diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 1a63b0a9279a..31f6c364f60f 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -59,7 +59,7 @@ static int sg_version_num = 30901;	/* 2 digits for each component */
 
 #ifdef CONFIG_SCSI_PROC_FS
 #include <linux/proc_fs.h>
-static char *sg_version_date = "20181019";
+static char *sg_version_date = "20181020";
 
 static int sg_proc_init(void);
 #endif
@@ -95,6 +95,10 @@ enum sg_rq_state {
 #define SG_DEF_TIME_UNIT SG_TIME_UNIT_MS
 #define SG_DEFAULT_TIMEOUT mult_frac(SG_DEFAULT_TIMEOUT_USER, HZ, USER_HZ)
 
+#define SG_FD_Q_AT_TAIL true
+#define SG_FD_Q_AT_HEAD false
+#define SG_DEFAULT_Q_AT SG_FD_Q_AT_HEAD	/* for backward compatibility */
+
 int sg_big_buff = SG_DEF_RESERVED_SIZE;
 /* N.B. This variable is readable and writeable via
    /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
@@ -187,6 +191,7 @@ struct sg_fd {		/* holds the state of a file descriptor */
 	bool keep_orphan;/* false -> drop (def), true -> keep for read() */
 	bool mmap_called;	/* false -> mmap() never called on this fd */
 	bool time_in_ns;	/* report times in nanoseconds */
+	bool q_at_tail;		/* queue at tail if true, head when false */
 	u8 next_cmd_len;	/* 0: automatic, >0: use on next write() */
 	struct sg_request *reserve_srp;	/* allocate on open(), starts on fl */
 	struct fasync_struct *async_qp;	/* used by asynchronous notification */
@@ -896,9 +901,13 @@ sg_common_write(struct sg_fd *sfp, const struct sg_io_hdr *hi_p,
 		srp->start_ts = ktime_get_with_offset(TK_OFFS_BOOT);
 	else
 		hp->duration = jiffies_to_msecs(jiffies);
-	/* at tail if v3 or later interface and tail flag set */
-	at_head = !(hp->interface_id != '\0' &&
-		    (SG_FLAG_Q_AT_TAIL & hp->flags));
+
+	if (hp->interface_id == '\0')	/* v1 and v2 interface */
+		at_head = true;		/* backward compatibility */
+	else if (sfp->q_at_tail)  /* cmd flags can override sfd setting */
+		at_head = (SG_FLAG_Q_AT_HEAD & hp->flags);
+	else		/* this sfd is defaulting to head */
+		at_head = !(SG_FLAG_Q_AT_TAIL & hp->flags);
 
 	srp->rq->timeout = timeout;
 	kref_get(&sfp->f_ref); /* sg_rq_end_io() does kref_put(). */
@@ -1176,11 +1185,12 @@ static int
 sg_set_get_extended(struct sg_fd *sfp, void __user *p)
 {
 	int result = 0;
-	u32 uv;
+	unsigned long iflags;
+	u32 uv, or_masks;
 	struct sg_device *sdp = sfp->parentdp;
 	struct sg_extended_info *seip;
+	struct sg_request *srp;
 	struct sg_extended_info sei;
-	u32 or_masks;
 
 	seip = &sei;
 	if (!access_ok(VERIFY_READ, p, SZ_SG_EXTENDED_INFO))
@@ -1194,8 +1204,10 @@ sg_set_get_extended(struct sg_fd *sfp, void __user *p)
 	}
 	SG_LOG(3, sdp, "%s: wr_mask=0x%x rd_mask=0x%x\n", __func__,
 	       seip->valid_wr_mask, seip->valid_rd_mask);
+	/* reserved_sz (u32), read-write */
 	if (or_masks & SG_SEIM_RESERVED_SIZE)
 		result = sg_reserved_sz(sfp, seip);
+	/* rq_rem_sgat_threshold (u32), read-write [impacts re-use only] */
 	if (or_masks & SG_SEIM_RQ_REM_THRESH) {
 		if (seip->valid_wr_mask & SG_SEIM_RQ_REM_THRESH) {
 			uv = seip->rq_rem_sgat_thresh;
@@ -1206,6 +1218,7 @@ sg_set_get_extended(struct sg_fd *sfp, void __user *p)
 		if (seip->valid_rd_mask & SG_SEIM_RQ_REM_THRESH)
 			seip->rq_rem_sgat_thresh = sfp->rem_sgat_thresh;
 	}
+	/* tot_fd_thresh (u32), read-write [sum of active cmd dlen_s] */
 	if (or_masks & SG_SEIM_TOT_FD_THRESH) {
 		if (seip->valid_wr_mask & SG_SEIM_TOT_FD_THRESH) {
 			uv = seip->tot_fd_thresh;
@@ -1216,8 +1229,9 @@ sg_set_get_extended(struct sg_fd *sfp, void __user *p)
 		if (seip->valid_rd_mask & SG_SEIM_TOT_FD_THRESH)
 			seip->tot_fd_thresh = sfp->tot_fd_thresh;
 	}
+	/* check all boolean flags if either wr or rd mask set in or_mask */
 	if (or_masks & SG_SEIM_CTL_FLAGS) {
-		/* don't care whether wr or rd mask set in or_mask */
+		/* TIME_IN_NS boolean, read-write */
 		if (seip->ctl_flags_wr_mask & SG_CTL_FLAGM_TIME_IN_NS)
 			sfp->time_in_ns =
 				!!(seip->ctl_flags & SG_CTL_FLAGM_TIME_IN_NS);
@@ -1227,19 +1241,32 @@ sg_set_get_extended(struct sg_fd *sfp, void __user *p)
 			else
 				seip->ctl_flags &= ~SG_CTL_FLAGM_TIME_IN_NS;
 		}
+		/* ORPHANS boolean, read-only */
 		if (seip->ctl_flags_rd_mask & SG_CTL_FLAGM_ORPHANS) {
 			if (sg_any_persistent_orphans(sfp))
 				seip->ctl_flags |= SG_CTL_FLAGM_ORPHANS;
 			else
 				seip->ctl_flags &= ~SG_CTL_FLAGM_ORPHANS;
 		}
+		/* OTHER_OPENS boolean, read-only */
 		if (seip->ctl_flags_rd_mask & SG_CTL_FLAGM_OTHER_OPENS) {
 			if (sdp->open_cnt > 1)
 				seip->ctl_flags |= SG_CTL_FLAGM_OTHER_OPENS;
 			else
 				seip->ctl_flags &= ~SG_CTL_FLAGM_OTHER_OPENS;
 		}
+		/* Q_TAIL boolean, read-write */
+		if (seip->ctl_flags_wr_mask & SG_CTL_FLAGM_Q_TAIL)
+			sfp->q_at_tail =
+				!!(seip->ctl_flags & SG_CTL_FLAGM_Q_TAIL);
+		if (seip->ctl_flags_rd_mask & SG_CTL_FLAGM_Q_TAIL) {
+			if (sfp->q_at_tail)
+				seip->ctl_flags |= SG_CTL_FLAGM_Q_TAIL;
+			else
+				seip->ctl_flags &= ~SG_CTL_FLAGM_Q_TAIL;
+		}
 	}
+	/* minor_index u32, read-only */
 	if (or_masks & SG_SEIM_MINOR_INDEX) {
 		if (seip->valid_wr_mask & SG_SEIM_MINOR_INDEX)
 			SG_LOG(2, sdp, "%s: writing to minor_index ignored\n",
@@ -1247,7 +1274,36 @@ sg_set_get_extended(struct sg_fd *sfp, void __user *p)
 		if (seip->valid_rd_mask & SG_SEIM_MINOR_INDEX)
 			seip->minor_index = sdp->index;
 	}
-	/* send object back to user space if any read mask set */
+	if ((seip->valid_rd_mask & SG_SEIM_READ_VAL) &&
+	    (seip->valid_wr_mask & SG_SEIM_READ_VAL)) {
+		switch (seip->read_value) {
+		case SG_SEIRV_INT_MASK:
+			seip->read_value = SG_SEIM_ALL_BITS;
+			break;
+		case SG_SEIRV_BOOL_MASK:
+			seip->read_value = SG_CTL_FLAGM_ALL_BITS;
+			break;
+		case SG_SEIRV_VERS_NUM:
+			seip->read_value = sg_version_num;
+			break;
+		case SG_SEIRV_FL_RQS:
+			uv = 0;
+			read_lock_irqsave(&sfp->rq_list_lock, iflags);
+			list_for_each_entry(srp, &sfp->rq_free_list,
+					    free_entry)
+				++uv;
+			read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+			seip->read_value = uv;
+			break;
+		default:
+			SG_LOG(6, sdp, "%s: can decode %d --> ::read_value\n",
+			       __func__, seip->read_value);
+			seip->read_value = 0;
+			break;
+		}
+	}
+
+	/* finally send object back to user space if any read mask set */
 	if (seip->valid_rd_mask || seip->ctl_flags_rd_mask) {
 		if (access_ok(VERIFY_WRITE, p, SZ_SG_EXTENDED_INFO))
 			result = __copy_to_user(p, seip, SZ_SG_EXTENDED_INFO);
@@ -2816,6 +2872,7 @@ sg_add_sfp(struct sg_device *sdp)
 	sfp->tot_fd_thresh = SG_TOT_FD_THRESHOLD;
 	atomic_set(&sfp->sum_fd_dlens, 0);
 	sfp->time_in_ns = !!SG_DEF_TIME_UNIT;
+	sfp->q_at_tail = SG_DEFAULT_Q_AT;
 	sfp->parentdp = sdp;
 	if (atomic_read(&sdp->detaching)) {
 		kfree(sfp);
diff --git a/include/scsi/sg.h b/include/scsi/sg.h
index 596f68746f66..46fc7cbffd78 100644
--- a/include/scsi/sg.h
+++ b/include/scsi/sg.h
@@ -4,41 +4,21 @@
 
 #include <linux/compiler.h>
 
-/*
- * History:
- *  Started: Aug 9 by Lawrence Foard (entropy@world.std.com), to allow user
- *  process control of SCSI devices.
- *  Development Sponsored by Killy Corp. NY NY
- *
- * Original driver (sg.h):
- *   Copyright (C) 1992 Lawrence Foard
- * Version 2 and 3 extensions to driver:
- *   Copyright (C) 1998 - 2018 Douglas Gilbert
- *
- *  Version: 3.9.01 (20181016)
- *  This version is for 2.6, 3 and 4 series kernels.
- *
- * Documentation
- * =============
- * A web site for the SG device driver can be found at:
- *   http://sg.danny.cz/sg  [alternatively check the MAINTAINERS file]
- * The documentation for the sg version 3 driver can be found at:
- *   http://sg.danny.cz/sg/p/sg_v3_ho.html
- * Also see: <kernel_source>/Documentation/scsi/scsi-generic.txt
- *
- * For utility and test programs see: http://sg.danny.cz/sg/sg3_utils.html
- */
-
 #ifdef __KERNEL__
 extern int sg_big_buff; /* for sysctl */
 #endif
 
+/*
+ * In version 3.9.01 of the sg driver, this file was spilt in two, with the
+ * bulk of the user space interface being placed in the file being included
+ * in the following line.
+ */
 #include <uapi/scsi/sg.h>
 
 #ifdef __KERNEL__
 #define SG_DEFAULT_TIMEOUT_USER (60*USER_HZ) /* HZ == 'jiffies in 1 second' */
 #endif
 
-#undef SG_DEFAULT_TIMEOUT	/* cause define in sg.c */
+#undef SG_DEFAULT_TIMEOUT	/* because of conflicting define in sg.c */
 
 #endif	/* end of ifndef _SCSI_GENERIC_H guard */
diff --git a/include/uapi/scsi/sg.h b/include/uapi/scsi/sg.h
index 0bc652402bd9..c0ee00573921 100644
--- a/include/uapi/scsi/sg.h
+++ b/include/uapi/scsi/sg.h
@@ -2,27 +2,6 @@
 #ifndef _UAPI_SCSI_SG_H
 #define _UAPI_SCSI_SG_H
 
-/*
- * Want to block the original sg.h header from also being included. That
- * causes lots of multiple definition errors. This will only work if this
- * header is included _before_ the original sg.h header .
- */
-#define _SCSI_GENERIC_H		/* original kernel header guard */
-#define _SCSI_SG_H		/* glibc header guard */
-
-/*
- * Other UAPI headers include linux/compiler.h to resolve "__" types but that
- * doesn't always work, perhaps in the future. Fall back to linux/types.h .
- */
-/* #include <linux/compiler.h> */
-#include <linux/types.h>
-#include <linux/major.h>
-
-/* Still problems with __user so define to nothing */
-#define __user
-
-#include <linux/bsg.h>
-
 /*
  * History:
  *  Started: Aug 9 by Lawrence Foard (entropy@world.std.com), to allow user
@@ -48,6 +27,11 @@
  * For utility and test programs see: http://sg.danny.cz/sg/sg3_utils.html
  */
 
+#include <linux/types.h>
+#include <linux/major.h>
+
+/* bsg.h contains the sg v4 use space interface structure. */
+#include <linux/bsg.h>
 
 /*
  * Same structure as used by readv() call. It defines one scatter-gather
@@ -109,7 +93,7 @@ typedef struct sg_io_hdr {
 #define SG_FLAG_MMAP_IO 4	/* request memory mapped IO */
 /* no transfer of kernel buffers to/from user space; to debug indirect IO */
 #define SG_FLAG_NO_DXFER 0x10000
-/* defaults: for sg driver: Q_AT_HEAD; for block layer: Q_AT_TAIL */
+/* defaults: for sg driver (v3): Q_AT_HEAD; for block layer: Q_AT_TAIL */
 #define SG_FLAG_Q_AT_TAIL 0x10
 #define SG_FLAG_Q_AT_HEAD 0x20
 
@@ -186,12 +170,21 @@ typedef struct sg_req_info {	/* used by SG_GET_REQUEST_TABLE ioctl() */
 #define SG_SEIM_TOT_FD_THRESH	0x4	/* tot_fd_thresh field valid */
 #define SG_SEIM_CTL_FLAGS	0x8	/* ctl_flags_mask bits in ctl_flags */
 #define SG_SEIM_MINOR_INDEX	0x10	/* sg device minor index number */
-#define SG_SEIM_ALL_BITS	0x1f	/* should be OR of previous items */
+#define SG_SEIM_READ_VAL	0x20	/* write SG_SEIRV, read related */
+#define SG_SEIM_ALL_BITS	0x3f	/* should be OR of previous items */
 
 #define SG_CTL_FLAGM_TIME_IN_NS	0x1	/* time: nanosecs (def: millisecs) */
 #define SG_CTL_FLAGM_TAG_FOR_PACK_ID	0x2
 #define SG_CTL_FLAGM_OTHER_OPENS	0x4 /* rd: other sg fd_s on this dev */
 #define SG_CTL_FLAGM_ORPHANS	0x8	/* rd: orphaned requests on this fd */
+#define SG_CTL_FLAGM_Q_TAIL	0x10	/* used for future cmds on this fd */
+#define SG_CTL_FLAGM_ALL_BITS	0x1f	/* should be OR of previous items */
+
+/* Write one of the following values to sg_extended_info::read_value, get... */
+#define SG_SEIRV_INT_MASK	0x0	/* get SG_SEIM_ALL_BITS */
+#define SG_SEIRV_BOOL_MASK	0x1	/* get SG_CTL_FLAGM_ALL_BITS */
+#define SG_SEIRV_VERS_NUM	0x2	/* get driver version number as int */
+#define SG_SEIRV_FL_RQS		0x3	/* number of requests in free list */
 
 /*
  * A pointer to the following structure is passed as the third argument to 
@@ -203,11 +196,11 @@ typedef struct sg_req_info {	/* used by SG_GET_REQUEST_TABLE ioctl() */
  * back to the user space. If the same bit is set in both the *_wr_mask and
  * corresponding *_rd_mask fields, then the write action takes place before
  * the read action and no other operation will split the two. This structure
- * is padded to 64 bytes to allow for new values to be added in the future.
+ * is padded to 96 bytes to allow for new values to be added in the future.
  */
 struct sg_extended_info {
-	__u32	valid_wr_mask;	/* OR-ed SG_SEIM_* values */
-	__u32	valid_rd_mask;	/* OR-ed SG_SEIM_* values */
+	__u32	valid_wr_mask;	/* OR-ed SG_SEIM_* user->driver values */
+	__u32	valid_rd_mask;	/* OR-ed SG_SEIM_* driver->user values */
 	__u32	reserved_sz;	/* data/sgl size of pre-allocated request */
 	__u32	rq_rem_sgat_thresh;/* request re-use: clear data/sgat if > */
 	__u32	tot_fd_thresh;	/* total data/sgat for this fd, 0: no limit */
@@ -215,7 +208,8 @@ struct sg_extended_info {
 	__u32	ctl_flags_rd_mask;	/* OR-ed SG_CTL_FLAGM_* values */
 	__u32	ctl_flags;	/* bit values OR-ed, see SG_CTL_FLAGM_* */
 	__u32	minor_index;	/* rd: kernel's sg device minor number */
-	__u8	pad_to_64[28];	/* pad so struct is 64 bytes long */
+	__u32	read_value;	/* write known value, read back related */
+	__u8	pad_to_96[56];	/* pad so struct is 96 bytes long */
 };
 
 /*
