Mali T764/RK3288: how to get the ion handler/address from egl window surface

We are using firefly board and run Android 4.4.4. And we want to display the frame buffer (content generated from GPU) directly instead of using elgswap() for speed critical application.   But we meet one question, how to get the window surface's