KMDF filter driver acting as a bus driver

I have a disk upper filter driver written using WDF (KMDF) and I currently have a control device object that is used to communicate to the driver from userspace. However, I find myself needing to specify what disk device (by instance ID with an appended string) I want to perform the operation on. I feel like this isn’t the best approach and neither does microsoft’s own documentation.

I was thinking of creating a device for each disk device, and the Microsoft docs here explain that I can do so. It says that the filter driver should “act as a bus driver and enumerate child devices that operate in raw mode.” I’m confused about what this means for my disk filter.

Do I need to somehow write a bus filter driver to create the custom named PDOs? How do I create a “physical device object (PDO) that does not require a function driver?”

Are there multiple instances of your device, one for each disk? If you’re a PnP filter, that would be natural. A “PDO that does not require a function driver” is called a “raw device”.

Yes, so for each internal/external HDD (or like things like USB drives) there is a filter device added to the stack during the EvtDriverDeviceAdd routine.

Ah, but right now the driver just creates one single “control” device, and all requests arrive there?

If your driver is KMDF, it is surprisingly easy to have each device create a raw PDO and accept requests on that PDO. You become a bus driver, but it’s almost painless. You just have to come up with a naming convention.

Both the kbfilter and moufiltr WDK examples demonstrate a filter driver enumerating a raw PDO

Yes, that single control device parses the requests and then dispatches them to the I/O queues of the target filter device object in the device stack.

The reason I’m confused is because I’m not sure what exactly “becoming a bus driver” entails. Does this mean I have to handle bus-driver responsibilities like static and dynamic enumeration of child devices, handling power management queues, among other things? Also does my driver acting like a bus driver replace the bus driver in the stack? Or is like an “addition?”

Being a bus driver really means nothing more than “I have child devices”. In WDM, becoming a bus driver is a relatively big deal. In KMDF, it is a piece of cake, because they handle all of the standard overhead for you. You should go look at the samples Doron mentioned. Whether your driver is a bus driver or not has no impact to the drivers below you. There are many bus drivers in your stack.