As I wrote about last time, you can have a class filter driver. What I didn't mention is that there are also device filter drivers. What's the difference between the two?

The difference is scope

A class filter driver will attach to all device instances of that class. For instance, all keyboard port drivers will have kbdclass as an upper filter, regardless of the device plugged into the system. Let's assume that you have two of the same USB keyboard and both are plugged in. Each device will have its own PnP device stack and kbdclass will be loaded on each instance.

On the other hand, a device filter driver will only attach to device instances on which it was installed. It is installed relative to the device instance for each device instance. This means every time you install the device, the device filter must also be installed if you want to filter that device. Compare this to the class filter which is installed only once and is loaded automaticall for all device instances of that class. Let's take the previous example of the 2 keyboards plugged in at the same time. With a device filter you can selectively filter the first instance while leaving the second instance unfiltered.

Note that the distinction between a class and device filter is made on the device object level, not the driver. This means that a driver could be installed as a class filter as well as a device filter. I am not sure how useful it would be to have a driver implementing both roles, but it is certainly possible.

Why would you pick one over the other? Well it depends on what you are trying to do in your filter driver and the device class. Let's say you have a HID device which is not spec compliant and sends an extra byte on each transfer. In this case you would create a device filter and modify the data for only your device instance, leaving all the other HID devices alone. On the other hand, let's say you want to know about every key press in the system. In this case you want a class filter so that you can get the data from all instances of that device class in the system.