概念介绍：

Provder相关：

GPS_PROVIDER：基于GNSS信号的位置信息。
NETWORK_PROVIDER：基于第三方位置供应商的位置信息。
PASSIVE_PROVIDER：被动定位位置信息。
FUSED_PROVIDER: 混合定位位置信息。

LocationRequest:

属性	说明
mProvider	见Provider说明
mQuality	电池相关，有POWER_NONE（不主动定位），POWER_LOW（默认值，能耗低的定位模式），POWER_HIGH（允许高能耗的定位模式）
mInterval	定位间隔，默认值60分钟
mSmallestDisplacement	最小位移（米）
mExpireAt	request过期时间
mNumUpdates	更新次数，默认值为IntMAX，相当于一直更新
mHideFromAppOps	是否从（权限）管理隐藏
mWorkSource	维护了一些调用者信息

Location: 返回的location对象

属性	说明
mProvider	见Provider说明
mTime	数据unix时间
mElapsedRealtimeNanos	数据Elapsed时间
mLatitude	纬度
mLongitude	经度
mAltitude	高度
mSpeed	速度，米/秒
mBearing	以度为单位获取方位角
mHorizontalAccuracyMeters	水平方向精度（米）
mVerticalAccuracyMeters	垂直方向精度（米）
mSpeedAccuracyMetersPerSecond	速度(米/秒)精度
mBearingAccuracyDegrees	方位角精度
mExtras	额外数据

LocationManager开启位置监听方法：

requestLocationUpdates

源码部分：

LocationManager通过ILocationManager.aild调用到LocationManagerService类：

@Override
    public void requestLocationUpdates(LocationRequest request, ILocationListener listener,
            PendingIntent intent, String packageName) {
        synchronized (mLock) {
            ...//一堆检测
            try {
               ...
                Receiver receiver;
                if (intent != null) {
                    receiver = getReceiverLocked(intent, pid, uid, packageName, workSource,
                            hideFromAppOps);
                } else {
                    receiver = getReceiverLocked(listener, pid, uid, packageName, workSource,
                            hideFromAppOps);
                }
                requestLocationUpdatesLocked(sanitizedRequest, receiver, uid, packageName);
            } finally {
                Binder.restoreCallingIdentity(identity);
            }
        }
    }

对LocationRequest 里的值做了一系列判断与初始化
根据两种接收返回数据方式：intent和listener，生成内部receiver
继续走requestLocationUpdatesLocked

    @GuardedBy("mLock")
    private void requestLocationUpdatesLocked(LocationRequest request, Receiver receiver,
            int uid, String packageName) {
        ...//一系列判断
        LocationProvider provider = getLocationProviderLocked(name);
        if (provider == null) {
            throw new IllegalArgumentException("provider doesn't exist: " + name);
        }

        UpdateRecord record = new UpdateRecord(name, request, receiver);
        ...
        UpdateRecord oldRecord = receiver.mUpdateRecords.put(name, record);
        if (oldRecord != null) {
            oldRecord.disposeLocked(false);
        }
        ...
        applyRequirementsLocked(name);
        receiver.updateMonitoring(true);
    }

生成一个UpdateRecord，并放在receiver对象中
applyRequirementsLocked最终走的是·applyRequirementsLocked·方法：

@GuardedBy("mLock")
    private void applyRequirementsLocked(LocationProvider provider) {
        ...
        provider.setRequestLocked(providerRequest, worksource);
    }

最终是调用的provider的setReques方法
所以重点还是研究provider
回到LocationManagerService的init方法，发现会调用initializeProvidersLocked(),这里就是初始化所有provider的地方：

 @GuardedBy("mLock")
    private void initializeProvidersLocked() {
        // create a passive location provider, which is always enabled
        LocationProvider passiveProviderManager = new LocationProvider(PASSIVE_PROVIDER);
        addProviderLocked(passiveProviderManager);
        mPassiveProvider = new PassiveProvider(mContext, passiveProviderManager);
        passiveProviderManager.attachLocked(mPassiveProvider);

        if (GnssLocationProvider.isSupported()) {
            // Create a gps location provider
            LocationProvider gnssProviderManager = new LocationProvider(GPS_PROVIDER, true);
            mRealProviders.add(gnssProviderManager);
            addProviderLocked(gnssProviderManager);

            GnssLocationProvider gnssProvider = new GnssLocationProvider(mContext,
                    gnssProviderManager,
                    mHandler.getLooper());
            gnssProviderManager.attachLocked(gnssProvider);
            ...
        }
        ...
        // bind to network provider
        LocationProvider networkProviderManager = new LocationProvider(NETWORK_PROVIDER, true);
        LocationProviderProxy networkProvider = LocationProviderProxy.createAndBind(
                mContext,
                networkProviderManager,
                NETWORK_LOCATION_SERVICE_ACTION,
                com.android.internal.R.bool.config_enableNetworkLocationOverlay,
                com.android.internal.R.string.config_networkLocationProviderPackageName,
                com.android.internal.R.array.config_locationProviderPackageNames);
        if (networkProvider != null) {
            mRealProviders.add(networkProviderManager);
            addProviderLocked(networkProviderManager);
            networkProviderManager.attachLocked(networkProvider);
        } else {
            Slog.w(TAG, "no network location provider found");
        }

        // bind to fused provider
        LocationProvider fusedProviderManager = new LocationProvider(FUSED_PROVIDER);
        LocationProviderProxy fusedProvider = LocationProviderProxy.createAndBind(
                mContext,
                fusedProviderManager,
                FUSED_LOCATION_SERVICE_ACTION,
                com.android.internal.R.bool.config_enableFusedLocationOverlay,
                com.android.internal.R.string.config_fusedLocationProviderPackageName,
                com.android.internal.R.array.config_locationProviderPackageNames);
        if (fusedProvider != null) {
            mRealProviders.add(fusedProviderManager);
            addProviderLocked(fusedProviderManager);
            fusedProviderManager.attachLocked(fusedProvider);
        } else {
            Slog.e(TAG, "no fused location provider found",
                    new IllegalStateException("Location service needs a fused location provider"));
        }

        // bind to geocoder provider
        mGeocodeProvider = GeocoderProxy.createAndBind(mContext,
                com.android.internal.R.bool.config_enableGeocoderOverlay,
                com.android.internal.R.string.config_geocoderProviderPackageName,
                com.android.internal.R.array.config_locationProviderPackageNames);
        if (mGeocodeProvider == null) {
            Slog.e(TAG, "no geocoder provider found");
        }

        // bind to geofence provider
        GeofenceProxy provider = GeofenceProxy.createAndBind(
                mContext, com.android.internal.R.bool.config_enableGeofenceOverlay,
                com.android.internal.R.string.config_geofenceProviderPackageName,
                com.android.internal.R.array.config_locationProviderPackageNames,
                mGpsGeofenceProxy,
                null);
        if (provider == null) {
            Slog.d(TAG, "Unable to bind FLP Geofence proxy.");
        }

        // bind to hardware activity recognition
       ...
        ActivityRecognitionProxy proxy = ActivityRecognitionProxy.createAndBind(
                mContext,
                activityRecognitionHardwareIsSupported,
                activityRecognitionHardware,
                com.android.internal.R.bool.config_enableActivityRecognitionHardwareOverlay,
                com.android.internal.R.string.config_activityRecognitionHardwarePackageName,
                com.android.internal.R.array.config_locationProviderPackageNames);
        if (proxy == null) {
            Slog.d(TAG, "Unable to bind ActivityRecognitionProxy.");
        }
        ...
    }

PassiveProvider,GnssLocationProvider 都是直接new出来的
networkProvider，fusedProvider 是由LocationProviderProxy的方法createAndBind创建的
GeocodeProvider（地理位置反解析）是由GeocoderProxy的方法createAndBind创建的，里面的实现和LocationProviderProxy相似
GeofenceProvider（地理围栏）是由GeofenceProxy 的方法createAndBind创建的，里面的实现和LocationProviderProxy相似
ActivityRecognitionProxy 是gms的功能，不做多介绍

1. GnssLocationProvider

先拿GnssLocationProvider作分析:
GnssLocationProvider.java中setRequest的实现：

  @Override
    public void setRequest(ProviderRequest request, WorkSource source) {
        sendMessage(SET_REQUEST, 0, new GpsRequest(request, source));
    }

 private final class ProviderHandler extends Handler {
    @Override
        public void handleMessage(Message msg) {
            int message = msg.what;
            switch (message) {
                    case SET_REQUEST:
                    GpsRequest gpsRequest = (GpsRequest) msg.obj;
                    handleSetRequest(gpsRequest.request, gpsRequest.source);
                    break;
              ...
            }
        }
}

    private void handleSetRequest(ProviderRequest request, WorkSource source) {
        mProviderRequest = request;
        mWorkSource = source;
        updateEnabled();
        updateRequirements();
    }

主要在updateRequirements中实现

 // Called when the requirements for GPS may have changed
    private void updateRequirements() {
...
        if (mProviderRequest.reportLocation && isGpsEnabled()) {
           ...
            if (mStarted && hasCapability(GPS_CAPABILITY_SCHEDULING)) {
                ...
            } else if (!mStarted) {
                // start GPS
                startNavigating();
            } else {
                ...
            }
        } else {
            ...
        }
    }

startNavigating中调用的是native方法：

private void startNavigating() {
        if (!mStarted) {
           ...
            if (!native_start()) {
                setStarted(false);
                Log.e(TAG, "native_start failed in startNavigating()");
                return;
            }
            ...
            mFixRequestTime = SystemClock.elapsedRealtime();
            if (!hasCapability(GPS_CAPABILITY_SCHEDULING)) {
                // set timer to give up if we do not receive a fix within NO_FIX_TIMEOUT
                // and our fix interval is not short
                if (mFixInterval >= NO_FIX_TIMEOUT) {
                    mAlarmManager.set(AlarmManager.ELAPSED_REALTIME_WAKEUP,
                            SystemClock.elapsedRealtime() + NO_FIX_TIMEOUT, mTimeoutIntent);
                }
            }
        }
    }

native_start为native方法，当他成功运行后，AlarmManager会起一个timeout的计时

这就是gnss开始获取位置的过程
那么定位结果是如何上报的呢：

结果上报：

我们注意到GnssLocationProvider.java中有一个NativeEntryPoint注解

    @NativeEntryPoint
    private void reportLocation(boolean hasLatLong, Location location) {
        sendMessage(REPORT_LOCATION, hasLatLong ? 1 : 0, location);
    }

该注解的意义为JNI调用的入口，防止IDE编译警告
然后通过handler调用到handleReportLocation，handleReportLocation调用父类接口：

public abstract class AbstractLocationProvider {
    public interface LocationProviderManager {
        /**
         * May be called to inform the location service of a change in this location provider's
         * enabled/disabled state.
         */
        void onSetEnabled(boolean enabled);
        /**
         * May be called to inform the location service of a change in this location provider's
         * properties.
         */
        void onSetProperties(ProviderProperties properties);
        /**
         * May be called to inform the location service that this provider has a new location
         * available.
         */
        void onReportLocation(Location location);
        /**
         * May be called to inform the location service that this provider has a new location
         * available.
         */
        void onReportLocation(List<Location> locations);
    }

    protected void reportLocation(Location location) {
        mLocationProviderManager.onReportLocation(location);
    }
}

LocationProviderManager接口的实现在LocationManagerService的内部类LocationProvider中

 // called from any thread
        @Override
        public void onReportLocation(Location location) {
            // no security check necessary because this is coming from an internal-only interface
            // move calls coming from below LMS onto a different thread to avoid deadlock
            mHandler.post(() -> {
                synchronized (mLock) {
                    handleLocationChangedLocked(location, this);
                }
            });
        }

这里只是做了层线程转换,关键在于handleLocationChangedLocked这个方法:

 private void handleLocationChangedLocked(Location location, LocationProvider provider) {
       ...
        if (provider.isUseableLocked()) {
            if (!provider.isPassiveLocked()) {
                mPassiveProvider.updateLocation(location);
            }
        }
       ...
        if (provider.isUseableLocked()) {
            updateLastLocationLocked(location, provider.getName());
        }
        ...
        for (UpdateRecord r : records) {
            ...
            if (notifyLocation != null) {
                Location lastLoc = r.mLastFixBroadcast;
                if ((lastLoc == null)
                        || shouldBroadcastSafeLocked(notifyLocation, lastLoc, r, now)) {
                    if (lastLoc == null) {
                        lastLoc = new Location(notifyLocation);
                        r.mLastFixBroadcast = lastLoc;
                    } else {
                        lastLoc.set(notifyLocation);
                    }
                  ...
                    r.mRealRequest.decrementNumUpdates();
                }
            }
        }
      ...
    }

mPassiveProvider更新了其location数据
更新自己的location数据
更新UpdateRecord 里的location数据

2. NetworkProvider

先看下LocationProviderProxy是如何createAndBind的：

public static LocationProviderProxy createAndBind(
            Context context, LocationProviderManager locationProviderManager, String action,
            int overlaySwitchResId, int defaultServicePackageNameResId,
            int initialPackageNamesResId) {
        LocationProviderProxy proxy = new LocationProviderProxy(context, locationProviderManager,
                action, overlaySwitchResId, defaultServicePackageNameResId,
                initialPackageNamesResId);
        if (proxy.bind()) {
            return proxy;
        } else {
            return null;
        }
    }

private LocationProviderProxy(Context context, LocationProviderManager locationProviderManager,
            String action, int overlaySwitchResId, int defaultServicePackageNameResId,
            int initialPackageNamesResId) {
        super(context, locationProviderManager);

        mServiceWatcher = new ServiceWatcher(context, TAG, action, overlaySwitchResId,
                defaultServicePackageNameResId, initialPackageNamesResId,
                FgThread.getHandler()) {
              ...
        };
        ...
    }

实际上是交给ServiceWatcher这个类去生成，在proxy.bind()时调用ServiceWatcher.start()方法，start方法中最关键的是调用bindBestPackage方法，bindBestPackage最终调用的是bind方法，看下此方法的实现：

private void bind(ComponentName component, int version, int userId) {
        Preconditions.checkState(Looper.myLooper() == mHandler.getLooper());

        Intent intent = new Intent(mAction);
        intent.setComponent(component);

        mBestComponent = component;
        mBestVersion = version;
        mBestUserId = userId;

        if (D) Log.d(mTag, "binding " + component + " (v" + version + ") (u" + userId + ")");
        mContext.bindServiceAsUser(intent, this,
                Context.BIND_AUTO_CREATE | Context.BIND_NOT_FOREGROUND | Context.BIND_NOT_VISIBLE,
                UserHandle.of(userId));
    }

可以看到此处是bind了一个Service，那么：
networkProvider的action="com.android.location.service.v3.NetworkLocationProvider"（此处OS版本不同，对应的action也可能不同）
fusedProvider的的action=com.android.location.service.FusedLocationProvider
所以system层只要定义一个Service，接收上述的action，就可以接收到系统发来的请求

以上是NetworkProvider如何生成

我们再研究下setRequest如何处理
在networkprovider生成的代码中可知：
在LocationManagerService中，networkProvider是用其代理类LocationProviderProxy交互的
所以看下LocationProviderProxy中setRequest的实现：

   @Override
    public void setRequest(ProviderRequest request, WorkSource source) {
        synchronized (mRequestLock) {
            mRequest = request;
            mWorkSource = source;
        }
        mServiceWatcher.runOnBinder(binder -> {
            ILocationProvider service = ILocationProvider.Stub.asInterface(binder);
            service.setRequest(request, source);
        });
    }

可以看到用了 ILocationProvider这个aidl进行实现的，
ILocationProvider.aidl的实现在LocationProviderBase类的内部类Service 中：

private final class Service extends ILocationProvider.Stub {

        @Override
        public void setLocationProviderManager(ILocationProviderManager manager) {
            synchronized (mBinder) {
               ...
                mManager = manager;
            }
            onInit();
        }

        @Override
        public void setRequest(ProviderRequest request, WorkSource ws) {
            onSetRequest(new ProviderRequestUnbundled(request), ws);
        }

        @Override
        public int getStatus(Bundle extras) {
            return onGetStatus(extras);
        }

        @Override
        public long getStatusUpdateTime() {
            return onGetStatusUpdateTime();
        }

        @Override
        public void sendExtraCommand(String command, Bundle extras) {
            onSendExtraCommand(command, extras);
        }
    }

setLocationProviderManager方法传进来一个ILocationProviderManager ，这个ILocationProviderManager.aidl就是LocationManagerService的内部类LocationProvider，作为LocationManagerService与LocationProviderBase的交互

实现就在onSetRequest这个方法中
onSetRequest是一个抽象方法，LocationProviderBase类也是抽象类，这就提供了自定义Provider实现的可能性：

 public LocationProviderBase(String tag, ProviderPropertiesUnbundled properties) {
        mBinder = new Service();//此处Service为内部类
        ...
    }

    public IBinder getBinder() {
        return mBinder;
    }

只要在上述自定义Service中，bind自定义的provider:

class RobinProviderService : Service(){
    override fun onBind(intent: Intent): IBinder? {
        if (mProvider == null) {
            mProvider = RobinProvide(applicationContext)
        }
        return mProvider?.binder
    }
}

同样的我们来研究下如何上报location数据：

结果上报：

在LocationProviderBase中：

/**
     * Reports a new location from this provider.
     */
    public void reportLocation(Location location) {
        ILocationProviderManager manager = mManager;
        if (manager != null) {
            try {
                manager.onReportLocation(location);
            } catch (RemoteException | RuntimeException e) {
                Log.w(mTag, e);
            }
        }
    }

通过aidl调用LocationManagerService的内部类LocationProvider的onReportLocation方法,此方法在GnssLocationProvider中已做过介绍

以上就是LocationManager定位的大致实现过程