>My question is about how SIOCSDRVSPEC ioctl for if_bridge is 
>transferred to bridge_ioctl(). When ioctl system call is executing,
>it reaches soo_ioctl() and finally ifioctl() in if.c.
>
>But I can't find entry to bridge_ioctl. For me, there is no matching
>routine such as (*if_ioctl)(...). Would someone clarify how it works?

SIOCSDRVSPEC is handled by the default case which calls

		error = ((*so->so_proto->pr_usrreq)(so, PRU_CONTROL,
		    (struct mbuf *)cmd, (struct mbuf *)data,
		    (struct mbuf *)ifp, p));

where pr_usrreq(), in a call to manipulate a bridge device, will be a
udp socket, that means udp_usrreq() in netinet/udp_usrreq.c, which
does this:

	if (req == PRU_CONTROL)
		return (in_control(so, (long)m, (caddr_t)nam,
		    (struct ifnet *)control, p));

in_control() in netinet/in.c has a default case near the bottom of a
long switch that does this:

                error = (*ifp->if_ioctl)(ifp, cmd, data);

and that's how bridge_ioctl() gets called.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."