diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c
index 801922b..cf445ce 100644
--- a/hw/scsi-bus.c
+++ b/hw/scsi-bus.c
@@ -111,3 +111,34 @@ void scsi_bus_legacy_handle_cmdline(SCSIBus *bus)
         scsi_bus_legacy_add_drive(bus, dinfo, unit);
     }
 }
+
+SCSIRequest *scsi_req_alloc(size_t size, SCSIDevice *d, uint32_t tag, uint32_t lun)
+{
+    SCSIRequest *req;
+
+    req = qemu_mallocz(size);
+    req->bus = scsi_bus_from_device(d);
+    req->dev = d;
+    req->tag = tag;
+    req->lun = lun;
+    QTAILQ_INSERT_TAIL(&d->requests, req, next);
+    return req;
+}
+
+SCSIRequest *scsi_req_find(SCSIDevice *d, uint32_t tag)
+{
+    SCSIRequest *req;
+
+    QTAILQ_FOREACH(req, &d->requests, next) {
+        if (req->tag == tag) {
+            return req;
+        }
+    }
+    return NULL;
+}
+
+void scsi_req_free(SCSIRequest *req)
+{
+    QTAILQ_REMOVE(&req->dev->requests, req, next);
+    qemu_free(req);
+}
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 997eef6..c18b7f0 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -71,37 +71,26 @@ struct SCSIDiskState
     QEMUBH *bh;
 };
 
-static SCSIDiskReq *scsi_new_request(SCSIDevice *d, uint32_t tag)
+static SCSIDiskReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
 {
+    SCSIRequest *req;
     SCSIDiskReq *r;
 
-    r = qemu_mallocz(sizeof(SCSIDiskReq));
+    req = scsi_req_alloc(sizeof(SCSIDiskReq), d, tag, lun);
+    r = DO_UPCAST(SCSIDiskReq, req, req);
     r->iov.iov_base = qemu_memalign(512, SCSI_DMA_BUF_SIZE);
-    r->req.bus = scsi_bus_from_device(d);
-    r->req.dev = d;
-    r->req.tag = tag;
-
-    QTAILQ_INSERT_TAIL(&d->requests, &r->req, next);
     return r;
 }
 
 static void scsi_remove_request(SCSIDiskReq *r)
 {
     qemu_free(r->iov.iov_base);
-    QTAILQ_REMOVE(&r->req.dev->requests, &r->req, next);
-    qemu_free(r);
+    scsi_req_free(&r->req);
 }
 
 static SCSIDiskReq *scsi_find_request(SCSIDiskState *s, uint32_t tag)
 {
-    SCSIRequest *req;
-
-    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
-        if (req->tag == tag) {
-            return DO_UPCAST(SCSIDiskReq, req, req);
-        }
-    }
-    return NULL;
+    return DO_UPCAST(SCSIDiskReq, req, scsi_req_find(&s->qdev, tag));
 }
 
 /* Helper function for command completion.  */
@@ -113,8 +102,8 @@ static void scsi_command_complete(SCSIDiskReq *r, int status, int sense)
             r->req.tag, status, sense);
     s->sense = sense;
     tag = r->req.tag;
-    scsi_remove_request(r);
     r->req.bus->complete(r->req.bus, SCSI_REASON_DONE, tag, status);
+    scsi_remove_request(r);
 }
 
 /* Cancel a pending data transfer.  */
@@ -349,7 +338,7 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
     }
     /* ??? Tags are not unique for different luns.  We only implement a
        single lun, so this should not matter.  */
-    r = scsi_new_request(d, tag);
+    r = scsi_new_request(d, tag, lun);
     outbuf = (uint8_t *)r->iov.iov_base;
     is_write = 0;
     DPRINTF("Command: lun=%d tag=0x%x data=0x%02x", lun, tag, buf[0]);
diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c
index 1fa9d33..f63d83d 100644
--- a/hw/scsi-generic.c
+++ b/hw/scsi-generic.c
@@ -76,36 +76,23 @@ struct SCSIGenericState
     uint8_t senselen;
 };
 
-static SCSIGenericReq *scsi_new_request(SCSIDevice *d, uint32_t tag)
+static SCSIGenericReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
 {
-    SCSIGenericReq *r;
-
-    r = qemu_mallocz(sizeof(SCSIGenericReq));
-    r->req.bus = scsi_bus_from_device(d);
-    r->req.dev = d;
-    r->req.tag = tag;
+    SCSIRequest *req;
 
-    QTAILQ_INSERT_TAIL(&d->requests, &r->req, next);
-    return r;
+    req = scsi_req_alloc(sizeof(SCSIGenericReq), d, tag, lun);
+    return DO_UPCAST(SCSIGenericReq, req, req);
 }
 
 static void scsi_remove_request(SCSIGenericReq *r)
 {
     qemu_free(r->buf);
-    QTAILQ_REMOVE(&r->req.dev->requests, &r->req, next);
-    qemu_free(r);
+    scsi_req_free(&r->req);
 }
 
 static SCSIGenericReq *scsi_find_request(SCSIGenericState *s, uint32_t tag)
 {
-    SCSIRequest *req;
-
-    QTAILQ_FOREACH(req, &s->qdev.requests, next) {
-        if (req->tag == tag) {
-            return DO_UPCAST(SCSIGenericReq, req, req);
-        }
-    }
-    return NULL;
+    return DO_UPCAST(SCSIGenericReq, req, scsi_req_find(&s->qdev, tag));
 }
 
 /* Helper function for command completion.  */
@@ -136,8 +123,8 @@ static void scsi_command_complete(void *opaque, int ret)
     DPRINTF("Command complete 0x%p tag=0x%x status=%d\n",
             r, r->req.tag, status);
     tag = r->req.tag;
-    scsi_remove_request(r);
     r->req.bus->complete(r->req.bus, SCSI_REASON_DONE, tag, status);
+    scsi_remove_request(r);
 }
 
 /* Cancel a pending data transfer.  */
@@ -520,7 +507,7 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
         BADF("Tag 0x%x already in use %p\n", tag, r);
         scsi_cancel_io(d, tag);
     }
-    r = scsi_new_request(d, tag);
+    r = scsi_new_request(d, tag, lun);
 
     memcpy(r->cmd, cmd, cmdlen);
     r->cmdlen = cmdlen;
diff --git a/hw/scsi.h b/hw/scsi.h
index a9b846c..ceeb26a 100644
--- a/hw/scsi.h
+++ b/hw/scsi.h
@@ -20,6 +20,7 @@ typedef struct SCSIRequest {
     SCSIBus           *bus;
     SCSIDevice        *dev;
     uint32_t          tag;
+    uint32_t          lun;
     BlockDriverAIOCB  *aiocb;
     QTAILQ_ENTRY(SCSIRequest) next;
 } SCSIRequest;
@@ -74,4 +75,8 @@ static inline SCSIBus *scsi_bus_from_device(SCSIDevice *d)
 SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, DriveInfo *dinfo, int unit);
 void scsi_bus_legacy_handle_cmdline(SCSIBus *bus);
 
+SCSIRequest *scsi_req_alloc(size_t size, SCSIDevice *d, uint32_t tag, uint32_t lun);
+SCSIRequest *scsi_req_find(SCSIDevice *d, uint32_t tag);
+void scsi_req_free(SCSIRequest *req);
+
 #endif
