diff --git a/libfprint/drivers/elan.c b/libfprint/drivers/elan.c
index 2e00259..699f4cf 100644
--- a/libfprint/drivers/elan.c
+++ b/libfprint/drivers/elan.c
@@ -583,7 +583,9 @@ static void elan_capture(struct fp_img_dev *dev)
 	fpi_ssm_start(ssm, capture_complete);
 }
 
-static void fpi_ssm_next_state_async(void *data)
+static void
+fpi_ssm_next_state_async(struct fp_dev *dev,
+			 void          *data)
 {
 	fpi_ssm_next_state((fpi_ssm *)data);
 }
@@ -678,7 +680,7 @@ static void calibrate_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_da
 			if (elandev->calib_status == 0x00
 			    && elandev->last_read[0] == 0x01)
 				elandev->calib_status = 0x01;
-			if (!fpi_timeout_add(50, fpi_ssm_next_state_async, ssm))
+			if (!fpi_timeout_add(50, fpi_ssm_next_state_async, _dev, ssm))
 				fpi_ssm_mark_failed(ssm, -ETIME);
 		}
 		break;
@@ -884,9 +886,11 @@ static void elan_change_state(struct fp_img_dev *dev)
 	elandev->dev_state = next_state;
 }
 
-static void elan_change_state_async(void *data)
+static void
+elan_change_state_async(struct fp_dev *dev,
+			void          *data)
 {
-	elan_change_state((struct fp_img_dev *)data);
+	elan_change_state(FP_IMG_DEV (dev));
 }
 
 static int dev_change_state(struct fp_img_dev *dev, enum fp_imgdev_state state)
@@ -902,7 +906,7 @@ static int dev_change_state(struct fp_img_dev *dev, enum fp_imgdev_state state)
 		/* schedule state change instead of calling it directly to allow all actions
 		 * related to the previous state to complete */
 		elandev->dev_state_next = state;
-		if (!fpi_timeout_add(10, elan_change_state_async, dev)) {
+		if (!fpi_timeout_add(10, elan_change_state_async, FP_DEV(dev), NULL)) {
 			fpi_imgdev_session_error(dev, -ETIME);
 			return -ETIME;
 		}
diff --git a/libfprint/drivers/uru4000.c b/libfprint/drivers/uru4000.c
index b2e80e8..58455c0 100644
--- a/libfprint/drivers/uru4000.c
+++ b/libfprint/drivers/uru4000.c
@@ -876,11 +876,12 @@ enum rebootpwr_states {
 	REBOOTPWR_NUM_STATES,
 };
 
-static void rebootpwr_pause_cb(void *data)
+static void
+rebootpwr_pause_cb(struct fp_dev *dev,
+		   void          *data)
 {
 	fpi_ssm *ssm = data;
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
-	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
+	struct uru4k_dev *urudev = FP_INSTANCE_DATA(dev);
 
 	if (!--urudev->rebootpwr_ctr) {
 		fp_err("could not reboot device power");
@@ -911,7 +912,7 @@ static void rebootpwr_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_da
 			fpi_ssm_next_state(ssm);
 		break;
 	case REBOOTPWR_PAUSE:
-		if (fpi_timeout_add(10, rebootpwr_pause_cb, ssm) == NULL)
+		if (fpi_timeout_add(10, rebootpwr_pause_cb, _dev, ssm) == NULL)
 			fpi_ssm_mark_failed(ssm, -ETIME);
 		break;
 	}
@@ -953,11 +954,12 @@ enum powerup_states {
 	POWERUP_NUM_STATES,
 };
 
-static void powerup_pause_cb(void *data)
+static void
+powerup_pause_cb(struct fp_dev *dev,
+		 void          *data)
 {
 	fpi_ssm *ssm = data;
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
-	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
+	struct uru4k_dev *urudev = FP_INSTANCE_DATA(dev);
 
 	if (!--urudev->powerup_ctr) {
 		fp_err("could not power device up");
@@ -994,7 +996,7 @@ static void powerup_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data
 			fpi_ssm_next_state(ssm);
 		break;
 	case POWERUP_PAUSE:
-		if (fpi_timeout_add(10, powerup_pause_cb, ssm) == NULL)
+		if (fpi_timeout_add(10, powerup_pause_cb, _dev, ssm) == NULL)
 			fpi_ssm_mark_failed(ssm, -ETIME);
 		break;
 	case POWERUP_CHALLENGE_RESPONSE:
@@ -1056,11 +1058,12 @@ static void init_scanpwr_irq_cb(struct fp_img_dev *dev, int status,
 	}
 }
 
-static void init_scanpwr_timeout(void *user_data)
+static void
+init_scanpwr_timeout(struct fp_dev *dev,
+		     void          *user_data)
 {
 	fpi_ssm *ssm = user_data;
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
-	struct uru4k_dev *urudev = FP_INSTANCE_DATA(FP_DEV(dev));
+	struct uru4k_dev *urudev = FP_INSTANCE_DATA(dev);
 
 	fp_warn("powerup timed out");
 	urudev->irq_cb = NULL;
@@ -1123,7 +1126,8 @@ static void init_run_state(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		 * so we include this timeout loop to retry the whole process 3 times
 		 * if we don't get an irq any time soon. */
 		urudev->scanpwr_irq_timeout = fpi_timeout_add(300,
-			init_scanpwr_timeout, ssm);
+							      init_scanpwr_timeout,
+							      _dev, ssm);
 		if (!urudev->scanpwr_irq_timeout) {
 			fpi_ssm_mark_failed(ssm, -ETIME);
 			break;
diff --git a/libfprint/drivers/vfs0050.c b/libfprint/drivers/vfs0050.c
index e805ccc..c3e17bc 100644
--- a/libfprint/drivers/vfs0050.c
+++ b/libfprint/drivers/vfs0050.c
@@ -499,11 +499,12 @@ static void receive_callback(struct libusb_transfer *transfer)
 }
 
 /* Stub to keep SSM alive when waiting an interrupt */
-static void wait_interrupt(void *data)
+static void
+wait_interrupt(struct fp_dev *dev,
+	       void          *data)
 {
 	fpi_ssm *ssm = data;
-	struct fp_img_dev *idev = fpi_ssm_get_user_data(ssm);
-	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(FP_DEV(idev));
+	struct vfs_dev_t *vdev = FP_INSTANCE_DATA(dev);
 
 	/* Keep sleeping while this flag is on */
 	if (vdev->wait_interrupt)
@@ -511,14 +512,18 @@ static void wait_interrupt(void *data)
 }
 
 /* SSM stub to prepare device to another scan after orange light was on */
-static void another_scan(void *data)
+static void
+another_scan(struct fp_dev *dev,
+	     void          *data)
 {
 	fpi_ssm *ssm = data;
 	fpi_ssm_jump_to_state(ssm, SSM_TURN_ON);
 }
 
 /* Another SSM stub to continue after waiting for probable vdev->active changes */
-static void scan_completed(void *data)
+static void
+scan_completed(struct fp_dev *dev,
+	       void          *data)
 {
 	fpi_ssm *ssm = data;
 	fpi_ssm_next_state(ssm);
@@ -608,7 +613,7 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		}
 
 		if (vdev->wait_interrupt)
-			fpi_timeout_add(VFS_SSM_TIMEOUT, wait_interrupt, ssm);
+			fpi_timeout_add(VFS_SSM_TIMEOUT, wait_interrupt, _dev, ssm);
 		break;
 
 	case SSM_RECEIVE_FINGER:
@@ -647,7 +652,7 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		clear_data(vdev);
 
 		/* Wait for probable vdev->active changing */
-		fpi_timeout_add(VFS_SSM_TIMEOUT, scan_completed, ssm);
+		fpi_timeout_add(VFS_SSM_TIMEOUT, scan_completed, _dev, ssm);
 		break;
 
 	case SSM_NEXT_RECEIVE:
@@ -665,7 +670,7 @@ static void activate_ssm(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 
 	case SSM_WAIT_ANOTHER_SCAN:
 		/* Orange light is on now */
-		fpi_timeout_add(VFS_SSM_ORANGE_TIMEOUT, another_scan, ssm);
+		fpi_timeout_add(VFS_SSM_ORANGE_TIMEOUT, another_scan, _dev, ssm);
 		break;
 
 	default:
diff --git a/libfprint/drivers/vfs101.c b/libfprint/drivers/vfs101.c
index 1d39d33..6f7d7f0 100644
--- a/libfprint/drivers/vfs101.c
+++ b/libfprint/drivers/vfs101.c
@@ -471,11 +471,12 @@ async_load(fpi_ssm           *ssm,
 }
 
 /* Callback of asynchronous sleep */
-static void async_sleep_cb(void *data)
+static void
+async_sleep_cb(struct fp_dev *dev,
+	       void          *data)
 {
 	fpi_ssm *ssm = data;
-	struct fp_img_dev *dev = fpi_ssm_get_user_data(ssm);
-	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
+	struct vfs101_dev *vdev = FP_INSTANCE_DATA(dev);
 
 	/* Cleanup timeout */
 	vdev->timeout = NULL;
@@ -492,7 +493,7 @@ async_sleep(unsigned int       msec,
 	struct vfs101_dev *vdev = FP_INSTANCE_DATA(FP_DEV(dev));
 
 	/* Add timeout */
-	vdev->timeout = fpi_timeout_add(msec, async_sleep_cb, ssm);
+	vdev->timeout = fpi_timeout_add(msec, async_sleep_cb, FP_DEV(dev), ssm);
 
 	if (vdev->timeout == NULL)
 	{
diff --git a/libfprint/drivers/vfs301.c b/libfprint/drivers/vfs301.c
index 5f469c3..a7854f4 100644
--- a/libfprint/drivers/vfs301.c
+++ b/libfprint/drivers/vfs301.c
@@ -27,7 +27,9 @@
 /************************** GENERIC STUFF *************************************/
 
 /* Callback of asynchronous sleep */
-static void async_sleep_cb(void *data)
+static void
+async_sleep_cb(struct fp_dev *dev,
+	       void          *data)
 {
 	fpi_ssm *ssm = data;
 
@@ -43,7 +45,7 @@ async_sleep(unsigned int       msec,
 	fpi_timeout *timeout;
 
 	/* Add timeout */
-	timeout = fpi_timeout_add(msec, async_sleep_cb, ssm);
+	timeout = fpi_timeout_add(msec, async_sleep_cb, FP_DEV(dev), ssm);
 
 	if (timeout == NULL) {
 		/* Failed to add timeout */
diff --git a/libfprint/drivers/vfs5011.c b/libfprint/drivers/vfs5011.c
index ea183a8..11766dc 100644
--- a/libfprint/drivers/vfs5011.c
+++ b/libfprint/drivers/vfs5011.c
@@ -472,7 +472,9 @@ static int capture_chunk_async(struct vfs5011_data *data,
 	return libusb_submit_transfer(data->flying_transfer);
 }
 
-static void async_sleep_cb(void *data)
+static void
+async_sleep_cb(struct fp_dev *dev,
+	       void          *data)
 {
 	fpi_ssm *ssm = data;
 
@@ -719,7 +721,7 @@ static void activate_loop(fpi_ssm *ssm, struct fp_dev *_dev, void *user_data)
 		break;
 
 	case DEV_ACTIVATE_DATA_COMPLETE:
-		timeout = fpi_timeout_add(1, async_sleep_cb, ssm);
+		timeout = fpi_timeout_add(1, async_sleep_cb, _dev, ssm);
 
 		if (timeout == NULL) {
 			/* Failed to add timeout */
diff --git a/libfprint/fpi-poll.c b/libfprint/fpi-poll.c
index 5c6fc96..ee7d86d 100644
--- a/libfprint/fpi-poll.c
+++ b/libfprint/fpi-poll.c
@@ -84,6 +84,7 @@ static fp_pollfd_removed_cb fd_removed_cb = NULL;
 struct fpi_timeout {
 	struct timeval expiry;
 	fpi_timeout_fn callback;
+	struct fp_dev *dev;
 	void *data;
 };
 
@@ -106,7 +107,8 @@ static int timeout_sort_fn(gconstpointer _a, gconstpointer _b)
  * fpi_timeout_add:
  * @msec: the time before calling the function, in milliseconds (1/1000ths of a second)
  * @callback: function to callback
- * @data: data to pass to @callback
+ * @dev: a struct #fp_dev
+ * @data: data to pass to @callback, or %NULL
  *
  * A timeout is the asynchronous equivalent of sleeping. You create a timeout
  * saying that you'd like to have a function invoked at a certain time in
@@ -118,14 +120,18 @@ static int timeout_sort_fn(gconstpointer _a, gconstpointer _b)
  *
  * Returns: an #fpi_timeout structure
  */
-fpi_timeout *fpi_timeout_add(unsigned int msec, fpi_timeout_fn callback,
-	void *data)
+fpi_timeout *fpi_timeout_add(unsigned int    msec,
+			     fpi_timeout_fn  callback,
+			     struct fp_dev  *dev,
+			     void           *data)
 {
 	struct timespec ts;
 	struct timeval add_msec;
 	fpi_timeout *timeout;
 	int r;
 
+	g_return_val_if_fail (dev != NULL, NULL);
+
 	fp_dbg("in %dms", msec);
 
 	r = clock_gettime(CLOCK_MONOTONIC, &ts);
@@ -136,6 +142,7 @@ fpi_timeout *fpi_timeout_add(unsigned int msec, fpi_timeout_fn callback,
 
 	timeout = g_malloc(sizeof(*timeout));
 	timeout->callback = callback;
+	timeout->dev = dev;
 	timeout->data = data;
 	TIMESPEC_TO_TIMEVAL(&timeout->expiry, &ts);
 
@@ -207,7 +214,7 @@ static int get_next_timeout_expiry(struct timeval *out,
 static void handle_timeout(struct fpi_timeout *timeout)
 {
 	G_DEBUG_HERE();
-	timeout->callback(timeout->data);
+	timeout->callback(timeout->dev, timeout->data);
 	active_timers = g_slist_remove(active_timers, timeout);
 	g_free(timeout);
 }
diff --git a/libfprint/fpi-poll.h b/libfprint/fpi-poll.h
index 34c2520..8077eb0 100644
--- a/libfprint/fpi-poll.h
+++ b/libfprint/fpi-poll.h
@@ -18,13 +18,16 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include "fprint.h"
+
 /**
  * fpi_timeout_fn:
+ * @dev: the struct #fp_dev passed to fpi_timeout_add()
  * @data: the data passed to fpi_timeout_add()
  *
  * The prototype of the callback function for fpi_timeout_add().
  */
-typedef void (*fpi_timeout_fn)(void *data);
+typedef void (*fpi_timeout_fn)(struct fp_dev *dev, void *data);
 
 /**
  * fpi_timeout:
@@ -33,6 +36,8 @@ typedef void (*fpi_timeout_fn)(void *data);
  * fpi_timeout_add().
  */
 typedef struct fpi_timeout fpi_timeout;
-fpi_timeout *fpi_timeout_add(unsigned int msec, fpi_timeout_fn callback,
-	void *data);
+fpi_timeout *fpi_timeout_add(unsigned int    msec,
+			     fpi_timeout_fn  callback,
+			     struct fp_dev  *dev,
+			     void           *data);
 void fpi_timeout_cancel(fpi_timeout *timeout);