ROS2 Source Code Parsing and Abstraction
1. CPG Generation and Outputs
We follow the Joern default setting and conduct our analysis in a virtual machine with Ubuntu 20.04 system. Specifically, we analyze 4 ROS2 libraries:
(1) RCL general library: https://github.com/ros2/rcl
(2) RCL API for C++ (rclcpp): https://github.com/ros2/rclcpp
(3) RMW general library: https://github.com/ros2/rmw
(4) RMW support for FastRPTS: https://github.com/ros2/rmw_fastrtps
Without any abstraction, we upload the original CPG to Zenodo.org the at: https://doi.org/10.5281/zenodo.6751317
Each .dot file stores the graph information for one specific method, and the file name is the method index generated by Joern by default.
2. CPG Analysis and Graph Reduction
It can be noticed that the CPG result is huge: there are more than 50k source CPG files, most of which are not related to message communication. We follow the methodology as described in Section 4.1. In the end, we obtain 23 key functions, and the CPGs of these functions are in the abstracted_CPG folder, also at the above Zenodo link.
3. Result Interpretation
We make the following graph to visualize the ROS2 code structure, which is an abstraction of the code dependency graph (CDG) from CPG. It reflects the function call relations between the key functions. We divide the functions into RCL level, RMW level and DDS level. The white color nodes are the functions, and the grey color nodes are the API entry functions that interact with the functions on another layer.
ROS2 Code Structure Details
We further present our analysis result, while the full CPG result is available at: https://doi.org/10.5281/zenodo.6751317
-----------------------------------------
The code structure and the detailed function analysis are summarized as below (in MarkDown format):
# ROS2 Source Code Analysis
## High Level Structure
rcl_node_init -> rcl_logging_rosout_init_publisher_for_node
rcl_publisher_init
rmw_create_publisher
rmw_publisher_get_actual_qos -> dds_qos_to_rmw_qos
__rmw_publish
info->data_writer_->write
rcl_subscription_init
rmw_create_subscription
rmw_subscription_get_actual_qos
__rmw_subscription_get_actual_qos -> dds_qos_to_rmw_qos
subscriber->create_datareader
## Suscription Functions
Input Function Name: rcl_subscription_init
----High Level Summary---------------------------
original total number of nodes: 117
number of unique nodes: 27
number of non-operator nodes: 16
number of unique non-error handling nodes: 7
----details below---------------------------
allocator->deallocate
rcl_node_resolve_name
rmw_create_subscription
rmw_subscription_get_actual_qos
allocator->zero_allocate
rcl_node_get_rmw_handle
RCUTILS_SAFE_FWRITE_TO_STDERR
Input Function Name: rmw_create_subscription
----High Level Summary---------------------------
original total number of nodes: 67
number of unique nodes: 22
number of non-operator nodes: 12
number of unique non-error handling nodes: 5
----details below---------------------------
rmw_fastrtps_cpp::create_subscription
common_context->graph_cache.associate_reader
rmw_fastrtps_shared_cpp::__rmw_publish
common_context->graph_cache.dissociate_writer
RMW_SAFE_FWRITE_TO_STDERR
Input Function Name: rmw::create_subscription (QoS level calls)
----High Level Summary---------------------------
original total number of nodes: 231
number of unique nodes: 56
number of non-operator nodes: 43
number of unique non-error handling nodes: 19
----details below---------------------------
subscriber->get_datareader_qos_from_profile
rmw_fastrtps_shared_cpp::__init_subscription_for_loans
get_message_typesupport_handle
_create_type_name
dds_participant->get_default_topic_qos
subscriber->get_default_datareader_qos
rmw_fastrtps_shared_cpp::create_rmw_gid
rmw_subscription_allocate
rcutils_strdup
rmw_fastrtps_shared_cpp::find_and_check_topic_and_type
rmw_fastrtps_shared_cpp::register_type_object
get_topic_qos
rmw_fastrtps_shared_cpp::cast_or_create_topic
get_datareader_qos
rmw_fastrtps_shared_cpp::create_datareader
info->data_reader_->guid
rcutils_get_default_allocator
_create_topic_name
rmw_fastrtps_shared_cpp::create_content_filtered_topic
## Publish Function
Input Function Name: rcl_node_init
----High Level Summary---------------------------
original total number of nodes: 311
number of unique nodes: 53
number of non-operator nodes: 39
number of unique non-error handling nodes: 16
----details below---------------------------
rcl_guard_condition_get_default_options
rcl_node_get_default_options
rcl_node_options_copy
rcl_remap_node_name
rcl_remap_node_namespace
rmw_create_node
rmw_node_get_graph_guard_condition
rcl_get_zero_initialized_guard_condition
rcl_guard_condition_init_from_rmw
rcl_node_get_name
rcl_node_get_namespace
rcl_get_zero_initialized_node
allocator->allocate
rcl_node_get_rmw_handle
allocator->deallocate
rcutils_format_string
Input Function Name: rcl_logging_rosout_init_publisher_for_node
----High Level Summary---------------------------
original total number of nodes: 60
number of unique nodes: 26
number of non-operator nodes: 19
number of unique non-error handling nodes: 8
----details below---------------------------
rcl_publisher_get_default_options
rcl_node_get_options
rcl_get_zero_initialized_publisher
rcl_publisher_init
ROSOUT_TOPIC_NAME
RCL_RET_FROM_RCUTIL_RET
rcl_publisher_fini
rcutils_hash_map_set
Input Function Name: rcl_publisher_init
----High Level Summary---------------------------
original total number of nodes: 110
number of unique nodes: 27
number of non-operator nodes: 16
number of unique non-error handling nodes: 7
----details below---------------------------
allocator->deallocate
rcl_node_resolve_name
rmw_create_publisher
rmw_publisher_get_actual_qos
allocator->allocate
rcl_node_get_rmw_handle
RCUTILS_SAFE_FWRITE_TO_STDERR
Input Function Name: rmw_create_node
----High Level Summary---------------------------
original total number of nodes: 86
number of unique nodes: 25
number of non-operator nodes: 15
number of unique non-error handling nodes: 5
----details below---------------------------
assert
rmw_node_allocate
guard
rmw_allocate
__rmw_publish
Input Function Name: rmw_create_publisher
----High Level Summary---------------------------
original total number of nodes: 63
number of unique nodes: 22
number of non-operator nodes: 12
number of unique non-error handling nodes: 5
----details below---------------------------
rmw_fastrtps_cpp::create_publisher
common_context->graph_cache.associate_writer
rmw_fastrtps_shared_cpp::__rmw_publish
common_context->graph_cache.dissociate_writer
RMW_SAFE_FWRITE_TO_STDERR
Input Function Name: rmw::create_publisher (QoS level function calls)
----High Level Summary---------------------------
original total number of nodes: 238
number of unique nodes: 58
number of non-operator nodes: 44
number of unique non-error handling nodes: 17
----details below---------------------------
publisher->get_datawriter_qos_from_profile
get_message_typesupport_handle
_create_type_name
dds_participant->get_default_topic_qos
publisher->get_default_datawriter_qos
publisher->create_datawriter
rmw_fastrtps_shared_cpp::create_rmw_gid
rmw_publisher_allocate
rmw_fastrtps_shared_cpp::find_and_check_topic_and_type
rmw_fastrtps_shared_cpp::register_type_object
get_topic_qos
rmw_fastrtps_shared_cpp::cast_or_create_topic
get_datawriter_qos
info->data_writer_->guid
info->type_support_->is_plain
rmw_allocate
_create_topic_name