diff --git a/libfprint/drivers/aes1610.c b/libfprint/drivers/aes1610.c
index 1748af7..17f9f06 100644
--- a/libfprint/drivers/aes1610.c
+++ b/libfprint/drivers/aes1610.c
@@ -643,7 +643,7 @@ out:
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aes1610_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -690,7 +690,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aes1610_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
@@ -737,7 +737,7 @@ enum activate_states {
 
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 
 	/* activation on aes1610 seems much more straightforward compared to aes2501 */
 	/* verify theres anything missing here */
@@ -752,7 +752,7 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 /* jump to finger detection */
 static void activate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	fp_dbg("status %d", fpi_ssm_get_error(ssm));
 	fpi_imgdev_activate_complete(dev, fpi_ssm_get_error(ssm));
 
diff --git a/libfprint/drivers/aes2501.c b/libfprint/drivers/aes2501.c
index 7d1357c..f91682b 100644
--- a/libfprint/drivers/aes2501.c
+++ b/libfprint/drivers/aes2501.c
@@ -521,7 +521,7 @@ out:
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aes2501_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -572,7 +572,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aes2501_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
@@ -737,7 +737,7 @@ static void activate_init3_cb(struct fp_img_dev *dev, int result,
 
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 
 	/* This state machine isn't as linear as it may appear. After doing init1
 	 * and init2 register configuration writes, we have to poll a register
@@ -791,7 +791,7 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 
 static void activate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	fp_dbg("status %d", fpi_ssm_get_error(ssm));
 	fpi_imgdev_activate_complete(dev, fpi_ssm_get_error(ssm));
 
diff --git a/libfprint/drivers/aes2550.c b/libfprint/drivers/aes2550.c
index bc5a0ef..34533b5 100644
--- a/libfprint/drivers/aes2550.c
+++ b/libfprint/drivers/aes2550.c
@@ -200,10 +200,9 @@ enum capture_states {
 };
 
 /* Returns number of processed bytes */
-static int process_strip_data(fpi_ssm *ssm, unsigned char *data)
+static int process_strip_data(fpi_ssm *ssm, struct fp_img_dev *dev, unsigned char *data)
 {
 	unsigned char *stripdata;
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct aes2550_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	struct fpi_frame *stripe;
 	int len;
@@ -290,7 +289,7 @@ static void capture_read_data_cb(struct libusb_transfer *transfer)
 
 	switch (transfer->actual_length) {
 		case AES2550_STRIP_SIZE:
-			r = process_strip_data(ssm, data);
+			r = process_strip_data(ssm, dev, data);
 			if (r < 0) {
 				fp_dbg("Processing strip data failed: %d", r);
 				fpi_ssm_mark_failed(ssm, -EPROTO);
@@ -325,7 +324,7 @@ out:
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	int r;
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -388,7 +387,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aes2550_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	fp_dbg("Capture completed");
@@ -484,7 +483,7 @@ static void calibrate_read_data_cb(struct libusb_transfer *transfer)
 
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	int r;
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -569,7 +568,7 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 
 static void activate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	fp_dbg("status %d", fpi_ssm_get_error(ssm));
 	fpi_imgdev_activate_complete(dev, fpi_ssm_get_error(ssm));
 
diff --git a/libfprint/drivers/aesx660.c b/libfprint/drivers/aesx660.c
index cd8d65b..650dc84 100644
--- a/libfprint/drivers/aesx660.c
+++ b/libfprint/drivers/aesx660.c
@@ -37,10 +37,15 @@ static void complete_deactivation(struct fp_img_dev *dev);
 
 #define min(a, b) (((a) < (b)) ? (a) : (b))
 
-static void aesX660_send_cmd_timeout(fpi_ssm *ssm, const unsigned char *cmd,
-	size_t cmd_len, libusb_transfer_cb_fn callback, int timeout)
+static void
+aesX660_send_cmd_timeout(fpi_ssm               *ssm,
+			 struct fp_dev         *_dev,
+			 const unsigned char   *cmd,
+			 size_t                 cmd_len,
+			 libusb_transfer_cb_fn  callback,
+			 int                    timeout)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = FP_IMG_DEV(_dev);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	int r;
 
@@ -60,16 +65,23 @@ static void aesX660_send_cmd_timeout(fpi_ssm *ssm, const unsigned char *cmd,
 	}
 }
 
-static void aesX660_send_cmd(fpi_ssm *ssm, const unsigned char *cmd,
-	size_t cmd_len, libusb_transfer_cb_fn callback)
+static void
+aesX660_send_cmd(fpi_ssm               *ssm,
+		 struct fp_dev         *dev,
+		 const unsigned char   *cmd,
+		 size_t                 cmd_len,
+		 libusb_transfer_cb_fn  callback)
 {
-	return aesX660_send_cmd_timeout(ssm, cmd, cmd_len, callback, BULK_TIMEOUT);
+	return aesX660_send_cmd_timeout(ssm, dev, cmd, cmd_len, callback, BULK_TIMEOUT);
 }
 
-static void aesX660_read_response(fpi_ssm *ssm, size_t buf_len,
-	libusb_transfer_cb_fn callback)
+static void
+aesX660_read_response(fpi_ssm               *ssm,
+		      struct fp_dev         *_dev,
+		      size_t                 buf_len,
+		      libusb_transfer_cb_fn  callback)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = FP_IMG_DEV(_dev);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	unsigned char *data;
 	int r;
@@ -197,7 +209,7 @@ static void finger_det_set_idle_cmd_cb(struct libusb_transfer *transfer)
 
 static void finger_det_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aesX660_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int err = fpi_ssm_get_error(ssm);
 
@@ -215,23 +227,23 @@ static void finger_det_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user
 	}
 }
 
-static void finger_det_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
+static void finger_det_run_state(fpi_ssm *ssm, struct fp_dev *dev, void *user_data)
 {
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case FINGER_DET_SEND_LED_CMD:
-		aesX660_send_cmd(ssm, led_blink_cmd, sizeof(led_blink_cmd),
+		aesX660_send_cmd(ssm, dev, led_blink_cmd, sizeof(led_blink_cmd),
 			aesX660_send_cmd_cb);
 	break;
 	case FINGER_DET_SEND_FD_CMD:
-		aesX660_send_cmd_timeout(ssm, wait_for_finger_cmd, sizeof(wait_for_finger_cmd),
+		aesX660_send_cmd_timeout(ssm, dev, wait_for_finger_cmd, sizeof(wait_for_finger_cmd),
 			aesX660_send_cmd_cb, 0);
 	break;
 	case FINGER_DET_READ_FD_DATA:
 		/* Should return 4 byte of response */
-		aesX660_read_response(ssm, 4, finger_det_read_fd_data_cb);
+		aesX660_read_response(ssm, dev, 4, finger_det_read_fd_data_cb);
 	break;
 	case FINGER_DET_SET_IDLE:
-		aesX660_send_cmd(ssm, set_idle_cmd, sizeof(set_idle_cmd),
+		aesX660_send_cmd(ssm, dev, set_idle_cmd, sizeof(set_idle_cmd),
 			finger_det_set_idle_cmd_cb);
 	break;
 	}
@@ -262,11 +274,10 @@ enum capture_states {
 };
 
 /* Returns number of processed bytes */
-static int process_stripe_data(fpi_ssm *ssm, unsigned char *data)
+static int process_stripe_data(fpi_ssm *ssm, struct fp_img_dev *dev, unsigned char *data)
 {
 	struct fpi_frame *stripe;
 	unsigned char *stripdata;
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct aesX660_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	stripe = g_malloc(aesdev->assembling_ctx->frame_width * FRAME_HEIGHT / 2 + sizeof(struct fpi_frame)); /* 4 bpp */
@@ -351,7 +362,7 @@ static void capture_read_stripe_data_cb(struct libusb_transfer *transfer)
 					aesdev->buffer_max);
 				continue;
 			} else {
-				finger_missing |= process_stripe_data(ssm, aesdev->buffer);
+				finger_missing |= process_stripe_data(ssm, dev, aesdev->buffer);
 				aesdev->buffer_max = AESX660_HEADER_SIZE;
 				aesdev->buffer_size = 0;
 			}
@@ -372,28 +383,28 @@ out:
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aesX660_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case CAPTURE_SEND_LED_CMD:
-		aesX660_send_cmd(ssm, led_solid_cmd, sizeof(led_solid_cmd),
+		aesX660_send_cmd(ssm, _dev, led_solid_cmd, sizeof(led_solid_cmd),
 			aesX660_send_cmd_cb);
 	break;
 	case CAPTURE_SEND_CAPTURE_CMD:
 		aesdev->buffer_size = 0;
 		aesdev->buffer_max = AESX660_HEADER_SIZE;
-		aesX660_send_cmd(ssm, aesdev->start_imaging_cmd,
+		aesX660_send_cmd(ssm, _dev, aesdev->start_imaging_cmd,
 			aesdev->start_imaging_cmd_len,
 			aesX660_send_cmd_cb);
 	break;
 	case CAPTURE_READ_STRIPE_DATA:
-		aesX660_read_response(ssm, AESX660_BULK_TRANSFER_SIZE,
+		aesX660_read_response(ssm, _dev, AESX660_BULK_TRANSFER_SIZE,
 			capture_read_stripe_data_cb);
 	break;
 	case CAPTURE_SET_IDLE:
 		fp_dbg("Got %lu frames\n", aesdev->strips_len);
-		aesX660_send_cmd(ssm, set_idle_cmd, sizeof(set_idle_cmd),
+		aesX660_send_cmd(ssm, _dev, set_idle_cmd, sizeof(set_idle_cmd),
 			capture_set_idle_cmd_cb);
 	break;
 	}
@@ -401,7 +412,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aesX660_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int err = fpi_ssm_get_error(ssm);
 
@@ -534,30 +545,30 @@ out:
 
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct aesX660_dev *aesdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case ACTIVATE_SET_IDLE:
 		aesdev->init_seq_idx = 0;
 		fp_dbg("Activate: set idle\n");
-		aesX660_send_cmd(ssm, set_idle_cmd, sizeof(set_idle_cmd),
+		aesX660_send_cmd(ssm, _dev, set_idle_cmd, sizeof(set_idle_cmd),
 			aesX660_send_cmd_cb);
 	break;
 	case ACTIVATE_SEND_READ_ID_CMD:
 		fp_dbg("Activate: read ID\n");
-		aesX660_send_cmd(ssm, read_id_cmd, sizeof(read_id_cmd),
+		aesX660_send_cmd(ssm, _dev, read_id_cmd, sizeof(read_id_cmd),
 			aesX660_send_cmd_cb);
 	break;
 	case ACTIVATE_READ_ID:
 		/* Should return 8-byte response */
-		aesX660_read_response(ssm, 8, activate_read_id_cb);
+		aesX660_read_response(ssm, _dev, 8, activate_read_id_cb);
 	break;
 	case ACTIVATE_SEND_INIT_CMD:
 		fp_dbg("Activate: send init seq #%d cmd #%d\n",
 			aesdev->init_seq_idx,
 			aesdev->init_cmd_idx);
-		aesX660_send_cmd(ssm,
+		aesX660_send_cmd(ssm, _dev,
 			aesdev->init_seq[aesdev->init_cmd_idx].cmd,
 			aesdev->init_seq[aesdev->init_cmd_idx].len,
 			aesX660_send_cmd_cb);
@@ -565,22 +576,22 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 	case ACTIVATE_READ_INIT_RESPONSE:
 		fp_dbg("Activate: read init response\n");
 		/* Should return 4-byte response */
-		aesX660_read_response(ssm, 4, activate_read_init_cb);
+		aesX660_read_response(ssm, _dev, 4, activate_read_init_cb);
 	break;
 	case ACTIVATE_SEND_CALIBRATE_CMD:
-		aesX660_send_cmd(ssm, calibrate_cmd, sizeof(calibrate_cmd),
+		aesX660_send_cmd(ssm, _dev, calibrate_cmd, sizeof(calibrate_cmd),
 			aesX660_send_cmd_cb);
 	break;
 	case ACTIVATE_READ_CALIBRATE_DATA:
 		/* Should return 4-byte response */
-		aesX660_read_response(ssm, 4, aesX660_read_calibrate_data_cb);
+		aesX660_read_response(ssm, _dev, 4, aesX660_read_calibrate_data_cb);
 	break;
 	}
 }
 
 static void activate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	int err = fpi_ssm_get_error(ssm);
 	fp_dbg("status %d", err);
 	fpi_imgdev_activate_complete(dev, err);
diff --git a/libfprint/drivers/elan.c b/libfprint/drivers/elan.c
index 9c5d8bc..330f625 100644
--- a/libfprint/drivers/elan.c
+++ b/libfprint/drivers/elan.c
@@ -343,7 +343,7 @@ static void elan_cmd_cb(struct libusb_transfer *transfer)
 		} else {
 			/* just finished sending */
 			G_DEBUG_HERE();
-			elan_cmd_read(ssm);
+			elan_cmd_read(ssm, dev);
 		}
 		break;
 	case LIBUSB_TRANSFER_CANCELLED:
@@ -362,9 +362,8 @@ static void elan_cmd_cb(struct libusb_transfer *transfer)
 	}
 }
 
-static void elan_cmd_read(fpi_ssm *ssm)
+static void elan_cmd_read(fpi_ssm *ssm, struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int response_len = elandev->cmd->response_len;
 
@@ -401,10 +400,12 @@ static void elan_cmd_read(fpi_ssm *ssm)
 		fpi_ssm_mark_failed(ssm, r);
 }
 
-static void elan_run_cmd(fpi_ssm *ssm, const struct elan_cmd *cmd,
-			 int cmd_timeout)
+static void
+elan_run_cmd(fpi_ssm               *ssm,
+	     struct fp_img_dev     *dev,
+	     const struct elan_cmd *cmd,
+	     int                    cmd_timeout)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	dbg_buf(cmd->cmd, 2);
@@ -440,20 +441,20 @@ enum stop_capture_states {
 	STOP_CAPTURE_NUM_STATES,
 };
 
-static void stop_capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
+static void stop_capture_run_state(fpi_ssm *ssm, struct fp_dev *dev, void *user_data)
 {
 	G_DEBUG_HERE();
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case STOP_CAPTURE:
-		elan_run_cmd(ssm, &stop_cmd, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, FP_IMG_DEV(dev), &stop_cmd, ELAN_CMD_TIMEOUT);
 		break;
 	}
 }
 
 static void stop_capture_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int error = fpi_ssm_get_error(ssm);
 
@@ -501,16 +502,16 @@ enum capture_states {
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case CAPTURE_LED_ON:
-		elan_run_cmd(ssm, &led_on_cmd, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, dev, &led_on_cmd, ELAN_CMD_TIMEOUT);
 		break;
 	case CAPTURE_WAIT_FINGER:
-		elan_run_cmd(ssm, &pre_scan_cmd, -1);
+		elan_run_cmd(ssm, dev, &pre_scan_cmd, -1);
 		break;
 	case CAPTURE_READ_DATA:
 		/* 0x55 - finger present
@@ -518,7 +519,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 		if (elandev->last_read && elandev->last_read[0] == 0x55) {
 			if (elandev->dev_state == IMGDEV_STATE_AWAIT_FINGER_ON)
 				fpi_imgdev_report_finger_status(dev, TRUE);
-			elan_run_cmd(ssm, &get_image_cmd, ELAN_CMD_TIMEOUT);
+			elan_run_cmd(ssm, dev, &get_image_cmd, ELAN_CMD_TIMEOUT);
 		} else
 			fpi_ssm_mark_failed(ssm, -EBADMSG);
 		break;
@@ -539,7 +540,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
@@ -624,14 +625,14 @@ enum calibrate_states {
 
 static void calibrate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case CALIBRATE_GET_BACKGROUND:
-		elan_run_cmd(ssm, &get_image_cmd, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, dev, &get_image_cmd, ELAN_CMD_TIMEOUT);
 		break;
 	case CALIBRATE_SAVE_BACKGROUND:
 		elan_save_background(elandev);
@@ -642,7 +643,7 @@ static void calibrate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_da
 			fpi_ssm_next_state(ssm);
 		break;
 	case CALIBRATE_GET_MEAN:
-		elan_run_cmd(ssm, &get_calib_mean_cmd, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, dev, &get_calib_mean_cmd, ELAN_CMD_TIMEOUT);
 		break;
 	case CALIBRATE_CHECK_NEEDED:
 		if (elan_need_calibration(elandev)) {
@@ -654,7 +655,7 @@ static void calibrate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_da
 	case CALIBRATE_GET_STATUS:
 		elandev->calib_atts_left -= 1;
 		if (elandev->calib_atts_left)
-			elan_run_cmd(ssm, &get_calib_status_cmd,
+			elan_run_cmd(ssm, dev, &get_calib_status_cmd,
 				     ELAN_CMD_TIMEOUT);
 		else {
 			fp_dbg("calibration failed");
@@ -689,7 +690,7 @@ static void calibrate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_da
 
 static void calibrate_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 
 	G_DEBUG_HERE();
 
@@ -725,14 +726,14 @@ enum activate_states {
 
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct elan_dev *elandev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case ACTIVATE_GET_FW_VER:
-		elan_run_cmd(ssm, &get_fw_ver_cmd, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, dev, &get_fw_ver_cmd, ELAN_CMD_TIMEOUT);
 		break;
 	case ACTIVATE_SET_FW_VER:
 		elandev->fw_ver =
@@ -741,7 +742,7 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 		fpi_ssm_next_state(ssm);
 		break;
 	case ACTIVATE_GET_SENSOR_DIM:
-		elan_run_cmd(ssm, &get_sensor_dim_cmd, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, dev, &get_sensor_dim_cmd, ELAN_CMD_TIMEOUT);
 		break;
 	case ACTIVATE_SET_SENSOR_DIM:
 		/* see elan_save_frame for details */
@@ -762,14 +763,14 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 		break;
 	case ACTIVATE_CMD_1:
 		/* TODO: find out what this does, if we need it */
-		elan_run_cmd(ssm, &activate_cmd_1, ELAN_CMD_TIMEOUT);
+		elan_run_cmd(ssm, dev, &activate_cmd_1, ELAN_CMD_TIMEOUT);
 		break;
 	}
 }
 
 static void activate_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 
 	G_DEBUG_HERE();
 
diff --git a/libfprint/drivers/elan.h b/libfprint/drivers/elan.h
index fc36bb5..853f31d 100644
--- a/libfprint/drivers/elan.h
+++ b/libfprint/drivers/elan.h
@@ -211,7 +211,7 @@ static const struct usb_id elan_id_table[] = {
 };
 
 static void elan_cmd_done(fpi_ssm *ssm);
-static void elan_cmd_read(fpi_ssm *ssm);
+static void elan_cmd_read(fpi_ssm *ssm, struct fp_img_dev *dev);
 
 static void elan_calibrate(struct fp_img_dev *dev);
 static void elan_capture(struct fp_img_dev *dev);
diff --git a/libfprint/drivers/etes603.c b/libfprint/drivers/etes603.c
index e540698..06dea50 100644
--- a/libfprint/drivers/etes603.c
+++ b/libfprint/drivers/etes603.c
@@ -701,7 +701,7 @@ static void async_tx_cb(struct libusb_transfer *transfer)
 
 static void m_exit_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -729,7 +729,7 @@ err:
 
 static void m_exit_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 
 	if (fpi_ssm_get_error(ssm)) {
 		fp_err("Error switching the device to idle state");
@@ -750,7 +750,7 @@ static void m_exit_start(struct fp_img_dev *idev)
 
 static void m_capture_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	if (dev->is_active == FALSE) {
@@ -831,7 +831,7 @@ err:
 
 static void m_capture_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	if (fpi_ssm_get_error(ssm)) {
@@ -853,7 +853,7 @@ static void m_capture_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 
 static void m_finger_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	if (dev->is_active == FALSE) {
@@ -949,7 +949,7 @@ err:
 
 static void m_finger_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	if (!fpi_ssm_get_error(ssm)) {
@@ -981,7 +981,7 @@ static void m_start_fingerdetect(struct fp_img_dev *idev)
  */
 static void m_tunevrb_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 	float hist[5];
 
@@ -1133,7 +1133,7 @@ err:
 
 static void m_tunevrb_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 
 	fpi_imgdev_activate_complete(idev, fpi_ssm_get_error(ssm) != 0);
 	if (!fpi_ssm_get_error(ssm)) {
@@ -1155,7 +1155,7 @@ static void m_tunevrb_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
  */
 static void m_tunedc_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	if (dev->is_active == FALSE) {
@@ -1258,7 +1258,7 @@ err:
 
 static void m_tunedc_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	if (!fpi_ssm_get_error(ssm)) {
 		fpi_ssm *ssm_tune;
 		ssm_tune = fpi_ssm_new(FP_DEV(idev), m_tunevrb_state,
@@ -1276,7 +1276,7 @@ static void m_tunedc_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct etes603_dev *dev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	if (dev->is_active == FALSE) {
@@ -1377,7 +1377,7 @@ err:
 
 static void m_init_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	if (!fpi_ssm_get_error(ssm)) {
 		fpi_ssm *ssm_tune;
 		ssm_tune = fpi_ssm_new(FP_DEV(idev), m_tunedc_state,
diff --git a/libfprint/drivers/upeksonly.c b/libfprint/drivers/upeksonly.c
index c597e31..cc5588c 100644
--- a/libfprint/drivers/upeksonly.c
+++ b/libfprint/drivers/upeksonly.c
@@ -615,9 +615,12 @@ static void sm_write_reg_cb(struct libusb_transfer *transfer)
 
 }
 
-static void sm_write_reg(fpi_ssm *ssm, uint8_t reg, uint8_t value)
+static void
+sm_write_reg(fpi_ssm           *ssm,
+	     struct fp_img_dev *dev,
+	     uint8_t            reg,
+	     uint8_t            value)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	unsigned char *data;
 	int r;
@@ -663,9 +666,11 @@ static void sm_read_reg_cb(struct libusb_transfer *transfer)
 	g_free(transfer->buffer);
 }
 
-static void sm_read_reg(fpi_ssm *ssm, uint8_t reg)
+static void
+sm_read_reg(fpi_ssm           *ssm,
+	    struct fp_img_dev *dev,
+	    uint8_t            reg)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	unsigned char *data;
 	int r;
@@ -714,9 +719,10 @@ static void sm_await_intr_cb(struct libusb_transfer *transfer)
 	fpi_ssm_next_state(ssm);
 }
 
-static void sm_await_intr(fpi_ssm *ssm)
+static void
+sm_await_intr(fpi_ssm           *ssm,
+	      struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	unsigned char *data;
 	int r;
@@ -766,7 +772,7 @@ enum awfsm_1000_states {
 
 static void awfsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -774,36 +780,36 @@ static void awfsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_d
 		sm_write_regs(ssm, _dev, awfsm_2016_writev_1, G_N_ELEMENTS(awfsm_2016_writev_1));
 		break;
 	case AWFSM_2016_READ_01:
-		sm_read_reg(ssm, 0x01);
+		sm_read_reg(ssm, dev, 0x01);
 		break;
 	case AWFSM_2016_WRITE_01:
 		if (sdev->read_reg_result != 0xc6)
-			sm_write_reg(ssm, 0x01, 0x46);
+			sm_write_reg(ssm, dev, 0x01, 0x46);
 		else
-			sm_write_reg(ssm, 0x01, 0xc6);
+			sm_write_reg(ssm, dev, 0x01, 0xc6);
 		break;
 	case AWFSM_2016_WRITEV_2:
 		sm_write_regs(ssm, _dev, awfsm_2016_writev_2, G_N_ELEMENTS(awfsm_2016_writev_2));
 		break;
 	case AWFSM_2016_READ_13:
-		sm_read_reg(ssm, 0x13);
+		sm_read_reg(ssm, dev, 0x13);
 		break;
 	case AWFSM_2016_WRITE_13:
 		if (sdev->read_reg_result != 0x45)
-			sm_write_reg(ssm, 0x13, 0x05);
+			sm_write_reg(ssm, dev, 0x13, 0x05);
 		else
-			sm_write_reg(ssm, 0x13, 0x45);
+			sm_write_reg(ssm, dev, 0x13, 0x45);
 		break;
 	case AWFSM_2016_WRITEV_3:
 		sm_write_regs(ssm, _dev, awfsm_2016_writev_3, G_N_ELEMENTS(awfsm_2016_writev_3));
 		break;
 	case AWFSM_2016_READ_07:
-		sm_read_reg(ssm, 0x07);
+		sm_read_reg(ssm, dev, 0x07);
 		break;
 	case AWFSM_2016_WRITE_07:
 		if (sdev->read_reg_result != 0x10 && sdev->read_reg_result != 0x90)
 			fp_warn("odd reg7 value %x", sdev->read_reg_result);
-		sm_write_reg(ssm, 0x07, sdev->read_reg_result);
+		sm_write_reg(ssm, dev, 0x07, sdev->read_reg_result);
 		break;
 	case AWFSM_2016_WRITEV_4:
 		sm_write_regs(ssm, _dev, awfsm_2016_writev_4, G_N_ELEMENTS(awfsm_2016_writev_4));
@@ -852,9 +858,11 @@ enum capsm_1001_states {
 	CAPSM_1001_NUM_STATES,
 };
 
-static void capsm_fire_bulk(fpi_ssm *ssm)
+static void
+capsm_fire_bulk(fpi_ssm       *ssm,
+		struct fp_dev *_dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = FP_IMG_DEV(_dev);
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int i;
 	for (i = 0; i < NUM_BULK_TRANSFERS; i++) {
@@ -884,7 +892,7 @@ static void capsm_fire_bulk(fpi_ssm *ssm)
 
 static void capsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -900,13 +908,13 @@ static void capsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_d
 		fpi_ssm_next_state(ssm);
 		break;
 	case CAPSM_2016_WRITE_15:
-		sm_write_reg(ssm, 0x15, 0x20);
+		sm_write_reg(ssm, dev, 0x15, 0x20);
 		break;
 	case CAPSM_2016_WRITE_30:
-		sm_write_reg(ssm, 0x30, 0xe0);
+		sm_write_reg(ssm, dev, 0x30, 0xe0);
 		break;
 	case CAPSM_2016_FIRE_BULK: ;
-		capsm_fire_bulk (ssm);
+		capsm_fire_bulk (ssm, _dev);
 		break;
 	case CAPSM_2016_WRITEV:
 		sm_write_regs(ssm, _dev, capsm_2016_writev, G_N_ELEMENTS(capsm_2016_writev));
@@ -916,7 +924,7 @@ static void capsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_d
 
 static void capsm_1000_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -932,7 +940,7 @@ static void capsm_1000_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_d
 		fpi_ssm_next_state(ssm);
 		break;
 	case CAPSM_1000_FIRE_BULK: ;
-		capsm_fire_bulk (ssm);
+		capsm_fire_bulk (ssm, _dev);
 		break;
 	case CAPSM_1000_WRITEV:
 		sm_write_regs(ssm, _dev, capsm_1000_writev, G_N_ELEMENTS(capsm_1000_writev));
@@ -942,7 +950,7 @@ static void capsm_1000_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_d
 
 static void capsm_1001_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -958,7 +966,7 @@ static void capsm_1001_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_d
 		fpi_ssm_next_state(ssm);
 		break;
 	case CAPSM_1001_FIRE_BULK: ;
-		capsm_fire_bulk (ssm);
+		capsm_fire_bulk (ssm, _dev);
 		break;
 	case CAPSM_1001_WRITEV_1:
 		sm_write_regs(ssm, _dev, capsm_1001_writev_1, G_N_ELEMENTS(capsm_1001_writev_1));
@@ -1051,7 +1059,7 @@ enum initsm_1001_states {
 
 static void initsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -1059,22 +1067,22 @@ static void initsm_2016_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_
 		sm_write_regs(ssm, _dev, initsm_2016_writev_1, G_N_ELEMENTS(initsm_2016_writev_1));
 		break;
 	case INITSM_2016_READ_09:
-		sm_read_reg(ssm, 0x09);
+		sm_read_reg(ssm, dev, 0x09);
 		break;
 	case INITSM_2016_WRITE_09:
-		sm_write_reg(ssm, 0x09, sdev->read_reg_result & ~0x08);
+		sm_write_reg(ssm, dev, 0x09, sdev->read_reg_result & ~0x08);
 		break;
 	case INITSM_2016_READ_13:
-		sm_read_reg(ssm, 0x13);
+		sm_read_reg(ssm, dev, 0x13);
 		break;
 	case INITSM_2016_WRITE_13:
-		sm_write_reg(ssm, 0x13, sdev->read_reg_result & ~0x10);
+		sm_write_reg(ssm, dev, 0x13, sdev->read_reg_result & ~0x10);
 		break;
 	case INITSM_2016_WRITE_04:
-		sm_write_reg(ssm, 0x04, 0x00);
+		sm_write_reg(ssm, dev, 0x04, 0x00);
 		break;
 	case INITSM_2016_WRITE_05:
-		sm_write_reg(ssm, 0x05, 0x00);
+		sm_write_reg(ssm, dev, 0x05, 0x00);
 		break;
 	}
 }
@@ -1123,7 +1131,7 @@ enum loopsm_states {
 
 static void loopsm_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -1162,7 +1170,7 @@ static void loopsm_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 			fpi_ssm_next_state(ssm);
 			break;
 		default:
-			sm_await_intr(ssm);
+			sm_await_intr(ssm, dev);
 			break;
 		}
 		break;
@@ -1248,7 +1256,7 @@ static void dev_deactivate(struct fp_img_dev *dev)
 
 static void loopsm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r = fpi_ssm_get_error(ssm);
 
@@ -1267,7 +1275,7 @@ static void loopsm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 static void initsm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct sonly_dev *sdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r = fpi_ssm_get_error(ssm);
 
diff --git a/libfprint/drivers/upektc.c b/libfprint/drivers/upektc.c
index fd59c41..43facc2 100644
--- a/libfprint/drivers/upektc.c
+++ b/libfprint/drivers/upektc.c
@@ -56,9 +56,10 @@ enum activate_states {
 	ACTIVATE_NUM_STATES,
 };
 
-static void upektc_next_init_cmd(fpi_ssm *ssm)
+static void
+upektc_next_init_cmd(fpi_ssm           *ssm,
+		     struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct upektc_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	upekdev->init_idx += 1;
@@ -79,7 +80,7 @@ static void write_init_cb(struct libusb_transfer *transfer)
 		if (upekdev->setup_commands[upekdev->init_idx].response_len)
 			fpi_ssm_next_state(ssm);
 		else
-			upektc_next_init_cmd(ssm);
+			upektc_next_init_cmd(ssm, dev);
 	} else {
 		fpi_ssm_mark_failed(ssm, -EIO);
 	}
@@ -89,9 +90,10 @@ static void write_init_cb(struct libusb_transfer *transfer)
 static void read_init_data_cb(struct libusb_transfer *transfer)
 {
 	fpi_ssm *ssm = transfer->user_data;
+	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 
 	if (transfer->status == LIBUSB_TRANSFER_COMPLETED)
-		upektc_next_init_cmd(ssm);
+		upektc_next_init_cmd(ssm, dev);
 	else
 		fpi_ssm_mark_failed(ssm, -EIO);
 	g_free(transfer->buffer);
@@ -100,7 +102,7 @@ static void read_init_data_cb(struct libusb_transfer *transfer)
 
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -150,7 +152,7 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_dat
 
 static void activate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	fp_dbg("status %d", fpi_ssm_get_error(ssm));
 	fpi_imgdev_activate_complete(dev, fpi_ssm_get_error(ssm));
 
@@ -323,7 +325,7 @@ out:
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -372,7 +374,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	fp_dbg("Capture completed");
diff --git a/libfprint/drivers/upektc_img.c b/libfprint/drivers/upektc_img.c
index 750c3a2..6fd62dd 100644
--- a/libfprint/drivers/upektc_img.c
+++ b/libfprint/drivers/upektc_img.c
@@ -71,11 +71,14 @@ static void upektc_img_cmd_update_crc(unsigned char *cmd_buf, size_t size)
 	cmd_buf[size - 1] = (crc & 0xff00) >> 8;
 }
 
-static void upektc_img_submit_req(fpi_ssm *ssm,
-	const unsigned char *buf, size_t buf_size, unsigned char seq,
-	libusb_transfer_cb_fn cb)
+static void
+upektc_img_submit_req(fpi_ssm               *ssm,
+		      struct fp_img_dev     *dev,
+		      const unsigned char   *buf,
+		      size_t                 buf_size,
+		      unsigned char          seq,
+		      libusb_transfer_cb_fn  cb)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	int r;
@@ -103,10 +106,14 @@ static void upektc_img_submit_req(fpi_ssm *ssm,
 	}
 }
 
-static void upektc_img_read_data(fpi_ssm *ssm, size_t buf_size, size_t buf_offset, libusb_transfer_cb_fn cb)
+static void
+upektc_img_read_data(fpi_ssm               *ssm,
+		     struct fp_img_dev     *dev,
+		     size_t                 buf_size,
+		     size_t                 buf_offset,
+		     libusb_transfer_cb_fn  cb)
 {
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -306,35 +313,35 @@ static void capture_read_data_cb(struct libusb_transfer *transfer)
 
 static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case CAPTURE_INIT_CAPTURE:
-		upektc_img_submit_req(ssm, upek2020_init_capture, sizeof(upek2020_init_capture),
+		upektc_img_submit_req(ssm, dev, upek2020_init_capture, sizeof(upek2020_init_capture),
 			upekdev->seq, capture_reqs_cb);
 			upekdev->seq++;
 		break;
 	case CAPTURE_READ_DATA:
 	case CAPTURE_READ_DATA_TERM:
 		if (!upekdev->response_rest)
-			upektc_img_read_data(ssm, SHORT_RESPONSE_SIZE, 0, capture_read_data_cb);
+			upektc_img_read_data(ssm, dev, SHORT_RESPONSE_SIZE, 0, capture_read_data_cb);
 		else
-			upektc_img_read_data(ssm, MAX_RESPONSE_SIZE - SHORT_RESPONSE_SIZE,
+			upektc_img_read_data(ssm, dev, MAX_RESPONSE_SIZE - SHORT_RESPONSE_SIZE,
 			SHORT_RESPONSE_SIZE, capture_read_data_cb);
 		break;
 	case CAPTURE_ACK_00_28:
 	case CAPTURE_ACK_00_28_TERM:
-		upektc_img_submit_req(ssm, upek2020_ack_00_28, sizeof(upek2020_ack_00_28),
+		upektc_img_submit_req(ssm, dev, upek2020_ack_00_28, sizeof(upek2020_ack_00_28),
 			upekdev->seq, capture_reqs_cb);
 			upekdev->seq++;
 		break;
 	case CAPTURE_ACK_08:
-		upektc_img_submit_req(ssm, upek2020_ack_08, sizeof(upek2020_ack_08),
+		upektc_img_submit_req(ssm, dev, upek2020_ack_08, sizeof(upek2020_ack_08),
 			0, capture_reqs_cb);
 		break;
 	case CAPTURE_ACK_FRAME:
-		upektc_img_submit_req(ssm, upek2020_ack_frame, sizeof(upek2020_ack_frame),
+		upektc_img_submit_req(ssm, dev, upek2020_ack_frame, sizeof(upek2020_ack_frame),
 			upekdev->seq, capture_reqs_cb);
 			upekdev->seq++;
 		break;
@@ -343,7 +350,7 @@ static void capture_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void capture_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int err = fpi_ssm_get_error(ssm);
 
@@ -403,24 +410,24 @@ static void deactivate_read_data_cb(struct libusb_transfer *transfer)
 
 static void deactivate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case DEACTIVATE_DEINIT:
-		upektc_img_submit_req(ssm, upek2020_deinit, sizeof(upek2020_deinit),
+		upektc_img_submit_req(ssm, dev, upek2020_deinit, sizeof(upek2020_deinit),
 			upekdev->seq, deactivate_reqs_cb);
 		upekdev->seq++;
 		break;
 	case DEACTIVATE_READ_DEINIT_DATA:
-		upektc_img_read_data(ssm, SHORT_RESPONSE_SIZE, 0, deactivate_read_data_cb);
+		upektc_img_read_data(ssm, dev, SHORT_RESPONSE_SIZE, 0, deactivate_read_data_cb);
 		break;
 	};
 }
 
 static void deactivate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int err = fpi_ssm_get_error(ssm);
 
@@ -501,7 +508,7 @@ static void init_read_data_cb(struct libusb_transfer *transfer)
 static void activate_run_state(fpi_ssm *ssm, struct fp_dev *dev, void *user_data)
 {
 	struct libusb_transfer *transfer;
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct upektc_img_dev *upekdev = FP_INSTANCE_DATA(FP_DEV(idev));
 	int r;
 
@@ -533,19 +540,19 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *dev, void *user_data
 	}
 	break;
 	case ACTIVATE_INIT_1:
-		upektc_img_submit_req(ssm, upek2020_init_1, sizeof(upek2020_init_1),
+		upektc_img_submit_req(ssm, idev, upek2020_init_1, sizeof(upek2020_init_1),
 			0, init_reqs_cb);
 	break;
 	case ACTIVATE_INIT_2:
-		upektc_img_submit_req(ssm, upek2020_init_2, sizeof(upek2020_init_2),
+		upektc_img_submit_req(ssm, idev, upek2020_init_2, sizeof(upek2020_init_2),
 			0, init_reqs_cb);
 	break;
 	case ACTIVATE_INIT_3:
-		upektc_img_submit_req(ssm, upek2020_init_3, sizeof(upek2020_init_3),
+		upektc_img_submit_req(ssm, idev, upek2020_init_3, sizeof(upek2020_init_3),
 			0, init_reqs_cb);
 	break;
 	case ACTIVATE_INIT_4:
-		upektc_img_submit_req(ssm, upek2020_init_4, sizeof(upek2020_init_4),
+		upektc_img_submit_req(ssm, idev, upek2020_init_4, sizeof(upek2020_init_4),
 			upekdev->seq, init_reqs_cb);
 		/* Seq should be updated after 4th init */
 		upekdev->seq++;
@@ -556,14 +563,14 @@ static void activate_run_state(fpi_ssm *ssm, struct fp_dev *dev, void *user_data
 	case ACTIVATE_READ_INIT_2_RESP:
 	case ACTIVATE_READ_INIT_3_RESP:
 	case ACTIVATE_READ_INIT_4_RESP:
-		upektc_img_read_data(ssm, SHORT_RESPONSE_SIZE, 0, init_read_data_cb);
+		upektc_img_read_data(ssm, idev, SHORT_RESPONSE_SIZE, 0, init_read_data_cb);
 	break;
 	}
 }
 
 static void activate_sm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	int err = fpi_ssm_get_error(ssm);
 
 	fpi_ssm_free(ssm);
diff --git a/libfprint/drivers/upekts.c b/libfprint/drivers/upekts.c
index db3e867..98448e1 100644
--- a/libfprint/drivers/upekts.c
+++ b/libfprint/drivers/upekts.c
@@ -880,7 +880,7 @@ enum enroll_start_sm_states {
 /* Called when the device initialization state machine completes */
 static void enroll_start_sm_cb_initsm(fpi_ssm *initsm, struct fp_dev *_dev, void *user_data)
 {
-	fpi_ssm *enroll_start_ssm = fpi_ssm_get_user_data(initsm);
+	fpi_ssm *enroll_start_ssm = user_data;
 	int error = fpi_ssm_get_error(initsm);
 
 	fpi_ssm_free(initsm);
@@ -1185,7 +1185,7 @@ enum {
 /* Called when the device initialization state machine completes */
 static void verify_start_sm_cb_initsm(fpi_ssm *initsm, struct fp_dev *_dev, void *user_data)
 {
-	fpi_ssm *verify_start_ssm = fpi_ssm_get_user_data(initsm);
+	fpi_ssm *verify_start_ssm = user_data;
 	int err;
 
 	err = fpi_ssm_get_error(initsm);
diff --git a/libfprint/drivers/uru4000.c b/libfprint/drivers/uru4000.c
index d3b577d..c26235b 100644
--- a/libfprint/drivers/uru4000.c
+++ b/libfprint/drivers/uru4000.c
@@ -354,9 +354,10 @@ static void challenge_cb(struct fp_img_dev *dev, int status,
  * authentication scheme, where the device challenges the authenticity of the
  * driver.
  */
-static void sm_do_challenge_response(fpi_ssm *ssm)
+static void
+sm_do_challenge_response(fpi_ssm           *ssm,
+			 struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	int r;
 
 	G_DEBUG_HERE();
@@ -516,19 +517,25 @@ static void sm_write_reg_cb(struct fp_img_dev *dev, int result, void *user_data)
 		fpi_ssm_next_state(ssm);
 }
 
-static void sm_write_regs(fpi_ssm *ssm, uint16_t first_reg, uint16_t num_regs,
-	void *data)
+static void
+sm_write_regs(fpi_ssm           *ssm,
+	      struct fp_img_dev *dev,
+	      uint16_t           first_reg,
+	      uint16_t           num_regs,
+	      void              *data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	int r = write_regs(dev, first_reg, num_regs, data, sm_write_reg_cb, ssm);
 	if (r < 0)
 		fpi_ssm_mark_failed(ssm, r);
 }
 
-static void sm_write_reg(fpi_ssm *ssm, uint16_t reg,
-	unsigned char value)
+static void
+sm_write_reg(fpi_ssm           *ssm,
+	     struct fp_img_dev *dev,
+	     uint16_t           reg,
+	     unsigned char      value)
 {
-	sm_write_regs(ssm, reg, 1, &value);
+	sm_write_regs(ssm, dev, reg, 1, &value);
 }
 
 static void sm_read_reg_cb(struct fp_img_dev *dev, int result,
@@ -546,9 +553,12 @@ static void sm_read_reg_cb(struct fp_img_dev *dev, int result,
 	}
 }
 
-static void sm_read_regs(fpi_ssm *ssm, uint16_t reg, uint16_t num_regs)
+static void
+sm_read_regs(fpi_ssm           *ssm,
+	     struct fp_img_dev *dev,
+	     uint16_t           reg,
+	     uint16_t           num_regs)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -563,15 +573,21 @@ static void sm_read_regs(fpi_ssm *ssm, uint16_t reg, uint16_t num_regs)
 		fpi_ssm_mark_failed(ssm, r);
 }
 
-static void sm_read_reg(fpi_ssm *ssm, uint16_t reg)
+static void
+sm_read_reg(fpi_ssm           *ssm,
+	    struct fp_img_dev *dev,
+	    uint16_t           reg)
 {
-	sm_read_regs(ssm, reg, 1);
+	sm_read_regs(ssm, dev, reg, 1);
 }
 
-static void sm_set_hwstat(fpi_ssm *ssm, unsigned char value)
+static void
+sm_set_hwstat(fpi_ssm           *ssm,
+	      struct fp_img_dev *dev,
+	      unsigned char      value)
 {
 	fp_dbg("set %02x", value);
-	sm_write_reg(ssm, REG_HWSTAT, value);
+	sm_write_reg(ssm, dev, REG_HWSTAT, value);
 }
 
 /***** IMAGING LOOP *****/
@@ -689,7 +705,7 @@ static int calc_dev2(struct uru4k_image *img)
 
 static void imaging_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
 	struct uru4k_image *img = urudev->img_data;
 	struct fp_img *fpimg;
@@ -734,10 +750,10 @@ static void imaging_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 		buf[2] = urudev->img_enc_seed >> 8;
 		buf[3] = urudev->img_enc_seed >> 16;
 		buf[4] = urudev->img_enc_seed >> 24;
-		sm_write_regs(ssm, REG_SCRAMBLE_DATA_INDEX, 5, buf);
+		sm_write_regs(ssm, dev, REG_SCRAMBLE_DATA_INDEX, 5, buf);
 		break;
 	case IMAGING_READ_KEY:
-		sm_read_regs(ssm, REG_SCRAMBLE_DATA_KEY, 4);
+		sm_read_regs(ssm, dev, REG_SCRAMBLE_DATA_KEY, 4);
 		break;
 	case IMAGING_DECODE:
 		key  = urudev->last_reg_rd[0];
@@ -812,7 +828,7 @@ static void imaging_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 
 static void imaging_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r = fpi_ssm_get_error(ssm);
 	fpi_ssm_free(ssm);
@@ -876,16 +892,16 @@ static void rebootpwr_pause_cb(void *data)
 
 static void rebootpwr_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case REBOOTPWR_SET_HWSTAT:
 		urudev->rebootpwr_ctr = 100;
-		sm_set_hwstat(ssm, urudev->last_hwstat & 0xf);
+		sm_set_hwstat(ssm, dev, urudev->last_hwstat & 0xf);
 		break;
 	case REBOOTPWR_GET_HWSTAT:
-		sm_read_reg(ssm, REG_HWSTAT);
+		sm_read_reg(ssm, dev, REG_HWSTAT);
 		break;
 	case REBOOTPWR_CHECK_HWSTAT:
 		urudev->last_hwstat = urudev->last_reg_rd[0];
@@ -955,7 +971,7 @@ static void powerup_pause_cb(void *data)
 
 static void powerup_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -965,10 +981,10 @@ static void powerup_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 		fpi_ssm_next_state(ssm);
 		break;
 	case POWERUP_SET_HWSTAT:
-		sm_set_hwstat(ssm, urudev->powerup_hwstat);
+		sm_set_hwstat(ssm, dev, urudev->powerup_hwstat);
 		break;
 	case POWERUP_GET_HWSTAT:
-		sm_read_reg(ssm, REG_HWSTAT);
+		sm_read_reg(ssm, dev, REG_HWSTAT);
 		break;
 	case POWERUP_CHECK_HWSTAT:
 		urudev->last_hwstat = urudev->last_reg_rd[0];
@@ -982,7 +998,7 @@ static void powerup_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 			fpi_ssm_mark_failed(ssm, -ETIME);
 		break;
 	case POWERUP_CHALLENGE_RESPONSE:
-		sm_do_challenge_response(ssm);
+		sm_do_challenge_response(ssm, dev);
 		break;
 	case POWERUP_CHALLENGE_RESPONSE_SUCCESS:
 		fpi_ssm_jump_to_state(ssm, POWERUP_SET_HWSTAT);
@@ -1060,12 +1076,12 @@ static void init_scanpwr_timeout(void *user_data)
 
 static void init_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case INIT_GET_HWSTAT:
-		sm_read_reg(ssm, REG_HWSTAT);
+		sm_read_reg(ssm, dev, REG_HWSTAT);
 		break;
 	case INIT_CHECK_HWSTAT_REBOOT:
 		urudev->last_hwstat = urudev->last_reg_rd[0];
@@ -1081,7 +1097,7 @@ static void init_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		break;
 	case INIT_CHECK_HWSTAT_POWERDOWN:
 		if ((urudev->last_hwstat & 0x80) == 0)
-			sm_set_hwstat(ssm, urudev->last_hwstat | 0x80);
+			sm_set_hwstat(ssm, dev, urudev->last_hwstat | 0x80);
 		else
 			fpi_ssm_next_state(ssm);
 		break;
@@ -1123,7 +1139,7 @@ static void init_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		fpi_ssm_next_state(ssm);
 		break;
 	case INIT_GET_VERSION:
-		sm_read_regs(ssm, REG_DEVICE_INFO, 16);
+		sm_read_regs(ssm, dev, REG_DEVICE_INFO, 16);
 		break;
 	case INIT_REPORT_VERSION:
 		/* Likely hardware revision, and firmware version.
@@ -1138,7 +1154,7 @@ static void init_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 static void activate_initsm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	int r = fpi_ssm_get_error(ssm);
 	fpi_ssm_free(ssm);
 
diff --git a/libfprint/drivers/vcom5s.c b/libfprint/drivers/vcom5s.c
index 97ba94d..0ac931b 100644
--- a/libfprint/drivers/vcom5s.c
+++ b/libfprint/drivers/vcom5s.c
@@ -85,10 +85,12 @@ static void sm_write_reg_cb(struct libusb_transfer *transfer)
 	libusb_free_transfer(transfer);
 }
 
-static void sm_write_reg(fpi_ssm *ssm, unsigned char reg,
-	unsigned char value)
+static void
+sm_write_reg(fpi_ssm           *ssm,
+	     struct fp_img_dev *dev,
+	     unsigned char      reg,
+	     unsigned char      value)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	unsigned char *data;
 	int r;
@@ -124,10 +126,12 @@ static void sm_exec_cmd_cb(struct libusb_transfer *transfer)
 	libusb_free_transfer(transfer);
 }
 
-static void sm_exec_cmd(fpi_ssm *ssm, unsigned char cmd,
-	unsigned char param)
+static void
+sm_exec_cmd(fpi_ssm           *ssm,
+	    struct fp_img_dev *dev,
+	    unsigned char      cmd,
+	    unsigned char      param)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
 	unsigned char *data;
 	int r;
@@ -187,7 +191,7 @@ static gboolean finger_is_present(unsigned char *data)
 
 /***** IMAGE ACQUISITION *****/
 
-static void capture_iterate(fpi_ssm *ssm);
+static void capture_iterate(fpi_ssm *ssm, struct fp_img_dev *dev);
 
 static void capture_cb(struct libusb_transfer *transfer)
 {
@@ -211,16 +215,17 @@ static void capture_cb(struct libusb_transfer *transfer)
 		fpi_imgdev_image_captured(dev, img);
 		fpi_ssm_next_state(ssm);
 	} else {
-		capture_iterate(ssm);
+		capture_iterate(ssm, dev);
 	}
 
 out:
 	libusb_free_transfer(transfer);
 }
 
-static void capture_iterate(fpi_ssm *ssm)
+static void
+capture_iterate(fpi_ssm           *ssm,
+		struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct v5s_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int iteration = vdev->capture_iteration;
 	struct libusb_transfer *transfer = libusb_alloc_transfer(0);
@@ -243,15 +248,16 @@ static void capture_iterate(fpi_ssm *ssm)
 }
 
 
-static void sm_do_capture(fpi_ssm *ssm)
+static void
+sm_do_capture(fpi_ssm           *ssm,
+	      struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct v5s_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
 	vdev->capture_img = fpi_img_new_for_imgdev(dev);
 	vdev->capture_iteration = 0;
-	capture_iterate(ssm);
+	capture_iterate(ssm, dev);
 }
 
 /***** CAPTURE LOOP *****/
@@ -267,25 +273,25 @@ enum loop_states {
 
 static void loop_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct v5s_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case LOOP_SET_CONTRAST:
-		sm_write_reg(ssm, REG_CONTRAST, 0x01);
+		sm_write_reg(ssm, dev, REG_CONTRAST, 0x01);
 		break;
 	case LOOP_SET_GAIN:
-		sm_write_reg(ssm, REG_GAIN, 0x29);
+		sm_write_reg(ssm, dev, REG_GAIN, 0x29);
 		break;
 	case LOOP_CMD_SCAN:
 		if (vdev->deactivating) {
 			fp_dbg("deactivating, marking completed");
 			fpi_ssm_mark_completed(ssm);
 		} else
-			sm_exec_cmd(ssm, CMD_SCAN, 0x00);
+			sm_exec_cmd(ssm, dev, CMD_SCAN, 0x00);
 		break;
 	case LOOP_CAPTURE:
-		sm_do_capture(ssm);
+		sm_do_capture(ssm, dev);
 		break;
 	case LOOP_CAPTURE_DONE:
 		fpi_ssm_jump_to_state(ssm, LOOP_CMD_SCAN);
@@ -295,7 +301,7 @@ static void loop_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 static void loopsm_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct v5s_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r = fpi_ssm_get_error(ssm);
 
diff --git a/libfprint/drivers/vfs0050.c b/libfprint/drivers/vfs0050.c
index fdc50e5..5a1bc43 100644
--- a/libfprint/drivers/vfs0050.c
+++ b/libfprint/drivers/vfs0050.c
@@ -51,11 +51,14 @@ static void async_write_callback(struct libusb_transfer *transfer)
 }
 
 /* Send data to EP1, the only out endpoint */
-static void async_write(fpi_ssm *ssm, void *data, int len)
+static void
+async_write(fpi_ssm           *ssm,
+	    struct fp_img_dev *dev,
+	    void              *data,
+	    int                len)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
-	struct libusb_device_handle *usb_dev = fpi_dev_get_usb_dev(FP_DEV(idev));
-	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(idev));
+	struct libusb_device_handle *usb_dev = fpi_dev_get_usb_dev(FP_DEV(dev));
+	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	vdev->transfer = libusb_alloc_transfer(0);
 	vdev->transfer->flags |= LIBUSB_TRANSFER_FREE_TRANSFER;
@@ -93,7 +96,12 @@ static void async_read_callback(struct libusb_transfer *transfer)
 }
 
 /* Receive data from the given ep and compare with expected */
-static void async_read(fpi_ssm *ssm, int ep, void *data, int len)
+static void
+async_read(fpi_ssm           *ssm,
+	   struct fp_img_dev *dev,
+	   int                ep,
+	   void              *data,
+	   int                len)
 {
 	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
 	struct libusb_device_handle *usb_dev = fpi_dev_get_usb_dev(FP_DEV(idev));
@@ -279,20 +287,21 @@ static void submit_image(struct fp_img_dev *idev)
 /* Proto functions */
 
 /* SSM loop for clear_ep2 */
-static void clear_ep2_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
+static void
+clear_ep2_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 
 	short result;
 	char command04 = 0x04;
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case SUBSM1_COMMAND_04:
-		async_write(ssm, &command04, sizeof(command04));
+		async_write(ssm, idev, &command04, sizeof(command04));
 		break;
 
 	case SUBSM1_RETURN_CODE:
-		async_read(ssm, 1, &result, sizeof(result));
+		async_read(ssm, idev, 1, &result, sizeof(result));
 		break;
 
 	case SUBSM1_ABORT_2:
@@ -307,10 +316,10 @@ static void clear_ep2_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 }
 
 /* Send command to clear EP2 */
-static void clear_ep2(fpi_ssm *ssm)
+static void
+clear_ep2(fpi_ssm           *ssm,
+	  struct fp_img_dev *idev)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
-
 	fpi_ssm *subsm =
 	    fpi_ssm_new(FP_DEV(idev), clear_ep2_ssm, SUBSM1_STATES, idev);
 	fpi_ssm_start_subsm(ssm, subsm);
@@ -318,7 +327,7 @@ static void clear_ep2(fpi_ssm *ssm)
 
 static void send_control_packet_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	short result;
@@ -326,11 +335,11 @@ static void send_control_packet_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *use
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
 	case SUBSM2_SEND_CONTROL:
-		async_write(ssm, vdev->control_packet, VFS_CONTROL_PACKET_SIZE);
+		async_write(ssm, idev, vdev->control_packet, VFS_CONTROL_PACKET_SIZE);
 		break;
 
 	case SUBSM2_RETURN_CODE:
-		async_read(ssm, 1, &result, sizeof(result));
+		async_read(ssm, idev, 1, &result, sizeof(result));
 		break;
 
 	case SUBSM2_SEND_COMMIT:
@@ -341,19 +350,19 @@ static void send_control_packet_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *use
 			break;
 		}
 		/* commit_out in Windows differs in each commit, but I send the same each time */
-		async_write(ssm, commit_out, sizeof(commit_out));
+		async_write(ssm, idev, commit_out, sizeof(commit_out));
 		break;
 
 	case SUBSM2_COMMIT_RESPONSE:
 		commit_result = g_malloc(VFS_COMMIT_RESPONSE_SIZE);
-		async_read(ssm, 1, commit_result, VFS_COMMIT_RESPONSE_SIZE);
+		async_read(ssm, idev, 1, commit_result, VFS_COMMIT_RESPONSE_SIZE);
 		break;
 
 	case SUBSM2_READ_EMPTY_INTERRUPT:
 		/* I don't know how to check result, it could be different */
 		g_free(commit_result);
 
-		async_read(ssm, 3, vdev->interrupt, VFS_INTERRUPT_SIZE);
+		async_read(ssm, idev, 3, vdev->interrupt, VFS_INTERRUPT_SIZE);
 		break;
 
 	case SUBSM2_ABORT_3:
@@ -371,7 +380,7 @@ static void send_control_packet_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *use
 	case SUBSM2_CLEAR_EP2:
 		/* After turn_on Windows doesn't clear EP2 */
 		if (vdev->control_packet != turn_on)
-			clear_ep2(ssm);
+			clear_ep2(ssm, idev);
 		else
 			fpi_ssm_next_state(ssm);
 		break;
@@ -384,10 +393,10 @@ static void send_control_packet_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *use
 }
 
 /* Send device state control packet */
-static void send_control_packet(fpi_ssm *ssm)
+static void
+send_control_packet(fpi_ssm           *ssm,
+		    struct fp_img_dev *idev)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
-
 	fpi_ssm *subsm =
 	    fpi_ssm_new(FP_DEV(idev), send_control_packet_ssm, SUBSM2_STATES, idev);
 	fpi_ssm_start_subsm(ssm, subsm);
@@ -518,7 +527,7 @@ static void scan_completed(void *data)
 /* Main SSM loop */
 static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct libusb_device_handle *usb_dev = fpi_dev_get_usb_dev(FP_DEV(idev));
 	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(idev));
 
@@ -536,14 +545,14 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		break;
 
 	case SSM_CLEAR_EP2:
-		clear_ep2(ssm);
+		clear_ep2(ssm, idev);
 		break;
 
 	case SSM_TURN_OFF:
 		/* Set control_packet argument */
 		vdev->control_packet = turn_off;
 
-		send_control_packet(ssm);
+		send_control_packet(ssm, idev);
 		break;
 
 	case SSM_TURN_ON:
@@ -560,7 +569,7 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		/* Set control_packet argument */
 		vdev->control_packet = turn_on;
 
-		send_control_packet(ssm);
+		send_control_packet(ssm, idev);
 		break;
 
 	case SSM_ASK_INTERRUPT:
@@ -651,7 +660,7 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		/* Set control_packet argument */
 		vdev->control_packet = next_receive_1;
 
-		send_control_packet(ssm);
+		send_control_packet(ssm, idev);
 		break;
 
 	case SSM_WAIT_ANOTHER_SCAN:
@@ -671,7 +680,7 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 /* Callback for dev_activate ssm */
 static void dev_activate_callback(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *idev = user_data;
 	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(idev));
 
 	vdev->ssm_active = 0;
@@ -713,7 +722,7 @@ static void dev_deactivate(struct fp_img_dev *idev)
 static void dev_open_callback(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
 	/* Notify open complete */
-	fpi_imgdev_open_complete(fpi_ssm_get_user_data(ssm), 0);
+	fpi_imgdev_open_complete(user_data, 0);
 	fpi_ssm_free(ssm);
 }
 
diff --git a/libfprint/drivers/vfs101.c b/libfprint/drivers/vfs101.c
index 674855e..86a2fa1 100644
--- a/libfprint/drivers/vfs101.c
+++ b/libfprint/drivers/vfs101.c
@@ -242,9 +242,10 @@ out:
 }
 
 /* Submit asynchronous send */
-static void async_send(fpi_ssm *ssm)
+static void
+async_send(fpi_ssm           *ssm,
+	   struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -329,9 +330,10 @@ out:
 }
 
 /* Submit asynchronous recv */
-static void async_recv(fpi_ssm *ssm)
+static void
+async_recv(fpi_ssm           *ssm,
+	   struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int r;
 
@@ -362,7 +364,7 @@ static void async_recv(fpi_ssm *ssm)
 	}
 }
 
-static void async_load(fpi_ssm *ssm);
+static void async_load(fpi_ssm *ssm, struct fp_img_dev *dev);
 
 /* Callback of asynchronous load */
 static void async_load_cb(struct libusb_transfer *transfer)
@@ -411,7 +413,7 @@ static void async_load_cb(struct libusb_transfer *transfer)
 		}
 		else
 			/* Image load not completed, submit another asynchronous load */
-			async_load(ssm);
+			async_load(ssm, dev);
 	}
 	else
 	{
@@ -430,9 +432,10 @@ out:
 }
 
 /* Submit asynchronous load */
-static void async_load(fpi_ssm *ssm)
+static void
+async_load(fpi_ssm           *ssm,
+	   struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	unsigned char *buffer;
 	int r;
@@ -481,9 +484,11 @@ static void async_sleep_cb(void *data)
 }
 
 /* Submit asynchronous sleep */
-static void async_sleep(unsigned int msec, fpi_ssm *ssm)
+static void
+async_sleep(unsigned int       msec,
+	    fpi_ssm           *ssm,
+	    struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	/* Add timeout */
@@ -513,20 +518,23 @@ static void m_swap_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 	{
 	case M_SWAP_SEND:
 		/* Send data */
-		async_send(ssm);
+		async_send(ssm, user_data);
 		break;
 
 	case M_SWAP_RECV:
 		/* Recv response */
-		async_recv(ssm);
+		async_recv(ssm, user_data);
 		break;
 	}
 }
 
 /* Start swap sequential state machine */
-static void m_swap(fpi_ssm *ssm, unsigned char *data, size_t length)
+static void
+m_swap(fpi_ssm           *ssm,
+       struct fp_img_dev *dev,
+       unsigned char     *data,
+       size_t             length)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	fpi_ssm *subsm;
 
@@ -541,7 +549,11 @@ static void m_swap(fpi_ssm *ssm, unsigned char *data, size_t length)
 }
 
 /* Retrieve fingerprint image */
-static void vfs_get_print(fpi_ssm *ssm, unsigned int param, int type)
+static void
+vfs_get_print(fpi_ssm           *ssm,
+	      struct fp_img_dev *dev,
+	      unsigned int       param,
+	      int                type)
 {
 	unsigned char data[2][0x0e] = {
 		{	0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00,
@@ -557,11 +569,15 @@ static void vfs_get_print(fpi_ssm *ssm, unsigned int param, int type)
 	data[type][7] = byte(1, param);
 
 	/* Run swap sequential state machine */
-	m_swap(ssm, data[type], 0x0e);
+	m_swap(ssm, dev, data[type], 0x0e);
 }
 
 /* Set a parameter value on the device */
-static void vfs_set_param(fpi_ssm *ssm, unsigned int param, unsigned int value)
+static void
+vfs_set_param(fpi_ssm           *ssm,
+	      struct fp_img_dev *dev,
+	      unsigned int       param,
+	      unsigned int       value)
 {
 	unsigned char data[0x0a] = { 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
@@ -574,22 +590,29 @@ static void vfs_set_param(fpi_ssm *ssm, unsigned int param, unsigned int value)
 	data[9] = byte(1, value);
 
 	/* Run swap sequential state machine */
-	m_swap(ssm, data, 0x0a);
+	m_swap(ssm, dev, data, 0x0a);
 }
 
 /* Abort previous print */
-static void vfs_abort_print(fpi_ssm *ssm)
+static void
+vfs_abort_print(fpi_ssm           *ssm,
+		struct fp_img_dev *dev)
 {
 	unsigned char data[0x06] = { 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00 };
 
 	G_DEBUG_HERE();
 
 	/* Run swap sequential state machine */
-	m_swap (ssm, data, 0x06);
+	m_swap (ssm, dev, data, 0x06);
 }
 
 /* Poke a value on a region */
-static void vfs_poke(fpi_ssm *ssm, unsigned int addr, unsigned int value, unsigned int size)
+static void
+vfs_poke(fpi_ssm           *ssm,
+	 struct fp_img_dev *dev,
+	 unsigned int       addr,
+	 unsigned int       value,
+	 unsigned int       size)
 {
 	unsigned char data[0x0f] = { 0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
@@ -607,24 +630,27 @@ static void vfs_poke(fpi_ssm *ssm, unsigned int addr, unsigned int value, unsign
 	data[14] = byte(0, size);
 
 	/* Run swap sequential state machine */
-	m_swap(ssm, data, 0x0f);
+	m_swap(ssm, dev, data, 0x0f);
 }
 
 /* Get current finger state */
-static void vfs_get_finger_state(fpi_ssm *ssm)
+static void
+vfs_get_finger_state(fpi_ssm           *ssm,
+		     struct fp_img_dev *dev)
 {
 	unsigned char data[0x06] = { 0x00, 0x00, 0x00, 0x00, 0x16, 0x00 };
 
 	G_DEBUG_HERE();
 
 	/* Run swap sequential state machine */
-	m_swap (ssm, data, 0x06);
+	m_swap (ssm, dev, data, 0x06);
 }
 
 /* Load raw image from reader */
-static void vfs_img_load(fpi_ssm *ssm)
+static void
+vfs_img_load(fpi_ssm           *ssm,
+	     struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	G_DEBUG_HERE();
@@ -637,7 +663,7 @@ static void vfs_img_load(fpi_ssm *ssm)
 	vdev->height = -1;
 
 	/* Asynchronous load */
-	async_load(ssm);
+	async_load(ssm, dev);
 }
 
 /* Check if action is completed */
@@ -753,9 +779,10 @@ static void img_copy(struct vfs101_dev *vdev, struct fp_img *img)
 }
 
 /* Extract fingerpint image from raw data */
-static void img_extract(fpi_ssm *ssm)
+static void
+img_extract(fpi_ssm           *ssm,
+	    struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	struct fp_img *img;
 
@@ -913,7 +940,7 @@ enum
 /* Exec loop sequential state machine */
 static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	/* Check action state */
@@ -928,17 +955,17 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 	{
 	case M_LOOP_0_GET_PRINT:
 		/* Send get print command to the reader */
-		vfs_get_print(ssm, VFS_BUFFER_HEIGHT, 1);
+		vfs_get_print(ssm, dev, VFS_BUFFER_HEIGHT, 1);
 		break;
 
 	case M_LOOP_0_SLEEP:
 		/* Wait fingerprint scanning */
-		async_sleep(50, ssm);
+		async_sleep(50, ssm, dev);
 		break;
 
 	case M_LOOP_0_GET_STATE:
 		/* Get finger state */
-		vfs_get_finger_state(ssm);
+		vfs_get_finger_state(ssm, dev);
 		break;
 
 	case M_LOOP_0_LOAD_IMAGE:
@@ -953,7 +980,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		case VFS_FINGER_PRESENT:
 			/* Load image from reader */
 			vdev->ignore_error = TRUE;
-			vfs_img_load(ssm);
+			vfs_img_load(ssm, dev);
 			break;
 
 		default:
@@ -969,10 +996,10 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		/* Check if image is loaded */
 		if (vdev->height > 0)
 			/* Fingerprint is loaded, extract image from raw data */
-			img_extract(ssm);
+			img_extract(ssm, dev);
 
 		/* Wait handling image */
-		async_sleep(10, ssm);
+		async_sleep(10, ssm, dev);
 		break;
 
 	case M_LOOP_0_CHECK_ACTION:
@@ -992,7 +1019,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_LOOP_1_GET_STATE:
 		/* Get finger state */
-		vfs_get_finger_state(ssm);
+		vfs_get_finger_state(ssm, dev);
 		break;
 
 	case M_LOOP_1_CHECK_STATE:
@@ -1010,7 +1037,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 				/* Wait removing finger */
 				vdev->counter++;
-				async_sleep(250, ssm);
+				async_sleep(250, ssm, dev);
 			}
 			else
 			{
@@ -1048,13 +1075,13 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_LOOP_1_GET_PRINT:
 		/* Send get print command to the reader */
-		vfs_get_print(ssm, VFS_BUFFER_HEIGHT, 1);
+		vfs_get_print(ssm, dev, VFS_BUFFER_HEIGHT, 1);
 		break;
 
 	case M_LOOP_1_LOAD_IMAGE:
 		/* Load image */
 		vdev->ignore_error = TRUE;
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_LOOP_1_LOOP:
@@ -1064,29 +1091,29 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_LOOP_1_SLEEP:
 		/* Wait fingerprint scanning */
-		async_sleep(10, ssm);
+		async_sleep(10, ssm, dev);
 		break;
 
 	case M_LOOP_2_ABORT_PRINT:
 		/* Abort print command */
-		vfs_abort_print(ssm);
+		vfs_abort_print(ssm, dev);
 		break;
 
 	case M_LOOP_2_LOAD_IMAGE:
 		/* Load abort image */
 		vdev->ignore_error = TRUE;
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_LOOP_3_GET_PRINT:
 		/* Get empty image */
-		vfs_get_print(ssm, 0x000a, 0);
+		vfs_get_print(ssm, dev, 0x000a, 0);
 		break;
 
 	case M_LOOP_3_LOAD_IMAGE:
 		/* Load abort image */
 		vdev->ignore_error = TRUE;
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_LOOP_3_CHECK_IMAGE:
@@ -1100,7 +1127,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		{
 			/* Wait aborting */
 			vdev->counter++;
-			async_sleep(100, ssm);
+			async_sleep(100, ssm, dev);
 		}
 		else
 		{
@@ -1177,7 +1204,7 @@ enum
 /* Exec init sequential state machine */
 static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	/* Check action state */
@@ -1193,29 +1220,29 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 	case M_INIT_0_RECV_DIRTY:
 		/* Recv eventualy dirty data */
 		vdev->ignore_error = TRUE;
-		async_recv(ssm);
+		async_recv(ssm, dev);
 		break;
 
 	case M_INIT_0_ABORT_PRINT:
 		/* Abort print command */
-		vfs_abort_print(ssm);
+		vfs_abort_print(ssm, dev);
 		break;
 
 	case M_INIT_0_LOAD_IMAGE:
 		/* Load abort image */
 		vdev->ignore_error = TRUE;
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_INIT_1_GET_PRINT:
 		/* Get empty image */
-		vfs_get_print(ssm, 0x000a, 0);
+		vfs_get_print(ssm, dev, 0x000a, 0);
 		break;
 
 	case M_INIT_1_LOAD_IMAGE:
 		/* Load abort image */
 		vdev->ignore_error = TRUE;
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_INIT_1_CHECK_IMAGE:
@@ -1229,7 +1256,7 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		{
 			/* Wait aborting */
 			vdev->counter++;
-			async_sleep(100, ssm);
+			async_sleep(100, ssm, dev);
 		}
 		else
 		{
@@ -1247,7 +1274,7 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_INIT_2_GET_STATE:
 		/* Get finger state */
-		vfs_get_finger_state(ssm);
+		vfs_get_finger_state(ssm, dev);
 		break;
 
 	case M_INIT_2_CHECK_STATE:
@@ -1265,7 +1292,7 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 				/* Wait removing finger */
 				vdev->counter++;
-				async_sleep(250, ssm);
+				async_sleep(250, ssm, dev);
 			}
 			else
 			{
@@ -1292,13 +1319,13 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_INIT_2_GET_PRINT:
 		/* Send get print command to the reader */
-		vfs_get_print(ssm, VFS_BUFFER_HEIGHT, 1);
+		vfs_get_print(ssm, dev, VFS_BUFFER_HEIGHT, 1);
 		break;
 
 	case M_INIT_2_LOAD_IMAGE:
 		/* Load unexpected image */
 		vdev->ignore_error = TRUE;
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_INIT_2_LOOP:
@@ -1308,68 +1335,68 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_INIT_3_SET_000E:
 		/* Set param 0x000e, required for take image */
-		vfs_set_param(ssm, VFS_PAR_000E, VFS_VAL_000E);
+		vfs_set_param(ssm, dev, VFS_PAR_000E, VFS_VAL_000E);
 		break;
 
 	case M_INIT_3_SET_0011:
 		/* Set param 0x0011, required for take image */
-		vfs_set_param(ssm, VFS_PAR_0011, VFS_VAL_0011);
+		vfs_set_param(ssm, dev, VFS_PAR_0011, VFS_VAL_0011);
 		break;
 
 	case M_INIT_3_SET_0076:
 		/* Set param 0x0076, required for use info line */
-		vfs_set_param(ssm, VFS_PAR_0076, VFS_VAL_0076);
+		vfs_set_param(ssm, dev, VFS_PAR_0076, VFS_VAL_0076);
 		break;
 
 	case M_INIT_3_SET_0078:
 		/* Set param 0x0078, required for use info line */
-		vfs_set_param(ssm, VFS_PAR_0078, VFS_VAL_0078);
+		vfs_set_param(ssm, dev, VFS_PAR_0078, VFS_VAL_0078);
 		break;
 
 	case M_INIT_3_SET_THRESHOLD:
 		/* Set threshold */
-		vfs_set_param(ssm, VFS_PAR_THRESHOLD, VFS_VAL_THRESHOLD);
+		vfs_set_param(ssm, dev, VFS_PAR_THRESHOLD, VFS_VAL_THRESHOLD);
 		break;
 
 	case M_INIT_3_SET_STATE3_COUNT:
 		/* Set state 3 count */
-		vfs_set_param(ssm, VFS_PAR_STATE_3, VFS_VAL_STATE_3);
+		vfs_set_param(ssm, dev, VFS_PAR_STATE_3, VFS_VAL_STATE_3);
 		break;
 
 	case M_INIT_3_SET_STATE5_COUNT:
 		/* Set state 5 count */
-		vfs_set_param(ssm, VFS_PAR_STATE_5, VFS_VAL_STATE_5);
+		vfs_set_param(ssm, dev, VFS_PAR_STATE_5, VFS_VAL_STATE_5);
 		break;
 
 	case M_INIT_3_SET_INFO_CONTRAST:
 		/* Set info line contrast */
-		vfs_set_param(ssm, VFS_PAR_INFO_CONTRAST, 10);
+		vfs_set_param(ssm, dev, VFS_PAR_INFO_CONTRAST, 10);
 		break;
 
 	case M_INIT_3_SET_INFO_RATE:
 		/* Set info line rate */
-		vfs_set_param(ssm, VFS_PAR_INFO_RATE, 32);
+		vfs_set_param(ssm, dev, VFS_PAR_INFO_RATE, 32);
 		break;
 
 	case M_INIT_4_SET_EXPOSURE:
 		/* Set exposure level of reader */
-		vfs_poke(ssm, VFS_REG_IMG_EXPOSURE, 0x4000, 0x02);
+		vfs_poke(ssm, dev, VFS_REG_IMG_EXPOSURE, 0x4000, 0x02);
 		vdev->counter = 1;
 		break;
 
 	case M_INIT_4_SET_CONTRAST:
 		/* Set contrast level of reader */
-		vfs_poke(ssm, VFS_REG_IMG_CONTRAST, vdev->contrast, 0x01);
+		vfs_poke(ssm, dev, VFS_REG_IMG_CONTRAST, vdev->contrast, 0x01);
 		break;
 
 	case M_INIT_4_GET_PRINT:
 		/* Get empty image */
-		vfs_get_print(ssm, 0x000a, 0);
+		vfs_get_print(ssm, dev, 0x000a, 0);
 		break;
 
 	case M_INIT_4_LOAD_IMAGE:
 		/* Load empty image */
-		vfs_img_load(ssm);
+		vfs_img_load(ssm, dev);
 		break;
 
 	case M_INIT_4_CHECK_CONTRAST:
@@ -1395,22 +1422,22 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_INIT_5_SET_EXPOSURE:
 		/* Set exposure level of reader */
-		vfs_poke(ssm, VFS_REG_IMG_EXPOSURE, VFS_VAL_IMG_EXPOSURE, 0x02);
+		vfs_poke(ssm, dev, VFS_REG_IMG_EXPOSURE, VFS_VAL_IMG_EXPOSURE, 0x02);
 		break;
 
 	case M_INIT_5_SET_CONTRAST:
 		/* Set contrast level of reader */
-		vfs_poke(ssm, VFS_REG_IMG_CONTRAST, vdev->contrast, 0x01);
+		vfs_poke(ssm, dev, VFS_REG_IMG_CONTRAST, vdev->contrast, 0x01);
 		break;
 
 	case M_INIT_5_SET_INFO_CONTRAST:
 		/* Set info line contrast */
-		vfs_set_param(ssm, VFS_PAR_INFO_CONTRAST, vdev->contrast);
+		vfs_set_param(ssm, dev, VFS_PAR_INFO_CONTRAST, vdev->contrast);
 		break;
 
 	case M_INIT_5_SET_INFO_RATE:
 		/* Set info line rate */
-		vfs_set_param(ssm, VFS_PAR_INFO_RATE, VFS_VAL_INFO_RATE);
+		vfs_set_param(ssm, dev, VFS_PAR_INFO_RATE, VFS_VAL_INFO_RATE);
 		break;
 	}
 }
@@ -1418,7 +1445,7 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 /* Complete init sequential state machine */
 static void m_init_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	fpi_ssm *ssm_loop;
 
diff --git a/libfprint/drivers/vfs301.c b/libfprint/drivers/vfs301.c
index 72f8f53..a8085b4 100644
--- a/libfprint/drivers/vfs301.c
+++ b/libfprint/drivers/vfs301.c
@@ -35,9 +35,11 @@ static void async_sleep_cb(void *data)
 }
 
 /* Submit asynchronous sleep */
-static void async_sleep(unsigned int msec, fpi_ssm *ssm)
+static void
+async_sleep(unsigned int       msec,
+	    fpi_ssm           *ssm,
+	    struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	fpi_timeout *timeout;
 
 	/* Add timeout */
@@ -51,9 +53,10 @@ static void async_sleep(unsigned int msec, fpi_ssm *ssm)
 	}
 }
 
-static int submit_image(fpi_ssm *ssm)
+static int
+submit_image(fpi_ssm           *ssm,
+	     struct fp_img_dev *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	vfs301_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 	int height;
 	struct fp_img *img;
@@ -105,7 +108,7 @@ enum
 /* Exec loop sequential state machine */
 static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	vfs301_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	switch (fpi_ssm_get_cur_state(ssm)) {
@@ -116,7 +119,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_WAIT_PRINT:
 		/* Wait fingerprint scanning */
-		async_sleep(200, ssm);
+		async_sleep(200, ssm, dev);
 		break;
 
 	case M_CHECK_PRINT:
@@ -134,7 +137,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case M_READ_PRINT_WAIT:
 		/* Wait fingerprint scanning */
-		async_sleep(200, ssm);
+		async_sleep(200, ssm, dev);
 		break;
 
 	case M_READ_PRINT_POLL:
@@ -149,7 +152,7 @@ static void m_loop_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		break;
 
 	case M_SUBMIT_PRINT:
-		if (submit_image(ssm)) {
+		if (submit_image(ssm, dev)) {
 			fpi_ssm_mark_completed(ssm);
 			/* NOTE: finger off is expected only after submitting image... */
 			fpi_imgdev_report_finger_status(dev, FALSE);
@@ -170,7 +173,7 @@ static void m_loop_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 /* Exec init sequential state machine */
 static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	vfs301_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	g_assert(fpi_ssm_get_cur_state(ssm) == 0);
@@ -183,7 +186,7 @@ static void m_init_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 /* Complete init sequential state machine */
 static void m_init_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	fpi_ssm *ssm_loop;
 
 	if (!fpi_ssm_get_error(ssm)) {
diff --git a/libfprint/drivers/vfs5011.c b/libfprint/drivers/vfs5011.c
index 10a15cc..ba57b41 100644
--- a/libfprint/drivers/vfs5011.c
+++ b/libfprint/drivers/vfs5011.c
@@ -173,7 +173,7 @@ out:
 
 static void usbexchange_loop(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct usbexchange_data *data = fpi_ssm_get_user_data(ssm);
+	struct usbexchange_data *data = user_data;
 	if (fpi_ssm_get_cur_state(ssm) >= data->stepcount) {
 		fp_err("Bug detected: state %d out of range, only %d steps",
 				fpi_ssm_get_cur_state(ssm), data->stepcount);
@@ -395,9 +395,11 @@ static int process_chunk(struct vfs5011_data *data, int transferred)
 	return 0;
 }
 
-void submit_image(fpi_ssm *ssm, struct vfs5011_data *data)
+static void
+submit_image(fpi_ssm             *ssm,
+	     struct vfs5011_data *data,
+	     struct fp_img_dev   *dev)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
 	struct fp_img *img;
 
 	if (data->lines_recorded == 0) {
@@ -669,7 +671,7 @@ static void activate_loop(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
 	enum {READ_TIMEOUT = 0};
 
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs5011_data *data;
 	int r;
 	fpi_timeout *timeout;
@@ -744,7 +746,7 @@ static void activate_loop(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 static void activate_loop_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs5011_data *data;
 	int r = fpi_ssm_get_error(ssm);
 
@@ -755,7 +757,7 @@ static void activate_loop_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user
 		g_free(data->init_sequence.receive_buf);
 	data->init_sequence.receive_buf = NULL;
 	if (!data->deactivating && !r) {
-		submit_image(ssm, data);
+		submit_image(ssm, data, dev);
 		fpi_imgdev_report_finger_status(dev, FALSE);
 	}
 	fpi_ssm_free(ssm);
@@ -774,7 +776,7 @@ static void activate_loop_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user
 
 static void open_loop(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs5011_data *data;
 
 	data = FP_INSTANCE_DATA(FP_DEV(dev));
@@ -795,7 +797,7 @@ static void open_loop(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 static void open_loop_complete(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 {
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
+	struct fp_img_dev *dev = user_data;
 	struct vfs5011_data *data;
 
 	data = FP_INSTANCE_DATA(FP_DEV(dev));