Editing Direct Rendering Manager (section)

=== API ===
The DRM core exports several interfaces to user-space applications, generally intended to be used through corresponding <code>libdrm</code> wrapper functions. In addition, drivers export device-specific interfaces for use by user-space drivers and device-aware applications through [[ioctl]]s and [[sysfs]] files. External interfaces include: memory mapping, context management, [[Direct memory access|DMA]] operations, [[Accelerated Graphics Port|AGP]] management, [[Vertical blanking interval|vblank]] control, fence management, memory management, and output management.

==== DRM-Master and DRM-Auth ====
There are several operations (ioctls) in the DRM API that either for security purposes or for concurrency issues must be restricted to be used by a single user-space process per device.{{r|Kitching 2012}} To implement this restriction, DRM limits such ioctls to be only invoked by the process considered the "master" of a DRM device, usually called ''DRM-Master''. Only one of all processes that have the device node <code>/dev/dri/card''X''</code> opened will have its [[file handle]] marked as master, specifically the first calling the {{mono|SET_MASTER}} ioctl. Any attempt to use one of these restricted ioctls without being the DRM-Master will return an error. A process can also give up its master role&mdash;and let another process acquire it&mdash;by calling the {{mono|DROP_MASTER}} ioctl.

The [[X Window System|X Server]]&mdash;or any other [[display server]]&mdash;is commonly the process that acquires the DRM-Master status in every DRM device it manages, usually when it opens the corresponding device node during its startup, and keeps these privileges for the entire graphical session until it finishes or dies.

For the remaining user-space processes there is another way to gain the privilege to invoke some restricted operations on the DRM device called ''DRM-Auth''. It is basically a method of authentication against the DRM device, in order to prove to it that the process has the DRM-Master's approval to get such privileges. The procedure consists of:{{r|Peres Ravier 2013|p=13}}
* The client gets a unique token&mdash;a 32-bit integer&mdash;from the DRM device using the {{mono|GET_MAGIC}} ioctl and passes it to the DRM-Master process by whatever means (normally some sort of [[Inter-process communication|IPC]]; for example, in [[DRI2]] there is a {{mono|DRI2Authenticate}} request that any X client can send to the X Server.{{r|DRI2 spec}})
* The DRM-Master process, in turn, sends back the token to the DRM device by invoking the {{mono|AUTH_MAGIC}} ioctl.
* The device grants special rights to the process file handle whose auth token matches the received token from the DRM-Master.