/dev/rpl is a character device file which returns the data captured from ttys through the rpldev kernel module. It has no fixed device number, since it asks the misc driver subsystem (char-major 10) to assign it a dynamic one.

This is a little feature rather than a bug. rpld will automatically read /proc/misc for the minor number and creates a device file in its working directory. You should not worry about the minor number and creating a device node, that's the idea behind.

However, the hotplug subsystem and udev might happen to create /dev/rpl when the kernel module it is loaded, for the misc subsystem calls the hotplug layer. /dev/rpl is not touched if it exists, and since the userspace hotplug components will be shutdown before the module is unloaded, the node will be kept. If it exists, make sure nobody else than root can read it, usually mode 0400.

Everytime the kernel functions for reading/ writing from/to a terminal are executed, the call chain is extened into the RPL hooks, i.e. an external function in the rpldev kernel module is called, which packs the tty buffer into so-called packets, which are then returned as /dev/rpl is read.

A packet consists of a device number, magic byte combined with kernel version, size of the data, and of course, the data itself. All fields are little-endian and packed, i.e. there are no alignment gaps. It can be represented in this C struct:

The data itself is actually not included in the struct, since it is of dynamic length. For further reference, the struct alone will be called packet header, whereas packet header and data equal to packet. There are no byte-aligning gaps between the members.

The .dev member contains the device number as it is represented within the current kernel version, which is truly different between 2.4 and 2.6. In 2.4 and earlier, a device number was composed of (major << 8) | minor, whereas in 2.6, it is (major << 20) | minor. rpld checks the magic byte, which is 0xFF for 2.4 and 0xEE for 2.6 and decodes the device number depending on that.

The following event types exist: EV_OPEN=1, EV_READ=2, EV_WRITE=3, EV_IOCTL=4, EV_CLOSE=5, EV_IDENT=240, EV_IGNORE=255.