEARMASK (~(SETMASK))
+
+static
+void mainSort ( UInt32* ptr, 
+                UChar*  block,
+                UInt16* quadrant, 
+                UInt32* ftab,
+                Int32   nblock,
+                Int32   verb,
+                Int32*  budget )
+{
+   Int32  i, j, k, ss, sb;
+   Int32  runningOrder[256];
+   Bool   bigDone[256];
+   Int32  copyStart[256];
+   Int32  copyEnd  [256];
+   UChar  c1;
+   Int32  numQSorted;
+   UInt16 s;
+   if (verb >= 4) VPrintf0 ( "        main sort initialise ...\n" );
+
+   /*-- set up the 2-byte frequency table --*/
+   for (i = 65536; i >= 0; i--) ftab[i] = 0;
+
+   j = block[0] << 8;
+   i = nblock-1;
+   for (; i >= 3; i -= 4) {
+      quadrant[i] = 0;
+      j = (j >> 8) | ( ((UInt16)block[i]) << 8);
+      ftab[j]++;
+      quadrant[i-1] = 0;
+      j = (j >> 8) | ( ((UInt16)block[i-1]) << 8);
+      ftab[j]++;
+      quadrant[i-2] = 0;
+      j = (j >> 8) | ( ((UInt16)block[i-2]) << 8);
+      ftab[j]++;
+      quadrant[i-3] = 0;
+      j = (j >> 8) | ( ((UInt16)block[i-3]) << 8);
+      ftab[j]++;
+   }
+   for (; i >= 0; i--) {
+      quadrant[i] = 0;
+      j = (j >> 8) | ( ((UInt16)block[i]) << 8);
+      ftab[j]++;
+   }
+
+   /*-- (emphasises close relationship of block & quadrant) --*/
+   for (i = 0; i < BZ_N_OVERSHOOT; i++) {
+      block   [nblock+i] = block[i];
+      quadrant[nblock+i] = 0;
+   }
+
+   if (verb >= 4) VPrintf0 ( "        bucket sorting ...\n" );
+
+   /*-- Complete the initial radix sort --*/
+   for (i = 1; i <= 65536; i++) ftab[i] += ftab[i-1];
+
+   s = block[0] << 8;
+   i = nblock-1;
+   for (; i >= 3; i -= 4) {
+      s = (s >> 8) | (block[i] << 8);
+      j = ftab[s] -1;
+      ftab[s] = j;
+      ptr[j] = i;
+      s = (s >> 8) | (block[i-1] << 8);
+      j = ftab[s] -1;
+      ftab[s] = j;
+      ptr[j] = i-1;
+      s = (s >> 8) | (block[i-2] << 8);
+      j = ftab[s] -1;
+      ftab[s] = j;
+      ptr[j] = i-2;
+      s = (s >> 8) | (block[i-3] << 8);
+      j = ftab[s] -1;
+      ftab[s] = j;
+      ptr[j] = i-3;
+   }
+   for (; i >= 0; i--) {
+      s = (s >> 8) | (block[i] << 8);
+      j = ftab[s] -1;
+      ftab[s] = j;
+      ptr[j] = i;
+   }
+
+   /*--
+      Now ftab contains the first loc of every small bucket.
+      Calculate the running order, from smallest to largest
+      big bucket.
+   --*/
+   for (i = 0; i <= 255; i++) {
+      bigDone     [i] = False;
+      runningOrder[i] = i;
+   }
+
+   {
+      Int32 vv;
+      Int32 h = 1;
+      do h = 3 * h + 1; while (h <= 256);
+      do {
+         h = h / 3;
+         for (i = h; i <= 255; i++) {
+            vv = runningOrder[i];
+            j = i;
+            while ( BIGFREQ(runningOrder[j-h]) > BIGFREQ(vv) ) {
+               runningOrder[j] = runningOrder[j-h];
+               j = j - h;
+               if (j <= (h - 1)) goto zero;
+            }
+            zero:
+            runningOrder[j] = vv;
+         }
+      } while (h != 1);
+   }
+
+   /*--
+      The main sorting loop.
+   --*/
+
+   numQSorted = 0;
+
+   for (i = 0; i <= 255; i++) {
+
+      /*--
+         Process big buckets, starting with the least full.
+         Basically this is a 3-step process in which we call
+         mainQSort3 to sort the small buckets [ss, j], but
+         also make a big effort to avoid the calls if we can.
+      --*/
+      ss = runningOrder[i];
+
+      /*--
+         Step 1:
+         Complete the big bucket [ss] by quicksorting
+         any unsorted small buckets [ss, j], for j != ss.  
+         Hopefully previous pointer-scanning phases have already
+         completed many of the small buckets [ss, j], so
+         we don't have to sort them at all.
+      --*/
+      for (j = 0; j <= 255; j++) {
+         if (j != ss) {
+            sb = (ss << 8) + j;
+            if ( ! (ftab[sb] & SETMASK) ) {
+               Int32 lo = ftab[sb]   & CLEARMASK;
+               Int32 hi = (ftab[sb+1] & CLEARMASK) - 1;
+               if (hi > lo) {
+                  if (verb >= 4)
+                     VPrintf4 ( "        qsort [0x%x, 0x%x]   "
+                                "done %d   this %d\n",
+                                ss, j, numQSorted, hi - lo + 1 );
+                  mainQSort3 ( 
+                     ptr, block, quadrant, nblock, 
+                     lo, hi, BZ_N_RADIX, budget 
+                  );   
+                  numQSorted += (hi - lo + 1);
+                  if (*budget < 0) return;
+               }
+            }
+            ftab[sb] |= SETMASK;
+         }
+      }
+
+      AssertH ( !bigDone[ss], 1006 );
+
+      /*--
+         Step 2:
+         Now scan this big bucket [ss] so as to synthesise the
+         sorted order for small buckets [t, ss] for all t,
+         including, magically, the bucket [ss,ss] too.
+         This will avoid doing Real Work in subsequent Step 1's.
+      --*/
+      {
+         for (j = 0; j <= 255; j++) {
+            copyStart[j] =  ftab[(j << 8) + ss]     & CLEARMASK;
+            copyEnd  [j] = (ftab[(j << 8) + ss + 1] & CLEARMASK) - 1;
+         }
+         for (j = ftab[ss << 8] & CLEARMASK; j < copyStart[ss]; j++) {
+            k = ptr[j]-1; if (k < 0) k += nblock;
+            c1 = block[k];
+            if (!bigDone[c1])
+               ptr[ copyStart[c1]++ ] = k;
+         }
+         for (j = (ftab[(ss+1) << 8] & CLEARMASK) - 1; j > copyEnd[ss]; j--) {
+            k = ptr[j]-1; if (k < 0) k += nblock;
+            c1 = block[k];
+            if (!bigDone[c1]) 
+               ptr[ copyEnd[c1]-- ] = k;
+         }
+      }
+
+      AssertH ( (copyStart[ss]-1 == copyEnd[ss])
+                || 
+                /* Extremely rare case missing in bzip2-1.0.0 and 1.0.1.
+                   Necessity for this case is demonstrated by compressing 
+                   a sequence of approximately 48.5 million of character 
+                   251; 1.0.0/1.0.1 will then die here. */
+                (copyStart[ss] == 0 && copyEnd[ss] == nblock-1),
+                1007 )
+
+      for (j = 0; j <= 255; j++) ftab[(j << 8) + ss] |= SETMASK;
+
+      /*--
+         Step 3:
+         The [ss] big bucket is now done.  Record this fact,
+         and update the quadrant descriptors.  Remember to
+         update quadrants in the overshoot area too, if
+         necessary.  The "if (i < 255)" test merely skips
+         this updating for the last bucket processed, since
+         updating for the last bucket is pointless.
+
+         The quadrant array provides a way to incrementally
+         cache sort orderings, as they appear, so as to 
+         make subsequent comparisons in fullGtU() complete
+         faster.  For repetitive blocks this makes a big
+         difference (but not big enough to be able to avoid
+         the fallback sorting mechanism, exponential radix sort).
+
+         The precise meaning is: at all times:
+
+            for 0 <= i < nblock and 0 <= j <= nblock
+
+            if block[i] != block[j], 
+
+               then the relative values of quadrant[i] and 
+                    quadrant[j] are meaningless.
+
+               else {
+                  if quadrant[i] < quadrant[j]
+                     then the string starting at i lexicographically
+                     precedes the string starting at j
+
+                  else if quadrant[i] > quadrant[j]
+                     then the string starting at j lexicographically
+                     precedes the string starting at i
+
+                  else
+                     the relative ordering of the strings starting
+                     at i and j has not yet been determined.
+               }
+      --*/
+      bigDone[ss] = True;
+
+      if (i < 255) {
+         Int32 bbStart  = ftab[ss << 8] & CLEARMASK;
+         Int32 bbSize   = (ftab[(ss+1) << 8] & CLEARMASK) - bbStart;
+         Int32 shifts   = 0;
+
+         while ((bbSize >> shifts) > 65534) shifts++;
+
+         for (j = bbSize-1; j >= 0; j--) {
+            Int32 a2update     = ptr[bbStart + j];
+            UInt16 qVal        = (UInt16)(j >> shifts);
+            quadrant[a2update] = qVal;
+            if (a2update < BZ_N_OVERSHOOT)
+               quadrant[a2update + nblock] = qVal;
+         }
+         AssertH ( ((bbSize-1) >> shifts) <= 65535, 1002 );
+      }
+
+   }
+
+   if (verb >= 4)
+      VPrintf3 ( "        %d pointers, %d sorted, %d scanned\n",
+                 nblock, numQSorted, nblock - numQSorted );
+}
+
+#undef BIGFREQ
+#undef SETMASK
+#undef CLEARMASK
+
+
+/*---------------------------------------------*/
+/* Pre:
+      nblock > 0
+      arr2 exists for [0 .. nblock-1 +N_OVERSHOOT]
+      ((UChar*)arr2)  [0 .. nblock-1] holds block
+      arr1 exists for [0 .. nblock-1]
+
+   Post:
+      ((UChar*)arr2) [0 .. nblock-1] holds block
+      All other areas of block destroyed
+      ftab [ 0 .. 65536 ] destroyed
+      arr1 [0 .. nblock-1] holds sorted order
+*/
+void BZ2_blockSort ( EState* s )
+{
+   UInt32* ptr    = s->ptr; 
+   UChar*  block  = s->block;
+   UInt32* ftab   = s->ftab;
+   Int32   nblock = s->nblock;
+   Int32   verb   = s->verbosity;
+   Int32   wfact  = s->workFactor;
+   UInt16* quadrant;
+   Int32   budget;
+   Int32   budgetInit;
+   Int32   i;
+
+   if (nblock < 10000) {
+      fallbackSort ( s->arr1, s->arr2, ftab, nblock, verb );
+   } else {
+      /* Calculate the location for quadrant, remembering to get
+         the alignment right.  Assumes that &(block[0]) is at least
+         2-byte aligned -- this should be ok since block is really
+         the first section of arr2.
+      */
+      i = nblock+BZ_N_OVERSHOOT;
+      if (i & 1) i++;
+      quadrant = (UInt16*)(&(block[i]));
+
+      /* (wfact-1) / 3 puts the default-factor-30
+         transition point at very roughly the same place as 
+         with v0.1 and v0.9.0.  
+         Not that it particularly matters any more, since the
+         resulting compressed stream is now the same regardless
+         of whether or not we use the main sort or fallback sort.
+      */
+      if (wfact < 1  ) wfact = 1;
+      if (wfact > 100) wfact = 100;
+      budgetInit = nblock * ((wfact-1) / 3);
+      budget = budgetInit;
+
+      mainSort ( ptr, block, quadrant, ftab, nblock, verb, &budget );
+      if (verb >= 3) 
+         VPrintf3 ( "      %d work, %d block, ratio %5.2f\n",
+                    budgetInit - budget,
+                    nblock, 
+                    (float)(budgetInit - budget) /
+                    (float)(nblock==0 ? 1 : nblock) ); 
+      if (budget < 0) {
+         if (verb >= 2) 
+            VPrintf0 ( "    too repetitive; using fallback"
+                       " sorting algorithm\n" );
+         fallbackSort ( s->arr1, s->arr2, ftab, nblock, verb );
+      }
+   }
+
+   s->origPtr = -1;
+   for (i = 0; i < s->nblock; i++)
+      if (ptr[i] == 0)
+         { s->origPtr = i; break; };
+
+   AssertH( s->origPtr != -1, 1003 );
+}
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                       blocksort.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-------------------------------------------------------------*/
+/*--- Huffman coding low-level stuff                        ---*/
+/*---                                             huffman.c ---*/
+/*-------------------------------------------------------------*/
+
+
+/*---------------------------------------------------*/
+#define WEIGHTOF(zz0)  ((zz0) & 0xffffff00)
+#define DEPTHOF(zz1)   ((zz1) & 0x000000ff)
+#define MYMAX(zz2,zz3) ((zz2) > (zz3) ? (zz2) : (zz3))
+
+#define ADDWEIGHTS(zw1,zw2)                           \
+   (WEIGHTOF(zw1)+WEIGHTOF(zw2)) |                    \
+   (1 + MYMAX(DEPTHOF(zw1),DEPTHOF(zw2)))
+
+#define UPHEAP(z)                                     \
+{                                                     \
+   Int32 zz, tmp;                                     \
+   zz = z; tmp = heap[zz];                            \
+   while (weight[tmp] < weight[heap[zz >> 1]]) {      \
+      heap[zz] = heap[zz >> 1];                       \
+      zz >>= 1;                                       \
+   }                                                  \
+   heap[zz] = tmp;                                    \
+}
+
+#define DOWNHEAP(z)                                   \
+{                                                     \
+   Int32 zz, yy, tmp;                                 \
+   zz = z; tmp = heap[zz];                            \
+   while (True) {                                     \
+      yy = zz << 1;                                   \
+      if (yy > nHeap) break;                          \
+      if (yy < nHeap &&                               \
+          weight[heap[yy+1]] < weight[heap[yy]])      \
+         yy++;                                        \
+      if (weight[tmp] < weight[heap[yy]]) break;      \
+      heap[zz] = heap[yy];                            \
+      zz = yy;                                        \
+   }                                                  \
+   heap[zz] = tmp;                                    \
+}
+
+
+/*---------------------------------------------------*/
+void BZ2_hbMakeCodeLengths ( UChar *len, 
+                             Int32 *freq,
+                             Int32 alphaSize,
+                             Int32 maxLen )
+{
+   /*--
+      Nodes and heap entries run from 1.  Entry 0
+      for both the heap and nodes is a sentinel.
+   --*/
+   Int32 nNodes, nHeap, n1, n2, i, j, k;
+   Bool  tooLong;
+
+   Int32 heap   [ BZ_MAX_ALPHA_SIZE + 2 ];
+   Int32 weight [ BZ_MAX_ALPHA_SIZE * 2 ];
+   Int32 parent [ BZ_MAX_ALPHA_SIZE * 2 ]; 
+
+   for (i = 0; i < alphaSize; i++)
+      weight[i+1] = (freq[i] == 0 ? 1 : freq[i]) << 8;
+
+   while (True) {
+
+      nNodes = alphaSize;
+      nHeap = 0;
+
+      heap[0] = 0;
+      weight[0] = 0;
+      parent[0] = -2;
+
+      for (i = 1; i <= alphaSize; i++) {
+         parent[i] = -1;
+         nHeap++;
+         heap[nHeap] = i;
+         UPHEAP(nHeap);
+      }
+
+      AssertH( nHeap < (BZ_MAX_ALPHA_SIZE+2), 2001 );
+   
+      while (nHeap > 1) {
+         n1 = heap[1]; heap[1] = heap[nHeap]; nHeap--; DOWNHEAP(1);
+         n2 = heap[1]; heap[1] = heap[nHeap]; nHeap--; DOWNHEAP(1);
+         nNodes++;
+         parent[n1] = parent[n2] = nNodes;
+         weight[nNodes] = ADDWEIGHTS(weight[n1], weight[n2]);
+         parent[nNodes] = -1;
+         nHeap++;
+         heap[nHeap] = nNodes;
+         UPHEAP(nHeap);
+      }
+
+      AssertH( nNodes < (BZ_MAX_ALPHA_SIZE * 2), 2002 );
+
+      tooLong = False;
+      for (i = 1; i <= alphaSize; i++) {
+         j = 0;
+         k = i;
+         while (parent[k] >= 0) { k = parent[k]; j++; }
+         len[i-1] = j;
+         if (j > maxLen) tooLong = True;
+      }
+      
+      if (! tooLong) break;
+
+      for (i = 1; i < alphaSize; i++) {
+         j = weight[i] >> 8;
+         j = 1 + (j / 2);
+         weight[i] = j << 8;
+      }
+   }
+}
+
+
+/*---------------------------------------------------*/
+void BZ2_hbAssignCodes ( Int32 *code,
+                         UChar *length,
+                         Int32 minLen,
+                         Int32 maxLen,
+                         Int32 alphaSize )
+{
+   Int32 n, vec, i;
+
+   vec = 0;
+   for (n = minLen; n <= maxLen; n++) {
+      for (i = 0; i < alphaSize; i++)
+         if (length[i] == n) { code[i] = vec; vec++; };
+      vec <<= 1;
+   }
+}
+
+
+/*---------------------------------------------------*/
+void BZ2_hbCreateDecodeTables ( Int32 *limit,
+                                Int32 *base,
+                                Int32 *perm,
+                                UChar *length,
+                                Int32 minLen,
+                                Int32 maxLen,
+                                Int32 alphaSize )
+{
+   Int32 pp, i, j, vec;
+
+   pp = 0;
+   for (i = minLen; i <= maxLen; i++)
+      for (j = 0; j < alphaSize; j++)
+         if (length[j] == i) { perm[pp] = j; pp++; };
+
+   for (i = 0; i < BZ_MAX_CODE_LEN; i++) base[i] = 0;
+   for (i = 0; i < alphaSize; i++) base[length[i]+1]++;
+
+   for (i = 1; i < BZ_MAX_CODE_LEN; i++) base[i] += base[i-1];
+
+   for (i = 0; i < BZ_MAX_CODE_LEN; i++) limit[i] = 0;
+   vec = 0;
+
+   for (i = minLen; i <= maxLen; i++) {
+      vec += (base[i+1] - base[i]);
+      limit[i] = vec-1;
+      vec <<= 1;
+   }
+   for (i = minLen + 1; i <= maxLen; i++)
+      base[i] = ((limit[i-1] + 1) << 1) - base[i];
+}
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                         huffman.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-------------------------------------------------------------*/
+/*--- Table for doing CRCs                                  ---*/
+/*---                                            crctable.c ---*/
+/*-------------------------------------------------------------*/
+
+
+/*--
+  I think this is an implementation of the AUTODIN-II,
+  Ethernet & FDDI 32-bit CRC standard.  Vaguely derived
+  from code by Rob Warnock, in Section 51 of the
+  comp.compression FAQ.
+--*/
+
+UInt32 BZ2_crc32Table[256] = {
+
+   /*-- Ugly, innit? --*/
+
+   0x00000000L, 0x04c11db7L, 0x09823b6eL, 0x0d4326d9L,
+   0x130476dcL, 0x17c56b6bL, 0x1a864db2L, 0x1e475005L,
+   0x2608edb8L, 0x22c9f00fL, 0x2f8ad6d6L, 0x2b4bcb61L,
+   0x350c9b64L, 0x31cd86d3L, 0x3c8ea00aL, 0x384fbdbdL,
+   0x4c11db70L, 0x48d0c6c7L, 0x4593e01eL, 0x4152fda9L,
+   0x5f15adacL, 0x5bd4b01bL, 0x569796c2L, 0x52568b75L,
+   0x6a1936c8L, 0x6ed82b7fL, 0x639b0da6L, 0x675a1011L,
+   0x791d4014L, 0x7ddc5da3L, 0x709f7b7aL, 0x745e66cdL,
+   0x9823b6e0L, 0x9ce2ab57L, 0x91a18d8eL, 0x95609039L,
+   0x8b27c03cL, 0x8fe6dd8bL, 0x82a5fb52L, 0x8664e6e5L,
+   0xbe2b5b58L, 0xbaea46efL, 0xb7a96036L, 0xb3687d81L,
+   0xad2f2d84L, 0xa9ee3033L, 0xa4ad16eaL, 0xa06c0b5dL,
+   0xd4326d90L, 0xd0f37027L, 0xddb056feL, 0xd9714b49L,
+   0xc7361b4cL, 0xc3f706fbL, 0xceb42022L, 0xca753d95L,
+   0xf23a8028L, 0xf6fb9d9fL, 0xfbb8bb46L, 0xff79a6f1L,
+   0xe13ef6f4L, 0xe5ffeb43L, 0xe8bccd9aL, 0xec7dd02dL,
+   0x34867077L, 0x30476dc0L, 0x3d044b19L, 0x39c556aeL,
+   0x278206abL, 0x23431b1cL, 0x2e003dc5L, 0x2ac12072L,
+   0x128e9dcfL, 0x164f8078L, 0x1b0ca6a1L, 0x1fcdbb16L,
+   0x018aeb13L, 0x054bf6a4L, 0x0808d07dL, 0x0cc9cdcaL,
+   0x7897ab07L, 0x7c56b6b0L, 0x71159069L, 0x75d48ddeL,
+   0x6b93dddbL, 0x6f52c06cL, 0x6211e6b5L, 0x66d0fb02L,
+   0x5e9f46bfL, 0x5a5e5b08L, 0x571d7dd1L, 0x53dc6066L,
+   0x4d9b3063L, 0x495a2dd4L, 0x44190b0dL, 0x40d816baL,
+   0xaca5c697L, 0xa864db20L, 0xa527fdf9L, 0xa1e6e04eL,
+   0xbfa1b04bL, 0xbb60adfcL, 0xb6238b25L, 0xb2e29692L,
+   0x8aad2b2fL, 0x8e6c3698L, 0x832f1041L, 0x87ee0df6L,
+   0x99a95df3L, 0x9d684044L, 0x902b669dL, 0x94ea7b2aL,
+   0xe0b41de7L, 0xe4750050L, 0xe9362689L, 0xedf73b3eL,
+   0xf3b06b3bL, 0xf771768cL, 0xfa325055L, 0xfef34de2L,
+   0xc6bcf05fL, 0xc27dede8L, 0xcf3ecb31L, 0xcbffd686L,
+   0xd5b88683L, 0xd1799b34L, 0xdc3abdedL, 0xd8fba05aL,
+   0x690ce0eeL, 0x6dcdfd59L, 0x608edb80L, 0x644fc637L,
+   0x7a089632L, 0x7ec98b85L, 0x738aad5cL, 0x774bb0ebL,
+   0x4f040d56L, 0x4bc510e1L, 0x46863638L, 0x42472b8fL,
+   0x5c007b8aL, 0x58c1663dL, 0x558240e4L, 0x51435d53L,
+   0x251d3b9eL, 0x21dc2629L, 0x2c9f00f0L, 0x285e1d47L,
+   0x36194d42L, 0x32d850f5L, 0x3f9b762cL, 0x3b5a6b9bL,
+   0x0315d626L, 0x07d4cb91L, 0x0a97ed48L, 0x0e56f0ffL,
+   0x1011a0faL, 0x14d0bd4dL, 0x19939b94L, 0x1d528623L,
+   0xf12f560eL, 0xf5ee4bb9L, 0xf8ad6d60L, 0xfc6c70d7L,
+   0xe22b20d2L, 0xe6ea3d65L, 0xeba91bbcL, 0xef68060bL,
+   0xd727bbb6L, 0xd3e6a601L, 0xdea580d8L, 0xda649d6fL,
+   0xc423cd6aL, 0xc0e2d0ddL, 0xcda1f604L, 0xc960ebb3L,
+   0xbd3e8d7eL, 0xb9ff90c9L, 0xb4bcb610L, 0xb07daba7L,
+   0xae3afba2L, 0xaafbe615L, 0xa7b8c0ccL, 0xa379dd7bL,
+   0x9b3660c6L, 0x9ff77d71L, 0x92b45ba8L, 0x9675461fL,
+   0x8832161aL, 0x8cf30badL, 0x81b02d74L, 0x857130c3L,
+   0x5d8a9099L, 0x594b8d2eL, 0x5408abf7L, 0x50c9b640L,
+   0x4e8ee645L, 0x4a4ffbf2L, 0x470cdd2bL, 0x43cdc09cL,
+   0x7b827d21L, 0x7f436096L, 0x7200464fL, 0x76c15bf8L,
+   0x68860bfdL, 0x6c47164aL, 0x61043093L, 0x65c52d24L,
+   0x119b4be9L, 0x155a565eL, 0x18197087L, 0x1cd86d30L,
+   0x029f3d35L, 0x065e2082L, 0x0b1d065bL, 0x0fdc1becL,
+   0x3793a651L, 0x3352bbe6L, 0x3e119d3fL, 0x3ad08088L,
+   0x2497d08dL, 0x2056cd3aL, 0x2d15ebe3L, 0x29d4f654L,
+   0xc5a92679L, 0xc1683bceL, 0xcc2b1d17L, 0xc8ea00a0L,
+   0xd6ad50a5L, 0xd26c4d12L, 0xdf2f6bcbL, 0xdbee767cL,
+   0xe3a1cbc1L, 0xe760d676L, 0xea23f0afL, 0xeee2ed18L,
+   0xf0a5bd1dL, 0xf464a0aaL, 0xf9278673L, 0xfde69bc4L,
+   0x89b8fd09L, 0x8d79e0beL, 0x803ac667L, 0x84fbdbd0L,
+   0x9abc8bd5L, 0x9e7d9662L, 0x933eb0bbL, 0x97ffad0cL,
+   0xafb010b1L, 0xab710d06L, 0xa6322bdfL, 0xa2f33668L,
+   0xbcb4666dL, 0xb8757bdaL, 0xb5365d03L, 0xb1f740b4L
+};
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                        crctable.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-------------------------------------------------------------*/
+/*--- Table for randomising repetitive blocks               ---*/
+/*---                                           randtable.c ---*/
+/*-------------------------------------------------------------*/
+
+
+/*---------------------------------------------*/
+Int32 BZ2_rNums[512] = { 
+   619, 720, 127, 481, 931, 816, 813, 233, 566, 247, 
+   985, 724, 205, 454, 863, 491, 741, 242, 949, 214, 
+   733, 859, 335, 708, 621, 574, 73, 654, 730, 472, 
+   419, 436, 278, 496, 867, 210, 399, 680, 480, 51, 
+   878, 465, 811, 169, 869, 675, 611, 697, 867, 561, 
+   862, 687, 507, 283, 482, 129, 807, 591, 733, 623, 
+   150, 238, 59, 379, 684, 877, 625, 169, 643, 105, 
+   170, 607, 520, 932, 727, 476, 693, 425, 174, 647, 
+   73, 122, 335, 530, 442, 853, 695, 249, 445, 515, 
+   909, 545, 703, 919, 874, 474, 882, 500, 594, 612, 
+   641, 801, 220, 162, 819, 984, 589, 513, 495, 799, 
+   161, 604, 958, 533, 221, 400, 386, 867, 600, 782, 
+   382, 596, 414, 171, 516, 375, 682, 485, 911, 276, 
+   98, 553, 163, 354, 666, 933, 424, 341, 533, 870, 
+   227, 730, 475, 186, 263, 647, 537, 686, 600, 224, 
+   469, 68, 770, 919, 190, 373, 294, 822, 808, 206, 
+   184, 943, 795, 384, 383, 461, 404, 758, 839, 887, 
+   715, 67, 618, 276, 204, 918, 873, 777, 604, 560, 
+   951, 160, 578, 722, 79, 804, 96, 409, 713, 940, 
+   652, 934, 970, 447, 318, 353, 859, 672, 112, 785, 
+   645, 863, 803, 350, 139, 93, 354, 99, 820, 908, 
+   609, 772, 154, 274, 580, 184, 79, 626, 630, 742, 
+   653, 282, 762, 623, 680, 81, 927, 626, 789, 125, 
+   411, 521, 938, 300, 821, 78, 343, 175, 128, 250, 
+   170, 774, 972, 275, 999, 639, 495, 78, 352, 126, 
+   857, 956, 358, 619, 580, 124, 737, 594, 701, 612, 
+   669, 112, 134, 694, 363, 992, 809, 743, 168, 974, 
+   944, 375, 748, 52, 600, 747, 642, 182, 862, 81, 
+   344, 805, 988, 739, 511, 655, 814, 334, 249, 515, 
+   897, 955, 664, 981, 649, 113, 974, 459, 893, 228, 
+   433, 837, 553, 268, 926, 240, 102, 654, 459, 51, 
+   686, 754, 806, 760, 493, 403, 415, 394, 687, 700, 
+   946, 670, 656, 610, 738, 392, 760, 799, 887, 653, 
+   978, 321, 576, 617, 626, 502, 894, 679, 243, 440, 
+   680, 879, 194, 572, 640, 724, 926, 56, 204, 700, 
+   707, 151, 457, 449, 797, 195, 791, 558, 945, 679, 
+   297, 59, 87, 824, 713, 663, 412, 693, 342, 606, 
+   134, 108, 571, 364, 631, 212, 174, 643, 304, 329, 
+   343, 97, 430, 751, 497, 314, 983, 374, 822, 928, 
+   140, 206, 73, 263, 980, 736, 876, 478, 430, 305, 
+   170, 514, 364, 692, 829, 82, 855, 953, 676, 246, 
+   369, 970, 294, 750, 807, 827, 150, 790, 288, 923, 
+   804, 378, 215, 828, 592, 281, 565, 555, 710, 82, 
+   896, 831, 547, 261, 524, 462, 293, 465, 502, 56, 
+   661, 821, 976, 991, 658, 869, 905, 758, 745, 193, 
+   768, 550, 608, 933, 378, 286, 215, 979, 792, 961, 
+   61, 688, 793, 644, 986, 403, 106, 366, 905, 644, 
+   372, 567, 466, 434, 645, 210, 389, 550, 919, 135, 
+   780, 773, 635, 389, 707, 100, 626, 958, 165, 504, 
+   920, 176, 193, 713, 857, 265, 203, 50, 668, 108, 
+   645, 990, 626, 197, 510, 357, 358, 850, 858, 364, 
+   936, 638
+};
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                       randtable.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-------------------------------------------------------------*/
+/*--- Compression machinery (not incl block sorting)        ---*/
+/*---                                            compress.c ---*/
+/*-------------------------------------------------------------*/
+
+
+/*---------------------------------------------------*/
+/*--- Bit stream I/O                              ---*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------------*/
+void BZ2_bsInitWrite ( EState* s )
+{
+   s->bsLive = 0;
+   s->bsBuff = 0;
+}
+
+
+/*---------------------------------------------------*/
+static
+void bsFinishWrite ( EState* s )
+{
+   while (s->bsLive > 0) {
+      s->zbits[s->numZ] = (UChar)(s->bsBuff >> 24);
+      s->numZ++;
+      s->bsBuff <<= 8;
+      s->bsLive -= 8;
+   }
+}
+
+
+/*---------------------------------------------------*/
+#define bsNEEDW(nz)                           \
+{                                             \
+   while (s->bsLive >= 8) {                   \
+      s->zbits[s->numZ]                       \
+         = (UChar)(s->bsBuff >> 24);          \
+      s->numZ++;                              \
+      s->bsBuff <<= 8;                        \
+      s->bsLive -= 8;                         \
+   }                                          \
+}
+
+
+/*---------------------------------------------------*/
+static
+__inline__
+void bsW ( EState* s, Int32 n, UInt32 v )
+{
+   bsNEEDW ( n );
+   s->bsBuff |= (v << (32 - s->bsLive - n));
+   s->bsLive += n;
+}
+
+
+/*---------------------------------------------------*/
+static
+void bsPutUInt32 ( EState* s, UInt32 u )
+{
+   bsW ( s, 8, (u >> 24) & 0xffL );
+   bsW ( s, 8, (u >> 16) & 0xffL );
+   bsW ( s, 8, (u >>  8) & 0xffL );
+   bsW ( s, 8,  u        & 0xffL );
+}
+
+
+/*---------------------------------------------------*/
+static
+void bsPutUChar ( EState* s, UChar c )
+{
+   bsW( s, 8, (UInt32)c );
+}
+
+
+/*---------------------------------------------------*/
+/*--- The back end proper                         ---*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------------*/
+static
+void makeMaps_e ( EState* s )
+{
+   Int32 i;
+   s->nInUse = 0;
+   for (i = 0; i < 256; i++)
+      if (s->inUse[i]) {
+         s->unseqToSeq[i] = s->nInUse;
+         s->nInUse++;
+      }
+}
+
+
+/*---------------------------------------------------*/
+static
+void generateMTFValues ( EState* s )
+{
+   UChar   yy[256];
+   Int32   i, j;
+   Int32   zPend;
+   Int32   wr;
+   Int32   EOB;
+
+   /* 
+      After sorting (eg, here),
+         s->arr1 [ 0 .. s->nblock-1 ] holds sorted order,
+         and
+         ((UChar*)s->arr2) [ 0 .. s->nblock-1 ] 
+         holds the original block data.
+
+      The first thing to do is generate the MTF values,
+      and put them in
+         ((UInt16*)s->arr1) [ 0 .. s->nblock-1 ].
+      Because there are strictly fewer or equal MTF values
+      than block values, ptr values in this area are overwritten
+      with MTF values only when they are no longer needed.
+
+      The final compressed bitstream is generated into the
+      area starting at
+         (UChar*) (&((UChar*)s->arr2)[s->nblock])
+
+      These storage aliases are set up in bzCompressInit(),
+      except for the last one, which is arranged in 
+      compressBlock().
+   */
+   UInt32* ptr   = s->ptr;
+   UChar* block  = s->block;
+   UInt16* mtfv  = s->mtfv;
+
+   makeMaps_e ( s );
+   EOB = s->nInUse+1;
+
+   for (i = 0; i <= EOB; i++) s->mtfFreq[i] = 0;
+
+   wr = 0;
+   zPend = 0;
+   for (i = 0; i < s->nInUse; i++) yy[i] = (UChar) i;
+
+   for (i = 0; i < s->nblock; i++) {
+      UChar ll_i;
+      AssertD ( wr <= i, "generateMTFValues(1)" );
+      j = ptr[i]-1; if (j < 0) j += s->nblock;
+      ll_i = s->unseqToSeq[block[j]];
+      AssertD ( ll_i < s->nInUse, "generateMTFValues(2a)" );
+
+      if (yy[0] == ll_i) { 
+         zPend++;
+      } else {
+
+         if (zPend > 0) {
+            zPend--;
+            while (True) {
+               if (zPend & 1) {
+                  mtfv[wr] = BZ_RUNB; wr++; 
+                  s->mtfFreq[BZ_RUNB]++; 
+               } else {
+                  mtfv[wr] = BZ_RUNA; wr++; 
+                  s->mtfFreq[BZ_RUNA]++; 
+               }
+               if (zPend < 2) break;
+               zPend = (zPend - 2) / 2;
+            };
+            zPend = 0;
+         }
+         {
+            register UChar  rtmp;
+            register UChar* ryy_j;
+            register UChar  rll_i;
+            rtmp  = yy[1];
+            yy[1] = yy[0];
+            ryy_j = &(yy[1]);
+            rll_i = ll_i;
+            while ( rll_i != rtmp ) {
+               register UChar rtmp2;
+               ryy_j++;
+               rtmp2  = rtmp;
+               rtmp   = *ryy_j;
+               *ryy_j = rtmp2;
+            };
+            yy[0] = rtmp;
+            j = ryy_j - &(yy[0]);
+            mtfv[wr] = j+1; wr++; s->mtfFreq[j+1]++;
+         }
+
+      }
+   }
+
+   if (zPend > 0) {
+      zPend--;
+      while (True) {
+         if (zPend & 1) {
+            mtfv[wr] = BZ_RUNB; wr++; 
+            s->mtfFreq[BZ_RUNB]++; 
+         } else {
+            mtfv[wr] = BZ_RUNA; wr++; 
+            s->mtfFreq[BZ_RUNA]++; 
+         }
+         if (zPend < 2) break;
+         zPend = (zPend - 2) / 2;
+      };
+      zPend = 0;
+   }
+
+   mtfv[wr] = EOB; wr++; s->mtfFreq[EOB]++;
+
+   s->nMTF = wr;
+}
+
+
+/*---------------------------------------------------*/
+#define BZ_LESSER_ICOST  0
+#define BZ_GREATER_ICOST 15
+
+static
+void sendMTFValues ( EState* s )
+{
+   Int32 v, t, i, j, gs, ge, totc, bt, bc, iter;
+   Int32 nSelectors, alphaSize, minLen, maxLen, selCtr;
+   Int32 nGroups, nBytes;
+
+   /*--
+   UChar  len [BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+   is a global since the decoder also needs it.
+
+   Int32  code[BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+   Int32  rfreq[BZ_N_GROUPS][BZ_MAX_ALPHA_SIZE];
+   are also globals only used in this proc.
+   Made global to keep stack frame size small.
+   --*/
+
+
+   UInt16 cost[BZ_N_GROUPS];
+   Int32  fave[BZ_N_GROUPS];
+
+   UInt16* mtfv = s->mtfv;
+
+   if (s->verbosity >= 3)
+      VPrintf3( "      %d in block, %d after MTF & 1-2 coding, "
+                "%d+2 syms in use\n", 
+                s->nblock, s->nMTF, s->nInUse );
+
+   alphaSize = s->nInUse+2;
+   for (t = 0; t < BZ_N_GROUPS; t++)
+      for (v = 0; v < alphaSize; v++)
+         s->len[t][v] = BZ_GREATER_ICOST;
+
+   /*--- Decide how many coding tables to use ---*/
+   AssertH ( s->nMTF > 0, 3001 );
+   if (s->nMTF < 200)  nGroups = 2; else
+   if (s->nMTF < 600)  nGroups = 3; else
+   if (s->nMTF < 1200) nGroups = 4; else
+   if (s->nMTF < 2400) nGroups = 5; else
+                       nGroups = 6;
+
+   /*--- Generate an initial set of coding tables ---*/
+   { 
+      Int32 nPart, remF, tFreq, aFreq;
+
+      nPart = nGroups;
+      remF  = s->nMTF;
+      gs = 0;
+      while (nPart > 0) {
+         tFreq = remF / nPart;
+         ge = gs-1;
+         aFreq = 0;
+         while (aFreq < tFreq && ge < alphaSize-1) {
+            ge++;
+            aFreq += s->mtfFreq[ge];
+         }
+
+         if (ge > gs 
+             && nPart != nGroups && nPart != 1 
+             && ((nGroups-nPart) % 2 == 1)) {
+            aFreq -= s->mtfFreq[ge];
+            ge--;
+         }
+
+         if (s->verbosity >= 3)
+            VPrintf5( "      initial group %d, [%d .. %d], "
+                      "has %d syms (%4.1f%%)\n",
+                      nPart, gs, ge, aFreq, 
+                      (100.0 * (float)aFreq) / (float)(s->nMTF) );
+ 
+         for (v = 0; v < alphaSize; v++)
+            if (v >= gs && v <= ge) 
+               s->len[nPart-1][v] = BZ_LESSER_ICOST; else
+               s->len[nPart-1][v] = BZ_GREATER_ICOST;
+ 
+         nPart--;
+         gs = ge+1;
+         remF -= aFreq;
+      }
+   }
+
+   /*--- 
+      Iterate up to BZ_N_ITERS times to improve the tables.
+   ---*/
+   for (iter = 0; iter < BZ_N_ITERS; iter++) {
+
+      for (t = 0; t < nGroups; t++) fave[t] = 0;
+
+      for (t = 0; t < nGroups; t++)
+         for (v = 0; v < alphaSize; v++)
+            s->rfreq[t][v] = 0;
+
+      /*---
+        Set up an auxiliary length table which is used to fast-track
+	the common case (nGroups == 6). 
+      ---*/
+      if (nGroups == 6) {
+         for (v = 0; v < alphaSize; v++) {
+            s->len_pack[v][0] = (s->len[1][v] << 16) | s->len[0][v];
+            s->len_pack[v][1] = (s->len[3][v] << 16) | s->len[2][v];
+            s->len_pack[v][2] = (s->len[5][v] << 16) | s->len[4][v];
+	 }
+      }
+
+      nSelectors = 0;
+      totc = 0;
+      gs = 0;
+      while (True) {
+
+         /*--- Set group start & end marks. --*/
+         if (gs >= s->nMTF) break;
+         ge = gs + BZ_G_SIZE - 1; 
+         if (ge >= s->nMTF) ge = s->nMTF-1;
+
+         /*-- 
+            Calculate the cost of this group as coded
+            by each of the coding tables.
+         --*/
+         for (t = 0; t < nGroups; t++) cost[t] = 0;
+
+         if (nGroups == 6 && 50 == ge-gs+1) {
+            /*--- fast track the common case ---*/
+            register UInt32 cost01, cost23, cost45;
+            register UInt16 icv;
+            cost01 = cost23 = cost45 = 0;
+
+#           define BZ_ITER(nn)                \
+               icv = mtfv[gs+(nn)];           \
+               cost01 += s->len_pack[icv][0]; \
+               cost23 += s->len_pack[icv][1]; \
+               cost45 += s->len_pack[icv][2]; \
+
+            BZ_ITER(0);  BZ_ITER(1);  BZ_ITER(2);  BZ_ITER(3);  BZ_ITER(4);
+            BZ_ITER(5);  BZ_ITER(6);  BZ_ITER(7);  BZ_ITER(8);  BZ_ITER(9);
+            BZ_ITER(10); BZ_ITER(11); BZ_ITER(12); BZ_ITER(13); BZ_ITER(14);
+            BZ_ITER(15); BZ_ITER(16); BZ_ITER(17); BZ_ITER(18); BZ_ITER(19);
+            BZ_ITER(20); BZ_ITER(21); BZ_ITER(22); BZ_ITER(23); BZ_ITER(24);
+            BZ_ITER(25); BZ_ITER(26); BZ_ITER(27); BZ_ITER(28); BZ_ITER(29);
+            BZ_ITER(30); BZ_ITER(31); BZ_ITER(32); BZ_ITER(33); BZ_ITER(34);
+            BZ_ITER(35); BZ_ITER(36); BZ_ITER(37); BZ_ITER(38); BZ_ITER(39);
+            BZ_ITER(40); BZ_ITER(41); BZ_ITER(42); BZ_ITER(43); BZ_ITER(44);
+            BZ_ITER(45); BZ_ITER(46); BZ_ITER(47); BZ_ITER(48); BZ_ITER(49);
+
+#           undef BZ_ITER
+
+            cost[0] = cost01 & 0xffff; cost[1] = cost01 >> 16;
+            cost[2] = cost23 & 0xffff; cost[3] = cost23 >> 16;
+            cost[4] = cost45 & 0xffff; cost[5] = cost45 >> 16;
+
+         } else {
+	    /*--- slow version which correctly handles all situations ---*/
+            for (i = gs; i <= ge; i++) { 
+               UInt16 icv = mtfv[i];
+               for (t = 0; t < nGroups; t++) cost[t] += s->len[t][icv];
+            }
+         }
+ 
+         /*-- 
+            Find the coding table which is best for this group,
+            and record its identity in the selector table.
+         --*/
+         bc = 999999999; bt = -1;
+         for (t = 0; t < nGroups; t++)
+            if (cost[t] < bc) { bc = cost[t]; bt = t; };
+         totc += bc;
+         fave[bt]++;
+         s->selector[nSelectors] = bt;
+         nSelectors++;
+
+         /*-- 
+            Increment the symbol frequencies for the selected table.
+          --*/
+         if (nGroups == 6 && 50 == ge-gs+1) {
+            /*--- fast track the common case ---*/
+
+#           define BZ_ITUR(nn) s->rfreq[bt][ mtfv[gs+(nn)] ]++
+
+            BZ_ITUR(0);  BZ_ITUR(1);  BZ_ITUR(2);  BZ_ITUR(3);  BZ_ITUR(4);
+            BZ_ITUR(5);  BZ_ITUR(6);  BZ_ITUR(7);  BZ_ITUR(8);  BZ_ITUR(9);
+            BZ_ITUR(10); BZ_ITUR(11); BZ_ITUR(12); BZ_ITUR(13); BZ_ITUR(14);
+            BZ_ITUR(15); BZ_ITUR(16); BZ_ITUR(17); BZ_ITUR(18); BZ_ITUR(19);
+            BZ_ITUR(20); BZ_ITUR(21); BZ_ITUR(22); BZ_ITUR(23); BZ_ITUR(24);
+            BZ_ITUR(25); BZ_ITUR(26); BZ_ITUR(27); BZ_ITUR(28); BZ_ITUR(29);
+            BZ_ITUR(30); BZ_ITUR(31); BZ_ITUR(32); BZ_ITUR(33); BZ_ITUR(34);
+            BZ_ITUR(35); BZ_ITUR(36); BZ_ITUR(37); BZ_ITUR(38); BZ_ITUR(39);
+            BZ_ITUR(40); BZ_ITUR(41); BZ_ITUR(42); BZ_ITUR(43); BZ_ITUR(44);
+            BZ_ITUR(45); BZ_ITUR(46); BZ_ITUR(47); BZ_ITUR(48); BZ_ITUR(49);
+
+#           undef BZ_ITUR
+
+         } else {
+	    /*--- slow version which correctly handles all situations ---*/
+            for (i = gs; i <= ge; i++)
+               s->rfreq[bt][ mtfv[i] ]++;
+         }
+
+         gs = ge+1;
+      }
+      if (s->verbosity >= 3) {
+         VPrintf2 ( "      pass %d: size is %d, grp uses are ", 
+                   iter+1, totc/8 );
+         for (t = 0; t < nGroups; t++)
+            VPrintf1 ( "%d ", fave[t] );
+         VPrintf0 ( "\n" );
+      }
+
+      /*--
+        Recompute the tables based on the accumulated frequencies.
+      --*/
+      for (t = 0; t < nGroups; t++)
+         BZ2_hbMakeCodeLengths ( &(s->len[t][0]), &(s->rfreq[t][0]), 
+                                 alphaSize, 20 );
+   }
+
+
+   AssertH( nGroups < 8, 3002 );
+   AssertH( nSelectors < 32768 &&
+            nSelectors <= (2 + (900000 / BZ_G_SIZE)),
+            3003 );
+
+
+   /*--- Compute MTF values for the selectors. ---*/
+   {
+      UChar pos[BZ_N_GROUPS], ll_i, tmp2, tmp;
+      for (i = 0; i < nGroups; i++) pos[i] = i;
+      for (i = 0; i < nSelectors; i++) {
+         ll_i = s->selector[i];
+         j = 0;
+         tmp = pos[j];
+         while ( ll_i != tmp ) {
+            j++;
+            tmp2 = tmp;
+            tmp = pos[j];
+            pos[j] = tmp2;
+         };
+         pos[0] = tmp;
+         s->selectorMtf[i] = j;
+      }
+   };
+
+   /*--- Assign actual codes for the tables. --*/
+   for (t = 0; t < nGroups; t++) {
+      minLen = 32;
+      maxLen = 0;
+      for (i = 0; i < alphaSize; i++) {
+         if (s->len[t][i] > maxLen) maxLen = s->len[t][i];
+         if (s->len[t][i] < minLen) minLen = s->len[t][i];
+      }
+      AssertH ( !(maxLen > 20), 3004 );
+      AssertH ( !(minLen < 1),  3005 );
+      BZ2_hbAssignCodes ( &(s->code[t][0]), &(s->len[t][0]), 
+                          minLen, maxLen, alphaSize );
+   }
+
+   /*--- Transmit the mapping table. ---*/
+   { 
+      Bool inUse16[16];
+      for (i = 0; i < 16; i++) {
+          inUse16[i] = False;
+          for (j = 0; j < 16; j++)
+             if (s->inUse[i * 16 + j]) inUse16[i] = True;
+      }
+     
+      nBytes = s->numZ;
+      for (i = 0; i < 16; i++)
+         if (inUse16[i]) bsW(s,1,1); else bsW(s,1,0);
+
+      for (i = 0; i < 16; i++)
+         if (inUse16[i])
+            for (j = 0; j < 16; j++) {
+               if (s->inUse[i * 16 + j]) bsW(s,1,1); else bsW(s,1,0);
+            }
+
+      if (s->verbosity >= 3) 
+         VPrintf1( "      bytes: mapping %d, ", s->numZ-nBytes );
+   }
+
+   /*--- Now the selectors. ---*/
+   nBytes = s->numZ;
+   bsW ( s, 3, nGroups );
+   bsW ( s, 15, nSelectors );
+   for (i = 0; i < nSelectors; i++) { 
+      for (j = 0; j < s->selectorMtf[i]; j++) bsW(s,1,1);
+      bsW(s,1,0);
+   }
+   if (s->verbosity >= 3)
+      VPrintf1( "selectors %d, ", s->numZ-nBytes );
+
+   /*--- Now the coding tables. ---*/
+   nBytes = s->numZ;
+
+   for (t = 0; t < nGroups; t++) {
+      Int32 curr = s->len[t][0];
+      bsW ( s, 5, curr );
+      for (i = 0; i < alphaSize; i++) {
+         while (curr < s->len[t][i]) { bsW(s,2,2); curr++; /* 10 */ };
+         while (curr > s->len[t][i]) { bsW(s,2,3); curr--; /* 11 */ };
+         bsW ( s, 1, 0 );
+      }
+   }
+
+   if (s->verbosity >= 3)
+      VPrintf1 ( "code lengths %d, ", s->numZ-nBytes );
+
+   /*--- And finally, the block data proper ---*/
+   nBytes = s->numZ;
+   selCtr = 0;
+   gs = 0;
+   while (True) {
+      if (gs >= s->nMTF) break;
+      ge = gs + BZ_G_SIZE - 1; 
+      if (ge >= s->nMTF) ge = s->nMTF-1;
+      AssertH ( s->selector[selCtr] < nGroups, 3006 );
+
+      if (nGroups == 6 && 50 == ge-gs+1) {
+            /*--- fast track the common case ---*/
+            UInt16 mtfv_i;
+            UChar* s_len_sel_selCtr 
+               = &(s->len[s->selector[selCtr]][0]);
+            Int32* s_code_sel_selCtr
+               = &(s->code[s->selector[selCtr]][0]);
+
+#           define BZ_ITAH(nn)                      \
+               mtfv_i = mtfv[gs+(nn)];              \
+               bsW ( s,                             \
+                     s_len_sel_selCtr[mtfv_i],      \
+                     s_code_sel_selCtr[mtfv_i] )
+
+            BZ_ITAH(0);  BZ_ITAH(1);  BZ_ITAH(2);  BZ_ITAH(3);  BZ_ITAH(4);
+            BZ_ITAH(5);  BZ_ITAH(6);  BZ_ITAH(7);  BZ_ITAH(8);  BZ_ITAH(9);
+            BZ_ITAH(10); BZ_ITAH(11); BZ_ITAH(12); BZ_ITAH(13); BZ_ITAH(14);
+            BZ_ITAH(15); BZ_ITAH(16); BZ_ITAH(17); BZ_ITAH(18); BZ_ITAH(19);
+            BZ_ITAH(20); BZ_ITAH(21); BZ_ITAH(22); BZ_ITAH(23); BZ_ITAH(24);
+            BZ_ITAH(25); BZ_ITAH(26); BZ_ITAH(27); BZ_ITAH(28); BZ_ITAH(29);
+            BZ_ITAH(30); BZ_ITAH(31); BZ_ITAH(32); BZ_ITAH(33); BZ_ITAH(34);
+            BZ_ITAH(35); BZ_ITAH(36); BZ_ITAH(37); BZ_ITAH(38); BZ_ITAH(39);
+            BZ_ITAH(40); BZ_ITAH(41); BZ_ITAH(42); BZ_ITAH(43); BZ_ITAH(44);
+            BZ_ITAH(45); BZ_ITAH(46); BZ_ITAH(47); BZ_ITAH(48); BZ_ITAH(49);
+
+#           undef BZ_ITAH
+
+      } else {
+	 /*--- slow version which correctly handles all situations ---*/
+         for (i = gs; i <= ge; i++) {
+            bsW ( s, 
+                  s->len  [s->selector[selCtr]] [mtfv[i]],
+                  s->code [s->selector[selCtr]] [mtfv[i]] );
+         }
+      }
+
+
+      gs = ge+1;
+      selCtr++;
+   }
+   AssertH( selCtr == nSelectors, 3007 );
+
+   if (s->verbosity >= 3)
+      VPrintf1( "codes %d\n", s->numZ-nBytes );
+}
+
+
+/*---------------------------------------------------*/
+void BZ2_compressBlock ( EState* s, Bool is_last_block )
+{
+   if (s->nblock > 0) {
+
+      BZ_FINALISE_CRC ( s->blockCRC );
+      s->combinedCRC = (s->combinedCRC << 1) | (s->combinedCRC >> 31);
+      s->combinedCRC ^= s->blockCRC;
+      if (s->blockNo > 1) s->numZ = 0;
+
+      if (s->verbosity >= 2)
+         VPrintf4( "    block %d: crc = 0x%8x, "
+                   "combined CRC = 0x%8x, size = %d\n",
+                   s->blockNo, s->blockCRC, s->combinedCRC, s->nblock );
+
+      BZ2_blockSort ( s );
+   }
+
+   s->zbits = (UChar*) (&((UChar*)s->arr2)[s->nblock]);
+
+   /*-- If this is the first block, create the stream header. --*/
+   if (s->blockNo == 1) {
+      BZ2_bsInitWrite ( s );
+      bsPutUChar ( s, BZ_HDR_B );
+      bsPutUChar ( s, BZ_HDR_Z );
+      bsPutUChar ( s, BZ_HDR_h );
+      bsPutUChar ( s, (UChar)(BZ_HDR_0 + s->blockSize100k) );
+   }
+
+   if (s->nblock > 0) {
+
+      bsPutUChar ( s, 0x31 ); bsPutUChar ( s, 0x41 );
+      bsPutUChar ( s, 0x59 ); bsPutUChar ( s, 0x26 );
+      bsPutUChar ( s, 0x53 ); bsPutUChar ( s, 0x59 );
+
+      /*-- Now the block's CRC, so it is in a known place. --*/
+      bsPutUInt32 ( s, s->blockCRC );
+
+      /*-- 
+         Now a single bit indicating (non-)randomisation. 
+         As of version 0.9.5, we use a better sorting algorithm
+         which makes randomisation unnecessary.  So always set
+         the randomised bit to 'no'.  Of course, the decoder
+         still needs to be able to handle randomised blocks
+         so as to maintain backwards compatibility with
+         older versions of bzip2.
+      --*/
+      bsW(s,1,0);
+
+      bsW ( s, 24, s->origPtr );
+      generateMTFValues ( s );
+      sendMTFValues ( s );
+   }
+
+
+   /*-- If this is the last block, add the stream trailer. --*/
+   if (is_last_block) {
+
+      bsPutUChar ( s, 0x17 ); bsPutUChar ( s, 0x72 );
+      bsPutUChar ( s, 0x45 ); bsPutUChar ( s, 0x38 );
+      bsPutUChar ( s, 0x50 ); bsPutUChar ( s, 0x90 );
+      bsPutUInt32 ( s, s->combinedCRC );
+      if (s->verbosity >= 2)
+         VPrintf1( "    final combined CRC = 0x%x\n   ", s->combinedCRC );
+      bsFinishWrite ( s );
+   }
+}
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                        compress.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-------------------------------------------------------------*/
+/*--- Decompression machinery                               ---*/
+/*---                                          decompress.c ---*/
+/*-------------------------------------------------------------*/
+
+
+/*---------------------------------------------------*/
+static
+void makeMaps_d ( DState* s )
+{
+   Int32 i;
+   s->nInUse = 0;
+   for (i = 0; i < 256; i++)
+      if (s->inUse[i]) {
+         s->seqToUnseq[s->nInUse] = i;
+         s->nInUse++;
+      }
+}
+
+
+/*---------------------------------------------------*/
+#define RETURN(rrr)                               \
+   { retVal = rrr; goto save_state_and_return; };
+
+#define GET_BITS(lll,vvv,nnn)                     \
+   case lll: s->state = lll;                      \
+   while (True) {                                 \
+      if (s->bsLive >= nnn) {                     \
+         UInt32 v;                                \
+         v = (s->bsBuff >>                        \
+             (s->bsLive-nnn)) & ((1 << nnn)-1);   \
+         s->bsLive -= nnn;                        \
+         vvv = v;                                 \
+         break;                                   \
+      }                                           \
+      if (s->strm->avail_in == 0) RETURN(BZ_OK);  \
+      s->bsBuff                                   \
+         = (s->bsBuff << 8) |                     \
+           ((UInt32)                              \
+              (*((UChar*)(s->strm->next_in))));   \
+      s->bsLive += 8;                             \
+      s->strm->next_in++;                         \
+      s->strm->avail_in--;                        \
+      s->strm->total_in_lo32++;                   \
+      if (s->strm->total_in_lo32 == 0)            \
+         s->strm->total_in_hi32++;                \
+   }
+
+#define GET_UCHAR(lll,uuu)                        \
+   GET_BITS(lll,uuu,8)
+
+#define GET_BIT(lll,uuu)                          \
+   GET_BITS(lll,uuu,1)
+
+/*---------------------------------------------------*/
+#define GET_MTF_VAL(label1,label2,lval)           \
+{                                                 \
+   if (groupPos == 0) {                           \
+      groupNo++;                                  \
+      if (groupNo >= nSelectors)                  \
+         RETURN(BZ_DATA_ERROR);                   \
+      groupPos = BZ_G_SIZE;                       \
+      gSel = s->selector[groupNo];                \
+      gMinlen = s->minLens[gSel];                 \
+      gLimit = &(s->limit[gSel][0]);              \
+      gPerm = &(s->perm[gSel][0]);                \
+      gBase = &(s->base[gSel][0]);                \
+   }                                              \
+   groupPos--;                                    \
+   zn = gMinlen;                                  \
+   GET_BITS(label1, zvec, zn);                    \
+   while (1) {                                    \
+      if (zn > 20 /* the longest code */)         \
+         RETURN(BZ_DATA_ERROR);                   \
+      if (zvec <= gLimit[zn]) break;              \
+      zn++;                                       \
+      GET_BIT(label2, zj);                        \
+      zvec = (zvec << 1) | zj;                    \
+   };                                             \
+   if (zvec - gBase[zn] < 0                       \
+       || zvec - gBase[zn] >= BZ_MAX_ALPHA_SIZE)  \
+      RETURN(BZ_DATA_ERROR);                      \
+   lval = gPerm[zvec - gBase[zn]];                \
+}
+
+
+/*---------------------------------------------------*/
+Int32 BZ2_decompress ( DState* s )
+{
+   UChar      uc;
+   Int32      retVal;
+   Int32      minLen, maxLen;
+   bz_stream* strm = s->strm;
+
+   /* stuff that needs to be saved/restored */
+   Int32  i;
+   Int32  j;
+   Int32  t;
+   Int32  alphaSize;
+   Int32  nGroups;
+   Int32  nSelectors;
+   Int32  EOB;
+   Int32  groupNo;
+   Int32  groupPos;
+   Int32  nextSym;
+   Int32  nblockMAX;
+   Int32  nblock;
+   Int32  es;
+   Int32  N;
+   Int32  curr;
+   Int32  zt;
+   Int32  zn; 
+   Int32  zvec;
+   Int32  zj;
+   Int32  gSel;
+   Int32  gMinlen;
+   Int32* gLimit;
+   Int32* gBase;
+   Int32* gPerm;
+
+   if (s->state == BZ_X_MAGIC_1) {
+      /*initialise the save area*/
+      s->save_i           = 0;
+      s->save_j           = 0;
+      s->save_t           = 0;
+      s->save_alphaSize   = 0;
+      s->save_nGroups     = 0;
+      s->save_nSelectors  = 0;
+      s->save_EOB         = 0;
+      s->save_groupNo     = 0;
+      s->save_groupPos    = 0;
+      s->save_nextSym     = 0;
+      s->save_nblockMAX   = 0;
+      s->save_nblock      = 0;
+      s->save_es          = 0;
+      s->save_N           = 0;
+      s->save_curr        = 0;
+      s->save_zt          = 0;
+      s->save_zn          = 0;
+      s->save_zvec        = 0;
+      s->save_zj          = 0;
+      s->save_gSel        = 0;
+      s->save_gMinlen     = 0;
+      s->save_gLimit      = NULL;
+      s->save_gBase       = NULL;
+      s->save_gPerm       = NULL;
+   }
+
+   /*restore from the save area*/
+   i           = s->save_i;
+   j           = s->save_j;
+   t           = s->save_t;
+   alphaSize   = s->save_alphaSize;
+   nGroups     = s->save_nGroups;
+   nSelectors  = s->save_nSelectors;
+   EOB         = s->save_EOB;
+   groupNo     = s->save_groupNo;
+   groupPos    = s->save_groupPos;
+   nextSym     = s->save_nextSym;
+   nblockMAX   = s->save_nblockMAX;
+   nblock      = s->save_nblock;
+   es          = s->save_es;
+   N           = s->save_N;
+   curr        = s->save_curr;
+   zt          = s->save_zt;
+   zn          = s->save_zn; 
+   zvec        = s->save_zvec;
+   zj          = s->save_zj;
+   gSel        = s->save_gSel;
+   gMinlen     = s->save_gMinlen;
+   gLimit      = s->save_gLimit;
+   gBase       = s->save_gBase;
+   gPerm       = s->save_gPerm;
+
+   retVal = BZ_OK;
+
+   switch (s->state) {
+
+      GET_UCHAR(BZ_X_MAGIC_1, uc);
+      if (uc != BZ_HDR_B) RETURN(BZ_DATA_ERROR_MAGIC);
+
+      GET_UCHAR(BZ_X_MAGIC_2, uc);
+      if (uc != BZ_HDR_Z) RETURN(BZ_DATA_ERROR_MAGIC);
+
+      GET_UCHAR(BZ_X_MAGIC_3, uc)
+      if (uc != BZ_HDR_h) RETURN(BZ_DATA_ERROR_MAGIC);
+
+      GET_BITS(BZ_X_MAGIC_4, s->blockSize100k, 8)
+      if (s->blockSize100k < (BZ_HDR_0 + 1) || 
+          s->blockSize100k > (BZ_HDR_0 + 9)) RETURN(BZ_DATA_ERROR_MAGIC);
+      s->blockSize100k -= BZ_HDR_0;
+
+      if (s->smallDecompress) {
+         s->ll16 = BZALLOC( s->blockSize100k * 100000 * sizeof(UInt16) );
+         s->ll4  = BZALLOC( 
+                      ((1 + s->blockSize100k * 100000) >> 1) * sizeof(UChar) 
+                   );
+         if (s->ll16 == NULL || s->ll4 == NULL) RETURN(BZ_MEM_ERROR);
+      } else {
+         s->tt  = BZALLOC( s->blockSize100k * 100000 * sizeof(Int32) );
+         if (s->tt == NULL) RETURN(BZ_MEM_ERROR);
+      }
+
+      GET_UCHAR(BZ_X_BLKHDR_1, uc);
+
+      if (uc == 0x17) goto endhdr_2;
+      if (uc != 0x31) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_BLKHDR_2, uc);
+      if (uc != 0x41) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_BLKHDR_3, uc);
+      if (uc != 0x59) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_BLKHDR_4, uc);
+      if (uc != 0x26) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_BLKHDR_5, uc);
+      if (uc != 0x53) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_BLKHDR_6, uc);
+      if (uc != 0x59) RETURN(BZ_DATA_ERROR);
+
+      s->currBlockNo++;
+      if (s->verbosity >= 2)
+         VPrintf1 ( "\n    [%d: huff+mtf ", s->currBlockNo );
+ 
+      s->storedBlockCRC = 0;
+      GET_UCHAR(BZ_X_BCRC_1, uc);
+      s->storedBlockCRC = (s->storedBlockCRC << 8) | ((UInt32)uc);
+      GET_UCHAR(BZ_X_BCRC_2, uc);
+      s->storedBlockCRC = (s->storedBlockCRC << 8) | ((UInt32)uc);
+      GET_UCHAR(BZ_X_BCRC_3, uc);
+      s->storedBlockCRC = (s->storedBlockCRC << 8) | ((UInt32)uc);
+      GET_UCHAR(BZ_X_BCRC_4, uc);
+      s->storedBlockCRC = (s->storedBlockCRC << 8) | ((UInt32)uc);
+
+      GET_BITS(BZ_X_RANDBIT, s->blockRandomised, 1);
+
+      s->origPtr = 0;
+      GET_UCHAR(BZ_X_ORIGPTR_1, uc);
+      s->origPtr = (s->origPtr << 8) | ((Int32)uc);
+      GET_UCHAR(BZ_X_ORIGPTR_2, uc);
+      s->origPtr = (s->origPtr << 8) | ((Int32)uc);
+      GET_UCHAR(BZ_X_ORIGPTR_3, uc);
+      s->origPtr = (s->origPtr << 8) | ((Int32)uc);
+
+      if (s->origPtr < 0)
+         RETURN(BZ_DATA_ERROR);
+      if (s->origPtr > 10 + 100000*s->blockSize100k) 
+         RETURN(BZ_DATA_ERROR);
+
+      /*--- Receive the mapping table ---*/
+      for (i = 0; i < 16; i++) {
+         GET_BIT(BZ_X_MAPPING_1, uc);
+         if (uc == 1) 
+            s->inUse16[i] = True; else 
+            s->inUse16[i] = False;
+      }
+
+      for (i = 0; i < 256; i++) s->inUse[i] = False;
+
+      for (i = 0; i < 16; i++)
+         if (s->inUse16[i])
+            for (j = 0; j < 16; j++) {
+               GET_BIT(BZ_X_MAPPING_2, uc);
+               if (uc == 1) s->inUse[i * 16 + j] = True;
+            }
+      makeMaps_d ( s );
+      if (s->nInUse == 0) RETURN(BZ_DATA_ERROR);
+      alphaSize = s->nInUse+2;
+
+      /*--- Now the selectors ---*/
+      GET_BITS(BZ_X_SELECTOR_1, nGroups, 3);
+      if (nGroups < 2 || nGroups > 6) RETURN(BZ_DATA_ERROR);
+      GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15);
+      if (nSelectors < 1) RETURN(BZ_DATA_ERROR);
+      for (i = 0; i < nSelectors; i++) {
+         j = 0;
+         while (True) {
+            GET_BIT(BZ_X_SELECTOR_3, uc);
+            if (uc == 0) break;
+            j++;
+            if (j >= nGroups) RETURN(BZ_DATA_ERROR);
+         }
+         s->selectorMtf[i] = j;
+      }
+
+      /*--- Undo the MTF values for the selectors. ---*/
+      {
+         UChar pos[BZ_N_GROUPS], tmp, v;
+         for (v = 0; v < nGroups; v++) pos[v] = v;
+   
+         for (i = 0; i < nSelectors; i++) {
+            v = s->selectorMtf[i];
+            tmp = pos[v];
+            while (v > 0) { pos[v] = pos[v-1]; v--; }
+            pos[0] = tmp;
+            s->selector[i] = tmp;
+         }
+      }
+
+      /*--- Now the coding tables ---*/
+      for (t = 0; t < nGroups; t++) {
+         GET_BITS(BZ_X_CODING_1, curr, 5);
+         for (i = 0; i < alphaSize; i++) {
+            while (True) {
+               if (curr < 1 || curr > 20) RETURN(BZ_DATA_ERROR);
+               GET_BIT(BZ_X_CODING_2, uc);
+               if (uc == 0) break;
+               GET_BIT(BZ_X_CODING_3, uc);
+               if (uc == 0) curr++; else curr--;
+            }
+            s->len[t][i] = curr;
+         }
+      }
+
+      /*--- Create the Huffman decoding tables ---*/
+      for (t = 0; t < nGroups; t++) {
+         minLen = 32;
+         maxLen = 0;
+         for (i = 0; i < alphaSize; i++) {
+            if (s->len[t][i] > maxLen) maxLen = s->len[t][i];
+            if (s->len[t][i] < minLen) minLen = s->len[t][i];
+         }
+         BZ2_hbCreateDecodeTables ( 
+            &(s->limit[t][0]), 
+            &(s->base[t][0]), 
+            &(s->perm[t][0]), 
+            &(s->len[t][0]),
+            minLen, maxLen, alphaSize
+         );
+         s->minLens[t] = minLen;
+      }
+
+      /*--- Now the MTF values ---*/
+
+      EOB      = s->nInUse+1;
+      nblockMAX = 100000 * s->blockSize100k;
+      groupNo  = -1;
+      groupPos = 0;
+
+      for (i = 0; i <= 255; i++) s->unzftab[i] = 0;
+
+      /*-- MTF init --*/
+      {
+         Int32 ii, jj, kk;
+         kk = MTFA_SIZE-1;
+         for (ii = 256 / MTFL_SIZE - 1; ii >= 0; ii--) {
+            for (jj = MTFL_SIZE-1; jj >= 0; jj--) {
+               s->mtfa[kk] = (UChar)(ii * MTFL_SIZE + jj);
+               kk--;
+            }
+            s->mtfbase[ii] = kk + 1;
+         }
+      }
+      /*-- end MTF init --*/
+
+      nblock = 0;
+      GET_MTF_VAL(BZ_X_MTF_1, BZ_X_MTF_2, nextSym);
+
+      while (True) {
+
+         if (nextSym == EOB) break;
+
+         if (nextSym == BZ_RUNA || nextSym == BZ_RUNB) {
+
+            es = -1;
+            N = 1;
+            do {
+               if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
+               if (nextSym == BZ_RUNB) es = es + (1+1) * N;
+               N = N * 2;
+               GET_MTF_VAL(BZ_X_MTF_3, BZ_X_MTF_4, nextSym);
+            }
+               while (nextSym == BZ_RUNA || nextSym == BZ_RUNB);
+
+            es++;
+            uc = s->seqToUnseq[ s->mtfa[s->mtfbase[0]] ];
+            s->unzftab[uc] += es;
+
+            if (s->smallDecompress)
+               while (es > 0) {
+                  if (nblock >= nblockMAX) RETURN(BZ_DATA_ERROR);
+                  s->ll16[nblock] = (UInt16)uc;
+                  nblock++;
+                  es--;
+               }
+            else
+               while (es > 0) {
+                  if (nblock >= nblockMAX) RETURN(BZ_DATA_ERROR);
+                  s->tt[nblock] = (UInt32)uc;
+                  nblock++;
+                  es--;
+               };
+
+            continue;
+
+         } else {
+
+            if (nblock >= nblockMAX) RETURN(BZ_DATA_ERROR);
+
+            /*-- uc = MTF ( nextSym-1 ) --*/
+            {
+               Int32 ii, jj, kk, pp, lno, off;
+               UInt32 nn;
+               nn = (UInt32)(nextSym - 1);
+
+               if (nn < MTFL_SIZE) {
+                  /* avoid general-case expense */
+                  pp = s->mtfbase[0];
+                  uc = s->mtfa[pp+nn];
+                  while (nn > 3) {
+                     Int32 z = pp+nn;
+                     s->mtfa[(z)  ] = s->mtfa[(z)-1];
+                     s->mtfa[(z)-1] = s->mtfa[(z)-2];
+                     s->mtfa[(z)-2] = s->mtfa[(z)-3];
+                     s->mtfa[(z)-3] = s->mtfa[(z)-4];
+                     nn -= 4;
+                  }
+                  while (nn > 0) { 
+                     s->mtfa[(pp+nn)] = s->mtfa[(pp+nn)-1]; nn--; 
+                  };
+                  s->mtfa[pp] = uc;
+               } else { 
+                  /* general case */
+                  lno = nn / MTFL_SIZE;
+                  off = nn % MTFL_SIZE;
+                  pp = s->mtfbase[lno] + off;
+                  uc = s->mtfa[pp];
+                  while (pp > s->mtfbase[lno]) { 
+                     s->mtfa[pp] = s->mtfa[pp-1]; pp--; 
+                  };
+                  s->mtfbase[lno]++;
+                  while (lno > 0) {
+                     s->mtfbase[lno]--;
+                     s->mtfa[s->mtfbase[lno]] 
+                        = s->mtfa[s->mtfbase[lno-1] + MTFL_SIZE - 1];
+                     lno--;
+                  }
+                  s->mtfbase[0]--;
+                  s->mtfa[s->mtfbase[0]] = uc;
+                  if (s->mtfbase[0] == 0) {
+                     kk = MTFA_SIZE-1;
+                     for (ii = 256 / MTFL_SIZE-1; ii >= 0; ii--) {
+                        for (jj = MTFL_SIZE-1; jj >= 0; jj--) {
+                           s->mtfa[kk] = s->mtfa[s->mtfbase[ii] + jj];
+                           kk--;
+                        }
+                        s->mtfbase[ii] = kk + 1;
+                     }
+                  }
+               }
+            }
+            /*-- end uc = MTF ( nextSym-1 ) --*/
+
+            s->unzftab[s->seqToUnseq[uc]]++;
+            if (s->smallDecompress)
+               s->ll16[nblock] = (UInt16)(s->seqToUnseq[uc]); else
+               s->tt[nblock]   = (UInt32)(s->seqToUnseq[uc]);
+            nblock++;
+
+            GET_MTF_VAL(BZ_X_MTF_5, BZ_X_MTF_6, nextSym);
+            continue;
+         }
+      }
+
+      /* Now we know what nblock is, we can do a better sanity
+         check on s->origPtr.
+      */
+      if (s->origPtr < 0 || s->origPtr >= nblock)
+         RETURN(BZ_DATA_ERROR);
+
+      s->state_out_len = 0;
+      s->state_out_ch  = 0;
+      BZ_INITIALISE_CRC ( s->calculatedBlockCRC );
+      s->state = BZ_X_OUTPUT;
+      if (s->verbosity >= 2) VPrintf0 ( "rt+rld" );
+
+      /*-- Set up cftab to facilitate generation of T^(-1) --*/
+      s->cftab[0] = 0;
+      for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
+      for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
+
+      if (s->smallDecompress) {
+
+         /*-- Make a copy of cftab, used in generation of T --*/
+         for (i = 0; i <= 256; i++) s->cftabCopy[i] = s->cftab[i];
+
+         /*-- compute the T vector --*/
+         for (i = 0; i < nblock; i++) {
+            uc = (UChar)(s->ll16[i]);
+            SET_LL(i, s->cftabCopy[uc]);
+            s->cftabCopy[uc]++;
+         }
+
+         /*-- Compute T^(-1) by pointer reversal on T --*/
+         i = s->origPtr;
+         j = GET_LL(i);
+         do {
+            Int32 tmp = GET_LL(j);
+            SET_LL(j, i);
+            i = j;
+            j = tmp;
+         }
+            while (i != s->origPtr);
+
+         s->tPos = s->origPtr;
+         s->nblock_used = 0;
+         if (s->blockRandomised) {
+            BZ_RAND_INIT_MASK;
+            BZ_GET_SMALL(s->k0); s->nblock_used++;
+            BZ_RAND_UPD_MASK; s->k0 ^= BZ_RAND_MASK; 
+         } else {
+            BZ_GET_SMALL(s->k0); s->nblock_used++;
+         }
+
+      } else {
+
+         /*-- compute the T^(-1) vector --*/
+         for (i = 0; i < nblock; i++) {
+            uc = (UChar)(s->tt[i] & 0xff);
+            s->tt[s->cftab[uc]] |= (i << 8);
+            s->cftab[uc]++;
+         }
+
+         s->tPos = s->tt[s->origPtr] >> 8;
+         s->nblock_used = 0;
+         if (s->blockRandomised) {
+            BZ_RAND_INIT_MASK;
+            BZ_GET_FAST(s->k0); s->nblock_used++;
+            BZ_RAND_UPD_MASK; s->k0 ^= BZ_RAND_MASK; 
+         } else {
+            BZ_GET_FAST(s->k0); s->nblock_used++;
+         }
+
+      }
+
+      RETURN(BZ_OK);
+
+
+
+    endhdr_2:
+
+      GET_UCHAR(BZ_X_ENDHDR_2, uc);
+      if (uc != 0x72) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_ENDHDR_3, uc);
+      if (uc != 0x45) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_ENDHDR_4, uc);
+      if (uc != 0x38) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_ENDHDR_5, uc);
+      if (uc != 0x50) RETURN(BZ_DATA_ERROR);
+      GET_UCHAR(BZ_X_ENDHDR_6, uc);
+      if (uc != 0x90) RETURN(BZ_DATA_ERROR);
+
+      s->storedCombinedCRC = 0;
+      GET_UCHAR(BZ_X_CCRC_1, uc);
+      s->storedCombinedCRC = (s->storedCombinedCRC << 8) | ((UInt32)uc);
+      GET_UCHAR(BZ_X_CCRC_2, uc);
+      s->storedCombinedCRC = (s->storedCombinedCRC << 8) | ((UInt32)uc);
+      GET_UCHAR(BZ_X_CCRC_3, uc);
+      s->storedCombinedCRC = (s->storedCombinedCRC << 8) | ((UInt32)uc);
+      GET_UCHAR(BZ_X_CCRC_4, uc);
+      s->storedCombinedCRC = (s->storedCombinedCRC << 8) | ((UInt32)uc);
+
+      s->state = BZ_X_IDLE;
+      RETURN(BZ_STREAM_END);
+
+      default: AssertH ( False, 4001 );
+   }
+
+   AssertH ( False, 4002 );
+
+   save_state_and_return:
+
+   s->save_i           = i;
+   s->save_j           = j;
+   s->save_t           = t;
+   s->save_alphaSize   = alphaSize;
+   s->save_nGroups     = nGroups;
+   s->save_nSelectors  = nSelectors;
+   s->save_EOB         = EOB;
+   s->save_groupNo     = groupNo;
+   s->save_groupPos    = groupPos;
+   s->save_nextSym     = nextSym;
+   s->save_nblockMAX   = nblockMAX;
+   s->save_nblock      = nblock;
+   s->save_es          = es;
+   s->save_N           = N;
+   s->save_curr        = curr;
+   s->save_zt          = zt;
+   s->save_zn          = zn;
+   s->save_zvec        = zvec;
+   s->save_zj          = zj;
+   s->save_gSel        = gSel;
+   s->save_gMinlen     = gMinlen;
+   s->save_gLimit      = gLimit;
+   s->save_gBase       = gBase;
+   s->save_gPerm       = gPerm;
+
+   return retVal;   
+}
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                      decompress.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-------------------------------------------------------------*/
+/*--- Library top-level functions.                          ---*/
+/*---                                               bzlib.c ---*/
+/*-------------------------------------------------------------*/
+
+/*---------------------------------------------------*/
+/*--- Compression stuff                           ---*/
+/*---------------------------------------------------*/
+
+
+/*---------------------------------------------------*/
+#ifndef BZ_NO_STDIO
+void BZ2_bz__AssertH__fail ( int errcode )
+{
+   fprintf(stderr, 
+      "\n\nbzip2/libbzip2: internal error number %d.\n"
+      "This is a bug in bzip2/libbzip2, %s.\n"
+      "Please report it to me at: jseward@acm.org.  If this happened\n"
+      "when you were using some program which uses libbzip2 as a\n"
+      "component, you should also report this bug to the author(s)\n"
+      "of that program.  Please make an effort to report this bug;\n"
+      "timely and accurate bug reports eventually lead to higher\n"
+      "quality software.  Thanks.  Julian Seward, 30 December 2001.\n\n",
+      errcode,
+      BZ2_bzlibVersion()
+   );
+
+   if (errcode == 1007) {
+   fprintf(stderr,
+      "\n*** A special note about internal error number 1007 ***\n"
+      "\n"
+      "Experience suggests that a common cause of i.e. 1007\n"
+      "is unreliable memory or other hardware.  The 1007 assertion\n"
+      "just happens to cross-check the results of huge numbers of\n"
+      "memory reads/writes, and so acts (unintendedly) as a stress\n"
+      "test of your memory system.\n"
+      "\n"
+      "I suggest the following: try compressing the file again,\n"
+      "possibly monitoring progress in detail with the -vv flag.\n"
+      "\n"
+      "* If the error cannot be reproduced, and/or happens at different\n"
+      "  points in compression, you may have a flaky memory system.\n"
+      "  Try a memory-test program.  I have used Memtest86\n"
+      "  (www.memtest86.com).  At the time of writing it is free (GPLd).\n"
+      "  Memtest86 tests memory much more thorougly than your BIOSs\n"
+      "  power-on test, and may find failures that the BIOS doesn't.\n"
+      "\n"
+      "* If the error can be repeatably reproduced, this is a bug in\n"
+      "  bzip2, and I would very much like to hear about it.  Please\n"
+      "  let me know, and, ideally, save a copy of the file causing the\n"
+      "  problem -- without which I will be unable to investigate it.\n"
+      "\n"
+   );
+   }
+
+   exit(3);
+}
+#endif
+
+
+/*---------------------------------------------------*/
+static
+int bz_config_ok ( void )
+{
+   if (sizeof(int)   != 4) return 0;
+   if (sizeof(short) != 2) return 0;
+   if (sizeof(char)  != 1) return 0;
+   return 1;
+}
+
+
+/*---------------------------------------------------*/
+static
+void* default_bzalloc ( void* opaque, Int32 items, Int32 size )
+{
+   void* v = malloc ( items * size );
+   return v;
+}
+
+static
+void default_bzfree ( void* opaque, void* addr )
+{
+   if (addr != NULL) free ( addr );
+}
+
+
+/*---------------------------------------------------*/
+static
+void prepare_new_block ( EState* s )
+{
+   Int32 i;
+   s->nblock = 0;
+   s->numZ = 0;
+   s->state_out_pos = 0;
+   BZ_INITIALISE_CRC ( s->blockCRC );
+   for (i = 0; i < 256; i++) s->inUse[i] = False;
+   s->blockNo++;
+}
+
+
+/*---------------------------------------------------*/
+static
+void init_RL ( EState* s )
+{
+   s->state_in_ch  = 256;
+   s->state_in_len = 0;
+}
+
+
+static
+Bool isempty_RL ( EState* s )
+{
+   if (s->state_in_ch < 256 && s->state_in_len > 0)
+      return False; else
+      return True;
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzCompressInit) 
+                    ( bz_stream* strm, 
+                     int        blockSize100k,
+                     int        verbosity,
+                     int        workFactor )
+{
+   Int32   n;
+   EState* s;
+
+   if (!bz_config_ok()) return BZ_CONFIG_ERROR;
+
+   if (strm == NULL || 
+       blockSize100k < 1 || blockSize100k > 9 ||
+       workFactor < 0 || workFactor > 250)
+     return BZ_PARAM_ERROR;
+
+   if (workFactor == 0) workFactor = 30;
+   if (strm->bzalloc == NULL) strm->bzalloc = default_bzalloc;
+   if (strm->bzfree == NULL) strm->bzfree = default_bzfree;
+
+   s = BZALLOC( sizeof(EState) );
+   if (s == NULL) return BZ_MEM_ERROR;
+   s->strm = strm;
+
+   s->arr1 = NULL;
+   s->arr2 = NULL;
+   s->ftab = NULL;
+
+   n       = 100000 * blockSize100k;
+   s->arr1 = BZALLOC( n                  * sizeof(UInt32) );
+   s->arr2 = BZALLOC( (n+BZ_N_OVERSHOOT) * sizeof(UInt32) );
+   s->ftab = BZALLOC( 65537              * sizeof(UInt32) );
+
+   if (s->arr1 == NULL || s->arr2 == NULL || s->ftab == NULL) {
+      if (s->arr1 != NULL) BZFREE(s->arr1);
+      if (s->arr2 != NULL) BZFREE(s->arr2);
+      if (s->ftab != NULL) BZFREE(s->ftab);
+      if (s       != NULL) BZFREE(s);
+      return BZ_MEM_ERROR;
+   }
+
+   s->blockNo           = 0;
+   s->state             = BZ_S_INPUT;
+   s->mode              = BZ_M_RUNNING;
+   s->combinedCRC       = 0;
+   s->blockSize100k     = blockSize100k;
+   s->nblockMAX         = 100000 * blockSize100k - 19;
+   s->verbosity         = verbosity;
+   s->workFactor        = workFactor;
+
+   s->block             = (UChar*)s->arr2;
+   s->mtfv              = (UInt16*)s->arr1;
+   s->zbits             = NULL;
+   s->ptr               = (UInt32*)s->arr1;
+
+   strm->state          = s;
+   strm->total_in_lo32  = 0;
+   strm->total_in_hi32  = 0;
+   strm->total_out_lo32 = 0;
+   strm->total_out_hi32 = 0;
+   init_RL ( s );
+   prepare_new_block ( s );
+   return BZ_OK;
+}
+
+
+/*---------------------------------------------------*/
+static
+void add_pair_to_block ( EState* s )
+{
+   Int32 i;
+   UChar ch = (UChar)(s->state_in_ch);
+   for (i = 0; i < s->state_in_len; i++) {
+      BZ_UPDATE_CRC( s->blockCRC, ch );
+   }
+   s->inUse[s->state_in_ch] = True;
+   switch (s->state_in_len) {
+      case 1:
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         break;
+      case 2:
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         break;
+      case 3:
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         break;
+      default:
+         s->inUse[s->state_in_len-4] = True;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = (UChar)ch; s->nblock++;
+         s->block[s->nblock] = ((UChar)(s->state_in_len-4));
+         s->nblock++;
+         break;
+   }
+}
+
+
+/*---------------------------------------------------*/
+static
+void flush_RL ( EState* s )
+{
+   if (s->state_in_ch < 256) add_pair_to_block ( s );
+   init_RL ( s );
+}
+
+
+/*---------------------------------------------------*/
+#define ADD_CHAR_TO_BLOCK(zs,zchh0)               \
+{                                                 \
+   UInt32 zchh = (UInt32)(zchh0);                 \
+   /*-- fast track the common case --*/           \
+   if (zchh != zs->state_in_ch &&                 \
+       zs->state_in_len == 1) {                   \
+      UChar ch = (UChar)(zs->state_in_ch);        \
+      BZ_UPDATE_CRC( zs->blockCRC, ch );          \
+      zs->inUse[zs->state_in_ch] = True;          \
+      zs->block[zs->nblock] = (UChar)ch;          \
+      zs->nblock++;                               \
+      zs->state_in_ch = zchh;                     \
+   }                                              \
+   else                                           \
+   /*-- general, uncommon cases --*/              \
+   if (zchh != zs->state_in_ch ||                 \
+      zs->state_in_len == 255) {                  \
+      if (zs->state_in_ch < 256)                  \
+         add_pair_to_block ( zs );                \
+      zs->state_in_ch = zchh;                     \
+      zs->state_in_len = 1;                       \
+   } else {                                       \
+      zs->state_in_len++;                         \
+   }                                              \
+}
+
+
+/*---------------------------------------------------*/
+static
+Bool copy_input_until_stop ( EState* s )
+{
+   Bool progress_in = False;
+
+   if (s->mode == BZ_M_RUNNING) {
+
+      /*-- fast track the common case --*/
+      while (True) {
+         /*-- block full? --*/
+         if (s->nblock >= s->nblockMAX) break;
+         /*-- no input? --*/
+         if (s->strm->avail_in == 0) break;
+         progress_in = True;
+         ADD_CHAR_TO_BLOCK ( s, (UInt32)(*((UChar*)(s->strm->next_in))) ); 
+         s->strm->next_in++;
+         s->strm->avail_in--;
+         s->strm->total_in_lo32++;
+         if (s->strm->total_in_lo32 == 0) s->strm->total_in_hi32++;
+      }
+
+   } else {
+
+      /*-- general, uncommon case --*/
+      while (True) {
+         /*-- block full? --*/
+         if (s->nblock >= s->nblockMAX) break;
+         /*-- no input? --*/
+         if (s->strm->avail_in == 0) break;
+         /*-- flush/finish end? --*/
+         if (s->avail_in_expect == 0) break;
+         progress_in = True;
+         ADD_CHAR_TO_BLOCK ( s, (UInt32)(*((UChar*)(s->strm->next_in))) ); 
+         s->strm->next_in++;
+         s->strm->avail_in--;
+         s->strm->total_in_lo32++;
+         if (s->strm->total_in_lo32 == 0) s->strm->total_in_hi32++;
+         s->avail_in_expect--;
+      }
+   }
+   return progress_in;
+}
+
+
+/*---------------------------------------------------*/
+static
+Bool copy_output_until_stop ( EState* s )
+{
+   Bool progress_out = False;
+
+   while (True) {
+
+      /*-- no output space? --*/
+      if (s->strm->avail_out == 0) break;
+
+      /*-- block done? --*/
+      if (s->state_out_pos >= s->numZ) break;
+
+      progress_out = True;
+      *(s->strm->next_out) = s->zbits[s->state_out_pos];
+      s->state_out_pos++;
+      s->strm->avail_out--;
+      s->strm->next_out++;
+      s->strm->total_out_lo32++;
+      if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
+   }
+
+   return progress_out;
+}
+
+
+/*---------------------------------------------------*/
+static
+Bool handle_compress ( bz_stream* strm )
+{
+   Bool progress_in  = False;
+   Bool progress_out = False;
+   EState* s = strm->state;
+   
+   while (True) {
+
+      if (s->state == BZ_S_OUTPUT) {
+         progress_out |= copy_output_until_stop ( s );
+         if (s->state_out_pos < s->numZ) break;
+         if (s->mode == BZ_M_FINISHING && 
+             s->avail_in_expect == 0 &&
+             isempty_RL(s)) break;
+         prepare_new_block ( s );
+         s->state = BZ_S_INPUT;
+         if (s->mode == BZ_M_FLUSHING && 
+             s->avail_in_expect == 0 &&
+             isempty_RL(s)) break;
+      }
+
+      if (s->state == BZ_S_INPUT) {
+         progress_in |= copy_input_until_stop ( s );
+         if (s->mode != BZ_M_RUNNING && s->avail_in_expect == 0) {
+            flush_RL ( s );
+            BZ2_compressBlock ( s, (Bool)(s->mode == BZ_M_FINISHING) );
+            s->state = BZ_S_OUTPUT;
+         }
+         else
+         if (s->nblock >= s->nblockMAX) {
+            BZ2_compressBlock ( s, False );
+            s->state = BZ_S_OUTPUT;
+         }
+         else
+         if (s->strm->avail_in == 0) {
+            break;
+         }
+      }
+
+   }
+
+   return progress_in || progress_out;
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzCompress) ( bz_stream *strm, int action )
+{
+   Bool progress;
+   EState* s;
+   if (strm == NULL) return BZ_PARAM_ERROR;
+   s = strm->state;
+   if (s == NULL) return BZ_PARAM_ERROR;
+   if (s->strm != strm) return BZ_PARAM_ERROR;
+
+   preswitch:
+   switch (s->mode) {
+
+      case BZ_M_IDLE:
+         return BZ_SEQUENCE_ERROR;
+
+      case BZ_M_RUNNING:
+         if (action == BZ_RUN) {
+            progress = handle_compress ( strm );
+            return progress ? BZ_RUN_OK : BZ_PARAM_ERROR;
+         } 
+         else
+	 if (action == BZ_FLUSH) {
+            s->avail_in_expect = strm->avail_in;
+            s->mode = BZ_M_FLUSHING;
+            goto preswitch;
+         }
+         else
+         if (action == BZ_FINISH) {
+            s->avail_in_expect = strm->avail_in;
+            s->mode = BZ_M_FINISHING;
+            goto preswitch;
+         }
+         else 
+            return BZ_PARAM_ERROR;
+
+      case BZ_M_FLUSHING:
+         if (action != BZ_FLUSH) return BZ_SEQUENCE_ERROR;
+         if (s->avail_in_expect != s->strm->avail_in) 
+            return BZ_SEQUENCE_ERROR;
+         progress = handle_compress ( strm );
+         if (s->avail_in_expect > 0 || !isempty_RL(s) ||
+             s->state_out_pos < s->numZ) return BZ_FLUSH_OK;
+         s->mode = BZ_M_RUNNING;
+         return BZ_RUN_OK;
+
+      case BZ_M_FINISHING:
+         if (action != BZ_FINISH) return BZ_SEQUENCE_ERROR;
+         if (s->avail_in_expect != s->strm->avail_in) 
+            return BZ_SEQUENCE_ERROR;
+         progress = handle_compress ( strm );
+         if (!progress) return BZ_SEQUENCE_ERROR;
+         if (s->avail_in_expect > 0 || !isempty_RL(s) ||
+             s->state_out_pos < s->numZ) return BZ_FINISH_OK;
+         s->mode = BZ_M_IDLE;
+         return BZ_STREAM_END;
+   }
+   return BZ_OK; /*--not reached--*/
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzCompressEnd)  ( bz_stream *strm )
+{
+   EState* s;
+   if (strm == NULL) return BZ_PARAM_ERROR;
+   s = strm->state;
+   if (s == NULL) return BZ_PARAM_ERROR;
+   if (s->strm != strm) return BZ_PARAM_ERROR;
+
+   if (s->arr1 != NULL) BZFREE(s->arr1);
+   if (s->arr2 != NULL) BZFREE(s->arr2);
+   if (s->ftab != NULL) BZFREE(s->ftab);
+   BZFREE(strm->state);
+
+   strm->state = NULL;   
+
+   return BZ_OK;
+}
+
+
+/*---------------------------------------------------*/
+/*--- Decompression stuff                         ---*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzDecompressInit) 
+                     ( bz_stream* strm, 
+                       int        verbosity,
+                       int        small )
+{
+   DState* s;
+
+   if (!bz_config_ok()) return BZ_CONFIG_ERROR;
+
+   if (strm == NULL) return BZ_PARAM_ERROR;
+   if (small != 0 && small != 1) return BZ_PARAM_ERROR;
+   if (verbosity < 0 || verbosity > 4) return BZ_PARAM_ERROR;
+
+   if (strm->bzalloc == NULL) strm->bzalloc = default_bzalloc;
+   if (strm->bzfree == NULL) strm->bzfree = default_bzfree;
+
+   s = BZALLOC( sizeof(DState) );
+   if (s == NULL) return BZ_MEM_ERROR;
+   s->strm                  = strm;
+   strm->state              = s;
+   s->state                 = BZ_X_MAGIC_1;
+   s->bsLive                = 0;
+   s->bsBuff                = 0;
+   s->calculatedCombinedCRC = 0;
+   strm->total_in_lo32      = 0;
+   strm->total_in_hi32      = 0;
+   strm->total_out_lo32     = 0;
+   strm->total_out_hi32     = 0;
+   s->smallDecompress       = (Bool)small;
+   s->ll4                   = NULL;
+   s->ll16                  = NULL;
+   s->tt                    = NULL;
+   s->currBlockNo           = 0;
+   s->verbosity             = verbosity;
+
+   return BZ_OK;
+}
+
+
+/*---------------------------------------------------*/
+static
+void unRLE_obuf_to_output_FAST ( DState* s )
+{
+   UChar k1;
+
+   if (s->blockRandomised) {
+
+      while (True) {
+         /* try to finish existing run */
+         while (True) {
+            if (s->strm->avail_out == 0) return;
+            if (s->state_out_len == 0) break;
+            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
+            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
+            s->state_out_len--;
+            s->strm->next_out++;
+            s->strm->avail_out--;
+            s->strm->total_out_lo32++;
+            if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
+         }
+   
+         /* can a new run be started? */
+         if (s->nblock_used == s->save_nblock+1) return;
+               
+   
+         s->state_out_len = 1;
+         s->state_out_ch = s->k0;
+         BZ_GET_FAST(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         s->state_out_len = 2;
+         BZ_GET_FAST(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         s->state_out_len = 3;
+         BZ_GET_FAST(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         BZ_GET_FAST(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         s->state_out_len = ((Int32)k1) + 4;
+         BZ_GET_FAST(s->k0); BZ_RAND_UPD_MASK; 
+         s->k0 ^= BZ_RAND_MASK; s->nblock_used++;
+      }
+
+   } else {
+
+      /* restore */
+      UInt32        c_calculatedBlockCRC = s->calculatedBlockCRC;
+      UChar         c_state_out_ch       = s->state_out_ch;
+      Int32         c_state_out_len      = s->state_out_len;
+      Int32         c_nblock_used        = s->nblock_used;
+      Int32         c_k0                 = s->k0;
+      UInt32*       c_tt                 = s->tt;
+      UInt32        c_tPos               = s->tPos;
+      char*         cs_next_out          = s->strm->next_out;
+      unsigned int  cs_avail_out         = s->strm->avail_out;
+      /* end restore */
+
+      UInt32       avail_out_INIT = cs_avail_out;
+      Int32        s_save_nblockPP = s->save_nblock+1;
+      unsigned int total_out_lo32_old;
+
+      while (True) {
+
+         /* try to finish existing run */
+         if (c_state_out_len > 0) {
+            while (True) {
+               if (cs_avail_out == 0) goto return_notr;
+               if (c_state_out_len == 1) break;
+               *( (UChar*)(cs_next_out) ) = c_state_out_ch;
+               BZ_UPDATE_CRC ( c_calculatedBlockCRC, c_state_out_ch );
+               c_state_out_len--;
+               cs_next_out++;
+               cs_avail_out--;
+            }
+            s_state_out_len_eq_one:
+            {
+               if (cs_avail_out == 0) { 
+                  c_state_out_len = 1; goto return_notr;
+               };
+               *( (UChar*)(cs_next_out) ) = c_state_out_ch;
+               BZ_UPDATE_CRC ( c_calculatedBlockCRC, c_state_out_ch );
+               cs_next_out++;
+               cs_avail_out--;
+            }
+         }   
+         /* can a new run be started? */
+         if (c_nblock_used == s_save_nblockPP) {
+            c_state_out_len = 0; goto return_notr;
+         };   
+         c_state_out_ch = c_k0;
+         BZ_GET_FAST_C(k1); c_nblock_used++;
+         if (k1 != c_k0) { 
+            c_k0 = k1; goto s_state_out_len_eq_one; 
+         };
+         if (c_nblock_used == s_save_nblockPP) 
+            goto s_state_out_len_eq_one;
+   
+         c_state_out_len = 2;
+         BZ_GET_FAST_C(k1); c_nblock_used++;
+         if (c_nblock_used == s_save_nblockPP) continue;
+         if (k1 != c_k0) { c_k0 = k1; continue; };
+   
+         c_state_out_len = 3;
+         BZ_GET_FAST_C(k1); c_nblock_used++;
+         if (c_nblock_used == s_save_nblockPP) continue;
+         if (k1 != c_k0) { c_k0 = k1; continue; };
+   
+         BZ_GET_FAST_C(k1); c_nblock_used++;
+         c_state_out_len = ((Int32)k1) + 4;
+         BZ_GET_FAST_C(c_k0); c_nblock_used++;
+      }
+
+      return_notr:
+      total_out_lo32_old = s->strm->total_out_lo32;
+      s->strm->total_out_lo32 += (avail_out_INIT - cs_avail_out);
+      if (s->strm->total_out_lo32 < total_out_lo32_old)
+         s->strm->total_out_hi32++;
+
+      /* save */
+      s->calculatedBlockCRC = c_calculatedBlockCRC;
+      s->state_out_ch       = c_state_out_ch;
+      s->state_out_len      = c_state_out_len;
+      s->nblock_used        = c_nblock_used;
+      s->k0                 = c_k0;
+      s->tt                 = c_tt;
+      s->tPos               = c_tPos;
+      s->strm->next_out     = cs_next_out;
+      s->strm->avail_out    = cs_avail_out;
+      /* end save */
+   }
+}
+
+
+
+/*---------------------------------------------------*/
+Int32 BZ2_indexIntoF ( Int32 indx, Int32 *cftab )
+{
+   Int32 nb, na, mid;
+   nb = 0;
+   na = 256;
+   do {
+      mid = (nb + na) >> 1;
+      if (indx >= cftab[mid]) nb = mid; else na = mid;
+   }
+   while (na - nb != 1);
+   return nb;
+}
+
+
+/*---------------------------------------------------*/
+static
+void unRLE_obuf_to_output_SMALL ( DState* s )
+{
+   UChar k1;
+
+   if (s->blockRandomised) {
+
+      while (True) {
+         /* try to finish existing run */
+         while (True) {
+            if (s->strm->avail_out == 0) return;
+            if (s->state_out_len == 0) break;
+            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
+            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
+            s->state_out_len--;
+            s->strm->next_out++;
+            s->strm->avail_out--;
+            s->strm->total_out_lo32++;
+            if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
+         }
+   
+         /* can a new run be started? */
+         if (s->nblock_used == s->save_nblock+1) return;
+               
+   
+         s->state_out_len = 1;
+         s->state_out_ch = s->k0;
+         BZ_GET_SMALL(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         s->state_out_len = 2;
+         BZ_GET_SMALL(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         s->state_out_len = 3;
+         BZ_GET_SMALL(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         BZ_GET_SMALL(k1); BZ_RAND_UPD_MASK; 
+         k1 ^= BZ_RAND_MASK; s->nblock_used++;
+         s->state_out_len = ((Int32)k1) + 4;
+         BZ_GET_SMALL(s->k0); BZ_RAND_UPD_MASK; 
+         s->k0 ^= BZ_RAND_MASK; s->nblock_used++;
+      }
+
+   } else {
+
+      while (True) {
+         /* try to finish existing run */
+         while (True) {
+            if (s->strm->avail_out == 0) return;
+            if (s->state_out_len == 0) break;
+            *( (UChar*)(s->strm->next_out) ) = s->state_out_ch;
+            BZ_UPDATE_CRC ( s->calculatedBlockCRC, s->state_out_ch );
+            s->state_out_len--;
+            s->strm->next_out++;
+            s->strm->avail_out--;
+            s->strm->total_out_lo32++;
+            if (s->strm->total_out_lo32 == 0) s->strm->total_out_hi32++;
+         }
+   
+         /* can a new run be started? */
+         if (s->nblock_used == s->save_nblock+1) return;
+   
+         s->state_out_len = 1;
+         s->state_out_ch = s->k0;
+         BZ_GET_SMALL(k1); s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         s->state_out_len = 2;
+         BZ_GET_SMALL(k1); s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         s->state_out_len = 3;
+         BZ_GET_SMALL(k1); s->nblock_used++;
+         if (s->nblock_used == s->save_nblock+1) continue;
+         if (k1 != s->k0) { s->k0 = k1; continue; };
+   
+         BZ_GET_SMALL(k1); s->nblock_used++;
+         s->state_out_len = ((Int32)k1) + 4;
+         BZ_GET_SMALL(s->k0); s->nblock_used++;
+      }
+
+   }
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzDecompress) ( bz_stream *strm )
+{
+   DState* s;
+   if (strm == NULL) return BZ_PARAM_ERROR;
+   s = strm->state;
+   if (s == NULL) return BZ_PARAM_ERROR;
+   if (s->strm != strm) return BZ_PARAM_ERROR;
+
+   while (True) {
+      if (s->state == BZ_X_IDLE) return BZ_SEQUENCE_ERROR;
+      if (s->state == BZ_X_OUTPUT) {
+         if (s->smallDecompress)
+            unRLE_obuf_to_output_SMALL ( s ); else
+            unRLE_obuf_to_output_FAST  ( s );
+         if (s->nblock_used == s->save_nblock+1 && s->state_out_len == 0) {
+            BZ_FINALISE_CRC ( s->calculatedBlockCRC );
+            if (s->verbosity >= 3) 
+               VPrintf2 ( " {0x%x, 0x%x}", s->storedBlockCRC, 
+                          s->calculatedBlockCRC );
+            if (s->verbosity >= 2) VPrintf0 ( "]" );
+            if (s->calculatedBlockCRC != s->storedBlockCRC)
+               return BZ_DATA_ERROR;
+            s->calculatedCombinedCRC 
+               = (s->calculatedCombinedCRC << 1) | 
+                    (s->calculatedCombinedCRC >> 31);
+            s->calculatedCombinedCRC ^= s->calculatedBlockCRC;
+            s->state = BZ_X_BLKHDR_1;
+         } else {
+            return BZ_OK;
+         }
+      }
+      if (s->state >= BZ_X_MAGIC_1) {
+         Int32 r = BZ2_decompress ( s );
+         if (r == BZ_STREAM_END) {
+            if (s->verbosity >= 3)
+               VPrintf2 ( "\n    combined CRCs: stored = 0x%x, computed = 0x%x", 
+                          s->storedCombinedCRC, s->calculatedCombinedCRC );
+            if (s->calculatedCombinedCRC != s->storedCombinedCRC)
+               return BZ_DATA_ERROR;
+            return r;
+         }
+         if (s->state != BZ_X_OUTPUT) return r;
+      }
+   }
+
+   AssertH ( 0, 6001 );
+
+   return 0;  /*NOTREACHED*/
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzDecompressEnd)  ( bz_stream *strm )
+{
+   DState* s;
+   if (strm == NULL) return BZ_PARAM_ERROR;
+   s = strm->state;
+   if (s == NULL) return BZ_PARAM_ERROR;
+   if (s->strm != strm) return BZ_PARAM_ERROR;
+
+   if (s->tt   != NULL) BZFREE(s->tt);
+   if (s->ll16 != NULL) BZFREE(s->ll16);
+   if (s->ll4  != NULL) BZFREE(s->ll4);
+
+   BZFREE(strm->state);
+   strm->state = NULL;
+
+   return BZ_OK;
+}
+
+
+#ifndef BZ_NO_STDIO
+/*---------------------------------------------------*/
+/*--- File I/O stuff                              ---*/
+/*---------------------------------------------------*/
+
+#define BZ_SETERR(eee)                    \
+{                                         \
+   if (bzerror != NULL) *bzerror = eee;   \
+   if (bzf != NULL) bzf->lastErr = eee;   \
+}
+
+typedef 
+   struct {
+      FILE*     handle;
+      Char      buf[BZ_MAX_UNUSED];
+      Int32     bufN;
+      Bool      writing;
+      bz_stream strm;
+      Int32     lastErr;
+      Bool      initialisedOk;
+   }
+   bzFile;
+
+
+/*---------------------------------------------*/
+static Bool myfeof ( FILE* f )
+{
+   Int32 c = fgetc ( f );
+   if (c == EOF) return True;
+   ungetc ( c, f );
+   return False;
+}
+
+
+/*---------------------------------------------------*/
+BZFILE* BZ_API(BZ2_bzWriteOpen) 
+                    ( int*  bzerror,      
+                      FILE* f, 
+                      int   blockSize100k, 
+                      int   verbosity,
+                      int   workFactor )
+{
+   Int32   ret;
+   bzFile* bzf = NULL;
+
+   BZ_SETERR(BZ_OK);
+
+   if (f == NULL ||
+       (blockSize100k < 1 || blockSize100k > 9) ||
+       (workFactor < 0 || workFactor > 250) ||
+       (verbosity < 0 || verbosity > 4))
+      { BZ_SETERR(BZ_PARAM_ERROR); return NULL; };
+
+   if (ferror(f))
+      { BZ_SETERR(BZ_IO_ERROR); return NULL; };
+
+   bzf = malloc ( sizeof(bzFile) );
+   if (bzf == NULL)
+      { BZ_SETERR(BZ_MEM_ERROR); return NULL; };
+
+   BZ_SETERR(BZ_OK);
+   bzf->initialisedOk = False;
+   bzf->bufN          = 0;
+   bzf->handle        = f;
+   bzf->writing       = True;
+   bzf->strm.bzalloc  = NULL;
+   bzf->strm.bzfree   = NULL;
+   bzf->strm.opaque   = NULL;
+
+   if (workFactor == 0) workFactor = 30;
+   ret = BZ2_bzCompressInit ( &(bzf->strm), blockSize100k, 
+                              verbosity, workFactor );
+   if (ret != BZ_OK)
+      { BZ_SETERR(ret); free(bzf); return NULL; };
+
+   bzf->strm.avail_in = 0;
+   bzf->initialisedOk = True;
+   return bzf;   
+}
+
+
+
+/*---------------------------------------------------*/
+void BZ_API(BZ2_bzWrite)
+             ( int*    bzerror, 
+               BZFILE* b, 
+               void*   buf, 
+               int     len )
+{
+   Int32 n, n2, ret;
+   bzFile* bzf = (bzFile*)b;
+
+   BZ_SETERR(BZ_OK);
+   if (bzf == NULL || buf == NULL || len < 0)
+      { BZ_SETERR(BZ_PARAM_ERROR); return; };
+   if (!(bzf->writing))
+      { BZ_SETERR(BZ_SEQUENCE_ERROR); return; };
+   if (ferror(bzf->handle))
+      { BZ_SETERR(BZ_IO_ERROR); return; };
+
+   if (len == 0)
+      { BZ_SETERR(BZ_OK); return; };
+
+   bzf->strm.avail_in = len;
+   bzf->strm.next_in  = buf;
+
+   while (True) {
+      bzf->strm.avail_out = BZ_MAX_UNUSED;
+      bzf->strm.next_out = bzf->buf;
+      ret = BZ2_bzCompress ( &(bzf->strm), BZ_RUN );
+      if (ret != BZ_RUN_OK)
+         { BZ_SETERR(ret); return; };
+
+      if (bzf->strm.avail_out < BZ_MAX_UNUSED) {
+         n = BZ_MAX_UNUSED - bzf->strm.avail_out;
+         n2 = fwrite ( (void*)(bzf->buf), sizeof(UChar), 
+                       n, bzf->handle );
+         if (n != n2 || ferror(bzf->handle))
+            { BZ_SETERR(BZ_IO_ERROR); return; };
+      }
+
+      if (bzf->strm.avail_in == 0)
+         { BZ_SETERR(BZ_OK); return; };
+   }
+}
+
+
+/*---------------------------------------------------*/
+void BZ_API(BZ2_bzWriteClose)
+                  ( int*          bzerror, 
+                    BZFILE*       b, 
+                    int           abandon,
+                    unsigned int* nbytes_in,
+                    unsigned int* nbytes_out )
+{
+   BZ2_bzWriteClose64 ( bzerror, b, abandon, 
+                        nbytes_in, NULL, nbytes_out, NULL );
+}
+
+
+void BZ_API(BZ2_bzWriteClose64)
+                  ( int*          bzerror, 
+                    BZFILE*       b, 
+                    int           abandon,
+                    unsigned int* nbytes_in_lo32,
+                    unsigned int* nbytes_in_hi32,
+                    unsigned int* nbytes_out_lo32,
+                    unsigned int* nbytes_out_hi32 )
+{
+   Int32   n, n2, ret;
+   bzFile* bzf = (bzFile*)b;
+
+   if (bzf == NULL)
+      { BZ_SETERR(BZ_OK); return; };
+   if (!(bzf->writing))
+      { BZ_SETERR(BZ_SEQUENCE_ERROR); return; };
+   if (ferror(bzf->handle))
+      { BZ_SETERR(BZ_IO_ERROR); return; };
+
+   if (nbytes_in_lo32 != NULL) *nbytes_in_lo32 = 0;
+   if (nbytes_in_hi32 != NULL) *nbytes_in_hi32 = 0;
+   if (nbytes_out_lo32 != NULL) *nbytes_out_lo32 = 0;
+   if (nbytes_out_hi32 != NULL) *nbytes_out_hi32 = 0;
+
+   if ((!abandon) && bzf->lastErr == BZ_OK) {
+      while (True) {
+         bzf->strm.avail_out = BZ_MAX_UNUSED;
+         bzf->strm.next_out = bzf->buf;
+         ret = BZ2_bzCompress ( &(bzf->strm), BZ_FINISH );
+         if (ret != BZ_FINISH_OK && ret != BZ_STREAM_END)
+            { BZ_SETERR(ret); return; };
+
+         if (bzf->strm.avail_out < BZ_MAX_UNUSED) {
+            n = BZ_MAX_UNUSED - bzf->strm.avail_out;
+            n2 = fwrite ( (void*)(bzf->buf), sizeof(UChar), 
+                          n, bzf->handle );
+            if (n != n2 || ferror(bzf->handle))
+               { BZ_SETERR(BZ_IO_ERROR); return; };
+         }
+
+         if (ret == BZ_STREAM_END) break;
+      }
+   }
+
+   if ( !abandon && !ferror ( bzf->handle ) ) {
+      fflush ( bzf->handle );
+      if (ferror(bzf->handle))
+         { BZ_SETERR(BZ_IO_ERROR); return; };
+   }
+
+   if (nbytes_in_lo32 != NULL)
+      *nbytes_in_lo32 = bzf->strm.total_in_lo32;
+   if (nbytes_in_hi32 != NULL)
+      *nbytes_in_hi32 = bzf->strm.total_in_hi32;
+   if (nbytes_out_lo32 != NULL)
+      *nbytes_out_lo32 = bzf->strm.total_out_lo32;
+   if (nbytes_out_hi32 != NULL)
+      *nbytes_out_hi32 = bzf->strm.total_out_hi32;
+
+   BZ_SETERR(BZ_OK);
+   BZ2_bzCompressEnd ( &(bzf->strm) );
+   free ( bzf );
+}
+
+
+/*---------------------------------------------------*/
+BZFILE* BZ_API(BZ2_bzReadOpen) 
+                   ( int*  bzerror, 
+                     FILE* f, 
+                     int   verbosity,
+                     int   small,
+                     void* unused,
+                     int   nUnused )
+{
+   bzFile* bzf = NULL;
+   int     ret;
+
+   BZ_SETERR(BZ_OK);
+
+   if (f == NULL || 
+       (small != 0 && small != 1) ||
+       (verbosity < 0 || verbosity > 4) ||
+       (unused == NULL && nUnused != 0) ||
+       (unused != NULL && (nUnused < 0 || nUnused > BZ_MAX_UNUSED)))
+      { BZ_SETERR(BZ_PARAM_ERROR); return NULL; };
+
+   if (ferror(f))
+      { BZ_SETERR(BZ_IO_ERROR); return NULL; };
+
+   bzf = malloc ( sizeof(bzFile) );
+   if (bzf == NULL) 
+      { BZ_SETERR(BZ_MEM_ERROR); return NULL; };
+
+   BZ_SETERR(BZ_OK);
+
+   bzf->initialisedOk = False;
+   bzf->handle        = f;
+   bzf->bufN          = 0;
+   bzf->writing       = False;
+   bzf->strm.bzalloc  = NULL;
+   bzf->strm.bzfree   = NULL;
+   bzf->strm.opaque   = NULL;
+   
+   while (nUnused > 0) {
+      bzf->buf[bzf->bufN] = *((UChar*)(unused)); bzf->bufN++;
+      unused = ((void*)( 1 + ((UChar*)(unused))  ));
+      nUnused--;
+   }
+
+   ret = BZ2_bzDecompressInit ( &(bzf->strm), verbosity, small );
+   if (ret != BZ_OK)
+      { BZ_SETERR(ret); free(bzf); return NULL; };
+
+   bzf->strm.avail_in = bzf->bufN;
+   bzf->strm.next_in  = bzf->buf;
+
+   bzf->initialisedOk = True;
+   return bzf;   
+}
+
+
+/*---------------------------------------------------*/
+void BZ_API(BZ2_bzReadClose) ( int *bzerror, BZFILE *b )
+{
+   bzFile* bzf = (bzFile*)b;
+
+   BZ_SETERR(BZ_OK);
+   if (bzf == NULL)
+      { BZ_SETERR(BZ_OK); return; };
+
+   if (bzf->writing)
+      { BZ_SETERR(BZ_SEQUENCE_ERROR); return; };
+
+   if (bzf->initialisedOk)
+      (void)BZ2_bzDecompressEnd ( &(bzf->strm) );
+   free ( bzf );
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzRead) 
+           ( int*    bzerror, 
+             BZFILE* b, 
+             void*   buf, 
+             int     len )
+{
+   Int32   n, ret;
+   bzFile* bzf = (bzFile*)b;
+
+   BZ_SETERR(BZ_OK);
+
+   if (bzf == NULL || buf == NULL || len < 0)
+      { BZ_SETERR(BZ_PARAM_ERROR); return 0; };
+
+   if (bzf->writing)
+      { BZ_SETERR(BZ_SEQUENCE_ERROR); return 0; };
+
+   if (len == 0)
+      { BZ_SETERR(BZ_OK); return 0; };
+
+   bzf->strm.avail_out = len;
+   bzf->strm.next_out = buf;
+
+   while (True) {
+
+      if (ferror(bzf->handle)) 
+         { BZ_SETERR(BZ_IO_ERROR); return 0; };
+
+      if (bzf->strm.avail_in == 0 && !myfeof(bzf->handle)) {
+         n = fread ( bzf->buf, sizeof(UChar), 
+                     BZ_MAX_UNUSED, bzf->handle );
+         if (ferror(bzf->handle))
+            { BZ_SETERR(BZ_IO_ERROR); return 0; };
+         bzf->bufN = n;
+         bzf->strm.avail_in = bzf->bufN;
+         bzf->strm.next_in = bzf->buf;
+      }
+
+      ret = BZ2_bzDecompress ( &(bzf->strm) );
+
+      if (ret != BZ_OK && ret != BZ_STREAM_END)
+         { BZ_SETERR(ret); return 0; };
+
+      if (ret == BZ_OK && myfeof(bzf->handle) && 
+          bzf->strm.avail_in == 0 && bzf->strm.avail_out > 0)
+         { BZ_SETERR(BZ_UNEXPECTED_EOF); return 0; };
+
+      if (ret == BZ_STREAM_END)
+         { BZ_SETERR(BZ_STREAM_END);
+           return len - bzf->strm.avail_out; };
+      if (bzf->strm.avail_out == 0)
+         { BZ_SETERR(BZ_OK); return len; };
+      
+   }
+
+   return 0; /*not reached*/
+}
+
+
+/*---------------------------------------------------*/
+void BZ_API(BZ2_bzReadGetUnused) 
+                     ( int*    bzerror, 
+                       BZFILE* b, 
+                       void**  unused, 
+                       int*    nUnused )
+{
+   bzFile* bzf = (bzFile*)b;
+   if (bzf == NULL)
+      { BZ_SETERR(BZ_PARAM_ERROR); return; };
+   if (bzf->lastErr != BZ_STREAM_END)
+      { BZ_SETERR(BZ_SEQUENCE_ERROR); return; };
+   if (unused == NULL || nUnused == NULL)
+      { BZ_SETERR(BZ_PARAM_ERROR); return; };
+
+   BZ_SETERR(BZ_OK);
+   *nUnused = bzf->strm.avail_in;
+   *unused = bzf->strm.next_in;
+}
+#endif
+
+
+/*---------------------------------------------------*/
+/*--- Misc convenience stuff                      ---*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzBuffToBuffCompress) 
+                         ( char*         dest, 
+                           unsigned int* destLen,
+                           char*         source, 
+                           unsigned int  sourceLen,
+                           int           blockSize100k, 
+                           int           verbosity, 
+                           int           workFactor )
+{
+   bz_stream strm;
+   int ret;
+
+   if (dest == NULL || destLen == NULL || 
+       source == NULL ||
+       blockSize100k < 1 || blockSize100k > 9 ||
+       verbosity < 0 || verbosity > 4 ||
+       workFactor < 0 || workFactor > 250) 
+      return BZ_PARAM_ERROR;
+
+   if (workFactor == 0) workFactor = 30;
+   strm.bzalloc = NULL;
+   strm.bzfree = NULL;
+   strm.opaque = NULL;
+   ret = BZ2_bzCompressInit ( &strm, blockSize100k, 
+                              verbosity, workFactor );
+   if (ret != BZ_OK) return ret;
+
+   strm.next_in = source;
+   strm.next_out = dest;
+   strm.avail_in = sourceLen;
+   strm.avail_out = *destLen;
+
+   ret = BZ2_bzCompress ( &strm, BZ_FINISH );
+   if (ret == BZ_FINISH_OK) goto output_overflow;
+   if (ret != BZ_STREAM_END) goto errhandler;
+
+   /* normal termination */
+   *destLen -= strm.avail_out;   
+   BZ2_bzCompressEnd ( &strm );
+   return BZ_OK;
+
+   output_overflow:
+   BZ2_bzCompressEnd ( &strm );
+   return BZ_OUTBUFF_FULL;
+
+   errhandler:
+   BZ2_bzCompressEnd ( &strm );
+   return ret;
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzBuffToBuffDecompress) 
+                           ( char*         dest, 
+                             unsigned int* destLen,
+                             char*         source, 
+                             unsigned int  sourceLen,
+                             int           small,
+                             int           verbosity )
+{
+   bz_stream strm;
+   int ret;
+
+   if (dest == NULL || destLen == NULL || 
+       source == NULL ||
+       (small != 0 && small != 1) ||
+       verbosity < 0 || verbosity > 4) 
+          return BZ_PARAM_ERROR;
+
+   strm.bzalloc = NULL;
+   strm.bzfree = NULL;
+   strm.opaque = NULL;
+   ret = BZ2_bzDecompressInit ( &strm, verbosity, small );
+   if (ret != BZ_OK) return ret;
+
+   strm.next_in = source;
+   strm.next_out = dest;
+   strm.avail_in = sourceLen;
+   strm.avail_out = *destLen;
+
+   ret = BZ2_bzDecompress ( &strm );
+   if (ret == BZ_OK) goto output_overflow_or_eof;
+   if (ret != BZ_STREAM_END) goto errhandler;
+
+   /* normal termination */
+   *destLen -= strm.avail_out;
+   BZ2_bzDecompressEnd ( &strm );
+   return BZ_OK;
+
+   output_overflow_or_eof:
+   if (strm.avail_out > 0) {
+      BZ2_bzDecompressEnd ( &strm );
+      return BZ_UNEXPECTED_EOF;
+   } else {
+      BZ2_bzDecompressEnd ( &strm );
+      return BZ_OUTBUFF_FULL;
+   };      
+
+   errhandler:
+   BZ2_bzDecompressEnd ( &strm );
+   return ret; 
+}
+
+
+/*---------------------------------------------------*/
+/*--
+   Code contributed by Yoshioka Tsuneo
+   (QWF00133@niftyserve.or.jp/tsuneo-y@is.aist-nara.ac.jp),
+   to support better zlib compatibility.
+   This code is not _officially_ part of libbzip2 (yet);
+   I haven't tested it, documented it, or considered the
+   threading-safeness of it.
+   If this code breaks, please contact both Yoshioka and me.
+--*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------------*/
+/*--
+   return version like "0.9.0c".
+--*/
+const char * BZ_API(BZ2_bzlibVersion)(void)
+{
+   return BZ_VERSION;
+}
+
+
+#ifndef BZ_NO_STDIO
+/*---------------------------------------------------*/
+
+static
+BZFILE * bzopen_or_bzdopen
+               ( const char *path,   /* no use when bzdopen */
+                 int fd,             /* no use when bzdopen */
+                 const char *mode,
+                 int open_mode)      /* bzopen: 0, bzdopen:1 */
+{
+   int    bzerr;
+   char   unused[BZ_MAX_UNUSED];
+   int    blockSize100k = 9;
+   int    writing       = 0;
+   char   mode2[10]     = "";
+   FILE   *fp           = NULL;
+   BZFILE *bzfp         = NULL;
+   int    verbosity     = 0;
+   int    workFactor    = 30;
+   int    smallMode     = 0;
+   int    nUnused       = 0; 
+
+   if (mode == NULL) return NULL;
+   while (*mode) {
+      switch (*mode) {
+      case 'r':
+         writing = 0; break;
+      case 'w':
+         writing = 1; break;
+      case 's':
+         smallMode = 1; break;
+      default:
+         if (isdigit((int)(*mode))) {
+            blockSize100k = *mode-BZ_HDR_0;
+         }
+      }
+      mode++;
+   }
+   strcat(mode2, writing ? "w" : "r" );
+   strcat(mode2,"b");   /* binary mode */
+
+   if (open_mode==0) {
+      if (path==NULL || strcmp(path,"")==0) {
+        fp = (writing ? stdout : stdin);
+      } else {
+        fp = fopen(path,mode2);
+      }
+   } else {
+#ifdef BZ_STRICT_ANSI
+      fp = NULL;
+#else
+      fp = fdopen(fd,mode2);
+#endif
+   }
+   if (fp == NULL) return NULL;
+
+   if (writing) {
+      /* Guard against total chaos and anarchy -- JRS */
+      if (blockSize100k < 1) blockSize100k = 1;
+      if (blockSize100k > 9) blockSize100k = 9; 
+      bzfp = BZ2_bzWriteOpen(&bzerr,fp,blockSize100k,
+                             verbosity,workFactor);
+   } else {
+      bzfp = BZ2_bzReadOpen(&bzerr,fp,verbosity,smallMode,
+                            unused,nUnused);
+   }
+   if (bzfp == NULL) {
+      if (fp != stdin && fp != stdout) fclose(fp);
+      return NULL;
+   }
+   return bzfp;
+}
+
+
+/*---------------------------------------------------*/
+/*--
+   open file for read or write.
+      ex) bzopen("file","w9")
+      case path="" or NULL => use stdin or stdout.
+--*/
+BZFILE * BZ_API(BZ2_bzopen)
+               ( const char *path,
+                 const char *mode )
+{
+   return bzopen_or_bzdopen(path,-1,mode,/*bzopen*/0);
+}
+
+
+/*---------------------------------------------------*/
+BZFILE * BZ_API(BZ2_bzdopen)
+               ( int fd,
+                 const char *mode )
+{
+   return bzopen_or_bzdopen(NULL,fd,mode,/*bzdopen*/1);
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzread) (BZFILE* b, void* buf, int len )
+{
+   int bzerr, nread;
+   if (((bzFile*)b)->lastErr == BZ_STREAM_END) return 0;
+   nread = BZ2_bzRead(&bzerr,b,buf,len);
+   if (bzerr == BZ_OK || bzerr == BZ_STREAM_END) {
+      return nread;
+   } else {
+      return -1;
+   }
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzwrite) (BZFILE* b, void* buf, int len )
+{
+   int bzerr;
+
+   BZ2_bzWrite(&bzerr,b,buf,len);
+   if(bzerr == BZ_OK){
+      return len;
+   }else{
+      return -1;
+   }
+}
+
+
+/*---------------------------------------------------*/
+int BZ_API(BZ2_bzflush) (BZFILE *b)
+{
+   /* do nothing now... */
+   return 0;
+}
+
+
+/*---------------------------------------------------*/
+void BZ_API(BZ2_bzclose) (BZFILE* b)
+{
+   int bzerr;
+   FILE *fp = ((bzFile *)b)->handle;
+   
+   if (b==NULL) {return;}
+   if(((bzFile*)b)->writing){
+      BZ2_bzWriteClose(&bzerr,b,0,NULL,NULL);
+      if(bzerr != BZ_OK){
+         BZ2_bzWriteClose(NULL,b,1,NULL,NULL);
+      }
+   }else{
+      BZ2_bzReadClose(&bzerr,b);
+   }
+   if(fp!=stdin && fp!=stdout){
+      fclose(fp);
+   }
+}
+
+
+/*---------------------------------------------------*/
+/*--
+   return last error code 
+--*/
+static char *bzerrorstrings[] = {
+       "OK"
+      ,"SEQUENCE_ERROR"
+      ,"PARAM_ERROR"
+      ,"MEM_ERROR"
+      ,"DATA_ERROR"
+      ,"DATA_ERROR_MAGIC"
+      ,"IO_ERROR"
+      ,"UNEXPECTED_EOF"
+      ,"OUTBUFF_FULL"
+      ,"CONFIG_ERROR"
+      ,"???"   /* for future */
+      ,"???"   /* for future */
+      ,"???"   /* for future */
+      ,"???"   /* for future */
+      ,"???"   /* for future */
+      ,"???"   /* for future */
+};
+
+
+const char * BZ_API(BZ2_bzerror) (BZFILE *b, int *errnum)
+{
+   int err = ((bzFile *)b)->lastErr;
+
+   if(err>0) err = 0;
+   *errnum = err;
+   return bzerrorstrings[err*-1];
+}
+#endif
+
+
+/*-------------------------------------------------------------*/
+/*--- end                                           bzlib.c ---*/
+/*-------------------------------------------------------------*/
+
+/*-----------------------------------------------------------*/
+/*--- A block-sorting, lossless compressor        bzip2.c ---*/
+/*-----------------------------------------------------------*/
+
+
+
+/*----------------------------------------------------*/
+/*--- IMPORTANT                                    ---*/
+/*----------------------------------------------------*/
+
+/*--
+   WARNING:
+      This program and library (attempts to) compress data by 
+      performing several non-trivial transformations on it.  
+      Unless you are 100% familiar with *all* the algorithms 
+      contained herein, and with the consequences of modifying them, 
+      you should NOT meddle with the compression or decompression 
+      machinery.  Incorrect changes can and very likely *will* 
+      lead to disasterous loss of data.
+
+   DISCLAIMER:
+      I TAKE NO RESPONSIBILITY FOR ANY LOSS OF DATA ARISING FROM THE
+      USE OF THIS PROGRAM, HOWSOEVER CAUSED.
+
+      Every compression of a file implies an assumption that the
+      compressed file can be decompressed to reproduce the original.
+      Great efforts in design, coding and testing have been made to
+      ensure that this program works correctly.  However, the
+      complexity of the algorithms, and, in particular, the presence
+      of various special cases in the code which occur with very low
+      but non-zero probability make it impossible to rule out the
+      possibility of bugs remaining in the program.  DO NOT COMPRESS
+      ANY DATA WITH THIS PROGRAM AND/OR LIBRARY UNLESS YOU ARE PREPARED 
+      TO ACCEPT THE POSSIBILITY, HOWEVER SMALL, THAT THE DATA WILL 
+      NOT BE RECOVERABLE.
+
+      That is not to say this program is inherently unreliable.
+      Indeed, I very much hope the opposite is true.  bzip2/libbzip2
+      has been carefully constructed and extensively tested.
+
+   PATENTS:
+      To the best of my knowledge, bzip2/libbzip2 does not use any 
+      patented algorithms.  However, I do not have the resources 
+      available to carry out a full patent search.  Therefore I cannot 
+      give any guarantee of the above statement.
+--*/
+
+
+
+/*----------------------------------------------------*/
+/*--- and now for something much more pleasant :-) ---*/
+/*----------------------------------------------------*/
+
+/*---------------------------------------------*/
+/*--
+  Place a 1 beside your platform, and 0 elsewhere.
+--*/
+
+/*--
+  Generic 32-bit Unix.
+  Also works on 64-bit Unix boxes.
+  This is the default.
+--*/
+#define BZ_UNIX      1
+
+/*--
+  Win32, as seen by Jacob Navia's excellent
+  port of (Chris Fraser & David Hanson)'s excellent
+  lcc compiler.  Or with MS Visual C.
+  This is selected automatically if compiled by a compiler which
+  defines _WIN32, not including the Cygwin GCC.
+--*/
+#define BZ_LCCWIN32  0
+
+#if defined(_WIN32) && !defined(__CYGWIN__)
+#undef  BZ_LCCWIN32
+#define BZ_LCCWIN32 1
+#undef  BZ_UNIX
+#define BZ_UNIX 0
+#endif
+
+
+/*---------------------------------------------*/
+/*--
+  Some stuff for all platforms.
+--*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+#include <math.h>
+#include <errno.h>
+#include <ctype.h>
+
+#define ERROR_IF_EOF(i)       { if ((i) == EOF)  ioError(); }
+#define ERROR_IF_NOT_ZERO(i)  { if ((i) != 0)    ioError(); }
+#define ERROR_IF_MINUS_ONE(i) { if ((i) == (-1)) ioError(); }
+
+
+/*---------------------------------------------*/
+/*--
+   Platform-specific stuff.
+--*/
+
+#if BZ_UNIX
+#   include <fcntl.h>
+#   include <sys/types.h>
+#   include <utime.h>
+#   include <unistd.h>
+#   include <sys/stat.h>
+#   include <sys/times.h>
+
+#   define PATH_SEP    '/'
+#   define MY_LSTAT    lstat
+#   define MY_STAT     stat
+#   define MY_S_ISREG  S_ISREG
+#   define MY_S_ISDIR  S_ISDIR
+
+#   define APPEND_FILESPEC(root, name) \
+      root=snocString((root), (name))
+
+#   define APPEND_FLAG(root, name) \
+      root=snocString((root), (name))
+
+#   define SET_BINARY_MODE(fd) /**/
+
+#   ifdef __GNUC__
+#      define NORETURN __attribute__ ((noreturn))
+#   else
+#      define NORETURN /**/
+#   endif
+
+#   ifdef __DJGPP__
+#     include <io.h>
+#     include <fcntl.h>
+#     undef MY_LSTAT
+#     undef MY_STAT
+#     define MY_LSTAT stat
+#     define MY_STAT stat
+#     undef SET_BINARY_MODE
+#     define SET_BINARY_MODE(fd)                        \
+        do {                                            \
+           int retVal = setmode ( fileno ( fd ),        \
+                                  O_BINARY );           \
+           ERROR_IF_MINUS_ONE ( retVal );               \
+        } while ( 0 )
+#   endif
+
+#   ifdef __CYGWIN__
+#     include <io.h>
+#     include <fcntl.h>
+#     undef SET_BINARY_MODE
+#     define SET_BINARY_MODE(fd)                        \
+        do {                                            \
+           int retVal = setmode ( fileno ( fd ),        \
+                                  O_BINARY );           \
+           ERROR_IF_MINUS_ONE ( retVal );               \
+        } while ( 0 )
+#   endif
+#endif /* BZ_UNIX */
+
+
+
+#if BZ_LCCWIN32
+#   include <io.h>
+#   include <fcntl.h>
+#   include <sys\stat.h>
+
+#   define NORETURN       /**/
+#   define PATH_SEP       '\\'
+#   define MY_LSTAT       _stat
+#   define MY_STAT        _stat
+#   define MY_S_ISREG(x)  ((x) & _S_IFREG)
+#   define MY_S_ISDIR(x)  ((x) & _S_IFDIR)
+
+#   define APPEND_FLAG(root, name) \
+      root=snocString((root), (name))
+
+#   define APPEND_FILESPEC(root, name)                \
+      root = snocString ((root), (name))
+
+#   define SET_BINARY_MODE(fd)                        \
+      do {                                            \
+         int retVal = setmode ( fileno ( fd ),        \
+                                O_BINARY );           \
+         ERROR_IF_MINUS_ONE ( retVal );               \
+      } while ( 0 )
+
+#endif /* BZ_LCCWIN32 */
+
+
+/*---------------------------------------------*/
+/*--
+  Some more stuff for all platforms :-)
+--*/
+                                       
+#define True  ((Bool)1)
+#define False ((Bool)0)
+
+/*--
+  IntNative is your platform's `native' int size.
+  Only here to avoid probs with 64-bit platforms.
+--*/
+typedef int IntNative;
+
+
+/*---------------------------------------------------*/
+/*--- Misc (file handling) data decls             ---*/
+/*---------------------------------------------------*/
+
+Int32   verbosity;
+Bool    keepInputFiles, smallMode, deleteOutputOnInterrupt;
+Bool    forceOverwrite, testFailsExist, unzFailsExist, noisy;
+Int32   numFileNames, numFilesProcessed, blockSize100k;
+Int32   exitValue;
+
+/*-- source modes; F==file, I==stdin, O==stdout --*/
+#define SM_I2O           1
+#define SM_F2O           2
+#define SM_F2F           3
+
+/*-- operation modes --*/
+#define OM_Z             1
+#define OM_UNZ           2
+#define OM_TEST          3
+
+Int32   opMode;
+Int32   srcMode;
+
+#define FILE_NAME_LEN 1034
+
+Int32   longestFileName;
+Char    inName [FILE_NAME_LEN];
+Char    outName[FILE_NAME_LEN];
+Char    tmpName[FILE_NAME_LEN];
+Char    *progName;
+Char    progNameReally[FILE_NAME_LEN];
+FILE    *outputHandleJustInCase;
+Int32   workFactor;
+
+static void    panic                 ( Char* )   NORETURN;
+static void    ioError               ( void )    NORETURN;
+static void    outOfMemory           ( void )    NORETURN;
+static void    configError           ( void )    NORETURN;
+static void    crcError              ( void )    NORETURN;
+static void    cleanUpAndFail        ( Int32 )   NORETURN;
+static void    compressedStreamEOF   ( void )    NORETURN;
+
+static void    copyFileName ( Char*, Char* );
+static void*   myMalloc     ( Int32 );
+
+
+
+/*---------------------------------------------------*/
+/*--- An implementation of 64-bit ints.  Sigh.    ---*/
+/*--- Roll on widespread deployment of ANSI C9X ! ---*/
+/*---------------------------------------------------*/
+
+typedef
+   struct { UChar b[8]; } 
+   UInt64;
+
+
+static
+void uInt64_from_UInt32s ( UInt64* n, UInt32 lo32, UInt32 hi32 )
+{
+   n->b[7] = (UChar)((hi32 >> 24) & 0xFF);
+   n->b[6] = (UChar)((hi32 >> 16) & 0xFF);
+   n->b[5] = (UChar)((hi32 >> 8)  & 0xFF);
+   n->b[4] = (UChar) (hi32        & 0xFF);
+   n->b[3] = (UChar)((lo32 >> 24) & 0xFF);
+   n->b[2] = (UChar)((lo32 >> 16) & 0xFF);
+   n->b[1] = (UChar)((lo32 >> 8)  & 0xFF);
+   n->b[0] = (UChar) (lo32        & 0xFF);
+}
+
+
+static
+double uInt64_to_double ( UInt64* n )
+{
+   Int32  i;
+   double base = 1.0;
+   double sum  = 0.0;
+   for (i = 0; i < 8; i++) {
+      sum  += base * (double)(n->b[i]);
+      base *= 256.0;
+   }
+   return sum;
+}
+
+
+static
+Bool uInt64_isZero ( UInt64* n )
+{
+   Int32 i;
+   for (i = 0; i < 8; i++)
+      if (n->b[i] != 0) return 0;
+   return 1;
+}
+
+
+/* Divide *n by 10, and return the remainder.  */
+static 
+Int32 uInt64_qrm10 ( UInt64* n )
+{
+   UInt32 rem, tmp;
+   Int32  i;
+   rem = 0;
+   for (i = 7; i >= 0; i--) {
+      tmp = rem * 256 + n->b[i];
+      n->b[i] = tmp / 10;
+      rem = tmp % 10;
+   }
+   return rem;
+}
+
+
+/* ... and the Whole Entire Point of all this UInt64 stuff is
+   so that we can supply the following function.
+*/
+static
+void uInt64_toAscii ( char* outbuf, UInt64* n )
+{
+   Int32  i, q;
+   UChar  buf[32];
+   Int32  nBuf   = 0;
+   UInt64 n_copy = *n;
+   do {
+      q = uInt64_qrm10 ( &n_copy );
+      buf[nBuf] = q + '0';
+      nBuf++;
+   } while (!uInt64_isZero(&n_copy));
+   outbuf[nBuf] = 0;
+   for (i = 0; i < nBuf; i++) 
+      outbuf[i] = buf[nBuf-i-1];
+}
+
+
+/*---------------------------------------------------*/
+/*--- Processing of complete files and streams    ---*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------*/
+
+/*---------------------------------------------*/
+static 
+void compressStream ( FILE *stream, FILE *zStream )
+{
+   BZFILE* bzf = NULL;
+   UChar   ibuf[5000];
+   Int32   nIbuf;
+   UInt32  nbytes_in_lo32, nbytes_in_hi32;
+   UInt32  nbytes_out_lo32, nbytes_out_hi32;
+   Int32   bzerr, bzerr_dummy, ret;
+
+   SET_BINARY_MODE(stream);
+   SET_BINARY_MODE(zStream);
+
+   if (ferror(stream)) goto errhandler_io;
+   if (ferror(zStream)) goto errhandler_io;
+
+   bzf = BZ2_bzWriteOpen ( &bzerr, zStream, 
+                           blockSize100k, verbosity, workFactor );   
+   if (bzerr != BZ_OK) goto errhandler;
+
+   if (verbosity >= 2) fprintf ( stderr, "\n" );
+
+   while (True) {
+
+      if (myfeof(stream)) break;
+      nIbuf = fread ( ibuf, sizeof(UChar), 5000, stream );
+      if (ferror(stream)) goto errhandler_io;
+      if (nIbuf > 0) BZ2_bzWrite ( &bzerr, bzf, (void*)ibuf, nIbuf );
+      if (bzerr != BZ_OK) goto errhandler;
+
+   }
+
+   BZ2_bzWriteClose64 ( &bzerr, bzf, 0, 
+                        &nbytes_in_lo32, &nbytes_in_hi32,
+                        &nbytes_out_lo32, &nbytes_out_hi32 );
+   if (bzerr != BZ_OK) goto errhandler;
+
+   if (ferror(zStream)) goto errhandler_io;
+   ret = fflush ( zStream );
+   if (ret == EOF) goto errhandler_io;
+   if (zStream != stdout) {
+      ret = fclose ( zStream );
+      outputHandleJustInCase = NULL;
+      if (ret == EOF) goto errhandler_io;
+   }
+   outputHandleJustInCase = NULL;
+   if (ferror(stream)) goto errhandler_io;
+   ret = fclose ( stream );
+   if (ret == EOF) goto errhandler_io;
+
+   if (verbosity >= 1) {
+      if (nbytes_in_lo32 == 0 && nbytes_in_hi32 == 0) {
+	 fprintf ( stderr, " no data compressed.\n");
+      } else {
+	 Char   buf_nin[32], buf_nout[32];
+	 UInt64 nbytes_in,   nbytes_out;
+	 double nbytes_in_d, nbytes_out_d;
+	 uInt64_from_UInt32s ( &nbytes_in, 
+			       nbytes_in_lo32, nbytes_in_hi32 );
+	 uInt64_from_UInt32s ( &nbytes_out, 
+			       nbytes_out_lo32, nbytes_out_hi32 );
+	 nbytes_in_d  = uInt64_to_double ( &nbytes_in );
+	 nbytes_out_d = uInt64_to_double ( &nbytes_out );
+	 uInt64_toAscii ( buf_nin, &nbytes_in );
+	 uInt64_toAscii ( buf_nout, &nbytes_out );
+	 fprintf ( stderr, "%6.3f:1, %6.3f bits/byte, "
+		   "%5.2f%% saved, %s in, %s out.\n",
+		   nbytes_in_d / nbytes_out_d,
+		   (8.0 * nbytes_out_d) / nbytes_in_d,
+		   100.0 * (1.0 - nbytes_out_d / nbytes_in_d),
+		   buf_nin,
+		   buf_nout
+		 );
+      }
+   }
+
+   return;
+
+   errhandler:
+   BZ2_bzWriteClose64 ( &bzerr_dummy, bzf, 1, 
+                        &nbytes_in_lo32, &nbytes_in_hi32,
+                        &nbytes_out_lo32, &nbytes_out_hi32 );
+   switch (bzerr) {
+      case BZ_CONFIG_ERROR:
+         configError(); break;
+      case BZ_MEM_ERROR:
+         outOfMemory (); break;
+      case BZ_IO_ERROR:
+         errhandler_io:
+         ioError(); break;
+      default:
+         panic ( "compress:unexpected error" );
+   }
+
+   panic ( "compress:end" );
+   /*notreached*/
+}
+
+
+
+/*---------------------------------------------*/
+static 
+Bool uncompressStream ( FILE *zStream, FILE *stream )
+{
+   BZFILE* bzf = NULL;
+   Int32   bzerr, bzerr_dummy, ret, nread, streamNo, i;
+   UChar   obuf[5000];
+   UChar   unused[BZ_MAX_UNUSED];
+   Int32   nUnused;
+   UChar*  unusedTmp;
+
+   nUnused = 0;
+   streamNo = 0;
+
+   SET_BINARY_MODE(stream);
+   SET_BINARY_MODE(zStream);
+
+   if (ferror(stream)) goto errhandler_io;
+   if (ferror(zStream)) goto errhandler_io;
+
+   while (True) {
+
+      bzf = BZ2_bzReadOpen ( 
+               &bzerr, zStream, verbosity, 
+               (int)smallMode, unused, nUnused
+            );
+      if (bzf == NULL || bzerr != BZ_OK) goto errhandler;
+      streamNo++;
+
+      while (bzerr == BZ_OK) {
+         nread = BZ2_bzRead ( &bzerr, bzf, obuf, 5000 );
+         if (bzerr == BZ_DATA_ERROR_MAGIC) goto trycat;
+         if ((bzerr == BZ_OK || bzerr == BZ_STREAM_END) && nread > 0)
+            fwrite ( obuf, sizeof(UChar), nread, stream );
+         if (ferror(stream)) goto errhandler_io;
+      }
+      if (bzerr != BZ_STREAM_END) goto errhandler;
+
+      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      if (bzerr != BZ_OK) panic ( "decompress:bzReadGetUnused" );
+
+      for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];
+
+      BZ2_bzReadClose ( &bzerr, bzf );
+      if (bzerr != BZ_OK) panic ( "decompress:bzReadGetUnused" );
+
+      if (nUnused == 0 && myfeof(zStream)) break;
+   }
+
+   closeok:
+   if (ferror(zStream)) goto errhandler_io;
+   ret = fclose ( zStream );
+   if (ret == EOF) goto errhandler_io;
+
+   if (ferror(stream)) goto errhandler_io;
+   ret = fflush ( stream );
+   if (ret != 0) goto errhandler_io;
+   if (stream != stdout) {
+      ret = fclose ( stream );
+      outputHandleJustInCase = NULL;
+      if (ret == EOF) goto errhandler_io;
+   }
+   outputHandleJustInCase = NULL;
+   if (verbosity >= 2) fprintf ( stderr, "\n    " );
+   return True;
+
+   trycat: 
+   if (forceOverwrite) {
+      rewind(zStream);
+      while (True) {
+      	 if (myfeof(zStream)) break;
+      	 nread = fread ( obuf, sizeof(UChar), 5000, zStream );
+      	 if (ferror(zStream)) goto errhandler_io;
+      	 if (nread > 0) fwrite ( obuf, sizeof(UChar), nread, stream );
+      	 if (ferror(stream)) goto errhandler_io;
+      }
+      goto closeok;
+   }
+  
+   errhandler:
+   BZ2_bzReadClose ( &bzerr_dummy, bzf );
+   switch (bzerr) {
+      case BZ_CONFIG_ERROR:
+         configError(); break;
+      case BZ_IO_ERROR:
+         errhandler_io:
+         ioError(); break;
+      case BZ_DATA_ERROR:
+         crcError();
+      case BZ_MEM_ERROR:
+         outOfMemory();
+      case BZ_UNEXPECTED_EOF:
+         compressedStreamEOF();
+      case BZ_DATA_ERROR_MAGIC:
+         if (zStream != stdin) fclose(zStream);
+         if (stream != stdout) fclose(stream);
+         if (streamNo == 1) {
+            return False;
+         } else {
+            if (noisy)
+            fprintf ( stderr, 
+                      "\n%s: %s: trailing garbage after EOF ignored\n",
+                      progName, inName );
+            return True;       
+         }
+      default:
+         panic ( "decompress:unexpected error" );
+   }
+
+   panic ( "decompress:end" );
+   return True; /*notreached*/
+}
+
+
+/*---------------------------------------------*/
+static 
+Bool testStream ( FILE *zStream )
+{
+   BZFILE* bzf = NULL;
+   Int32   bzerr, bzerr_dummy, ret, nread, streamNo, i;
+   UChar   obuf[5000];
+   UChar   unused[BZ_MAX_UNUSED];
+   Int32   nUnused;
+   UChar*  unusedTmp;
+
+   nUnused = 0;
+   streamNo = 0;
+
+   SET_BINARY_MODE(zStream);
+   if (ferror(zStream)) goto errhandler_io;
+
+   while (True) {
+
+      bzf = BZ2_bzReadOpen ( 
+               &bzerr, zStream, verbosity, 
+               (int)smallMode, unused, nUnused
+            );
+      if (bzf == NULL || bzerr != BZ_OK) goto errhandler;
+      streamNo++;
+
+      while (bzerr == BZ_OK) {
+         nread = BZ2_bzRead ( &bzerr, bzf, obuf, 5000 );
+         if (bzerr == BZ_DATA_ERROR_MAGIC) goto errhandler;
+      }
+      if (bzerr != BZ_STREAM_END) goto errhandler;
+
+      BZ2_bzReadGetUnused ( &bzerr, bzf, (void**)(&unusedTmp), &nUnused );
+      if (bzerr != BZ_OK) panic ( "test:bzReadGetUnused" );
+
+      for (i = 0; i < nUnused; i++) unused[i] = unusedTmp[i];
+
+      BZ2_bzReadClose ( &bzerr, bzf );
+      if (bzerr != BZ_OK) panic ( "test:bzReadGetUnused" );
+      if (nUnused == 0 && myfeof(zStream)) break;
+
+   }
+
+   if (ferror(zStream)) goto errhandler_io;
+   ret = fclose ( zStream );
+   if (ret == EOF) goto errhandler_io;
+
+   if (verbosity >= 2) fprintf ( stderr, "\n    " );
+   return True;
+
+   errhandler:
+   BZ2_bzReadClose ( &bzerr_dummy, bzf );
+   if (verbosity == 0) 
+      fprintf ( stderr, "%s: %s: ", progName, inName );
+   switch (bzerr) {
+      case BZ_CONFIG_ERROR:
+         configError(); break;
+      case BZ_IO_ERROR:
+         errhandler_io:
+         ioError(); break;
+      case BZ_DATA_ERROR:
+         fprintf ( stderr,
+                   "data integrity (CRC) error in data\n" );
+         return False;
+      case BZ_MEM_ERROR:
+         outOfMemory();
+      case BZ_UNEXPECTED_EOF:
+         fprintf ( stderr,
+                   "file ends unexpectedly\n" );
+         return False;
+      case BZ_DATA_ERROR_MAGIC:
+         if (zStream != stdin) fclose(zStream);
+         if (streamNo == 1) {
+          fprintf ( stderr, 
+                    "bad magic number (file not created by bzip2)\n" );
+            return False;
+         } else {
+            if (noisy)
+            fprintf ( stderr, 
+                      "trailing garbage after EOF ignored\n" );
+            return True;       
+         }
+      default:
+         panic ( "test:unexpected error" );
+   }
+
+   panic ( "test:end" );
+   return True; /*notreached*/
+}
+
+
+/*---------------------------------------------------*/
+/*--- Error [non-] handling grunge                ---*/
+/*---------------------------------------------------*/
+
+/*---------------------------------------------*/
+static
+void setExit ( Int32 v )
+{
+   if (v > exitValue) exitValue = v;
+}
+
+
+/*---------------------------------------------*/
+static 
+void cadvise ( void )
+{
+   if (noisy)
+   fprintf (
+      stderr,
+      "\nIt is possible that the compressed file(s) have become corrupted.\n"
+        "You can use the -tvv option to test integrity of such files.\n\n"
+        "You can use the `bzip2recover' program to attempt to recover\n"
+        "data from undamaged sections of corrupted files.\n\n"
+    );
+}
+
+
+/*---------------------------------------------*/
+static 
+void showFileNames ( void )
+{
+   if (noisy)
+   fprintf (
+      stderr,
+      "\tInput file = %s, output file = %s\n",
+      inName, outName 
+   );
+}
+
+
+/*---------------------------------------------*/
+static 
+void cleanUpAndFail ( Int32 ec )
+{
+   IntNative      retVal;
+   struct MY_STAT statBuf;
+
+   if ( srcMode == SM_F2F 
+        && opMode != OM_TEST
+        && deleteOutputOnInterrupt ) {
+
+      /* Check whether input file still exists.  Delete output file
+         only if input exists to avoid loss of data.  Joerg Prante, 5
+         January 2002.  (JRS 06-Jan-2002: other changes in 1.0.2 mean
+         this is less likely to happen.  But to be ultra-paranoid, we
+         do the check anyway.)  */
+      retVal = MY_STAT ( inName, &statBuf );
+      if (retVal == 0) {
+         if (noisy)
+            fprintf ( stderr, 
+                      "%s: Deleting output file %s, if it exists.\n",
+                      progName, outName );
+         if (outputHandleJustInCase != NULL)
+            fclose ( outputHandleJustInCase );
+         retVal = remove ( outName );
+         if (retVal != 0)
+            fprintf ( stderr,
+                      "%s: WARNING: deletion of output file "
+                      "(apparently) failed.\n",
+                      progName );
+      } else {
+         fprintf ( stderr,
+                   "%s: WARNING: deletion of output file suppressed\n",
+                    progName );
+         fprintf ( stderr,
+                   "%s:    since input file no longer exists.  Output file\n",
+                   progName );
+         fprintf ( stderr,
+                   "%s:    `%s' may be incomplete.\n",
+                   progName, outName );
+         fprintf ( stderr, 
+                   "%s:    I suggest doing an integrity test (bzip2 -tv)"
+                   " of it.\n",
+                   progName );
+      }
+   }
+
+   if (noisy && numFileNames > 0 && numFilesProcessed < numFileNames) {
+      fprintf ( stderr, 
+                "%s: WARNING: some files have not been processed:\n"
+                "%s:    %d specified on command line, %d not processed yet.\n\n",
+                progName, progName,
+                numFileNames, numFileNames - numFilesProcessed );
+   }
+   setExit(ec);
+   exit(exitValue);
+}
+
+
+/*---------------------------------------------*/
+static 
+void panic ( Char* s )
+{
+   fprintf ( stderr,
+             "\n%s: PANIC -- internal consistency error:\n"
+             "\t%s\n"
+             "\tThis is a BUG.  Please report it to me at:\n"
+             "\tjseward@acm.org\n",
+             progName, s );
+   showFileNames();
+   cleanUpAndFail( 3 );
+}
+
+
+/*---------------------------------------------*/
+static 
+void crcError ( void )
+{
+   fprintf ( stderr,
+             "\n%s: Data integrity error when decompressing.\n",
+             progName );
+   showFileNames();
+   cadvise();
+   cleanUpAndFail( 2 );
+}
+
+
+/*---------------------------------------------*/
+static 
+void compressedStreamEOF ( void )
+{
+  if (noisy) {
+    fprintf ( stderr,
+	      "\n%s: Compressed file ends unexpectedly;\n\t"
+	      "perhaps it is corrupted?  *Possible* reason follows.\n",
+	      progName );
+    perror ( progName );
+    showFileNames();
+    cadvise();
+  }
+  cleanUpAndFail( 2 );
+}
+
+
+/*---------------------------------------------*/
+static 
+void ioError ( void )
+{
+   fprintf ( stderr,
+             "\n%s: I/O or other error, bailing out.  "
+             "Possible reason follows.\n",
+             progName );
+   perror ( progName );
+   showFileNames();
+   cleanUpAndFail( 1 );
+}
+
+
+/*---------------------------------------------*/
+static 
+void mySignalCatcher ( IntNative n )
+{
+   fprintf ( stderr,
+             "\n%s: Control-C or similar caught, quitting.\n",
+             progName );
+   cleanUpAndFail(1);
+}
+
+
+/*---------------------------------------------*/
+static 
+void mySIGSEGVorSIGBUScatcher ( IntNative n )
+{
+   if (opMode == OM_Z)
+      fprintf ( 
+      stderr,
+      "\n%s: Caught a SIGSEGV or SIGBUS whilst compressing.\n"
+      "\n"
+      "   Possible causes are (most likely first):\n"
+      "   (1) This computer has unreliable memory or cache hardware\n"
+      "       (a surprisingly common problem; try a different machine.)\n"
+      "   (2) A bug in the compiler used to create this executable\n"
+      "       (unlikely, if you didn't compile bzip2 yourself.)\n"
+      "   (3) A real bug in bzip2 -- I hope this should never be the case.\n"
+      "   The user's manual, Section 4.3, has more info on (1) and (2).\n"
+      "   \n"
+      "   If you suspect this is a bug in bzip2, or are unsure about (1)\n"
+      "   or (2), feel free to report it to me at: jseward@acm.org.\n"
+      "   Section 4.3 of the user's manual describes the info a useful\n"
+      "   bug report should have.  If the manual is available on your\n"
+      "   system, please try and read it before mailing me.  If you don't\n"
+      "   have the manual or can't be bothered to read it, mail me anyway.\n"
+      "\n",
+      progName );
+      else
+      fprintf ( 
+      stderr,
+      "\n%s: Caught a SIGSEGV or SIGBUS whilst decompressing.\n"
+      "\n"
+      "   Possible causes are (most likely first):\n"
+      "   (1) The compressed data is corrupted, and bzip2's usual checks\n"
+      "       failed to detect this.  Try bzip2 -tvv my_file.bz2.\n"
+      "   (2) This computer has unreliable memory or cache hardware\n"
+      "       (a surprisingly common problem; try a different machine.)\n"
+      "   (3) A bug in the compiler used to create this executable\n"
+      "       (unlikely, if you didn't compile bzip2 yourself.)\n"
+      "   (4) A real bug in bzip2 -- I hope this should never be the case.\n"
+      "   The user's manual, Section 4.3, has more info on (2) and (3).\n"
+      "   \n"
+      "   If you suspect this is a bug in bzip2, or are unsure about (2)\n"
+      "   or (3), feel free to report it to me at: jseward@acm.org.\n"
+      "   Section 4.3 of the user's manual describes the info a useful\n"
+      "   bug report should have.  If the manual is available on your\n"
+      "   system, please try and read it before mailing me.  If you don't\n"
+      "   have the manual or can't be bothered to read it, mail me anyway.\n"
+      "\n",
+      progName );
+
+   showFileNames();
+   if (opMode == OM_Z)
+      cleanUpAndFail( 3 ); else
+      { cadvise(); cleanUpAndFail( 2 ); }
+}
+
+
+/*---------------------------------------------*/
+static 
+void outOfMemory ( void )
+{
+   fprintf ( stderr,
+             "\n%s: couldn't allocate enough memory\n",
+             progName );
+   showFileNames();
+   cleanUpAndFail(1);
+}
+
+
+/*---------------------------------------------*/
+static 
+void configError ( void )
+{
+   fprintf ( stderr,
+             "bzip2: I'm not configured correctly for this platform!\n"
+             "\tI require Int32, Int16 and Char to have sizes\n"
+             "\tof 4, 2 and 1 bytes to run properly, and they don't.\n"
+             "\tProbably you can fix this by defining them correctly,\n"
+             "\tand recompiling.  Bye!\n" );
+   setExit(3);
+   exit(exitValue);
+}
+
+
+/*---------------------------------------------------*/
+/*--- The main driver machinery                   ---*/
+/*---------------------------------------------------*/
+
+/* All rather crufty.  The main problem is that input files
+   are stat()d multiple times before use.  This should be
+   cleaned up. 
+*/
+
+/*---------------------------------------------*/
+static 
+void pad ( Char *s )
+{
+   Int32 i;
+   if ( (Int32)strlen(s) >= longestFileName ) return;
+   for (i = 1; i <= longestFileName - (Int32)strlen(s); i++)
+      fprintf ( stderr, " " );
+}
+
+
+/*---------------------------------------------*/
+static 
+void copyFileName ( Char* to, Char* from ) 
+{
+   if ( strlen(from) > FILE_NAME_LEN-10 )  {
+      fprintf (
+         stderr,
+         "bzip2: file name\n`%s'\n"
+         "is suspiciously (more than %d chars) long.\n"
+         "Try using a reasonable file name instead.  Sorry! :-)\n",
+         from, FILE_NAME_LEN-10
+      );
+      setExit(1);
+      exit(exitValue);
+   }
+
+  strncpy(to,from,FILE_NAME_LEN-10);
+  to[FILE_NAME_LEN-10]='\0';
+}
+
+
+/*---------------------------------------------*/
+static 
+Bool fileExists ( Char* name )
+{
+   FILE *tmp   = fopen ( name, "rb" );
+   Bool exists = (tmp != NULL);
+   if (tmp != NULL) fclose ( tmp );
+   return exists;
+}
+
+
+/*---------------------------------------------*/
+/* Open an output file safely with O_EXCL and good permissions.
+   This avoids a race condition in versions < 1.0.2, in which
+   the file was first opened and then had its interim permissions
+   set safely.  We instead use open() to create the file with
+   the interim permissions required. (--- --- rw-).
+
+   For non-Unix platforms, if we are not worrying about
+   security issues, simple this simply behaves like fopen.
+*/
+FILE* fopen_output_safely ( Char* name, const char* mode )
+{
+#  if BZ_UNIX
+   FILE*     fp;
+   IntNative fh;
+   fh = open(name, O_WRONLY|O_CREAT|O_EXCL, S_IWUSR|S_IRUSR);
+   if (fh == -1) return NULL;
+   fp = fdopen(fh, mode);
+   if (fp == NULL) close(fh);
+   return fp;
+#  else
+   return fopen(name, mode);
+#  endif
+}
+
+
+/*---------------------------------------------*/
+/*--
+  if in doubt, return True
+--*/
+static 
+Bool notAStandardFile ( Char* name )
+{
+   IntNative      i;
+   struct MY_STAT statBuf;
+
+   i = MY_LSTAT ( name, &statBuf );
+   if (i != 0) return True;
+   if (MY_S_ISREG(statBuf.st_mode)) return False;
+   return True;
+}
+
+
+/*---------------------------------------------*/
+/*--
+  rac 11/21/98 see if file has hard links to it
+--*/
+static 
+Int32 countHardLinks ( Char* name )
+{  
+   IntNative      i;
+   struct MY_STAT statBuf;
+
+   i = MY_LSTAT ( name, &statBuf );
+   if (i != 0) return 0;
+   return (statBuf.st_nlink - 1);
+}
+
+
+/*---------------------------------------------*/
+/* Copy modification date, access date, permissions and owner from the
+   source to destination file.  We have to copy this meta-info off
+   into fileMetaInfo before starting to compress / decompress it,
+   because doing it afterwards means we get the wrong access time.
+
+   To complicate matters, in compress() and decompress() below, the
+   sequence of tests preceding the call to saveInputFileMetaInfo()
+   involves calling fileExists(), which in turn establishes its result
+   by attempting to fopen() the file, and if successful, immediately
+   fclose()ing it again.  So we have to assume that the fopen() call
+   does not cause the access time field to be updated.
+
+   Reading of the man page for stat() (man 2 stat) on RedHat 7.2 seems
+   to imply that merely doing open() will not affect the access time.
+   Therefore we merely need to hope that the C library only does
+   open() as a result of fopen(), and not any kind of read()-ahead
+   cleverness.
+
+   It sounds pretty fragile to me.  Whether this carries across
+   robustly to arbitrary Unix-like platforms (or even works robustly
+   on this one, RedHat 7.2) is unknown to me.  Nevertheless ...  
+*/
+#if BZ_UNIX
+static 
+struct MY_STAT fileMetaInfo;
+#endif
+
+static 
+void saveInputFileMetaInfo ( Char *srcName )
+{
+#  if BZ_UNIX
+   IntNative retVal;
+   /* Note use of stat here, not lstat. */
+   retVal = MY_STAT( srcName, &fileMetaInfo );
+   ERROR_IF_NOT_ZERO ( retVal );
+#  endif
+}
+
+
+static 
+void applySavedMetaInfoToOutputFile ( Char *dstName )
+{
+#  if BZ_UNIX
+   IntNative      retVal;
+   struct utimbuf uTimBuf;
+
+   uTimBuf.actime = fileMetaInfo.st_atime;
+   uTimBuf.modtime = fileMetaInfo.st_mtime;
+
+   retVal = chmod ( dstName, fileMetaInfo.st_mode );
+   ERROR_IF_NOT_ZERO ( retVal );
+
+   retVal = utime ( dstName, &uTimBuf );
+   ERROR_IF_NOT_ZERO ( retVal );
+
+   retVal = chown ( dstName, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
+   /* chown() will in many cases return with EPERM, which can
+      be safely ignored.
+   */
+#  endif
+}
+
+
+/*---------------------------------------------*/
+static 
+Bool containsDubiousChars ( Char* name )
+{
+#  if BZ_UNIX
+   /* On unix, files can contain any characters and the file expansion
+    * is performed by the shell.
+    */
+   return False;
+#  else /* ! BZ_UNIX */
+   /* On non-unix (Win* platforms), wildcard characters are not allowed in 
+    * filenames.
+    */
+   for (; *name != '\0'; name++)
+      if (*name == '?' || *name == '*') return True;
+   return False;
+#  endif /* BZ_UNIX */
+}
+
+
+/*---------------------------------------------*/
+#define BZ_N_SUFFIX_PAIRS 4
+
+Char* zSuffix[BZ_N_SUFFIX_PAIRS] 
+   = { ".bz2", ".bz", ".tbz2", ".tbz" };
+Char* unzSuffix[BZ_N_SUFFIX_PAIRS] 
+   = { "", "", ".tar", ".tar" };
+
+static 
+Bool hasSuffix ( Char* s, Char* suffix )
+{
+   Int32 ns = strlen(s);
+   Int32 nx = strlen(suffix);
+   if (ns < nx) return False;
+   if (strcmp(s + ns - nx, suffix) == 0) return True;
+   return False;
+}
+
+static 
+Bool mapSuffix ( Char* name, 
+                 Char* oldSuffix, Char* newSuffix )
+{
+   if (!hasSuffix(name,oldSuffix)) return False;
+   name[strlen(name)-strlen(oldSuffix)] = 0;
+   strcat ( name, newSuffix );
+   return True;
+}
+
+
+/*---------------------------------------------*/
+static 
+void compress ( Char *name )
+{
+   FILE  *inStr;
+   FILE  *outStr;
+   Int32 n, i;
+   struct MY_STAT statBuf;
+
+   deleteOutputOnInterrupt = False;
+
+   if (name == NULL && srcMode != SM_I2O)
+      panic ( "compress: bad modes\n" );
+
+   switch (srcMode) {
+      case SM_I2O: 
+         copyFileName ( inName, "(stdin)" );
+         copyFileName ( outName, "(stdout)" ); 
+         break;
+      case SM_F2F: 
+         copyFileName ( inName, name );
+         copyFileName ( outName, name );
+         strcat ( outName, ".bz2" ); 
+         break;
+      case SM_F2O: 
+         copyFileName ( inName, name );
+         copyFileName ( outName, "(stdout)" ); 
+         break;
+   }
+
+   if ( srcMode != SM_I2O && containsDubiousChars ( inName ) ) {
+      if (noisy)
+      fprintf ( stderr, "%s: There are no files matching `%s'.\n",
+                progName, inName );
+      setExit(1);
+      return;
+   }
+   if ( srcMode != SM_I2O && !fileExists ( inName ) ) {
+      fprintf ( stderr, "%s: Can't open input file %s: %s.\n",
+                progName, inName, strerror(errno) );
+      setExit(1);
+      return;
+   }
+   for (i = 0; i < BZ_N_SUFFIX_PAIRS; i++) {
+      if (hasSuffix(inName, zSuffix[i])) {
+         if (noisy)
+         fprintf ( stderr, 
+                   "%s: Input file %s already has %s suffix.\n",
+                   progName, inName, zSuffix[i] );
+         setExit(1);
+         return;
+      }
+   }
+   if ( srcMode == SM_F2F || srcMode == SM_F2O ) {
+      MY_STAT(inName, &statBuf);
+      if ( MY_S_ISDIR(statBuf.st_mode) ) {
+         fprintf( stderr,
+                  "%s: Input file %s is a directory.\n",
+                  progName,inName);
+         setExit(1);
+         return;
+      }
+   }
+   if ( srcMode == SM_F2F && !forceOverwrite && notAStandardFile ( inName )) {
+      if (noisy)
+      fprintf ( stderr, "%s: Input file %s is not a normal file.\n",
+                progName, inName );
+      setExit(1);
+      return;
+   }
+   if ( srcMode == SM_F2F && fileExists ( outName ) ) {
+      if (forceOverwrite) {
+	 remove(outName);
+      } else {
+	 fprintf ( stderr, "%s: Output file %s already exists.\n",
+		   progName, outName );
+	 setExit(1);
+	 return;
+      }
+   }
+   if ( srcMode == SM_F2F && !forceOverwrite &&
+        (n=countHardLinks ( inName )) > 0) {
+      fprintf ( stderr, "%s: Input file %s has %d other link%s.\n",
+                progName, inName, n, n > 1 ? "s" : "" );
+      setExit(1);
+      return;
+   }
+
+   if ( srcMode == SM_F2F ) {
+      /* Save the file's meta-info before we open it.  Doing it later
+         means we mess up the access times. */
+      saveInputFileMetaInfo ( inName );
+   }
+
+   switch ( srcMode ) {
+
+      case SM_I2O:
+         inStr = stdin;
+         outStr = stdout;
+         if ( isatty ( fileno ( stdout ) ) ) {
+            fprintf ( stderr,
+                      "%s: I won't write compressed data to a terminal.\n",
+                      progName );
+            fprintf ( stderr, "%s: For help, type: `%s --help'.\n",
+                              progName, progName );
+            setExit(1);
+            return;
+         };
+         break;
+
+      case SM_F2O:
+         inStr = fopen ( inName, "rb" );
+         outStr = stdout;
+         if ( isatty ( fileno ( stdout ) ) ) {
+            fprintf ( stderr,
+                      "%s: I won't write compressed data to a terminal.\n",
+                      progName );
+            fprintf ( stderr, "%s: For help, type: `%s --help'.\n",
+                              progName, progName );
+            if ( inStr != NULL ) fclose ( inStr );
+            setExit(1);
+            return;
+         };
+         if ( inStr == NULL ) {
+            fprintf ( stderr, "%s: Can't open input file %s: %s.\n",
+                      progName, inName, strerror(errno) );
+            setExit(1);
+            return;
+         };
+         break;
+
+      case SM_F2F:
+         inStr = fopen ( inName, "rb" );
+         outStr = fopen_output_safely ( outName, "wb" );
+         if ( outStr == NULL) {
+            fprintf ( stderr, "%s: Can't create output file %s: %s.\n",
+                      progName, outName, strerror(errno) );
+            if ( inStr != NULL ) fclose ( inStr );
+            setExit(1);
+            return;
+         }
+         if ( inStr == NULL ) {
+            fprintf ( stderr, "%s: Can't open input file %s: %s.\n",
+                      progName, inName, strerror(errno) );
+            if ( outStr != NULL ) fclose ( outStr );
+            setExit(1);
+            return;
+         };
+         break;
+
+      default:
+         panic ( "compress: bad srcMode" );
+         break;
+   }
+
+   if (verbosity >= 1) {
+      fprintf ( stderr,  "  %s: ", inName );
+      pad ( inName );
+      fflush ( stderr );
+   }
+
+   /*--- Now the input and output handles are sane.  Do the Biz. ---*/
+   outputHandleJustInCase = outStr;
+   deleteOutputOnInterrupt = True;
+   compressStream ( inStr, outStr );
+   outputHandleJustInCase = NULL;
+
+   /*--- If there was an I/O error, we won't get here. ---*/
+   if ( srcMode == SM_F2F ) {
+      applySavedMetaInfoToOutputFile ( outName );
+      deleteOutputOnInterrupt = False;
+      if ( !keepInputFiles ) {
+         IntNative retVal = remove ( inName );
+         ERROR_IF_NOT_ZERO ( retVal );
+      }
+   }
+
+   deleteOutputOnInterrupt = False;
+}
+
+
+/*---------------------------------------------*/
+static 
+void uncompress ( Char *name )
+{
+   FILE  *inStr;
+   FILE  *outStr;
+   Int32 n, i;
+   Bool  magicNumberOK;
+   Bool  cantGuess;
+   struct MY_STAT statBuf;
+
+   deleteOutputOnInterrupt = False;
+
+   if (name == NULL && srcMode != SM_I2O)
+      panic ( "uncompress: bad modes\n" );
+
+   cantGuess = False;
+   switch (srcMode) {
+      case SM_I2O: 
+         copyFileName ( inName, "(stdin)" );
+         copyFileName ( outName, "(stdout)" ); 
+         break;
+      case SM_F2F: 
+         copyFileName ( inName, name );
+         copyFileName ( outName, name );
+         for (i = 0; i < BZ_N_SUFFIX_PAIRS; i++)
+            if (mapSuffix(outName,zSuffix[i],unzSuffix[i]))
+               goto zzz; 
+         cantGuess = True;
+         strcat ( outName, ".out" );
+         break;
+      case SM_F2O: 
+         copyFileName ( inName, name );
+         copyFileName ( outName, "(stdout)" ); 
+         break;
+   }
+
+   zzz:
+   if ( srcMode != SM_I2O && containsDubiousChars ( inName ) ) {
+      if (noisy)
+      fprintf ( stderr, "%s: There are no files matching `%s'.\n",
+                progName, inName );
+      setExit(1);
+      return;
+   }
+   if ( srcMode != SM_I2O && !fileExists ( inName ) ) {
+      fprintf ( stderr, "%s: Can't open input file %s: %s.\n",
+                progName, inName, strerror(errno) );
+      setExit(1);
+      return;
+   }
+   if ( srcMode == SM_F2F || srcMode == SM_F2O ) {
+      MY_STAT(inName, &statBuf);
+      if ( MY_S_ISDIR(statBuf.st_mode) ) {
+         fprintf( stderr,
+                  "%s: Input file %s is a directory.\n",
+                  progName,inName);
+         setExit(1);
+         return;
+      }
+   }
+   if ( srcMode == SM_F2F && !forceOverwrite && notAStandardFile ( inName )) {
+      if (noisy)
+      fprintf ( stderr, "%s: Input file %s is not a normal file.\n",
+                progName, inName );
+      setExit(1);
+      return;
+   }
+   if ( /* srcMode == SM_F2F implied && */ cantGuess ) {
+      if (noisy)
+      fprintf ( stderr, 
+                "%s: Can't guess original name for %s -- using %s\n",
+                progName, inName, outName );
+      /* just a warning, no return */
+   }   
+   if ( srcMode == SM_F2F && fileExists ( outName ) ) {
+      if (forceOverwrite) {
+	remove(outName);
+      } else {
+        fprintf ( stderr, "%s: Output file %s already exists.\n",
+                  progName, outName );
+        setExit(1);
+        return;
+      }
+   }
+   if ( srcMode == SM_F2F && !forceOverwrite &&
+        (n=countHardLinks ( inName ) ) > 0) {
+      fprintf ( stderr, "%s: Input file %s has %d other link%s.\n",
+                progName, inName, n, n > 1 ? "s" : "" );
+      setExit(1);
+      return;
+   }
+
+   if ( srcMode == SM_F2F ) {
+      /* Save the file's meta-info before we open it.  Doing it later
+         means we mess up the access times. */
+      saveInputFileMetaInfo ( inName );
+   }
+
+   switch ( srcMode ) {
+
+      case SM_I2O:
+         inStr = stdin;
+         outStr = stdout;
+         if ( isatty ( fileno ( stdin ) ) ) {
+            fprintf ( stderr,
+                      "%s: I won't read compressed data from a terminal.\n",
+                      progName );
+            fprintf ( stderr, "%s: For help, type: `%s --help'.\n",
+                              progName, progName );
+            setExit(1);
+            return;
+         };
+         break;
+
+      case SM_F2O:
+         inStr = fopen ( inName, "rb" );
+         outStr = stdout;
+         if ( inStr == NULL ) {
+            fprintf ( stderr, "%s: Can't open input file %s:%s.\n",
+                      progName, inName, strerror(errno) );
+            if ( inStr != NULL ) fclose ( inStr );
+            setExit(1);
+            return;
+         };
+         break;
+
+      case SM_F2F:
+         inStr = fopen ( inName, "rb" );
+         outStr = fopen_output_safely ( outName, "wb" );
+         if ( outStr == NULL) {
+            fprintf ( stderr, "%s: Can't create output file %s: %s.\n",
+                      progName, outName, strerror(errno) );
+            if ( inStr != NULL ) fclose ( inStr );
+            setExit(1);
+            return;
+         }
+         if ( inStr == NULL ) {
+            fprintf ( stderr, "%s: Can't open input file %s: %s.\n",
+                      progName, inName, strerror(errno) );
+            if ( outStr != NULL ) fclose ( outStr );
+            setExit(1);
+            return;
+         };
+         break;
+
+      default:
+         panic ( "uncompress: bad srcMode" );
+         break;
+   }
+
+   if (verbosity >= 1) {
+      fprintf ( stderr, "  %s: ", inName );
+      pad ( inName );
+      fflush ( stderr );
+   }
+
+   /*--- Now the input and output handles are sane.  Do the Biz. ---*/
+   outputHandleJustInCase = outStr;
+   deleteOutputOnInterrupt = True;
+   magicNumberOK = uncompressStream ( inStr, outStr );
+   outputHandleJustInCase = NULL;
+
+   /*--- If there was an I/O error, we won't get here. ---*/
+   if ( magicNumberOK ) {
+      if ( srcMode == SM_F2F ) {
+         applySavedMetaInfoToOutputFile ( outName );
+         deleteOutputOnInterrupt = False;
+         if ( !keepInputFiles ) {
+            IntNative retVal = remove ( inName );
+            ERROR_IF_NOT_ZERO ( retVal );
+         }
+      }
+   } else {
+      unzFailsExist = True;
+      deleteOutputOnInterrupt = False;
+      if ( srcMode == SM_F2F ) {
+         IntNative retVal = remove ( outName );
+         ERROR_IF_NOT_ZERO ( retVal );
+      }
+   }
+   deleteOutputOnInterrupt = False;
+
+   if ( magicNumberOK ) {
+      if (verbosity >= 1)
+         fprintf ( stderr, "done\n" );
+   } else {
+      setExit(2);
+      if (verbosity >= 1)
+         fprintf ( stderr, "not a bzip2 file.\n" ); else
+         fprintf ( stderr,
+                   "%s: %s is not a bzip2 file.\n",
+                   progName, inName );
+   }
+
+}
+
+
+/*---------------------------------------------*/
+static 
+void testf ( Char *name )
+{
+   FILE *inStr;
+   Bool allOK;
+   struct MY_STAT statBuf;
+
+   deleteOutputOnInterrupt = False;
+
+   if (name == NULL && srcMode != SM_I2O)
+      panic ( "testf: bad modes\n" );
+
+   copyFileName ( outName, "(none)" );
+   switch (srcMode) {
+      case SM_I2O: copyFileName ( inName, "(stdin)" ); break;
+      case SM_F2F: copyFileName ( inName, name ); break;
+      case SM_F2O: copyFileName ( inName, name ); break;
+   }
+
+   if ( srcMode != SM_I2O && containsDubiousChars ( inName ) ) {
+      if (noisy)
+      fprintf ( stderr, "%s: There are no files matching `%s'.\n",
+                progName, inName );
+      setExit(1);
+      return;
+   }
+   if ( srcMode != SM_I2O && !fileExists ( inName ) ) {
+      fprintf ( stderr, "%s: Can't open input %s: %s.\n",
+                progName, inName, strerror(errno) );
+      setExit(1);
+      return;
+   }
+   if ( srcMode != SM_I2O ) {
+      MY_STAT(inName, &statBuf);
+      if ( MY_S_ISDIR(statBuf.st_mode) ) {
+         fprintf( stderr,
+                  "%s: Input file %s is a directory.\n",
+                  progName,inName);
+         setExit(1);
+         return;
+      }
+   }
+
+   switch ( srcMode ) {
+
+      case SM_I2O:
+         if ( isatty ( fileno ( stdin ) ) ) {
+            fprintf ( stderr,
+                      "%s: I won't read compressed data from a terminal.\n",
+                      progName );
+            fprintf ( stderr, "%s: For help, type: `%s --help'.\n",
+                              progName, progName );
+            setExit(1);
+            return;
+         };
+         inStr = stdin;
+         break;
+
+      case SM_F2O: case SM_F2F:
+         inStr = fopen ( inName, "rb" );
+         if ( inStr == NULL ) {
+            fprintf ( stderr, "%s: Can't open input file %s:%s.\n",
+                      progName, inName, strerror(errno) );
+            setExit(1);
+            return;
+         };
+         break;
+
+      default:
+         panic ( "testf: bad srcMode" );
+         break;
+   }
+
+   if (verbosity >= 1) {
+      fprintf ( stderr, "  %s: ", inName );
+      pad ( inName );
+      fflush ( stderr );
+   }
+
+   /*--- Now the input handle is sane.  Do the Biz. ---*/
+   outputHandleJustInCase = NULL;
+   allOK = testStream ( inStr );
+
+   if (allOK && verbosity >= 1) fprintf ( stderr, "ok\n" );
+   if (!allOK) testFailsExist = True;
+}
+
+
+/*---------------------------------------------*/
+static 
+void license ( void )
+{
+   fprintf ( stderr,
+
+    "bzip2, a block-sorting file compressor.  "
+    "Version %s.\n"
+    "   \n"
+    "   Copyright (C) 1996-2002 by Julian Seward.\n"
+    "   \n"
+    "   This program is free software; you can redistribute it and/or modify\n"
+    "   it under the terms set out in the LICENSE file, which is included\n"
+    "   in the bzip2-1.0 source distribution.\n"
+    "   \n"
+    "   This program is distributed in the hope that it will be useful,\n"
+    "   but WITHOUT ANY WARRANTY; without even the implied warranty of\n"
+    "   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n"
+    "   LICENSE file for more details.\n"
+    "   \n",
+    BZ2_bzlibVersion()
+   );
+}
+
+
+/*---------------------------------------------*/
+static 
+void usage ( Char *fullProgName )
+{
+   fprintf (
+      stderr,
+      "bzip2, a block-sorting file compressor.  "
+      "Version %s.\n"
+      "\n   usage: %s [flags and input files in any order]\n"
+      "\n"
+      "   -h --help           print this message\n"
+      "   -d --decompress     force decompression\n"
+      "   -z --compress       force compression\n"
+      "   -k --keep           keep (don't delete) input files\n"
+      "   -f --force          overwrite existing output files\n"
+      "   -t --test           test compressed file integrity\n"
+      "   -c --stdout         output to standard out\n"
+      "   -q --quiet          suppress noncritical error messages\n"
+      "   -v --verbose        be verbose (a 2nd -v gives more)\n"
+      "   -L --license        display software version & license\n"
+      "   -V --version        display software version & license\n"
+      "   -s --small          use less memory (at most 2500k)\n"
+      "   -1 .. -9            set block size to 100k .. 900k\n"
+      "   --fast              alias for -1\n"
+      "   --best              alias for -9\n"
+      "\n"
+      "   If invoked as `bzip2', default action is to compress.\n"
+      "              as `bunzip2',  default action is to decompress.\n"
+      "              as `bzcat', default action is to decompress to stdout.\n"
+      "\n"
+      "   If no file names are given, bzip2 compresses or decompresses\n"
+      "   from standard input to standard output.  You can combine\n"
+      "   short flags, so `-v -4' means the same as -v4 or -4v, &c.\n"
+#     if BZ_UNIX
+      "\n"
+#     endif
+      ,
+
+      BZ2_bzlibVersion(),
+      fullProgName
+   );
+}
+
+
+/*---------------------------------------------*/
+static 
+void redundant ( Char* flag )
+{
+   fprintf ( 
+      stderr, 
+      "%s: %s is redundant in versions 0.9.5 and above\n",
+      progName, flag );
+}
+
+
+/*---------------------------------------------*/
+/*--
+  All the garbage from here to main() is purely to
+  implement a linked list of command-line arguments,
+  into which main() copies argv[1 .. argc-1].
+
+  The purpose of this exercise is to facilitate 
+  the expansion of wildcard characters * and ? in 
+  filenames for OSs which don't know how to do it
+  themselves, like MSDOS, Windows 95 and NT.
+
+  The actual Dirty Work is done by the platform-
+  specific macro APPEND_FILESPEC.
+--*/
+
+typedef
+   struct zzzz {
+      Char        *name;
+      struct zzzz *link;
+   }
+   Cell;
+
+
+/*---------------------------------------------*/
+static 
+void *myMalloc ( Int32 n )
+{
+   void* p;
+
+   p = malloc ( (size_t)n );
+   if (p == NULL) outOfMemory ();
+   return p;
+}
+
+
+/*---------------------------------------------*/
+static 
+Cell *mkCell ( void )
+{
+   Cell *c;
+
+   c = (Cell*) myMalloc ( sizeof ( Cell ) );
+   c->name = NULL;
+   c->link = NULL;
+   return c;
+}
+
+
+/*---------------------------------------------*/
+static 
+Cell *snocString ( Cell *root, Char *name )
+{
+   if (root == NULL) {
+      Cell *tmp = mkCell();
+      tmp->name = (Char*) myMalloc ( 5 + strlen(name) );
+      strcpy ( tmp->name, name );
+      return tmp;
+   } else {
+      Cell *tmp = root;
+      while (tmp->link != NULL) tmp = tmp->link;
+      tmp->link = snocString ( tmp->link, name );
+      return root;
+   }
+}
+
+
+/*---------------------------------------------*/
+static 
+void addFlagsFromEnvVar ( Cell** argList, Char* varName ) 
+{
+   Int32 i, j, k;
+   Char *envbase, *p;
+
+   envbase = getenv(varName);
+   if (envbase != NULL) {
+      p = envbase;
+      i = 0;
+      while (True) {
+         if (p[i] == 0) break;
+         p += i;
+         i = 0;
+         while (isspace((Int32)(p[0]))) p++;
+         while (p[i] != 0 && !isspace((Int32)(p[i]))) i++;
+         if (i > 0) {
+            k = i; if (k > FILE_NAME_LEN-10) k = FILE_NAME_LEN-10;
+            for (j = 0; j < k; j++) tmpName[j] = p[j];
+            tmpName[k] = 0;
+            APPEND_FLAG(*argList, tmpName);
+         }
+      }
+   }
+}
+
+
+/*---------------------------------------------*/
+#define ISFLAG(s) (strcmp(aa->name, (s))==0)
+
+IntNative main ( IntNative argc, Char *argv[] )
+{
+   Int32  i, j;
+   Char   *tmp;
+   Cell   *argList;
+   Cell   *aa;
+   Bool   decode;
+
+   /*-- Be really really really paranoid :-) --*/
+   if (sizeof(Int32) != 4 || sizeof(UInt32) != 4  ||
+       sizeof(Int16) != 2 || sizeof(UInt16) != 2  ||
+       sizeof(Char)  != 1 || sizeof(UChar)  != 1)
+      configError();
+
+   /*-- Initialise --*/
+   outputHandleJustInCase  = NULL;
+   smallMode               = False;
+   keepInputFiles          = False;
+   forceOverwrite          = False;
+   noisy                   = True;
+   verbosity               = 0;
+   blockSize100k           = 9;
+   testFailsExist          = False;
+   unzFailsExist           = False;
+   numFileNames            = 0;
+   numFilesProcessed       = 0;
+   workFactor              = 30;
+   deleteOutputOnInterrupt = False;
+   exitValue               = 0;
+   i = j = 0; /* avoid bogus warning from egcs-1.1.X */
+
+   /*-- Set up signal handlers for mem access errors --*/
+   signal (SIGSEGV, mySIGSEGVorSIGBUScatcher);
+#  if BZ_UNIX
+#  ifndef __DJGPP__
+   signal (SIGBUS,  mySIGSEGVorSIGBUScatcher);
+#  endif
+#  endif
+
+   copyFileName ( inName,  "(none)" );
+   copyFileName ( outName, "(none)" );
+
+   copyFileName ( progNameReally, argv[0] );
+   progName = &progNameReally[0];
+   for (tmp = &progNameReally[0]; *tmp != '\0'; tmp++)
+      if (*tmp == PATH_SEP) progName = tmp + 1;
+
+
+   /*-- Copy flags from env var BZIP2, and 
+        expand filename wildcards in arg list.
+   --*/
+   argList = NULL;
+   addFlagsFromEnvVar ( &argList,  "BZIP2" );
+   addFlagsFromEnvVar ( &argList,  "BZIP" );
+   for (i = 1; i <= argc-1; i++)
+      APPEND_FILESPEC(argList, argv[i]);
+
+
+   /*-- Find the length of the longest filename --*/
+   longestFileName = 7;
+   numFileNames    = 0;
+   decode          = True;
+   for (aa = argList; aa != NULL; aa = aa->link) {
+      if (ISFLAG("--")) { decode = False; continue; }
+      if (aa->name[0] == '-' && decode) continue;
+      numFileNames++;
+      if (longestFileName < (Int32)strlen(aa->name) )
+         longestFileName = (Int32)strlen(aa->name);
+   }
+
+
+   /*-- Determine source modes; flag handling may change this too. --*/
+   if (numFileNames == 0)
+      srcMode = SM_I2O; else srcMode = SM_F2F;
+
+
+   /*-- Determine what to do (compress/uncompress/test/cat). --*/
+   /*-- Note that subsequent flag handling may change this. --*/
+   opMode = OM_Z;
+
+   if ( (strstr ( progName, "unzip" ) != 0) ||
+        (strstr ( progName, "UNZIP" ) != 0) )
+      opMode = OM_UNZ;
+
+   if ( (strstr ( progName, "z2cat" ) != 0) ||
+        (strstr ( progName, "Z2CAT" ) != 0) ||
+        (strstr ( progName, "zcat" ) != 0)  ||
+        (strstr ( progName, "ZCAT" ) != 0) )  {
+      opMode = OM_UNZ;
+      srcMode = (numFileNames == 0) ? SM_I2O : SM_F2O;
+   }
+
+
+   /*-- Look at the flags. --*/
+   for (aa = argList; aa != NULL; aa = aa->link) {
+      if (ISFLAG("--")) break;
+      if (aa->name[0] == '-' && aa->name[1] != '-') {
+         for (j = 1; aa->name[j] != '\0'; j++) {
+            switch (aa->name[j]) {
+               case 'c': srcMode          = SM_F2O; break;
+               case 'd': opMode           = OM_UNZ; break;
+               case 'z': opMode           = OM_Z; break;
+               case 'f': forceOverwrite   = True; break;
+               case 't': opMode           = OM_TEST; break;
+               case 'k': keepInputFiles   = True; break;
+               case 's': smallMode        = True; break;
+               case 'q': noisy            = False; break;
+               case '1': blockSize100k    = 1; break;
+               case '2': blockSize100k    = 2; break;
+               case '3': blockSize100k    = 3; break;
+               case '4': blockSize100k    = 4; break;
+               case '5': blockSize100k    = 5; break;
+               case '6': blockSize100k    = 6; break;
+               case '7': blockSize100k    = 7; break;
+               case '8': blockSize100k    = 8; break;
+               case '9': blockSize100k    = 9; break;
+               case 'V':
+               case 'L': license();            break;
+               case 'v': verbosity++; break;
+               case 'h': usage ( progName );
+                         exit ( 0 );
+                         break;
+               default:  fprintf ( stderr, "%s: Bad flag `%s'\n",
+                                   progName, aa->name );
+                         usage ( progName );
+                         exit ( 1 );
+                         break;
+            }
+         }
+      }
+   }
+   
+   /*-- And again ... --*/
+   for (aa = argList; aa != NULL; aa = aa->link) {
+      if (ISFLAG("--")) break;
+      if (ISFLAG("--stdout"))            srcMode          = SM_F2O;  else
+      if (ISFLAG("--decompress"))        opMode           = OM_UNZ;  else
+      if (ISFLAG("--compress"))          opMode           = OM_Z;    else
+      if (ISFLAG("--force"))             forceOverwrite   = True;    else
+      if (ISFLAG("--test"))              opMode           = OM_TEST; else
+      if (ISFLAG("--keep"))              keepInputFiles   = True;    else
+      if (ISFLAG("--small"))             smallMode        = True;    else
+      if (ISFLAG("--quiet"))             noisy            = False;   else
+      if (ISFLAG("--version"))           license();                  else
+      if (ISFLAG("--license"))           license();                  else
+      if (ISFLAG("--exponential"))       workFactor = 1;             else 
+      if (ISFLAG("--repetitive-best"))   redundant(aa->name);        else
+      if (ISFLAG("--repetitive-fast"))   redundant(aa->name);        else
+      if (ISFLAG("--fast"))              blockSize100k = 1;          else
+      if (ISFLAG("--best"))              blockSize100k = 9;          else
+      if (ISFLAG("--verbose"))           verbosity++;                else
+      if (ISFLAG("--help"))              { usage ( progName ); exit ( 0 ); }
+         else
+         if (strncmp ( aa->name, "--", 2) == 0) {
+            fprintf ( stderr, "%s: Bad flag `%s'\n", progName, aa->name );
+            usage ( progName );
+            exit ( 1 );
+         }
+   }
+
+   if (verbosity > 4) verbosity = 4;
+   if (opMode == OM_Z && smallMode && blockSize100k > 2) 
+      blockSize100k = 2;
+
+   if (opMode == OM_TEST && srcMode == SM_F2O) {
+      fprintf ( stderr, "%s: -c and -t cannot be used together.\n",
+                progName );
+      exit ( 1 );
+   }
+
+   if (srcMode == SM_F2O && numFileNames == 0)
+      srcMode = SM_I2O;
+
+   if (opMode != OM_Z) blockSize100k = 0;
+
+   if (srcMode == SM_F2F) {
+      signal (SIGINT,  mySignalCatcher);
+      signal (SIGTERM, mySignalCatcher);
+#     if BZ_UNIX
+      signal (SIGHUP,  mySignalCatcher);
+#     endif
+   }
+
+   if (opMode == OM_Z) {
+     if (srcMode == SM_I2O) {
+        compress ( NULL );
+     } else {
+        decode = True;
+        for (aa = argList; aa != NULL; aa = aa->link) {
+           if (ISFLAG("--")) { decode = False; continue; }
+           if (aa->name[0] == '-' && decode) continue;
+           numFilesProcessed++;
+           compress ( aa->name );
+        }
+     }
+   } 
+   else
+
+   if (opMode == OM_UNZ) {
+      unzFailsExist = False;
+      if (srcMode == SM_I2O) {
+         uncompress ( NULL );
+      } else {
+         decode = True;
+         for (aa = argList; aa != NULL; aa = aa->link) {
+            if (ISFLAG("--")) { decode = False; continue; }
+            if (aa->name[0] == '-' && decode) continue;
+            numFilesProcessed++;
+            uncompress ( aa->name );
+         }      
+      }
+      if (unzFailsExist) { 
+         setExit(2); 
+         exit(exitValue);
+      }
+   } 
+
+   else {
+      testFailsExist = False;
+      if (srcMode == SM_I2O) {
+         testf ( NULL );
+      } else {
+         decode = True;
+         for (aa = argList; aa != NULL; aa = aa->link) {
+	    if (ISFLAG("--")) { decode = False; continue; }
+            if (aa->name[0] == '-' && decode) continue;
+            numFilesProcessed++;
+            testf ( aa->name );
+	 }
+      }
+      if (testFailsExist && noisy) {
+         fprintf ( stderr,
+           "\n"
+           "You can use the `bzip2recover' program to attempt to recover\n"
+           "data from undamaged sections of corrupted files.\n\n"
+         );
+         setExit(2);
+         exit(exitValue);
+      }
+   }
+
+   /* Free the argument list memory to mollify leak detectors 
+      (eg) Purify, Checker.  Serves no other useful purpose.
+   */
+   aa = argList;
+   while (aa != NULL) {
+      Cell* aa2 = aa->link;
+      if (aa->name != NULL) free(aa->name);
+      free(aa);
+      aa = aa2;
+   }
+
+   return exitValue;
+}
+
+
+/*-----------------------------------------------------------*/
+/*--- end                                         bzip2.c ---*/
+/*-----------------------------------------------------------*/
diff --git a/Examples/gcc/test_files/gzip.c b/Examples/gcc/test_files/gzip.c
new file mode 100644
index 00000000..47ec39ef
--- /dev/null
+++ b/Examples/gcc/test_files/gzip.c
@@ -0,0 +1,8607 @@
+#include <ctype.h>
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <malloc.h>
+#include <memory.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/dir.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <time.h>
+#include <unistd.h>
+#include <utime.h>
+
+#define HAVE_CONFIG_H 1
+
+/* config.h.  Generated by configure.  */
+/* config.h.in.  Generated from configure.in by autoheader.  */
+
+/* Define if an assembler version of longest_match is available. */
+/* #undef ASMV */
+
+/* Define to 1 if you have the <dirent.h> header file, and it defines `DIR'.
+   */
+#define HAVE_DIRENT_H 1
+
+/* Define to 1 if you have the <fcntl.h> header file. */
+#define HAVE_FCNTL_H 1
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#define HAVE_INTTYPES_H 1
+
+/* Define to 1 if you have the <limits.h> header file. */
+#define HAVE_LIMITS_H 1
+
+/* Define to 1 if you have the `lstat' function. */
+#define HAVE_LSTAT 1
+
+/* Define to 1 if you have the <memory.h> header file. */
+#define HAVE_MEMORY_H 1
+
+/* Define to 1 if you have the <ndir.h> header file, and it defines `DIR'. */
+/* #undef HAVE_NDIR_H */
+
+/* Define to 1 if you have the `rpmatch' function. */
+/* #undef HAVE_RPMATCH */
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#define HAVE_STDINT_H 1
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#define HAVE_STDLIB_H 1
+
+/* Define to 1 if you have the <strings.h> header file. */
+#define HAVE_STRINGS_H 1
+
+/* Define to 1 if you have the <string.h> header file. */
+#define HAVE_STRING_H 1
+
+/* Define to 1 if you have the <sys/dir.h> header file, and it defines `DIR'.
+   */
+/* #undef HAVE_SYS_DIR_H */
+
+/* Define to 1 if you have the <sys/ndir.h> header file, and it defines `DIR'.
+   */
+/* #undef HAVE_SYS_NDIR_H */
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#define HAVE_SYS_STAT_H 1
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#define HAVE_SYS_TYPES_H 1
+
+/* Define to 1 if you have the <sys/utime.h> header file. */
+/* #undef HAVE_SYS_UTIME_H */
+
+/* Define to 1 if you have the <time.h> header file. */
+#define HAVE_TIME_H 1
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#define HAVE_UNISTD_H 1
+
+/* Define to 1 if you have the `utime' function. */
+#define HAVE_UTIME 1
+
+/* Define to 1 if you have the <utime.h> header file. */
+#define HAVE_UTIME_H 1
+
+/* Name of package */
+#define PACKAGE "gzip"
+
+/* Define to the address where bug reports for this package should be sent. */
+#define PACKAGE_BUGREPORT "bug-gzip@gnu.org"
+
+/* Define to the full name of this package. */
+#define PACKAGE_NAME "gzip"
+
+/* Define to the full name and version of this package. */
+#define PACKAGE_STRING "gzip 1.3.5"
+
+/* Define to the one symbol short name of this package. */
+#define PACKAGE_TARNAME "gzip"
+
+/* Define to the version of this package. */
+#define PACKAGE_VERSION "1.3.5"
+
+/* Define as the return type of signal handlers (`int' or `void'). */
+#define RETSIGTYPE void
+
+/* Define to 1 if you have the ANSI C header files. */
+#define STDC_HEADERS 1
+
+/* Version number of package */
+#define VERSION "1.3.5"
+
+/* Define to 1 if on AIX 3.
+   System headers sometimes define this.
+   We just want to avoid a redefinition error message.  */
+#ifndef _ALL_SOURCE
+/* # undef _ALL_SOURCE */
+#endif
+
+/* Number of bits in a file offset, on hosts where this is settable. */
+#define _FILE_OFFSET_BITS 64
+
+/* Enable GNU extensions on systems that have them.  */
+#ifndef _GNU_SOURCE
+# define _GNU_SOURCE 1
+#endif
+
+/* Define for large files, on AIX-style hosts. */
+/* #undef _LARGE_FILES */
+
+/* Define to 1 if on MINIX. */
+/* #undef _MINIX */
+
+/* Define to 2 if the system does not provide POSIX.1 features except with
+   this defined. */
+/* #undef _POSIX_1_SOURCE */
+
+/* Define to 1 if you need to in order for `stat' and other things to work. */
+/* #undef _POSIX_SOURCE */
+
+/* Define to empty if `const' does not conform to ANSI C. */
+/* #undef const */
+
+/* Define to `long' if <sys/types.h> does not define. */
+/* #undef off_t */
+
+/* Define to `unsigned' if <sys/types.h> does not define. */
+/* #undef size_t */
+
+
+/* bits.c -- output variable-length bit strings
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+
+/*
+ *  PURPOSE
+ *
+ *      Output variable-length bit strings. Compression can be done
+ *      to a file or to memory. (The latter is not supported in this version.)
+ *
+ *  DISCUSSION
+ *
+ *      The PKZIP "deflate" file format interprets compressed file data
+ *      as a sequence of bits.  Multi-bit strings in the file may cross
+ *      byte boundaries without restriction.
+ *
+ *      The first bit of each byte is the low-order bit.
+ *
+ *      The routines in this file allow a variable-length bit value to
+ *      be output right-to-left (useful for literal values). For
+ *      left-to-right output (useful for code strings from the tree routines),
+ *      the bits must have been reversed first with bi_reverse().
+ *
+ *      For in-memory compression, the compressed bit stream goes directly
+ *      into the requested output buffer. The input data is read in blocks
+ *      by the mem_read() function. The buffer is limited to 64K on 16 bit
+ *      machines.
+ *
+ *  INTERFACE
+ *
+ *      void bi_init (FILE *zipfile)
+ *          Initialize the bit string routines.
+ *
+ *      void send_bits (int value, int length)
+ *          Write out a bit string, taking the source bits right to
+ *          left.
+ *
+ *      int bi_reverse (int value, int length)
+ *          Reverse the bits of a bit string, taking the source bits left to
+ *          right and emitting them right to left.
+ *
+ *      void bi_windup (void)
+ *          Write out any remaining bits in an incomplete byte.
+ *
+ *      void copy_block(char *buf, unsigned len, int header)
+ *          Copy a stored block to the zip file, storing first the length and
+ *          its one's complement if requested.
+ *
+ */
+
+/* tailor.h -- target dependent definitions
+ * Copyright (C) 1992-1993 Jean-loup Gailly.
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+/* The target dependent definitions should be defined here only.
+ * The target dependent functions should be defined in tailor.c.
+ */
+
+/* $Id: tailor.h,v 0.18 1993/06/14 19:32:20 jloup Exp $ */
+
+#if defined(__MSDOS__) && !defined(MSDOS)
+#  define MSDOS
+#endif
+
+#if defined(__OS2__) && !defined(OS2)
+#  define OS2
+#endif
+
+#if defined(OS2) && defined(MSDOS) /* MS C under OS/2 */
+#  undef MSDOS
+#endif
+
+#if defined(ATARI) || defined(atarist)
+#  ifndef STDC_HEADERS
+#    define STDC_HEADERS
+#    define HAVE_UNISTD_H
+#    define HAVE_DIRENT_H
+#  endif
+#  define ASMV
+#  define OS_CODE  0x05
+#  ifdef TOSFS
+#    define PATH_SEP2 '\\'
+#    define PATH_SEP3 ':'
+#    define MAX_PATH_LEN  128
+#    define NO_MULTIPLE_DOTS
+#    define MAX_EXT_CHARS 3
+#    define Z_SUFFIX "z"
+#    define casemap(c) tolow(c) /* Force file names to lower case */
+#  endif
+#endif
+
+#ifdef MACOS
+#  define PATH_SEP ':'
+#  define DYN_ALLOC
+#  define PROTO
+#  define NO_STDIN_FSTAT
+#  define chmod(file, mode) (0)
+#  define OPEN(name, flags, mode) open(name, flags)
+#  define OS_CODE  0x07
+#  ifdef MPW
+#    define isatty(fd) ((fd) <= 2)
+#  endif
+#endif
+
+#ifdef __50SERIES /* Prime/PRIMOS */
+#  define PATH_SEP '>'
+#  define STDC_HEADERS
+#  define NO_STDIN_FSTAT 
+#  define NO_SIZE_CHECK 
+#  define RECORD_IO  1
+#  define casemap(c)  tolow(c) /* Force file names to lower case */
+#  define put_char(c) put_byte((c) & 0x7F)
+#  define get_char(c) ascii2pascii(get_byte())
+#  define OS_CODE  0x0F    /* temporary, subject to change */
+#  ifdef SIGTERM
+#    undef SIGTERM         /* We don't want a signal handler for SIGTERM */
+#  endif
+#endif
+
+#if defined(pyr) && !defined(NOMEMCPY) /* Pyramid */
+#  define NOMEMCPY /* problem with overlapping copies */
+#endif
+
+#ifdef TOPS20
+#  define OS_CODE  0x0a
+#endif
+
+#ifndef unix
+#  define NO_ST_INO /* don't rely on inode numbers */
+#endif
+
+
+	/* Common defaults */
+
+#ifndef OS_CODE
+#  define OS_CODE  0x03  /* assume Unix */
+#endif
+
+#ifndef PATH_SEP
+#  define PATH_SEP '/'
+#endif
+
+#ifndef casemap
+#  define casemap(c) (c)
+#endif
+
+#ifndef OPTIONS_VAR
+#  define OPTIONS_VAR "GZIP"
+#endif
+
+#ifndef Z_SUFFIX
+#  define Z_SUFFIX ".gz"
+#endif
+
+#ifdef MAX_EXT_CHARS
+#  define MAX_SUFFIX  MAX_EXT_CHARS
+#else
+#  define MAX_SUFFIX  30
+#endif
+
+#ifndef MAKE_LEGAL_NAME
+#  ifdef NO_MULTIPLE_DOTS
+#    define MAKE_LEGAL_NAME(name)   make_simple_name(name)
+#  else
+#    define MAKE_LEGAL_NAME(name)
+#  endif
+#endif
+
+#ifndef MIN_PART
+#  define MIN_PART 3
+   /* keep at least MIN_PART chars between dots in a file name. */
+#endif
+
+#ifndef EXPAND
+#  define EXPAND(argc,argv)
+#endif
+
+#ifndef RECORD_IO
+#  define RECORD_IO 0
+#endif
+
+#ifndef SET_BINARY_MODE
+#  define SET_BINARY_MODE(fd)
+#endif
+
+#ifndef OPEN
+#  define OPEN(name, flags, mode) open(name, flags, mode)
+#endif
+
+#ifndef get_char
+#  define get_char() get_byte()
+#endif
+
+#ifndef put_char
+#  define put_char(c) put_byte(c)
+#endif
+
+
+/* gzip.h -- common declarations for all gzip modules
+ * Copyright (C) 1997, 1998, 1999, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1992-1993 Jean-loup Gailly.
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+#if defined(__STDC__) || defined(PROTO)
+#  define OF(args)  args
+#else
+#  define OF(args)  ()
+#endif
+
+#ifdef __STDC__
+   typedef void *voidp;
+#else
+   typedef char *voidp;
+#endif
+
+#  define memzero(s, n)     memset ((voidp)(s), 0, (n))
+
+#ifndef RETSIGTYPE
+#  define RETSIGTYPE void
+#endif
+
+#define local static
+
+typedef unsigned char  uch;
+typedef unsigned short ush;
+typedef unsigned long  ulg;
+
+/* Return codes from gzip */
+#define OK      0
+#define ERROR   1
+#define WARNING 2
+
+/* Compression methods (see algorithm.doc) */
+#define STORED      0
+#define COMPRESSED  1
+#define PACKED      2
+#define LZHED       3
+/* methods 4 to 7 reserved */
+#define DEFLATED    8
+#define MAX_METHODS 9
+extern int method;         /* compression method */
+
+/* To save memory for 16 bit systems, some arrays are overlaid between
+ * the various modules:
+ * deflate:  prev+head   window      d_buf  l_buf  outbuf
+ * unlzw:    tab_prefix  tab_suffix  stack  inbuf  outbuf
+ * inflate:              window             inbuf
+ * unpack:               window             inbuf  prefix_len
+ * unlzh:    left+right  window      c_table inbuf c_len
+ * For compression, input is done in window[]. For decompression, output
+ * is done in window except for unlzw.
+ */
+
+#ifndef	INBUFSIZ
+#  ifdef SMALL_MEM
+#    define INBUFSIZ  0x2000  /* input buffer size */
+#  else
+#    define INBUFSIZ  0x8000  /* input buffer size */
+#  endif
+#endif
+#define INBUF_EXTRA  64     /* required by unlzw() */
+
+#ifndef	OUTBUFSIZ
+#  ifdef SMALL_MEM
+#    define OUTBUFSIZ   8192  /* output buffer size */
+#  else
+#    define OUTBUFSIZ  16384  /* output buffer size */
+#  endif
+#endif
+#define OUTBUF_EXTRA 2048   /* required by unlzw() */
+
+#ifndef DIST_BUFSIZE
+#  ifdef SMALL_MEM
+#    define DIST_BUFSIZE 0x2000 /* buffer for distances, see trees.c */
+#  else
+#    define DIST_BUFSIZE 0x8000 /* buffer for distances, see trees.c */
+#  endif
+#endif
+
+#define near
+
+#ifdef DYN_ALLOC
+#  define EXTERN(type, array)  extern type * near array
+#  define DECLARE(type, array, size)  type * near array
+#  define ALLOC(type, array, size) { \
+      array = (type*)fcalloc((size_t)(((size)+1L)/2), 2*sizeof(type)); \
+      if (array == NULL) error("insufficient memory"); \
+   }
+#  define FREE(array) {if (array != NULL) fcfree(array), array=NULL;}
+#else
+#  define EXTERN(type, array)  extern type array[]
+#  define DECLARE(type, array, size)  type array[size]
+#  define ALLOC(type, array, size)
+#  define FREE(array)
+#endif
+
+EXTERN(uch, inbuf);          /* input buffer */
+EXTERN(uch, outbuf);         /* output buffer */
+EXTERN(ush, d_buf);          /* buffer for distances, see trees.c */
+EXTERN(uch, window);         /* Sliding window and suffix table (unlzw) */
+#define tab_suffix window
+#ifndef MAXSEG_64K
+#  define tab_prefix prev    /* hash link (see deflate.c) */
+#  define head (prev+WSIZE)  /* hash head (see deflate.c) */
+   EXTERN(ush, tab_prefix);  /* prefix code (see unlzw.c) */
+#else
+#  define tab_prefix0 prev
+#  define head tab_prefix1
+   EXTERN(ush, tab_prefix0); /* prefix for even codes */
+   EXTERN(ush, tab_prefix1); /* prefix for odd  codes */
+#endif
+
+extern unsigned insize; /* valid bytes in inbuf */
+extern unsigned inptr;  /* index of next byte to be processed in inbuf */
+extern unsigned outcnt; /* bytes in output buffer */
+extern int rsync;  /* deflate into rsyncable chunks */
+
+extern off_t bytes_in;   /* number of input bytes */
+extern off_t bytes_out;  /* number of output bytes */
+extern off_t header_bytes;/* number of bytes in gzip header */
+
+extern int  ifd;        /* input file descriptor */
+extern int  ofd;        /* output file descriptor */
+extern char ifname[];   /* input file name or "stdin" */
+extern char ofname[];   /* output file name or "stdout" */
+extern char *progname;  /* program name */
+
+extern time_t time_stamp; /* original time stamp (modification time) */
+extern off_t ifile_size; /* input file size, -1 for devices (debug only) */
+
+typedef int file_t;     /* Do not use stdio */
+#define NO_FILE  (-1)   /* in memory compression */
+
+
+#define	PACK_MAGIC     "\037\036" /* Magic header for packed files */
+#define	GZIP_MAGIC     "\037\213" /* Magic header for gzip files, 1F 8B */
+#define	OLD_GZIP_MAGIC "\037\236" /* Magic header for gzip 0.5 = freeze 1.x */
+#define	LZH_MAGIC      "\037\240" /* Magic header for SCO LZH Compress files*/
+#define PKZIP_MAGIC    "\120\113\003\004" /* Magic header for pkzip files */
+
+/* gzip flag byte */
+#define ASCII_FLAG   0x01 /* bit 0 set: file probably ascii text */
+#define CONTINUATION 0x02 /* bit 1 set: continuation of multi-part gzip file */
+#define EXTRA_FIELD  0x04 /* bit 2 set: extra field present */
+#define ORIG_NAME    0x08 /* bit 3 set: original file name present */
+#define COMMENT      0x10 /* bit 4 set: file comment present */
+#define ENCRYPTED    0x20 /* bit 5 set: file is encrypted */
+#define RESERVED     0xC0 /* bit 6,7:   reserved */
+
+/* internal file attribute */
+#define UNKNOWN 0xffff
+#define BINARY  0
+#define ASCII   1
+
+#ifndef WSIZE
+#  define WSIZE 0x8000     /* window size--must be a power of two, and */
+#endif                     /*  at least 32K for zip's deflate method */
+
+#define MIN_MATCH  3
+#define MAX_MATCH  258
+/* The minimum and maximum match lengths */
+
+#define MIN_LOOKAHEAD (MAX_MATCH+MIN_MATCH+1)
+/* Minimum amount of lookahead, except at the end of the input file.
+ * See deflate.c for comments about the MIN_MATCH+1.
+ */
+
+#define MAX_DIST  (WSIZE-MIN_LOOKAHEAD)
+/* In order to simplify the code, particularly on 16 bit machines, match
+ * distances are limited to MAX_DIST instead of WSIZE.
+ */
+
+extern int decrypt;        /* flag to turn on decryption */
+extern int exit_code;      /* program exit code */
+extern int verbose;        /* be verbose (-v) */
+extern int quiet;          /* be quiet (-q) */
+extern int level;          /* compression level */
+extern int test;           /* check .z file integrity */
+extern int to_stdout;      /* output to stdout (-c) */
+extern int save_orig_name; /* set if original name must be saved */
+
+#define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(0))
+#define try_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(1))
+
+/* put_byte is used for the compressed output, put_ubyte for the
+ * uncompressed output. However unlzw() uses window for its
+ * suffix table instead of its output buffer, so it does not use put_ubyte
+ * (to be cleaned up).
+ */
+#define put_byte(c) {outbuf[outcnt++]=(uch)(c); if (outcnt==OUTBUFSIZ)\
+   flush_outbuf();}
+#define put_ubyte(c) {window[outcnt++]=(uch)(c); if (outcnt==WSIZE)\
+   flush_window();}
+
+/* Output a 16 bit value, lsb first */
+#define put_short(w) \
+{ if (outcnt < OUTBUFSIZ-2) { \
+    outbuf[outcnt++] = (uch) ((w) & 0xff); \
+    outbuf[outcnt++] = (uch) ((ush)(w) >> 8); \
+  } else { \
+    put_byte((uch)((w) & 0xff)); \
+    put_byte((uch)((ush)(w) >> 8)); \
+  } \
+}
+
+/* Output a 32 bit value to the bit stream, lsb first */
+#define put_long(n) { \
+    put_short((n) & 0xffff); \
+    put_short(((ulg)(n)) >> 16); \
+}
+
+#define seekable()    0  /* force sequential output */
+#define translate_eol 0  /* no option -a yet */
+
+#define tolow(c)  (isupper (c) ? tolower (c) : (c))  /* force to lower case */
+
+/* Macros for getting two-byte and four-byte header values */
+#define SH(p) ((ush)(uch)((p)[0]) | ((ush)(uch)((p)[1]) << 8))
+#define LG(p) ((ulg)(SH(p)) | ((ulg)(SH((p)+2)) << 16))
+
+/* Diagnostic functions */
+#ifdef DEBUG
+#  define Assert(cond,msg) {if(!(cond)) error(msg);}
+#  define Trace(x) fprintf x
+#  define Tracev(x) {if (verbose) fprintf x ;}
+#  define Tracevv(x) {if (verbose>1) fprintf x ;}
+#  define Tracec(c,x) {if (verbose && (c)) fprintf x ;}
+#  define Tracecv(c,x) {if (verbose>1 && (c)) fprintf x ;}
+#else
+#  define Assert(cond,msg)
+#  define Trace(x)
+#  define Tracev(x)
+#  define Tracevv(x)
+#  define Tracec(c,x)
+#  define Tracecv(c,x)
+#endif
+
+#define WARN(msg) {if (!quiet) fprintf msg ; \
+		   if (exit_code == OK) exit_code = WARNING;}
+
+	/* in zip.c: */
+extern int zip        OF((int in, int out));
+extern int file_read  OF((char *buf,  unsigned size));
+
+	/* in unzip.c */
+extern int unzip      OF((int in, int out));
+extern int check_zipfile OF((int in));
+
+	/* in unpack.c */
+extern int unpack     OF((int in, int out));
+
+	/* in unlzh.c */
+extern int unlzh      OF((int in, int out));
+
+	/* in gzip.c */
+RETSIGTYPE abort_gzip_signal OF((void));
+
+        /* in deflate.c */
+void lm_init OF((int pack_level, ush *flags));
+off_t deflate OF((void));
+
+        /* in trees.c */
+void ct_init     OF((ush *attr, int *method));
+int  ct_tally    OF((int dist, int lc));
+off_t flush_block OF((char *buf, ulg stored_len, int pad, int eof));
+
+        /* in bits.c */
+void     bi_init    OF((file_t zipfile));
+void     send_bits  OF((int value, int length));
+unsigned bi_reverse OF((unsigned value, int length));
+void     bi_windup  OF((void));
+void     copy_block OF((char *buf, unsigned len, int header));
+extern   int (*read_buf) OF((char *buf, unsigned size));
+
+	/* in util.c: */
+extern int copy           OF((int in, int out));
+extern ulg  updcrc        OF((uch *s, unsigned n));
+extern void clear_bufs    OF((void));
+extern int  fill_inbuf    OF((int eof_ok));
+extern void flush_outbuf  OF((void));
+extern void flush_window  OF((void));
+extern void write_buf     OF((int fd, voidp buf, unsigned cnt));
+extern char *strlwr       OF((char *s));
+extern char *base_name    OF((char *fname));
+extern int xunlink        OF((char *fname));
+extern void make_simple_name OF((char *name));
+extern char *add_envopt   OF((int *argcp, char ***argvp, char *env));
+extern void error         OF((char *m));
+extern void warning       OF((char *m));
+extern void read_error    OF((void));
+extern void write_error   OF((void));
+extern void display_ratio OF((off_t num, off_t den, FILE *file));
+extern void fprint_off    OF((FILE *, off_t, int));
+extern voidp xmalloc      OF((unsigned int size));
+
+	/* in inflate.c */
+extern int inflate OF((void));
+
+	/* in yesno.c */
+extern int yesno OF((void));
+
+
+/* crypt.h (dummy version) -- do not perform encryption
+ * Hardly worth copyrighting :-)
+ */
+
+#ifdef CRYPT
+#  undef CRYPT      /* dummy version */
+#endif
+
+#define RAND_HEAD_LEN  12  /* length of encryption random header */
+
+#define zencode
+#define zdecode
+
+
+#ifdef RCSID
+static char rcsid[] = "$Id: bits.c,v 0.9 1993/06/11 10:16:58 jloup Exp $";
+#endif
+
+/* ===========================================================================
+ * Local data used by the "bit string" routines.
+ */
+
+local file_t zfile; /* output gzip file */
+
+local unsigned short bi_buf;
+/* Output buffer. bits are inserted starting at the bottom (least significant
+ * bits).
+ */
+
+#define Buf_size (8 * 2*sizeof(char))
+/* Number of bits used within bi_buf. (bi_buf might be implemented on
+ * more than 16 bits on some systems.)
+ */
+
+local int bi_valid;
+/* Number of valid bits in bi_buf.  All bits above the last valid bit
+ * are always zero.
+ */
+
+int (*read_buf) OF((char *buf, unsigned size));
+/* Current input function. Set to mem_read for in-memory compression */
+
+#ifdef DEBUG
+  off_t bits_sent;   /* bit length of the compressed data */
+#endif
+
+/* ===========================================================================
+ * Initialize the bit string routines.
+ */
+void bi_init (zipfile)
+    file_t zipfile; /* output zip file, NO_FILE for in-memory compression */
+{
+    zfile  = zipfile;
+    bi_buf = 0;
+    bi_valid = 0;
+#ifdef DEBUG
+    bits_sent = 0L;
+#endif
+
+    /* Set the defaults for file compression. They are set by memcompress
+     * for in-memory compression.
+     */
+    if (zfile != NO_FILE) {
+	read_buf  = file_read;
+    }
+}
+
+/* ===========================================================================
+ * Send a value on a given number of bits.
+ * IN assertion: length <= 16 and value fits in length bits.
+ */
+void send_bits(value, length)
+    int value;  /* value to send */
+    int length; /* number of bits */
+{
+#ifdef DEBUG
+    Tracev((stderr," l %2d v %4x ", length, value));
+    Assert(length > 0 && length <= 15, "invalid length");
+    bits_sent += (off_t)length;
+#endif
+    /* If not enough room in bi_buf, use (valid) bits from bi_buf and
+     * (16 - bi_valid) bits from value, leaving (width - (16-bi_valid))
+     * unused bits in value.
+     */
+    if (bi_valid > (int)Buf_size - length) {
+        bi_buf |= (value << bi_valid);
+        put_short(bi_buf);
+        bi_buf = (ush)value >> (Buf_size - bi_valid);
+        bi_valid += length - Buf_size;
+    } else {
+        bi_buf |= value << bi_valid;
+        bi_valid += length;
+    }
+}
+
+/* ===========================================================================
+ * Reverse the first len bits of a code, using straightforward code (a faster
+ * method would use a table)
+ * IN assertion: 1 <= len <= 15
+ */
+unsigned bi_reverse(code, len)
+    unsigned code; /* the value to invert */
+    int len;       /* its bit length */
+{
+    register unsigned res = 0;
+    do {
+        res |= code & 1;
+        code >>= 1, res <<= 1;
+    } while (--len > 0);
+    return res >> 1;
+}
+
+/* ===========================================================================
+ * Write out any remaining bits in an incomplete byte.
+ */
+void bi_windup()
+{
+    if (bi_valid > 8) {
+        put_short(bi_buf);
+    } else if (bi_valid > 0) {
+        put_byte(bi_buf);
+    }
+    bi_buf = 0;
+    bi_valid = 0;
+#ifdef DEBUG
+    bits_sent = (bits_sent+7) & ~7;
+#endif
+}
+
+/* ===========================================================================
+ * Copy a stored block to the zip file, storing first the length and its
+ * one's complement if requested.
+ */
+void copy_block(buf, len, header)
+    char     *buf;    /* the input data */
+    unsigned len;     /* its length */
+    int      header;  /* true if block header must be written */
+{
+    bi_windup();              /* align on byte boundary */
+
+    if (header) {
+        put_short((ush)len);   
+        put_short((ush)~len);
+#ifdef DEBUG
+        bits_sent += 2*16;
+#endif
+    }
+#ifdef DEBUG
+    bits_sent += (off_t)len<<3;
+#endif
+    while (len--) {
+#ifdef CRYPT
+        int t;
+	if (key) zencode(*buf, t);
+#endif
+	put_byte(*buf++);
+    }
+}
+/* crypt.c (dummy version) -- do not perform encryption
+ * Hardly worth copyrighting :-)
+ */
+#ifdef RCSID
+static char rcsid[] = "$Id: crypt.c,v 0.6 1993/03/22 09:48:47 jloup Exp $";
+#endif
+/* deflate.c -- compress data using the deflation algorithm
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+/*
+ *  PURPOSE
+ *
+ *      Identify new text as repetitions of old text within a fixed-
+ *      length sliding window trailing behind the new text.
+ *
+ *  DISCUSSION
+ *
+ *      The "deflation" process depends on being able to identify portions
+ *      of the input text which are identical to earlier input (within a
+ *      sliding window trailing behind the input currently being processed).
+ *
+ *      The most straightforward technique turns out to be the fastest for
+ *      most input files: try all possible matches and select the longest.
+ *      The key feature of this algorithm is that insertions into the string
+ *      dictionary are very simple and thus fast, and deletions are avoided
+ *      completely. Insertions are performed at each input character, whereas
+ *      string matches are performed only when the previous match ends. So it
+ *      is preferable to spend more time in matches to allow very fast string
+ *      insertions and avoid deletions. The matching algorithm for small
+ *      strings is inspired from that of Rabin & Karp. A brute force approach
+ *      is used to find longer strings when a small match has been found.
+ *      A similar algorithm is used in comic (by Jan-Mark Wams) and freeze
+ *      (by Leonid Broukhis).
+ *         A previous version of this file used a more sophisticated algorithm
+ *      (by Fiala and Greene) which is guaranteed to run in linear amortized
+ *      time, but has a larger average cost, uses more memory and is patented.
+ *      However the F&G algorithm may be faster for some highly redundant
+ *      files if the parameter max_chain_length (described below) is too large.
+ *
+ *  ACKNOWLEDGEMENTS
+ *
+ *      The idea of lazy evaluation of matches is due to Jan-Mark Wams, and
+ *      I found it in 'freeze' written by Leonid Broukhis.
+ *      Thanks to many info-zippers for bug reports and testing.
+ *
+ *  REFERENCES
+ *
+ *      APPNOTE.TXT documentation file in PKZIP 1.93a distribution.
+ *
+ *      A description of the Rabin and Karp algorithm is given in the book
+ *         "Algorithms" by R. Sedgewick, Addison-Wesley, p252.
+ *
+ *      Fiala,E.R., and Greene,D.H.
+ *         Data Compression with Finite Windows, Comm.ACM, 32,4 (1989) 490-595
+ *
+ *  INTERFACE
+ *
+ *      void lm_init (int pack_level, ush *flags)
+ *          Initialize the "longest match" routines for a new file
+ *
+ *      off_t deflate (void)
+ *          Processes a new input file and return its compressed length. Sets
+ *          the compressed length, crc, deflate flags and internal file
+ *          attributes.
+ */
+
+
+/* lzw.h -- define the lzw functions.
+ * Copyright (C) 1992-1993 Jean-loup Gailly.
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+#ifndef BITS
+#  define BITS 16
+#endif
+#define INIT_BITS 9              /* Initial number of bits per code */
+
+#define	LZW_MAGIC  "\037\235"   /* Magic header for lzw files, 1F 9D */
+
+#define BIT_MASK    0x1f /* Mask for 'number of compression bits' */
+/* Mask 0x20 is reserved to mean a fourth header byte, and 0x40 is free.
+ * It's a pity that old uncompress does not check bit 0x20. That makes
+ * extension of the format actually undesirable because old compress
+ * would just crash on the new format instead of giving a meaningful
+ * error message. It does check the number of bits, but it's more
+ * helpful to say "unsupported format, get a new version" than
+ * "can only handle 16 bits".
+ */
+
+#define BLOCK_MODE  0x80
+/* Block compression: if table is full and compression rate is dropping,
+ * clear the dictionary.
+ */
+
+#define LZW_RESERVED 0x60 /* reserved bits */
+
+#define	CLEAR  256       /* flush the dictionary */
+#define FIRST  (CLEAR+1) /* first free entry */
+
+extern int maxbits;      /* max bits per code for LZW */
+extern int block_mode;   /* block compress mode -C compatible with 2.0 */
+
+extern int lzw    OF((int in, int out));
+extern int unlzw  OF((int in, int out));
+
+
+#ifdef RCSID
+static char rcsid[] = "$Id: deflate.c,v 0.15 1993/06/24 10:53:53 jloup Exp $";
+#endif
+
+/* ===========================================================================
+ * Configuration parameters
+ */
+
+/* Compile with MEDIUM_MEM to reduce the memory requirements or
+ * with SMALL_MEM to use as little memory as possible. Use BIG_MEM if the
+ * entire input file can be held in memory (not possible on 16 bit systems).
+ * Warning: defining these symbols affects HASH_BITS (see below) and thus
+ * affects the compression ratio. The compressed output
+ * is still correct, and might even be smaller in some cases.
+ */
+
+#ifdef SMALL_MEM
+#   define HASH_BITS  13  /* Number of bits used to hash strings */
+#endif
+#ifdef MEDIUM_MEM
+#   define HASH_BITS  14
+#endif
+#ifndef HASH_BITS
+#   define HASH_BITS  15
+   /* For portability to 16 bit machines, do not use values above 15. */
+#endif
+
+/* To save space (see unlzw.c), we overlay prev+head with tab_prefix and
+ * window with tab_suffix. Check that we can do this:
+ */
+#if (WSIZE<<1) > (1<<BITS)
+   error: cannot overlay window with tab_suffix and prev with tab_prefix0
+#endif
+#if HASH_BITS > BITS-1
+   error: cannot overlay head with tab_prefix1
+#endif
+
+#define HASH_SIZE (unsigned)(1<<HASH_BITS)
+#define HASH_MASK (HASH_SIZE-1)
+#define WMASK     (WSIZE-1)
+/* HASH_SIZE and WSIZE must be powers of two */
+
+#define NIL 0
+/* Tail of hash chains */
+
+#define FAST 4
+#define SLOW 2
+/* speed options for the general purpose bit flag */
+
+#ifndef TOO_FAR
+#  define TOO_FAR 4096
+#endif
+/* Matches of length 3 are discarded if their distance exceeds TOO_FAR */
+
+#ifndef RSYNC_WIN
+#  define RSYNC_WIN 4096
+#endif
+/* Size of rsync window, must be < MAX_DIST */
+
+#define RSYNC_SUM_MATCH(sum) ((sum) % RSYNC_WIN == 0)
+/* Whether window sum matches magic value */
+
+/* ===========================================================================
+ * Local data used by the "longest match" routines.
+ */
+
+typedef ush Pos;
+typedef unsigned IPos;
+/* A Pos is an index in the character window. We use short instead of int to
+ * save space in the various tables. IPos is used only for parameter passing.
+ */
+
+/* DECLARE(uch, window, 2L*WSIZE); */
+/* Sliding window. Input bytes are read into the second half of the window,
+ * and move to the first half later to keep a dictionary of at least WSIZE
+ * bytes. With this organization, matches are limited to a distance of
+ * WSIZE-MAX_MATCH bytes, but this ensures that IO is always
+ * performed with a length multiple of the block size. Also, it limits
+ * the window size to 64K, which is quite useful on MSDOS.
+ * To do: limit the window size to WSIZE+BSZ if SMALL_MEM (the code would
+ * be less efficient).
+ */
+
+/* DECLARE(Pos, prev, WSIZE); */
+/* Link to older string with same hash index. To limit the size of this
+ * array to 64K, this link is maintained only for the last 32K strings.
+ * An index in this array is thus a window index modulo 32K.
+ */
+
+/* DECLARE(Pos, head, 1<<HASH_BITS); */
+/* Heads of the hash chains or NIL. */
+
+ulg window_size = (ulg)2*WSIZE;
+/* window size, 2*WSIZE except for MMAP or BIG_MEM, where it is the
+ * input file length plus MIN_LOOKAHEAD.
+ */
+
+long block_start;
+/* window position at the beginning of the current output block. Gets
+ * negative when the window is moved backwards.
+ */
+
+local unsigned ins_h;  /* hash index of string to be inserted */
+
+#define H_SHIFT  ((HASH_BITS+MIN_MATCH-1)/MIN_MATCH)
+/* Number of bits by which ins_h and del_h must be shifted at each
+ * input step. It must be such that after MIN_MATCH steps, the oldest
+ * byte no longer takes part in the hash key, that is:
+ *   H_SHIFT * MIN_MATCH >= HASH_BITS
+ */
+
+unsigned int near prev_length;
+/* Length of the best match at previous step. Matches not greater than this
+ * are discarded. This is used in the lazy match evaluation.
+ */
+
+      unsigned near strstart;      /* start of string to insert */
+      unsigned near match_start;   /* start of matching string */
+local int           eofile;        /* flag set at end of input file */
+local unsigned      lookahead;     /* number of valid bytes ahead in window */
+
+unsigned near max_chain_length;
+/* To speed up deflation, hash chains are never searched beyond this length.
+ * A higher limit improves compression ratio but degrades the speed.
+ */
+
+local unsigned int max_lazy_match;
+/* Attempt to find a better match only when the current match is strictly
+ * smaller than this value. This mechanism is used only for compression
+ * levels >= 4.
+ */
+#define max_insert_length  max_lazy_match
+/* Insert new strings in the hash table only if the match length
+ * is not greater than this length. This saves time but degrades compression.
+ * max_insert_length is used only for compression levels <= 3.
+ */
+
+local int compr_level;
+/* compression level (1..9) */
+
+unsigned near good_match;
+/* Use a faster search when the previous match is longer than this */
+
+local ulg rsync_sum;  /* rolling sum of rsync window */
+local ulg rsync_chunk_end; /* next rsync sequence point */
+
+/* Values for max_lazy_match, good_match and max_chain_length, depending on
+ * the desired pack level (0..9). The values given below have been tuned to
+ * exclude worst case performance for pathological files. Better values may be
+ * found for specific files.
+ */
+
+typedef struct config {
+   ush good_length; /* reduce lazy search above this match length */
+   ush max_lazy;    /* do not perform lazy search above this match length */
+   ush nice_length; /* quit search above this match length */
+   ush max_chain;
+} config;
+
+#ifdef  FULL_SEARCH
+# define nice_match MAX_MATCH
+#else
+  int near nice_match; /* Stop searching when current match exceeds this */
+#endif
+
+local config configuration_table[10] = {
+/*      good lazy nice chain */
+/* 0 */ {0,    0,  0,    0},  /* store only */
+/* 1 */ {4,    4,  8,    4},  /* maximum speed, no lazy matches */
+/* 2 */ {4,    5, 16,    8},
+/* 3 */ {4,    6, 32,   32},
+
+/* 4 */ {4,    4, 16,   16},  /* lazy matches */
+/* 5 */ {8,   16, 32,   32},
+/* 6 */ {8,   16, 128, 128},
+/* 7 */ {8,   32, 128, 256},
+/* 8 */ {32, 128, 258, 1024},
+/* 9 */ {32, 258, 258, 4096}}; /* maximum compression */
+
+/* Note: the deflate() code requires max_lazy >= MIN_MATCH and max_chain >= 4
+ * For deflate_fast() (levels <= 3) good is ignored and lazy has a different
+ * meaning.
+ */
+
+#define EQUAL 0
+/* result of memcmp for equal strings */
+
+/* ===========================================================================
+ *  Prototypes for local functions.
+ */
+local void fill_window   OF((void));
+local off_t deflate_fast OF((void));
+
+      int  longest_match OF((IPos cur_match));
+#ifdef ASMV
+      void match_init OF((void)); /* asm code initialization */
+#endif
+
+#ifdef DEBUG
+local  void check_match OF((IPos start, IPos match, int length));
+#endif
+
+/* ===========================================================================
+ * Update a hash value with the given input byte
+ * IN  assertion: all calls to to UPDATE_HASH are made with consecutive
+ *    input characters, so that a running hash key can be computed from the
+ *    previous key instead of complete recalculation each time.
+ */
+#define UPDATE_HASH(h,c) (h = (((h)<<H_SHIFT) ^ (c)) & HASH_MASK)
+
+/* ===========================================================================
+ * Insert string s in the dictionary and set match_head to the previous head
+ * of the hash chain (the most recent string with same hash key). Return
+ * the previous length of the hash chain.
+ * IN  assertion: all calls to to INSERT_STRING are made with consecutive
+ *    input characters and the first MIN_MATCH bytes of s are valid
+ *    (except for the last MIN_MATCH-1 bytes of the input file).
+ */
+#define INSERT_STRING(s, match_head) \
+   (UPDATE_HASH(ins_h, window[(s) + MIN_MATCH-1]), \
+    prev[(s) & WMASK] = match_head = head[ins_h], \
+    head[ins_h] = (s))
+
+/* ===========================================================================
+ * Initialize the "longest match" routines for a new file
+ */
+void lm_init (pack_level, flags)
+    int pack_level; /* 0: store, 1: best speed, 9: best compression */
+    ush *flags;     /* general purpose bit flag */
+{
+    register unsigned j;
+
+    if (pack_level < 1 || pack_level > 9) error("bad pack level");
+    compr_level = pack_level;
+
+    /* Initialize the hash table. */
+#if defined(MAXSEG_64K) && HASH_BITS == 15
+    for (j = 0;  j < HASH_SIZE; j++) head[j] = NIL;
+#else
+    memzero((char*)head, HASH_SIZE*sizeof(*head));
+#endif
+    /* prev will be initialized on the fly */
+
+    /* rsync params */
+    rsync_chunk_end = 0xFFFFFFFFUL;
+    rsync_sum = 0;
+
+    /* Set the default configuration parameters:
+     */
+    max_lazy_match   = configuration_table[pack_level].max_lazy;
+    good_match       = configuration_table[pack_level].good_length;
+#ifndef FULL_SEARCH
+    nice_match       = configuration_table[pack_level].nice_length;
+#endif
+    max_chain_length = configuration_table[pack_level].max_chain;
+    if (pack_level == 1) {
+       *flags |= FAST;
+    } else if (pack_level == 9) {
+       *flags |= SLOW;
+    }
+    /* ??? reduce max_chain_length for binary files */
+
+    strstart = 0;
+    block_start = 0L;
+#ifdef ASMV
+    match_init(); /* initialize the asm code */
+#endif
+
+    lookahead = read_buf((char*)window,
+			 sizeof(int) <= 2 ? (unsigned)WSIZE : 2*WSIZE);
+
+    if (lookahead == 0 || lookahead == (unsigned)EOF) {
+       eofile = 1, lookahead = 0;
+       return;
+    }
+    eofile = 0;
+    /* Make sure that we always have enough lookahead. This is important
+     * if input comes from a device such as a tty.
+     */
+    while (lookahead < MIN_LOOKAHEAD && !eofile) fill_window();
+
+    ins_h = 0;
+    for (j=0; j<MIN_MATCH-1; j++) UPDATE_HASH(ins_h, window[j]);
+    /* If lookahead < MIN_MATCH, ins_h is garbage, but this is
+     * not important since only literal bytes will be emitted.
+     */
+}
+
+/* ===========================================================================
+ * Set match_start to the longest match starting at the given string and
+ * return its length. Matches shorter or equal to prev_length are discarded,
+ * in which case the result is equal to prev_length and match_start is
+ * garbage.
+ * IN assertions: cur_match is the head of the hash chain for the current
+ *   string (strstart) and its distance is <= MAX_DIST, and prev_length >= 1
+ */
+#ifndef ASMV
+/* For MSDOS, OS/2 and 386 Unix, an optimized version is in match.asm or
+ * match.s. The code is functionally equivalent, so you can use the C version
+ * if desired.
+ */
+int longest_match(cur_match)
+    IPos cur_match;                             /* current match */
+{
+    unsigned chain_length = max_chain_length;   /* max hash chain length */
+    register uch *scan = window + strstart;     /* current string */
+    register uch *match;                        /* matched string */
+    register int len;                           /* length of current match */
+    int best_len = prev_length;                 /* best match length so far */
+    IPos limit = strstart > (IPos)MAX_DIST ? strstart - (IPos)MAX_DIST : NIL;
+    /* Stop when cur_match becomes <= limit. To simplify the code,
+     * we prevent matches with the string of window index 0.
+     */
+
+/* The code is optimized for HASH_BITS >= 8 and MAX_MATCH-2 multiple of 16.
+ * It is easy to get rid of this optimization if necessary.
+ */
+#if HASH_BITS < 8 || MAX_MATCH != 258
+   error: Code too clever
+#endif
+
+#ifdef UNALIGNED_OK
+    /* Compare two bytes at a time. Note: this is not always beneficial.
+     * Try with and without -DUNALIGNED_OK to check.
+     */
+    register uch *strend = window + strstart + MAX_MATCH - 1;
+    register ush scan_start = *(ush*)scan;
+    register ush scan_end   = *(ush*)(scan+best_len-1);
+#else
+    register uch *strend = window + strstart + MAX_MATCH;
+    register uch scan_end1  = scan[best_len-1];
+    register uch scan_end   = scan[best_len];
+#endif
+
+    /* Do not waste too much time if we already have a good match: */
+    if (prev_length >= good_match) {
+        chain_length >>= 2;
+    }
+    Assert(strstart <= window_size-MIN_LOOKAHEAD, "insufficient lookahead");
+
+    do {
+        Assert(cur_match < strstart, "no future");
+        match = window + cur_match;
+
+        /* Skip to next match if the match length cannot increase
+         * or if the match length is less than 2:
+         */
+#if (defined(UNALIGNED_OK) && MAX_MATCH == 258)
+        /* This code assumes sizeof(unsigned short) == 2. Do not use
+         * UNALIGNED_OK if your compiler uses a different size.
+         */
+        if (*(ush*)(match+best_len-1) != scan_end ||
+            *(ush*)match != scan_start) continue;
+
+        /* It is not necessary to compare scan[2] and match[2] since they are
+         * always equal when the other bytes match, given that the hash keys
+         * are equal and that HASH_BITS >= 8. Compare 2 bytes at a time at
+         * strstart+3, +5, ... up to strstart+257. We check for insufficient
+         * lookahead only every 4th comparison; the 128th check will be made
+         * at strstart+257. If MAX_MATCH-2 is not a multiple of 8, it is
+         * necessary to put more guard bytes at the end of the window, or
+         * to check more often for insufficient lookahead.
+         */
+        scan++, match++;
+        do {
+        } while (*(ush*)(scan+=2) == *(ush*)(match+=2) &&
+                 *(ush*)(scan+=2) == *(ush*)(match+=2) &&
+                 *(ush*)(scan+=2) == *(ush*)(match+=2) &&
+                 *(ush*)(scan+=2) == *(ush*)(match+=2) &&
+                 scan < strend);
+        /* The funny "do {}" generates better code on most compilers */
+
+        /* Here, scan <= window+strstart+257 */
+        Assert(scan <= window+(unsigned)(window_size-1), "wild scan");
+        if (*scan == *match) scan++;
+
+        len = (MAX_MATCH - 1) - (int)(strend-scan);
+        scan = strend - (MAX_MATCH-1);
+
+#else /* UNALIGNED_OK */
+
+        if (match[best_len]   != scan_end  ||
+            match[best_len-1] != scan_end1 ||
+            *match            != *scan     ||
+            *++match          != scan[1])      continue;
+
+        /* The check at best_len-1 can be removed because it will be made
+         * again later. (This heuristic is not always a win.)
+         * It is not necessary to compare scan[2] and match[2] since they
+         * are always equal when the other bytes match, given that
+         * the hash keys are equal and that HASH_BITS >= 8.
+         */
+        scan += 2, match++;
+
+        /* We check for insufficient lookahead only every 8th comparison;
+         * the 256th check will be made at strstart+258.
+         */
+        do {
+        } while (*++scan == *++match && *++scan == *++match &&
+                 *++scan == *++match && *++scan == *++match &&
+                 *++scan == *++match && *++scan == *++match &&
+                 *++scan == *++match && *++scan == *++match &&
+                 scan < strend);
+
+        len = MAX_MATCH - (int)(strend - scan);
+        scan = strend - MAX_MATCH;
+
+#endif /* UNALIGNED_OK */
+
+        if (len > best_len) {
+            match_start = cur_match;
+            best_len = len;
+            if (len >= nice_match) break;
+#ifdef UNALIGNED_OK
+            scan_end = *(ush*)(scan+best_len-1);
+#else
+            scan_end1  = scan[best_len-1];
+            scan_end   = scan[best_len];
+#endif
+        }
+    } while ((cur_match = prev[cur_match & WMASK]) > limit
+	     && --chain_length != 0);
+
+    return best_len;
+}
+#endif /* ASMV */
+
+#ifdef DEBUG
+/* ===========================================================================
+ * Check that the match at match_start is indeed a match.
+ */
+local void check_match(start, match, length)
+    IPos start, match;
+    int length;
+{
+    /* check that the match is indeed a match */
+    if (memcmp((char*)window + match,
+                (char*)window + start, length) != EQUAL) {
+        fprintf(stderr,
+            " start %d, match %d, length %d\n",
+            start, match, length);
+        error("invalid match");
+    }
+    if (verbose > 1) {
+        fprintf(stderr,"\\[%d,%d]", start-match, length);
+        do { putc(window[start++], stderr); } while (--length != 0);
+    }
+}
+#else
+#  define check_match(start, match, length)
+#endif
+
+/* ===========================================================================
+ * Fill the window when the lookahead becomes insufficient.
+ * Updates strstart and lookahead, and sets eofile if end of input file.
+ * IN assertion: lookahead < MIN_LOOKAHEAD && strstart + lookahead > 0
+ * OUT assertions: at least one byte has been read, or eofile is set;
+ *    file reads are performed for at least two bytes (required for the
+ *    translate_eol option).
+ */
+local void fill_window()
+{
+    register unsigned n, m;
+    unsigned more = (unsigned)(window_size - (ulg)lookahead - (ulg)strstart);
+    /* Amount of free space at the end of the window. */
+
+    /* If the window is almost full and there is insufficient lookahead,
+     * move the upper half to the lower one to make room in the upper half.
+     */
+    if (more == (unsigned)EOF) {
+        /* Very unlikely, but possible on 16 bit machine if strstart == 0
+         * and lookahead == 1 (input done one byte at time)
+         */
+        more--;
+    } else if (strstart >= WSIZE+MAX_DIST) {
+        /* By the IN assertion, the window is not empty so we can't confuse
+         * more == 0 with more == 64K on a 16 bit machine.
+         */
+        Assert(window_size == (ulg)2*WSIZE, "no sliding with BIG_MEM");
+
+        memcpy((char*)window, (char*)window+WSIZE, (unsigned)WSIZE);
+        match_start -= WSIZE;
+        strstart    -= WSIZE; /* we now have strstart >= MAX_DIST: */
+	if (rsync_chunk_end != 0xFFFFFFFFUL)
+	    rsync_chunk_end -= WSIZE;
+
+        block_start -= (long) WSIZE;
+
+        for (n = 0; n < HASH_SIZE; n++) {
+            m = head[n];
+            head[n] = (Pos)(m >= WSIZE ? m-WSIZE : NIL);
+        }
+        for (n = 0; n < WSIZE; n++) {
+            m = prev[n];
+            prev[n] = (Pos)(m >= WSIZE ? m-WSIZE : NIL);
+            /* If n is not on any hash chain, prev[n] is garbage but
+             * its value will never be used.
+             */
+        }
+        more += WSIZE;
+    }
+    /* At this point, more >= 2 */
+    if (!eofile) {
+        n = read_buf((char*)window+strstart+lookahead, more);
+        if (n == 0 || n == (unsigned)EOF) {
+            eofile = 1;
+        } else {
+            lookahead += n;
+        }
+    }
+}
+
+local void rsync_roll(start, num)
+    unsigned start;
+    unsigned num;
+{
+    unsigned i;
+
+    if (start < RSYNC_WIN) {
+	/* before window fills. */
+	for (i = start; i < RSYNC_WIN; i++) {
+	    if (i == start + num) return;
+	    rsync_sum += (ulg)window[i];
+	}
+	num -= (RSYNC_WIN - start);
+	start = RSYNC_WIN;
+    }
+
+    /* buffer after window full */
+    for (i = start; i < start+num; i++) {
+	/* New character in */
+	rsync_sum += (ulg)window[i];
+	/* Old character out */
+	rsync_sum -= (ulg)window[i - RSYNC_WIN];
+	if (rsync_chunk_end == 0xFFFFFFFFUL && RSYNC_SUM_MATCH(rsync_sum))
+	    rsync_chunk_end = i;
+    }
+}
+
+/* ===========================================================================
+ * Set rsync_chunk_end if window sum matches magic value.
+ */
+#define RSYNC_ROLL(s, n) \
+   do { if (rsync) rsync_roll((s), (n)); } while(0)
+
+/* ===========================================================================
+ * Flush the current block, with given end-of-file flag.
+ * IN assertion: strstart is set to the end of the current match.
+ */
+#define FLUSH_BLOCK(eof) \
+   flush_block(block_start >= 0L ? (char*)&window[(unsigned)block_start] : \
+                (char*)NULL, (long)strstart - block_start, flush-1, (eof))
+
+/* ===========================================================================
+ * Processes a new input file and return its compressed length. This
+ * function does not perform lazy evaluationof matches and inserts
+ * new strings in the dictionary only for unmatched strings or for short
+ * matches. It is used only for the fast compression options.
+ */
+local off_t deflate_fast()
+{
+    IPos hash_head; /* head of the hash chain */
+    int flush;      /* set if current block must be flushed, 2=>and padded  */
+    unsigned match_length = 0;  /* length of best match */
+
+    prev_length = MIN_MATCH-1;
+    while (lookahead != 0) {
+        /* Insert the string window[strstart .. strstart+2] in the
+         * dictionary, and set hash_head to the head of the hash chain:
+         */
+        INSERT_STRING(strstart, hash_head);
+
+        /* Find the longest match, discarding those <= prev_length.
+         * At this point we have always match_length < MIN_MATCH
+         */
+        if (hash_head != NIL && strstart - hash_head <= MAX_DIST &&
+	    strstart <= window_size - MIN_LOOKAHEAD) {
+            /* To simplify the code, we prevent matches with the string
+             * of window index 0 (in particular we have to avoid a match
+             * of the string with itself at the start of the input file).
+             */
+            match_length = longest_match (hash_head);
+            /* longest_match() sets match_start */
+            if (match_length > lookahead) match_length = lookahead;
+        }
+        if (match_length >= MIN_MATCH) {
+            check_match(strstart, match_start, match_length);
+
+            flush = ct_tally(strstart-match_start, match_length - MIN_MATCH);
+
+            lookahead -= match_length;
+
+	    RSYNC_ROLL(strstart, match_length);
+	    /* Insert new strings in the hash table only if the match length
+             * is not too large. This saves time but degrades compression.
+             */
+            if (match_length <= max_insert_length) {
+                match_length--; /* string at strstart already in hash table */
+                do {
+                    strstart++;
+                    INSERT_STRING(strstart, hash_head);
+                    /* strstart never exceeds WSIZE-MAX_MATCH, so there are
+                     * always MIN_MATCH bytes ahead. If lookahead < MIN_MATCH
+                     * these bytes are garbage, but it does not matter since
+                     * the next lookahead bytes will be emitted as literals.
+                     */
+                } while (--match_length != 0);
+	        strstart++; 
+            } else {
+	        strstart += match_length;
+	        match_length = 0;
+	        ins_h = window[strstart];
+	        UPDATE_HASH(ins_h, window[strstart+1]);
+#if MIN_MATCH != 3
+                Call UPDATE_HASH() MIN_MATCH-3 more times
+#endif
+            }
+        } else {
+            /* No match, output a literal byte */
+            Tracevv((stderr,"%c",window[strstart]));
+            flush = ct_tally (0, window[strstart]);
+	    RSYNC_ROLL(strstart, 1);
+            lookahead--;
+	    strstart++; 
+        }
+	if (rsync && strstart > rsync_chunk_end) {
+	    rsync_chunk_end = 0xFFFFFFFFUL;
+	    flush = 2;
+	} 
+        if (flush) FLUSH_BLOCK(0), block_start = strstart;
+
+        /* Make sure that we always have enough lookahead, except
+         * at the end of the input file. We need MAX_MATCH bytes
+         * for the next match, plus MIN_MATCH bytes to insert the
+         * string following the next match.
+         */
+        while (lookahead < MIN_LOOKAHEAD && !eofile) fill_window();
+
+    }
+    return FLUSH_BLOCK(1); /* eof */
+}
+
+/* ===========================================================================
+ * Same as above, but achieves better compression. We use a lazy
+ * evaluation for matches: a match is finally adopted only if there is
+ * no better match at the next window position.
+ */
+off_t deflate()
+{
+    IPos hash_head;          /* head of hash chain */
+    IPos prev_match;         /* previous match */
+    int flush;               /* set if current block must be flushed */
+    int match_available = 0; /* set if previous match exists */
+    register unsigned match_length = MIN_MATCH-1; /* length of best match */
+
+    if (compr_level <= 3) return deflate_fast(); /* optimized for speed */
+
+    /* Process the input block. */
+    while (lookahead != 0) {
+        /* Insert the string window[strstart .. strstart+2] in the
+         * dictionary, and set hash_head to the head of the hash chain:
+         */
+        INSERT_STRING(strstart, hash_head);
+
+        /* Find the longest match, discarding those <= prev_length.
+         */
+        prev_length = match_length, prev_match = match_start;
+        match_length = MIN_MATCH-1;
+
+        if (hash_head != NIL && prev_length < max_lazy_match &&
+            strstart - hash_head <= MAX_DIST &&
+	    strstart <= window_size - MIN_LOOKAHEAD) {
+            /* To simplify the code, we prevent matches with the string
+             * of window index 0 (in particular we have to avoid a match
+             * of the string with itself at the start of the input file).
+             */
+            match_length = longest_match (hash_head);
+            /* longest_match() sets match_start */
+            if (match_length > lookahead) match_length = lookahead;
+
+            /* Ignore a length 3 match if it is too distant: */
+            if (match_length == MIN_MATCH && strstart-match_start > TOO_FAR){
+                /* If prev_match is also MIN_MATCH, match_start is garbage
+                 * but we will ignore the current match anyway.
+                 */
+                match_length--;
+            }
+        }
+        /* If there was a match at the previous step and the current
+         * match is not better, output the previous match:
+         */
+        if (prev_length >= MIN_MATCH && match_length <= prev_length) {
+
+            check_match(strstart-1, prev_match, prev_length);
+
+            flush = ct_tally(strstart-1-prev_match, prev_length - MIN_MATCH);
+
+            /* Insert in hash table all strings up to the end of the match.
+             * strstart-1 and strstart are already inserted.
+             */
+            lookahead -= prev_length-1;
+            prev_length -= 2;
+	    RSYNC_ROLL(strstart, prev_length+1);
+            do {
+                strstart++;
+                INSERT_STRING(strstart, hash_head);
+                /* strstart never exceeds WSIZE-MAX_MATCH, so there are
+                 * always MIN_MATCH bytes ahead. If lookahead < MIN_MATCH
+                 * these bytes are garbage, but it does not matter since the
+                 * next lookahead bytes will always be emitted as literals.
+                 */
+            } while (--prev_length != 0);
+            match_available = 0;
+            match_length = MIN_MATCH-1;
+            strstart++;
+
+	    if (rsync && strstart > rsync_chunk_end) {
+		rsync_chunk_end = 0xFFFFFFFFUL;
+		flush = 2;
+	    }
+            if (flush) FLUSH_BLOCK(0), block_start = strstart;
+        } else if (match_available) {
+            /* If there was no match at the previous position, output a
+             * single literal. If there was a match but the current match
+             * is longer, truncate the previous match to a single literal.
+             */
+            Tracevv((stderr,"%c",window[strstart-1]));
+	    flush = ct_tally (0, window[strstart-1]);
+	    if (rsync && strstart > rsync_chunk_end) {
+		rsync_chunk_end = 0xFFFFFFFFUL;
+		flush = 2;
+	    }
+            if (flush) FLUSH_BLOCK(0), block_start = strstart;
+	    RSYNC_ROLL(strstart, 1);
+            strstart++;
+            lookahead--;
+        } else {
+            /* There is no previous match to compare with, wait for
+             * the next step to decide.
+             */
+	    if (rsync && strstart > rsync_chunk_end) {
+		/* Reset huffman tree */
+		rsync_chunk_end = 0xFFFFFFFFUL;
+		flush = 2;
+		FLUSH_BLOCK(0), block_start = strstart;
+	    }
+            match_available = 1;
+	    RSYNC_ROLL(strstart, 1);
+            strstart++;
+            lookahead--;
+        }
+        Assert (strstart <= bytes_in && lookahead <= bytes_in, "a bit too far");
+
+        /* Make sure that we always have enough lookahead, except
+         * at the end of the input file. We need MAX_MATCH bytes
+         * for the next match, plus MIN_MATCH bytes to insert the
+         * string following the next match.
+         */
+        while (lookahead < MIN_LOOKAHEAD && !eofile) fill_window();
+    }
+    if (match_available) ct_tally (0, window[strstart-1]);
+
+    return FLUSH_BLOCK(1); /* eof */
+}
+/* Getopt for GNU.
+   NOTE: getopt is now part of the C library, so if you don't know what
+   "Keep this file name-space clean" means, talk to drepper@gnu.org
+   before changing it!
+   Copyright (C) 1987,88,89,90,91,92,93,94,95,96,98,99,2000,2001
+   	Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+/* This tells Alpha OSF/1 not to define a getopt prototype in <stdio.h>.
+   Ditto for AIX 3.2 and <stdlib.h>.  */
+#ifndef _NO_PROTO
+# define _NO_PROTO
+#endif
+
+#if !defined __STDC__ || !__STDC__
+/* This is a separate conditional since some stdc systems
+   reject `defined (const)'.  */
+# ifndef const
+#  define const
+# endif
+#endif
+
+/* This needs to come after some library #include
+   to get __GNU_LIBRARY__ defined.  */
+
+#  define _(msgid)	(msgid)
+
+/* This version of `getopt' appears to the caller like standard Unix `getopt'
+   but it behaves differently for the user, since it allows the user
+   to intersperse the options with the other arguments.
+
+   As `getopt' works, it permutes the elements of ARGV so that,
+   when it is done, all the options precede everything else.  Thus
+   all application programs are extended to handle flexible argument order.
+
+   Setting the environment variable POSIXLY_CORRECT disables permutation.
+   Then the behavior is completely standard.
+
+   GNU application programs can use a third alternative mode in which
+   they can distinguish the relative order of options and other arguments.  */
+
+/* Declarations for getopt.
+   Copyright (C) 1989-1994, 1996-1999, 2001 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+#ifndef _GETOPT_H
+
+#ifndef __need_getopt
+# define _GETOPT_H 1
+#endif
+
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+/* For communication from `getopt' to the caller.
+   When `getopt' finds an option that takes an argument,
+   the argument value is returned here.
+   Also, when `ordering' is RETURN_IN_ORDER,
+   each non-option ARGV-element is returned here.  */
+
+extern char *optarg;
+
+/* Index in ARGV of the next element to be scanned.
+   This is used for communication to and from the caller
+   and for communication between successive calls to `getopt'.
+
+   On entry to `getopt', zero means this is the first call; initialize.
+
+   When `getopt' returns -1, this is the index of the first of the
+   non-option elements that the caller should itself scan.
+
+   Otherwise, `optind' communicates from one call to the next
+   how much of ARGV has been scanned so far.  */
+
+extern int optind;
+
+/* Callers store zero here to inhibit the error message `getopt' prints
+   for unrecognized options.  */
+
+extern int opterr;
+
+/* Set to an option character which was unrecognized.  */
+
+extern int optopt;
+
+/* Describe the long-named options requested by the application.
+   The LONG_OPTIONS argument to getopt_long or getopt_long_only is a vector
+   of `struct option' terminated by an element containing a name which is
+   zero.
+
+   The field `has_arg' is:
+   no_argument		(or 0) if the option does not take an argument,
+   required_argument	(or 1) if the option requires an argument,
+   optional_argument 	(or 2) if the option takes an optional argument.
+
+   If the field `flag' is not NULL, it points to a variable that is set
+   to the value given in the field `val' when the option is found, but
+   left unchanged if the option is not found.
+
+   To have a long-named option do something other than set an `int' to
+   a compiled-in constant, such as set a value from `optarg', set the
+   option's `flag' field to zero and its `val' field to a nonzero
+   value (the equivalent single-letter option character, if there is
+   one).  For long options that have a zero `flag' field, `getopt'
+   returns the contents of the `val' field.  */
+
+struct option
+{
+# if (defined __STDC__ && __STDC__) || defined __cplusplus
+  const char *name;
+# else
+  char *name;
+# endif
+  /* has_arg can't be an enum because some compilers complain about
+     type mismatches in all the code that assumes it is an int.  */
+  int has_arg;
+  int *flag;
+  int val;
+};
+
+/* Names for the values of the `has_arg' field of `struct option'.  */
+
+# define no_argument		0
+# define required_argument	1
+# define optional_argument	2
+
+
+/* Get definitions and prototypes for functions to process the
+   arguments in ARGV (ARGC of them, minus the program name) for
+   options given in OPTS.
+
+   Return the option character from OPTS just read.  Return -1 when
+   there are no more options.  For unrecognized options, or options
+   missing arguments, `optopt' is set to the option letter, and '?' is
+   returned.
+
+   The OPTS string is a list of characters which are recognized option
+   letters, optionally followed by colons, specifying that that letter
+   takes an argument, to be placed in `optarg'.
+
+   If a letter in OPTS is followed by two colons, its argument is
+   optional.  This behavior is specific to the GNU `getopt'.
+
+   The argument `--' causes premature termination of argument
+   scanning, explicitly telling `getopt' that there are no more
+   options.
+
+   If OPTS begins with `--', then non-option arguments are treated as
+   arguments to the option '\0'.  This behavior is specific to the GNU
+   `getopt'.  */
+
+#if (defined __STDC__ && __STDC__) || defined __cplusplus
+# ifdef __GNU_LIBRARY__
+/* Many other libraries have conflicting prototypes for getopt, with
+   differences in the consts, in stdlib.h.  To avoid compilation
+   errors, only prototype getopt for the GNU C library.  */
+extern int getopt (int __argc, char *const *__argv, const char *__shortopts);
+# else /* not __GNU_LIBRARY__ */
+extern int getopt ();
+# endif /* __GNU_LIBRARY__ */
+
+# ifndef __need_getopt
+extern int getopt_long (int __argc, char *const *__argv, const char *__shortopts,
+		        const struct option *__longopts, int *__longind);
+extern int getopt_long_only (int __argc, char *const *__argv,
+			     const char *__shortopts,
+		             const struct option *__longopts, int *__longind);
+
+/* Internal only.  Users should not call this directly.  */
+extern int _getopt_internal (int __argc, char *const *__argv,
+			     const char *__shortopts,
+		             const struct option *__longopts, int *__longind,
+			     int __long_only);
+# endif
+#else /* not __STDC__ */
+extern int getopt ();
+# ifndef __need_getopt
+extern int getopt_long ();
+extern int getopt_long_only ();
+
+extern int _getopt_internal ();
+# endif
+#endif /* __STDC__ */
+
+#ifdef	__cplusplus
+}
+#endif
+
+/* Make sure we later can get all the definitions and declarations.  */
+#undef __need_getopt
+
+#endif /* getopt.h */
+
+
+/* For communication from `getopt' to the caller.
+   When `getopt' finds an option that takes an argument,
+   the argument value is returned here.
+   Also, when `ordering' is RETURN_IN_ORDER,
+   each non-option ARGV-element is returned here.  */
+
+char *optarg;
+
+/* Index in ARGV of the next element to be scanned.
+   This is used for communication to and from the caller
+   and for communication between successive calls to `getopt'.
+
+   On entry to `getopt', zero means this is the first call; initialize.
+
+   When `getopt' returns -1, this is the index of the first of the
+   non-option elements that the caller should itself scan.
+
+   Otherwise, `optind' communicates from one call to the next
+   how much of ARGV has been scanned so far.  */
+
+/* 1003.2 says this must be 1 before any call.  */
+int optind = 1;
+
+/* Formerly, initialization of getopt depended on optind==0, which
+   causes problems with re-calling getopt as programs generally don't
+   know that. */
+
+int __getopt_initialized;
+
+/* The next char to be scanned in the option-element
+   in which the last option character we returned was found.
+   This allows us to pick up the scan where we left off.
+
+   If this is zero, or a null string, it means resume the scan
+   by advancing to the next ARGV-element.  */
+
+static char *nextchar;
+
+/* Callers store zero here to inhibit the error message
+   for unrecognized options.  */
+
+int opterr = 1;
+
+/* Set to an option character which was unrecognized.
+   This must be initialized on some systems to avoid linking in the
+   system's own getopt implementation.  */
+
+int optopt = '?';
+
+/* Describe how to deal with options that follow non-option ARGV-elements.
+
+   If the caller did not specify anything,
+   the default is REQUIRE_ORDER if the environment variable
+   POSIXLY_CORRECT is defined, PERMUTE otherwise.
+
+   REQUIRE_ORDER means don't recognize them as options;
+   stop option processing when the first non-option is seen.
+   This is what Unix does.
+   This mode of operation is selected by either setting the environment
+   variable POSIXLY_CORRECT, or using `+' as the first character
+   of the list of option characters.
+
+   PERMUTE is the default.  We permute the contents of ARGV as we scan,
+   so that eventually all the non-options are at the end.  This allows options
+   to be given in any order, even with programs that were not written to
+   expect this.
+
+   RETURN_IN_ORDER is an option available to programs that were written
+   to expect options and other ARGV-elements in any order and that care about
+   the ordering of the two.  We describe each non-option ARGV-element
+   as if it were the argument of an option with character code 1.
+   Using `-' as the first character of the list of option characters
+   selects this mode of operation.
+
+   The special argument `--' forces an end of option-scanning regardless
+   of the value of `ordering'.  In the case of RETURN_IN_ORDER, only
+   `--' can cause `getopt' to return -1 with `optind' != ARGC.  */
+
+static enum
+{
+  REQUIRE_ORDER, PERMUTE, RETURN_IN_ORDER
+} ordering;
+
+/* Value of POSIXLY_CORRECT environment variable.  */
+static char *posixly_correct;
+
+# define my_index	strchr
+
+/* Avoid depending on library functions or files
+   whose names are inconsistent.  */
+
+#ifndef getenv
+extern char *getenv ();
+#endif
+
+char *
+my_index (str, chr)
+     const char *str;
+     int chr;
+{
+  while (*str)
+    {
+      if (*str == chr)
+	return (char *) str;
+      str++;
+    }
+  return 0;
+}
+
+/* If using GCC, we can safely declare strlen this way.
+   If not using GCC, it is ok not to declare it.  */
+#ifdef __GNUC__
+/* Note that Motorola Delta 68k R3V7 comes with GCC but not stddef.h.
+   That was relevant to code that was here before.  */
+# if (!defined __STDC__ || !__STDC__) && !defined strlen
+/* gcc with -traditional declares the built-in strlen to return int,
+   and has done so at least since version 2.4.5. -- rms.  */
+extern int strlen (const char *);
+# endif /* not __STDC__ */
+#endif /* __GNUC__ */
+
+
+/* Handle permutation of arguments.  */
+
+/* Describe the part of ARGV that contains non-options that have
+   been skipped.  `first_nonopt' is the index in ARGV of the first of them;
+   `last_nonopt' is the index after the last of them.  */
+
+static int first_nonopt;
+static int last_nonopt;
+
+#ifdef _LIBC
+/* Bash 2.0 gives us an environment variable containing flags
+   indicating ARGV elements that should not be considered arguments.  */
+
+#ifdef USE_NONOPTION_FLAGS
+/* Defined in getopt_init.c  */
+extern char *__getopt_nonoption_flags;
+
+static int nonoption_flags_max_len;
+static int nonoption_flags_len;
+#endif
+
+static int original_argc;
+static char *const *original_argv;
+
+/* Make sure the environment variable bash 2.0 puts in the environment
+   is valid for the getopt call we must make sure that the ARGV passed
+   to getopt is that one passed to the process.  */
+static void
+__attribute__ ((unused))
+store_args_and_env (int argc, char *const *argv)
+{
+  /* XXX This is no good solution.  We should rather copy the args so
+     that we can compare them later.  But we must not use malloc(3).  */
+  original_argc = argc;
+  original_argv = argv;
+}
+# ifdef text_set_element
+text_set_element (__libc_subinit, store_args_and_env);
+# endif /* text_set_element */
+
+# ifdef USE_NONOPTION_FLAGS
+#  define SWAP_FLAGS(ch1, ch2) \
+  if (nonoption_flags_len > 0)						      \
+    {									      \
+      char __tmp = __getopt_nonoption_flags[ch1];			      \
+      __getopt_nonoption_flags[ch1] = __getopt_nonoption_flags[ch2];	      \
+      __getopt_nonoption_flags[ch2] = __tmp;				      \
+    }
+# else
+#  define SWAP_FLAGS(ch1, ch2)
+# endif
+#else	/* !_LIBC */
+# define SWAP_FLAGS(ch1, ch2)
+#endif	/* _LIBC */
+
+/* Exchange two adjacent subsequences of ARGV.
+   One subsequence is elements [first_nonopt,last_nonopt)
+   which contains all the non-options that have been skipped so far.
+   The other is elements [last_nonopt,optind), which contains all
+   the options processed since those non-options were skipped.
+
+   `first_nonopt' and `last_nonopt' are relocated so that they describe
+   the new indices of the non-options in ARGV after they are moved.  */
+
+#if defined __STDC__ && __STDC__
+static void exchange (char **);
+#endif
+
+static void
+exchange (argv)
+     char **argv;
+{
+  int bottom = first_nonopt;
+  int middle = last_nonopt;
+  int top = optind;
+  char *tem;
+
+  /* Exchange the shorter segment with the far end of the longer segment.
+     That puts the shorter segment into the right place.
+     It leaves the longer segment in the right place overall,
+     but it consists of two parts that need to be swapped next.  */
+
+#if defined _LIBC && defined USE_NONOPTION_FLAGS
+  /* First make sure the handling of the `__getopt_nonoption_flags'
+     string can work normally.  Our top argument must be in the range
+     of the string.  */
+  if (nonoption_flags_len > 0 && top >= nonoption_flags_max_len)
+    {
+      /* We must extend the array.  The user plays games with us and
+	 presents new arguments.  */
+      char *new_str = malloc (top + 1);
+      if (new_str == NULL)
+	nonoption_flags_len = nonoption_flags_max_len = 0;
+      else
+	{
+	  memset (__mempcpy (new_str, __getopt_nonoption_flags,
+			     nonoption_flags_max_len),
+		  '\0', top + 1 - nonoption_flags_max_len);
+	  nonoption_flags_max_len = top + 1;
+	  __getopt_nonoption_flags = new_str;
+	}
+    }
+#endif
+
+  while (top > middle && middle > bottom)
+    {
+      if (top - middle > middle - bottom)
+	{
+	  /* Bottom segment is the short one.  */
+	  int len = middle - bottom;
+	  register int i;
+
+	  /* Swap it with the top part of the top segment.  */
+	  for (i = 0; i < len; i++)
+	    {
+	      tem = argv[bottom + i];
+	      argv[bottom + i] = argv[top - (middle - bottom) + i];
+	      argv[top - (middle - bottom) + i] = tem;
+	      SWAP_FLAGS (bottom + i, top - (middle - bottom) + i);
+	    }
+	  /* Exclude the moved bottom segment from further swapping.  */
+	  top -= len;
+	}
+      else
+	{
+	  /* Top segment is the short one.  */
+	  int len = top - middle;
+	  register int i;
+
+	  /* Swap it with the bottom part of the bottom segment.  */
+	  for (i = 0; i < len; i++)
+	    {
+	      tem = argv[bottom + i];
+	      argv[bottom + i] = argv[middle + i];
+	      argv[middle + i] = tem;
+	      SWAP_FLAGS (bottom + i, middle + i);
+	    }
+	  /* Exclude the moved top segment from further swapping.  */
+	  bottom += len;
+	}
+    }
+
+  /* Update records for the slots the non-options now occupy.  */
+
+  first_nonopt += (optind - last_nonopt);
+  last_nonopt = optind;
+}
+
+/* Initialize the internal data when the first call is made.  */
+
+#if defined __STDC__ && __STDC__
+static const char *_getopt_initialize (int, char *const *, const char *);
+#endif
+static const char *
+_getopt_initialize (argc, argv, optstring)
+     int argc;
+     char *const *argv;
+     const char *optstring;
+{
+  /* Start processing options with ARGV-element 1 (since ARGV-element 0
+     is the program name); the sequence of previously skipped
+     non-option ARGV-elements is empty.  */
+
+  first_nonopt = last_nonopt = optind;
+
+  nextchar = NULL;
+
+  posixly_correct = getenv ("POSIXLY_CORRECT");
+
+  /* Determine how to handle the ordering of options and nonoptions.  */
+
+  if (optstring[0] == '-')
+    {
+      ordering = RETURN_IN_ORDER;
+      ++optstring;
+    }
+  else if (optstring[0] == '+')
+    {
+      ordering = REQUIRE_ORDER;
+      ++optstring;
+    }
+  else if (posixly_correct != NULL)
+    ordering = REQUIRE_ORDER;
+  else
+    ordering = PERMUTE;
+
+#if defined _LIBC && defined USE_NONOPTION_FLAGS
+  if (posixly_correct == NULL
+      && argc == original_argc && argv == original_argv)
+    {
+      if (nonoption_flags_max_len == 0)
+	{
+	  if (__getopt_nonoption_flags == NULL
+	      || __getopt_nonoption_flags[0] == '\0')
+	    nonoption_flags_max_len = -1;
+	  else
+	    {
+	      const char *orig_str = __getopt_nonoption_flags;
+	      int len = nonoption_flags_max_len = strlen (orig_str);
+	      if (nonoption_flags_max_len < argc)
+		nonoption_flags_max_len = argc;
+	      __getopt_nonoption_flags =
+		(char *) malloc (nonoption_flags_max_len);
+	      if (__getopt_nonoption_flags == NULL)
+		nonoption_flags_max_len = -1;
+	      else
+		memset (__mempcpy (__getopt_nonoption_flags, orig_str, len),
+			'\0', nonoption_flags_max_len - len);
+	    }
+	}
+      nonoption_flags_len = nonoption_flags_max_len;
+    }
+  else
+    nonoption_flags_len = 0;
+#endif
+
+  return optstring;
+}
+
+/* Scan elements of ARGV (whose length is ARGC) for option characters
+   given in OPTSTRING.
+
+   If an element of ARGV starts with '-', and is not exactly "-" or "--",
+   then it is an option element.  The characters of this element
+   (aside from the initial '-') are option characters.  If `getopt'
+   is called repeatedly, it returns successively each of the option characters
+   from each of the option elements.
+
+   If `getopt' finds another option character, it returns that character,
+   updating `optind' and `nextchar' so that the next call to `getopt' can
+   resume the scan with the following option character or ARGV-element.
+
+   If there are no more option characters, `getopt' returns -1.
+   Then `optind' is the index in ARGV of the first ARGV-element
+   that is not an option.  (The ARGV-elements have been permuted
+   so that those that are not options now come last.)
+
+   OPTSTRING is a string containing the legitimate option characters.
+   If an option character is seen that is not listed in OPTSTRING,
+   return '?' after printing an error message.  If you set `opterr' to
+   zero, the error message is suppressed but we still return '?'.
+
+   If a char in OPTSTRING is followed by a colon, that means it wants an arg,
+   so the following text in the same ARGV-element, or the text of the following
+   ARGV-element, is returned in `optarg'.  Two colons mean an option that
+   wants an optional arg; if there is text in the current ARGV-element,
+   it is returned in `optarg', otherwise `optarg' is set to zero.
+
+   If OPTSTRING starts with `-' or `+', it requests different methods of
+   handling the non-option ARGV-elements.
+   See the comments about RETURN_IN_ORDER and REQUIRE_ORDER, above.
+
+   Long-named options begin with `--' instead of `-'.
+   Their names may be abbreviated as long as the abbreviation is unique
+   or is an exact match for some defined option.  If they have an
+   argument, it follows the option name in the same ARGV-element, separated
+   from the option name by a `=', or else the in next ARGV-element.
+   When `getopt' finds a long-named option, it returns 0 if that option's
+   `flag' field is nonzero, the value of the option's `val' field
+   if the `flag' field is zero.
+
+   The elements of ARGV aren't really const, because we permute them.
+   But we pretend they're const in the prototype to be compatible
+   with other systems.
+
+   LONGOPTS is a vector of `struct option' terminated by an
+   element containing a name which is zero.
+
+   LONGIND returns the index in LONGOPT of the long-named option found.
+   It is only valid when a long-named option has been found by the most
+   recent call.
+
+   If LONG_ONLY is nonzero, '-' as well as '--' can introduce
+   long-named options.  */
+
+int
+_getopt_internal (argc, argv, optstring, longopts, longind, long_only)
+     int argc;
+     char *const *argv;
+     const char *optstring;
+     const struct option *longopts;
+     int *longind;
+     int long_only;
+{
+  int print_errors = opterr;
+  if (optstring[0] == ':')
+    print_errors = 0;
+
+  if (argc < 1)
+    return -1;
+
+  optarg = NULL;
+
+  if (optind == 0 || !__getopt_initialized)
+    {
+      if (optind == 0)
+	optind = 1;	/* Don't scan ARGV[0], the program name.  */
+      optstring = _getopt_initialize (argc, argv, optstring);
+      __getopt_initialized = 1;
+    }
+
+  /* Test whether ARGV[optind] points to a non-option argument.
+     Either it does not have option syntax, or there is an environment flag
+     from the shell indicating it is not an option.  The later information
+     is only used when the used in the GNU libc.  */
+#if defined _LIBC && defined USE_NONOPTION_FLAGS
+# define NONOPTION_P (argv[optind][0] != '-' || argv[optind][1] == '\0'	      \
+		      || (optind < nonoption_flags_len			      \
+			  && __getopt_nonoption_flags[optind] == '1'))
+#else
+# define NONOPTION_P (argv[optind][0] != '-' || argv[optind][1] == '\0')
+#endif
+
+  if (nextchar == NULL || *nextchar == '\0')
+    {
+      /* Advance to the next ARGV-element.  */
+
+      /* Give FIRST_NONOPT & LAST_NONOPT rational values if OPTIND has been
+	 moved back by the user (who may also have changed the arguments).  */
+      if (last_nonopt > optind)
+	last_nonopt = optind;
+      if (first_nonopt > optind)
+	first_nonopt = optind;
+
+      if (ordering == PERMUTE)
+	{
+	  /* If we have just processed some options following some non-options,
+	     exchange them so that the options come first.  */
+
+	  if (first_nonopt != last_nonopt && last_nonopt != optind)
+	    exchange ((char **) argv);
+	  else if (last_nonopt != optind)
+	    first_nonopt = optind;
+
+	  /* Skip any additional non-options
+	     and extend the range of non-options previously skipped.  */
+
+	  while (optind < argc && NONOPTION_P)
+	    optind++;
+	  last_nonopt = optind;
+	}
+
+      /* The special ARGV-element `--' means premature end of options.
+	 Skip it like a null option,
+	 then exchange with previous non-options as if it were an option,
+	 then skip everything else like a non-option.  */
+
+      if (optind != argc && !strcmp (argv[optind], "--"))
+	{
+	  optind++;
+
+	  if (first_nonopt != last_nonopt && last_nonopt != optind)
+	    exchange ((char **) argv);
+	  else if (first_nonopt == last_nonopt)
+	    first_nonopt = optind;
+	  last_nonopt = argc;
+
+	  optind = argc;
+	}
+
+      /* If we have done all the ARGV-elements, stop the scan
+	 and back over any non-options that we skipped and permuted.  */
+
+      if (optind == argc)
+	{
+	  /* Set the next-arg-index to point at the non-options
+	     that we previously skipped, so the caller will digest them.  */
+	  if (first_nonopt != last_nonopt)
+	    optind = first_nonopt;
+	  return -1;
+	}
+
+      /* If we have come to a non-option and did not permute it,
+	 either stop the scan or describe it to the caller and pass it by.  */
+
+      if (NONOPTION_P)
+	{
+	  if (ordering == REQUIRE_ORDER)
+	    return -1;
+	  optarg = argv[optind++];
+	  return 1;
+	}
+
+      /* We have found another option-ARGV-element.
+	 Skip the initial punctuation.  */
+
+      nextchar = (argv[optind] + 1
+		  + (longopts != NULL && argv[optind][1] == '-'));
+    }
+
+  /* Decode the current option-ARGV-element.  */
+
+  /* Check whether the ARGV-element is a long option.
+
+     If long_only and the ARGV-element has the form "-f", where f is
+     a valid short option, don't consider it an abbreviated form of
+     a long option that starts with f.  Otherwise there would be no
+     way to give the -f short option.
+
+     On the other hand, if there's a long option "fubar" and
+     the ARGV-element is "-fu", do consider that an abbreviation of
+     the long option, just like "--fu", and not "-f" with arg "u".
+
+     This distinction seems to be the most useful approach.  */
+
+  if (longopts != NULL
+      && (argv[optind][1] == '-'
+	  || (long_only && (argv[optind][2] || !my_index (optstring, argv[optind][1])))))
+    {
+      char *nameend;
+      const struct option *p;
+      const struct option *pfound = NULL;
+      int exact = 0;
+      int ambig = 0;
+      int indfound = -1;
+      int option_index;
+
+      for (nameend = nextchar; *nameend && *nameend != '='; nameend++)
+	/* Do nothing.  */ ;
+
+      /* Test all long options for either exact match
+	 or abbreviated matches.  */
+      for (p = longopts, option_index = 0; p->name; p++, option_index++)
+	if (!strncmp (p->name, nextchar, nameend - nextchar))
+	  {
+	    if ((unsigned int) (nameend - nextchar)
+		== (unsigned int) strlen (p->name))
+	      {
+		/* Exact match found.  */
+		pfound = p;
+		indfound = option_index;
+		exact = 1;
+		break;
+	      }
+	    else if (pfound == NULL)
+	      {
+		/* First nonexact match found.  */
+		pfound = p;
+		indfound = option_index;
+	      }
+	    else if (long_only
+		     || pfound->has_arg != p->has_arg
+		     || pfound->flag != p->flag
+		     || pfound->val != p->val)
+	      /* Second or later nonexact match found.  */
+	      ambig = 1;
+	  }
+
+      if (ambig && !exact)
+	{
+	  if (print_errors)
+	    fprintf (stderr, _("%s: option `%s' is ambiguous\n"),
+		     argv[0], argv[optind]);
+	  nextchar += strlen (nextchar);
+	  optind++;
+	  optopt = 0;
+	  return '?';
+	}
+
+      if (pfound != NULL)
+	{
+	  option_index = indfound;
+	  optind++;
+	  if (*nameend)
+	    {
+	      /* Don't test has_arg with >, because some C compilers don't
+		 allow it to be used on enums.  */
+	      if (pfound->has_arg)
+		optarg = nameend + 1;
+	      else
+		{
+		  if (print_errors)
+		    {
+		      if (argv[optind - 1][1] == '-')
+			/* --option */
+			fprintf (stderr,
+				 _("%s: option `--%s' doesn't allow an argument\n"),
+				 argv[0], pfound->name);
+		      else
+			/* +option or -option */
+			fprintf (stderr,
+				 _("%s: option `%c%s' doesn't allow an argument\n"),
+				 argv[0], argv[optind - 1][0], pfound->name);
+		    }
+
+		  nextchar += strlen (nextchar);
+
+		  optopt = pfound->val;
+		  return '?';
+		}
+	    }
+	  else if (pfound->has_arg == 1)
+	    {
+	      if (optind < argc)
+		optarg = argv[optind++];
+	      else
+		{
+		  if (print_errors)
+		    fprintf (stderr,
+			   _("%s: option `%s' requires an argument\n"),
+			   argv[0], argv[optind - 1]);
+		  nextchar += strlen (nextchar);
+		  optopt = pfound->val;
+		  return optstring[0] == ':' ? ':' : '?';
+		}
+	    }
+	  nextchar += strlen (nextchar);
+	  if (longind != NULL)
+	    *longind = option_index;
+	  if (pfound->flag)
+	    {
+	      *(pfound->flag) = pfound->val;
+	      return 0;
+	    }
+	  return pfound->val;
+	}
+
+      /* Can't find it as a long option.  If this is not getopt_long_only,
+	 or the option starts with '--' or is not a valid short
+	 option, then it's an error.
+	 Otherwise interpret it as a short option.  */
+      if (!long_only || argv[optind][1] == '-'
+	  || my_index (optstring, *nextchar) == NULL)
+	{
+	  if (print_errors)
+	    {
+	      if (argv[optind][1] == '-')
+		/* --option */
+		fprintf (stderr, _("%s: unrecognized option `--%s'\n"),
+			 argv[0], nextchar);
+	      else
+		/* +option or -option */
+		fprintf (stderr, _("%s: unrecognized option `%c%s'\n"),
+			 argv[0], argv[optind][0], nextchar);
+	    }
+	  nextchar = (char *) "";
+	  optind++;
+	  optopt = 0;
+	  return '?';
+	}
+    }
+
+  /* Look at and handle the next short option-character.  */
+
+  {
+    char c = *nextchar++;
+    char *temp = my_index (optstring, c);
+
+    /* Increment `optind' when we start to process its last character.  */
+    if (*nextchar == '\0')
+      ++optind;
+
+    if (temp == NULL || c == ':')
+      {
+	if (print_errors)
+	  {
+	    if (posixly_correct)
+	      /* 1003.2 specifies the format of this message.  */
+	      fprintf (stderr, _("%s: illegal option -- %c\n"),
+		       argv[0], c);
+	    else
+	      fprintf (stderr, _("%s: invalid option -- %c\n"),
+		       argv[0], c);
+	  }
+	optopt = c;
+	return '?';
+      }
+    /* Convenience. Treat POSIX -W foo same as long option --foo */
+    if (temp[0] == 'W' && temp[1] == ';')
+      {
+	char *nameend;
+	const struct option *p;
+	const struct option *pfound = NULL;
+	int exact = 0;
+	int ambig = 0;
+	int indfound = 0;
+	int option_index;
+
+	/* This is an option that requires an argument.  */
+	if (*nextchar != '\0')
+	  {
+	    optarg = nextchar;
+	    /* If we end this ARGV-element by taking the rest as an arg,
+	       we must advance to the next element now.  */
+	    optind++;
+	  }
+	else if (optind == argc)
+	  {
+	    if (print_errors)
+	      {
+		/* 1003.2 specifies the format of this message.  */
+		fprintf (stderr, _("%s: option requires an argument -- %c\n"),
+			 argv[0], c);
+	      }
+	    optopt = c;
+	    if (optstring[0] == ':')
+	      c = ':';
+	    else
+	      c = '?';
+	    return c;
+	  }
+	else
+	  /* We already incremented `optind' once;
+	     increment it again when taking next ARGV-elt as argument.  */
+	  optarg = argv[optind++];
+
+	/* optarg is now the argument, see if it's in the
+	   table of longopts.  */
+
+	for (nextchar = nameend = optarg; *nameend && *nameend != '='; nameend++)
+	  /* Do nothing.  */ ;
+
+	/* Test all long options for either exact match
+	   or abbreviated matches.  */
+	for (p = longopts, option_index = 0; p->name; p++, option_index++)
+	  if (!strncmp (p->name, nextchar, nameend - nextchar))
+	    {
+	      if ((unsigned int) (nameend - nextchar) == strlen (p->name))
+		{
+		  /* Exact match found.  */
+		  pfound = p;
+		  indfound = option_index;
+		  exact = 1;
+		  break;
+		}
+	      else if (pfound == NULL)
+		{
+		  /* First nonexact match found.  */
+		  pfound = p;
+		  indfound = option_index;
+		}
+	      else
+		/* Second or later nonexact match found.  */
+		ambig = 1;
+	    }
+	if (ambig && !exact)
+	  {
+	    if (print_errors)
+	      fprintf (stderr, _("%s: option `-W %s' is ambiguous\n"),
+		       argv[0], argv[optind]);
+	    nextchar += strlen (nextchar);
+	    optind++;
+	    return '?';
+	  }
+	if (pfound != NULL)
+	  {
+	    option_index = indfound;
+	    if (*nameend)
+	      {
+		/* Don't test has_arg with >, because some C compilers don't
+		   allow it to be used on enums.  */
+		if (pfound->has_arg)
+		  optarg = nameend + 1;
+		else
+		  {
+		    if (print_errors)
+		      fprintf (stderr, _("\
+%s: option `-W %s' doesn't allow an argument\n"),
+			       argv[0], pfound->name);
+
+		    nextchar += strlen (nextchar);
+		    return '?';
+		  }
+	      }
+	    else if (pfound->has_arg == 1)
+	      {
+		if (optind < argc)
+		  optarg = argv[optind++];
+		else
+		  {
+		    if (print_errors)
+		      fprintf (stderr,
+			       _("%s: option `%s' requires an argument\n"),
+			       argv[0], argv[optind - 1]);
+		    nextchar += strlen (nextchar);
+		    return optstring[0] == ':' ? ':' : '?';
+		  }
+	      }
+	    nextchar += strlen (nextchar);
+	    if (longind != NULL)
+	      *longind = option_index;
+	    if (pfound->flag)
+	      {
+		*(pfound->flag) = pfound->val;
+		return 0;
+	      }
+	    return pfound->val;
+	  }
+	  nextchar = NULL;
+	  return 'W';	/* Let the application handle it.   */
+      }
+    if (temp[1] == ':')
+      {
+	if (temp[2] == ':')
+	  {
+	    /* This is an option that accepts an argument optionally.  */
+	    if (*nextchar != '\0')
+	      {
+		optarg = nextchar;
+		optind++;
+	      }
+	    else
+	      optarg = NULL;
+	    nextchar = NULL;
+	  }
+	else
+	  {
+	    /* This is an option that requires an argument.  */
+	    if (*nextchar != '\0')
+	      {
+		optarg = nextchar;
+		/* If we end this ARGV-element by taking the rest as an arg,
+		   we must advance to the next element now.  */
+		optind++;
+	      }
+	    else if (optind == argc)
+	      {
+		if (print_errors)
+		  {
+		    /* 1003.2 specifies the format of this message.  */
+		    fprintf (stderr,
+			     _("%s: option requires an argument -- %c\n"),
+			     argv[0], c);
+		  }
+		optopt = c;
+		if (optstring[0] == ':')
+		  c = ':';
+		else
+		  c = '?';
+	      }
+	    else
+	      /* We already incremented `optind' once;
+		 increment it again when taking next ARGV-elt as argument.  */
+	      optarg = argv[optind++];
+	    nextchar = NULL;
+	  }
+      }
+    return c;
+  }
+}
+
+int
+getopt (argc, argv, optstring)
+     int argc;
+     char *const *argv;
+     const char *optstring;
+{
+  return _getopt_internal (argc, argv, optstring,
+			   (const struct option *) 0,
+			   (int *) 0,
+			   0);
+}
+
+
+/* getopt_long and getopt_long_only entry points for GNU getopt.
+   Copyright (C) 1987,88,89,90,91,92,93,94,96,97,98
+     Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+
+#if !defined __STDC__ || !__STDC__
+/* This is a separate conditional since some stdc systems
+   reject `defined (const)'.  */
+#ifndef const
+#define const
+#endif
+#endif
+
+/* Comment out all this code if we are using the GNU C Library, and are not
+   actually compiling the library itself.  This code is part of the GNU C
+   Library, but also included in many other GNU distributions.  Compiling
+   and linking in this code is a waste when using the GNU C library
+   (especially if it is a shared library).  Rather than having every GNU
+   program understand `configure --with-gnu-libc' and omit the object files,
+   it is simpler to just do this in the source for each such file.  */
+
+/* gzip (GNU zip) -- compress files with zip algorithm and 'compress' interface
+ * Copyright (C) 1999, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * The unzip code was written and put in the public domain by Mark Adler.
+ * Portions of the lzw code are derived from the public domain 'compress'
+ * written by Spencer Thomas, Joe Orost, James Woods, Jim McKie, Steve Davies,
+ * Ken Turkowski, Dave Mack and Peter Jannesen.
+ *
+ * See the license_msg below and the file COPYING for the software license.
+ * See the file algorithm.doc for the compression algorithms and file formats.
+ */
+
+static char  *license_msg[] = {
+"Copyright 2002 Free Software Foundation",
+"Copyright 1992-1993 Jean-loup Gailly",
+"This program comes with ABSOLUTELY NO WARRANTY.",
+"You may redistribute copies of this program",
+"under the terms of the GNU General Public License.",
+"For more information about these matters, see the file named COPYING.",
+0};
+
+/* Compress files with zip algorithm and 'compress' interface.
+ * See usage() and help() functions below for all options.
+ * Outputs:
+ *        file.gz:   compressed file with same mode, owner, and utimes
+ *     or stdout with -c option or if stdin used as input.
+ * If the output file name had to be truncated, the original name is kept
+ * in the compressed file.
+ * On MSDOS, file.tmp -> file.tmz. On VMS, file.tmp -> file.tmp-gz.
+ *
+ * Using gz on MSDOS would create too many file name conflicts. For
+ * example, foo.txt -> foo.tgz (.tgz must be reserved as shorthand for
+ * tar.gz). Similarly, foo.dir and foo.doc would both be mapped to foo.dgz.
+ * I also considered 12345678.txt -> 12345txt.gz but this truncates the name
+ * too heavily. There is no ideal solution given the MSDOS 8+3 limitation. 
+ *
+ * For the meaning of all compilation flags, see comments in Makefile.in.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: gzip.c,v 0.24 1993/06/24 10:52:07 jloup Exp $";
+#endif
+
+/* revision.h -- define the version number
+ * Copyright (C) 1998, 1999, 2001, 2002 Free Software Foundation, Inc.
+ * Copyright (C) 1992-1993 Jean-loup Gailly.
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+#define PATCHLEVEL 0
+#define REVDATE "2002-09-30"
+
+/* This version does not support compression into old compress format: */
+#ifdef LZW
+#  undef LZW
+#endif
+
+/* $Id: revision.h,v 0.25 1993/06/24 08:29:52 jloup Exp $ */
+
+
+		/* configuration */
+
+#  define NAMLEN(direct) strlen((direct)->d_name)
+#  define DIR_OPT "DIRENT"
+#ifndef NO_DIR
+# define NO_DIR 0
+#endif
+
+#ifdef CLOSEDIR_VOID
+# define CLOSEDIR(d) (closedir(d), 0)
+#else
+# define CLOSEDIR(d) closedir(d)
+#endif
+
+#if !defined(HAVE_LSTAT) && !defined(lstat)
+# define lstat(name, buf) stat(name, buf)
+#endif
+
+#    define TIME_OPT "UTIME"
+
+#if !defined(S_ISDIR) && defined(S_IFDIR)
+#  define S_ISDIR(m) (((m) & S_IFMT) == S_IFDIR)
+#endif
+#if !defined(S_ISREG) && defined(S_IFREG)
+#  define S_ISREG(m) (((m) & S_IFMT) == S_IFREG)
+#endif
+
+typedef RETSIGTYPE (*sig_type) OF((int));
+
+#ifndef	O_BINARY
+#  define  O_BINARY  0  /* creation mode for open() */
+#endif
+
+
+#ifndef S_IRUSR
+#  define S_IRUSR 0400
+#endif
+#ifndef S_IWUSR
+#  define S_IWUSR 0200
+#endif
+#define RW_USER (S_IRUSR | S_IWUSR)  /* creation mode for open() */
+
+#ifndef MAX_PATH_LEN
+#  define MAX_PATH_LEN   1024 /* max pathname length */
+#endif
+
+#ifndef SEEK_END
+#  define SEEK_END 2
+#endif
+
+#ifndef CHAR_BIT
+#  define CHAR_BIT 8
+#endif
+
+#ifdef off_t
+  off_t lseek OF((int fd, off_t offset, int whence));
+#endif
+
+#ifndef OFF_T_MIN
+#define OFF_T_MIN (~ (off_t) 0 << (sizeof (off_t) * CHAR_BIT - 1))
+#endif
+
+#ifndef OFF_T_MAX
+#define OFF_T_MAX (~ (off_t) 0 - OFF_T_MIN)
+#endif
+
+/* Separator for file name parts (see shorten_name()) */
+#ifdef NO_MULTIPLE_DOTS
+#  define PART_SEP "-"
+#else
+#  define PART_SEP "."
+#endif
+
+		/* global buffers */
+
+DECLARE(uch, inbuf,  INBUFSIZ +INBUF_EXTRA);
+DECLARE(uch, outbuf, OUTBUFSIZ+OUTBUF_EXTRA);
+DECLARE(ush, d_buf,  DIST_BUFSIZE);
+DECLARE(uch, window, 2L*WSIZE);
+#ifndef MAXSEG_64K
+    DECLARE(ush, tab_prefix, 1L<<BITS);
+#else
+    DECLARE(ush, tab_prefix0, 1L<<(BITS-1));
+    DECLARE(ush, tab_prefix1, 1L<<(BITS-1));
+#endif
+
+		/* local variables */
+
+int ascii = 0;        /* convert end-of-lines to local OS conventions */
+int to_stdout = 0;    /* output to stdout (-c) */
+int decompress = 0;   /* decompress (-d) */
+int force = 0;        /* don't ask questions, compress links (-f) */
+int no_name = -1;     /* don't save or restore the original file name */
+int no_time = -1;     /* don't save or restore the original file time */
+int recursive = 0;    /* recurse through directories (-r) */
+int list = 0;         /* list the file contents (-l) */
+int verbose = 0;      /* be verbose (-v) */
+int quiet = 0;        /* be very quiet (-q) */
+int do_lzw = 0;       /* generate output compatible with old compress (-Z) */
+int test = 0;         /* test .gz file integrity */
+int foreground;       /* set if program run in foreground */
+char *progname;       /* program name */
+int maxbits = BITS;   /* max bits per code for LZW */
+int method = DEFLATED;/* compression method */
+int level = 6;        /* compression level */
+int exit_code = OK;   /* program exit code */
+int save_orig_name;   /* set if original name must be saved */
+int last_member;      /* set for .zip and .Z files */
+int part_nb;          /* number of parts in .gz file */
+time_t time_stamp;      /* original time stamp (modification time) */
+off_t ifile_size;      /* input file size, -1 for devices (debug only) */
+char *env;            /* contents of GZIP env variable */
+char **args = NULL;   /* argv pointer if GZIP env variable defined */
+char *z_suffix;       /* default suffix (can be set with --suffix) */
+size_t z_len;         /* strlen(z_suffix) */
+
+off_t bytes_in;             /* number of input bytes */
+off_t bytes_out;            /* number of output bytes */
+off_t total_in;		    /* input bytes for all files */
+off_t total_out;	    /* output bytes for all files */
+char ifname[MAX_PATH_LEN]; /* input file name */
+char ofname[MAX_PATH_LEN]; /* output file name */
+int  remove_ofname = 0;	   /* remove output file on error */
+struct stat istat;         /* status for input file */
+int  ifd;                  /* input file descriptor */
+int  ofd;                  /* output file descriptor */
+unsigned insize;           /* valid bytes in inbuf */
+unsigned inptr;            /* index of next byte to be processed in inbuf */
+unsigned outcnt;           /* bytes in output buffer */
+int rsync = 0;             /* make ryncable chunks */
+
+struct option longopts[] =
+{
+ /* { name  has_arg  *flag  val } */
+    {"ascii",      0, 0, 'a'}, /* ascii text mode */
+    {"to-stdout",  0, 0, 'c'}, /* write output on standard output */
+    {"stdout",     0, 0, 'c'}, /* write output on standard output */
+    {"decompress", 0, 0, 'd'}, /* decompress */
+    {"uncompress", 0, 0, 'd'}, /* decompress */
+ /* {"encrypt",    0, 0, 'e'},    encrypt */
+    {"force",      0, 0, 'f'}, /* force overwrite of output file */
+    {"help",       0, 0, 'h'}, /* give help */
+ /* {"pkzip",      0, 0, 'k'},    force output in pkzip format */
+    {"list",       0, 0, 'l'}, /* list .gz file contents */
+    {"license",    0, 0, 'L'}, /* display software license */
+    {"no-name",    0, 0, 'n'}, /* don't save or restore original name & time */
+    {"name",       0, 0, 'N'}, /* save or restore original name & time */
+    {"quiet",      0, 0, 'q'}, /* quiet mode */
+    {"silent",     0, 0, 'q'}, /* quiet mode */
+    {"recursive",  0, 0, 'r'}, /* recurse through directories */
+    {"suffix",     1, 0, 'S'}, /* use given suffix instead of .gz */
+    {"test",       0, 0, 't'}, /* test compressed file integrity */
+    {"no-time",    0, 0, 'T'}, /* don't save or restore the time stamp */
+    {"verbose",    0, 0, 'v'}, /* verbose mode */
+    {"version",    0, 0, 'V'}, /* display version number */
+    {"fast",       0, 0, '1'}, /* compress faster */
+    {"best",       0, 0, '9'}, /* compress better */
+    {"lzw",        0, 0, 'Z'}, /* make output compatible with old compress */
+    {"bits",       1, 0, 'b'}, /* max number of bits per code (implies -Z) */
+    {"rsyncable",  0, 0, 'R'}, /* make rsync-friendly archive */
+    { 0, 0, 0, 0 }
+};
+
+/* local functions */
+
+local void usage        OF((void));
+local void help         OF((void));
+local void license      OF((void));
+local void version      OF((void));
+local int input_eof	OF((void));
+local void treat_stdin  OF((void));
+local void treat_file   OF((char *iname));
+local int create_outfile OF((void));
+local int  do_stat      OF((char *name, struct stat *sbuf));
+local char *get_suffix  OF((char *name));
+local int  get_istat    OF((char *iname, struct stat *sbuf));
+local int  make_ofname  OF((void));
+local int  same_file    OF((struct stat *stat1, struct stat *stat2));
+local int name_too_long OF((char *name, struct stat *statb));
+local void shorten_name  OF((char *name));
+local int  get_method   OF((int in));
+local void do_list      OF((int ifd, int method));
+local int  check_ofname OF((void));
+local void copy_stat    OF((struct stat *ifstat));
+local void do_exit      OF((int exitcode));
+      int main          OF((int argc, char **argv));
+int (*work) OF((int infile, int outfile)) = zip; /* function to call */
+
+#if ! NO_DIR
+local void treat_dir    OF((char *dir));
+#endif
+#ifdef HAVE_UTIME
+local void reset_times  OF((char *name, struct stat *statb));
+#endif
+
+#define strequ(s1, s2) (strcmp((s1),(s2)) == 0)
+
+/* ======================================================================== */
+local void usage()
+{
+    printf ("usage: %s [-%scdfhlLnN%stvV19] [-S suffix] [file ...]\n",
+	    progname,
+	    O_BINARY ? "a" : "", NO_DIR ? "" : "r");
+}
+
+/* ======================================================================== */
+local void help()
+{
+    static char  *help_msg[] = {
+#if O_BINARY
+ " -a --ascii       ascii text; convert end-of-lines using local conventions",
+#endif
+ " -c --stdout      write on standard output, keep original files unchanged",
+ " -d --decompress  decompress",
+/* -e --encrypt     encrypt */
+ " -f --force       force overwrite of output file and compress links",
+ " -h --help        give this help",
+/* -k --pkzip       force output in pkzip format */
+ " -l --list        list compressed file contents",
+ " -L --license     display software license",
+#ifdef UNDOCUMENTED
+ " -m --no-time     do not save or restore the original modification time",
+ " -M --time        save or restore the original modification time",
+#endif
+ " -n --no-name     do not save or restore the original name and time stamp",
+ " -N --name        save or restore the original name and time stamp",
+ " -q --quiet       suppress all warnings",
+#if ! NO_DIR
+ " -r --recursive   operate recursively on directories",
+#endif
+ " -S .suf  --suffix .suf     use suffix .suf on compressed files",
+ " -t --test        test compressed file integrity",
+ " -v --verbose     verbose mode",
+ " -V --version     display version number",
+ " -1 --fast        compress faster",
+ " -9 --best        compress better",
+#ifdef LZW
+ " -Z --lzw         produce output compatible with old compress",
+ " -b --bits maxbits   max number of bits per code (implies -Z)",
+#endif
+ "    --rsyncable   Make rsync-friendly archive",
+ " file...          files to (de)compress. If none given, use standard input.",
+ "Report bugs to <bug-gzip@gnu.org>.",
+  0};
+    char **p = help_msg;
+
+    printf ("%s %s\n(%s)\n", progname, VERSION, REVDATE);
+    usage();
+    while (*p) printf ("%s\n", *p++);
+}
+
+/* ======================================================================== */
+local void license()
+{
+    char **p = license_msg;
+
+    printf ("%s %s\n(%s)\n", progname, VERSION, REVDATE);
+    while (*p) printf ("%s\n", *p++);
+}
+
+/* ======================================================================== */
+local void version()
+{
+    license ();
+    printf ("Compilation options:\n%s %s ", DIR_OPT, TIME_OPT);
+#ifdef STDC_HEADERS
+    printf ("STDC_HEADERS ");
+#endif
+#ifdef HAVE_UNISTD_H
+    printf ("HAVE_UNISTD_H ");
+#endif
+#ifdef HAVE_MEMORY_H
+    printf ("HAVE_MEMORY_H ");
+#endif
+#ifdef HAVE_STRING_H
+    printf ("HAVE_STRING_H ");
+#endif
+#ifdef HAVE_LSTAT
+    printf ("HAVE_LSTAT ");
+#endif
+#ifdef NO_MULTIPLE_DOTS
+    printf ("NO_MULTIPLE_DOTS ");
+#endif
+#ifdef HAVE_CHOWN
+    printf ("HAVE_CHOWN ");
+#endif
+#ifdef PROTO
+    printf ("PROTO ");
+#endif
+#ifdef ASMV
+    printf ("ASMV ");
+#endif
+#ifdef DEBUG
+    printf ("DEBUG ");
+#endif
+#ifdef DYN_ALLOC
+    printf ("DYN_ALLOC ");
+#endif
+#ifdef MAXSEG_64K
+    printf ("MAXSEG_64K");
+#endif
+    printf ("\n");
+    printf ("Written by Jean-loup Gailly.\n");
+}
+
+local void progerror (string)
+    char *string;
+{
+    int e = errno;
+    fprintf(stderr, "%s: ", progname);
+    errno = e;
+    perror(string);
+    exit_code = ERROR;
+}
+
+/* ======================================================================== */
+int main (argc, argv)
+    int argc;
+    char **argv;
+{
+    int file_count;     /* number of files to precess */
+    int proglen;        /* length of progname */
+    int optc;           /* current option */
+
+    EXPAND(argc, argv); /* wild card expansion if necessary */
+
+    progname = base_name (argv[0]);
+    proglen = strlen(progname);
+
+    /* Suppress .exe for MSDOS, OS/2 and VMS: */
+    if (proglen > 4 && strequ(progname+proglen-4, ".exe")) {
+        progname[proglen-4] = '\0';
+    }
+
+    /* Add options in GZIP environment variable if there is one */
+    env = add_envopt(&argc, &argv, OPTIONS_VAR);
+    if (env != NULL) args = argv;
+
+    foreground = signal(SIGINT, SIG_IGN) != SIG_IGN;
+    if (foreground) {
+	(void) signal (SIGINT, (sig_type)abort_gzip_signal);
+    }
+#ifdef SIGTERM
+    if (signal(SIGTERM, SIG_IGN) != SIG_IGN) {
+	(void) signal(SIGTERM, (sig_type)abort_gzip_signal);
+    }
+#endif
+#ifdef SIGHUP
+    if (signal(SIGHUP, SIG_IGN) != SIG_IGN) {
+	(void) signal(SIGHUP,  (sig_type)abort_gzip_signal);
+    }
+#endif
+
+#ifndef GNU_STANDARD
+    /* For compatibility with old compress, use program name as an option.
+     * If you compile with -DGNU_STANDARD, this program will behave as
+     * gzip even if it is invoked under the name gunzip or zcat.
+     *
+     * Systems which do not support links can still use -d or -dc.
+     * Ignore an .exe extension for MSDOS, OS/2 and VMS.
+     */
+    if (  strncmp(progname, "un",  2) == 0     /* ungzip, uncompress */
+       || strncmp(progname, "gun", 3) == 0) {  /* gunzip */
+	decompress = 1;
+    } else if (strequ(progname+1, "cat")       /* zcat, pcat, gcat */
+	    || strequ(progname, "gzcat")) {    /* gzcat */
+	decompress = to_stdout = 1;
+    }
+#endif
+
+    z_suffix = Z_SUFFIX;
+    z_len = strlen(z_suffix);
+
+    while ((optc = getopt_long (argc, argv, "ab:cdfhH?lLmMnNqrS:tvVZ123456789",
+				longopts, (int *)0)) != -1) {
+	switch (optc) {
+        case 'a':
+            ascii = 1; break;
+	case 'b':
+	    maxbits = atoi(optarg);
+	    for (; *optarg; optarg++)
+	      if (! ('0' <= *optarg && *optarg <= '9'))
+		{
+		  fprintf (stderr, "%s: -b operand is not an integer\n",
+			   progname);
+		  usage ();
+		  do_exit (ERROR);
+		}
+	    break;
+	case 'c':
+	    to_stdout = 1; break;
+	case 'd':
+	    decompress = 1; break;
+	case 'f':
+	    force++; break;
+	case 'h': case 'H': case '?':
+	    help(); do_exit(OK); break;
+	case 'l':
+	    list = decompress = to_stdout = 1; break;
+	case 'L':
+	    license(); do_exit(OK); break;
+	case 'm': /* undocumented, may change later */
+	    no_time = 1; break;
+	case 'M': /* undocumented, may change later */
+	    no_time = 0; break;
+	case 'n':
+	    no_name = no_time = 1; break;
+	case 'N':
+	    no_name = no_time = 0; break;
+	case 'q':
+	    quiet = 1; verbose = 0; break;
+	case 'r':
+#if NO_DIR
+	    fprintf(stderr, "%s: -r not supported on this system\n", progname);
+	    usage();
+	    do_exit(ERROR); break;
+#else
+	    recursive = 1; break;
+#endif
+	case 'R':
+	    rsync = 1; break;
+
+	case 'S':
+#ifdef NO_MULTIPLE_DOTS
+            if (*optarg == '.') optarg++;
+#endif
+            z_len = strlen(optarg);
+	    z_suffix = optarg;
+            break;
+	case 't':
+	    test = decompress = to_stdout = 1;
+	    break;
+	case 'v':
+	    verbose++; quiet = 0; break;
+	case 'V':
+	    version(); do_exit(OK); break;
+	case 'Z':
+#ifdef LZW
+	    do_lzw = 1; break;
+#else
+	    fprintf(stderr, "%s: -Z not supported in this version\n",
+		    progname);
+	    usage();
+	    do_exit(ERROR); break;
+#endif
+	case '1':  case '2':  case '3':  case '4':
+	case '5':  case '6':  case '7':  case '8':  case '9':
+	    level = optc - '0';
+	    break;
+	default:
+	    /* Error message already emitted by getopt_long. */
+	    usage();
+	    do_exit(ERROR);
+	}
+    } /* loop on all arguments */
+
+#ifdef SIGPIPE
+    /* Ignore "Broken Pipe" message with --quiet */
+    if (quiet && signal (SIGPIPE, SIG_IGN) != SIG_IGN)
+      signal (SIGPIPE, (sig_type) abort_gzip_signal);
+#endif
+
+    /* By default, save name and timestamp on compression but do not
+     * restore them on decompression.
+     */
+    if (no_time < 0) no_time = decompress;
+    if (no_name < 0) no_name = decompress;
+
+    file_count = argc - optind;
+
+#if O_BINARY
+#else
+    if (ascii && !quiet) {
+	fprintf(stderr, "%s: option --ascii ignored on this system\n",
+		progname);
+    }
+#endif
+    if ((z_len == 0 && !decompress) || z_len > MAX_SUFFIX) {
+        fprintf(stderr, "%s: incorrect suffix '%s'\n",
+                progname, z_suffix);
+        do_exit(ERROR);
+    }
+    if (do_lzw && !decompress) work = lzw;
+
+    /* Allocate all global buffers (for DYN_ALLOC option) */
+    ALLOC(uch, inbuf,  INBUFSIZ +INBUF_EXTRA);
+    ALLOC(uch, outbuf, OUTBUFSIZ+OUTBUF_EXTRA);
+    ALLOC(ush, d_buf,  DIST_BUFSIZE);
+    ALLOC(uch, window, 2L*WSIZE);
+#ifndef MAXSEG_64K
+    ALLOC(ush, tab_prefix, 1L<<BITS);
+#else
+    ALLOC(ush, tab_prefix0, 1L<<(BITS-1));
+    ALLOC(ush, tab_prefix1, 1L<<(BITS-1));
+#endif
+
+    /* And get to work */
+    if (file_count != 0) {
+	if (to_stdout && !test && !list && (!decompress || !ascii)) {
+	    SET_BINARY_MODE(fileno(stdout));
+	}
+        while (optind < argc) {
+	    treat_file(argv[optind++]);
+	}
+    } else {  /* Standard input */
+	treat_stdin();
+    }
+    if (list && !quiet && file_count > 1) {
+	do_list(-1, -1); /* print totals */
+    }
+    do_exit(exit_code);
+    return exit_code; /* just to avoid lint warning */
+}
+
+/* Return nonzero when at end of file on input.  */
+local int
+input_eof ()
+{
+  if (!decompress || last_member)
+    return 1;
+
+  if (inptr == insize)
+    {
+      if (insize != INBUFSIZ || fill_inbuf (1) == EOF)
+	return 1;
+
+      /* Unget the char that fill_inbuf got.  */
+      inptr = 0;
+    }
+
+  return 0;
+}
+
+/* ========================================================================
+ * Compress or decompress stdin
+ */
+local void treat_stdin()
+{
+    if (!force && !list &&
+	isatty(fileno((FILE *)(decompress ? stdin : stdout)))) {
+	/* Do not send compressed data to the terminal or read it from
+	 * the terminal. We get here when user invoked the program
+	 * without parameters, so be helpful. According to the GNU standards:
+	 *
+	 *   If there is one behavior you think is most useful when the output
+	 *   is to a terminal, and another that you think is most useful when
+	 *   the output is a file or a pipe, then it is usually best to make
+	 *   the default behavior the one that is useful with output to a
+	 *   terminal, and have an option for the other behavior.
+	 *
+	 * Here we use the --force option to get the other behavior.
+	 */
+	fprintf(stderr,
+    "%s: compressed data not %s a terminal. Use -f to force %scompression.\n",
+		progname, decompress ? "read from" : "written to",
+		decompress ? "de" : "");
+	fprintf(stderr,"For help, type: %s -h\n", progname);
+	do_exit(ERROR);
+    }
+
+    if (decompress || !ascii) {
+	SET_BINARY_MODE(fileno(stdin));
+    }
+    if (!test && !list && (!decompress || !ascii)) {
+	SET_BINARY_MODE(fileno(stdout));
+    }
+    strcpy(ifname, "stdin");
+    strcpy(ofname, "stdout");
+
+    /* Get the time stamp on the input file. */
+    time_stamp = 0; /* time unknown by default */
+
+#ifndef NO_STDIN_FSTAT
+    if (list || !no_time) {
+	if (fstat(fileno(stdin), &istat) != 0) {
+	    progerror("standard input");
+	    do_exit(ERROR);
+	}
+# ifdef NO_PIPE_TIMESTAMP
+	if (S_ISREG(istat.st_mode))
+# endif
+	    time_stamp = istat.st_mtime;
+#endif /* NO_STDIN_FSTAT */
+    }
+    ifile_size = -1L; /* convention for unknown size */
+
+    clear_bufs(); /* clear input and output buffers */
+    to_stdout = 1;
+    part_nb = 0;
+
+    if (decompress) {
+	method = get_method(ifd);
+	if (method < 0) {
+	    do_exit(exit_code); /* error message already emitted */
+	}
+    }
+    if (list) {
+        do_list(ifd, method);
+        return;
+    }
+
+    /* Actually do the compression/decompression. Loop over zipped members.
+     */
+    for (;;) {
+	if ((*work)(fileno(stdin), fileno(stdout)) != OK) return;
+
+	if (input_eof ())
+	  break;
+
+	method = get_method(ifd);
+	if (method < 0) return; /* error message already emitted */
+	bytes_out = 0;            /* required for length check */
+    }
+
+    if (verbose) {
+	if (test) {
+	    fprintf(stderr, " OK\n");
+
+	} else if (!decompress) {
+	    display_ratio(bytes_in-(bytes_out-header_bytes), bytes_in, stderr);
+	    fprintf(stderr, "\n");
+#ifdef DISPLAY_STDIN_RATIO
+	} else {
+	    display_ratio(bytes_out-(bytes_in-header_bytes), bytes_out,stderr);
+	    fprintf(stderr, "\n");
+#endif
+	}
+    }
+}
+
+/* ========================================================================
+ * Compress or decompress the given file
+ */
+local void treat_file(iname)
+    char *iname;
+{
+    /* Accept "-" as synonym for stdin */
+    if (strequ(iname, "-")) {
+	int cflag = to_stdout;
+	treat_stdin();
+	to_stdout = cflag;
+	return;
+    }
+
+    /* Check if the input file is present, set ifname and istat: */
+    if (get_istat(iname, &istat) != OK) return;
+
+    /* If the input name is that of a directory, recurse or ignore: */
+    if (S_ISDIR(istat.st_mode)) {
+#if ! NO_DIR
+	if (recursive) {
+	    struct stat st;
+	    st = istat;
+	    treat_dir(iname);
+	    /* Warning: ifname is now garbage */
+#  ifndef NO_UTIME
+	    reset_times (iname, &st);
+#  endif
+	} else
+#endif
+	WARN((stderr,"%s: %s is a directory -- ignored\n", progname, ifname));
+	return;
+    }
+    if (!S_ISREG(istat.st_mode)) {
+	WARN((stderr,
+	      "%s: %s is not a directory or a regular file - ignored\n",
+	      progname, ifname));
+	return;
+    }
+    if (istat.st_nlink > 1 && !to_stdout && !force) {
+	WARN((stderr, "%s: %s has %lu other link%c -- unchanged\n",
+	      progname, ifname, (unsigned long) istat.st_nlink - 1,
+	      istat.st_nlink > 2 ? 's' : ' '));
+	return;
+    }
+
+    ifile_size = istat.st_size;
+    time_stamp = no_time && !list ? 0 : istat.st_mtime;
+
+    /* Generate output file name. For -r and (-t or -l), skip files
+     * without a valid gzip suffix (check done in make_ofname).
+     */
+    if (to_stdout && !list && !test) {
+	strcpy(ofname, "stdout");
+
+    } else if (make_ofname() != OK) {
+	return;
+    }
+
+    /* Open the input file and determine compression method. The mode
+     * parameter is ignored but required by some systems (VMS) and forbidden
+     * on other systems (MacOS).
+     */
+    ifd = OPEN(ifname, ascii && !decompress ? O_RDONLY : O_RDONLY | O_BINARY,
+	       RW_USER);
+    if (ifd == -1) {
+	progerror(ifname);
+	return;
+    }
+    clear_bufs(); /* clear input and output buffers */
+    part_nb = 0;
+
+    if (decompress) {
+	method = get_method(ifd); /* updates ofname if original given */
+	if (method < 0) {
+	    close(ifd);
+	    return;               /* error message already emitted */
+	}
+    }
+    if (list) {
+        do_list(ifd, method);
+        close(ifd);
+        return;
+    }
+
+    /* If compressing to a file, check if ofname is not ambiguous
+     * because the operating system truncates names. Otherwise, generate
+     * a new ofname and save the original name in the compressed file.
+     */
+    if (to_stdout) {
+	ofd = fileno(stdout);
+	/* keep remove_ofname as zero */
+    } else {
+	if (create_outfile() != OK) return;
+
+	if (!decompress && save_orig_name && !verbose && !quiet) {
+	    fprintf(stderr, "%s: %s compressed to %s\n",
+		    progname, ifname, ofname);
+	}
+    }
+    /* Keep the name even if not truncated except with --no-name: */
+    if (!save_orig_name) save_orig_name = !no_name;
+
+    if (verbose) {
+	fprintf(stderr, "%s:\t", ifname);
+    }
+
+    /* Actually do the compression/decompression. Loop over zipped members.
+     */
+    for (;;) {
+	if ((*work)(ifd, ofd) != OK) {
+	    method = -1; /* force cleanup */
+	    break;
+	}
+
+	if (input_eof ())
+	  break;
+
+	method = get_method(ifd);
+	if (method < 0) break;    /* error message already emitted */
+	bytes_out = 0;            /* required for length check */
+    }
+
+    close(ifd);
+    if (!to_stdout) {
+         /* Copy modes, times, ownership, and remove the input file */
+         copy_stat(&istat);
+         if (close(ofd))
+            write_error();
+    }
+    if (method == -1) {
+	if (!to_stdout) xunlink (ofname);
+	return;
+    }
+    /* Display statistics */
+    if(verbose) {
+	if (test) {
+	    fprintf(stderr, " OK");
+	} else if (decompress) {
+	    display_ratio(bytes_out-(bytes_in-header_bytes), bytes_out,stderr);
+	} else {
+	    display_ratio(bytes_in-(bytes_out-header_bytes), bytes_in, stderr);
+	}
+	if (!test && !to_stdout) {
+	    fprintf(stderr, " -- replaced with %s", ofname);
+	}
+	fprintf(stderr, "\n");
+    }
+}
+
+/* ========================================================================
+ * Create the output file. Return OK or ERROR.
+ * Try several times if necessary to avoid truncating the z_suffix. For
+ * example, do not create a compressed file of name "1234567890123."
+ * Sets save_orig_name to true if the file name has been truncated.
+ * IN assertions: the input file has already been open (ifd is set) and
+ *   ofname has already been updated if there was an original name.
+ * OUT assertions: ifd and ofd are closed in case of error.
+ */
+local int create_outfile()
+{
+    struct stat	ostat; /* stat for ofname */
+    int flags = O_WRONLY | O_CREAT | O_EXCL | O_BINARY;
+
+    if (ascii && decompress) {
+	flags &= ~O_BINARY; /* force ascii text mode */
+    }
+    for (;;) {
+	/* Make sure that ofname is not an existing file */
+	if (check_ofname() != OK) {
+	    close(ifd);
+	    return ERROR;
+	}
+	/* Create the output file */
+	remove_ofname = 1;
+	ofd = OPEN(ofname, flags, RW_USER);
+	if (ofd == -1) {
+	    progerror(ofname);
+	    close(ifd);
+	    return ERROR;
+	}
+
+	/* Check for name truncation on new file (1234567890123.gz) */
+#ifdef NO_FSTAT
+	if (stat(ofname, &ostat) != 0) {
+#else
+	if (fstat(ofd, &ostat) != 0) {
+#endif
+	    progerror(ofname);
+	    close(ifd); close(ofd);
+	    xunlink (ofname);
+	    return ERROR;
+	}
+	if (!name_too_long(ofname, &ostat)) return OK;
+
+	if (decompress) {
+	    /* name might be too long if an original name was saved */
+	    WARN((stderr, "%s: %s: warning, name truncated\n",
+		  progname, ofname));
+	    return OK;
+	}
+	close(ofd);
+	xunlink (ofname);
+#ifdef NO_MULTIPLE_DOTS
+	/* Should never happen, see check_ofname() */
+	fprintf(stderr, "%s: %s: name too long\n", progname, ofname);
+	do_exit(ERROR);
+#endif
+	shorten_name(ofname);
+    }
+}
+
+/* ========================================================================
+ * Use lstat if available, except for -c or -f. Use stat otherwise.
+ * This allows links when not removing the original file.
+ */
+local int do_stat(name, sbuf)
+    char *name;
+    struct stat *sbuf;
+{
+    errno = 0;
+    if (!to_stdout && !force) {
+	return lstat(name, sbuf);
+    }
+    return stat(name, sbuf);
+}
+
+/* ========================================================================
+ * Return a pointer to the 'z' suffix of a file name, or NULL. For all
+ * systems, ".gz", ".z", ".Z", ".taz", ".tgz", "-gz", "-z" and "_z" are
+ * accepted suffixes, in addition to the value of the --suffix option.
+ * ".tgz" is a useful convention for tar.z files on systems limited
+ * to 3 characters extensions. On such systems, ".?z" and ".??z" are
+ * also accepted suffixes. For Unix, we do not want to accept any
+ * .??z suffix as indicating a compressed file; some people use .xyz
+ * to denote volume data.
+ *   On systems allowing multiple versions of the same file (such as VMS),
+ * this function removes any version suffix in the given name.
+ */
+local char *get_suffix(name)
+    char *name;
+{
+    int nlen, slen;
+    char suffix[MAX_SUFFIX+3]; /* last chars of name, forced to lower case */
+    static char *known_suffixes[] =
+       {NULL, ".gz", ".z", ".taz", ".tgz", "-gz", "-z", "_z",
+#ifdef MAX_EXT_CHARS
+          "z",
+#endif
+          NULL};
+    char **suf = known_suffixes;
+
+    *suf = z_suffix;
+    if (strequ(z_suffix, "z")) suf++; /* check long suffixes first */
+
+#ifdef SUFFIX_SEP
+    /* strip a version number from the file name */
+    {
+	char *v = strrchr(name, SUFFIX_SEP);
+ 	if (v != NULL) *v = '\0';
+    }
+#endif
+    nlen = strlen(name);
+    if (nlen <= MAX_SUFFIX+2) {
+        strcpy(suffix, name);
+    } else {
+        strcpy(suffix, name+nlen-MAX_SUFFIX-2);
+    }
+    strlwr(suffix);
+    slen = strlen(suffix);
+    do {
+       int s = strlen(*suf);
+       if (slen > s && suffix[slen-s-1] != PATH_SEP
+           && strequ(suffix + slen - s, *suf)) {
+           return name+nlen-s;
+       }
+    } while (*++suf != NULL);
+
+    return NULL;
+}
+
+
+/* ========================================================================
+ * Set ifname to the input file name (with a suffix appended if necessary)
+ * and istat to its stats. For decompression, if no file exists with the
+ * original name, try adding successively z_suffix, .gz, .z, -z and .Z.
+ * For MSDOS, we try only z_suffix and z.
+ * Return OK or ERROR.
+ */
+local int get_istat(iname, sbuf)
+    char *iname;
+    struct stat *sbuf;
+{
+    int ilen;  /* strlen(ifname) */
+    int z_suffix_errno = 0;
+    static char *suffixes[] = {NULL, ".gz", ".z", "-z", ".Z", NULL};
+    char **suf = suffixes;
+    char *s;
+#ifdef NO_MULTIPLE_DOTS
+    char *dot; /* pointer to ifname extension, or NULL */
+#endif
+
+    *suf = z_suffix;
+
+    if (sizeof ifname - 1 <= strlen (iname))
+	goto name_too_long;
+
+    strcpy(ifname, iname);
+
+    /* If input file exists, return OK. */
+    if (do_stat(ifname, sbuf) == 0) return OK;
+
+    if (!decompress || errno != ENOENT) {
+	progerror(ifname);
+	return ERROR;
+    }
+    /* file.ext doesn't exist, try adding a suffix (after removing any
+     * version number for VMS).
+     */
+    s = get_suffix(ifname);
+    if (s != NULL) {
+	progerror(ifname); /* ifname already has z suffix and does not exist */
+	return ERROR;
+    }
+#ifdef NO_MULTIPLE_DOTS
+    dot = strrchr(ifname, '.');
+    if (dot == NULL) {
+        strcat(ifname, ".");
+        dot = strrchr(ifname, '.');
+    }
+#endif
+    ilen = strlen(ifname);
+    if (strequ(z_suffix, ".gz")) suf++;
+
+    /* Search for all suffixes */
+    do {
+        char *s0 = s = *suf;
+        strcpy (ifname, iname);
+#ifdef NO_MULTIPLE_DOTS
+        if (*s == '.') s++;
+        if (*dot == '\0') strcpy (dot, ".");
+#endif
+#ifdef MAX_EXT_CHARS
+	if (MAX_EXT_CHARS < strlen (s) + strlen (dot + 1))
+	  dot[MAX_EXT_CHARS + 1 - strlen (s)] = '\0';
+#endif
+	if (sizeof ifname <= ilen + strlen (s))
+	  goto name_too_long;
+        strcat(ifname, s);
+        if (do_stat(ifname, sbuf) == 0) return OK;
+	if (strequ (s0, z_suffix))
+	  z_suffix_errno = errno;
+    } while (*++suf != NULL);
+
+    /* No suffix found, complain using z_suffix: */
+    strcpy(ifname, iname);
+#ifdef NO_MULTIPLE_DOTS
+    if (*dot == '\0') strcpy(dot, ".");
+#endif
+#ifdef MAX_EXT_CHARS
+    if (MAX_EXT_CHARS < z_len + strlen (dot + 1))
+      dot[MAX_EXT_CHARS + 1 - z_len] = '\0';
+#endif
+    strcat(ifname, z_suffix);
+    errno = z_suffix_errno;
+    progerror(ifname);
+    return ERROR;
+      
+ name_too_long:
+    fprintf (stderr, "%s: %s: file name too long\n", progname, iname);
+    exit_code = ERROR;
+    return ERROR;
+}
+
+/* ========================================================================
+ * Generate ofname given ifname. Return OK, or WARNING if file must be skipped.
+ * Sets save_orig_name to true if the file name has been truncated.
+ */
+local int make_ofname()
+{
+    char *suff;            /* ofname z suffix */
+
+    strcpy(ofname, ifname);
+    /* strip a version number if any and get the gzip suffix if present: */
+    suff = get_suffix(ofname);
+
+    if (decompress) {
+	if (suff == NULL) {
+	    /* With -t or -l, try all files (even without .gz suffix)
+	     * except with -r (behave as with just -dr).
+             */
+            if (!recursive && (list || test)) return OK;
+
+	    /* Avoid annoying messages with -r */
+	    if (verbose || (!recursive && !quiet)) {
+		WARN((stderr,"%s: %s: unknown suffix -- ignored\n",
+		      progname, ifname));
+	    }
+	    return WARNING;
+	}
+	/* Make a special case for .tgz and .taz: */
+	strlwr(suff);
+	if (strequ(suff, ".tgz") || strequ(suff, ".taz")) {
+	    strcpy(suff, ".tar");
+	} else {
+	    *suff = '\0'; /* strip the z suffix */
+	}
+        /* ofname might be changed later if infile contains an original name */
+
+    } else if (suff != NULL) {
+	/* Avoid annoying messages with -r (see treat_dir()) */
+	if (verbose || (!recursive && !quiet)) {
+	    /* don't use WARN -- it will cause an exit_code of 2 */
+	    fprintf(stderr, "%s: %s already has %s suffix -- unchanged\n",
+		  progname, ifname, suff);
+	}
+	return WARNING;
+    } else {
+        save_orig_name = 0;
+
+#ifdef NO_MULTIPLE_DOTS
+	suff = strrchr(ofname, '.');
+	if (suff == NULL) {
+	    if (sizeof ofname <= strlen (ofname) + 1)
+		goto name_too_long;
+            strcat(ofname, ".");
+#  ifdef MAX_EXT_CHARS
+	    if (strequ(z_suffix, "z")) {
+		if (sizeof ofname <= strlen (ofname) + 2)
+		    goto name_too_long;
+		strcat(ofname, "gz"); /* enough room */
+		return OK;
+	    }
+        /* On the Atari and some versions of MSDOS, name_too_long()
+         * does not work correctly because of a bug in stat(). So we
+         * must truncate here.
+         */
+        } else if (strlen(suff)-1 + z_len > MAX_SUFFIX) {
+            suff[MAX_SUFFIX+1-z_len] = '\0';
+            save_orig_name = 1;
+#  endif
+        }
+#endif /* NO_MULTIPLE_DOTS */
+	if (sizeof ofname <= strlen (ofname) + z_len)
+	    goto name_too_long;
+	strcat(ofname, z_suffix);
+
+    } /* decompress ? */
+    return OK;
+
+ name_too_long:
+    WARN ((stderr, "%s: %s: file name too long\n", progname, ifname));
+    return WARNING;
+}
+
+
+/* ========================================================================
+ * Check the magic number of the input file and update ofname if an
+ * original name was given and to_stdout is not set.
+ * Return the compression method, -1 for error, -2 for warning.
+ * Set inptr to the offset of the next byte to be processed.
+ * Updates time_stamp if there is one and --no-time is not used.
+ * This function may be called repeatedly for an input file consisting
+ * of several contiguous gzip'ed members.
+ * IN assertions: there is at least one remaining compressed member.
+ *   If the member is a zip file, it must be the only one.
+ */
+local int get_method(in)
+    int in;        /* input file descriptor */
+{
+    uch flags;     /* compression flags */
+    char magic[2]; /* magic header */
+    int imagic1;   /* like magic[1], but can represent EOF */
+    ulg stamp;     /* time stamp */
+
+    /* If --force and --stdout, zcat == cat, so do not complain about
+     * premature end of file: use try_byte instead of get_byte.
+     */
+    if (force && to_stdout) {
+	magic[0] = (char)try_byte();
+	imagic1 = try_byte ();
+	magic[1] = (char) imagic1;
+	/* If try_byte returned EOF, magic[1] == (char) EOF.  */
+    } else {
+	magic[0] = (char)get_byte();
+	magic[1] = (char)get_byte();
+	imagic1 = 0; /* avoid lint warning */
+    }
+    method = -1;                 /* unknown yet */
+    part_nb++;                   /* number of parts in gzip file */
+    header_bytes = 0;
+    last_member = RECORD_IO;
+    /* assume multiple members in gzip file except for record oriented I/O */
+
+    if (memcmp(magic, GZIP_MAGIC, 2) == 0
+        || memcmp(magic, OLD_GZIP_MAGIC, 2) == 0) {
+
+	method = (int)get_byte();
+	if (method != DEFLATED) {
+	    fprintf(stderr,
+		    "%s: %s: unknown method %d -- not supported\n",
+		    progname, ifname, method);
+	    exit_code = ERROR;
+	    return -1;
+	}
+	work = unzip;
+	flags  = (uch)get_byte();
+
+	if ((flags & ENCRYPTED) != 0) {
+	    fprintf(stderr,
+		    "%s: %s is encrypted -- not supported\n",
+		    progname, ifname);
+	    exit_code = ERROR;
+	    return -1;
+	}
+	if ((flags & CONTINUATION) != 0) {
+	    fprintf(stderr,
+		    "%s: %s is a a multi-part gzip file -- not supported\n",
+		    progname, ifname);
+	    exit_code = ERROR;
+	    if (force <= 1) return -1;
+	}
+	if ((flags & RESERVED) != 0) {
+	    fprintf(stderr,
+		    "%s: %s has flags 0x%x -- not supported\n",
+		    progname, ifname, flags);
+	    exit_code = ERROR;
+	    if (force <= 1) return -1;
+	}
+	stamp  = (ulg)get_byte();
+	stamp |= ((ulg)get_byte()) << 8;
+	stamp |= ((ulg)get_byte()) << 16;
+	stamp |= ((ulg)get_byte()) << 24;
+	if (stamp != 0 && !no_time) time_stamp = stamp;
+
+	(void)get_byte();  /* Ignore extra flags for the moment */
+	(void)get_byte();  /* Ignore OS type for the moment */
+
+	if ((flags & CONTINUATION) != 0) {
+	    unsigned part = (unsigned)get_byte();
+	    part |= ((unsigned)get_byte())<<8;
+	    if (verbose) {
+		fprintf(stderr,"%s: %s: part number %u\n",
+			progname, ifname, part);
+	    }
+	}
+	if ((flags & EXTRA_FIELD) != 0) {
+	    unsigned len = (unsigned)get_byte();
+	    len |= ((unsigned)get_byte())<<8;
+	    if (verbose) {
+		fprintf(stderr,"%s: %s: extra field of %u bytes ignored\n",
+			progname, ifname, len);
+	    }
+	    while (len--) (void)get_byte();
+	}
+
+	/* Get original file name if it was truncated */
+	if ((flags & ORIG_NAME) != 0) {
+	    if (no_name || (to_stdout && !list) || part_nb > 1) {
+		/* Discard the old name */
+		char c; /* dummy used for NeXTstep 3.0 cc optimizer bug */
+		do {c=get_byte();} while (c != 0);
+	    } else {
+		/* Copy the base name. Keep a directory prefix intact. */
+                char *p = base_name (ofname);
+                char *base = p;
+		char *base2;
+		for (;;) {
+		    *p = (char)get_char();
+		    if (*p++ == '\0') break;
+		    if (p >= ofname+sizeof(ofname)) {
+			error("corrupted input -- file name too large");
+		    }
+		}
+		base2 = base_name (base);
+		strcpy(base, base2);
+                /* If necessary, adapt the name to local OS conventions: */
+                if (!list) {
+                   MAKE_LEGAL_NAME(base);
+		   if (base) list=0; /* avoid warning about unused variable */
+                }
+	    } /* no_name || to_stdout */
+	} /* ORIG_NAME */
+
+	/* Discard file comment if any */
+	if ((flags & COMMENT) != 0) {
+	    while (get_char() != 0) /* null */ ;
+	}
+	if (part_nb == 1) {
+	    header_bytes = inptr + 2*sizeof(long); /* include crc and size */
+	}
+
+    } else if (memcmp(magic, PKZIP_MAGIC, 2) == 0 && inptr == 2
+	    && memcmp((char*)inbuf, PKZIP_MAGIC, 4) == 0) {
+	/* To simplify the code, we support a zip file when alone only.
+         * We are thus guaranteed that the entire local header fits in inbuf.
+         */
+        inptr = 0;
+	work = unzip;
+	if (check_zipfile(in) != OK) return -1;
+	/* check_zipfile may get ofname from the local header */
+	last_member = 1;
+
+    } else if (memcmp(magic, PACK_MAGIC, 2) == 0) {
+	work = unpack;
+	method = PACKED;
+
+    } else if (memcmp(magic, LZW_MAGIC, 2) == 0) {
+	work = unlzw;
+	method = COMPRESSED;
+	last_member = 1;
+
+    } else if (memcmp(magic, LZH_MAGIC, 2) == 0) {
+	work = unlzh;
+	method = LZHED;
+	last_member = 1;
+
+    } else if (force && to_stdout && !list) { /* pass input unchanged */
+	method = STORED;
+	work = copy;
+        inptr = 0;
+	last_member = 1;
+    }
+    if (method >= 0) return method;
+
+    if (part_nb == 1) {
+	fprintf(stderr, "\n%s: %s: not in gzip format\n", progname, ifname);
+	exit_code = ERROR;
+	return -1;
+    } else {
+	if (magic[0] == 0)
+	  {
+	    int inbyte;
+	    for (inbyte = imagic1;  inbyte == 0;  inbyte = try_byte ())
+	      continue;
+	    if (inbyte == EOF)
+	      {
+		if (verbose)
+		  WARN ((stderr, "\n%s: %s: decompression OK, trailing zero bytes ignored\n",
+			 progname, ifname));
+		return -3;
+	      }
+	  }
+
+	WARN((stderr, "\n%s: %s: decompression OK, trailing garbage ignored\n",
+	      progname, ifname));
+	return -2;
+    }
+}
+
+/* ========================================================================
+ * Display the characteristics of the compressed file.
+ * If the given method is < 0, display the accumulated totals.
+ * IN assertions: time_stamp, header_bytes and ifile_size are initialized.
+ */
+local void do_list(ifd, method)
+    int ifd;     /* input file descriptor */
+    int method;  /* compression method */
+{
+    ulg crc;  /* original crc */
+    static int first_time = 1;
+    static char* methods[MAX_METHODS] = {
+        "store",  /* 0 */
+        "compr",  /* 1 */
+        "pack ",  /* 2 */
+        "lzh  ",  /* 3 */
+        "", "", "", "", /* 4 to 7 reserved */
+        "defla"}; /* 8 */
+    char *date;
+    int positive_off_t_width = 1;
+    off_t o;
+
+    for (o = OFF_T_MAX;  9 < o;  o /= 10) {
+	positive_off_t_width++;
+    }
+
+    if (first_time && method >= 0) {
+	first_time = 0;
+	if (verbose)  {
+	    printf("method  crc     date  time  ");
+	}
+	if (!quiet) {
+	    printf("%*.*s %*.*s  ratio uncompressed_name\n",
+		   positive_off_t_width, positive_off_t_width, "compressed",
+		   positive_off_t_width, positive_off_t_width, "uncompressed");
+	}
+    } else if (method < 0) {
+	if (total_in <= 0 || total_out <= 0) return;
+	if (verbose) {
+	    printf("                            ");
+	}
+	if (verbose || !quiet) {
+	    fprint_off(stdout, total_in, positive_off_t_width);
+	    printf(" ");
+	    fprint_off(stdout, total_out, positive_off_t_width);
+	    printf(" ");
+	}
+	display_ratio(total_out-(total_in-header_bytes), total_out, stdout);
+	/* header_bytes is not meaningful but used to ensure the same
+	 * ratio if there is a single file.
+	 */
+	printf(" (totals)\n");
+	return;
+    }
+    crc = (ulg)~0; /* unknown */
+    bytes_out = -1L;
+    bytes_in = ifile_size;
+
+#if RECORD_IO == 0
+    if (method == DEFLATED && !last_member) {
+        /* Get the crc and uncompressed size for gzip'ed (not zip'ed) files.
+         * If the lseek fails, we could use read() to get to the end, but
+         * --list is used to get quick results.
+         * Use "gunzip < foo.gz | wc -c" to get the uncompressed size if
+         * you are not concerned about speed.
+         */
+        bytes_in = lseek(ifd, (off_t)(-8), SEEK_END);
+        if (bytes_in != -1L) {
+            uch buf[8];
+            bytes_in += 8L;
+            if (read(ifd, (char*)buf, sizeof(buf)) != sizeof(buf)) {
+                read_error();
+            }
+            crc       = LG(buf);
+	    bytes_out = LG(buf+4);
+	}
+    }
+#endif /* RECORD_IO */
+    date = ctime((time_t*)&time_stamp) + 4; /* skip the day of the week */
+    date[12] = '\0';               /* suppress the 1/100sec and the year */
+    if (verbose) {
+        printf("%5s %08lx %11s ", methods[method], crc, date);
+    }
+    fprint_off(stdout, bytes_in, positive_off_t_width);
+    printf(" ");
+    fprint_off(stdout, bytes_out, positive_off_t_width);
+    printf(" ");
+    if (bytes_in  == -1L) {
+	total_in = -1L;
+	bytes_in = bytes_out = header_bytes = 0;
+    } else if (total_in >= 0) {
+	total_in  += bytes_in;
+    }
+    if (bytes_out == -1L) {
+	total_out = -1L;
+	bytes_in = bytes_out = header_bytes = 0;
+    } else if (total_out >= 0) {
+	total_out += bytes_out;
+    }
+    display_ratio(bytes_out-(bytes_in-header_bytes), bytes_out, stdout);
+    printf(" %s\n", ofname);
+}
+
+/* ========================================================================
+ * Return true if the two stat structures correspond to the same file.
+ */
+local int same_file(stat1, stat2)
+    struct stat *stat1;
+    struct stat *stat2;
+{
+    return stat1->st_ino   == stat2->st_ino
+	&& stat1->st_dev   == stat2->st_dev
+#ifdef NO_ST_INO
+        /* Can't rely on st_ino and st_dev, use other fields: */
+	&& stat1->st_mode  == stat2->st_mode
+	&& stat1->st_uid   == stat2->st_uid
+	&& stat1->st_gid   == stat2->st_gid
+	&& stat1->st_size  == stat2->st_size
+	&& stat1->st_atime == stat2->st_atime
+	&& stat1->st_mtime == stat2->st_mtime
+	&& stat1->st_ctime == stat2->st_ctime
+#endif
+	    ;
+}
+
+/* ========================================================================
+ * Return true if a file name is ambiguous because the operating system
+ * truncates file names.
+ */
+local int name_too_long(name, statb)
+    char *name;           /* file name to check */
+    struct stat *statb;   /* stat buf for this file name */
+{
+    int s = strlen(name);
+    char c = name[s-1];
+    struct stat	tstat; /* stat for truncated name */
+    int res;
+
+    tstat = *statb;      /* Just in case OS does not fill all fields */
+    name[s-1] = '\0';
+    res = lstat(name, &tstat) == 0 && same_file(statb, &tstat);
+    name[s-1] = c;
+    Trace((stderr, " too_long(%s) => %d\n", name, res));
+    return res;
+}
+
+/* ========================================================================
+ * Shorten the given name by one character, or replace a .tar extension
+ * with .tgz. Truncate the last part of the name which is longer than
+ * MIN_PART characters: 1234.678.012.gz -> 123.678.012.gz. If the name
+ * has only parts shorter than MIN_PART truncate the longest part.
+ * For decompression, just remove the last character of the name.
+ *
+ * IN assertion: for compression, the suffix of the given name is z_suffix.
+ */
+local void shorten_name(name)
+    char *name;
+{
+    int len;                 /* length of name without z_suffix */
+    char *trunc = NULL;      /* character to be truncated */
+    int plen;                /* current part length */
+    int min_part = MIN_PART; /* current minimum part length */
+    char *p;
+
+    len = strlen(name);
+    if (decompress) {
+	if (len <= 1) error("name too short");
+	name[len-1] = '\0';
+	return;
+    }
+    p = get_suffix(name);
+    if (p == NULL) error("can't recover suffix\n");
+    *p = '\0';
+    save_orig_name = 1;
+
+    /* compress 1234567890.tar to 1234567890.tgz */
+    if (len > 4 && strequ(p-4, ".tar")) {
+	strcpy(p-4, ".tgz");
+	return;
+    }
+    /* Try keeping short extensions intact:
+     * 1234.678.012.gz -> 123.678.012.gz
+     */
+    do {
+	p = strrchr(name, PATH_SEP);
+	p = p ? p+1 : name;
+	while (*p) {
+	    plen = strcspn(p, PART_SEP);
+	    p += plen;
+	    if (plen > min_part) trunc = p-1;
+	    if (*p) p++;
+	}
+    } while (trunc == NULL && --min_part != 0);
+
+    if (trunc != NULL) {
+	do {
+	    trunc[0] = trunc[1];
+	} while (*trunc++);
+	trunc--;
+    } else {
+	trunc = strrchr(name, PART_SEP[0]);
+	if (trunc == NULL) error("internal error in shorten_name");
+	if (trunc[1] == '\0') trunc--; /* force truncation */
+    }
+    strcpy(trunc, z_suffix);
+}
+
+/* ========================================================================
+ * If compressing to a file, check if ofname is not ambiguous
+ * because the operating system truncates names. Otherwise, generate
+ * a new ofname and save the original name in the compressed file.
+ * If the compressed file already exists, ask for confirmation.
+ *    The check for name truncation is made dynamically, because different
+ * file systems on the same OS might use different truncation rules (on SVR4
+ * s5 truncates to 14 chars and ufs does not truncate).
+ *    This function returns -1 if the file must be skipped, and
+ * updates save_orig_name if necessary.
+ * IN assertions: save_orig_name is already set if ofname has been
+ * already truncated because of NO_MULTIPLE_DOTS. The input file has
+ * already been open and istat is set.
+ */
+local int check_ofname()
+{
+    struct stat	ostat; /* stat for ofname */
+
+#ifdef ENAMETOOLONG
+    /* Check for strictly conforming Posix systems (which return ENAMETOOLONG
+     * instead of silently truncating filenames).
+     */
+    errno = 0;
+    while (lstat(ofname, &ostat) != 0) {
+        if (errno != ENAMETOOLONG) return 0; /* ofname does not exist */
+	shorten_name(ofname);
+    }
+#else
+    if (lstat(ofname, &ostat) != 0) return 0;
+#endif
+    /* Check for name truncation on existing file. Do this even on systems
+     * defining ENAMETOOLONG, because on most systems the strict Posix
+     * behavior is disabled by default (silent name truncation allowed).
+     */
+    if (!decompress && name_too_long(ofname, &ostat)) {
+	shorten_name(ofname);
+	if (lstat(ofname, &ostat) != 0) return 0;
+    }
+
+    /* Check that the input and output files are different (could be
+     * the same by name truncation or links).
+     */
+    if (same_file(&istat, &ostat)) {
+	if (strequ(ifname, ofname)) {
+	    fprintf(stderr, "%s: %s: cannot %scompress onto itself\n",
+		    progname, ifname, decompress ? "de" : "");
+	} else {
+	    fprintf(stderr, "%s: %s and %s are the same file\n",
+		    progname, ifname, ofname);
+	}
+	exit_code = ERROR;
+	return ERROR;
+    }
+    /* Ask permission to overwrite the existing file */
+    if (!force) {
+	int ok = 0;
+	fprintf(stderr, "%s: %s already exists;", progname, ofname);
+	if (foreground && isatty(fileno(stdin))) {
+	    fprintf(stderr, " do you wish to overwrite (y or n)? ");
+	    fflush(stderr);
+	    ok = yesno();
+	}
+	if (!ok) {
+	    fprintf(stderr, "\tnot overwritten\n");
+	    if (exit_code == OK) exit_code = WARNING;
+	    return ERROR;
+	}
+    }
+    if (xunlink (ofname)) {
+	progerror(ofname);
+	return ERROR;
+    }
+    return OK;
+}
+
+
+#ifndef NO_UTIME
+/* ========================================================================
+ * Set the access and modification times from the given stat buffer.
+ */
+local void reset_times (name, statb)
+    char *name;
+    struct stat *statb;
+{
+    struct utimbuf	timep;
+
+    /* Copy the time stamp */
+    timep.actime  = statb->st_atime;
+    timep.modtime = statb->st_mtime;
+
+    /* Some systems (at least OS/2) do not support utime on directories */
+    if (utime(name, &timep) && !S_ISDIR(statb->st_mode)) {
+	int e = errno;
+	WARN((stderr, "%s: ", progname));
+	if (!quiet) {
+	    errno = e;
+	    perror(ofname);
+	}
+    }
+}
+#endif
+
+
+/* ========================================================================
+ * Copy modes, times, ownership from input file to output file.
+ * IN assertion: to_stdout is false.
+ */
+local void copy_stat(ifstat)
+    struct stat *ifstat;
+{
+#ifndef NO_UTIME
+    if (decompress && time_stamp != 0 && ifstat->st_mtime != time_stamp) {
+	ifstat->st_mtime = time_stamp;
+	if (verbose > 1) {
+	    fprintf(stderr, "%s: time stamp restored\n", ofname);
+	}
+    }
+    reset_times(ofname, ifstat);
+#endif
+    /* Copy the protection modes */
+    if (fchmod(ofd, ifstat->st_mode & 07777)) {
+	int e = errno;
+	WARN((stderr, "%s: ", progname));
+	if (!quiet) {
+	    errno = e;
+	    perror(ofname);
+	}
+    }
+#ifndef NO_CHOWN
+    fchown(ofd, ifstat->st_uid, ifstat->st_gid);  /* Copy ownership */
+#endif
+    remove_ofname = 0;
+    /* It's now safe to remove the input file: */
+    if (xunlink (ifname)) {
+	int e = errno;
+	WARN((stderr, "%s: ", progname));
+	if (!quiet) {
+	    errno = e;
+	    perror(ifname);
+	}
+    }
+}
+
+#if ! NO_DIR
+
+/* ========================================================================
+ * Recurse through the given directory. This code is taken from ncompress.
+ */
+local void treat_dir(dir)
+    char *dir;
+{
+    struct dirent *dp;
+    DIR      *dirp;
+    char     nbuf[MAX_PATH_LEN];
+    int      len;
+
+    dirp = opendir(dir);
+    
+    if (dirp == NULL) {
+	progerror(dir);
+	return ;
+    }
+    /*
+     ** WARNING: the following algorithm could occasionally cause
+     ** compress to produce error warnings of the form "<filename>.gz
+     ** already has .gz suffix - ignored". This occurs when the
+     ** .gz output file is inserted into the directory below
+     ** readdir's current pointer.
+     ** These warnings are harmless but annoying, so they are suppressed
+     ** with option -r (except when -v is on). An alternative
+     ** to allowing this would be to store the entire directory
+     ** list in memory, then compress the entries in the stored
+     ** list. Given the depth-first recursive algorithm used here,
+     ** this could use up a tremendous amount of memory. I don't
+     ** think it's worth it. -- Dave Mack
+     ** (An other alternative might be two passes to avoid depth-first.)
+     */
+    
+    while ((errno = 0, dp = readdir(dirp)) != NULL) {
+
+	if (strequ(dp->d_name,".") || strequ(dp->d_name,"..")) {
+	    continue;
+	}
+	len = strlen(dir);
+	if (len + NAMLEN(dp) + 1 < MAX_PATH_LEN - 1) {
+	    strcpy(nbuf,dir);
+	    if (len != 0 /* dir = "" means current dir on Amiga */
+#ifdef PATH_SEP2
+		&& dir[len-1] != PATH_SEP2
+#endif
+#ifdef PATH_SEP3
+		&& dir[len-1] != PATH_SEP3
+#endif
+	    ) {
+		nbuf[len++] = PATH_SEP;
+	    }
+	    strcpy(nbuf+len, dp->d_name);
+	    treat_file(nbuf);
+	} else {
+	    fprintf(stderr,"%s: %s/%s: pathname too long\n",
+		    progname, dir, dp->d_name);
+	    exit_code = ERROR;
+	}
+    }
+    if (errno != 0)
+	progerror(dir);
+    if (CLOSEDIR(dirp) != 0)
+	progerror(dir);
+}
+#endif /* ! NO_DIR */
+
+/* ========================================================================
+ * Free all dynamically allocated variables and exit with the given code.
+ */
+local void do_exit(exitcode)
+    int exitcode;
+{
+    static int in_exit = 0;
+
+    if (in_exit) exit(exitcode);
+    in_exit = 1;
+    if (env != NULL)  free(env),  env  = NULL;
+    if (args != NULL) free((char*)args), args = NULL;
+    FREE(inbuf);
+    FREE(outbuf);
+    FREE(d_buf);
+    FREE(window);
+#ifndef MAXSEG_64K
+    FREE(tab_prefix);
+#else
+    FREE(tab_prefix0);
+    FREE(tab_prefix1);
+#endif
+    exit(exitcode);
+}
+
+/* ========================================================================
+ * Close and unlink the output file if appropriate.  This routine must be
+ * async-signal-safe.
+ */
+local void do_remove() {
+   if (remove_ofname) {
+       close(ofd);
+       xunlink (ofname);
+   }
+}
+
+/* ========================================================================
+ * Error handler.
+ */
+RETSIGTYPE abort_gzip()
+{
+	do_remove();
+	do_exit(ERROR);
+}
+
+/* ========================================================================
+ * Signal handler.
+ */
+RETSIGTYPE abort_gzip_signal()
+{
+	do_remove();
+	_exit(ERROR);
+}
+
+/* Inflate deflated data
+
+   Copyright (C) 1997, 1998, 1999, 2002 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+   See the GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.
+   If not, write to the Free Software Foundation,
+   59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+/* Not copyrighted 1992 by Mark Adler
+   version c10p1, 10 January 1993 */
+
+/* You can do whatever you like with this source file, though I would
+   prefer that if you modify it and redistribute it that you include
+   comments to that effect with your name and the date.  Thank you.
+   [The history has been moved to the file ChangeLog.]
+ */
+
+/*
+   Inflate deflated (PKZIP's method 8 compressed) data.  The compression
+   method searches for as much of the current string of bytes (up to a
+   length of 258) in the previous 32K bytes.  If it doesn't find any
+   matches (of at least length 3), it codes the next byte.  Otherwise, it
+   codes the length of the matched string and its distance backwards from
+   the current position.  There is a single Huffman code that codes both
+   single bytes (called "literals") and match lengths.  A second Huffman
+   code codes the distance information, which follows a length code.  Each
+   length or distance code actually represents a base value and a number
+   of "extra" (sometimes zero) bits to get to add to the base value.  At
+   the end of each deflated block is a special end-of-block (EOB) literal/
+   length code.  The decoding process is basically: get a literal/length
+   code; if EOB then done; if a literal, emit the decoded byte; if a
+   length then get the distance and emit the referred-to bytes from the
+   sliding window of previously emitted data.
+
+   There are (currently) three kinds of inflate blocks: stored, fixed, and
+   dynamic.  The compressor deals with some chunk of data at a time, and
+   decides which method to use on a chunk-by-chunk basis.  A chunk might
+   typically be 32K or 64K.  If the chunk is uncompressible, then the
+   "stored" method is used.  In this case, the bytes are simply stored as
+   is, eight bits per byte, with none of the above coding.  The bytes are
+   preceded by a count, since there is no longer an EOB code.
+
+   If the data is compressible, then either the fixed or dynamic methods
+   are used.  In the dynamic method, the compressed data is preceded by
+   an encoding of the literal/length and distance Huffman codes that are
+   to be used to decode this block.  The representation is itself Huffman
+   coded, and so is preceded by a description of that code.  These code
+   descriptions take up a little space, and so for small blocks, there is
+   a predefined set of codes, called the fixed codes.  The fixed method is
+   used if the block codes up smaller that way (usually for quite small
+   chunks), otherwise the dynamic method is used.  In the latter case, the
+   codes are customized to the probabilities in the current block, and so
+   can code it much better than the pre-determined fixed codes.
+ 
+   The Huffman codes themselves are decoded using a multi-level table
+   lookup, in order to maximize the speed of decoding plus the speed of
+   building the decoding tables.  See the comments below that precede the
+   lbits and dbits tuning parameters.
+ */
+
+
+/*
+   Notes beyond the 1.93a appnote.txt:
+
+   1. Distance pointers never point before the beginning of the output
+      stream.
+   2. Distance pointers can point back across blocks, up to 32k away.
+   3. There is an implied maximum of 7 bits for the bit length table and
+      15 bits for the actual data.
+   4. If only one code exists, then it is encoded using one bit.  (Zero
+      would be more efficient, but perhaps a little confusing.)  If two
+      codes exist, they are coded using one bit each (0 and 1).
+   5. There is no way of sending zero distance codes--a dummy must be
+      sent if there are none.  (History: a pre 2.0 version of PKZIP would
+      store blocks with no distance codes, but this was discovered to be
+      too harsh a criterion.)  Valid only for 1.93a.  2.04c does allow
+      zero distance codes, which is sent as one code of zero bits in
+      length.
+   6. There are up to 286 literal/length codes.  Code 256 represents the
+      end-of-block.  Note however that the static length tree defines
+      288 codes just to fill out the Huffman codes.  Codes 286 and 287
+      cannot be used though, since there is no length base or extra bits
+      defined for them.  Similarly, there are up to 30 distance codes.
+      However, static trees define 32 codes (all 5 bits) to fill out the
+      Huffman codes, but the last two had better not show up in the data.
+   7. Unzip can check dynamic Huffman blocks for complete code sets.
+      The exception is that a single code would not be complete (see #4).
+   8. The five bits following the block type is really the number of
+      literal codes sent minus 257.
+   9. Length codes 8,16,16 are interpreted as 13 length codes of 8 bits
+      (1+6+6).  Therefore, to output three times the length, you output
+      three codes (1+1+1), whereas to output four times the same length,
+      you only need two codes (1+3).  Hmm.
+  10. In the tree reconstruction algorithm, Code = Code + Increment
+      only if BitLength(i) is not zero.  (Pretty obvious.)
+  11. Correction: 4 Bits: # of Bit Length codes - 4     (4 - 19)
+  12. Note: length code 284 can represent 227-258, but length code 285
+      really is 258.  The last length deserves its own, short code
+      since it gets used a lot in very redundant files.  The length
+      258 is special since 258 - 3 (the min match length) is 255.
+  13. The literal/length and distance code bit lengths are read as a
+      single stream of lengths.  It is possible (and advantageous) for
+      a repeat code (16, 17, or 18) to go across the boundary between
+      the two sets of lengths.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: inflate.c,v 0.14 1993/06/10 13:27:04 jloup Exp $";
+#endif
+
+#define slide window
+
+/* Huffman code lookup table entry--this entry is four bytes for machines
+   that have 16-bit pointers (e.g. PC's in the small or medium model).
+   Valid extra bits are 0..13.  e == 15 is EOB (end of block), e == 16
+   means that v is a literal, 16 < e < 32 means that v is a pointer to
+   the next table, which codes e - 16 bits, and lastly e == 99 indicates
+   an unused code.  If a code with e == 99 is looked up, this implies an
+   error in the data. */
+struct huft {
+  uch e;                /* number of extra bits or operation */
+  uch b;                /* number of bits in this code or subcode */
+  union {
+    ush n;              /* literal, length base, or distance base */
+    struct huft *t;     /* pointer to next level of table */
+  } v;
+};
+
+
+/* Function prototypes */
+int huft_build OF((unsigned *, unsigned, unsigned, ush *, ush *,
+                   struct huft **, int *));
+int huft_free OF((struct huft *));
+int inflate_codes OF((struct huft *, struct huft *, int, int));
+int inflate_stored OF((void));
+int inflate_fixed OF((void));
+int inflate_dynamic OF((void));
+int inflate_block OF((int *));
+int inflate OF((void));
+
+
+/* The inflate algorithm uses a sliding 32K byte window on the uncompressed
+   stream to find repeated byte strings.  This is implemented here as a
+   circular buffer.  The index is updated simply by incrementing and then
+   and'ing with 0x7fff (32K-1). */
+/* It is left to other modules to supply the 32K area.  It is assumed
+   to be usable as if it were declared "uch slide[32768];" or as just
+   "uch *slide;" and then malloc'ed in the latter case.  The definition
+   must be in unzip.h, included above. */
+/* unsigned wp;             current position in slide */
+#define wp outcnt
+#define flush_output(w) (wp=(w),flush_window())
+
+/* Tables for deflate from PKZIP's appnote.txt. */
+static unsigned border[] = {    /* Order of the bit length code lengths */
+        16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
+static ush cplens[] = {         /* Copy lengths for literal codes 257..285 */
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
+        35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258, 0, 0};
+        /* note: see note #13 above about the 258 in this list. */
+static ush cplext[] = {         /* Extra bits for literal codes 257..285 */
+        0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
+        3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0, 99, 99}; /* 99==invalid */
+static ush cpdist[] = {         /* Copy offsets for distance codes 0..29 */
+        1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
+        257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
+        8193, 12289, 16385, 24577};
+static ush cpdext[] = {         /* Extra bits for distance codes */
+        0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
+        7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
+        12, 12, 13, 13};
+
+
+
+/* Macros for inflate() bit peeking and grabbing.
+   The usage is:
+   
+        NEEDBITS(j)
+        x = b & mask_bits[j];
+        DUMPBITS(j)
+
+   where NEEDBITS makes sure that b has at least j bits in it, and
+   DUMPBITS removes the bits from b.  The macros use the variable k
+   for the number of bits in b.  Normally, b and k are register
+   variables for speed, and are initialized at the beginning of a
+   routine that uses these macros from a global bit buffer and count.
+   The macros also use the variable w, which is a cached copy of wp.
+
+   If we assume that EOB will be the longest code, then we will never
+   ask for bits with NEEDBITS that are beyond the end of the stream.
+   So, NEEDBITS should not read any more bytes than are needed to
+   meet the request.  Then no bytes need to be "returned" to the buffer
+   at the end of the last block.
+
+   However, this assumption is not true for fixed blocks--the EOB code
+   is 7 bits, but the other literal/length codes can be 8 or 9 bits.
+   (The EOB code is shorter than other codes because fixed blocks are
+   generally short.  So, while a block always has an EOB, many other
+   literal/length codes have a significantly lower probability of
+   showing up at all.)  However, by making the first table have a
+   lookup of seven bits, the EOB code will be found in that first
+   lookup, and so will not require that too many bits be pulled from
+   the stream.
+ */
+
+ulg bb;                         /* bit buffer */
+unsigned bk;                    /* bits in bit buffer */
+
+ush mask_bits[] = {
+    0x0000,
+    0x0001, 0x0003, 0x0007, 0x000f, 0x001f, 0x003f, 0x007f, 0x00ff,
+    0x01ff, 0x03ff, 0x07ff, 0x0fff, 0x1fff, 0x3fff, 0x7fff, 0xffff
+};
+
+#define GETBYTE() (inptr < insize ? inbuf[inptr++] : (wp = w, fill_inbuf(0)))
+
+#ifdef CRYPT
+  uch cc;
+#  define NEXTBYTE() \
+     (decrypt ? (cc = GETBYTE(), zdecode(cc), cc) : GETBYTE())
+#else
+#  define NEXTBYTE()  (uch)GETBYTE()
+#endif
+#define NEEDBITS(n) {while(k<(n)){b|=((ulg)NEXTBYTE())<<k;k+=8;}}
+#define DUMPBITS(n) {b>>=(n);k-=(n);}
+
+
+/*
+   Huffman code decoding is performed using a multi-level table lookup.
+   The fastest way to decode is to simply build a lookup table whose
+   size is determined by the longest code.  However, the time it takes
+   to build this table can also be a factor if the data being decoded
+   is not very long.  The most common codes are necessarily the
+   shortest codes, so those codes dominate the decoding time, and hence
+   the speed.  The idea is you can have a shorter table that decodes the
+   shorter, more probable codes, and then point to subsidiary tables for
+   the longer codes.  The time it costs to decode the longer codes is
+   then traded against the time it takes to make longer tables.
+
+   This results of this trade are in the variables lbits and dbits
+   below.  lbits is the number of bits the first level table for literal/
+   length codes can decode in one step, and dbits is the same thing for
+   the distance codes.  Subsequent tables are also less than or equal to
+   those sizes.  These values may be adjusted either when all of the
+   codes are shorter than that, in which case the longest code length in
+   bits is used, or when the shortest code is *longer* than the requested
+   table size, in which case the length of the shortest code in bits is
+   used.
+
+   There are two different values for the two tables, since they code a
+   different number of possibilities each.  The literal/length table
+   codes 286 possible values, or in a flat code, a little over eight
+   bits.  The distance table codes 30 possible values, or a little less
+   than five bits, flat.  The optimum values for speed end up being
+   about one bit more than those, so lbits is 8+1 and dbits is 5+1.
+   The optimum values may differ though from machine to machine, and
+   possibly even between compilers.  Your mileage may vary.
+ */
+
+
+int lbits = 9;          /* bits in base literal/length lookup table */
+int dbits = 6;          /* bits in base distance lookup table */
+
+
+/* If BMAX needs to be larger than 16, then h and x[] should be ulg. */
+#define BMAX 16         /* maximum bit length of any code (16 for explode) */
+#define N_MAX 288       /* maximum number of codes in any set */
+
+
+unsigned hufts;         /* track memory usage */
+
+
+int huft_build(b, n, s, d, e, t, m)
+unsigned *b;            /* code lengths in bits (all assumed <= BMAX) */
+unsigned n;             /* number of codes (assumed <= N_MAX) */
+unsigned s;             /* number of simple-valued codes (0..s-1) */
+ush *d;                 /* list of base values for non-simple codes */
+ush *e;                 /* list of extra bits for non-simple codes */
+struct huft **t;        /* result: starting table */
+int *m;                 /* maximum lookup bits, returns actual */
+/* Given a list of code lengths and a maximum table size, make a set of
+   tables to decode that set of codes.  Return zero on success, one if
+   the given code set is incomplete (the tables are still built in this
+   case), two if the input is invalid (all zero length codes or an
+   oversubscribed set of lengths), and three if not enough memory. */
+{
+  unsigned a;                   /* counter for codes of length k */
+  unsigned c[BMAX+1];           /* bit length count table */
+  unsigned f;                   /* i repeats in table every f entries */
+  int g;                        /* maximum code length */
+  int h;                        /* table level */
+  register unsigned i;          /* counter, current code */
+  register unsigned j;          /* counter */
+  register int k;               /* number of bits in current code */
+  int l;                        /* bits per table (returned in m) */
+  register unsigned *p;         /* pointer into c[], b[], or v[] */
+  register struct huft *q;      /* points to current table */
+  struct huft r;                /* table entry for structure assignment */
+  struct huft *u[BMAX];         /* table stack */
+  unsigned v[N_MAX];            /* values in order of bit length */
+  register int w;               /* bits before this table == (l * h) */
+  unsigned x[BMAX+1];           /* bit offsets, then code stack */
+  unsigned *xp;                 /* pointer into x */
+  int y;                        /* number of dummy codes added */
+  unsigned z;                   /* number of entries in current table */
+
+
+  /* Generate counts for each bit length */
+  memzero(c, sizeof(c));
+  p = b;  i = n;
+  do {
+    Tracecv(*p, (stderr, (n-i >= ' ' && n-i <= '~' ? "%c %d\n" : "0x%x %d\n"), 
+	    n-i, *p));
+    c[*p]++;                    /* assume all entries <= BMAX */
+    p++;                      /* Can't combine with above line (Solaris bug) */
+  } while (--i);
+  if (c[0] == n)                /* null input--all zero length codes */
+  {
+    *t = (struct huft *)NULL;
+    *m = 0;
+    return 0;
+  }
+
+
+  /* Find minimum and maximum length, bound *m by those */
+  l = *m;
+  for (j = 1; j <= BMAX; j++)
+    if (c[j])
+      break;
+  k = j;                        /* minimum code length */
+  if ((unsigned)l < j)
+    l = j;
+  for (i = BMAX; i; i--)
+    if (c[i])
+      break;
+  g = i;                        /* maximum code length */
+  if ((unsigned)l > i)
+    l = i;
+  *m = l;
+
+
+  /* Adjust last length count to fill out codes, if needed */
+  for (y = 1 << j; j < i; j++, y <<= 1)
+    if ((y -= c[j]) < 0)
+      return 2;                 /* bad input: more codes than bits */
+  if ((y -= c[i]) < 0)
+    return 2;
+  c[i] += y;
+
+
+  /* Generate starting offsets into the value table for each length */
+  x[1] = j = 0;
+  p = c + 1;  xp = x + 2;
+  while (--i) {                 /* note that i == g from above */
+    *xp++ = (j += *p++);
+  }
+
+
+  /* Make a table of values in order of bit lengths */
+  p = b;  i = 0;
+  do {
+    if ((j = *p++) != 0)
+      v[x[j]++] = i;
+  } while (++i < n);
+  n = x[g];                   /* set n to length of v */
+
+
+  /* Generate the Huffman codes and for each, make the table entries */
+  x[0] = i = 0;                 /* first Huffman code is zero */
+  p = v;                        /* grab values in bit order */
+  h = -1;                       /* no tables yet--level -1 */
+  w = -l;                       /* bits decoded == (l * h) */
+  u[0] = (struct huft *)NULL;   /* just to keep compilers happy */
+  q = (struct huft *)NULL;      /* ditto */
+  z = 0;                        /* ditto */
+
+  /* go through the bit lengths (k already is bits in shortest code) */
+  for (; k <= g; k++)
+  {
+    a = c[k];
+    while (a--)
+    {
+      /* here i is the Huffman code of length k bits for value *p */
+      /* make tables up to required level */
+      while (k > w + l)
+      {
+        h++;
+        w += l;                 /* previous table always l bits */
+
+        /* compute minimum size table less than or equal to l bits */
+        z = (z = g - w) > (unsigned)l ? l : z;  /* upper limit on table size */
+        if ((f = 1 << (j = k - w)) > a + 1)     /* try a k-w bit table */
+        {                       /* too few codes for k-w bit table */
+          f -= a + 1;           /* deduct codes from patterns left */
+          xp = c + k;
+	  if (j < z)
+	    while (++j < z)       /* try smaller tables up to z bits */
+	    {
+	      if ((f <<= 1) <= *++xp)
+		break;            /* enough codes to use up j bits */
+	      f -= *xp;           /* else deduct codes from patterns */
+	    }
+        }
+        z = 1 << j;             /* table entries for j-bit table */
+
+        /* allocate and link in new table */
+        if ((q = (struct huft *)malloc((z + 1)*sizeof(struct huft))) ==
+            (struct huft *)NULL)
+        {
+          if (h)
+            huft_free(u[0]);
+          return 3;             /* not enough memory */
+        }
+        hufts += z + 1;         /* track memory usage */
+        *t = q + 1;             /* link to list for huft_free() */
+        *(t = &(q->v.t)) = (struct huft *)NULL;
+        u[h] = ++q;             /* table starts after link */
+
+        /* connect to last table, if there is one */
+        if (h)
+        {
+          x[h] = i;             /* save pattern for backing up */
+          r.b = (uch)l;         /* bits to dump before this table */
+          r.e = (uch)(16 + j);  /* bits in this table */
+          r.v.t = q;            /* pointer to this table */
+          j = i >> (w - l);     /* (get around Turbo C bug) */
+          u[h-1][j] = r;        /* connect to last table */
+        }
+      }
+
+      /* set up table entry in r */
+      r.b = (uch)(k - w);
+      if (p >= v + n)
+        r.e = 99;               /* out of values--invalid code */
+      else if (*p < s)
+      {
+        r.e = (uch)(*p < 256 ? 16 : 15);    /* 256 is end-of-block code */
+        r.v.n = (ush)(*p);             /* simple code is just the value */
+	p++;                           /* one compiler does not like *p++ */
+      }
+      else
+      {
+        r.e = (uch)e[*p - s];   /* non-simple--look up in lists */
+        r.v.n = d[*p++ - s];
+      }
+
+      /* fill code-like entries with r */
+      f = 1 << (k - w);
+      for (j = i >> w; j < z; j += f)
+        q[j] = r;
+
+      /* backwards increment the k-bit code i */
+      for (j = 1 << (k - 1); i & j; j >>= 1)
+        i ^= j;
+      i ^= j;
+
+      /* backup over finished tables */
+      while ((i & ((1 << w) - 1)) != x[h])
+      {
+        h--;                    /* don't need to update q */
+        w -= l;
+      }
+    }
+  }
+
+
+  /* Return true (1) if we were given an incomplete table */
+  return y != 0 && g != 1;
+}
+
+
+
+int huft_free(t)
+struct huft *t;         /* table to free */
+/* Free the malloc'ed tables built by huft_build(), which makes a linked
+   list of the tables it made, with the links in a dummy first entry of
+   each table. */
+{
+  register struct huft *p, *q;
+
+
+  /* Go through linked list, freeing from the malloced (t[-1]) address. */
+  p = t;
+  while (p != (struct huft *)NULL)
+  {
+    q = (--p)->v.t;
+    free((char*)p);
+    p = q;
+  } 
+  return 0;
+}
+
+
+int inflate_codes(tl, td, bl, bd)
+struct huft *tl, *td;   /* literal/length and distance decoder tables */
+int bl, bd;             /* number of bits decoded by tl[] and td[] */
+/* inflate (decompress) the codes in a deflated (compressed) block.
+   Return an error code or zero if it all goes ok. */
+{
+  register unsigned e;  /* table entry flag/number of extra bits */
+  unsigned n, d;        /* length and index for copy */
+  unsigned w;           /* current window position */
+  struct huft *t;       /* pointer to table entry */
+  unsigned ml, md;      /* masks for bl and bd bits */
+  register ulg b;       /* bit buffer */
+  register unsigned k;  /* number of bits in bit buffer */
+
+
+  /* make local copies of globals */
+  b = bb;                       /* initialize bit buffer */
+  k = bk;
+  w = wp;                       /* initialize window position */
+
+  /* inflate the coded data */
+  ml = mask_bits[bl];           /* precompute masks for speed */
+  md = mask_bits[bd];
+  for (;;)                      /* do until end of block */
+  {
+    NEEDBITS((unsigned)bl)
+    if ((e = (t = tl + ((unsigned)b & ml))->e) > 16)
+      do {
+        if (e == 99)
+          return 1;
+        DUMPBITS(t->b)
+        e -= 16;
+        NEEDBITS(e)
+      } while ((e = (t = t->v.t + ((unsigned)b & mask_bits[e]))->e) > 16);
+    DUMPBITS(t->b)
+    if (e == 16)                /* then it's a literal */
+    {
+      slide[w++] = (uch)t->v.n;
+      Tracevv((stderr, "%c", slide[w-1]));
+      if (w == WSIZE)
+      {
+        flush_output(w);
+        w = 0;
+      }
+    }
+    else                        /* it's an EOB or a length */
+    {
+      /* exit if end of block */
+      if (e == 15)
+        break;
+
+      /* get length of block to copy */
+      NEEDBITS(e)
+      n = t->v.n + ((unsigned)b & mask_bits[e]);
+      DUMPBITS(e);
+
+      /* decode distance of block to copy */
+      NEEDBITS((unsigned)bd)
+      if ((e = (t = td + ((unsigned)b & md))->e) > 16)
+        do {
+          if (e == 99)
+            return 1;
+          DUMPBITS(t->b)
+          e -= 16;
+          NEEDBITS(e)
+        } while ((e = (t = t->v.t + ((unsigned)b & mask_bits[e]))->e) > 16);
+      DUMPBITS(t->b)
+      NEEDBITS(e)
+      d = w - t->v.n - ((unsigned)b & mask_bits[e]);
+      DUMPBITS(e)
+      Tracevv((stderr,"\\[%d,%d]", w-d, n));
+
+      /* do the copy */
+      do {
+        n -= (e = (e = WSIZE - ((d &= WSIZE-1) > w ? d : w)) > n ? n : e);
+#if !defined(NOMEMCPY) && !defined(DEBUG)
+        if (w - d >= e)         /* (this test assumes unsigned comparison) */
+        {
+          memcpy(slide + w, slide + d, e);
+          w += e;
+          d += e;
+        }
+        else                      /* do it slow to avoid memcpy() overlap */
+#endif /* !NOMEMCPY */
+          do {
+            slide[w++] = slide[d++];
+	    Tracevv((stderr, "%c", slide[w-1]));
+          } while (--e);
+        if (w == WSIZE)
+        {
+          flush_output(w);
+          w = 0;
+        }
+      } while (n);
+    }
+  }
+
+
+  /* restore the globals from the locals */
+  wp = w;                       /* restore global window pointer */
+  bb = b;                       /* restore global bit buffer */
+  bk = k;
+
+  /* done */
+  return 0;
+}
+
+
+
+int inflate_stored()
+/* "decompress" an inflated type 0 (stored) block. */
+{
+  unsigned n;           /* number of bytes in block */
+  unsigned w;           /* current window position */
+  register ulg b;       /* bit buffer */
+  register unsigned k;  /* number of bits in bit buffer */
+
+
+  /* make local copies of globals */
+  b = bb;                       /* initialize bit buffer */
+  k = bk;
+  w = wp;                       /* initialize window position */
+
+
+  /* go to byte boundary */
+  n = k & 7;
+  DUMPBITS(n);
+
+
+  /* get the length and its complement */
+  NEEDBITS(16)
+  n = ((unsigned)b & 0xffff);
+  DUMPBITS(16)
+  NEEDBITS(16)
+  if (n != (unsigned)((~b) & 0xffff))
+    return 1;                   /* error in compressed data */
+  DUMPBITS(16)
+
+
+  /* read and output the compressed data */
+  while (n--)
+  {
+    NEEDBITS(8)
+    slide[w++] = (uch)b;
+    if (w == WSIZE)
+    {
+      flush_output(w);
+      w = 0;
+    }
+    DUMPBITS(8)
+  }
+
+
+  /* restore the globals from the locals */
+  wp = w;                       /* restore global window pointer */
+  bb = b;                       /* restore global bit buffer */
+  bk = k;
+  return 0;
+}
+
+
+
+int inflate_fixed()
+/* decompress an inflated type 1 (fixed Huffman codes) block.  We should
+   either replace this with a custom decoder, or at least precompute the
+   Huffman tables. */
+{
+  int i;                /* temporary variable */
+  struct huft *tl;      /* literal/length code table */
+  struct huft *td;      /* distance code table */
+  int bl;               /* lookup bits for tl */
+  int bd;               /* lookup bits for td */
+  unsigned l[288];      /* length list for huft_build */
+
+
+  /* set up literal table */
+  for (i = 0; i < 144; i++)
+    l[i] = 8;
+  for (; i < 256; i++)
+    l[i] = 9;
+  for (; i < 280; i++)
+    l[i] = 7;
+  for (; i < 288; i++)          /* make a complete, but wrong code set */
+    l[i] = 8;
+  bl = 7;
+  if ((i = huft_build(l, 288, 257, cplens, cplext, &tl, &bl)) != 0)
+    return i;
+
+
+  /* set up distance table */
+  for (i = 0; i < 30; i++)      /* make an incomplete code set */
+    l[i] = 5;
+  bd = 5;
+  if ((i = huft_build(l, 30, 0, cpdist, cpdext, &td, &bd)) > 1)
+  {
+    huft_free(tl);
+    return i;
+  }
+
+
+  /* decompress until an end-of-block code */
+  if (inflate_codes(tl, td, bl, bd))
+    return 1;
+
+
+  /* free the decoding tables, return */
+  huft_free(tl);
+  huft_free(td);
+  return 0;
+}
+
+
+
+int inflate_dynamic()
+/* decompress an inflated type 2 (dynamic Huffman codes) block. */
+{
+  int i;                /* temporary variables */
+  unsigned j;
+  unsigned l;           /* last length */
+  unsigned m;           /* mask for bit lengths table */
+  unsigned n;           /* number of lengths to get */
+  unsigned w;           /* current window position */
+  struct huft *tl;      /* literal/length code table */
+  struct huft *td;      /* distance code table */
+  int bl;               /* lookup bits for tl */
+  int bd;               /* lookup bits for td */
+  unsigned nb;          /* number of bit length codes */
+  unsigned nl;          /* number of literal/length codes */
+  unsigned nd;          /* number of distance codes */
+#ifdef PKZIP_BUG_WORKAROUND
+  unsigned ll[288+32];  /* literal/length and distance code lengths */
+#else
+  unsigned ll[286+30];  /* literal/length and distance code lengths */
+#endif
+  register ulg b;       /* bit buffer */
+  register unsigned k;  /* number of bits in bit buffer */
+
+
+  /* make local bit buffer */
+  b = bb;
+  k = bk;
+  w = wp;
+
+
+  /* read in table lengths */
+  NEEDBITS(5)
+  nl = 257 + ((unsigned)b & 0x1f);      /* number of literal/length codes */
+  DUMPBITS(5)
+  NEEDBITS(5)
+  nd = 1 + ((unsigned)b & 0x1f);        /* number of distance codes */
+  DUMPBITS(5)
+  NEEDBITS(4)
+  nb = 4 + ((unsigned)b & 0xf);         /* number of bit length codes */
+  DUMPBITS(4)
+#ifdef PKZIP_BUG_WORKAROUND
+  if (nl > 288 || nd > 32)
+#else
+  if (nl > 286 || nd > 30)
+#endif
+    return 1;                   /* bad lengths */
+
+
+  /* read in bit-length-code lengths */
+  for (j = 0; j < nb; j++)
+  {
+    NEEDBITS(3)
+    ll[border[j]] = (unsigned)b & 7;
+    DUMPBITS(3)
+  }
+  for (; j < 19; j++)
+    ll[border[j]] = 0;
+
+
+  /* build decoding table for trees--single level, 7 bit lookup */
+  bl = 7;
+  if ((i = huft_build(ll, 19, 19, NULL, NULL, &tl, &bl)) != 0)
+  {
+    if (i == 1)
+      huft_free(tl);
+    return i;                   /* incomplete code set */
+  }
+
+  if (tl == NULL)		/* Grrrhhh */
+	return 2;
+
+  /* read in literal and distance code lengths */
+  n = nl + nd;
+  m = mask_bits[bl];
+  i = l = 0;
+  while ((unsigned)i < n)
+  {
+    NEEDBITS((unsigned)bl)
+    j = (td = tl + ((unsigned)b & m))->b;
+    DUMPBITS(j)
+    j = td->v.n;
+    if (j < 16)                 /* length of code in bits (0..15) */
+      ll[i++] = l = j;          /* save last length in l */
+    else if (j == 16)           /* repeat last length 3 to 6 times */
+    {
+      NEEDBITS(2)
+      j = 3 + ((unsigned)b & 3);
+      DUMPBITS(2)
+      if ((unsigned)i + j > n)
+        return 1;
+      while (j--)
+        ll[i++] = l;
+    }
+    else if (j == 17)           /* 3 to 10 zero length codes */
+    {
+      NEEDBITS(3)
+      j = 3 + ((unsigned)b & 7);
+      DUMPBITS(3)
+      if ((unsigned)i + j > n)
+        return 1;
+      while (j--)
+        ll[i++] = 0;
+      l = 0;
+    }
+    else                        /* j == 18: 11 to 138 zero length codes */
+    {
+      NEEDBITS(7)
+      j = 11 + ((unsigned)b & 0x7f);
+      DUMPBITS(7)
+      if ((unsigned)i + j > n)
+        return 1;
+      while (j--)
+        ll[i++] = 0;
+      l = 0;
+    }
+  }
+
+
+  /* free decoding table for trees */
+  huft_free(tl);
+
+
+  /* restore the global bit buffer */
+  bb = b;
+  bk = k;
+
+
+  /* build the decoding tables for literal/length and distance codes */
+  bl = lbits;
+  if ((i = huft_build(ll, nl, 257, cplens, cplext, &tl, &bl)) != 0)
+  {
+    if (i == 1) {
+      fprintf(stderr, " incomplete literal tree\n");
+      huft_free(tl);
+    }
+    return i;                   /* incomplete code set */
+  }
+  bd = dbits;
+  if ((i = huft_build(ll + nl, nd, 0, cpdist, cpdext, &td, &bd)) != 0)
+  {
+    if (i == 1) {
+      fprintf(stderr, " incomplete distance tree\n");
+#ifdef PKZIP_BUG_WORKAROUND
+      i = 0;
+    }
+#else
+      huft_free(td);
+    }
+    huft_free(tl);
+    return i;                   /* incomplete code set */
+#endif
+  }
+
+
+  /* decompress until an end-of-block code */
+  if (inflate_codes(tl, td, bl, bd))
+    return 1;
+
+
+  /* free the decoding tables, return */
+  huft_free(tl);
+  huft_free(td);
+  return 0;
+}
+
+
+
+int inflate_block(e)
+int *e;                 /* last block flag */
+/* decompress an inflated block */
+{
+  unsigned t;           /* block type */
+  unsigned w;           /* current window position */
+  register ulg b;       /* bit buffer */
+  register unsigned k;  /* number of bits in bit buffer */
+
+
+  /* make local bit buffer */
+  b = bb;
+  k = bk;
+  w = wp;
+
+
+  /* read in last block bit */
+  NEEDBITS(1)
+  *e = (int)b & 1;
+  DUMPBITS(1)
+
+
+  /* read in block type */
+  NEEDBITS(2)
+  t = (unsigned)b & 3;
+  DUMPBITS(2)
+
+
+  /* restore the global bit buffer */
+  bb = b;
+  bk = k;
+
+
+  /* inflate that block type */
+  if (t == 2)
+    return inflate_dynamic();
+  if (t == 0)
+    return inflate_stored();
+  if (t == 1)
+    return inflate_fixed();
+
+
+  /* bad block type */
+  return 2;
+}
+
+
+
+int inflate()
+/* decompress an inflated entry */
+{
+  int e;                /* last block flag */
+  int r;                /* result code */
+  unsigned h;           /* maximum struct huft's malloc'ed */
+
+
+  /* initialize window, bit buffer */
+  wp = 0;
+  bk = 0;
+  bb = 0;
+
+
+  /* decompress until the last block */
+  h = 0;
+  do {
+    hufts = 0;
+    if ((r = inflate_block(&e)) != 0)
+      return r;
+    if (hufts > h)
+      h = hufts;
+  } while (!e);
+
+  /* Undo too much lookahead. The next read will be byte aligned so we
+   * can discard unused bits in the last meaningful byte.
+   */
+  while (bk >= 8) {
+    bk -= 8;
+    inptr--;
+  }
+
+  /* flush out slide */
+  flush_output(wp);
+
+
+  /* return success */
+#ifdef DEBUG
+  fprintf(stderr, "<%u> ", h);
+#endif /* DEBUG */
+  return 0;
+}
+/* lzw.c -- compress files in LZW format.
+ * This is a dummy version avoiding patent problems.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: lzw.c,v 0.9 1993/06/10 13:27:31 jloup Exp $";
+#endif
+
+static int msg_done = 0;
+
+/* Compress in to out with lzw method. */
+int lzw(in, out)
+    int in, out;
+{
+    if (msg_done) return ERROR;
+    msg_done = 1;
+    fprintf(stderr,"output in compress .Z format not supported\n");
+    if (in != out) { /* avoid warnings on unused variables */
+        exit_code = ERROR;
+    }
+    return ERROR;
+}
+/* trees.c -- output deflated data using Huffman coding
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+/*
+ *  PURPOSE
+ *
+ *      Encode various sets of source values using variable-length
+ *      binary code trees.
+ *
+ *  DISCUSSION
+ *
+ *      The PKZIP "deflation" process uses several Huffman trees. The more
+ *      common source values are represented by shorter bit sequences.
+ *
+ *      Each code tree is stored in the ZIP file in a compressed form
+ *      which is itself a Huffman encoding of the lengths of
+ *      all the code strings (in ascending order by source values).
+ *      The actual code strings are reconstructed from the lengths in
+ *      the UNZIP process, as described in the "application note"
+ *      (APPNOTE.TXT) distributed as part of PKWARE's PKZIP program.
+ *
+ *  REFERENCES
+ *
+ *      Lynch, Thomas J.
+ *          Data Compression:  Techniques and Applications, pp. 53-55.
+ *          Lifetime Learning Publications, 1985.  ISBN 0-534-03418-7.
+ *
+ *      Storer, James A.
+ *          Data Compression:  Methods and Theory, pp. 49-50.
+ *          Computer Science Press, 1988.  ISBN 0-7167-8156-5.
+ *
+ *      Sedgewick, R.
+ *          Algorithms, p290.
+ *          Addison-Wesley, 1983. ISBN 0-201-06672-6.
+ *
+ *  INTERFACE
+ *
+ *      void ct_init (ush *attr, int *methodp)
+ *          Allocate the match buffer, initialize the various tables and save
+ *          the location of the internal file attribute (ascii/binary) and
+ *          method (DEFLATE/STORE)
+ *
+ *      void ct_tally (int dist, int lc);
+ *          Save the match info and tally the frequency counts.
+ *
+ *      off_t flush_block (char *buf, ulg stored_len, int pad, int eof)
+ *          Determine the best encoding for the current block: dynamic trees,
+ *          static trees or store, and output the encoded block to the zip
+ *          file. If pad is set, pads the block to the next
+ *          byte. Returns the total compressed length for the file so
+ *          far.
+ * */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: trees.c,v 0.12 1993/06/10 13:27:54 jloup Exp $";
+#endif
+
+/* ===========================================================================
+ * Constants
+ */
+
+#define MAX_BITS 15
+/* All codes must not exceed MAX_BITS bits */
+
+#define MAX_BL_BITS 7
+/* Bit length codes must not exceed MAX_BL_BITS bits */
+
+#define LENGTH_CODES 29
+/* number of length codes, not counting the special END_BLOCK code */
+
+#define LITERALS  256
+/* number of literal bytes 0..255 */
+
+#define END_BLOCK 256
+/* end of block literal code */
+
+#define L_CODES (LITERALS+1+LENGTH_CODES)
+/* number of Literal or Length codes, including the END_BLOCK code */
+
+#define D_CODES   30
+/* number of distance codes */
+
+#define BL_CODES  19
+/* number of codes used to transfer the bit lengths */
+
+
+local int near extra_lbits[LENGTH_CODES] /* extra bits for each length code */
+   = {0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0};
+
+local int near extra_dbits[D_CODES] /* extra bits for each distance code */
+   = {0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13};
+
+local int near extra_blbits[BL_CODES]/* extra bits for each bit length code */
+   = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,3,7};
+
+#define STORED_BLOCK 0
+#define STATIC_TREES 1
+#define DYN_TREES    2
+/* The three kinds of block type */
+
+#ifndef LIT_BUFSIZE
+#  ifdef SMALL_MEM
+#    define LIT_BUFSIZE  0x2000
+#  else
+#  ifdef MEDIUM_MEM
+#    define LIT_BUFSIZE  0x4000
+#  else
+#    define LIT_BUFSIZE  0x8000
+#  endif
+#  endif
+#endif
+#ifndef DIST_BUFSIZE
+#  define DIST_BUFSIZE  LIT_BUFSIZE
+#endif
+/* Sizes of match buffers for literals/lengths and distances.  There are
+ * 4 reasons for limiting LIT_BUFSIZE to 64K:
+ *   - frequencies can be kept in 16 bit counters
+ *   - if compression is not successful for the first block, all input data is
+ *     still in the window so we can still emit a stored block even when input
+ *     comes from standard input.  (This can also be done for all blocks if
+ *     LIT_BUFSIZE is not greater than 32K.)
+ *   - if compression is not successful for a file smaller than 64K, we can
+ *     even emit a stored file instead of a stored block (saving 5 bytes).
+ *   - creating new Huffman trees less frequently may not provide fast
+ *     adaptation to changes in the input data statistics. (Take for
+ *     example a binary file with poorly compressible code followed by
+ *     a highly compressible string table.) Smaller buffer sizes give
+ *     fast adaptation but have of course the overhead of transmitting trees
+ *     more frequently.
+ *   - I can't count above 4
+ * The current code is general and allows DIST_BUFSIZE < LIT_BUFSIZE (to save
+ * memory at the expense of compression). Some optimizations would be possible
+ * if we rely on DIST_BUFSIZE == LIT_BUFSIZE.
+ */
+#if LIT_BUFSIZE > INBUFSIZ
+    error cannot overlay l_buf and inbuf
+#endif
+
+#define REP_3_6      16
+/* repeat previous bit length 3-6 times (2 bits of repeat count) */
+
+#define REPZ_3_10    17
+/* repeat a zero length 3-10 times  (3 bits of repeat count) */
+
+#define REPZ_11_138  18
+/* repeat a zero length 11-138 times  (7 bits of repeat count) */
+
+/* ===========================================================================
+ * Local data
+ */
+
+/* Data structure describing a single value and its code string. */
+typedef struct ct_data {
+    union {
+        ush  freq;       /* frequency count */
+        ush  code;       /* bit string */
+    } fc;
+    union {
+        ush  dad;        /* father node in Huffman tree */
+        ush  len;        /* length of bit string */
+    } dl;
+} ct_data;
+
+#define Freq fc.freq
+#define Code fc.code
+#define Dad  dl.dad
+#define Len  dl.len
+
+#define HEAP_SIZE (2*L_CODES+1)
+/* maximum heap size */
+
+local ct_data near dyn_ltree[HEAP_SIZE];   /* literal and length tree */
+local ct_data near dyn_dtree[2*D_CODES+1]; /* distance tree */
+
+local ct_data near static_ltree[L_CODES+2];
+/* The static literal tree. Since the bit lengths are imposed, there is no
+ * need for the L_CODES extra codes used during heap construction. However
+ * The codes 286 and 287 are needed to build a canonical tree (see ct_init
+ * below).
+ */
+
+local ct_data near static_dtree[D_CODES];
+/* The static distance tree. (Actually a trivial tree since all codes use
+ * 5 bits.)
+ */
+
+local ct_data near bl_tree[2*BL_CODES+1];
+/* Huffman tree for the bit lengths */
+
+typedef struct tree_desc {
+    ct_data near *dyn_tree;      /* the dynamic tree */
+    ct_data near *static_tree;   /* corresponding static tree or NULL */
+    int     near *extra_bits;    /* extra bits for each code or NULL */
+    int     extra_base;          /* base index for extra_bits */
+    int     elems;               /* max number of elements in the tree */
+    int     max_length;          /* max bit length for the codes */
+    int     max_code;            /* largest code with non zero frequency */
+} tree_desc;
+
+local tree_desc near l_desc =
+{dyn_ltree, static_ltree, extra_lbits, LITERALS+1, L_CODES, MAX_BITS, 0};
+
+local tree_desc near d_desc =
+{dyn_dtree, static_dtree, extra_dbits, 0,          D_CODES, MAX_BITS, 0};
+
+local tree_desc near bl_desc =
+{bl_tree, (ct_data near *)0, extra_blbits, 0,      BL_CODES, MAX_BL_BITS, 0};
+
+
+local ush near bl_count[MAX_BITS+1];
+/* number of codes at each bit length for an optimal tree */
+
+local uch near bl_order[BL_CODES]
+   = {16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15};
+/* The lengths of the bit length codes are sent in order of decreasing
+ * probability, to avoid transmitting the lengths for unused bit length codes.
+ */
+
+local int near heap[2*L_CODES+1]; /* heap used to build the Huffman trees */
+local int heap_len;               /* number of elements in the heap */
+local int heap_max;               /* element of largest frequency */
+/* The sons of heap[n] are heap[2*n] and heap[2*n+1]. heap[0] is not used.
+ * The same heap array is used to build all trees.
+ */
+
+local uch near depth[2*L_CODES+1];
+/* Depth of each subtree used as tie breaker for trees of equal frequency */
+
+local uch length_code[MAX_MATCH-MIN_MATCH+1];
+/* length code for each normalized match length (0 == MIN_MATCH) */
+
+local uch dist_code[512];
+/* distance codes. The first 256 values correspond to the distances
+ * 3 .. 258, the last 256 values correspond to the top 8 bits of
+ * the 15 bit distances.
+ */
+
+local int near base_length[LENGTH_CODES];
+/* First normalized length for each code (0 = MIN_MATCH) */
+
+local int near base_dist[D_CODES];
+/* First normalized distance for each code (0 = distance of 1) */
+
+#define l_buf inbuf
+/* DECLARE(uch, l_buf, LIT_BUFSIZE);  buffer for literals or lengths */
+
+/* DECLARE(ush, d_buf, DIST_BUFSIZE); buffer for distances */
+
+local uch near flag_buf[(LIT_BUFSIZE/8)];
+/* flag_buf is a bit array distinguishing literals from lengths in
+ * l_buf, thus indicating the presence or absence of a distance.
+ */
+
+local unsigned last_lit;    /* running index in l_buf */
+local unsigned last_dist;   /* running index in d_buf */
+local unsigned last_flags;  /* running index in flag_buf */
+local uch flags;            /* current flags not yet saved in flag_buf */
+local uch flag_bit;         /* current bit used in flags */
+/* bits are filled in flags starting at bit 0 (least significant).
+ * Note: these flags are overkill in the current code since we don't
+ * take advantage of DIST_BUFSIZE == LIT_BUFSIZE.
+ */
+
+local ulg opt_len;        /* bit length of current block with optimal trees */
+local ulg static_len;     /* bit length of current block with static trees */
+
+local off_t compressed_len; /* total bit length of compressed file */
+
+local off_t input_len;      /* total byte length of input file */
+/* input_len is for debugging only since we can get it by other means. */
+
+ush *file_type;        /* pointer to UNKNOWN, BINARY or ASCII */
+int *file_method;      /* pointer to DEFLATE or STORE */
+
+#ifdef DEBUG
+extern off_t bits_sent;  /* bit length of the compressed data */
+#endif
+
+extern long block_start;       /* window offset of current block */
+extern unsigned near strstart; /* window offset of current string */
+
+/* ===========================================================================
+ * Local (static) routines in this file.
+ */
+
+local void init_block     OF((void));
+local void pqdownheap     OF((ct_data near *tree, int k));
+local void gen_bitlen     OF((tree_desc near *desc));
+local void gen_codes      OF((ct_data near *tree, int max_code));
+local void build_tree_1     OF((tree_desc near *desc));
+local void scan_tree      OF((ct_data near *tree, int max_code));
+local void send_tree      OF((ct_data near *tree, int max_code));
+local int  build_bl_tree  OF((void));
+local void send_all_trees OF((int lcodes, int dcodes, int blcodes));
+local void compress_block OF((ct_data near *ltree, ct_data near *dtree));
+local void set_file_type  OF((void));
+
+
+#ifndef DEBUG
+#  define send_code(c, tree) send_bits(tree[c].Code, tree[c].Len)
+   /* Send a code of the given tree. c and tree must not have side effects */
+
+#else /* DEBUG */
+#  define send_code(c, tree) \
+     { if (verbose>1) fprintf(stderr,"\ncd %3d ",(c)); \
+       send_bits(tree[c].Code, tree[c].Len); }
+#endif
+
+#define d_code(dist) \
+   ((dist) < 256 ? dist_code[dist] : dist_code[256+((dist)>>7)])
+/* Mapping from a distance to a distance code. dist is the distance - 1 and
+ * must not have side effects. dist_code[256] and dist_code[257] are never
+ * used.
+ */
+
+#define MAX(a,b) (a >= b ? a : b)
+/* the arguments must not have side effects */
+
+/* ===========================================================================
+ * Allocate the match buffer, initialize the various tables and save the
+ * location of the internal file attribute (ascii/binary) and method
+ * (DEFLATE/STORE).
+ */
+void ct_init(attr, methodp)
+    ush  *attr;   /* pointer to internal file attribute */
+    int  *methodp; /* pointer to compression method */
+{
+    int n;        /* iterates over tree elements */
+    int bits;     /* bit counter */
+    int length;   /* length value */
+    int code;     /* code value */
+    int dist;     /* distance index */
+
+    file_type = attr;
+    file_method = methodp;
+    compressed_len = input_len = 0L;
+        
+    if (static_dtree[0].Len != 0) return; /* ct_init already called */
+
+    /* Initialize the mapping length (0..255) -> length code (0..28) */
+    length = 0;
+    for (code = 0; code < LENGTH_CODES-1; code++) {
+        base_length[code] = length;
+        for (n = 0; n < (1<<extra_lbits[code]); n++) {
+            length_code[length++] = (uch)code;
+        }
+    }
+    Assert (length == 256, "ct_init: length != 256");
+    /* Note that the length 255 (match length 258) can be represented
+     * in two different ways: code 284 + 5 bits or code 285, so we
+     * overwrite length_code[255] to use the best encoding:
+     */
+    length_code[length-1] = (uch)code;
+
+    /* Initialize the mapping dist (0..32K) -> dist code (0..29) */
+    dist = 0;
+    for (code = 0 ; code < 16; code++) {
+        base_dist[code] = dist;
+        for (n = 0; n < (1<<extra_dbits[code]); n++) {
+            dist_code[dist++] = (uch)code;
+        }
+    }
+    Assert (dist == 256, "ct_init: dist != 256");
+    dist >>= 7; /* from now on, all distances are divided by 128 */
+    for ( ; code < D_CODES; code++) {
+        base_dist[code] = dist << 7;
+        for (n = 0; n < (1<<(extra_dbits[code]-7)); n++) {
+            dist_code[256 + dist++] = (uch)code;
+        }
+    }
+    Assert (dist == 256, "ct_init: 256+dist != 512");
+
+    /* Construct the codes of the static literal tree */
+    for (bits = 0; bits <= MAX_BITS; bits++) bl_count[bits] = 0;
+    n = 0;
+    while (n <= 143) static_ltree[n++].Len = 8, bl_count[8]++;
+    while (n <= 255) static_ltree[n++].Len = 9, bl_count[9]++;
+    while (n <= 279) static_ltree[n++].Len = 7, bl_count[7]++;
+    while (n <= 287) static_ltree[n++].Len = 8, bl_count[8]++;
+    /* Codes 286 and 287 do not exist, but we must include them in the
+     * tree construction to get a canonical Huffman tree (longest code
+     * all ones)
+     */
+    gen_codes((ct_data near *)static_ltree, L_CODES+1);
+
+    /* The static distance tree is trivial: */
+    for (n = 0; n < D_CODES; n++) {
+        static_dtree[n].Len = 5;
+        static_dtree[n].Code = bi_reverse(n, 5);
+    }
+
+    /* Initialize the first block of the first file: */
+    init_block();
+}
+
+/* ===========================================================================
+ * Initialize a new block.
+ */
+local void init_block()
+{
+    int n; /* iterates over tree elements */
+
+    /* Initialize the trees. */
+    for (n = 0; n < L_CODES;  n++) dyn_ltree[n].Freq = 0;
+    for (n = 0; n < D_CODES;  n++) dyn_dtree[n].Freq = 0;
+    for (n = 0; n < BL_CODES; n++) bl_tree[n].Freq = 0;
+
+    dyn_ltree[END_BLOCK].Freq = 1;
+    opt_len = static_len = 0L;
+    last_lit = last_dist = last_flags = 0;
+    flags = 0; flag_bit = 1;
+}
+
+#define SMALLEST 1
+/* Index within the heap array of least frequent node in the Huffman tree */
+
+
+/* ===========================================================================
+ * Remove the smallest element from the heap and recreate the heap with
+ * one less element. Updates heap and heap_len.
+ */
+#define pqremove(tree, top) \
+{\
+    top = heap[SMALLEST]; \
+    heap[SMALLEST] = heap[heap_len--]; \
+    pqdownheap(tree, SMALLEST); \
+}
+
+/* ===========================================================================
+ * Compares to subtrees, using the tree depth as tie breaker when
+ * the subtrees have equal frequency. This minimizes the worst case length.
+ */
+#define smaller(tree, n, m) \
+   (tree[n].Freq < tree[m].Freq || \
+   (tree[n].Freq == tree[m].Freq && depth[n] <= depth[m]))
+
+/* ===========================================================================
+ * Restore the heap property by moving down the tree starting at node k,
+ * exchanging a node with the smallest of its two sons if necessary, stopping
+ * when the heap property is re-established (each father smaller than its
+ * two sons).
+ */
+local void pqdownheap(tree, k)
+    ct_data near *tree;  /* the tree to restore */
+    int k;               /* node to move down */
+{
+    int v = heap[k];
+    int j = k << 1;  /* left son of k */
+    while (j <= heap_len) {
+        /* Set j to the smallest of the two sons: */
+        if (j < heap_len && smaller(tree, heap[j+1], heap[j])) j++;
+
+        /* Exit if v is smaller than both sons */
+        if (smaller(tree, v, heap[j])) break;
+
+        /* Exchange v with the smallest son */
+        heap[k] = heap[j];  k = j;
+
+        /* And continue down the tree, setting j to the left son of k */
+        j <<= 1;
+    }
+    heap[k] = v;
+}
+
+/* ===========================================================================
+ * Compute the optimal bit lengths for a tree and update the total bit length
+ * for the current block.
+ * IN assertion: the fields freq and dad are set, heap[heap_max] and
+ *    above are the tree nodes sorted by increasing frequency.
+ * OUT assertions: the field len is set to the optimal bit length, the
+ *     array bl_count contains the frequencies for each bit length.
+ *     The length opt_len is updated; static_len is also updated if stree is
+ *     not null.
+ */
+local void gen_bitlen(desc)
+    tree_desc near *desc; /* the tree descriptor */
+{
+    ct_data near *tree  = desc->dyn_tree;
+    int near *extra     = desc->extra_bits;
+    int base            = desc->extra_base;
+    int max_code        = desc->max_code;
+    int max_length      = desc->max_length;
+    ct_data near *stree = desc->static_tree;
+    int h;              /* heap index */
+    int n, m;           /* iterate over the tree elements */
+    int bits;           /* bit length */
+    int xbits;          /* extra bits */
+    ush f;              /* frequency */
+    int overflow = 0;   /* number of elements with bit length too large */
+
+    for (bits = 0; bits <= MAX_BITS; bits++) bl_count[bits] = 0;
+
+    /* In a first pass, compute the optimal bit lengths (which may
+     * overflow in the case of the bit length tree).
+     */
+    tree[heap[heap_max]].Len = 0; /* root of the heap */
+
+    for (h = heap_max+1; h < HEAP_SIZE; h++) {
+        n = heap[h];
+        bits = tree[tree[n].Dad].Len + 1;
+        if (bits > max_length) bits = max_length, overflow++;
+        tree[n].Len = (ush)bits;
+        /* We overwrite tree[n].Dad which is no longer needed */
+
+        if (n > max_code) continue; /* not a leaf node */
+
+        bl_count[bits]++;
+        xbits = 0;
+        if (n >= base) xbits = extra[n-base];
+        f = tree[n].Freq;
+        opt_len += (ulg)f * (bits + xbits);
+        if (stree) static_len += (ulg)f * (stree[n].Len + xbits);
+    }
+    if (overflow == 0) return;
+
+    Trace((stderr,"\nbit length overflow\n"));
+    /* This happens for example on obj2 and pic of the Calgary corpus */
+
+    /* Find the first bit length which could increase: */
+    do {
+        bits = max_length-1;
+        while (bl_count[bits] == 0) bits--;
+        bl_count[bits]--;      /* move one leaf down the tree */
+        bl_count[bits+1] += 2; /* move one overflow item as its brother */
+        bl_count[max_length]--;
+        /* The brother of the overflow item also moves one step up,
+         * but this does not affect bl_count[max_length]
+         */
+        overflow -= 2;
+    } while (overflow > 0);
+
+    /* Now recompute all bit lengths, scanning in increasing frequency.
+     * h is still equal to HEAP_SIZE. (It is simpler to reconstruct all
+     * lengths instead of fixing only the wrong ones. This idea is taken
+     * from 'ar' written by Haruhiko Okumura.)
+     */
+    for (bits = max_length; bits != 0; bits--) {
+        n = bl_count[bits];
+        while (n != 0) {
+            m = heap[--h];
+            if (m > max_code) continue;
+            if (tree[m].Len != (unsigned) bits) {
+                Trace((stderr,"code %d bits %d->%d\n", m, tree[m].Len, bits));
+                opt_len += ((long)bits-(long)tree[m].Len)*(long)tree[m].Freq;
+                tree[m].Len = (ush)bits;
+            }
+            n--;
+        }
+    }
+}
+
+/* ===========================================================================
+ * Generate the codes for a given tree and bit counts (which need not be
+ * optimal).
+ * IN assertion: the array bl_count contains the bit length statistics for
+ * the given tree and the field len is set for all tree elements.
+ * OUT assertion: the field code is set for all tree elements of non
+ *     zero code length.
+ */
+local void gen_codes (tree, max_code)
+    ct_data near *tree;        /* the tree to decorate */
+    int max_code;              /* largest code with non zero frequency */
+{
+    ush next_code[MAX_BITS+1]; /* next code value for each bit length */
+    ush code = 0;              /* running code value */
+    int bits;                  /* bit index */
+    int n;                     /* code index */
+
+    /* The distribution counts are first used to generate the code values
+     * without bit reversal.
+     */
+    for (bits = 1; bits <= MAX_BITS; bits++) {
+        next_code[bits] = code = (code + bl_count[bits-1]) << 1;
+    }
+    /* Check that the bit counts in bl_count are consistent. The last code
+     * must be all ones.
+     */
+    Assert (code + bl_count[MAX_BITS]-1 == (1<<MAX_BITS)-1,
+            "inconsistent bit counts");
+    Tracev((stderr,"\ngen_codes: max_code %d ", max_code));
+
+    for (n = 0;  n <= max_code; n++) {
+        int len = tree[n].Len;
+        if (len == 0) continue;
+        /* Now reverse the bits */
+        tree[n].Code = bi_reverse(next_code[len]++, len);
+
+        Tracec(tree != static_ltree, (stderr,"\nn %3d %c l %2d c %4x (%x) ",
+             n, (isgraph(n) ? n : ' '), len, tree[n].Code, next_code[len]-1));
+    }
+}
+
+/* ===========================================================================
+ * Construct one Huffman tree and assigns the code bit strings and lengths.
+ * Update the total bit length for the current block.
+ * IN assertion: the field freq is set for all tree elements.
+ * OUT assertions: the fields len and code are set to the optimal bit length
+ *     and corresponding code. The length opt_len is updated; static_len is
+ *     also updated if stree is not null. The field max_code is set.
+ */
+local void build_tree_1(desc)
+    tree_desc near *desc; /* the tree descriptor */
+{
+    ct_data near *tree   = desc->dyn_tree;
+    ct_data near *stree  = desc->static_tree;
+    int elems            = desc->elems;
+    int n, m;          /* iterate over heap elements */
+    int max_code = -1; /* largest code with non zero frequency */
+    int node = elems;  /* next internal node of the tree */
+
+    /* Construct the initial heap, with least frequent element in
+     * heap[SMALLEST]. The sons of heap[n] are heap[2*n] and heap[2*n+1].
+     * heap[0] is not used.
+     */
+    heap_len = 0, heap_max = HEAP_SIZE;
+
+    for (n = 0; n < elems; n++) {
+        if (tree[n].Freq != 0) {
+            heap[++heap_len] = max_code = n;
+            depth[n] = 0;
+        } else {
+            tree[n].Len = 0;
+        }
+    }
+
+    /* The pkzip format requires that at least one distance code exists,
+     * and that at least one bit should be sent even if there is only one
+     * possible code. So to avoid special checks later on we force at least
+     * two codes of non zero frequency.
+     */
+    while (heap_len < 2) {
+        int new = heap[++heap_len] = (max_code < 2 ? ++max_code : 0);
+        tree[new].Freq = 1;
+        depth[new] = 0;
+        opt_len--; if (stree) static_len -= stree[new].Len;
+        /* new is 0 or 1 so it does not have extra bits */
+    }
+    desc->max_code = max_code;
+
+    /* The elements heap[heap_len/2+1 .. heap_len] are leaves of the tree,
+     * establish sub-heaps of increasing lengths:
+     */
+    for (n = heap_len/2; n >= 1; n--) pqdownheap(tree, n);
+
+    /* Construct the Huffman tree by repeatedly combining the least two
+     * frequent nodes.
+     */
+    do {
+        pqremove(tree, n);   /* n = node of least frequency */
+        m = heap[SMALLEST];  /* m = node of next least frequency */
+
+        heap[--heap_max] = n; /* keep the nodes sorted by frequency */
+        heap[--heap_max] = m;
+
+        /* Create a new node father of n and m */
+        tree[node].Freq = tree[n].Freq + tree[m].Freq;
+        depth[node] = (uch) (MAX(depth[n], depth[m]) + 1);
+        tree[n].Dad = tree[m].Dad = (ush)node;
+#ifdef DUMP_BL_TREE
+        if (tree == bl_tree) {
+            fprintf(stderr,"\nnode %d(%d), sons %d(%d) %d(%d)",
+                    node, tree[node].Freq, n, tree[n].Freq, m, tree[m].Freq);
+        }
+#endif
+        /* and insert the new node in the heap */
+        heap[SMALLEST] = node++;
+        pqdownheap(tree, SMALLEST);
+
+    } while (heap_len >= 2);
+
+    heap[--heap_max] = heap[SMALLEST];
+
+    /* At this point, the fields freq and dad are set. We can now
+     * generate the bit lengths.
+     */
+    gen_bitlen((tree_desc near *)desc);
+
+    /* The field len is now set, we can generate the bit codes */
+    gen_codes ((ct_data near *)tree, max_code);
+}
+
+/* ===========================================================================
+ * Scan a literal or distance tree to determine the frequencies of the codes
+ * in the bit length tree. Updates opt_len to take into account the repeat
+ * counts. (The contribution of the bit length codes will be added later
+ * during the construction of bl_tree.)
+ */
+local void scan_tree (tree, max_code)
+    ct_data near *tree; /* the tree to be scanned */
+    int max_code;       /* and its largest code of non zero frequency */
+{
+    int n;                     /* iterates over all tree elements */
+    int prevlen = -1;          /* last emitted length */
+    int curlen;                /* length of current code */
+    int nextlen = tree[0].Len; /* length of next code */
+    int count = 0;             /* repeat count of the current code */
+    int max_count = 7;         /* max repeat count */
+    int min_count = 4;         /* min repeat count */
+
+    if (nextlen == 0) max_count = 138, min_count = 3;
+    tree[max_code+1].Len = (ush)0xffff; /* guard */
+
+    for (n = 0; n <= max_code; n++) {
+        curlen = nextlen; nextlen = tree[n+1].Len;
+        if (++count < max_count && curlen == nextlen) {
+            continue;
+        } else if (count < min_count) {
+            bl_tree[curlen].Freq += count;
+        } else if (curlen != 0) {
+            if (curlen != prevlen) bl_tree[curlen].Freq++;
+            bl_tree[REP_3_6].Freq++;
+        } else if (count <= 10) {
+            bl_tree[REPZ_3_10].Freq++;
+        } else {
+            bl_tree[REPZ_11_138].Freq++;
+        }
+        count = 0; prevlen = curlen;
+        if (nextlen == 0) {
+            max_count = 138, min_count = 3;
+        } else if (curlen == nextlen) {
+            max_count = 6, min_count = 3;
+        } else {
+            max_count = 7, min_count = 4;
+        }
+    }
+}
+
+/* ===========================================================================
+ * Send a literal or distance tree in compressed form, using the codes in
+ * bl_tree.
+ */
+local void send_tree (tree, max_code)
+    ct_data near *tree; /* the tree to be scanned */
+    int max_code;       /* and its largest code of non zero frequency */
+{
+    int n;                     /* iterates over all tree elements */
+    int prevlen = -1;          /* last emitted length */
+    int curlen;                /* length of current code */
+    int nextlen = tree[0].Len; /* length of next code */
+    int count = 0;             /* repeat count of the current code */
+    int max_count = 7;         /* max repeat count */
+    int min_count = 4;         /* min repeat count */
+
+    /* tree[max_code+1].Len = -1; */  /* guard already set */
+    if (nextlen == 0) max_count = 138, min_count = 3;
+
+    for (n = 0; n <= max_code; n++) {
+        curlen = nextlen; nextlen = tree[n+1].Len;
+        if (++count < max_count && curlen == nextlen) {
+            continue;
+        } else if (count < min_count) {
+            do { send_code(curlen, bl_tree); } while (--count != 0);
+
+        } else if (curlen != 0) {
+            if (curlen != prevlen) {
+                send_code(curlen, bl_tree); count--;
+            }
+            Assert(count >= 3 && count <= 6, " 3_6?");
+            send_code(REP_3_6, bl_tree); send_bits(count-3, 2);
+
+        } else if (count <= 10) {
+            send_code(REPZ_3_10, bl_tree); send_bits(count-3, 3);
+
+        } else {
+            send_code(REPZ_11_138, bl_tree); send_bits(count-11, 7);
+        }
+        count = 0; prevlen = curlen;
+        if (nextlen == 0) {
+            max_count = 138, min_count = 3;
+        } else if (curlen == nextlen) {
+            max_count = 6, min_count = 3;
+        } else {
+            max_count = 7, min_count = 4;
+        }
+    }
+}
+
+/* ===========================================================================
+ * Construct the Huffman tree for the bit lengths and return the index in
+ * bl_order of the last bit length code to send.
+ */
+local int build_bl_tree()
+{
+    int max_blindex;  /* index of last bit length code of non zero freq */
+
+    /* Determine the bit length frequencies for literal and distance trees */
+    scan_tree((ct_data near *)dyn_ltree, l_desc.max_code);
+    scan_tree((ct_data near *)dyn_dtree, d_desc.max_code);
+
+    /* Build the bit length tree: */
+    build_tree_1((tree_desc near *)(&bl_desc));
+    /* opt_len now includes the length of the tree representations, except
+     * the lengths of the bit lengths codes and the 5+5+4 bits for the counts.
+     */
+
+    /* Determine the number of bit length codes to send. The pkzip format
+     * requires that at least 4 bit length codes be sent. (appnote.txt says
+     * 3 but the actual value used is 4.)
+     */
+    for (max_blindex = BL_CODES-1; max_blindex >= 3; max_blindex--) {
+        if (bl_tree[bl_order[max_blindex]].Len != 0) break;
+    }
+    /* Update opt_len to include the bit length tree and counts */
+    opt_len += 3*(max_blindex+1) + 5+5+4;
+    Tracev((stderr, "\ndyn trees: dyn %lu, stat %lu", opt_len, static_len));
+
+    return max_blindex;
+}
+
+/* ===========================================================================
+ * Send the header for a block using dynamic Huffman trees: the counts, the
+ * lengths of the bit length codes, the literal tree and the distance tree.
+ * IN assertion: lcodes >= 257, dcodes >= 1, blcodes >= 4.
+ */
+local void send_all_trees(lcodes, dcodes, blcodes)
+    int lcodes, dcodes, blcodes; /* number of codes for each tree */
+{
+    int rank;                    /* index in bl_order */
+
+    Assert (lcodes >= 257 && dcodes >= 1 && blcodes >= 4, "not enough codes");
+    Assert (lcodes <= L_CODES && dcodes <= D_CODES && blcodes <= BL_CODES,
+            "too many codes");
+    Tracev((stderr, "\nbl counts: "));
+    send_bits(lcodes-257, 5); /* not +255 as stated in appnote.txt */
+    send_bits(dcodes-1,   5);
+    send_bits(blcodes-4,  4); /* not -3 as stated in appnote.txt */
+    for (rank = 0; rank < blcodes; rank++) {
+        Tracev((stderr, "\nbl code %2d ", bl_order[rank]));
+        send_bits(bl_tree[bl_order[rank]].Len, 3);
+    }
+
+    send_tree((ct_data near *)dyn_ltree, lcodes-1); /* send the literal tree */
+
+    send_tree((ct_data near *)dyn_dtree, dcodes-1); /* send the distance tree */
+}
+
+/* ===========================================================================
+ * Determine the best encoding for the current block: dynamic trees, static
+ * trees or store, and output the encoded block to the zip file. This function
+ * returns the total compressed length for the file so far.
+ */
+off_t flush_block(buf, stored_len, pad, eof)
+    char *buf;        /* input block, or NULL if too old */
+    ulg stored_len;   /* length of input block */
+    int pad;          /* pad output to byte boundary */
+    int eof;          /* true if this is the last block for a file */
+{
+    ulg opt_lenb, static_lenb; /* opt_len and static_len in bytes */
+    int max_blindex;  /* index of last bit length code of non zero freq */
+
+    flag_buf[last_flags] = flags; /* Save the flags for the last 8 items */
+
+     /* Check if the file is ascii or binary */
+    if (*file_type == (ush)UNKNOWN) set_file_type();
+
+    /* Construct the literal and distance trees */
+    build_tree_1((tree_desc near *)(&l_desc));
+    Tracev((stderr, "\nlit data: dyn %lu, stat %lu", opt_len, static_len));
+
+    build_tree_1((tree_desc near *)(&d_desc));
+    Tracev((stderr, "\ndist data: dyn %lu, stat %lu", opt_len, static_len));
+    /* At this point, opt_len and static_len are the total bit lengths of
+     * the compressed block data, excluding the tree representations.
+     */
+
+    /* Build the bit length tree for the above two trees, and get the index
+     * in bl_order of the last bit length code to send.
+     */
+    max_blindex = build_bl_tree();
+
+    /* Determine the best encoding. Compute first the block length in bytes */
+    opt_lenb = (opt_len+3+7)>>3;
+    static_lenb = (static_len+3+7)>>3;
+    input_len += stored_len; /* for debugging only */
+
+    Trace((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u ",
+            opt_lenb, opt_len, static_lenb, static_len, stored_len,
+            last_lit, last_dist));
+
+    if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
+
+    /* If compression failed and this is the first and last block,
+     * and if the zip file can be seeked (to rewrite the local header),
+     * the whole file is transformed into a stored file:
+     */
+#ifdef FORCE_METHOD
+    if (level == 1 && eof && compressed_len == 0L) { /* force stored file */
+#else
+    if (stored_len <= opt_lenb && eof && compressed_len == 0L && seekable()) {
+#endif
+        /* Since LIT_BUFSIZE <= 2*WSIZE, the input data must be there: */
+        if (buf == (char*)0) error ("block vanished");
+
+        copy_block(buf, (unsigned)stored_len, 0); /* without header */
+        compressed_len = stored_len << 3;
+        *file_method = STORED;
+
+#ifdef FORCE_METHOD
+    } else if (level == 2 && buf != (char*)0) { /* force stored block */
+#else
+    } else if (stored_len+4 <= opt_lenb && buf != (char*)0) {
+                       /* 4: two words for the lengths */
+#endif
+        /* The test buf != NULL is only necessary if LIT_BUFSIZE > WSIZE.
+         * Otherwise we can't have processed more than WSIZE input bytes since
+         * the last block flush, because compression would have been
+         * successful. If LIT_BUFSIZE <= WSIZE, it is never too late to
+         * transform a block into a stored block.
+         */
+        send_bits((STORED_BLOCK<<1)+eof, 3);  /* send block type */
+        compressed_len = (compressed_len + 3 + 7) & ~7L;
+        compressed_len += (stored_len + 4) << 3;
+
+        copy_block(buf, (unsigned)stored_len, 1); /* with header */
+
+#ifdef FORCE_METHOD
+    } else if (level == 3) { /* force static trees */
+#else
+    } else if (static_lenb == opt_lenb) {
+#endif
+        send_bits((STATIC_TREES<<1)+eof, 3);
+        compress_block((ct_data near *)static_ltree, (ct_data near *)static_dtree);
+        compressed_len += 3 + static_len;
+    } else {
+        send_bits((DYN_TREES<<1)+eof, 3);
+        send_all_trees(l_desc.max_code+1, d_desc.max_code+1, max_blindex+1);
+        compress_block((ct_data near *)dyn_ltree, (ct_data near *)dyn_dtree);
+        compressed_len += 3 + opt_len;
+    }
+    Assert (compressed_len == bits_sent, "bad compressed size");
+    init_block();
+
+    if (eof) {
+        Assert (input_len == bytes_in, "bad input size");
+        bi_windup();
+        compressed_len += 7;  /* align on byte boundary */
+    } else if (pad && (compressed_len % 8) != 0) {
+        send_bits((STORED_BLOCK<<1)+eof, 3);  /* send block type */
+        compressed_len = (compressed_len + 3 + 7) & ~7L;
+        copy_block(buf, 0, 1); /* with header */
+    }
+
+    return compressed_len >> 3;
+}
+
+/* ===========================================================================
+ * Save the match info and tally the frequency counts. Return true if
+ * the current block must be flushed.
+ */
+int ct_tally (dist, lc)
+    int dist;  /* distance of matched string */
+    int lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
+{
+    l_buf[last_lit++] = (uch)lc;
+    if (dist == 0) {
+        /* lc is the unmatched char */
+        dyn_ltree[lc].Freq++;
+    } else {
+        /* Here, lc is the match length - MIN_MATCH */
+        dist--;             /* dist = match distance - 1 */
+        Assert((ush)dist < (ush)MAX_DIST &&
+               (ush)lc <= (ush)(MAX_MATCH-MIN_MATCH) &&
+               (ush)d_code(dist) < (ush)D_CODES,  "ct_tally: bad match");
+
+        dyn_ltree[length_code[lc]+LITERALS+1].Freq++;
+        dyn_dtree[d_code(dist)].Freq++;
+
+        d_buf[last_dist++] = (ush)dist;
+        flags |= flag_bit;
+    }
+    flag_bit <<= 1;
+
+    /* Output the flags if they fill a byte: */
+    if ((last_lit & 7) == 0) {
+        flag_buf[last_flags++] = flags;
+        flags = 0, flag_bit = 1;
+    }
+    /* Try to guess if it is profitable to stop the current block here */
+    if (level > 2 && (last_lit & 0xfff) == 0) {
+        /* Compute an upper bound for the compressed length */
+        ulg out_length = (ulg)last_lit*8L;
+        ulg in_length = (ulg)strstart-block_start;
+        int dcode;
+        for (dcode = 0; dcode < D_CODES; dcode++) {
+            out_length += (ulg)dyn_dtree[dcode].Freq*(5L+extra_dbits[dcode]);
+        }
+        out_length >>= 3;
+        Trace((stderr,"\nlast_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%) ",
+               last_lit, last_dist, in_length, out_length,
+               100L - out_length*100L/in_length));
+        if (last_dist < last_lit/2 && out_length < in_length/2) return 1;
+    }
+    return (last_lit == LIT_BUFSIZE-1 || last_dist == DIST_BUFSIZE);
+    /* We avoid equality with LIT_BUFSIZE because of wraparound at 64K
+     * on 16 bit machines and because stored blocks are restricted to
+     * 64K-1 bytes.
+     */
+}
+
+/* ===========================================================================
+ * Send the block data compressed using the given Huffman trees
+ */
+local void compress_block(ltree, dtree)
+    ct_data near *ltree; /* literal tree */
+    ct_data near *dtree; /* distance tree */
+{
+    unsigned dist;      /* distance of matched string */
+    int lc;             /* match length or unmatched char (if dist == 0) */
+    unsigned lx = 0;    /* running index in l_buf */
+    unsigned dx = 0;    /* running index in d_buf */
+    unsigned fx = 0;    /* running index in flag_buf */
+    uch flag = 0;       /* current flags */
+    unsigned code;      /* the code to send */
+    int extra;          /* number of extra bits to send */
+
+    if (last_lit != 0) do {
+        if ((lx & 7) == 0) flag = flag_buf[fx++];
+        lc = l_buf[lx++];
+        if ((flag & 1) == 0) {
+            send_code(lc, ltree); /* send a literal byte */
+            Tracecv(isgraph(lc), (stderr," '%c' ", lc));
+        } else {
+            /* Here, lc is the match length - MIN_MATCH */
+            code = length_code[lc];
+            send_code(code+LITERALS+1, ltree); /* send the length code */
+            extra = extra_lbits[code];
+            if (extra != 0) {
+                lc -= base_length[code];
+                send_bits(lc, extra);        /* send the extra length bits */
+            }
+            dist = d_buf[dx++];
+            /* Here, dist is the match distance - 1 */
+            code = d_code(dist);
+            Assert (code < D_CODES, "bad d_code");
+
+            send_code(code, dtree);       /* send the distance code */
+            extra = extra_dbits[code];
+            if (extra != 0) {
+                dist -= base_dist[code];
+                send_bits(dist, extra);   /* send the extra distance bits */
+            }
+        } /* literal or match pair ? */
+        flag >>= 1;
+    } while (lx < last_lit);
+
+    send_code(END_BLOCK, ltree);
+}
+
+/* ===========================================================================
+ * Set the file type to ASCII or BINARY, using a crude approximation:
+ * binary if more than 20% of the bytes are <= 6 or >= 128, ascii otherwise.
+ * IN assertion: the fields freq of dyn_ltree are set and the total of all
+ * frequencies does not exceed 64K (to fit in an int on 16 bit machines).
+ */
+local void set_file_type()
+{
+    int n = 0;
+    unsigned ascii_freq = 0;
+    unsigned bin_freq = 0;
+    while (n < 7)        bin_freq += dyn_ltree[n++].Freq;
+    while (n < 128)    ascii_freq += dyn_ltree[n++].Freq;
+    while (n < LITERALS) bin_freq += dyn_ltree[n++].Freq;
+    *file_type = bin_freq > (ascii_freq >> 2) ? BINARY : ASCII;
+    if (*file_type == BINARY && translate_eol) {
+        warning ("-l used on binary file");
+    }
+}
+/* unlzh.c -- decompress files in SCO compress -H (LZH) format.
+ * The code in this file is directly derived from the public domain 'ar002'
+ * written by Haruhiko Okumura.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: unlzh.c,v 1.2 1993/06/24 10:59:01 jloup Exp $";
+#endif
+
+/* decode.c */
+
+local unsigned  decode  OF((unsigned count, uch buffer[]));
+local void decode_start OF((void));
+
+/* huf.c */
+local void huf_decode_start OF((void));
+local unsigned decode_c     OF((void));
+local unsigned decode_p     OF((void));
+local void read_pt_len      OF((int nn, int nbit, int i_special));
+local void read_c_len       OF((void));
+
+/* io.c */
+local void fillbuf      OF((int n));
+local unsigned getbits  OF((int n));
+local void init_getbits OF((void));
+
+/* maketbl.c */
+
+local void make_table OF((int nchar, uch bitlen[],
+			  int tablebits, ush table[]));
+
+
+#define DICBIT    13    /* 12(-lh4-) or 13(-lh5-) */
+#define DICSIZ ((unsigned) 1 << DICBIT)
+
+#ifndef CHAR_BIT
+#  define CHAR_BIT 8
+#endif
+
+#ifndef UCHAR_MAX
+#  define UCHAR_MAX 255
+#endif
+
+#define BITBUFSIZ (CHAR_BIT * 2 * sizeof(char))
+/* Do not use CHAR_BIT * sizeof(bitbuf), does not work on machines
+ * for which short is not on 16 bits (Cray).
+ */
+
+/* encode.c and decode.c */
+
+#define MAXMATCH 256    /* formerly F (not more than UCHAR_MAX + 1) */
+#define THRESHOLD  3    /* choose optimal value */
+
+/* huf.c */
+
+#define NC (UCHAR_MAX + MAXMATCH + 2 - THRESHOLD)
+	/* alphabet = {0, 1, 2, ..., NC - 1} */
+#define CBIT 9  /* $\lfloor \log_2 NC \rfloor + 1$ */
+#define CODE_BIT  16  /* codeword length */
+
+#define NP (DICBIT + 1)
+#define NT (CODE_BIT + 3)
+#define PBIT 4  /* smallest integer such that (1U << PBIT) > NP */
+#define TBIT 5  /* smallest integer such that (1U << TBIT) > NT */
+#if NT > NP
+# define NPT NT
+#else
+# define NPT NP
+#endif
+
+/* local ush left[2 * NC - 1]; */
+/* local ush right[2 * NC - 1]; */
+#define left  prev
+#define right head
+#if NC > (1<<(BITS-2))
+    error cannot overlay left+right and prev
+#endif
+
+/* local uch c_len[NC]; */
+#define c_len outbuf
+#if NC > OUTBUFSIZ
+    error cannot overlay c_len and outbuf
+#endif
+
+local uch pt_len[NPT];
+local unsigned blocksize;
+local ush pt_table[256];
+
+/* local ush c_table[4096]; */
+#define c_table d_buf
+#if (DIST_BUFSIZE-1) < 4095
+    error cannot overlay c_table and d_buf
+#endif
+
+/***********************************************************
+        io.c -- input/output
+***********************************************************/
+
+local ush       io_bitbuf;
+local unsigned  subbitbuf;
+local int       bitcount;
+
+local void fillbuf(n)  /* Shift io_bitbuf n bits left, read n bits */
+    int n;
+{
+    io_bitbuf <<= n;
+    while (n > bitcount) {
+	io_bitbuf |= subbitbuf << (n -= bitcount);
+	subbitbuf = (unsigned)try_byte();
+	if ((int)subbitbuf == EOF) subbitbuf = 0;
+	bitcount = CHAR_BIT;
+    }
+    io_bitbuf |= subbitbuf >> (bitcount -= n);
+}
+
+local unsigned getbits(n)
+    int n;
+{
+    unsigned x;
+
+    x = io_bitbuf >> (BITBUFSIZ - n);  fillbuf(n);
+    return x;
+}
+
+local void init_getbits()
+{
+    io_bitbuf = 0;  subbitbuf = 0;  bitcount = 0;
+    fillbuf(BITBUFSIZ);
+}
+
+/***********************************************************
+	maketbl.c -- make table for decoding
+***********************************************************/
+
+local void make_table(nchar, bitlen, tablebits, table)
+    int nchar;
+    uch bitlen[];
+    int tablebits;
+    ush table[];
+{
+    ush count[17], weight[17], start[18], *p;
+    unsigned i, k, len, ch, jutbits, avail, nextcode, mask;
+
+    for (i = 1; i <= 16; i++) count[i] = 0;
+    for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;
+
+    start[1] = 0;
+    for (i = 1; i <= 16; i++)
+	start[i + 1] = start[i] + (count[i] << (16 - i));
+    if ((start[17] & 0xffff) != 0)
+	error("Bad table\n");
+
+    jutbits = 16 - tablebits;
+    for (i = 1; i <= (unsigned)tablebits; i++) {
+	start[i] >>= jutbits;
+	weight[i] = (unsigned) 1 << (tablebits - i);
+    }
+    while (i <= 16) {
+	weight[i] = (unsigned) 1 << (16 - i);
+	i++;
+    }
+
+    i = start[tablebits + 1] >> jutbits;
+    if (i != 0) {
+	k = 1 << tablebits;
+	while (i != k) table[i++] = 0;
+    }
+
+    avail = nchar;
+    mask = (unsigned) 1 << (15 - tablebits);
+    for (ch = 0; ch < (unsigned)nchar; ch++) {
+	if ((len = bitlen[ch]) == 0) continue;
+	nextcode = start[len] + weight[len];
+	if (len <= (unsigned)tablebits) {
+	    for (i = start[len]; i < nextcode; i++) table[i] = ch;
+	} else {
+	    k = start[len];
+	    p = &table[k >> jutbits];
+	    i = len - tablebits;
+	    while (i != 0) {
+		if (*p == 0) {
+		    right[avail] = left[avail] = 0;
+		    *p = avail++;
+		}
+		if (k & mask) p = &right[*p];
+		else          p = &left[*p];
+		k <<= 1;  i--;
+	    }
+	    *p = ch;
+	}
+	start[len] = nextcode;
+    }
+}
+
+/***********************************************************
+        huf.c -- static Huffman
+***********************************************************/
+
+local void read_pt_len(nn, nbit, i_special)
+    int nn;
+    int nbit;
+    int i_special;
+{
+    int i, c, n;
+    unsigned mask;
+
+    n = getbits(nbit);
+    if (n == 0) {
+	c = getbits(nbit);
+	for (i = 0; i < nn; i++) pt_len[i] = 0;
+	for (i = 0; i < 256; i++) pt_table[i] = c;
+    } else {
+	i = 0;
+	while (i < n) {
+	    c = io_bitbuf >> (BITBUFSIZ - 3);
+	    if (c == 7) {
+		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
+		while (mask & io_bitbuf) {  mask >>= 1;  c++;  }
+	    }
+	    fillbuf((c < 7) ? 3 : c - 3);
+	    pt_len[i++] = c;
+	    if (i == i_special) {
+		c = getbits(2);
+		while (--c >= 0) pt_len[i++] = 0;
+	    }
+	}
+	while (i < nn) pt_len[i++] = 0;
+	make_table(nn, pt_len, 8, pt_table);
+    }
+}
+
+local void read_c_len()
+{
+    int i, c, n;
+    unsigned mask;
+
+    n = getbits(CBIT);
+    if (n == 0) {
+	c = getbits(CBIT);
+	for (i = 0; i < NC; i++) c_len[i] = 0;
+	for (i = 0; i < 4096; i++) c_table[i] = c;
+    } else {
+	i = 0;
+	while (i < n) {
+	    c = pt_table[io_bitbuf >> (BITBUFSIZ - 8)];
+	    if (c >= NT) {
+		mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
+		do {
+		    if (io_bitbuf & mask) c = right[c];
+		    else               c = left [c];
+		    mask >>= 1;
+		} while (c >= NT);
+	    }
+	    fillbuf((int) pt_len[c]);
+	    if (c <= 2) {
+		if      (c == 0) c = 1;
+		else if (c == 1) c = getbits(4) + 3;
+		else             c = getbits(CBIT) + 20;
+		while (--c >= 0) c_len[i++] = 0;
+	    } else c_len[i++] = c - 2;
+	}
+	while (i < NC) c_len[i++] = 0;
+	make_table(NC, c_len, 12, c_table);
+    }
+}
+
+local unsigned decode_c()
+{
+    unsigned j, mask;
+
+    if (blocksize == 0) {
+	blocksize = getbits(16);
+	if (blocksize == 0) {
+	    return NC; /* end of file */
+	}
+	read_pt_len(NT, TBIT, 3);
+	read_c_len();
+	read_pt_len(NP, PBIT, -1);
+    }
+    blocksize--;
+    j = c_table[io_bitbuf >> (BITBUFSIZ - 12)];
+    if (j >= NC) {
+	mask = (unsigned) 1 << (BITBUFSIZ - 1 - 12);
+	do {
+	    if (io_bitbuf & mask) j = right[j];
+	    else               j = left [j];
+	    mask >>= 1;
+	} while (j >= NC);
+    }
+    fillbuf((int) c_len[j]);
+    return j;
+}
+
+local unsigned decode_p()
+{
+    unsigned j, mask;
+
+    j = pt_table[io_bitbuf >> (BITBUFSIZ - 8)];
+    if (j >= NP) {
+	mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
+	do {
+	    if (io_bitbuf & mask) j = right[j];
+	    else               j = left [j];
+	    mask >>= 1;
+	} while (j >= NP);
+    }
+    fillbuf((int) pt_len[j]);
+    if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));
+    return j;
+}
+
+local void huf_decode_start()
+{
+    init_getbits();  blocksize = 0;
+}
+
+/***********************************************************
+        decode.c
+***********************************************************/
+
+local int j;    /* remaining bytes to copy */
+local int done; /* set at end of input */
+
+local void decode_start()
+{
+    huf_decode_start();
+    j = 0;
+    done = 0;
+}
+
+/* Decode the input and return the number of decoded bytes put in buffer
+ */
+local unsigned decode(count, buffer)
+    unsigned count;
+    uch buffer[];
+    /* The calling function must keep the number of
+       bytes to be processed.  This function decodes
+       either 'count' bytes or 'DICSIZ' bytes, whichever
+       is smaller, into the array 'buffer[]' of size
+       'DICSIZ' or more.
+       Call decode_start() once for each new file
+       before calling this function.
+     */
+{
+    local unsigned i;
+    unsigned r, c;
+
+    r = 0;
+    while (--j >= 0) {
+	buffer[r] = buffer[i];
+	i = (i + 1) & (DICSIZ - 1);
+	if (++r == count) return r;
+    }
+    for ( ; ; ) {
+	c = decode_c();
+	if (c == NC) {
+	    done = 1;
+	    return r;
+	}
+	if (c <= UCHAR_MAX) {
+	    buffer[r] = c;
+	    if (++r == count) return r;
+	} else {
+	    j = c - (UCHAR_MAX + 1 - THRESHOLD);
+	    i = (r - decode_p() - 1) & (DICSIZ - 1);
+	    while (--j >= 0) {
+		buffer[r] = buffer[i];
+		i = (i + 1) & (DICSIZ - 1);
+		if (++r == count) return r;
+	    }
+	}
+    }
+}
+
+
+/* ===========================================================================
+ * Unlzh in to out. Return OK or ERROR.
+ */
+int unlzh(in, out)
+    int in;
+    int out;
+{
+    unsigned n;
+    ifd = in;
+    ofd = out;
+
+    decode_start();
+    while (!done) {
+	n = decode((unsigned) DICSIZ, window);
+	if (!test && n > 0) {
+	    write_buf(out, (char*)window, n);
+	}
+    }
+    return OK;
+}
+/* unlzw.c -- decompress files in LZW format.
+ * The code in this file is directly derived from the public domain 'compress'
+ * written by Spencer Thomas, Joe Orost, James Woods, Jim McKie, Steve Davies,
+ * Ken Turkowski, Dave Mack and Peter Jannesen.
+ *
+ * This is a temporary version which will be rewritten in some future version
+ * to accommodate in-memory decompression.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: unlzw.c,v 0.15 1993/06/10 13:28:35 jloup Exp $";
+#endif
+
+typedef	unsigned char	char_type;
+typedef          long   code_int;
+typedef unsigned long 	count_int;
+typedef unsigned short	count_short;
+typedef unsigned long 	cmp_code_int;
+
+#define MAXCODE(n)	(1L << (n))
+    
+#ifndef	REGISTERS
+#	define	REGISTERS	2
+#endif
+#define	REG1	
+#define	REG2	
+#define	REG3	
+#define	REG4	
+#define	REG5	
+#define	REG6	
+#define	REG7	
+#define	REG8	
+#define	REG9	
+#define	REG10
+#define	REG11	
+#define	REG12	
+#define	REG13
+#define	REG14
+#define	REG15
+#define	REG16
+#if REGISTERS >= 1
+#	undef	REG1
+#	define	REG1	register
+#endif
+#if REGISTERS >= 2
+#	undef	REG2
+#	define	REG2	register
+#endif
+#if REGISTERS >= 3
+#	undef	REG3
+#	define	REG3	register
+#endif
+#if REGISTERS >= 4
+#	undef	REG4
+#	define	REG4	register
+#endif
+#if REGISTERS >= 5
+#	undef	REG5
+#	define	REG5	register
+#endif
+#if REGISTERS >= 6
+#	undef	REG6
+#	define	REG6	register
+#endif
+#if REGISTERS >= 7
+#	undef	REG7
+#	define	REG7	register
+#endif
+#if REGISTERS >= 8
+#	undef	REG8
+#	define	REG8	register
+#endif
+#if REGISTERS >= 9
+#	undef	REG9
+#	define	REG9	register
+#endif
+#if REGISTERS >= 10
+#	undef	REG10
+#	define	REG10	register
+#endif
+#if REGISTERS >= 11
+#	undef	REG11
+#	define	REG11	register
+#endif
+#if REGISTERS >= 12
+#	undef	REG12
+#	define	REG12	register
+#endif
+#if REGISTERS >= 13
+#	undef	REG13
+#	define	REG13	register
+#endif
+#if REGISTERS >= 14
+#	undef	REG14
+#	define	REG14	register
+#endif
+#if REGISTERS >= 15
+#	undef	REG15
+#	define	REG15	register
+#endif
+#if REGISTERS >= 16
+#	undef	REG16
+#	define	REG16	register
+#endif
+    
+#ifndef	BYTEORDER
+#	define	BYTEORDER	0000
+#endif
+	
+#ifndef	NOALLIGN
+#	define	NOALLIGN	0
+#endif
+
+
+union	bytes {
+    long  word;
+    struct {
+#if BYTEORDER == 4321
+	char_type	b1;
+	char_type	b2;
+	char_type	b3;
+	char_type	b4;
+#else
+#if BYTEORDER == 1234
+	char_type	b4;
+	char_type	b3;
+	char_type	b2;
+	char_type	b1;
+#else
+#	undef	BYTEORDER
+	int  dummy;
+#endif
+#endif
+    } bytes;
+};
+
+#if BYTEORDER == 4321 && NOALLIGN == 1
+#  define input(b,o,c,n,m){ \
+     (c) = (*(long *)(&(b)[(o)>>3])>>((o)&0x7))&(m); \
+     (o) += (n); \
+   }
+#else
+#  define input(b,o,c,n,m){ \
+     REG1 char_type *p = &(b)[(o)>>3]; \
+     (c) = ((((long)(p[0]))|((long)(p[1])<<8)| \
+     ((long)(p[2])<<16))>>((o)&0x7))&(m); \
+     (o) += (n); \
+   }
+#endif
+
+#ifndef MAXSEG_64K
+   /* DECLARE(ush, tab_prefix, (1<<BITS)); -- prefix code */
+#  define tab_prefixof(i) tab_prefix[i]
+#  define clear_tab_prefixof()	memzero(tab_prefix, 256);
+#else
+   /* DECLARE(ush, tab_prefix0, (1<<(BITS-1)); -- prefix for even codes */
+   /* DECLARE(ush, tab_prefix1, (1<<(BITS-1)); -- prefix for odd  codes */
+   ush *tab_prefix[2];
+#  define tab_prefixof(i) tab_prefix[(i)&1][(i)>>1]
+#  define clear_tab_prefixof()	\
+      memzero(tab_prefix0, 128), \
+      memzero(tab_prefix1, 128);
+#endif
+#define de_stack        ((char_type *)(&d_buf[DIST_BUFSIZE-1]))
+#define tab_suffixof(i) tab_suffix[i]
+
+int block_mode = BLOCK_MODE; /* block compress mode -C compatible with 2.0 */
+
+/* ============================================================================
+ * Decompress in to out.  This routine adapts to the codes in the
+ * file building the "string" table on-the-fly; requiring no table to
+ * be stored in the compressed file.
+ * IN assertions: the buffer inbuf contains already the beginning of
+ *   the compressed data, from offsets iptr to insize-1 included.
+ *   The magic header has already been checked and skipped.
+ *   bytes_in and bytes_out have been initialized.
+ */
+int unlzw(in, out) 
+    int in, out;    /* input and output file descriptors */
+{
+    REG2   char_type  *stackp;
+    REG3   code_int   code;
+    REG4   int        finchar;
+    REG5   code_int   oldcode;
+    REG6   code_int   incode;
+    REG7   long       inbits;
+    REG8   long       posbits;
+    REG9   int        outpos;
+/*  REG10  int        insize; (global) */
+    REG11  unsigned   bitmask;
+    REG12  code_int   free_ent;
+    REG13  code_int   maxcode;
+    REG14  code_int   maxmaxcode;
+    REG15  int        n_bits;
+    REG16  int        rsize;
+    
+#ifdef MAXSEG_64K
+    tab_prefix[0] = tab_prefix0;
+    tab_prefix[1] = tab_prefix1;
+#endif
+    maxbits = get_byte();
+    block_mode = maxbits & BLOCK_MODE;
+    if ((maxbits & LZW_RESERVED) != 0) {
+	WARN((stderr, "\n%s: %s: warning, unknown flags 0x%x\n",
+	      progname, ifname, maxbits & LZW_RESERVED));
+    }
+    maxbits &= BIT_MASK;
+    maxmaxcode = MAXCODE(maxbits);
+    
+    if (maxbits > BITS) {
+	fprintf(stderr,
+		"\n%s: %s: compressed with %d bits, can only handle %d bits\n",
+		progname, ifname, maxbits, BITS);
+	exit_code = ERROR;
+	return ERROR;
+    }
+    rsize = insize;
+    maxcode = MAXCODE(n_bits = INIT_BITS)-1;
+    bitmask = (1<<n_bits)-1;
+    oldcode = -1;
+    finchar = 0;
+    outpos = 0;
+    posbits = inptr<<3;
+
+    free_ent = ((block_mode) ? FIRST : 256);
+    
+    clear_tab_prefixof(); /* Initialize the first 256 entries in the table. */
+    
+    for (code = 255 ; code >= 0 ; --code) {
+	tab_suffixof(code) = (char_type)code;
+    }
+    do {
+	REG1 int i;
+	int  e;
+	int  o;
+	
+    resetbuf:
+	e = insize-(o = (posbits>>3));
+	
+	for (i = 0 ; i < e ; ++i) {
+	    inbuf[i] = inbuf[i+o];
+	}
+	insize = e;
+	posbits = 0;
+	
+	if (insize < INBUF_EXTRA) {
+	    if ((rsize = read(in, (char*)inbuf+insize, INBUFSIZ)) == -1) {
+		read_error();
+	    }
+	    insize += rsize;
+	    bytes_in += (off_t)rsize;
+	}
+	inbits = ((rsize != 0) ? ((long)insize - insize%n_bits)<<3 : 
+		  ((long)insize<<3)-(n_bits-1));
+	
+	while (inbits > posbits) {
+	    if (free_ent > maxcode) {
+		posbits = ((posbits-1) +
+			   ((n_bits<<3)-(posbits-1+(n_bits<<3))%(n_bits<<3)));
+		++n_bits;
+		if (n_bits == maxbits) {
+		    maxcode = maxmaxcode;
+		} else {
+		    maxcode = MAXCODE(n_bits)-1;
+		}
+		bitmask = (1<<n_bits)-1;
+		goto resetbuf;
+	    }
+	    input(inbuf,posbits,code,n_bits,bitmask);
+	    Tracev((stderr, "%d ", code));
+
+	    if (oldcode == -1) {
+		if (code >= 256) error("corrupt input.");
+		outbuf[outpos++] = (char_type)(finchar = (int)(oldcode=code));
+		continue;
+	    }
+	    if (code == CLEAR && block_mode) {
+		clear_tab_prefixof();
+		free_ent = FIRST - 1;
+		posbits = ((posbits-1) +
+			   ((n_bits<<3)-(posbits-1+(n_bits<<3))%(n_bits<<3)));
+		maxcode = MAXCODE(n_bits = INIT_BITS)-1;
+		bitmask = (1<<n_bits)-1;
+		goto resetbuf;
+	    }
+	    incode = code;
+	    stackp = de_stack;
+	    
+	    if (code >= free_ent) { /* Special case for KwKwK string. */
+		if (code > free_ent) {
+#ifdef DEBUG		    
+		    char_type *p;
+
+		    posbits -= n_bits;
+		    p = &inbuf[posbits>>3];
+		    fprintf(stderr,
+			    "code:%ld free_ent:%ld n_bits:%d insize:%u\n",
+			    code, free_ent, n_bits, insize);
+		    fprintf(stderr,
+			    "posbits:%ld inbuf:%02X %02X %02X %02X %02X\n",
+			    posbits, p[-1],p[0],p[1],p[2],p[3]);
+#endif
+		    if (!test && outpos > 0) {
+			write_buf(out, (char*)outbuf, outpos);
+			bytes_out += (off_t)outpos;
+		    }
+		    error(to_stdout ? "corrupt input." :
+			  "corrupt input. Use zcat to recover some data.");
+		}
+		*--stackp = (char_type)finchar;
+		code = oldcode;
+	    }
+
+	    while ((cmp_code_int)code >= (cmp_code_int)256) {
+		/* Generate output characters in reverse order */
+		*--stackp = tab_suffixof(code);
+		code = tab_prefixof(code);
+	    }
+	    *--stackp =	(char_type)(finchar = tab_suffixof(code));
+	    
+	    /* And put them out in forward order */
+	    {
+		REG1 int	i;
+	    
+		if (outpos+(i = (de_stack-stackp)) >= OUTBUFSIZ) {
+		    do {
+			if (i > OUTBUFSIZ-outpos) i = OUTBUFSIZ-outpos;
+
+			if (i > 0) {
+			    memcpy(outbuf+outpos, stackp, i);
+			    outpos += i;
+			}
+			if (outpos >= OUTBUFSIZ) {
+			    if (!test) {
+				write_buf(out, (char*)outbuf, outpos);
+				bytes_out += (off_t)outpos;
+			    }
+			    outpos = 0;
+			}
+			stackp+= i;
+		    } while ((i = (de_stack-stackp)) > 0);
+		} else {
+		    memcpy(outbuf+outpos, stackp, i);
+		    outpos += i;
+		}
+	    }
+
+	    if ((code = free_ent) < maxmaxcode) { /* Generate the new entry. */
+
+		tab_prefixof(code) = (unsigned short)oldcode;
+		tab_suffixof(code) = (char_type)finchar;
+		free_ent = code+1;
+	    } 
+	    oldcode = incode;	/* Remember previous code.	*/
+	}
+    } while (rsize != 0);
+    
+    if (!test && outpos > 0) {
+	write_buf(out, (char*)outbuf, outpos);
+	bytes_out += (off_t)outpos;
+    }
+    return OK;
+}
+/* unpack.c -- decompress files in pack format.
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: unpack.c,v 1.4 1993/06/11 19:25:36 jloup Exp $";
+#endif
+
+#define MIN(a,b) ((a) <= (b) ? (a) : (b))
+/* The arguments must not have side effects. */
+
+#define MAX_BITLEN 25
+/* Maximum length of Huffman codes. (Minor modifications to the code
+ * would be needed to support 32 bits codes, but pack never generates
+ * more than 24 bits anyway.)
+ */
+
+#define LITERALS 256
+/* Number of literals, excluding the End of Block (EOB) code */
+
+#define MAX_PEEK 12
+/* Maximum number of 'peek' bits used to optimize traversal of the
+ * Huffman tree.
+ */
+
+local ulg orig_len;       /* original uncompressed length */
+local int max_len;        /* maximum bit length of Huffman codes */
+
+local uch literal[LITERALS];
+/* The literal bytes present in the Huffman tree. The EOB code is not
+ * represented.
+ */
+
+local int lit_base[MAX_BITLEN+1];
+/* All literals of a given bit length are contiguous in literal[] and
+ * have contiguous codes. literal[code+lit_base[len]] is the literal
+ * for a code of len bits.
+ */
+
+local int leaves [MAX_BITLEN+1]; /* Number of leaves for each bit length */
+local int parents[MAX_BITLEN+1]; /* Number of parents for each bit length */
+
+local int peek_bits; /* Number of peek bits currently used */
+
+/* local uch prefix_len[1 << MAX_PEEK]; */
+#define prefix_len outbuf
+/* For each bit pattern b of peek_bits bits, prefix_len[b] is the length
+ * of the Huffman code starting with a prefix of b (upper bits), or 0
+ * if all codes of prefix b have more than peek_bits bits. It is not
+ * necessary to have a huge table (large MAX_PEEK) because most of the
+ * codes encountered in the input stream are short codes (by construction).
+ * So for most codes a single lookup will be necessary.
+ */
+#if (1<<MAX_PEEK) > OUTBUFSIZ
+    error cannot overlay prefix_len and outbuf
+#endif
+
+local ulg bitbuf;
+/* Bits are added on the low part of bitbuf and read from the high part. */
+
+local int valid;                  /* number of valid bits in bitbuf */
+/* all bits above the last valid bit are always zero */
+
+/* Set code to the next 'bits' input bits without skipping them. code
+ * must be the name of a simple variable and bits must not have side effects.
+ * IN assertions: bits <= 25 (so that we still have room for an extra byte
+ * when valid is only 24), and mask = (1<<bits)-1.
+ */
+#define look_bits(code,bits,mask) \
+{ \
+  while (valid < (bits)) bitbuf = (bitbuf<<8) | (ulg)get_byte(), valid += 8; \
+  code = (bitbuf >> (valid-(bits))) & (mask); \
+}
+
+/* Skip the given number of bits (after having peeked at them): */
+#define skip_bits(bits)  (valid -= (bits))
+
+#define clear_bitbuf() (valid = 0, bitbuf = 0)
+
+/* Local functions */
+
+local void read_tree  OF((void));
+local void build_tree OF((void));
+
+/* ===========================================================================
+ * Read the Huffman tree.
+ */
+local void read_tree()
+{
+    int len;  /* bit length */
+    int base; /* base offset for a sequence of leaves */
+    int n;
+
+    /* Read the original input size, MSB first */
+    orig_len = 0;
+    for (n = 1; n <= 4; n++) orig_len = (orig_len << 8) | (ulg)get_byte();
+
+    max_len = (int)get_byte(); /* maximum bit length of Huffman codes */
+    if (max_len > MAX_BITLEN) {
+	error("invalid compressed data -- Huffman code > 32 bits");
+    }
+
+    /* Get the number of leaves at each bit length */
+    n = 0;
+    for (len = 1; len <= max_len; len++) {
+	leaves[len] = (int)get_byte();
+	n += leaves[len];
+    }
+    if (n > LITERALS) {
+	error("too many leaves in Huffman tree");
+    }
+    Trace((stderr, "orig_len %lu, max_len %d, leaves %d\n",
+	   orig_len, max_len, n));
+    /* There are at least 2 and at most 256 leaves of length max_len.
+     * (Pack arbitrarily rejects empty files and files consisting of
+     * a single byte even repeated.) To fit the last leaf count in a
+     * byte, it is offset by 2. However, the last literal is the EOB
+     * code, and is not transmitted explicitly in the tree, so we must
+     * adjust here by one only.
+     */
+    leaves[max_len]++;
+
+    /* Now read the leaves themselves */
+    base = 0;
+    for (len = 1; len <= max_len; len++) {
+	/* Remember where the literals of this length start in literal[] : */
+	lit_base[len] = base;
+	/* And read the literals: */
+	for (n = leaves[len]; n > 0; n--) {
+	    literal[base++] = (uch)get_byte();
+	}
+    }
+    leaves[max_len]++; /* Now include the EOB code in the Huffman tree */
+}
+
+/* ===========================================================================
+ * Build the Huffman tree and the prefix table.
+ */
+local void build_tree()
+{
+    int nodes = 0; /* number of nodes (parents+leaves) at current bit length */
+    int len;       /* current bit length */
+    uch *prefixp;  /* pointer in prefix_len */
+
+    for (len = max_len; len >= 1; len--) {
+	/* The number of parent nodes at this level is half the total
+	 * number of nodes at parent level:
+	 */
+	nodes >>= 1;
+	parents[len] = nodes;
+	/* Update lit_base by the appropriate bias to skip the parent nodes
+	 * (which are not represented in the literal array):
+	 */
+	lit_base[len] -= nodes;
+	/* Restore nodes to be parents+leaves: */
+	nodes += leaves[len];
+    }
+    /* Construct the prefix table, from shortest leaves to longest ones.
+     * The shortest code is all ones, so we start at the end of the table.
+     */
+    peek_bits = MIN(max_len, MAX_PEEK);
+    prefixp = &prefix_len[1<<peek_bits];
+    for (len = 1; len <= peek_bits; len++) {
+	int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */
+	while (prefixes--) *--prefixp = (uch)len;
+    }
+    /* The length of all other codes is unknown: */
+    while (prefixp > prefix_len) *--prefixp = 0;
+}
+
+/* ===========================================================================
+ * Unpack in to out.  This routine does not support the old pack format
+ * with magic header \037\037.
+ *
+ * IN assertions: the buffer inbuf contains already the beginning of
+ *   the compressed data, from offsets inptr to insize-1 included.
+ *   The magic header has already been checked. The output buffer is cleared.
+ */
+int unpack(in, out)
+    int in, out;            /* input and output file descriptors */
+{
+    int len;                /* Bit length of current code */
+    unsigned eob;           /* End Of Block code */
+    register unsigned peek; /* lookahead bits */
+    unsigned peek_mask;     /* Mask for peek_bits bits */
+
+    ifd = in;
+    ofd = out;
+
+    read_tree();     /* Read the Huffman tree */
+    build_tree();    /* Build the prefix table */
+    clear_bitbuf();  /* Initialize bit input */
+    peek_mask = (1<<peek_bits)-1;
+
+    /* The eob code is the largest code among all leaves of maximal length: */
+    eob = leaves[max_len]-1;
+    Trace((stderr, "eob %d %x\n", max_len, eob));
+
+    /* Decode the input data: */
+    for (;;) {
+	/* Since eob is the longest code and not shorter than max_len,
+         * we can peek at max_len bits without having the risk of reading
+         * beyond the end of file.
+	 */
+	look_bits(peek, peek_bits, peek_mask);
+	len = prefix_len[peek];
+	if (len > 0) {
+	    peek >>= peek_bits - len; /* discard the extra bits */
+	} else {
+	    /* Code of more than peek_bits bits, we must traverse the tree */
+	    ulg mask = peek_mask;
+	    len = peek_bits;
+	    do {
+                len++, mask = (mask<<1)+1;
+		look_bits(peek, len, mask);
+	    } while (peek < (unsigned)parents[len]);
+	    /* loop as long as peek is a parent node */
+	}
+	/* At this point, peek is the next complete code, of len bits */
+	if (peek == eob && len == max_len) break; /* end of file? */
+	put_ubyte(literal[peek+lit_base[len]]);
+	Tracev((stderr,"%02d %04x %c\n", len, peek,
+		literal[peek+lit_base[len]]));
+	skip_bits(len);
+    } /* for (;;) */
+
+    flush_window();
+    if (orig_len != (ulg)(bytes_out & 0xffffffff)) {
+	error("invalid compressed data--length error");
+    }
+    return OK;
+}
+/* unzip.c -- decompress files in gzip or pkzip format.
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ *
+ * The code in this file is derived from the file funzip.c written
+ * and put in the public domain by Mark Adler.
+ */
+
+/*
+   This version can extract files in gzip or pkzip format.
+   For the latter, only the first entry is extracted, and it has to be
+   either deflated or stored.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: unzip.c,v 0.13 1993/06/10 13:29:00 jloup Exp $";
+#endif
+
+/* PKZIP header definitions */
+#define LOCSIG 0x04034b50L      /* four-byte lead-in (lsb first) */
+#define LOCFLG 6                /* offset of bit flag */
+#define  CRPFLG 1               /*  bit for encrypted entry */
+#define  EXTFLG 8               /*  bit for extended local header */
+#define LOCHOW 8                /* offset of compression method */
+#define LOCTIM 10               /* file mod time (for decryption) */
+#define LOCCRC 14               /* offset of crc */
+#define LOCSIZ 18               /* offset of compressed size */
+#define LOCLEN 22               /* offset of uncompressed length */
+#define LOCFIL 26               /* offset of file name field length */
+#define LOCEXT 28               /* offset of extra field length */
+#define LOCHDR 30               /* size of local header, including sig */
+#define EXTHDR 16               /* size of extended local header, inc sig */
+#define RAND_HEAD_LEN  12       /* length of encryption random header */
+
+
+/* Globals */
+
+int decrypt;        /* flag to turn on decryption */
+char *key;          /* not used--needed to link crypt.c */
+int pkzip = 0;      /* set for a pkzip file */
+int ext_header = 0; /* set if extended local header */
+
+/* ===========================================================================
+ * Check zip file and advance inptr to the start of the compressed data.
+ * Get ofname from the local header if necessary.
+ */
+int check_zipfile(in)
+    int in;   /* input file descriptors */
+{
+    uch *h = inbuf + inptr; /* first local header */
+
+    ifd = in;
+
+    /* Check validity of local header, and skip name and extra fields */
+    inptr += LOCHDR + SH(h + LOCFIL) + SH(h + LOCEXT);
+
+    if (inptr > insize || LG(h) != LOCSIG) {
+	fprintf(stderr, "\n%s: %s: not a valid zip file\n",
+		progname, ifname);
+	exit_code = ERROR;
+	return ERROR;
+    }
+    method = h[LOCHOW];
+    if (method != STORED && method != DEFLATED) {
+	fprintf(stderr,
+		"\n%s: %s: first entry not deflated or stored -- use unzip\n",
+		progname, ifname);
+	exit_code = ERROR;
+	return ERROR;
+    }
+
+    /* If entry encrypted, decrypt and validate encryption header */
+    if ((decrypt = h[LOCFLG] & CRPFLG) != 0) {
+	fprintf(stderr, "\n%s: %s: encrypted file -- use unzip\n",
+		progname, ifname);
+	exit_code = ERROR;
+	return ERROR;
+    }
+
+    /* Save flags for unzip() */
+    ext_header = (h[LOCFLG] & EXTFLG) != 0;
+    pkzip = 1;
+
+    /* Get ofname and time stamp from local header (to be done) */
+    return OK;
+}
+
+/* ===========================================================================
+ * Unzip in to out.  This routine works on both gzip and pkzip files.
+ *
+ * IN assertions: the buffer inbuf contains already the beginning of
+ *   the compressed data, from offsets inptr to insize-1 included.
+ *   The magic header has already been checked. The output buffer is cleared.
+ */
+int unzip(in, out)
+    int in, out;   /* input and output file descriptors */
+{
+    ulg orig_crc = 0;       /* original crc */
+    ulg orig_len = 0;       /* original uncompressed length */
+    int n;
+    uch buf[EXTHDR];        /* extended local header */
+    int err = OK;
+
+    ifd = in;
+    ofd = out;
+
+    updcrc(NULL, 0);           /* initialize crc */
+
+    if (pkzip && !ext_header) {  /* crc and length at the end otherwise */
+	orig_crc = LG(inbuf + LOCCRC);
+	orig_len = LG(inbuf + LOCLEN);
+    }
+
+    /* Decompress */
+    if (method == DEFLATED)  {
+
+	int res = inflate();
+
+	if (res == 3) {
+	    error("out of memory");
+	} else if (res != 0) {
+	    error("invalid compressed data--format violated");
+	}
+
+    } else if (pkzip && method == STORED) {
+
+	register ulg n = LG(inbuf + LOCLEN);
+
+	if (n != LG(inbuf + LOCSIZ) - (decrypt ? RAND_HEAD_LEN : 0)) {
+
+	    fprintf(stderr, "len %ld, siz %ld\n", n, LG(inbuf + LOCSIZ));
+	    error("invalid compressed data--length mismatch");
+	}
+	while (n--) {
+	    uch c = (uch)get_byte();
+	    put_ubyte(c);
+	}
+	flush_window();
+    } else {
+	error("internal error, invalid method");
+    }
+
+    /* Get the crc and original length */
+    if (!pkzip) {
+        /* crc32  (see algorithm.doc)
+	 * uncompressed input size modulo 2^32
+         */
+	for (n = 0; n < 8; n++) {
+	    buf[n] = (uch)get_byte(); /* may cause an error if EOF */
+	}
+	orig_crc = LG(buf);
+	orig_len = LG(buf+4);
+
+    } else if (ext_header) {  /* If extended header, check it */
+	/* signature - 4bytes: 0x50 0x4b 0x07 0x08
+	 * CRC-32 value
+         * compressed size 4-bytes
+         * uncompressed size 4-bytes
+	 */
+	for (n = 0; n < EXTHDR; n++) {
+	    buf[n] = (uch)get_byte(); /* may cause an error if EOF */
+	}
+	orig_crc = LG(buf+4);
+	orig_len = LG(buf+12);
+    }
+
+    /* Validate decompression */
+    if (orig_crc != updcrc(outbuf, 0)) {
+	fprintf(stderr, "\n%s: %s: invalid compressed data--crc error\n",
+		progname, ifname);
+	err = ERROR;
+    }
+    if (orig_len != (ulg)(bytes_out & 0xffffffff)) {
+	fprintf(stderr, "\n%s: %s: invalid compressed data--length error\n",
+		progname, ifname);
+	err = ERROR;
+    }
+
+    /* Check if there are more entries in a pkzip file */
+    if (pkzip && inptr + 4 < insize && LG(inbuf+inptr) == LOCSIG) {
+	if (to_stdout) {
+	    WARN((stderr,
+		  "%s: %s has more than one entry--rest ignored\n",
+		  progname, ifname));
+	} else {
+	    /* Don't destroy the input zip file */
+	    fprintf(stderr,
+		    "%s: %s has more than one entry -- unchanged\n",
+		    progname, ifname);
+	    err = ERROR;
+	}
+    }
+    ext_header = pkzip = 0; /* for next file */
+    if (err == OK) return OK;
+    exit_code = ERROR;
+    if (!test) abort_gzip();
+    return err;
+}
+/* util.c -- utility functions for gzip support
+ * Copyright (C) 1997, 1998, 1999, 2001 Free Software Foundation, Inc.
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: util.c,v 0.15 1993/06/15 09:04:13 jloup Exp $";
+#endif
+
+#ifndef CHAR_BIT
+#  define CHAR_BIT 8
+#endif
+
+extern ulg crc_32_tab[];   /* crc table, defined below */
+
+/* ===========================================================================
+ * Copy input to output unchanged: zcat == cat with --force.
+ * IN assertion: insize bytes have already been read in inbuf.
+ */
+int copy(in, out)
+    int in, out;   /* input and output file descriptors */
+{
+    errno = 0;
+    while (insize != 0 && (int)insize != -1) {
+	write_buf(out, (char*)inbuf, insize);
+	bytes_out += insize;
+	insize = read(in, (char*)inbuf, INBUFSIZ);
+    }
+    if ((int)insize == -1) {
+	read_error();
+    }
+    bytes_in = bytes_out;
+    return OK;
+}
+
+/* ===========================================================================
+ * Run a set of bytes through the crc shift register.  If s is a NULL
+ * pointer, then initialize the crc shift register contents instead.
+ * Return the current crc in either case.
+ */
+ulg updcrc(s, n)
+    uch *s;                 /* pointer to bytes to pump through */
+    unsigned n;             /* number of bytes in s[] */
+{
+    register ulg c;         /* temporary variable */
+
+    static ulg crc = (ulg)0xffffffffL; /* shift register contents */
+
+    if (s == NULL) {
+	c = 0xffffffffL;
+    } else {
+	c = crc;
+        if (n) do {
+            c = crc_32_tab[((int)c ^ (*s++)) & 0xff] ^ (c >> 8);
+        } while (--n);
+    }
+    crc = c;
+    return c ^ 0xffffffffL;       /* (instead of ~c for 64-bit machines) */
+}
+
+/* ===========================================================================
+ * Clear input and output buffers
+ */
+void clear_bufs()
+{
+    outcnt = 0;
+    insize = inptr = 0;
+    bytes_in = bytes_out = 0L;
+}
+
+/* ===========================================================================
+ * Fill the input buffer. This is called only when the buffer is empty.
+ */
+int fill_inbuf(eof_ok)
+    int eof_ok;          /* set if EOF acceptable as a result */
+{
+    int len;
+
+    /* Read as much as possible */
+    insize = 0;
+    do {
+	len = read(ifd, (char*)inbuf+insize, INBUFSIZ-insize);
+	if (len == 0) break;
+	if (len == -1) {
+	  read_error();
+	  break;
+	}
+	insize += len;
+    } while (insize < INBUFSIZ);
+
+    if (insize == 0) {
+	if (eof_ok) return EOF;
+	flush_window();
+	errno = 0;
+	read_error();
+    }
+    bytes_in += (off_t)insize;
+    inptr = 1;
+    return inbuf[0];
+}
+
+/* ===========================================================================
+ * Write the output buffer outbuf[0..outcnt-1] and update bytes_out.
+ * (used for the compressed data only)
+ */
+void flush_outbuf()
+{
+    if (outcnt == 0) return;
+
+    write_buf(ofd, (char *)outbuf, outcnt);
+    bytes_out += (off_t)outcnt;
+    outcnt = 0;
+}
+
+/* ===========================================================================
+ * Write the output window window[0..outcnt-1] and update crc and bytes_out.
+ * (Used for the decompressed data only.)
+ */
+void flush_window()
+{
+    if (outcnt == 0) return;
+    updcrc(window, outcnt);
+
+    if (!test) {
+	write_buf(ofd, (char *)window, outcnt);
+    }
+    bytes_out += (off_t)outcnt;
+    outcnt = 0;
+}
+
+/* ===========================================================================
+ * Does the same as write(), but also handles partial pipe writes and checks
+ * for error return.
+ */
+void write_buf(fd, buf, cnt)
+    int       fd;
+    voidp     buf;
+    unsigned  cnt;
+{
+    unsigned  n;
+
+    while ((n = write(fd, buf, cnt)) != cnt) {
+	if (n == (unsigned)(-1)) {
+	    write_error();
+	}
+	cnt -= n;
+	buf = (voidp)((char*)buf+n);
+    }
+}
+
+/* ========================================================================
+ * Put string s in lower case, return s.
+ */
+char *strlwr(s)
+    char *s;
+{
+    char *t;
+    for (t = s; *t; t++)
+      *t = tolow ((unsigned char) *t);
+    return s;
+}
+
+/* ========================================================================
+ * Return the base name of a file (remove any directory prefix and
+ * any version suffix). For systems with file names that are not
+ * case sensitive, force the base name to lower case.
+ */
+char *base_name(fname)
+    char *fname;
+{
+    char *p;
+
+    if ((p = strrchr(fname, PATH_SEP))  != NULL) fname = p+1;
+#ifdef PATH_SEP2
+    if ((p = strrchr(fname, PATH_SEP2)) != NULL) fname = p+1;
+#endif
+#ifdef PATH_SEP3
+    if ((p = strrchr(fname, PATH_SEP3)) != NULL) fname = p+1;
+#endif
+#ifdef SUFFIX_SEP
+    if ((p = strrchr(fname, SUFFIX_SEP)) != NULL) *p = '\0';
+#endif
+    if (casemap('A') == 'a') strlwr(fname);
+    return fname;
+}
+
+/* ========================================================================
+ * Unlink a file, working around the unlink readonly bug (if present).
+ */
+int xunlink (filename)
+     char *filename;
+{
+  int r = unlink (filename);
+
+#ifdef UNLINK_READONLY_BUG
+  if (r != 0)
+    {
+      int e = errno;
+      if (chmod (filename, S_IWUSR) != 0)
+	{
+	  errno = e;
+	  return -1;
+	}
+
+      r = unlink (filename);
+    }
+#endif
+
+  return r;
+}
+
+/* ========================================================================
+ * Make a file name legal for file systems not allowing file names with
+ * multiple dots or starting with a dot (such as MSDOS), by changing
+ * all dots except the last one into underlines.  A target dependent
+ * function can be used instead of this simple function by defining the macro
+ * MAKE_LEGAL_NAME in tailor.h and providing the function in a target
+ * dependent module.
+ */
+void make_simple_name(name)
+    char *name;
+{
+    char *p = strrchr(name, '.');
+    if (p == NULL) return;
+    if (p == name) p++;
+    do {
+        if (*--p == '.') *p = '_';
+    } while (p != name);
+}
+
+
+#if !defined HAVE_STRING_H && !defined STDC_HEADERS
+
+/* Provide missing strspn and strcspn functions. */
+
+#  ifndef __STDC__
+#    define const
+#  endif
+
+int strspn  OF((const char *s, const char *accept));
+int strcspn OF((const char *s, const char *reject));
+
+/* ========================================================================
+ * Return the length of the maximum initial segment
+ * of s which contains only characters in accept.
+ */
+int strspn(s, accept)
+    const char *s;
+    const char *accept;
+{
+    register const char *p;
+    register const char *a;
+    register int count = 0;
+
+    for (p = s; *p != '\0'; ++p) {
+	for (a = accept; *a != '\0'; ++a) {
+	    if (*p == *a) break;
+	}
+	if (*a == '\0') return count;
+	++count;
+    }
+    return count;
+}
+
+/* ========================================================================
+ * Return the length of the maximum inital segment of s
+ * which contains no characters from reject.
+ */
+int strcspn(s, reject)
+    const char *s;
+    const char *reject;
+{
+    register int count = 0;
+
+    while (*s != '\0') {
+	if (strchr(reject, *s++) != NULL) return count;
+	++count;
+    }
+    return count;
+}
+
+#endif
+
+/* ========================================================================
+ * Add an environment variable (if any) before argv, and update argc.
+ * Return the expanded environment variable to be freed later, or NULL 
+ * if no options were added to argv.
+ */
+#define SEPARATOR	" \t"	/* separators in env variable */
+
+char *add_envopt(argcp, argvp, env)
+    int *argcp;          /* pointer to argc */
+    char ***argvp;       /* pointer to argv */
+    char *env;           /* name of environment variable */
+{
+    char *p;             /* running pointer through env variable */
+    char **oargv;        /* runs through old argv array */
+    char **nargv;        /* runs through new argv array */
+    int	 oargc = *argcp; /* old argc */
+    int  nargc = 0;      /* number of arguments in env variable */
+
+    env = (char*)getenv(env);
+    if (env == NULL) return NULL;
+
+    p = (char*)xmalloc(strlen(env)+1);
+    env = strcpy(p, env);                    /* keep env variable intact */
+
+    for (p = env; *p; nargc++ ) {            /* move through env */
+	p += strspn(p, SEPARATOR);	     /* skip leading separators */
+	if (*p == '\0') break;
+
+	p += strcspn(p, SEPARATOR);	     /* find end of word */
+	if (*p) *p++ = '\0';		     /* mark it */
+    }
+    if (nargc == 0) {
+	free(env);
+	return NULL;
+    }
+    *argcp += nargc;
+    /* Allocate the new argv array, with an extra element just in case
+     * the original arg list did not end with a NULL.
+     */
+    nargv = (char**)calloc(*argcp+1, sizeof(char *));
+    if (nargv == NULL) error("out of memory");
+    oargv  = *argvp;
+    *argvp = nargv;
+
+    /* Copy the program name first */
+    if (oargc-- < 0) error("argc<=0");
+    *(nargv++) = *(oargv++);
+
+    /* Then copy the environment args */
+    for (p = env; nargc > 0; nargc--) {
+	p += strspn(p, SEPARATOR);	     /* skip separators */
+	*(nargv++) = p;			     /* store start */
+	while (*p++) ;			     /* skip over word */
+    }
+
+    /* Finally copy the old args and add a NULL (usual convention) */
+    while (oargc--) *(nargv++) = *(oargv++);
+    *nargv = NULL;
+    return env;
+}
+
+/* ========================================================================
+ * Error handlers.
+ */
+void error(m)
+    char *m;
+{
+    fprintf(stderr, "\n%s: %s: %s\n", progname, ifname, m);
+    abort_gzip();
+}
+
+void warning (m)
+    char *m;
+{
+    WARN ((stderr, "%s: %s: warning: %s\n", progname, ifname, m));
+}
+
+void read_error()
+{
+    int e = errno;
+    fprintf(stderr, "\n%s: ", progname);
+    if (e != 0) {
+	errno = e;
+	perror(ifname);
+    } else {
+	fprintf(stderr, "%s: unexpected end of file\n", ifname);
+    }
+    abort_gzip();
+}
+
+void write_error()
+{
+    int e = errno;
+    fprintf(stderr, "\n%s: ", progname);
+    errno = e;
+    perror(ofname);
+    abort_gzip();
+}
+
+/* ========================================================================
+ * Display compression ratio on the given stream on 6 characters.
+ */
+void display_ratio(num, den, file)
+    off_t num;
+    off_t den;
+    FILE *file;
+{
+    fprintf(file, "%5.1f%%", den == 0 ? 0 : 100.0 * num / den);
+}
+
+/* ========================================================================
+ * Print an off_t.  There's no completely portable way to use printf,
+ * so we do it ourselves.
+ */
+void fprint_off(file, offset, width)
+    FILE *file;
+    off_t offset;
+    int width;
+{
+    char buf[CHAR_BIT * sizeof (off_t)];
+    char *p = buf + sizeof buf;
+
+    /* Don't negate offset here; it might overflow.  */
+    if (offset < 0) {
+	do
+	  *--p = '0' - offset % 10;
+	while ((offset /= 10) != 0);
+
+	*--p = '-';
+    } else {
+	do
+	  *--p = '0' + offset % 10;
+	while ((offset /= 10) != 0);
+    }
+
+    width -= buf + sizeof buf - p;
+    while (0 < width--) {
+	putc (' ', file);
+    }
+    for (;  p < buf + sizeof buf;  p++)
+	putc (*p, file);
+}
+
+/* ========================================================================
+ * Semi-safe malloc -- never returns NULL.
+ */
+voidp xmalloc (size)
+    unsigned size;
+{
+    voidp cp = (voidp)malloc (size);
+
+    if (cp == NULL) error("out of memory");
+    return cp;
+}
+
+/* ========================================================================
+ * Table of CRC-32's of all single-byte values (made by makecrc.c)
+ */
+ulg crc_32_tab[] = {
+  0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
+  0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
+  0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
+  0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
+  0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
+  0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
+  0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
+  0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
+  0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
+  0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
+  0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
+  0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
+  0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
+  0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
+  0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
+  0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
+  0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
+  0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
+  0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
+  0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
+  0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
+  0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
+  0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
+  0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
+  0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
+  0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
+  0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
+  0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
+  0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
+  0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
+  0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
+  0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
+  0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
+  0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
+  0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
+  0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
+  0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
+  0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
+  0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
+  0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
+  0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
+  0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
+  0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
+  0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
+  0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
+  0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
+  0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
+  0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
+  0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
+  0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
+  0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
+  0x2d02ef8dL
+};
+/* yesno.c -- read a yes/no response from stdin
+   Copyright (C) 1990, 1998 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+/* Read one line from standard input
+   and return nonzero if that line begins with y or Y,
+   otherwise return 0. */
+
+int rpmatch ();
+
+int
+yesno ()
+{
+  /* We make some assumptions here:
+     a) leading white space in the response are not vital
+     b) the first 128 characters of the answer are enough (the rest can
+	be ignored)
+     I cannot think for a situation where this is not ok.  --drepper@gnu  */
+  char buf[128];
+  int len = 0;
+  int c;
+
+  while ((c = getchar ()) != EOF && c != '\n')
+    if ((len > 0 && len < 127) || (len == 0 && !isspace (c)))
+      buf[len++] = c;
+  buf[len] = '\0';
+
+  return rpmatch (buf) == 1;
+}
+/* zip.c -- compress files to the gzip or pkzip format
+ * Copyright (C) 1992-1993 Jean-loup Gailly
+ * This is free software; you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License, see the file COPYING.
+ */
+
+#ifdef RCSID
+static char rcsid[] = "$Id: zip.c,v 0.17 1993/06/10 13:29:25 jloup Exp $";
+#endif
+
+local ulg crc;       /* crc on uncompressed file data */
+off_t header_bytes;   /* number of bytes in gzip header */
+
+/* ===========================================================================
+ * Deflate in to out.
+ * IN assertions: the input and output buffers are cleared.
+ *   The variables time_stamp and save_orig_name are initialized.
+ */
+int zip(in, out)
+    int in, out;            /* input and output file descriptors */
+{
+    uch  flags = 0;         /* general purpose bit flags */
+    ush  attr = 0;          /* ascii/binary flag */
+    ush  deflate_flags = 0; /* pkzip -es, -en or -ex equivalent */
+
+    ifd = in;
+    ofd = out;
+    outcnt = 0;
+
+    /* Write the header to the gzip file. See algorithm.doc for the format */
+
+    method = DEFLATED;
+    put_byte(GZIP_MAGIC[0]); /* magic header */
+    put_byte(GZIP_MAGIC[1]);
+    put_byte(DEFLATED);      /* compression method */
+
+    if (save_orig_name) {
+	flags |= ORIG_NAME;
+    }
+    put_byte(flags);         /* general flags */
+    put_long(time_stamp == (time_stamp & 0xffffffff)
+	     ? (ulg)time_stamp : (ulg)0);
+
+    /* Write deflated file to zip file */
+    crc = updcrc(0, 0);
+
+    bi_init(out);
+    ct_init(&attr, &method);
+    lm_init(level, &deflate_flags);
+
+    put_byte((uch)deflate_flags); /* extra flags */
+    put_byte(OS_CODE);            /* OS identifier */
+
+    if (save_orig_name) {
+	char *p = base_name(ifname); /* Don't save the directory part. */
+	do {
+	    put_char(*p);
+	} while (*p++);
+    }
+    header_bytes = (off_t)outcnt;
+
+    (void)deflate();
+
+#if !defined(NO_SIZE_CHECK) && !defined(RECORD_IO)
+  /* Check input size (but not in VMS -- variable record lengths mess it up)
+   * and not on MSDOS -- diet in TSR mode reports an incorrect file size)
+   */
+    if (ifile_size != -1L && bytes_in != ifile_size) {
+	fprintf(stderr, "%s: %s: file size changed while zipping\n",
+		progname, ifname);
+    }
+#endif
+
+    /* Write the crc and uncompressed size */
+    put_long(crc);
+    put_long((ulg)bytes_in);
+    header_bytes += 2*sizeof(long);
+
+    flush_outbuf();
+    return OK;
+}
+
+
+/* ===========================================================================
+ * Read a new buffer from the current input file, perform end-of-line
+ * translation, and update the crc and input file size.
+ * IN assertion: size >= 2 (for end-of-line translation)
+ */
+int file_read(buf, size)
+    char *buf;
+    unsigned size;
+{
+    unsigned len;
+
+    Assert(insize == 0, "inbuf not empty");
+
+    len = read(ifd, buf, size);
+    if (len == 0) return (int)len;
+    if (len == (unsigned)-1) {
+	read_error();
+	return EOF;
+    }
+
+    crc = updcrc((uch*)buf, len);
+    bytes_in += (off_t)len;
+    return (int)len;
+}
+
+/* Determine whether string value is affirmation or negative response
+   according to current locale's data.
+   Copyright (C) 1996, 1998, 2000 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software Foundation,
+   Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */
+
+int
+rpmatch (const char *response)
+{
+  /* Test against "^[yY]" and "^[nN]", hardcoded to avoid requiring regex */
+  return (*response == 'y' || *response == 'Y' ? 1
+	  : *response == 'n' || *response == 'N' ? 0 : -1);
+}
+
+
+int
+getopt_long (argc, argv, options, long_options, opt_index)
+     int argc;
+     char *const *argv;
+     const char *options;
+     const struct option *long_options;
+     int *opt_index;
+{
+  return _getopt_internal (argc, argv, options, long_options, opt_index, 0);
+}
+
+/* Like getopt_long, but '-' as well as '--' can indicate a long option.
+   If an option that starts with '-' (not '--') doesn't match a long option,
+   but does match a short option, it is parsed as a short option
+   instead.  */
+
+int
+getopt_long_only (argc, argv, options, long_options, opt_index)
+     int argc;
+     char *const *argv;
+     const char *options;
+     const struct option *long_options;
+     int *opt_index;
+{
+  return _getopt_internal (argc, argv, options, long_options, opt_index, 1);
+}
diff --git a/Examples/gcc/test_files/helloworld.c b/Examples/gcc/test_files/helloworld.c
new file mode 100644
index 00000000..e31915e0
--- /dev/null
+++ b/Examples/gcc/test_files/helloworld.c
@@ -0,0 +1,6 @@
+#include <stdio.h>
+
+int main(int argc, char ** argv) {
+    printf("Hello world (%s)!\n", argv[0]);
+    return 0;
+}
diff --git a/Examples/lighttpd/.gitignore b/Examples/lighttpd/.gitignore
new file mode 100644
index 00000000..b0d48cdb
--- /dev/null
+++ b/Examples/lighttpd/.gitignore
@@ -0,0 +1,8 @@
+/result-*
+/OUTPUT
+/install/
+/lighttpd.conf
+/lighttpd-*/
+/*.conf
+!/lighttpd-generic.conf
+/*.tar.gz
diff --git a/Examples/lighttpd/Makefile b/Examples/lighttpd/Makefile
new file mode 100644
index 00000000..2df2e992
--- /dev/null
+++ b/Examples/lighttpd/Makefile
@@ -0,0 +1,166 @@
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+INSTALL_DIR ?= $(THIS_DIR)install
+
+LIGHTTPD_SRC ?= $(THIS_DIR)lighttpd-1.4.54
+LIGHTTPD_HASH ?= 5151d38cb7c4c40effa13710e77ebdbef899f945b062cf32befc02d128ac424c
+
+LIGHTTPD_MIRRORS ?= \
+	https://download.lighttpd.net/lighttpd/releases-1.4.x/
+
+# Host and port on which lighttpd listens
+HOST ?= 127.0.0.1
+PORT ?= 8003
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= $(THIS_DIR)../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+GREP = grep
+SED  = sed
+LDD  = ldd
+AWK  = awk
+
+CONF_FILES = lighttpd-server.conf lighttpd.conf
+
+.PHONY: all
+all: $(INSTALL_DIR)/sbin/lighttpd lighttpd.manifest pal_loader $(CONF_FILES) testdata
+ifeq ($(SGX),1)
+all: lighttpd.token
+endif
+
+# The commands for downloading and compiling the lighttpd source code, and
+# installing the binaries.
+$(INSTALL_DIR)/sbin/lighttpd: $(LIGHTTPD_SRC)/configure
+	cd $(LIGHTTPD_SRC) && ./configure --prefix=$(abspath $(INSTALL_DIR)) \
+		--without-openssl --without-pcre --without-zlib --without-bzip2
+	cd $(LIGHTTPD_SRC) && $(MAKE)
+	cd $(LIGHTTPD_SRC) && $(MAKE) install
+
+$(LIGHTTPD_SRC)/configure: $(LIGHTTPD_SRC).tar.gz
+	tar -xzf $<
+
+$(LIGHTTPD_SRC).tar.gz:
+	$(GRAPHENEDIR)/Scripts/download --output $@ --sha256 $(LIGHTTPD_HASH) $(foreach mirror,$(LIGHTTPD_MIRRORS),--url $(mirror)/$(LIGHTTPD_SRC).tar.gz)
+
+# lighttpd dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libpthread libutil
+
+LIGHTTPD_LIBS = $(INSTALL_DIR)/lib/mod_indexfile.so \
+		$(INSTALL_DIR)/lib/mod_dirlisting.so \
+		$(INSTALL_DIR)/lib/mod_staticfile.so
+
+# Listing all the lighttpd dependencies, besides Glibc libraries
+.INTERMEDIATE: lighttpd-deps
+lighttpd-deps:
+	@$(LDD) $(LIGHTTPD_LIBS) $(INSTALL_DIR)/sbin/lighttpd | \
+		$(AWK) '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' | \
+		sort | uniq | $($(GREP) -v -x $(patsubst %,-e %,$(GLIBC_DEPS))) > $@
+
+# Generating manifest rules for lighttpd dependencies
+.INTERMEDIATE: lighttpd-trusted-libs
+lighttpd-trusted-libs: lighttpd-deps
+	@LIGHTTPD_LIBS="$(LIGHTTPD_LIBS)" && \
+	for F in `cat lighttpd-deps`; do \
+		P=`$(LDD) $$LIGHTTPD_LIBS $(INSTALL_DIR)/sbin/lighttpd | $(GREP) $$F | $(AWK) '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+.INTERMEDIATE: lighttpd-trusted-mods
+lighttpd-trusted-mods:
+	@for F in $(LIGHTTPD_LIBS); do \
+		N=`basename $$F .so | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$F\\\\n"; \
+	done > $@
+
+lighttpd.manifest: lighttpd.manifest.template lighttpd-trusted-libs lighttpd-trusted-mods
+	@$(SED) -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(INSTALL_DIR)|'"$(INSTALL_DIR)"'|g' \
+		-e 's|$$(INSTALL_DIR_ABSPATH)|'"$(abspath $(INSTALL_DIR))"'|g' \
+		-e 's|$$(LIGHTTPD_TRUSTED_MODS)|'"`cat lighttpd-trusted-mods`"'|g' \
+		-e 's|$$(LIGHTTPD_TRUSTED_LIBS)|'"`cat lighttpd-trusted-libs`"'|g' \
+		$< > $@
+
+# Generate the SGX-specific manifest (lighttpd.manifest.sgx), the enclave signature, and the token
+# for enclave initialization.
+lighttpd.manifest.sgx: lighttpd.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+lighttpd.sig: lighttpd.manifest.sgx
+
+lighttpd.token: lighttpd.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $@ -sig $^
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+# lighttpd configuration and test data
+
+lighttpd-server.conf:
+	@$(RM) $@
+	@echo "server.document-root       = \"$(abspath $(INSTALL_DIR))/html\""    >> $@
+	@echo "server.port                = $(PORT)"            >> $@
+	@echo "server.bind                = \"$(HOST)\""        >> $@
+
+lighttpd.conf:
+	@$(RM) $@
+	@echo "include \"lighttpd-server.conf\""                >> $@
+	@echo "include \"lighttpd-generic.conf\""               >> $@
+
+# Generate variously-sized HTML files in $(RANDOM_DIR)
+RANDOM_DIR = $(INSTALL_DIR)/html/random
+RANDOM_FILES = \
+	$(foreach n,1 2 3 4 5 6 7 8 9 10,2K.$n.html) \
+	$(foreach n,1 2 3 4 5,10K.$n.html) \
+	$(foreach n,1 2 3 4 5,100K.$n.html) \
+	$(foreach n,1 2 3,1M.$n.html) \
+	$(foreach n,1 2 3,10M.$n.html) \
+	$(foreach n,1 2 3,100.$n.html)
+
+TEST_DATA = $(addprefix $(RANDOM_DIR)/,$(RANDOM_FILES))
+
+$(RANDOM_DIR)/%.html:
+	mkdir -p $(RANDOM_DIR)
+	dd if=/dev/urandom of=$@ count=1 bs=$(basename $(basename $(notdir $@)))
+
+.PHONY: testdata
+testdata: $(TEST_DATA)
+
+# Targets to run lighttpd
+
+.PHONY: start-native-server
+start-native-server: all
+	$(INSTALL_DIR)/sbin/lighttpd -D -m $(INSTALL_DIR)/lib -f lighttpd.conf
+
+.PHONY: start-graphene-server
+start-graphene-server: all
+	./pal_loader lighttpd.manifest -D -m $(INSTALL_DIR)/lib -f lighttpd.conf
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT result-* $(CONF_FILES) pal_loader
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(LIGHTTPD_SRC).tar.gz $(LIGHTTPD_SRC) $(INSTALL_DIR) $(TEST_DATA) *.pem
diff --git a/Examples/lighttpd/README.md b/Examples/lighttpd/README.md
new file mode 100644
index 00000000..0fee1e95
--- /dev/null
+++ b/Examples/lighttpd/README.md
@@ -0,0 +1,49 @@
+# Lighttpd Example
+
+This directory contains an example for running lighttpd in Graphene, including the Makefile and a
+template for generating the manifest. We tested lighttpd on Ubuntu 16.04.
+
+# Building lighttpd source
+
+For this example, we build lighttpd from source instead of using an existing binary. To build
+lighttpd on Ubuntu 16.04, please make sure that the following packages are installed:
+
+    sudo apt-get install -y build-essential apache2-utils
+
+## Linux
+
+Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
+
+## SGX
+
+Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory to prepare lighttpd to
+run on SGX.
+
+# Running lighttpd natively, under Graphene, and under Graphene-SGX
+
+Execute one of the following commands to start lighttpd either natively (non-Graphene), on Graphene
+or Graphene-SGX, respectively.
+
+    make start-native-server
+    make start-graphene-server
+    SGX=1 make start-graphene-server
+
+Because these commands will start the lighttpd server in the foreground, you will need to open
+another console to run the client.
+
+Once the server has started, you can test it with `wget`
+
+    wget http://127.0.0.1:8003/random/10K.1.html
+
+You may also run the benchmark script using `ab` (Apachebench)
+
+    ./benchmark-http.sh 127.0.0.1:8003
+
+Use Ctrl-C to terminate the server once you are finished testing lighttpd.
+
+# Clean up
+
+There are two commands to clean up the directory:
+
+* `make clean`: Remove manifest, signature, and token files.
+* `make distclean`: Remove the lighttpd source code and installation directory.
diff --git a/Examples/lighttpd/benchmark-http.sh b/Examples/lighttpd/benchmark-http.sh
new file mode 120000
index 00000000..38087f85
--- /dev/null
+++ b/Examples/lighttpd/benchmark-http.sh
@@ -0,0 +1 @@
+../common_tools/benchmark-http.sh
\ No newline at end of file
diff --git a/Examples/lighttpd/lighttpd-generic.conf b/Examples/lighttpd/lighttpd-generic.conf
new file mode 100644
index 00000000..b86b47db
--- /dev/null
+++ b/Examples/lighttpd/lighttpd-generic.conf
@@ -0,0 +1,66 @@
+server.event-handler          = "select"
+#server.event-handler          = "linux-sysepoll"
+
+# If keep-alive is undesired, uncomment the following line.
+# server.max-keep-alive-requests = 0
+
+index-file.names = ( "index.html", "index.php" )
+
+mimetype.assign            = (
+  ".pdf"          =>      "application/pdf",
+  ".sig"          =>      "application/pgp-signature",
+  ".spl"          =>      "application/futuresplash",
+  ".class"        =>      "application/octet-stream",
+  ".ps"           =>      "application/postscript",
+  ".torrent"      =>      "application/x-bittorrent",
+  ".dvi"          =>      "application/x-dvi",
+  ".gz"           =>      "application/x-gzip",
+  ".pac"          =>      "application/x-ns-proxy-autoconfig",
+  ".swf"          =>      "application/x-shockwave-flash",
+  ".tar.gz"       =>      "application/x-tgz",
+  ".tgz"          =>      "application/x-tgz",
+  ".tar"          =>      "application/x-tar",
+  ".zip"          =>      "application/zip",
+  ".mp3"          =>      "audio/mpeg",
+  ".m3u"          =>      "audio/x-mpegurl",
+  ".wma"          =>      "audio/x-ms-wma",
+  ".wax"          =>      "audio/x-ms-wax",
+  ".ogg"          =>      "application/ogg",
+  ".wav"          =>      "audio/x-wav",
+  ".gif"          =>      "image/gif",
+  ".jpg"          =>      "image/jpeg",
+  ".jpeg"         =>      "image/jpeg",
+  ".png"          =>      "image/png",
+  ".xbm"          =>      "image/x-xbitmap",
+  ".xpm"          =>      "image/x-xpixmap",
+  ".xwd"          =>      "image/x-xwindowdump",
+  ".css"          =>      "text/css",
+  ".html"         =>      "text/html",
+  ".htm"          =>      "text/html",
+  ".php"          =>      "text/html",
+  ".js"           =>      "text/javascript",
+  ".asc"          =>      "text/plain",
+  ".c"            =>      "text/plain",
+  ".cpp"          =>      "text/plain",
+  ".log"          =>      "text/plain",
+  ".conf"         =>      "text/plain",
+  ".text"         =>      "text/plain",
+  ".txt"          =>      "text/plain",
+  ".spec"         =>      "text/plain",
+  ".dtd"          =>      "text/xml",
+  ".xml"          =>      "text/xml",
+  ".mpeg"         =>      "video/mpeg",
+  ".mpg"          =>      "video/mpeg",
+  ".mov"          =>      "video/quicktime",
+  ".qt"           =>      "video/quicktime",
+  ".avi"          =>      "video/x-msvideo",
+  ".asf"          =>      "video/x-ms-asf",
+  ".asx"          =>      "video/x-ms-asf",
+  ".wmv"          =>      "video/x-ms-wmv",
+  ".bz2"          =>      "application/x-bzip",
+  ".tbz"          =>      "application/x-bzip-compressed-tar",
+  ".tar.bz2"      =>      "application/x-bzip-compressed-tar",
+
+# make the default mime type application/octet-stream.
+  ""              =>      "application/octet-stream",
+)
diff --git a/Examples/lighttpd/lighttpd.manifest.template b/Examples/lighttpd/lighttpd.manifest.template
new file mode 100644
index 00000000..1cc64592
--- /dev/null
+++ b/Examples/lighttpd/lighttpd.manifest.template
@@ -0,0 +1,86 @@
+# lighttpd manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# lighttpd must be run with the pal_loader:
+#
+# ./pal_loader lighttpd.manifest <script>
+
+# The executable to load in Graphene.
+loader.exec = file:$(INSTALL_DIR)/sbin/lighttpd
+loader.execname = lighttpd
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables for lighttpd
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:$(INSTALL_DIR)/lib
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by the lighttpd executable
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Host-level directory (/usr) required by the lighttpd executable
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+# Mount the current working directory
+fs.mount.cwd.type = chroot
+fs.mount.cwd.path = $(INSTALL_DIR_ABSPATH)
+fs.mount.cwd.uri = file:$(INSTALL_DIR)
+
+# Mount lighttpd's default server.upload-dirs path
+fs.mount.var_tmp.type = chroot
+fs.mount.var_tmp.path = /var/tmp
+fs.mount.var_tmp.uri = file:/var/tmp
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If lighttpd needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 3
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1
+sgx.trusted_files.nss_files = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+
+# lighttpd modules and dependencies
+$(LIGHTTPD_TRUSTED_MODS)
+$(LIGHTTPD_TRUSTED_LIBS)
+
+# Trusted configuration files
+sgx.trusted_files.conf = file:lighttpd.conf
+sgx.trusted_files.conf2 = file:lighttpd-generic.conf
+sgx.trusted_files.conf3 = file:lighttpd-server.conf
+
+sgx.allowed_files.install = file:install
diff --git a/Examples/lmbench/.gitignore b/Examples/lmbench/.gitignore
new file mode 100644
index 00000000..9bd202a7
--- /dev/null
+++ b/Examples/lmbench/.gitignore
@@ -0,0 +1,2 @@
+/lmbench-2.5
+/lmbench-2.5.tgz
diff --git a/Examples/lmbench/Makefile b/Examples/lmbench/Makefile
new file mode 100644
index 00000000..8cfe079c
--- /dev/null
+++ b/Examples/lmbench/Makefile
@@ -0,0 +1,128 @@
+# Build the manifest for LMBench (only tested for version 2.5):
+#
+# - make                Building for Linux
+# - make DEBUG=1        Building for Linux (with Graphene debug output)
+# - make SGX=1          Building for SGX
+# - make SGX=1 DEBUG=1  Building for SGX (with Graphene debug output)
+#
+# Use `make clean` to remove Graphene-generated files or `make distclean` to
+# remove all generated or downloaded files from the directory.
+
+# Constants
+
+LMBENCHURL = https://sourceforge.net/projects/lmbench/files/lmbench/2.5/lmbench-2.5.tgz/download
+LMBENCHHASH = e7431530a4cf4c44b5068e23454f95765dc0b51e7d98bc2bd70451b17d505bd9
+LMBENCHDIR = lmbench-2.5
+INSTALLDIR = $(LMBENCHDIR)/bin/linux
+LMBENCHCONFIG = $(INSTALLDIR)$(shell $(LMBENCHDIR)/scripts/config)
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= ../../../../..
+
+# If GRAPHENEDIR is a relative path, extend the path from where LMBench is installed
+ifeq ($(patsubst /%,,$(GRAPHENEDIR)),)
+GRAPHENEDIR_FROM_INSTALLDIR = $(GRAPHENEDIR)
+else
+GRAPHENEDIR_FROM_INSTALLDIR = ../../../$(GRAPHENEDIR)
+endif
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+MANIFESTS = $(INSTALLDIR)/manifest $(INSTALLDIR)/hello.manifest $(INSTALLDIR)/sh.manifest
+
+.PHONY: all
+all: $(INSTALLDIR)/lmbench $(MANIFESTS) $(INSTALLDIR)/pal_loader
+ifeq ($(SGX),1)
+all: sgx
+endif
+
+# Building LMBench binaries
+
+$(INSTALLDIR)/lmbench: $(LMBENCHDIR)/src/Makefile
+	$(MAKE) -C $(LMBENCHDIR)/src OS=linux
+
+# Automatically downloading and unpacking LMBench source code
+$(LMBENCHDIR)/src/Makefile: $(LMBENCHDIR).tgz
+	tar -xzf $<
+	touch $@
+
+$(LMBENCHDIR).tgz:
+	$(GRAPHENEDIR)/Scripts/download --output $@ --sha256 $(LMBENCHHASH) --url $(LMBENCHURL)
+
+$(INSTALLDIR)/lmbench-test-ci.sh:
+	cp lmbench-test-ci.sh $@
+
+
+# Generating the manifests
+
+$(MANIFESTS): $(INSTALLDIR)/%: %.template $(INSTALLDIR)/lmbench
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR_FROM_INSTALLDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		$< > $@
+
+# Generating the manifests for SGX
+#
+# For each program in LMBench, we need to generate the manifest
+# individually, along with the signature and the inittoken.
+#
+# The 'sgx' rule below will list the executables in $(INSTALLDIR)
+# and generate their manifests for SGX.
+
+.PHONY: sgx
+sgx: $(INSTALLDIR)/lmbench $(INSTALLDIR)/sh.manifest.sgx $(INSTALLDIR)/hello.manifest.sgx
+	cd $(INSTALLDIR) && \
+	for f in `find -executable -not -name . -not -name lmbench -not -name hello`; do \
+		if [ ! -f $$f.manifest.sgx ]; then \
+			$(GRAPHENEDIR_FROM_INSTALLDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+				-libpal $(GRAPHENEDIR_FROM_INSTALLDIR)/Runtime/libpal-Linux-SGX.so \
+				-key $(GRAPHENEDIR_FROM_INSTALLDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+				-manifest manifest -exec $$f -output $$f.manifest.sgx && \
+			$(GRAPHENEDIR_FROM_INSTALLDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+				-output $$f.token -sig $$f.sig; \
+		fi; \
+	done
+
+$(INSTALLDIR)/sh.manifest.sgx $(INSTALLDIR)/hello.manifest.sgx: %.sgx: %
+	cd $(INSTALLDIR) && \
+	$(GRAPHENEDIR_FROM_INSTALLDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR_FROM_INSTALLDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR_FROM_INSTALLDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $(abspath $<) -output $(abspath $@) && \
+	$(GRAPHENEDIR_FROM_INSTALLDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $(abspath $(basename $<).token) -sig $(abspath $(basename $<).sig)
+
+# Running LMBench natively and under Graphene
+#
+# - make run-native:   run the whole test suite natively (with configuration prompt)
+# - make run-graphene: run the whole test suite under Graphene (with configuration prompt)
+# - make test:         run LMBench for CI (without configuration prompt)
+
+$(LMBENCHCONFIG):
+	cd $(LMBENCHDIR)/scripts && env OS=linux ./config-run
+
+.PHONY: run-native
+run-native: all $(LMBENCHCONFIG)
+	cd $(LMBENCHDIR)/scripts && env OS=linux ./results
+
+.PHONY: run-graphene
+run-graphene: all $(LMBENCHCONFIG)
+	cd $(LMBENCHDIR)/scripts && env LOADER=./pal_loader OS=linux RESULTS=results/graphene ./results
+
+.PHONY: test
+test: all $(INSTALLDIR)/lmbench-test-ci.sh
+	cd $(INSTALLDIR) && env LOADER=./pal_loader OS=linux ./lmbench-test-ci.sh
+
+$(INSTALLDIR)/pal_loader:
+	ln -s $(GRAPHENEDIR_FROM_INSTALLDIR)/Runtime/pal_loader $@
+
+.PHONY: clean
+clean:
+	[ ! -d $(INSTALLDIR) ] || (cd $(INSTALLDIR) && $(RM) *.manifest *.manifest.sgx *.sig *.token)
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(LMBENCHDIR) $(LMBENCHDIR).tgz
diff --git a/Examples/lmbench/README.md b/Examples/lmbench/README.md
new file mode 100644
index 00000000..3827d2cb
--- /dev/null
+++ b/Examples/lmbench/README.md
@@ -0,0 +1,68 @@
+# LMBench example
+
+This directory contains an example for running LMBench in Graphene, including
+the Makefile and a template for generating the manifest. The configuration
+is only tested with LMBench 2.5 and does not work for LMBench 3.0+. The
+application is tested on Ubuntu 16.04, with both normal Linux and SGX platforms.
+
+# Building LMBench and generating the manifest
+
+This repository does not contain the source code of LMBench. Using the following
+building commands will automatically download the source code and unpack it into
+a subdirectory of the current directory.
+
+## Building for Linux
+
+Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
+
+## Building for SGX
+
+Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory.
+
+# Running LMBench
+
+## Running natively
+
+To run the whole test suite natively, use the following command:
+```
+make run-native
+
+```
+
+To run individual tests, you may run the programs in `lmbench-2.5/bin/linux`.
+Here are a few examples:
+```
+./lat_syscall null
+./lat_syscall read
+./lat_syscall write
+```
+
+## Running with Graphene
+
+To run the whole test suite under Graphene, use the following command:
+```
+make run-graphene
+```
+
+To run individual tests, you may run the programs in `lmbench-2.5/bin/linux`,
+using `pal_loader`. Here are a few examples:
+```
+./pal_loader lat_syscall null
+./pal_loader lat_syscall read
+./pal_loader lat_syscall write
+```
+
+## Running with Graphene-SGX
+
+To run the whole test suite, use the following command:
+```
+make run-graphene SGX=1
+```
+
+To run individual tests, you may run the programs in `lmbench-2.5/bin/linux`,
+using `pal_loader`. Here are a few examples:
+```
+SGX=1 ./pal_loader lat_syscall null
+SGX=1 ./pal_loader lat_syscall read
+SGX=1 ./pal_loader lat_syscall write
+```
diff --git a/Examples/lmbench/hello.manifest.template b/Examples/lmbench/hello.manifest.template
new file mode 100644
index 00000000..351d7227
--- /dev/null
+++ b/Examples/lmbench/hello.manifest.template
@@ -0,0 +1,41 @@
+# manifest for running `hello` from LMBench.
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+# The executable to load in Graphene.
+loader.exec = file:hello
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave size
+# must be specified during signing. If the program needs more virtual memory than
+# the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 4
+
+# SGX trusted libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
diff --git a/Examples/lmbench/lmbench-test-ci.sh b/Examples/lmbench/lmbench-test-ci.sh
new file mode 100755
index 00000000..7c17ba9d
--- /dev/null
+++ b/Examples/lmbench/lmbench-test-ci.sh
@@ -0,0 +1,282 @@
+#!/bin/bash
+
+# lmbench - run the lmbench benchmark suite.
+#
+# Hacked by Larry McVoy (lm@sun.com, lm@sgi.com, lm@bitmover.com).
+# Copyright (c) 1994 Larry McVoy.  GPLed software.
+# $Id$
+
+# Make sure we can find: ./cmd, df, and netstat
+PATH=.:../../scripts:$PATH:/etc:/usr/etc:/sbin:/usr/sbin
+export PATH
+
+echo PATH = $PATH
+echo lat_syscall = `readlink -f lat_syscall`
+
+# lat_unix, lat_udp, lat_tcp only do one run!!!
+# we loop to repeat the tests
+N_RUNS=${N_RUNS:-1}
+
+if [ -f $1 ]
+then	. $1
+	echo Using config in $1
+else	echo Using defaults
+	ENOUGH=${ENOUGH:-1000}
+	TIMING_O=0
+	LOOP_O=0
+fi
+export ENOUGH TIMING_O LOOP_O
+
+if [ X$FILE = X ]
+then
+	FILE=/tmp/XXX
+	touch $FILE || echo Can not create $FILE
+fi
+if [ X$MB = X ]
+then
+	MB=8
+fi
+AVAILKB=`expr $MB \* 1024`
+
+# Figure out how big we can go for stuff that wants to use
+# all and half of memory.
+HALF="512 1k 2k 4k 8k 16k 32k 64k 128k 256k 512k 1m"
+ALL="$HALF 2m"
+i=4
+while [ $i -le $MB ]
+do
+	ALL="$ALL ${i}m"
+	h=`expr $i / 2`
+	HALF="$HALF ${h}m"
+	i=`expr $i \* 2`
+done
+
+
+if [ X$FSDIR = X ]
+then
+	FSDIR=/tmp/lat_fs
+fi
+MP=N
+
+# Figure out as much stuff as we can about this system.
+# Sure would be nice if everyone had SGI's "hinv".
+echo \[lmbench2.0 results for `uname -a`] 1>&2
+echo \[ALL: ${ALL}] 1>&2
+echo \[DISKS: ${DISKS}] 1>&2
+echo \[DISK_DESC: ${DISK_DESC}] 1>&2
+echo \[ENOUGH: ${ENOUGH}] 1>&2
+echo \[FAST: ${FAST}] 1>&2
+echo \[FASTMEM: ${FASTMEM}] 1>&2
+echo \[FILE: ${FILE}] 1>&2
+echo \[FSDIR: ${FSDIR}] 1>&2
+echo \[HALF: ${HALF}] 1>&2
+echo \[INFO: ${INFO}] 1>&2
+echo \[LOOP_O: ${LOOP_O}] 1>&2
+echo \[MB: ${MB}] 1>&2
+echo \[MHZ: ${MHZ}] 1>&2
+echo \[MOTHERBOARD: ${MOTHERBOARD}] 1>&2
+echo \[NETrunS: ${NETrunS}] 1>&2
+echo \[PROCESSORS: ${PROCESSORS}] 1>&2
+echo \[REMOTE: ${REMOTE}] 1>&2
+echo \[SLOWFS: ${SLOWFS}] 1>&2
+echo \[OS: ${OS}] 1>&2
+echo \[TIMING_O: ${TIMING_O}] 1>&2
+echo \[LMBENCH VERSION: ${VERSION}] 1>&2
+echo \[USER: $USER] 1>&2
+echo \[HOSTNAME: `hostname`] 1>&2
+echo \[NODENAME: `uname -n`] 1>&2
+echo \[SYSNAME: `uname -s`] 1>&2
+echo \[PROCESSOR: `uname -p`] 1>&2
+echo \[MACHINE: `uname -m`] 1>&2
+echo \[RELEASE: `uname -r`] 1>&2
+echo \[VERSION: `uname -v`] 1>&2
+#if 0
+echo \[`date`] 1>&2
+echo \[`uptime`] 1>&2
+netstat -i | while read i
+do
+	echo \[net: "$i"] 1>&2
+	set `echo $i`
+	case $1 in
+	    *ame)	;;
+	    *)		ifconfig $1 | while read i
+			do
+				echo \[if: "$i"] 1>&2
+			done
+			;;
+	esac
+done
+
+mount | while read i
+do
+	echo \[mount: "$i"] 1>&2
+done
+
+STAT=$FSDIR/lmbench
+mkdir $FSDIR 2>/dev/null
+touch $STAT 2>/dev/null
+if [ ! -f $STAT ]
+then
+	echo "Can't make a file - $STAT - in $FSDIR"
+	touch $STAT
+	exit 1
+fi
+
+if [ ! -f "/tmp/hello" ]
+then
+	cp hello /tmp/hello
+fi
+
+function run {
+	echo "$@"
+	TMPOUT=/tmp/OUT
+	rm -rf $TMPOUT
+	$LOADER "$@" 2>>$TMPOUT | tee -a $TMPOUT
+	retval=$?
+	echo $retval
+	if [ $retval -ne 0 ]
+	then
+	    cat $TMPOUT 1>&2
+	    exit $retval
+	else
+	    cat $TMPOUT 1>&2
+	fi
+}
+
+function af_unix {
+# DP 7/4/18: This test intermittently hangs on SGX, taking out of CI for now
+#AF_UNIX
+	echo AF_UNIX socket latency
+	for i in `seq 1 $N_RUNS`
+	do
+		run lat_unix
+	done
+}
+
+
+function wr_bw {
+	for i in `seq 1 $N_RUNS`
+	do
+		rm -f $FILE
+		run lmdd label="File $FILE write bandwidth:" of=$FILE move=${MB}m fsync=1 print=3
+	done
+}
+
+function udp_soc_lat {
+	echo UDP socket latency
+	run lat_udp -s &
+	sleep 3
+	for i in `seq 1 $N_RUNS`
+	do
+		run lat_udp 127.0.0.1
+		sleep 1
+	done
+	run lat_udp -127.0.0.1
+	sleep 3
+}
+
+function tcp_soc_lat {
+	echo TCP socket latency
+	run lat_tcp -s &
+	sleep 3
+	for i in `seq 1 $N_RUNS`
+	do
+		run lat_tcp 127.0.0.1
+		sleep 1
+	done
+	run lat_tcp -127.0.0.1
+	sleep 3
+}
+
+function tcp_con_lat {
+	echo TCP connect latency
+	run lat_connect -s &
+	sleep 3
+	run lat_connect 127.0.0.1
+	sleep 1
+	run lat_connect -127.0.0.1
+	sleep 3
+}
+
+function tcp_soc_bw {
+	echo TCP socket bandwidth
+	run bw_tcp -s &
+	sleep 3
+	for i in `seq 1 $N_RUNS`
+	do
+		run bw_tcp 127.0.0.1
+		sleep 1
+	done
+	run bw_tcp -127.0.0.1
+	sleep 3
+}
+
+function bw_unix {
+	for i in `seq 1 $N_RUNS`
+	do
+		run bw_unix
+	done
+}
+
+function bw_pipe {
+	for i in `seq 1 $N_RUNS`
+	do
+		run bw_pipe
+	done
+}
+
+
+declare -a tests=(
+			"lat_syscall null"
+			"lat_syscall read"
+			"lat_syscall write"
+			"lat_syscall stat $STAT"
+			"lat_syscall fstat $STAT"
+			"lat_syscall open $STAT"
+			"lat_select file 500"
+# DP 1/20/18: This test intermittently hangs on SGX, taking out of CI for now
+#			"lat_select tcp 500"
+			"lat_sig install"
+			"lat_sig catch"
+			"lat_sig prot lat_sig"
+## DEP  2/4/19: Temporarily remove fork from the unit tests
+#			"lat_proc fork"
+## DEP 11/1/18: Temporarily remove exec from the unit tests
+#			"lat_proc exec"
+## DEP 6/16/18: Temporarily remove shell from the unit tests
+#			"lat_proc shell"
+			"lat_fs $FSDIR"
+		);
+
+declare -a test_funcs=(
+# DP 7/4/18: This test intermittently hangs on SGX, taking out of CI for now
+#			"af_unix"
+			"wr_bw"
+			"udp_soc_lat"
+			"tcp_soc_lat"
+			"tcp_con_lat"
+			"tcp_soc_bw"
+			"bw_unix"
+## DEP 1/20/18: Temporarliy remove bw_pipe from the unit tests - intermittent hangs
+#			"bw_pipe"
+		);
+
+date
+echo Latency measurements
+msleep 250
+
+for i in `seq 0 $((${#tests[@]}-1))`
+do
+	echo "Running ${tests[$i]}"
+	run ${tests[$i]}
+done
+
+
+for i in `seq 0 $((${#test_funcs[@]}-1))`
+do
+	echo "Calling ${test_funcs[$i]}"
+	${test_funcs[$i]}
+done
+
+exit 0
+
diff --git a/Examples/lmbench/manifest.template b/Examples/lmbench/manifest.template
new file mode 100644
index 00000000..7c72574f
--- /dev/null
+++ b/Examples/lmbench/manifest.template
@@ -0,0 +1,84 @@
+# LMBench 2.5 manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# This manifest has no specific executable. It's prepared as a generic manifest
+# for all LMBench programs. To run a single LMBench test, simply run the command
+# under pal_loader:
+#
+# ./pal_loader <program> <arguments>
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables for LMBench
+loader.env.LD_LIBRARY_PATH = /lib
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Mount /bin (mainly needed for running /bin/sh)
+fs.mount.bin.type = chroot
+fs.mount.bin.path = /bin
+fs.mount.bin.uri = file:/bin
+
+# Mount /tmp
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+# Mount /var/tmp
+fs.mount.var_tmp.type = chroot
+fs.mount.var_tmp.path = /var/tmp
+fs.mount.var_tmp.uri = file:/var/tmp
+
+# Mount /usr/include/x84_64-linux-gnu/ (used by LMBench for file tests)
+fs.mount.inc.type = chroot
+fs.mount.inc.path = /usr/include/x86_64-linux-gnu/
+fs.mount.inc.uri = file:/usr/include/x86_64-linux-gnu/
+
+# Network related rules. These rules are used only for sandboxing, which is
+# currently an EXPERIMENTAL feature.
+net.allow_bind.1 = 0.0.0.0:31233-31237
+net.allow_bind.2 = 0.0.0.0:34297-34298
+net.allow_peer.1 = 127.0.0.1:0-65535
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If LMBench needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 4
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# SGX untrusted (allowed) files/directories
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.var_tmp = file:/var/tmp
+sgx.allowed_files.inc = file:/usr/include/x86_64-linux-gnu
+
+# Trusted signature for creating child enclaves (by execve())
+sgx.trusted_children.hello = file:hello.sig
+sgx.trusted_children.sh = file:sh.sig
diff --git a/Examples/lmbench/sh.manifest.template b/Examples/lmbench/sh.manifest.template
new file mode 100644
index 00000000..447513d0
--- /dev/null
+++ b/Examples/lmbench/sh.manifest.template
@@ -0,0 +1,41 @@
+# sh manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+# The executable to load in Graphene.
+loader.exec = file:/bin/sh
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave size
+# must be specified during signing. If the program needs more virtual memory than
+# the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 4
+
+# SGX trusted libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
diff --git a/Examples/memcached/.gitignore b/Examples/memcached/.gitignore
new file mode 100644
index 00000000..69865c2c
--- /dev/null
+++ b/Examples/memcached/.gitignore
@@ -0,0 +1,2 @@
+/src
+/memcached.tar.gz
diff --git a/Examples/memcached/Makefile b/Examples/memcached/Makefile
new file mode 100644
index 00000000..01701c52
--- /dev/null
+++ b/Examples/memcached/Makefile
@@ -0,0 +1,102 @@
+# Build Memcached as follows:
+#
+# - make               -- create non-SGX no-debug-log manifest
+# - make SGX=1         -- create SGX no-debug-log manifest
+# - make SGX=1 DEBUG=1 -- create SGX debug-log manifest
+#
+# Any of these invocations downloads Memcached and builds Memcached in default
+# configuration.
+#
+# Use `make clean` to remove Graphene-generated files and `make distclean` to
+# additionally remove the Memcached source.
+
+################################# CONSTANTS ###################################
+
+# Relative path to Graphene root
+GRAPHENEDIR = ../../../../..
+
+SRCDIR = src
+MEMCACHED_URL ?= https://memcached.org/files/memcached-1.5.21.tar.gz
+MEMCACHED_SHA256 ?= e3d10c06db755b220f43d26d3b68d15ebf737a69c7663529b504ab047efe92f4
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY=all
+all: memcached memcached.manifest pal_loader
+ifeq ($(SGX),1)
+all: memcached.manifest.sgx
+endif
+
+############################ MEMCACHED EXECUTABLE #############################
+
+# Memcached is built as usual, without any changes to the build process. The
+# source is downloaded from memcached.org and built via classic ./configure &&
+# make. The result of this build process is the final executable
+# "src/memcached".
+
+$(SRCDIR)/configure:
+	$(GRAPHENEDIR)/Scripts/download --output memcached.tar.gz \
+		--sha256 $(MEMCACHED_SHA256) --url $(MEMCACHED_URL)
+	mkdir $(SRCDIR)
+	tar -C $(SRCDIR) --strip-components=1 -xf memcached.tar.gz
+
+$(SRCDIR)/memcached: $(SRCDIR)/configure
+	cd $(SRCDIR) && ./configure
+	cd $(SRCDIR) && make
+
+############################## MEMCACHED MANIFEST #############################
+
+# The template file contains almost all necessary information to run Memcached
+# under Graphene / Graphene-SGX. We create memcached.manifest (to be run under
+# non-SGX Graphene) by simply replacing variables in the template file via sed.
+
+memcached.manifest: memcached.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		$< > $@
+
+# Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This
+# procedure measures all Memcached dependencies (shared libraries and trusted
+# files), measures Memcached code/data pages, and adds measurements in the
+# resulting manifest.sgx file (among other, less important SGX options).
+#
+# Additionally, Graphene-SGX requires EINITTOKEN and SIGSTRUCT objects (see
+# SGX hardware ABI, in particular EINIT instruction). The "pal-sgx-get-token"
+# script generates these objects and puts them in files .token and .sig
+# respectively. Note that filenames must be the same as the executable/manifest
+# name (i.e., "memcached").
+
+memcached.manifest.sgx: memcached.manifest $(SRCDIR)/memcached
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@ \
+		-exec $(SRCDIR)/memcached
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output memcached.token -sig memcached.sig
+
+########################### COPIES OF EXECUTABLES #############################
+
+# Memcached build process creates the final executable as src/memcached. For
+# simplicity, copy it into our root directory.
+# Also, create a link to pal_loader for simplicity.
+
+memcached: $(SRCDIR)/memcached
+	cp $< $@
+
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+################################## CLEANUP ####################################
+
+.PHONY=clean
+clean:
+	$(RM) *.token *.sig *.manifest.sgx *.manifest pal_loader memcached
+
+.PHONY=distclean
+distclean: clean
+	$(RM) -r $(SRCDIR) memcached.tar.gz
diff --git a/Examples/memcached/README b/Examples/memcached/README
new file mode 100644
index 00000000..398dfeda
--- /dev/null
+++ b/Examples/memcached/README
@@ -0,0 +1,33 @@
+# Memcached
+
+This directory contains the Makefile and the template manifest for the most
+recent version of Memcached (as of this writing, commit 78eb770 on May 24,
+2019). This was tested on a machine with SGX v1 and Ubuntu 16.04.
+
+The Makefile and the template manifest contain extensive comments and are made
+self-explanatory. Please review them to gain understanding in Graphene-SGX
+and requirements for applications running under Graphene-SGX.
+
+# Quick Start
+
+```sh
+# build Memcached and the final manifest
+make SGX=1
+
+# run original Memcached against a benchmark (memtier_benchmark,
+# install the benchmark on your host OS first)
+./memcached &
+memtier_benchmark --port=11211 --protocol=memcache_binary --hide-histogram
+killall memcached
+
+# run Memcached in non-SGX Graphene against a benchmark
+# (note -u nobody, for explanation see memcached.manifest.template)
+./pal_loader memcached -u nobody &
+memtier_benchmark --port=11211 --protocol=memcache_binary --hide-histogram
+killall pal-Linux
+
+# run Memcached in Graphene-SGX against a benchmark
+SGX=1 ./pal_loader memcached -u nobody &
+memtier_benchmark --port=11211 --protocol=memcache_binary --hide-histogram
+killall pal-Linux-SGX
+```
diff --git a/Examples/memcached/memcached.manifest.template b/Examples/memcached/memcached.manifest.template
new file mode 100644
index 00000000..4b5bab45
--- /dev/null
+++ b/Examples/memcached/memcached.manifest.template
@@ -0,0 +1,198 @@
+# Memcached manifest file example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+################################## RUNNING ####################################
+
+# Memcached must be run with the --user=<existing-user-name> argument:
+#
+# ./pal_loader ./memcached --user=nobody
+#
+# User argument is required because Graphene currently emulates real/effective
+# user ID as 0 (root). This leads Memcached to believe it is run under root. For
+# security reasons, Memcached drops privileges and assumes non-privileged user
+# ID which must be specified as command-line argument. The assumed user ID is
+# irrelevant for consequent Memcached execution, so it may be any existing
+# host-OS username (e.g. "nobody" or even "root").
+
+# Executable to load into Graphene and run. Note that Graphene tries its best
+# to find the corresponding manifest file (by appending ".manifest" or
+# ".manifest.sgx") based on the executable name, and vice versa. Still, it is
+# required to have the explicit name of the executable here.
+loader.exec = file:memcached
+
+################################## GRAPHENE ###################################
+
+# LibOS layer library of Graphene. There is currently only one implementation,
+# so it is always set to libsysdb.so. Note that GRAPHENEDIR macro is expanded
+# to relative path to Graphene repository in the Makefile as part of the
+# build process.
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively). Note that
+# GRAPHENEDEBUG macro is expanded to inline/none in the Makefile as part of the
+# build process.
+loader.debug_type = $(GRAPHENEDEBUG)
+
+################################# ENV VARS  ###################################
+
+# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
+# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
+# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
+#
+# In case of Memcached:
+# - /lib is searched for Glibc libraries (ld, libc, libpthread)
+# - /lib/x86_64-linux-gnu is searched for Name Service Switch (NSS) libraries
+# - /usr/lib/x86_64-linux-gnu is searched for libevent (the only explicit
+#                             Memcached dependency)
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Explicitly unset all environment variables used by Memcached. This is just a
+# precaution so that attacker cannot influence the default behavior of Memcached
+# by setting unexpected environment variables.
+#
+# TODO(dimakuv): Graphene's PAL incorrectly handles this currently. See
+# `read_environments()`, the end of function. Below strings create envvars
+# with empty strings, which forces Memcached to do incorrect things like
+# creating an empty-prefix .lck file (due to MEMCACHED_PORT_FILENAME=="").
+loader.env.MEMCACHED_PORT_FILENAME =
+loader.env.MEMCACHED_HASH_BULK_MOVE =
+loader.env.SASL_CONF_PATH =
+loader.env.MEMCACHED_SASL_PWDB =
+loader.env.T_MEMD_INITIAL_MALLOC =
+loader.env.MEMCACHED_SLAB_BULK_CHECK =
+
+################################# MOUNT FS  ###################################
+
+# General notes:
+# - There is only one supported type of mount points: 'chroot'.
+# - Directory names are (somewhat confusingly) prepended by 'file:'.
+# - Names of mount entries (lib, lib2, lib3) are irrelevant but must be unique.
+# - In-Graphene visible path names may be arbitrary but we reuse host-OS URIs
+#   for simplicity (except for the first 'lib' case).
+
+# Mount host-OS directory to Graphene glibc/runtime libraries (in 'uri') into
+# in-Graphene visible directory /lib (in 'path'). Note that GRAPHENEDIR macro
+# is expanded to relative path to Graphene repository in the Makefile as part
+# of the build process.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Mount host-OS directory to Name Service Switch (NSS) libraries (in 'uri')
+# into in-Graphene visible directory /lib/x86_64-linux-gnu (in 'path').
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to libevent lib required by Memcached (in 'uri')
+# into in-Graphene visible directory /usr/lib/x86_64-linux-gnu (in 'path').
+fs.mount.lib3.type = chroot
+fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu
+fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to NSS files required by Glibc + NSS libs (in 'uri')
+# into in-Graphene visible directory /etc (in 'path').
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+################################## NETWORK ####################################
+
+# Allow binding on any network interface but only on port 11211. This is the
+# default port used by Memcached. Note how a missing interface name means "any
+# interface".
+net.allow_bind.memcachedport = :11211
+
+############################### SGX: GENERAL ##################################
+
+# Set enclave size (somewhat arbitrarily) to 1024MB. Recall that SGX v1 requires
+# to specify enclave size at enclave creation time. If Memcached exhausts these
+# 1024MB then it will start failing with random errors. Greater enclave sizes
+# result in longer startup times, smaller enclave sizes are not enough for
+# typical Memcached workloads.
+#
+# NOTE: Memcached does not fail explicitly when enclave memory is exhausted.
+# Instead, Memcached goes into infinite loop without a listening socket. You
+# can trigger this incorrect behavior by increasing the number of threads
+# to 12 (each thread requires 128MB of memory): `memcached -t 12`. This is
+# an issue in Memcached source code, not related to Graphene.
+sgx.enclave_size = 1024M
+
+# Set maximum number of in-enclave threads (somewhat arbitrarily) to 16. Recall
+# that SGX v1 requires to specify the maximum number of simulteneous threads at
+# enclave creation time. If Memcached spawns more threads, Graphene-SGX fails.
+#
+# Note that internally Graphene may spawn two additional threads, one for IPC
+# and one for asynchronous events/alarms. Memcached spawns an additional main
+# thread which sits idle after spawning worker threads. Therefore, specifying
+# '16' allows to run a maximum of 13 Memcached threads (`--threads <= 13`).
+sgx.thread_num = 16
+
+############################# SGX: TRUSTED LIBS ###############################
+
+# Specify all libraries used by Memcached and its dependencies (including all
+# libraries which can be loaded at runtime via dlopen). The paths to libraries
+# are host-OS paths. These libraries will be searched for in in-Graphene visible
+# paths according to mount points above.
+#
+# As part of the build process, Graphene-SGX script (`pal-sgx-sign`) finds each
+# specified library, measures its hash, and outputs the hash in auto-generated
+# entry 'sgx.trusted_checksum.xxx' in auto-generated memcached.manifest.sgx.
+# Note that this happens on the developer machine.
+#
+# At runtime, during loading of this library, Graphene-SGX measures its hash
+# and compares with the one specified in 'sgx.trusted_checksum.xxx'. If hashes
+# match, this library is trusted and allowed to be loaded and used. Note that
+# this happens on the client machine.
+
+# Glibc libraries. ld and libc are needed for all apps; pthread is needed
+# because Memcached is multi-threaded.
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Name Service Switch (NSS) libraries. Glibc calls these libraries as part of
+# name-service information gathering. libnss_{compat,files,nis} are the
+# most widely used libraries, at least on Ubuntu.
+# For more info, see 'man nsswitch.conf'.
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssfiles  = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssnis  = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+
+# libNSL is a dependency of libnss_compat above. It is a good example of nested
+# library dependencies required by Graphene-SGX.
+sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+# libEvent is an explicit dependency of Memcached. We choose to install it on
+# host OS instead of downloading the sources, building, and linking Memcached
+# against the built library (which is possible but would require more effort).
+sgx.trusted_files.libevent = file:/usr/lib/x86_64-linux-gnu/libevent-2.0.so.5
+
+############################ SGX: TRUSTED FILES ###############################
+
+# Trusted no-library files include configuration files, read-only files, and
+# other static files. It is useful to specify such files here to make sure
+# they are not maliciously modified (modifications will be detected as hash
+# mismatch by Graphene-SGX).
+#
+# Memcached does not have any configuration files, so this section is empty.
+# sgx.trusted_files.config = file:<important-configuration-file>
+
+############################# SGX: ALLOWED FILES ###############################
+
+# Specify all non-static files used by app. These files may be opened by
+# Graphene-SGX but modifications to them are not detected (Graphene-SGX does
+# not measure their hashes). This may pose a security risk!
+
+# Name Service Switch (NSS) files. Glibc reads these files as part of name-
+# service information gathering. For more info, see 'man nsswitch.conf'.
+sgx.allowed_files.nsswitch  = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers    = file:/etc/ethers
+sgx.allowed_files.hosts     = file:/etc/hosts
+sgx.allowed_files.group     = file:/etc/group
+sgx.allowed_files.passwd    = file:/etc/passwd
+
+# getaddrinfo(3) configuration file. Glibc reads this file to correctly find
+# network addresses. For more info, see 'man gai.conf'.
+sgx.allowed_files.gaiconf   = file:/etc/gai.conf
diff --git a/Examples/nginx/.gitignore b/Examples/nginx/.gitignore
new file mode 100644
index 00000000..62d8be6f
--- /dev/null
+++ b/Examples/nginx/.gitignore
@@ -0,0 +1,5 @@
+*.tar.gz
+/nginx-*/*
+/install/*
+/result-*
+/OUTPUT
diff --git a/Examples/nginx/Makefile b/Examples/nginx/Makefile
new file mode 100644
index 00000000..0836a3a9
--- /dev/null
+++ b/Examples/nginx/Makefile
@@ -0,0 +1,175 @@
+# Building the manifest for Nginx:
+#
+# - make                  Building for Linux
+# - make DEBUG=1          Building for Linux, with Graphene debug output
+# - make SGX=1            Building for SGX
+# - make SGX=1 DEBUG=1    Building for SGX, with Graphene debug output
+#
+# Use `make clean` to remove Graphene-generated files.
+#
+# Use `make distclean` to further remove the Nginx tarball, source code,
+# and installation.
+
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+INSTALL_DIR ?= $(THIS_DIR)install
+NGINX_SRC ?= $(THIS_DIR)nginx-1.16.1
+NGINX_CHECKSUM ?= f11c2a6dd1d3515736f0324857957db2de98be862461b5a542a3ac6188dbe32b
+
+# Mirrors for downloading the Nginx source code
+NGINX_MIRRORS ?= \
+	http://nginx.org/download/
+
+# Address and port for the Nginx server to listen
+LISTEN_HOST ?= 127.0.0.1
+LISTEN_PORT ?= 8002
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= $(THIS_DIR)../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: $(INSTALL_DIR)/sbin/nginx nginx.manifest pal_loader config testdata
+ifeq ($(SGX),1)
+all: nginx.manifest.sgx nginx.sig nginx.token
+endif
+
+# The make targets for downloading and compiling the Nginx source code, and
+# installing the binaries.
+# Note that Graphene doesn't support eventfd() and PR_SET_DUMPABLE, so we manually
+# overwrite these macros in the autogenerated configuration header of Nginx.
+$(INSTALL_DIR)/sbin/nginx: $(NGINX_SRC)/configure
+	cd $(NGINX_SRC) && ./configure --prefix=$(abspath $(INSTALL_DIR))
+	sed -e "s|#define NGX_HAVE_EVENTFD[[:space:]]\+1|#define NGX_HAVE_EVENTFD 0|g" \
+		-e "s|#define NGX_HAVE_SYS_EVENTFD_H[[:space:]]\+1|#define NGX_HAVE_SYS_EVENTFD_H 0|g" \
+		-e "s|#define NGX_HAVE_PR_SET_DUMPABLE[[:space:]]\+1|#define NGX_HAVE_PR_SET_DUMPABLE 0|g" \
+		-i $(NGINX_SRC)/objs/ngx_auto_config.h
+	cd $(NGINX_SRC) && $(MAKE)
+	cd $(NGINX_SRC) && $(MAKE) install
+
+$(NGINX_SRC)/configure: $(NGINX_SRC).tar.gz
+	tar -mxzf $<
+
+$(NGINX_SRC).tar.gz:
+	$(GRAPHENEDIR)/Scripts/download --output $@ --sha256 $(NGINX_CHECKSUM) $(foreach mirror,$(NGINX_MIRRORS),--url $(mirror)/$(NGINX_SRC).tar.gz)
+
+# Nginx dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libutil libpthread
+
+# Listing all the Nginx dependencies, besides Glibc libraries
+.INTERMEDIATE: nginx-ldd
+nginx-ldd: $(INSTALL_DIR)/sbin/nginx
+	@for F in $(INSTALL_DIR)/sbin/nginx; do \
+		ldd $$F >> $@ || exit 1; done
+
+.INTERMEDIATE: nginx-deps
+nginx-deps: nginx-ldd
+	@cat $< | awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' \
+		| sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generating manifest rules for Nginx dependencies
+.INTERMEDIATE: nginx-trusted-libs
+nginx-trusted-libs: nginx-deps
+	@HTTPD_LIBS="$(INSTALL_DIR)/sbin/nginx" && \
+	for F in `cat nginx-deps`; do \
+		P=`ldd $$HTTPD_LIBS | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+nginx.manifest: nginx.manifest.template nginx-trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(INSTALL_DIR)|'"$(INSTALL_DIR)"'|g' \
+		-e 's|$$(INSTALL_DIR_ABSPATH)|'"$(abspath $(INSTALL_DIR))"'|g' \
+		-e 's|$$(NGINX_TRUSTED_LIBS)|'"`cat nginx-trusted-libs`"'|g' \
+		$< > $@
+
+# Generating the SGX-specific manifest (nginx.manifest.sgx), the enclave signature,
+# and the token for enclave initialization.
+nginx.manifest.sgx: nginx.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+nginx.sig: nginx.manifest.sgx
+
+nginx.token: nginx.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output nginx.token -sig nginx.sig
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+# Nginx configuration and test data
+#
+# The following changes are made in nginx.conf (copied as nginx-graphene.conf):
+# - Number of worker processes in increased from 1 to 4
+# - Listening port is changed from 80 to LISTEN_PORT
+# - Listening host is changed from localhost to LISTEN_HOST
+# - Add `daemon off` to run Nginx in the foreground
+.PHONY: config
+config: $(INSTALL_DIR)/conf/nginx-graphene.conf
+
+$(INSTALL_DIR)/conf/nginx-graphene.conf: $(INSTALL_DIR)/conf/nginx.conf
+	sed -e "s|^worker_processes[[:space:]]\+1;|worker_processes 4;|g" \
+		-e "s|listen[[:space:]]\+80;|listen $(LISTEN_PORT);|g" \
+		-e "s|server_name[[:space:]]\+localhost;|server_name $(LISTEN_HOST);|g" \
+	$< > $@
+	echo "\n\
+daemon off;\n" >> $@
+
+# HTTP docs:
+# Generating random HTML files in $(INSTALL_DIR)/html/random
+
+RANDOM_DIR = $(INSTALL_DIR)/html/random
+RANDOM_FILES = \
+	$(foreach n,1 2 3 4 5 6 7 8 9 10,2K.$n.html) \
+	$(foreach n,1 2 3 4 5,10K.$n.html) \
+	$(foreach n,1 2 3 4 5,100K.$n.html) \
+	$(foreach n,1 2 3,1M.$n.html) \
+	$(foreach n,1 2 3,10M.$n.html) \
+	$(foreach n,1 2 3,100.$n.html)
+
+TEST_DATA = $(addprefix $(RANDOM_DIR)/,$(RANDOM_FILES))
+
+$(RANDOM_DIR)/%.html:
+	mkdir -p $(RANDOM_DIR)
+	dd if=/dev/urandom of=$@ count=1 bs=$(basename $(basename $(notdir $@)))
+
+.PHONY: testdata
+testdata: $(TEST_DATA)
+
+# Targets to run Nginx
+
+.PHONY: start-native-server
+start-native-server: all
+	$(INSTALL_DIR)/sbin/nginx -c conf/nginx-graphene.conf
+
+.PHONY: start-graphene-server
+start-graphene-server: all
+	./pal_loader nginx.manifest -c conf/nginx-graphene.conf
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT result-* nginx-ldd tmp
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(NGINX_SRC).tar.gz $(NGINX_SRC) $(INSTALL_DIR)
diff --git a/Examples/nginx/README.md b/Examples/nginx/README.md
new file mode 100644
index 00000000..5464b4b9
--- /dev/null
+++ b/Examples/nginx/README.md
@@ -0,0 +1,47 @@
+# Nginx
+
+This directory contains the Makefile and the template manifest for the most
+recent version of Nginx web server (as of this writing, version 1.16.1). This
+was tested on a machine with SGX v1 and Ubuntu 16.04.
+
+The Makefile and the template manifest contain extensive comments. Please review
+them to understand the requirements for Nginx running under Graphene-SGX.
+
+We build Nginx from the source code instead of using an existing installation.
+On Ubuntu 16.04, please make sure that the following packages are installed:
+```sh
+sudo apt-get install -y build-essential apache2-utils
+```
+
+# Quick Start
+
+```sh
+# build Nginx and the final manifest
+make SGX=1
+
+# run original Nginx against a benchmark (benchmark-http.sh, uses ab)
+./install/sbin/nginx -c conf/nginx-graphene.conf &
+./benchmark-http.sh 127.0.0.1:8002
+kill -SIGINT %%
+
+# run Nginx in non-SGX Graphene against a benchmark
+./pal_loader ./nginx.manifest -c conf/nginx-graphene.conf &
+./benchmark-http.sh 127.0.0.1:8002
+kill -SIGINT %%
+
+# run Nginx in Graphene-SGX against a benchmark
+SGX=1 ./pal_loader ./nginx.manifest -c conf/nginx-graphene.conf &
+./benchmark-http.sh 127.0.0.1:8002
+kill -SIGINT %%
+
+# you can also test the server using other utilities like wget
+wget http://127.0.0.1:8002/random/10K.1.html
+```
+
+Alternatively, to run the Nginx server, use one of the following commands:
+
+```
+make start-native-server
+make start-graphene-server
+make SGX=1 start-graphene-server
+```
diff --git a/Examples/nginx/benchmark-http.sh b/Examples/nginx/benchmark-http.sh
new file mode 120000
index 00000000..38087f85
--- /dev/null
+++ b/Examples/nginx/benchmark-http.sh
@@ -0,0 +1 @@
+../common_tools/benchmark-http.sh
\ No newline at end of file
diff --git a/Examples/nginx/nginx.manifest.template b/Examples/nginx/nginx.manifest.template
new file mode 100644
index 00000000..13be68e5
--- /dev/null
+++ b/Examples/nginx/nginx.manifest.template
@@ -0,0 +1,100 @@
+# Nginx manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# Nginx must be run with the pal_loader:
+#
+# ./pal_loader nginx.manifest -c conf/nginx-graphene.conf
+
+# The executable to load in Graphene.
+loader.exec = file:$(INSTALL_DIR)/sbin/nginx
+loader.execname = nginx
+
+# Graphene environment, including the path to the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by Nginx.
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Host-level directory to NSS files required by Glibc + NSS libs.
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# Mount the current working directory
+fs.mount.cwd.type = chroot
+fs.mount.cwd.path = $(INSTALL_DIR_ABSPATH)
+fs.mount.cwd.uri = file:$(INSTALL_DIR)
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If Nginx needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+#
+# We (somewhat arbitrarily) specify 4 threads since Nginx is single-threaded.
+sgx.thread_num = 4
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Name Service Switch (NSS) libraries (Glibc dependencies)
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+
+# libNSL is a dependency of libnss_compat above
+sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+# Nginx dependencies (shared libraries)
+$(NGINX_TRUSTED_LIBS)
+
+# Nginx configuration (trusted)
+sgx.trusted_files.conf1 = file:$(INSTALL_DIR)/conf/nginx-graphene.conf
+sgx.trusted_files.conf2 = file:$(INSTALL_DIR)/conf/mime.types
+
+# Nginx HTTP documents (trusted)
+# We only specify those documents used in our tests/benchmarks
+sgx.trusted_files.htdocs1 = file:$(INSTALL_DIR)/html/index.html
+sgx.trusted_files.htdocs2 = file:$(INSTALL_DIR)/html/random/10K.1.html
+
+# Nginx logs directory (untrusted and allowed, since log files are not security-critical)
+sgx.allowed_files.logs = file:$(INSTALL_DIR)/logs
+
+# Name Service Switch (NSS) files (Glibc reads these files)
+sgx.allowed_files.nsswitch = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers = file:/etc/ethers
+sgx.allowed_files.hosts = file:/etc/hosts
+sgx.allowed_files.group = file:/etc/group
+sgx.allowed_files.passwd = file:/etc/passwd
diff --git a/Examples/nodejs-express-server/.gitignore b/Examples/nodejs-express-server/.gitignore
new file mode 100644
index 00000000..2ccbe465
--- /dev/null
+++ b/Examples/nodejs-express-server/.gitignore
@@ -0,0 +1 @@
+/node_modules/
diff --git a/Examples/nodejs-express-server/Makefile b/Examples/nodejs-express-server/Makefile
new file mode 100644
index 00000000..6cd6cfbc
--- /dev/null
+++ b/Examples/nodejs-express-server/Makefile
@@ -0,0 +1,91 @@
+# Use one of these commands to build the manifest for Node.js:
+#
+# - make
+# - make DEBUG=1
+# - make SGX=1
+# - make SGX=1 DEBUG=1
+#
+# Use `make clean` to remove Graphene-generated files.
+
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+NODEJS_DIR ?= /usr/bin/
+
+# Relative path to Graphene root and key for enclave signing
+GRAPHENEDIR ?= ../../../../..
+GRAPHENEKEY ?= $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: nodejs.manifest pal_loader
+ifeq ($(SGX),1)
+all: nodejs.token
+endif
+
+# Node.js dependencies (generated from ldd). For SGX, the manifest needs to list all the libraries
+# loaded during execution, so that the signer can include the file hashes.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc binaries are
+# already listed in the manifest template, so we can skip them from the ldd results.
+GLIBC_DEPS = linux-vdso.so.1 /lib64/ld-linux-x86-64.so.2 libc.so.6 libm.so.6 librt.so.1 \
+             libdl.so.2 libpthread.so.0 libutil.so.1 libresolv.so.2 libnss_dns.so.2
+
+# List all the Node.js dependencies, besides Glibc libraries
+.INTERMEDIATE: nodejs-deps
+nodejs-deps:
+	@ldd $(NODEJS_DIR)nodejs | \
+		awk '{if ($$2 =="=>") {print $$1}}' | \
+		sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generate manifest rules for Node.js dependencies
+.INTERMEDIATE: nodejs-trusted-libs
+nodejs-trusted-libs: nodejs-deps
+	@for F in `cat nodejs-deps`; do \
+		P=`ldd $(NODEJS_DIR)nodejs | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '.' | tr --delete '-' | tr --delete '+'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+nodejs.manifest: nodejs.manifest.template nodejs-trusted-libs
+	@sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(NODEJS_DIR)|'"$(NODEJS_DIR)"'|g' \
+		-e 's|$$(NODEJS_TRUSTED_LIBS)|'"`cat nodejs-trusted-libs`"'|g' \
+		$< > $@
+
+# Generate SGX-specific manifest, enclave signature, and token for enclave initialization
+nodejs.manifest.sgx: nodejs.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEKEY) \
+		-manifest $< -output $@
+
+nodejs.sig: nodejs.manifest.sgx
+
+nodejs.token: nodejs.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $@ -sig $^
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: check
+check: all
+	./pal_loader nodejs.manifest helloworld.js 3000 & SERVER_ID=$$!; \
+	sleep 30; \
+	curl localhost:3000 > OUTPUT; \
+	kill -9 $$SERVER_ID;
+	@grep -q "Hello World!" OUTPUT && echo "[ Success 1/1 ]"
+	@rm OUTPUT
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/nodejs-express-server/README.md b/Examples/nodejs-express-server/README.md
new file mode 100644
index 00000000..fe5feb66
--- /dev/null
+++ b/Examples/nodejs-express-server/README.md
@@ -0,0 +1,29 @@
+# Running Node.js express server with Graphene SGX
+
+This is a Node.js application, runs an express server, listening on a given port.
+
+## Environment
+
+This application was tested with Node.js version 8.
+
+## Requirements
+
+This project requires Node.js to be installed.
+See https://nodejs.org/ for more details on how to install Node.js.
+
+## Steps to run with SGX
+
+1. Run `npm install`, which installs all dependencies and modules needed for this application.
+See `package.json` for more details on Node.js dependencies needed for this project.
+At this point, the application itself can be executed without SGX by running `node helloworld.js`.
+2. Run `make SGX=1` in order to build the application using SGX.
+3. Once the application is built, and manifest files are generated, execute application by running:
+ `./pal_loader SGX nodejs.manifest.sgx helloworld.js 3000`
+4. The expected output should be the following: `Example app listening on port 3000!`
+
+## Steps to run without SGX
+
+1. Run `npm install`, which installs all dependencies and modules needed for this application.
+See `package.json` for more details on Node.js dependencies needed for this project.
+2. Run `node helloworld.js 3000`.
+3. The expected output should be the following: `Example app listening on port 3000!`
diff --git a/Examples/nodejs-express-server/helloworld.js b/Examples/nodejs-express-server/helloworld.js
new file mode 100644
index 00000000..d3212c8c
--- /dev/null
+++ b/Examples/nodejs-express-server/helloworld.js
@@ -0,0 +1,19 @@
+const express = require('express')
+const app = express()
+const args = process.argv;
+
+if (args == null || args.length != 3) {
+  console.log('Error: The only argument required is the port number.')
+  return;
+}
+
+const port = process.argv[2];
+
+if (isNaN(port)) {
+  console.log('Error: Port argument is not a number.')
+  return;
+}
+
+app.get('/', (req, res) => res.send('Hello World!'))
+
+app.listen(port, () => console.log(`Example app listening on port ${port}!`))
diff --git a/Examples/nodejs-express-server/nodejs.manifest.template b/Examples/nodejs-express-server/nodejs.manifest.template
new file mode 100644
index 00000000..a3ed89be
--- /dev/null
+++ b/Examples/nodejs-express-server/nodejs.manifest.template
@@ -0,0 +1,57 @@
+# Nodejs manifest file example
+#
+# This manifest was prepared and tested on Ubuntu 18.04.
+
+# Executable to load into Graphene and run.
+loader.exec = file:$(NODEJS_DIR)nodejs
+loader.execname = file:nodejs
+
+# LibOS layer library of Graphene. There is currently only one implementation,
+# so it is always set to libsysdb.so.
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively).
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
+# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
+# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to required libraries (in 'uri') into in-Graphene
+# visible directory /lib (in 'path').
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.lib3.type = chroot
+fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu
+fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu
+
+# Set enclave size to 2GB. Recall that SGX v1 requires to specify enclave size at
+# enclave creation time.
+sgx.enclave_size = 2G
+
+# Set maximum number of in-enclave threads to 8. Recall that SGX v1 requires to
+# specify the maximum number of simultaneous threads at enclave creation time.
+sgx.thread_num = 8
+
+# Specify all libraries used by Node.js and its dependencies (including all libs
+# which can be loaded at runtime via dlopen).
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+$(NODEJS_TRUSTED_LIBS)
+
+# JavaScript (trusted)
+sgx.trusted_files.javascript = file:helloworld.js
+sgx.allowed_files.modules = file:node_modules
+
diff --git a/Examples/nodejs-express-server/package.json b/Examples/nodejs-express-server/package.json
new file mode 100644
index 00000000..ca586222
--- /dev/null
+++ b/Examples/nodejs-express-server/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "nodejs-express-server",
+  "version": "1.0.0",
+  "description": "Node.js express server hello world sample app.",
+  "main": "helloworld.js",
+  "dependencies": {
+    "express": "^4.17.1"
+  },
+  "author": "Eduardo Rodriguez",
+  "email": "erodrig@us.ibm.com",
+  "license": "ISC"
+}
diff --git a/Examples/nodejs/Makefile b/Examples/nodejs/Makefile
new file mode 100644
index 00000000..a937aebd
--- /dev/null
+++ b/Examples/nodejs/Makefile
@@ -0,0 +1,88 @@
+# Use one of these commands to build the manifest for Node.js:
+#
+# - make
+# - make DEBUG=1
+# - make SGX=1
+# - make SGX=1 DEBUG=1
+#
+# Use `make clean` to remove Graphene-generated files.
+
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+NODEJS_DIR ?= /usr/bin/
+
+# Relative path to Graphene root and key for enclave signing
+GRAPHENEDIR ?= ../../../../..
+GRAPHENEKEY ?= $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: nodejs.manifest pal_loader
+ifeq ($(SGX),1)
+all: nodejs.token
+endif
+
+# Node.js dependencies (generated from ldd). For SGX, the manifest needs to list all the libraries
+# loaded during execution, so that the signer can include the file hashes.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc binaries are
+# already listed in the manifest template, so we can skip them from the ldd results.
+GLIBC_DEPS = linux-vdso.so.1 /lib64/ld-linux-x86-64.so.2 libc.so.6 libm.so.6 librt.so.1 \
+             libdl.so.2 libpthread.so.0 libutil.so.1 libresolv.so.2 libnss_dns.so.2
+
+# List all the Node.js dependencies, besides Glibc libraries
+.INTERMEDIATE: nodejs-deps
+nodejs-deps:
+	@ldd $(NODEJS_DIR)nodejs | \
+		awk '{if ($$2 =="=>") {print $$1}}' | \
+		sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generate manifest rules for Node.js dependencies
+.INTERMEDIATE: nodejs-trusted-libs
+nodejs-trusted-libs: nodejs-deps
+	@for F in `cat nodejs-deps`; do \
+		P=`ldd $(NODEJS_DIR)nodejs | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '.' | tr --delete '-' | tr --delete '+'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+nodejs.manifest: nodejs.manifest.template nodejs-trusted-libs
+	@sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(NODEJS_DIR)|'"$(NODEJS_DIR)"'|g' \
+		-e 's|$$(NODEJS_TRUSTED_LIBS)|'"`cat nodejs-trusted-libs`"'|g' \
+		$< > $@
+
+# Generate SGX-specific manifest, enclave signature, and token for enclave initialization
+nodejs.manifest.sgx: nodejs.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEKEY) \
+		-manifest $< -output $@
+
+nodejs.sig: nodejs.manifest.sgx
+
+nodejs.token: nodejs.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output $@ -sig $^
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: check
+check: all
+	./pal_loader nodejs.manifest helloworld.js > OUTPUT
+	@grep -q "Hello World" OUTPUT && echo "[ Success 1/1 ]"
+	@rm OUTPUT
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/nodejs/README.md b/Examples/nodejs/README.md
new file mode 100644
index 00000000..e17ff099
--- /dev/null
+++ b/Examples/nodejs/README.md
@@ -0,0 +1,12 @@
+# Node.js
+
+This directory contains a Makefile and template manifest to run Node.js on Graphene. We tested it
+with Node.js 8.10.0 on Ubuntu 18.04. This example uses Node.js installed on the system instead of
+compiling from source as some of the other examples do.
+
+The Makefile and the template manifest contain comments to hopefully make them easier to understand.
+
+# Quick Start
+
+To run the regression test execute ```make check```. To do the same for SGX, execute ```make SGX=1
+check```.
diff --git a/Examples/nodejs/helloworld.js b/Examples/nodejs/helloworld.js
new file mode 100644
index 00000000..accefceb
--- /dev/null
+++ b/Examples/nodejs/helloworld.js
@@ -0,0 +1 @@
+console.log("Hello World");
diff --git a/Examples/nodejs/nodejs.manifest.template b/Examples/nodejs/nodejs.manifest.template
new file mode 100644
index 00000000..92f9fcb9
--- /dev/null
+++ b/Examples/nodejs/nodejs.manifest.template
@@ -0,0 +1,57 @@
+# Nodejs manifest file example
+#
+# This manifest was prepared and tested on Ubuntu 18.04.
+
+# Executable to load into Graphene and run.
+loader.exec = file:$(NODEJS_DIR)nodejs
+loader.execname = file:nodejs
+
+# LibOS layer library of Graphene. There is currently only one implementation,
+# so it is always set to libsysdb.so.
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively).
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
+# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
+# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to required libraries (in 'uri') into in-Graphene
+# visible directory /lib (in 'path').
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.lib3.type = chroot
+fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu
+fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu
+
+# Set enclave size to 2GB; NodeJS expects around 1.7GB of heap on startup,
+# see e.g. https://github.com/nodejs/node/issues/13018.
+# Recall that SGX v1 requires to specify enclave size at enclave creation time.
+sgx.enclave_size = 2G
+
+# Set maximum number of in-enclave threads (somewhat arbitrarily) to 8. Recall
+# that SGX v1 requires to specify the maximum number of simultaneous threads at
+# enclave creation time.
+sgx.thread_num = 8
+
+# Specify all libraries used by Node.js and its dependencies (including all libs
+# which can be loaded at runtime via dlopen).
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+$(NODEJS_TRUSTED_LIBS)
+
+# JavaScript (trusted)
+sgx.trusted_files.javascript = file:helloworld.js
diff --git a/Examples/openvino/.gitignore b/Examples/openvino/.gitignore
new file mode 100644
index 00000000..c1f0bab1
--- /dev/null
+++ b/Examples/openvino/.gitignore
@@ -0,0 +1,3 @@
+*.bmp
+/openvino/
+/model/
diff --git a/Examples/openvino/Makefile b/Examples/openvino/Makefile
new file mode 100644
index 00000000..2a6f6a85
--- /dev/null
+++ b/Examples/openvino/Makefile
@@ -0,0 +1,98 @@
+# Building the manifest for OpenVINO:
+#
+# - make                Build for Linux, OpenVINO with Release build
+# - make DEBUG=1        Build for Linux, OpenVINO with Debug build, Graphene with debug output
+# - make SGX=1          Build for SGX, OpenVINO with Release build
+# - make SGX=1 DEBUG=1  Build for SGX, OpenVINO with Debug build, Graphene with debug output
+#
+# Use `make clean` to remove Graphene-generated files.
+#
+# Use `make distclean` to further remove the OpenVINO source and installation.
+
+THIS_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+MODEL_DIR ?= $(THIS_DIR)model
+MODEL_COMMIT ?= acf297c73db8cb3f68791ae1fad4a7cc4a6039e5     # corresponds to tag "2019_R3"
+MODEL_NAME ?= VGG_VOC0712Plus_SSD_300x300_ft_iter_160000
+
+OPENVINO_DIR ?= $(THIS_DIR)openvino
+OPENVINO_COMMIT ?= ba6e22b1b5ee4cbefcc30e8d9493cddb0bb3dfdf  # corresponds to tag "2019_R2"
+
+# Relative path to Graphene root and key for enclave signing
+GRAPHENE_DIR ?= ../../../../..
+GRAPHENE_KEY ?= $(GRAPHENE_DIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
+
+ifeq ($(DEBUG),1)
+GRAPHENE_DEBUG = inline
+OPENVINO_BUILD = Debug
+LIBTBB_DEBUG   = "sgx.trusted_files.libtbb_debug = file:$(OPENVINO_DIR)/inference-engine/temp/tbb/lib/libtbb_debug.so.2"
+else
+GRAPHENE_DEBUG = none
+OPENVINO_BUILD = Release
+LIBTBB_DEBUG   = ""
+endif
+
+.PHONY: all
+all: $(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/object_detection_sample_ssd $(MODEL_DIR)/$(MODEL_NAME).bin openvino.manifest pal_loader
+ifeq ($(SGX),1)
+all: openvino.manifest.sgx openvino.sig openvino.token
+endif
+
+$(MODEL_DIR)/README.md:
+	git clone https://github.com/opencv/open_model_zoo.git $(MODEL_DIR)
+	cd $(MODEL_DIR) && git checkout $(MODEL_COMMIT)
+
+$(MODEL_DIR)/$(MODEL_NAME).bin: $(MODEL_DIR)/README.md
+	cd $(MODEL_DIR)/tools/downloader && python3 ./downloader.py \
+		--name ssd300 -o $(abspath $(MODEL_DIR))
+	cd $(OPENVINO_DIR)/model-optimizer && python3 ./mo.py \
+		--input_model $(abspath $(MODEL_DIR))/public/ssd300/models/VGGNet/VOC0712Plus/SSD_300x300_ft/$(MODEL_NAME).caffemodel \
+		--input_proto $(abspath $(MODEL_DIR))/public/ssd300/models/VGGNet/VOC0712Plus/SSD_300x300_ft/deploy.prototxt \
+		--output_dir $(abspath $(MODEL_DIR))
+
+$(OPENVINO_DIR)/README.md:
+	git clone https://github.com/opencv/dldt.git $(OPENVINO_DIR)
+	cd $(OPENVINO_DIR) && git checkout $(OPENVINO_COMMIT)
+	cd $(OPENVINO_DIR)/inference-engine && git submodule init
+	cd $(OPENVINO_DIR)/inference-engine && git submodule update --recursive
+
+$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/object_detection_sample_ssd: $(OPENVINO_DIR)/README.md
+	cd $(OPENVINO_DIR)/inference-engine && mkdir -p build
+	cd $(OPENVINO_DIR)/inference-engine/build && cmake -DCMAKE_BUILD_TYPE=$(OPENVINO_BUILD) ..
+	$(MAKE) -C $(OPENVINO_DIR)/inference-engine/build
+
+openvino.manifest: openvino.manifest.template
+	sed -e 's|$$(GRAPHENE_DIR)|'"$(GRAPHENE_DIR)"'|g' \
+		-e 's|$$(GRAPHENE_DEBUG)|'"$(GRAPHENE_DEBUG)"'|g' \
+		-e 's|$$(OPENVINO_DIR)|'"$(OPENVINO_DIR)"'|g' \
+		-e 's|$$(OPENVINO_DIR_ABSPATH)|'"$(abspath $(OPENVINO_DIR))"'|g' \
+		-e 's|$$(MODEL_DIR)|'"$(MODEL_DIR)"'|g' \
+		-e 's|$$(OPENVINO_BUILD)|'"$(OPENVINO_BUILD)"'|g' \
+		-e 's|$$(LIBTBB_DEBUG)|'$(LIBTBB_DEBUG)'|g' \
+		$< > $@
+
+# Generating the SGX-specific manifest (openvino.manifest.sgx), the enclave signature,
+# and the token for enclave initialization.
+openvino.manifest.sgx: openvino.manifest
+	$(GRAPHENE_DIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENE_DIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENE_KEY) \
+		-manifest $< -output $@
+
+openvino.sig: openvino.manifest.sgx
+
+openvino.token: openvino.sig
+	$(GRAPHENE_DIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-sig $< -output $@
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENE_DIR)/Runtime/pal_loader $@
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader *.bmp
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(OPENVINO_DIR) $(MODEL_DIR)
diff --git a/Examples/openvino/README.md b/Examples/openvino/README.md
new file mode 100644
index 00000000..f9f67d96
--- /dev/null
+++ b/Examples/openvino/README.md
@@ -0,0 +1,52 @@
+# OpenVINO
+
+This directory contains a Makefile and a template manifest for the most
+recent version of OpenVINO toolkit (as of this writing, version 2019_R2).
+We use the "Object Detection C++ Sample SSD" (object_detection_sample_ssd)
+example from the OpenVINO distribution as a concrete application running
+under Graphene-SGX. We test only the CPU backend (i.e., no GPU or FPGA). This
+was tested on a machine with SGX v1 and Ubuntu 16.04.
+
+The Makefile and the template manifest contain extensive comments. Please review
+them to understand the requirements for OpenVINO/object_detection_sample_ssd
+running under Graphene-SGX.
+
+We build OpenVINO from the source code instead of using an existing installation.
+**Note:** the build process requires ~1.1GB of disk space and takes ~20 minutes.
+
+We also download the Open Model Zoo repository and use the SSD300 pre-trained
+model from it. **Note:** the model zoo requires ~350MB of disk space.
+
+# Prerequisites
+
+For Ubuntu 16.04, install the following prerequisite packages:
+
+* Install CMake version >= 3.7.2 (on Ubuntu 16.04, this may require installing
+  Cmake from a non-official APT repository like Kitware).
+
+* Install libusb version >= 1.0.0.
+
+* Install packages for Python3:
+  `pip3 install pyyaml numpy networkx test-generator defusedxml protobuf>=3.6.1`
+
+# Quick Start
+
+```sh
+# build OpenVINO together with object_detection_sample_ssd and the final manifest;
+# note that it also downloads the SSD300 model and transforms it from the Caffe
+# format to an optimized Intermediate Representation (IR)
+make SGX=1
+
+# run original OpenVINO/object_detection_sample_ssd
+# note that this assumes the Release build of OpenVINO (no DEBUG=1)
+./openvino/inference-engine/bin/intel64/Release/object_detection_sample_ssd -i images/horses.jpg -m model/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml -d CPU
+
+# run OpenVINO/object_detection_sample_ssd in non-SGX Graphene
+./pal_loader openvino.manifest -i images/horses.jpg -m model/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml -d CPU
+
+# run OpenVINO/object_detection_sample_ssd in Graphene-SGX
+SGX=1 ./pal_loader openvino.manifest.sgx -i images/horses.jpg -m model/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml -d CPU
+
+# Each of these commands produces an image out_0.bmp with detected objects
+xxd out_0.bmp   # or open in any image editor
+```
diff --git a/Examples/openvino/images/horses.jpg b/Examples/openvino/images/horses.jpg
new file mode 100644
index 00000000..ad1e3e21
Binary files /dev/null and b/Examples/openvino/images/horses.jpg differ
diff --git a/Examples/openvino/openvino.manifest.template b/Examples/openvino/openvino.manifest.template
new file mode 100644
index 00000000..13b909a5
--- /dev/null
+++ b/Examples/openvino/openvino.manifest.template
@@ -0,0 +1,124 @@
+# OpenVINO (object_detection_sample_ssd) manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# OpenVINO must be run with the pal_loader:
+#
+# ./pal_loader openvino.manifest -i input/image.bmp -m model.xml -d CPU
+
+# The executable to load in Graphene.
+loader.exec = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/object_detection_sample_ssd
+loader.execname = object_detection_sample_ssd
+
+# Graphene environment, including the path to the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENE_DIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENE_DEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENE_DIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENE_DIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by OpenVINO.
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# More host-level libraries (/usr/lib/x86_64-linux-gnu) required by OpenVINO.
+fs.mount.lib3.type = chroot
+fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu
+fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu
+
+# Host-level directory to NSS files required by Glibc + NSS libs.
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# Mount the current working directory
+fs.mount.cwd.type = chroot
+fs.mount.cwd.path = $(OPENVINO_DIR_ABSPATH)
+fs.mount.cwd.uri = file:$(OPENVINO_DIR)
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If OpenVINO needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 2G
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+#
+# We (somewhat arbitrarily) specify 16 threads since OpenVINO is multithreaded.
+sgx.thread_num = 16
+
+# Allow Graphene-SGX to create files (needed for output image out_0.bmp)
+sgx.allow_file_creation  = 1
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENE_DIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENE_DIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENE_DIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENE_DIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENE_DIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENE_DIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENE_DIR)/Runtime/libpthread.so.0
+
+# Name Service Switch (NSS) libraries (Glibc dependencies)
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+
+# libNSL is a dependency of libnss_compat above
+sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+# OpenVINO C++ dependencies
+sgx.trusted_files.libcpp = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6
+sgx.trusted_files.libgcc = file:/lib/x86_64-linux-gnu/libgcc_s.so.1
+
+# OpenVINO main libraries
+sgx.trusted_files.libformatreader    = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libformat_reader.so
+sgx.trusted_files.libcpuextension    = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libcpu_extension.so
+sgx.trusted_files.libinferencenegine = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libinference_engine.so
+sgx.trusted_files.libmkldnnplugin    = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libMKLDNNPlugin.so
+sgx.trusted_files.libgnapplugin      = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libGNAPlugin.so
+sgx.trusted_files.libcldnnpplugin    = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libclDNNPlugin.so
+sgx.trusted_files.libmyriadplugin    = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libmyriadPlugin.so
+
+# OpenVINO OpenCV libraries
+sgx.trusted_files.libimgcodecs  = file:$(OPENVINO_DIR)/inference-engine/temp/opencv_4.1.1_ubuntu16/lib/libopencv_imgcodecs.so.4.1
+sgx.trusted_files.libimgproc    = file:$(OPENVINO_DIR)/inference-engine/temp/opencv_4.1.1_ubuntu16/lib/libopencv_imgproc.so.4.1
+sgx.trusted_files.libopencvcore = file:$(OPENVINO_DIR)/inference-engine/temp/opencv_4.1.1_ubuntu16/lib/libopencv_core.so.4.1
+
+# OpenVINO TBB libraries
+sgx.trusted_files.libtbbmalloc = file:$(OPENVINO_DIR)/inference-engine/temp/tbb/lib/libtbbmalloc.so.2
+sgx.trusted_files.libtbb       = file:$(OPENVINO_DIR)/inference-engine/temp/tbb/lib/libtbb.so.2
+$(LIBTBB_DEBUG)
+
+# OpenVINO SSD300 model
+sgx.trusted_files.pluginsxml = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/plugins.xml
+sgx.trusted_files.modelxml   = file:$(MODEL_DIR)/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.xml
+sgx.trusted_files.modelbin   = file:$(MODEL_DIR)/VGG_VOC0712Plus_SSD_300x300_ft_iter_160000.bin
+
+# OpenVINO images (allowed instead of trusted for simplicity)
+sgx.allowed_files.imagesdir   = file:images
+
+# Name Service Switch (NSS) files (Glibc reads these files)
+sgx.allowed_files.nsswitch = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers = file:/etc/ethers
+sgx.allowed_files.hosts = file:/etc/hosts
+sgx.allowed_files.group = file:/etc/group
+sgx.allowed_files.passwd = file:/etc/passwd
diff --git a/Examples/python-scipy-insecure/.gitignore b/Examples/python-scipy-insecure/.gitignore
new file mode 100644
index 00000000..0d20b648
--- /dev/null
+++ b/Examples/python-scipy-insecure/.gitignore
@@ -0,0 +1 @@
+*.pyc
diff --git a/Examples/python-scipy-insecure/Makefile b/Examples/python-scipy-insecure/Makefile
new file mode 100644
index 00000000..c1c52f1e
--- /dev/null
+++ b/Examples/python-scipy-insecure/Makefile
@@ -0,0 +1,130 @@
+# Use one of the following commands to build the manifest for Python3:
+#
+# - make                Building for Linux
+# - make DEBUG=1        Building for Linux (with Graphene debug output)
+# - make SGX=1          Building for SGX
+# - make SGX=1 DEBUG=1  Building for SGX (with Graphene debug output)
+#
+# Use `make clean` to remove Graphene-generated files.
+
+# Constants
+
+# By default, Graphene runs the system Python 3.5 executable.
+PYTHONVERSION ?= python3.5
+PYTHONPATH ?= /usr
+
+PYTHONHOME = $(PYTHONPATH)/lib/$(PYTHONVERSION)
+PYTHONEXEC = $(PYTHONPATH)/bin/$(PYTHONVERSION)
+PYTHONDISTHOME = $(PYTHONPATH)/lib/python3/dist-packages
+PYTHONSHORTVERSION = $(subst python,,$(subst .,,$(PYTHONVERSION)))
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= ../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: python.manifest pal_loader
+ifeq ($(SGX),1)
+all: python.manifest.sgx python.token python.sig
+endif
+
+# Python dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results.
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libutil libpthread
+
+# Define the python libraries which are dynamically loaded.
+PY_LIBS = $(PYTHONHOME)/lib-dynload/_hashlib.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_ctypes.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_ssl.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONDISTHOME)/numpy/linalg/lapack_lite.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONDISTHOME)/numpy/core/multiarray.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONDISTHOME)/scipy/sparse/_sparsetools.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so
+
+PY_LIBS_TRUSTED_LIBS = "sgx.trusted_files.hashlib = file:$(PYTHONHOME)/lib-dynload/_hashlib.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.ctypes = file:$(PYTHONHOME)/lib-dynload/_ctypes.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.ssl = file:$(PYTHONHOME)/lib-dynload/_ssl.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.lapack_lite = file:$(PYTHONDISTHOME)/numpy/linalg/lapack_lite.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.multiarray = file:$(PYTHONDISTHOME)/numpy/core/multiarray.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.sparsetools = file:$(PYTHONDISTHOME)/scipy/sparse/_sparsetools.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n"
+
+# Listing all the Python dependencies, besides Glibc libraries
+.INTERMEDIATE: python-ldd
+python-ldd:
+	@for F in $(PY_LIBS); do ldd $$F >> $@ || exit 1; done
+
+.INTERMEDIATE: python-deps
+python-deps: python-ldd
+	@cat $< | awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' \
+		| sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generating manifest rules for Python dependencies
+.INTERMEDIATE: python-trusted-libs
+python-trusted-libs: python-deps
+	@PY_LIBS="$(PY_LIBS)" && \
+	for F in `cat python-deps`; do \
+		P=`ldd $$PY_LIBS | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '+-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+	echo -n "$(PY_LIBS_TRUSTED_LIBS)" >> $@
+
+python.manifest: python.manifest.template python-trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(PYTHONDISTHOME)|'"$(PYTHONDISTHOME)"'|g' \
+		-e 's|$$(PYTHONHOME)|'"$(PYTHONHOME)"'|g' \
+		-e 's|$$(PYTHONEXEC)|'"$(PYTHONEXEC)"'|g' \
+		-e 's|$$(PYTHON_TRUSTED_LIBS)|'"`cat python-trusted-libs`"'|g' \
+		$< > $@
+
+# Python manifests for SGX:
+#   Generating the SGX-specific manifest (python.manifest.sgx), the enclave signature,
+#   and the token for enclave initialization.
+
+python.manifest.sgx: python.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+python.sig: python.manifest.sgx
+
+python.token: python.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token -output $@ -sig $<
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: check
+check: all
+	./pal_loader python.manifest scripts/test-numpy.py > OUTPUT 2> /dev/null
+	@sleep 1  # to make sure Bash child processes flush output under Graphene-SGX
+	@grep -q "dot: " OUTPUT && echo "[ Success 1/2 ]"
+	@rm OUTPUT
+
+	./pal_loader python.manifest scripts/test-scipy.py > OUTPUT 2> /dev/null
+	@sleep 1
+	@grep -q "cholesky: " OUTPUT && echo "[ Success 2/2 ]"
+	@rm OUTPUT
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT*
+	$(RM) -r scripts/__pycache__
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/python-scipy-insecure/README.md b/Examples/python-scipy-insecure/README.md
new file mode 100644
index 00000000..251d55da
--- /dev/null
+++ b/Examples/python-scipy-insecure/README.md
@@ -0,0 +1,57 @@
+# Python example
+
+This directory contains an example for running Python 3 with SciPy/NumPy in Graphene,
+including the Makefile and a template for generating the manifest. The application is
+tested on Ubuntu 16.04, with both normal Linux and SGX platforms.
+
+This example is *insecure*: the manifest file uses `sgx.allowed_files` to allow all
+Python libraries/scripts without any integrity checks. This example simply shows
+the functionality of Graphene but *does not* prevent the attacker from silently
+modifying Python files. For secure Python usage, see the `python-simple` example.
+
+# Generating the manifest
+
+## Installing prerequisites
+
+For generating the manifest and running the test scripts, please run the following
+command to install the required Python packages (Ubuntu-specific):
+
+    sudo apt-get install libnss-mdns python3-numpy python3-scipy
+
+## Building for Linux
+
+Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
+
+## Building for SGX
+
+Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory.
+
+## Building with a local Python installation
+
+By default, the `make` command creates the manifest for the Python binary from
+the system installation. If you have a local installation, you may create the
+manifest with the `PYTHONPATH` variable set accordingly. You can also specify
+a particular version of Python. For example:
+
+```
+make PYTHONPATH=<python install path> PYTHONVERSION=python3.2 SGX=1
+```
+
+By default, `PYTHONPATH=/usr` and `PYTHONVERSION=python3.5`.
+
+
+# Run Python with Graphene
+
+Here's an example of running Python scripts under Graphene:
+
+Without SGX:
+```
+./pal_loader python.manifest scripts/test-numpy.py
+./pal_loader python.manifest scripts/test-scipy.py
+```
+
+With SGX:
+```
+SGX=1 ./pal_loader python.manifest scripts/test-numpy.py
+SGX=1 ./pal_loader python.manifest scripts/test-scipy.py
+```
diff --git a/Examples/python-scipy-insecure/python.manifest.template b/Examples/python-scipy-insecure/python.manifest.template
new file mode 100644
index 00000000..d93e4f66
--- /dev/null
+++ b/Examples/python-scipy-insecure/python.manifest.template
@@ -0,0 +1,107 @@
+# Python3 manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# Python must be run with the pal_loader:
+#
+# ./pal_loader python.manifest <script>
+
+# The executable to load in Graphene. By default, PYTHONHOME points to the
+# system installation. To run Python from a local installation, specify PYTHONHOME
+# when running `make` in this directory.
+loader.exec = file:$(PYTHONEXEC)
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables for Python
+loader.env.LD_LIBRARY_PATH = $(PYTHONHOME)/lib:/lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = $(PYTHONHOME)/bin:/usr/bin:/bin
+loader.env.PYTHONHOME = $(PYTHONHOME)
+loader.env.PYTHONPATH = $(PYTHONHOME):$(PYTHONHOME)/plat-x86_64-linux-gnu:$(PYTHONDISTHOME):$(PYTHONHOME)/lib-dynload
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by the Python executable
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Host-level directory (/usr) required by the Python executable
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+# Mount $PYTHONHOME
+fs.mount.pyhome.type = chroot
+fs.mount.pyhome.path = $(PYTHONHOME)
+fs.mount.pyhome.uri = file:$(PYTHONHOME)
+
+# Mount $PYTHONDISTHOME
+fs.mount.pydisthome.type = chroot
+fs.mount.pydisthome.path = $(PYTHONDISTHOME)
+fs.mount.pydisthome.uri = file:$(PYTHONDISTHOME)
+
+# Mount /tmp
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+# Mount /etc
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# Graphene general options
+
+# Graphene creates stacks of 256KB by default. It is not enough for SciPy/NumPy
+# packages, e.g., libopenblas dependency assumes more than 512KB-sized stacks.
+sys.stack.size = 2M
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If Python needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 1G
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 32
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Other libraries
+sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1
+sgx.trusted_files.libbz2 = file:/lib/x86_64-linux-gnu/libbz2.so.1.0
+sgx.trusted_files.liblzma = file:/lib/x86_64-linux-gnu/liblzma.so.5
+sgx.trusted_files.libexpat = file:/lib/x86_64-linux-gnu/libexpat.so.1
+$(PYTHON_TRUSTED_LIBS)
+
+# SGX untrusted (allowed) files/directories
+sgx.allowed_files.scripts = file:scripts
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.etc = file:/etc
+sgx.allowed_files.pyhome = file:$(PYTHONHOME)
+sgx.allowed_files.pydisthome = file:$(PYTHONDISTHOME)
diff --git a/Examples/python-scipy-insecure/scripts/test-numpy.py b/Examples/python-scipy-insecure/scripts/test-numpy.py
new file mode 100644
index 00000000..d0c9ac72
--- /dev/null
+++ b/Examples/python-scipy-insecure/scripts/test-numpy.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+
+import numpy
+import sys
+import timeit
+
+try:
+    import numpy.core._dotblas
+except ImportError:
+    pass
+
+print("numpy version: " + numpy.__version__)
+
+x = numpy.random.random((1000,1000))
+
+setup = "import numpy; x = numpy.random.random((1000,1000))"
+count = 5
+
+t = timeit.Timer("numpy.dot(x, x.T)", setup=setup)
+print("numpy.dot: " + str(t.timeit(count)/count) + " sec")
diff --git a/Examples/python-scipy-insecure/scripts/test-scipy.py b/Examples/python-scipy-insecure/scripts/test-scipy.py
new file mode 100644
index 00000000..e397e3a3
--- /dev/null
+++ b/Examples/python-scipy-insecure/scripts/test-scipy.py
@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+
+import timeit
+
+setup = "import numpy;\
+        import scipy.linalg as linalg;\
+        x = numpy.random.random((1000,1000));\
+        z = numpy.dot(x, x.T)"
+count = 5
+
+t = timeit.Timer("linalg.cholesky(z, lower=True)", setup=setup)
+print("linalg.cholesky: " + str(t.timeit(count)/count) + "sec")
+
+t = timeit.Timer("linalg.svd(z)", setup=setup)
+print("linalg.svd: " + str(t.timeit(count)/count) + "sec")
diff --git a/Examples/python-simple/.gitignore b/Examples/python-simple/.gitignore
new file mode 100644
index 00000000..0d20b648
--- /dev/null
+++ b/Examples/python-simple/.gitignore
@@ -0,0 +1 @@
+*.pyc
diff --git a/Examples/python-simple/Makefile b/Examples/python-simple/Makefile
new file mode 100644
index 00000000..78c64bbf
--- /dev/null
+++ b/Examples/python-simple/Makefile
@@ -0,0 +1,140 @@
+# Use one of the following commands to build the manifest for Python3:
+#
+# - make                Building for Linux
+# - make DEBUG=1        Building for Linux (with Graphene debug output)
+# - make SGX=1          Building for SGX
+# - make SGX=1 DEBUG=1  Building for SGX (with Graphene debug output)
+#
+# Use `make clean` to remove Graphene-generated files.
+
+# Constants
+
+# By default, Graphene runs the system Python 3.5 executable.
+PYTHONVERSION ?= python3.5
+PYTHONPATH ?= /usr
+
+PYTHONHOME := $(PYTHONPATH)/lib/$(PYTHONVERSION)
+PYTHONEXEC := $(PYTHONPATH)/bin/$(PYTHONVERSION)
+PYTHONDISTHOME := $(PYTHONPATH)/lib/python3/dist-packages
+PYTHONSHORTVERSION := $(subst python,,$(subst .,,$(PYTHONVERSION)))
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= ../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: python.manifest pal_loader
+ifeq ($(SGX),1)
+all: python.manifest.sgx python.token python.sig
+endif
+
+# Python dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results.
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results.
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libutil libpthread
+
+# Define the python libraries which are dynamically loaded.
+PY_LIBS = $(PYTHONHOME)/lib-dynload/_hashlib.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_ctypes.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_ssl.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_bz2.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_lzma.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONHOME)/lib-dynload/_json.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so \
+	  $(PYTHONDISTHOME)/apt_pkg.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so
+
+PY_LIBS_TRUSTED_LIBS = "sgx.trusted_files.hashlib = file:$(PYTHONHOME)/lib-dynload/_hashlib.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.ctypes = file:$(PYTHONHOME)/lib-dynload/_ctypes.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.ssl = file:$(PYTHONHOME)/lib-dynload/_ssl.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.bz2 = file:$(PYTHONHOME)/lib-dynload/_bz2.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.lzma = file:$(PYTHONHOME)/lib-dynload/_lzma.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.json = file:$(PYTHONHOME)/lib-dynload/_json.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n" \
+	  "sgx.trusted_files.aptpkg = file:$(PYTHONDISTHOME)/apt_pkg.cpython-$(PYTHONSHORTVERSION)m-x86_64-linux-gnu.so\\\\n"
+
+ifeq ($(PYTHONSHORTVERSION),35)
+PYTHON_TRUSTED_SCRIPTS = "sgx.trusted_files.python21 = file:$(PYTHONHOME)/_sysconfigdata.py\\\\n" \
+	  "sgx.trusted_files.python22 = file:$(PYTHONHOME)/plat-x86_64-linux-gnu/_sysconfigdata_m.py\\\\n"
+else
+PYTHON_TRUSTED_SCRIPTS = "sgx.trusted_files.python21 = file:$(PYTHONHOME)/_sysconfigdata_m_linux_x86_64-linux-gnu.py\\\\n"
+endif
+
+# Listing all the Python dependencies, besides Glibc libraries
+.INTERMEDIATE: python-ldd
+python-ldd:
+	@for F in $(PY_LIBS); do ldd $$F >> $@ || exit 1; done
+
+.INTERMEDIATE: python-deps
+python-deps: python-ldd
+	@cat $< | awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' \
+		| sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generating manifest rules for Python dependencies
+.INTERMEDIATE: python-trusted-libs
+python-trusted-libs: python-deps
+	@PY_LIBS="$(PY_LIBS)" && \
+	for F in `cat python-deps`; do \
+		P=`ldd $$PY_LIBS | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '+-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+	echo -n "$(PY_LIBS_TRUSTED_LIBS)" >> $@
+
+.INTERMEDIATE: python-trusted-scripts
+python-trusted-scripts:
+	echo -n "$(PYTHON_TRUSTED_SCRIPTS)" >> $@
+
+python.manifest: python.manifest.template python-trusted-libs python-trusted-scripts
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(PYTHONDISTHOME)|'"$(PYTHONDISTHOME)"'|g' \
+		-e 's|$$(PYTHONHOME)|'"$(PYTHONHOME)"'|g' \
+		-e 's|$$(PYTHONEXEC)|'"$(PYTHONEXEC)"'|g' \
+		-e 's|$$(PYTHON_TRUSTED_SCRIPTS)|'"`cat python-trusted-scripts`"'|g' \
+		-e 's|$$(PYTHON_TRUSTED_LIBS)|'"`cat python-trusted-libs`"'|g' \
+		$< > $@
+
+# Python manifests for SGX:
+#   Generating the SGX-specific manifest (python.manifest.sgx), the enclave signature,
+#   and the token for enclave initialization.
+
+python.manifest.sgx: python.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+python.sig: python.manifest.sgx
+
+python.token: python.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token -output $@ -sig $<
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: check
+check: all
+	./run-tests.sh > OUTPUT_TEST 2> /dev/null
+	@grep -q "Success 1/3" OUTPUT_TEST
+	@grep -q "Success 2/3" OUTPUT_TEST
+	@grep -q "Success 3/3" OUTPUT_TEST
+	@rm OUTPUT_TEST
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader OUTPUT* *.PID
+	$(RM) -r scripts/__pycache__
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/python-simple/README.md b/Examples/python-simple/README.md
new file mode 100644
index 00000000..19794a8e
--- /dev/null
+++ b/Examples/python-simple/README.md
@@ -0,0 +1,58 @@
+# Python example
+
+This directory contains an example for running Python 3 in Graphene, including
+the Makefile and a template for generating the manifest. The application is
+tested on Ubuntu 16.04 and Ubuntu 18.04, with both normal Linux and SGX
+platforms. The tested versions of Python are 3.5 and 3.6.
+
+# Generating the manifest
+
+## Installing prerequisites
+
+For generating the manifest and running the test scripts, please run the following
+command to install the required utility packages (Ubuntu-specific):
+
+    sudo apt-get install libnss-mdns
+
+## Building for Linux
+
+Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
+
+## Building for SGX
+
+Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory.
+
+## Building with a local Python installation
+
+By default, the `make` command creates the manifest for the Python binary from
+the system installation. If you have a local installation, you may create the
+manifest with the `PYTHONPATH` variable set accordingly. You can also specify
+a particular version of Python. For example:
+
+```
+make PYTHONPATH=<python install path> PYTHONVERSION=python3.6 SGX=1
+```
+
+By default, `PYTHONPATH=/usr` and `PYTHONVERSION=python3.5`.
+
+
+# Run Python with Graphene
+
+Here's an example of running Python scripts under Graphene:
+
+Without SGX:
+```
+./pal_loader python.manifest scripts/helloworld.py
+./pal_loader python.manifest scripts/fibonacci.py
+```
+
+With SGX:
+```
+SGX=1 ./pal_loader python.manifest scripts/helloworld.py
+SGX=1 ./pal_loader python.manifest scripts/fibonacci.py
+```
+
+You can also manually run included tests:
+```
+SGX=1 ./run-tests.sh
+```
diff --git a/Examples/python-simple/python.manifest.template b/Examples/python-simple/python.manifest.template
new file mode 100644
index 00000000..811dbc5b
--- /dev/null
+++ b/Examples/python-simple/python.manifest.template
@@ -0,0 +1,264 @@
+# Python3 manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04/18.04 and tested with
+# Python 3.5 and 3.6.
+#
+# Python must be run with the pal_loader:
+#
+# ./pal_loader python.manifest <script>
+
+# The executable to load in Graphene. By default, PYTHONHOME points to the
+# system installation. To run Python from a local installation, specify PYTHONHOME
+# when running `make` in this directory.
+loader.exec = file:$(PYTHONEXEC)
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables for Python
+loader.env.LD_LIBRARY_PATH = $(PYTHONHOME)/lib:/lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = $(PYTHONHOME)/bin:/usr/bin:/bin
+loader.env.PYTHONHOME = $(PYTHONHOME)
+loader.env.PYTHONPATH = $(PYTHONHOME):$(PYTHONHOME)/plat-x86_64-linux-gnu:$(PYTHONDISTHOME):$(PYTHONHOME)/lib-dynload
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by the Python executable
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Host-level directory (/usr) required by the Python executable
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+# Mount $PYTHONHOME
+fs.mount.pyhome.type = chroot
+fs.mount.pyhome.path = $(PYTHONHOME)
+fs.mount.pyhome.uri = file:$(PYTHONHOME)
+
+# Mount $PYTHONDISTHOME
+fs.mount.pydisthome.type = chroot
+fs.mount.pydisthome.path = $(PYTHONDISTHOME)
+fs.mount.pydisthome.uri = file:$(PYTHONDISTHOME)
+
+# Mount /tmp
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+# Mount /etc
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If Python needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 1G
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 8
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libnssdns = file:$(GRAPHENEDIR)/Runtime/libnss_dns.so.2
+sgx.trusted_files.libresolve = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2
+
+# Other libraries
+sgx.trusted_files.libexpat = file:/lib/x86_64-linux-gnu/libexpat.so.1
+sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssmdns4 = file:/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2
+$(PYTHON_TRUSTED_LIBS)
+
+# Python scripts required for helloworld.py/fibonacci.py
+# NOTE: we ignore precompiled .pyc files since they are for optimization purposes only
+sgx.trusted_files.python01 = file:$(PYTHONHOME)/io.py
+sgx.trusted_files.python02 = file:$(PYTHONHOME)/encodings/__init__.py
+sgx.trusted_files.python03 = file:$(PYTHONHOME)/abc.py
+sgx.trusted_files.python04 = file:$(PYTHONHOME)/codecs.py
+sgx.trusted_files.python05 = file:$(PYTHONHOME)/_weakrefset.py
+sgx.trusted_files.python06 = file:$(PYTHONHOME)/encodings/aliases.py
+sgx.trusted_files.python07 = file:$(PYTHONHOME)/encodings/ascii.py
+sgx.trusted_files.python08 = file:$(PYTHONHOME)/encodings/utf_8.py
+sgx.trusted_files.python09 = file:$(PYTHONHOME)/encodings/latin_1.py
+sgx.trusted_files.python10 = file:$(PYTHONHOME)/_bootlocale.py
+sgx.trusted_files.python11 = file:$(PYTHONHOME)/site.py
+sgx.trusted_files.python12 = file:$(PYTHONHOME)/os.py
+sgx.trusted_files.python13 = file:$(PYTHONHOME)/stat.py
+sgx.trusted_files.python14 = file:$(PYTHONHOME)/posixpath.py
+sgx.trusted_files.python15 = file:$(PYTHONHOME)/genericpath.py
+sgx.trusted_files.python16 = file:$(PYTHONHOME)/_collections_abc.py
+sgx.trusted_files.python17 = file:$(PYTHONHOME)/_sitebuiltins.py
+sgx.trusted_files.python18 = file:$(PYTHONHOME)/sysconfig.py
+sgx.trusted_files.python19 = file:$(PYTHONHOME)/sitecustomize.py
+sgx.trusted_files.python20 = file:$(PYTHONDISTHOME)/apport_python_hook.py
+$(PYTHON_TRUSTED_SCRIPTS)
+
+# Python scripts required for dummy-web-server.py
+sgx.trusted_files.pythonhttp01 = file:$(PYTHONHOME)/http/__init__.py
+sgx.trusted_files.pythonhttp02 = file:$(PYTHONHOME)/enum.py
+sgx.trusted_files.pythonhttp03 = file:$(PYTHONHOME)/collections/__init__.py
+sgx.trusted_files.pythonhttp04 = file:$(PYTHONHOME)/operator.py
+sgx.trusted_files.pythonhttp05 = file:$(PYTHONHOME)/keyword.py
+sgx.trusted_files.pythonhttp06 = file:$(PYTHONHOME)/heapq.py
+sgx.trusted_files.pythonhttp07 = file:$(PYTHONHOME)/reprlib.py
+sgx.trusted_files.pythonhttp08 = file:$(PYTHONHOME)/types.py
+sgx.trusted_files.pythonhttp09 = file:$(PYTHONHOME)/functools.py
+sgx.trusted_files.pythonhttp10 = file:$(PYTHONHOME)/weakref.py
+sgx.trusted_files.pythonhttp11 = file:$(PYTHONHOME)/collections/abc.py
+sgx.trusted_files.pythonhttp12 = file:$(PYTHONHOME)/http/server.py
+sgx.trusted_files.pythonhttp13 = file:$(PYTHONHOME)/html/__init__.py
+sgx.trusted_files.pythonhttp14 = file:$(PYTHONHOME)/re.py
+sgx.trusted_files.pythonhttp15 = file:$(PYTHONHOME)/sre_compile.py
+sgx.trusted_files.pythonhttp16 = file:$(PYTHONHOME)/sre_parse.py
+sgx.trusted_files.pythonhttp17 = file:$(PYTHONHOME)/sre_constants.py
+sgx.trusted_files.pythonhttp18 = file:$(PYTHONHOME)/copyreg.py
+sgx.trusted_files.pythonhttp19 = file:$(PYTHONHOME)/html/entities.py
+sgx.trusted_files.pythonhttp20 = file:$(PYTHONHOME)/http/client.py
+sgx.trusted_files.pythonhttp21 = file:$(PYTHONHOME)/email/__init__.py
+sgx.trusted_files.pythonhttp22 = file:$(PYTHONHOME)/email/parser.py
+sgx.trusted_files.pythonhttp23 = file:$(PYTHONHOME)/email/feedparser.py
+sgx.trusted_files.pythonhttp24 = file:$(PYTHONHOME)/email/errors.py
+sgx.trusted_files.pythonhttp25 = file:$(PYTHONHOME)/email/message.py
+sgx.trusted_files.pythonhttp26 = file:$(PYTHONHOME)/uu.py
+sgx.trusted_files.pythonhttp27 = file:$(PYTHONHOME)/quopri.py
+sgx.trusted_files.pythonhttp28 = file:$(PYTHONHOME)/warnings.py
+sgx.trusted_files.pythonhttp29 = file:$(PYTHONHOME)/email/utils.py
+sgx.trusted_files.pythonhttp30 = file:$(PYTHONHOME)/random.py
+sgx.trusted_files.pythonhttp31 = file:$(PYTHONHOME)/hashlib.py
+sgx.trusted_files.pythonhttp32 = file:$(PYTHONHOME)/socket.py
+sgx.trusted_files.pythonhttp33 = file:$(PYTHONHOME)/selectors.py
+sgx.trusted_files.pythonhttp34 = file:$(PYTHONHOME)/datetime.py
+sgx.trusted_files.pythonhttp35 = file:$(PYTHONHOME)/urllib/__init__.py
+sgx.trusted_files.pythonhttp36 = file:$(PYTHONHOME)/urllib/parse.py
+sgx.trusted_files.pythonhttp37 = file:$(PYTHONHOME)/email/_parseaddr.py
+sgx.trusted_files.pythonhttp38 = file:$(PYTHONHOME)/calendar.py
+sgx.trusted_files.pythonhttp39 = file:$(PYTHONHOME)/locale.py
+sgx.trusted_files.pythonhttp40 = file:$(PYTHONHOME)/email/charset.py
+sgx.trusted_files.pythonhttp41 = file:$(PYTHONHOME)/email/base64mime.py
+sgx.trusted_files.pythonhttp42 = file:$(PYTHONHOME)/base64.py
+sgx.trusted_files.pythonhttp43 = file:$(PYTHONHOME)/struct.py
+sgx.trusted_files.pythonhttp44 = file:$(PYTHONHOME)/email/quoprimime.py
+sgx.trusted_files.pythonhttp45 = file:$(PYTHONHOME)/string.py
+sgx.trusted_files.pythonhttp46 = file:$(PYTHONHOME)/email/encoders.py
+sgx.trusted_files.pythonhttp47 = file:$(PYTHONHOME)/email/_policybase.py
+sgx.trusted_files.pythonhttp48 = file:$(PYTHONHOME)/email/header.py
+sgx.trusted_files.pythonhttp49 = file:$(PYTHONHOME)/email/_encoded_words.py
+sgx.trusted_files.pythonhttp50 = file:$(PYTHONHOME)/email/iterators.py
+sgx.trusted_files.pythonhttp51 = file:$(PYTHONHOME)/ssl.py
+sgx.trusted_files.pythonhttp52 = file:$(PYTHONHOME)/ipaddress.py
+sgx.trusted_files.pythonhttp53 = file:$(PYTHONHOME)/textwrap.py
+sgx.trusted_files.pythonhttp54 = file:$(PYTHONHOME)/mimetypes.py
+sgx.trusted_files.pythonhttp55 = file:$(PYTHONHOME)/shutil.py
+sgx.trusted_files.pythonhttp56 = file:$(PYTHONHOME)/fnmatch.py
+sgx.trusted_files.pythonhttp57 = file:$(PYTHONHOME)/tarfile.py
+sgx.trusted_files.pythonhttp58 = file:$(PYTHONHOME)/copy.py
+sgx.trusted_files.pythonhttp59 = file:$(PYTHONHOME)/bz2.py
+sgx.trusted_files.pythonhttp60 = file:$(PYTHONHOME)/_compression.py
+sgx.trusted_files.pythonhttp61 = file:$(PYTHONHOME)/threading.py
+sgx.trusted_files.pythonhttp62 = file:$(PYTHONHOME)/traceback.py
+sgx.trusted_files.pythonhttp63 = file:$(PYTHONHOME)/linecache.py
+sgx.trusted_files.pythonhttp64 = file:$(PYTHONHOME)/tokenize.py
+sgx.trusted_files.pythonhttp65 = file:$(PYTHONHOME)/token.py
+sgx.trusted_files.pythonhttp66 = file:$(PYTHONHOME)/lzma.py
+sgx.trusted_files.pythonhttp67 = file:$(PYTHONHOME)/socketserver.py
+sgx.trusted_files.pythonhttp68 = file:$(PYTHONHOME)/argparse.py
+sgx.trusted_files.pythonhttp69 = file:$(PYTHONHOME)/gettext.py
+sgx.trusted_files.pythonhttp70 = file:$(PYTHONDISTHOME)/apport/__init__.py
+sgx.trusted_files.pythonhttp71 = file:$(PYTHONDISTHOME)/apport/report.py
+sgx.trusted_files.pythonhttp72 = file:$(PYTHONHOME)/subprocess.py
+sgx.trusted_files.pythonhttp73 = file:$(PYTHONHOME)/signal.py
+sgx.trusted_files.pythonhttp74 = file:$(PYTHONHOME)/tempfile.py
+sgx.trusted_files.pythonhttp75 = file:$(PYTHONHOME)/glob.py
+sgx.trusted_files.pythonhttp76 = file:$(PYTHONHOME)/imp.py
+sgx.trusted_files.pythonhttp77 = file:$(PYTHONHOME)/importlib/__init__.py
+sgx.trusted_files.pythonhttp78 = file:$(PYTHONHOME)/importlib/machinery.py
+sgx.trusted_files.pythonhttp79 = file:$(PYTHONHOME)/importlib/util.py
+sgx.trusted_files.pythonhttp80 = file:$(PYTHONHOME)/importlib/abc.py
+sgx.trusted_files.pythonhttp81 = file:$(PYTHONHOME)/contextlib.py
+sgx.trusted_files.pythonhttp82 = file:$(PYTHONHOME)/xml/__init__.py
+sgx.trusted_files.pythonhttp83 = file:$(PYTHONHOME)/xml/dom/__init__.py
+sgx.trusted_files.pythonhttp84 = file:$(PYTHONHOME)/xml/dom/domreg.py
+sgx.trusted_files.pythonhttp85 = file:$(PYTHONHOME)/xml/dom/minidom.py
+sgx.trusted_files.pythonhttp86 = file:$(PYTHONHOME)/xml/dom/minicompat.py
+sgx.trusted_files.pythonhttp87 = file:$(PYTHONHOME)/xml/dom/xmlbuilder.py
+sgx.trusted_files.pythonhttp88 = file:$(PYTHONHOME)/xml/dom/NodeFilter.py
+sgx.trusted_files.pythonhttp89 = file:$(PYTHONHOME)/xml/parsers/__init__.py
+sgx.trusted_files.pythonhttp90 = file:$(PYTHONHOME)/xml/parsers/expat.py
+sgx.trusted_files.pythonhttp91 = file:$(PYTHONHOME)/urllib/error.py
+sgx.trusted_files.pythonhttp92 = file:$(PYTHONHOME)/urllib/response.py
+sgx.trusted_files.pythonhttp93 = file:$(PYTHONHOME)/urllib/request.py
+sgx.trusted_files.pythonhttp94 = file:$(PYTHONHOME)/bisect.py
+sgx.trusted_files.pythonhttp95 = file:$(PYTHONDISTHOME)/problem_report.py
+sgx.trusted_files.pythonhttp96 = file:$(PYTHONHOME)/gzip.py
+sgx.trusted_files.pythonhttp97 = file:$(PYTHONHOME)/email/mime/__init__.py
+sgx.trusted_files.pythonhttp98 = file:$(PYTHONHOME)/email/mime/multipart.py
+sgx.trusted_files.pythonhttp99 = file:$(PYTHONHOME)/email/mime/base.py
+sgx.trusted_files.pythonhttp100 = file:$(PYTHONHOME)/email/mime/text.py
+sgx.trusted_files.pythonhttp101 = file:$(PYTHONHOME)/email/mime/nonmultipart.py
+sgx.trusted_files.pythonhttp102 = file:$(PYTHONDISTHOME)/apport/fileutils.py
+sgx.trusted_files.pythonhttp103 = file:$(PYTHONHOME)/configparser.py
+sgx.trusted_files.pythonhttp104 = file:$(PYTHONDISTHOME)/apport/packaging_impl.py
+sgx.trusted_files.pythonhttp105 = file:$(PYTHONHOME)/json/__init__.py
+sgx.trusted_files.pythonhttp106 = file:$(PYTHONHOME)/json/decoder.py
+sgx.trusted_files.pythonhttp107 = file:$(PYTHONHOME)/json/scanner.py
+sgx.trusted_files.pythonhttp108 = file:$(PYTHONHOME)/json/encoder.py
+sgx.trusted_files.pythonhttp109 = file:$(PYTHONDISTHOME)/apt/__init__.py
+sgx.trusted_files.pythonhttp110 = file:$(PYTHONHOME)/__future__.py
+sgx.trusted_files.pythonhttp111 = file:$(PYTHONDISTHOME)/apt/package.py
+sgx.trusted_files.pythonhttp112 = file:$(PYTHONDISTHOME)/apt/progress/__init__.py
+sgx.trusted_files.pythonhttp113 = file:$(PYTHONDISTHOME)/apt/progress/text.py
+sgx.trusted_files.pythonhttp114 = file:$(PYTHONDISTHOME)/apt/progress/base.py
+sgx.trusted_files.pythonhttp115 = file:$(PYTHONDISTHOME)/apt/cache.py
+sgx.trusted_files.pythonhttp116 = file:$(PYTHONDISTHOME)/apt/cdrom.py
+sgx.trusted_files.pythonhttp117 = file:$(PYTHONHOME)/pickle.py
+sgx.trusted_files.pythonhttp118 = file:$(PYTHONHOME)/_compat_pickle.py
+sgx.trusted_files.pythonhttp119 = file:$(PYTHONDISTHOME)/apport/packaging.py
+sgx.trusted_files.pythonhttp120 = file:$(PYTHONHOME)/encodings/idna.py
+sgx.trusted_files.pythonhttp121 = file:$(PYTHONHOME)/stringprep.py
+
+# User scripts
+sgx.trusted_files.user01 = file:scripts/benchrun.py
+sgx.trusted_files.user02 = file:scripts/dummy-web-server.py
+sgx.trusted_files.user03 = file:scripts/fibonacci.py
+sgx.trusted_files.user04 = file:scripts/helloworld.py
+sgx.trusted_files.user05 = file:scripts/test-http.py
+
+# Python-required etc files
+sgx.trusted_files.mimetypes = file:/etc/mime.types
+sgx.trusted_files.defapport = file:/etc/default/apport
+
+# Name Service Switch (NSS) and getaddrinfo(3) configuration files
+sgx.allowed_files.nsswitch  = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers    = file:/etc/ethers
+sgx.allowed_files.hosts     = file:/etc/hosts
+sgx.allowed_files.group     = file:/etc/group
+sgx.allowed_files.passwd    = file:/etc/passwd
+sgx.allowed_files.gaiconf   = file:/etc/gai.conf
+sgx.allowed_files.hostconf  = file:/etc/host.conf
+sgx.allowed_files.resolv    = file:/etc/resolv.conf
diff --git a/Examples/python-simple/run-tests.sh b/Examples/python-simple/run-tests.sh
new file mode 100755
index 00000000..5a9eceed
--- /dev/null
+++ b/Examples/python-simple/run-tests.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+set -e
+
+# === hellworld ===
+echo -e "\n\nRunning helloworld.py:"
+./pal_loader python.manifest scripts/helloworld.py > OUTPUT
+grep -q "Hello World" OUTPUT && echo "[ Success 1/3 ]"
+rm OUTPUT
+
+# === fibonacci ===
+echo -e "\n\nRunning fibonacci.py:"
+./pal_loader python.manifest scripts/fibonacci.py > OUTPUT
+grep -q "fib2              55" OUTPUT && echo "[ Success 2/3 ]"
+rm OUTPUT
+
+# === web server and client (on port 8005) ===
+echo -e "\n\nRunning HTTP server dummy-web-server.py in the background:"
+./pal_loader python.manifest scripts/dummy-web-server.py 8005 & echo $! > server.PID
+sleep 30  # Graphene-SGX takes a lot of time to initialize
+
+echo -e "\n\nRunning HTTP client test-http.py:"
+./pal_loader python.manifest scripts/test-http.py localhost 8005 > OUTPUT1
+wget -q http://localhost:8005/ -O OUTPUT2
+echo >> OUTPUT2  # include newline since wget doesn't add it
+diff -q OUTPUT1 OUTPUT2 && echo "[ Success 3/3 ]"
+kill `cat server.PID`
+rm -f OUTPUT1 OUTPUT2 server.PID
diff --git a/Examples/python-simple/scripts/benchrun.py b/Examples/python-simple/scripts/benchrun.py
new file mode 100644
index 00000000..43570022
--- /dev/null
+++ b/Examples/python-simple/scripts/benchrun.py
@@ -0,0 +1,116 @@
+"""
+Downloaded from https://code.google.com/p/benchrun/
+
+A benchmark is defined by creating a subclass of Benchmark.
+The subclass should define a method run() that executes the code
+to be timed and returns the elapsed time in seconds (as a float),
+or None if the benchmark should be skipped.
+
+See fibonacci.py for example.
+"""
+
+import sys
+if sys.platform == 'win32':
+    from time import clock
+else:
+    from time import time as clock
+
+# http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/302478
+def combinations(*seqin):
+    def rloop(seqin,comb):
+        if seqin:
+            for item in seqin[0]:
+                newcomb = comb + [item]
+                for item in rloop(seqin[1:],newcomb):   
+                    yield item
+        else:
+            yield comb
+    return rloop(seqin,[])
+
+
+class Benchmark:
+    sort_by = []
+    reference = None
+
+    def __init__(self):
+        self.pnames = []
+        self.pvalues = []
+        self.results = []
+        self.results_dict = {}
+        for pname in self.parameters:
+            value = getattr(self, pname)
+            self.pnames.append(pname)
+            self.pvalues.append(value)
+        self.pcombos = list(combinations(*self.pvalues))
+        if self.reference:
+            self.reference_param = self.reference[0]
+            self.reference_value = self.reference[1]
+
+    def time_all(self):
+        """Run benchmark for all versions and parameters."""
+        for params in self.pcombos:
+            args = dict(zip(self.pnames, params))
+            t = self.run(**args)
+            self.results.append(tuple(params) + (t,))
+            self.results_dict[tuple(params)] = t
+
+    def sort_results(self):
+        sort_keys = []
+        for name in self.sort_by:
+            sort_keys += [self.pnames.index(name)]
+        for i, name in enumerate(self.pnames):
+            if i not in sort_keys:
+                sort_keys += [i]
+        def key(v):
+            return list(v[i] for i in sort_keys)
+        self.results.sort(key=key)
+
+    def get_factor(self, pvalues, time):
+        if not self.reference or not time:
+            return None
+        pvalues = list(pvalues)
+        i = self.pnames.index(self.reference_param)
+        if pvalues[i] == self.reference_value:
+            return None
+        else:
+            pvalues[i] = self.reference_value
+        ref = self.results_dict[tuple(pvalues)]
+        if ref == None:
+            return None
+        return ref / time
+
+    def print_result(self):
+        """Run benchmark for all versions and parameters and print results
+        in tabular form to the standard output."""
+        self.time_all()
+        self.sort_results()
+
+        print("=" * 78)
+        print()
+        print(self.__class__.__name__)
+        print(self.__doc__ + "\n")
+
+        colwidth = 15
+        reftimes = {}
+
+        ts = "seconds"
+        if self.reference:
+            ts += " (x faster than " + (str(self.reference_value)) + ")"
+        print("  " + "   ".join([str(r).ljust(colwidth) for r in self.pnames + [ts]]))
+        print("-" * 79)
+
+        rows = []
+        for vals in self.results:
+            pvalues =  vals[:-1]
+            time = vals[-1]
+            if time == None:
+                stime = "(n/a)"
+            else:
+                stime = "%.8f" % time
+                factor = self.get_factor(pvalues, time)
+                if factor != None:
+                    stime += ("  (%.2f)" % factor)
+            vals = pvalues + (stime,)
+            row = [str(val).ljust(colwidth) for val in vals]
+            print("  " + "   ".join(row))
+        print()
diff --git a/Examples/python-simple/scripts/dummy-web-server.py b/Examples/python-simple/scripts/dummy-web-server.py
new file mode 100644
index 00000000..1aa21d4a
--- /dev/null
+++ b/Examples/python-simple/scripts/dummy-web-server.py
@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+
+"""
+Very simple HTTP server in python.
+Downloaded from: https://gist.github.com/bradmontgomery/2219997
+
+Usage::
+    ./dummy-web-server.py [<port>]
+
+Send a GET request::
+    curl http://localhost
+
+Send a HEAD request::
+    curl -I http://localhost
+
+Send a POST request::
+    curl -d "foo=bar&bin=baz" http://localhost
+
+"""
+
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import socketserver
+
+class S(BaseHTTPRequestHandler):
+    def _set_headers(self):
+        self.send_response(200)
+        self.send_header('Content-type', 'text/html')
+        self.end_headers()
+
+    def do_GET(self):
+        self._set_headers()
+        self.wfile.write("<html><body><h1>hi!</h1></body></html>".encode())
+
+    def do_HEAD(self):
+        self._set_headers()
+
+    def do_POST(self):
+        # Doesn't do anything with posted data
+        self._set_headers()
+        self.wfile.write("<html><body><h1>POST!</h1></body></html>".encode())
+
+def run(server_class=HTTPServer, handler_class=S, port=80):
+    server_address = ('', port)
+    httpd = server_class(server_address, handler_class)
+    print('Starting httpd...')
+    httpd.serve_forever()
+
+if __name__ == "__main__":
+    from sys import argv
+
+    if len(argv) == 2:
+        run(port=int(argv[1]))
+    else:
+        run()
diff --git a/Examples/python-simple/scripts/fibonacci.py b/Examples/python-simple/scripts/fibonacci.py
new file mode 100644
index 00000000..ee5b6bf1
--- /dev/null
+++ b/Examples/python-simple/scripts/fibonacci.py
@@ -0,0 +1,54 @@
+"""
+Downloaded from https://code.google.com/p/benchrun/
+
+Fibonacci numbers test benchmark
+"""
+
+from benchrun import Benchmark, clock
+
+def fib1(n):
+    if n < 2:
+        return n
+    return fib1(n-1) + fib1(n-2)
+
+def fib2(n):
+    if n < 2:
+        return n
+    a, b = 1, 0
+    for i in range(n-1):
+        a, b = a+b, a
+    return a
+
+class FibonacciBenchmark(Benchmark):
+    """Compare time to compute the nth Fibonacci number recursively
+    (fib1) and iteratively (fib2)."""
+
+    # Execute for all combinations of these parameters
+    parameters = ['version', 'n']
+    version = ['fib1', 'fib2']
+    n = range(0, 60, 5)
+
+    # Compare timings against this parameter value
+    reference = ('version', 'fib1')
+
+    def run(self, n, version):
+        f = globals()[version]
+        # Don't repeat when slow
+        if version == 'fib1' and n > 10:
+            # Skip altogether
+            if n > 30:
+                return None
+            t1 = clock()
+            f(n)
+            t2 = clock()
+            return t2-t1
+        # Need to repeat many times to get accurate timings for small n
+        else:
+            t1 = clock()
+            f(n); f(n); f(n); f(n); f(n); f(n); f(n)
+            f(n); f(n); f(n); f(n); f(n); f(n); f(n)
+            t2 = clock()
+            return (t2 - t1) / 14
+
+if __name__ == '__main__':
+    FibonacciBenchmark().print_result()
diff --git a/Examples/python-simple/scripts/helloworld.py b/Examples/python-simple/scripts/helloworld.py
new file mode 100644
index 00000000..b11fb8ab
--- /dev/null
+++ b/Examples/python-simple/scripts/helloworld.py
@@ -0,0 +1,3 @@
+#!/usr/bin/env python3
+
+print("Hello World")
diff --git a/Examples/python-simple/scripts/test-http.py b/Examples/python-simple/scripts/test-http.py
new file mode 100644
index 00000000..fa7abc21
--- /dev/null
+++ b/Examples/python-simple/scripts/test-http.py
@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+
+import sys
+import urllib.request
+
+request = urllib.request.Request("http://" + sys.argv[1] + ":" + sys.argv[2] + "/index.html")
+opener = urllib.request.build_opener()
+response = opener.open(request, timeout=10)
+while True:
+    data = response.read(1024)
+    if data:
+        print(data.decode())
+    else:
+        break
diff --git a/Examples/pytorch/Makefile b/Examples/pytorch/Makefile
new file mode 100644
index 00000000..1c5c057a
--- /dev/null
+++ b/Examples/pytorch/Makefile
@@ -0,0 +1,76 @@
+# Build PyTorch as follows:
+#
+# - make               -- create non-SGX no-debug-log manifest
+# - make SGX=1         -- create SGX no-debug-log manifest
+# - make SGX=1 DEBUG=1 -- create SGX debug-log manifest
+#
+# PyTorch and the pre-trained model must be installed on the system.
+# See README for details.
+#
+# Use `make clean` to remove Graphene-generated files.
+
+GRAPHENEDIR ?= ../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+DISTRIB_ID ?= $(shell lsb_release --short --id)
+DISTRIB_RELEASE ?= $(shell lsb_release --short --release)
+
+ifneq ($(DISTRIB_ID),Ubuntu)
+$(error This example requires Ubuntu.)
+endif
+
+UBUNTU_VERSION = $(DISTRIB_ID)$(DISTRIB_RELEASE)
+
+.PHONY: default
+ifeq ($(SGX),1)
+default: pytorch.token python3.token pal_loader
+else
+default: pytorch.manifest python3.manifest pal_loader
+endif
+
+pytorch.sig: python3.sig
+
+# .manifest.template contains stanzas for both Ubuntu 16 and 18. The last rule selectively enables
+# those lines based on the Ubuntu version detected.
+%.manifest: %.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(HOME)|'"$(HOME)"'|g' \
+		-e 's|# '"$(UBUNTU_VERSION)"' ||g' \
+		$< > $@
+
+pytorch.sig: pytorch.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-output pytorch.manifest.sgx -exec /usr/bin/python3 -manifest $<
+
+%.token: %.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token -output $@ -sig $<
+
+# The PyTorch workload forks/execve()s at some point. This rule generates the required additional
+# manifest for the child process.
+python3.manifest: pytorch.manifest
+	cp $< $@
+	sed -i '/trusted_children/d' $@
+
+python3.sig: python3.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-output python3.manifest.sgx -exec /usr/bin/python3 -manifest $<
+
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: clean
+clean:
+	$(RM) *.token *.sig *.manifest.sgx *.manifest pal_loader
+
+.PHONY: distclean
+distclean: clean
diff --git a/Examples/pytorch/README.md b/Examples/pytorch/README.md
new file mode 100644
index 00000000..a8ebceee
--- /dev/null
+++ b/Examples/pytorch/README.md
@@ -0,0 +1,40 @@
+# PyTorch
+
+This directory contains steps and artifacts to run a PyTorch sample workload on
+Graphene. Specifically, this example uses a pre-trained model for image classification. We tested
+this on Ubuntu 16.04 and 18.04. The sample uses the package versions of Python (3.5 and 3.6) coming
+with each distribution.
+
+The workload reads an image from a file on disk `input.jpg` and runs the classifier to detect what
+object is present in the image. For the image shipping with the workload, the output should be
+
+```
+[('Labrador retriever', 41.58518600463867), ('golden retriever', 16.59165382385254), ('Saluki, gazelle hound', 16.286855697631836), ('whippet', 2.853914976119995), ('Ibizan hound, Ibizan Podenco', 2.3924756050109863)]
+```
+
+With high probability (41%) the classifier detected the image to contain a Labrador retriever.
+
+# Pre-requisites
+
+The following steps should suffice to run the workload on a stock Ubuntu 16.04 and 18.04
+installation.
+
+- `sudo apt-get install python3-pip lsb-release` to install `pip` and `lsb_release`. The former is
+  required to install additional Python packages while the latter is used by the Makefile.
+- `pip3 install --user torchvision pillow` to install the torchvision and pillow Python packages and
+  their dependencies (usually in $HOME/.local). WARNING: This downloads several hundred megabytes of
+  data!
+- `python3 -c 'import torchvision ; torchvision.models.alexnet(pretrained=True)'` to download the
+  pre-trained model ($HOME/.cache/torch). WARNING: This downloads about 200MB of data!
+
+# Build
+
+Run `make` to build the non-SGX version and `make SGX=1` to build the SGX version.
+
+# Run
+
+Execute any one of the following commands to run the workload
+
+- natively: `python3 pytorchexample.py`
+- Graphene w/o SGX: `./pal_loader ./pytorch.manifest ./pytorchexample.py`
+- Graphene with SGX: `SGX=1 ./pal_loader ./pytorch.manifest ./pytorchexample.py`
diff --git a/Examples/pytorch/classes.txt b/Examples/pytorch/classes.txt
new file mode 100644
index 00000000..722c9845
--- /dev/null
+++ b/Examples/pytorch/classes.txt
@@ -0,0 +1,1000 @@
+tench, Tinca tinca
+goldfish, Carassius auratus
+great white shark, white shark, man-eater, man-eating shark, Carcharodon carcharias
+tiger shark, Galeocerdo cuvieri
+hammerhead, hammerhead shark
+electric ray, crampfish, numbfish, torpedo
+stingray
+cock
+hen
+ostrich, Struthio camelus
+brambling, Fringilla montifringilla
+goldfinch, Carduelis carduelis
+house finch, linnet, Carpodacus mexicanus
+junco, snowbird
+indigo bunting, indigo finch, indigo bird, Passerina cyanea
+robin, American robin, Turdus migratorius
+bulbul
+jay
+magpie
+chickadee
+water ouzel, dipper
+kite
+bald eagle, American eagle, Haliaeetus leucocephalus
+vulture
+great grey owl, great gray owl, Strix nebulosa
+European fire salamander, Salamandra salamandra
+common newt, Triturus vulgaris
+eft
+spotted salamander, Ambystoma maculatum
+axolotl, mud puppy, Ambystoma mexicanum
+bullfrog, Rana catesbeiana
+tree frog, tree-frog
+tailed frog, bell toad, ribbed toad, tailed toad, Ascaphus trui
+loggerhead, loggerhead turtle, Caretta caretta
+leatherback turtle, leatherback, leathery turtle, Dermochelys coriacea
+mud turtle
+terrapin
+box turtle, box tortoise
+banded gecko
+common iguana, iguana, Iguana iguana
+American chameleon, anole, Anolis carolinensis
+whiptail, whiptail lizard
+agama
+frilled lizard, Chlamydosaurus kingi
+alligator lizard
+Gila monster, Heloderma suspectum
+green lizard, Lacerta viridis
+African chameleon, Chamaeleo chamaeleon
+Komodo dragon, Komodo lizard, dragon lizard, giant lizard, Varanus komodoensis
+African crocodile, Nile crocodile, Crocodylus niloticus
+American alligator, Alligator mississipiensis
+triceratops
+thunder snake, worm snake, Carphophis amoenus
+ringneck snake, ring-necked snake, ring snake
+hognose snake, puff adder, sand viper
+green snake, grass snake
+king snake, kingsnake
+garter snake, grass snake
+water snake
+vine snake
+night snake, Hypsiglena torquata
+boa constrictor, Constrictor constrictor
+rock python, rock snake, Python sebae
+Indian cobra, Naja naja
+green mamba
+sea snake
+horned viper, cerastes, sand viper, horned asp, Cerastes cornutus
+diamondback, diamondback rattlesnake, Crotalus adamanteus
+sidewinder, horned rattlesnake, Crotalus cerastes
+trilobite
+harvestman, daddy longlegs, Phalangium opilio
+scorpion
+black and gold garden spider, Argiope aurantia
+barn spider, Araneus cavaticus
+garden spider, Aranea diademata
+black widow, Latrodectus mactans
+tarantula
+wolf spider, hunting spider
+tick
+centipede
+black grouse
+ptarmigan
+ruffed grouse, partridge, Bonasa umbellus
+prairie chicken, prairie grouse, prairie fowl
+peacock
+quail
+partridge
+African grey, African gray, Psittacus erithacus
+macaw
+sulphur-crested cockatoo, Kakatoe galerita, Cacatua galerita
+lorikeet
+coucal
+bee eater
+hornbill
+hummingbird
+jacamar
+toucan
+drake
+red-breasted merganser, Mergus serrator
+goose
+black swan, Cygnus atratus
+tusker
+echidna, spiny anteater, anteater
+platypus, duckbill, duckbilled platypus, duck-billed platypus, Ornithorhynchus anatinus
+wallaby, brush kangaroo
+koala, koala bear, kangaroo bear, native bear, Phascolarctos cinereus
+wombat
+jellyfish
+sea anemone, anemone
+brain coral
+flatworm, platyhelminth
+nematode, nematode worm, roundworm
+conch
+snail
+slug
+sea slug, nudibranch
+chiton, coat-of-mail shell, sea cradle, polyplacophore
+chambered nautilus, pearly nautilus, nautilus
+Dungeness crab, Cancer magister
+rock crab, Cancer irroratus
+fiddler crab
+king crab, Alaska crab, Alaskan king crab, Alaska king crab, Paralithodes camtschatica
+American lobster, Northern lobster, Maine lobster, Homarus americanus
+spiny lobster, langouste, rock lobster, crawfish, crayfish, sea crawfish
+crayfish, crawfish, crawdad, crawdaddy
+hermit crab
+isopod
+white stork, Ciconia ciconia
+black stork, Ciconia nigra
+spoonbill
+flamingo
+little blue heron, Egretta caerulea
+American egret, great white heron, Egretta albus
+bittern
+crane
+limpkin, Aramus pictus
+European gallinule, Porphyrio porphyrio
+American coot, marsh hen, mud hen, water hen, Fulica americana
+bustard
+ruddy turnstone, Arenaria interpres
+red-backed sandpiper, dunlin, Erolia alpina
+redshank, Tringa totanus
+dowitcher
+oystercatcher, oyster catcher
+pelican
+king penguin, Aptenodytes patagonica
+albatross, mollymawk
+grey whale, gray whale, devilfish, Eschrichtius gibbosus, Eschrichtius robustus
+killer whale, killer, orca, grampus, sea wolf, Orcinus orca
+dugong, Dugong dugon
+sea lion
+Chihuahua
+Japanese spaniel
+Maltese dog, Maltese terrier, Maltese
+Pekinese, Pekingese, Peke
+Shih-Tzu
+Blenheim spaniel
+papillon
+toy terrier
+Rhodesian ridgeback
+Afghan hound, Afghan
+basset, basset hound
+beagle
+bloodhound, sleuthhound
+bluetick
+black-and-tan coonhound
+Walker hound, Walker foxhound
+English foxhound
+redbone
+borzoi, Russian wolfhound
+Irish wolfhound
+Italian greyhound
+whippet
+Ibizan hound, Ibizan Podenco
+Norwegian elkhound, elkhound
+otterhound, otter hound
+Saluki, gazelle hound
+Scottish deerhound, deerhound
+Weimaraner
+Staffordshire bullterrier, Staffordshire bull terrier
+American Staffordshire terrier, Staffordshire terrier, American pit bull terrier, pit bull terrier
+Bedlington terrier
+Border terrier
+Kerry blue terrier
+Irish terrier
+Norfolk terrier
+Norwich terrier
+Yorkshire terrier
+wire-haired fox terrier
+Lakeland terrier
+Sealyham terrier, Sealyham
+Airedale, Airedale terrier
+cairn, cairn terrier
+Australian terrier
+Dandie Dinmont, Dandie Dinmont terrier
+Boston bull, Boston terrier
+miniature schnauzer
+giant schnauzer
+standard schnauzer
+Scotch terrier, Scottish terrier, Scottie
+Tibetan terrier, chrysanthemum dog
+silky terrier, Sydney silky
+soft-coated wheaten terrier
+West Highland white terrier
+Lhasa, Lhasa apso
+flat-coated retriever
+curly-coated retriever
+golden retriever
+Labrador retriever
+Chesapeake Bay retriever
+German short-haired pointer
+vizsla, Hungarian pointer
+English setter
+Irish setter, red setter
+Gordon setter
+Brittany spaniel
+clumber, clumber spaniel
+English springer, English springer spaniel
+Welsh springer spaniel
+cocker spaniel, English cocker spaniel, cocker
+Sussex spaniel
+Irish water spaniel
+kuvasz
+schipperke
+groenendael
+malinois
+briard
+kelpie
+komondor
+Old English sheepdog, bobtail
+Shetland sheepdog, Shetland sheep dog, Shetland
+collie
+Border collie
+Bouvier des Flandres, Bouviers des Flandres
+Rottweiler
+German shepherd, German shepherd dog, German police dog, alsatian
+Doberman, Doberman pinscher
+miniature pinscher
+Greater Swiss Mountain dog
+Bernese mountain dog
+Appenzeller
+EntleBucher
+boxer
+bull mastiff
+Tibetan mastiff
+French bulldog
+Great Dane
+Saint Bernard, St Bernard
+Eskimo dog, husky
+malamute, malemute, Alaskan malamute
+Siberian husky
+dalmatian, coach dog, carriage dog
+affenpinscher, monkey pinscher, monkey dog
+basenji
+pug, pug-dog
+Leonberg
+Newfoundland, Newfoundland dog
+Great Pyrenees
+Samoyed, Samoyede
+Pomeranian
+chow, chow chow
+keeshond
+Brabancon griffon
+Pembroke, Pembroke Welsh corgi
+Cardigan, Cardigan Welsh corgi
+toy poodle
+miniature poodle
+standard poodle
+Mexican hairless
+timber wolf, grey wolf, gray wolf, Canis lupus
+white wolf, Arctic wolf, Canis lupus tundrarum
+red wolf, maned wolf, Canis rufus, Canis niger
+coyote, prairie wolf, brush wolf, Canis latrans
+dingo, warrigal, warragal, Canis dingo
+dhole, Cuon alpinus
+African hunting dog, hyena dog, Cape hunting dog, Lycaon pictus
+hyena, hyaena
+red fox, Vulpes vulpes
+kit fox, Vulpes macrotis
+Arctic fox, white fox, Alopex lagopus
+grey fox, gray fox, Urocyon cinereoargenteus
+tabby, tabby cat
+tiger cat
+Persian cat
+Siamese cat, Siamese
+Egyptian cat
+cougar, puma, catamount, mountain lion, painter, panther, Felis concolor
+lynx, catamount
+leopard, Panthera pardus
+snow leopard, ounce, Panthera uncia
+jaguar, panther, Panthera onca, Felis onca
+lion, king of beasts, Panthera leo
+tiger, Panthera tigris
+cheetah, chetah, Acinonyx jubatus
+brown bear, bruin, Ursus arctos
+American black bear, black bear, Ursus americanus, Euarctos americanus
+ice bear, polar bear, Ursus Maritimus, Thalarctos maritimus
+sloth bear, Melursus ursinus, Ursus ursinus
+mongoose
+meerkat, mierkat
+tiger beetle
+ladybug, ladybeetle, lady beetle, ladybird, ladybird beetle
+ground beetle, carabid beetle
+long-horned beetle, longicorn, longicorn beetle
+leaf beetle, chrysomelid
+dung beetle
+rhinoceros beetle
+weevil
+fly
+bee
+ant, emmet, pismire
+grasshopper, hopper
+cricket
+walking stick, walkingstick, stick insect
+cockroach, roach
+mantis, mantid
+cicada, cicala
+leafhopper
+lacewing, lacewing fly
+dragonfly, darning needle, devil's darning needle, sewing needle, snake feeder, snake doctor, mosquito hawk, skeeter hawk
+damselfly
+admiral
+ringlet, ringlet butterfly
+monarch, monarch butterfly, milkweed butterfly, Danaus plexippus
+cabbage butterfly
+sulphur butterfly, sulfur butterfly
+lycaenid, lycaenid butterfly
+starfish, sea star
+sea urchin
+sea cucumber, holothurian
+wood rabbit, cottontail, cottontail rabbit
+hare
+Angora, Angora rabbit
+hamster
+porcupine, hedgehog
+fox squirrel, eastern fox squirrel, Sciurus niger
+marmot
+beaver
+guinea pig, Cavia cobaya
+sorrel
+zebra
+hog, pig, grunter, squealer, Sus scrofa
+wild boar, boar, Sus scrofa
+warthog
+hippopotamus, hippo, river horse, Hippopotamus amphibius
+ox
+water buffalo, water ox, Asiatic buffalo, Bubalus bubalis
+bison
+ram, tup
+bighorn, bighorn sheep, cimarron, Rocky Mountain bighorn, Rocky Mountain sheep, Ovis canadensis
+ibex, Capra ibex
+hartebeest
+impala, Aepyceros melampus
+gazelle
+Arabian camel, dromedary, Camelus dromedarius
+llama
+weasel
+mink
+polecat, fitch, foulmart, foumart, Mustela putorius
+black-footed ferret, ferret, Mustela nigripes
+otter
+skunk, polecat, wood pussy
+badger
+armadillo
+three-toed sloth, ai, Bradypus tridactylus
+orangutan, orang, orangutang, Pongo pygmaeus
+gorilla, Gorilla gorilla
+chimpanzee, chimp, Pan troglodytes
+gibbon, Hylobates lar
+siamang, Hylobates syndactylus, Symphalangus syndactylus
+guenon, guenon monkey
+patas, hussar monkey, Erythrocebus patas
+baboon
+macaque
+langur
+colobus, colobus monkey
+proboscis monkey, Nasalis larvatus
+marmoset
+capuchin, ringtail, Cebus capucinus
+howler monkey, howler
+titi, titi monkey
+spider monkey, Ateles geoffroyi
+squirrel monkey, Saimiri sciureus
+Madagascar cat, ring-tailed lemur, Lemur catta
+indri, indris, Indri indri, Indri brevicaudatus
+Indian elephant, Elephas maximus
+African elephant, Loxodonta africana
+lesser panda, red panda, panda, bear cat, cat bear, Ailurus fulgens
+giant panda, panda, panda bear, coon bear, Ailuropoda melanoleuca
+barracouta, snoek
+eel
+coho, cohoe, coho salmon, blue jack, silver salmon, Oncorhynchus kisutch
+rock beauty, Holocanthus tricolor
+anemone fish
+sturgeon
+gar, garfish, garpike, billfish, Lepisosteus osseus
+lionfish
+puffer, pufferfish, blowfish, globefish
+abacus
+abaya
+academic gown, academic robe, judge's robe
+accordion, piano accordion, squeeze box
+acoustic guitar
+aircraft carrier, carrier, flattop, attack aircraft carrier
+airliner
+airship, dirigible
+altar
+ambulance
+amphibian, amphibious vehicle
+analog clock
+apiary, bee house
+apron
+ashcan, trash can, garbage can, wastebin, ash bin, ash-bin, ashbin, dustbin, trash barrel, trash bin
+assault rifle, assault gun
+backpack, back pack, knapsack, packsack, rucksack, haversack
+bakery, bakeshop, bakehouse
+balance beam, beam
+balloon
+ballpoint, ballpoint pen, ballpen, Biro
+Band Aid
+banjo
+bannister, banister, balustrade, balusters, handrail
+barbell
+barber chair
+barbershop
+barn
+barometer
+barrel, cask
+barrow, garden cart, lawn cart, wheelbarrow
+baseball
+basketball
+bassinet
+bassoon
+bathing cap, swimming cap
+bath towel
+bathtub, bathing tub, bath, tub
+beach wagon, station wagon, wagon, estate car, beach waggon, station waggon, waggon
+beacon, lighthouse, beacon light, pharos
+beaker
+bearskin, busby, shako
+beer bottle
+beer glass
+bell cote, bell cot
+bib
+bicycle-built-for-two, tandem bicycle, tandem
+bikini, two-piece
+binder, ring-binder
+binoculars, field glasses, opera glasses
+birdhouse
+boathouse
+bobsled, bobsleigh, bob
+bolo tie, bolo, bola tie, bola
+bonnet, poke bonnet
+bookcase
+bookshop, bookstore, bookstall
+bottlecap
+bow
+bow tie, bow-tie, bowtie
+brass, memorial tablet, plaque
+brassiere, bra, bandeau
+breakwater, groin, groyne, mole, bulwark, seawall, jetty
+breastplate, aegis, egis
+broom
+bucket, pail
+buckle
+bulletproof vest
+bullet train, bullet
+butcher shop, meat market
+cab, hack, taxi, taxicab
+caldron, cauldron
+candle, taper, wax light
+cannon
+canoe
+can opener, tin opener
+cardigan
+car mirror
+carousel, carrousel, merry-go-round, roundabout, whirligig
+carpenter's kit, tool kit
+carton
+car wheel
+cash machine, cash dispenser, automated teller machine, automatic teller machine, automated teller, automatic teller, ATM
+cassette
+cassette player
+castle
+catamaran
+CD player
+cello, violoncello
+cellular telephone, cellular phone, cellphone, cell, mobile phone
+chain
+chainlink fence
+chain mail, ring mail, mail, chain armor, chain armour, ring armor, ring armour
+chain saw, chainsaw
+chest
+chiffonier, commode
+chime, bell, gong
+china cabinet, china closet
+Christmas stocking
+church, church building
+cinema, movie theater, movie theatre, movie house, picture palace
+cleaver, meat cleaver, chopper
+cliff dwelling
+cloak
+clog, geta, patten, sabot
+cocktail shaker
+coffee mug
+coffeepot
+coil, spiral, volute, whorl, helix
+combination lock
+computer keyboard, keypad
+confectionery, confectionary, candy store
+container ship, containership, container vessel
+convertible
+corkscrew, bottle screw
+cornet, horn, trumpet, trump
+cowboy boot
+cowboy hat, ten-gallon hat
+cradle
+crane
+crash helmet
+crate
+crib, cot
+Crock Pot
+croquet ball
+crutch
+cuirass
+dam, dike, dyke
+desk
+desktop computer
+dial telephone, dial phone
+diaper, nappy, napkin
+digital clock
+digital watch
+dining table, board
+dishrag, dishcloth
+dishwasher, dish washer, dishwashing machine
+disk brake, disc brake
+dock, dockage, docking facility
+dogsled, dog sled, dog sleigh
+dome
+doormat, welcome mat
+drilling platform, offshore rig
+drum, membranophone, tympan
+drumstick
+dumbbell
+Dutch oven
+electric fan, blower
+electric guitar
+electric locomotive
+entertainment center
+envelope
+espresso maker
+face powder
+feather boa, boa
+file, file cabinet, filing cabinet
+fireboat
+fire engine, fire truck
+fire screen, fireguard
+flagpole, flagstaff
+flute, transverse flute
+folding chair
+football helmet
+forklift
+fountain
+fountain pen
+four-poster
+freight car
+French horn, horn
+frying pan, frypan, skillet
+fur coat
+garbage truck, dustcart
+gasmask, respirator, gas helmet
+gas pump, gasoline pump, petrol pump, island dispenser
+goblet
+go-kart
+golf ball
+golfcart, golf cart
+gondola
+gong, tam-tam
+gown
+grand piano, grand
+greenhouse, nursery, glasshouse
+grille, radiator grille
+grocery store, grocery, food market, market
+guillotine
+hair slide
+hair spray
+half track
+hammer
+hamper
+hand blower, blow dryer, blow drier, hair dryer, hair drier
+hand-held computer, hand-held microcomputer
+handkerchief, hankie, hanky, hankey
+hard disc, hard disk, fixed disk
+harmonica, mouth organ, harp, mouth harp
+harp
+harvester, reaper
+hatchet
+holster
+home theater, home theatre
+honeycomb
+hook, claw
+hoopskirt, crinoline
+horizontal bar, high bar
+horse cart, horse-cart
+hourglass
+iPod
+iron, smoothing iron
+jack-o'-lantern
+jean, blue jean, denim
+jeep, landrover
+jersey, T-shirt, tee shirt
+jigsaw puzzle
+jinrikisha, ricksha, rickshaw
+joystick
+kimono
+knee pad
+knot
+lab coat, laboratory coat
+ladle
+lampshade, lamp shade
+laptop, laptop computer
+lawn mower, mower
+lens cap, lens cover
+letter opener, paper knife, paperknife
+library
+lifeboat
+lighter, light, igniter, ignitor
+limousine, limo
+liner, ocean liner
+lipstick, lip rouge
+Loafer
+lotion
+loudspeaker, speaker, speaker unit, loudspeaker system, speaker system
+loupe, jeweler's loupe
+lumbermill, sawmill
+magnetic compass
+mailbag, postbag
+mailbox, letter box
+maillot
+maillot, tank suit
+manhole cover
+maraca
+marimba, xylophone
+mask
+matchstick
+maypole
+maze, labyrinth
+measuring cup
+medicine chest, medicine cabinet
+megalith, megalithic structure
+microphone, mike
+microwave, microwave oven
+military uniform
+milk can
+minibus
+miniskirt, mini
+minivan
+missile
+mitten
+mixing bowl
+mobile home, manufactured home
+Model T
+modem
+monastery
+monitor
+moped
+mortar
+mortarboard
+mosque
+mosquito net
+motor scooter, scooter
+mountain bike, all-terrain bike, off-roader
+mountain tent
+mouse, computer mouse
+mousetrap
+moving van
+muzzle
+nail
+neck brace
+necklace
+nipple
+notebook, notebook computer
+obelisk
+oboe, hautboy, hautbois
+ocarina, sweet potato
+odometer, hodometer, mileometer, milometer
+oil filter
+organ, pipe organ
+oscilloscope, scope, cathode-ray oscilloscope, CRO
+overskirt
+oxcart
+oxygen mask
+packet
+paddle, boat paddle
+paddlewheel, paddle wheel
+padlock
+paintbrush
+pajama, pyjama, pj's, jammies
+palace
+panpipe, pandean pipe, syrinx
+paper towel
+parachute, chute
+parallel bars, bars
+park bench
+parking meter
+passenger car, coach, carriage
+patio, terrace
+pay-phone, pay-station
+pedestal, plinth, footstall
+pencil box, pencil case
+pencil sharpener
+perfume, essence
+Petri dish
+photocopier
+pick, plectrum, plectron
+pickelhaube
+picket fence, paling
+pickup, pickup truck
+pier
+piggy bank, penny bank
+pill bottle
+pillow
+ping-pong ball
+pinwheel
+pirate, pirate ship
+pitcher, ewer
+plane, carpenter's plane, woodworking plane
+planetarium
+plastic bag
+plate rack
+plow, plough
+plunger, plumber's helper
+Polaroid camera, Polaroid Land camera
+pole
+police van, police wagon, paddy wagon, patrol wagon, wagon, black Maria
+poncho
+pool table, billiard table, snooker table
+pop bottle, soda bottle
+pot, flowerpot
+potter's wheel
+power drill
+prayer rug, prayer mat
+printer
+prison, prison house
+projectile, missile
+projector
+puck, hockey puck
+punching bag, punch bag, punching ball, punchball
+purse
+quill, quill pen
+quilt, comforter, comfort, puff
+racer, race car, racing car
+racket, racquet
+radiator
+radio, wireless
+radio telescope, radio reflector
+rain barrel
+recreational vehicle, RV, R.V.
+reel
+reflex camera
+refrigerator, icebox
+remote control, remote
+restaurant, eating house, eating place, eatery
+revolver, six-gun, six-shooter
+rifle
+rocking chair, rocker
+rotisserie
+rubber eraser, rubber, pencil eraser
+rugby ball
+rule, ruler
+running shoe
+safe
+safety pin
+saltshaker, salt shaker
+sandal
+sarong
+sax, saxophone
+scabbard
+scale, weighing machine
+school bus
+schooner
+scoreboard
+screen, CRT screen
+screw
+screwdriver
+seat belt, seatbelt
+sewing machine
+shield, buckler
+shoe shop, shoe-shop, shoe store
+shoji
+shopping basket
+shopping cart
+shovel
+shower cap
+shower curtain
+ski
+ski mask
+sleeping bag
+slide rule, slipstick
+sliding door
+slot, one-armed bandit
+snorkel
+snowmobile
+snowplow, snowplough
+soap dispenser
+soccer ball
+sock
+solar dish, solar collector, solar furnace
+sombrero
+soup bowl
+space bar
+space heater
+space shuttle
+spatula
+speedboat
+spider web, spider's web
+spindle
+sports car, sport car
+spotlight, spot
+stage
+steam locomotive
+steel arch bridge
+steel drum
+stethoscope
+stole
+stone wall
+stopwatch, stop watch
+stove
+strainer
+streetcar, tram, tramcar, trolley, trolley car
+stretcher
+studio couch, day bed
+stupa, tope
+submarine, pigboat, sub, U-boat
+suit, suit of clothes
+sundial
+sunglass
+sunglasses, dark glasses, shades
+sunscreen, sunblock, sun blocker
+suspension bridge
+swab, swob, mop
+sweatshirt
+swimming trunks, bathing trunks
+swing
+switch, electric switch, electrical switch
+syringe
+table lamp
+tank, army tank, armored combat vehicle, armoured combat vehicle
+tape player
+teapot
+teddy, teddy bear
+television, television system
+tennis ball
+thatch, thatched roof
+theater curtain, theatre curtain
+thimble
+thresher, thrasher, threshing machine
+throne
+tile roof
+toaster
+tobacco shop, tobacconist shop, tobacconist
+toilet seat
+torch
+totem pole
+tow truck, tow car, wrecker
+toyshop
+tractor
+trailer truck, tractor trailer, trucking rig, rig, articulated lorry, semi
+tray
+trench coat
+tricycle, trike, velocipede
+trimaran
+tripod
+triumphal arch
+trolleybus, trolley coach, trackless trolley
+trombone
+tub, vat
+turnstile
+typewriter keyboard
+umbrella
+unicycle, monocycle
+upright, upright piano
+vacuum, vacuum cleaner
+vase
+vault
+velvet
+vending machine
+vestment
+viaduct
+violin, fiddle
+volleyball
+waffle iron
+wall clock
+wallet, billfold, notecase, pocketbook
+wardrobe, closet, press
+warplane, military plane
+washbasin, handbasin, washbowl, lavabo, wash-hand basin
+washer, automatic washer, washing machine
+water bottle
+water jug
+water tower
+whiskey jug
+whistle
+wig
+window screen
+window shade
+Windsor tie
+wine bottle
+wing
+wok
+wooden spoon
+wool, woolen, woollen
+worm fence, snake fence, snake-rail fence, Virginia fence
+wreck
+yawl
+yurt
+web site, website, internet site, site
+comic book
+crossword puzzle, crossword
+street sign
+traffic light, traffic signal, stoplight
+book jacket, dust cover, dust jacket, dust wrapper
+menu
+plate
+guacamole
+consomme
+hot pot, hotpot
+trifle
+ice cream, icecream
+ice lolly, lolly, lollipop, popsicle
+French loaf
+bagel, beigel
+pretzel
+cheeseburger
+hotdog, hot dog, red hot
+mashed potato
+head cabbage
+broccoli
+cauliflower
+zucchini, courgette
+spaghetti squash
+acorn squash
+butternut squash
+cucumber, cuke
+artichoke, globe artichoke
+bell pepper
+cardoon
+mushroom
+Granny Smith
+strawberry
+orange
+lemon
+fig
+pineapple, ananas
+banana
+jackfruit, jak, jack
+custard apple
+pomegranate
+hay
+carbonara
+chocolate sauce, chocolate syrup
+dough
+meat loaf, meatloaf
+pizza, pizza pie
+potpie
+burrito
+red wine
+espresso
+cup
+eggnog
+alp
+bubble
+cliff, drop, drop-off
+coral reef
+geyser
+lakeside, lakeshore
+promontory, headland, head, foreland
+sandbar, sand bar
+seashore, coast, seacoast, sea-coast
+valley, vale
+volcano
+ballplayer, baseball player
+groom, bridegroom
+scuba diver
+rapeseed
+daisy
+yellow lady's slipper, yellow lady-slipper, Cypripedium calceolus, Cypripedium parviflorum
+corn
+acorn
+hip, rose hip, rosehip
+buckeye, horse chestnut, conker
+coral fungus
+agaric
+gyromitra
+stinkhorn, carrion fungus
+earthstar
+hen-of-the-woods, hen of the woods, Polyporus frondosus, Grifola frondosa
+bolete
+ear, spike, capitulum
+toilet tissue, toilet paper, bathroom tissue
\ No newline at end of file
diff --git a/Examples/pytorch/input.jpg b/Examples/pytorch/input.jpg
new file mode 100644
index 00000000..498e5989
Binary files /dev/null and b/Examples/pytorch/input.jpg differ
diff --git a/Examples/pytorch/pytorch.manifest.template b/Examples/pytorch/pytorch.manifest.template
new file mode 100644
index 00000000..427fbc35
--- /dev/null
+++ b/Examples/pytorch/pytorch.manifest.template
@@ -0,0 +1,146 @@
+# PyTorch manifest template
+#
+# This manifest was tested on Ubuntu 16.04 and 18.04.
+#
+# Run the application with:
+#
+# ./pal_loader pytorch.manifest pytorchexample.py
+
+# The executable to load in Graphene
+loader.exec     = file:/usr/bin/python3
+loader.execname = python3
+
+# Graphene environment, including the path to the library OS and the debug
+# option (inline/none)
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib:/usr/lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime/
+
+# More libraries required by PyTorch
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+# Host-level directory to NSS files required by Glibc + NSS libs
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+# Workload needs to create temporary files
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+# PyTorch loads its pre-trained models from here
+fs.mount.torch.type = chroot
+fs.mount.torch.path = $(HOME)/.cache/torch
+fs.mount.torch.uri = file:$(HOME)/.cache/torch
+
+# When run as `pip install --user ...`, pip installs Python packages here
+fs.mount.pip.type = chroot
+fs.mount.pip.path = $(HOME)/.local/lib
+fs.mount.pip.uri  = file:$(HOME)/.local/lib
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If the workload needs more virtual memory
+# than the enclave size, Graphene will not be able to allocate it.
+#
+# In particular, libtorch*.so is more than 1G, thus 4G is the minimum to make this run.
+sgx.enclave_size = 4G
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+#
+# We (somewhat arbitrarily) specify 16 threads for this workload.
+sgx.thread_num = 16
+
+# SGX trusted libraries
+
+sgx.trusted_files.ld          = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc        = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl       = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm        = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libpthread  = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.libresolv   = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2
+sgx.trusted_files.librt       = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libutil     = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
+
+sgx.trusted_files.libstdc     = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6
+sgx.trusted_files.libgccs     = file:/lib/x86_64-linux-gnu/libgcc_s.so.1
+sgx.trusted_files.libaptpkg   = file:/usr/lib/x86_64-linux-gnu/libapt-pkg.so.5.0
+sgx.trusted_files.liblz4      = file:/usr/lib/x86_64-linux-gnu/liblz4.so.1
+sgx.trusted_files.libsystemd  = file:/lib/x86_64-linux-gnu/libsystemd.so.0
+sgx.trusted_files.libselinux  = file:/lib/x86_64-linux-gnu/libselinux.so.1
+sgx.trusted_files.libgcrypt   = file:/lib/x86_64-linux-gnu/libgcrypt.so.20
+sgx.trusted_files.libpcre     = file:/lib/x86_64-linux-gnu/libpcre.so.3
+sgx.trusted_files.libgpgerror = file:/lib/x86_64-linux-gnu/libgpg-error.so.0
+sgx.trusted_files.libexpat    = file:/lib/x86_64-linux-gnu/libexpat.so.1
+sgx.trusted_files.libz        = file:/lib/x86_64-linux-gnu/libz.so.1
+sgx.trusted_files.libz2       = file:/lib/x86_64-linux-gnu/libbz2.so.1.0
+sgx.trusted_files.liblzma     = file:/lib/x86_64-linux-gnu/liblzma.so.5
+sgx.trusted_files.libmpdec    = file:/usr/lib/x86_64-linux-gnu/libmpdec.so.2
+
+# Ubuntu16.04 sgx.trusted_files.libcrypto = file:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
+# Ubuntu16.04 sgx.trusted_files.libssl    = file:/lib/x86_64-linux-gnu/libssl.so.1.0.0
+# Ubuntu18.04 sgx.trusted_files.libcrypto = file:/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1
+# Ubuntu18.04 sgx.trusted_files.libssl    = file:/usr/lib/x86_64-linux-gnu/libssl.so.1.1
+
+# Name Service Switch (NSS) libraries (Glibc dependencies)
+sgx.trusted_files.libnssfiles  = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssnis    = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+sgx.trusted_files.libnsl       = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+# The script to run
+sgx.trusted_files.script  = file:pytorchexample.py
+
+# required by Python package ctypes (lib/python3.6/lib-dynload/ctypes.cpython-36m-x86_64-linux-gnu.so)
+# Ubuntu18.04 sgx.trusted_files.libffi = file:/usr/lib/x86_64-linux-gnu/libffi.so.6
+
+# File containing the classes, i.e., things the classifier has been trained to distinguish between
+sgx.trusted_files.classes = file:classes.txt
+
+# File containing the pre-trained model
+sgx.trusted_files.torch   = file:$(HOME)/.cache/torch/checkpoints/alexnet-owt-4df8aa71.pth
+
+# Input image
+sgx.trusted_files.image   = file:input.jpg
+
+# Scratch space
+sgx.allowed_files.tmp     = file:/tmp
+
+# The workload needs to fork/execve; this allows it to do so
+sgx.trusted_children.fork = file:python3.sig
+
+# Various locations where Python dependencies are found
+sgx.allowed_files.python3    = file:/usr/lib/python3
+sgx.allowed_files.pythonhome = file:$(HOME)/.local/lib
+# Ubuntu16.04 sgx.allowed_files.python35 = file:/usr/lib/python3.5
+# Ubuntu18.04 sgx.allowed_files.python36 = file:/usr/lib/python3.6
+
+# Some Python package wants to access these files on Ubuntu 16.04
+# Ubuntu16.04 sgx.allowed_files.aptconfd = file:/etc/apt/apt.conf.d
+# Ubuntu16.04 sgx.allowed_files.aptconf  = file:/etc/apt/apt.conf
+# Ubuntu16.04 sgx.allowed_files.apport   = file:/etc/default/apport
+
+# Name Service Switch (NSS) files (Glibc reads these files)
+sgx.trusted_files.nsswitch     = file:/etc/nsswitch.conf
+sgx.trusted_files.group        = file:/etc/group
+sgx.trusted_files.passwd       = file:/etc/passwd
diff --git a/Examples/pytorch/pytorchexample.py b/Examples/pytorch/pytorchexample.py
new file mode 100644
index 00000000..abf641ad
--- /dev/null
+++ b/Examples/pytorch/pytorchexample.py
@@ -0,0 +1,47 @@
+# This PyTorch image classification example is based off
+# https://www.learnopencv.com/pytorch-for-beginners-image-classification-using-pre-trained-models/
+
+from torchvision import models
+import torch
+
+# Load the model.
+alexnet = models.alexnet(pretrained=True)
+
+# Prepare a transform to get the input image into a format (e.g., x,y dimensions) the classifier
+# expects.
+from torchvision import transforms
+transform = transforms.Compose([
+    transforms.Resize(256),
+    transforms.CenterCrop(224),
+    transforms.ToTensor(),
+    transforms.Normalize(
+    mean=[0.485, 0.456, 0.406],
+    std=[0.229, 0.224, 0.225]
+)])
+
+# Load the image.
+from PIL import Image
+img = Image.open("input.jpg")
+
+# Apply the transform to the image.
+img_t = transform(img)
+
+# Magic (not sure what this does).
+batch_t = torch.unsqueeze(img_t, 0)
+
+# Prepare the model and run the classifier.
+alexnet.eval()
+out = alexnet(batch_t)
+
+# Load the classes from disk.
+with open('classes.txt') as f:
+    classes = [line.strip() for line in f.readlines()]
+
+# Sort the predictions.
+_, indices = torch.sort(out, descending=True)
+
+# Convert into percentages.
+percentage = torch.nn.functional.softmax(out, dim=1)[0] * 100
+
+# Print the 5 most likely predictions.
+print([(classes[idx], percentage[idx].item()) for idx in indices[0][:5]])
diff --git a/Examples/r/Makefile b/Examples/r/Makefile
new file mode 100644
index 00000000..080f8d55
--- /dev/null
+++ b/Examples/r/Makefile
@@ -0,0 +1,124 @@
+# Build the manifest for R:
+#
+# - make                Building for Linux
+# - make DEBUG=1        Building for Linux (with Graphene debug output)
+# - make SGX=1          Building for SGX
+# - make SGX=1 DEBUG=1  Building for SGX (with Graphene debug output)
+#
+# Use `make clean` to remove Graphene-generated files.
+
+# Constants
+
+# Installation location of R. By default, Graphene will run the system R executable.
+R_HOME ?= /usr/lib/R
+R_EXEC = $(R_HOME)/bin/exec/R
+
+# Relative path to Graphene root
+GRAPHENEDIR ?= ../../../../..
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+LD_LIBRARY_PATH := $(LD_LIBRARY_PATH):$(R_HOME)/lib
+export LD_LIBRARY_PATH
+
+.PHONY: all
+all: R.manifest sh.manifest pal_loader
+ifeq ($(SGX),1)
+all: R.manifest.sgx R.sig R.token sh.manifest.sgx sh.sig sh.token
+endif
+
+# R dependencies (generate from ldd):
+#
+# For SGX, the manifest needs to list all the libraries loaded during the
+# execution, so that the signer can include the file checksums.
+#
+# The dependencies are generated from the ldd results of:
+#    - $(R_HOME)/bin/exec/R
+#    - $(R_HOME)/library/stats/libs/stats.so
+#    - $(R_HOME)/modules/lapack.so
+
+# We need to replace Glibc dependencies with Graphene-specific Glibc. The Glibc
+# binaries are already listed in the manifest template, so we can skip them
+# from the ldd results
+GLIBC_DEPS = linux-vdso /lib64/ld-linux-x86-64 libc libm librt libdl libpthread
+
+# Use the ldd result of R, stats.so, and lapack.so
+R_TARGETS = $(R_EXEC) $(R_HOME)/library/stats/libs/stats.so $(R_HOME)/modules/lapack.so
+
+# Listing all the R dependencies, besides Glibc libraries
+.INTERMEDIATE: R-ldd
+R-ldd:
+	@for F in $(R_TARGETS); do ldd $$F >> $@ || exit 1; done
+
+.INTERMEDIATE: R-deps
+R-deps: R-ldd
+	@cat $< | awk '{if ($$2 =="=>") {split($$1,s,/\./); print s[1]}}' \
+		| sort | uniq | grep -v -x $(patsubst %,-e %,$(GLIBC_DEPS)) > $@
+
+# Generating manifest rules for R dependencies
+.INTERMEDIATE: R-trusted-libs
+R-trusted-libs: R-deps
+	@R_LIBS="$(R_TARGETS)" && \
+	for F in `cat R-deps`; do \
+		P=`ldd $$R_LIBS | grep $$F | awk '{print $$3; exit}'`; \
+		N=`echo $$F | tr --delete '-'`; \
+		echo -n "sgx.trusted_files.$$N = file:$$P\\\\n"; \
+	done > $@
+
+# R manifests:
+#   For each dependency, generate a rule as follows:
+#       sgx.trusted_files.xxxx = file:xxxx
+
+R.manifest: R.manifest.template R-trusted-libs
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		-e 's|$$(R_HOME)|'"$(R_HOME)"'|g' \
+		-e 's|$$(R_EXEC)|'"$(R_EXEC)"'|g' \
+		-e 's|$$(R_TRUSTED_LIBS)|'"`cat R-trusted-libs`"'|g' \
+		$< > $@
+
+sh.manifest: sh.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		$< > $@
+
+# R manifests for SGX:
+#   Generating the SGX-specific manifest (R.manifest.sgx), the enclave signature,
+#   and the token for enclave initialization.
+
+R.manifest.sgx: R.manifest sh.manifest.sgx
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+R.sig: R.manifest.sgx
+
+R.token: R.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output R.token -sig R.sig
+
+# sh.manifest.sgx is needed for R to run the shell for file clean-up
+sh.manifest.sgx: sh.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@
+
+sh.sig: sh.manifest.sgx
+
+sh.token: sh.sig
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output sh.token -sig sh.sig
+
+# Extra executables
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+.PHONY: clean
+clean:
+	$(RM) *.manifest *.manifest.sgx *.token *.sig pal_loader
diff --git a/Examples/r/R.manifest.template b/Examples/r/R.manifest.template
new file mode 100644
index 00000000..42dea918
--- /dev/null
+++ b/Examples/r/R.manifest.template
@@ -0,0 +1,95 @@
+# R manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+#
+# R must be run with the pal_loader:
+#
+# ./pal_loader R.manifest <script>
+
+# The executable to load in Graphene. By default, $(R_HOME) points to the R
+# system installation. To run R from a local installation, specify R_HOME
+# when running `make` in this directory.
+loader.exec = file:$(R_EXEC)
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables for R
+loader.env.LD_LIBRARY_PATH = $(R_HOME)/lib:/lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
+loader.env.PATH = $(R_HOME)/bin:/usr/bin:/bin
+loader.env.USERNAME =
+loader.env.HOME =
+loader.env.PWD =
+loader.env.R_ARCH =
+loader.env.R_HOME = $(R_HOME)
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Host-level libraries (/lib/x86_64-linux-gnu) required by the R executable
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Host-level directory (/usr) required by the R executable
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+# Mount $R_HOME
+fs.mount.r_home.type = chroot
+fs.mount.r_home.path = $(R_HOME)
+fs.mount.r_home.uri = file:$(R_HOME)
+
+# Mount /tmp
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
+# size must be specified during signing. If R needs more virtual memory than
+# the enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 1G
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 4
+
+# SGX trusted libraries
+
+# Glibc libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Other libraries as dependencies of R (generated from ldd from the Makefile)
+sgx.trusted_files.stats_lib = file:$(R_HOME)/library/stats/libs/stats.so
+sgx.trusted_files.lapack = file:$(R_HOME)/modules/lapack.so
+$(R_TRUSTED_LIBS)
+
+# SGX untrusted (allowed) files/directories
+sgx.allowed_files.scripts = file:scripts
+sgx.allowed_files.tmp = file:/tmp
+sgx.allowed_files.r_etc = file:$(R_HOME)/etc
+sgx.allowed_files.r_lib = file:$(R_HOME)/library
+
+# Allow creating child enclaves for sh
+sgx.trusted_files.sh = file:/bin/sh
+sgx.trusted_children.sh = file:sh.sig
diff --git a/Examples/r/README.md b/Examples/r/README.md
new file mode 100644
index 00000000..5e64bd3a
--- /dev/null
+++ b/Examples/r/README.md
@@ -0,0 +1,43 @@
+# R example
+
+This directory contains an example for running R in Graphene, including the
+Makefile and a template for generating the manifest. The application was
+tested on Ubuntu 16.04, with both normal Linux and SGX platforms.
+
+# Generating the manifest
+
+## Building for Linux
+
+Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
+
+## Building for SGX
+
+Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory.
+
+## Building with a local R installation
+
+By default, the `make` command creates the manifest for the system R binary
+(`/usr/lib/R/bin/exec/R`). If you have a local R installation, you may create
+the manifest with the `R_HOME` variable set accordingly. For example:
+
+```
+make R_HOME=<install path>/lib/R SGX=1
+```
+
+# Run R with Graphene
+
+When running R with Graphene, please use the `--vanilla` or `--no-save` option.
+
+Here's an example of running an R script under Graphene:
+
+Without SGX:
+```
+./pal_loader R.manifest --slave --vanilla -f scripts/sample.r
+./pal_loader R.manifest --slave --vanilla -f scripts/R-benchmark-25.R
+```
+
+With SGX:
+```
+SGX=1 ./pal_loader R.manifest --slave --vanilla -f scripts/sample.r
+SGX=1 ./pal_loader R.manifest --slave --vanilla -f scripts/R-benchmark-25.R
+```
diff --git a/Examples/r/scripts/R-benchmark-25.R b/Examples/r/scripts/R-benchmark-25.R
new file mode 100644
index 00000000..404dcf97
--- /dev/null
+++ b/Examples/r/scripts/R-benchmark-25.R
@@ -0,0 +1,385 @@
+# R Benchmark 2.5 (06/2008) [Simon Urbanek]
+# version 2.5: scaled to get roughly 1s per test, R 2.7.0 @ 2.6GHz Mac Pro
+# R Benchmark 2.4 (06/2008) [Simon Urbanek]
+# version 2.4 adapted to more recent Matrix package
+# R Benchmark 2.3 (21 April 2004)
+# Warning: changes are not carefully checked yet!
+# version 2.3 adapted to R 1.9.0
+# Many thanks to Douglas Bates (bates@stat.wisc.edu) for improvements!
+# version 2.2 adapted to R 1.8.0
+# version 2.1 adapted to R 1.7.0
+# version 2, scaled to get 1 +/- 0.1 sec with R 1.6.2
+# using the standard ATLAS library (Rblas.dll)
+# on a Pentium IV 1.6 Ghz with 1 Gb Ram on Win XP pro
+
+# revised and optimized for R v. 1.5.x, 8 June 2002
+# Requires additionnal libraries: Matrix, SuppDists
+# Author : Philippe Grosjean
+# eMail  : phgrosjean@sciviews.org
+# Web    : http://www.sciviews.org
+# License: GPL 2 or above at your convenience (see: http://www.gnu.org)
+#
+# Several tests are adapted from the Splus Benchmark Test V. 2
+# by Stephan Steinhaus (stst@informatik.uni-frankfurt.de) 
+# Reference for Escoufier's equivalents vectors (test III.5):
+# Escoufier Y., 1970. Echantillonnage dans une population de variables
+# aleatoires réelles. Publ. Inst. Statis. Univ. Paris 19 Fasc 4, 1-47.
+#
+# type source("c:/<dir>/R2.R") to start the test
+
+runs <- 3			# Number of times the tests are executed
+times <- rep(0, 15); dim(times) <- c(5,3)
+require(Matrix)		# Optimized matrix operations
+require(SuppDists)	# Optimized random number generators
+#Runif <- rMWC1019	# The fast uniform number generator
+Runif <- runif
+# If you don't have SuppDists, you can use: Runif <- runif
+#a <- rMWC1019(10, new.start=TRUE, seed=492166)	# Init. the generator
+#Rnorm <- rziggurat	# The fast normal number generator
+# If you don't have SuppDists, you can use: Rnorm <- rnorm
+#b <- rziggurat(10, new.start=TRUE)	# Init. the generator
+Rnorm <- rnorm
+remove("a", "b")
+options(object.size=100000000)
+
+cat("\n\n   R Benchmark 2.5\n")
+cat("   ===============\n")
+cat(c("Number of times each test is run__________________________: ", runs))
+cat("\n\n")
+
+
+cat("   I. Matrix calculation\n")
+cat("   ---------------------\n")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (1)
+cumulate <- 0; a <- 0; b <- 0
+for (i in 1:runs) {
+  invisible(gc())
+  timing <- system.time({
+    a <- matrix(Rnorm(2500*2500)/10, ncol=2500, nrow=2500);
+    b <- t(a);
+    dim(b) <- c(1250, 5000);
+    a <- t(b)
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[1, 1] <- timing
+cat(c("Creation, transp., deformation of a 2500x2500 matrix (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (2)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- abs(matrix(Rnorm(2500*2500)/2, ncol=2500, nrow=2500));
+  invisible(gc())
+  timing <- system.time({ 
+    b <- a^1000 
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[2, 1] <- timing
+cat(c("2400x2400 normal distributed random matrix ^1000____ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (3)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- Rnorm(7000000)
+  invisible(gc())
+  timing <- system.time({
+    b <- sort(a, method="quick")	# Sort is modified in v. 1.5.x
+    # And there is now a quick method that better competes with other packages!!!
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[3, 1] <- timing
+cat(c("Sorting of 7,000,000 random values__________________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (4)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- Rnorm(2800*2800); dim(a) <- c(2800, 2800)
+  invisible(gc())
+  timing <- system.time({
+    b <- crossprod(a)		# equivalent to: b <- t(a) %*% a
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[4, 1] <- timing
+cat(c("2800x2800 cross-product matrix (b = a' * a)_________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (5)
+cumulate <- 0; c <- 0; qra <-0
+for (i in 1:runs) {
+  a <- new("dgeMatrix", x = Rnorm(2000*2000), Dim = as.integer(c(2000,2000)))
+  b <- as.double(1:2000)
+  invisible(gc())
+  timing <- system.time({
+    c <- solve(crossprod(a), crossprod(a,b))
+  })[3]
+  cumulate <- cumulate + timing
+  
+  # This is the old method
+  #a <- Rnorm(600*600); dim(a) <- c(600,600)
+  #b <- 1:600
+  #invisible(gc())
+  #timing <- system.time({
+  #  qra <- qr(a, tol = 1e-7);
+  #  c <- qr.coef(qra, b)
+  #  #Rem: a little faster than c <- lsfit(a, b, inter=F)$coefficients
+  #})[3]
+  #cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[5, 1] <- timing
+cat(c("Linear regr. over a 3000x3000 matrix (c = a \\ b')___ (sec): ", timing, "\n"))
+remove("a", "b", "c", "qra")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+times[ , 1] <- sort(times[ , 1])
+cat("                      --------------------------------------------\n")
+cat(c("                 Trimmed geom. mean (2 extremes eliminated): ", exp(mean(log(times[2:4, 1]))), "\n\n"))
+
+cat("   II. Matrix functions\n")
+cat("   --------------------\n")
+if (R.Version()$os == "Win32") flush.console()
+
+# (1)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- Rnorm(2400000)
+  invisible(gc())
+  timing <- system.time({
+    b <- fft(a)
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[1, 2] <- timing
+cat(c("FFT over 2,400,000 random values____________________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (2)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- array(Rnorm(600*600), dim = c(600, 600))
+  # Only needed if using eigen.Matrix(): Matrix.class(a)
+  invisible(gc())
+  timing <- system.time({
+  	b <- eigen(a, symmetric=FALSE, only.values=TRUE)$Value
+  	# Rem: on my machine, it is faster than:
+  #	 b <- La.eigen(a, symmetric=F, only.values=T, method="dsyevr")$Value
+  #	 b <- La.eigen(a, symmetric=F, only.values=T, method="dsyev")$Value
+  #  b <- eigen.Matrix(a, vectors = F)$Value
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[2, 2] <- timing
+cat(c("Eigenvalues of a 640x640 random matrix______________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (3)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- Rnorm(2500*2500); dim(a) <- c(2500, 2500)
+  #Matrix.class(a)
+  invisible(gc())
+  timing <- system.time({
+    #b <- determinant(a, logarithm=F)
+    # Rem: the following is slower on my computer!
+    # b <- det.default(a)
+    b <- det(a)
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[3, 2] <- timing
+cat(c("Determinant of a 2500x2500 random matrix____________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (4)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- crossprod(new("dgeMatrix", x = Rnorm(3000*3000),
+                       Dim = as.integer(c(3000, 3000))))
+  invisible(gc())
+  #a <- Rnorm(900*900); dim(a) <- c(900, 900)
+  #a <- crossprod(a, a)
+  timing <- system.time({
+    b <- chol(a)
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[4, 2] <- timing
+cat(c("Cholesky decomposition of a 3000x3000 matrix________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (5)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  a <- new("dgeMatrix", x = Rnorm(1600*1600), Dim = as.integer(c(1600, 1600)))
+  invisible(gc())
+  #a <- Rnorm(400*400); dim(a) <- c(400, 400)
+  timing <- system.time({
+  #  b <- qr.solve(a)
+    # Rem: a little faster than
+    b <- solve(a)
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[5, 2] <- timing
+cat(c("Inverse of a 1600x1600 random matrix________________ (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+times[ , 2] <- sort(times[ , 2])
+cat("                      --------------------------------------------\n")
+cat(c("                Trimmed geom. mean (2 extremes eliminated): ", exp(mean(log(times[2:4, 2]))), "\n\n"))
+
+cat("   III. Programmation\n")
+cat("   ------------------\n")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (1)
+cumulate <- 0; a <- 0; b <- 0; phi <- 1.6180339887498949
+for (i in 1:runs) {
+  a <- floor(Runif(3500000)*1000)
+  invisible(gc())
+  timing <- system.time({
+    b <- (phi^a - (-phi)^(-a))/sqrt(5)
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[1, 3] <- timing
+cat(c("3,500,000 Fibonacci numbers calculation (vector calc)(sec): ", timing, "\n"))
+remove("a", "b", "phi")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (2)
+cumulate <- 0; a <- 3000; b <- 0
+for (i in 1:runs) {
+  invisible(gc())
+  timing <- system.time({
+    b <- rep(1:a, a); dim(b) <- c(a, a);
+    b <- 1 / (t(b) + 0:(a-1))
+    # Rem: this is twice as fast as the following code proposed by R programmers
+    # a <- 1:a; b <- 1 / outer(a - 1, a, "+")
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[2, 3] <- timing
+cat(c("Creation of a 3000x3000 Hilbert matrix (matrix calc) (sec): ", timing, "\n"))
+remove("a", "b")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (3)
+cumulate <- 0; c <- 0
+gcd2 <- function(x, y) {if (sum(y > 1.0E-4) == 0) x else {y[y == 0] <- x[y == 0]; Recall(y, x %% y)}}
+for (i in 1:runs) {
+  a <- ceiling(Runif(400000)*1000)
+  b <- ceiling(Runif(400000)*1000)
+  invisible(gc())
+  timing <- system.time({	  
+    c <- gcd2(a, b)                            # gcd2 is a recursive function
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[3, 3] <- timing
+cat(c("Grand common divisors of 400,000 pairs (recursion)__ (sec): ", timing, "\n"))
+remove("a", "b", "c", "gcd2")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (4)
+cumulate <- 0; b <- 0
+for (i in 1:runs) {
+  b <- rep(0, 500*500); dim(b) <- c(500, 500)
+  invisible(gc())
+  timing <- system.time({
+  	# Rem: there are faster ways to do this
+  	# but here we want to time loops (220*220 'for' loops)! 
+    for (j in 1:500) {
+      for (k in 1:500) {
+        b[k,j] <- abs(j - k) + 1
+      }
+    }
+  })[3]
+  cumulate <- cumulate + timing
+}
+timing <- cumulate/runs
+times[4, 3] <- timing
+cat(c("Creation of a 500x500 Toeplitz matrix (loops)_______ (sec): ", timing, "\n"))
+remove("b", "j", "k")
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+# (5)
+cumulate <- 0; p <- 0; vt <- 0; vr <- 0; vrt <- 0; rvt <- 0; RV <- 0; j <- 0; k <- 0;
+x2 <- 0; R <- 0; Rxx <- 0; Ryy <- 0; Rxy <- 0; Ryx <- 0; Rvmax <- 0
+# Calculate the trace of a matrix (sum of its diagonal elements)
+Trace <- function(y) {sum(c(y)[1 + 0:(min(dim(y)) - 1) * (dim(y)[1] + 1)], na.rm=FALSE)}
+for (i in 1:runs) {
+  x <- abs(Rnorm(45*45)); dim(x) <- c(45, 45)
+  invisible(gc())
+  timing <- system.time({
+    # Calculation of Escoufier's equivalent vectors
+    p <- ncol(x)
+    vt <- 1:p                                  # Variables to test
+    vr <- NULL                                 # Result: ordered variables
+    RV <- 1:p                                  # Result: correlations
+    vrt <- NULL
+    for (j in 1:p) {                           # loop on the variable number
+      Rvmax <- 0
+      for (k in 1:(p-j+1)) {                   # loop on the variables
+        x2 <- cbind(x, x[,vr], x[,vt[k]])
+        R <- cor(x2)                           # Correlations table
+        Ryy <- R[1:p, 1:p]
+        Rxx <- R[(p+1):(p+j), (p+1):(p+j)]
+        Rxy <- R[(p+1):(p+j), 1:p]
+        Ryx <- t(Rxy)
+        rvt <- Trace(Ryx %*% Rxy) / sqrt(Trace(Ryy %*% Ryy) * Trace(Rxx %*% Rxx)) # RV calculation
+        if (rvt > Rvmax) {
+          Rvmax <- rvt                         # test of RV
+          vrt <- vt[k]                         # temporary held variable
+        }
+      }
+      vr[j] <- vrt                             # Result: variable
+      RV[j] <- Rvmax                           # Result: correlation
+      vt <- vt[vt!=vr[j]]                      # reidentify variables to test
+    }
+  })[3]
+  cumulate <- cumulate + timing
+}
+times[5, 3] <- timing
+cat(c("Escoufier's method on a 45x45 matrix (mixed)________ (sec): ", timing, "\n"))
+remove("x", "p", "vt", "vr", "vrt", "rvt", "RV", "j", "k")
+remove("x2", "R", "Rxx", "Ryy", "Rxy", "Ryx", "Rvmax", "Trace") 
+if (R.Version()$os == "Win32" || R.Version()$os == "mingw32") flush.console()
+
+times[ , 3] <- sort(times[ , 3])
+cat("                      --------------------------------------------\n")
+cat(c("                Trimmed geom. mean (2 extremes eliminated): ", exp(mean(log(times[2:4, 3]))), "\n\n\n"))
+
+cat(c("Total time for all 15 tests_________________________ (sec): ", sum(times), "\n"))
+cat(c("Overall mean (sum of I, II and III trimmed means/3)_ (sec): ", exp(mean(log(times[2:4, ]))), "\n"))
+remove("cumulate", "timing", "times", "runs", "i")
+cat("                      --- End of test ---\n\n")   
diff --git a/Examples/r/scripts/sample.r b/Examples/r/scripts/sample.r
new file mode 100644
index 00000000..95f08237
--- /dev/null
+++ b/Examples/r/scripts/sample.r
@@ -0,0 +1,4 @@
+print(sample(1:3))
+print(sample(1:3, size=3, replace=FALSE))  # same as previous line
+print(sample(c(2,5,3), size=4, replace=TRUE))
+print(sample(1:2, size=10, prob=c(1,3), replace=TRUE))
diff --git a/Examples/r/sh.manifest.template b/Examples/r/sh.manifest.template
new file mode 100644
index 00000000..87a4c22d
--- /dev/null
+++ b/Examples/r/sh.manifest.template
@@ -0,0 +1,41 @@
+# sh manifest example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+# The executable to load in Graphene.
+loader.exec = file:/bin/sh
+
+# Graphene environment, including the path of the library OS and the debug
+# option (inline/none).
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.debug_type = $(GRAPHENEDEBUG)
+
+# Environment variables
+loader.env.LD_LIBRARY_PATH = /lib
+
+# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
+# guest. Other parts of the host FS will not be available in the guest.
+
+# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# SGX general options
+
+# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave size
+# must be specified during signing. If sh needs more virtual memory than the
+# enclave size, Graphene will not be able to allocate it.
+sgx.enclave_size = 256M
+
+# Set the maximum number of enclave threads. For SGX v1, the number of enclave
+# TCSes must be specified during signing, so the application cannot use more
+# threads than the number of TCSes. Note that Graphene also creates an internal
+# thread for handling inter-process communication (IPC), and potentially another
+# thread for asynchronous events. Therefore, the actual number of threads that
+# the application can create is (sgx.thread_num - 2).
+sgx.thread_num = 2
+
+# SGX trusted libraries
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
diff --git a/Examples/redis/.gitignore b/Examples/redis/.gitignore
new file mode 100644
index 00000000..4c71eb34
--- /dev/null
+++ b/Examples/redis/.gitignore
@@ -0,0 +1,3 @@
+/redis.tar.gz
+/redis-server
+/src
diff --git a/Examples/redis/Makefile b/Examples/redis/Makefile
new file mode 100644
index 00000000..575daca9
--- /dev/null
+++ b/Examples/redis/Makefile
@@ -0,0 +1,121 @@
+# Build Redis as follows:
+#
+# - make               -- create non-SGX no-debug-log manifest
+# - make SGX=1         -- create SGX no-debug-log manifest
+# - make SGX=1 DEBUG=1 -- create SGX debug-log manifest
+#
+# Any of these invocations clones Redis' git repository and builds Redis in
+# default configuration and in the latest-to-date (5.0.5) version.
+#
+# By default, Redis uses poll/epoll mechanism of Linux. To build Redis with
+# select, use `make USE_SELECT=1`. For correct re-builds, always clean up
+# Redis source code beforehand via `make distclean`.
+#
+# Use `make clean` to remove Graphene-generated files and `make distclean` to
+# additionally remove the cloned Redis git repository.
+
+################################# CONSTANTS ###################################
+
+# Relative path to Graphene root
+GRAPHENEDIR = ../../../../..
+
+SRCDIR = src
+COMMIT = 5.0.5
+TAR_SHA256 = 3313d5e09938dc6e16c6911efa4a24b1c494bacb5a917a8e7925ebd55e56be85
+
+ifeq ($(DEBUG),1)
+GRAPHENEDEBUG = inline
+else
+GRAPHENEDEBUG = none
+endif
+
+.PHONY: all
+all: redis-server redis-server.manifest pal_loader
+ifeq ($(SGX),1)
+all: redis-server.manifest.sgx
+endif
+
+############################## REDIS EXECUTABLE ###############################
+
+# Redis is built as usual, without any changes to the build process (except to
+# test select syscall instead of poll/epoll). The source is downloaded from the
+# GitHub repo (5.0.5 tag) and built via `make`. The result of this build process
+# is the final executable "src/redis-server".
+
+$(SRCDIR)/Makefile:
+	$(GRAPHENEDIR)/Scripts/download --output redis.tar.gz \
+		--sha256 $(TAR_SHA256) \
+		--url https://github.com/antirez/redis/archive/$(COMMIT).tar.gz
+	mkdir $(SRCDIR)
+	tar -C $(SRCDIR) --strip-components=1 -xf redis.tar.gz
+
+ifeq ($(USE_SELECT),1)
+$(SRCDIR)/src/redis-server: $(SRCDIR)/Makefile
+	sed -i 's|#define HAVE_EPOLL 1|/* no HAVE_EPOLL */|g' src/src/config.h
+	$(MAKE) -C $(SRCDIR)
+else
+$(SRCDIR)/src/redis-server: $(SRCDIR)/Makefile
+	$(MAKE) -C $(SRCDIR)
+endif
+
+################################ REDIS MANIFEST ###############################
+
+# The template file contains almost all necessary information to run Redis
+# under Graphene / Graphene-SGX. We create redis.manifest (to be run under
+# non-SGX Graphene) by simply replacing variables in the template file via sed.
+
+redis-server.manifest: redis-server.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		$< > $@
+
+# Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This
+# procedure measures all Redis dependencies (shared libraries and trusted
+# files), measures Redis code/data pages, and adds measurements in the
+# resulting manifest.sgx file (among other, less important SGX options).
+#
+# Additionally, Graphene-SGX requires EINITTOKEN and SIGSTRUCT objects (see
+# SGX hardware ABI, in particular EINIT instruction). The "pal-sgx-get-token"
+# script generates these objects and puts them in files .token and .sig
+# respectively. Note that filenames must be the same as the executable/manifest
+# name (i.e., "redis-server").
+
+redis-server.manifest.sgx: redis-server.manifest $(SRCDIR)/src/redis-server
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@ \
+		-exec $(SRCDIR)/src/redis-server
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output redis-server.token -sig redis-server.sig
+
+########################### COPIES OF EXECUTABLES #############################
+
+# Redis build process creates the final executable as src/redis-server. For
+# simplicity, copy it into our root directory.
+# Also, create a link to pal_loader for simplicity.
+
+redis-server: $(SRCDIR)/src/redis-server
+	cp $< $@
+
+pal_loader:
+	ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
+
+############################## RUNNING TESTS ##################################
+.PHONY: start-native-server
+start-native-server: all
+	./redis-server --save '' --protected-mode no
+
+.PHONY: start-graphene-server
+start-graphene-server: all
+	./pal_loader redis-server --save '' --protected-mode no
+
+################################## CLEANUP ####################################
+
+.PHONY: clean
+clean:
+	$(RM) *.token *.sig *.manifest.sgx *.manifest pal_loader redis-server *.rdb
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r $(SRCDIR) redis.tar.gz
diff --git a/Examples/redis/README b/Examples/redis/README
new file mode 100644
index 00000000..eae5b93d
--- /dev/null
+++ b/Examples/redis/README
@@ -0,0 +1,49 @@
+# Redis
+
+This directory contains the Makefile and the template manifest for the most
+recent version of Redis (as of this writing, version 5.0.5). This was tested
+on a machine with SGX v1 and Ubuntu 16.04.
+
+The Makefile and the template manifest contain extensive comments and are made
+self-explanatory. Please review them to gain understanding of Graphene-SGX
+and requirements for applications running under Graphene-SGX.
+
+# Quick Start
+
+```sh
+# build Redis and the final manifest
+make SGX=1
+
+# run original Redis against a benchmark (redis-benchmark supplied with Redis)
+./redis-server --save '' --protected-mode no &
+src/src/redis-benchmark
+kill %%
+
+# run Redis in non-SGX Graphene against a benchmark
+./pal_loader redis-server --save '' --protected-mode no &
+src/src/redis-benchmark
+kill %%
+
+# run Redis in Graphene-SGX against a benchmark
+SGX=1 ./pal_loader redis-server --save '' --protected-mode no &
+src/src/redis-benchmark
+kill %%
+```
+
+# Why this Redis configuration?
+
+Notice that we run Redis with two parameters: `save ''` and `protected-mode no`:
+
+- `save ''` disables saving DB to disk (both RDB snapshots and AOF logs). We
+  use this parameter to side-step some bugs in Graphene triggered during the
+  graceful shutdown of Redis.
+
+- `protected-mode no` allows clients to connect to Redis on any network
+  interface. Even though we use the loopback interface (which is always allowed
+  in Redis), Graphene hides this information. Therefore, we ask Redis to allow
+  clients on all interfaces.
+
+# Redis with Select
+
+By default, Redis uses the epoll mechanism of Linux to monitor client connections.
+To test Redis with select, add `USE_SELECT=1`, e.g., `make SGX=1 USE_SELECT=1`.
diff --git a/Examples/redis/redis-server.manifest.template b/Examples/redis/redis-server.manifest.template
new file mode 100644
index 00000000..3e6a7fcb
--- /dev/null
+++ b/Examples/redis/redis-server.manifest.template
@@ -0,0 +1,156 @@
+# Redis manifest file example
+#
+# This manifest was prepared and tested on Ubuntu 16.04.
+
+################################## RUNNING ####################################
+
+# Executable to load into Graphene and run. Note that Graphene tries its best
+# to find the corresponding manifest file (by appending ".manifest" or
+# ".manifest.sgx") based on the executable name, and vice versa. Still, it is
+# required to have the explicit name of the executable here.
+loader.exec = file:redis-server
+
+################################## GRAPHENE ###################################
+
+# LibOS layer library of Graphene. There is currently only one implementation,
+# so it is always set to libsysdb.so. Note that GRAPHENEDIR macro is expanded
+# to relative path to Graphene repository in the Makefile as part of the
+# build process.
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+
+# Show/hide debug log of Graphene ('inline' or 'none' respectively). Note that
+# GRAPHENEDEBUG macro is expanded to inline/none in the Makefile as part of the
+# build process.
+loader.debug_type = $(GRAPHENEDEBUG)
+
+################################# ENV VARS  ###################################
+
+# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
+# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
+# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
+#
+# In case of Redis:
+# - /lib is searched for Glibc libraries (ld, libc, libpthread)
+# - /lib/x86_64-linux-gnu is searched for Name Service Switch (NSS) libraries
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu
+
+################################# MOUNT FS  ###################################
+
+# General notes:
+# - There is only one supported type of mount points: 'chroot'.
+# - Directory names are (somewhat confusingly) prepended by 'file:'.
+# - Names of mount entries (lib, lib2, lib3) are irrelevant but must be unique.
+# - In-Graphene visible path names may be arbitrary but we reuse host-OS URIs
+#   for simplicity (except for the first 'lib' case).
+
+# Mount host-OS directory to Graphene glibc/runtime libraries (in 'uri') into
+# in-Graphene visible directory /lib (in 'path'). Note that GRAPHENEDIR macro
+# is expanded to relative path to Graphene repository in the Makefile as part
+# of the build process.
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Mount host-OS directory to Name Service Switch (NSS) libraries (in 'uri')
+# into in-Graphene visible directory /lib/x86_64-linux-gnu (in 'path').
+fs.mount.lib2.type = chroot
+fs.mount.lib2.path = /lib/x86_64-linux-gnu
+fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
+
+# Mount host-OS directory to NSS files required by Glibc + NSS libs (in 'uri')
+# into in-Graphene visible directory /etc (in 'path').
+fs.mount.etc.type = chroot
+fs.mount.etc.path = /etc
+fs.mount.etc.uri = file:/etc
+
+################################## NETWORK ####################################
+
+# Allow binding on any network interface but only on port 6379. This is the
+# default port used by Redis. Note how a missing interface name means "any
+# interface".
+net.allow_bind.redisport = :6379
+
+############################### SGX: GENERAL ##################################
+
+# Set enclave size (somewhat arbitrarily) to 1024MB. Recall that SGX v1 requires
+# to specify enclave size at enclave creation time. If Redis exhausts these
+# 1024MB then it will start failing with random errors. Greater enclave sizes
+# result in longer startup times, smaller enclave sizes are not enough for
+# typical Redis workloads.
+sgx.enclave_size = 1024M
+
+# Set maximum number of in-enclave threads (somewhat arbitrarily) to 8. Recall
+# that SGX v1 requires to specify the maximum number of simulteneous threads at
+# enclave creation time.
+#
+# Note that internally Graphene may spawn two additional threads, one for IPC
+# and one for asynchronous events/alarms. Redis is technically single-threaded
+# but spawns couple additional threads to do background bookkeeping. Therefore,
+# specifying '8' allows to run a maximum of 6 Redis threads which is enough.
+sgx.thread_num = 8
+
+############################# SGX: TRUSTED LIBS ###############################
+
+# Specify all libraries used by Redis and its dependencies (including all
+# libraries which can be loaded at runtime via dlopen). The paths to libraries
+# are host-OS paths. These libraries will be searched for in in-Graphene visible
+# paths according to mount points above.
+#
+# As part of the build process, Graphene-SGX script (`pal-sgx-sign`) finds each
+# specified library, measures its hash, and outputs the hash in auto-generated
+# entry 'sgx.trusted_checksum.xxx' in auto-generated redis-server.manifest.sgx.
+# Note that this happens on the developer machine.
+#
+# At runtime, during loading of this library, Graphene-SGX measures its hash
+# and compares with the one specified in 'sgx.trusted_checksum.xxx'. If hashes
+# match, this library is trusted and allowed to be loaded and used. Note that
+# this happens on the client machine.
+
+# Glibc libraries. ld, libc, libm, libdl, librt provide common functionality;
+# pthread is needed because Redis spawns helper threads for bookkeeping.
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+
+# Name Service Switch (NSS) libraries. Glibc calls these libraries as part of
+# name-service information gathering. libnss_{compat,files,nis} are the
+# most widely used libraries, at least on Ubuntu.
+# For more info, see 'man nsswitch.conf'.
+sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
+sgx.trusted_files.libnssfiles  = file:/lib/x86_64-linux-gnu/libnss_files.so.2
+sgx.trusted_files.libnssnis  = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
+
+# libNSL is a dependency of libnss_compat above. It is a good example of nested
+# library dependencies required by Graphene-SGX.
+sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
+
+############################ SGX: TRUSTED FILES ###############################
+
+# Trusted no-library files include configuration files, read-only files, and
+# other static files. It is useful to specify such files here to make sure
+# they are not maliciously modified (modifications will be detected as hash
+# mismatch by Graphene-SGX).
+#
+# Redis by default does not use configuration files, so this section is empty.
+# sgx.trusted_files.config = file:<important-configuration-file>
+
+############################# SGX: ALLOWED FILES ###############################
+
+# Specify all non-static files used by app. These files may be accessed by
+# Graphene-SGX but their integrity is not verified (Graphene-SGX does not
+# measure their hashes). This may pose a security risk!
+
+# Name Service Switch (NSS) files. Glibc reads these files as part of name-
+# service information gathering. For more info, see 'man nsswitch.conf'.
+sgx.allowed_files.nsswitch  = file:/etc/nsswitch.conf
+sgx.allowed_files.ethers    = file:/etc/ethers
+sgx.allowed_files.hosts     = file:/etc/hosts
+sgx.allowed_files.group     = file:/etc/group
+sgx.allowed_files.passwd    = file:/etc/passwd
+
+# getaddrinfo(3) configuration file. Glibc reads this file to correctly find
+# network addresses. For more info, see 'man gai.conf'.
+sgx.allowed_files.gaiconf   = file:/etc/gai.conf
diff --git a/Examples/tensorflow/.gitignore b/Examples/tensorflow/.gitignore
new file mode 100644
index 00000000..ca13728d
--- /dev/null
+++ b/Examples/tensorflow/.gitignore
@@ -0,0 +1,2 @@
+/tensorflow
+/tensorflow.tar.gz
diff --git a/Examples/tensorflow/Makefile b/Examples/tensorflow/Makefile
new file mode 100644
index 00000000..57b57ee1
--- /dev/null
+++ b/Examples/tensorflow/Makefile
@@ -0,0 +1,99 @@
+manifests = $(addsuffix .manifest,label_image)
+exec_target = $(manifests)
+target = label_image
+
+GRAPHENEDIR ?= ../../../../..
+TF_DIR ?= tensorflow
+BAZEL_BIN ?= $(HOME)/bin/bazel
+
+GIT_COMMIT ?= v1.9.0
+TAR_SHA256 ?= ffc3151b06823d57b4a408261ba8efe53601563dfe93af0866751d4f6ca5068c
+
+PHONY: default
+default: label_image.manifest
+ifeq ($(SGX),1)
+default: label_image.manifest.sgx
+endif
+
+$(TF_DIR)/configure:
+	$(GRAPHENEDIR)/Scripts/download --output tensorflow.tar.gz --sha256 $(TAR_SHA256)\
+	       --url https://github.com/tensorflow/tensorflow/archive/$(GIT_COMMIT).tar.gz
+	mkdir $(TF_DIR)
+	tar -C $(TF_DIR) --strip-components=1 -xf tensorflow.tar.gz
+
+$(TF_DIR)/bazel-bin/tensorflow/contrib/lite/examples/label_image/label_image: $(TF_DIR)/configure
+	cd $(TF_DIR) && $(BAZEL_BIN) build tensorflow/contrib/lite/examples/label_image
+
+label_image: $(TF_DIR)/bazel-bin/tensorflow/contrib/lite/examples/label_image/label_image
+	cp $^ .
+
+libtensorflow_framework.so: label_image
+	cp $(TF_DIR)/bazel-bin/tensorflow/libtensorflow_framework.so $@
+
+INCEPTION_HASH=b1a1f91276e48a9ddf0cb0d854f044ebfbf985dc2c2cedceb52b3d668894299a
+inception_v3.tflite:
+	$(GRAPHENEDIR)/Scripts/download --output inception_v3_2018_04_27.tgz --sha256 $(INCEPTION_HASH)\
+	       --url https://storage.googleapis.com/download.tensorflow.org/models/tflite/model_zoo/upload_20180427/inception_v3_2018_04_27.tgz
+	tar xfz inception_v3_2018_04_27.tgz
+
+labels.txt: $(TF_DIR)/tensorflow/contrib/lite/java/ovic/src/testdata/labels.txt
+	cp $^ $@
+
+image.bmp: $(TF_DIR)/tensorflow/contrib/lite/examples/label_image/testdata/grace_hopper.bmp
+	cp $^ $@
+
+$(GRAPHENEDIR)/Runtime/libgcc_s.so.1:
+	cp /lib/x86_64-linux-gnu/libgcc_s.so.1 $@
+
+$(GRAPHENEDIR)/Runtime/libstdc++.so.6:
+	cp /usr/lib/x86_64-linux-gnu/libstdc++.so.6 $@
+
+label_image.manifest: libtensorflow_framework.so label_image inception_v3.tflite labels.txt image.bmp
+label_image.manifest: $(GRAPHENEDIR)/Runtime/libgcc_s.so.1 $(GRAPHENEDIR)/Runtime/libstdc++.so.6
+label_image.manifest: label_image.manifest.template
+	sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
+		-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
+		$< > $@
+
+label_image.manifest.sgx: label_image.manifest
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
+		-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
+		-key $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem \
+		-manifest $< -output $@ \
+		-exec label_image
+	$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token \
+		-output label_image.token -sig label_image.sig
+
+.PHONY: check
+check: default
+	$(GRAPHENEDIR)/Runtime/pal_loader ./label_image -m inception_v3.tflite -i image.bmp -t 1
+
+.PHONY: run-native
+run-native: default
+	./label_image -m inception_v3.tflite -i image.bmp -t 1
+
+.PHONY: run-graphene
+run-graphene: default
+	$(GRAPHENEDIR)/Runtime/pal_loader ./label_image -m inception_v3.tflite -i image.bmp -t 1
+
+.PHONY: clean
+clean:
+	$(RM) label_image.manifest label_image.manifest.sgx label_image.sig label_image.token
+
+.PHONY: distclean
+distclean: clean
+	$(RM) -r label_image
+	$(RM) inception_v3_2018_04_27.tgz inception_v3.pb inception_v3.tflite labels.txt image.bmp
+	$(RM) -r $(TF_DIR) tensorflow.tar.gz libtensorflow_framework.so
+
+BAZEL_INSTALLER_HASH=17ab70344645359fd4178002f367885e9019ae7507c9c1ade8220f3628383444
+.PHONY: install-dependencies-ubuntu
+install-dependencies-ubuntu:
+	apt-get update
+	apt-get install -y python-dev python-pip wget git
+	# https://docs.bazel.build/versions/master/install-ubuntu.html
+	apt-get install -y pkg-config zip g++ zlib1g-dev unzip python
+	$(GRAPHENEDIR)/Scripts/download --output bazel-0.16.1-installer-linux-x86_64.sh --sha256 $(BAZEL_INSTALLER_HASH)\
+		--url https://github.com/bazelbuild/bazel/releases/download/0.16.1/bazel-0.16.1-installer-linux-x86_64.sh
+	chmod +x bazel-0.16.1-installer-linux-x86_64.sh
+	./bazel-0.16.1-installer-linux-x86_64.sh --user
diff --git a/Examples/tensorflow/README.md b/Examples/tensorflow/README.md
new file mode 100644
index 00000000..a3ec793c
--- /dev/null
+++ b/Examples/tensorflow/README.md
@@ -0,0 +1,17 @@
+This example demonstrates how to run TensorFlow (v1.9) Lite's label_image example on Graphene. Reads an input image `image.bmp` from the current directory and uses TensorFlow lite and the Inception v3 model to label the image.
+
+Known limitations:
+
+- Tested on Ubuntu 16.04 with Graphene [commit 030a088](https://github.com/oscarlab/graphene/tree/030a0888926f315710da94ee6f855c466059cf6c). Ubuntu 18.04 should work, but have not tested.
+- Currently single threaded. Multi-threaded not tested.
+
+To install build dependencies on Ubuntu 16.04 there is a convenience target invoked with `make install-dependencies-ubuntu`. This also serves as a starting point to figure out which packages to install on newer releases of Ubuntu.
+
+To build TensorFlow and Graphene artifacts:
+- without SGX do `make`
+- with SGX do `make SGX=1 `
+
+To run the image labeling example of TensorFlow:
+- without Graphene do `make run-native`
+- with Graphene do `make run-graphene`
+- with Graphene-SGX do `make SGX=1 run-graphene`
diff --git a/Examples/tensorflow/label_image.manifest.template b/Examples/tensorflow/label_image.manifest.template
new file mode 100644
index 00000000..86fab68f
--- /dev/null
+++ b/Examples/tensorflow/label_image.manifest.template
@@ -0,0 +1,32 @@
+#!$(PAL)
+
+loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
+loader.exec = file:label_image
+loader.env.LD_LIBRARY_PATH = /lib:.
+loader.env.PATH = /bin:/usr/bin
+loader.debug_type = none
+
+fs.mount.lib1.type = chroot
+fs.mount.lib1.path = /lib
+fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime
+
+# Minimum amount of memory to make it work.
+sgx.enclave_size = 512M
+
+# Graphene internally consumes up to 2 threads; one thread available to label_image, i.e., must be
+# run with -t 1 as its command line parameter (see Makefile's check target).
+sgx.thread_num = 3
+
+sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
+sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
+sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
+sgx.trusted_files.libcpp = file:$(GRAPHENEDIR)/Runtime/libstdc++.so.6
+sgx.trusted_files.libgcc = file:$(GRAPHENEDIR)/Runtime/libgcc_s.so.1
+sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
+sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
+sgx.trusted_files.libtensorflowframework = file:libtensorflow_framework.so
+
+sgx.trusted_files.model = file:inception_v3.tflite
+sgx.allowed_files.image = file:image.bmp
+sgx.trusted_files.labels = file:labels.txt
diff --git a/LibOS/shim/test/apps b/LibOS/shim/test/apps
deleted file mode 160000
index aebe8e11..00000000
--- a/LibOS/shim/test/apps
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit aebe8e11409bd36d1c03f4a0e8cc9945bc18a813
diff --git a/LibOS/shim/test/ltp/.gitignore b/LibOS/shim/test/ltp/.gitignore
new file mode 100644
index 00000000..48531cc5
--- /dev/null
+++ b/LibOS/shim/test/ltp/.gitignore
@@ -0,0 +1,2 @@
+opt/
+ltp*.xml
diff --git a/LibOS/shim/test/ltp/Makefile b/LibOS/shim/test/ltp/Makefile
new file mode 100644
index 00000000..354ed768
--- /dev/null
+++ b/LibOS/shim/test/ltp/Makefile
@@ -0,0 +1,55 @@
+include makevars.mk
+
+target = $(TESTCASEDIR)/pal_loader build-manifest
+exec_target =
+
+clean-extra = clean-build
+
+include Makefile.Test
+
+$(SRCDIR)/Makefile:
+	$(error "$(SRCDIR) is empty. Please run `git submodule update --init $(SRCDIR)` or download the LTP source code (https://github.com/linux-test-project/ltp) into $(SRCDIR).")
+
+$(SRCDIR)/configure: $(SRCDIR)/Makefile
+	cd $(SRCDIR) && $(MAKE) autotools
+
+$(BUILDDIR)/runltp: $(SRCDIR)/configure
+	cd $(SRCDIR) && ./configure
+	cd $(SRCDIR) && $(MAKE) all
+	cd $(SRCDIR) && $(MAKE) "DESTDIR=$(PWD)" SKIP_IDCHECK=1 install
+
+$(TESTCASEDIR)/pal_loader: $(BUILDDIR)/runltp
+	ln -sf $(call relative-to,$(dir $@),../../../Runtime/pal_loader) $@
+
+build-manifest: $(TESTCASEDIR)/manifest.template $(TESTCASEDIR)/Makefile
+	cd $(TESTCASEDIR) && $(MAKE)
+
+$(TESTCASEDIR)/manifest.template: manifest.template
+	cp -f $< $@
+
+$(TESTCASEDIR)/Makefile: Makefile.testcases
+	ln -sf $(abspath $<) $@
+
+.PHONY: sgx-tokens
+sgx-tokens: build-manifest
+	$(MAKE) -C $(TESTCASEDIR) $@
+
+.PHONY: regression
+regression:
+	if test "$(SGX)" -eq 1; then \
+		$(RM) ltp-sgx.xml; \
+		$(MAKE) ltp-sgx.xml; \
+	else \
+		$(RM) ltp.xml; \
+		$(MAKE) ltp.xml; \
+	fi
+
+%.xml: %.cfg ltp-bug-1248.cfg ltp-bug-1075.cfg $(LTPSCENARIO) $(target)
+	./contrib/conf_lint.py < $<
+	./runltp_xml.py $(RUNLTPOPTS) -c $< $(LTPSCENARIO) > $@
+
+ltp-sgx.xml: RUNLTPOPTS += -c ltp-bug-1075.cfg
+
+clean-build:
+	cd $(SRCDIR) && $(MAKE) clean
+	rm -rf opt ltp*.xml
diff --git a/LibOS/shim/test/ltp/Makefile.Test b/LibOS/shim/test/ltp/Makefile.Test
new file mode 100644
index 00000000..1c09a79b
--- /dev/null
+++ b/LibOS/shim/test/ltp/Makefile.Test
@@ -0,0 +1,130 @@
+LTP_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+
+SYS ?= $(shell gcc -dumpmachine)
+export SYS
+
+PALDIR  = $(LTP_DIR)/../../../../../Pal/src
+SHIMDIR = $(LTP_DIR)/../../../src
+RUNTIME = $(LTP_DIR)/../../../../../Runtime
+
+ifeq ($(SGX),1)
+PAL_LOADER = pal_loader SGX
+else
+PAL_LOADER = pal_loader
+endif
+
+CC = gcc
+CXX = g++
+CFLAGS =
+CXXFLAGS =
+LDFLAGS =
+
+.PHONY: default
+default: all
+
+expand_target_to_token = $(foreach t,$(filter-out manifest,$(1)),$(patsubst %.manifest,%,$(t)).token)
+ifeq ($(SGX),1)
+expand_target = $(1) $(foreach t,$(filter-out manifest,$(1)), \
+                $(patsubst %.manifest,%,$(t)).manifest.sgx)
+else
+expand_target = $(1)
+endif
+
+.PHONY: all
+all: pal_loader $(target) | $(call expand_target,$(exec_target))
+
+.PHONY: sgx-tokens
+sgx-tokens: $(call expand_target_to_token,$(exec_target))
+
+ifeq ($(DEBUG),1)
+CC += -g
+CXX += -g
+endif
+export DEBUG
+
+ifeq ($(WERROR),1)
+CFLAGS += -Werror
+endif
+
+ifeq ($(ABSPATH_IN_MANIFEST),yes)
+manifest_rules = \
+	-e 's:\$$(PAL):$(abspath $(RUNTIME))/$(PAL_LOADER):g' \
+	-e 's:\$$(PWD):$(PWD):g' \
+	-e 's:\$$(BIN):$(subst .manifest,,$(notdir $@)):g' \
+	-e 's:\$$(SHIMPATH):$(abspath $(RUNTIME))/libsysdb.so:g' \
+	-e 's:\$$(LIBCDIR):$(abspath $(RUNTIME)):g' \
+	$(extra_rules)
+else
+manifest_rules= \
+	-e 's:\$$(PAL):$(abspath $(RUNTIME))/$(PAL_LOADER):g' \
+	-e 's:\$$(PWD):$(PWD):g' \
+	-e 's:\$$(BIN):$(subst .manifest,,$(notdir $@)):g' \
+	-e 's:\$$(SHIMPATH):'$$RELDIR'$(RUNTIME)/libsysdb.so:g' \
+	-e 's:\$$(LIBCDIR):'$$RELDIR'$(RUNTIME):g' \
+	$(extra_rules)
+endif
+
+pal_loader:
+	ln -sf $(RUNTIME)/pal_loader
+
+relative-to = $(shell python -c "import os.path; print os.path.relpath(\"$(abspath $2)\",\"$(abspath $1)\")")
+
+%.manifest: %.manifest.template
+	@echo [ $@ ]
+	RELDIR=$(filter-out ./,$(call relative-to,$(dir $@),$(shell pwd))/) && \
+	sed $(manifest_rules) $< > $@
+	(grep -q '^#!' $@ && chmod +x $@) || true
+
+manifest: manifest.template
+	@echo [ $@ ]
+	sed $(manifest_rules) $< > $@
+
+ifeq ($(SGX),1)
+SGX_DIR = $(PALDIR)/host/Linux-SGX
+RUNTIME_DIR = $(RUNTIME)
+
+LIBPAL = $(RUNTIME_DIR)/libpal-Linux-SGX.so
+SGX_SIGNER_KEY ?= $(SGX_DIR)/signer/enclave-key.pem
+SGX_SIGN = $(SGX_DIR)/signer/pal-sgx-sign -libpal $(LIBPAL) -key $(SGX_SIGNER_KEY)
+SGX_GET_TOKEN = $(SGX_DIR)/signer/pal-sgx-get-token
+
+# sgx manifest.sgx/sig/token
+drop_manifest_suffix = $(filter-out manifest,$(sort $(patsubst %.manifest,%,$(1))))
+expand_target_to_token = $(addsuffix .token,$(call drop_manifest_suffix, $(1)))
+expand_target_to_sig = $(addsuffix .sig,$(call drop_manifest_suffix,$(1)))
+expand_target_to_sgx = $(addsuffix .manifest.sgx,$(call drop_manifest_suffix,$(1)))
+
+%.token: %.sig
+	@echo [ $@ ]
+	@$(SGX_GET_TOKEN) -output $@ -sig $^ > .output.sgx_get_token.$(basename $*)
+
+%.sig %.manifest.sgx: %.manifest % $(LIBPAL) $(SGX_SIGNER_KEY) %.manifest.sgx.d
+	@echo [ $@ ]
+	@$(SGX_SIGN) -output $*.manifest.sgx -exec $* -manifest $< > .output.sgx_sign.$*
+
+%.sig %.manifest.sgx: manifest % $(LIBPAL) $(SGX_SIGNER_KEY) %.manifest.sgx.d
+	@echo [ $@ ]
+	@$(SGX_SIGN) -output $*.manifest.sgx -exec $* -manifest $< > .output.sgx_sign.$*
+
+%.sig %.manifest.sgx: %.manifest $(LIBPAL) $(SGX_SIGNER_KEY) %.manifest.sgx.d
+	@echo [ $@ ]
+	@$(SGX_SIGN) -output $*.manifest.sgx -manifest $< > .output.sgx_sign.$*
+
+.PRECIOUS: %.manifest.sgx.d
+
+%.manifest.sgx.d: %.manifest
+	@echo [ $@ ]
+	@$(SGX_SIGN) -depend -output $@ -exec $* -manifest $<
+
+%.manifest.sgx.d: manifest
+	@echo [ $@ ]
+	@$(SGX_SIGN) -depend -output $@ -manifest $<
+
+ifeq ($(filter clean,$(MAKECMDGOALS)),)
+include $(addsuffix .manifest.sgx.d,$(call drop_manifest_suffix,$(exec_target)))
+endif
+endif
+
+.PHONY: clean
+clean: $(clean-extra)
+	rm -rf pal_loader $(exec_target) *.token *.sig *.manifest.sgx $(target) $(wildcard *.d) .output.*
diff --git a/LibOS/shim/test/ltp/Makefile.testcases b/LibOS/shim/test/ltp/Makefile.testcases
new file mode 100644
index 00000000..07c12ddd
--- /dev/null
+++ b/LibOS/shim/test/ltp/Makefile.testcases
@@ -0,0 +1,24 @@
+include ../../../../makevars.mk
+
+manifests = $(wildcard $(ROOTDIR)/*.manifest.template) manifest
+testcases = $(shell cd $(ROOTDIR); \
+	./runltp_xml.py $(RUNLTPOPTS) -c ltp-sgx.cfg --list-executables $(LTPSCENARIO))
+
+exec_target = $(testcases)
+target = $(manifests) $(testcases) etc/nsswitch.conf etc/passwd
+
+include $(ROOTDIR)/Makefile.Test
+
+$(addsuffix .template,$(manifests)): %: ../../../../%
+	ln -sf $< $@
+
+etc/nsswitch.conf:
+	mkdir -p etc
+	echo "passwd: compat\ngroup: compat\nshadow: compat\nhosts: files" > $@
+
+etc/passwd:
+	mkdir -p etc
+	echo "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin" > $@
+
+.PHONY: sgx-tokens
+sgx-tokens: $(call expand_target_to_token,$(testcases))
diff --git a/LibOS/shim/test/ltp/README.rst b/LibOS/shim/test/ltp/README.rst
new file mode 100644
index 00000000..ec419fba
--- /dev/null
+++ b/LibOS/shim/test/ltp/README.rst
@@ -0,0 +1,95 @@
+LTP FOR GRAPHENE
+================
+
+Just run ``make regression``, or ``make SGX=1 regression``.
+
+Test results are reported as an XML file, ``ltp.xml`` or ``ltp-sgx.xml``, which
+is for consumption in Jenkins. There is also rudimentary logging.
+
+To run a single testcase, execute the following commands::
+
+    cd <LTP_REPO>/opt/ltp/testcases/bin/
+    <GRAPHENE_DIR>/Runtime/pal_loader [SGX] <TEST_BINARY>
+
+In this way, one can debug one particular syscall testcase.
+
+``ltp.cfg``
+------------
+
+This is a file in ``.ini`` format
+(https://docs.python.org/library/configparser). Lines starting with ``#`` and
+``;`` are comments. Section names are names of the binaries. There is one
+special section, ``[DEFAULT]``, which holds defaults for all binaries and some
+global options.
+
+Global options:
+- ``sgx``: if true-ish, run under SGX (default: false)
+- ``jobs``: run that many tests in parallel (default is 1 under SGX and number of
+  CPUs otherwise); **WARNING:** Because EPC has limited size, test suite may
+  become unstable if more than one test is running concurrently under SGX
+- ``junit-classname``: classname to be shown in JUnit-XML report (``LTP``)
+- ``loader``: path to ``pal_loader`` (default: ``./pal_loader``)
+- ``ltproot``: path to LTP (default: ``./opt/ltp``)
+
+Per-binary options:
+- ``skip``: if true-ish, do not attempt to run the binary (default: false).
+- ``timeout`` in seconds (default: ``30``)
+- ``must-pass``: if not specified (the default), treat the whole binary as
+  a single test and report its return code; if specified, only those subtests
+  (numbers separated by whitespace) are expected to pass, but they must be in
+  the report, so if the binary TBROK'e earlier and did not run the test, report
+  failure; empty ``must-pass`` is valid (means nothing is required); **NOTE**
+  that this depends on stability of subtest numbering, which may be affected by
+  various factors, among those the glibc version and/or what is ``#define``\ d
+  in the headers (see ``signal03`` for example).
+
+Another config file path can be specified using ``--config`` argument to
+``./runltp_xml.py``. Options can be overridden as parameters to ``-o`` argument.
+See ``--help``.
+
+
+Flaky tests
+-----------
+
+::
+
+   clone02 - Invokes clone with CLONE_VM but without either of CLONE_THREAD or CLONE_VFORK, i.e., a
+   process sharing its parents address space. Graphene doesn't support this exotic model. Bug exposed by #1034.
+
+   waitpid03,1 and 2 - fails about 20% of the time
+   preadv01 - fails intermittently in CI - perhaps an unrelated bug?
+   preadv01,2
+   preadv01,3
+   preadv01,4
+
+   waitpid02 - Gets a segfault in debug build fairly often
+   waitpid02,1
+   waitpid02,2
+   waitpid02,3
+
+   clock_nanosleep01,11 - Pretty prone to hanging, don't think it is a timeout
+
+   sendfile05,1 - pretty prone to a segfault, perhaps an unrelated issue
+   Internal memory fault at 0x8 (IP = +0x34f1a, VMID = 3902099696, TID = 1)
+
+   Prone to hanging - I think a memory corruption issue that may have a pending fix
+   recvfrom01,1
+   recvfrom01,2
+
+   futex_wait03,1 (see https://github.com/oscarlab/graphene/pull/180#issuecomment-368970338)
+
+   Intermittent seg fault
+   kill03,1
+
+   Intermittent hang
+   send01,1
+   send01,2
+   sendto01,1
+   sendto01,2
+   sendto01,3
+   recv01,1
+   recv01,2
+
+   Intermittent failure on Linux debug host
+   recvmsg01,1
+   recvmsg01,2
diff --git a/LibOS/shim/test/ltp/contrib/conf_lint.py b/LibOS/shim/test/ltp/contrib/conf_lint.py
new file mode 100755
index 00000000..4c08f4d8
--- /dev/null
+++ b/LibOS/shim/test/ltp/contrib/conf_lint.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+
+#
+# Copyright (C) 2019  Wojtek Porczyk <woju@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+'''
+Check ltp.cfg for tag sorting
+'''
+
+import argparse
+import sys
+
+argparser = argparse.ArgumentParser()
+argparser.add_argument('config', metavar='FILENAME',
+    type=argparse.FileType('r'), nargs='?', default='-',
+    help='ltp.cfg file (default: stdin)')
+
+def count_mistakes(file):
+    mistakes = 0
+    with file:
+        prev = ''
+        for i, line in enumerate(file):
+            line = line.strip()
+            if not line.startswith('['):
+                continue
+            line = line.strip(' []')
+            if line < prev:
+                print('bad order in line {i}: {line} (after {prev})'.format(
+                    i=i, line=line, prev=prev))
+                mistakes += 1
+            prev = line
+    return mistakes
+
+def main(args=None):
+    args = argparser.parse_args(args)
+    return min(count_mistakes(args.config), 255)
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/LibOS/shim/test/ltp/contrib/conf_merge.py b/LibOS/shim/test/ltp/contrib/conf_merge.py
new file mode 100755
index 00000000..2a0d3524
--- /dev/null
+++ b/LibOS/shim/test/ltp/contrib/conf_merge.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+
+#
+# Copyright (C) 2019  Wojtek Porczyk <woju@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+import argparse
+import collections
+import sys
+
+DEFAULT = 'DEFAULT'
+
+# textual config representation to preserve comments
+
+argparser = argparse.ArgumentParser()
+argparser.add_argument('files', metavar='FILENAME',
+    type=argparse.FileType('r'),
+    nargs='+',
+    help='.cfg files to be merged')
+
+def print_section(section, lines):
+    if section is not None:
+        print(f'[{section}]')
+    for line in lines:
+        print(line, end='')
+
+def main(args=None):
+    args = argparser.parse_args(args)
+    sections = collections.defaultdict(list)
+
+    for file in args.files:
+        section = None
+
+        with file:
+            for line in file:
+                if line.lstrip().startswith('['):
+                    section = line.strip(' \n[]')
+                else:
+                    sections[section].append(line)
+
+    for section in (None, DEFAULT):
+        if section not in sections:
+            continue
+        print_section(section, sections.pop(section))
+
+    for section in sorted(sections):
+        print_section(section, sections[section])
+
+if __name__ == '__main__':
+    main()
diff --git a/LibOS/shim/test/ltp/contrib/conf_missing.py b/LibOS/shim/test/ltp/contrib/conf_missing.py
new file mode 100755
index 00000000..715c11df
--- /dev/null
+++ b/LibOS/shim/test/ltp/contrib/conf_missing.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+
+#
+# Copyright (C) 2019  Wojtek Porczyk <woju@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+import argparse
+import configparser
+import sys
+
+argparser = argparse.ArgumentParser()
+argparser.add_argument('--config', '-c', metavar='FILENAME',
+    type=argparse.FileType('r'),
+    help='location of ltp.cfg filfe')
+argparser.add_argument('file', metavar='FILENAME',
+    type=argparse.FileType('r'), nargs='?', default='-',
+    help='LTP scenario file')
+
+def main(args=None):
+    args = argparser.parse_args(args)
+    config = configparser.ConfigParser()
+    config.read_file(args.config)
+
+    with args.file:
+        for line in args.file:
+            line = line.strip()
+            if not line or line[0] == '#': continue
+
+            tag, cmd = line.split(maxsplit=1)
+            if not tag in config and not any(c in cmd for c in '|;&'):
+                print(f'[{tag}]\nmust-pass =\n')
+
+if __name__ == '__main__':
+    main()
diff --git a/LibOS/shim/test/ltp/contrib/conf_remove_must_pass.py b/LibOS/shim/test/ltp/contrib/conf_remove_must_pass.py
new file mode 100755
index 00000000..8fbf055a
--- /dev/null
+++ b/LibOS/shim/test/ltp/contrib/conf_remove_must_pass.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+
+#
+# Copyright (C) 2019  Wojtek Porczyk <woju@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+import argparse
+import enum
+import sys
+
+# textual config representation to preserve comments
+
+argparser = argparse.ArgumentParser()
+argparser.add_argument('--config', '-c', metavar='FILENAME',
+    type=argparse.FileType('r'),
+    default='-',
+    help='location of ltp.cfg filfe')
+argparser.add_argument('sections', metavar='SECTION',
+    nargs='+',
+    help='sections to be removed')
+
+class State(enum.Enum):
+    IDLE, ACCUMULATING, DROPPING = range(3)
+
+def flush(accumulator):
+    if accumulator and any(i.strip() for i in accumulator[1:]):
+        for i in accumulator:
+            sys.stdout.write(i)
+    accumulator.clear()
+
+def main(args=None):
+    args = argparser.parse_args(args)
+
+    with args.config as file:
+        state = State.IDLE
+        accumulator = []
+
+        for line in file:
+            if line.lstrip().startswith('['):
+                section = line.strip(' \n[]')
+
+                flush(accumulator)
+
+                if section in args.sections:
+                    state = State.ACCUMULATING
+                else:
+                    state = State.IDLE
+
+            elif line.startswith('must-pass') and state is State.ACCUMULATING:
+                state = State.DROPPING
+
+            elif line[0] in ' \t':
+                pass
+
+            elif state is State.DROPPING:
+                state = State.ACCUMULATING
+
+
+            if state is State.IDLE:
+                sys.stdout.write(line)
+            elif state is State.ACCUMULATING:
+                accumulator.append(line)
+
+        flush(accumulator)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/LibOS/shim/test/ltp/ltp-bug-1075.cfg b/LibOS/shim/test/ltp/ltp-bug-1075.cfg
new file mode 100644
index 00000000..4363f246
--- /dev/null
+++ b/LibOS/shim/test/ltp/ltp-bug-1075.cfg
@@ -0,0 +1,1013 @@
+[abort01]
+skip = yes
+
+[accept01]
+skip = yes
+
+[accept4_01]
+skip = yes
+
+[access01]
+skip = yes
+
+[access02]
+skip = yes
+
+[access03]
+skip = yes
+
+[access04]
+skip = yes
+
+[acct01]
+skip = yes
+
+[add_key01]
+skip = yes
+
+[add_key02]
+skip = yes
+
+[add_key03]
+skip = yes
+
+[add_key04]
+skip = yes
+
+[alarm02]
+skip = yes
+
+[alarm03]
+skip = yes
+
+[alarm05]
+skip = yes
+
+[alarm06]
+skip = yes
+
+[alarm07]
+skip = yes
+
+[bind03]
+skip = yes
+
+[brk01]
+skip = yes
+
+[chdir03]
+skip = yes
+
+[chmod05]
+skip = yes
+
+[chmod06]
+skip = yes
+
+[chmod07]
+skip = yes
+
+[clock_adjtime01]
+skip = yes
+
+[clock_adjtime02]
+skip = yes
+
+[clock_gettime02]
+skip = yes
+
+[clock_getres01]
+skip = yes
+
+[clock_nanosleep01]
+skip = yes
+
+[clone09]
+skip = yes
+
+[copy_file_range01]
+skip = yes
+
+[creat01]
+skip = yes
+
+[creat03]
+skip = yes
+
+[creat04]
+skip = yes
+
+[creat05]
+skip = yes
+
+[creat06]
+skip = yes
+
+[creat07]
+skip = yes
+
+[delete_module01]
+skip = yes
+
+[delete_module02]
+skip = yes
+
+[delete_module03]
+skip = yes
+
+[dirtyc0w]
+skip = yes
+
+[execl01]
+skip = yes
+
+[execle01]
+skip = yes
+
+[execlp01]
+skip = yes
+
+[execv01]
+skip = yes
+
+[execve01]
+skip = yes
+
+[execve02]
+skip = yes
+
+[execve03]
+skip = yes
+
+[execve04]
+skip = yes
+
+[execve05]
+skip = yes
+
+[execveat01]
+skip = yes
+
+[execveat02]
+skip = yes
+
+[execveat03]
+skip = yes
+
+[execvp01]
+skip = yes
+
+[exit02]
+skip = yes
+
+[fallocate04]
+skip = yes
+
+[fallocate05]
+skip = yes
+
+[fanotify01]
+skip = yes
+
+[fanotify02]
+skip = yes
+
+[fanotify03]
+skip = yes
+
+[fanotify04]
+skip = yes
+
+[fanotify05]
+skip = yes
+
+[fanotify07]
+skip = yes
+
+[fanotify08]
+skip = yes
+
+[fanotify09]
+skip = yes
+
+[fanotify10]
+skip = yes
+
+[fanotify11]
+skip = yes
+
+[fanotify12]
+skip = yes
+
+[fchdir03]
+skip = yes
+
+[fchmod01]
+skip = yes
+
+[fchmod02]
+skip = yes
+
+[fchmod05]
+skip = yes
+
+[fchmod06]
+skip = yes
+
+[fcntl02]
+skip = yes
+
+[fcntl02_64]
+skip = yes
+
+[fcntl03]
+skip = yes
+
+[fcntl03_64]
+skip = yes
+
+[fcntl04]
+skip = yes
+
+[fcntl04_64]
+skip = yes
+
+[fcntl33]
+skip = yes
+
+[fcntl33_64]
+skip = yes
+
+[fcntl35]
+skip = yes
+
+[fcntl35_64]
+skip = yes
+
+[fdatasync03]
+skip = yes
+
+[fgetxattr01]
+skip = yes
+
+[fgetxattr02]
+skip = yes
+
+[fgetxattr03]
+skip = yes
+
+[flistxattr01]
+skip = yes
+
+[flistxattr02]
+skip = yes
+
+[flistxattr03]
+skip = yes
+
+[flock01]
+skip = yes
+
+[flock02]
+skip = yes
+
+[flock04]
+skip = yes
+
+[flock06]
+skip = yes
+
+[fremovexattr01]
+skip = yes
+
+[fremovexattr02]
+skip = yes
+
+[fsetxattr01]
+skip = yes
+
+[fsetxattr02]
+skip = yes
+
+[fsync01]
+skip = yes
+
+[fsync04]
+skip = yes
+
+[ftruncate04]
+skip = yes
+
+[ftruncate04_64]
+skip = yes
+
+[futex_wait05]
+skip = yes
+
+[getcpu01]
+skip = yes
+
+[getcwd01]
+skip = yes
+
+[getcwd02]
+skip = yes
+
+[getcwd03]
+skip = yes
+
+[getcwd04]
+skip = yes
+
+[getpriority01]
+skip = yes
+
+[getpriority02]
+skip = yes
+
+[getrandom01]
+skip = yes
+
+[getrandom02]
+skip = yes
+
+[getrandom03]
+skip = yes
+
+[getrandom04]
+skip = yes
+
+[getrlimit03]
+skip = yes
+
+[getsockopt02]
+skip = yes
+
+[getxattr04]
+skip = yes
+
+[inotify01]
+skip = yes
+
+[inotify02]
+skip = yes
+
+[inotify03]
+skip = yes
+
+[inotify04]
+skip = yes
+
+[inotify05]
+skip = yes
+
+[inotify07]
+skip = yes
+
+[inotify08]
+skip = yes
+
+[ioctl03]
+skip = yes
+
+[ioctl04]
+skip = yes
+
+[ioctl05]
+skip = yes
+
+[ioctl06]
+skip = yes
+
+[ioctl07]
+skip = yes
+
+[kcmp01]
+skip = yes
+
+[kcmp02]
+skip = yes
+
+[kcmp03]
+skip = yes
+
+[keyctl01]
+skip = yes
+
+[keyctl02]
+skip = yes
+
+[keyctl03]
+skip = yes
+
+[keyctl04]
+skip = yes
+
+[keyctl05]
+skip = yes
+
+[keyctl06]
+skip = yes
+
+[keyctl07]
+skip = yes
+
+[keyctl08]
+skip = yes
+
+[lgetxattr01]
+skip = yes
+
+[lgetxattr02]
+skip = yes
+
+[link08]
+skip = yes
+
+[listxattr01]
+skip = yes
+
+[listxattr02]
+skip = yes
+
+[listxattr03]
+skip = yes
+
+[llistxattr01]
+skip = yes
+
+[llistxattr02]
+skip = yes
+
+[llistxattr03]
+skip = yes
+
+[lseek01]
+skip = yes
+
+[lseek07]
+skip = yes
+
+[lseek11]
+skip = yes
+
+[madvise01]
+skip = yes
+
+[madvise02]
+skip = yes
+
+[madvise05]
+skip = yes
+
+[madvise06]
+skip = yes
+
+[madvise07]
+skip = yes
+
+[madvise08]
+skip = yes
+
+[madvise09]
+skip = yes
+
+[madvise10]
+skip = yes
+
+[memfd_create01]
+skip = yes
+
+[memfd_create02]
+skip = yes
+
+[mkdir02]
+skip = yes
+
+[mkdir04]
+skip = yes
+
+[mkdir05]
+skip = yes
+
+[mlock201]
+skip = yes
+
+[mlock202]
+skip = yes
+
+[mlock203]
+skip = yes
+
+[mmap12]
+skip = yes
+
+[mmap16]
+skip = yes
+
+[mprotect02]
+skip = yes
+
+[msgctl01]
+skip = yes
+
+[msgctl02]
+skip = yes
+
+[msgctl03]
+skip = yes
+
+[msgctl04]
+skip = yes
+
+[msgctl12]
+skip = yes
+
+[msgget01]
+skip = yes
+
+[msgget02]
+skip = yes
+
+[msgget03]
+skip = yes
+
+[msgsnd02]
+skip = yes
+
+[msgsnd05]
+skip = yes
+
+[msgsnd06]
+skip = yes
+
+[msync03]
+skip = yes
+
+[msync04]
+skip = yes
+
+[nanosleep01]
+skip = yes
+
+[nanosleep02]
+skip = yes
+
+[nice01]
+skip = yes
+
+[nice02]
+skip = yes
+
+[nice03]
+skip = yes
+
+[nice04]
+skip = yes
+
+[open01]
+skip = yes
+
+[open02]
+skip = yes
+
+[open08]
+skip = yes
+
+[open11]
+skip = yes
+
+[pause01]
+skip = yes
+
+[pipe01]
+skip = yes
+
+[pipe02]
+skip = yes
+
+[pipe03]
+skip = yes
+
+[pipe11]
+skip = yes
+
+[pivot_root01]
+skip = yes
+
+[posix_fadvise01]
+skip = yes
+
+[posix_fadvise01_64]
+skip = yes
+
+[posix_fadvise02]
+skip = yes
+
+[posix_fadvise02_64]
+skip = yes
+
+[posix_fadvise03]
+skip = yes
+
+[posix_fadvise03_64]
+skip = yes
+
+[posix_fadvise04]
+skip = yes
+
+[posix_fadvise04_64]
+skip = yes
+
+[ppoll01]
+skip = yes
+
+[prctl01]
+skip = yes
+
+[prctl02]
+skip = yes
+
+[prctl03]
+skip = yes
+
+[preadv03]
+skip = yes
+
+[preadv03_64]
+skip = yes
+
+[preadv201]
+skip = yes
+
+[preadv201_64]
+skip = yes
+
+[preadv202]
+skip = yes
+
+[preadv202_64]
+skip = yes
+
+[ptrace07]
+skip = yes
+
+[pwrite02]
+skip = yes
+
+[pwrite02_64]
+skip = yes
+
+[pwrite03]
+skip = yes
+
+[pwrite03_64]
+skip = yes
+
+[pwritev03]
+skip = yes
+
+[pwritev03_64]
+skip = yes
+
+[pwritev201]
+skip = yes
+
+[pwritev201_64]
+skip = yes
+
+[pwritev202]
+skip = yes
+
+[pwritev202_64]
+skip = yes
+
+[quotactl01]
+skip = yes
+
+[read01]
+skip = yes
+
+[read02]
+skip = yes
+
+[readahead01]
+skip = yes
+
+[readahead02]
+skip = yes
+
+[readlink01]
+skip = yes
+
+[readlink03]
+skip = yes
+
+[realpath01]
+skip = yes
+
+[recvmsg02]
+skip = yes
+
+[remap_file_pages02]
+skip = yes
+
+[request_key01]
+skip = yes
+
+[request_key02]
+skip = yes
+
+[request_key03]
+skip = yes
+
+[request_key04]
+skip = yes
+
+[request_key05]
+skip = yes
+
+[rmdir01]
+skip = yes
+
+[rmdir02]
+skip = yes
+
+[rmdir03]
+skip = yes
+
+[rt_sigsuspend01]
+skip = yes
+
+[rt_tgsigqueueinfo01]
+skip = yes
+
+[sbrk03]
+skip = yes
+
+[sched_getaffinity01]
+skip = yes
+
+[sched_setscheduler03]
+skip = yes
+
+[semctl01]
+skip = yes
+
+[sendto02]
+skip = yes
+
+[setpriority01]
+skip = yes
+
+[setpriority02]
+skip = yes
+
+[setregid01]
+skip = yes
+
+[setregid01_16]
+skip = yes
+
+[setregid02]
+skip = yes
+
+[setregid02_16]
+skip = yes
+
+[setregid03]
+skip = yes
+
+[setregid03_16]
+skip = yes
+
+[setregid04]
+skip = yes
+
+[setregid04_16]
+skip = yes
+
+[setrlimit02]
+skip = yes
+
+[setrlimit03]
+skip = yes
+
+[setrlimit04]
+skip = yes
+
+[setrlimit05]
+skip = yes
+
+[setrlimit06]
+skip = yes
+
+[setsockopt02]
+skip = yes
+
+[setsockopt03]
+skip = yes
+
+[setuid01]
+skip = yes
+
+[setuid01_16]
+skip = yes
+
+[setuid03]
+skip = yes
+
+[setuid03_16]
+skip = yes
+
+[setuid04]
+skip = yes
+
+[setuid04_16]
+skip = yes
+
+[setxattr01]
+skip = yes
+
+[setxattr02]
+skip = yes
+
+[shmat01]
+skip = yes
+
+[shmat02]
+skip = yes
+
+[shmat03]
+skip = yes
+
+[sigpending02]
+skip = yes
+
+[socket01]
+skip = yes
+
+[socket02]
+skip = yes
+
+[socketpair01]
+skip = yes
+
+[socketpair02]
+skip = yes
+
+[splice01]
+skip = yes
+
+[splice03]
+skip = yes
+
+[splice04]
+skip = yes
+
+[splice05]
+skip = yes
+
+[stat01]
+skip = yes
+
+[stat01_64]
+skip = yes
+
+[stat03]
+skip = yes
+
+[stat03_64]
+skip = yes
+
+[stime01]
+skip = yes
+
+[stime02]
+skip = yes
+
+[sync03]
+skip = yes
+
+[sync_file_range02]
+skip = yes
+
+[syncfs01]
+skip = yes
+
+[syscall01]
+skip = yes
+
+[sysctl01]
+skip = yes
+
+[sysctl03]
+skip = yes
+
+[sysctl04]
+skip = yes
+
+[tee01]
+skip = yes
+
+[tee02]
+skip = yes
+
+[tgkill01]
+skip = yes
+
+[tgkill02]
+skip = yes
+
+[tgkill03]
+skip = yes
+
+[umask01]
+skip = yes
+
+[umount01]
+skip = yes
+
+[umount02]
+skip = yes
+
+[umount03]
+skip = yes
+
+[uname04]
+skip = yes
+
+[unlink05]
+skip = yes
+
+[ustat01]
+skip = yes
+
+[ustat02]
+skip = yes
+
+[utimes01]
+skip = yes
+
+[vhangup01]
+skip = yes
+
+[vhangup02]
+skip = yes
+
+[vmsplice01]
+skip = yes
+
+[vmsplice02]
+skip = yes
+
+[wait401]
+skip = yes
+
+[waitpid01]
+skip = yes
+
+[waitpid06]
+skip = yes
+
+[waitpid07]
+skip = yes
+
+[waitpid08]
+skip = yes
+
+[waitpid09]
+skip = yes
+
+[waitpid10]
+skip = yes
+
+[waitpid11]
+skip = yes
+
+[waitpid12]
+skip = yes
+
+[waitpid13]
+skip = yes
+
+[write01]
+skip = yes
+
+[write02]
+skip = yes
+
+[write03]
+skip = yes
+
+[write04]
+skip = yes
+
+[write05]
+skip = yes
+
+[writev01]
+skip = yes
+
+[writev07]
+skip = yes
diff --git a/LibOS/shim/test/ltp/ltp-bug-1248.cfg b/LibOS/shim/test/ltp/ltp-bug-1248.cfg
new file mode 100644
index 00000000..cc16df73
--- /dev/null
+++ b/LibOS/shim/test/ltp/ltp-bug-1248.cfg
@@ -0,0 +1,2 @@
+[getdents02]
+skip = yes
diff --git a/LibOS/shim/test/ltp/ltp-sgx.cfg b/LibOS/shim/test/ltp/ltp-sgx.cfg
new file mode 100644
index 00000000..56b553bb
--- /dev/null
+++ b/LibOS/shim/test/ltp/ltp-sgx.cfg
@@ -0,0 +1,3781 @@
+# KEEP THIS FILE SORTED
+# in case of trouble, use ./contrib/conf_lint.py < FILENAME
+
+[DEFAULT]
+timeout = 45
+sgx = yes
+
+[abort01]
+skip = yes
+
+[accept01]
+skip = yes
+
+[accept4_01]
+skip = yes
+
+[access01]
+skip = yes
+
+[access02]
+skip = yes
+
+[access03]
+skip = yes
+
+[access04]
+skip = yes
+
+[acct01]
+skip = yes
+
+[add_key01]
+skip = yes
+
+[add_key02]
+skip = yes
+
+[add_key03]
+skip = yes
+
+[add_key04]
+skip = yes
+
+[adjtimex01]
+skip = yes
+
+[adjtimex02]
+skip = yes
+
+[alarm02]
+timeout = 60
+skip = yes
+
+[alarm03]
+timeout = 60
+must-pass =
+    1
+
+[alarm05]
+timeout = 60
+
+[alarm06]
+timeout = 16
+must-pass =
+    2
+
+[alarm07]
+skip = yes
+
+[asyncio02]
+timeout = 80
+
+[bdflush01]
+skip = yes
+
+[bind01]
+must-pass =
+    1
+    2
+    3
+    4
+    5
+
+[bind02]
+skip = yes
+
+[bind03]
+skip = yes
+
+[brk01]
+timeout = 60
+
+[cacheflush01]
+skip = yes
+
+[capget01]
+skip = yes
+
+[capget02]
+skip = yes
+
+[capset01]
+skip = yes
+
+[capset02]
+skip = yes
+
+[chdir01]
+must-pass =
+    1
+
+[chdir01A]
+skip = yes
+
+[chdir02]
+skip = yes
+
+[chdir03]
+skip = yes
+
+[chdir04]
+skip = yes
+
+[chmod01]
+skip = yes
+
+[chmod01A]
+skip = yes
+
+[chmod02]
+timeout = 60
+
+[chmod04]
+skip = yes
+
+[chmod05]
+skip = yes
+
+[chmod06]
+skip = yes
+
+[chmod07]
+skip = yes
+
+[chown01]
+skip = yes
+
+[chown01_16]
+skip = yes
+
+[chown02]
+skip = yes
+
+[chown02_16]
+skip = yes
+
+[chown03]
+skip = yes
+
+[chown03_16]
+skip = yes
+
+[chown04]
+skip = yes
+
+[chown04_16]
+skip = yes
+
+[chown05]
+skip = yes
+
+[chown05_16]
+skip = yes
+
+[chroot01]
+skip = yes
+
+[chroot02]
+skip = yes
+
+[chroot03]
+skip = yes
+
+[chroot04]
+skip = yes
+
+[clock_adjtime01]
+skip = yes
+
+[clock_adjtime02]
+skip = yes
+
+[clock_getres01]
+must-pass =
+    1
+    2
+    3
+    4
+    6
+    7
+    8
+    9
+    10
+    11
+
+[clock_gettime01]
+skip = yes
+
+[clock_gettime02]
+skip = yes
+
+[clock_nanosleep01]
+timeout = 60
+must-pass =
+    3
+
+[clock_nanosleep02]
+skip = yes
+
+[clock_nanosleep2_01]
+skip = yes
+
+[clock_settime01]
+skip = yes
+
+[clock_settime02]
+skip = yes
+
+[clone01]
+skip = yes
+
+[clone02]
+skip = yes
+
+[clone03]
+timeout = 60
+skip = yes
+
+[clone04]
+skip = yes
+
+[clone05]
+skip = yes
+
+[clone06]
+timeout = 60
+
+[clone07]
+skip = yes
+
+[clone08]
+skip = yes
+
+[clone09]
+skip = yes
+
+[close01]
+skip = yes
+
+[close02]
+skip = yes
+
+[close08]
+skip = yes
+
+[confstr01]
+skip = yes
+
+[connect01]
+must-pass =
+    1
+    2
+    3
+    4
+
+[copy_file_range01]
+skip = yes
+
+[creat01]
+skip = yes
+
+[creat03]
+skip = yes
+
+[creat04]
+skip = yes
+
+[creat05]
+skip = yes
+
+[creat06]
+skip = yes
+
+[creat07]
+skip = yes
+
+[creat08]
+skip = yes
+
+[delete_module01]
+skip = yes
+
+[delete_module02]
+skip = yes
+
+[delete_module03]
+skip = yes
+
+[dirtyc0w]
+skip = yes
+
+[dup01]
+skip = yes
+
+[dup02]
+skip = yes
+
+[dup03]
+skip = yes
+
+[dup04]
+skip = yes
+
+[dup05]
+skip = yes
+
+[dup06]
+skip = yes
+
+[dup07]
+# unskip when #1066 is merged
+skip = yes
+must-pass =
+    1
+    2
+    3
+
+[dup201]
+# maybe unskip when #1066 is merged
+skip = yes
+must-pass =
+    1
+    2
+
+[dup202]
+# unskip when #1066 is merged
+skip = yes
+must-pass =
+    1
+    2
+    3
+
+[dup203]
+skip = yes
+
+[dup204]
+timeout = 60
+
+[dup205]
+skip = yes
+
+[dup3_01]
+skip = yes
+
+[dup3_02]
+skip = yes
+
+# complex test, not all of its checking is implemented in Graphene
+[epoll01]
+skip = yes
+
+# segfault: uses sigprocmask and sends signals, broken in Graphene
+[epoll_pwait01]
+skip = yes
+
+[eventfd01]
+skip = yes
+
+[eventfd2_01]
+skip = yes
+
+[eventfd2_02]
+skip = yes
+
+[eventfd2_03]
+skip = yes
+
+[execl01]
+must-pass =
+    1
+
+[execle01]
+skip = yes
+
+[execlp01]
+must-pass =
+    1
+
+[execv01]
+must-pass =
+    1
+
+[execve01]
+skip = yes
+
+[execve02]
+skip = yes
+
+[execve03]
+skip = yes
+
+[execve04]
+skip = yes
+
+[execve05]
+skip = yes
+
+[execveat01]
+skip = yes
+
+[execveat02]
+skip = yes
+
+[execveat03]
+skip = yes
+
+[execvp01]
+must-pass =
+    1
+
+[exit01]
+timeout = 60
+
+[exit02]
+skip = yes
+
+[exit_group01]
+skip = yes
+
+[faccessat01]
+timeout = 80
+skip = yes
+
+[fallocate01]
+skip = yes
+
+[fallocate02]
+skip = yes
+
+[fallocate03]
+skip = yes
+
+[fallocate04]
+skip = yes
+
+[fallocate05]
+skip = yes
+
+[fanotify01]
+skip = yes
+
+[fanotify02]
+skip = yes
+
+[fanotify03]
+skip = yes
+
+[fanotify04]
+skip = yes
+
+[fanotify05]
+skip = yes
+
+[fanotify06]
+skip = yes
+
+[fanotify07]
+skip = yes
+
+[fanotify08]
+skip = yes
+
+[fanotify09]
+skip = yes
+
+[fanotify10]
+skip = yes
+
+[fanotify11]
+skip = yes
+
+[fanotify12]
+skip = yes
+
+[fchdir01]
+skip = yes
+
+[fchdir02]
+timeout = 60
+
+[fchdir03]
+skip = yes
+
+[fchmod01]
+skip = yes
+
+[fchmod02]
+skip = yes
+
+[fchmod03]
+skip = yes
+
+[fchmod04]
+skip = yes
+
+[fchmod05]
+skip = yes
+
+[fchmod06]
+skip = yes
+
+[fchmod07]
+timeout = 60
+
+[fchmodat01]
+timeout = 60
+
+[fchown01]
+skip = yes
+
+[fchown01_16]
+skip = yes
+
+[fchown02]
+must-pass =
+    4
+
+[fchown02_16]
+skip = yes
+
+[fchown03]
+skip = yes
+
+[fchown03_16]
+skip = yes
+
+[fchown04]
+skip = yes
+
+[fchown04_16]
+skip = yes
+
+[fchown05]
+skip = yes
+
+[fchown05_16]
+skip = yes
+
+[fchownat01]
+skip = yes
+
+[fchownat02]
+skip = yes
+
+[fcntl01]
+skip = yes
+
+[fcntl01_64]
+skip = yes
+
+[fcntl02]
+skip = yes
+
+[fcntl02_64]
+timeout = 60
+
+[fcntl03]
+skip = yes
+
+[fcntl03_64]
+skip = yes
+
+[fcntl04]
+skip = yes
+
+[fcntl04_64]
+skip = yes
+
+[fcntl05]
+skip = yes
+
+[fcntl05_64]
+skip = yes
+
+[fcntl06]
+skip = yes
+
+[fcntl06_64]
+skip = yes
+
+[fcntl07]
+skip = yes
+
+[fcntl07_64]
+skip = yes
+
+[fcntl08]
+skip = yes
+
+[fcntl08_64]
+timeout = 60
+
+[fcntl09]
+skip = yes
+
+[fcntl09_64]
+skip = yes
+
+[fcntl10]
+skip = yes
+
+[fcntl10_64]
+skip = yes
+
+[fcntl11]
+skip = yes
+
+[fcntl11_64]
+skip = yes
+
+[fcntl12]
+skip = yes
+
+[fcntl12_64]
+skip = yes
+
+[fcntl13]
+must-pass =
+    6
+
+[fcntl13_64]
+timeout = 60
+must-pass =
+    6
+
+[fcntl14]
+skip = yes
+
+[fcntl14_64]
+skip = yes
+
+[fcntl15]
+skip = yes
+
+[fcntl15_64]
+skip = yes
+
+[fcntl16]
+skip = yes
+
+[fcntl16_64]
+skip = yes
+
+[fcntl17]
+skip = yes
+
+[fcntl17_64]
+skip = yes
+
+[fcntl18]
+skip = yes
+
+[fcntl18_64]
+skip = yes
+
+[fcntl19]
+skip = yes
+
+[fcntl19_64]
+skip = yes
+
+[fcntl20]
+skip = yes
+
+[fcntl20_64]
+skip = yes
+
+[fcntl21]
+skip = yes
+
+[fcntl21_64]
+skip = yes
+
+[fcntl22]
+skip = yes
+
+[fcntl22_64]
+skip = yes
+
+[fcntl23]
+skip = yes
+
+[fcntl23_64]
+skip = yes
+
+[fcntl24]
+skip = yes
+
+[fcntl24_64]
+skip = yes
+
+[fcntl25]
+skip = yes
+
+[fcntl25_64]
+skip = yes
+
+[fcntl26]
+skip = yes
+
+[fcntl26_64]
+skip = yes
+
+[fcntl27]
+skip = yes
+
+[fcntl27_64]
+skip = yes
+
+[fcntl28]
+must-pass =
+    1
+
+[fcntl28_64]
+must-pass =
+    1
+
+[fcntl29]
+skip = yes
+
+[fcntl29_64]
+skip = yes
+
+[fcntl30]
+skip = yes
+
+[fcntl30_64]
+skip = yes
+
+[fcntl31]
+skip = yes
+
+[fcntl31_64]
+skip = yes
+
+[fcntl32]
+skip = yes
+
+[fcntl32_64]
+skip = yes
+
+[fcntl33]
+skip = yes
+
+[fcntl33_64]
+skip = yes
+
+[fcntl34]
+skip = yes
+
+[fcntl34_64]
+skip = yes
+
+[fcntl35]
+skip = yes
+
+[fcntl35_64]
+skip = yes
+
+[fcntl36]
+skip = yes
+
+[fcntl36_64]
+skip = yes
+
+[fdatasync01]
+skip = yes
+
+[fdatasync02]
+must-pass =
+    1
+
+[fdatasync03]
+skip = yes
+
+[fgetxattr01]
+skip = yes
+
+[fgetxattr02]
+skip = yes
+
+[fgetxattr03]
+skip = yes
+
+[flistxattr01]
+skip = yes
+
+[flistxattr02]
+skip = yes
+
+[flistxattr03]
+skip = yes
+
+[flock01]
+skip = yes
+
+[flock02]
+skip = yes
+
+[flock03]
+skip = yes
+
+[flock04]
+skip = yes
+
+[flock06]
+skip = yes
+
+[fmtmsg01]
+skip = yes
+
+[fork01]
+skip = yes
+
+[fork02]
+timeout = 60
+
+[fork03]
+skip = yes
+
+[fork04]
+skip = yes
+
+[fork05]
+skip = yes
+
+[fork06]
+skip = yes
+
+[fork07]
+skip = yes
+
+[fork08]
+skip = yes
+
+[fork09]
+skip = yes
+
+[fork10]
+skip = yes
+
+[fork11]
+skip = yes
+
+[fork12]
+skip = yes
+
+[fork13]
+skip = yes
+
+[fork14]
+skip = yes
+
+[fpathconf01]
+skip = yes
+
+[fremovexattr01]
+skip = yes
+
+[fremovexattr02]
+skip = yes
+
+[fsetxattr01]
+skip = yes
+
+[fsetxattr02]
+skip = yes
+
+[fstat01]
+skip = yes
+
+[fstat01_64]
+skip = yes
+
+[fstat02]
+skip = yes
+
+[fstat02_64]
+skip = yes
+
+[fstat03]
+skip = yes
+
+[fstat03_64]
+skip = yes
+
+[fstat05]
+skip = yes
+
+[fstat05_64]
+skip = yes
+
+[fstatat01]
+skip = yes
+
+[fstatfs01]
+skip = yes
+
+[fstatfs01_64]
+skip = yes
+
+[fstatfs02]
+skip = yes
+
+[fstatfs02_64]
+skip = yes
+
+[fsync01]
+timeout = 60
+skip = yes
+
+[fsync02]
+skip = yes
+
+[fsync03]
+timeout = 60
+must-pass =
+    1
+
+[fsync04]
+timeout = 60
+skip = yes
+
+[ftruncate01]
+skip = yes
+
+[ftruncate01_64]
+skip = yes
+
+[ftruncate02]
+skip = yes
+
+[ftruncate02_64]
+skip = yes
+
+[ftruncate03]
+skip = yes
+
+[ftruncate03_64]
+skip = yes
+
+[ftruncate04]
+skip = yes
+
+[ftruncate04_64]
+skip = yes
+
+[futex_wait01]
+skip = yes
+
+[futex_wait02]
+skip = yes
+
+[futex_wait03]
+skip = yes
+
+[futex_wait04]
+skip = yes
+
+[futex_wait05]
+skip = yes
+
+[futex_wait_bitset01]
+skip = yes
+
+[futex_wait_bitset02]
+timeout = 60
+skip = yes
+
+[futex_wake01]
+skip = yes
+
+[futex_wake02]
+skip = yes
+
+[futex_wake03]
+skip = yes
+
+[futex_wake04]
+skip = yes
+
+[futimesat01]
+skip = yes
+
+[get_mempolicy01]
+skip = yes
+
+[get_robust_list01]
+skip = yes
+
+[getcontext01]
+skip = yes
+
+[getcpu01]
+skip = yes
+
+[getcwd01]
+skip = yes
+
+[getcwd02]
+skip = yes
+
+[getcwd03]
+skip = yes
+
+[getcwd04]
+skip = yes
+
+[getdents01]
+skip = yes
+
+[getdents01_64]
+skip = yes
+
+[getdents02]
+skip = yes
+
+[getdents02_64]
+skip = yes
+
+[getdomainname01]
+skip = yes
+
+[getdtablesize01]
+must-pass =
+    1
+
+[getegid01]
+skip = yes
+
+[getegid01_16]
+skip = yes
+
+[getegid02]
+skip = yes
+
+[getegid02_16]
+skip = yes
+
+[geteuid01]
+skip = yes
+
+[geteuid01_16]
+skip = yes
+
+[geteuid02]
+skip = yes
+
+[geteuid02_16]
+skip = yes
+
+[getgid01]
+skip = yes
+
+[getgid01_16]
+skip = yes
+
+[getgid03]
+timeout = 60
+skip = yes
+
+[getgid03_16]
+skip = yes
+
+[getgroups01]
+skip = yes
+
+[getgroups01_16]
+skip = yes
+
+[getgroups03]
+skip = yes
+
+[getgroups03_16]
+skip = yes
+
+[gethostbyname_r01]
+skip = yes
+
+[gethostid01]
+skip = yes
+
+[gethostname01]
+timeout = 60
+
+[getitimer01]
+must-pass =
+    1
+    3
+    5
+
+[getitimer02]
+skip = yes
+
+[getitimer03]
+skip = yes
+
+[getpagesize01]
+skip = yes
+
+[getpeername01]
+skip = yes
+
+[getpgid01]
+skip = yes
+
+[getpgid02]
+skip = yes
+
+[getpgrp01]
+skip = yes
+
+[getpid01]
+skip = yes
+
+[getpid02]
+timeout = 60
+
+[getppid01]
+skip = yes
+
+[getppid02]
+skip = yes
+
+[getpriority01]
+skip = yes
+
+[getpriority02]
+skip = yes
+
+[getrandom01]
+skip = yes
+
+[getrandom02]
+skip = yes
+
+[getrandom03]
+skip = yes
+
+[getrandom04]
+skip = yes
+
+[getresgid01]
+skip = yes
+
+[getresgid01_16]
+skip = yes
+
+[getresgid02]
+skip = yes
+
+[getresgid02_16]
+skip = yes
+
+[getresgid03]
+skip = yes
+
+[getresgid03_16]
+skip = yes
+
+[getresuid01]
+skip = yes
+
+[getresuid01_16]
+skip = yes
+
+[getresuid02]
+skip = yes
+
+[getresuid02_16]
+skip = yes
+
+[getresuid03]
+skip = yes
+
+[getresuid03_16]
+skip = yes
+
+[getrlimit01]
+skip = yes
+
+[getrlimit02]
+skip = yes
+
+[getrlimit03]
+skip = yes
+
+[getrusage01]
+skip = yes
+
+[getrusage02]
+skip = yes
+
+[getrusage03]
+skip = yes
+
+[getrusage04]
+skip = yes
+
+[getsid01]
+skip = yes
+
+[getsid02]
+skip = yes
+
+[getsockname01]
+skip = yes
+
+[getsockopt01]
+must-pass =
+    1
+    2
+    3
+    4
+    8
+    9
+
+[getsockopt02]
+skip = yes
+
+[gettid01]
+timeout = 60
+
+[gettimeofday01]
+skip = yes
+
+[gettimeofday02]
+skip = yes
+
+[getuid01]
+skip = yes
+
+[getuid01_16]
+skip = yes
+
+[getuid03]
+skip = yes
+
+[getuid03_16]
+skip = yes
+
+[getxattr01]
+skip = yes
+
+[getxattr02]
+skip = yes
+
+[getxattr03]
+skip = yes
+
+[getxattr04]
+skip = yes
+
+[getxattr05]
+skip = yes
+
+[inotify01]
+skip = yes
+
+[inotify02]
+skip = yes
+
+[inotify03]
+skip = yes
+
+[inotify04]
+skip = yes
+
+[inotify05]
+skip = yes
+
+[inotify06]
+skip = yes
+
+[inotify07]
+skip = yes
+
+[inotify08]
+skip = yes
+
+[inotify09]
+skip = yes
+
+[inotify_init1_01]
+skip = yes
+
+[inotify_init1_02]
+skip = yes
+
+[io_cancel01]
+skip = yes
+
+[io_destroy01]
+skip = yes
+
+[io_getevents01]
+skip = yes
+
+[io_setup01]
+skip = yes
+
+[io_submit01]
+skip = yes
+
+[ioctl01_02]
+skip = yes
+
+[ioctl03]
+skip = yes
+
+[ioctl04]
+skip = yes
+
+[ioctl05]
+skip = yes
+
+[ioctl06]
+skip = yes
+
+[ioctl07]
+skip = yes
+
+[ioctl08]
+skip = yes
+
+[ioctl_ns01]
+skip = yes
+
+[ioctl_ns02]
+skip = yes
+
+[ioctl_ns03]
+skip = yes
+
+[ioctl_ns04]
+skip = yes
+
+[ioctl_ns05]
+skip = yes
+
+[ioctl_ns06]
+skip = yes
+
+[ioctl_ns07]
+skip = yes
+
+[ioperm01]
+skip = yes
+
+[ioperm02]
+skip = yes
+
+[iopl01]
+skip = yes
+
+[iopl02]
+skip = yes
+
+[kcmp01]
+skip = yes
+
+[kcmp02]
+skip = yes
+
+[kcmp03]
+skip = yes
+
+[keyctl01]
+skip = yes
+
+[keyctl02]
+skip = yes
+
+[keyctl03]
+skip = yes
+
+[keyctl04]
+skip = yes
+
+[keyctl05]
+skip = yes
+
+[keyctl06]
+skip = yes
+
+[keyctl07]
+skip = yes
+
+[keyctl08]
+skip = yes
+
+[kill01]
+skip = yes
+
+[kill02]
+skip = yes
+
+[kill03]
+skip = yes
+
+[kill04]
+skip = yes
+
+[kill05]
+skip = yes
+
+[kill06]
+skip = yes
+
+[kill07]
+skip = yes
+
+[kill08]
+skip = yes
+
+[kill09]
+timeout = 80
+skip = yes
+
+[kill10]
+skip = yes
+
+[kill11]
+skip = yes
+
+[lchown01]
+skip = yes
+
+[lchown01_16]
+skip = yes
+
+[lchown02]
+skip = yes
+
+[lchown02_16]
+skip = yes
+
+[lchown03]
+skip = yes
+
+[lchown03_16]
+skip = yes
+
+[lgetxattr01]
+skip = yes
+
+[lgetxattr02]
+skip = yes
+
+[link01]
+skip = yes
+
+[link02]
+skip = yes
+
+[link03]
+skip = yes
+
+[link04]
+skip = yes
+
+[link05]
+skip = yes
+
+[link06]
+skip = yes
+
+[link07]
+skip = yes
+
+[link08]
+skip = yes
+
+[linkat01]
+skip = yes
+
+[linkat02]
+skip = yes
+
+[listen01]
+must-pass =
+    1
+    2
+
+[listxattr01]
+skip = yes
+
+[listxattr02]
+skip = yes
+
+[listxattr03]
+skip = yes
+
+[llistxattr01]
+skip = yes
+
+[llistxattr02]
+skip = yes
+
+[llistxattr03]
+skip = yes
+
+[llseek01]
+skip = yes
+
+[llseek02]
+skip = yes
+
+[llseek03]
+skip = yes
+
+[lremovexattr01]
+skip = yes
+
+[lseek01]
+skip = yes
+
+[lseek02]
+skip = yes
+timeout = 60
+
+[lseek07]
+skip = yes
+
+[lseek08]
+skip = yes
+
+[lseek10]
+skip = yes
+
+[lseek11]
+skip = yes
+
+[lstat01]
+skip = yes
+
+[lstat01A]
+skip = yes
+
+[lstat01A_64]
+skip = yes
+
+[lstat01_64]
+skip = yes
+
+[lstat02]
+skip = yes
+
+[lstat02_64]
+skip = yes
+
+[lstat03]
+skip = yes
+
+[lstat03_64]
+skip = yes
+
+[madvise01]
+skip = yes
+
+[madvise02]
+skip = yes
+
+[madvise05]
+skip = yes
+
+[madvise06]
+skip = yes
+
+[madvise07]
+skip = yes
+
+[madvise08]
+skip = yes
+
+[madvise09]
+skip = yes
+
+[madvise10]
+skip = yes
+
+[mallopt01]
+skip = yes
+
+[mbind01]
+skip = yes
+
+[membarrier01]
+skip = yes
+
+[memcmp01]
+skip = yes
+
+[memcpy01]
+skip = yes
+
+[memfd_create01]
+skip = yes
+
+[memfd_create02]
+skip = yes
+
+[memfd_create03]
+skip = yes
+
+[memfd_create04]
+skip = yes
+
+[memset01]
+skip = yes
+
+[migrate_pages01]
+skip = yes
+
+[migrate_pages02]
+skip = yes
+
+[migrate_pages03]
+skip = yes
+
+[mincore01]
+skip = yes
+
+[mincore02]
+skip = yes
+
+[mkdir01]
+skip = yes
+
+[mkdir02]
+skip = yes
+
+[mkdir03]
+skip = yes
+
+[mkdir04]
+skip = yes
+
+[mkdir05]
+skip = yes
+
+[mkdir05A]
+skip = yes
+
+[mkdir09]
+skip = yes
+
+[mkdirat01]
+skip = yes
+
+[mkdirat02]
+skip = yes
+
+[mknod01]
+skip = yes
+
+[mknod02]
+skip = yes
+
+[mknod03]
+skip = yes
+
+[mknod04]
+skip = yes
+
+[mknod05]
+skip = yes
+
+[mknod06]
+skip = yes
+
+[mknod07]
+timeout = 60
+skip = yes
+
+[mknod08]
+skip = yes
+
+[mknod09]
+skip = yes
+
+[mknodat01]
+skip = yes
+
+[mknodat02]
+skip = yes
+
+[mlock01]
+skip = yes
+
+[mlock02]
+skip = yes
+
+[mlock03]
+skip = yes
+
+[mlock04]
+skip = yes
+
+[mlock201]
+skip = yes
+
+[mlock202]
+skip = yes
+
+[mlock203]
+skip = yes
+
+[mlockall01]
+skip = yes
+
+[mlockall02]
+skip = yes
+
+[mlockall03]
+skip = yes
+
+[mmap001]
+skip = yes
+
+[mmap01]
+skip = yes
+
+[mmap02]
+skip = yes
+
+[mmap03]
+skip = yes
+
+[mmap04]
+skip = yes
+
+[mmap05]
+skip = yes
+
+[mmap06]
+skip = yes
+
+[mmap07]
+skip = yes
+
+[mmap08]
+skip = yes
+
+[mmap09]
+skip = yes
+
+[mmap12]
+skip = yes
+
+[mmap13]
+skip = yes
+
+[mmap14]
+skip = yes
+
+[mmap15]
+skip = yes
+
+[mmap16]
+skip = yes
+
+[modify_ldt01]
+skip = yes
+
+[modify_ldt02]
+skip = yes
+
+[modify_ldt03]
+skip = yes
+
+[mount01]
+skip = yes
+
+[mount02]
+skip = yes
+
+[mount03]
+skip = yes
+
+[mount04]
+skip = yes
+
+[mount05]
+skip = yes
+
+[mount06]
+skip = yes
+
+[move_pages01]
+skip = yes
+
+[move_pages02]
+skip = yes
+
+[move_pages03]
+skip = yes
+
+[move_pages04]
+skip = yes
+
+[move_pages05]
+skip = yes
+
+[move_pages06]
+skip = yes
+
+[move_pages07]
+skip = yes
+
+[move_pages08]
+skip = yes
+
+[move_pages09]
+skip = yes
+
+[move_pages10]
+skip = yes
+
+[move_pages11]
+skip = yes
+
+[move_pages12]
+skip = yes
+
+[mprotect01]
+skip = yes
+
+[mprotect02]
+skip = yes
+
+[mprotect03]
+skip = yes
+
+[mprotect04]
+timeout = 60
+skip = yes
+
+[mq_notify01]
+skip = yes
+
+[mq_notify02]
+skip = yes
+
+[mq_open01]
+skip = yes
+
+[mq_timedreceive01]
+skip = yes
+
+[mq_timedsend01]
+skip = yes
+
+[mq_unlink01]
+skip = yes
+
+[mremap01]
+skip = yes
+
+[mremap02]
+skip = yes
+
+[mremap03]
+skip = yes
+
+[mremap04]
+skip = yes
+
+[mremap05]
+skip = yes
+
+[msgctl01]
+skip = yes
+
+[msgctl02]
+skip = yes
+
+[msgctl03]
+skip = yes
+
+[msgctl04]
+skip = yes
+
+[msgctl07]
+skip = yes
+
+[msgctl12]
+skip = yes
+
+[msgget01]
+skip = yes
+
+[msgget02]
+must-pass =
+    1
+    2
+    3
+
+[msgget03]
+skip = yes
+
+[msgrcv01]
+skip = yes
+
+[msgrcv02]
+skip = yes
+
+[msgrcv03]
+skip = yes
+
+[msgrcv04]
+skip = yes
+
+[msgrcv05]
+skip = yes
+
+[msgrcv06]
+skip = yes
+
+[msgrcv07]
+skip = yes
+
+[msgrcv08]
+skip = yes
+
+[msgsnd01]
+skip = yes
+timeout = 60
+
+[msgsnd02]
+skip = yes
+
+[msgsnd05]
+must-pass =
+    1
+
+[msgsnd06]
+skip = yes
+
+[msgstress01]
+skip = yes
+
+[msgstress02]
+skip = yes
+
+[msgstress03]
+skip = yes
+
+[msgstress04]
+skip = yes
+
+[msync01]
+skip = yes
+
+[msync02]
+skip = yes
+
+[msync03]
+skip = yes
+
+[msync04]
+skip = yes
+
+[munlock01]
+skip = yes
+
+[munlock02]
+skip = yes
+
+[munlockall01]
+skip = yes
+
+[munmap01]
+skip = yes
+
+[munmap02]
+skip = yes
+
+[munmap03]
+skip = yes
+
+[nanosleep01]
+skip = yes
+
+[nanosleep02]
+skip = yes
+
+[nanosleep03]
+skip = yes
+
+[nanosleep04]
+skip = yes
+
+[newuname01]
+timeout = 60
+
+[nftw01]
+skip = yes
+
+[nftw6401]
+skip = yes
+
+[nice01]
+skip = yes
+
+[nice02]
+skip = yes
+
+[nice03]
+skip = yes
+
+[nice04]
+skip = yes
+
+[nosleep04]
+skip = yes
+
+[open01]
+skip = yes
+
+[open01A]
+skip = yes
+
+[open02]
+skip = yes
+
+[open03]
+skip = yes
+
+[open04]
+skip = yes
+
+[open05]
+skip = yes
+
+[open06]
+skip = yes
+
+[open07]
+skip = yes
+
+[open08]
+must-pass =
+    2
+
+[open09]
+skip = yes
+
+[open10]
+skip = yes
+
+[open11]
+skip = yes
+
+[open12]
+skip = yes
+
+[open13]
+skip = yes
+
+[open14]
+skip = yes
+
+[openat01]
+skip = yes
+
+[openat02]
+skip = yes
+
+[openat03]
+skip = yes
+
+[pathconf01]
+skip = yes
+
+[pause01]
+skip = yes
+
+[pause02]
+skip = yes
+
+[pause03]
+skip = yes
+
+[perf_event_open01]
+skip = yes
+
+[perf_event_open02]
+skip = yes
+
+[personality01]
+skip = yes
+
+[personality02]
+skip = yes
+
+[pipe01]
+must-pass =
+    1
+
+[pipe02]
+skip = yes
+
+[pipe03]
+skip = yes
+
+[pipe04]
+skip = yes
+
+[pipe05]
+skip = yes
+
+[pipe06]
+skip = yes
+
+[pipe07]
+skip = yes
+
+[pipe08]
+skip = yes
+
+[pipe09]
+skip = yes
+
+[pipe10]
+skip = yes
+
+[pipe11]
+skip = yes
+
+[pipe2_01]
+skip = yes
+
+[pipe2_02]
+skip = yes
+
+[pivot_root01]
+skip = yes
+
+[posix_fadvise01]
+skip = yes
+
+[posix_fadvise01_64]
+skip = yes
+
+[posix_fadvise02]
+skip = yes
+
+[posix_fadvise02_64]
+skip = yes
+
+[posix_fadvise03]
+skip = yes
+
+[posix_fadvise03_64]
+skip = yes
+
+[posix_fadvise04]
+skip = yes
+
+[posix_fadvise04_64]
+skip = yes
+
+# segfault: uses sigprocmask and sends signals, broken in Graphene
+[ppoll01]
+skip = yes
+
+[prctl01]
+skip = yes
+
+[prctl02]
+skip = yes
+
+[prctl03]
+skip = yes
+
+[pread01]
+timeout = 60
+
+[pread01_64]
+timeout = 60
+
+[pread02]
+timeout = 60
+
+[pread02_64]
+skip = yes
+
+[pread03]
+skip = yes
+
+[pread03_64]
+skip = yes
+
+[preadv01]
+skip = yes
+timeout = 80
+
+[preadv01_64]
+skip = yes
+
+[preadv02]
+skip = yes
+
+[preadv02_64]
+skip = yes
+
+[preadv03]
+skip = yes
+
+[preadv03_64]
+skip = yes
+
+[preadv201]
+skip = yes
+
+[preadv201_64]
+skip = yes
+
+[preadv202]
+skip = yes
+
+[preadv202_64]
+skip = yes
+
+[process_vm01]
+skip = yes
+
+[process_vm_readv01]
+skip = yes
+
+[process_vm_readv02]
+skip = yes
+
+[process_vm_readv03]
+skip = yes
+
+[process_vm_writev01]
+skip = yes
+
+[process_vm_writev02]
+skip = yes
+
+[profil01]
+skip = yes
+
+[prot_hsymlinks]
+skip = yes
+
+# WORKAROUND: test passes but TWARNs on cleanup of temp dir; bug in Graphene
+[pselect02]
+must-pass =
+    1
+    2
+    3
+
+# WORKAROUND: test passes but TWARNs on cleanup of temp dir; bug in Graphene
+[pselect02_64]
+must-pass =
+    1
+    2
+    3
+
+[ptrace01]
+skip = yes
+
+[ptrace02]
+skip = yes
+
+[ptrace03]
+skip = yes
+
+[ptrace04]
+skip = yes
+
+[ptrace05]
+skip = yes
+
+[ptrace07]
+skip = yes
+
+[pwrite01]
+skip = yes
+
+[pwrite01_64]
+timeout = 60
+
+[pwrite02]
+skip = yes
+
+[pwrite02_64]
+skip = yes
+
+[pwrite03]
+skip = yes
+
+[pwrite03_64]
+skip = yes
+
+[pwrite04]
+must-pass =
+    2
+
+[pwrite04_64]
+timeout = 60
+must-pass =
+    2
+
+[pwritev01]
+skip = yes
+timeout = 60
+
+[pwritev01_64]
+skip = yes
+
+[pwritev02]
+skip = yes
+
+[pwritev02_64]
+skip = yes
+
+[pwritev03]
+skip = yes
+
+[pwritev03_64]
+skip = yes
+
+[pwritev201]
+skip = yes
+
+[pwritev201_64]
+skip = yes
+
+[pwritev202]
+skip = yes
+
+[pwritev202_64]
+skip = yes
+
+[qmm01]
+skip = yes
+
+[quotactl01]
+skip = yes
+
+[quotactl02]
+skip = yes
+
+[quotactl03]
+skip = yes
+
+[read01]
+timeout = 60
+
+[read02]
+skip = yes
+
+[read03]
+skip = yes
+
+[read04]
+skip = yes
+
+[readahead01]
+skip = yes
+
+[readahead02]
+skip = yes
+
+[readdir01]
+timeout = 60
+
+[readdir21]
+skip = yes
+
+[readlink01]
+skip = yes
+
+[readlink01A]
+skip = yes
+
+[readlink03]
+skip = yes
+
+[readlinkat01]
+skip = yes
+
+[readlinkat02]
+skip = yes
+
+[readv01]
+timeout = 60
+
+[readv02]
+must-pass =
+    1
+
+[readv03]
+skip = yes
+
+[realpath01]
+skip = yes
+
+[reboot01]
+skip = yes
+
+[reboot02]
+skip = yes
+
+[recv01]
+skip = yes
+
+[recvfrom01]
+skip = yes
+
+[recvmsg01]
+skip = yes
+
+[recvmsg02]
+skip = yes
+
+[recvmsg03]
+skip = yes
+
+[remap_file_pages01]
+skip = yes
+
+[remap_file_pages02]
+skip = yes
+
+[removexattr01]
+skip = yes
+
+[removexattr02]
+skip = yes
+
+[rename01]
+skip = yes
+
+[rename01A]
+skip = yes
+
+[rename02]
+skip = yes
+
+[rename03]
+skip = yes
+
+[rename04]
+skip = yes
+
+[rename05]
+skip = yes
+
+[rename06]
+skip = yes
+
+[rename07]
+skip = yes
+
+[rename08]
+skip = yes
+
+[rename09]
+skip = yes
+
+[rename10]
+skip = yes
+
+[rename11]
+skip = yes
+
+[rename12]
+skip = yes
+
+[rename13]
+skip = yes
+
+[rename14]
+skip = yes
+
+[renameat01]
+skip = yes
+
+[renameat201]
+skip = yes
+
+[renameat202]
+skip = yes
+
+[request_key01]
+skip = yes
+
+[request_key02]
+skip = yes
+
+[request_key03]
+skip = yes
+
+[request_key04]
+skip = yes
+
+[request_key05]
+skip = yes
+
+[rmdir01]
+skip = yes
+
+[rmdir02]
+skip = yes
+
+[rmdir03]
+skip = yes
+
+[rmdir03A]
+skip = yes
+
+[rmdir05]
+skip = yes
+
+[rt_sigaction01]
+skip = yes
+
+[rt_sigaction02]
+skip = yes
+
+[rt_sigaction03]
+skip = yes
+
+[rt_sigprocmask01]
+skip = yes
+
+[rt_sigprocmask02]
+skip = yes
+
+[rt_sigqueueinfo01]
+skip = yes
+
+[rt_sigsuspend01]
+skip = yes
+
+[rt_sigtimedwait01]
+skip = yes
+
+[rt_tgsigqueueinfo01]
+skip = yes
+
+[sbrk01]
+skip = yes
+
+[sbrk02]
+skip = yes
+
+[sbrk03]
+skip = yes
+
+[sched_get_priority_max01]
+skip = yes
+
+[sched_get_priority_max02]
+skip = yes
+
+[sched_get_priority_min01]
+skip = yes
+
+[sched_get_priority_min02]
+skip = yes
+
+[sched_getaffinity01]
+skip = yes
+
+[sched_getattr01]
+skip = yes
+
+[sched_getattr02]
+skip = yes
+
+[sched_getparam01]
+skip = yes
+
+[sched_getparam02]
+skip = yes
+
+[sched_getparam03]
+skip = yes
+
+[sched_getscheduler01]
+skip = yes
+
+[sched_getscheduler02]
+skip = yes
+
+[sched_rr_get_interval01]
+skip = yes
+
+[sched_rr_get_interval02]
+skip = yes
+
+[sched_rr_get_interval03]
+skip = yes
+
+[sched_setaffinity01]
+skip = yes
+
+[sched_setattr01]
+skip = yes
+
+[sched_setparam01]
+skip = yes
+
+[sched_setparam02]
+skip = yes
+
+[sched_setparam03]
+skip = yes
+
+[sched_setparam04]
+skip = yes
+
+[sched_setparam05]
+skip = yes
+
+[sched_setscheduler01]
+skip = yes
+
+[sched_setscheduler02]
+skip = yes
+
+[sched_setscheduler03]
+skip = yes
+
+[sched_yield01]
+skip = yes
+
+# WORKAROUND: test passes but TWARNs on cleanup of temp dir; bug in Graphene
+[select01]
+must-pass =
+    1
+
+# TBROK: uses mknodat() syscall not implemented in Graphene
+[select03]
+skip = yes
+
+[semctl01]
+skip = yes
+
+[semctl02]
+skip = yes
+
+[semctl03]
+skip = yes
+
+[semctl04]
+skip = yes
+
+[semctl05]
+skip = yes
+
+[semctl06]
+skip = yes
+
+[semctl07]
+skip = yes
+
+[semget01]
+skip = yes
+
+[semget02]
+skip = yes
+
+[semget03]
+skip = yes
+
+[semget05]
+skip = yes
+
+[semget06]
+skip = yes
+
+[semop01]
+skip = yes
+
+[semop02]
+skip = yes
+
+[semop03]
+skip = yes
+
+[semop04]
+timeout = 60
+
+[semop05]
+skip = yes
+
+[send01]
+must-pass =
+    1
+    2
+
+[sendfile02]
+skip = yes
+
+[sendfile02_64]
+skip = yes
+
+[sendfile03]
+skip = yes
+
+[sendfile03_64]
+timeout = 60
+
+[sendfile04]
+skip = yes
+
+[sendfile04_64]
+skip = yes
+
+[sendfile05]
+skip = yes
+
+[sendfile05_64]
+skip = yes
+
+[sendfile06]
+skip = yes
+
+[sendfile06_64]
+skip = yes
+
+[sendfile07]
+skip = yes
+
+[sendfile07_64]
+skip = yes
+
+[sendfile08]
+skip = yes
+
+[sendfile08_64]
+skip = yes
+
+[sendfile09]
+skip = yes
+
+[sendfile09_64]
+skip = yes
+
+[sendmsg01]
+skip = yes
+
+[sendmsg02]
+skip = yes
+
+[sendto01]
+skip = yes
+
+[sendto02]
+skip = yes
+
+[set_robust_list01]
+skip = yes
+
+[set_thread_area01]
+skip = yes
+
+[set_tid_address01]
+skip = yes
+
+[setdomainname01]
+skip = yes
+
+[setdomainname02]
+skip = yes
+
+[setdomainname03]
+skip = yes
+
+[setegid01]
+skip = yes
+
+[setegid02]
+skip = yes
+
+[setfsgid01]
+skip = yes
+
+[setfsgid01_16]
+skip = yes
+
+[setfsgid02]
+skip = yes
+
+[setfsgid02_16]
+skip = yes
+
+[setfsgid03]
+skip = yes
+
+[setfsgid03_16]
+skip = yes
+
+[setfsuid01]
+skip = yes
+
+[setfsuid01_16]
+skip = yes
+
+[setfsuid02]
+skip = yes
+
+[setfsuid02_16]
+skip = yes
+
+[setfsuid03]
+skip = yes
+
+[setfsuid03_16]
+skip = yes
+
+[setfsuid04]
+skip = yes
+
+[setfsuid04_16]
+skip = yes
+
+[setgid01]
+skip = yes
+
+[setgid01_16]
+skip = yes
+
+[setgid02]
+skip = yes
+
+[setgid02_16]
+skip = yes
+
+[setgid03]
+skip = yes
+
+[setgid03_16]
+skip = yes
+
+[setgroups01]
+skip = yes
+
+[setgroups01_16]
+skip = yes
+
+[setgroups02]
+skip = yes
+
+[setgroups02_16]
+skip = yes
+
+[setgroups03]
+must-pass =
+    1
+
+[setgroups03_16]
+skip = yes
+
+[setgroups04]
+skip = yes
+
+[setgroups04_16]
+skip = yes
+
+[sethostname01]
+skip = yes
+
+[sethostname02]
+skip = yes
+
+[sethostname03]
+skip = yes
+
+[setitimer01]
+skip = yes
+
+[setitimer02]
+skip = yes
+
+[setitimer03]
+skip = yes
+
+[setns01]
+skip = yes
+
+[setns02]
+skip = yes
+
+[setpgid01]
+skip = yes
+
+[setpgid02]
+skip = yes
+
+[setpgid03]
+skip = yes
+
+[setpgrp01]
+skip = yes
+
+[setpgrp02]
+skip = yes
+
+[setpriority01]
+skip = yes
+
+[setpriority02]
+skip = yes
+
+[setregid01]
+skip = yes
+
+[setregid01_16]
+skip = yes
+
+[setregid02]
+skip = yes
+
+[setregid02_16]
+skip = yes
+
+[setregid03]
+skip = yes
+
+[setregid03_16]
+skip = yes
+
+[setregid04]
+skip = yes
+
+[setregid04_16]
+skip = yes
+
+[setresgid01]
+skip = yes
+
+[setresgid01_16]
+skip = yes
+
+[setresgid02]
+skip = yes
+
+[setresgid02_16]
+skip = yes
+
+[setresgid03]
+skip = yes
+
+[setresgid03_16]
+skip = yes
+
+[setresgid04]
+skip = yes
+
+[setresgid04_16]
+skip = yes
+
+[setresuid01]
+skip = yes
+
+[setresuid01_16]
+skip = yes
+
+[setresuid02]
+skip = yes
+
+[setresuid02_16]
+skip = yes
+
+[setresuid03]
+skip = yes
+
+[setresuid03_16]
+skip = yes
+
+[setresuid04]
+skip = yes
+
+[setresuid04_16]
+skip = yes
+
+[setresuid05]
+skip = yes
+
+[setresuid05_16]
+skip = yes
+
+[setreuid01]
+skip = yes
+
+[setreuid01_16]
+skip = yes
+
+[setreuid02]
+skip = yes
+
+[setreuid02_16]
+skip = yes
+
+[setreuid03]
+skip = yes
+
+[setreuid03_16]
+skip = yes
+
+[setreuid04]
+skip = yes
+
+[setreuid04_16]
+skip = yes
+
+[setreuid05]
+skip = yes
+
+[setreuid05_16]
+skip = yes
+
+[setreuid06]
+skip = yes
+
+[setreuid06_16]
+skip = yes
+
+[setreuid07]
+skip = yes
+
+[setreuid07_16]
+skip = yes
+
+[setrlimit01]
+skip = yes
+
+[setrlimit02]
+skip = yes
+
+[setrlimit03]
+skip = yes
+
+[setrlimit04]
+skip = yes
+
+[setrlimit05]
+skip = yes
+
+[setrlimit06]
+skip = yes
+
+[setsid01]
+skip = yes
+
+[setsockopt01]
+must-pass =
+    1
+    2
+    3
+    5
+    6
+    7
+    8
+
+[setsockopt02]
+skip = yes
+
+[setsockopt03]
+skip = yes
+
+# this test fails on Glibc 2.31; see https://github.com/linux-test-project/ltp/issues/646
+[settimeofday01]
+skip = yes
+
+[settimeofday02]
+skip = yes
+
+[setuid01]
+timeout = 60
+
+[setuid01_16]
+skip = yes
+
+[setuid02]
+timeout = 60
+
+[setuid03]
+skip = yes
+
+[setuid03_16]
+skip = yes
+
+[setuid04]
+skip = yes
+
+[setuid04_16]
+skip = yes
+
+[setxattr01]
+skip = yes
+
+[setxattr02]
+skip = yes
+
+[setxattr03]
+skip = yes
+
+[sgetmask01]
+skip = yes
+
+[shmat01]
+skip = yes
+
+[shmat02]
+skip = yes
+
+[shmat03]
+skip = yes
+
+[shmctl01]
+skip = yes
+
+[shmctl02]
+skip = yes
+
+[shmctl03]
+skip = yes
+
+[shmctl04]
+skip = yes
+
+[shmctl05]
+skip = yes
+
+[shmdt01]
+skip = yes
+
+[shmdt02]
+skip = yes
+
+[shmget01]
+skip = yes
+
+[shmget02]
+skip = yes
+
+[shmget03]
+skip = yes
+
+[shmget04]
+skip = yes
+
+[shmget05]
+skip = yes
+
+[sigaction01]
+must-pass =
+    4
+
+[sigaction02]
+skip = yes
+
+[sigaltstack01]
+skip = yes
+
+[sigaltstack02]
+timeout = 60
+
+[sighold02]
+skip = yes
+
+[signal01]
+skip = yes
+
+[signal02]
+skip = yes
+
+[signal03]
+skip = yes
+
+[signal04]
+skip = yes
+
+[signal05]
+skip = yes
+
+[signal06]
+skip = yes
+
+[signalfd01]
+skip = yes
+
+[signalfd4_01]
+skip = yes
+
+[signalfd4_02]
+skip = yes
+
+[sigpending02]
+skip = yes
+
+[sigprocmask01]
+skip = yes
+
+[sigrelse01]
+skip = yes
+
+[sigsuspend01]
+skip = yes
+
+[sigtimedwait01]
+skip = yes
+
+[sigwait01]
+skip = yes
+
+[sigwaitinfo01]
+skip = yes
+
+[socket01]
+timeout = 60
+skip = yes
+
+[socket02]
+timeout = 60
+skip = yes
+
+[socketcall01]
+skip = yes
+
+[socketcall02]
+skip = yes
+
+[socketcall03]
+skip = yes
+
+[socketcall04]
+skip = yes
+
+[socketpair01]
+skip = yes
+
+[socketpair02]
+skip = yes
+
+[sockioctl01]
+timeout = 60
+skip = yes
+
+[splice01]
+skip = yes
+
+[splice03]
+skip = yes
+
+[splice04]
+skip = yes
+
+[splice05]
+skip = yes
+
+[ssetmask01]
+skip = yes
+
+[stat01]
+skip = yes
+
+[stat01_64]
+skip = yes
+
+[stat02]
+skip = yes
+
+[stat02_64]
+skip = yes
+
+[stat03]
+skip = yes
+
+[stat03_64]
+skip = yes
+
+[stat04]
+skip = yes
+
+[stat04_64]
+skip = yes
+
+[stat05_64]
+timeout = 60
+
+[stat06]
+skip = yes
+
+[stat06_64]
+skip = yes
+
+[statfs01]
+skip = yes
+
+[statfs01_64]
+skip = yes
+
+[statfs02]
+skip = yes
+
+[statfs02_64]
+skip = yes
+
+[statfs03]
+skip = yes
+
+[statfs03_64]
+skip = yes
+
+[statvfs01]
+skip = yes
+
+[statvfs02]
+skip = yes
+
+[statx01]
+skip = yes
+
+[statx02]
+skip = yes
+
+[statx03]
+skip = yes
+
+[statx04]
+skip = yes
+
+[statx05]
+skip = yes
+
+[statx06]
+skip = yes
+
+[statx07]
+skip = yes
+
+[stime01]
+timeout = 80
+skip = yes
+
+[stime02]
+skip = yes
+
+[string01]
+skip = yes
+
+[swapoff01]
+skip = yes
+
+[swapoff02]
+skip = yes
+
+[swapon01]
+skip = yes
+
+[swapon02]
+skip = yes
+
+[swapon03]
+skip = yes
+
+[switch01]
+skip = yes
+
+[symlink01]
+skip = yes
+
+[symlink02]
+skip = yes
+
+[symlink03]
+skip = yes
+
+[symlink04]
+skip = yes
+
+[symlink05]
+skip = yes
+
+[symlinkat01]
+skip = yes
+
+[sync01]
+timeout = 60
+
+[sync02]
+skip = yes
+
+[sync03]
+skip = yes
+
+[sync_file_range01]
+skip = yes
+
+[sync_file_range02]
+skip = yes
+
+[syncfs01]
+skip = yes
+
+[syscall01]
+timeout = 80
+skip = yes
+
+[sysconf01]
+skip = yes
+
+[sysctl01]
+skip = yes
+
+[sysctl03]
+skip = yes
+
+[sysctl04]
+skip = yes
+
+[sysfs01]
+skip = yes
+
+[sysfs02]
+skip = yes
+
+[sysfs03]
+skip = yes
+
+[sysfs04]
+skip = yes
+
+[sysfs05]
+skip = yes
+
+[sysfs06]
+skip = yes
+
+[sysinfo01]
+skip = yes
+
+[sysinfo02]
+skip = yes
+
+[syslog01]
+skip = yes
+
+[syslog02]
+skip = yes
+
+[syslog03]
+skip = yes
+
+[syslog04]
+skip = yes
+
+[syslog05]
+skip = yes
+
+[syslog06]
+skip = yes
+
+[syslog07]
+skip = yes
+
+[syslog08]
+skip = yes
+
+[syslog09]
+skip = yes
+
+[syslog10]
+skip = yes
+
+[syslog11]
+skip = yes
+
+[syslog12]
+skip = yes
+
+[tee01]
+skip = yes
+
+[tee02]
+skip = yes
+
+[tgkill01]
+skip = yes
+
+[tgkill02]
+skip = yes
+
+[tgkill03]
+skip = yes
+
+[time01]
+skip = yes
+
+[time02]
+skip = yes
+
+[timer_getoverrun01]
+skip = yes
+
+[timer_gettime01]
+skip = yes
+
+[timerfd01]
+skip = yes
+
+[timerfd02]
+skip = yes
+
+[timerfd03]
+skip = yes
+
+[timerfd_create01]
+skip = yes
+
+[timerfd_gettime01]
+skip = yes
+
+[timerfd_settime01]
+skip = yes
+
+[times01]
+skip = yes
+
+[times03]
+skip = yes
+
+[tkill01]
+skip = yes
+
+[tkill02]
+skip = yes
+
+[trace05]
+skip = yes
+
+[truncate01]
+skip = yes
+
+[truncate01_64]
+skip = yes
+
+[truncate02]
+skip = yes
+
+[truncate02_64]
+skip = yes
+
+[truncate03]
+skip = yes
+
+[truncate03_64]
+skip = yes
+
+[ulimit01]
+skip = yes
+
+[umask01]
+skip = yes
+
+[umount01]
+skip = yes
+
+[umount02]
+skip = yes
+
+[umount03]
+skip = yes
+
+[umount2_01]
+skip = yes
+
+[umount2_02]
+skip = yes
+
+[umount2_03]
+skip = yes
+
+[uname01]
+skip = yes
+
+[uname02]
+skip = yes
+
+[uname03]
+skip = yes
+
+[uname04]
+skip = yes
+
+[unlink01]
+skip = yes
+
+[unlink05]
+skip = yes
+
+[unlink07]
+skip = yes
+
+[unlink08]
+skip = yes
+
+[unlinkat01]
+skip = yes
+
+[unshare01]
+skip = yes
+
+[unshare02]
+skip = yes
+
+[userfaultfd01]
+skip = yes
+
+[ustat01]
+skip = yes
+
+[ustat02]
+skip = yes
+
+[utime01]
+skip = yes
+
+[utime01A]
+skip = yes
+
+[utime02]
+skip = yes
+
+[utime03]
+skip = yes
+
+[utime04]
+skip = yes
+
+[utime05]
+skip = yes
+
+[utime06]
+skip = yes
+
+[utimensat01]
+skip = yes
+
+[utimes01]
+skip = yes
+
+[vfork01]
+skip = yes
+
+[vfork02]
+skip = yes
+
+[vhangup01]
+skip = yes
+
+[vhangup02]
+skip = yes
+
+[vmsplice01]
+skip = yes
+
+[vmsplice02]
+skip = yes
+
+[wait01]
+skip = yes
+
+[wait02]
+skip = yes
+
+[wait401]
+timeout = 60
+skip = yes
+
+[wait402]
+skip = yes
+
+[waitid01]
+skip = yes
+
+[waitid02]
+skip = yes
+
+[waitpid01]
+skip = yes
+
+[waitpid02]
+skip = yes
+
+[waitpid03]
+timeout = 80
+
+[waitpid04]
+skip = yes
+
+[waitpid05]
+timeout = 240
+skip = yes
+
+[waitpid06]
+skip = yes
+
+[waitpid07]
+skip = yes
+
+[waitpid08]
+skip = yes
+
+[waitpid09]
+skip = yes
+
+[waitpid10]
+skip = yes
+
+[waitpid11]
+skip = yes
+
+[waitpid12]
+skip = yes
+
+[waitpid13]
+skip = yes
+
+[write01]
+skip = yes
+
+[write02]
+skip = yes
+
+[write03]
+timeout = 60
+skip = yes
+
+[write04]
+skip = yes
+
+[write05]
+timeout = 60
+skip = yes
+
+[writev01]
+skip = yes
+
+[writev02]
+skip = yes
+
+[writev05]
+skip = yes
+
+[writev06]
+skip = yes
+
+[writev07]
+skip = yes
diff --git a/LibOS/shim/test/ltp/ltp.cfg b/LibOS/shim/test/ltp/ltp.cfg
new file mode 100644
index 00000000..ecf1497a
--- /dev/null
+++ b/LibOS/shim/test/ltp/ltp.cfg
@@ -0,0 +1,3276 @@
+# KEEP THIS FILE SORTED
+# in case of trouble, use ./contrib/conf_lint.py < FILENAME
+
+[DEFAULT]
+timeout = 30
+
+
+[abort01]
+must-pass =
+    2
+
+[access01]
+skip = yes
+
+[access02]
+skip = yes
+
+[access04]
+skip = yes
+
+[acct01]
+skip = yes
+
+[add_key01]
+skip = yes
+
+[add_key02]
+skip = yes
+
+[add_key03]
+skip = yes
+
+[add_key04]
+skip = yes
+
+[adjtimex01]
+skip = yes
+
+[adjtimex02]
+skip = yes
+
+[alarm02]
+timeout = 40
+
+[alarm03]
+timeout = 40
+
+[alarm05]
+timeout = 40
+
+[alarm06]
+timeout = 16
+
+[asyncio02]
+timeout = 80
+
+[bdflush01]
+skip = yes
+
+[bind01]
+must-pass =
+    1
+    2
+    3
+    4
+    5
+
+[bind02]
+skip = yes
+
+[brk01]
+timeout = 40
+
+[cacheflush01]
+skip = yes
+
+[capget01]
+skip = yes
+
+[capget02]
+skip = yes
+
+[capset01]
+skip = yes
+
+[capset02]
+skip = yes
+
+[chdir01]
+must-pass =
+    1
+
+[chdir01A]
+skip = yes
+
+[chdir03]
+skip = yes
+
+[chmod01A]
+skip = yes
+
+[chmod02]
+timeout = 40
+
+[chmod05]
+skip = yes
+
+[chmod06]
+skip = yes
+
+[chmod07]
+skip = yes
+
+[chown01_16]
+skip = yes
+
+[chown02]
+skip = yes
+
+[chown02_16]
+skip = yes
+
+[chown03]
+skip = yes
+
+[chown03_16]
+skip = yes
+
+[chown04]
+skip = yes
+
+[chown04_16]
+skip = yes
+
+[chown05]
+skip = yes
+
+[chown05_16]
+skip = yes
+
+[chroot01]
+skip = yes
+
+[chroot03]
+skip = yes
+
+[chroot04]
+skip = yes
+
+[clock_adjtime01]
+skip = yes
+
+[clock_adjtime02]
+skip = yes
+
+[clock_getres01]
+must-pass =
+    1
+    2
+    3
+    4
+    6
+    7
+    8
+    9
+    10
+    11
+
+[clock_gettime02]
+must-pass =
+    3
+    4
+    5
+    6
+    7
+    8
+    9
+    10
+
+[clock_nanosleep01]
+timeout = 40
+must-pass =
+    3
+
+[clock_nanosleep02]
+must-pass =
+
+[clock_nanosleep2_01]
+skip = yes
+
+[clock_settime01]
+skip = yes
+
+[clock_settime02]
+skip = yes
+
+[clone02]
+skip = yes
+
+[clone03]
+timeout = 40
+
+[clone05]
+skip = yes
+
+[clone06]
+timeout = 40
+
+[clone08]
+skip = yes
+
+[clone09]
+skip = yes
+
+[copy_file_range01]
+skip = yes
+
+[creat04]
+skip = yes
+
+[creat05]
+skip = yes
+
+[creat06]
+skip = yes
+
+[creat07]
+skip = yes
+
+[creat08]
+skip = yes
+
+[delete_module01]
+skip = yes
+
+[delete_module02]
+skip = yes
+
+[delete_module03]
+skip = yes
+
+[dirtyc0w]
+skip = yes
+
+[dup03]
+skip = yes
+
+[dup05]
+skip = yes
+
+[dup06]
+skip = yes
+
+[dup07]
+must-pass =
+    1
+    2
+    3
+
+[dup201]
+must-pass =
+    1
+    2
+
+[dup202]
+must-pass =
+    1
+    2
+    3
+
+[dup204]
+timeout = 40
+
+[dup205]
+skip = yes
+
+[dup3_01]
+skip = yes
+
+[dup3_02]
+skip = yes
+
+# complex test, not all of its checking is implemented in Graphene
+[epoll01]
+skip = yes
+
+# segfault: uses sigprocmask and sends signals, broken in Graphene
+[epoll_pwait01]
+skip = yes
+
+[eventfd01]
+skip = yes
+
+[eventfd2_01]
+skip = yes
+
+[eventfd2_02]
+skip = yes
+
+[eventfd2_03]
+skip = yes
+
+[execl01]
+must-pass =
+    1
+
+[execle01]
+skip = yes
+
+[execlp01]
+must-pass =
+    1
+
+[execv01]
+must-pass =
+    1
+
+[execve01]
+skip = yes
+
+[execve02]
+skip = yes
+
+[execve03]
+skip = yes
+
+[execve04]
+skip = yes
+
+[execve05]
+skip = yes
+
+[execveat01]
+skip = yes
+
+[execveat02]
+skip = yes
+
+[execveat03]
+skip = yes
+
+[execvp01]
+must-pass =
+    1
+
+[exit01]
+timeout = 40
+
+[faccessat01]
+timeout = 80
+
+[fallocate01]
+skip = yes
+
+[fallocate02]
+skip = yes
+
+[fallocate03]
+skip = yes
+
+[fallocate04]
+skip = yes
+
+[fallocate05]
+skip = yes
+
+[fanotify01]
+skip = yes
+
+[fanotify02]
+skip = yes
+
+[fanotify03]
+skip = yes
+
+[fanotify04]
+skip = yes
+
+[fanotify05]
+skip = yes
+
+[fanotify06]
+skip = yes
+
+[fanotify07]
+skip = yes
+
+[fanotify08]
+skip = yes
+
+[fanotify09]
+skip = yes
+
+[fanotify10]
+skip = yes
+
+[fanotify11]
+skip = yes
+
+[fanotify12]
+skip = yes
+
+[fchdir02]
+timeout = 40
+
+[fchdir03]
+skip = yes
+
+[fchmod02]
+skip = yes
+
+[fchmod03]
+skip = yes
+
+[fchmod04]
+skip = yes
+
+[fchmod05]
+skip = yes
+
+[fchmod06]
+skip = yes
+
+[fchmod07]
+timeout = 40
+
+[fchmodat01]
+timeout = 40
+
+[fchown01_16]
+skip = yes
+
+[fchown02]
+must-pass =
+    4
+
+[fchown02_16]
+skip = yes
+
+[fchown03]
+skip = yes
+
+[fchown03_16]
+skip = yes
+
+[fchown04]
+skip = yes
+
+[fchown04_16]
+skip = yes
+
+[fchown05]
+skip = yes
+
+[fchown05_16]
+skip = yes
+
+[fchownat01]
+skip = yes
+
+[fchownat02]
+skip = yes
+
+[fcntl01]
+skip = yes
+
+[fcntl01_64]
+skip = yes
+
+[fcntl02_64]
+timeout = 40
+
+[fcntl05]
+skip = yes
+
+[fcntl05_64]
+skip = yes
+
+[fcntl06]
+skip = yes
+
+[fcntl06_64]
+skip = yes
+
+[fcntl07]
+skip = yes
+
+[fcntl07_64]
+skip = yes
+
+[fcntl08_64]
+timeout = 40
+
+[fcntl09]
+skip = yes
+
+[fcntl09_64]
+skip = yes
+
+[fcntl10]
+skip = yes
+
+[fcntl10_64]
+skip = yes
+
+[fcntl11]
+skip = yes
+
+[fcntl11_64]
+skip = yes
+
+[fcntl12]
+skip = yes
+
+[fcntl12_64]
+skip = yes
+
+[fcntl13]
+must-pass =
+    6
+
+[fcntl13_64]
+timeout = 40
+must-pass =
+    6
+
+[fcntl14]
+skip = yes
+
+[fcntl14_64]
+skip = yes
+
+[fcntl15]
+skip = yes
+
+[fcntl15_64]
+skip = yes
+
+[fcntl16]
+skip = yes
+
+[fcntl16_64]
+skip = yes
+
+[fcntl17]
+skip = yes
+
+[fcntl17_64]
+skip = yes
+
+[fcntl18]
+skip = yes
+
+[fcntl18_64]
+skip = yes
+
+[fcntl19]
+skip = yes
+
+[fcntl19_64]
+skip = yes
+
+[fcntl20]
+skip = yes
+
+[fcntl20_64]
+skip = yes
+
+[fcntl21]
+skip = yes
+
+[fcntl21_64]
+skip = yes
+
+[fcntl22]
+skip = yes
+
+[fcntl22_64]
+skip = yes
+
+[fcntl23]
+skip = yes
+
+[fcntl23_64]
+skip = yes
+
+[fcntl24]
+skip = yes
+
+[fcntl24_64]
+skip = yes
+
+[fcntl25]
+skip = yes
+
+[fcntl25_64]
+skip = yes
+
+[fcntl26]
+skip = yes
+
+[fcntl26_64]
+skip = yes
+
+[fcntl28]
+must-pass =
+    1
+
+[fcntl28_64]
+must-pass =
+    1
+
+[fcntl30]
+skip = yes
+
+[fcntl30_64]
+skip = yes
+
+[fcntl31]
+skip = yes
+
+[fcntl31_64]
+skip = yes
+
+[fcntl32]
+skip = yes
+
+[fcntl32_64]
+skip = yes
+
+[fcntl33]
+skip = yes
+
+[fcntl33_64]
+skip = yes
+
+[fcntl34]
+skip = yes
+
+[fcntl34_64]
+skip = yes
+
+[fcntl35]
+skip = yes
+
+[fcntl35_64]
+skip = yes
+
+[fcntl36]
+skip = yes
+
+[fcntl36_64]
+skip = yes
+
+[fdatasync02]
+must-pass =
+    1
+
+[fdatasync03]
+skip = yes
+
+[fgetxattr01]
+skip = yes
+
+[fgetxattr02]
+skip = yes
+
+[fgetxattr03]
+skip = yes
+
+[flistxattr01]
+skip = yes
+
+[flistxattr02]
+skip = yes
+
+[flistxattr03]
+skip = yes
+
+[flock01]
+skip = yes
+
+[flock02]
+skip = yes
+
+[flock03]
+skip = yes
+
+[flock04]
+skip = yes
+
+[flock06]
+must-pass =
+    2
+
+[fork02]
+timeout = 40
+
+[fork05]
+skip = yes
+
+[fork06]
+skip = yes
+
+[fork07]
+skip = yes
+
+[fork08]
+skip = yes
+
+[fork09]
+skip = yes
+
+[fork10]
+skip = yes
+
+[fork12]
+skip = yes
+
+[fork13]
+skip = yes
+
+[fork14]
+skip = yes
+
+[fremovexattr01]
+skip = yes
+
+[fremovexattr02]
+skip = yes
+
+[fsetxattr01]
+skip = yes
+
+[fsetxattr02]
+skip = yes
+
+[fstat02]
+skip = yes
+
+[fstat02_64]
+skip = yes
+
+[fstat05]
+skip = yes
+
+[fstat05_64]
+skip = yes
+
+[fstatfs01]
+skip = yes
+
+[fstatfs01_64]
+skip = yes
+
+[fstatfs02]
+skip = yes
+
+[fstatfs02_64]
+skip = yes
+
+[fsync01]
+timeout = 60
+skip = yes
+
+[fsync02]
+skip = yes
+
+[fsync03]
+timeout = 40
+must-pass =
+    1
+
+[fsync04]
+timeout = 60
+skip = yes
+
+[ftruncate04]
+skip = yes
+
+[ftruncate04_64]
+skip = yes
+
+[futex_wait02]
+skip = yes
+
+[futex_wait03]
+skip = yes
+
+[futex_wait_bitset02]
+timeout = 40
+
+[futex_wake02]
+skip = yes
+
+[futex_wake03]
+skip = yes
+
+[futex_wake04]
+skip = yes
+
+[futimesat01]
+skip = yes
+
+[get_mempolicy01]
+skip = yes
+
+[get_robust_list01]
+skip = yes
+
+[getcpu01]
+skip = yes
+
+[getcwd03]
+skip = yes
+
+[getcwd04]
+must-pass =
+    2
+
+[getdents01]
+skip = yes
+
+[getdents01_64]
+skip = yes
+
+[getdents02_64]
+skip = yes
+
+[getdtablesize01]
+must-pass =
+    1
+
+[getegid01_16]
+skip = yes
+
+[getegid02_16]
+skip = yes
+
+[geteuid01_16]
+skip = yes
+
+[geteuid02_16]
+skip = yes
+
+[getgid01_16]
+skip = yes
+
+[getgid03_16]
+skip = yes
+
+[getgroups01_16]
+skip = yes
+
+[getgroups03_16]
+skip = yes
+
+[gethostid01]
+skip = yes
+
+[gethostname01]
+timeout = 40
+
+[getitimer01]
+must-pass =
+    1
+    3
+    5
+
+[getitimer02]
+skip = yes
+
+[getitimer03]
+skip = yes
+
+[getpeername01]
+must-pass =
+    1
+    2
+    3
+    4
+    5
+    6
+
+[getpgid01]
+must-pass =
+    1
+    2
+
+[getpgid02]
+skip = yes
+
+[getpid02]
+timeout = 40
+
+[getppid02]
+skip = yes
+
+[getpriority01]
+skip = yes
+
+[getpriority02]
+skip = yes
+
+[getrandom01]
+skip = yes
+
+[getrandom02]
+skip = yes
+
+[getrandom03]
+skip = yes
+
+[getrandom04]
+skip = yes
+
+[getresgid01]
+skip = yes
+
+[getresgid01_16]
+skip = yes
+
+[getresgid02]
+skip = yes
+
+[getresgid02_16]
+skip = yes
+
+[getresgid03]
+skip = yes
+
+[getresgid03_16]
+skip = yes
+
+[getresuid01]
+skip = yes
+
+[getresuid01_16]
+skip = yes
+
+[getresuid02]
+skip = yes
+
+[getresuid02_16]
+skip = yes
+
+[getresuid03]
+skip = yes
+
+[getresuid03_16]
+skip = yes
+
+[getrlimit03]
+skip = yes
+
+[getrusage01]
+skip = yes
+
+[getrusage02]
+skip = yes
+
+[getrusage03]
+skip = yes
+
+[getrusage04]
+skip = yes
+
+[getsid02]
+skip = yes
+
+[getsockname01]
+must-pass =
+    3
+    4
+
+[getsockopt01]
+must-pass =
+    1
+    2
+    3
+    4
+    8
+    9
+
+[getsockopt02]
+skip = yes
+
+[gettid01]
+timeout = 40
+
+[gettimeofday01]
+skip = yes
+
+[gettimeofday02]
+skip = yes
+
+[getuid01_16]
+skip = yes
+
+[getuid03_16]
+skip = yes
+
+[getxattr01]
+skip = yes
+
+[getxattr02]
+skip = yes
+
+[getxattr03]
+skip = yes
+
+[getxattr04]
+skip = yes
+
+[getxattr05]
+skip = yes
+
+[inotify01]
+skip = yes
+
+[inotify02]
+skip = yes
+
+[inotify03]
+skip = yes
+
+[inotify04]
+skip = yes
+
+[inotify05]
+skip = yes
+
+[inotify06]
+skip = yes
+
+[inotify07]
+skip = yes
+
+[inotify08]
+skip = yes
+
+[inotify09]
+skip = yes
+
+[inotify_init1_01]
+skip = yes
+
+[inotify_init1_02]
+skip = yes
+
+[io_cancel01]
+skip = yes
+
+[io_destroy01]
+skip = yes
+
+[io_getevents01]
+skip = yes
+
+[io_setup01]
+skip = yes
+
+[io_submit01]
+skip = yes
+
+[ioctl01_02]
+skip = yes
+
+[ioctl03]
+skip = yes
+
+[ioctl04]
+skip = yes
+
+[ioctl05]
+skip = yes
+
+[ioctl06]
+skip = yes
+
+[ioctl07]
+skip = yes
+
+[ioctl08]
+skip = yes
+
+[ioctl_ns01]
+skip = yes
+
+[ioctl_ns02]
+skip = yes
+
+[ioctl_ns03]
+skip = yes
+
+[ioctl_ns04]
+skip = yes
+
+[ioctl_ns05]
+skip = yes
+
+[ioctl_ns06]
+skip = yes
+
+[ioctl_ns07]
+skip = yes
+
+[ioperm01]
+skip = yes
+
+[ioperm02]
+skip = yes
+
+[iopl01]
+skip = yes
+
+[iopl02]
+skip = yes
+
+[kcmp01]
+skip = yes
+
+[kcmp02]
+skip = yes
+
+[kcmp03]
+skip = yes
+
+[keyctl01]
+skip = yes
+
+[keyctl02]
+skip = yes
+
+[keyctl03]
+skip = yes
+
+[keyctl04]
+skip = yes
+
+[keyctl05]
+skip = yes
+
+[keyctl06]
+skip = yes
+
+[keyctl07]
+skip = yes
+
+[keyctl08]
+skip = yes
+
+[kill02]
+skip = yes
+
+[kill04]
+skip = yes
+
+[kill05]
+skip = yes
+
+[kill06]
+skip = yes
+
+[kill07]
+skip = yes
+
+[kill08]
+skip = yes
+
+[kill09]
+timeout = 80
+
+[kill10]
+skip = yes
+
+[lchown01]
+skip = yes
+
+[lchown01_16]
+skip = yes
+
+[lchown02]
+skip = yes
+
+[lchown02_16]
+skip = yes
+
+[lchown03]
+skip = yes
+
+[lchown03_16]
+skip = yes
+
+[lgetxattr01]
+skip = yes
+
+[lgetxattr02]
+skip = yes
+
+[link01]
+skip = yes
+
+[link02]
+skip = yes
+
+[link03]
+skip = yes
+
+[link04]
+skip = yes
+
+[link05]
+skip = yes
+
+[link06]
+skip = yes
+
+[link07]
+skip = yes
+
+[link08]
+skip = yes
+
+[linkat01]
+skip = yes
+
+[linkat02]
+skip = yes
+
+[listen01]
+must-pass =
+    1
+    2
+
+[listxattr01]
+skip = yes
+
+[listxattr02]
+skip = yes
+
+[listxattr03]
+skip = yes
+
+[llistxattr01]
+skip = yes
+
+[llistxattr02]
+skip = yes
+
+[llistxattr03]
+skip = yes
+
+[llseek01]
+skip = yes
+
+[lremovexattr01]
+skip = yes
+
+[lseek02]
+skip = yes
+timeout = 40
+
+[lseek10]
+skip = yes
+
+[lseek11]
+skip = yes
+
+[lstat01]
+skip = yes
+
+[lstat01A]
+skip = yes
+
+[lstat01A_64]
+skip = yes
+
+[lstat01_64]
+skip = yes
+
+[lstat02]
+skip = yes
+
+[lstat02_64]
+skip = yes
+
+[lstat03]
+skip = yes
+
+[lstat03_64]
+skip = yes
+
+[madvise01]
+skip = yes
+
+[madvise02]
+skip = yes
+
+[madvise05]
+skip = yes
+
+[madvise06]
+skip = yes
+
+[madvise07]
+skip = yes
+
+[madvise08]
+skip = yes
+
+[madvise09]
+skip = yes
+
+[madvise10]
+skip = yes
+
+[mbind01]
+skip = yes
+
+[membarrier01]
+skip = yes
+
+[memfd_create01]
+skip = yes
+
+[memfd_create02]
+skip = yes
+
+[memfd_create03]
+skip = yes
+
+[memfd_create04]
+skip = yes
+
+[migrate_pages01]
+skip = yes
+
+[migrate_pages02]
+skip = yes
+
+[migrate_pages03]
+skip = yes
+
+[mincore02]
+skip = yes
+
+[mkdir01]
+skip = yes
+
+[mkdir02]
+skip = yes
+
+[mkdir03]
+skip = yes
+
+[mkdir04]
+skip = yes
+
+[mkdir05]
+skip = yes
+
+[mkdir05A]
+skip = yes
+
+[mkdir09]
+skip = yes
+
+[mkdirat02]
+skip = yes
+
+[mknod01]
+skip = yes
+
+[mknod02]
+skip = yes
+
+[mknod03]
+skip = yes
+
+[mknod04]
+skip = yes
+
+[mknod05]
+skip = yes
+
+[mknod06]
+skip = yes
+
+[mknod07]
+timeout = 60
+skip = yes
+
+[mknod08]
+skip = yes
+
+[mknod09]
+skip = yes
+
+[mknodat01]
+skip = yes
+
+[mknodat02]
+skip = yes
+
+[mlock01]
+skip = yes
+
+[mlock02]
+skip = yes
+
+[mlock04]
+skip = yes
+
+[mlock201]
+skip = yes
+
+[mlock202]
+skip = yes
+
+[mlock203]
+skip = yes
+
+[mlockall01]
+skip = yes
+
+[mlockall02]
+skip = yes
+
+[mlockall03]
+skip = yes
+
+[mmap001]
+must-pass =
+    1
+    2
+    4
+
+[mmap01]
+skip = yes
+
+[mmap06]
+skip = yes
+
+[mmap07]
+skip = yes
+
+[mmap12]
+skip = yes
+
+[mmap14]
+skip = yes
+
+[mmap16]
+skip = yes
+
+[modify_ldt01]
+skip = yes
+
+[modify_ldt02]
+skip = yes
+
+[modify_ldt03]
+skip = yes
+
+[mount01]
+skip = yes
+
+[mount02]
+skip = yes
+
+[mount03]
+skip = yes
+
+[mount04]
+skip = yes
+
+[mount05]
+skip = yes
+
+[mount06]
+skip = yes
+
+[move_pages01]
+skip = yes
+
+[move_pages02]
+skip = yes
+
+[move_pages03]
+skip = yes
+
+[move_pages04]
+skip = yes
+
+[move_pages05]
+skip = yes
+
+[move_pages06]
+skip = yes
+
+[move_pages07]
+skip = yes
+
+[move_pages08]
+skip = yes
+
+[move_pages09]
+skip = yes
+
+[move_pages10]
+skip = yes
+
+[move_pages11]
+skip = yes
+
+[move_pages12]
+skip = yes
+
+[mprotect01]
+must-pass =
+    2
+
+[mprotect04]
+timeout = 40
+
+[mq_notify01]
+skip = yes
+
+[mq_notify02]
+skip = yes
+
+[mq_open01]
+skip = yes
+
+[mq_timedreceive01]
+skip = yes
+
+[mq_timedsend01]
+skip = yes
+
+[mq_unlink01]
+skip = yes
+
+[mremap01]
+skip = yes
+
+[mremap02]
+skip = yes
+
+[mremap03]
+skip = yes
+
+[mremap04]
+skip = yes
+
+[mremap05]
+skip = yes
+
+[msgctl01]
+skip = yes
+
+[msgctl02]
+skip = yes
+
+[msgctl03]
+skip = yes
+
+[msgctl04]
+skip = yes
+
+[msgctl07]
+skip = yes
+
+[msgctl12]
+skip = yes
+
+[msgget02]
+must-pass =
+    1
+    2
+    3
+
+[msgget03]
+skip = yes
+
+[msgrcv02]
+skip = yes
+
+[msgrcv03]
+skip = yes
+
+[msgrcv04]
+skip = yes
+
+[msgrcv05]
+skip = yes
+
+[msgrcv06]
+skip = yes
+
+[msgrcv07]
+skip = yes
+
+[msgrcv08]
+skip = yes
+
+[msgsnd01]
+skip = yes
+timeout = 40
+
+[msgsnd02]
+skip = yes
+
+[msgsnd05]
+must-pass =
+    1
+
+[msgsnd06]
+skip = yes
+
+[msgstress01]
+skip = yes
+
+[msgstress02]
+skip = yes
+
+[msgstress03]
+skip = yes
+
+[msgstress04]
+skip = yes
+
+[msync01]
+skip = yes
+
+[msync02]
+skip = yes
+
+[msync03]
+skip = yes
+
+[msync04]
+skip = yes
+
+[munlock01]
+skip = yes
+
+[munlock02]
+skip = yes
+
+[munlockall01]
+skip = yes
+
+[nanosleep02]
+skip = yes
+
+[nanosleep04]
+skip = yes
+
+[newuname01]
+timeout = 40
+
+[nftw01]
+skip = yes
+
+[nftw6401]
+skip = yes
+
+[nice01]
+skip = yes
+
+[nice02]
+skip = yes
+
+[nice03]
+skip = yes
+
+[nice04]
+skip = yes
+
+[nosleep04]
+skip = yes
+
+[open01]
+skip = yes
+
+[open01A]
+skip = yes
+
+[open02]
+skip = yes
+
+[open04]
+skip = yes
+
+[open05]
+skip = yes
+
+[open06]
+skip = yes
+
+[open07]
+skip = yes
+
+[open08]
+must-pass =
+    1
+    2
+    4
+    6
+
+[open10]
+skip = yes
+
+[open11]
+skip = yes
+
+[open12]
+skip = yes
+
+[open13]
+skip = yes
+
+[open14]
+skip = yes
+
+[openat02]
+skip = yes
+
+[openat03]
+skip = yes
+
+[pause01]
+skip = yes
+
+[pause02]
+skip = yes
+
+[pause03]
+skip = yes
+
+[perf_event_open01]
+skip = yes
+
+[perf_event_open02]
+skip = yes
+
+[personality01]
+skip = yes
+
+[pipe02]
+skip = yes
+
+[pipe03]
+skip = yes
+
+[pipe06]
+skip = yes
+
+[pipe07]
+skip = yes
+
+[pipe08]
+skip = yes
+
+[pipe11]
+must-pass =
+    1
+
+[pipe2_02]
+skip = yes
+
+[pivot_root01]
+skip = yes
+
+[posix_fadvise01]
+skip = yes
+
+[posix_fadvise01_64]
+skip = yes
+
+[posix_fadvise02]
+skip = yes
+
+[posix_fadvise02_64]
+skip = yes
+
+[posix_fadvise03]
+skip = yes
+
+[posix_fadvise03_64]
+skip = yes
+
+[posix_fadvise04]
+skip = yes
+
+[posix_fadvise04_64]
+skip = yes
+
+# segfault: uses sigprocmask and sends signals, broken in Graphene
+[ppoll01]
+skip = yes
+
+[prctl01]
+skip = yes
+
+[prctl03]
+skip = yes
+
+[pread01]
+timeout = 40
+
+[pread01_64]
+timeout = 40
+
+[pread02]
+timeout = 40
+
+[pread03]
+skip = yes
+
+[pread03_64]
+skip = yes
+
+[preadv01]
+skip = yes
+timeout = 80
+
+[preadv01_64]
+skip = yes
+
+[preadv02]
+skip = yes
+
+[preadv02_64]
+skip = yes
+
+[preadv03]
+skip = yes
+
+[preadv03_64]
+skip = yes
+
+[preadv201]
+skip = yes
+
+[preadv201_64]
+skip = yes
+
+[preadv202]
+skip = yes
+
+[preadv202_64]
+skip = yes
+
+[process_vm01]
+skip = yes
+
+[process_vm_readv01]
+skip = yes
+
+[process_vm_readv02]
+skip = yes
+
+[process_vm_readv03]
+skip = yes
+
+[process_vm_writev01]
+skip = yes
+
+[process_vm_writev02]
+skip = yes
+
+[profil01]
+skip = yes
+
+[prot_hsymlinks]
+skip = yes
+
+[ptrace01]
+skip = yes
+
+[ptrace02]
+skip = yes
+
+[ptrace03]
+skip = yes
+
+[ptrace04]
+skip = yes
+
+[ptrace05]
+skip = yes
+
+[ptrace07]
+skip = yes
+
+[pwrite01_64]
+timeout = 40
+
+[pwrite03]
+skip = yes
+
+[pwrite03_64]
+skip = yes
+
+[pwrite04]
+must-pass =
+    2
+
+[pwrite04_64]
+timeout = 40
+must-pass =
+    2
+
+[pwritev01]
+skip = yes
+timeout = 40
+
+[pwritev01_64]
+skip = yes
+
+[pwritev02]
+skip = yes
+
+[pwritev02_64]
+skip = yes
+
+[pwritev03]
+skip = yes
+
+[pwritev03_64]
+skip = yes
+
+[pwritev201]
+skip = yes
+
+[pwritev201_64]
+skip = yes
+
+[pwritev202]
+skip = yes
+
+[pwritev202_64]
+skip = yes
+
+[qmm01]
+skip = yes
+
+[quotactl01]
+skip = yes
+
+[quotactl02]
+skip = yes
+
+[quotactl03]
+skip = yes
+
+[read01]
+timeout = 40
+
+[read02]
+skip = yes
+
+[read03]
+skip = yes
+
+[readahead01]
+skip = yes
+
+[readahead02]
+skip = yes
+
+[readdir01]
+timeout = 40
+
+[readdir21]
+skip = yes
+
+[readlink01]
+skip = yes
+
+[readlink01A]
+skip = yes
+
+[readlink03]
+skip = yes
+
+[readlinkat01]
+skip = yes
+
+[readlinkat02]
+skip = yes
+
+[readv01]
+timeout = 40
+
+[readv03]
+skip = yes
+
+[realpath01]
+skip = yes
+
+[reboot01]
+skip = yes
+
+[reboot02]
+skip = yes
+
+[recv01]
+must-pass =
+    1
+    2
+
+[recvfrom01]
+must-pass =
+    1
+    2
+
+[recvmsg01]
+must-pass =
+    1
+    2
+
+[recvmsg02]
+skip = yes
+
+[recvmsg03]
+skip = yes
+
+[remap_file_pages01]
+skip = yes
+
+[remap_file_pages02]
+skip = yes
+
+[removexattr01]
+skip = yes
+
+[removexattr02]
+skip = yes
+
+[rename01]
+skip = yes
+
+[rename01A]
+skip = yes
+
+[rename02]
+skip = yes
+
+[rename03]
+skip = yes
+
+[rename04]
+skip = yes
+
+[rename05]
+skip = yes
+
+[rename06]
+skip = yes
+
+[rename07]
+skip = yes
+
+[rename08]
+skip = yes
+
+[rename09]
+skip = yes
+
+[rename10]
+skip = yes
+
+[rename11]
+skip = yes
+
+[rename12]
+skip = yes
+
+[rename13]
+skip = yes
+
+[rename14]
+skip = yes
+
+[renameat01]
+skip = yes
+
+[renameat201]
+skip = yes
+
+[renameat202]
+skip = yes
+
+[request_key01]
+skip = yes
+
+[request_key02]
+skip = yes
+
+[request_key03]
+skip = yes
+
+[request_key04]
+skip = yes
+
+[request_key05]
+skip = yes
+
+[rmdir02]
+skip = yes
+
+[rmdir03]
+skip = yes
+
+[rmdir03A]
+skip = yes
+
+[rmdir05]
+skip = yes
+
+[rt_sigaction02]
+skip = yes
+
+[rt_sigprocmask01]
+skip = yes
+
+[rt_sigprocmask02]
+skip = yes
+
+[rt_sigqueueinfo01]
+skip = yes
+
+[rt_sigtimedwait01]
+skip = yes
+
+[rt_tgsigqueueinfo01]
+skip = yes
+
+[sbrk03]
+skip = yes
+
+[sched_get_priority_max01]
+skip = yes
+
+[sched_get_priority_max02]
+skip = yes
+
+[sched_get_priority_min01]
+skip = yes
+
+[sched_get_priority_min02]
+skip = yes
+
+[sched_getaffinity01]
+must-pass =
+    1
+    2
+    3
+
+[sched_getattr01]
+skip = yes
+
+[sched_getattr02]
+skip = yes
+
+[sched_getparam01]
+skip = yes
+
+[sched_getparam02]
+skip = yes
+
+[sched_getparam03]
+skip = yes
+
+[sched_getscheduler01]
+skip = yes
+
+[sched_getscheduler02]
+skip = yes
+
+[sched_rr_get_interval01]
+skip = yes
+
+[sched_rr_get_interval02]
+skip = yes
+
+[sched_rr_get_interval03]
+skip = yes
+
+[sched_setaffinity01]
+skip = yes
+
+[sched_setattr01]
+skip = yes
+
+[sched_setparam01]
+skip = yes
+
+[sched_setparam02]
+skip = yes
+
+[sched_setparam03]
+skip = yes
+
+[sched_setparam04]
+skip = yes
+
+[sched_setparam05]
+skip = yes
+
+[sched_setscheduler01]
+skip = yes
+
+[sched_setscheduler02]
+skip = yes
+
+[sched_setscheduler03]
+skip = yes
+
+# TBROK: uses mknodat() syscall not implemented in Graphene
+[select03]
+skip = yes
+
+[semctl01]
+must-pass =
+    2
+    3
+
+[semctl02]
+skip = yes
+
+[semctl03]
+skip = yes
+
+[semctl04]
+skip = yes
+
+[semctl05]
+skip = yes
+
+[semctl06]
+skip = yes
+
+[semctl07]
+skip = yes
+
+[semget01]
+skip = yes
+
+[semget02]
+must-pass =
+    2
+
+[semget05]
+skip = yes
+
+[semget06]
+skip = yes
+
+[semop02]
+skip = yes
+
+[semop03]
+skip = yes
+
+[semop04]
+timeout = 40
+
+[semop05]
+skip = yes
+
+[send01]
+must-pass =
+    1
+    2
+    3
+
+[sendfile02]
+skip = yes
+
+[sendfile02_64]
+skip = yes
+
+[sendfile03_64]
+timeout = 40
+
+[sendfile04]
+skip = yes
+
+[sendfile04_64]
+skip = yes
+
+[sendfile06]
+skip = yes
+
+[sendfile06_64]
+skip = yes
+
+[sendfile07]
+skip = yes
+
+[sendfile07_64]
+skip = yes
+
+[sendfile08]
+skip = yes
+
+[sendfile08_64]
+skip = yes
+
+[sendfile09]
+skip = yes
+
+[sendfile09_64]
+skip = yes
+
+[sendmsg01]
+skip = yes
+
+[sendmsg02]
+skip = yes
+
+[sendto01]
+must-pass =
+    1
+    2
+    3
+    4
+    7
+
+[set_robust_list01]
+skip = yes
+
+[set_thread_area01]
+skip = yes
+
+[setdomainname01]
+skip = yes
+
+[setdomainname02]
+skip = yes
+
+[setdomainname03]
+skip = yes
+
+[setegid01]
+skip = yes
+
+[setegid02]
+skip = yes
+
+[setfsgid01]
+skip = yes
+
+[setfsgid01_16]
+skip = yes
+
+[setfsgid02]
+skip = yes
+
+[setfsgid02_16]
+skip = yes
+
+[setfsgid03]
+skip = yes
+
+[setfsgid03_16]
+skip = yes
+
+[setfsuid01]
+skip = yes
+
+[setfsuid01_16]
+skip = yes
+
+[setfsuid02]
+skip = yes
+
+[setfsuid02_16]
+skip = yes
+
+[setfsuid03]
+skip = yes
+
+[setfsuid03_16]
+skip = yes
+
+[setfsuid04]
+skip = yes
+
+[setfsuid04_16]
+skip = yes
+
+[setgid01_16]
+skip = yes
+
+[setgid02]
+skip = yes
+
+[setgid02_16]
+skip = yes
+
+[setgid03]
+skip = yes
+
+[setgid03_16]
+skip = yes
+
+[setgroups01_16]
+skip = yes
+
+[setgroups02_16]
+skip = yes
+
+[setgroups03]
+must-pass =
+    1
+
+[setgroups03_16]
+skip = yes
+
+[setgroups04]
+skip = yes
+
+[setgroups04_16]
+skip = yes
+
+[sethostname01]
+skip = yes
+
+[sethostname02]
+skip = yes
+
+[sethostname03]
+skip = yes
+
+[setitimer02]
+skip = yes
+
+[setitimer03]
+skip = yes
+
+[setns01]
+skip = yes
+
+[setns02]
+skip = yes
+
+[setpgid02]
+skip = yes
+
+[setpgid03]
+skip = yes
+
+[setpriority01]
+skip = yes
+
+[setpriority02]
+skip = yes
+
+[setregid01]
+skip = yes
+
+[setregid01_16]
+skip = yes
+
+[setregid02]
+skip = yes
+
+[setregid02_16]
+skip = yes
+
+[setregid03]
+skip = yes
+
+[setregid03_16]
+skip = yes
+
+[setregid04]
+skip = yes
+
+[setregid04_16]
+skip = yes
+
+[setresgid01]
+skip = yes
+
+[setresgid01_16]
+skip = yes
+
+[setresgid02]
+skip = yes
+
+[setresgid02_16]
+skip = yes
+
+[setresgid03]
+skip = yes
+
+[setresgid03_16]
+skip = yes
+
+[setresgid04]
+skip = yes
+
+[setresgid04_16]
+skip = yes
+
+[setresuid01]
+skip = yes
+
+[setresuid01_16]
+skip = yes
+
+[setresuid02]
+skip = yes
+
+[setresuid02_16]
+skip = yes
+
+[setresuid03]
+skip = yes
+
+[setresuid03_16]
+skip = yes
+
+[setresuid04]
+skip = yes
+
+[setresuid04_16]
+skip = yes
+
+[setresuid05]
+skip = yes
+
+[setresuid05_16]
+skip = yes
+
+[setreuid01]
+skip = yes
+
+[setreuid01_16]
+skip = yes
+
+[setreuid02]
+skip = yes
+
+[setreuid02_16]
+skip = yes
+
+[setreuid03]
+skip = yes
+
+[setreuid03_16]
+skip = yes
+
+[setreuid04]
+skip = yes
+
+[setreuid04_16]
+skip = yes
+
+[setreuid05]
+skip = yes
+
+[setreuid05_16]
+skip = yes
+
+[setreuid06]
+skip = yes
+
+[setreuid06_16]
+skip = yes
+
+[setreuid07]
+skip = yes
+
+[setreuid07_16]
+skip = yes
+
+[setrlimit01]
+must-pass =
+    1
+    3
+    4
+
+[setrlimit02]
+must-pass =
+    1
+
+[setrlimit03]
+must-pass =
+    2
+
+[setrlimit04]
+skip = yes
+
+[setrlimit05]
+must-pass =
+    1
+
+[setrlimit06]
+skip = yes
+
+[setsid01]
+skip = yes
+
+[setsockopt01]
+must-pass =
+    1
+    2
+    3
+    5
+    6
+    7
+    8
+
+[setsockopt02]
+skip = yes
+
+[setsockopt03]
+must-pass =
+    2
+
+# this test fails on Glibc 2.31; see https://github.com/linux-test-project/ltp/issues/646
+[settimeofday01]
+skip = yes
+
+[settimeofday02]
+skip = yes
+
+[setuid01]
+timeout = 40
+
+[setuid01_16]
+skip = yes
+
+[setuid02]
+timeout = 40
+
+[setuid03]
+skip = yes
+
+[setuid03_16]
+skip = yes
+
+[setuid04]
+skip = yes
+
+[setuid04_16]
+skip = yes
+
+[setxattr01]
+skip = yes
+
+[setxattr02]
+skip = yes
+
+[setxattr03]
+skip = yes
+
+[sgetmask01]
+skip = yes
+
+[shmat01]
+skip = yes
+
+[shmat02]
+skip = yes
+
+[shmat03]
+skip = yes
+
+[shmctl01]
+skip = yes
+
+[shmctl02]
+skip = yes
+
+[shmctl03]
+skip = yes
+
+[shmctl04]
+skip = yes
+
+[shmctl05]
+skip = yes
+
+[shmdt01]
+skip = yes
+
+[shmdt02]
+skip = yes
+
+[shmget01]
+skip = yes
+
+[shmget02]
+skip = yes
+
+[shmget03]
+skip = yes
+
+[shmget04]
+skip = yes
+
+[shmget05]
+skip = yes
+
+[sigaction01]
+must-pass =
+    4
+
+[sigaltstack02]
+timeout = 40
+
+[sighold02]
+skip = yes
+
+[signal01]
+skip = yes
+
+[signal06]
+skip = yes
+
+[signalfd01]
+skip = yes
+
+[signalfd4_01]
+skip = yes
+
+[signalfd4_02]
+skip = yes
+
+[sigpending02]
+must-pass =
+    1
+
+[sigrelse01]
+skip = yes
+
+[sigtimedwait01]
+skip = yes
+
+[sigwait01]
+skip = yes
+
+[sigwaitinfo01]
+skip = yes
+
+[socket01]
+timeout = 40
+must-pass =
+    3
+    5
+    8
+
+[socket02]
+timeout = 40
+
+[socketcall01]
+skip = yes
+
+[socketpair01]
+must-pass =
+    1
+    5
+    6
+
+[socketpair02]
+must-pass =
+    1
+
+[sockioctl01]
+timeout = 40
+must-pass =
+    1
+
+[splice01]
+skip = yes
+
+[splice03]
+skip = yes
+
+[splice04]
+skip = yes
+
+[splice05]
+skip = yes
+
+[ssetmask01]
+skip = yes
+
+[stat03]
+skip = yes
+
+[stat03_64]
+skip = yes
+
+[stat04]
+skip = yes
+
+[stat04_64]
+skip = yes
+
+[stat05_64]
+timeout = 40
+
+[stat06]
+skip = yes
+
+[stat06_64]
+skip = yes
+
+[statfs01]
+skip = yes
+
+[statfs01_64]
+skip = yes
+
+[statfs02]
+skip = yes
+
+[statfs02_64]
+skip = yes
+
+[statfs03]
+skip = yes
+
+[statfs03_64]
+skip = yes
+
+[statvfs01]
+skip = yes
+
+[statvfs02]
+skip = yes
+
+[statx01]
+skip = yes
+
+[statx02]
+skip = yes
+
+[statx03]
+skip = yes
+
+[statx04]
+skip = yes
+
+[statx05]
+skip = yes
+
+[statx06]
+skip = yes
+
+[statx07]
+skip = yes
+
+[stime01]
+timeout = 80
+skip = yes
+
+[stime02]
+skip = yes
+
+[swapoff01]
+skip = yes
+
+[swapoff02]
+skip = yes
+
+[swapon01]
+skip = yes
+
+[swapon02]
+skip = yes
+
+[swapon03]
+skip = yes
+
+[switch01]
+skip = yes
+
+[symlink01]
+skip = yes
+
+[symlink02]
+skip = yes
+
+[symlink03]
+skip = yes
+
+[symlink04]
+skip = yes
+
+[symlink05]
+skip = yes
+
+[symlinkat01]
+skip = yes
+
+[sync01]
+timeout = 40
+
+[sync03]
+skip = yes
+
+[sync_file_range01]
+skip = yes
+
+[sync_file_range02]
+skip = yes
+
+[syncfs01]
+skip = yes
+
+[syscall01]
+timeout = 80
+
+# Graphene doesn't emulate all sysconf parameters, so we disable the ones not currently emulated
+[sysconf01]
+must-pass =
+    1
+    2
+    3
+    4
+    5
+    6
+    7
+    8
+    9
+    10
+    12
+    14
+    15
+    16
+    17
+    18
+    19
+    21
+    24
+    25
+    27
+    28
+    29
+    30
+    31
+    32
+    33
+    34
+    35
+    36
+    37
+    38
+    39
+    41
+    42
+    44
+    45
+    46
+    47
+    48
+    50
+    51
+    52
+    53
+    56
+
+[sysctl01]
+skip = yes
+
+[sysctl03]
+skip = yes
+
+[sysctl04]
+skip = yes
+
+[sysfs01]
+skip = yes
+
+[sysfs02]
+skip = yes
+
+[sysfs03]
+skip = yes
+
+[sysfs04]
+skip = yes
+
+[sysfs05]
+skip = yes
+
+[sysfs06]
+skip = yes
+
+[sysinfo01]
+skip = yes
+
+[sysinfo02]
+skip = yes
+
+[syslog01]
+skip = yes
+
+[syslog02]
+skip = yes
+
+[syslog03]
+skip = yes
+
+[syslog04]
+skip = yes
+
+[syslog05]
+skip = yes
+
+[syslog06]
+skip = yes
+
+[syslog07]
+skip = yes
+
+[syslog08]
+skip = yes
+
+[syslog09]
+skip = yes
+
+[syslog10]
+skip = yes
+
+[syslog11]
+skip = yes
+
+[syslog12]
+skip = yes
+
+[tee01]
+skip = yes
+
+[tee02]
+skip = yes
+
+[tgkill01]
+must-pass =
+    1
+
+[tgkill02]
+skip = yes
+
+[tgkill03]
+skip = yes
+
+[timer_getoverrun01]
+skip = yes
+
+[timer_gettime01]
+skip = yes
+
+[timerfd01]
+skip = yes
+
+[timerfd02]
+skip = yes
+
+[timerfd03]
+skip = yes
+
+[timerfd_create01]
+skip = yes
+
+[timerfd_gettime01]
+skip = yes
+
+[timerfd_settime01]
+skip = yes
+
+[times03]
+skip = yes
+
+[tkill02]
+skip = yes
+
+[trace05]
+skip = yes
+
+[truncate02]
+skip = yes
+
+[truncate02_64]
+skip = yes
+
+[truncate03]
+skip = yes
+
+[truncate03_64]
+skip = yes
+
+[umask01]
+skip = yes
+
+[umount01]
+skip = yes
+
+[umount02]
+skip = yes
+
+[umount03]
+skip = yes
+
+[umount2_01]
+skip = yes
+
+[umount2_02]
+skip = yes
+
+[umount2_03]
+skip = yes
+
+[uname04]
+must-pass =
+    1
+
+[unlink01]
+skip = yes
+
+[unlink05]
+skip = yes
+
+[unlink07]
+skip = yes
+
+[unlink08]
+skip = yes
+
+[unshare01]
+skip = yes
+
+[unshare02]
+skip = yes
+
+[userfaultfd01]
+skip = yes
+
+[ustat01]
+skip = yes
+
+[ustat02]
+skip = yes
+
+[utime01]
+skip = yes
+
+[utime01A]
+skip = yes
+
+[utime02]
+skip = yes
+
+[utime03]
+skip = yes
+
+[utime04]
+skip = yes
+
+[utime05]
+skip = yes
+
+[utime06]
+skip = yes
+
+[utimensat01]
+skip = yes
+
+[utimes01]
+skip = yes
+
+[vfork01]
+skip = yes
+
+[vhangup01]
+skip = yes
+
+[vhangup02]
+skip = yes
+
+[vmsplice01]
+skip = yes
+
+[vmsplice02]
+skip = yes
+
+[wait401]
+timeout = 40
+must-pass =
+    2
+    3
+
+[wait402]
+skip = yes
+
+[waitid01]
+skip = yes
+
+[waitid02]
+skip = yes
+
+[waitpid03]
+timeout = 80
+
+[waitpid04]
+skip = yes
+
+[waitpid05]
+timeout = 240
+
+[waitpid06]
+skip = yes
+
+[waitpid07]
+skip = yes
+
+[waitpid08]
+skip = yes
+
+[waitpid09]
+skip = yes
+
+[waitpid10]
+skip = yes
+
+[waitpid11]
+skip = yes
+
+[waitpid12]
+skip = yes
+
+[waitpid13]
+skip = yes
+
+[write02]
+skip = yes
+
+[write03]
+timeout = 40
+
+[write04]
+skip = yes
+
+[write05]
+timeout = 40
+must-pass =
+    1
+    2
+
+[writev01]
+must-pass =
+    1
+    2
+    3
+    4
+    5
+
+[writev02]
+skip = yes
+
+[writev05]
+skip = yes
+
+[writev06]
+skip = yes
diff --git a/LibOS/shim/test/ltp/makevars.mk b/LibOS/shim/test/ltp/makevars.mk
new file mode 100644
index 00000000..244f4223
--- /dev/null
+++ b/LibOS/shim/test/ltp/makevars.mk
@@ -0,0 +1,6 @@
+ROOTDIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+SRCDIR = $(ROOTDIR)/src
+BUILDDIR = $(ROOTDIR)/opt/ltp
+TESTCASEDIR = $(BUILDDIR)/testcases/bin
+LTPSCENARIO = $(BUILDDIR)/runtest/syscalls
+RUNLTPOPTS = -c ltp-bug-1248.cfg
diff --git a/LibOS/shim/test/ltp/manifest.template b/LibOS/shim/test/ltp/manifest.template
new file mode 100644
index 00000000..63464dae
--- /dev/null
+++ b/LibOS/shim/test/ltp/manifest.template
@@ -0,0 +1,39 @@
+loader.preload = file:$(SHIMPATH)
+loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib64
+loader.env.PATH = /bin:/usr/bin:.
+loader.env.LD_PRELOAD = /usr/lib/x86_64-linux-gnu/coreutils/libstdbuf.so
+loader.env._STDBUF_O = L
+loader.debug_type = none
+
+fs.mount.shm.type = chroot
+fs.mount.shm.path = /dev/shm
+fs.mount.shm.uri = file:/tmp
+
+fs.mount.lib.type = chroot
+fs.mount.lib.path = /lib
+fs.mount.lib.uri = file:$(LIBCDIR)
+
+fs.mount.lib64.type = chroot
+fs.mount.lib64.path = /lib/x86_64-linux-gnu
+fs.mount.lib64.uri = file:/lib/x86_64-linux-gnu
+
+fs.mount.usr.type = chroot
+fs.mount.usr.path = /usr
+fs.mount.usr.uri = file:/usr
+
+fs.mount.tmp.type = chroot
+fs.mount.tmp.path = /tmp
+fs.mount.tmp.uri = file:/tmp
+
+sys.brk.size = 32M
+sys.stack.size = 4M
+
+sgx.trusted_files.ld = file:$(LIBCDIR)/ld-linux-x86-64.so.2
+sgx.trusted_files.libc = file:$(LIBCDIR)/libc.so.6
+sgx.trusted_files.libdl = file:$(LIBCDIR)/libdl.so.2
+sgx.trusted_files.libm = file:$(LIBCDIR)/libm.so.6
+sgx.trusted_files.libpthread = file:$(LIBCDIR)/libpthread.so.0
+sgx.trusted_files.librt = file:$(LIBCDIR)/librt.so.1
+sgx.trusted_files.libstdbuf = file:/usr/lib/x86_64-linux-gnu/coreutils/libstdbuf.so
+
+sgx.allowed_files.tmp = file:/tmp
diff --git a/LibOS/shim/test/ltp/runltp_xml.py b/LibOS/shim/test/ltp/runltp_xml.py
new file mode 100755
index 00000000..f3ef247d
--- /dev/null
+++ b/LibOS/shim/test/ltp/runltp_xml.py
@@ -0,0 +1,611 @@
+#!/usr/bin/env python3
+
+#
+# Copyright (C) 2019  Wojtek Porczyk <woju@invisiblethingslab.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+import abc
+import argparse
+import asyncio
+import configparser
+import logging
+import os
+import pathlib
+import shlex
+import signal
+import subprocess
+import sys
+import time
+
+from lxml import etree
+
+try:
+    fspath = os.fspath
+except AttributeError:
+    # python < 3.6
+    fspath = str
+
+DEFAULT_CONFIG = 'ltp.cfg'
+ERRORHANDLER = 'backslashreplace'
+
+argparser = argparse.ArgumentParser()
+argparser.add_argument('--config', '-c', metavar='FILENAME',
+    action='append',
+    type=argparse.FileType('r'),
+    help='config file (default: {}); may be given multiple times'.format(
+        DEFAULT_CONFIG))
+
+argparser.add_argument('--option', '-o', metavar='KEY=VALUE',
+    action='append',
+    help='set an option')
+
+argparser.add_argument('--verbose', '-v',
+    action='count',
+    help='increase verbosity')
+
+argparser.add_argument('--list-executables',
+    action='store_true', default=False,
+    help='only list executables needed to run the suite')
+
+argparser.add_argument('cmdfile', metavar='FILENAME',
+    type=argparse.FileType('r'),
+    nargs='?',
+    help='cmdfile (default: stdin)')
+
+argparser.set_defaults(
+    config=None,
+    option=[],
+    verbose=0,
+    cmdfile='-')
+
+_log = logging.getLogger('LTP')  # pylint: disable=invalid-name
+
+
+class AbnormalTestResult(Exception):
+    '''Raised in some cases of test not succeeding.
+
+    Args:
+        message (str): a message to be logged
+    '''
+
+    loglevel = logging.WARNING
+
+    def __init__(self, message, *, loglevel=None):
+        super().__init__()
+        self.message = message
+        if loglevel is not None:
+            self.loglevel = loglevel
+
+    @abc.abstractmethod
+    def apply_to(self, runner):
+        '''Apply a status to a runner.
+
+        Args:
+            runner (TestRunner): runner to apply the status to
+        '''
+        raise NotImplementedError()
+
+class Fail(AbnormalTestResult):
+    '''Raised when test fails nominally.'''
+    def apply_to(self, runner):
+        runner.failure(self.message, loglevel=self.loglevel)
+
+class Skip(AbnormalTestResult):
+    '''Raised when test is skipped.'''
+    def apply_to(self, runner):
+        runner.skipped(self.message, loglevel=self.loglevel)
+
+class Error(AbnormalTestResult):
+    '''Raised when test fails for external or grave reason.'''
+    loglevel = logging.ERROR
+    def apply_to(self, runner):
+        runner.error(self.message, loglevel=self.loglevel)
+
+
+class TestRunner:
+    '''A runner which will run a single scenario.
+
+    The arguments *tag* and *cmd* most likely come from parsing a scenario file.
+    The command should be a simple invocation, limited to a single executable
+    with arguments. Compound commands (i.e. with pipes) are not supported and
+    will result in :py:exc:`Error`.
+
+    Args:
+        suite (TestSuite): a suite, for which this runner will add a result
+        tag (str): a name of the test
+        cmd (iterable): the command (full *argv*)
+    '''
+    def __init__(self, suite, tag, cmd):
+        self.suite = suite
+        self.tag = tag
+        self.cmd = tuple(cmd)
+
+        try:
+            self.cfgsection = self.suite.config[self.tag]
+        except (configparser.NoSectionError, KeyError):
+            self.cfgsection = self.suite.config[
+                self.suite.config.default_section]
+
+        self.classname = self.cfgsection.get('junit-classname')
+        self.log = _log.getChild(self.tag)
+
+        self.stdout = None
+        self.stderr = None
+        self.time = None
+        self.props = {}
+
+        self._added_result = False
+
+
+    def _add_result(self):
+        if self._added_result:
+            raise RuntimeError('multiple results for a testcase')
+        self._added_result = True
+
+        element = etree.Element('testcase',
+            classname=self.classname, name=self.tag)
+
+        self.suite.add_result(element)
+        self.suite.inc('tests')
+
+        if self.time is not None:
+            element.set('time', '{:.3f}'.format(self.time))
+            self.suite.inc('time', self.time, type=float, fmt='.3f')
+
+        if self.stdout is not None:
+            etree.SubElement(element, 'system-out').text = self.stdout
+        if self.stderr is not None:
+            etree.SubElement(element, 'system-err').text = self.stderr
+
+        if self.props:
+            properties = etree.SubElement(element, 'properties')
+            for name, value in self.props.items():
+                etree.SubElement(properties, 'property',
+                    name=str(name), value=str(value))
+
+        return element
+
+    def success(self, *, loglevel=logging.INFO):
+        '''Add a success to the report'''
+        # pylint: disable=redefined-outer-name
+        self.log.log(loglevel, '-> PASS')
+        self._add_result()
+
+    def failure(self, message, *, loglevel=logging.WARNING):
+        '''Add a nominal failure to the report
+
+        Args:
+            message (str): a message to display (“Stack Trace” in Jenkins)
+        '''
+        # pylint: disable=redefined-outer-name
+        self.log.log(loglevel, '-> FAIL (%s)', message)
+        etree.SubElement(self._add_result(), 'failure', message=message)
+        self.suite.inc('failures')
+
+    def error(self, message, *, loglevel=logging.ERROR):
+        '''Add an error to the report
+
+        Args:
+            message (str): a message to display
+        '''
+        # pylint: disable=redefined-outer-name
+        self.log.log(loglevel, '-> ERROR (%s)', message)
+        etree.SubElement(self._add_result(), 'error').text = message
+        self.suite.inc('errors')
+
+    def skipped(self, message, *, loglevel=logging.WARNING):
+        '''Add a skipped test to the report
+
+        Args:
+            message (str): a message to display (“Skip Message” in Jenkins)
+        '''
+        # pylint: disable=redefined-outer-name
+        self.log.log(loglevel, '-> SKIP (%s)', message)
+        etree.SubElement(self._add_result(), 'skipped').text = message
+        self.suite.inc('skipped')
+
+
+    def _prepare(self):
+        '''Common initalisation
+
+        This is used in two ways, so was refactored to a separate function
+        '''
+
+        if self.cfgsection.getboolean('skip', fallback=False):
+            raise Skip('skipped via config', loglevel=logging.INFO)
+
+        if any(c in self.cmd for c in ';|&'):
+            # This is a shell command which would spawn multiple processes.
+            # We don't run those in unit tests.
+            if 'must-pass' in self.cfgsection:
+                raise Error('invalid shell command with must-pass')
+            else:
+                raise Skip('invalid shell command')
+
+    def get_executable_name(self):
+        '''Return the executable name, or :py:obj:`None` if the test will not
+        run.'''
+        try:
+            self._prepare()
+        except AbnormalTestResult:
+            return None
+        else:
+            return self.cmd[0]
+
+    async def _run_cmd(self):
+        '''Actually run the test and possibly set various attributes that result
+        from the test run.
+
+        Raises:
+            AbnormalTestResult: for assorted failures
+        '''
+        cmd = [*self.suite.loader, *self.cmd]
+        timeout = self.cfgsection.getfloat('timeout')
+        self.log.info('starting %r with timeout %d', cmd, timeout)
+        start_time = time.time()
+
+        # pylint: disable=subprocess-popen-preexec-fn
+        proc = await asyncio.create_subprocess_exec(
+            *cmd,
+            cwd=fspath(self.suite.bindir),
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+            preexec_fn=os.setsid,
+            close_fds=True)
+
+        try:
+            stdout, stderr = await asyncio.wait_for(
+                proc.communicate(), timeout=timeout)
+
+        except asyncio.TimeoutError:
+            self.time = time.time() - start_time
+
+            if sys.version_info >= (3, 7):
+                # https://bugs.python.org/issue32751 (fixed in 3.7) causes
+                # proc.communicate() task inside wait_for() to be cancelled,
+                # but it most likely didn't get scheduled, so the coroutine
+                # inside is still waiting for CancelledError delivery and is not
+                # actually done waiting for stdio. No two tasks should await the
+                # same input. Rather than reimplement fix for the bug, better
+                # update, hence the warning.
+                self.stdout = (await proc.stdout.read()).decode(
+                    errors=ERRORHANDLER)
+                self.stderr = (await proc.stderr.read()).decode(
+                    errors=ERRORHANDLER)
+            else:
+                self.log.warning('cannot extract stdio on python < 3.7')
+
+            raise Error('Timed out after {} s.'.format(timeout))
+
+        finally:
+            try:
+                os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+            except ProcessLookupError:
+                pass
+
+        self.time = time.time() - start_time
+
+        assert proc.pid is not None
+        self.log.info('finished pid=%d time=%.3f returncode=%d stdout=%r',
+            proc.pid, self.time, proc.returncode, stdout)
+        if stderr:
+            self.log.info('stderr=%r', stderr)
+
+        self.props['returncode'] = proc.returncode
+
+        self.stdout, self.stderr = (stream.decode(errors=ERRORHANDLER)
+            for stream in (stdout, stderr))
+
+        return proc.returncode
+
+    async def execute(self):
+        '''Execute the test, parse the results and add report in the suite.'''
+        try:
+            self._prepare()
+
+            async with self.suite.semaphore:
+                returncode = await self._run_cmd()
+
+            must_pass = self.cfgsection.getintset('must-pass')
+            if must_pass is None:
+                if returncode != 0:
+                    raise Fail('returncode={}'.format(returncode))
+                return
+
+            self._parse_test_output(must_pass)
+
+        except AbnormalTestResult as result:
+            result.apply_to(self)
+
+        else:
+            self.success()
+
+    def _parse_test_output(self, must_pass):
+        '''Parse the output
+
+        This is normally done only for a test that has non-empty ``must-pass``
+        config directive.
+        '''
+        # pylint: disable=too-many-branches
+
+        notfound = must_pass.copy()
+        passed = set()
+        failed = set()
+        skipped = set()
+        dontcare = set()
+
+        # on empty must_pass, it is always needed
+        maybe_unneeded_must_pass = bool(must_pass)
+
+        subtest = 0
+        for line in self.stdout.split('\n'):
+            self.log.debug('<- %r', line)
+
+            if line == 'Summary:':
+                break
+
+            # Drop this line so that we get consistent offsets
+            if line == 'WARNING: no physical memory support, process creation may be slow.':
+                continue
+
+            tokens = line.split()
+            if len(tokens) < 2:
+                continue
+
+            if 'INFO' in line:
+                continue
+
+            if tokens[1].isdigit():
+                subtest = int(tokens[1])
+            else:
+                subtest += 1
+
+            try:
+                notfound.remove(subtest)
+            except KeyError:
+                # subtest is not in must-pass
+                maybe_unneeded_must_pass = False
+
+            if 'TPASS' in line or 'PASS:' in line:
+                if subtest in must_pass:
+                    passed.add(subtest)
+                else:
+                    dontcare.add(subtest)
+                continue
+
+            if any(t in line for t in (
+                    'TFAIL', 'FAIL:', 'TCONF', 'CONF:', 'TBROK', 'BROK:')):
+                if subtest in must_pass:
+                    failed.add(subtest)
+                    maybe_unneeded_must_pass = False
+                else:
+                    skipped.add(subtest)
+                continue
+
+            #self.error(line, subtest=subtest)
+            self.log.info('additional info: %s', line)
+
+
+        self.props.update(
+            must_pass=', '.join(str(i) for i in sorted(must_pass)),
+            passed=', '.join(str(i) for i in sorted(passed)),
+            failed=', '.join(str(i) for i in sorted(failed)),
+            skipped=', '.join(str(i) for i in sorted(skipped)),
+            notfound=', '.join(str(i) for i in sorted(notfound)),
+            dontcare=', '.join(str(i) for i in sorted(dontcare)),
+        )
+
+        stat = (
+            'FAILED=[{failed}] '
+            'NOTFOUND=[{notfound}] '
+            'passed=[{passed}] '
+            'dontcare=[{dontcare}] '
+            'skipped=[{skipped}] '
+            'returncode={returncode}'
+        ).format(**self.props)
+
+        if not (passed or failed or skipped or dontcare):
+            if must_pass:
+                raise Error('binary did not provide any subtests, see stdout '
+                    '(returncode={returncode}, must-pass=[{must_pass}])'.format(
+                        **self.props))
+            else:
+                raise Skip('binary without subtests, see stdout '
+                        '(returncode={returncode})'.format(**self.props))
+
+        if maybe_unneeded_must_pass and not notfound:
+            # all subtests passed and must-pass specified exactly all subtests
+            raise Error(
+                'must-pass is unneeded, remove it from config ({})'.format(stat)
+            )
+
+        if failed or notfound:
+            raise Fail('some required subtests failed or not attempted, '
+                'see stdout ({})'.format(stat))
+
+        if not passed:
+            raise Skip('all subtests skipped ({})'.format(stat))
+
+
+class TestSuite:
+    '''A test suite and result generator.
+
+    Args:
+        config (configparser.Configparser): configuration
+    '''
+    def __init__(self, config):
+        self.config = config
+        self.sgx = self.config.getboolean(config.default_section, 'sgx')
+
+        self.loader = [
+            fspath(config.getpath(config.default_section, 'loader').resolve())]
+        if self.sgx:
+            self.loader.append('SGX')
+
+        self.bindir = (
+            config.getpath(config.default_section, 'ltproot') / 'testcases/bin')
+
+        # Running parallel tests under SGX is risky, see README.
+        # However, if user wanted to do that, we shouldn't stand in the way,
+        # just issue a warning.
+        processes = config.getint(config.default_section, 'jobs',
+            fallback=(1 if self.sgx else len(os.sched_getaffinity(0))))
+        if self.sgx and processes != 1:
+            _log.warning('WARNING: SGX is enabled and jobs = %d (!= 1);'
+                ' expect stability issues', processes)
+
+        self.semaphore = asyncio.BoundedSemaphore(processes)
+        self.queue = []
+        self.xml = etree.Element('testsuite')
+        self.time = 0
+
+    def add_test(self, tag, cmd):
+        '''Instantiate appropriate :py:class:`TestRunner` and add it to the
+        suite
+
+        Args:
+            tag (str): test case name
+            cmd (iterable): command (full *argv*)
+        '''
+        self.queue.append(TestRunner(self, tag, cmd))
+
+    def add_result(self, element):
+        '''Add a result.
+
+        This should only be invoked from the :py:class:`TestRunner`.
+
+        Args:
+            element (lxml.etree.Element): XML element
+        '''
+        self.xml.append(element)
+
+    def get_executable_names(self):
+        '''Return a list for all executables that would be run, without acutally
+        running them.'''
+        names = {runner.get_executable_name() for runner in self.queue}
+        names.discard(None)
+        return sorted(names)
+
+    def _get(self, accumulator, *, default=0, type=int):
+        # pylint: disable=redefined-builtin
+        return type(self.xml.get(accumulator, default))
+
+    def inc(self, accumulator, value=1, *, type=int, fmt=''):
+        '''Increase a counter on the report.
+
+        Args:
+            accumulator (str): the counter name
+            value (int or float): the increment (default: 1)
+            type: the type the existing value, or callable that given a string
+                would parse and return it (default: :py:class:`int`)
+            fmt (str): the desired format to be stored, as accepted by
+                :py:func:`format`
+                (default is equivalent to what :py:func:`repr` does)
+        '''
+        # pylint: disable=redefined-builtin
+        self.xml.set(accumulator,
+            format(self._get(accumulator, type=type) + value, fmt))
+
+    @property
+    def returncode(self):
+        '''A suggested return code for the application that run this test suite
+        '''
+        return min(255, self._get('errors') + self._get('failures'))
+
+    def write_report(self, stream):
+        '''Write the XML report to a file
+
+        Args:
+            stream: a file-like object
+        '''
+        stream.write(etree.tostring(self.xml, pretty_print=True))
+
+    def log_summary(self):
+        _log.warning('LTP finished'
+            ' tests=%d failures=%d errors=%d skipped=%d returncode=%d',
+            self._get('tests'), self._get('failures'), self._get('errors'),
+            self._get('skipped'), self.returncode)
+
+    async def execute(self):
+        '''Execute the suite'''
+        await asyncio.gather(*(runner.execute() for runner in self.queue))
+
+
+def _getintset(value):
+    return set(int(i) for i in value.strip().split())
+
+def load_config(files):
+    '''Load the configuration from a given files
+
+    Returns:
+        configparser.ConfigParser:
+    '''
+    config = configparser.ConfigParser(
+        converters={
+            'path': pathlib.Path,
+            'intset': _getintset,
+        },
+        defaults={
+            'timeout': '30',
+            'sgx': 'false',
+            'loader': './pal_loader',
+            'ltproot': './opt/ltp',
+            'junit-classname': 'apps.LTP',
+        })
+
+    for file in files:
+        with file:
+            config.read_file(file)
+
+    return config
+
+def main(args=None):
+    logging.basicConfig(
+        format='%(asctime)s %(name)s: %(message)s',
+        level=logging.WARNING)
+    args = argparser.parse_args(args)
+    _log.setLevel(_log.level - args.verbose * 10)
+
+    if args.config is None:
+        args.config = [open(DEFAULT_CONFIG)]
+
+    config = load_config(args.config)
+    for token in args.option:
+        key, value = token.split('=', maxsplit=1)
+        config[config.default_section][key] = value
+
+    suite = TestSuite(config)
+    with args.cmdfile as file:
+        for line in file:
+            if line[0] in '\n#':
+                continue
+            tag, *cmd = shlex.split(line)
+            suite.add_test(tag, cmd)
+
+    if args.list_executables:
+        print('\n'.join(suite.get_executable_names()))
+        return 0
+
+    try:
+        loop = asyncio.get_event_loop()
+        loop.run_until_complete(suite.execute())
+    finally:
+        loop.close()
+    suite.write_report(sys.stdout.buffer)
+    suite.log_summary()
+    return suite.returncode
+
+if __name__ == '__main__':
+    sys.exit(main())