Every IoTimer routine is associated with a driver-created device object. Consequently, an NT driver can have a single IoTimer routine for all its device objects, a separate IoTimer routine for each of its device objects, or some number of IoTimer routines associated with nonintersecting subsets of the driver’s device objects, at the discretion of the driver designer.
An IoTimer routine is called approximately once per second after the driver calls IoStartTimer with the DeviceObject pointer to an associated device object unless the driver disables the timer for that device object with a call to IoStopTimer using the same DeviceObject pointer. The driver can re-enable the timer with another call to IoStartTimer, so that its IoTimer routine again will be called automatically at one-second intervals for a given device object.
Frequently, an NT device driver calls IoStartTimer with the DeviceObject pointer in its I/O stack location of the current IRP.
Do not call IoStopTimer from within a driver’s IoTimer routine.