If you mmap a region of memory, and give the address of that to the OS, the OS can lock that region (so that it doesn't become swapped out) and get the physical address of the memory.
It is not at all used for that purpose, but the code in drivers/xen/privcmd.c, in the function mmap_mfn_range
called from privcmd_ioctl_mmap
(indirectly, by traverse_map
). This in turn calls remap_area_mfn_pte_fn
from xen_remap_domain_mfn_range
.
So, if you do something along those lines in the driver, such that the pages are locked into memory and belong to the application, you can program the physical address(es) of the mmap
'd region into the hardware of the network driver, and get the data directly to the user-mode memory that was mmap'd by the user code.