The GPS on the N900 is accessed by sending isi/phonet messages to the cellular modem.

The messages being sent/received are defined in pn_location_isi.h which can be found in:
http://mirrors.muarf.org/maemo/apt-m...+0m5_armel.deb

The location-daemon binary sends these messages:
LS_HYBRID_TRACKING_REQ with sub blocks LS_SB_HYBRID_TRACKING_INSTR and LS_SB_CLIENT_IDENT

and receives these messages:
LS_HYBRID_TRACKING_RESP
LS_GPS_STATUS_IND
LS_HYBRID_TRACKING_NTF with sub blocks LS_SB_NPE_POSITION, LS_SB_NPE_TIME, LS_SB_NPE_VELOCITY, LS_SB_NPE_CHANNELS, LS_SB_NPE_NMEA, LS_SB_CELL_INFO_GSM and LS_SB_CELL_INFO_WCDMA

The location-proxy binary sends these messages:
LS_SUPL_NW_INIT_REQ
LS_SOCKET_CLOSE_RESPONSE_NTF
LS_SOCKET_OPEN_RESPONSE_NTF with sub blocks LS_SB_SOCKET_IPADDR and LS_SB_SOCKET_BEARER_TYPE
LS_PRIVACY_NOTIFICATION_RESULT_REQ
LS_SOCKET_CLOSED_REQ
LS_SUPL_SERVER_CONF_REQ with sub block LS_SB_SOCKET_ADDR
LS_PRIVACY_REGISTRATION_REQ
LS_SOCKET_REGISTRATION_REQ
LS_SOCKET_SEND_RESPONSE_NTF
LS_SOCKET_RECV_REQ

and receives these messages:
LS_PRIVACY_REGISTRATION_RESP
LS_PRIVACY_NOTIFICATION_RESULT_RESP
LS_SUPL_SERVER_CONF_RESP
LS_SUPL_NW_INIT_RESP
LS_SOCKET_REGISTRATION_RESP
LS_SOCKET_OPEN_REQUEST_NTF with sub blocks LS_SB_SOCKET_ADDR_EXT, LS_SB_SOCKET_BEARER_TYPE and LS_SB_SOCKET_ADDR
LS_SOCKET_SEND_REQUEST_NTF
LS_SOCKET_CLOSE_REQUEST_NTF
LS_PRIVACY_NTF with sub blocks LS_SB_LATITUDE_LONGITUDE, LS_SB_SS_CODEWORD, LS_SB_SS_SERVICE_TYPE_ID, LS_SB_SS_REQUESTOR_ID, LS_SB_SS_CLIENT_EXT_ID, LS_SB_SS_CLIENT_NAME, LS_SB_SS_NOTIFICATION_INFO and LS_SB_ALTITUDE

The clear-gps-cache binary (used to clear out stored GPS information) sends these messages
LS_CLEAR_GPS_DATA_REQ

and receives these messages
LS_CLEAR_GPS_DATA_RESP