Since no reply but got 500+ views in 10 days, let me add my finding here to attract more attentions on this topic:
The only way I know is through WMI. Based on the 5 steps in wmiacpi sample, we can add the sample into the ASL of target machine, update ACPI DSDT, and then the KMDF can talk to ASL thr. the defined WMI classes.
However, it's no good for my case due to the ASL is from factory side, i.e., unchangeable or need a lot of communication efforts.
Now my plan is back to studying WDM, any hint from anyone is highly appreciated!