return (unsigned long)pfn_to_kaddr(idx_to_pfn(vif, idx));
 }
 
+static inline struct xenvif* ubuf_to_vif(struct ubuf_info *ubuf)
+{
+       return NULL;
+}
 /* This is a miniumum size for the linear area to avoid lots of
  * calls to __pskb_pull_tail() as we set up checksum offsets. The
  * value 128 was chosen as it covers all IPv4 and most likely
 static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                                 struct netrx_pending_operations *npo,
                                 struct page *page, unsigned long size,
-                                unsigned long offset, int *head)
+                                unsigned long offset, int *head,
+                                struct xenvif *foreign_vif,
+                                grant_ref_t foreign_gref)
 {
        struct gnttab_copy *copy_gop;
        struct xenvif_rx_meta *meta;
                copy_gop->flags = GNTCOPY_dest_gref;
                copy_gop->len = bytes;
 
-               copy_gop->source.domid = DOMID_SELF;
-               copy_gop->source.u.gmfn = virt_to_mfn(page_address(page));
+               if (foreign_vif) {
+                       copy_gop->source.domid = foreign_vif->domid;
+                       copy_gop->source.u.ref = foreign_gref;
+                       copy_gop->flags |= GNTCOPY_source_gref;
+               } else {
+                       copy_gop->source.domid = DOMID_SELF;
+                       copy_gop->source.u.gmfn =
+                               virt_to_mfn(page_address(page));
+               }
                copy_gop->source.offset = offset;
 
                copy_gop->dest.domid = vif->domid;
        int old_meta_prod;
        int gso_type;
        int gso_size;
+       struct ubuf_info *ubuf = skb_shinfo(skb)->destructor_arg;
+       grant_ref_t foreign_grefs[MAX_SKB_FRAGS];
+       struct xenvif *foreign_vif = NULL;
 
        old_meta_prod = npo->meta_prod;
 
        npo->copy_off = 0;
        npo->copy_gref = req->gref;
 
+       if ((skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) &&
+                (ubuf->callback == &xenvif_zerocopy_callback)) {
+               int i = 0;
+               foreign_vif = ubuf_to_vif(ubuf);
+
+               do {
+                       u16 pending_idx = ubuf->desc;
+                       foreign_grefs[i++] =
+                               foreign_vif->pending_tx_info[pending_idx].req.gref;
+                       ubuf = (struct ubuf_info *) ubuf->ctx;
+               } while (ubuf);
+       }
+
        data = skb->data;
        while (data < skb_tail_pointer(skb)) {
                unsigned int offset = offset_in_page(data);
                        len = skb_tail_pointer(skb) - data;
 
                xenvif_gop_frag_copy(vif, skb, npo,
-                                    virt_to_page(data), len, offset, &head);
+                                    virt_to_page(data), len, offset, &head,
+                                    NULL,
+                                    0);
                data += len;
        }
 
                                     skb_frag_page(&skb_shinfo(skb)->frags[i]),
                                     skb_frag_size(&skb_shinfo(skb)->frags[i]),
                                     skb_shinfo(skb)->frags[i].page_offset,
-                                    &head);
+                                    &head,
+                                    foreign_vif,
+                                    foreign_grefs[i]);
        }
 
        return npo->meta_prod - old_meta_prod;
        return work_done;
 }
 
+void xenvif_zerocopy_callback(struct ubuf_info *ubuf, bool zerocopy_success)
+{
+       return;
+}
+
 /* Called after netfront has transmitted */
 int xenvif_tx_action(struct xenvif *vif, int budget)
 {