date : 2019 - 12 - 06
email: panzh8266@163.com
github: https://github.com/Jess-Pan

Android Q 系统集成百度定位流程分析

1. 需求文件

百度提供的文件
- networklocation-xxx-releasee-xxx-signed.apk
- libnlocSDK7d.so
- BaiduNLPTestTool-debug.apk
Android 系统
- 安装有com.android.location.provider.jar

2. 功能实现

2.1 大致集成步骤

在android框架中集成百度定位（配置frameworks/base/core/res/res/values/config.xml）
将networklocation-xxx-releasee-xxx-signed.apk和libnlocSDK7d.so编入out/.../product/app下
使用BaiduNLPTestTool-debug.apk进行系统网络定位测试

2.2 具体集成代码

2.2.1 配置android框架

frameworks/base/core/res/res/values/config.xml

<bool name="config_enableNetworkLocationOverlay" translatable="false">false</bool>
<bool name="config_enableFusedLocationOverlay" translatable="false">true</bool>
<string name="config_networkLocationProviderPackageName" translatable="false">com.baidu.map.location</string>

<bool name="config_enableGeocoderOverlay" translatable="false">true</bool>
<string-array name="config_locationProviderPackageNames" translatable="false">
    <!-- The standard AOSP fused location provider -->
    <item>com.android.location.fused</item>
    <item>com.baidu.map.location</item>>
</string-array>

2.2.2 集成百度系统定位apk

客制化文件夹路径

将百度提供的networklocation-xxx-releasee-xxx-signed.apk和/so/libs/...下对应系统内核架构的so库放在客制化文件夹下
创建Android.mk文件

LOCAL_PATH := $(my-dir)
# armeabi-v7a
my_archs := arm64 armeabi arm
my_src_arch := $(call get-prebuilt-src-arch, $(my_archs))

include $(CLEAR_VARS)
LOCAL_MODULE := NetworkLocationxxx
LOCAL_MODULE_TAGS := optional
LOCAL_SRC_FILES := ./networklocation-xxx-release-xxx-signed.apk
LOCAL_CERTIFICATE := PRESIGNED
LOCAL_SDK_VERSION := current
LOCCAL_MODULE_PATH := $(PRODUCT_OUT)/product/app
LOCAL_MODULE_CLASS := APPS
LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
LOCAL_PRODUCT_MODULE := true
$(warning log:$(my_src_arch))
LOCAL_PREBUILT_JNI_LIBS := libs/$(my_src_arch)/libnlocSDK7d.so
LOCAL_MODULE_TARGET_ARCH := $(my_src_arch)
include $(BUILD_PREBUILT)

在系统主make中将该目录包含进去
```
PRODUCT_PACKAGES += NetworkLocationxxx
```

2.3 整编系统，测试相关功能

3. 具体分析

使用jadx工具对networklocation-xxx-releasee-xxx-signed.apk进行反编译后进行分析

3.1 有关隐藏桌面图标的问题

反编译后得到的清单文件

<application android:label="@string/app_name" android:allowClearUserData="false">
    <uses-library android:name="org.apache.http.legacy" android:required="false"/>
    <uses-library android:name="com.android.location.provider"/>
    <service android:name="com.baidu.map.location.BaiduNetworkLocationService" android:enabled="true" android:exported="false" android:visibleToInstantApps="true">
        <intent-filter>
            <action android:name="com.android.location.service.v3.NetworkLocationProvider"/>
            <action android:name="com.android.location.service.v2.NetworkLocationProvider"/>
            <action android:name="com.baidu.bms.location.BaiduNetworkLocationProvider"/>
            <action android:name="com.baidu.bms.location.BaiduGeocodeProvider"/>
            <action android:name="com.google.android.location.NetworkLocationProvider"/>
            <action android:name="com.android.location.service.FusedLocationProvider"/>
            <action android:name="com.qualcomm.services.location.xtwifi.XTWiFiLocationProvider"/>
            <action android:name="com.google.android.location.GeocodeProvider"/>
            <action android:name="com.android.location.service.NetworkLocationProvider"/>
            <action android:name="com.android.location.service.GeocodeProvider"/>
        </intent-filter>
        <meta-data android:name="serviceVersion" android:value="10"/>
    </service>
    <service android:name="com.baidu.location.f" android:permission="com.baidu.permision.BAIDU_LOCATION_SERVICE" android:enabled="true" android:visibleToInstantApps="true">
        <intent-filter>
            <action android:name="com.baidu.locationx.service"/>
        </intent-filter>
    </service>
    <activity android:theme="@style/Transparent" android:name="com.baidu.map.location.ConfirmAlertActivity1" android:excludeFromRecents="true" android:launchMode="singleTask" android:configChanges="mcc|mnc|touchscreen|keyboard|keyboardHidden|navigation|orientation|screenLayout|uiMode|fontScale"/>
    <receiver android:name="com.baidu.map.location.LocationModeChangeReceiver">
        <intent-filter>
            <action android:name="com.android.settings.location.MODE_CHANGING"/>
        </intent-filter>
    </receiver>
</application>

清单文件中没有android.intent.action.MAIN 和android.intent.category.LAUNCHER 这两个action，意味着程序只接受Intent启动，不会显示桌面图标（如果使用adb install 进行安装会显示默认图标）

3.2 有关应用权限和签名的问题

3.2.1 应用权限

百度将apk分为有弹窗授权类和无弹窗授权类两种，沟通时针对项目选择，选择不同的apk版本
应Google要求，厂商应用不再编入/system/app下，统一编入/product/app下

3.2.2 应用签名

使用apk本身的签名

3.3 有关系统定位广播和输出log的问题

12-05 22:17:16.118631 30105 30739 I System.out: [OkHttp] sendRequest>>
12-05 22:17:16.118902 30105 30739 I System.out: [OkHttp] sendRequest<<

12-05 22:17:16.129574  1858  1858 I NLP     : Location result:[location successful by Baidu], reason:[network location] locType=161

12-05 22:17:22.559460  1858  1916 D NLPLOC  : start network locating ...false  false
12-05 22:17:22.589600  1858  1916 D NLP_STA : network locating ...false  false
12-05 22:17:22.610570   966   984 D LocationManagerService: incoming location from: network

4. Android 系统有关定位信息调用关系

应用调用LocationManagerService

应用调用系统定位服务需要获取LocationManager来选择定位方式（网络定位、GPS定位、WIFI定位）

LocationManager locationManager = (LocationManager)getSystemService(LOCATION_SERVICE);
// NETWORK_PROVIDER, 使用网络定位
// 45000, 定位时间间隔,单位ms
locationManager.requestLocationUpdates(Location.NETWORK_PROVIDER, 45000, 0, locationListioner);

frameworks/base/location/java/android/location/LocationManager.java

public static final String NETWORK_PROVIDER = "network";

    private void requestLocationUpdates(LocationRequest request, LocationListener listener,
            Looper looper, PendingIntent intent) {

        String packageName = mContext.getPackageName();

        // 包装一个监听器
        ListenerTransport transport = wrapListener(listener, looper);

        try {
            // 实则调用mService.requestLocationUpdate(... ...)
            mService.requestLocationUpdates(request, transport, intent, packageName);
       } catch (RemoteException e) {
           throw e.rethrowFromSystemServer();
       }
    }

private final ILocationManager mService;

frameworks/base/location/java/android/location/ILocationManager.aidl

在这个接口中，有很多眼熟的方法

void requestLocationUpdates(in LocationRequest request, in ILocationListener listener,
                            in PendingIntent intent, String packageName);
void removeUpdates(in ILocationListener listener, in PendingIntent intent, String packageName);

void requestGeofence(in LocationRequest request, in Geofence geofence,
                     in PendingIntent intent, String packageName);
void removeGeofence(in Geofence fence, in PendingIntent intent, String packageName);

Location getLastLocation(in LocationRequest request, String packageName);

那么该aidl的具体实现是放在了LocationManagerService中

frameworks/base/services/core/java/com/android/server/LocationManagerService.java

首先可以看到LocationManagerService的构造函数

    public LocationManagerService(Context context) {
        super();
        mContext = context;
        mHandler = FgThread.getHandler();
        mLocationUsageLogger = new LocationUsageLogger();
        
        // 找到默认的系统服务提供者
        PackageManagerInternal packageManagerInternal = LocalServices.getService(
                PackageManagerInternal.class);
        // 这里指定了xml中配置好的百度Nlp系统定位apk包名
        packageManagerInternal.setLocationPackagesProvider(
                userId -> mContext.getResources().getStringArray(
                        com.android.internal.R.array.config_locationProviderPackageNames));
        packageManagerInternal.setLocationExtraPackagesProvider(
                userId -> mContext.getResources().getStringArray(
                      com.android.internal.R.array.config_locationExtraPackageNames));
        // 大多数启动推迟到systemRunning()
    }

String[] pkgs = resources.getStringArray(
                com.android.internal.R.array.config_locationProviderPackageNames);
... ...
// bind to network provider
        LocationProvider networkProviderManager = new LocationProvider(NETWORK_PROVIDER, true);
        LocationProviderProxy networkProvider = LocationProviderProxy.createAndBind(
                mContext,
                networkProviderManager,
                NETWORK_LOCATION_SERVICE_ACTION,
                com.android.internal.R.bool.config_enableNetworkLocationOverlay,
                com.android.internal.R.string.config_networkLocationProviderPackageName,
                com.android.internal.R.array.config_locationProviderPackageNames);
        if (networkProvider != null) {
            mRealProviders.add(networkProviderManager);
            addProviderLocked(networkProviderManager);
            networkProviderManager.attachLocked(networkProvider);
        } else {
            Slog.w(TAG, "no network location provider found");
        }

frameworks/base/services/core/java/com/android/server/location/ActivityRecognitionProxy.java

    public static ActivityRecognitionProxy createAndBind(
            Context context,
            boolean activityRecognitionHardwareIsSupported,
            ActivityRecognitionHardware activityRecognitionHardware,
            int overlaySwitchResId,
            int defaultServicePackageNameResId,
            int initialPackageNameResId) {
        ActivityRecognitionProxy activityRecognitionProxy = new ActivityRecognitionProxy(
                context,
                activityRecognitionHardwareIsSupported,
                activityRecognitionHardware,
                overlaySwitchResId,
                defaultServicePackageNameResId,
                initialPackageNameResId);

        if (activityRecognitionProxy.mServiceWatcher.start()) {
            return activityRecognitionProxy;
        } else {
            return null;
        }
    }

frameworks/base/services/core/java/com/android/server/location/ServiceWatcher.java

通过包名来绑定、解绑服务

    private void bind(ComponentName component, int version, int userId) {
        Preconditions.checkState(Looper.myLooper() == mHandler.getLooper());

        Intent intent = new Intent(mAction);
        intent.setComponent(component);

        mBestComponent = component;
        mBestVersion = version;
        mBestUserId = userId;

        if (D) Log.d(mTag, "binding " + component + " (v" + version + ") (u" + userId + ")");
        mContext.bindServiceAsUser(intent, this,
                Context.BIND_AUTO_CREATE | Context.BIND_NOT_FOREGROUND | Context.BIND_NOT_VISIBLE,
                UserHandle.of(userId));
    }

    private void unbind() {
        Preconditions.checkState(Looper.myLooper() == mHandler.getLooper());

        if (mBestComponent != null) {
            if (D) Log.d(mTag, "unbinding " + mBestComponent);
            mContext.unbindService(this);
        }

        mBestComponent = null;
        mBestVersion = Integer.MIN_VALUE;
        mBestUserId = UserHandle.USER_NULL;
    }

由此，系统应用可以通过调用ILocationManager.aidl中的方法，通过LocationManagerService进行定位。

LocationManagerService 调用 NLP

应用申明一个LocationManager 调用 ILocationManager中的方法，这个方法的具体实现放在了LocationManagerService中。LocationManagerService通过调用ILocationProvider.aidl来获取NLP的查询后的结果，而NLP实现的接口则为LocationProviderBase.java

frameworks/base/location/lib/java/com/android/location/provider/LocationProviderBase.java

在系统中打开定位

public void setEnabled(boolean enabled) {
        synchronized (mBinder) {
            if (mEnabled == enabled) {
                return;
            }

            mEnabled = enabled;
        }

        ILocationProviderManager manager = mManager;
        if (manager != null) {
            try {
                manager.onSetEnabled(mEnabled);
            } catch (RemoteException | RuntimeException e) {
                Log.w(mTag, e);
            }
        }
    }

查询位置

    protected abstract void onSetRequest(ProviderRequestUnbundled request, WorkSource source);

5. 测试要求

网络定位需要提前连接Wi-Fi或打开移动网络

使用BaiduNLPTestTool-debug.apk进行测试
使用内置应用进行测试（浏览器、相机等）
使用三方应用进行测试（百度地图、高德地图、QQ、微信、抖音等）

Android Q 集成百度定位分析