Nvnflinger services

Nvnflinger is responsible for mediating the communication between vi and nvservices. The vi sysmodule relays display accesses to nvnflinger which in turn uses /dev/nvdisp-ctrl and /dev/nvdisp-disp0, /dev/nvdisp-disp1 from nvservices.

dispdrv

This is "nns::hosbinder::IHOSBinderDriver".

Cmd	Name
0	#TransactParcel
1	#AdjustRefcount
2	#GetNativeHandle
3	[3.0.0+] #TransactParcelAuto

This uses Android code.

Command(s) from here are constantly used while displaying gfx.

TransactParcel is used by 1.0.0 official user-processes, while starting with 3.0.0 TransactParcelAuto is used instead.

For IHOSBinderDriver, the below ID is loaded from the layer's Display_services#NativeWindow.

TransactParcel

Takes a s32 (ID), an u32 (code), a type-0x5 input buffer (parcel_data), a type-0x6 output buffer (parcel_reply) and an input u32 (flags). Each word is placed immediately after the previous word.

Analogous to "onTransact" from "android.os.IServiceManager".

AdjustRefcount

Takes 3 input s32s: ID, addval, and type. Each word immediately follows the previous word. No additional output.

type indicates whether the strong reference count or weak reference count will be affected. 0 indicates the weak reference count, while 1 indicates the strong reference count.

Called by official function	addval	type
"android::BpBinder::onFirstRef"	1	1
"android::BpBinder::onLastStrongRef"	-1	1
?	1	0
?	-1	0

During init, {addval=1, type=0} is used then {addval=1, type=1} is used.

GetNativeHandle

Takes an input s32 (ID) and u32, with the latter immediately following the previous word. Returns an output event handle.

TransactParcelAuto

Takes a s32 (ID), an u32 (code), a type-0x21 input buffer (parcel_data), a type-0x22 output buffer (parcel_reply) and an input u32 (flags). Each word is placed immediately after the previous word.