Nvnflinger is responsible for mediating the communication between vi and nvservices. The vi sysmodule relays display accesses to nvnflinger which in turn uses /dev/nvdisp-ctrl and /dev/nvdisp-disp0, /dev/nvdisp-disp1 from nvservices.
dispdrv
This is "nns::hosbinder::IHOSBinderDriver".
| Cmd | Name |
|---|---|
| 0 | #TransactParcel |
| 1 | #AdjustRefcount |
| 2 | #GetNativeHandle |
| 3 | [3.0.0+] #TransactParcelAuto |
This uses Android code.
Command(s) from here are constantly used while displaying gfx.
TransactParcel is used by 1.0.0 official user-processes, while starting with 3.0.0 TransactParcelAuto is used instead.
For IHOSBinderDriver, the below ID is loaded from the layer's Display_services#NativeWindow.
TransactParcel
Takes a s32 (ID), an u32 (code), a type-0x5 input buffer (parcel_data), a type-0x6 output buffer (parcel_reply) and an input u32 (flags). Each word is placed immediately after the previous word.
Analogous to "onTransact" from "android.os.IServiceManager".
AdjustRefcount
Takes 3 input s32s: ID, addval, and type. Each word immediately follows the previous word. No additional output.
| Called by official function | addval | type |
|---|---|---|
| "android::BpBinder::onFirstRef" | 1 | 1 |
| "android::BpBinder::onLastStrongRef" | -1 | 1 |
| ? | 1 | 0 |
| ? | -1 | 0 |
During init, {addval=1, type=0} is used then {addval=1, type=1} is used.
GetNativeHandle
Takes an input s32 (ID) and u32, with the latter immediately following the previous word. Returns an output event handle.
TransactParcelAuto
Takes a s32 (ID), an u32 (code), a type-0x21 input buffer (parcel_data), a type-0x22 output buffer (parcel_reply) and an input u32 (flags). Each word is placed immediately after the previous word.