This is intended to be a guide to the inner workings of the N900 GPS subsystem. It will provide info people who want to talk to the GPS hardware can use as well as info people who want to totally replace the GPS subsystem (e.g. for Neo900) can use. And people who just want to talk to it or understand how it works.

Part 1 will give an overview of the N900 GPS subsystem
Part 2 will talk about how to talk to the GPS hardware at the low level via isi/phonet messages
Part 3 will describe the gconf, dbus and other interfaces involved in the various components.

On the N900, the GPS hardware is connected via the cellular modem. The main processor talks to the GPS via isi/phonet messages. The GPS subsystem is made up of 4 components. liblas is the low level library used to talk to the GPS hardware (it sends isi/phonet messages to the cellular modem via libisi). location-daemon is the daemon that handles the GPS position stuff. location-proxy is the daemon that handles supl and AGPS data and passes it to the cellular modem. liblocation is the library that other apps use to talk to the GPS subsystem.

Ok, now for part 2:
The easiest way to talk to the GPS hardware directly is to use libisi (header file available from http://talk.maemo.org/showthread.php?t=93906 ) and http://www.cncmods.net/files/pn_location_isi.h which is the header file containing all the modem location server info for the N900 cellular modem.

liblas calls the following libisi functions:
isi_client_cleanup (cleans up a isi_client_t structure)
isi_client_init (initializes an isi_client_t structure and sets callbacks that will be called by libisi. the only callback liblas cares about is the "receive" callback. Pass zero for the channel.)
isi_client_run (starts a private timer for an isi_client_t structure, call this after isi_client_start)
isi_client_sendto_resource (sends data to a phonet resource using an isi_client_t structure, pass zero for the address and 0x54 aka PN_LOCATION for the resource)
isi_client_set_recv_buf_size (sets the receive buffer size for an isi_client_t structure)
isi_client_start (starts an isi_client_t going, call this after isi_client_init)
isi_client_subscribe_indications (registers a client to receive indications from a given phonet resource, you want to register for 0x54 aka PN_LOCATION)
isi_glib_init (initializes libisi using a glib context)
msgbuf_add_ptr (adds data to an isi_msgbuf_t structure)
msgbuf_get_ptr (gets data from an isi_msgbuf_t structure)
msgbuf_init (initializes an isi_msgbuf_t structure)
socket_cinfo_init (initializes a comm_channel_info_t structure)

Feel free to hit me (here or in IRC) with any questions you may have about this stuff.

Ok, part 3 covers all the external things location-proxy does other than talk to the GPS hardware (liblas does nothing external except talk to the GPS hardware which we dont care about for this). This will allow you to talk directly to location-proxy if you want and also to replace location-proxy with something that talks to different GPS hardware (such as the one in the Neo900).

location-proxy references the following gconf keys:
/system/nokia/location/supl/server (server name for location SUPL server, this is written with the default value if it doesn't already have a value)
/system/nokia/location/supl/port (port number for location SUPL server)
/system/nokia/location/sim_imsi (this gets set to the SIM IMSI)

location-proxy will also create the file /var/run/location-proxy.pid and store its PID (as ASCII) in it.

It takes the command line parameters --no-detach and --pid-file

More to come tomorrow, covering dbus interfaces and ssl/security/network interfaces to location-proxy as well as all the interfaces to location-daemon and liblocation.

ok, now for the dbus stuff referenced by location-proxy.
Relevant header files/bits:
http://www.cncmods.net/files/dbus/csd-ssc.h
http://www.cncmods.net/files/dbus/ssc.xml
http://www.cncmods.net/files/dbus/wappushd-dbus.h
http://www.cncmods.net/files/dbus/csd-sim.h
http://www.cncmods.net/files/dbus/sim.xml

Location-proxy listens for the com.nokia.phone.SSC.modem_state_changed_ind in order to detect the modem state changes (if the passed in state is "initialize" it sets some things up)

It calls om.nokia.wappush.register to register for WAP push notifications (see wappushd-dbus.h for the details of the WAP push stuff) and passes "x-oma-application:ulp.ua" as the URN, "com.nokia.Location.Proxy" as the service and "/com/nokia/location/proxy" as the path.

It calls Phone.Sim.get_imsi to get the imsi for setting the sim_imsi gconf key mentioned above.

It listens for the DBUS message com.nokia.WAPPushHandler.HandleWAPPush on the com.nokia.Location.Proxy service (again see wappushd-dbus.h for the details) and passes the message to the cellular modem (details of how WAP push supl messages work is likely documented somewhere given that its a standard of some sort, I dont know how they work)

It also listens for the dbus message com.nokia.ShortMessageHandler.HandleBinarySMSData. This is undocumented other than the dbus signature which is siiyyay. The only bit location-proxy cares about is the array at the end which is sent to the cellular modem (the format passed in is identical to the one passed in in the WAP push case and as mentioned is likely documented somewhere)

The final relavent thing location-proxy does is to talk via dbus to com.nokia.Location.UI. This is used to display UI related to supl. Work continues on reverse engineering this unknown interface.

If anyone wants me to finish this and post details of com.nokia.Location.UI, post here and I will do it

Layman question :
can this thing be used in nitdroid to use gps

No it cant.