Nvnflinger is responsible for mediating the communication between vi and nvservices. The vi sysmodule relays display accesses to nvnflinger which in turn uses /dev/nvdisp-ctrl and /dev/nvdisp-disp0, /dev/nvdisp-disp1 from nvservices.

dispdrv

This is "nns::hosbinder::IHOSBinderDriver".

Cmd Name
0 #TransactParcel
1 #AdjustRefcount
2 #GetNativeHandle
3 #TransactParcelAuto

This uses Android code.

Command(s) from here are constantly used while displaying gfx.

TransactParcel is used by 1.0.0 official user-processes, while starting with {unknown version} TransactParcelAuto is used instead.

TransactParcel

Takes a s32 (Binder ID?), an u32 (code), a type-0x5 input buffer (parcel_data), a type-0x6 output buffer (parcel_reply) and an input u32 (flags). Each word is placed immediately after the previous word.

Analogous to "onTransact" from "android.os.IServiceManager".

AdjustRefcount

Takes 3 input s32s: {Binder ID?}, addval, and type. Each word immediately follows the previous word. No additional output.

Called by official function addval type
"android::BpBinder::onFirstRef" 1 1
"android::BpBinder::onLastStrongRef" -1 1
? 1 0
? -1 0

During init, {addval=1, type=0} is used then {addval=1, type=1} is used.

GetNativeHandle

Takes an input s32 (Binder ID?) and u32, with the latter immediately following the previous word. Returns an output event handle.

TransactParcelAuto

Takes a s32 (Binder ID?), an u32 (code), a type-0x21 input buffer (parcel_data), a type-0x22 output buffer (parcel_reply) and an input u32 (flags). Each word is placed immediately after the previous word.