Getting Started: Building and Running KLEE

Building KLEE

If you would like to try KLEE, the current procedure for building is below.

NOTE: KLEE is only currently tested on Linux and Darwin x86-32 targets, using LLVM top-of-tree. KLEE will not work with an older LLVM (e.g., 2.5). We are currently working on full support for Linux and Darwin x86-64 targets.

1. Install llvm-gcc:
   • Download and install the LLVM 2.7 release of llvm-gcc from here. Add llvm-gcc to your PATH. It is important to do this first so that llvm-gcc is found in subsequent configure steps. llvm-gcc will be used later to compile programs that KLEE can execute.
2. Download and build LLVM 2.7 (you may also use SVN head, but klee may not always be up-to-date with LLVM API changes).
   $ curl -O http://llvm.org/releases/2.7/llvm-2.7.tgz
   $ tar zxvf llvm-2.7.tgz
   $ cd llvm-2.7
   $ ./configure --enable-optimized
   $ make
   (the --enable-optimized configure argument is not necessary, but KLEE runs very slowly in Debug mode).
3. Checkout KLEE (to any path you like):
   $ svn co http://llvm.org/svn/llvm-project/klee/trunk klee
   Alternatively, if you prefer to use git there is also a read-only git mirror, which syncs automatically with each Subversion commit. You can do a git clone of KLEE via:
   $ git clone http://llvm.org/git/klee.git
4. Configure KLEE (from the KLEE source directory):
   $ ./configure --with-llvm=path/to/llvm

   This assumes that you compiled LLVM in-place. If you used a different directory for the object files then use:

   $ ./configure --with-llvmsrc=path/to/llvm/src --with-llvmobj=path/to/llvm/obj
5. Build KLEE (from the KLEE source directory):
   $ make ENABLE_OPTIMIZED=1
6. Run the regression suite to verify your build:
   $ make check
   $ make unittests
   
7. You're ready to go! Go to the Tutorials page to try KLEE.

Building KLEE with POSIX runtime support

The steps above are enough for building and testing KLEE on closed programs (programs that don't use any external code such as C library functions). However, if you want to use KLEE to run real programs you will want to enable the KLEE POSIX runtime, which is built on top of the uClibc C library.

1. Download KLEE's uClibc:
   • KLEE uses a version of uClibc which has been modified slightly for use with KLEE.
     • A version that works on 32-bit Linux can be found here: klee-uclibc-0.01.tgz
     • A version that works on 64-bit Linux can be found here: klee-uclibc-0.01-x64.tgz
2. Build uClibc with llvm-gcc:
   $ tar zxvf klee-uclibc-0.01.tgz
   $ ./configure --with-llvm=path/to/llvm
   $ make
   

   NOTE: KLEE's uClibc is shipped in a pre-configured for x86-32. If you are on a different target (e.g. x86-64), you will need to run 'make config' and select the correct target. The defaults for the other uClibc configuration variables should be fine.

3. Configure KLEE with uClibc/POSIX support:
   $ ./configure --with-llvm=path/to/llvm --with-uclibc=path/to/klee-uclibc --enable-posix-runtime
4. Rebuild KLEE and run make check and verify that the POSIX tests run correctly.

Building KLEE with a more recent version of STP

If your benchmarks are running slowly or not terminating it may be worth trying a more recent version of KLEE's constraint solver STP, which offers performance improvements over the version supplied with KLEE.

STP does not make frequent releases, and its Subversion repository is under constant development and may be unstable. The instructions below are for a particular revision which is known to pass the KLEE test suite, but you can try a more recent revision (at your own risk) by changing or removing the -r argument to the svn co command.

1. Download and build STP.
   $ svn co -r 940 https://stp-fast-prover.svn.sourceforge.net/svnroot/stp-fast-prover/trunk/stp stp
   $ cd stp
   $ scripts/configure --with-prefix=path/to/stp/inst --with-cryptominisat2
   $ make OPTIMIZE=-O2 CFLAGS_M32= install
2. Configure KLEE:
   $ ./configure --with-llvm=path/to/llvm --with-stp=path/to/stp/inst
3. Rebuild KLEE.