Mali T764/RK3288: how to get the ion handler/address from egl window surface

We are using firefly board and run Android 4.4.4.

And we want to display the frame buffer (content generated from GPU) directly instead of using elgswap() for speed critical application.

But we meet one question, how to get the window surface's ion handler or frame buffer virtual address?

window surface is created via eglCreateWindowSurface(),

so how to get the ion handler or frame buffer virtual address?

After the handler or frame buffer virtual address is available, it could be converted to frame buffer physical address, then we could display the frame buffer directly.

Thanks in advance.