AFAIK the gimballing is done by the ATVC SOP. Where do the commands for it come from, I'm not sure. Is there a "place" in the memory where it reads from and acts, or each of the possible sources has a distinct "place" in the memory and the SOP listens to who it wants? I don't know.
Yes... I try my best to explain something that is a mystery to myself sometimes:
Each GPC uses shared memory for all processes or tasks, how they are called in the HAL/s language. This is defined in software with a structure called COMPOOL or common pool. Simplified, every layer in the software hierarchy has its own COMPOOL:
There is a FCOS COMPOOL for the variables of all system software (which the application software in the overlays above does not directly interfere with)
There is a GNC COMPOOL shared by all GNC software.
There is a OPS1 COMPOOL for all OPS1 software.
In reality, the common memory is made often of multiple COMPOOLs at fixed memory addresses, because of software development decisions.
The important thing of PASS: Everything in memory above FCOS is practically the same for all GPCs in a redundant set. Because of the synchronization, the software is executed equal in all GPCs and only the data hidden in the FCOS memory is special for every GPC (for example, it contains the number of the GPC)
When you do I/O, you are not directly talking to a subsystem, as you already expect. The software instead tells the IOP of its GPC, to execute a small program and write the results of the IO into memory or read the commands for the subsystem from memory. The PASS software can then either wait for I/O to finish or go on with processing while the IOP is busy. Even more, because of the chosen execution model, tasks can have I/O programs attached that are executed in advance of running the task, so that the task is always started with new data.
All that data that goes around with I/O is in the common memory. When you read the position of the SBTA, you don't directly talk to it. You tell the responsible MDM to execute a small program in its memory and the stream of 16 bit words that arrives is stored in structures in GPC memory.
Because of that structure and because only the FCOS operating system knows which GPC it is, the displays are not drawn by the application software, but by a special system process of FCOS. The application does not even know how its display looks like. All that the application software does, is telling the FCOS operating system, which "format" it uses. The FCOS checks if it has already loaded this format, and if not, it loads the format from tape. All the numbers, symbols, text and stuff are not painted by the application. When the software is compiled, the memory locations for the variables that the software has in its COMPOOL is compiled into the display formats and stored as RAM addresses there. When the display gets updated by the "cyclic display processor" process of FCOS, it reads the format and replaces special commands that reference to GPC memory by the actual drawing commands in the display buffer. And then sends the current display buffer to the DEU that needs the update.
So: Every RM and SOP write to the same memory. SOPs for the navigation systems would write directly to GNC COMPOOLs, the SOPs that talk to SRBs or SSMEs would use the OPS1 COMPOOL. And the data that goes into the COMPOOLs is read by the operating system for drawing the displays according to the format, that describes the displays.
That separation of application, UI and operating system software is what makes it possible to run 4 GPCs in a redundant set as one computer. Everything, that could depend on one special GPC being used to execute the software is done by the FCOS.
Things get much more funny with the ILOADS - the constants for the mission are written into the software tapes and loaded into memory when a new memory overlay is selected. And the software on the tape can be edited even just a few hours from launch away, via LDB commands. And memory inside the GPCs can be loaded with new ILOADS even seconds from launch. Or updated in orbit.